@eryx-org/eryx 0.0.0 → 0.15.0

package/shims/net-fetch.js

@@ -0,0 +1,264 @@
+/**
+ * Browser transport for the eryx:net shims: HTTP(S) over fetch().
+ *
+ * Browsers can't open raw sockets, but TLS is terminated host-side (Python's
+ * ssl module calls tls.upgrade), so everything the guest writes is plaintext
+ * HTTP. We buffer the request bytes, replay them with fetch() on the first
+ * read, and serve the response back as raw HTTP/1.1 bytes.
+ *
+ * Limits: HTTP only, one request per connection (responses always say
+ * `Connection: close`), and CORS applies. Requests always go to the host the
+ * guest connected to, and redirects aren't followed: the guest's HTTP client
+ * sees the 3xx and connects again, through the policy. Browsers hide a
+ * redirect's target, so there a redirect fails instead.
+ */
+
+// windows-1252 maps every byte to one UTF-16 unit, so string offsets of the
+// decoded request are byte offsets into it.
+import { embeddedIPv4, ipv4Bytes, ipv6Bytes } from "./ip.js";
+
+const latin1 = new TextDecoder("latin1");
+const utf8 = new TextEncoder();
+
+const tcpErr = (val) => ({ payload: val });
+// tls-error wraps tcp-level failures in its `tcp` case.
+const tlsErr = (val) => ({ payload: { tag: "tcp", val } });
+
+// Set by the browser (or rejected by fetch) rather than taken from the guest.
+const SKIP_REQUEST_HEADERS = new Set([
+  "host", "connection", "content-length", "transfer-encoding", "keep-alive",
+  "proxy-connection", "upgrade", "te", "trailer", "accept-encoding",
+]);
+// fetch() has already decoded and de-chunked the body; we re-frame it.
+const SKIP_RESPONSE_HEADERS = new Set([
+  "content-encoding", "content-length", "transfer-encoding", "connection", "keep-alive",
+]);
+
+// HTTP/2 and HTTP/3 have no reason phrase, so statusText is usually empty.
+// Python's http.HTTPStatus phrases, for clients that show the reason.
+const REASONS = {
+  100: "Continue", 101: "Switching Protocols", 200: "OK", 201: "Created", 202: "Accepted",
+  203: "Non-Authoritative Information", 204: "No Content", 205: "Reset Content",
+  206: "Partial Content", 207: "Multi-Status", 300: "Multiple Choices", 301: "Moved Permanently",
+  302: "Found", 303: "See Other", 304: "Not Modified", 307: "Temporary Redirect",
+  308: "Permanent Redirect", 400: "Bad Request", 401: "Unauthorized", 402: "Payment Required",
+  403: "Forbidden", 404: "Not Found", 405: "Method Not Allowed", 406: "Not Acceptable",
+  407: "Proxy Authentication Required", 408: "Request Timeout", 409: "Conflict", 410: "Gone",
+  411: "Length Required", 412: "Precondition Failed", 413: "Content Too Large",
+  414: "URI Too Long", 415: "Unsupported Media Type", 416: "Range Not Satisfiable",
+  417: "Expectation Failed", 418: "I'm a Teapot", 421: "Misdirected Request",
+  422: "Unprocessable Content", 423: "Locked", 424: "Failed Dependency", 425: "Too Early",
+  426: "Upgrade Required", 428: "Precondition Required", 429: "Too Many Requests",
+  431: "Request Header Fields Too Large", 451: "Unavailable For Legal Reasons",
+  500: "Internal Server Error", 501: "Not Implemented", 502: "Bad Gateway",
+  503: "Service Unavailable", 504: "Gateway Timeout", 505: "HTTP Version Not Supported",
+  507: "Insufficient Storage", 508: "Loop Detected", 511: "Network Authentication Required",
+};
+
+/**
+ * `(address, family) => allowed` for `blockedNetworks` minus
+ * `allowedNetworks`, matching like the Node transport's BlockList. Throws a
+ * TypeError on an invalid network address.
