@vercel/sandbox 2.0.0-beta.13 → 2.0.0-beta.18

package/dist/snapshot.js

@@ -1,6 +1,8 @@
 import { APIClient } from "./api-client/api-client.js";
 import "./api-client/index.js";
 import { getCredentials } from "./utils/get-credentials.js";
+import { attachPaginator } from "./utils/paginator.js";
+import { WORKFLOW_DESERIALIZE, WORKFLOW_SERIALIZE } from "@workflow/serde";
 
 //#region src/snapshot.ts
 /**
@@ -10,6 +12,22 @@ import { getCredentials } from "./utils/get-credentials.js";
 * @hideconstructor
 */
 var Snapshot = class Snapshot {
+	/**
+	* Lazily resolve credentials and construct an API client.
+	* This is used in step contexts where the Snapshot was deserialized
+	* without a client (e.g. when crossing workflow/step boundaries).
+	* @internal
+	*/
+	async ensureClient() {
+		"use step";
+		if (this._client) return this._client;
+		const credentials = await getCredentials();
+		this._client = new APIClient({
+			teamId: credentials.teamId,
+			token: credentials.token
+		});
+		return this._client;
+	}
 	/**
 	* Unique ID of this snapshot.
 	*/
@@ -48,31 +66,65 @@ var Snapshot = class Snapshot {
 		return new Date(this.snapshot.expiresAt);
 	}
 	/**
-	* Create a new Snapshot instance.
+	* Serialize a Snapshot instance to plain data for @workflow/serde.
+	*
+	* @param instance - The Snapshot instance to serialize
+	* @returns A plain object containing snapshot metadata
+	*/
+	static [WORKFLOW_SERIALIZE](instance) {
+		return { snapshot: instance.snapshot };
+	}
+	/**
+	* Deserialize a Snapshot from serialized data.
+	*
+	* The deserialized instance uses the serialized metadata synchronously and
+	* lazily creates an API client only when methods perform API requests.
 	*
-	* @param client - API client used to communicate with the backend
-	* @param snapshot - Snapshot metadata
+	* @param data - The serialized snapshot data
+	* @returns The reconstructed Snapshot instance
 	*/
+	static [WORKFLOW_DESERIALIZE](data) {
+		return new Snapshot({ snapshot: data.snapshot });
+	}
 	constructor({ client, snapshot }) {
-		this.client = client;
+		this._client = null;
+		this._client = client ?? null;
 		this.snapshot = snapshot;
 	}
 	/**
 	* Allow to get a list of snapshots for a team narrowed to the given params.
 	* It returns both the snapshots and the pagination metadata to allow getting
 	* the next page of results.
+	*
+	* The returned object is async-iterable to auto-paginate through all pages:
+	*
+	* ```ts
+	* const result = await Snapshot.list({ name: "my-sandbox" });
+	* for await (const snapshot of result) { ... }
+	* // or: await result.toArray();
+	* // or: for await (const page of result.pages()) { ... }
+	* ```
 	*/
 	static async list(params) {
 		"use step";
 		const credentials = await getCredentials(params);
-		return (await new APIClient({
+		const client = new APIClient({
 			teamId: credentials.teamId,
 			token: credentials.token,
 			fetch: params?.fetch
-		}).listSnapshots({
-			...credentials,
-			...params
-		})).json;
+		});
+		const fetchPage = async (cursor) => {
+			return (await client.listSnapshots({
+				...credentials,
+				...params,
+				...cursor !== void 0 && { cursor }
+			})).json;
+		};
+		return attachPaginator(await fetchPage(params?.cursor), {
+			itemsKey: "snapshots",
+			fetchNext: fetchPage,
+			signal: params?.signal
+		});
 	}
 	/**
 	* Retrieve an existing snapshot.
@@ -104,7 +156,7 @@ var Snapshot = class Snapshot {
 	*/
 	async delete(opts) {
 		"use step";
-		this.snapshot = (await this.client.deleteSnapshot({
+		this.snapshot = (await (await this.ensureClient()).deleteSnapshot({
 			snapshotId: this.snapshot.id,
 			signal: opts?.signal
 		})).json.snapshot;

