@foro-sh/foro 0.10.0 → 0.12.1

package/dist/_generated-manifest-cases.d.ts

@@ -1,219 +1,713 @@
 export declare const rawManifestCases: readonly [{
-    readonly name: "minimal-valid";
-    readonly yaml: "name: my-server\nentrypoint: server.py\n";
+    readonly name: "python-minimal";
+    readonly files: {
+        readonly "pyproject.toml": "[project]\nname = \"my-server\"\n";
+        readonly "server.py": "";
+    };
+    readonly expect: {
+        readonly ok: true;
+    };
+}, {
+    readonly name: "python-poetry-only-name";
+    readonly files: {
+        readonly "pyproject.toml": "[tool.poetry]\nname = \"my-server\"\n";
+        readonly "main.py": "";
+    };
     readonly expect: {
         readonly ok: true;
     };
 }, {
-    readonly name: "nested-entrypoint";
-    readonly yaml: "name: my-server\nentrypoint: src/server.py\n";
+    readonly name: "python-explicit-entrypoint";
+    readonly files: {
+        readonly "pyproject.toml": "[project]\nname = \"my-server\"\n\n[tool.foro]\nentrypoint = \"src/server.py\"\n";
+    };
     readonly expect: {
         readonly ok: true;
     };
 }, {
-    readonly name: "all-fields";
-    readonly yaml: "name: my-server\nentrypoint: server.py\nbuild_path: app\nruntime: python\nruntime_version: \"3.11\"\nport: 9000\ndependency_manager: poetry\n";
+    readonly name: "python-all-fields";
+    readonly files: {
+        readonly "pyproject.toml": "[project]\nname = \"my-server\"\n\n[tool.foro]\nbuild_path = \"app\"\nentrypoint = \"server.py\"\nruntime = \"python\"\nruntime_version = \"3.11\"\nport = 9000\ndependency_manager = \"poetry\"\n";
+    };
     readonly expect: {
         readonly ok: true;
     };
 }, {
-    readonly name: "unquoted-runtime-version";
-    readonly yaml: "name: my-server\nentrypoint: server.py\nruntime_version: 3.12\n";
+    readonly name: "python-requires-python-range";
+    readonly files: {
+        readonly "pyproject.toml": "[project]\nname = \"my-server\"\nrequires-python = \">=3.11,<3.13\"\n";
+        readonly "server.py": "";
+    };
     readonly expect: {
         readonly ok: true;
     };
 }, {
-    readonly name: "bad-name-uppercase";
-    readonly yaml: "name: My-Server\nentrypoint: server.py\n";
+    readonly name: "python-requires-python-exclusion";
+    readonly files: {
+        readonly "pyproject.toml": "[project]\nname = \"my-server\"\nrequires-python = \">=3.11,!=3.13\"\n";
+        readonly "server.py": "";
+    };
+    readonly expect: {
+        readonly ok: true;
+    };
+}, {
+    readonly name: "python-requires-python-excludes-every-supported-version-one-by-one";
+    readonly files: {
+        readonly "pyproject.toml": "[project]\nname = \"my-server\"\nrequires-python = \">=3.11,!=3.11,!=3.12,!=3.13\"\n";
+        readonly "server.py": "";
+    };
     readonly expect: {
         readonly ok: false;
-        readonly reason: "invalid_name";
+        readonly reason: "invalid_runtime_version";
     };
 }, {
-    readonly name: "bad-name-too-short";
-    readonly yaml: "name: ab\nentrypoint: server.py\n";
+    readonly name: "python-hyphen-inside-a-path-segment-is-fine";
+    readonly files: {
+        readonly "pyproject.toml": "[project]\nname = \"my-server\"\n\n[tool.foro]\nentrypoint = \"my-tools/mcp-server.py\"\n";
+    };
+    readonly expect: {
+        readonly ok: true;
+    };
+}, {
+    readonly name: "python-scoped-unspellable-name-is-normalised";
+    readonly files: {
+        readonly "pyproject.toml": "[project]\nname = \"My_Server\"\n";
+        readonly "server.py": "";
+    };
+    readonly expect: {
+        readonly ok: true;
+    };
+}, {
+    readonly name: "python-no-entry-file";
+    readonly files: {
+        readonly "pyproject.toml": "[project]\nname = \"my-server\"\n";
+    };
     readonly expect: {
         readonly ok: false;
-        readonly reason: "invalid_name";
