@straiffi/archon 1.8.21 → 1.8.23

package/dist/server/lib/dockerSandboxNetworkPolicy.js

@@ -0,0 +1,222 @@
+import { SbxContractFailure, asRecord, parseJsonObject, requireSuccessfulCommand, } from './dockerSandboxExecutionEnvironment.js';
+const POLICY_LS_COMMAND = 'policy ls';
+const POLICY_ALLOW_COMMAND = 'policy allow';
+const POLICY_CHECK_COMMAND = 'policy check';
+const POLICY_RM_COMMAND = 'policy rm';
+const SANDBOX_SCOPE_PREFIX = 'sandbox:';
+const assertBoundedArgument = (name, value) => {
+    if (typeof value !== 'string' || value.trim().length === 0) {
+        throw new Error(`${name} must be a non-empty string`);
+    }
+};
+const dedupe = (values) => [...new Set(values)];
+const scopedNetworkRulesForSandbox = (rules, sandboxName) => rules.filter(rule => rule.scope === `${SANDBOX_SCOPE_PREFIX}${sandboxName}` && rule.resourceType === 'network');
+export const parseScopedSbxPolicyLsOutput = (output) => {
+    const record = parseJsonObject(POLICY_LS_COMMAND, output);
+    if (!Array.isArray(record.rules)) {
+        throw new SbxContractFailure(POLICY_LS_COMMAND, 'sbx policy ls returned an unsupported schema');
+    }
+    return record.rules.map((value, index) => {
+        const rule = asRecord(value);
+        const requiredStringFields = ['id', 'scope', 'resource_type', 'decision', 'status'];
+        const hasRequiredStrings = rule !== null && requiredStringFields.every(field => (typeof rule[field] === 'string' && rule[field].length > 0));
+        const resources = rule?.resources;
+        const hasValidResources = Array.isArray(resources)
+            && resources.every(resource => typeof resource === 'string' && resource.length > 0);
+        if (!hasRequiredStrings || !hasValidResources) {
+            throw new SbxContractFailure(POLICY_LS_COMMAND, `sbx policy ls rule ${index} was unrecognized`);
+        }
+        return {
+            id: rule.id,
+            scope: rule.scope,
+            resourceType: rule.resource_type,
+            decision: rule.decision,
+            resources: [...resources],
+            status: rule.status,
+        };
+    });
+};
+export const parseSbxPolicyCheckOutput = (output, target, sandboxName) => {
+    const record = parseJsonObject(POLICY_CHECK_COMMAND, output);
+    const normalizedTarget = /:\d+$/.test(target) ? target : `${target}:443`;
+    if (record.action !== 'net:connect:tcp'
+        ||
+            record.context !== `${SANDBOX_SCOPE_PREFIX}${sandboxName}`
+        || record.type !== 'network'
+        || record.resource_type !== 'net:domain'
+        || record.target !== normalizedTarget
+        || record.resource_value !== normalizedTarget) {
+        throw new SbxContractFailure(POLICY_CHECK_COMMAND, 'sbx policy check returned a response that does not match the requested destination context');
+    }
+    const governance = asRecord(record.governance);
+    if (governance?.active !== true) {
+        throw new SbxContractFailure(POLICY_CHECK_COMMAND, 'sbx policy check did not report active network governance');
+    }
+    if (typeof record.allowed !== 'boolean') {
+        throw new SbxContractFailure(POLICY_CHECK_COMMAND, 'sbx policy check returned an unsupported schema');
+    }
+    return {
+        target,
+        decision: record.allowed ? 'allow' : 'deny',
+        rawDecision: null,
+        evaluatedRuleId: null,
+    };
+};
+export const parseSbxPolicyAllowOutput = (output, sandboxName, requestedResources) => {
+    const trimmed = output.trim();
+    if (trimmed.length === 0) {
+        throw new SbxContractFailure(POLICY_ALLOW_COMMAND, 'sbx policy allow returned no created rule identifiers');
+    }
+    let parsed;
+    try {
+        parsed = JSON.parse(trimmed);
+    }
+    catch (error) {
+        throw new SbxContractFailure(POLICY_ALLOW_COMMAND, 'sbx policy allow returned invalid JSON', { cause: error });
+    }
+    const values = Array.isArray(parsed) ? parsed : [parsed];
+    const requested = new Set(requestedResources);
+    const returnedResources = new Set();
+    const ids = [];
+    for (const value of values) {
+        const rule = asRecord(value);
+        const resources = rule?.resources;
+        if (!rule
+            || typeof rule.id !== 'string'
+            || rule.id.length === 0
+            || rule.scope !== `${SANDBOX_SCOPE_PREFIX}${sandboxName}`
+            || rule.resource_type !== 'network'
+            || rule.decision !== 'allow'
+            || rule.status !== 'active'
+            || !Array.isArray(resources)
+            || resources.length === 0
+            || !resources.every(resource => typeof resource === 'string' && requested.has(resource))) {
+            throw new SbxContractFailure(POLICY_ALLOW_COMMAND, 'sbx policy allow returned an unqualified scoped rule');
+        }
+        ids.push(rule.id);
+        resources.forEach(resource => returnedResources.add(resource));
+    }
+    if (returnedResources.size !== requested.size || [...requested].some(resource => !returnedResources.has(resource))) {
+        throw new SbxContractFailure(POLICY_ALLOW_COMMAND, 'sbx policy allow did not create the exact requested resources');
+    }
+    return ids;
+};
+export const assertExactSandboxNetworkAllowlist = (rules, requestedResources) => {
+    const requested = new Set(requestedResources);
+    const activeAllows = rules.filter(rule => rule.status === 'active' && rule.decision === 'allow');
+    const effectiveResources = new Set(activeAllows.flatMap(rule => rule.resources));
+    const broaderResources = [...effectiveResources].filter(resource => !requested.has(resource));
+    const missingResources = [...requested].filter(resource => !effectiveResources.has(resource));
+    if (broaderResources.length > 0 || missingResources.length > 0) {
+        const details = [
+            broaderResources.length > 0 ? `broader active resources: ${broaderResources.join(', ')}` : null,
+            missingResources.length > 0 ? `missing resources: ${missingResources.join(', ')}` : null,
+        ].filter((detail) => detail !== null);
+        throw new SbxContractFailure(POLICY_LS_COMMAND, `Sandbox network rules do not exactly match the requested allowlist (${details.join('; ')})`);
+    }
+};
+export const inspectSandboxNetworkRules = async (runner, sandboxName, options = {}) => {
+    assertBoundedArgument('Docker Sandbox name', sandboxName);
+    const result = await runner.run(['policy', 'ls', sandboxName, '--json', '--wide'], options);
+    requireSuccessfulCommand(POLICY_LS_COMMAND, result);
+    return scopedNetworkRulesForSandbox(parseScopedSbxPolicyLsOutput(result.stdout), sandboxName);
+};
+const sandboxApplicationLocks = new Map();
+const withSandboxApplicationLock = async (sandboxName, operation) => {
+    const previous = sandboxApplicationLocks.get(sandboxName) ?? Promise.resolve();
+    const gate = previous.then(() => undefined, () => undefined);
+    let release;
+    const current = new Promise(resolve => {