+ */
+export function networkFilter({ blockedNetworks, allowedNetworks }) {
+  const parse = (cidrs) =>
+    cidrs.map((cidr) => {
+      const [addr, prefix] = cidr.split("/");
+      const bytes = addr.includes(":") ? ipv6Bytes(addr) : ipv4Bytes(addr);
+      if (!bytes) throw new TypeError(`invalid CIDR '${cidr}'`);
+      return { bytes, prefix: Number(prefix) };
+    });
+  const inNet = (b, { bytes, prefix }) => {
+    if (b.length !== bytes.length) return false;
+    for (let bit = 0; bit < prefix; bit++) {
+      const mask = 0x80 >> bit % 8;
+      if ((b[bit >> 3] & mask) !== (bytes[bit >> 3] & mask)) return false;
+    }
+    return true;
+  };
+  const blocked = parse(blockedNetworks);
+  const allowed = parse(allowedNetworks);
+  const matches = (nets, b) => {
+    const v4 = b.length === 16 ? embeddedIPv4(b) : null;
+    return nets.some((n) => inNet(b, n) || (v4 !== null && inNet(v4, n)));
+  };
+  return (address, family) => {
+    const b = family === 6 ? ipv6Bytes(address) : ipv4Bytes(address);
+    return b !== null && (!matches(blocked, b) || matches(allowed, b));
+  };
+}
+
+/** 4 or 6 if `host` is an IP address (in the canonical form net.js passes), else 0. */
+const ipFamily = (host) => (host.includes(":") ? 6 : ipv4Bytes(host) ? 4 : 0);
+
+function open(conns, c) {
+  const h = conns.next++;
+  conns.set(h, c);
+  return h;
+}
+
+function concat(chunks) {
+  const out = new Uint8Array(chunks.reduce((n, c) => n + c.length, 0));
+  let off = 0;
+  for (const c of chunks) {
+    out.set(c, off);
+    off += c.length;
+  }
+  return out;
+}
+
+function parseRequest(buf) {
+  const text = latin1.decode(buf);
+  const headEnd = text.indexOf("\r\n\r\n");
+  const [requestLine, ...lines] = text.slice(0, Math.max(headEnd, 0)).split("\r\n");
+  const m = /^([A-Z]+) (\S+) HTTP\/1\.[01]$/.exec(requestLine);
+  if (headEnd < 0 || !m) {
+    throw { tag: "not-permitted", val: "only HTTP(S) requests are supported in the browser" };
+  }
+  const headers = new Headers();
+  let contentLength = 0;
+  for (const line of lines) {
+    const i = line.indexOf(":");
+    if (i <= 0) continue;
+    const name = line.slice(0, i).trim().toLowerCase();
+    const value = line.slice(i + 1).trim();
+    if (name === "content-length") contentLength = Number(value);
+    if (name === "transfer-encoding" && value.toLowerCase() !== "identity") {
+      throw { tag: "io-error", val: "chunked request bodies are not supported in the browser" };
+    }
+    if (!SKIP_REQUEST_HEADERS.has(name)) headers.append(name, value);
+  }
+  const body = buf.subarray(headEnd + 4, headEnd + 4 + contentLength);
+  if (body.length < contentLength) {
+    throw { tag: "io-error", val: "connection read before the HTTP request body was fully written" };
+  }
+  return { method: m[1], target: m[2], headers, body };
+}
+
+async function send(c, timeoutMs) {
+  const req = parseRequest(concat(c.request));
+  const defaultPort = c.scheme === "https" ? 443 : 80;
+  const host = c.host.includes(":") ? `[${c.host}]` : c.host;
+  const origin = `${c.scheme}://${c.port === defaultPort ? host : `${host}:${c.port}`}`;
+  // The URL always comes from the connection. An absolute-form target (as
+  // sent to a proxy) is only accepted for the connected origin.
+  let path = req.target;
+  if (!path.startsWith("/")) {
+    let target = null;
+    try {
+      target = new URL(path);
+    } catch {}
+    if (target?.origin !== origin) {
+      throw { tag: "not-permitted", val: `request target '${path}' is not on the connected host ${origin}` };
+    }
+    path = target.pathname + target.search;
+  }
+  const url = origin + path;
+
+  let resp;
+  try {
+    resp = await fetch(url, {
+      method: req.method,
+      headers: req.headers,
+      body: req.method === "GET" || req.method === "HEAD" ? undefined : req.body,
+      // Never let sandboxed code ride the embedding page's cookies.
+      credentials: "omit",
+      // Following a redirect would reach hosts the policy never checked.