+        readonly reason: "invalid_entrypoint";
     };
 }, {
-    readonly name: "missing-name";
-    readonly yaml: "entrypoint: server.py\n";
+    readonly name: "python-entrypoint-traversal";
+    readonly files: {
+        readonly "pyproject.toml": "[project]\nname = \"my-server\"\n\n[tool.foro]\nentrypoint = \"../server.py\"\n";
+    };
     readonly expect: {
         readonly ok: false;
-        readonly reason: "invalid_name";
+        readonly reason: "invalid_entrypoint";
     };
 }, {
-    readonly name: "bad-entrypoint-traversal";
-    readonly yaml: "name: my-server\nentrypoint: ../server.py\n";
+    readonly name: "python-entrypoint-absolute";
+    readonly files: {
+        readonly "pyproject.toml": "[project]\nname = \"my-server\"\n\n[tool.foro]\nentrypoint = \"/server.py\"\n";
+    };
     readonly expect: {
         readonly ok: false;
         readonly reason: "invalid_entrypoint";
     };
 }, {
-    readonly name: "bad-entrypoint-absolute";
-    readonly yaml: "name: my-server\nentrypoint: /server.py\n";
+    readonly name: "python-entrypoint-shell-metachar";
+    readonly files: {
+        readonly "pyproject.toml": "[project]\nname = \"my-server\"\n\n[tool.foro]\nentrypoint = \"server.py; rm -rf x\"\n";
+    };
     readonly expect: {
         readonly ok: false;
         readonly reason: "invalid_entrypoint";
     };
 }, {
-    readonly name: "bad-entrypoint-shell-metachar";
-    readonly yaml: "name: my-server\nentrypoint: \"server.py; rm -rf x\"\n";
+    readonly name: "python-entrypoint-leading-dash";
+    readonly files: {
+        readonly "pyproject.toml": "[project]\nname = \"my-server\"\n\n[tool.foro]\nentrypoint = \"--isolated\"\n";
+    };
     readonly expect: {
         readonly ok: false;
         readonly reason: "invalid_entrypoint";
     };
 }, {
-    readonly name: "missing-entrypoint";
-    readonly yaml: "name: my-server\n";
+    readonly name: "python-entrypoint-leading-dash-nested";
+    readonly files: {
+        readonly "pyproject.toml": "[project]\nname = \"my-server\"\n\n[tool.foro]\nentrypoint = \"src/-rf.py\"\n";
+    };
     readonly expect: {
         readonly ok: false;
         readonly reason: "invalid_entrypoint";
     };
 }, {
-    readonly name: "bad-build-path-traversal";
-    readonly yaml: "name: my-server\nentrypoint: server.py\nbuild_path: ../x\n";
+    readonly name: "python-build-path-traversal";
+    readonly files: {
+        readonly "pyproject.toml": "[project]\nname = \"my-server\"\n\n[tool.foro]\nentrypoint = \"server.py\"\nbuild_path = \"../x\"\n";
+    };
     readonly expect: {
         readonly ok: false;
         readonly reason: "invalid_build_path";
     };
 }, {
-    readonly name: "bad-build-path-shell-metachar";
-    readonly yaml: "name: my-server\nentrypoint: server.py\nbuild_path: \". && whoami\"\n";
+    readonly name: "python-build-path-shell-metachar";
+    readonly files: {
+        readonly "pyproject.toml": "[project]\nname = \"my-server\"\n\n[tool.foro]\nentrypoint = \"server.py\"\nbuild_path = \". && whoami\"\n";
+    };
     readonly expect: {
         readonly ok: false;
         readonly reason: "invalid_build_path";
     };
 }, {
-    readonly name: "bad-build-path-space";
-    readonly yaml: "name: my-server\nentrypoint: server.py\nbuild_path: \"my services\"\n";
+    readonly name: "python-build-path-space";
+    readonly files: {
+        readonly "pyproject.toml": "[project]\nname = \"my-server\"\n\n[tool.foro]\nentrypoint = \"server.py\"\nbuild_path = \"my services\"\n";
+    };
     readonly expect: {
         readonly ok: false;
         readonly reason: "invalid_build_path";
     };
 }, {
-    readonly name: "bad-build-path-newline";
-    readonly yaml: "name: my-server\nentrypoint: server.py\nbuild_path: \"app\\nUSER root\"\n";
+    readonly name: "python-build-path-newline";
