@archildata/api-types 0.0.58 → 0.0.60

package/index.d.ts

@@ -1724,9 +1724,9 @@ export interface components {
         /** @description Denied addresses block all traffic to them, and allowed addresses admit all traffic to them regardless of domain rules. Other connections are matched by TLS SNI, or HTTP Host on any port, against domain denies, then domain allows, then the default. When domain rules are present, TCP connections without a hostname are denied; UDP follows the address rules and the default, except that UDP port 443 is denied. Header transforms, forwarding, and drain selectors apply to plaintext HTTP on any port, and to TLS on any port whose handshake offers HTTP through ALPN (or, on port 443, offers no ALPN). */
         SandboxEgressPolicy: {
             default: components["schemas"]["SandboxNetworkAction"];
-            /** @description Allowed IPv4 addresses, CIDR ranges, exact domains, wildcard domains beginning with `*.`, or target objects with optional outbound HTTPS request transformations. A wildcard matches subdomains but not the apex domain, including when applying transformations. */
+            /** @description Allowed IPv4 addresses, CIDR ranges, lowercase domain patterns using * wildcards, or target objects with optional outbound HTTPS request transformations. The first matching domain rule wins, including its transformations and forwarding. Numeric wildcard IP targets such as 10.0.0.* are rejected; use a CIDR range instead. Asterisk matches zero or more characters, including dots; mount.*.archil.com matches mount endpoints across fleets. A leading *. matches subdomains but not the apex domain, including when applying transformations. */
             allow?: (string | components["schemas"]["SandboxEgressRule"])[];
-            /** @description Denied IPv4 addresses, CIDR ranges, exact domains, or wildcard domains beginning with `*.`. A wildcard matches subdomains but not the apex domain. */
+            /** @description Denied IPv4 addresses, CIDR ranges, or lowercase domain patterns using * wildcards. Numeric wildcard IP targets such as 10.0.0.* are rejected; use a CIDR range instead. Asterisk matches zero or more characters, including dots; data.*.archil.com matches data endpoints across fleets. A leading *. matches subdomains but not the apex domain. */
             deny?: string[];
             /** @description Optional hosts whose HTTP(S) requests should finish before pausing, regardless of URL path. Pausing gates new matching requests and waits up to ten minutes by default for active responses, including streams, before taking a snapshot. Errors stop counting, and expiry proceeds with the snapshot. This does not limit requests during normal operation. Selectors do not grant network access. Matching uses the original request host before transformations or forwarding. Policies with domain rules apply selectors on any port; policies with only selectors apply them on TCP ports 80 and 443. Connections may need to be retried after resume. */
             drain_on_pause?: string[];
@@ -1751,11 +1751,12 @@ export interface components {
         /**
          * @description Sandbox network policy. New sandboxes on free plans are managed: their
          *     egress denies everything except Archil's allowlist of package
-         *     registries, Git hosts, OS package mirrors, and model provider APIs.
-         *     Free plans cannot set an egress policy; a create request with one is
-         *     rejected with `sandbox_network_plan_required`, as are policy updates.
-         *     Start/resume and forks retain the stored policy. For paid accounts,
-         *     egress is unrestricted when omitted.
+         *     registries, Git hosts, OS package mirrors, model provider APIs, and
+         *     managed fleet mount/data endpoints (mount.*.archil.com and
+         *     data.*.archil.com). Free plans cannot set an egress policy; a create
+         *     request with one is rejected with `sandbox_network_plan_required`,
+         *     as are policy updates. Start/resume and forks retain the stored policy.
+         *     For paid accounts, egress is unrestricted when omitted.
          */
         SandboxNetwork: {
             egress?: components["schemas"]["SandboxEgressPolicy"];
@@ -1966,7 +1967,7 @@ export interface components {
             vcpu_count: number;
             /** @default 2048 */
             mem_size_mib: number;
-            /** @description Public Linux OCI image reference. Docker shorthand and tags are accepted; the selected platform manifest is pinned at creation. Defaults to `ubuntu:26.04` when neither this nor `image_id` is set. Mutually exclusive with `image_id`. */
+            /** @description Public Linux OCI image reference. Docker shorthand and tags are accepted; the selected platform manifest is pinned at creation. Defaults to `node:24-bookworm` (Debian with Node.js, Python, git, and a C toolchain) when neither this nor `image_id` is set. Mutually exclusive with `image_id`. */
             base_image?: string;
             /** @description An image from the images API, for images that need registry credentials. The sandbox boots the image's current `digest`. Mutually exclusive with `base_image`. */
             image_id?: string;

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@archildata/api-types",
-  "version": "0.0.58",
+  "version": "0.0.60",
   "description": "API types for the Archil control plane",
   "type": "module",
   "types": "index.d.ts",