package/dist/snapshot.js.map

@@ -1 +1 @@
-{"version":3,"file":"snapshot.js","names":[],"sources":["../src/snapshot.ts"],"sourcesContent":["import type { WithFetchOptions } from \"./api-client/api-client.js\";\nimport type { SnapshotMetadata } from \"./api-client/index.js\";\nimport { APIClient } from \"./api-client/index.js\";\nimport { type Credentials, getCredentials } from \"./utils/get-credentials.js\";\n\n/** @inline */\ninterface GetSnapshotParams {\n  /**\n   * Unique identifier of the snapshot.\n   */\n  snapshotId: string;\n  /**\n   * An AbortSignal to cancel the operation.\n   */\n  signal?: AbortSignal;\n}\n\n/**\n * A Snapshot is a saved state of a Sandbox that can be used to create new Sandboxes\n *\n * Use {@link Sandbox.snapshot} or {@link Snapshot.get} to construct.\n * @hideconstructor\n */\nexport class Snapshot {\n  private readonly client: APIClient;\n\n  /**\n   * Unique ID of this snapshot.\n   */\n  public get snapshotId(): string {\n    return this.snapshot.id;\n  }\n\n  /**\n   * The ID of the session from which this snapshot was created.\n   */\n  public get sourceSessionId(): string {\n    return this.snapshot.sourceSessionId;\n  }\n\n  /**\n   * The status of the snapshot.\n   */\n  public get status(): SnapshotMetadata[\"status\"] {\n    return this.snapshot.status;\n  }\n\n  /**\n   * The size of the snapshot in bytes, or null if not available.\n   */\n  public get sizeBytes(): number {\n    return this.snapshot.sizeBytes;\n  }\n\n  /**\n   * The creation date of this snapshot.\n   */\n  public get createdAt(): Date {\n    return new Date(this.snapshot.createdAt);\n  }\n\n  /**\n   * The expiration date of this snapshot, or undefined if it does not expire.\n   */\n  public get expiresAt(): Date | undefined {\n    if (this.snapshot.expiresAt === undefined) {\n      return undefined;\n    }\n\n    return new Date(this.snapshot.expiresAt);\n  }\n\n  /**\n   * Internal metadata about this snapshot.\n   */\n  private snapshot: SnapshotMetadata;\n\n  /**\n   * Create a new Snapshot instance.\n   *\n   * @param client - API client used to communicate with the backend\n   * @param snapshot - Snapshot metadata\n   */\n  constructor({\n    client,\n    snapshot,\n  }: {\n    client: APIClient;\n    snapshot: SnapshotMetadata;\n  }) {\n    this.client = client;\n    this.snapshot = snapshot;\n  }\n\n  /**\n   * Allow to get a list of snapshots for a team narrowed to the given params.\n   * It returns both the snapshots and the pagination metadata to allow getting\n   * the next page of results.\n   */\n  static async list(\n    params?: Partial<Parameters<APIClient[\"listSnapshots\"]>[0]> &\n      Partial<Credentials> &\n      WithFetchOptions,\n  ) {\n    \"use step\";\n    const credentials = await getCredentials(params);\n    const client = new APIClient({\n      teamId: credentials.teamId,\n      token: credentials.token,\n      fetch: params?.fetch,\n    });\n    const response = await client.listSnapshots({\n      ...credentials,\n      ...params,\n    });\n    return response.json;\n  }\n\n  /**\n   * Retrieve an existing snapshot.\n   *\n   * @param params - Get parameters and optional credentials.\n   * @returns A promise resolving to the {@link Sandbox}.\n   */\n  static async get(\n    params: GetSnapshotParams | (GetSnapshotParams & Credentials),\n  ): Promise<Snapshot> {\n    \"use step\";\n    const credentials = await getCredentials(params);\n    const client = new APIClient({\n      teamId: credentials.teamId,\n      token: credentials.token,\n    });\n\n    const sandbox = await client.getSnapshot({\n      snapshotId: params.snapshotId,\n      signal: params.signal,\n    });\n\n    return new Snapshot({\n      client,\n      snapshot: sandbox.json.snapshot,\n    });\n  }\n\n  /**\n   * Delete this snapshot.\n   *\n   * @param opts - Optional parameters.\n   * @param opts.signal - An AbortSignal to cancel the operation.\n   * @returns A promise that resolves once the snapshot has been deleted.\n   */\n  async delete(opts?: { signal?: AbortSignal }): Promise<void> {\n    \"use step\";\n    const response = await this.client!.deleteSnapshot({\n      snapshotId: this.snapshot.id,\n      signal: opts?.signal,\n    });\n\n    this.snapshot = response.json.snapshot;\n  }\n}\n"],"mappings":";;;;;;;;;;;AAuBA,IAAa,WAAb,MAAa,SAAS;;;;CAMpB,IAAW,aAAqB;AAC9B,SAAO,KAAK,SAAS;;;;;CAMvB,IAAW,kBAA0B;AACnC,SAAO,KAAK,SAAS;;;;;CAMvB,IAAW,SAAqC;AAC9C,SAAO,KAAK,SAAS;;;;;CAMvB,IAAW,YAAoB;AAC7B,SAAO,KAAK,SAAS;;;;;CAMvB,IAAW,YAAkB;AAC3B,SAAO,IAAI,KAAK,KAAK,SAAS,UAAU;;;;;CAM1C,IAAW,YAA8B;AACvC,MAAI,KAAK,SAAS,cAAc,OAC9B;AAGF,SAAO,IAAI,KAAK,KAAK,SAAS,UAAU;;;;;;;;CAc1C,YAAY,EACV,QACA,YAIC;AACD,OAAK,SAAS;AACd,OAAK,WAAW;;;;;;;CAQlB,aAAa,KACX,QAGA;AACA;EACA,MAAM,cAAc,MAAM,eAAe,OAAO;AAUhD,UAJiB,MALF,IAAI,UAAU;GAC3B,QAAQ,YAAY;GACpB,OAAO,YAAY;GACnB,OAAO,QAAQ;GAChB,CAAC,CAC4B,cAAc;GAC1C,GAAG;GACH,GAAG;GACJ,CAAC,EACc;;;;;;;;CASlB,aAAa,IACX,QACmB;AACnB;EACA,MAAM,cAAc,MAAM,eAAe,OAAO;EAChD,MAAM,SAAS,IAAI,UAAU;GAC3B,QAAQ,YAAY;GACpB,OAAO,YAAY;GACpB,CAAC;AAOF,SAAO,IAAI,SAAS;GAClB;GACA,WAPc,MAAM,OAAO,YAAY;IACvC,YAAY,OAAO;IACnB,QAAQ,OAAO;IAChB,CAAC,EAIkB,KAAK;GACxB,CAAC;;;;;;;;;CAUJ,MAAM,OAAO,MAAgD;AAC3D;AAMA,OAAK,YALY,MAAM,KAAK,OAAQ,eAAe;GACjD,YAAY,KAAK,SAAS;GAC1B,QAAQ,MAAM;GACf,CAAC,EAEuB,KAAK"}
+{"version":3,"file":"snapshot.js","names":[],"sources":["../src/snapshot.ts"],"sourcesContent":["import { WORKFLOW_DESERIALIZE, WORKFLOW_SERIALIZE } from \"@workflow/serde\";\nimport type { WithFetchOptions } from \"./api-client/api-client.js\";\nimport type { SnapshotMetadata } from \"./api-client/index.js\";\nimport { APIClient } from \"./api-client/index.js\";\nimport { type Credentials, getCredentials } from \"./utils/get-credentials.js\";\nimport { attachPaginator } from \"./utils/paginator.js\";\n\nexport interface SerializedSnapshot {\n  snapshot: SnapshotMetadata;\n}\n\n/** @inline */\ninterface GetSnapshotParams {\n  /**\n   * Unique identifier of the snapshot.\n   */\n  snapshotId: string;\n  /**\n   * An AbortSignal to cancel the operation.\n   */\n  signal?: AbortSignal;\n}\n\n/**\n * A Snapshot is a saved state of a Sandbox that can be used to create new Sandboxes\n *\n * Use {@link Sandbox.snapshot} or {@link Snapshot.get} to construct.\n * @hideconstructor\n */\nexport class Snapshot {\n  private _client: APIClient | null = null;\n\n  /**\n   * Lazily resolve credentials and construct an API client.\n   * This is used in step contexts where the Snapshot was deserialized\n   * without a client (e.g. when crossing workflow/step boundaries).\n   * @internal\n   */\n  private async ensureClient(): Promise<APIClient> {\n    \"use step\";\n    if (this._client) return this._client;\n    const credentials = await getCredentials();\n    this._client = new APIClient({\n      teamId: credentials.teamId,\n      token: credentials.token,\n    });\n    return this._client;\n  }\n\n  /**\n   * Unique ID of this snapshot.\n   */\n  public get snapshotId(): string {\n    return this.snapshot.id;\n  }\n\n  /**\n   * The ID of the session from which this snapshot was created.\n   */\n  public get sourceSessionId(): string {\n    return this.snapshot.sourceSessionId;\n  }\n\n  /**\n   * The status of the snapshot.\n   */\n  public get status(): SnapshotMetadata[\"status\"] {\n    return this.snapshot.status;\n  }\n\n  /**\n   * The size of the snapshot in bytes, or null if not available.\n   */\n  public get sizeBytes(): number {\n    return this.snapshot.sizeBytes;\n  }\n\n  /**\n   * The creation date of this snapshot.\n   */\n  public get createdAt(): Date {\n    return new Date(this.snapshot.createdAt);\n  }\n\n  /**\n   * The expiration date of this snapshot, or undefined if it does not expire.\n   */\n  public get expiresAt(): Date | undefined {\n    if (this.snapshot.expiresAt === undefined) {\n      return undefined;\n    }\n\n    return new Date(this.snapshot.expiresAt);\n  }\n\n  /**\n   * Internal metadata about this snapshot.\n   */\n  private snapshot: SnapshotMetadata;\n\n  /**\n   * Serialize a Snapshot instance to plain data for @workflow/serde.\n   *\n   * @param instance - The Snapshot instance to serialize\n   * @returns A plain object containing snapshot metadata\n   */\n  static [WORKFLOW_SERIALIZE](instance: Snapshot): SerializedSnapshot {\n    return {\n      snapshot: instance.snapshot,\n    };\n  }\n\n  /**\n   * Deserialize a Snapshot from serialized data.\n   *\n   * The deserialized instance uses the serialized metadata synchronously and\n   * lazily creates an API client only when methods perform API requests.\n   *\n   * @param data - The serialized snapshot data\n   * @returns The reconstructed Snapshot instance\n   */\n  static [WORKFLOW_DESERIALIZE](data: SerializedSnapshot): Snapshot {\n    return new Snapshot({\n      snapshot: data.snapshot,\n    });\n  }\n\n  constructor({\n    client,\n    snapshot,\n  }: {\n    client?: APIClient;\n    snapshot: SnapshotMetadata;\n  }) {\n    this._client = client ?? null;\n    this.snapshot = snapshot;\n  }\n\n  /**\n   * Allow to get a list of snapshots for a team narrowed to the given params.\n   * It returns both the snapshots and the pagination metadata to allow getting\n   * the next page of results.\n   *\n   * The returned object is async-iterable to auto-paginate through all pages:\n   *\n   * ```ts\n   * const result = await Snapshot.list({ name: \"my-sandbox\" });\n   * for await (const snapshot of result) { ... }\n   * // or: await result.toArray();\n   * // or: for await (const page of result.pages()) { ... }\n   * ```\n   */\n  static async list(\n    params?: Partial<Parameters<APIClient[\"listSnapshots\"]>[0]> &\n      Partial<Credentials> &\n      WithFetchOptions,\n  ) {\n    \"use step\";\n    const credentials = await getCredentials(params);\n    const client = new APIClient({\n      teamId: credentials.teamId,\n      token: credentials.token,\n      fetch: params?.fetch,\n    });\n    const fetchPage = async (cursor?: string) => {\n      const response = await client.listSnapshots({\n        ...credentials,\n        ...params,\n        ...(cursor !== undefined && { cursor }),\n      });\n      return response.json;\n    };\n    const firstPage = await fetchPage(params?.cursor);\n    return attachPaginator(firstPage, {\n      itemsKey: \"snapshots\",\n      fetchNext: fetchPage,\n      signal: params?.signal,\n    });\n  }\n\n  /**\n   * Retrieve an existing snapshot.\n   *\n   * @param params - Get parameters and optional credentials.\n   * @returns A promise resolving to the {@link Sandbox}.\n   */\n  static async get(\n    params: GetSnapshotParams | (GetSnapshotParams & Credentials),\n  ): Promise<Snapshot> {\n    \"use step\";\n    const credentials = await getCredentials(params);\n    const client = new APIClient({\n      teamId: credentials.teamId,\n      token: credentials.token,\n    });\n\n    const sandbox = await client.getSnapshot({\n      snapshotId: params.snapshotId,\n      signal: params.signal,\n    });\n\n    return new Snapshot({\n      client,\n      snapshot: sandbox.json.snapshot,\n    });\n  }\n\n  /**\n   * Delete this snapshot.\n   *\n   * @param opts - Optional parameters.\n   * @param opts.signal - An AbortSignal to cancel the operation.\n   * @returns A promise that resolves once the snapshot has been deleted.\n   */\n  async delete(opts?: { signal?: AbortSignal }): Promise<void> {\n    \"use step\";\n    const client = await this.ensureClient();\n    const response = await client.deleteSnapshot({\n      snapshotId: this.snapshot.id,\n      signal: opts?.signal,\n    });\n\n    this.snapshot = response.json.snapshot;\n  }\n}\n"],"mappings":";;;;;;;;;;;;;AA6BA,IAAa,WAAb,MAAa,SAAS;;;;;;;CASpB,MAAc,eAAmC;AAC/C;AACA,MAAI,KAAK,QAAS,QAAO,KAAK;EAC9B,MAAM,cAAc,MAAM,gBAAgB;AAC1C,OAAK,UAAU,IAAI,UAAU;GAC3B,QAAQ,YAAY;GACpB,OAAO,YAAY;GACpB,CAAC;AACF,SAAO,KAAK;;;;;CAMd,IAAW,aAAqB;AAC9B,SAAO,KAAK,SAAS;;;;;CAMvB,IAAW,kBAA0B;AACnC,SAAO,KAAK,SAAS;;;;;CAMvB,IAAW,SAAqC;AAC9C,SAAO,KAAK,SAAS;;;;;CAMvB,IAAW,YAAoB;AAC7B,SAAO,KAAK,SAAS;;;;;CAMvB,IAAW,YAAkB;AAC3B,SAAO,IAAI,KAAK,KAAK,SAAS,UAAU;;;;;CAM1C,IAAW,YAA8B;AACvC,MAAI,KAAK,SAAS,cAAc,OAC9B;AAGF,SAAO,IAAI,KAAK,KAAK,SAAS,UAAU;;;;;;;;CAc1C,QAAQ,oBAAoB,UAAwC;AAClE,SAAO,EACL,UAAU,SAAS,UACpB;;;;;;;;;;;CAYH,QAAQ,sBAAsB,MAAoC;AAChE,SAAO,IAAI,SAAS,EAClB,UAAU,KAAK,UAChB,CAAC;;CAGJ,YAAY,EACV,QACA,YAIC;OAvGK,UAA4B;AAwGlC,OAAK,UAAU,UAAU;AACzB,OAAK,WAAW;;;;;;;;;;;;;;;;CAiBlB,aAAa,KACX,QAGA;AACA;EACA,MAAM,cAAc,MAAM,eAAe,OAAO;EAChD,MAAM,SAAS,IAAI,UAAU;GAC3B,QAAQ,YAAY;GACpB,OAAO,YAAY;GACnB,OAAO,QAAQ;GAChB,CAAC;EACF,MAAM,YAAY,OAAO,WAAoB;AAM3C,WALiB,MAAM,OAAO,cAAc;IAC1C,GAAG;IACH,GAAG;IACH,GAAI,WAAW,UAAa,EAAE,QAAQ;IACvC,CAAC,EACc;;AAGlB,SAAO,gBADW,MAAM,UAAU,QAAQ,OAAO,EACf;GAChC,UAAU;GACV,WAAW;GACX,QAAQ,QAAQ;GACjB,CAAC;;;;;;;;CASJ,aAAa,IACX,QACmB;AACnB;EACA,MAAM,cAAc,MAAM,eAAe,OAAO;EAChD,MAAM,SAAS,IAAI,UAAU;GAC3B,QAAQ,YAAY;GACpB,OAAO,YAAY;GACpB,CAAC;AAOF,SAAO,IAAI,SAAS;GAClB;GACA,WAPc,MAAM,OAAO,YAAY;IACvC,YAAY,OAAO;IACnB,QAAQ,OAAO;IAChB,CAAC,EAIkB,KAAK;GACxB,CAAC;;;;;;;;;CAUJ,MAAM,OAAO,MAAgD;AAC3D;AAOA,OAAK,YALY,OADF,MAAM,KAAK,cAAc,EACV,eAAe;GAC3C,YAAY,KAAK,SAAS;GAC1B,QAAQ,MAAM;GACf,CAAC,EAEuB,KAAK"}