+    readonly files: {
+        readonly "pyproject.toml": "[project]\nname = \"my-server\"\n\n[tool.foro]\nentrypoint = \"server.py\"\nbuild_path = \"app\\nUSER root\"\n";
+    };
     readonly expect: {
         readonly ok: false;
         readonly reason: "invalid_build_path";
     };
 }, {
-    readonly name: "bad-runtime-version";
-    readonly yaml: "name: my-server\nentrypoint: server.py\nruntime_version: \"3.9\"\n";
+    readonly name: "python-build-path-leading-dash";
+    readonly files: {
+        readonly "pyproject.toml": "[project]\nname = \"my-server\"\n\n[tool.foro]\nentrypoint = \"server.py\"\nbuild_path = \"-rf\"\n";
+    };
+    readonly expect: {
+        readonly ok: false;
+        readonly reason: "invalid_build_path";
+    };
+}, {
+    readonly name: "python-runtime-version-outside-allowlist";
+    readonly files: {
+        readonly "pyproject.toml": "[project]\nname = \"my-server\"\n\n[tool.foro]\nentrypoint = \"server.py\"\nruntime_version = \"3.9\"\n";
+    };
     readonly expect: {
         readonly ok: false;
         readonly reason: "invalid_runtime_version";
     };
 }, {
-    readonly name: "bad-runtime";
-    readonly yaml: "name: my-server\nentrypoint: server.py\nruntime: node\n";
+    readonly name: "python-requires-python-excludes-every-supported-version";
+    readonly files: {
+        readonly "pyproject.toml": "[project]\nname = \"my-server\"\nrequires-python = \"==3.9\"\n";
+        readonly "server.py": "";
+    };
     readonly expect: {
         readonly ok: false;
-        readonly reason: "invalid_runtime";
+        readonly reason: "invalid_runtime_version";
     };
 }, {
-    readonly name: "runtime-version-from-another-runtime";
-    readonly yaml: "name: my-server\nentrypoint: server.py\nruntime: python\nruntime_version: \"22\"\n";
+    readonly name: "python-runtime-version-from-another-runtime";
+    readonly files: {
+        readonly "pyproject.toml": "[project]\nname = \"my-server\"\n\n[tool.foro]\nentrypoint = \"server.py\"\nruntime_version = \"22\"\n";
+    };
     readonly expect: {
         readonly ok: false;
         readonly reason: "invalid_runtime_version";
     };
+}, {
+    readonly name: "runtime-outside-allowlist";
+    readonly files: {
+        readonly "pyproject.toml": "[project]\nname = \"my-server\"\n\n[tool.foro]\nentrypoint = \"server.py\"\nruntime = \"ruby\"\n";
+    };
+    readonly expect: {
+        readonly ok: false;
+        readonly reason: "invalid_runtime";
+    };
+}, {
+    readonly name: "runtime-disagrees-with-the-file-it-was-read-from";
+    readonly files: {
+        readonly "pyproject.toml": "[project]\nname = \"my-server\"\n\n[tool.foro]\nentrypoint = \"server.py\"\nruntime = \"node\"\n";
+    };
+    readonly expect: {
+        readonly ok: false;
+        readonly reason: "invalid_runtime";
+    };
+}, {
+    readonly name: "both-config-files-and-neither-claims-the-runtime";
+    readonly files: {
+        readonly "pyproject.toml": "[project]\nname = \"my-server\"\n";
+        readonly "package.json": "{\"name\": \"my-server\", \"main\": \"index.js\"}";
+        readonly "server.py": "";
+    };
+    readonly expect: {
+        readonly ok: false;
+        readonly reason: "invalid_runtime";
+    };
+}, {
+    readonly name: "both-config-files-and-both-claim-the-runtime";
+    readonly files: {
+        readonly "pyproject.toml": "[project]\nname = \"my-server\"\n\n[tool.foro]\nruntime = \"python\"\n";
+        readonly "package.json": "{\"name\": \"my-server\", \"main\": \"index.js\", \"foro\": {\"runtime\": \"node\"}}";
+        readonly "server.py": "";
+    };
+    readonly expect: {
+        readonly ok: false;
+        readonly reason: "invalid_runtime";
+    };
+}, {
+    readonly name: "both-config-files-python-claims-the-runtime";
+    readonly files: {
