network

Inbound HTTP — network.endpoints

Requires: WEB_END_POINTS

await network.endpoints.create(path, method, callbackName);

Returns { success: true } or { success: false, message }.

Streaming a file from ADDON_TMP_DIR

Endpoint handlers may return { file: absolutePath, contentType? } instead of JSON. The main process streams that file only when it lies under this addon's ADDON_TMP_DIR (HTTP Range supported for media seeking).

events.On('onMedia', ({ query }) => {
  if (query.token !== data.token) {
    return { success: false, message: 'Unauthorized' };
  }
  return { file: `${ADDON_TMP_DIR}/clip.mp4` };
});

Token-protected endpoint for web UI

events.On('onParams', ({ query }) => {
  if (query.token !== data.token) {
    return { success: false, message: 'Unauthorized' };
  }
  return api.config.getParams();
});

Socket.IO — network.socketEndpoints

Requires: SOCKET_END_POINTS

await network.socketEndpoints.create(path, callbackName);
events.On(callbackName, payload => { /* see api-events.md */ });

await network.socketEndpoints.emit(path, event, data, socketId?);

Client connection:

// path: /addon/socket.io
// namespace: /addon/{addonId}/{path}
const socket = io('http://localhost:3000/addon/my_addon/live', {
  path: '/addon/socket.io',
});

Omit socketId in emit to broadcast.

Outbound HTTP — network.request

Requires: NETWORK_REQUEST

Limits: 5 concurrent, 10 s timeout, no private hosts, redirects not followed.

const text = await network.request.get('https://api.example.com/v1/me');
const created = await network.request.post('https://api.example.com/v1/items', { title: 'Hello' });

Outbound WebSocket — network.websocket

Requires: NETWORK_WEBSOCKET

const ws = await network.websocket.connect('wss://example.com/socket', {
  headers: { Authorization: 'Bearer token' },
  protocols: 'json',
});

ws.On('open', () => ws.Send({ type: 'hello' }));
ws.On('message', data => console.log(data));
ws.On('close', ({ code, reason }) => console.log(code, reason));
ws.On('error', err => console.error(err));

ws.Close();
ws.Destroy();

Send accepts string or JSON-serializable object. Max 5 concurrent connections.

Outbound Server-Sent Events — network.sse

Requires: NETWORK_SSE

const sse = await network.sse.connect('https://example.com/events', {
  headers: { Authorization: 'Bearer token' },
  lastEventId: '42',
  autoReconnect: true,
  reconnectInterval: 3000,
});

sse.On('open', () => console.log('stream open'));
sse.On('message', ({ data, event, id }) => console.log(event, data, id));
sse.On('error', err => console.error(err));
sse.On('close', () => console.log('stream closed'));

sse.Close();
sse.Destroy();

message payload: { data: string, event: string, id?: string } (event is "message" when the SSE event: field is omitted). Optional lastEventId is sent as the Last-Event-ID header (also updated from received id: fields when reconnecting).

Max 5 concurrent connections; redirects not followed.

Outbound SignalR — network.signalr

Requires: NETWORK_SIGNALR

Globals LogLevel and HttpTransportType from @microsoft/signalr are available in the sandbox.

const connection = (
  await network.signalr.CreateSignalRConnection(
    'https://example.com/hub?access_token=TOKEN',
    { transport: HttpTransportType.WebSockets }
  )
)
  .withAutomaticReconnect()
  .configureLogging(LogLevel.Information)
  .build();

connection.on('DonationCreated', donation => console.log(donation));
await connection.start();
await connection.invoke('SomeMethod', arg);
await connection.stop();

CreateSignalRConnection validates the URL (http:// / https:// only, same host blocklist as HTTP) and returns a HubConnectionBuilder with withUrl already applied. Calling withUrl again or changing connection.baseUrl is blocked. Max 5 concurrent started connections. Custom httpClient and custom transport objects are not allowed.