+      redirect: "manual",
+      signal: timeoutMs ? AbortSignal.any([c.abort.signal, AbortSignal.timeout(timeoutMs)]) : c.abort.signal,
+    });
+  } catch (e) {
+    if (e?.name === "TimeoutError") throw { tag: "timed-out" };
+    throw {
+      tag: "io-error",
+      val: `fetch ${url} failed: ${e?.message ?? e} (in the browser, the server must allow cross-origin requests)`,
+    };
+  }
+
+  if (resp.type === "opaqueredirect") {
+    throw { tag: "io-error", val: `${url} redirected; browsers hide the redirect target, so it can't be followed` };
+  }
+  const body = req.method === "HEAD" ? new Uint8Array(0) : new Uint8Array(await resp.arrayBuffer());
+  let head = `HTTP/1.1 ${resp.status} ${resp.statusText || (REASONS[resp.status] ?? "")}\r\n`;
+  for (const [name, value] of resp.headers) {
+    if (!SKIP_RESPONSE_HEADERS.has(name)) head += `${name}: ${value}\r\n`;
+  }
+  if (req.method !== "HEAD") head += `content-length: ${body.length}\r\n`;
+  head += "connection: close\r\n\r\n";
+  return concat([utf8.encode(head), body]);
+}
+
+function write(conns, h, data, wrapErr) {
+  const c = conns.get(h);
+  if (!c) throw wrapErr({ tag: "invalid-handle" });
+  if (c.response) throw wrapErr({ tag: "io-error", val: "only one HTTP request per connection is supported in the browser" });
+  c.request.push(data.slice());
+  return data.length;
+}
+
+async function read(conns, h, len, timeoutMs, wrapErr) {
+  const c = conns.get(h);
+  if (!c) throw wrapErr({ tag: "invalid-handle" });
+  c.response ??= send(c, timeoutMs);
+  let bytes;
+  try {
+    bytes = await c.response;
+  } catch (e) {
+    throw wrapErr(e);
+  }
+  const out = bytes.subarray(c.offset, c.offset + len);
+  c.offset += out.length;
+  return out;
+}
+
+/** `isAllowed` is a networkFilter() result, or null to skip the address check. */
+function connect(conns, host, port, isAllowed) {
+  // Browsers resolve names themselves, so only IP addresses can be checked.
+  const family = ipFamily(host);
+  if (family && isAllowed && !isAllowed(host, family)) {
+    throw tcpErr({ tag: "not-permitted", val: `host '${host}' resolves to a blocked network` });
+  }
+  const abort = new AbortController();
+  return open(conns, { host, port, scheme: "http", request: [], response: null, offset: 0, abort });
+}
+
+// The SNI hostname is ignored: fetch() verifies the certificate against the
+// URL host, and keeping the connect() host stops an upgrade from retargeting
+// an allowed connection at a host the policy never checked.
+function upgrade(conns, tcpHandle) {
+  const c = conns.get(tcpHandle);
+  if (!c) throw tlsErr({ tag: "invalid-handle" });
+  conns.delete(tcpHandle);
+  return open(conns, { ...c, scheme: "https" });
+}
+
+/**
+ * A transport with its own connection table, so each sandbox instance only
+ * sees (and closes) its own handles.
+ */
+export function createTransport() {
+  const conns = new Map();
+  conns.next = 1;
+  const close = (h) => {
+    conns.get(h)?.abort.abort();
+    conns.delete(h);
+  };
+  return {
+    openConnections: () => conns.size,
+    closeAll() {
+      for (const h of [...conns.keys()]) close(h);
+    },
+    tcp: {
+      connect: async (host, port, _timeoutMs, isAllowed) => connect(conns, host, port, isAllowed),
+      read: (h, len, timeoutMs) => read(conns, h, len, timeoutMs, tcpErr),
+      write: async (h, _timeoutMs, data) => write(conns, h, data, tcpErr),
+      close,
+    },
+    tls: {
+      upgrade: async (h, _hostname, _timeoutMs) => upgrade(conns, h),
+      read: (h, len, timeoutMs) => read(conns, h, len, timeoutMs, tlsErr),
+      write: async (h, _timeoutMs, data) => write(conns, h, data, tlsErr),
+      close,
+    },
+  };
+}

package/shims/net-node.js

@@ -0,0 +1,236 @@
+/**
+ * Node.js transport for the eryx:net shims: real TCP/TLS via node:net and
+ * node:tls. Host policy is checked in net.js; the resolved-address check
+ * happens here, since only the transport sees the address it connects to.
+ */
+
+import { embeddedIPv4, ipv6Bytes } from "./ip.js";
+
+// Received bytes buffered per connection before the socket is paused until
+// the guest reads, so a fast peer can't fill host memory.
+const HIGH_WATER_BYTES = 1 << 20;
+
+const tcpErr = (val) => ({ payload: val });
+// tls-error wraps tcp-level failures in its `tcp` case.