+        readonly "pyproject.toml": "[project]\nname = \"my-server\"\n\n[tool.foro]\nruntime = \"python\"\n";
+        readonly "package.json": "{\"name\": \"tooling-only\"}";
+        readonly "server.py": "";
+    };
+    readonly expect: {
+        readonly ok: true;
+    };
+}, {
+    readonly name: "both-config-files-node-claims-the-runtime";
+    readonly files: {
+        readonly "pyproject.toml": "[project]\nname = \"my-server\"\n";
+        readonly "package.json": "{\"name\": \"my-server\", \"main\": \"index.js\", \"foro\": {\"runtime\": \"node\"}}";
+        readonly "server.py": "";
+    };
+    readonly expect: {
+        readonly ok: true;
+    };
+}, {
+    readonly name: "no-config-file-only-a-legacy-manifest";
+    readonly files: {
+        readonly "foro.yaml": "name: my-server\nentrypoint: server.py\n";
+        readonly "server.py": "";
+    };
+    readonly expect: {
+        readonly ok: false;
+        readonly reason: "missing_manifest";
+    };
 }, {
     readonly name: "unknown-field-stale-python-version";
-    readonly yaml: "name: my-server\nentrypoint: server.py\npython_version: \"3.13\"\n";
+    readonly files: {
+        readonly "pyproject.toml": "[project]\nname = \"my-server\"\n\n[tool.foro]\nentrypoint = \"server.py\"\npython_version = \"3.13\"\n";
+    };
     readonly expect: {
         readonly ok: false;
         readonly reason: "unknown_field";
     };
 }, {
     readonly name: "unknown-field-typo";
-    readonly yaml: "name: my-server\nentrypoint: server.py\nentrypoints: server.py\n";
+    readonly files: {
+        readonly "pyproject.toml": "[project]\nname = \"my-server\"\n\n[tool.foro]\nentrypoint = \"server.py\"\nentrypoints = \"server.py\"\n";
+    };
     readonly expect: {
         readonly ok: false;
         readonly reason: "unknown_field";
     };
 }, {
-    readonly name: "bad-port-too-low";
-    readonly yaml: "name: my-server\nentrypoint: server.py\nport: 80\n";
+    readonly name: "unknown-field-name-belongs-to-the-package";
+    readonly files: {
+        readonly "pyproject.toml": "[project]\nname = \"my-server\"\n\n[tool.foro]\nentrypoint = \"server.py\"\nname = \"other\"\n";
+    };
+    readonly expect: {
+        readonly ok: false;
+        readonly reason: "unknown_field";
+    };
+}, {
+    readonly name: "port-too-low";
+    readonly files: {
+        readonly "pyproject.toml": "[project]\nname = \"my-server\"\n\n[tool.foro]\nentrypoint = \"server.py\"\nport = 80\n";
+    };
+    readonly expect: {
+        readonly ok: false;
+        readonly reason: "invalid_port";
+    };
+}, {
+    readonly name: "port-too-high";
+    readonly files: {
+        readonly "pyproject.toml": "[project]\nname = \"my-server\"\n\n[tool.foro]\nentrypoint = \"server.py\"\nport = 70000\n";
+    };
     readonly expect: {
         readonly ok: false;
         readonly reason: "invalid_port";
     };
 }, {
-    readonly name: "bad-port-too-high";
-    readonly yaml: "name: my-server\nentrypoint: server.py\nport: 70000\n";
+    readonly name: "port-sidecar-reserved";
+    readonly files: {
+        readonly "pyproject.toml": "[project]\nname = \"my-server\"\n\n[tool.foro]\nentrypoint = \"server.py\"\nport = 8001\n";
+    };
     readonly expect: {
         readonly ok: false;
         readonly reason: "invalid_port";
     };
 }, {
-    readonly name: "bad-port-sidecar-reserved";
-    readonly yaml: "name: my-server\nentrypoint: server.py\nport: 8001\n";
+    readonly name: "port-gate-reserved";
+    readonly files: {
+        readonly "pyproject.toml": "[project]\nname = \"my-server\"\n\n[tool.foro]\nentrypoint = \"server.py\"\nport = 8002\n";
+    };
     readonly expect: {
         readonly ok: false;
         readonly reason: "invalid_port";
     };
 }, {
-    readonly name: "bad-port-non-integer";
-    readonly yaml: "name: my-server\nentrypoint: server.py\nport: \"abc\"\n";
+    readonly name: "port-non-integer";
