Make NetworkPolicy a first-class public Pydantic codec

[scotttrinh]

Summary

NetworkPolicy is exposed publicly as a union of public models, but the actual codec to and from the API shape still lives in the internal ApiNetworkPolicy type. That makes parsing arbitrary payloads and serializing back to JSON awkward for callers, and it leaves the real contract split across public and internal types.

Current State

• Public sandbox types export NetworkPolicy, NetworkPolicyCustom, NetworkPolicyRule, NetworkPolicySubnets, and NetworkTransformer:
  • https://github.com/vercel/vercel-py/blob/main/src/vercel/sandbox/__init__.py#L11-L68
• The real wire-format codec is internal ApiNetworkPolicy:
  • https://github.com/vercel/vercel-py/blob/main/src/vercel/_internal/sandbox/models.py#L121-L210
• That internal type owns:
  • from_payload(...)
  • from_network_policy(...)
  • to_network_policy(...)
• Public call sites still depend on that internal codec when sending updates:
  • https://github.com/vercel/vercel-py/blob/main/src/vercel/sandbox/sandbox.py#L269-L278
  • https://github.com/vercel/vercel-py/blob/main/src/vercel/sandbox/sandbox.py#L701-L712
• Sandbox model parsing also routes through the internal API type:
  • https://github.com/vercel/vercel-py/blob/main/src/vercel/_internal/sandbox/models.py#L565-L587

There are already strong tests around the conversion contract:

• https://github.com/vercel/vercel-py/blob/main/tests/unit/test_sandbox_model_network_policy.py
• https://github.com/vercel/vercel-py/blob/main/tests/unit/test_sandbox_network_policy_conversion.py

Desired Direction

• Use a first-class Pydantic pattern for NetworkPolicy so it has a proper public codec to and from the API shape.
• Make it easy to:
  • parse API JSON into the public NetworkPolicy representation
  • serialize the public NetworkPolicy representation back to API JSON
• Eliminate ApiNetworkPolicy as a distinct internal/public conceptual type if possible.

Scope

• Replace the split between NetworkPolicy and ApiNetworkPolicy with one public-facing codec story.
• Keep the current conversion behavior and test coverage, including header-name redaction handling.
• Ensure sandbox create/get/update flows can use the new codec without callers importing internals.