+const tlsErr = (val) => ({ payload: { tag: "tcp", val } });
+
+function track(conns, socket) {
+  const c = { socket, chunks: [], buffered: 0, ended: false, error: null, wake: null };
+  const notify = () => {
+    const w = c.wake;
+    c.wake = null;
+    w?.();
+  };
+  c.onData = (b) => {
+    c.chunks.push(new Uint8Array(b));
+    c.buffered += b.length;
+    if (c.buffered >= HIGH_WATER_BYTES) socket.pause();
+    notify();
+  };
+  c.onEnd = () => { c.ended = true; notify(); };
+  c.onError = (e) => { c.error = e; notify(); };
+  socket.on("data", c.onData).on("end", c.onEnd).on("error", c.onError);
+  const h = conns.next++;
+  conns.set(h, c);
+  return h;
+}
+
+function untrack(conns, h) {
+  const c = conns.get(h);
+  conns.delete(h);
+  if (c) {
+    c.socket.off("data", c.onData).off("end", c.onEnd).off("error", c.onError);
+  }
+  return c;
+}
+
+function mapTcpError(e) {
+  switch (e?.code) {
+    case "ECONNREFUSED": return { tag: "connection-refused" };
+    case "ECONNRESET": return { tag: "connection-reset" };
+    case "ETIMEDOUT": return { tag: "timed-out" };
+    case "ENOTFOUND":
+    case "EAI_AGAIN": return { tag: "host-not-found" };
+    case "EERYX_BLOCKED": return { tag: "not-permitted", val: e.message };
+    default: return { tag: "io-error", val: String(e?.message ?? e) };
+  }
+}
+
+/** Resolves true when `c` has news, or false after `ms`. */
+function wait(c, ms) {
+  return new Promise((resolve) => {
+    const timer = setTimeout(() => { c.wake = null; resolve(false); }, ms);
+    c.wake = () => { clearTimeout(timer); resolve(true); };
+  });
+}
+
+/** Reject with `err` if `promise` hasn't settled after `ms`. */
+function withTimeout(promise, ms, err) {
+  let timer;
+  return Promise.race([
+    promise,
+    new Promise((_, reject) => { timer = setTimeout(() => reject(err), ms); }),
+  ]).finally(() => clearTimeout(timer));
+}
+
+// net.js passes timeouts already clamped to the host's.
+async function read(conns, h, len, timeoutMs, wrapErr) {
+  const c = conns.get(h);
+  if (!c) throw wrapErr({ tag: "invalid-handle" });
+  const deadline = Date.now() + timeoutMs;
+  while (!c.chunks.length && !c.ended && !c.error) {
+    if (!(await wait(c, deadline - Date.now()))) throw wrapErr({ tag: "timed-out" });
+  }
+  if (c.chunks.length) {
+    const chunk = c.chunks.shift();
+    if (chunk.length > len) c.chunks.unshift(chunk.subarray(len));
+    const out = chunk.subarray(0, len);
+    c.buffered -= out.length;
+    if (c.buffered < HIGH_WATER_BYTES) c.socket.resume();
+    return out;
+  }
+  if (c.error) throw wrapErr(mapTcpError(c.error));
+  return new Uint8Array(0);
+}
+
+async function write(conns, h, data, timeoutMs, wrapErr) {
+  const c = conns.get(h);
+  if (!c) throw wrapErr({ tag: "invalid-handle" });
+  const written = new Promise((resolve, reject) =>
+    c.socket.write(data, (e) => (e ? reject(wrapErr(mapTcpError(e))) : resolve())),
+  );
+  await withTimeout(written, timeoutMs, wrapErr({ tag: "timed-out" }));
+  return data.length;
+}
+
+function close(conns, h) {
+  untrack(conns, h)?.socket.destroy();
+}
+
+// Synchronous so net.js can build (and so validate) the filter in setNetConfig.
+const net = await import(/* webpackIgnore: true */ "node:net");
+const dns = await import(/* webpackIgnore: true */ "node:dns");
+const tlsMod = await import(/* webpackIgnore: true */ "node:tls");
+
+// The address stays out of the message: telling the guest would let it map
+// internal DNS names to addresses.
+function blockedError(host) {
+  const e = new Error(`host '${host}' resolves to a blocked network`);
+  e.code = "EERYX_BLOCKED";
+  return e;
+}
+
+/** The IPv4 address an IPv6 address stands for on the wire (see ip.js), or null. */
+function embeddedIPv4Address(address) {
+  const b = ipv6Bytes(address);
+  return (b && embeddedIPv4(b)?.join(".")) ?? null;
+}
+
+/**
+ * `(address, family) => allowed` for `blockedNetworks` minus `allowedNetworks`.