+        release = resolve;
+    });
+    sandboxApplicationLocks.set(sandboxName, current);
+    await gate;
+    try {
+        return await operation();
+    }
+    finally {
+        release();
+        if (sandboxApplicationLocks.get(sandboxName) === current) {
+            sandboxApplicationLocks.delete(sandboxName);
+        }
+    }
+};
+export const applyScopedNetworkRules = (runner, sandboxName, resources, options = {}) => withSandboxApplicationLock(sandboxName, async () => {
+    assertBoundedArgument('Docker Sandbox name', sandboxName);
+    const requested = dedupe(resources);
+    requested.forEach(resource => assertBoundedArgument('Network resource', resource));
+    if (requested.length === 0) {
+        return [];
+    }
+    const existing = await inspectSandboxNetworkRules(runner, sandboxName, options);
+    const covered = new Set(existing
+        .filter(rule => rule.status === 'active' && rule.decision === 'allow')
+        .flatMap(rule => rule.resources));
+    const missing = requested.filter(resource => !covered.has(resource));
+    if (missing.length === 0) {
+        return [];
+    }
+    const result = await runner.run(['policy', 'allow', 'network', '--sandbox', sandboxName, missing.join(',')], options);
+    requireSuccessfulCommand(POLICY_ALLOW_COMMAND, result);
+    return parseSbxPolicyAllowOutput(result.stdout, sandboxName, missing);
+});
+export const checkDestinationAccess = async (runner, sandboxName, target, options = {}) => {
+    assertBoundedArgument('Docker Sandbox name', sandboxName);
+    assertBoundedArgument('Network destination target', target);
+    const result = await runner.run(['policy', 'check', 'network', '--sandbox', sandboxName, target, '--json'], options);
+    requireSuccessfulCommand(POLICY_CHECK_COMMAND, result);
+    return parseSbxPolicyCheckOutput(result.stdout, target, sandboxName);
+};
+export const inspectGlobalNetworkPosture = async (runner, options = {}) => {
+    const result = await runner.run(['policy', 'ls', '--json', '--wide'], options);
+    requireSuccessfulCommand(POLICY_LS_COMMAND, result);
+    return classifyGlobalNetworkPosture(parseScopedSbxPolicyLsOutput(result.stdout));
+};
+const CATCH_ALL_RESOURCES = new Set(['**', '*', '*:*', 'any']);
+const isCatchAllRule = (rule) => (rule.resources.length === 0
+    || rule.resources.some(resource => CATCH_ALL_RESOURCES.has(resource.trim().toLowerCase())));
+export const classifyGlobalNetworkPosture = (rules) => {
+    const activeGlobalNetworkRules = rules.filter(rule => (rule.scope === 'global' && rule.resourceType === 'network' && rule.status === 'active'));
+    if (activeGlobalNetworkRules.length === 0) {
+        return 'none_initialized';
+    }
+    const catchAllRules = activeGlobalNetworkRules.filter(isCatchAllRule);
+    if (catchAllRules.length === 0) {
+        return 'mixed';
+    }
+    const decisions = new Set(catchAllRules.map(rule => rule.decision));
+    if (decisions.size > 1) {
+        return 'unknown';
+    }
+    const decision = [...decisions][0];
+    const hasResourceSpecificAllowException = activeGlobalNetworkRules.some(rule => (!isCatchAllRule(rule) && rule.decision === 'allow'));
+    if (decision === 'deny' && hasResourceSpecificAllowException) {
+        return 'mixed';
+    }
+    if (decision === 'allow') {
+        return 'allow_all';
+    }
+    if (decision === 'deny') {
+        return 'deny_all';
+    }
+    return 'unknown';
+};
+export const removeScopedNetworkRules = async (runner, sandboxName, ruleIds, options = {}) => {
+    assertBoundedArgument('Docker Sandbox name', sandboxName);
+    const ids = dedupe(ruleIds);
+    ids.forEach(id => assertBoundedArgument('Network policy rule ID', id));
+    if (ids.length === 0) {
+        return;
+    }
+    const scoped = await inspectSandboxNetworkRules(runner, sandboxName, options);
+    const owned = new Set(scoped.map(rule => rule.id));
+    const foreign = ids.filter(id => !owned.has(id));
+    if (foreign.length > 0) {
+        throw new SbxContractFailure(POLICY_RM_COMMAND, `Refusing to remove network policy rules Archon did not create for sandbox ${sandboxName}`);
+    }
+    for (const id of ids) {
+        const result = await runner.run(['policy', 'rm', 'network', '--sandbox', sandboxName, '--id', id], options);
+        requireSuccessfulCommand(POLICY_RM_COMMAND, result);
+    }
+};
+//# sourceMappingURL=dockerSandboxNetworkPolicy.js.map

package/dist/server/lib/dockerSandboxNetworkPolicy.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"dockerSandboxNetworkPolicy.js","sourceRoot":"","sources":["../../../server/lib/dockerSandboxNetworkPolicy.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,kBAAkB,EAClB,QAAQ,EACR,eAAe,EACf,wBAAwB,GAGzB,MAAM,wCAAwC,CAAA;AAuB/C,MAAM,iBAAiB,GAAG,WAAW,CAAA;AACrC,MAAM,oBAAoB,GAAG,cAAc,CAAA;AAC3C,MAAM,oBAAoB,GAAG,cAAc,CAAA;AAC3C,MAAM,iBAAiB,GAAG,WAAW,CAAA;AAErC,MAAM,oBAAoB,GAAG,UAAU,CAAA;AAEvC,MAAM,qBAAqB,GAAG,CAAC,IAAY,EAAE,KAAa,EAAE,EAAE;IAC5D,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,CAAC,IAAI,EAAE,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QAC3D,MAAM,IAAI,KAAK,CAAC,GAAG,IAAI,6BAA6B,CAAC,CAAA;IACvD,CAAC;AACH,CAAC,CAAA;AAED,MAAM,MAAM,GAAG,CAAC,MAAyB,EAAE,EAAE,CAAC,CAAC,GAAG,IAAI,GAAG,CAAC,MAAM,CAAC,CAAC,CAAA;AAElE,MAAM,4BAA4B,GAAG,CACnC,KAAsC,EACtC,WAAmB,EACnB,EAAE,CAAC,KAAK,CAAC,MAAM,CAAC,IAAI,CAAC,EAAE,CAAC,IAAI,CAAC,KAAK,KAAK,GAAG,oBAAoB,GAAG,WAAW,EAAE,IAAI,IAAI,CAAC,YAAY,KAAK,SAAS,CAAC,CAAA;AAEpH,MAAM,CAAC,MAAM,4BAA4B,GAAG,CAAC,MAAc,EAAmC,EAAE;IAC9F,MAAM,MAAM,GAAG,eAAe,CAAC,iBAAiB,EAAE,MAAM,CAAC,CAAA;IACzD,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,EAAE,CAAC;QACjC,MAAM,IAAI,kBAAkB,CAAC,iBAAiB,EAAE,8CAA8C,CAAC,CAAA;IACjG,CAAC;IACD,OAAO,MAAM,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,KAAK,EAAE,KAAK,EAAE,EAAE;QACvC,MAAM,IAAI,GAAG,QAAQ,CAAC,KAAK,CAAC,CAAA;QAC5B,MAAM,oBAAoB,GAAG,CAAC,IAAI,EAAE,OAAO,EAAE,eAAe,EAAE,UAAU,EAAE,QAAQ,CAAU,CAAA;QAC5F,MAAM,kBAAkB,GAAG,IAAI,KAAK,IAAI,IAAI,oBAAoB,CAAC,KAAK,CAAC,KAAK,CAAC,EAAE,CAAC,CAC9E,OAAO,IAAI,CAAC,KAAK,CAAC,KAAK,QAAQ,IAAK,IAAI,CAAC,KAAK,CAAY,CAAC,MAAM,GAAG,CAAC,CACtE,CAAC,CAAA;QACF,MAAM,SAAS,GAAG,IAAI,EAAE,SAAS,CAAA;QACjC,MAAM,iBAAiB,GAAG,KAAK,CAAC,OAAO,CAAC,SAAS,CAAC;eAC7C,SAAS,CAAC,KAAK,CAAC,QAAQ,CAAC,EAAE,CAAC,OAAO,QAAQ,KAAK,QAAQ,IAAI,QAAQ,CAAC,MAAM,GAAG,CAAC,CAAC,CAAA;QACrF,IAAI,CAAC,kBAAkB,IAAI,CAAC,iBAAiB,EAAE,CAAC;YAC9C,MAAM,IAAI,kBAAkB,CAAC,iBAAiB,EAAE,sBAAsB,KAAK,mBAAmB,CAAC,CAAA;QACjG,CAAC;QACD,OAAO;YACL,EAAE,EAAE,IAAI,CAAC,EAAY;YACrB,KAAK,EAAE,IAAI,CAAC,KAAe;YAC3B,YAAY,EAAE,IAAI,CAAC,aAAuB;YAC1C,QAAQ,EAAE,IAAI,CAAC,QAAkB;YACjC,SAAS,EAAE,CAAC,GAAG,SAAS,CAAC;YACzB,MAAM,EAAE,IAAI,CAAC,MAAgB;SAC9B,CAAA;IACH,CAAC,CAAC,CAAA;AACJ,CAAC,CAAA;AAED,MAAM,CAAC,MAAM,yBAAyB,GAAG,CACvC,MAAc,EACd,MAAc,EACd,WAAmB,EACQ,EAAE;IAC7B,MAAM,MAAM,GAAG,eAAe,CAAC,oBAAoB,EAAE,MAAM,CAAC,CAAA;IAC5D,MAAM,gBAAgB,GAAG,OAAO,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,GAAG,MAAM,MAAM,CAAA;IACxE,IACE,MAAM,CAAC,MAAM,KAAK,iBAAiB;;YAEnC,MAAM,CAAC,OAAO,KAAK,GAAG,oBAAoB,GAAG,WAAW,EAAE;WACvD,MAAM,CAAC,IAAI,KAAK,SAAS;WACzB,MAAM,CAAC,aAAa,KAAK,YAAY;WACrC,MAAM,CAAC,MAAM,KAAK,gBAAgB;WAClC,MAAM,CAAC,cAAc,KAAK,gBAAgB,EAC7C,CAAC;QACD,MAAM,IAAI,kBAAkB,CAC1B,oBAAoB,EACpB,4FAA4F,CAC7F,CAAA;IACH,CAAC;IACD,MAAM,UAAU,GAAG,QAAQ,CAAC,MAAM,CAAC,UAAU,CAA+B,CAAA;IAC5E,IAAI,UAAU,EAAE,MAAM,KAAK,IAAI,EAAE,CAAC;QAChC,MAAM,IAAI,kBAAkB,CAC1B,oBAAoB,EACpB,2DAA2D,CAC5D,CAAA;IACH,CAAC;IACD,IAAI,OAAO,MAAM,CAAC,OAAO,KAAK,SAAS,EAAE,CAAC;QACxC,MAAM,IAAI,kBAAkB,CAAC,oBAAoB,EAAE,iDAAiD,CAAC,CAAA;IACvG,CAAC;IACD,OAAO;QACL,MAAM;QACN,QAAQ,EAAE,MAAM,CAAC,OAAO,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM;QAC3C,WAAW,EAAE,IAAI;QACjB,eAAe,EAAE,IAAI;KACtB,CAAA;AACH,CAAC,CAAA;AAED,MAAM,CAAC,MAAM,yBAAyB,GAAG,CACvC,MAAc,EACd,WAAmB,EACnB,kBAAqC,EAClB,EAAE;IACrB,MAAM,OAAO,GAAG,MAAM,CAAC,IAAI,EAAE,CAAA;IAC7B,IAAI,OAAO,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACzB,MAAM,IAAI,kBAAkB,CAAC,oBAAoB,EAAE,uDAAuD,CAAC,CAAA;IAC7G,CAAC;IACD,IAAI,MAAe,CAAA;IACnB,IAAI,CAAC;QACH,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,CAAA;IAC9B,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,MAAM,IAAI,kBAAkB,CAAC,oBAAoB,EAAE,wCAAwC,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,CAAC,CAAA;IAChH,CAAC;IACD,MAAM,MAAM,GAAG,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,CAAA;IACxD,MAAM,SAAS,GAAG,IAAI,GAAG,CAAC,kBAAkB,CAAC,CAAA;IAC7C,MAAM,iBAAiB,GAAG,IAAI,GAAG,EAAU,CAAA;IAC3C,MAAM,GAAG,GAAa,EAAE,CAAA;IACxB,KAAK,MAAM,KAAK,IAAI,MAAM,EAAE,CAAC;QAC3B,MAAM,IAAI,GAAG,QAAQ,CAAC,KAAK,CAAC,CAAA;QAC5B,MAAM,SAAS,GAAG,IAAI,EAAE,SAAS,CAAA;QACjC,IACE,CAAC,IAAI;eACF,OAAO,IAAI,CAAC,EAAE,KAAK,QAAQ;eAC3B,IAAI,CAAC,EAAE,CAAC,MAAM,KAAK,CAAC;eACpB,IAAI,CAAC,KAAK,KAAK,GAAG,oBAAoB,GAAG,WAAW,EAAE;eACtD,IAAI,CAAC,aAAa,KAAK,SAAS;eAChC,IAAI,CAAC,QAAQ,KAAK,OAAO;eACzB,IAAI,CAAC,MAAM,KAAK,QAAQ;eACxB,CAAC,KAAK,CAAC,OAAO,CAAC,SAAS,CAAC;eACzB,SAAS,CAAC,MAAM,KAAK,CAAC;eACtB,CAAC,SAAS,CAAC,KAAK,CAAC,QAAQ,CAAC,EAAE,CAAC,OAAO,QAAQ,KAAK,QAAQ,IAAI,SAAS,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC,EACxF,CAAC;YACD,MAAM,IAAI,kBAAkB,CAAC,oBAAoB,EAAE,sDAAsD,CAAC,CAAA;QAC5G,CAAC;QACD,GAAG,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,CAAA;QACjB,SAAS,CAAC,OAAO,CAAC,QAAQ,CAAC,EAAE,CAAC,iBAAiB,CAAC,GAAG,CAAC,QAAkB,CAAC,CAAC,CAAA;IAC1E,CAAC;IACD,IAAI,iBAAiB,CAAC,IAAI,KAAK,SAAS,CAAC,IAAI,IAAI,CAAC,GAAG,SAAS,CAAC,CAAC,IAAI,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAC,iBAAiB,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC,EAAE,CAAC;QACnH,MAAM,IAAI,kBAAkB,CAAC,oBAAoB,EAAE,+DAA+D,CAAC,CAAA;IACrH,CAAC;IACD,OAAO,GAAG,CAAA;AACZ,CAAC,CAAA;AAED,MAAM,CAAC,MAAM,kCAAkC,GAAG,CAChD,KAAsC,EACtC,kBAAqC,EACrC,EAAE;IACF,MAAM,SAAS,GAAG,IAAI,GAAG,CAAC,kBAAkB,CAAC,CAAA;IAC7C,MAAM,YAAY,GAAG,KAAK,CAAC,MAAM,CAAC,IAAI,CAAC,EAAE,CAAC,IAAI,CAAC,MAAM,KAAK,QAAQ,IAAI,IAAI,CAAC,QAAQ,KAAK,OAAO,CAAC,CAAA;IAChG,MAAM,kBAAkB,GAAG,IAAI,GAAG,CAAC,YAAY,CAAC,OAAO,CAAC,IAAI,CAAC,EAAE,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC,CAAA;IAChF,MAAM,gBAAgB,GAAG,CAAC,GAAG,kBAAkB,CAAC,CAAC,MAAM,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAC,SAAS,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC,CAAA;IAC7F,MAAM,gBAAgB,GAAG,CAAC,GAAG,SAAS,CAAC,CAAC,MAAM,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAC,kBAAkB,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC,CAAA;IAC7F,IAAI,gBAAgB,CAAC,MAAM,GAAG,CAAC,IAAI,gBAAgB,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QAC/D,MAAM,OAAO,GAAG;YACd,gBAAgB,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,6BAA6B,gBAAgB,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC,CAAC,IAAI;YAC/F,gBAAgB,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,sBAAsB,gBAAgB,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC,CAAC,IAAI;SACzF,CAAC,MAAM,CAAC,CAAC,MAAM,EAAoB,EAAE,CAAC,MAAM,KAAK,IAAI,CAAC,CAAA;QACvD,MAAM,IAAI,kBAAkB,CAC1B,iBAAiB,EACjB,uEAAuE,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,CAC7F,CAAA;IACH,CAAC;AACH,CAAC,CAAA;AAED,MAAM,CAAC,MAAM,0BAA0B,GAAG,KAAK,EAC7C,MAAwB,EACxB,WAAmB,EACnB,UAA6B,EAAE,EACW,EAAE;IAC5C,qBAAqB,CAAC,qBAAqB,EAAE,WAAW,CAAC,CAAA;IACzD,MAAM,MAAM,GAAG,MAAM,MAAM,CAAC,GAAG,CAAC,CAAC,QAAQ,EAAE,IAAI,EAAE,WAAW,EAAE,QAAQ,EAAE,QAAQ,CAAC,EAAE,OAAO,CAAC,CAAA;IAC3F,wBAAwB,CAAC,iBAAiB,EAAE,MAAM,CAAC,CAAA;IACnD,OAAO,4BAA4B,CAAC,4BAA4B,CAAC,MAAM,CAAC,MAAM,CAAC,EAAE,WAAW,CAAC,CAAA;AAC/F,CAAC,CAAA;AAED,MAAM,uBAAuB,GAAG,IAAI,GAAG,EAAyB,CAAA;AAEhE,MAAM,0BAA0B,GAAG,KAAK,EACtC,WAAmB,EACnB,SAA2B,EACf,EAAE;IACd,MAAM,QAAQ,GAAG,uBAAuB,CAAC,GAAG,CAAC,WAAW,CAAC,IAAI,OAAO,CAAC,OAAO,EAAE,CAAA;IAC9E,MAAM,IAAI,GAAG,QAAQ,CAAC,IAAI,CAAC,GAAG,EAAE,CAAC,SAAS,EAAE,GAAG,EAAE,CAAC,SAAS,CAAC,CAAA;IAC5D,IAAI,OAAoB,CAAA;IACxB,MAAM,OAAO,GAAG,IAAI,OAAO,CAAO,OAAO,CAAC,EAAE;QAC1C,OAAO,GAAG,OAAO,CAAA;IACnB,CAAC,CAAC,CAAA;IACF,uBAAuB,CAAC,GAAG,CAAC,WAAW,EAAE,OAAO,CAAC,CAAA;IACjD,MAAM,IAAI,CAAA;IACV,IAAI,CAAC;QACH,OAAO,MAAM,SAAS,EAAE,CAAA;IAC1B,CAAC;YAAS,CAAC;QACT,OAAO,EAAE,CAAA;QACT,IAAI,uBAAuB,CAAC,GAAG,CAAC,WAAW,CAAC,KAAK,OAAO,EAAE,CAAC;YACzD,uBAAuB,CAAC,MAAM,CAAC,WAAW,CAAC,CAAA;QAC7C,CAAC;IACH,CAAC;AACH,CAAC,CAAA;AAED,MAAM,CAAC,MAAM,uBAAuB,GAAG,CACrC,MAAwB,EACxB,WAAmB,EACnB,SAA4B,EAC5B,UAA6B,EAAE,EACH,EAAE,CAAC,0BAA0B,CAAC,WAAW,EAAE,KAAK,IAAI,EAAE;IAClF,qBAAqB,CAAC,qBAAqB,EAAE,WAAW,CAAC,CAAA;IACzD,MAAM,SAAS,GAAG,MAAM,CAAC,SAAS,CAAC,CAAA;IACnC,SAAS,CAAC,OAAO,CAAC,QAAQ,CAAC,EAAE,CAAC,qBAAqB,CAAC,kBAAkB,EAAE,QAAQ,CAAC,CAAC,CAAA;IAClF,IAAI,SAAS,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QAC3B,OAAO,EAAE,CAAA;IACX,CAAC;IACD,MAAM,QAAQ,GAAG,MAAM,0BAA0B,CAAC,MAAM,EAAE,WAAW,EAAE,OAAO,CAAC,CAAA;IAC/E,MAAM,OAAO,GAAG,IAAI,GAAG,CAAC,QAAQ;SAC7B,MAAM,CAAC,IAAI,CAAC,EAAE,CAAC,IAAI,CAAC,MAAM,KAAK,QAAQ,IAAI,IAAI,CAAC,QAAQ,KAAK,OAAO,CAAC;SACrE,OAAO,CAAC,IAAI,CAAC,EAAE,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC,CAAA;IACnC,MAAM,OAAO,GAAG,SAAS,CAAC,MAAM,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAC,OAAO,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC,CAAA;IACpE,IAAI,OAAO,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACzB,OAAO,EAAE,CAAA;IACX,CAAC;IACD,MAAM,MAAM,GAAG,MAAM,MAAM,CAAC,GAAG,CAC7B,CAAC,QAAQ,EAAE,OAAO,EAAE,SAAS,EAAE,WAAW,EAAE,WAAW,EAAE,OAAO,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,EAC3E,OAAO,CACR,CAAA;IACD,wBAAwB,CAAC,oBAAoB,EAAE,MAAM,CAAC,CAAA;IACtD,OAAO,yBAAyB,CAAC,MAAM,CAAC,MAAM,EAAE,WAAW,EAAE,OAAO,CAAC,CAAA;AACvE,CAAC,CAAC,CAAA;AAEF,MAAM,CAAC,MAAM,sBAAsB,GAAG,KAAK,EACzC,MAAwB,EACxB,WAAmB,EACnB,MAAc,EACd,UAA6B,EAAE,EACK,EAAE;IACtC,qBAAqB,CAAC,qBAAqB,EAAE,WAAW,CAAC,CAAA;IACzD,qBAAqB,CAAC,4BAA4B,EAAE,MAAM,CAAC,CAAA;IAC3D,MAAM,MAAM,GAAG,MAAM,MAAM,CAAC,GAAG,CAC7B,CAAC,QAAQ,EAAE,OAAO,EAAE,SAAS,EAAE,WAAW,EAAE,WAAW,EAAE,MAAM,EAAE,QAAQ,CAAC,EAC1E,OAAO,CACR,CAAA;IACD,wBAAwB,CAAC,oBAAoB,EAAE,MAAM,CAAC,CAAA;IACtD,OAAO,yBAAyB,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,EAAE,WAAW,CAAC,CAAA;AACtE,CAAC,CAAA;AAED,MAAM,CAAC,MAAM,2BAA2B,GAAG,KAAK,EAC9C,MAAwB,EACxB,UAA6B,EAAE,EACY,EAAE;IAC7C,MAAM,MAAM,GAAG,MAAM,