@molecule/api-code-sandbox-flyio 1.1.0 → 1.2.1

package/README.md

@@ -3,7 +3,7 @@ AUTO-GENERATED — DO NOT EDIT THIS FILE.
 Generated by `mlcl sync-docs` from the package's src/index.ts JSDoc + mlcl/registry.json.
 Edits here are overwritten on the next commit (molecule's pre-commit hook regenerates).
 To change this document, edit the module-level JSDoc in src/index.ts.
-Generated: 2026-08-16T01:24:44.152Z
+Generated: 2026-08-16T14:04:35.624Z
 -->
 
 # @molecule/api-code-sandbox-flyio
@@ -75,7 +75,7 @@ const warm = await provider.create({
 ## Installation
 
 ```bash
-npm install @molecule/api-code-sandbox-flyio @aws-sdk/client-s3 @aws-sdk/s3-request-presigner @molecule/api-bond @molecule/api-code-sandbox @molecule/api-i18n
+npm install @molecule/api-code-sandbox-flyio @aws-sdk/client-s3 @aws-sdk/s3-request-presigner @molecule/api-bond @molecule/api-code-sandbox @molecule/api-i18n @molecule/api-proxy-agent
 ```
 
 ## API
@@ -94,10 +94,24 @@ interface EgressProbeContext {
   targets: EgressProbeTarget[]
   /**
    * Ports this provider's own egress policy allows, or `undefined` when it
-   * applies no policy at all. Used ONLY for the message and the remediation —
-   * never to decide the verdict, which comes from the observation alone.
+   * applies no policy at all. Used for the message, the remediation, and as the
+   * INTENT half of the drift check against {@link appliedPolicyPorts} — never to
+   * decide `open` vs `filtered` from a probe that reached a target, which comes
+   * from the observation alone.
    */
   policyPorts?: FlyNetworkPolicyPort[]
+  /**
+   * Ports the policy Fly ACTUALLY holds for this app allows, read back from the
+   * API after the probe ran, or `undefined` when the readback failed or found no
+   * policy of this provider's name.
+   *
+   * This is the observation half of the only drift this module can catch: a
+   * policy widened outside the provider (by hand, by another tool, by an older
+   * build) allows ports nothing here configured, and the raw-connect probe
+   * cannot see it because it only attempts the targets it was given. See
+   * {@link unexpectedPolicyPorts}.
+   */
+  appliedPolicyPorts?: FlyNetworkPolicyPort[]
 }
 ```
 
@@ -580,6 +594,13 @@ One rule in a Fly network policy. `allow` is the only documented action:
 "Once you create a rule for a given direction, the default for that direction
 becomes drop."
 
+There is no destination field, and that is measured rather than assumed
+(2026-08-16, live API): `ipv6_cidrs`, `ipv4_cidrs`, `cidrs`, `destinations`,
+`apps`, `app`, `to` and `dst` were each POSTed on a rule and each came back
+absent — the stored rule is `{action, direction, ports}` and nothing more. An
+`allow tcp/5432` rule therefore permits the Machine to reach port 5432 on
+every host on the internet.
+
 ```typescript
 interface FlyNetworkPolicyRule {
   /** Only `allow` is supported by Fly. */
@@ -593,8 +614,16 @@ interface FlyNetworkPolicyRule {
 
 #### `FlyNetworkPolicySelector`
 
-Which Machines in the app a policy applies to. Documented criteria combine
-with AND, so this provider uses `{ all: true }` alone.
+Which Machines in the app a policy applies to — the SOURCE side only. There is
+no destination selector: an `apps` array is the one candidate the API answers
+about, and it answers `400 {"error":"apps array not currently supported in
+selectors"}` (measured 2026-08-16); every other candidate field is silently
+dropped. Documented criteria combine with AND, so this provider uses
+`{ all: true }` alone.
+
+The API's LIST response returns this object under the key `netpolSelector`
+while accepting it as `selector` on write — which is why nothing here reads it
+back by name.
 
 ```typescript
 interface FlyNetworkPolicySelector {
@@ -1165,6 +1194,28 @@ function decodePrivateRoutes(raw: string | undefined): Record<string, string>
 
 **Returns:** Target app name → allocated private address. Unparseable entries are skipped: this value only drives cleanup and self-healing, and a malformed entry must not stop either.
 
+#### `describePublicReach(policyPorts)`
+
+States, in the verdict itself, what an allowed port actually permits.
+
+A Fly network policy has no destination (see the module description — measured
+against the live API, not inferred), so every allowed port is open to every
+host on the internet, not only to the private service it was derived for. That
+is the single most consequential thing about this mechanism and it was invisible
+everywhere it mattered: the probe attempts one port the policy denies, reports
+`filtered`, and an operator reasonably reads that as "nothing gets out".
+
+Naming it here means the residual is restated on every re-probe (the consumer
+re-verifies every 15 minutes) instead of living only in a document.
+
+```typescript
+function describePublicReach(policyPorts: FlyNetworkPolicyPort[] | undefined): string
+```
+
+- `policyPorts` — Allowed ports, or `undefined` when no policy is applied.
+
+**Returns:** A sentence naming the public reach, or `''` when there is nothing to say (no policy, or nothing but UDP/53 — DNS is a documented residual of its own and not a TCP channel).
+
 #### `encodePrivateRoutes(routes)`
 
 Encodes allocated addresses for storage in Machine metadata.
@@ -1223,6 +1274,32 @@ function extractPolicyId(response: unknown, name: string): string | undefined
 
 **Returns:** The matching policy's id, or `undefined`.
 
+#### `extractPolicyPorts(response, name)`
+
+Reads back the egress ports the policy Fly ACTUALLY holds allows.
+
+The write is not the observation: this provider POSTs a policy, but what
+governs a Machine is whatever Fly has when that Machine boots — which may
+differ because a person, another tool or an older build changed it. Reading it
+back is what lets {@link unexpectedPolicyPorts} catch a policy wider than the
+one this provider configured, so `verifyEgress()` can fail on drift its raw
+connects were never going to attempt.
+
+Parsed as defensively as {@link extractPolicyId}, and for the same reason:
+neither Fly document specifies the LIST response shape. The live API answers
+with a bare array whose selector key is `netpolSelector` rather than the
+`selector` it accepts (verified 2026-08-16), which is exactly why nothing here
+depends on any key but `name` and `rules`.
+
+```typescript
+function extractPolicyPorts(response: unknown, name: string): FlyNetworkPolicyPort[] | undefined
+```
+
+- `response` — The raw parsed LIST response.
+- `name` — The policy name to match.
+
+**Returns:** The allowed egress ports, or `undefined` when no policy of that name is present or the shape is unrecognized. `undefined` means "nothing to compare", never "nothing is allowed".
+
 #### `flycastHost(app)`
 
 Renders the DNS name a sandbox dials to reach an app over its Flycast address.
@@ -1388,14 +1465,25 @@ It is deliberately a UNION and never a replacement, so an operator's list is
 still exactly what they wrote plus the ports their own declarations require,
 and the applied policy is logged.
 
-Whether the addition is even load-bearing is UNVERIFIED: Fly states "Network
-policies only apply to traffic directly to and from Machines. They do not
-affect traffic routed through the Fly Proxy"
+The addition is load-bearing — VERIFIED 2026-08-16, not inferred. Fly states
+"Network policies only apply to traffic directly to and from Machines. They do
+not affect traffic routed through the Fly Proxy"
 (https://fly.io/docs/machines/guides-examples/network-policies/), and Flycast
-traffic IS routed through Fly Proxy — but Fly says that about ingress and
-never addresses a Machine's egress toward a Flycast address. An inert entry
-costs a port on the allow list; a missing one costs every database in the
-fleet, so the port is added.
+traffic IS routed through Fly Proxy, so it was an open question whether these
+ports did anything. Measured on a throwaway app with a Flycast address into
+its own 6PN: under a policy allowing only `udp:53`, `molecule-pg-tenant.flycast`
+and `molecule-api.flycast` both RESOLVED and every TCP connect to them was
+dropped; re-applying the policy with `tcp:443` opened 443 and nothing else.
+Fly's sentence is about INGRESS — a Machine's egress TOWARD a Flycast address
+is filtered like any other. Drop a declared service's port and every database
+connection in the fleet goes with it.
+
+The cost of each derived port, stated plainly because a Fly policy has no
+destination field of any kind (also measured — see the `egress.ts` module
+description): the port is opened to EVERY host on the internet, not only to
+the private service it was derived for. That residual cannot be closed at this
+layer; it is named in `verifyEgress()`'s verdict and in
+`docs/sandbox-egress-enforcement.md`.
 
 ```typescript
 function mergeEgressPorts(
@@ -1672,6 +1760,30 @@ function toSandboxId(app: string, machineId: string): string
 
 **Returns:** The composite sandbox id.
 
+#### `unexpectedPolicyPorts(applied, intended)`
+
+Finds ports the policy Fly holds allows that this provider never configured.
+
+The raw-connect probe can only speak for the targets it was handed, so a
+policy widened outside this provider — edited by hand to unblock something, or
+left behind by an older build — is invisible to it: the probe's own port stays
+denied and the verdict stays `filtered` while a port nothing here asked for is
+open to the whole internet. Comparing what Fly holds against what this
+provider intended is the one check that can catch that, and it is why the
+verdict reads the policy back rather than trusting the write.
+
+```typescript
+function unexpectedPolicyPorts(
+  applied: FlyNetworkPolicyPort[] | undefined,
+  intended: FlyNetworkPolicyPort[] | undefined,
+): FlyNetworkPolicyPort[]
+```
+
+- `applied` — Ports in the policy Fly actually holds, or `undefined` when the readback found nothing (in which case there is nothing to compare).
+- `intended` — Ports this provider configured, or `undefined` when it applies no policy.
+
+**Returns:** The applied ports with no counterpart in `intended`, in order.
+
 #### `verdictForProbeExit(exitCode, context)`
 
 Maps a probe's exit status onto an {@link EgressVerdict}.
@@ -1961,7 +2073,7 @@ export function setupCodeSandboxFlyio(): void {
 Peer dependencies:
 
 - `@molecule/api-bond` ^1.0.1
-- `@molecule/api-code-sandbox` ^1.0.1
+- `@molecule/api-code-sandbox` ^1.2.0
 - `@molecule/api-i18n` ^1.0.1
 
 ### Environment Variables
@@ -2000,6 +2112,7 @@ Peer dependencies:
 - `@molecule/api-bond`
 - `@molecule/api-code-sandbox`
 - `@molecule/api-i18n`
+- `@molecule/api-proxy-agent`
 