package/dist/utils/network-policy.cjs

@@ -1,53 +1,37 @@
 
 //#region src/utils/network-policy.ts
 function toAPINetworkPolicy(policy) {
-	if (policy === "allow-all") return { mode: "allow-all" };
-	if (policy === "deny-all") return { mode: "deny-all" };
-	if (policy.allow && !Array.isArray(policy.allow)) {
-		const allowedDomains = Object.keys(policy.allow);
-		const injectionRules = [];
-		for (const [domain, rules] of Object.entries(policy.allow)) {
-			const merged = {};
-			for (const rule of rules) for (const t of rule.transform ?? []) Object.assign(merged, t.headers);
-			if (Object.keys(merged).length > 0) injectionRules.push({
-				domain,
-				headers: merged
-			});
-		}
-		return {
-			mode: "custom",
-			...allowedDomains.length > 0 && { allowedDomains },
-			...injectionRules.length > 0 && { injectionRules },
-			...policy.subnets?.allow && { allowedCIDRs: policy.subnets.allow },
-			...policy.subnets?.deny && { deniedCIDRs: policy.subnets.deny }
-		};
-	}
-	return {
-		mode: "custom",
-		...policy.allow && { allowedDomains: policy.allow },
-		...policy.subnets?.allow && { allowedCIDRs: policy.subnets.allow },
-		...policy.subnets?.deny && { deniedCIDRs: policy.subnets.deny }
-	};
+	if (policy === "allow-all" || policy === "deny-all") return { mode: policy };
+	return policy;
 }
 function fromAPINetworkPolicy(api) {
-	if (api.mode === "allow-all") return "allow-all";
-	if (api.mode === "deny-all") return "deny-all";
+	if (api.mode === "allow-all" || api.mode === "deny-all") return api.mode;
 	const subnets = api.allowedCIDRs || api.deniedCIDRs ? { subnets: {
 		...api.allowedCIDRs && { allow: api.allowedCIDRs },
 		...api.deniedCIDRs && { deny: api.deniedCIDRs }
 	} } : void 0;
-	if (api.injectionRules && api.injectionRules.length > 0) {
-		const rulesByDomain = new Map(api.injectionRules.map((r) => [r.domain, r.headerNames ?? []]));
-		const allow = {};
-		for (const domain of api.allowedDomains ?? []) {
-			const headerNames = rulesByDomain.get(domain);
-			if (headerNames && headerNames.length > 0) allow[domain] = [{ transform: [{ headers: Object.fromEntries(headerNames.map((n) => [n, "<redacted>"])) }] }];
-			else allow[domain] = [];
-		}
-		for (const rule of api.injectionRules) if (!(rule.domain in allow)) {
+	if (api.injectionRules && api.injectionRules.length > 0 || api.forwardRules && api.forwardRules.length > 0) {
+		const rulesByDomain = /* @__PURE__ */ new Map();
+		for (const rule of api.injectionRules ?? []) {
 			const headers = Object.fromEntries((rule.headerNames ?? []).map((n) => [n, "<redacted>"]));
-			allow[rule.domain] = [{ transform: [{ headers }] }];
+			const rules = rulesByDomain.get(rule.domain) ?? [];
+			rules.push({
+				...rule.match ? { match: rule.match } : {},
+				transform: [{ headers }]
+			});
+			rulesByDomain.set(rule.domain, rules);
 		}
+		for (const rule of api.forwardRules ?? []) {
+			const rules = rulesByDomain.get(rule.domain) ?? [];
+			rules.push({
+				...rule.match ? { match: rule.match } : {},
+				forwardURL: rule.forwardURL
+			});
+			rulesByDomain.set(rule.domain, rules);
+		}
+		const allow = {};
+		for (const domain of api.allowedDomains ?? []) allow[domain] = rulesByDomain.get(domain) ?? [];
+		for (const rule of [...api.injectionRules ?? [], ...api.forwardRules ?? []]) if (!(rule.domain in allow)) allow[rule.domain] = rulesByDomain.get(rule.domain) ?? [];
 		return {
 			allow,
 			...subnets