+ * CIDR syntax is checked by net.js; BlockList throws on a bad address or prefix.
+ */
+export function networkFilter({ blockedNetworks, allowedNetworks }) {
+  const list = (cidrs) => {
+    const bl = new net.BlockList();
+    for (const cidr of cidrs) {
+      const [addr, prefix] = cidr.split("/");
+      bl.addSubnet(addr, Number(prefix), net.isIPv6(addr) ? "ipv6" : "ipv4");
+    }
+    return bl;
+  };
+  const blocked = list(blockedNetworks);
+  const allowed = list(allowedNetworks);
+  const matches = (bl, address, type) => {
+    const v4 = type === "ipv6" ? embeddedIPv4Address(address) : null;
+    return bl.check(address, type) || (v4 !== null && bl.check(v4, "ipv4"));
+  };
+  return (address, family) => {
+    const type = family === 6 ? "ipv6" : "ipv4";
+    return !matches(blocked, address, type) || matches(allowed, address, type);
+  };
+}
+
+/** `isAllowed` is a networkFilter() result, or null to skip the address check. */
+async function connect(conns, host, port, timeoutMs, isAllowed) {
+  isAllowed ??= () => true;
+  // Node skips `lookup` for IP literals, so check those here.
+  const literal = net.isIP(host);
+  if (literal && !isAllowed(host, literal)) {
+    throw tcpErr(mapTcpError(blockedError(host)));
+  }
+  // Filter the DNS answer before Node picks an address, so the address
+  // connected to is one that was checked.
+  const lookup = (hostname, options, cb) =>
+    dns.lookup(hostname, { ...options, all: true }, (err, addrs) => {
+      if (err) return cb(err);
+      const ok = addrs.filter((a) => isAllowed(a.address, a.family));
+      if (!ok.length) return cb(blockedError(hostname));
+      if (options.all) return cb(null, ok);
+      cb(null, ok[0].address, ok[0].family);
+    });
+  const s = net.connect({ host, port, lookup });
+  conns.pending.add(s);
+  const connected = new Promise((resolve, reject) => {
+    s.once("connect", () => resolve(track(conns, s)));
+    s.once("error", (e) => reject(tcpErr(mapTcpError(e))));
+    s.once("close", () => reject(tcpErr({ tag: "connection-reset" })));
+  });
+  return withTimeout(connected, timeoutMs, tcpErr({ tag: "timed-out" }))
+    .catch((e) => {
+      s.destroy();
+      throw e;
+    })
+    .finally(() => conns.pending.delete(s));
+}
+
+async function upgrade(conns, tcpHandle, hostname, timeoutMs) {
+  const c = untrack(conns, tcpHandle);
+  if (!c) throw tlsErr({ tag: "invalid-handle" });
+  const s = tlsMod.connect({ socket: c.socket, servername: hostname });
+  conns.pending.add(c.socket).add(s);
+  const handshake = new Promise((resolve, reject) => {
+    s.once("secureConnect", () => resolve(track(conns, s)));
+    s.once("error", (e) => reject({ payload: { tag: "handshake-failed", val: String(e.message) } }));
+    s.once("close", () => reject(tlsErr({ tag: "connection-reset" })));
+  });
+  return withTimeout(handshake, timeoutMs, tlsErr({ tag: "timed-out" }))
+    .catch((e) => {
+      s.destroy();
+      throw e;
+    })
+    .finally(() => {
+      conns.pending.delete(c.socket);
+      conns.pending.delete(s);
+    });
+}
+
+/**
+ * A transport with its own connection table, so each sandbox instance only
+ * sees (and closes) its own handles.
+ */
+export function createTransport() {
+  const conns = new Map();
+  conns.next = 1;
+  // Sockets still connecting or handshaking, which have no handle yet.
