tpmjs/packages/tools/official/sprites-policy-set

@tpmjs/sprites-policy-set

Update the network policy for a sprite to control outbound network access.

Installation

npm install @tpmjs/sprites-policy-set

Requirements

• SPRITES_TOKEN environment variable - Get your token from https://sprites.dev

Usage

import { spritesPolicySetTool } from '@tpmjs/sprites-policy-set';

// Allow only specific domains (block everything else)
const result = await spritesPolicySetTool.execute({
  name: 'my-sandbox',
  mode: 'allow',
  domains: ['api.github.com', 'registry.npmjs.org', 'pypi.org']
});

console.log(result);
// {
//   policy: {
//     mode: 'allow',
//     domains: ['api.github.com', 'registry.npmjs.org', 'pypi.org']
//   },
//   applied: true
// }

// Block specific domains (allow everything else)
const blockResult = await spritesPolicySetTool.execute({
  name: 'my-sandbox',
  mode: 'deny',
  domains: ['malicious-site.com', 'tracking.example.com']
});

Input Parameters

Parameter	Type	Required	Description
name	string	Yes	Name of the sprite to update policy for
mode	'allow' | 'deny'	Yes	Policy mode
domains	string[]	Yes	List of domains to allow or deny based on mode

Output

Field	Type	Description
policy	NetworkPolicy	The applied network policy
applied	boolean	Whether the policy was successfully applied

NetworkPolicy Object

Field	Type	Description
mode	'allow' | 'deny'	Policy mode
domains	string[]	List of domains affected by the policy
rules	object[]?	Optional additional filtering rules

Policy Modes

• allow mode: Blocks all outbound traffic EXCEPT to listed domains

  • Use for maximum security when you know exactly which APIs are needed

• deny mode: Allows all outbound traffic EXCEPT to listed domains

  • Use to block known-bad domains while allowing general access

Use Cases

• Restrict sprite to only access required APIs
• Block access to potentially harmful domains
• Implement defense-in-depth security
• Ensure code can only communicate with trusted services

Error Handling

The tool throws errors in these cases:

• SPRITES_TOKEN environment variable is not set
• Invalid mode (must be 'allow' or 'deny')
• Domains must be an array
• Sprite not found (HTTP 404)
• Invalid or expired API token (HTTP 401)
• Network timeout (30 second limit)
• API errors with descriptive messages

License

MIT