archil-openapi 0.0.41__tar.gz → 0.0.43__tar.gz

{archil_openapi-0.0.41 → archil_openapi-0.0.43}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.3
 Name: archil-openapi
-Version: 0.0.41
+Version: 0.0.43
 Summary: Generated low-level Python client for the Archil control plane API
 Keywords: archil,openapi
 Author: Archil, Inc.

{archil_openapi-0.0.41 → archil_openapi-0.0.43}/pyproject.toml

@@ -1,6 +1,6 @@
 [project]
 name = "archil-openapi"
-version = "0.0.41"
+version = "0.0.43"
 description = "Generated low-level Python client for the Archil control plane API"
 readme = "README.md"
 license = { file = "LICENSE" }

{archil_openapi-0.0.41 → archil_openapi-0.0.43}/src/archil_openapi/models/sandbox_egress_policy.py

@@ -17,11 +17,15 @@ T = TypeVar("T", bound="SandboxEgressPolicy")
 @_attrs_define
 class SandboxEgressPolicy:
     """Deny targets take precedence when an address or domain matches both lists. When domain rules or drain selectors are
-    present, TCP ports 80 and 443 are restricted to HTTP/1.1 or HTTP/2. Plaintext HTTP authority is enforced on port 80,
-    but requests matching a transformation rule are rejected unless the rule also forwards. Port 443 is TLS-terminated;
-    both TLS SNI and HTTP authority are evaluated, and the HTTP authority selects the upstream, any request
-    transformations, and any request forwarding. DNS to the sandbox's configured resolvers is allowed and UDP port 443
-    is denied.
+    present, TCP port 80 is restricted to HTTP/1.1 or HTTP/2 and plaintext HTTP authority is enforced, but requests
+    matching a transformation rule are rejected unless the rule also forwards. Port 443 is relayed without TLS
+    termination. With domain rules, it is evaluated by TLS SNI and connects to an address the runtime resolves for that
+    name, never the address the guest dialed; names need a matching domain rule or default allow, and connections
+    without a hostname SNI are denied. Only rules with header transformations or forwarding, and drain selectors,
+    terminate TLS, which requires clients to trust the sandbox egress CA unless the region serves its sandbox port
+    domain's certificate to egress and the name is exactly one label below that domain; for those, both TLS SNI and HTTP
+    authority are evaluated, and the HTTP authority selects the upstream, any request transformations, and any request
+    forwarding. DNS to the sandbox's configured resolvers is allowed and UDP port 443 is denied.
 
         Attributes:
             default (SandboxNetworkAction):

{archil_openapi-0.0.41 → archil_openapi-0.0.43}/src/archil_openapi/models/sandbox_egress_rule.py

@@ -25,7 +25,9 @@ class SandboxEgressRule:
             the archil-forwarded-host, archil-forwarded-scheme, archil-forwarded-port, archil-forwarded-path, and archil-
             sandbox-id headers with request metadata. A transform on the same rule is applied before forwarding, so the
             forwarded request carries the transformed headers. URLs containing credentials, a query, or a fragment are
-            rejected.
+            rejected. In regions that serve their sandbox port domain's certificate to egress, a target exactly one label
+            below that domain is presented with that publicly trusted certificate, so clients that do not trust the Archil
+            egress CA can use it as a provider base URL.
     """
 
     target: str

{archil_openapi-0.0.41 → archil_openapi-0.0.43}/src/archil_openapi/models/sandbox_network.py

@@ -21,11 +21,16 @@ class SandboxNetwork:
 
         Attributes:
             egress (Union[Unset, SandboxEgressPolicy]): Deny targets take precedence when an address or domain matches both
-                lists. When domain rules or drain selectors are present, TCP ports 80 and 443 are restricted to HTTP/1.1 or
-                HTTP/2. Plaintext HTTP authority is enforced on port 80, but requests matching a transformation rule are
-                rejected unless the rule also forwards. Port 443 is TLS-terminated; both TLS SNI and HTTP authority are
-                evaluated, and the HTTP authority selects the upstream, any request transformations, and any request forwarding.
-                DNS to the sandbox's configured resolvers is allowed and UDP port 443 is denied.
+                lists. When domain rules or drain selectors are present, TCP port 80 is restricted to HTTP/1.1 or HTTP/2 and
+                plaintext HTTP authority is enforced, but requests matching a transformation rule are rejected unless the rule
+                also forwards. Port 443 is relayed without TLS termination. With domain rules, it is evaluated by TLS SNI and
+                connects to an address the runtime resolves for that name, never the address the guest dialed; names need a
+                matching domain rule or default allow, and connections without a hostname SNI are denied. Only rules with header
+                transformations or forwarding, and drain selectors, terminate TLS, which requires clients to trust the sandbox
+                egress CA unless the region serves its sandbox port domain's certificate to egress and the name is exactly one
+                label below that domain; for those, both TLS SNI and HTTP authority are evaluated, and the HTTP authority
+                selects the upstream, any request transformations, and any request forwarding. DNS to the sandbox's configured
+                resolvers is allowed and UDP port 443 is denied.
     """
 
     egress: Union[Unset, "SandboxEgressPolicy"] = UNSET