MAAM,CAAC,GAAG,CAAC,CAAC,QAAQ,EAAE,IAAI,EAAE,QAAQ,EAAE,QAAQ,CAAC,EAAE,OAAO,CAAC,CAAA;IAC9E,wBAAwB,CAAC,iBAAiB,EAAE,MAAM,CAAC,CAAA;IACnD,OAAO,4BAA4B,CAAC,4BAA4B,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,CAAA;AAClF,CAAC,CAAA;AAED,MAAM,mBAAmB,GAAG,IAAI,GAAG,CAAC,CAAC,IAAI,EAAE,GAAG,EAAE,KAAK,EAAE,KAAK,CAAC,CAAC,CAAA;AAE9D,MAAM,cAAc,GAAG,CAAC,IAA0B,EAAE,EAAE,CAAC,CACrD,IAAI,CAAC,SAAS,CAAC,MAAM,KAAK,CAAC;OACxB,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,QAAQ,CAAC,EAAE,CAAC,mBAAmB,CAAC,GAAG,CAAC,QAAQ,CAAC,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC,CAAC,CAC3F,CAAA;AAED,MAAM,CAAC,MAAM,4BAA4B,GAAG,CAC1C,KAAsC,EACJ,EAAE;IACpC,MAAM,wBAAwB,GAAG,KAAK,CAAC,MAAM,CAAC,IAAI,CAAC,EAAE,CAAC,CACpD,IAAI,CAAC,KAAK,KAAK,QAAQ,IAAI,IAAI,CAAC,YAAY,KAAK,SAAS,IAAI,IAAI,CAAC,MAAM,KAAK,QAAQ,CACvF,CAAC,CAAA;IACF,IAAI,wBAAwB,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QAC1C,OAAO,kBAAkB,CAAA;IAC3B,CAAC;IACD,MAAM,aAAa,GAAG,wBAAwB,CAAC,MAAM,CAAC,cAAc,CAAC,CAAA;IACrE,IAAI,aAAa,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QAC/B,OAAO,OAAO,CAAA;IAChB,CAAC;IACD,MAAM,SAAS,GAAG,IAAI,GAAG,CAAC,aAAa,CAAC,GAAG,CAAC,IAAI,CAAC,EAAE,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC,CAAA;IACnE,IAAI,SAAS,CAAC,IAAI,GAAG,CAAC,EAAE,CAAC;QACvB,OAAO,SAAS,CAAA;IAClB,CAAC;IACD,MAAM,QAAQ,GAAG,CAAC,GAAG,SAAS,CAAC,CAAC,CAAC,CAAC,CAAA;IAClC,MAAM,iCAAiC,GAAG,wBAAwB,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,CAC9E,CAAC,cAAc,CAAC,IAAI,CAAC,IAAI,IAAI,CAAC,QAAQ,KAAK,OAAO,CACnD,CAAC,CAAA;IACF,IAAI,QAAQ,KAAK,MAAM,IAAI,iCAAiC,EAAE,CAAC;QAC7D,OAAO,OAAO,CAAA;IAChB,CAAC;IACD,IAAI,QAAQ,KAAK,OAAO,EAAE,CAAC;QACzB,OAAO,WAAW,CAAA;IACpB,CAAC;IACD,IAAI,QAAQ,KAAK,MAAM,EAAE,CAAC;QACxB,OAAO,UAAU,CAAA;IACnB,CAAC;IACD,OAAO,SAAS,CAAA;AAClB,CAAC,CAAA;AAED,MAAM,CAAC,MAAM,wBAAwB,GAAG,KAAK,EAC3C,MAAwB,EACxB,WAAmB,EACnB,OAA0B,EAC1B,UAA6B,EAAE,EAChB,EAAE;IACjB,qBAAqB,CAAC,qBAAqB,EAAE,WAAW,CAAC,CAAA;IACzD,MAAM,GAAG,GAAG,MAAM,CAAC,OAAO,CAAC,CAAA;IAC3B,GAAG,CAAC,OAAO,CAAC,EAAE,CAAC,EAAE,CAAC,qBAAqB,CAAC,wBAAwB,EAAE,EAAE,CAAC,CAAC,CAAA;IACtE,IAAI,GAAG,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACrB,OAAM;IACR,CAAC;IACD,MAAM,MAAM,GAAG,MAAM,0BAA0B,CAAC,MAAM,EAAE,WAAW,EAAE,OAAO,CAAC,CAAA;IAC7E,MAAM,KAAK,GAAG,IAAI,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,IAAI,CAAC,EAAE,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC,CAAA;IAClD,MAAM,OAAO,GAAG,GAAG,CAAC,MAAM,CAAC,EAAE,CAAC,EAAE,CAAC,CAAC,KAAK,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC,CAAA;IAChD,IAAI,OAAO,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QACvB,MAAM,IAAI,kBAAkB,CAC1B,iBAAiB,EACjB,6EAA6E,WAAW,EAAE,CAC3F,CAAA;IACH,CAAC;IACD,KAAK,MAAM,EAAE,IAAI,GAAG,EAAE,CAAC;QACrB,MAAM,MAAM,GAAG,MAAM,MAAM,CAAC,GAAG,CAAC,CAAC,QAAQ,EAAE,IAAI,EAAE,SAAS,EAAE,WAAW,EAAE,WAAW,EAAE,MAAM,EAAE,EAAE,CAAC,EAAE,OAAO,CAAC,CAAA;QAC3G,wBAAwB,CAAC,iBAAiB,EAAE,MAAM,CAAC,CAAA;IACrD,CAAC;AACH,CAAC,CAAA"}

package/dist/server/lib/executionEnvironmentContexts.js

@@ -1,4 +1,5 @@
 import db from '../db.js';
+import { EXECUTION_ENVIRONMENT_AUTHENTICATION_MODES, EXECUTION_ENVIRONMENT_CREDENTIAL_DELIVERIES } from './types.js';
 const parseSnapshot = (value) => {
     if (!value) {
         return null;
@@ -15,6 +16,7 @@ const parseSnapshot = (value) => {
     }
 };
 const hasString = (value, key) => typeof value[key] === 'string';
+const parseEnumValue = (allowed, value) => (typeof value === 'string' && allowed.includes(value) ? value : null);
 const isPlacementSnapshot = (value) => {
     const scope = value.scope;
     if (!hasString(value, 'provider')
@@ -71,8 +73,8 @@ const parseAuthority = (row) => {
             ? degradationReasons
             : null,
         agent: value?.agent === 'opencode' || value?.agent === 'claude' ? value.agent : null,
-        authentication_mode: value?.authentication_mode === 'validated_guest' ? value.authentication_mode : null,
-        credential_delivery: value?.credential_delivery === 'sandbox_template' ? value.credential_delivery : null,
+        authentication_mode: parseEnumValue(EXECUTION_ENVIRONMENT_AUTHENTICATION_MODES, value?.authentication_mode),
+        credential_delivery: parseEnumValue(EXECUTION_ENVIRONMENT_CREDENTIAL_DELIVERIES, value?.credential_delivery),
         run_authority: runAuthority,
     };
 };

package/dist/server/lib/executionEnvironmentContexts.js.map

@@ -1 +1 @@
-{"version":3,"file":"executionEnvironmentContexts.js","sourceRoot":"","sources":["../../../server/lib/executionEnvironmentContexts.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,MAAM,UAAU,CAAA;AA+BzB,MAAM,aAAa,GAAG,CAAC,KAAoB,EAAkC,EAAE;IAC7E,IAAI,CAAC,KAAK,EAAE,CAAC;QACX,OAAO,IAAI,CAAA;IACb,CAAC;IACD,IAAI,CAAC;QACH,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,KAAK,CAAY,CAAA;QAC3C,IAAI,OAAO,MAAM,KAAK,QAAQ,IAAI,MAAM,KAAK,IAAI,IAAI,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC,EAAE,CAAC;YAC3E,OAAO,IAAI,CAAA;QACb,CAAC;QACD,OAAO,MAAiC,CAAA;IAC1C,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAA;IACb,CAAC;AACH,CAAC,CAAA;AAED,MAAM,SAAS,GAAG,CAAC,KAA8B,EAAE,GAAW,EAAE,EAAE,CAAC,OAAO,KAAK,CAAC,GAAG,CAAC,KAAK,QAAQ,CAAA;AAEjG,MAAM,mBAAmB,GAAG,CAAC,KAA8B,EAAE,EAAE;IAC7D,MAAM,KAAK,GAAG,KAAK,CAAC,KAAK,CAAA;IACzB,IACE,CAAC,SAAS,CAAC,KAAK,EAAE,UAAU,CAAC;WAC1B,CAAC,SAAS,CAAC,KAAK,EAAE,iBAAiB,CAAC;WACpC,CAAC,SAAS,CAAC,KAAK,EAAE,eAAe,CAAC;WAClC,OAAO,KAAK,CAAC,mBAAmB,KAAK,QAAQ;WAC7C,CAAC,SAAS,CAAC,KAAK,EAAE,gBAAgB,CAAC;WACnC,CAAC,SAAS,CAAC,KAAK,EAAE,WAAW,CAAC;WAC9B,OAAO,KAAK,KAAK,QAAQ;WACzB,KAAK,KAAK,IAAI;WACd,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,EACvB,CAAC;QACD,OAAO,KAAK,CAAA;IACd,CAAC;IACD,MAAM,UAAU,GAAG,KAAgC,CAAA;IACnD,OAAO,CAAC,UAAU,CAAC,IAAI,KAAK,gBAAgB,IAAI,SAAS,CAAC,UAAU,EAAE,OAAO,CAAC,CAAC;WAC1E,CAAC,UAAU,CAAC,IAAI,KAAK,eAAe,IAAI,OAAO,UAAU,CAAC,GAAG,KAAK,QAAQ,IAAI,SAAS,CAAC,UAAU,EAAE,YAAY,CAAC,CAAC;WAClH,CAAC,UAAU,CAAC,IAAI,KAAK,eAAe,IAAI,SAAS,CAAC,UAAU,EAAE,YAAY,CAAC,CAAC,CAAA;AACnF,CAAC,CAAA;AAED,MAAM,cAAc,GAAG,CAAC,GAAe,EAA+C,EAAE;IACtF,IAAI,GAAG,CAAC,YAAY,KAAK,WAAW,EAAE,CAAC;QACrC,OAAO,IAAI,CAAA;IACb,CAAC;IACD,MAAM,KAAK,GAAG,aAAa,CAAC,GAAG,CAAC,cAAc,CAAC,CAAA;IAC/C,MAAM,MAAM,GAAG,KAAK,EAAE,MAAM,CAAA;IAC5B,MAAM,WAAW,GAAG,OAAO,MAAM,KAAK,QAAQ,IAAI,MAAM,KAAK,IAAI,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC;QACzF,CAAC,CAAC,MAAiC;QACnC,CAAC,CAAC,IAAI,CAAA;IACR,MAAM,YAAY,GAAG,KAAK,EAAE,YAAY,CAAA;IACxC,MAAM,kBAAkB,GAAG,KAAK,EAAE,mBAAmB,CAAA;IACrD,MAAM,iBAAiB,GAAG,aAAa,CAAC,GAAG,CAAC,kBAAkB,CAAC,CAAA;IAC/D,MAAM,YAAY,GAAG,iBAAiB,EAAE,cAAc,KAAK,CAAC;QAC1D,CAAC,CAAC,iBAAkD;QACpD,CAAC,CAAC,IAAI,CAAA;IACR,OAAO;QACL,cAAc,EAAE,KAAK,EAAE,cAAc,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI;QACtD,QAAQ,EAAE,KAAK,EAAE,QAAQ,KAAK,gBAAgB,CAAC,CAAC,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAC,CAAC,IAAI;QACtE,gBAAgB,EAAE,OAAO,KAAK,EAAE,gBAAgB,KAAK,QAAQ,CAAC,CAAC,CAAC,KAAK,CAAC,gBAAgB,CAAC,CAAC,CAAC,IAAI;QAC7F,cAAc,EAAE,KAAK,EAAE,cAAc,KAAK,GAAG,CAAC,sBAAsB,CAAC,CAAC,CAAC,KAAK,CAAC,cAAc,CAAC,CAAC,CAAC,IAAI;QAClG,oBAAoB,EAAE,KAAK