 **Sources.** Every endpoint, payload field and documented behaviour used here
 was checked against Fly's own material, not recalled:

package/dist/egress.d.ts

@@ -46,6 +46,30 @@
  * and that `name` is mandatory — which is why {@link DEFAULT_EGRESS_POLICY_NAME}
  * is always sent.
  *
+ * **THE PORT LIST IS THE WHOLE POLICY — there is no destination, and this was
+ * measured rather than inferred (2026-08-16, live API, throwaway app).** Every
+ * plausible destination field was POSTed and read back: on a RULE,
+ * `ipv6_cidrs` / `ipv4_cidrs` / `cidrs` / `destinations` / `apps` / `app` / `to`
+ * / `dst` are all accepted by the decoder and DROPPED — the stored rule comes
+ * back as `{action, direction, ports}` and nothing else. On the SELECTOR (which
+ * chooses which Machines a policy covers, i.e. the SOURCE, never a destination)
+ * only `all`, `machines` and `metadata` persist; `apps` is the one field the API
+ * answers about, with `400 {"error":"apps array not currently supported in
+ * selectors"}`. So an `allow tcp/5432` rule permits that Machine to reach port
+ * 5432 on EVERY host on the internet, and no arrangement of this object can say
+ * otherwise. {@link describePublicReach} states that in the verdict rather than
+ * leaving an operator to deduce it.
+ *
+ * **The derived private-service ports ARE load-bearing** (the open question this
+ * module and FLY-OPERATOR-SETUP §9 both carried since 2026-08-05). Measured the
+ * same day: with a policy allowing only `udp:53`, a Machine on a custom 6PN
+ * could resolve `molecule-pg-tenant.flycast` and `molecule-api.flycast` but
+ * every TCP connect to them was dropped, and re-applying `tcp:443` re-opened
+ * only 443. Fly's "policies do not affect traffic routed through the Fly Proxy"
+ * is about INGRESS; a Machine's egress TOWARD a Flycast address is filtered like
+ * any other. Dropping a declared service's port would therefore take out every
+ * database connection in the fleet.
+ *
  * @module
  */
 import type { EgressVerdict } from '@molecule/api-code-sandbox';
@@ -83,10 +107,24 @@ export interface EgressProbeContext {
     targets: EgressProbeTarget[];
     /**
      * Ports this provider's own egress policy allows, or `undefined` when it
-     * applies no policy at all. Used ONLY for the message and the remediation —
-     * never to decide the verdict, which comes from the observation alone.
+     * applies no policy at all. Used for the message, the remediation, and as the
+     * INTENT half of the drift check against {@link appliedPolicyPorts} — never to
+     * decide `open` vs `filtered` from a probe that reached a target, which comes
+     * from the observation alone.
      */
     policyPorts?: FlyNetworkPolicyPort[];
+    /**
+     * Ports the policy Fly ACTUALLY holds for this app allows, read back from the
+     * API after the probe ran, or `undefined` when the readback failed or found no
+     * policy of this provider's name.
+     *
+     * This is the observation half of the only drift this module can catch: a
+     * policy widened outside the provider (by hand, by another tool, by an older
+     * build) allows ports nothing here configured, and the raw-connect probe
+     * cannot see it because it only attempts the targets it was given. See
+     * {@link unexpectedPolicyPorts}.
+     */
+    appliedPolicyPorts?: FlyNetworkPolicyPort[];
 }
 /**
  * Renders a target the way it is written in configuration, so an operator can
@@ -139,6 +177,41 @@ export declare function parseEgressAllowedPorts(raw: string | undefined): FlyNet
  * @returns A `sh`-safe command string.
  */
 export declare function buildEgressProbeCommand(targets: EgressProbeTarget[], timeoutMs: number): string;
+/**
+ * States, in the verdict itself, what an allowed port actually permits.
+ *
+ * A Fly network policy has no destination (see the module description — measured
+ * against the live API, not inferred), so every allowed port is open to every
+ * host on the internet, not only to the private service it was derived for. That
+ * is the single most consequential thing about this mechanism and it was invisible
+ * everywhere it mattered: the probe attempts one port the policy denies, reports
+ * `filtered`, and an operator reasonably reads that as "nothing gets out".
+ *
+ * Naming it here means the residual is restated on every re-probe (the consumer
+ * re-verifies every 15 minutes) instead of living only in a document.
+ * @param policyPorts - Allowed ports, or `undefined` when no policy is applied.
+ * @returns A sentence naming the public reach, or `''` when there is nothing to
+ *   say (no policy, or nothing but UDP/53 — DNS is a documented residual of its
+ *   own and not a TCP channel).
+ */
+export declare function describePublicReach(policyPorts: FlyNetworkPolicyPort[] | undefined): string;
+/**
+ * Finds ports the policy Fly holds allows that this provider never configured.
+ *
+ * The raw-connect probe can only speak for the targets it was handed, so a
+ * policy widened outside this provider — edited by hand to unblock something, or
+ * left behind by an older build — is invisible to it: the probe's own port stays
+ * denied and the verdict stays `filtered` while a port nothing here asked for is
+ * open to the whole internet. Comparing what Fly holds against what this
+ * provider intended is the one check that can catch that, and it is why the
+ * verdict reads the policy back rather than trusting the write.
+ * @param applied - Ports in the policy Fly actually holds, or `undefined` when
+ *   the readback found nothing (in which case there is nothing to compare).
+ * @param intended - Ports this provider configured, or `undefined` when it
+ *   applies no policy.
+ * @returns The applied ports with no counterpart in `intended`, in order.
+ */
+export declare function unexpectedPolicyPorts(applied: FlyNetworkPolicyPort[] | undefined, intended: FlyNetworkPolicyPort[] | undefined): FlyNetworkPolicyPort[];
 /**
  * Maps a probe's exit status onto an {@link EgressVerdict}.
  *
@@ -177,4 +250,26 @@ export declare function verdictForProbeExit(exitCode: number, context: EgressPro
  * @returns The matching policy's id, or `undefined`.
  */
 export declare function extractPolicyId(response: unknown, name: string): string | undefined;
+/**
+ * Reads back the egress ports the policy Fly ACTUALLY holds allows.
+ *
+ * The write is not the observation: this provider POSTs a policy, but what
+ * governs a Machine is whatever Fly has when that Machine boots — which may
+ * differ because a person, another tool or an older build changed it. Reading it
+ * back is what lets {@link unexpectedPolicyPorts} catch a policy wider than the
+ * one this provider configured, so `verifyEgress()` can fail on drift its raw
+ * connects were never going to attempt.
+ *
+ * Parsed as defensively as {@link extractPolicyId}, and for the same reason:
+ * neither Fly document specifies the LIST response shape. The live API answers
+ * with a bare array whose selector key is `netpolSelector` rather than the
+ * `selector` it accepts (verified 2026-08-16), which is exactly why nothing here
+ * depends on any key but `name` and `rules`.
+ * @param response - The raw parsed LIST response.
+ * @param name - The policy name to match.
+ * @returns The allowed egress ports, or `undefined` when no policy of that name
+ *   is present or the shape is unrecognized. `undefined` means "nothing to
+ *   compare", never "nothing is allowed".
+ */
+export declare function extractPolicyPorts(response: unknown, name: string): FlyNetworkPolicyPort[] | undefined;
 //# sourceMappingURL=egress.d.ts.map

package/dist/egress.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"egress.d.ts","sourceRoot":"","sources":["../src/egress.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAiDG;AAEH,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,4BAA4B,CAAA;AAE/D,OAAO,KAAK,EAAE,oBAAoB,EAAE,MAAM,YAAY,CAAA;AAGtD,gFAAgF;AAChF,eAAO,MAAM,0BAA0B,4BAA4B,CAAA;AAEnE;;;;GAIG;AACH,eAAO,MAAM,yBAAyB,IAAI,CAAA;AAE1C,uFAAuF;AACvF,eAAO,MAAM,yBAAyB,IAAI,CAAA;AAE1C;;;;;;GAMG;AACH,eAAO,MAAM,4BAA4B,2CAA2C,CAAA;AAEpF,wEAAwE;AACxE,MAAM,WAAW,iBAAiB;IAChC,8FAA8F;IAC9F,IAAI,EAAE,MAAM,CAAA;IACZ,gBAAgB;IAChB,IAAI,EAAE,MAAM,CAAA;CACb;AAED,qFAAqF;AACrF,MAAM,WAAW,kBAAkB;IACjC,wCAAwC;IACxC,GAAG,EAAE,MAAM,CAAA;IACX,mCAAmC;IACnC,OAAO,EAAE,iBAAiB,EAAE,CAAA;IAC5B;;;;OAIG;IACH,WAAW,CAAC,EAAE,oBAAoB,EAAE,CAAA;CACrC;AAQD;;;;;GAKG;AACH,wBAAgB,uBAAuB,CAAC,MAAM,EAAE,iBAAiB,GAAG,MAAM,CAGzE;AAED;;;;;;;;;;;;;GAaG;AACH,wBAAgB,uBAAuB,CAAC,GAAG,EAAE,MAAM,GAAG,MAAM,EAAE,GAAG,SAAS,GAAG,iBAAiB,EAAE,CAc/F;AAED;;;;;;;;;;;;;;GAcG;AACH,wBAAgB,uBAAuB,CACrC,GAAG,EAAE,MAAM,GAAG,SAAS,GACtB,oBAAoB,EAAE,GAAG,SAAS,CAyBpC;AAED;;;;;;;;;;;GAWG;AACH,wBAAgB,uBAAuB,CAAC,OAAO,EAAE,iBAAiB,EAAE,EAAE,SAAS,EAAE,MAAM,GAAG,MAAM,CAY/F;AAaD;;;;;;;;;;;;;;;;;;;;;GAqBG;AACH,wBAAgB,mBAAmB,CAAC,QAAQ,EAAE,MAAM,EAAE,OAAO,EAAE,kBAAkB,GAAG,aAAa,CA0ChG;AAWD;;;;;;;;;;;;;GAaG;AACH,wBAAgB,eAAe,CAAC,QAAQ,EAAE,OAAO,EAAE,IAAI,EAAE,MAAM,GAAG,MAAM,GAAG,SAAS,CAanF"}
+{"version":3,"file":"egress.d.ts","sourceRoot":"","sources":["../src/egress.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAyEG;AAEH,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,4BAA4B,CAAA;AAE/D,OAAO,KAAK,EAAE,oBAAoB,EAAE,MAAM,YAAY,CAAA;AAGtD,gFAAgF;AAChF,eAAO,MAAM,0BAA0B,4BAA4B,CAAA;AAcnE;;;;GAIG;AACH,eAAO,MAAM,yBAAyB,IAAI,CAAA;AAE1C,uFAAuF;AACvF,eAAO,MAAM,yBAAyB,IAAI,CAAA;AAE1C;;;;;;GAMG;AACH,eAAO,MAAM,4BAA4B,2CAA2C,CAAA;AAEpF,wEAAwE;AACxE,MAAM,WAAW,iBAAiB;IAChC,8FAA8F;IAC9F,IAAI,EAAE,MAAM,CAAA;IACZ,gBAAgB;IAChB,IAAI,EAAE,MAAM,CAAA;CACb;AAED,qFAAqF;AACrF,MAAM,WAAW,kBAAkB;IACjC,wCAAwC;IACxC,GAAG,EAAE,MAAM,CAAA;IACX,mCAAmC;IACnC,OAAO,EAAE,iBAAiB,EAAE,CAAA;IAC5B;;;;;;OAMG;IACH,WAAW,CAAC,EAAE,oBAAoB,EAAE,CAAA;IACpC;;;;;;;;;;OAUG;IACH,kBAAkB,CAAC,EAAE,oBAAoB,EAAE,CAAA;CAC5C;AAQD;;;;;GAKG;AACH,wBAAgB,uBAAuB,CAAC,MAAM,EAAE,iBAAiB,GAAG,MAAM,CAGzE;AAED;;;;;;;;;;;;;GAaG;AACH,wBAAgB,uBAAuB,CAAC,GAAG,EAAE,MAAM,GAAG,MAAM,EAAE,GAAG,SAAS,GAAG,iBAAiB,EAAE,CAc/F;AAED;;;;;;;;;;;;;;GAcG;AACH,wBAAgB,uBAAuB,CACrC,GAAG,EAAE,MAAM,GAAG,SAAS,GACtB,oBAAoB,EAAE,GAAG,SAAS,CAyBpC;AAED;;;;;;;;;;;GAWG;AACH,wBAAgB,uBAAuB,CAAC,OAAO,EAAE,iBAAiB,EAAE,EAAE,SAAS,EAAE,MAAM,GAAG,MAAM,CAY/F;AAqBD;;;;;;;;;;;;;;;;GAgBG;AACH,wBAAgB,mBAAmB,CAAC,WAAW,EAAE,oBAAoB,EAAE,GAAG,SAAS,GAAG,MAAM,CAW3F;AAED;;;;;;;;;;;;;;;GAeG;AACH,wBAAgB,qBAAqB,CACnC,OAAO,EAAE,oBAAoB,EAAE,GAAG,SAAS,EAC3C,QAAQ,EAAE,oBAAoB,EAAE,GAAG,SAAS,GAC3C,oBAAoB,EAAE,CAMxB;AAED;;;;;;;;;;;;;;;;;;;;;GAqBG;AACH,wBAAgB,mBAAmB,CAAC,QAAQ,EAAE,MAAM,EAAE,OAAO,EAAE,kBAAkB,GAAG,aAAa,CAgEhG;AAWD;;;;;;;;;;;;;GAaG;AACH,wBAAgB,eAAe,CAAC,QAAQ,EAAE,OAAO,EAAE,IAAI,EAAE,MAAM,GAAG,MAAM,GAAG,SAAS,CAGnF;AAED;;;;;;;;;;;;;;;;;;;;GAoBG;AACH,wBAAgB,kBAAkB,CAChC,QAAQ,EAAE,OAAO,EACjB,IAAI,EAAE,MAAM,GACX,oBAAoB,EAAE,GAAG,SAAS,CAiBpC"}

