@vercel/sandbox 2.0.0-beta.2 → 2.0.0-beta.20

package/dist/network-policy.d.cts

@@ -0,0 +1,156 @@
+//#region src/network-policy.d.ts
+/**
+ * A transform applied to network requests matching a domain rule.
+ *
+ * @example
+ * {
+ *   headers: { authorization: "Bearer sk-..." }
+ * }
+ */
+type NetworkTransformer = {
+  /** Headers to set on the outgoing request. */
+  headers?: Record<string, string>;
+};
+/**
+ * Defines how a request value is matched.
+ */
+type NetworkPolicyMatcher = {
+  /** Match the value exactly. */
+  exact?: string;
+} | {
+  /** Match values that start with the provided prefix. */
+  startsWith?: string;
+} | {
+  /** Match values against an RE2 regular expression. */
+  regex?: string;
+};
+/**
+ * Matcher for key/value request entries such as headers and query parameters.
+ */
+type NetworkPolicyKeyValueMatcher = {
+  /** Matcher for the entry key. */
+  key?: NetworkPolicyMatcher;
+  /** Matcher for the entry value. */
+  value?: NetworkPolicyMatcher;
+};
+/**
+ * Request matcher for a network policy rule.
+ *
+ * All specified dimensions must match. Multiple methods are ORed; multiple
+ * header and query-string matchers are ANDed.
+ */
+type NetworkPolicyMatch = {
+  /** Match on the request path. */
+  path?: NetworkPolicyMatcher;
+  /** Match on the HTTP method. */
+  method?: string[];
+  /** Match on query-string entries. */
+  queryString?: NetworkPolicyKeyValueMatcher[];
+  /** Match on request headers. */
+  headers?: NetworkPolicyKeyValueMatcher[];
+};
+/**
+ * A rule applied to requests matching a domain in the network policy.
+ */
+type NetworkPolicyRule = {
+  /**
+   * Optional request matcher. When provided, transforms only apply to requests
+   * that match every specified dimension.
+   */
+  match?: NetworkPolicyMatch;
+  /**
+   * Transforms to apply to matching requests.
+   */
+  transform?: NetworkTransformer[];
+  /**
+   * HTTPS proxy URL to forward matching requests to. Must not include query string or fragment.
+   */
+  forwardURL?: string;
+};
+/**
+ * Network policy to define network restrictions for the sandbox.
+ *
+ * - `"allow-all"`: Full internet access (default). All traffic is allowed.
+ * - `"deny-all"`: No internet access. All traffic is denied.
+ * - Object: Custom access with explicit allow/deny lists.
+ *
+ * @example
+ * // Full internet access (default)
+ * "allow-all"
+ *
+ * @example
+ * // No external access
+ * "deny-all"
+ *
+ * @example
+ * // Custom access with specific domains (simple list)
+ * // All traffic not explicitly allowed is denied.
+ * {
+ *   allow: ["*.npmjs.org", "github.com"],
+ *   subnets: {
+ *     allow: ["10.0.0.0/8"],
+ *     deny: ["10.1.0.0/16"]
+ *   }
+ * }
+ *
+ * @example
+ * // Custom access with specific domains (record form)
+ * {
+ *   allow: {
+ *     "*.npmjs.org": [],
+ *     "github.com": [],
+ *   }
+ * }
+ *
+ * @example
+ * // Custom access with request transformers
+ * {
+ *   allow: {
+ *     "ai-gateway.vercel.sh": [
+ *       {
+ *         match: {
+ *           method: ["POST"],
+ *           path: { startsWith: "/v1/" },
+ *           headers: [
+ *             { key: { exact: "x-api-key" }, value: { exact: "placeholder" } }
+ *           ]
+ *         },
+ *         transform: [{
+ *           headers: { authorization: "Bearer ..." }
+ *         }]
+ *       }
+ *     ],
+ *     "*": []
+ *   }
+ * }
+ */
+type NetworkPolicy = "allow-all" | "deny-all" | {
+  /**
+   * Domains to allow traffic to.
+   * Use "*" prefix for wildcard matching (e.g., "*.npmjs.org").
+   *
+   * Accepts either:
+   * - `string[]`: A simple list of domains to allow.
+   * - `Record<string, NetworkPolicyRule[]>`: A map of domains to rules.
+   *   An empty array allows traffic with no additional rules.
+   */
+  allow?: string[] | Record<string, NetworkPolicyRule[]>;
+  /**
+   * Subnet-level access control using CIDR notation.
+   */
+  subnets?: {
+    /**
+     * List of CIDRs to allow traffic to.
+     * Traffic to these addresses will bypass the domain allowlist.
+     */
+    allow?: string[];
+    /**
+     * List of CIDRs to deny traffic to.
+     * These take precedence over allowed domains and CIDRs.
+     */
+    deny?: string[];
+  };
+};
+//#endregion
+export { NetworkPolicy, NetworkPolicyKeyValueMatcher, NetworkPolicyMatch, NetworkPolicyMatcher, NetworkPolicyRule, NetworkTransformer };
+//# sourceMappingURL=network-policy.d.cts.map