,EAAE,oBAAoB,KAAK,GAAG,CAAC,4BAA4B;YACpF,CAAC,CAAC,KAAK,CAAC,oBAAoB;YAC5B,CAAC,CAAC,IAAI;QACR,kCAAkC,EAChC,KAAK,EAAE,kCAAkC,KAAK,GAAG,CAAC,0CAA0C;YAC1F,CAAC,CAAC,KAAK,CAAC,kCAAkC;YAC1C,CAAC,CAAC,IAAI;QACV,MAAM,EAAE;YACN,IAAI,EAAE,OAAO,WAAW,EAAE,IAAI,KAAK,QAAQ,CAAC,CAAC,CAAC,WAAW,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI;YACrE,GAAG,EAAE,OAAO,WAAW,EAAE,GAAG,KAAK,QAAQ,CAAC,CAAC,CAAC,WAAW,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI;YAClE,cAAc,EAAE,OAAO,WAAW,EAAE,cAAc,KAAK,QAAQ,CAAC,CAAC,CAAC,WAAW,CAAC,cAAc,CAAC,CAAC,CAAC,IAAI;SACpG;QACD,YAAY,EAAE,OAAO,YAAY,KAAK,QAAQ,IAAI,YAAY,KAAK,IAAI,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,YAAY,CAAC;YACrG,CAAC,CAAC,YAAuC;YACzC,CAAC,CAAC,IAAI;QACR,mBAAmB,EAAE,KAAK,CAAC,OAAO,CAAC,kBAAkB,CAAC,IAAI,kBAAkB,CAAC,KAAK,CAAC,MAAM,CAAC,EAAE,CAAC,OAAO,MAAM,KAAK,QAAQ,CAAC;YACtH,CAAC,CAAC,kBAAkB;YACpB,CAAC,CAAC,IAAI;QACR,KAAK,EAAE,KAAK,EAAE,KAAK,KAAK,UAAU,IAAI,KAAK,EAAE,KAAK,KAAK,QAAQ,CAAC,CAAC,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI;QACpF,mBAAmB,EAAE,KAAK,EAAE,mBAAmB,KAAK,iBAAiB,CAAC,CAAC,CAAC,KAAK,CAAC,mBAAmB,CAAC,CAAC,CAAC,IAAI;QACxG,mBAAmB,EAAE,KAAK,EAAE,mBAAmB,KAAK,kBAAkB,CAAC,CAAC,CAAC,KAAK,CAAC,mBAAmB,CAAC,CAAC,CAAC,IAAI;QACzG,aAAa,EAAE,YAAY;KAC5B,CAAA;AACH,CAAC,CAAA;AAED,MAAM,6BAA6B,GAAG,CACpC,SAAwC,EACX,EAAE,CAAC,CAAC;IACjC,YAAY,EAAE,WAAW;IACzB,YAAY,EAAE,KAAK;IACnB,SAAS,EAAE;QACT,cAAc,EAAE,CAAC;QACjB,QAAQ,EAAE,SAAS,CAAC,SAAS,CAAC,QAAQ;QACtC,gBAAgB,EAAE,IAAI;QACtB,cAAc,EAAE,SAAS,CAAC,SAAS,CAAC,cAAc;QAClD,oBAAoB,EAAE,SAAS,CAAC,SAAS,CAAC,oBAAoB;QAC9D,kCAAkC,EAAE,SAAS,CAAC,SAAS,CAAC,kCAAkC;QAC1F,MAAM,EAAE;YACN,IAAI,EAAE,SAAS,CAAC,MAAM,CAAC,IAAI;YAC3B,GAAG,EAAE,SAAS,CAAC,MAAM,CAAC,GAAG;YACzB,cAAc,EAAE,SAAS,CAAC,MAAM,CAAC,cAAc;SAChD;QACD,YAAY,EAAE,IAAI;QAClB,mBAAmB,EAAE,CAAC,GAAG,SAAS,CAAC,YAAY,CAAC;QAChD,KAAK,EAAE,SAAS,CAAC,KAAK,CAAC,KAAK;QAC5B,mBAAmB,EAAE,IAAI;QACzB,mBAAmB,EAAE,IAAI;QACzB,aAAa,EAAE,SAAS;KACzB;IACD,SAAS,EAAE,IAAI;IACf,gBAAgB,EAAE,IAAI;IACtB,QAAQ,EAAE,EAAE;IACZ,WAAW,EAAE,IAAI;CAClB,CAAC,CAAA;AAEF,MAAM,gBAAgB,GAAG,CAAC,GAAe,EAA+B,EAAE;IACxE,MAAM,SAAS,GAAG,cAAc,CAAC,GAAG,CAAC,CAAA;IACrC,MAAM,oBAAoB,GAAG,aAAa,CAAC,GAAG,CAAC,cAAc,CAAC,CAAA;IAC9D,MAAM,eAAe,GAAG,oBAAoB,IAAI,mBAAmB,CAAC,oBAAoB,CAAC;QACvF,CAAC,CAAC,oBAAkD;QACpD,CAAC,CAAC,IAAI,CAAA;IACR,MAAM,SAAS,GAAG,eAAe;WAC5B,eAAe,CAAC,aAAa,KAAK,GAAG,CAAC,sBAAsB;WAC5D,eAAe,CAAC,mBAAmB,KAAK,GAAG,CAAC,4BAA4B;WACxE,eAAe,CAAC,cAAc,KAAK,GAAG,CAAC,gBAAgB;QAC1D,CAAC,CAAC,eAAe;QACjB,CAAC,CAAC,IAAI,CAAA;IACR,OAAO;QACL,YAAY,EAAE,GAAG,CAAC,YAAY;QAC9B,YAAY,EAAE,GAAG,CAAC,WAAW,KAAK,IAAI;QACtC,SAAS;QACT,SAAS;QACT,gBAAgB,EAAE,GAAG,CAAC,EAAE,IAAI,GAAG,CAAC,aAAa,IAAI,GAAG,CAAC,gBAAgB,IAAI,GAAG,CAAC,WAAW;eACnF,GAAG,CAAC,UAAU,IAAI,GAAG,CAAC,qBAAqB,IAAI,GAAG,CAAC,oBAAoB,KAAK,IAAI;eAChF,GAAG,CAAC,kCAAkC,IAAI,GAAG,CAAC,eAAe;YAChE,CAAC,CAAC;gBACE,EAAE,EAAE,GAAG,CAAC,EAAE;gBACV,aAAa,EAAE,GAAG,CAAC,aAAa;gBAChC,gBAAgB,EAAE,GAAG,CAAC,gBAAgB;gBACtC,WAAW,EAAE,GAAG,CAAC,WAAW;gBAC5B,UAAU,EAAE,GAAG,CAAC,UAAU;gBAC1B,qBAAqB,EAAE,GAAG,CAAC,qBAAqB;gBAChD,oBAAoB,EAAE,GAAG,CAAC,oBAAoB;gBAC9C,kCAAkC,EAAE,GAAG,CAAC,kCAAkC;gBAC1E,eAAe,EAAE,GAAG,CAAC,eAAe;aACrC;YACH,CAAC,CAAC,IAAI;QACR,QAAQ,EAAE,GAAG,CAAC,QAAQ;QACtB,WAAW,EAAE,GAAG,CAAC,WAAW;KAC7B,CAAA;AACH,CAAC,CAAA;AAED,MAAM,CAAC,MAAM,uCAAuC,GAAG,CACrD,SAAiB,EACjB,eAAkC,EACQ,EAAE;IAC5C,IAAI,eAAe,CAAC,MAAM,KAAK,CAAC,IAAI,CAAC,EAAE,CAAC,OAAO,CAAC;;GAE/C,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC;QACT,OAAO,IAAI,GAAG,EAAE,CAAA;IAClB,CAAC;IACD,MAAM,YAAY,GAAG,eAAe,CAAC,GAAG,CAAC,GAAG,EAAE,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAA;IAC9D,MAAM,iBAAiB,GAAG,OAAO,CAAC,EAAE,CAAC,OAAO,CAAC;;GAE5C,CAAC,CAAC,GAAG,EAAE,CAAC,CAAA;IACT,MAAM,IAAI,GAAG,EAAE,CAAC,OAAO,CAAC;;;;;gCAKM,iBAAiB,CAAC,CAAC,CAAC,8BAA8B,CAAC,CAAC,CAAC,MAAM;;;;;;;;;MASrF,iBAAiB,CAAC,CAAC,CAAC;;wDAE8B,CAAC,CAAC,CAAC,EAAE;oEACO,YAAY;;GAE7E,CAAC,CAAC,GAAG,CAAC,SAAS,EAAE,GAAG,eAAe,CAAiB,CAAA;IACrD,MAAM,QAAQ,GAAG,IAAI,GAAG,EAAuC,CAAA;IAC/D,KAAK,MAAM,GAAG,IAAI,IAAI,EAAE,CAAC;QACvB,MAAM,KAAK,GAAG,GAAG,CAAC,gBAAgB,CAAA;QAClC,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,KAAK,CAAC,EAAE,CAAC;YACzB,QAAQ,CAAC,GAAG,CAAC,KAAK,EAAE,gBAAgB,CAAC,GAAG,CAAC,CAAC,CAAA;QAC5C,CAAC;IACH,CAAC;IACD,MAAM,aAAa,GAAG,iBAAiB,CAAC,CAAC,CAAC,EAAE,CAAC,OAAO,CAAC;;;oDAGH,YAAY;GAC7D,CAAC,CAAC,GAAG,CAAC,SAAS,EAAE,GAAG,eAAe,CAIlC,CAAC,CAAC,CAAC,EAAE,CAAA;IACP,KAAK,MAAM,GAAG,IAAI,aAAa,EAAE,CAAC;QAChC,IAAI,QAAQ,CAAC,GAAG,CAAC,GAAG,CAAC,gBAAgB,CAAC,EAAE,CAAC;YACvC,SAAQ;QACV,CAAC;QACD,MAAM,KAAK,GAAG,aAAa,CAAC,GAAG,CAAC,cAAc,CAAC,CAAA;QAC/C,IAAI,KAAK,EAAE,cAAc,KAAK,CAAC,EAAE,CAAC;YAChC,SAAQ;QACV,CAAC;QACD,MAAM,OAAO,GAAG,6BAA6B,CAAC,KAAsC,CAAC,CAAA;QACrF,QAAQ,CAAC,GAAG,CAAC,GAAG,CAAC,gBAAgB,EAAE,EAAE,GAAG,OAAO,EAAE,QAAQ,EAAE,GAAG,CAAC,UAAU,EAAE,CAAC,CAAA;IAC9E,CAAC;IACD,OAAO,QAAQ,CAAA;AACjB,CAAC,CAAA;AAED,MAAM,CAAC,MAAM,oCAAoC,GAAG,CAClD,SAAiB,EACjB,cAAsB,EACc,EAAE,CAAC,CACvC,uCAAuC,CAAC,SAAS,EAAE,CAAC,cAAc,CAAC,CAAC,CAAC,GAAG,CAAC,cAAc,CAAC,IAAI,IAAI,CACjG,CAAA"}
+{"version":3,"file":"executionEnvironmentContexts.js","sourceRoot":"","sources":["../../../server/lib/executionEnvironmentContexts.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,MAAM,UAAU,CAAA;AAEzB,OAAO,EAAE,0CAA0C,EAAE,2CAA2C,EAAE,MAAM,YAAY,CAAA;AAgCpH,MAAM,aAAa,GAAG,CAAC,KAAoB,EAAkC,EAAE;IAC7E,IAAI,CAAC,KAAK,EAAE,CAAC;QACX,OAAO,IAAI,CAAA;IACb,CAAC;IACD,IAAI,CAAC;QACH,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,KAAK,CAAY,CAAA;QAC3C,IAAI,OAAO,MAAM,KAAK,QAAQ,IAAI,MAAM,KAAK,IAAI,IAAI,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC,EAAE,CAAC;YAC3E,OAAO,IAAI,CAAA;QACb,CAAC;QACD,OAAO,MAAiC,CAAA;IAC1C,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAA;IACb,CAAC;AACH,CAAC,CAAA;AAED,MAAM,SAAS,GAAG,CAAC,KAA8B,EAAE,GAAW,EAAE,EAAE,CAAC,OAAO,KAAK,CAAC,GAAG,CAAC,KAAK,QAAQ,CAAA;AAEjG,MAAM,cAAc,GAAG,CAAmB,OAAqB,EAAE,KAAc,EAAY,EAAE,CAAC,CAC5F,OAAO,KAAK,KAAK,QAAQ,IAAK,OAA6B,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,KAAU,CAAC,CAAC,CAAC,IAAI,CAChG,CAAA;AAED,MAAM,mBAAmB,GAAG,CAAC,KAA8B,EAAE,EAAE;IAC7D,MAAM,KAAK,GAAG,KAAK,CAAC,KAAK,CAAA;IACzB,IACE,CAAC,SAAS,CAAC,KAAK,EAAE,UAAU,CAAC;WAC1B,CAAC,SAAS,CAAC,KAAK,EAAE,iBAAiB,CAAC;WACpC,CAAC,SAAS,CAAC,KAAK,EAAE,eAAe,CAAC;WAClC,OAAO,KAAK,CAAC,mBAAmB,KAAK,QAAQ;WAC7C,CAAC,SAAS,CAAC,KAAK,EAAE,gBAAgB,CAAC;WACnC,CAAC,SAAS,CAAC,KAAK,EAAE,WAAW,CAAC;WAC9B,OAAO,KAAK,KAAK,QAAQ;WACzB,KAAK,KAAK,IAAI;WACd,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,EACvB,CAAC;QACD,OAAO,KAAK,CAAA;IACd,CAAC;IACD,MAAM,UAAU,GAAG,KAAgC,CAAA;IACnD,OAAO,CAAC,UAAU,CAAC,IAAI,KAAK,gBAAgB,IAAI,SAAS,CAAC,UAAU,EAAE,OAAO,CAAC,CAAC;WAC1E,CAAC,UAAU,CAAC,IAAI,KAAK,eAAe,IAAI,OAAO,UAAU,CAAC,GAAG,KAAK,QAAQ,IAAI,SAAS,CAAC,UAAU,EAAE,YAAY,CAAC,CAAC;WAClH,CAAC,UAAU,CAAC,IAAI,KAAK,eAAe,IAAI,SAAS,CAAC,UAAU,EAAE,YAAY,CAAC,CAAC,CAAA;AACnF,CAAC,CAAA;AAED,MAAM,cAAc,GAAG,CAAC,GAAe,EAA+C,EAAE;IACtF,IAAI,GAAG,CAAC,YAAY,KAAK,WAAW,EAAE,CAAC;QACrC,OAAO,IAAI,CAAA;IACb,CAAC;IACD,MAAM,KAAK,GAAG,aAAa,CAAC,GAAG,CAAC,cAAc,CAAC,CAAA;IAC/C,MAAM,MAAM,GAAG,KAAK,EAAE,MAAM,CAAA;IAC5B,MAAM,WAAW,GAAG,OAAO,MAAM,KAAK,QAAQ,IAAI,MAAM,KAAK,IAAI,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC;QACzF,CAAC,CAAC,MAAiC;QACnC,CAAC,CAAC,IAAI,CAAA;IACR,MAAM,YAAY,GAAG,KAAK,EAAE,YAAY,CAAA;IACxC,MAAM,kBAAkB,GAAG,KAAK,EAAE,mBAAmB,CAAA;IACrD,MAAM,iBAAiB,GAAG,aAAa,CAAC,GAAG,CAAC,kBAAkB,CAAC,CAAA;IAC/D,MAAM,YAAY,GAAG,iBAAiB,EAAE,cAAc,KAAK,CAAC;QAC1D,CAAC,CAAC,iBAAkD;QACpD,CAAC,CAAC,IAAI,CAAA;IACR,OAAO;QACL,cAAc,EAAE,KAAK,EAAE,cAAc,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI;QACtD,QAAQ,EAAE,KAAK,EAAE,QAAQ,KAAK,gBAAgB,CAAC,CAAC,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAC,CAAC,IAAI;QACtE,gBAAgB,EAAE,OAAO,KAAK,EAAE,gBAAgB,KAAK,QAAQ,CAAC,CAAC,CAAC,KAAK,CAAC,gBAAgB,CAAC,CAAC,CAAC,IAAI;QAC7F,cAAc,EAAE,KAAK,EAAE,cAAc,KAAK,GAAG,CAAC,sBAAsB,CAAC,CAAC,CAAC,KAAK,CAAC,cAAc,CAAC,CAAC,CAAC,IAAI;QAClG,oBAAoB,EAAE,KAAK,EAAE,oBAAoB,KAAK,GAAG,CAAC,4BAA4B;YACpF,CAAC,CAAC,KAAK,CAAC,oBAAoB;YAC5B,CAAC,CAAC,IAAI;QACR,kCAAkC,EAChC,KAAK,EAAE,kCAAkC,KAAK,GAAG,CAAC,0CAA0C;YAC1F,CAAC,CAAC,KAAK,CAAC,kCAAkC;YAC1C,CAAC,CAAC,IAAI;QACV,MAAM,EAAE;YACN,IAAI,EAAE,OAAO,WAAW,EAAE,IAAI,KAAK,QAAQ,CAAC,CAAC,CAAC,WAAW,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI;YACrE,GAAG,EAAE,OAAO,WAAW,EAAE,GAAG,KAAK,QAAQ,CAAC,CAAC,CAAC,WAAW,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI;YAClE,cAAc,EAAE,OAAO,WAAW,EAAE,cAAc,KAAK,QAAQ,CAAC,CAAC,CAAC,WAAW,CAAC,cAAc,CAAC,CAAC,CAAC,IAAI;SACpG;QACD,YAAY,EAAE,OAAO,YAAY,KAAK,QAAQ,IAAI,YAAY,KAAK,IAAI,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,YAAY,CAAC;YACrG,CAAC,CAAC,YAAuC;YACzC,CAAC,CAAC,IAAI;QACR,mBAAmB,EAAE,KAAK,CAAC,OAAO,CAAC,kBAAkB,CAAC,IAAI,kBAAkB,CAAC,KAAK,CAAC,MAAM,CAAC,EAAE,CAAC,OAAO,MAAM,KAAK,QAAQ,CAAC;YACtH,CAAC,CAAC,kBAAkB;YACpB,CAAC,CAAC,IAAI;QACR,KAAK,EAAE,KAAK,EAAE,KAAK,KAAK,UAAU,IAAI,KAAK,EAAE,KAAK,KAAK,QAAQ,CAAC,CAAC,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI;QACpF,mBAAmB,EAAE,cAAc,CACjC,0CAA0C,EAC1C,KAAK,EAAE,mBAAmB,CAC3B;QACD,mBAAmB,EAAE,cAAc,CACjC,2CAA2C,EAC3C,KAAK,EAAE,mBAAmB,CAC3B;QACD,aAAa,EAAE,YAAY;KAC5B,CAAA;AACH,CAAC,CAAA;AAED,MAAM,6BAA6B,GAAG,CACpC,SAAwC,EACX,EAAE,CAAC,CAAC;IACjC,YAAY,EAAE,WAAW;IACzB,YAAY,EAAE,KAAK;IACnB,SAAS,EAAE;QACT,cAAc,EAAE,CAAC;QACjB,QAAQ,EAAE,SAAS,CAAC,SAAS,CAAC,QAAQ;QACtC,gBAAgB,EAAE,IAAI;QACtB,cAAc,EAAE,SAAS,CAAC,SAAS,CAAC,cAAc;QAClD,oBAAoB,EAAE,SAAS,CAAC,SAAS,CAAC,oBAAoB;QAC9D,kCAAkC,EAAE,SAAS,CAAC,SAAS,CAAC,kCAAkC;QAC1F,MAAM,EAAE;YACN,IAAI,EAAE,SAAS,CAAC,MAAM,CAAC,IAAI;YAC3B,GAAG,EAAE,SAAS,CAAC,MAAM,CAAC,GAAG;YACzB,cAAc,EAAE,SAAS,CAAC,MAAM,CAAC,cAAc;SAChD;QACD,YAAY,EAAE,IAAI;QAClB,mBAAmB,EAAE,CAAC,GAAG,SAAS,CAAC,YAAY,CAAC;QAChD,KAAK,EAAE,SAAS,CAAC,KAAK,CAAC,KAAK;QAC5B,mBAAmB,EAAE,IAAI;QACzB,mBAAmB,EAAE,IAAI;QACzB,aAAa,EAAE,SAAS;KACzB;IACD,SAAS,EAAE,IAAI;IACf,gBAAgB,EAAE,IAAI;IACtB,QAAQ,EAAE,EAAE;IACZ,WAAW,EAAE,IAAI;CAClB,CAAC,CAAA;AAEF,MAAM,gBAAgB,GAAG,CAAC,GAAe,EAA+B,EAAE;IACxE,MAAM,SAAS,GAAG,cAAc,CAAC,GAAG,CAAC,CAAA;IACrC,MAAM,oBAAoB,GAAG,aAAa,CAAC,GAAG,CAAC,cAAc,CAAC,CAAA;IAC9D,MAAM,eAAe,GAAG,oBAAoB,IAAI,mBAAmB,CAAC,oBAAoB,CAAC;QACvF,CAAC,CAAC,oBAAkD;QACpD,CAAC,CAAC,IAAI,CAAA;IACR,MAAM,SAAS,GAAG,eAAe;WAC5B,eAAe,CAAC,aAAa,KAAK,GAAG,CAAC,sBAAsB;WAC5D,eAAe,CAAC,mBAAmB,KAAK,GAAG,CAAC,4BAA4B;WACxE,eAAe,CAAC,cAAc,KAAK,GAAG,CAAC,gBAAgB;QAC1D,CAAC,CAAC,eAAe;QACjB,CAAC,CAAC,IAAI,CAAA;IACR,OAAO;QACL,YAAY,EAAE,GAAG,CAAC,YAAY;QAC9B,YAAY,EAAE,GAAG,CAAC,WAAW,KAAK,IAAI;QACtC,SAAS;QACT,SAAS;QACT,gBAAgB,EAAE,GAAG,CAAC,EAAE,IAAI,GAAG,CAAC,aAAa,IAAI,GAAG,CAAC,gBAAgB,IAAI,GAAG,CAAC,WAAW;eACnF,GAAG,CAAC,UAAU,IAAI,GAAG,CAAC,qBAAqB,IAAI,GAAG,CAAC,oBAAoB,KAAK,IAAI;eAChF,GAAG,CAAC,kCAAkC,IAAI,GAAG,CAAC,eAAe;YAChE,CAAC,CAAC;gBACE,EAAE,EAAE,GAAG,CAAC,EAAE;gBACV,aAAa,EAAE,GAAG,CAAC,aAAa;gBAChC,gBAAgB,EAAE,GAAG,CAAC,gBAAgB;gBACtC,WAAW,EAAE,GAAG,CAAC,WAAW;gBAC5B,UAAU,EAAE,GAAG,CAAC,UAAU;gBAC1B,qBAAqB,EAAE,GAAG,CAAC,qBAAqB;gBAChD,oBAAoB,EAAE,GAAG,CAAC,oBAAoB;gBAC9C,kCAAkC,EAAE,GAAG,CAAC,kCAAkC;gBAC1E,eAAe,EAAE,GAAG,CAAC,eAAe;aACrC;YACH,CAAC,CAAC,IAAI;QACR,QAAQ,EAAE,GAAG,CAAC,QAAQ;QACtB,WAAW,EAAE,GAAG,CAAC,WAAW;KAC7B,CAAA;AACH,CAAC,CAAA;AAED,MAAM,CAAC,MAAM,uCAAuC,GAAG,CACrD,SAAiB,EACjB,eAAkC,EACQ,EAAE;IAC5C,IAAI,eAAe,CAAC,MAAM,KAAK,CAAC,IAAI,CAAC,EAAE,CAAC,OAAO,CAAC;;GAE/C,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC;QACT,OAAO,IAAI,GAAG,EAAE,CAAA;IAClB,CAAC;IACD,MAAM,YAAY,GAAG,eAAe,CAAC,GAAG,CAAC,GAAG,EAAE,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAA;IAC9D,MAAM,iBAAiB,GAAG,OAAO,CAAC,EAAE,CAAC,OAAO,CAAC;;GAE5C,CAAC,CAAC,GAAG,EAAE,CAAC,CAAA;IACT,MAAM,IAAI,GAAG,EAAE,CAAC,OAAO,CAAC;;;;;gCAKM,iBAAiB,CAAC,CAAC,CAAC,8BAA8B,CAAC,CAAC,CAAC,MAAM;;;;;;;;;MASrF,iBAAiB,CAAC,CAAC,CAAC;;wDAE8B,CAAC,CAAC,CAAC,EAAE;oEACO,YAAY;;GAE7E,CAAC,CAAC,GAAG,CAAC,SAAS,EAAE,GAAG,eAAe,CAAiB,CAAA;IACrD,MAAM,QAAQ,GAAG,IAAI,GAAG,EAAuC,CAAA;IAC/D,KAAK,MAAM,GAAG,IAAI,IAAI,EAAE,CAAC;QACvB,MAAM,KAAK,GAAG,GAAG,CAAC,gBAAgB,CAAA;QAClC,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,KAAK,CAAC,EAAE,CAAC;YACzB,QAAQ,CAAC,GAAG,CAAC,KAAK,EAAE,gBAAgB,CAAC,GAAG,CAAC,CAAC,CAAA;QAC5C,CAAC;IACH,CAAC;IACD,MAAM,aAAa,GAAG,iBAAiB,CAAC,CAAC,CAAC,EAAE,CAAC,OAAO,CAAC;;;oDAGH,YAAY;GAC7D,CAAC,CAAC,GAAG,CAAC,SAAS,EAAE,GAAG,eAAe,CAIlC,CAAC,CAAC,CAAC,EAAE,CAAA;IACP,KAAK,MAAM,GAAG,IAAI,aAAa,EAAE,CAAC;QAChC,IAAI,QAAQ,CAAC,GAAG,CAAC,GAAG,CAAC,gBAAgB,CAAC,EAAE,CAAC;YACvC,SAAQ;QACV,CAAC;QACD,MAAM,KAAK,GAAG,aAAa,CAAC,GAAG,CAAC,cAAc,CAAC,CAAA;QAC/C,IAAI,KAAK,EAAE,cAAc,KAAK,CAAC,EAAE,CAAC;YAChC,SAAQ;QACV,CAAC;QACD,MAAM,OAAO,GAAG,6BAA6B,CAAC,KAAsC,CAAC,CAAA;QACrF,QAAQ,CAAC,GAAG,CAAC,GAAG,CAAC,gBAAgB,EAAE,EAAE,GAAG,OAAO,EAAE,QAAQ,EAAE,GAAG,CAAC,UAAU,EAAE,CAAC,CAAA;IAC9E,CAAC;IACD,OAAO,QAAQ,CAAA;AACjB,CAAC,CAAA;AAED,MAAM,CAAC,MAAM,oCAAoC,GAAG,CAClD,SAAiB,EACjB,cAAsB,EACc,EAAE,CAAC,CACvC,uCAAuC,CAAC,SAAS,EAAE,CAAC,cAAc,CAAC,CAAC,CAAC,GAAG,CAAC,cAAc,CAAC,IAAI,IAAI,CACjG,CAAA"}

package/dist/server/lib/executionEnvironmentLifecycle.js

@@ -1,6 +1,40 @@
 import { createHash } from 'crypto';
 import { ExecutionEnvironmentUnsupportedFailure } from './executionEnvironment.js';
 export const EXECUTION_ENVIRONMENT_VALIDATION_FINGERPRINT_FORMAT = 'archon-environment-validation-v1';
+const MAX_NETWORK_DESTINATION_HOST_BYTES = 253;
+export const normalizeExecutionEnvironmentDestinations = (destinations) => {
+    const normalized = [];
+    const seen = new Set();
+    for (const destination of destinations) {
+        if (typeof destination?.host !== 'string') {
+            throw new Error('Network destination host must be a string');
+        }
+        const host = destination.host.trim().toLowerCase();
+        if (host.length === 0
+            || Buffer.byteLength(host, 'utf8') > MAX_NETWORK_DESTINATION_HOST_BYTES) {
+            throw new Error(`Network destination host must contain between 1 and ${MAX_NETWORK_DESTINATION_HOST_BYTES} bytes`);
+        }
+        const rawPort = destination.port;
+        let port;
+        if (rawPort !== undefined && rawPort !== null) {
+            if (typeof rawPort !== 'number'
+                || !Number.isSafeInteger(rawPort)
+                || rawPort < 1