package/dist/egress.js

@@ -46,11 +46,46 @@
  * and that `name` is mandatory — which is why {@link DEFAULT_EGRESS_POLICY_NAME}
  * is always sent.
  *
+ * **THE PORT LIST IS THE WHOLE POLICY — there is no destination, and this was
+ * measured rather than inferred (2026-08-16, live API, throwaway app).** Every
+ * plausible destination field was POSTed and read back: on a RULE,
+ * `ipv6_cidrs` / `ipv4_cidrs` / `cidrs` / `destinations` / `apps` / `app` / `to`
+ * / `dst` are all accepted by the decoder and DROPPED — the stored rule comes
+ * back as `{action, direction, ports}` and nothing else. On the SELECTOR (which
+ * chooses which Machines a policy covers, i.e. the SOURCE, never a destination)
+ * only `all`, `machines` and `metadata` persist; `apps` is the one field the API
+ * answers about, with `400 {"error":"apps array not currently supported in
+ * selectors"}`. So an `allow tcp/5432` rule permits that Machine to reach port
+ * 5432 on EVERY host on the internet, and no arrangement of this object can say
+ * otherwise. {@link describePublicReach} states that in the verdict rather than
+ * leaving an operator to deduce it.
+ *
+ * **The derived private-service ports ARE load-bearing** (the open question this
+ * module and FLY-OPERATOR-SETUP §9 both carried since 2026-08-05). Measured the
+ * same day: with a policy allowing only `udp:53`, a Machine on a custom 6PN
+ * could resolve `molecule-pg-tenant.flycast` and `molecule-api.flycast` but
+ * every TCP connect to them was dropped, and re-applying `tcp:443` re-opened
+ * only 443. Fly's "policies do not affect traffic routed through the Fly Proxy"
+ * is about INGRESS; a Machine's egress TOWARD a Flycast address is filtered like
+ * any other. Dropping a declared service's port would therefore take out every
+ * database connection in the fleet.
+ *
  * @module
  */
 import { shellQuote } from './utilities.js';
 /** Default name of the egress policy this provider owns on each sandbox app. */
 export const DEFAULT_EGRESS_POLICY_NAME = 'molecule-sandbox-egress';
+/**
+ * UDP port name resolution runs on.
+ *
+ * Excluded from {@link describePublicReach}'s "reachable on" list because DNS is
+ * not a TCP channel and is a residual of its own (a resolver forwards queries
+ * upstream on the platform's behalf, which is why DNS tunnelling is tracked
+ * separately in `docs/sandbox-egress-enforcement.md` rather than as an open
+ * port). It is never excluded from {@link unexpectedPolicyPorts}: a policy that
+ * allows DNS this provider did not configure is still drift.
+ */
+const DNS_PORT = 53;
 /**
  * Probe exit status meaning at least one raw connection to a public IP
  * SUCCEEDED. Deliberately not 1, so an interpreter error (which exits 1) can
@@ -175,6 +210,14 @@ export function buildEgressProbeCommand(targets, timeoutMs) {
         `s.on('error',()=>done())}`;
     return `node -e ${shellQuote(script)}`;
 }
+/**
+ * Renders a port list the way an operator reads it back.
+ * @param ports - The ports.
+ * @returns `tcp/443, udp/53`.
+ */
+function formatPorts(ports) {
+    return ports.map((port) => `${port.protocol}/${port.port}`).join(', ');
+}
 /**
  * Describes the policy this provider applied, for the verdict message.
  * @param policyPorts - Allowed ports, or `undefined` when no policy is applied.
@@ -183,8 +226,55 @@ export function buildEgressProbeCommand(targets, timeoutMs) {
 function describePolicy(policyPorts) {
     if (!policyPorts)
         return 'no Fly network policy applied by this provider';
-    const ports = policyPorts.map((port) => `${port.protocol}/${port.port}`).join(', ');
-    return `a Fly network policy allowing egress on ${ports}`;
+    return `a Fly network policy allowing egress on ${formatPorts(policyPorts)}`;
+}
+/**
+ * States, in the verdict itself, what an allowed port actually permits.
+ *
+ * A Fly network policy has no destination (see the module description — measured
+ * against the live API, not inferred), so every allowed port is open to every
+ * host on the internet, not only to the private service it was derived for. That
+ * is the single most consequential thing about this mechanism and it was invisible
+ * everywhere it mattered: the probe attempts one port the policy denies, reports
+ * `filtered`, and an operator reasonably reads that as "nothing gets out".
+ *
+ * Naming it here means the residual is restated on every re-probe (the consumer
+ * re-verifies every 15 minutes) instead of living only in a document.
+ * @param policyPorts - Allowed ports, or `undefined` when no policy is applied.
+ * @returns A sentence naming the public reach, or `''` when there is nothing to
+ *   say (no policy, or nothing but UDP/53 — DNS is a documented residual of its
+ *   own and not a TCP channel).
+ */
+export function describePublicReach(policyPorts) {
+    const reachable = (policyPorts ?? []).filter((port) => port.protocol !== 'udp' || port.port !== DNS_PORT);
+    if (reachable.length === 0)
+        return '';
+    return (`Every allowed port is open to EVERY host, not only to the private service it exists for — ` +
+        `a Fly network policy matches protocol and port with no destination field of any kind — so ` +
+        `code in this app can still reach an arbitrary public host on ${formatPorts(reachable)}. ` +
+        'Route what must be filtered by host through an egress proxy on one of those ports.');
+}
+/**
+ * Finds ports the policy Fly holds allows that this provider never configured.
+ *
+ * The raw-connect probe can only speak for the targets it was handed, so a
+ * policy widened outside this provider — edited by hand to unblock something, or
+ * left behind by an older build — is invisible to it: the probe's own port stays
+ * denied and the verdict stays `filtered` while a port nothing here asked for is
+ * open to the whole internet. Comparing what Fly holds against what this
+ * provider intended is the one check that can catch that, and it is why the
+ * verdict reads the policy back rather than trusting the write.
+ * @param applied - Ports in the policy Fly actually holds, or `undefined` when
+ *   the readback found nothing (in which case there is nothing to compare).
+ * @param intended - Ports this provider configured, or `undefined` when it
+ *   applies no policy.
+ * @returns The applied ports with no counterpart in `intended`, in order.
+ */
+export function unexpectedPolicyPorts(applied, intended) {
+    if (!applied)
+        return [];
+    const wanted = intended ?? [];
+    return applied.filter((port) => !wanted.some((own) => own.protocol === port.protocol && own.port === port.port));
 }
 /**
  * Maps a probe's exit status onto an {@link EgressVerdict}.
@@ -211,6 +301,24 @@ function describePolicy(policyPorts) {
 export function verdictForProbeExit(exitCode, context) {
     const targets = context.targets.map(formatEgressProbeTarget).join(', ');
     const policy = describePolicy(context.policyPorts);
+    const reach = describePublicReach(context.appliedPolicyPorts ?? context.policyPorts);
+    // Drift, and it outranks a blocked probe: the probe attempts the targets it
+    // was handed, so a port widened outside this provider is open with nothing
+    // observing it. `open` is the honest state — something out there permits
+    // traffic this provider never configured.
+    const unexpected = unexpectedPolicyPorts(context.appliedPolicyPorts, context.policyPorts);
+    if (unexpected.length > 0) {
+        return {
+            state: 'open',
+            detail: (`The Fly network policy in force on app "${context.app}" allows ` +
+                `${formatPorts(unexpected)}, which this provider never configured (it applies ` +
+                `${policy}). ${describePublicReach(context.appliedPolicyPorts)}`).trim(),
+            remediation: 'Something outside this provider widened the policy. Inspect it with ' +
+                `\`GET /v1/apps/${context.app}/network_policies\`, remove the rule that does not belong, ` +
+                'and restart the Machines — Fly applies a policy at boot, so an already-running Machine ' +
+                'keeps the wider one until it is recreated.',
+        };
+    }
     if (exitCode === EGRESS_PROBE_EXIT_REACHED) {
         return {
             state: 'open',
@@ -231,7 +339,7 @@ export function verdictForProbeExit(exitCode, context) {
         return {
             state: 'filtered',
             detail: `Raw TCP connects to ${targets} from a Machine in Fly app "${context.app}" ` +
-                `(${policy}) were refused or timed out.`,
+                `(${policy}) were refused or timed out.${reach ? ` ${reach}` : ''}`,
         };
     }
     return {
@@ -267,6 +375,59 @@ function isRecord(value) {
  * @returns The matching policy's id, or `undefined`.
  */
 export function extractPolicyId(response, name) {
+    const entry = findPolicy(response, name);
+    return entry && typeof entry.id === 'string' && entry.id ? entry.id : undefined;
+}
+/**
+ * Reads back the egress ports the policy Fly ACTUALLY holds allows.
+ *
+ * The write is not the observation: this provider POSTs a policy, but what
+ * governs a Machine is whatever Fly has when that Machine boots — which may
+ * differ because a person, another tool or an older build changed it. Reading it
+ * back is what lets {@link unexpectedPolicyPorts} catch a policy wider than the
+ * one this provider configured, so `verifyEgress()` can fail on drift its raw
+ * connects were never going to attempt.
+ *
+ * Parsed as defensively as {@link extractPolicyId}, and for the same reason:
+ * neither Fly document specifies the LIST response shape. The live API answers
+ * with a bare array whose selector key is `netpolSelector` rather than the
+ * `selector` it accepts (verified 2026-08-16), which is exactly why nothing here
+ * depends on any key but `name` and `rules`.
+ * @param response - The raw parsed LIST response.
+ * @param name - The policy name to match.
+ * @returns The allowed egress ports, or `undefined` when no policy of that name
+ *   is present or the shape is unrecognized. `undefined` means "nothing to
+ *   compare", never "nothing is allowed".
+ */
+export function extractPolicyPorts(response, name) {
+    const entry = findPolicy(response, name);
+    if (!entry || !Array.isArray(entry.rules))
+        return undefined;
+    const ports = [];
+    for (const rule of entry.rules) {
+        if (!isRecord(rule) || rule.direction !== 'egress' || !Array.isArray(rule.ports))
+            continue;
+        for (const port of rule.ports) {
+            if (!isRecord(port))
+                continue;
+            const protocol = port.protocol;
+            const value = port.port;
+            if ((protocol !== 'tcp' && protocol !== 'udp') || typeof value !== 'number')
+                continue;
+            if (!ports.some((seen) => seen.protocol === protocol && seen.port === value)) {
+                ports.push({ protocol, port: value });
+            }
+        }
+    }
+    return ports;
+}
+/**
+ * Finds the named policy in a LIST response.
+ * @param response - The raw parsed LIST response.
+ * @param name - The policy name to match.
+ * @returns The matching entry, or `undefined`.
+ */
+function findPolicy(response, name) {
     const list = Array.isArray(response)
         ? response
         : isRecord(response)
@@ -275,9 +436,8 @@ export function extractPolicyId(response, name) {
     if (!Array.isArray(list))
         return undefined;
     for (const entry of list) {
-        if (isRecord(entry) && entry.name === name && typeof entry.id === 'string' && entry.id) {
-            return entry.id;
-        }
+        if (isRecord(entry) && entry.name === name)
+            return entry;
     }
     return undefined;
 }

package/dist/flycast.d.ts

@@ -115,14 +115,25 @@ export declare function parsePrivateServices(raw: string | undefined): FlyPrivat
  * still exactly what they wrote plus the ports their own declarations require,
  * and the applied policy is logged.
  *
- * Whether the addition is even load-bearing is UNVERIFIED: Fly states "Network
- * policies only apply to traffic directly to and from Machines. They do not
- * affect traffic routed through the Fly Proxy"
+ * The addition is load-bearing — VERIFIED 2026-08-16, not inferred. Fly states
+ * "Network policies only apply to traffic directly to and from Machines. They do
+ * not affect traffic routed through the Fly Proxy"
  * (https://fly.io/docs/machines/guides-examples/network-policies/), and Flycast
- * traffic IS routed through Fly Proxy — but Fly says that about ingress and
- * never addresses a Machine's egress toward a Flycast address. An inert entry
- * costs a port on the allow list; a missing one costs every database in the
- * fleet, so the port is added.
+ * traffic IS routed through Fly Proxy, so it was an open question whether these
+ * ports did anything. Measured on a throwaway app with a Flycast address into
+ * its own 6PN: under a policy allowing only `udp:53`, `molecule-pg-tenant.flycast`
+ * and `molecule-api.flycast` both RESOLVED and every TCP connect to them was
+ * dropped; re-applying the policy with `tcp:443` opened 443 and nothing else.
+ * Fly's sentence is about INGRESS — a Machine's egress TOWARD a Flycast address
+ * is filtered like any other. Drop a declared service's port and every database
+ * connection in the fleet goes with it.
+ *
+ * The cost of each derived port, stated plainly because a Fly policy has no
+ * destination field of any kind (also measured — see the `egress.ts` module
+ * description): the port is opened to EVERY host on the internet, not only to
+ * the private service it was derived for. That residual cannot be closed at this
+ * layer; it is named in `verifyEgress()`'s verdict and in
+ * `docs/sandbox-egress-enforcement.md`.
  * @param ports - The operator's configured ports, or `undefined` when no policy
  *   is being applied at all.
  * @param services - The declared private services, or `undefined`.

