@archildata/api-types 0.0.51 → 0.0.52

package/index.d.ts

@@ -1206,7 +1206,7 @@ export interface components {
         SandboxState: "pending" | "running" | "pausing" | "paused" | "stopping" | "stopped" | "exited" | "failed" | "deleting" | "deleted";
         /** @enum {string} */
         SandboxNetworkAction: "allow" | "deny";
-        /** @description Deny targets take precedence when an address or domain matches both lists. When domain rules or drain selectors are present, TCP ports 80 and 443 are restricted to HTTP/1.1 or HTTP/2. Plaintext HTTP authority is enforced on port 80, but requests matching a transformation rule are rejected unless the rule also forwards. Port 443 is TLS-terminated; both TLS SNI and HTTP authority are evaluated, and the HTTP authority selects the upstream, any request transformations, and any request forwarding. DNS to the sandbox's configured resolvers is allowed and UDP port 443 is denied. */
+        /** @description Deny targets take precedence when an address or domain matches both lists. When domain rules or drain selectors are present, TCP port 80 is restricted to HTTP/1.1 or HTTP/2 and plaintext HTTP authority is enforced, but requests matching a transformation rule are rejected unless the rule also forwards. Port 443 is relayed without TLS termination. With domain rules, it is evaluated by TLS SNI and connects to an address the runtime resolves for that name, never the address the guest dialed; names need a matching domain rule or default allow, and connections without a hostname SNI are denied. Only rules with header transformations or forwarding, and drain selectors, terminate TLS, which requires clients to trust the sandbox egress CA; for those, both TLS SNI and HTTP authority are evaluated, and the HTTP authority selects the upstream, any request transformations, and any request forwarding. DNS to the sandbox's configured resolvers is allowed and UDP port 443 is denied. */
         SandboxEgressPolicy: {
             default: components["schemas"]["SandboxNetworkAction"];
             /** @description Allowed IPv4 addresses, CIDR ranges, exact domains, wildcard domains beginning with `*.`, or target objects with optional outbound HTTPS request transformations. A wildcard matches subdomains but not the apex domain, including when applying transformations. */

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@archildata/api-types",
-  "version": "0.0.51",
+  "version": "0.0.52",
   "description": "API types for the Archil control plane",
   "type": "module",
   "types": "index.d.ts",