feat(mux): expose CIDR egress rules on the network policy API (#10269)

Author: stainless-app[bot]

.stats.yml

@@ -1,4 +1,4 @@
 configured_endpoints: 119
-openapi_spec_url: https://storage.googleapis.com/stainless-sdk-openapi-specs/runloop-ai/runloop-0e8f05634e48dcbabeafbb1ab71297b2c506f028ffc92a1f01767147e1244a77.yml
-openapi_spec_hash: 46d01fb341301ea07b9860151d9043f7
-config_hash: 9f32651e6269089b5d6c33594b992232
+openapi_spec_url: https://storage.googleapis.com/stainless-sdk-openapi-specs/runloop-ai/runloop-53098c6f2c4d6e31f36a6975b3f7f504ad3f8fbe5a209dac9b2304afcd053a77.yml
+openapi_spec_hash: 05dcd360988cd1044b6a7ab03933a5ef
+config_hash: 218b8d25038e627faab98532392ee9a0

api.md

@@ -364,10 +364,12 @@ Methods:
 
 Types:
 
+- <code><a href="./src/resources/network-policies.ts">AllowedCidr</a></code>
 - <code><a href="./src/resources/network-policies.ts">NetworkPolicyCreateParameters</a></code>
 - <code><a href="./src/resources/network-policies.ts">NetworkPolicyListView</a></code>
 - <code><a href="./src/resources/network-policies.ts">NetworkPolicyUpdateParameters</a></code>
 - <code><a href="./src/resources/network-policies.ts">NetworkPolicyView</a></code>
+- <code><a href="./src/resources/network-policies.ts">PortRule</a></code>
 
 Methods:
 

src/index.ts

@@ -124,6 +124,7 @@ import {
   McpConfigs,
 } from './resources/mcp-configs';
 import {
+  AllowedCidr,
   NetworkPolicies,
   NetworkPolicyCreateParameters,
   NetworkPolicyCreateParams,
@@ -134,6 +135,7 @@ import {
   NetworkPolicyUpdateParams,
   NetworkPolicyView,
   NetworkPolicyViewsNetworkPoliciesCursorIDPage,
+  PortRule,
 } from './resources/network-policies';
 import {
   ObjectCompleteParams,
@@ -769,10 +771,12 @@ export declare namespace Runloop {
 
   export {
     NetworkPolicies as NetworkPolicies,
+    type AllowedCidr as AllowedCidr,
     type NetworkPolicyCreateParameters as NetworkPolicyCreateParameters,
     type NetworkPolicyListView as NetworkPolicyListView,
     type NetworkPolicyUpdateParameters as NetworkPolicyUpdateParameters,
     type NetworkPolicyView as NetworkPolicyView,
+    type PortRule as PortRule,
     NetworkPolicyViewsNetworkPoliciesCursorIDPage as NetworkPolicyViewsNetworkPoliciesCursorIDPage,
     type NetworkPolicyCreateParams as NetworkPolicyCreateParams,
     type NetworkPolicyUpdateParams as NetworkPolicyUpdateParams,

src/resources/index.ts

@@ -147,10 +147,12 @@ export {
 export {
   NetworkPolicyViewsNetworkPoliciesCursorIDPage,
   NetworkPolicies,
+  type AllowedCidr,
   type NetworkPolicyCreateParameters,
   type NetworkPolicyListView,
   type NetworkPolicyUpdateParameters,
   type NetworkPolicyView,
+  type PortRule,
   type NetworkPolicyCreateParams,
   type NetworkPolicyUpdateParams,
   type NetworkPolicyListParams,

src/resources/network-policies.ts

@@ -3,6 +3,7 @@
 import { APIResource } from '../resource';
 import { isRequestOptions } from '../core';
 import * as Core from '../core';
+import * as NetworkPoliciesAPI from './network-policies';
 import { NetworkPoliciesCursorIDPage, type NetworkPoliciesCursorIDPageParams } from '../pagination';
 
 export class NetworkPolicies extends APIResource {
@@ -78,6 +79,22 @@ export class NetworkPolicies extends APIResource {
 
 export class NetworkPolicyViewsNetworkPoliciesCursorIDPage extends NetworkPoliciesCursorIDPage<NetworkPolicyView> {}
 
+/**
+ * A CIDR-based egress allow rule with optional port restrictions.
+ */
+export interface AllowedCidr {
+  /**
+   * IPv4 CIDR block in canonical form (host bits zero), e.g. '10.12.0.0/16'.
+   */
+  cidr: string;
+
+  /**
+   * (Optional) Ports allowed for this CIDR. Empty or omitted means all ports and
+   * protocols.
+   */
+  ports?: Array<PortRule> | null;
+}
+
 /**
  * Parameters required to create a new NetworkPolicy.
  */
@@ -113,6 +130,13 @@ export interface NetworkPolicyCreateParameters {
    */
   allow_mcp_gateway?: boolean | null;
 