package/dist/flycast.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"flycast.d.ts","sourceRoot":"","sources":["../src/flycast.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA0DG;AAIH,OAAO,KAAK,EAAE,oBAAoB,EAAE,iBAAiB,EAAE,MAAM,YAAY,CAAA;AAEzE;;;;GAIG;AACH,eAAO,MAAM,cAAc,aAAa,CAAA;AAExC;;;;;GAKG;AACH,eAAO,MAAM,8BAA8B,kBAAkB,CAAA;AAE7D;;;;;GAKG;AACH,eAAO,MAAM,uBAAuB,eAAe,CAAA;AAKnD;;;;GAIG;AACH,wBAAgB,WAAW,CAAC,GAAG,EAAE,MAAM,GAAG,MAAM,CAE/C;AAED;;;;;;;;;;;;;;GAcG;AACH,wBAAgB,oBAAoB,CAAC,GAAG,EAAE,MAAM,GAAG,SAAS,GAAG,iBAAiB,EAAE,GAAG,SAAS,CAqC7F;AAED;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA8BG;AACH,wBAAgB,gBAAgB,CAC9B,KAAK,EAAE,oBAAoB,EAAE,GAAG,SAAS,EACzC,QAAQ,EAAE,iBAAiB,EAAE,GAAG,SAAS,GACxC,oBAAoB,EAAE,GAAG,SAAS,CAUpC;AAED;;;;;GAKG;AACH,wBAAgB,mBAAmB,CAAC,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,GAAG,MAAM,CAI1E;AAED;;;;;;GAMG;AACH,wBAAgB,mBAAmB,CAAC,GAAG,EAAE,MAAM,GAAG,SAAS,GAAG,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAUnF;AA2BD;;;;;;;;;;;;;;;;;;;;;GAqBG;AACH,wBAAgB,yBAAyB,CACvC,GAAG,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,GAAG,SAAS,EACvC,QAAQ,EAAE,iBAAiB,EAAE,GAAG,SAAS,GACxC,IAAI,CAwCN"}
+{"version":3,"file":"flycast.d.ts","sourceRoot":"","sources":["../src/flycast.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA0DG;AAIH,OAAO,KAAK,EAAE,oBAAoB,EAAE,iBAAiB,EAAE,MAAM,YAAY,CAAA;AAEzE;;;;GAIG;AACH,eAAO,MAAM,cAAc,aAAa,CAAA;AAExC;;;;;GAKG;AACH,eAAO,MAAM,8BAA8B,kBAAkB,CAAA;AAE7D;;;;;GAKG;AACH,eAAO,MAAM,uBAAuB,eAAe,CAAA;AAKnD;;;;GAIG;AACH,wBAAgB,WAAW,CAAC,GAAG,EAAE,MAAM,GAAG,MAAM,CAE/C;AAED;;;;;;;;;;;;;;GAcG;AACH,wBAAgB,oBAAoB,CAAC,GAAG,EAAE,MAAM,GAAG,SAAS,GAAG,iBAAiB,EAAE,GAAG,SAAS,CAqC7F;AAED;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAyCG;AACH,wBAAgB,gBAAgB,CAC9B,KAAK,EAAE,oBAAoB,EAAE,GAAG,SAAS,EACzC,QAAQ,EAAE,iBAAiB,EAAE,GAAG,SAAS,GACxC,oBAAoB,EAAE,GAAG,SAAS,CAUpC;AAED;;;;;GAKG;AACH,wBAAgB,mBAAmB,CAAC,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,GAAG,MAAM,CAI1E;AAED;;;;;;GAMG;AACH,wBAAgB,mBAAmB,CAAC,GAAG,EAAE,MAAM,GAAG,SAAS,GAAG,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAUnF;AA2BD;;;;;;;;;;;;;;;;;;;;;GAqBG;AACH,wBAAgB,yBAAyB,CACvC,GAAG,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,GAAG,SAAS,EACvC,QAAQ,EAAE,iBAAiB,EAAE,GAAG,SAAS,GACxC,IAAI,CAwCN"}

package/dist/flycast.js

@@ -147,14 +147,25 @@ export function parsePrivateServices(raw) {
  * still exactly what they wrote plus the ports their own declarations require,
  * and the applied policy is logged.
  *
- * Whether the addition is even load-bearing is UNVERIFIED: Fly states "Network
- * policies only apply to traffic directly to and from Machines. They do not
- * affect traffic routed through the Fly Proxy"
+ * The addition is load-bearing — VERIFIED 2026-08-16, not inferred. Fly states
+ * "Network policies only apply to traffic directly to and from Machines. They do
+ * not affect traffic routed through the Fly Proxy"
  * (https://fly.io/docs/machines/guides-examples/network-policies/), and Flycast
- * traffic IS routed through Fly Proxy — but Fly says that about ingress and
- * never addresses a Machine's egress toward a Flycast address. An inert entry
- * costs a port on the allow list; a missing one costs every database in the
- * fleet, so the port is added.
+ * traffic IS routed through Fly Proxy, so it was an open question whether these
+ * ports did anything. Measured on a throwaway app with a Flycast address into
+ * its own 6PN: under a policy allowing only `udp:53`, `molecule-pg-tenant.flycast`
+ * and `molecule-api.flycast` both RESOLVED and every TCP connect to them was
+ * dropped; re-applying the policy with `tcp:443` opened 443 and nothing else.
+ * Fly's sentence is about INGRESS — a Machine's egress TOWARD a Flycast address
+ * is filtered like any other. Drop a declared service's port and every database
+ * connection in the fleet goes with it.
+ *
+ * The cost of each derived port, stated plainly because a Fly policy has no
+ * destination field of any kind (also measured — see the `egress.ts` module
+ * description): the port is opened to EVERY host on the internet, not only to
+ * the private service it was derived for. That residual cannot be closed at this
+ * layer; it is named in `verifyEgress()`'s verdict and in
+ * `docs/sandbox-egress-enforcement.md`.
  * @param ports - The operator's configured ports, or `undefined` when no policy
  *   is being applied at all.
  * @param services - The declared private services, or `undefined`.

package/dist/provider.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"provider.d.ts","sourceRoot":"","sources":["../src/provider.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AAMH,OAAO,KAAK,EAWV,eAAe,EAGhB,MAAM,4BAA4B,CAAA;AAGnC,OAAO,EAAE,YAAY,EAAgC,MAAM,UAAU,CAAA;AAsBrE,OAAO,EAAmD,KAAK,WAAW,EAAE,MAAM,cAAc,CAAA;AAEhG,OAAO,KAAK,EAIV,WAAW,EAUZ,MAAM,YAAY,CAAA;AA6oEnB;;;;;;;;;GASG;AACH,wBAAgB,cAAc,CAC5B,MAAM,CAAC,EAAE,WAAW,EACpB,MAAM,CAAC,EAAE,YAAY,EACrB,KAAK,CAAC,EAAE,WAAW,GAAG,IAAI,GACzB,eAAe,CAEjB"}
+{"version":3,"file":"provider.d.ts","sourceRoot":"","sources":["../src/provider.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AAMH,OAAO,KAAK,EAWV,eAAe,EAGhB,MAAM,4BAA4B,CAAA;AAGnC,OAAO,EAAE,YAAY,EAAgC,MAAM,UAAU,CAAA;AAwBrE,OAAO,EAAmD,KAAK,WAAW,EAAE,MAAM,cAAc,CAAA;AAEhG,OAAO,KAAK,EAIV,WAAW,EAUZ,MAAM,YAAY,CAAA;AA0tEnB;;;;;;;;;GASG;AACH,wBAAgB,cAAc,CAC5B,MAAM,CAAC,EAAE,WAAW,EACpB,MAAM,CAAC,EAAE,YAAY,EACrB,KAAK,CAAC,EAAE,WAAW,GAAG,IAAI,GACzB,eAAe,CAEjB"}