package/dist/utils/network-policy.cjs.map

@@ -1 +1 @@
-{"version":3,"file":"network-policy.cjs","names":["injectionRules: z.infer<typeof InjectionRuleValidator>[]","merged: Record<string, string>","allow: Record<string, NetworkPolicyRule[]>"],"sources":["../../src/utils/network-policy.ts"],"sourcesContent":["import { z } from \"zod\";\nimport { NetworkPolicy, NetworkPolicyRule } from \"../network-policy.js\";\nimport {\n  NetworkPolicyValidator,\n  InjectionRuleValidator,\n} from \"../api-client/validators.js\";\n\ntype APINetworkPolicy = z.infer<typeof NetworkPolicyValidator>;\n\nexport function toAPINetworkPolicy(policy: NetworkPolicy): APINetworkPolicy {\n  if (policy === \"allow-all\") return { mode: \"allow-all\" };\n  if (policy === \"deny-all\") return { mode: \"deny-all\" };\n\n  if (policy.allow && !Array.isArray(policy.allow)) {\n    const allowedDomains = Object.keys(policy.allow);\n    const injectionRules: z.infer<typeof InjectionRuleValidator>[] = [];\n\n    for (const [domain, rules] of Object.entries(policy.allow)) {\n      const merged: Record<string, string> = {};\n      for (const rule of rules) {\n        for (const t of rule.transform ?? []) {\n          Object.assign(merged, t.headers);\n        }\n      }\n      if (Object.keys(merged).length > 0) {\n        injectionRules.push({ domain, headers: merged });\n      }\n    }\n\n    return {\n      mode: \"custom\",\n      ...(allowedDomains.length > 0 && { allowedDomains }),\n      ...(injectionRules.length > 0 && { injectionRules }),\n      ...(policy.subnets?.allow && { allowedCIDRs: policy.subnets.allow }),\n      ...(policy.subnets?.deny && { deniedCIDRs: policy.subnets.deny }),\n    };\n  }\n\n  return {\n    mode: \"custom\",\n    ...(policy.allow && { allowedDomains: policy.allow }),\n    ...(policy.subnets?.allow && { allowedCIDRs: policy.subnets.allow }),\n    ...(policy.subnets?.deny && { deniedCIDRs: policy.subnets.deny }),\n  };\n}\n\nexport function fromAPINetworkPolicy(api: APINetworkPolicy): NetworkPolicy {\n  if (api.mode === \"allow-all\") return \"allow-all\";\n  if (api.mode === \"deny-all\") return \"deny-all\";\n\n  const subnets =\n    api.allowedCIDRs || api.deniedCIDRs\n      ? {\n          subnets: {\n            ...(api.allowedCIDRs && { allow: api.allowedCIDRs }),\n            ...(api.deniedCIDRs && { deny: api.deniedCIDRs }),\n          },\n        }\n      : undefined;\n\n  // If injectionRules are present, reconstruct the record form.\n  // The API returns headerNames (secret values are stripped), so we\n  // populate each header value with \"<redacted>\".\n  if (api.injectionRules && api.injectionRules.length > 0) {\n    const rulesByDomain = new Map(\n      api.injectionRules.map((r) => [r.domain, r.headerNames ?? []]),\n    );\n\n    const allow: Record<string, NetworkPolicyRule[]> = {};\n    for (const domain of api.allowedDomains ?? []) {\n      const headerNames = rulesByDomain.get(domain);\n      if (headerNames && headerNames.length > 0) {\n        const headers = Object.fromEntries(\n          headerNames.map((n) => [n, \"<redacted>\"]),\n        );\n        allow[domain] = [{ transform: [{ headers }] }];\n      } else {\n        allow[domain] = [];\n      }\n    }\n    // Include injection rules for domains not in allowedDomains\n    for (const rule of api.injectionRules) {\n      if (!(rule.domain in allow)) {\n        const headers = Object.fromEntries(\n          (rule.headerNames ?? []).map((n) => [n, \"<redacted>\"]),\n        );\n        allow[rule.domain] = [{ transform: [{ headers }] }];\n      }\n    }\n\n    return { allow, ...subnets };\n  }\n\n  return {\n    ...(api.allowedDomains && { allow: api.allowedDomains }),\n    ...subnets,\n  };\n}\n"],"mappings":";;AASA,SAAgB,mBAAmB,QAAyC;AAC1E,KAAI,WAAW,YAAa,QAAO,EAAE,MAAM,aAAa;AACxD,KAAI,WAAW,WAAY,QAAO,EAAE,MAAM,YAAY;AAEtD,KAAI,OAAO,SAAS,CAAC,MAAM,QAAQ,OAAO,MAAM,EAAE;EAChD,MAAM,iBAAiB,OAAO,KAAK,OAAO,MAAM;EAChD,MAAMA,iBAA2D,EAAE;AAEnE,OAAK,MAAM,CAAC,QAAQ,UAAU,OAAO,QAAQ,OAAO,MAAM,EAAE;GAC1D,MAAMC,SAAiC,EAAE;AACzC,QAAK,MAAM,QAAQ,MACjB,MAAK,MAAM,KAAK,KAAK,aAAa,EAAE,CAClC,QAAO,OAAO,QAAQ,EAAE,QAAQ;AAGpC,OAAI,OAAO,KAAK,OAAO,CAAC,SAAS,EAC/B,gBAAe,KAAK;IAAE;IAAQ,SAAS;IAAQ,CAAC;;AAIpD,SAAO;GACL,MAAM;GACN,GAAI,eAAe,SAAS,KAAK,EAAE,gBAAgB;GACnD,GAAI,eAAe,SAAS,KAAK,EAAE,gBAAgB;GACnD,GAAI,OAAO,SAAS,SAAS,EAAE,cAAc,OAAO,QAAQ,OAAO;GACnE,GAAI,OAAO,SAAS,QAAQ,EAAE,aAAa,OAAO,QAAQ,MAAM;GACjE;;AAGH,QAAO;EACL,MAAM;EACN,GAAI,OAAO,SAAS,EAAE,gBAAgB,OAAO,OAAO;EACpD,GAAI,OAAO,SAAS,SAAS,EAAE,cAAc,OAAO,QAAQ,OAAO;EACnE,GAAI,OAAO,SAAS,QAAQ,EAAE,aAAa,OAAO,QAAQ,MAAM;EACjE;;AAGH,SAAgB,qBAAqB,KAAsC;AACzE,KAAI,IAAI,SAAS,YAAa,QAAO;AACrC,KAAI,IAAI,SAAS,WAAY,QAAO;CAEpC,MAAM,UACJ,IAAI,gBAAgB,IAAI,cACpB,EACE,SAAS;EACP,GAAI,IAAI,gBAAgB,EAAE,OAAO,IAAI,cAAc;EACnD,GAAI,IAAI,eAAe,EAAE,MAAM,IAAI,aAAa;EACjD,EACF,GACD;AAKN,KAAI,IAAI,kBAAkB,IAAI,eAAe,SAAS,GAAG;EACvD,MAAM,gBAAgB,IAAI,IACxB,IAAI,eAAe,KAAK,MAAM,CAAC,EAAE,QAAQ,EAAE,eAAe,EAAE,CAAC,CAAC,CAC/D;EAED,MAAMC,QAA6C,EAAE;AACrD,OAAK,MAAM,UAAU,IAAI,kBAAkB,EAAE,EAAE;GAC7C,MAAM,cAAc,cAAc,IAAI,OAAO;AAC7C,OAAI,eAAe,YAAY,SAAS,EAItC,OAAM,UAAU,CAAC,EAAE,WAAW,CAAC,EAAE,SAHjB,OAAO,YACrB,YAAY,KAAK,MAAM,CAAC,GAAG,aAAa,CAAC,CAC1C,EACyC,CAAC,EAAE,CAAC;OAE9C,OAAM,UAAU,EAAE;;AAItB,OAAK,MAAM,QAAQ,IAAI,eACrB,KAAI,EAAE,KAAK,UAAU,QAAQ;GAC3B,MAAM,UAAU,OAAO,aACpB,KAAK,eAAe,EAAE,EAAE,KAAK,MAAM,CAAC,GAAG,aAAa,CAAC,CACvD;AACD,SAAM,KAAK,UAAU,CAAC,EAAE,WAAW,CAAC,EAAE,SAAS,CAAC,EAAE,CAAC;;AAIvD,SAAO;GAAE;GAAO,GAAG;GAAS;;AAG9B,QAAO;EACL,GAAI,IAAI,kBAAkB,EAAE,OAAO,IAAI,gBAAgB;EACvD,GAAG;EACJ"}
+{"version":3,"file":"network-policy.cjs","names":["allow: Record<string, NetworkPolicyRule[]>"],"sources":["../../src/utils/network-policy.ts"],"sourcesContent":["import { z } from \"zod\";\nimport { NetworkPolicy, NetworkPolicyRule } from \"../network-policy.js\";\nimport {\n  NetworkPolicyRequestValidator,\n  NetworkPolicyResponseValidator,\n} from \"../api-client/validators.js\";\n\ntype APIRequestNetworkPolicy = z.infer<typeof NetworkPolicyRequestValidator>;\ntype APIResponseNetworkPolicy = z.infer<typeof NetworkPolicyResponseValidator>;\n\nexport function toAPINetworkPolicy(\n  policy: NetworkPolicy,\n): APIRequestNetworkPolicy {\n  if (policy === \"allow-all\" || policy === \"deny-all\") {\n    return { mode: policy };\n  }\n\n  return policy;\n}\n\nexport function fromAPINetworkPolicy(\n  api: APIResponseNetworkPolicy,\n): NetworkPolicy {\n  if (api.mode === \"allow-all\" || api.mode === \"deny-all\") {\n    return api.mode;\n  }\n\n  const subnets =\n    api.allowedCIDRs || api.deniedCIDRs\n      ? {\n          subnets: {\n            ...(api.allowedCIDRs && { allow: api.allowedCIDRs }),\n            ...(api.deniedCIDRs && { deny: api.deniedCIDRs }),\n          },\n        }\n      : undefined;\n\n  // If L7 rules are present, reconstruct the record form.\n  // The API returns headerNames (secret values are stripped), so we\n  // populate each header value with \"<redacted>\".\n  if (\n    (api.injectionRules && api.injectionRules.length > 0) ||\n    (api.forwardRules && api.forwardRules.length > 0)\n  ) {\n    const rulesByDomain = new Map<string, NetworkPolicyRule[]>();\n    for (const rule of api.injectionRules ?? []) {\n      const headers = Object.fromEntries(\n        (rule.headerNames ?? []).map((n) => [n, \"<redacted>\"]),\n      );\n      const rules = rulesByDomain.get(rule.domain) ?? [];\n      rules.push({\n        ...(rule.match ? { match: rule.match } : {}),\n        transform: [{ headers }],\n      });\n      rulesByDomain.set(rule.domain, rules);\n    }\n    for (const rule of api.forwardRules ?? []) {\n      const rules = rulesByDomain.get(rule.domain) ?? [];\n      rules.push({\n        ...(rule.match ? { match: rule.match } : {}),\n        forwardURL: rule.forwardURL,\n      });\n      rulesByDomain.set(rule.domain, rules);\n    }\n\n    const allow: Record<string, NetworkPolicyRule[]> = {};\n    for (const domain of api.allowedDomains ?? []) {\n      allow[domain] = rulesByDomain.get(domain) ?? [];\n    }\n    // Include L7 rules for domains not in allowedDomains\n    for (const rule of [...(api.injectionRules ?? []), ...(api.forwardRules ?? [])]) {\n      if (!(rule.domain in allow)) {\n        allow[rule.domain] = rulesByDomain.get(rule.domain) ?? [];\n      }\n    }\n\n    return { allow, ...subnets };\n  }\n\n  return {\n    ...(api.allowedDomains && { allow: api.allowedDomains }),\n    ...subnets,\n  };\n}\n"],"mappings":";;AAUA,SAAgB,mBACd,QACyB;AACzB,KAAI,WAAW,eAAe,WAAW,WACvC,QAAO,EAAE,MAAM,QAAQ;AAGzB,QAAO;;AAGT,SAAgB,qBACd,KACe;AACf,KAAI,IAAI,SAAS,eAAe,IAAI,SAAS,WAC3C,QAAO,IAAI;CAGb,MAAM,UACJ,IAAI,gBAAgB,IAAI,cACpB,EACE,SAAS;EACP,GAAI,IAAI,gBAAgB,EAAE,OAAO,IAAI,cAAc;EACnD,GAAI,IAAI,eAAe,EAAE,MAAM,IAAI,aAAa;EACjD,EACF,GACD;AAKN,KACG,IAAI,kBAAkB,IAAI,eAAe,SAAS,KAClD,IAAI,gBAAgB,IAAI,aAAa,SAAS,GAC/C;EACA,MAAM,gCAAgB,IAAI,KAAkC;AAC5D,OAAK,MAAM,QAAQ,IAAI,kBAAkB,EAAE,EAAE;GAC3C,MAAM,UAAU,OAAO,aACpB,KAAK,eAAe,EAAE,EAAE,KAAK,MAAM,CAAC,GAAG,aAAa,CAAC,CACvD;GACD,MAAM,QAAQ,cAAc,IAAI,KAAK,OAAO,IAAI,EAAE;AAClD,SAAM,KAAK;IACT,GAAI,KAAK,QAAQ,EAAE,OAAO,KAAK,OAAO,GAAG,EAAE;IAC3C,WAAW,CAAC,EAAE,SAAS,CAAC;IACzB,CAAC;AACF,iBAAc,IAAI,KAAK,QAAQ,MAAM;;AAEvC,OAAK,MAAM,QAAQ,IAAI,gBAAgB,EAAE,EAAE;GACzC,MAAM,QAAQ,cAAc,IAAI,KAAK,OAAO,IAAI,EAAE;AAClD,SAAM,KAAK;IACT,GAAI,KAAK,QAAQ,EAAE,OAAO,KAAK,OAAO,GAAG,EAAE;IAC3C,YAAY,KAAK;IAClB,CAAC;AACF,iBAAc,IAAI,KAAK,QAAQ,MAAM;;EAGvC,MAAMA,QAA6C,EAAE;AACrD,OAAK,MAAM,UAAU,IAAI,kBAAkB,EAAE,CAC3C,OAAM,UAAU,cAAc,IAAI,OAAO,IAAI,EAAE;AAGjD,OAAK,MAAM,QAAQ,CAAC,GAAI,IAAI,kBAAkB,EAAE,EAAG,GAAI,IAAI,gBAAgB,EAAE,CAAE,CAC7E,KAAI,EAAE,KAAK,UAAU,OACnB,OAAM,KAAK,UAAU,cAAc,IAAI,KAAK,OAAO,IAAI,EAAE;AAI7D,SAAO;GAAE;GAAO,GAAG;GAAS;;AAG9B,QAAO;EACL,GAAI,IAAI,kBAAkB,EAAE,OAAO,IAAI,gBAAgB;EACvD,GAAG;EACJ"}