+  /**
+   * (Optional) IPv4 CIDR-based allow list with optional port restrictions, additive
+   * with allowed_hostnames. Example: [{'cidr': '10.12.0.0/16', 'ports': [{'port':
+   * 443}]}].
+   */
+  allowed_cidrs?: Array<AllowedCidr> | null;
+
   /**
    * (Optional) DNS-based allow list with wildcard support. Examples: ['github.com',
    * '*.npmjs.org'].
@@ -169,6 +193,12 @@ export interface NetworkPolicyUpdateParameters {
    */
   allow_mcp_gateway?: boolean | null;
 
+  /**
+   * Updated IPv4 CIDR-based allow list with optional port restrictions, additive
+   * with allowed_hostnames.
+   */
+  allowed_cidrs?: Array<AllowedCidr> | null;
+
   /**
    * Updated DNS-based allow list with wildcard support. Examples: ['github.com',
    * '*.npmjs.org'].
@@ -248,6 +278,12 @@ export namespace NetworkPolicyView {
      */
     allow_mcp_gateway: boolean;
 
+    /**
+     * CIDR-based allow list with optional port restrictions, additive with
+     * allowed_hostnames.
+     */
+    allowed_cidrs: Array<NetworkPoliciesAPI.AllowedCidr>;
+
     /**
      * DNS-based allow list with wildcard support. Examples: ['github.com',
      * '*.npmjs.org', 'api.openai.com']. Empty list with allow_all=false means no
@@ -257,6 +293,26 @@ export namespace NetworkPolicyView {
   }
 }
 
+/**
+ * A port or port range allowed for a CIDR egress rule.
+ */
+export interface PortRule {
+  /**
+   * The allowed port (1-65535), or the start of a port range.
+   */
+  port: number;
+
+  /**
+   * (Optional) Inclusive end of the port range (port-65535). Omit for a single port.
+   */
+  end_port?: number | null;
+
+  /**
+   * L4 protocol for a port rule.
+   */
+  protocol?: 'TCP' | 'UDP' | null;
+}
+
 export interface NetworkPolicyCreateParams {
   /**
    * The human-readable name for the NetworkPolicy. Must be unique within the
@@ -289,6 +345,13 @@ export interface NetworkPolicyCreateParams {
    */
   allow_mcp_gateway?: boolean | null;
 
+  /**
+   * (Optional) IPv4 CIDR-based allow list with optional port restrictions, additive
+   * with allowed_hostnames. Example: [{'cidr': '10.12.0.0/16', 'ports': [{'port':
+   * 443}]}].
+   */
+  allowed_cidrs?: Array<AllowedCidr> | null;
+
   /**
    * (Optional) DNS-based allow list with wildcard support. Examples: ['github.com',
    * '*.npmjs.org'].
@@ -322,6 +385,12 @@ export interface NetworkPolicyUpdateParams {
    */
   allow_mcp_gateway?: boolean | null;
 
+  /**
+   * Updated IPv4 CIDR-based allow list with optional port restrictions, additive
+   * with allowed_hostnames.
+   */
+  allowed_cidrs?: Array<AllowedCidr> | null;
+
   /**
    * Updated DNS-based allow list with wildcard support. Examples: ['github.com',
    * '*.npmjs.org'].
@@ -368,10 +437,12 @@ NetworkPolicies.NetworkPolicyViewsNetworkPoliciesCursorIDPage = NetworkPolicyVie
 
 export declare namespace NetworkPolicies {
   export {
+    type AllowedCidr as AllowedCidr,
     type NetworkPolicyCreateParameters as NetworkPolicyCreateParameters,
     type NetworkPolicyListView as NetworkPolicyListView,
     type NetworkPolicyUpdateParameters as NetworkPolicyUpdateParameters,
     type NetworkPolicyView as NetworkPolicyView,
+    type PortRule as PortRule,
     NetworkPolicyViewsNetworkPoliciesCursorIDPage as NetworkPolicyViewsNetworkPoliciesCursorIDPage,
     type NetworkPolicyCreateParams as NetworkPolicyCreateParams,
     type NetworkPolicyUpdateParams as NetworkPolicyUpdateParams,

tests/api-resources/network-policies.test.ts

@@ -27,6 +27,18 @@ describe('resource networkPolicies', () => {
       allow_all: true,
       allow_devbox_to_devbox: true,
       allow_mcp_gateway: true,
+      allowed_cidrs: [
+        {
+          cidr: 'cidr',
+          ports: [
+            {
+              port: 0,
+              end_port: 0,
+              protocol: 'TCP',
+            },
+          ],
+        },
+      ],
       allowed_hostnames: ['string'],
       description: 'description',
     });
@@ -78,6 +90,18 @@ describe('resource networkPolicies', () => {
           allow_all: true,
           allow_devbox_to_devbox: true,
           allow_mcp_gateway: true,
+          allowed_cidrs: [
+            {
+              cidr: 'cidr',
+              ports: [
+                {
+                  port: 0,
+                  end_port: 0,
+                  protocol: 'TCP',
+                },
+              ],
+            },
+          ],
           allowed_hostnames: ['string'],
           description: 'description',
           name: 'name',