package/dist/network-policy.d.ts

@@ -1,3 +1,4 @@
+//#region src/network-policy.d.ts
 /**
  * A transform applied to network requests matching a domain rule.
  *
@@ -6,16 +7,65 @@
  *   headers: { authorization: "Bearer sk-..." }
  * }
  */
-export type NetworkTransformer = {
-    /** Headers to set on the outgoing request. */
-    headers?: Record<string, string>;
+type NetworkTransformer = {
+  /** Headers to set on the outgoing request. */
+  headers?: Record<string, string>;
+};
+/**
+ * Defines how a request value is matched.
+ */
+type NetworkPolicyMatcher = {
+  /** Match the value exactly. */
+  exact?: string;
+} | {
+  /** Match values that start with the provided prefix. */
+  startsWith?: string;
+} | {
+  /** Match values against an RE2 regular expression. */
+  regex?: string;
+};
+/**
+ * Matcher for key/value request entries such as headers and query parameters.
+ */
+type NetworkPolicyKeyValueMatcher = {
+  /** Matcher for the entry key. */
+  key?: NetworkPolicyMatcher;
+  /** Matcher for the entry value. */
+  value?: NetworkPolicyMatcher;
+};
+/**
+ * Request matcher for a network policy rule.
+ *
+ * All specified dimensions must match. Multiple methods are ORed; multiple
+ * header and query-string matchers are ANDed.
+ */
+type NetworkPolicyMatch = {
+  /** Match on the request path. */
+  path?: NetworkPolicyMatcher;
+  /** Match on the HTTP method. */
+  method?: string[];
+  /** Match on query-string entries. */
+  queryString?: NetworkPolicyKeyValueMatcher[];
+  /** Match on request headers. */
+  headers?: NetworkPolicyKeyValueMatcher[];
 };
 /**
  * A rule applied to requests matching a domain in the network policy.
  */
-export type NetworkPolicyRule = {
-    /** Transforms to apply to matching requests. */
-    transform?: NetworkTransformer[];
+type NetworkPolicyRule = {
+  /**
+   * Optional request matcher. When provided, transforms only apply to requests
+   * that match every specified dimension.
+   */
+  match?: NetworkPolicyMatch;
+  /**
+   * Transforms to apply to matching requests.
+   */
+  transform?: NetworkTransformer[];
+  /**
+   * HTTPS proxy URL to forward matching requests to. Must not include query string or fragment.
+   */
+  forwardURL?: string;
 };
 /**
  * Network policy to define network restrictions for the sandbox.
@@ -58,6 +108,13 @@ export type NetworkPolicyRule = {
  *   allow: {
  *     "ai-gateway.vercel.sh": [
  *       {
+ *         match: {
+ *           method: ["POST"],
+ *           path: { startsWith: "/v1/" },
+ *           headers: [
+ *             { key: { exact: "x-api-key" }, value: { exact: "placeholder" } }
+ *           ]
+ *         },
  *         transform: [{
  *           headers: { authorization: "Bearer ..." }
  *         }]
@@ -67,30 +124,33 @@ export type NetworkPolicyRule = {
  *   }
  * }
  */
-export type NetworkPolicy = "allow-all" | "deny-all" | {
+type NetworkPolicy = "allow-all" | "deny-all" | {
+  /**
+   * Domains to allow traffic to.
+   * Use "*" prefix for wildcard matching (e.g., "*.npmjs.org").
+   *
+   * Accepts either:
+   * - `string[]`: A simple list of domains to allow.
+   * - `Record<string, NetworkPolicyRule[]>`: A map of domains to rules.
+   *   An empty array allows traffic with no additional rules.
+   */
+  allow?: string[] | Record<string, NetworkPolicyRule[]>;
+  /**
+   * Subnet-level access control using CIDR notation.
+   */
+  subnets?: {
     /**
-     * Domains to allow traffic to.
-     * Use "*" prefix for wildcard matching (e.g., "*.npmjs.org").
-     *
-     * Accepts either:
-     * - `string[]`: A simple list of domains to allow.
-     * - `Record<string, NetworkPolicyRule[]>`: A map of domains to rules.
-     *   An empty array allows traffic with no additional rules.
+     * List of CIDRs to allow traffic to.
+     * Traffic to these addresses will bypass the domain allowlist.
      */
-    allow?: string[] | Record<string, NetworkPolicyRule[]>;
+    allow?: string[];
     /**
-     * Subnet-level access control using CIDR notation.
+     * List of CIDRs to deny traffic to.
+     * These take precedence over allowed domains and CIDRs.
      */
-    subnets?: {
-        /**
-         * List of CIDRs to allow traffic to.
-         * Traffic to these addresses will bypass the domain allowlist.
-         */
-        allow?: string[];
-        /**
-         * List of CIDRs to deny traffic to.
-         * These take precedence over allowed domains and CIDRs.
-         */
-        deny?: string[];
-    };
+    deny?: string[];
+  };
 };
+//#endregion
+export { NetworkPolicy, NetworkPolicyKeyValueMatcher, NetworkPolicyMatch, NetworkPolicyMatcher, NetworkPolicyRule, NetworkTransformer };
+//# sourceMappingURL=network-policy.d.ts.map