package/dist/utils/network-policy.js

@@ -1,52 +1,36 @@
 //#region src/utils/network-policy.ts
 function toAPINetworkPolicy(policy) {
-	if (policy === "allow-all") return { mode: "allow-all" };
-	if (policy === "deny-all") return { mode: "deny-all" };
-	if (policy.allow && !Array.isArray(policy.allow)) {
-		const allowedDomains = Object.keys(policy.allow);
-		const injectionRules = [];
-		for (const [domain, rules] of Object.entries(policy.allow)) {
-			const merged = {};
-			for (const rule of rules) for (const t of rule.transform ?? []) Object.assign(merged, t.headers);
-			if (Object.keys(merged).length > 0) injectionRules.push({
-				domain,
-				headers: merged
-			});
-		}
-		return {
-			mode: "custom",
-			...allowedDomains.length > 0 && { allowedDomains },
-			...injectionRules.length > 0 && { injectionRules },
-			...policy.subnets?.allow && { allowedCIDRs: policy.subnets.allow },
-			...policy.subnets?.deny && { deniedCIDRs: policy.subnets.deny }
-		};
-	}
-	return {
-		mode: "custom",
-		...policy.allow && { allowedDomains: policy.allow },
-		...policy.subnets?.allow && { allowedCIDRs: policy.subnets.allow },
-		...policy.subnets?.deny && { deniedCIDRs: policy.subnets.deny }
-	};
+	if (policy === "allow-all" || policy === "deny-all") return { mode: policy };
+	return policy;
 }
 function fromAPINetworkPolicy(api) {
-	if (api.mode === "allow-all") return "allow-all";
-	if (api.mode === "deny-all") return "deny-all";
+	if (api.mode === "allow-all" || api.mode === "deny-all") return api.mode;
 	const subnets = api.allowedCIDRs || api.deniedCIDRs ? { subnets: {
 		...api.allowedCIDRs && { allow: api.allowedCIDRs },
 		...api.deniedCIDRs && { deny: api.deniedCIDRs }
 	} } : void 0;
-	if (api.injectionRules && api.injectionRules.length > 0) {
-		const rulesByDomain = new Map(api.injectionRules.map((r) => [r.domain, r.headerNames ?? []]));
-		const allow = {};
-		for (const domain of api.allowedDomains ?? []) {
-			const headerNames = rulesByDomain.get(domain);
-			if (headerNames && headerNames.length > 0) allow[domain] = [{ transform: [{ headers: Object.fromEntries(headerNames.map((n) => [n, "<redacted>"])) }] }];
-			else allow[domain] = [];
-		}
-		for (const rule of api.injectionRules) if (!(rule.domain in allow)) {
+	if (api.injectionRules && api.injectionRules.length > 0 || api.forwardRules && api.forwardRules.length > 0) {
+		const rulesByDomain = /* @__PURE__ */ new Map();
+		for (const rule of api.injectionRules ?? []) {
 			const headers = Object.fromEntries((rule.headerNames ?? []).map((n) => [n, "<redacted>"]));
-			allow[rule.domain] = [{ transform: [{ headers }] }];
+			const rules = rulesByDomain.get(rule.domain) ?? [];
+			rules.push({
+				...rule.match ? { match: rule.match } : {},
+				transform: [{ headers }]
+			});
+			rulesByDomain.set(rule.domain, rules);
 		}
+		for (const rule of api.forwardRules ?? []) {
+			const rules = rulesByDomain.get(rule.domain) ?? [];
+			rules.push({
+				...rule.match ? { match: rule.match } : {},
+				forwardURL: rule.forwardURL
+			});
+			rulesByDomain.set(rule.domain, rules);
+		}
+		const allow = {};
+		for (const domain of api.allowedDomains ?? []) allow[domain] = rulesByDomain.get(domain) ?? [];
+		for (const rule of [...api.injectionRules ?? [], ...api.forwardRules ?? []]) if (!(rule.domain in allow)) allow[rule.domain] = rulesByDomain.get(rule.domain) ?? [];
 		return {
 			allow,
 			...subnets