package/dist/provider.js

@@ -11,7 +11,7 @@ import { gzipSync } from 'node:zlib';
 import { getLogger } from '@molecule/api-bond';
 import { t } from '@molecule/api-i18n';
 import { FlyApiClient, FlyApiError, normalizeApiUrl } from './api.js';
-import { buildEgressProbeCommand, DEFAULT_EGRESS_POLICY_NAME, DEFAULT_EGRESS_PROBE_TARGETS, extractPolicyId, parseEgressAllowedPorts, parseEgressProbeTargets, verdictForProbeExit, } from './egress.js';
+import { buildEgressProbeCommand, DEFAULT_EGRESS_POLICY_NAME, DEFAULT_EGRESS_PROBE_TARGETS, describePublicReach, extractPolicyId, extractPolicyPorts, parseEgressAllowedPorts, parseEgressProbeTargets, verdictForProbeExit, } from './egress.js';
 import { execCommand, toExecResult } from './exec.js';
 import { assertPrivateRoutesForEnv, decodePrivateRoutes, DEFAULT_PRIVATE_IP_TYPE, encodePrivateRoutes, flycastHost, mergeEgressPorts, parsePrivateServices, PRIVATE_ROUTES_METADATA_SUFFIX, } from './flycast.js';
 import { appNameForProject, mapMachineState, parseSandboxId, toSandboxId } from './ids.js';
@@ -674,7 +674,74 @@ class FlyioSandboxProvider {
             rules: [{ action: 'allow', direction: 'egress', ports }],
         };
         await this.client.request(`/apps/${app}/network_policies`, { method: 'POST', body: policy });
-        logger.info('Applied Fly egress network policy', { app, name, ports, updated: Boolean(id) });
+        logger.info('Applied Fly egress network policy', {
+            app,
+            name,
+            ports,
+            updated: Boolean(id),
+            // A Fly policy has no destination field (measured — see the egress module
+            // description), so every port here is open to every host on the internet.
+            // Logged with the apply so the residual appears where the decision is
+            // recorded, not only in a document.
+            publicReach: describePublicReach(ports),
+        });
+    }
+    /**
+     * Re-applies this provider's egress policy to an app that ALREADY exists.
+     *
+     * `ensureApp()` applies the policy on the path to creating a Machine, so a
+     * change to the configured ports reaches an existing app only when something
+     * deploys into it again. Until then Fly still holds the older, wider policy —
+     * and Fly applies whatever it holds at Machine BOOT, so a host migration or a
+     * crash-restart brings that app back up under the policy the operator thought
+     * they had replaced. That window is what this closes: a consumer that knows
+     * which apps it created (from its own records — never by enumerating a
+     * provider that cannot be enumerated) can walk them at startup and put the
+     * current policy in place before any of them next boots.
+     *
+     * Idempotent, and it updates the policy this provider owns in place rather
+     * than stacking a second one.
+     * @param app - The Fly app name.
+     * @returns The ports now allowed, or `undefined` when no policy is configured
+     *   at all — in which case nothing was written, because turning "no policy"
+     *   into one that Fly then uses to drop everything else is not something to
+     *   infer from a reconciliation sweep.
+     * @throws {Error} When the policy cannot be applied. The caller decides what a
+     *   failed reconcile means; this never reports success for a write that did
+     *   not happen.
+     */
+    async reconcileEgressPolicy(app) {
+        const ports = this.egressAllowedPorts();
+        if (!ports)
+            return undefined;
+        await this.applyEgressPolicy(app);
+        return ports;
+    }
+    /**
+     * Reads back the egress ports the policy Fly holds for an app allows.
+     *
+     * Best-effort by design: this feeds a DRIFT check, and a readback that failed
+     * proves nothing about the policy — treating "I could not look" as "there is
+     * no drift" is the same conflation the verdict mapping refuses, so the caller
+     * gets `undefined` and reports on the observation alone.
+     * @param app - The Fly app name.
+     * @returns The allowed ports, or `undefined` when nothing could be read.
+     */
+    async readAppliedPolicyPorts(app) {
+        const name = this.config.egressPolicyName ?? DEFAULT_EGRESS_POLICY_NAME;
+        try {
+            const listed = await this.client.request(`/apps/${app}/network_policies`, {
+                nullOn: [404],
+            });
+            return extractPolicyPorts(listed, name);
+        }
+        catch (error) {
+            logger.warn('Could not read the Fly egress policy back — reporting on the probe alone', {
+                app,
+                error,
+            });
+            return undefined;
+        }
     }
     /**
      * Requests a shared Anycast IPv4 for the app so `<app>.fly.dev` serves traffic.
@@ -1396,7 +1463,17 @@ class FlyioSandboxProvider {
             await this.waitForStarted(app, machineId);
             const seconds = Math.min(MAX_WAIT_SECONDS, Math.max(1, Math.ceil(timeoutMs / 1000) + PROBE_EXEC_HEADROOM_SECONDS));
             const result = toExecResult(await this.rawExec(app, machineId)(['sh', '-c', buildEgressProbeCommand(targets, timeoutMs)], seconds));
-            return verdictForProbeExit(result.exitCode, { app, targets, policyPorts });
+            // Read the policy back from Fly rather than trusting the write: the probe
+            // can only speak for the ports it attempted, so a policy widened outside
+            // this provider is invisible to it. This is the observation that catches
+            // that, and it happens before the throwaway app is destroyed.
+            const appliedPolicyPorts = await this.readAppliedPolicyPorts(app);
+            return verdictForProbeExit(result.exitCode, {
+                app,
+                targets,
+                policyPorts,
+                appliedPolicyPorts,
+            });
         }
         catch (error) {
             // A probe that could not RUN proves nothing. Reporting `filtered` here is

package/dist/storage.d.ts

@@ -24,6 +24,14 @@
  * (https://www.tigrisdata.com/docs/api/s3/): PutObject, GetObject, HeadObject,
  * ListObjectsV2, DeleteObject and DeleteObjects.
  *
+ * Runs behind an outbound proxy when `HTTPS_PROXY` is set: the AWS SDK v3 builds
+ * its own agent and reads no proxy variable, so the client is given a
+ * CONNECT-capable one through its `requestHandler` hook
+ * (`@molecule/api-proxy-agent`, resolved against the configured endpoint so a
+ * store listed in `NO_PROXY` keeps connecting directly). Note this covers only
+ * the control plane's calls — the sandbox moves the tar bytes itself over the
+ * presigned URLs, through whatever egress path the sandbox has.
+ *
  * @module
  */
 import type { FlyioConfig } from './types.js';

package/dist/storage.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"storage.d.ts","sourceRoot":"","sources":["../src/storage.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;GA2BG;AAYH,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,YAAY,CAAA;AAE7C,4DAA4D;AAC5D,eAAO,MAAM,uBAAuB,+BAA+B,CAAA;AAEnE;;;;GAIG;AACH,eAAO,MAAM,uBAAuB,SAAS,CAAA;AAE7C;;;;;;GAMG;AACH,eAAO,MAAM,0BAA0B,QAAmB,CAAA;AAE1D,+CAA+C;AAC/C,MAAM,WAAW,YAAY;IAC3B,iDAAiD;IACjD,GAAG,EAAE,MAAM,CAAA;IACX,qBAAqB;IACrB,IAAI,EAAE,MAAM,CAAA;IACZ,sFAAsF;IACtF,YAAY,EAAE,MAAM,GAAG,IAAI,CAAA;CAC5B;AAED;;;;;GAKG;AACH,MAAM,WAAW,WAAW;IAC1B,sEAAsE;IACtE,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAA;IACzB,qFAAqF;IACrF,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAA;IACvB,4EAA4E;IAC5E,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAA;IACvB;;;;OAIG;IACH,IAAI,CAAC,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,YAAY,EAAE,CAAC,CAAA;IAC7C,4FAA4F;IAC5F,IAAI,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC,YAAY,GAAG,IAAI,CAAC,CAAA;IAC/C,+FAA+F;IAC/F,OAAO,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,GAAG,IAAI,CAAC,CAAA;IAC5C,iCAAiC;IACjC,OAAO,CAAC,GAAG,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,EAAE,WAAW,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAAA;IACtE,qEAAqE;IACrE,MAAM,CAAC,IAAI,EAAE,MAAM,EAAE,GAAG,OAAO,CAAC,IAAI,CAAC,CAAA;IACrC,yDAAyD;IACzD,UAAU,CAAC,GAAG,EAAE,MAAM,EAAE,gBAAgB,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,CAAA;IAClE,2DAA2D;IAC3D,UAAU,CAAC,GAAG,EAAE,MAAM,EAAE,gBAAgB,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,CAAA;CACnE;AAED,kEAAkE;AAClE,UAAU,eAAe;IACvB,MAAM,EAAE,MAAM,CAAA;IACd,QAAQ,EAAE,MAAM,GAAG,SAAS,CAAA;IAC5B,MAAM,EAAE,MAAM,CAAA;IACd,WAAW,EAAE,MAAM,CAAA;IACnB,eAAe,EAAE,MAAM,CAAA;IACvB,YAAY,EAAE,MAAM,GAAG,SAAS,CAAA;IAChC,cAAc,EAAE,OAAO,CAAA;IACvB,MAAM,EAAE,MAAM,CAAA;CACf;AAmBD;;;;;;;;;;GAUG;AACH,wBAAgB,sBAAsB,CAAC,MAAM,EAAE,WAAW,GAAG,eAAe,GAAG,IAAI,CAqClF;AAmBD;;;;;;GAMG;AACH,wBAAgB,mBAAmB,CAAC,MAAM,EAAE,WAAW,GAAG,WAAW,GAAG,IAAI,CA6H3E"}
+{"version":3,"file":"storage.d.ts","sourceRoot":"","sources":["../src/storage.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAmCG;AAcH,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,YAAY,CAAA;AAE7C,4DAA4D;AAC5D,eAAO,MAAM,uBAAuB,+BAA+B,CAAA;AAEnE;;;;GAIG;AACH,eAAO,MAAM,uBAAuB,SAAS,CAAA;AAE7C;;;;;;GAMG;AACH,eAAO,MAAM,0BAA0B,QAAmB,CAAA;AAE1D,+CAA+C;AAC/C,MAAM,WAAW,YAAY;IAC3B,iDAAiD;IACjD,GAAG,EAAE,MAAM,CAAA;IACX,qBAAqB;IACrB,IAAI,EAAE,MAAM,CAAA;IACZ,sFAAsF;IACtF,YAAY,EAAE,MAAM,GAAG,IAAI,CAAA;CAC5B;AAED;;;;;GAKG;AACH,MAAM,WAAW,WAAW;IAC1B,sEAAsE;IACtE,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAA;IACzB,qFAAqF;IACrF,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAA;IACvB,4EAA4E;IAC5E,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAA;IACvB;;;;OAIG;IACH,IAAI,CAAC,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,YAAY,EAAE,CAAC,CAAA;IAC7C,4FAA4F;IAC5F,IAAI,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC,YAAY,GAAG,IAAI,CAAC,CAAA;IAC/C,+FAA+F;IAC/F,OAAO,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,GAAG,IAAI,CAAC,CAAA;IAC5C,iCAAiC;IACjC,OAAO,CAAC,GAAG,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,EAAE,WAAW,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAAA;IACtE,qEAAqE;IACrE,MAAM,CAAC,IAAI,EAAE,MAAM,EAAE,GAAG,OAAO,CAAC,IAAI,CAAC,CAAA;IACrC,yDAAyD;IACzD,UAAU,CAAC,GAAG,EAAE,MAAM,EAAE,gBAAgB,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,CAAA;IAClE,2DAA2D;IAC3D,UAAU,CAAC,GAAG,EAAE,MAAM,EAAE,gBAAgB,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,CAAA;CACnE;AAED,kEAAkE;AAClE,UAAU,eAAe;IACvB,MAAM,EAAE,MAAM,CAAA;IACd,QAAQ,EAAE,MAAM,GAAG,SAAS,CAAA;IAC5B,MAAM,EAAE,MAAM,CAAA;IACd,WAAW,EAAE,MAAM,CAAA;IACnB,eAAe,EAAE,MAAM,CAAA;IACvB,YAAY,EAAE,MAAM,GAAG,SAAS,CAAA;IAChC,cAAc,EAAE,OAAO,CAAA;IACvB,MAAM,EAAE,MAAM,CAAA;CACf;AAmBD;;;;;;;;;;GAUG;AACH,wBAAgB,sBAAsB,CAAC,MAAM,EAAE,WAAW,GAAG,eAAe,GAAG,IAAI,CAqClF;AAmBD;;;;;;GAMG;AACH,wBAAgB,mBAAmB,CAAC,MAAM,EAAE,WAAW,GAAG,WAAW,GAAG,IAAI,CAsI3E"}

package/dist/storage.js

@@ -24,10 +24,19 @@
  * (https://www.tigrisdata.com/docs/api/s3/): PutObject, GetObject, HeadObject,
  * ListObjectsV2, DeleteObject and DeleteObjects.
  *
+ * Runs behind an outbound proxy when `HTTPS_PROXY` is set: the AWS SDK v3 builds
+ * its own agent and reads no proxy variable, so the client is given a
+ * CONNECT-capable one through its `requestHandler` hook
+ * (`@molecule/api-proxy-agent`, resolved against the configured endpoint so a
+ * store listed in `NO_PROXY` keeps connecting directly). Note this covers only
+ * the control plane's calls — the sandbox moves the tar bytes itself over the
+ * presigned URLs, through whatever egress path the sandbox has.
+ *
  * @module
  */
 import { DeleteObjectsCommand, GetObjectCommand, HeadObjectCommand, ListObjectsV2Command, PutObjectCommand, S3Client, } from '@aws-sdk/client-s3';
 import { getSignedUrl } from '@aws-sdk/s3-request-presigner';
+import { getProxyAgents } from '@molecule/api-proxy-agent';
 /** Default key prefix for every object this bond writes. */
 export const DEFAULT_TEMPLATE_PREFIX = 'molecule-sandbox-templates';
 /**
@@ -131,9 +140,17 @@ export function createTemplateStore(config) {
     const settings = resolveTemplateStorage(config);
     if (!settings)
         return null;
+    // The AWS SDK v3 builds its own `https.Agent` and reads no proxy variable, so
+    // on a host whose only egress path is a proxy every template read/write would
+    // fail with a bare connection error. `requestHandler` takes NodeHttpHandler
+    // OPTIONS, so the agent goes in with no `@smithy/*` dependency. Resolved
+    // against the endpoint actually in use, so an internal store that NO_PROXY
+    // exempts keeps connecting directly.
+    const proxy = getProxyAgents(settings.endpoint || `https://s3.${settings.region}.amazonaws.com`);
     const client = new S3Client({
         region: settings.region,
         ...(settings.endpoint ? { endpoint: settings.endpoint } : {}),
+        ...(proxy ? { requestHandler: proxy } : {}),
         forcePathStyle: settings.forcePathStyle,
         credentials: {
             accessKeyId: settings.accessKeyId,