+                || rawPort > 65535) {
+                throw new Error('Network destination port must be an integer between 1 and 65535');
+            }
+            port = rawPort;
+        }
+        const key = `${host}:${port ?? ''}`;
+        if (seen.has(key)) {
+            continue;
+        }
+        seen.add(key);
+        normalized.push(port === undefined ? { host } : { host, port });
+    }
+    return normalized;
+};
+export const networkDestinationTarget = (destination) => destination.port === undefined ? destination.host : `${destination.host}:${destination.port}`;
 const assertFingerprintComponent = (value, name) => {
     if (value.length === 0 || Buffer.byteLength(value, 'utf8') > 500) {
         throw new Error(`${name} must contain between 1 and 500 bytes`);

package/dist/server/lib/executionEnvironmentLifecycle.js.map

@@ -1 +1 @@
-{"version":3,"file":"executionEnvironmentLifecycle.js","sourceRoot":"","sources":["../../../server/lib/executionEnvironmentLifecycle.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,UAAU,EAAE,MAAM,QAAQ,CAAA;AACnC,OAAO,EAAE,sCAAsC,EAAE,MAAM,2BAA2B,CAAA;AAGlF,MAAM,CAAC,MAAM,mDAAmD,GAAG,kCAAkC,CAAA;AAsDrG,MAAM,0BAA0B,GAAG,CAAC,KAAa,EAAE,IAAY,EAAE,EAAE;IACjE,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC,IAAI,MAAM,CAAC,UAAU,CAAC,KAAK,EAAE,MAAM,CAAC,GAAG,GAAG,EAAE,CAAC;QACjE,MAAM,IAAI,KAAK,CAAC,GAAG,IAAI,uCAAuC,CAAC,CAAA;IACjE,CAAC;AACH,CAAC,CAAA;AAED,MAAM,0BAA0B,GAAG,CAAC,IAAmC,EAAE,IAAY,EAAE,KAAa,EAAE,EAAE;IACtG,MAAM,KAAK,GAAG,MAAM,CAAC,IAAI,CAAC,KAAK,EAAE,MAAM,CAAC,CAAA;IACxC,IAAI,CAAC,MAAM,CAAC,GAAG,IAAI,IAAI,KAAK,CAAC,MAAM,GAAG,EAAE,MAAM,CAAC,CAAA;IAC/C,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,CAAA;IAClB,IAAI,CAAC,MAAM,CAAC,IAAI,EAAE,MAAM,CAAC,CAAA;AAC3B,CAAC,CAAA;AAED,MAAM,CAAC,MAAM,iDAAiD,GAAG,CAC/D,KAA4C,EACL,EAAE;IACzC,IAAI,KAAK,CAAC,aAAa,KAAK,QAAQ,EAAE,CAAC;QACrC,MAAM,IAAI,KAAK,CAAC,4DAA4D,CAAC,CAAA;IAC/E,CAAC;IACD,IAAI,KAAK,CAAC,QAAQ,CAAC,IAAI,KAAK,UAAU,IAAI,KAAK,CAAC,QAAQ,CAAC,IAAI,KAAK,QAAQ,EAAE,CAAC;QAC3E,MAAM,IAAI,KAAK,CAAC,qDAAqD,CAAC,CAAA;IACxE,CAAC;IACD,0BAA0B,CAAC,KAAK,CAAC,QAAQ,CAAC,KAAK,EAAE,+BAA+B,CAAC,CAAA;IACjF,0BAA0B,CAAC,KAAK,CAAC,4BAA4B,EAAE,iCAAiC,CAAC,CAAA;IACjG,0BAA0B,CAAC,KAAK,CAAC,sBAAsB,EAAE,0BAA0B,CAAC,CAAA;IACpF,0BAA0B,CAAC,KAAK,CAAC,mBAAmB,EAAE,uBAAuB,CAAC,CAAA;IAC9E,MAAM,gBAAgB,GAAG,CAAC,GAAG,IAAI,GAAG,CAAC,KAAK,CAAC,gBAAgB,CAAC,CAAC,CAAC,IAAI,EAAE,CAAA;IACpE,IACE,gBAAgB,CAAC,MAAM,KAAK,CAAC;WAC1B,gBAAgB,CAAC,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC,KAAK,KAAK,UAAU,IAAI,KAAK,KAAK,QAAQ,CAAC,EAC7E,CAAC;QACD,MAAM,IAAI,KAAK,CAAC,6DAA6D,CAAC,CAAA;IAChF,CAAC;IACD,OAAO;QACL,aAAa,EAAE,QAAQ;QACvB,QAAQ,EAAE,EAAE,GAAG,KAAK,CAAC,QAAQ,EAAE;QAC/B,gBAAgB;QAChB,4BAA4B,EAAE,KAAK,CAAC,4BAA4B;QAChE,sBAAsB,EAAE,KAAK,CAAC,sBAAsB;QACpD,mBAAmB,EAAE,KAAK,CAAC,mBAAmB;KAC/C,CAAA;AACH,CAAC,CAAA;AAED,MAAM,CAAC,MAAM,sCAAsC,GAAG,CACpD,KAA4C,EACpC,EAAE;IACV,MAAM,SAAS,GAAG,iDAAiD,CAAC,KAAK,CAAC,CAAA;IAC1E,MAAM,IAAI,GAAG,UAAU,CAAC,QAAQ,CAAC,CAAA;IACjC,0BAA0B,CAAC,IAAI,EAAE,QAAQ,EAAE,mDAAmD,CAAC,CAAA;IAC/F,0BAA0B,CAAC,IAAI,EAAE,gBAAgB,EAAE,SAAS,CAAC,aAAa,CAAC,CAAA;IAC3E,0BAA0B,CAAC,IAAI,EAAE,eAAe,EAAE,SAAS,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAA;IAC1E,0BAA0B,CAAC,IAAI,EAAE,gBAAgB,EAAE,SAAS,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAA;IAC5E,KAAK,MAAM,KAAK,IAAI,SAAS,CAAC,gBAAgB,EAAE,CAAC;QAC/C,0BAA0B,CAAC,IAAI,EAAE,kBAAkB,EAAE,KAAK,CAAC,CAAA;IAC7D,CAAC;IACD,0BAA0B,CAAC,IAAI,EAAE,iCAAiC,EAAE,SAAS,CAAC,4BAA4B,CAAC,CAAA;IAC3G,0BAA0B,CAAC,IAAI,EAAE,0BAA0B,EAAE,SAAS,CAAC,sBAAsB,CAAC,CAAA;IAC9F,0BAA0B,CAAC,IAAI,EAAE,uBAAuB,EAAE,SAAS,CAAC,mBAAmB,CAAC,CAAA;IACxF,OAAO,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,CAAA;AAC3B,CAAC,CAAA;AAED,MAAM,CAAC,MAAM,4BAA4B,GAAG,CAC1C,QAAgB,EAChB,WAA4C,EAC5C,oBAAwD,EACxD,EAAE;IACF,KAAK,MAAM,UAAU,IAAI,oBAAoB,EAAE,CAAC;QAC9C,MAAM,OAAO,GAAG,WAAW,CAAC,YAAY,CAAC,UAAU,CAAC,CAAA;QACpD,IAAI,OAAO,KAAK,WAAW,EAAE,CAAC;YAC5B,MAAM,IAAI,sCAAsC,CAC9C,QAAQ,EACR,UAAU,EACV,uBAAuB,QAAQ,oCAAoC,UAAU,MAAM,OAAO,IAAI,CAC/F,CAAA;QACH,CAAC;IACH,CAAC;AACH,CAAC,CAAA"}
+{"version":3,"file":"executionEnvironmentLifecycle.js","sourceRoot":"","sources":["../../../server/lib/executionEnvironmentLifecycle.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,UAAU,EAAE,MAAM,QAAQ,CAAA;AACnC,OAAO,EAAE,sCAAsC,EAAE,MAAM,2BAA2B,CAAA;AAGlF,MAAM,CAAC,MAAM,mDAAmD,GAAG,kCAAkC,CAAA;AA2CrG,MAAM,kCAAkC,GAAG,GAAG,CAAA;AAE9C,MAAM,CAAC,MAAM,yCAAyC,GAAG,CACvD,YAIG,EACgD,EAAE;IACrD,MAAM,UAAU,GAA6C,EAAE,CAAA;IAC/D,MAAM,IAAI,GAAG,IAAI,GAAG,EAAU,CAAA;IAC9B,KAAK,MAAM,WAAW,IAAI,YAAY,EAAE,CAAC;QACvC,IAAI,OAAO,WAAW,EAAE,IAAI,KAAK,QAAQ,EAAE,CAAC;YAC1C,MAAM,IAAI,KAAK,CAAC,2CAA2C,CAAC,CAAA;QAC9D,CAAC;QACD,MAAM,IAAI,GAAG,WAAW,CAAC,IAAI,CAAC,IAAI,EAAE,CAAC,WAAW,EAAE,CAAA;QAClD,IACE,IAAI,CAAC,MAAM,KAAK,CAAC;eACd,MAAM,CAAC,UAAU,CAAC,IAAI,EAAE,MAAM,CAAC,GAAG,kCAAkC,EACvE,CAAC;YACD,MAAM,IAAI,KAAK,CAAC,uDAAuD,kCAAkC,QAAQ,CAAC,CAAA;QACpH,CAAC;QACD,MAAM,OAAO,GAAG,WAAW,CAAC,IAAI,CAAA;QAChC,IAAI,IAAwB,CAAA;QAC5B,IAAI,OAAO,KAAK,SAAS,IAAI,OAAO,KAAK,IAAI,EAAE,CAAC;YAC9C,IACE,OAAO,OAAO,KAAK,QAAQ;mBACxB,CAAC,MAAM,CAAC,aAAa,CAAC,OAAO,CAAC;mBAC9B,OAAO,GAAG,CAAC;mBACX,OAAO,GAAG,KAAK,EAClB,CAAC;gBACD,MAAM,IAAI,KAAK,CAAC,iEAAiE,CAAC,CAAA;YACpF,CAAC;YACD,IAAI,GAAG,OAAO,CAAA;QAChB,CAAC;QACD,MAAM,GAAG,GAAG,GAAG,IAAI,IAAI,IAAI,IAAI,EAAE,EAAE,CAAA;QACnC,IAAI,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC,EAAE,CAAC;YAClB,SAAQ;QACV,CAAC;QACD,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC,CAAA;QACb,UAAU,CAAC,IAAI,CAAC,IAAI,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,IAAI,EAAE,CAAC,CAAA;IACjE,CAAC;IACD,OAAO,UAAU,CAAA;AACnB,CAAC,CAAA;AAED,MAAM,CAAC,MAAM,wBAAwB,GAAG,CACtC,WAAmD,EAC3C,EAAE,CAAC,WAAW,CAAC,IAAI,KAAK,SAAS,CAAC,CAAC,CAAC,WAAW,CAAC,IAAI,CAAC,CAAC,CAAC,GAAG,WAAW,CAAC,IAAI,IAAI,WAAW,CAAC,IAAI,EAAE,CAAA;AAmB1G,MAAM,0BAA0B,GAAG,CAAC,KAAa,EAAE,IAAY,EAAE,EAAE;IACjE,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC,IAAI,MAAM,CAAC,UAAU,CAAC,KAAK,EAAE,MAAM,CAAC,GAAG,GAAG,EAAE,CAAC;QACjE,MAAM,IAAI,KAAK,CAAC,GAAG,IAAI,uCAAuC,CAAC,CAAA;IACjE,CAAC;AACH,CAAC,CAAA;AAED,MAAM,0BAA0B,GAAG,CAAC,IAAmC,EAAE,IAAY,EAAE,KAAa,EAAE,EAAE;IACtG,MAAM,KAAK,GAAG,MAAM,CAAC,IAAI,CAAC,KAAK,EAAE,MAAM,CAAC,CAAA;IACxC,IAAI,CAAC,MAAM,CAAC,GAAG,IAAI,IAAI,KAAK,CAAC,MAAM,GAAG,EAAE,MAAM,CAAC,CAAA;IAC/C,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,CAAA;IAClB,IAAI,CAAC,MAAM,CAAC,IAAI,EAAE,MAAM,CAAC,CAAA;AAC3B,CAAC,CAAA;AAED,MAAM,CAAC,MAAM,iDAAiD,GAAG,CAC/D,KAA4C,EACL,EAAE;IACzC,IAAI,KAAK,CAAC,aAAa,KAAK,QAAQ,EAAE,CAAC;QACrC,MAAM,IAAI,KAAK,CAAC,4DAA4D,CAAC,CAAA;IAC/E,CAAC;IACD,IAAI,KAAK,CAAC,QAAQ,CAAC,IAAI,KAAK,UAAU,IAAI,KAAK,CAAC,QAAQ,CAAC,IAAI,KAAK,QAAQ,EAAE,CAAC;QAC3E,MAAM,IAAI,KAAK,CAAC,qDAAqD,CAAC,CAAA;IACxE,CAAC;IACD,0BAA0B,CAAC,KAAK,CAAC,QAAQ,CAAC,KAAK,EAAE,+BAA+B,CAAC,CAAA;IACjF,0BAA0B,CAAC,KAAK,CAAC,4BAA4B,EAAE,iCAAiC,CAAC,CAAA;IACjG,0BAA0B,CAAC,KAAK,CAAC,sBAAsB,EAAE,0BAA0B,CAAC,CAAA;IACpF,0BAA0B,CAAC,KAAK,CAAC,mBAAmB,EAAE,uBAAuB,CAAC,CAAA;IAC9E,MAAM,gBAAgB,GAAG,CAAC,GAAG,