package/dist/utils/network-policy.js.map

@@ -1 +1 @@
-{"version":3,"file":"network-policy.js","names":["injectionRules: z.infer<typeof InjectionRuleValidator>[]","merged: Record<string, string>","allow: Record<string, NetworkPolicyRule[]>"],"sources":["../../src/utils/network-policy.ts"],"sourcesContent":["import { z } from \"zod\";\nimport { NetworkPolicy, NetworkPolicyRule } from \"../network-policy.js\";\nimport {\n  NetworkPolicyValidator,\n  InjectionRuleValidator,\n} from \"../api-client/validators.js\";\n\ntype APINetworkPolicy = z.infer<typeof NetworkPolicyValidator>;\n\nexport function toAPINetworkPolicy(policy: NetworkPolicy): APINetworkPolicy {\n  if (policy === \"allow-all\") return { mode: \"allow-all\" };\n  if (policy === \"deny-all\") return { mode: \"deny-all\" };\n\n  if (policy.allow && !Array.isArray(policy.allow)) {\n    const allowedDomains = Object.keys(policy.allow);\n    const injectionRules: z.infer<typeof InjectionRuleValidator>[] = [];\n\n    for (const [domain, rules] of Object.entries(policy.allow)) {\n      const merged: Record<string, string> = {};\n      for (const rule of rules) {\n        for (const t of rule.transform ?? []) {\n          Object.assign(merged, t.headers);\n        }\n      }\n      if (Object.keys(merged).length > 0) {\n        injectionRules.push({ domain, headers: merged });\n      }\n    }\n\n    return {\n      mode: \"custom\",\n      ...(allowedDomains.length > 0 && { allowedDomains }),\n      ...(injectionRules.length > 0 && { injectionRules }),\n      ...(policy.subnets?.allow && { allowedCIDRs: policy.subnets.allow }),\n      ...(policy.subnets?.deny && { deniedCIDRs: policy.subnets.deny }),\n    };\n  }\n\n  return {\n    mode: \"custom\",\n    ...(policy.allow && { allowedDomains: policy.allow }),\n    ...(policy.subnets?.allow && { allowedCIDRs: policy.subnets.allow }),\n    ...(policy.subnets?.deny && { deniedCIDRs: policy.subnets.deny }),\n  };\n}\n\nexport function fromAPINetworkPolicy(api: APINetworkPolicy): NetworkPolicy {\n  if (api.mode === \"allow-all\") return \"allow-all\";\n  if (api.mode === \"deny-all\") return \"deny-all\";\n\n  const subnets =\n    api.allowedCIDRs || api.deniedCIDRs\n      ? {\n          subnets: {\n            ...(api.allowedCIDRs && { allow: api.allowedCIDRs }),\n            ...(api.deniedCIDRs && { deny: api.deniedCIDRs }),\n          },\n        }\n      : undefined;\n\n  // If injectionRules are present, reconstruct the record form.\n  // The API returns headerNames (secret values are stripped), so we\n  // populate each header value with \"<redacted>\".\n  if (api.injectionRules && api.injectionRules.length > 0) {\n    const rulesByDomain = new Map(\n      api.injectionRules.map((r) => [r.domain, r.headerNames ?? []]),\n    );\n\n    const allow: Record<string, NetworkPolicyRule[]> = {};\n    for (const domain of api.allowedDomains ?? []) {\n      const headerNames = rulesByDomain.get(domain);\n      if (headerNames && headerNames.length > 0) {\n        const headers = Object.fromEntries(\n          headerNames.map((n) => [n, \"<redacted>\"]),\n        );\n        allow[domain] = [{ transform: [{ headers }] }];\n      } else {\n        allow[domain] = [];\n      }\n    }\n    // Include injection rules for domains not in allowedDomains\n    for (const rule of api.injectionRules) {\n      if (!(rule.domain in allow)) {\n        const headers = Object.fromEntries(\n          (rule.headerNames ?? []).map((n) => [n, \"<redacted>\"]),\n        );\n        allow[rule.domain] = [{ transform: [{ headers }] }];\n      }\n    }\n\n    return { allow, ...subnets };\n  }\n\n  return {\n    ...(api.allowedDomains && { allow: api.allowedDomains }),\n    ...subnets,\n  };\n}\n"],"mappings":";AASA,SAAgB,mBAAmB,QAAyC;AAC1E,KAAI,WAAW,YAAa,QAAO,EAAE,MAAM,aAAa;AACxD,KAAI,WAAW,WAAY,QAAO,EAAE,MAAM,YAAY;AAEtD,KAAI,OAAO,SAAS,CAAC,MAAM,QAAQ,OAAO,MAAM,EAAE;EAChD,MAAM,iBAAiB,OAAO,KAAK,OAAO,MAAM;EAChD,MAAMA,iBAA2D,EAAE;AAEnE,OAAK,MAAM,CAAC,QAAQ,UAAU,OAAO,QAAQ,OAAO,MAAM,EAAE;GAC1D,MAAMC,SAAiC,EAAE;AACzC,QAAK,MAAM,QAAQ,MACjB,MAAK,MAAM,KAAK,KAAK,aAAa,EAAE,CAClC,QAAO,OAAO,QAAQ,EAAE,QAAQ;AAGpC,OAAI,OAAO,KAAK,OAAO,CAAC,SAAS,EAC/B,gBAAe,KAAK;IAAE;IAAQ,SAAS;IAAQ,CAAC;;AAIpD,SAAO;GACL,MAAM;GACN,GAAI,eAAe,SAAS,KAAK,EAAE,gBAAgB;GACnD,GAAI,eAAe,SAAS,KAAK,EAAE,gBAAgB;GACnD,GAAI,OAAO,SAAS,SAAS,EAAE,cAAc,OAAO,QAAQ,OAAO;GACnE,GAAI,OAAO,SAAS,QAAQ,EAAE,aAAa,OAAO,QAAQ,MAAM;GACjE;;AAGH,QAAO;EACL,MAAM;EACN,GAAI,OAAO,SAAS,EAAE,gBAAgB,OAAO,OAAO;EACpD,GAAI,OAAO,SAAS,SAAS,EAAE,cAAc,OAAO,QAAQ,OAAO;EACnE,GAAI,OAAO,SAAS,QAAQ,EAAE,aAAa,OAAO,QAAQ,MAAM;EACjE;;AAGH,SAAgB,qBAAqB,KAAsC;AACzE,KAAI,IAAI,SAAS,YAAa,QAAO;AACrC,KAAI,IAAI,SAAS,WAAY,QAAO;CAEpC,MAAM,UACJ,IAAI,gBAAgB,IAAI,cACpB,EACE,SAAS;EACP,GAAI,IAAI,gBAAgB,EAAE,OAAO,IAAI,cAAc;EACnD,GAAI,IAAI,eAAe,EAAE,MAAM,IAAI,aAAa;EACjD,EACF,GACD;AAKN,KAAI,IAAI,kBAAkB,IAAI,eAAe,SAAS,GAAG;EACvD,MAAM,gBAAgB,IAAI,IACxB,IAAI,eAAe,KAAK,MAAM,CAAC,EAAE,QAAQ,EAAE,eAAe,EAAE,CAAC,CAAC,CAC/D;EAED,MAAMC,QAA6C,EAAE;AACrD,OAAK,MAAM,UAAU,IAAI,kBAAkB,EAAE,EAAE;GAC7C,MAAM,cAAc,cAAc,IAAI,OAAO;AAC7C,OAAI,eAAe,YAAY,SAAS,EAItC,OAAM,UAAU,CAAC,EAAE,WAAW,CAAC,EAAE,SAHjB,OAAO,YACrB,YAAY,KAAK,MAAM,CAAC,GAAG,aAAa,CAAC,CAC1C,EACyC,CAAC,EAAE,CAAC;OAE9C,OAAM,UAAU,EAAE;;AAItB,OAAK,MAAM,QAAQ,IAAI,eACrB,KAAI,EAAE,KAAK,UAAU,QAAQ;GAC3B,MAAM,UAAU,OAAO,aACpB,KAAK,eAAe,EAAE,EAAE,KAAK,MAAM,CAAC,GAAG,aAAa,CAAC,CACvD;AACD,SAAM,KAAK,UAAU,CAAC,EAAE,WAAW,CAAC,EAAE,SAAS,CAAC,EAAE,CAAC;;AAIvD,SAAO;GAAE;GAAO,GAAG;GAAS;;AAG9B,QAAO;EACL,GAAI,IAAI,kBAAkB,EAAE,OAAO,IAAI,gBAAgB;EACvD,GAAG;EACJ"}
+{"version":3,"file":"network-policy.js","names":["allow: Record<string, NetworkPolicyRule[]>"],"sources":["../../src/utils/network-policy.ts"],"sourcesContent":["import { z } from \"zod\";\nimport { NetworkPolicy, NetworkPolicyRule } from \"../network-policy.js\";\nimport {\n  NetworkPolicyRequestValidator,\n  NetworkPolicyResponseValidator,\n} from \"../api-client/validators.js\";\n\ntype APIRequestNetworkPolicy = z.infer<typeof NetworkPolicyRequestValidator>;\ntype APIResponseNetworkPolicy = z.infer<typeof NetworkPolicyResponseValidator>;\n\nexport function toAPINetworkPolicy(\n  policy: NetworkPolicy,\n): APIRequestNetworkPolicy {\n  if (policy === \"allow-all\" || policy === \"deny-all\") {\n    return { mode: policy };\n  }\n\n  return policy;\n}\n\nexport function fromAPINetworkPolicy(\n  api: APIResponseNetworkPolicy,\n): NetworkPolicy {\n  if (api.mode === \"allow-all\" || api.mode === \"deny-all\") {\n    return api.mode;\n  }\n\n  const subnets =\n    api.allowedCIDRs || api.deniedCIDRs\n      ? {\n          subnets: {\n            ...(api.allowedCIDRs && { allow: api.allowedCIDRs }),\n            ...(api.deniedCIDRs && { deny: api.deniedCIDRs }),\n          },\n        }\n      : undefined;\n\n  // If L7 rules are present, reconstruct the record form.\n  // The API returns headerNames (secret values are stripped), so we\n  // populate each header value with \"<redacted>\".\n  if (\n    (api.injectionRules && api.injectionRules.length > 0) ||\n    (api.forwardRules && api.forwardRules.length > 0)\n  ) {\n    const rulesByDomain = new Map<string, NetworkPolicyRule[]>();\n    for (const rule of api.injectionRules ?? []) {\n      const headers = Object.fromEntries(\n        (rule.headerNames ?? []).map((n) => [n, \"<redacted>\"]),\n      );\n      const rules = rulesByDomain.get(rule.domain) ?? [];\n      rules.push({\n        ...(rule.match ? { match: rule.match } : {}),\n        transform: [{ headers }],\n      });\n      rulesByDomain.set(rule.domain, rules);\n    }\n    for (const rule of api.forwardRules ?? []) {\n      const rules = rulesByDomain.get(rule.domain) ?? [];\n      rules.push({\n        ...(rule.match ? { match: rule.match } : {}),\n        forwardURL: rule.forwardURL,\n      });\n      rulesByDomain.set(rule.domain, rules);\n    }\n\n    const allow: Record<string, NetworkPolicyRule[]> = {};\n    for (const domain of api.allowedDomains ?? []) {\n      allow[domain] = rulesByDomain.get(domain) ?? [];\n    }\n    // Include L7 rules for domains not in allowedDomains\n    for (const rule of [...(api.injectionRules ?? []), ...(api.forwardRules ?? [])]) {\n      if (!(rule.domain in allow)) {\n        allow[rule.domain] = rulesByDomain.get(rule.domain) ?? [];\n      }\n    }\n\n    return { allow, ...subnets };\n  }\n\n  return {\n    ...(api.allowedDomains && { allow: api.allowedDomains }),\n    ...subnets,\n  };\n}\n"],"mappings":";AAUA,SAAgB,mBACd,QACyB;AACzB,KAAI,WAAW,eAAe,WAAW,WACvC,QAAO,EAAE,MAAM,QAAQ;AAGzB,QAAO;;AAGT,SAAgB,qBACd,KACe;AACf,KAAI,IAAI,SAAS,eAAe,IAAI,SAAS,WAC3C,QAAO,IAAI;CAGb,MAAM,UACJ,IAAI,gBAAgB,IAAI,cACpB,EACE,SAAS;EACP,GAAI,IAAI,gBAAgB,EAAE,OAAO,IAAI,cAAc;EACnD,GAAI,IAAI,eAAe,EAAE,MAAM,IAAI,aAAa;EACjD,EACF,GACD;AAKN,KACG,IAAI,kBAAkB,IAAI,eAAe,SAAS,KAClD,IAAI,gBAAgB,IAAI,aAAa,SAAS,GAC/C;EACA,MAAM,gCAAgB,IAAI,KAAkC;AAC5D,OAAK,MAAM,QAAQ,IAAI,kBAAkB,EAAE,EAAE;GAC3C,MAAM,UAAU,OAAO,aACpB,KAAK,eAAe,EAAE,EAAE,KAAK,MAAM,CAAC,GAAG,aAAa,CAAC,CACvD;GACD,MAAM,QAAQ,cAAc,IAAI,KAAK,OAAO,IAAI,EAAE;AAClD,SAAM,KAAK;IACT,GAAI,KAAK,QAAQ,EAAE,OAAO,KAAK,OAAO,GAAG,EAAE;IAC3C,WAAW,CAAC,EAAE,SAAS,CAAC;IACzB,CAAC;AACF,iBAAc,IAAI,KAAK,QAAQ,MAAM;;AAEvC,OAAK,MAAM,QAAQ,IAAI,gBAAgB,EAAE,EAAE;GACzC,MAAM,QAAQ,cAAc,IAAI,KAAK,OAAO,IAAI,EAAE;AAClD,SAAM,KAAK;IACT,GAAI,KAAK,QAAQ,EAAE,OAAO,KAAK,OAAO,GAAG,EAAE;IAC3C,YAAY,KAAK;IAClB,CAAC;AACF,iBAAc,IAAI,KAAK,QAAQ,MAAM;;EAGvC,MAAMA,QAA6C,EAAE;AACrD,OAAK,MAAM,UAAU,IAAI,kBAAkB,EAAE,CAC3C,OAAM,UAAU,cAAc,IAAI,OAAO,IAAI,EAAE;AAGjD,OAAK,MAAM,QAAQ,CAAC,GAAI,IAAI,kBAAkB,EAAE,EAAG,GAAI,IAAI,gBAAgB,EAAE,CAAE,CAC7E,KAAI,EAAE,KAAK,UAAU,OACnB,OAAM,KAAK,UAAU,cAAc,IAAI,KAAK,OAAO,IAAI,EAAE;AAI7D,SAAO;GAAE;GAAO,GAAG;GAAS;;AAG9B,QAAO;EACL,GAAI,IAAI,kBAAkB,EAAE,OAAO,IAAI,gBAAgB;EACvD,GAAG;EACJ"}