package/dist/types.d.ts

@@ -406,6 +406,13 @@ export interface FlyNetworkPolicyPort {
  * One rule in a Fly network policy. `allow` is the only documented action:
  * "Once you create a rule for a given direction, the default for that direction
  * becomes drop."
+ *
+ * There is no destination field, and that is measured rather than assumed
+ * (2026-08-16, live API): `ipv6_cidrs`, `ipv4_cidrs`, `cidrs`, `destinations`,
+ * `apps`, `app`, `to` and `dst` were each POSTed on a rule and each came back
+ * absent — the stored rule is `{action, direction, ports}` and nothing more. An
+ * `allow tcp/5432` rule therefore permits the Machine to reach port 5432 on
+ * every host on the internet.
  */
 export interface FlyNetworkPolicyRule {
     /** Only `allow` is supported by Fly. */
@@ -416,8 +423,16 @@ export interface FlyNetworkPolicyRule {
     ports: FlyNetworkPolicyPort[];
 }
 /**
- * Which Machines in the app a policy applies to. Documented criteria combine
- * with AND, so this provider uses `{ all: true }` alone.
+ * Which Machines in the app a policy applies to — the SOURCE side only. There is
+ * no destination selector: an `apps` array is the one candidate the API answers
+ * about, and it answers `400 {"error":"apps array not currently supported in
+ * selectors"}` (measured 2026-08-16); every other candidate field is silently
+ * dropped. Documented criteria combine with AND, so this provider uses
+ * `{ all: true }` alone.
+ *
+ * The API's LIST response returns this object under the key `netpolSelector`
+ * while accepting it as `selector` on write — which is why nothing here reads it
+ * back by name.
  */
 export interface FlyNetworkPolicySelector {
     /** Match every Machine in the app. */

