// @generated by microsandbox-types. Do not edit by hand.

export type EnvVar = {
  /**
   * Environment variable name.
   */
  key: string;
  /**
   * Environment variable value.
   */
  value: string;
};

export type HandoffInit = {
  /**
   * Init binary: absolute path inside the guest rootfs, or the literal `auto`.
   *
   * Always a Linux-style `/`-separated path — never build it with host OS path APIs, whose semantics diverge on Windows (`\` separators, `/sbin/init` treated as relative).
   */
  cmd: string;
  /**
   * Supplemental argv. `argv[0]` is implicitly `cmd`.
   */
  args: Array<string>;
  /**
   * Extra env vars merged on top of the inherited env.
   */
  env: Array<[string, string]>;
};

export type SecurityProfile = "default" | "restricted";

export type SandboxPolicy = {
  /**
   * Whether the sandbox is ephemeral.
   *
   * Ephemeral sandboxes are one-off: the host runtime that owns the
   * process removes the persisted DB row and on-disk state when the VM
   * reaches a terminal status, and other host runtimes opportunistically
   * clean up ephemeral leftovers from runtimes that died before they
   * could self-clean. Defaults to `false` (persistent); named and created
   * sandboxes stay inspectable and restartable after they stop.
   */
  ephemeral: boolean;
  /**
   * Hard cap on total sandbox lifetime in seconds. `None` = run forever.
   */
  max_duration_secs: number | null;
  /**
   * Idle timeout in seconds. `None` = no idle detection.
   */
  idle_timeout_secs: number | null;
};

export type SandboxLogLevel = "error" | "warn" | "info" | "debug" | "trace";

export type MountOptions = {
  /**
   * Whether the mount is read-only.
   *
   * Guest writes fail with the kernel's read-only filesystem behavior. Virtiofs-backed mounts also reject writes on the host-side filesystem server as defense in depth.
   */
  readonly: boolean;
  /**
   * Whether direct execution from the mount is disabled.
   *
   * This prevents `execve` of binaries or scripts located on the mount. Interpreters can still read files from the mount, for example `sh /mnt/script.sh`, because the interpreter itself executes from a different filesystem.
   */
  noexec: boolean;
  /**
   * Whether setuid and setgid privilege elevation from files on the mount is ignored.
   */
  nosuid: boolean;
  /**
   * Whether device files on the mount are ignored.
   */
  nodev: boolean;
};

export type StatVirtualization = "strict" | "relaxed" | "off";

export type HostPermissions = "private" | "mirror";

export type SecretInjection = {
  /**
   * Substitute in HTTP headers (default: true).
   */
  headers: boolean;
  /**
   * Substitute in HTTP Basic Auth (default: true).
   */
  basic_auth: boolean;
  /**
   * Substitute in URL query parameters (default: false).
   */
  query_params: boolean;
  /**
   * Substitute in request body (default: false).
   *
   * Fixed-length HTTP/1 bodies up to 16 MiB update `Content-Length`;
   * larger fixed-length bodies are blocked. Chunked HTTP/1 bodies are
   * decoded and re-encoded with fresh chunk sizes. Encoded bodies pass
   * through unchanged. HTTP/2 DATA-frame body substitution is not
   * supported; matching body placeholders are blocked.
   */
  body: boolean;
};

export type NetworkPolicy = {
  /**
   * Default action for egress traffic matching no rule. Default: `Deny`.
   */
  default_egress: Action;
  /**
   * Default action for ingress traffic matching no rule. Default: `Deny`.
   */
  default_ingress: Action;
  /**
   * Ordered rules, evaluated first-match-wins per direction.
   */
  rules: Array<Rule>;
};

export type Rule = {
  /**
   * Direction this rule applies to.
   */
  direction: Direction;
  /**
   * Destination filter (direction-dependent interpretation).
   */
  destination: Destination;
  /**
   * Protocol set; empty matches any protocol.
   */
  protocols: Array<Protocol>;
  /**
   * Guest-side port-range set; empty matches any port.
   */
  ports: Array<PortRange>;
  /**
   * Action to take on a match.
   */
  action: Action;
};

export type Action = "allow" | "deny";

export type Direction = "egress" | "ingress" | "any";

export type Protocol = "tcp" | "udp" | "icmpv4" | "icmpv6";

export type Destination = "any" | { "cidr": string } | { "domain": string } | {
  "domain_suffix": string;
} | { "group": DestinationGroup };

export type DestinationGroup =
  | "public"
  | "loopback"
  | "private"
  | "link_local"
  | "metadata"
  | "multicast"
  | "host";

export type PortRange = {
  /**
   * Start port (inclusive).
   */
  start: number;
  /**
   * End port (inclusive).
   */
  end: number;
};