package/dist/utils/paginator.cjs

@@ -0,0 +1,41 @@
+
+//#region src/utils/paginator.ts
+function attachPaginator(firstPage, options) {
+	const { itemsKey, fetchNext, signal } = options;
+	async function* iteratePages() {
+		throwIfAborted(signal);
+		let page = firstPage;
+		yield page;
+		while (page.pagination.next !== null) {
+			throwIfAborted(signal);
+			page = await fetchNext(page.pagination.next);
+			yield page;
+		}
+	}
+	async function* iterateItems() {
+		for await (const page of iteratePages()) {
+			const items = page[itemsKey];
+			for (const item of items) {
+				throwIfAborted(signal);
+				yield item;
+			}
+		}
+	}
+	return {
+		...firstPage,
+		[Symbol.asyncIterator]: iterateItems,
+		pages: iteratePages,
+		toArray: async () => {
+			const all = [];
+			for await (const item of iterateItems()) all.push(item);
+			return all;
+		}
+	};
+}
+function throwIfAborted(signal) {
+	if (signal?.aborted) throw signal.reason ?? new DOMException("Aborted", "AbortError");
+}
+
+//#endregion
+exports.attachPaginator = attachPaginator;
+//# sourceMappingURL=paginator.cjs.map

package/dist/utils/paginator.cjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"paginator.cjs","names":["all: ItemOf<Page, Key>[]"],"sources":["../../src/utils/paginator.ts"],"sourcesContent":["type CursorPaginationMeta = {\n  count: number;\n  next: string | null;\n};\n\ntype HasPagination = { pagination: CursorPaginationMeta };\n\ntype ItemOf<Page, Key extends keyof Page> = Page[Key] extends Array<infer Item>\n  ? Item\n  : never;\n\nexport type Paginator<Page extends HasPagination, Key extends keyof Page> =\n  Page &\n    AsyncIterable<ItemOf<Page, Key>> & {\n      pages(): AsyncIterable<Page>;\n      toArray(): Promise<ItemOf<Page, Key>[]>;\n    };\n\ntype AttachPaginatorOptions<Page extends HasPagination, Key extends keyof Page> = {\n  itemsKey: Key;\n  fetchNext: (cursor: string) => Promise<Page>;\n  signal?: AbortSignal;\n};\n\nexport function attachPaginator<\n  Page extends HasPagination,\n  Key extends keyof Page,\n>(\n  firstPage: Page,\n  options: AttachPaginatorOptions<Page, Key>,\n): Paginator<Page, Key> {\n  const { itemsKey, fetchNext, signal } = options;\n\n  async function* iteratePages(): AsyncGenerator<Page> {\n    throwIfAborted(signal);\n    let page = firstPage;\n    yield page;\n    while (page.pagination.next !== null) {\n      throwIfAborted(signal);\n      page = await fetchNext(page.pagination.next);\n      yield page;\n    }\n  }\n\n  async function* iterateItems(): AsyncGenerator<ItemOf<Page, Key>> {\n    for await (const page of iteratePages()) {\n      const items = page[itemsKey] as unknown as ItemOf<Page, Key>[];\n      for (const item of items) {\n        throwIfAborted(signal);\n        yield item;\n      }\n    }\n  }\n\n  return {\n    ...firstPage,\n    [Symbol.asyncIterator]: iterateItems,\n    pages: iteratePages,\n    toArray: async () => {\n      const all: ItemOf<Page, Key>[] = [];\n      for await (const item of iterateItems()) {\n        all.push(item);\n      }\n      return all;\n    },\n  };\n}\n\nfunction throwIfAborted(signal?: AbortSignal): void {\n  if (signal?.aborted) {\n    throw signal.reason ?? new DOMException(\"Aborted\", \"AbortError\");\n  }\n}\n"],"mappings":";;AAwBA,SAAgB,gBAId,WACA,SACsB;CACtB,MAAM,EAAE,UAAU,WAAW,WAAW;CAExC,gBAAgB,eAAqC;AACnD,iBAAe,OAAO;EACtB,IAAI,OAAO;AACX,QAAM;AACN,SAAO,KAAK,WAAW,SAAS,MAAM;AACpC,kBAAe,OAAO;AACtB,UAAO,MAAM,UAAU,KAAK,WAAW,KAAK;AAC5C,SAAM;;;CAIV,gBAAgB,eAAkD;AAChE,aAAW,MAAM,QAAQ,cAAc,EAAE;GACvC,MAAM,QAAQ,KAAK;AACnB,QAAK,MAAM,QAAQ,OAAO;AACxB,mBAAe,OAAO;AACtB,UAAM;;;;AAKZ,QAAO;EACL,GAAG;GACF,OAAO,gBAAgB;EACxB,OAAO;EACP,SAAS,YAAY;GACnB,MAAMA,MAA2B,EAAE;AACnC,cAAW,MAAM,QAAQ,cAAc,CACrC,KAAI,KAAK,KAAK;AAEhB,UAAO;;EAEV;;AAGH,SAAS,eAAe,QAA4B;AAClD,KAAI,QAAQ,QACV,OAAM,OAAO,UAAU,IAAI,aAAa,WAAW,aAAa"}

