## ADDED Requirements

### Requirement: Network policy type

The system SHALL define a `NetworkPolicy` type with three forms:

- `"allow-all"` — full internet access (default)
- `"deny-all"` — no external access
- `{ allow?: string[] | Record<string, NetworkPolicyRule[]>; subnets?: { allow?: string[]; deny?: string[] } }` — custom rules

#### Scenario: Allow-all permits all traffic

- **WHEN** `networkPolicy: "allow-all"` is set
- **THEN** all outbound traffic SHALL be permitted

#### Scenario: Deny-all blocks all traffic

- **WHEN** `networkPolicy: "deny-all"` is set
- **THEN** all outbound traffic SHALL be denied

#### Scenario: Domain allowlist restricts access

- **WHEN** `networkPolicy: { allow: ["*.npmjs.org"] }` is set
- **THEN** traffic to `registry.npmjs.org` SHALL be allowed and all other traffic SHALL be denied

#### Scenario: Wildcard domains match subdomains

- **WHEN** a domain pattern starts with `*.` (e.g., `*.example.com`)
- **THEN** it SHALL match any subdomain of that domain

### Requirement: Network policy rules with transformers

The system SHALL support per-domain rules with request transformers for header injection.

Parameters per rule:
- `match?: { path?, method?, queryString?, headers? }` — request matchers
- `transform?: { headers: Record<string, string> }[]` — header injection
- `forwardURL?: string` — HTTPS proxy forwarding

#### Scenario: Header transform injects authorization

- **WHEN** a request matches a rule with `transform: [{ headers: { authorization: "Bearer token" } }]`
- **THEN** the `authorization` header SHALL be injected before forwarding

### Requirement: Subnet filtering

The system SHALL support subnet-level access control via CIDR notation.

#### Scenario: Subnet allow takes precedence over domain deny

- **WHEN** `subnets: { allow: ["10.0.0.0/8"] }` is set
- **THEN** traffic to `10.0.0.1` SHALL be allowed regardless of domain rules