+    readonly files: {
+        readonly "pyproject.toml": "[project]\nname = \"my-server\"\n\n[tool.foro]\nentrypoint = \"server.py\"\nport = \"abc\"\n";
+    };
     readonly expect: {
         readonly ok: false;
         readonly reason: "invalid_port";
     };
 }, {
-    readonly name: "bad-dependency-manager";
-    readonly yaml: "name: my-server\nentrypoint: server.py\ndependency_manager: pipx\n";
+    readonly name: "dependency-manager-outside-allowlist";
+    readonly files: {
+        readonly "pyproject.toml": "[project]\nname = \"my-server\"\n\n[tool.foro]\nentrypoint = \"server.py\"\ndependency_manager = \"pipx\"\n";
+    };
     readonly expect: {
         readonly ok: false;
         readonly reason: "invalid_dependency_manager";
     };
 }, {
-    readonly name: "invalid-yaml";
-    readonly yaml: "name: [unclosed\n";
+    readonly name: "node-dependency-manager-on-python";
+    readonly files: {
+        readonly "pyproject.toml": "[project]\nname = \"my-server\"\n\n[tool.foro]\nentrypoint = \"server.py\"\ndependency_manager = \"npm\"\n";
+    };
     readonly expect: {
         readonly ok: false;
-        readonly reason: "invalid_yaml";
+        readonly reason: "invalid_dependency_manager";
     };
 }, {
-    readonly name: "invalid-shape-scalar";
-    readonly yaml: "just a string\n";
+    readonly name: "unparseable-pyproject";
+    readonly files: {
+        readonly "pyproject.toml": "[project\nname = \"my-server\"\n";
+    };
     readonly expect: {
         readonly ok: false;
         readonly reason: "invalid_shape";
     };
 }, {
-    readonly name: "invalid-shape-list";
-    readonly yaml: "- one\n- two\n";
+    readonly name: "node-minimal";
+    readonly files: {
+        readonly "package.json": "{\"name\": \"my-server\", \"main\": \"dist/index.js\"}";
+    };
+    readonly expect: {
+        readonly ok: true;
+    };
+}, {
+    readonly name: "node-scoped-name";
+    readonly files: {
+        readonly "package.json": "{\"name\": \"@acme/my-server\", \"main\": \"dist/index.js\"}";
+    };
+    readonly expect: {
+        readonly ok: true;
+    };
+}, {
+    readonly name: "node-bin-map";
+    readonly files: {
+        readonly "package.json": "{\"name\": \"my-server\", \"bin\": {\"my-server\": \"dist/cli.js\"}}";
+    };
+    readonly expect: {
+        readonly ok: true;
+    };
+}, {
+    readonly name: "node-implicit-index";
+    readonly files: {
+        readonly "package.json": "{\"name\": \"my-server\"}";
+        readonly "index.js": "";
+    };
+    readonly expect: {
+        readonly ok: true;
+    };
+}, {
+    readonly name: "node-engines-range";
+    readonly files: {
+        readonly "package.json": "{\"name\": \"my-server\", \"main\": \"index.js\", \"engines\": {\"node\": \">=22\"}}";
+    };
+    readonly expect: {
+        readonly ok: true;
+    };
+}, {
+    readonly name: "node-engines-union-of-every-supported-major";
+    readonly files: {
+        readonly "package.json": "{\"name\": \"my-server\", \"main\": \"index.js\", \"engines\": {\"node\": \"^22 || ^24\"}}";
+    };
+    readonly expect: {
+        readonly ok: true;
+    };
+}, {
+    readonly name: "node-engines-union-with-one-unsupported-branch";
+    readonly files: {
+        readonly "package.json": "{\"name\": \"my-server\", \"main\": \"index.js\", \"engines\": {\"node\": \"^20 || ^22\"}}";
+    };
+    readonly expect: {
+        readonly ok: true;
+    };
+}, {
+    readonly name: "node-all-fields";
+    readonly files: {
+        readonly "package.json": "{\"name\": \"my-server\", \"main\": \"dist/index.js\", \"foro\": {\"runtime\": \"node\", \"runtime_version\": \"22\", \"port\": 9000, \"dependency_manager\": \"pnpm\"}}";
+    };
+    readonly expect: {
+        readonly ok: true;
+    };
+}, {
+    readonly name: "node-no-entry-file";
+    readonly files: {