package/dist/utils/paginator.d.cts

@@ -0,0 +1,16 @@
+//#region src/utils/paginator.d.ts
+type CursorPaginationMeta = {
+  count: number;
+  next: string | null;
+};
+type HasPagination = {
+  pagination: CursorPaginationMeta;
+};
+type ItemOf<Page, Key extends keyof Page> = Page[Key] extends Array<infer Item> ? Item : never;
+type Paginator<Page extends HasPagination, Key extends keyof Page> = Page & AsyncIterable<ItemOf<Page, Key>> & {
+  pages(): AsyncIterable<Page>;
+  toArray(): Promise<ItemOf<Page, Key>[]>;
+};
+//#endregion
+export { Paginator };
+//# sourceMappingURL=paginator.d.cts.map

package/dist/utils/paginator.d.ts

@@ -0,0 +1,16 @@
+//#region src/utils/paginator.d.ts
+type CursorPaginationMeta = {
+  count: number;
+  next: string | null;
+};
+type HasPagination = {
+  pagination: CursorPaginationMeta;
+};
+type ItemOf<Page, Key extends keyof Page> = Page[Key] extends Array<infer Item> ? Item : never;
+type Paginator<Page extends HasPagination, Key extends keyof Page> = Page & AsyncIterable<ItemOf<Page, Key>> & {
+  pages(): AsyncIterable<Page>;
+  toArray(): Promise<ItemOf<Page, Key>[]>;
+};
+//#endregion
+export { Paginator };
+//# sourceMappingURL=paginator.d.ts.map

package/dist/utils/paginator.js

@@ -0,0 +1,40 @@
+//#region src/utils/paginator.ts
+function attachPaginator(firstPage, options) {
+	const { itemsKey, fetchNext, signal } = options;
+	async function* iteratePages() {
+		throwIfAborted(signal);
+		let page = firstPage;
+		yield page;
+		while (page.pagination.next !== null) {
+			throwIfAborted(signal);
+			page = await fetchNext(page.pagination.next);
+			yield page;
+		}
+	}
+	async function* iterateItems() {
+		for await (const page of iteratePages()) {
+			const items = page[itemsKey];
+			for (const item of items) {
+				throwIfAborted(signal);
+				yield item;
+			}
+		}
+	}
+	return {
+		...firstPage,
+		[Symbol.asyncIterator]: iterateItems,
+		pages: iteratePages,
+		toArray: async () => {
+			const all = [];
+			for await (const item of iterateItems()) all.push(item);
+			return all;
+		}
+	};
+}
+function throwIfAborted(signal) {
+	if (signal?.aborted) throw signal.reason ?? new DOMException("Aborted", "AbortError");
+}
+
+//#endregion
+export { attachPaginator };
+//# sourceMappingURL=paginator.js.map

package/dist/utils/paginator.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"paginator.js","names":["all: ItemOf<Page, Key>[]"],"sources":["../../src/utils/paginator.ts"],"sourcesContent":["type CursorPaginationMeta = {\n  count: number;\n  next: string | null;\n};\n\ntype HasPagination = { pagination: CursorPaginationMeta };\n\ntype ItemOf<Page, Key extends keyof Page> = Page[Key] extends Array<infer Item>\n  ? Item\n  : never;\n\nexport type Paginator<Page extends HasPagination, Key extends keyof Page> =\n  Page &\n    AsyncIterable<ItemOf<Page, Key>> & {\n      pages(): AsyncIterable<Page>;\n      toArray(): Promise<ItemOf<Page, Key>[]>;\n    };\n\ntype AttachPaginatorOptions<Page extends HasPagination, Key extends keyof Page> = {\n  itemsKey: Key;\n  fetchNext: (cursor: string) => Promise<Page>;\n  signal?: AbortSignal;\n};\n\nexport function attachPaginator<\n  Page extends HasPagination,\n  Key extends keyof Page,\n>(\n  firstPage: Page,\n  options: AttachPaginatorOptions<Page, Key>,\n): Paginator<Page, Key> {\n  const { itemsKey, fetchNext, signal } = options;\n\n  async function* iteratePages(): AsyncGenerator<Page> {\n    throwIfAborted(signal);\n    let page = firstPage;\n    yield page;\n    while (page.pagination.next !== null) {\n      throwIfAborted(signal);\n      page = await fetchNext(page.pagination.next);\n      yield page;\n    }\n  }\n\n  async function* iterateItems(): AsyncGenerator<ItemOf<Page, Key>> {\n    for await (const page of iteratePages()) {\n      const items = page[itemsKey] as unknown as ItemOf<Page, Key>[];\n      for (const item of items) {\n        throwIfAborted(signal);\n        yield item;\n      }\n    }\n  }\n\n  return {\n    ...firstPage,\n    [Symbol.asyncIterator]: iterateItems,\n    pages: iteratePages,\n    toArray: async () => {\n      const all: ItemOf<Page, Key>[] = [];\n      for await (const item of iterateItems()) {\n        all.push(item);\n      }\n      return all;\n    },\n  };\n}\n\nfunction throwIfAborted(signal?: AbortSignal): void {\n  if (signal?.aborted) {\n    throw signal.reason ?? new DOMException(\"Aborted\", \"AbortError\");\n  }\n}\n"],"mappings":";AAwBA,SAAgB,gBAId,WACA,SACsB;CACtB,MAAM,EAAE,UAAU,WAAW,WAAW;CAExC,gBAAgB,eAAqC;AACnD,iBAAe,OAAO;EACtB,IAAI,OAAO;AACX,QAAM;AACN,SAAO,KAAK,WAAW,SAAS,MAAM;AACpC,kBAAe,OAAO;AACtB,UAAO,MAAM,UAAU,KAAK,WAAW,KAAK;AAC5C,SAAM;;;CAIV,gBAAgB,eAAkD;AAChE,aAAW,MAAM,QAAQ,cAAc,EAAE;GACvC,MAAM,QAAQ,KAAK;AACnB,QAAK,MAAM,QAAQ,OAAO;AACxB,mBAAe,OAAO;AACtB,UAAM;;;;AAKZ,QAAO;EACL,GAAG;GACF,OAAO,gBAAgB;EACxB,OAAO;EACP,SAAS,YAAY;GACnB,MAAMA,MAA2B,EAAE;AACnC,cAAW,MAAM,QAAQ,cAAc,CACrC,KAAI,KAAK,KAAK;AAEhB,UAAO;;EAEV;;AAGH,SAAS,eAAe,QAA4B;AAClD,KAAI,QAAQ,QACV,OAAM,OAAO,UAAU,IAAI,aAAa,WAAW,aAAa"}

package/dist/version.cjs

@@ -1,6 +1,6 @@
 
 //#region src/version.ts
-const VERSION = "2.0.0-beta.13";
+const VERSION = "2.0.0-beta.18";
 
 //#endregion
 exports.VERSION = VERSION;

package/dist/version.cjs.map

@@ -1 +1 @@
-{"version":3,"file":"version.cjs","names":[],"sources":["../src/version.ts"],"sourcesContent":["// Autogenerated by inject-version.ts\nexport const VERSION = \"2.0.0-beta.13\";\n"],"mappings":";;AACA,MAAa,UAAU"}
+{"version":3,"file":"version.cjs","names":[],"sources":["../src/version.ts"],"sourcesContent":["// Autogenerated by inject-version.ts\nexport const VERSION = \"2.0.0-beta.18\";\n"],"mappings":";;AACA,MAAa,UAAU"}

package/dist/version.js

@@ -1,5 +1,5 @@
 //#region src/version.ts
-const VERSION = "2.0.0-beta.13";
+const VERSION = "2.0.0-beta.18";
 
 //#endregion
 export { VERSION };

package/dist/version.js.map

@@ -1 +1 @@
-{"version":3,"file":"version.js","names":[],"sources":["../src/version.ts"],"sourcesContent":["// Autogenerated by inject-version.ts\nexport const VERSION = \"2.0.0-beta.13\";\n"],"mappings":";AACA,MAAa,UAAU"}
+{"version":3,"file":"version.js","names":[],"sources":["../src/version.ts"],"sourcesContent":["// Autogenerated by inject-version.ts\nexport const VERSION = \"2.0.0-beta.18\";\n"],"mappings":";AACA,MAAa,UAAU"}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@vercel/sandbox",
-  "version": "2.0.0-beta.13",
+  "version": "2.0.0-beta.18",
   "description": "Software Development Kit for Vercel Sandbox",
   "type": "module",
   "main": "dist/index.cjs",