package/dist/types.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"types.d.ts","sourceRoot":"","sources":["../src/types.ts"],"names":[],"mappings":"AAAA;;;;;;;;;GASG;AAEH;;;;;GAKG;AACH,MAAM,WAAW,WAAW;IAC1B;;;;OAIG;IACH,QAAQ,CAAC,EAAE,MAAM,CAAA;IACjB;;;;;OAKG;IACH,MAAM,CAAC,EAAE,MAAM,CAAA;IACf;;;;OAIG;IACH,OAAO,CAAC,EAAE,MAAM,CAAA;IAChB;;;;;;;;OAQG;IACH,OAAO,CAAC,EAAE,MAAM,CAAA;IAChB;;;;OAIG;IACH,SAAS,CAAC,EAAE,MAAM,CAAA;IAClB;;;;;OAKG;IACH,aAAa,CAAC,EAAE,OAAO,CAAA;IACvB;;;;;OAKG;IACH,OAAO,CAAC,EAAE,MAAM,CAAA;IAChB,gGAAgG;IAChG,MAAM,CAAC,EAAE,MAAM,CAAA;IACf;;;;;OAKG;IACH,SAAS,CAAC,EAAE,MAAM,CAAA;IAClB,wDAAwD;IACxD,UAAU,CAAC,EAAE,MAAM,CAAA;IACnB,kFAAkF;IAClF,cAAc,CAAC,EAAE,MAAM,CAAA;IACvB,kEAAkE;IAClE,eAAe,CAAC,EAAE,MAAM,CAAA;IACxB;;;;OAIG;IACH,eAAe,CAAC,EAAE,MAAM,CAAA;IACxB,6FAA6F;IAC7F,WAAW,CAAC,EAAE,MAAM,CAAA;IACpB;;;;;;;;OAQG;IACH,kBAAkB,CAAC,EAAE,MAAM,CAAA;IAC3B;;;;OAIG;IACH,aAAa,CAAC,EAAE,OAAO,CAAA;IACvB;;;;;;;;OAQG;IACH,QAAQ,CAAC,EAAE,KAAK,GAAG,MAAM,GAAG,SAAS,CAAA;IACrC;;;;;OAKG;IACH,gBAAgB,CAAC,EAAE,OAAO,CAAA;IAC1B,kGAAkG;IAClG,gBAAgB,CAAC,EAAE,MAAM,CAAA;IACzB,+FAA+F;IAC/F,cAAc,CAAC,EAAE,MAAM,CAAA;IACvB,2EAA2E;IAC3E,gBAAgB,CAAC,EAAE,MAAM,CAAA;IACzB;;;;;;;;;;OAUG;IACH,mBAAmB,CAAC,EAAE,MAAM,CAAA;IAC5B;;;;;;;;;;;;;;;;;OAiBG;IACH,kBAAkB,CAAC,EAAE,oBAAoB,EAAE,CAAA;IAC3C,uGAAuG;IACvG,gBAAgB,CAAC,EAAE,MAAM,CAAA;IACzB;;;;;;;;;;;;;;;;;;;;;;;;;;OA0BG;IACH,eAAe,CAAC,EAAE,iBAAiB,EAAE,CAAA;IACrC;;;;;;OAMG;IACH,uBAAuB,CAAC,EAAE,MAAM,CAAA;IAChC;;;;;OAKG;IACH,kBAAkB,CAAC,EAAE,MAAM,EAAE,CAAA;IAC7B,sHAAsH;IACtH,oBAAoB,CAAC,EAAE,MAAM,CAAA;IAC7B;;;;OAIG;IACH,gBAAgB,CAAC,EAAE,MAAM,CAAA;IACzB;;;;;;;;;OASG;IACH,cAAc,CAAC,EAAE,MAAM,CAAA;IACvB;;;;OAIG;IACH,gBAAgB,CAAC,EAAE,MAAM,CAAA;IACzB;;;;;OAKG;IACH,cAAc,CAAC,EAAE,MAAM,CAAA;IACvB,mHAAmH;IACnH,mBAAmB,CAAC,EAAE,MAAM,CAAA;IAC5B,2HAA2H;IAC3H,uBAAuB,CAAC,EAAE,MAAM,CAAA;IAChC,wIAAwI;IACxI,oBAAoB,CAAC,EAAE,MAAM,CAAA;IAC7B;;;;;OAKG;IACH,cAAc,CAAC,EAAE,MAAM,CAAA;IACvB;;;;;OAKG;IACH,sBAAsB,CAAC,EAAE,OAAO,CAAA;IAChC;;;;;;OAMG;IACH,wBAAwB,CAAC,EAAE,MAAM,CAAA;IACjC;;;;OAIG;IACH,yBAAyB,CAAC,EAAE,MAAM,CAAA;IAClC;;;;;OAKG;IACH,uBAAuB,CAAC,EAAE,MAAM,CAAA;CACjC;AAED;;;GAGG;AACH,MAAM,WAAW,UAAU;IACzB,0DAA0D;IAC1D,aAAa,CAAC,EAAE,MAAM,CAAA;IACtB,kFAAkF;IAClF,gBAAgB,CAAC,EAAE,MAAM,CAAA;IACzB,+EAA+E;IAC/E,gBAAgB,CAAC,EAAE,MAAM,CAAA;IACzB,0EAA0E;IAC1E,YAAY,CAAC,EAAE,MAAM,CAAA;IACrB,+EAA+E;IAC/E,eAAe,CAAC,EAAE,MAAM,CAAA;IACxB,+DAA+D;IAC/D,sBAAsB,CAAC,EAAE,MAAM,CAAA;IAC/B,iEAAiE;IACjE,2BAA2B,CAAC,EAAE,MAAM,CAAA;IACpC,2DAA2D;IAC3D,UAAU,CAAC,EAAE,MAAM,CAAA;IACnB,sCAAsC;IACtC,iBAAiB,CAAC,EAAE,MAAM,CAAA;IAC1B;;;;OAIG;IACH,gCAAgC,CAAC,EAAE,MAAM,CAAA;IACzC;;;;;OAKG;IACH,4BAA4B,CAAC,EAAE,MAAM,CAAA;IACrC;;;OAGG;IACH,4BAA4B,CAAC,EAAE,MAAM,CAAA;IACrC,yEAAyE;IACzE,+BAA+B,CAAC,EAAE,MAAM,CAAA;IACxC,+EAA+E;IAC/E,uBAAuB,CAAC,EAAE,MAAM,CAAA;IAChC,qGAAqG;IACrG,WAAW,CAAC,EAAE,MAAM,CAAA;IACpB,oFAAoF;IACpF,yBAAyB,CAAC,EAAE,MAAM,CAAA;IAClC,uGAAuG;IACvG,mBAAmB,CAAC,EAAE,MAAM,CAAA;IAC5B,qGAAqG;IACrG,uBAAuB,CAAC,EAAE,MAAM,CAAA;IAChC,2FAA2F;IAC3F,UAAU,CAAC,EAAE,MAAM,CAAA;IACnB,qFAAqF;IACrF,8BAA8B,CAAC,EAAE,MAAM,CAAA;IACvC,+EAA+E;IAC/E,iBAAiB,CAAC,EAAE,MAAM,CAAA;IAC1B,yFAAyF;IACzF,kCAAkC,CAAC,EAAE,MAAM,CAAA;IAC3C,+EAA+E;IAC/E,qBAAqB,CAAC,EAAE,MAAM,CAAA;IAC9B,yFAAyF;IACzF,8BAA8B,CAAC,EAAE,MAAM,CAAA;IACvC,4CAA4C;IAC5C,iBAAiB,CAAC,EAAE,MAAM,CAAA;IAC1B,8EAA8E;IAC9E,uBAAuB,CAAC,EAAE,MAAM,CAAA;IAChC,sFAAsF;IACtF,iCAAiC,CAAC,EAAE,MAAM,CAAA;CAC3C;AAED;;;;;;;GAOG;AACH,MAAM,WAAW,iBAAiB;IAChC;;;;OAIG;IACH,GAAG,EAAE,MAAM,CAAA;IACX;;;OAGG;IACH,IAAI,EAAE,MAAM,CAAA;CACb;AAED;;;;;;;;;GASG;AACH,MAAM,WAAW,eAAe;IAC9B,oFAAoF;IACpF,EAAE,CAAC,EAAE,MAAM,CAAA;IACX,iEAAiE;IACjE,MAAM,CAAC,EAAE,MAAM,CAAA;IACf,sEAAsE;IACtE,YAAY,CAAC,EAAE,MAAM,CAAA;IACrB,wEAAwE;IACxE,MAAM,CAAC,EAAE,OAAO,CAAA;CACjB;AAED;;;;;;GAMG;AACH,MAAM,WAAW,oBAAoB;IACnC,mDAAmD;IACnD,QAAQ,EAAE,KAAK,GAAG,KAAK,CAAA;IACvB,+CAA+C;IAC/C,IAAI,EAAE,MAAM,CAAA;CACb;AAED;;;;GAIG;AACH,MAAM,WAAW,oBAAoB;IACnC,wCAAwC;IACxC,MAAM,EAAE,OAAO,CAAA;IACf,4EAA4E;IAC5E,SAAS,EAAE,SAAS,GAAG,QAAQ,CAAA;IAC/B,+BAA+B;IAC/B,KAAK,EAAE,oBAAoB,EAAE,CAAA;CAC9B;AAED;;;GAGG;AACH,MAAM,WAAW,wBAAwB;IACvC,sCAAsC;IACtC,GAAG,CAAC,EAAE,OAAO,CAAA;IACb,kCAAkC;IAClC,QAAQ,CAAC,EAAE,KAAK,CAAC;QAAE,EAAE,EAAE,MAAM,CAAA;KAAE,CAAC,CAAA;IAChC,mDAAmD;IACnD,QAAQ,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAA;CAClC;AAED;;;;;GAKG;AACH,MAAM,WAAW,gBAAgB;IAC/B,mEAAmE;IACnE,EAAE,CAAC,EAAE,MAAM,CAAA;IACX,+CAA+C;IAC/C,IAAI,EAAE,MAAM,CAAA;IACZ,sCAAsC;IACtC,QAAQ,EAAE,wBAAwB,CAAA;IAClC,uBAAuB;IACvB,KAAK,EAAE,oBAAoB,EAAE,CAAA;CAC9B;AAED;;;;GAIG;AACH,MAAM,MAAM,eAAe,GACvB,SAAS,GACT,UAAU,GACV,UAAU,GACV,SAAS,GACT,UAAU,GACV,SAAS,GACT,YAAY,GACZ,WAAW,GACX,YAAY,GACZ,UAAU,GACV,WAAW,GACX,UAAU,GACV,UAAU,GACV,YAAY,GACZ,WAAW,GACX,QAAQ,GACR,eAAe,GACf,CAAC,MAAM,GAAG,EAAE,CAAC,CAAA;AAEjB,mFAAmF;AACnF,MAAM,WAAW,UAAU;IACzB,EAAE,EAAE,MAAM,CAAA;IACV,IAAI,CAAC,EAAE,MAAM,CAAA;IACb,kGAAkG;IAClG,KAAK,CAAC,EAAE,eAAe,CAAA;IACvB,MAAM,CAAC,EAAE,MAAM,CAAA;IACf,UAAU,CAAC,EAAE,MAAM,CAAA;IACnB,MAAM,CAAC,EAAE,gBAAgB,CAAA;IACzB,iDAAiD;IACjD,UAAU,CAAC,EAAE,MAAM,CAAA;IACnB;;;;OAIG;IACH,MAAM,CAAC,EAAE,eAAe,EAAE,CAAA;CAC3B;AAED,8CAA8C;AAC9C,MAAM,WAAW,eAAe;IAC9B,mCAAmC;IACnC,IAAI,CAAC,EAAE,MAAM,CAAA;IACb,MAAM,CAAC,EAAE,MAAM,CAAA;IACf,0BAA0B;IAC1B,SAAS,CAAC,EAAE,MAAM,CAAA;CACnB;AAED,wFAAwF;AACxF,MAAM,WAAW,MAAM;IACrB,EAAE,CAAC,EAAE,MAAM,CAAA;IACX,IAAI,EAAE,MAAM,CAAA;IACZ,aAAa,CAAC,EAAE,MAAM,CAAA;CACvB;AAED,kDAAkD;AAClD,MAAM,WAAW,UAAU;IACzB,oEAAoE;IACpE,UAAU,CAAC,EAAE,MAAM,CAAA;IACnB,IAAI,CAAC,EAAE,MAAM,EAAE,CAAA;CAChB;AAED,wFAAwF;AACxF,MAAM,WAAW,aAAc,SAAQ,UAAU;IAC/C,QAAQ,EAAE,MAAM,CAAA;CACjB;AAED,qFAAqF;AACrF,MAAM,WAAW,gBAAgB;IAC/B,KAAK,EAAE,MAAM,CAAA;IACb,GAAG,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAA;IAC5B,QAAQ,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAA;IACjC,KAAK,CAAC,EAAE;QAAE,IAAI,CAAC,EAAE,MAAM,CAAC;QAAC,QAAQ,CAAC,EAAE,MAAM,CAAC;QAAC,SAAS,CAAC,EAAE,MAAM,CAAA;KAAE,CAAA;IAChE,MAAM,CAAC,EAAE,KAAK,CAAC;QAAE,MAAM,CAAC,EAAE,MAAM,CAAC;QAAC,IAAI,CAAC,EAAE,MAAM,CAAC;QAAC,IAAI,EAAE,MAAM,CAAA;KAAE,CAAC,CAAA;IAChE,QAAQ,CAAC,EAAE,iBAAiB,EAAE,CAAA;IAC9B,OAAO,CAAC,EAAE;QAAE,MAAM,CAAC,EAAE,IAAI,GAAG,QAAQ,GAAG,YAAY,GAAG,YAAY,CAAC;QAAC,WAAW,CAAC,EAAE,MAAM,CAAA;KAAE,CAAA;IAC1F,YAAY,CAAC,EAAE,OAAO,CAAA;IACtB,IAAI,CAAC,EAAE;QAAE,IAAI,CAAC,EAAE,MAAM,EAAE,CAAC;QAAC,UAAU,CAAC,EAAE,MAAM,EAAE,CAAC;QAAC,GAAG,CAAC,EAAE,MAAM,EAAE,CAAC;QAAC,GAAG,CAAC,EAAE,OAAO,CAAA;KAAE,CAAA;CACjF;AAED,wEAAwE;AACxE,MAAM,WAAW,iBAAiB;IAChC,QAAQ,EAAE,MAAM,CAAA;IAChB,aAAa,EAAE,MAAM,CAAA;IACrB,KAAK,EAAE,KAAK,CAAC;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,QAAQ,CAAC,EAAE,MAAM,EAAE,CAAC;QAAC,WAAW,CAAC,EAAE,OAAO,CAAA;KAAE,CAAC,CAAA;IAC1E,SAAS,CAAC,EAAE,OAAO,CAAA;IACnB,QAAQ,CAAC,EAAE,KAAK,GAAG,MAAM,GAAG,SAAS,CAAA;IACrC,oBAAoB,CAAC,EAAE,MAAM,CAAA;CAC9B;AAED,iDAAiD;AACjD,MAAM,WAAW,SAAS;IACxB,EAAE,EAAE,MAAM,CAAA;IACV,IAAI,EAAE,MAAM,CAAA;IACZ,KAAK,CAAC,EAAE,MAAM,CAAA;IACd,OAAO,CAAC,EAAE,MAAM,CAAA;IAChB,MAAM,CAAC,EAAE,MAAM,CAAA;IACf,mBAAmB,CAAC,EAAE,MAAM,CAAA;CAC7B;AAED,yFAAyF;AACzF,MAAM,WAAW,eAAe;IAC9B,MAAM,CAAC,EAAE,MAAM,CAAA;IACf,MAAM,CAAC,EAAE,MAAM,CAAA;IACf,SAAS,CAAC,EAAE,MAAM,CAAA;IAClB,WAAW,CAAC,EAAE,MAAM,CAAA;CACrB"}