+  conns.pending = new Set();
+  return {
+    openConnections: () => conns.size,
+    closeAll() {
+      for (const h of [...conns.keys()]) close(conns, h);
+      for (const s of conns.pending) s.destroy();
+    },
+    tcp: {
+      connect: (host, port, timeoutMs, isAllowed) => connect(conns, host, port, timeoutMs, isAllowed),
+      read: (h, len, timeoutMs) => read(conns, h, len, timeoutMs, tcpErr),
+      write: (h, timeoutMs, data) => write(conns, h, data, timeoutMs, tcpErr),
+      close: (h) => close(conns, h),
+    },
+    tls: {
+      upgrade: (h, hostname, timeoutMs) => upgrade(conns, h, hostname, timeoutMs),
+      read: (h, len, timeoutMs) => read(conns, h, len, timeoutMs, tlsErr),
+      write: (h, timeoutMs, data) => write(conns, h, data, timeoutMs, tlsErr),
+      close: (h) => close(conns, h),
+    },
+  };
+}

package/shims/net.d.ts

@@ -0,0 +1,84 @@
+/**
+ * Network policy for sandboxed code. Mirrors the Rust crate's `NetConfig`.
+ *
+ * In Node.js, sandboxed code gets real TCP/TLS sockets. In browsers only
+ * HTTP(S) works: requests are replayed through `fetch()`, so CORS applies, and
+ * the browser resolves names itself, so a name that resolves to a private
+ * address can't be refused there. Use `allowedHosts` rather than
+ * `allowAllHosts` in browsers.
+ *
+ * Connections still open when a call into the sandbox finishes are closed.
+ */
+export interface NetConfig {
+  /** Allow every host not matched by `blockedHosts` (default false). */
+  allowAllHosts?: boolean;
+  /** Host patterns to allow; `*` is a wildcard (e.g. `*.example.com`). */
+  allowedHosts?: readonly string[];
+  /**
+   * Host patterns always refused. Defaults to {@link DEFAULT_BLOCKED_HOSTS}.
+   * Hosts are matched as written and in WHATWG URL form, so `2130706433` and
+   * `0x7f.1` match `127.*`. `allowedHosts` and `internalHosts` match the URL
+   * form only.
+   */
+  blockedHosts?: readonly string[];
+  /**
+   * CIDRs (e.g. `"10.0.0.0/8"`) that an IP address host, or (in Node.js) the
+   * addresses a host name resolves to, must not fall in, so a public name
+   * pointing at an internal address is refused. Defaults to
+   * {@link DEFAULT_BLOCKED_NETWORKS}. Browsers don't expose resolved
+   * addresses, so there only IP address hosts are checked.
+   */
+  blockedNetworks?: readonly string[];
+  /** CIDRs exempt from `blockedNetworks`. */
+  allowedNetworks?: readonly string[];
+  /**
+   * Host patterns allowed to resolve into `blockedNetworks`, for trusted names
+   * routed internally on purpose. Only list names whose DNS you control.
+   */
+  internalHosts?: readonly string[];
+  /** Most connections open at once (default 10; `0` for no limit). */
+  maxConnections?: number;
+  /**
+   * Ceiling for connect and TLS handshake timeouts, in milliseconds (default
+   * 30000). Sandboxed code can set a shorter timeout, never a longer one.
+   * Must be greater than zero.
+   */
+  connectTimeoutMs?: number;
+  /** Ceiling for read and write timeouts, in milliseconds (default 60000; greater than zero). */
+  ioTimeoutMs?: number;
+}
+
+/** Localhost and private network ranges, blocked unless `blockedHosts` is overridden (frozen). */
+export const DEFAULT_BLOCKED_HOSTS: readonly string[];
+
+/** Every non-public address range, blocked unless `blockedNetworks` is overridden (frozen). */
+export const DEFAULT_BLOCKED_NETWORKS: readonly string[];
+
+/**
+ * Set the default policy, or disable networking again with `null` (the
+ * initial default). Each instance from {@link createNet} copies it when it is
+ * created; existing instances keep theirs. It also applies to the default
+ * instance behind {@link closeConnections} and the `tcp`/`tls` exports.
+ * Throws a TypeError if a network isn't a valid CIDR or `maxConnections`
+ * isn't a non-negative integer.
+ */
+export function setNetConfig(config: NetConfig | null): void;
+
+/** Close every connection the default instance's code left open. */
+export function closeConnections(): void;
+
+/** A transport's TCP and TLS imports. Internal: the shapes follow the eryx:net WIT. */
+type NetImports = Record<string, (...args: any[]) => unknown>;
+
+/**
+ * The eryx:net imports for one sandbox instance, with its own connection
+ * table and policy. The policy starts as the default from
+ * {@link setNetConfig}; the instance's `setNetConfig()` replaces it for that
+ * instance only, for connections opened after the call.
+ */
+export function createNet(): {
+  tcp: NetImports;
+  tls: NetImports;
+  closeConnections(): void;
+  setNetConfig(config: NetConfig | null): void;
+};