+        readonly "package.json": "{\"name\": \"my-server\"}";
+    };
+    readonly expect: {
+        readonly ok: false;
+        readonly reason: "invalid_entrypoint";
+    };
+}, {
+    readonly name: "node-engines-excludes-every-supported-version";
+    readonly files: {
+        readonly "package.json": "{\"name\": \"my-server\", \"main\": \"index.js\", \"engines\": {\"node\": \"^20\"}}";
+    };
+    readonly expect: {
+        readonly ok: false;
+        readonly reason: "invalid_runtime_version";
+    };
+}, {
+    readonly name: "node-runtime-version-from-another-runtime";
+    readonly files: {
+        readonly "package.json": "{\"name\": \"my-server\", \"main\": \"index.js\", \"foro\": {\"runtime_version\": \"3.12\"}}";
+    };
+    readonly expect: {
+        readonly ok: false;
+        readonly reason: "invalid_runtime_version";
+    };
+}, {
+    readonly name: "python-dependency-manager-on-node";
+    readonly files: {
+        readonly "package.json": "{\"name\": \"my-server\", \"main\": \"index.js\", \"foro\": {\"dependency_manager\": \"uv\"}}";
+    };
+    readonly expect: {
+        readonly ok: false;
+        readonly reason: "invalid_dependency_manager";
+    };
+}, {
+    readonly name: "unparseable-package-json";
+    readonly files: {
+        readonly "package.json": "{\"name\": ";
+    };
     readonly expect: {
         readonly ok: false;
         readonly reason: "invalid_shape";
     };
 }, {
-    readonly name: "bad-entrypoint-leading-dash";
-    readonly yaml: "name: my-server\nentrypoint: --isolated\n";
+    readonly name: "python-egress-ip-entry";
+    readonly files: {
+        readonly "pyproject.toml": "[project]\nname = \"my-server\"\n\n[tool.foro]\nentrypoint = \"server.py\"\negress = [\"10.20.30.40:5432\"]\n";
+    };
+    readonly expect: {
+        readonly ok: true;
+    };
+}, {
+    readonly name: "python-egress-cidr-entry";
+    readonly files: {
+        readonly "pyproject.toml": "[project]\nname = \"my-server\"\n\n[tool.foro]\nentrypoint = \"server.py\"\negress = [\"10.20.0.0/16:443\"]\n";
+    };
+    readonly expect: {
+        readonly ok: true;
+    };
+}, {
+    readonly name: "python-egress-hostname-entry";
+    readonly files: {
+        readonly "pyproject.toml": "[project]\nname = \"my-server\"\n\n[tool.foro]\nentrypoint = \"server.py\"\negress = [\"sql.database.windows.net:1433\"]\n";
+    };
+    readonly expect: {
+        readonly ok: true;
+    };
+}, {
+    readonly name: "python-egress-multiple-entries";
+    readonly files: {
+        readonly "pyproject.toml": "[project]\nname = \"my-server\"\n\n[tool.foro]\nentrypoint = \"server.py\"\negress = [\"sql.database.windows.net:1433\", \"10.20.30.40:5432\", \"10.20.0.0/16:443\"]\n";
+    };
+    readonly expect: {
+        readonly ok: true;
+    };
+}, {
+    readonly name: "python-egress-empty-list-denies-everything";
+    readonly files: {
+        readonly "pyproject.toml": "[project]\nname = \"my-server\"\n\n[tool.foro]\nentrypoint = \"server.py\"\negress = []\n";
+    };
+    readonly expect: {
+        readonly ok: true;
+    };
+}, {
+    readonly name: "python-egress-missing-port";
+    readonly files: {
+        readonly "pyproject.toml": "[project]\nname = \"my-server\"\n\n[tool.foro]\nentrypoint = \"server.py\"\negress = [\"example.com\"]\n";
+    };
     readonly expect: {
         readonly ok: false;
-        readonly reason: "invalid_entrypoint";
+        readonly reason: "invalid_egress";
     };
 }, {
-    readonly name: "bad-entrypoint-leading-dash-nested";
-    readonly yaml: "name: my-server\nentrypoint: src/-rf.py\n";
+    readonly name: "python-egress-port-zero";
+    readonly files: {
+        readonly "pyproject.toml": "[project]\nname = \"my-server\"\n\n[tool.foro]\nentrypoint = \"server.py\"\negress = [\"example.com:0\"]\n";
+    };
     readonly expect: {