+{"version":3,"file":"types.d.ts","sourceRoot":"","sources":["../src/types.ts"],"names":[],"mappings":"AAAA;;;;;;;;;GASG;AAEH;;;;;GAKG;AACH,MAAM,WAAW,WAAW;IAC1B;;;;OAIG;IACH,QAAQ,CAAC,EAAE,MAAM,CAAA;IACjB;;;;;OAKG;IACH,MAAM,CAAC,EAAE,MAAM,CAAA;IACf;;;;OAIG;IACH,OAAO,CAAC,EAAE,MAAM,CAAA;IAChB;;;;;;;;OAQG;IACH,OAAO,CAAC,EAAE,MAAM,CAAA;IAChB;;;;OAIG;IACH,SAAS,CAAC,EAAE,MAAM,CAAA;IAClB;;;;;OAKG;IACH,aAAa,CAAC,EAAE,OAAO,CAAA;IACvB;;;;;OAKG;IACH,OAAO,CAAC,EAAE,MAAM,CAAA;IAChB,gGAAgG;IAChG,MAAM,CAAC,EAAE,MAAM,CAAA;IACf;;;;;OAKG;IACH,SAAS,CAAC,EAAE,MAAM,CAAA;IAClB,wDAAwD;IACxD,UAAU,CAAC,EAAE,MAAM,CAAA;IACnB,kFAAkF;IAClF,cAAc,CAAC,EAAE,MAAM,CAAA;IACvB,kEAAkE;IAClE,eAAe,CAAC,EAAE,MAAM,CAAA;IACxB;;;;OAIG;IACH,eAAe,CAAC,EAAE,MAAM,CAAA;IACxB,6FAA6F;IAC7F,WAAW,CAAC,EAAE,MAAM,CAAA;IACpB;;;;;;;;OAQG;IACH,kBAAkB,CAAC,EAAE,MAAM,CAAA;IAC3B;;;;OAIG;IACH,aAAa,CAAC,EAAE,OAAO,CAAA;IACvB;;;;;;;;OAQG;IACH,QAAQ,CAAC,EAAE,KAAK,GAAG,MAAM,GAAG,SAAS,CAAA;IACrC;;;;;OAKG;IACH,gBAAgB,CAAC,EAAE,OAAO,CAAA;IAC1B,kGAAkG;IAClG,gBAAgB,CAAC,EAAE,MAAM,CAAA;IACzB,+FAA+F;IAC/F,cAAc,CAAC,EAAE,MAAM,CAAA;IACvB,2EAA2E;IAC3E,gBAAgB,CAAC,EAAE,MAAM,CAAA;IACzB;;;;;;;;;;OAUG;IACH,mBAAmB,CAAC,EAAE,MAAM,CAAA;IAC5B;;;;;;;;;;;;;;;;;OAiBG;IACH,kBAAkB,CAAC,EAAE,oBAAoB,EAAE,CAAA;IAC3C,uGAAuG;IACvG,gBAAgB,CAAC,EAAE,MAAM,CAAA;IACzB;;;;;;;;;;;;;;;;;;;;;;;;;;OA0BG;IACH,eAAe,CAAC,EAAE,iBAAiB,EAAE,CAAA;IACrC;;;;;;OAMG;IACH,uBAAuB,CAAC,EAAE,MAAM,CAAA;IAChC;;;;;OAKG;IACH,kBAAkB,CAAC,EAAE,MAAM,EAAE,CAAA;IAC7B,sHAAsH;IACtH,oBAAoB,CAAC,EAAE,MAAM,CAAA;IAC7B;;;;OAIG;IACH,gBAAgB,CAAC,EAAE,MAAM,CAAA;IACzB;;;;;;;;;OASG;IACH,cAAc,CAAC,EAAE,MAAM,CAAA;IACvB;;;;OAIG;IACH,gBAAgB,CAAC,EAAE,MAAM,CAAA;IACzB;;;;;OAKG;IACH,cAAc,CAAC,EAAE,MAAM,CAAA;IACvB,mHAAmH;IACnH,mBAAmB,CAAC,EAAE,MAAM,CAAA;IAC5B,2HAA2H;IAC3H,uBAAuB,CAAC,EAAE,MAAM,CAAA;IAChC,wIAAwI;IACxI,oBAAoB,CAAC,EAAE,MAAM,CAAA;IAC7B;;;;;OAKG;IACH,cAAc,CAAC,EAAE,MAAM,CAAA;IACvB;;;;;OAKG;IACH,sBAAsB,CAAC,EAAE,OAAO,CAAA;IAChC;;;;;;OAMG;IACH,wBAAwB,CAAC,EAAE,MAAM,CAAA;IACjC;;;;OAIG;IACH,yBAAyB,CAAC,EAAE,MAAM,CAAA;IAClC;;;;;OAKG;IACH,uBAAuB,CAAC,EAAE,MAAM,CAAA;CACjC;AAED;;;GAGG;AACH,MAAM,WAAW,UAAU;IACzB,0DAA0D;IAC1D,aAAa,CAAC,EAAE,MAAM,CAAA;IACtB,kFAAkF;IAClF,gBAAgB,CAAC,EAAE,MAAM,CAAA;IACzB,+EAA+E;IAC/E,gBAAgB,CAAC,EAAE,MAAM,CAAA;IACzB,0EAA0E;IAC1E,YAAY,CAAC,EAAE,MAAM,CAAA;IACrB,+EAA+E;IAC/E,eAAe,CAAC,EAAE,MAAM,CAAA;IACxB,+DAA+D;IAC/D,sBAAsB,CAAC,EAAE,MAAM,CAAA;IAC/B,iEAAiE;IACjE,2BAA2B,CAAC,EAAE,MAAM,CAAA;IACpC,2DAA2D;IAC3D,UAAU,CAAC,EAAE,MAAM,CAAA;IACnB,sCAAsC;IACtC,iBAAiB,CAAC,EAAE,MAAM,CAAA;IAC1B;;;;OAIG;IACH,gCAAgC,CAAC,EAAE,MAAM,CAAA;IACzC;;;;;OAKG;IACH,4BAA4B,CAAC,EAAE,MAAM,CAAA;IACrC;;;OAGG;IACH,4BAA4B,CAAC,EAAE,MAAM,CAAA;IACrC,yEAAyE;IACzE,+BAA+B,CAAC,EAAE,MAAM,CAAA;IACxC,+EAA+E;IAC/E,uBAAuB,CAAC,EAAE,MAAM,CAAA;IAChC,qGAAqG;IACrG,WAAW,CAAC,EAAE,MAAM,CAAA;IACpB,oFAAoF;IACpF,yBAAyB,CAAC,EAAE,MAAM,CAAA;IAClC,uGAAuG;IACvG,mBAAmB,CAAC,EAAE,MAAM,CAAA;IAC5B,qGAAqG;IACrG,uBAAuB,CAAC,EAAE,MAAM,CAAA;IAChC,2FAA2F;IAC3F,UAAU,CAAC,EAAE,MAAM,CAAA;IACnB,qFAAqF;IACrF,8BAA8B,CAAC,EAAE,MAAM,CAAA;IACvC,+EAA+E;IAC/E,iBAAiB,CAAC,EAAE,MAAM,CAAA;IAC1B,yFAAyF;IACzF,kCAAkC,CAAC,EAAE,MAAM,CAAA;IAC3C,+EAA+E;IAC/E,qBAAqB,CAAC,EAAE,MAAM,CAAA;IAC9B,yFAAyF;IACzF,8BAA8B,CAAC,EAAE,MAAM,CAAA;IACvC,4CAA4C;IAC5C,iBAAiB,CAAC,EAAE,MAAM,CAAA;IAC1B,8EAA8E;IAC9E,uBAAuB,CAAC,EAAE,MAAM,CAAA;IAChC,sFAAsF;IACtF,iCAAiC,CAAC,EAAE,MAAM,CAAA;CAC3C;AAED;;;;;;;GAOG;AACH,MAAM,WAAW,iBAAiB;IAChC;;;;OAIG;IACH,GAAG,EAAE,MAAM,CAAA;IACX;;;OAGG;IACH,IAAI,EAAE,MAAM,CAAA;CACb;AAED;;;;;;;;;GASG;AACH,MAAM,WAAW,eAAe;IAC9B,oFAAoF;IACpF,EAAE,CAAC,EAAE,MAAM,CAAA;IACX,iEAAiE;IACjE,MAAM,CAAC,EAAE,MAAM,CAAA;IACf,sEAAsE;IACtE,YAAY,CAAC,EAAE,MAAM,CAAA;IACrB,wEAAwE;IACxE,MAAM,CAAC,EAAE,OAAO,CAAA;CACjB;AAED;;;;;;GAMG;AACH,MAAM,WAAW,oBAAoB;IACnC,mDAAmD;IACnD,QAAQ,EAAE,KAAK,GAAG,KAAK,CAAA;IACvB,+CAA+C;IAC/C,IAAI,EAAE,MAAM,CAAA;CACb;AAED;;;;;;;;;;;GAWG;AACH,MAAM,WAAW,oBAAoB;IACnC,wCAAwC;IACxC,MAAM,EAAE,OAAO,CAAA;IACf,4EAA4E;IAC5E,SAAS,EAAE,SAAS,GAAG,QAAQ,CAAA;IAC/B,+BAA+B;IAC/B,KAAK,EAAE,oBAAoB,EAAE,CAAA;CAC9B;AAED;;;;;;;;;;;GAWG;AACH,MAAM,WAAW,wBAAwB;IACvC,sCAAsC;IACtC,GAAG,CAAC,EAAE,OAAO,CAAA;IACb,kCAAkC;IAClC,QAAQ,CAAC,EAAE,KAAK,CAAC;QAAE,EAAE,EAAE,MAAM,CAAA;KAAE,CAAC,CAAA;IAChC,mDAAmD;IACnD,QAAQ,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAA;CAClC;AAED;;;;;GAKG;AACH,MAAM,WAAW,gBAAgB;IAC/B,mEAAmE;IACnE,EAAE,CAAC,EAAE,MAAM,CAAA;IACX,+CAA+C;IAC/C,IAAI,EAAE,MAAM,CAAA;IACZ,sCAAsC;IACtC,QAAQ,EAAE,wBAAwB,CAAA;IAClC,uBAAuB;IACvB,KAAK,EAAE,oBAAoB,EAAE,CAAA;CAC9B;AAED;;;;GAIG;AACH,MAAM,MAAM,eAAe,GACvB,SAAS,GACT,UAAU,GACV,UAAU,GACV,SAAS,GACT,UAAU,GACV,SAAS,GACT,YAAY,GACZ,WAAW,GACX,YAAY,GACZ,UAAU,GACV,WAAW,GACX,UAAU,GACV,UAAU,GACV,YAAY,GACZ,WAAW,GACX,QAAQ,GACR,eAAe,GACf,CAAC,MAAM,GAAG,EAAE,CAAC,CAAA;AAEjB,mFAAmF;AACnF,MAAM,WAAW,UAAU;IACzB,EAAE,EAAE,MAAM,CAAA;IACV,IAAI,CAAC,EAAE,MAAM,CAAA;IACb,kGAAkG;IAClG,KAAK,CAAC,EAAE,eAAe,CAAA;IACvB,MAAM,CAAC,EAAE,MAAM,CAAA;IACf,UAAU,CAAC,EAAE,MAAM,CAAA;IACnB,MAAM,CAAC,EAAE,gBAAgB,CAAA;IACzB,iDAAiD;IACjD,UAAU,CAAC,EAAE,MAAM,CAAA;IACnB;;;;OAIG;IACH,MAAM,CAAC,EAAE,eAAe,EAAE,CAAA;CAC3B;AAED,8CAA8C;AAC9C,MAAM,WAAW,eAAe;IAC9B,mCAAmC;IACnC,IAAI,CAAC,EAAE,MAAM,CAAA;IACb,MAAM,CAAC,EAAE,MAAM,CAAA;IACf,0BAA0B;IAC1B,SAAS,CAAC,EAAE,MAAM,CAAA;CACnB;AAED,wFAAwF;AACxF,MAAM,WAAW,MAAM;IACrB,EAAE,CAAC,EAAE,MAAM,CAAA;IACX,IAAI,EAAE,MAAM,CAAA;IACZ,aAAa,CAAC,EAAE,MAAM,CAAA;CACvB;AAED,kDAAkD;AAClD,MAAM,WAAW,UAAU;IACzB,oEAAoE;IACpE,UAAU,CAAC,EAAE,MAAM,CAAA;IACnB,IAAI,CAAC,EAAE,MAAM,EAAE,CAAA;CAChB;AAED,wFAAwF;AACxF,MAAM,WAAW,aAAc,SAAQ,UAAU;IAC/C,QAAQ,EAAE,MAAM,CAAA;CACjB;AAED,qFAAqF;AACrF,MAAM,WAAW,gBAAgB;IAC/B,KAAK,EAAE,MAAM,CAAA;IACb,GAAG,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAA;IAC5B,QAAQ,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAA;IACjC,KAAK,CAAC,EAAE;QAAE,IAAI,CAAC,EAAE,MAAM,CAAC;QAAC,QAAQ,CAAC,EAAE,MAAM,CAAC;QAAC,SAAS,CAAC,EAAE,MAAM,CAAA;KAAE,CAAA;IAChE,MAAM,CAAC,EAAE,KAAK,CAAC;QAAE,MAAM,CAAC,EAAE,MAAM,CAAC;QAAC,IAAI,CAAC,EAAE,MAAM,CAAC;QAAC,IAAI,EAAE,MAAM,CAAA;KAAE,CAAC,CAAA;IAChE,QAAQ,CAAC,EAAE,iBAAiB,EAAE,CAAA;IAC9B,OAAO,CAAC,EAAE;QAAE,MAAM,CAAC,EAAE,IAAI,GAAG,QAAQ,GAAG,YAAY,GAAG,YAAY,CAAC;QAAC,WAAW,CAAC,EAAE,MAAM,CAAA;KAAE,CAAA;IAC1F,YAAY,CAAC,EAAE,OAAO,CAAA;IACtB,IAAI,CAAC,EAAE;QAAE,IAAI,CAAC,EAAE,MAAM,EAAE,CAAC;QAAC,UAAU,CAAC,EAAE,MAAM,EAAE,CAAC;QAAC,GAAG,CAAC,EAAE,MAAM,EAAE,CAAC;QAAC,GAAG,CAAC,EAAE,OAAO,CAAA;KAAE,CAAA;CACjF;AAED,wEAAwE;AACxE,MAAM,WAAW,iBAAiB;IAChC,QAAQ,EAAE,MAAM,CAAA;IAChB,aAAa,EAAE,MAAM,CAAA;IACrB,KAAK,EAAE,KAAK,CAAC;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,QAAQ,CAAC,EAAE,MAAM,EAAE,CAAC;QAAC,WAAW,CAAC,EAAE,OAAO,CAAA;KAAE,CAAC,CAAA;IAC1E,SAAS,CAAC,EAAE,OAAO,CAAA;IACnB,QAAQ,CAAC,EAAE,KAAK,GAAG,MAAM,GAAG,SAAS,CAAA;IACrC,oBAAoB,CAAC,EAAE,MAAM,CAAA;CAC9B;AAED,iDAAiD;AACjD,MAAM,WAAW,SAAS;IACxB,EAAE,EAAE,MAAM,CAAA;IACV,IAAI,EAAE,MAAM,CAAA;IACZ,KAAK,CAAC,EAAE,MAAM,CAAA;IACd,OAAO,CAAC,EAAE,MAAM,CAAA;IAChB,MAAM,CAAC,EAAE,MAAM,CAAA;IACf,mBAAmB,CAAC,EAAE,MAAM,CAAA;CAC7B;AAED,yFAAyF;AACzF,MAAM,WAAW,eAAe;IAC9B,MAAM,CAAC,EAAE,MAAM,CAAA;IACf,MAAM,CAAC,EAAE,MAAM,CAAA;IACf,SAAS,CAAC,EAAE,MAAM,CAAA;IAClB,WAAW,CAAC,EAAE,MAAM,CAAA;CACrB"}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@molecule/api-code-sandbox-flyio",
-  "version": "1.1.0",
+  "version": "1.2.1",
   "description": "Fly.io Machines (Firecracker microVM) code sandbox provider",
   "type": "module",
   "main": "dist/index.js",
@@ -30,11 +30,11 @@
   ],
   "license": "Apache-2.0",
   "devDependencies": {
-    "@molecule/api-bond": "1.0.1",
-    "@molecule/api-code-sandbox": "1.2.0",
+    "@molecule/api-bond": "1.0.2",
+    "@molecule/api-code-sandbox": "1.2.1",
     "@types/node": "26.1.2",
     "typescript": "6.0.3",
-    "vitest": "4.1.10"
+    "vitest": "4.1.11"
   },
   "peerDependencies": {
     "@molecule/api-bond": "^1.0.1",
@@ -51,13 +51,14 @@
     "url": "https://github.com/molecule-dev/molecule.git",
     "directory": "packages/api/bonds/code-sandbox/flyio"
   },
-  "homepage": "https://github.com/molecule-dev/molecule/tree/main/packages/api/bonds/code-sandbox/flyio",
+  "homepage": "https://www.molecule.dev/packages/api-code-sandbox-flyio",
   "bugs": "https://github.com/molecule-dev/molecule/issues",
   "publishConfig": {
     "access": "public"
   },
   "dependencies": {
     "@aws-sdk/client-s3": "3.1098.0",
-    "@aws-sdk/s3-request-presigner": "3.1098.0"
+    "@aws-sdk/s3-request-presigner": "3.1098.0",
+    "@molecule/api-proxy-agent": "1.1.1"
   }
 }