         readonly ok: false;
-        readonly reason: "invalid_entrypoint";
+        readonly reason: "invalid_egress";
     };
 }, {
-    readonly name: "bad-build-path-leading-dash";
-    readonly yaml: "name: my-server\nentrypoint: server.py\nbuild_path: -rf\n";
+    readonly name: "python-egress-port-too-high";
+    readonly files: {
+        readonly "pyproject.toml": "[project]\nname = \"my-server\"\n\n[tool.foro]\nentrypoint = \"server.py\"\negress = [\"example.com:65536\"]\n";
+    };
     readonly expect: {
         readonly ok: false;
-        readonly reason: "invalid_build_path";
+        readonly reason: "invalid_egress";
+    };
+}, {
+    readonly name: "python-egress-blocked-mail-port";
+    readonly files: {
+        readonly "pyproject.toml": "[project]\nname = \"my-server\"\n\n[tool.foro]\nentrypoint = \"server.py\"\negress = [\"smtp.example.com:25\"]\n";
+    };
+    readonly expect: {
+        readonly ok: false;
+        readonly reason: "invalid_egress";
+    };
+}, {
+    readonly name: "python-egress-metadata-endpoint";
+    readonly files: {
+        readonly "pyproject.toml": "[project]\nname = \"my-server\"\n\n[tool.foro]\nentrypoint = \"server.py\"\negress = [\"169.254.169.254:80\"]\n";
+    };
+    readonly expect: {
+        readonly ok: false;
+        readonly reason: "invalid_egress";
+    };
+}, {
+    readonly name: "python-egress-whole-internet";
+    readonly files: {
+        readonly "pyproject.toml": "[project]\nname = \"my-server\"\n\n[tool.foro]\nentrypoint = \"server.py\"\negress = [\"0.0.0.0/0:443\"]\n";
+    };
+    readonly expect: {
+        readonly ok: false;
+        readonly reason: "invalid_egress";
+    };
+}, {
+    readonly name: "python-egress-wide-range-swallows-a-reserved-one";
+    readonly files: {
+        readonly "pyproject.toml": "[project]\nname = \"my-server\"\n\n[tool.foro]\nentrypoint = \"server.py\"\negress = [\"172.16.0.0/12:443\"]\n";
+    };
+    readonly expect: {
+        readonly ok: false;
+        readonly reason: "invalid_egress";
+    };
+}, {
+    readonly name: "python-egress-hostname-over-253-chars";
+    readonly files: {
+        readonly "pyproject.toml": "[project]\nname = \"my-server\"\n\n[tool.foro]\nentrypoint = \"server.py\"\negress = [\"aaaa.aaaa.aaaa.aaaa.aaaa.aaaa.aaaa.aaaa.aaaa.aaaa.aaaa.aaaa.aaaa.aaaa.aaaa.aaaa.aaaa.aaaa.aaaa.aaaa.aaaa.aaaa.aaaa.aaaa.aaaa.aaaa.aaaa.aaaa.aaaa.aaaa.aaaa.aaaa.aaaa.aaaa.aaaa.aaaa.aaaa.aaaa.aaaa.aaaa.aaaa.aaaa.aaaa.aaaa.aaaa.aaaa.aaaa.aaaa.aaaa.aaaa.aaaa:443\"]\n";
+    };
+    readonly expect: {
+        readonly ok: false;
+        readonly reason: "invalid_egress";
+    };
+}, {
+    readonly name: "python-egress-string-instead-of-list";
+    readonly files: {
+        readonly "pyproject.toml": "[project]\nname = \"my-server\"\n\n[tool.foro]\nentrypoint = \"server.py\"\negress = \"example.com:443\"\n";
+    };
+    readonly expect: {
+        readonly ok: false;
+        readonly reason: "invalid_egress";
+    };
+}, {
+    readonly name: "python-egress-over-entry-cap";
+    readonly files: {
+        readonly "pyproject.toml": "[project]\nname = \"my-server\"\n\n[tool.foro]\nentrypoint = \"server.py\"\negress = [\"h0.example.com:443\", \"h1.example.com:443\", \"h2.example.com:443\", \"h3.example.com:443\", \"h4.example.com:443\", \"h5.example.com:443\", \"h6.example.com:443\", \"h7.example.com:443\", \"h8.example.com:443\", \"h9.example.com:443\", \"h10.example.com:443\", \"h11.example.com:443\", \"h12.example.com:443\", \"h13.example.com:443\", \"h14.example.com:443\", \"h15.example.com:443\", \"h16.example.com:443\", \"h17.example.com:443\", \"h18.example.com:443\", \"h19.example.com:443\", \"h20.example.com:443\"]\n";
+    };
+    readonly expect: {
+        readonly ok: false;
+        readonly reason: "invalid_egress";
+    };
+}, {
+    readonly name: "node-egress-non-string-entry";
+    readonly files: {
+        readonly "package.json": "{\"name\": \"my-server\", \"main\": \"index.js\", \"foro\": {\"egress\": [443]}}";
+    };
+    readonly expect: {
+        readonly ok: false;
+        readonly reason: "invalid_egress";
+    };
+}, {
+    readonly name: "python-egress-shell-metacharacter";
+    readonly files: {
+        readonly "pyproject.toml": "[project]\nname = \"my-server\"\n\n[tool.foro]\nentrypoint = \"server.py\"\negress = [\"evil.com:443; rm -rf /\"]\n";
+    };
+    readonly expect: {
+        readonly ok: false;
+        readonly reason: "invalid_egress";
+    };
+}, {
+    readonly name: "python-egress-embedded-whitespace";
+    readonly files: {
+        readonly "pyproject.toml": "[project]\nname = \"my-server\"\n\n[tool.foro]\nentrypoint = \"server.py\"\negress = [\"evil .com:443\"]\n";
+    };
+    readonly expect: {
+        readonly ok: false;
+        readonly reason: "invalid_egress";
     };
 }, {
-    readonly name: "hyphen-inside-a-path-segment-is-fine";
-    readonly yaml: "name: my-server\nentrypoint: my-tools/mcp-server.py\n";
+    readonly name: "python-egress-embedded-newline";
+    readonly files: {
+        readonly "pyproject.toml": "[project]\nname = \"my-server\"\n\n[tool.foro]\nentrypoint = \"server.py\"\negress = [\"evil.com:443\\nother:80\"]\n";
+    };
+    readonly expect: {
+        readonly ok: false;
+        readonly reason: "invalid_egress";
+    };
+}, {
+    readonly name: "python-egress-ipv6-literal";
+    readonly files: {
+        readonly "pyproject.toml": "[project]\nname = \"my-server\"\n\n[tool.foro]\nentrypoint = \"server.py\"\negress = [\"::1:443\"]\n";
+    };
+    readonly expect: {
+        readonly ok: false;
+        readonly reason: "invalid_egress";
+    };
+}, {
+    readonly name: "python-egress-cidr-prefix-out-of-range";
+    readonly files: {
+        readonly "pyproject.toml": "[project]\nname = \"my-server\"\n\n[tool.foro]\nentrypoint = \"server.py\"\negress = [\"10.0.0.0/33:443\"]\n";
+    };
+    readonly expect: {
+        readonly ok: false;
+        readonly reason: "invalid_egress";
+    };
+}, {
+    readonly name: "python-egress-link-local-range";
+    readonly files: {
+        readonly "pyproject.toml": "[project]\nname = \"my-server\"\n\n[tool.foro]\nentrypoint = \"server.py\"\negress = [\"169.254.0.0/16:443\"]\n";
+    };
+    readonly expect: {
+        readonly ok: false;
+        readonly reason: "invalid_egress";
+    };
+}, {
+    readonly name: "python-egress-loopback";
+    readonly files: {
+        readonly "pyproject.toml": "[project]\nname = \"my-server\"\n\n[tool.foro]\nentrypoint = \"server.py\"\negress = [\"127.0.0.1:5432\"]\n";
+    };
+    readonly expect: {
+        readonly ok: false;
+        readonly reason: "invalid_egress";
+    };
+}, {
+    readonly name: "python-egress-platform-bridge-network";
+    readonly files: {
+        readonly "pyproject.toml": "[project]\nname = \"my-server\"\n\n[tool.foro]\nentrypoint = \"server.py\"\negress = [\"172.20.0.5:5432\"]\n";
+    };
+    readonly expect: {
+        readonly ok: false;
+        readonly reason: "invalid_egress";
+    };
+}, {
+    readonly name: "python-egress-submission-port";
+    readonly files: {
+        readonly "pyproject.toml": "[project]\nname = \"my-server\"\n\n[tool.foro]\nentrypoint = \"server.py\"\negress = [\"smtp.example.com:587\"]\n";
+    };
+    readonly expect: {
+        readonly ok: false;
+        readonly reason: "invalid_egress";
+    };
+}, {
+    readonly name: "python-egress-private-ranges-stay-allowlistable";
+    readonly files: {
+        readonly "pyproject.toml": "[project]\nname = \"my-server\"\n\n[tool.foro]\nentrypoint = \"server.py\"\negress = [\"10.20.30.40:5432\", \"192.168.1.0/24:443\"]\n";
+    };
     readonly expect: {
         readonly ok: true;
     };