IAAI,GAAG,CAAC,KAAK,CAAC,gBAAgB,CAAC,CAAC,CAAC,IAAI,EAAE,CAAA;IACpE,IACE,gBAAgB,CAAC,MAAM,KAAK,CAAC;WAC1B,gBAAgB,CAAC,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC,KAAK,KAAK,UAAU,IAAI,KAAK,KAAK,QAAQ,CAAC,EAC7E,CAAC;QACD,MAAM,IAAI,KAAK,CAAC,6DAA6D,CAAC,CAAA;IAChF,CAAC;IACD,OAAO;QACL,aAAa,EAAE,QAAQ;QACvB,QAAQ,EAAE,EAAE,GAAG,KAAK,CAAC,QAAQ,EAAE;QAC/B,gBAAgB;QAChB,4BAA4B,EAAE,KAAK,CAAC,4BAA4B;QAChE,sBAAsB,EAAE,KAAK,CAAC,sBAAsB;QACpD,mBAAmB,EAAE,KAAK,CAAC,mBAAmB;KAC/C,CAAA;AACH,CAAC,CAAA;AAED,MAAM,CAAC,MAAM,sCAAsC,GAAG,CACpD,KAA4C,EACpC,EAAE;IACV,MAAM,SAAS,GAAG,iDAAiD,CAAC,KAAK,CAAC,CAAA;IAC1E,MAAM,IAAI,GAAG,UAAU,CAAC,QAAQ,CAAC,CAAA;IACjC,0BAA0B,CAAC,IAAI,EAAE,QAAQ,EAAE,mDAAmD,CAAC,CAAA;IAC/F,0BAA0B,CAAC,IAAI,EAAE,gBAAgB,EAAE,SAAS,CAAC,aAAa,CAAC,CAAA;IAC3E,0BAA0B,CAAC,IAAI,EAAE,eAAe,EAAE,SAAS,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAA;IAC1E,0BAA0B,CAAC,IAAI,EAAE,gBAAgB,EAAE,SAAS,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAA;IAC5E,KAAK,MAAM,KAAK,IAAI,SAAS,CAAC,gBAAgB,EAAE,CAAC;QAC/C,0BAA0B,CAAC,IAAI,EAAE,kBAAkB,EAAE,KAAK,CAAC,CAAA;IAC7D,CAAC;IACD,0BAA0B,CAAC,IAAI,EAAE,iCAAiC,EAAE,SAAS,CAAC,4BAA4B,CAAC,CAAA;IAC3G,0BAA0B,CAAC,IAAI,EAAE,0BAA0B,EAAE,SAAS,CAAC,sBAAsB,CAAC,CAAA;IAC9F,0BAA0B,CAAC,IAAI,EAAE,uBAAuB,EAAE,SAAS,CAAC,mBAAmB,CAAC,CAAA;IACxF,OAAO,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,CAAA;AAC3B,CAAC,CAAA;AAED,MAAM,CAAC,MAAM,4BAA4B,GAAG,CAC1C,QAAgB,EAChB,WAA4C,EAC5C,oBAAwD,EACxD,EAAE;IACF,KAAK,MAAM,UAAU,IAAI,oBAAoB,EAAE,CAAC;QAC9C,MAAM,OAAO,GAAG,WAAW,CAAC,YAAY,CAAC,UAAU,CAAC,CAAA;QACpD,IAAI,OAAO,KAAK,WAAW,EAAE,CAAC;YAC5B,MAAM,IAAI,sCAAsC,CAC9C,QAAQ,EACR,UAAU,EACV,uBAAuB,QAAQ,oCAAoC,UAAU,MAAM,OAAO,IAAI,CAC/F,CAAA;QACH,CAAC;IACH,CAAC;AACH,CAAC,CAAA"}

package/dist/server/lib/executionEnvironmentRoutes.js

@@ -27,6 +27,15 @@ const withRequestAbortSignal = async (req, res, operation) => {
         res.removeListener('close', abort);
     }
 };
+const parseUserRouteModel = (agent, value) => {
+    const model = value == null || (typeof value === 'string' && value.trim() === '')
+        ? null
+        : parseExecutionEnvironmentModel(value);
+    if (agent === 'opencode' && model === null) {
+        throw new ExecutionEnvironmentRouteError(400, 'model_required', 'An explicit OpenCode model is required for validation.');
+    }
+    return model;
+};
 const serializeValidationChecks = (value) => {
     if (!Array.isArray(value)) {
         return [];
@@ -36,7 +45,7 @@ const serializeValidationChecks = (value) => {
             return [];
         }
         const check = candidate;
-        const kinds = ['workspace_location', 'workspace_readable', 'workspace_writable', 'executable', 'headless', 'authentication', 'skills', 'destination'];
+        const kinds = ['workspace_location', 'workspace_readable', 'workspace_writable', 'executable', 'headless', 'authentication', 'skills', 'destination', 'network'];
         if (!kinds.some(kind => kind === check.kind)
             || (check.agent !== null && check.agent !== 'opencode' && check.agent !== 'claude')
             || (check.state !== 'cancelled' && check.state !== 'failed' && check.state !== 'passed')) {
@@ -91,6 +100,8 @@ const serializeValidationChecks = (value) => {
             || rawDetails.reason === 'model_required'
             || rawDetails.reason === 'provider_required'
             || rawDetails.reason === 'credential_inventory_unavailable'
+            || rawDetails.reason === 'runtime_version_unrecognized'
+            || typeof rawDetails.runtimeVersion === 'string'
             || availableSkills !== undefined
             || missingSkills !== undefined
             || rawDetails.destinationReason === 'invalid_json'
@@ -99,8 +110,10 @@ const serializeValidationChecks = (value) => {
             || rawDetails.destinationReason === 'provider_error'
             || rawDetails.destinationReason === 'model_not_found'
             || rawDetails.destinationReason === 'credential_rejected'
+            || rawDetails.destinationReason === 'empty_completion'
             || rawDetails.destinationReason === 'unexpected_response'
-            || providerError !== undefined)
+            || providerError !== undefined
+            || typeof rawDetails.networkTarget === 'string')
             ? {
                 ...(typeof rawDetails.credentialSource === 'string' ? { credential_source: rawDetails.credentialSource } : {}),
                 ...(typeof rawDetails.credentialProvider === 'string' ? { credential_provider: rawDetails.credentialProvider } : {}),
@@ -110,17 +123,30 @@ const serializeValidationChecks = (value) => {
                 ...(rawDetails.reason === 'model_required'
                     || rawDetails.reason === 'provider_required'
                     || rawDetails.reason === 'credential_inventory_unavailable'
+                    || rawDetails.reason === 'runtime_version_unrecognized'
                     ? { reason: rawDetails.reason }
                     : {}),
+                ...(typeof rawDetails.runtimeVersion === 'string' ? { runtime_version: rawDetails.runtimeVersion.slice(0, 100) } : {}),
                 ...(rawDetails.destinationReason === 'invalid_json'
                     || rawDetails.destinationReason === 'nonzero_exit'
                     || rawDetails.destinationReason === 'timeout'
                     || rawDetails.destinationReason === 'provider_error'
                     || rawDetails.destinationReason === 'model_not_found'
                     || rawDetails.destinationReason === 'credential_rejected'
+                    || rawDetails.destinationReason === 'empty_completion'
                     || rawDetails.destinationReason === 'unexpected_response'
                     ? { destination_reason: rawDetails.destinationReason }
                     : {}),
+                ...(typeof rawDetails.networkTarget === 'string'
+                    ? {
+                        network_target: rawDetails.networkTarget,
+                        ...(rawDetails.networkDecision === 'allow'
+                            || rawDetails.networkDecision === 'deny'
+                            || rawDetails.networkDecision === 'unknown'
+                            ? { network_decision: rawDetails.networkDecision }
+                            : {}),
+                    }
+                    : {}),
                 ...(providerError ? { provider_error: providerError } : {}),
             }
             : undefined;
@@ -191,6 +217,37 @@ const serializeCredentialCapability = (value) => {
         remediation: typeof capability.remediation === 'string' ? capability.remediation.slice(0, 500) : null,
     };
 };
+const NETWORK_GLOBAL_POSTURES = ['allow_all', 'deny_all', 'mixed', 'none_initialized', 'unknown'];
+const serializeValidationNetworkEvidence = (rawValidation, checks, requestedMode) => {
+    const posture = rawValidation?.observedNetworkPosture ?? rawValidation?.observed_network_posture;
+    if (typeof posture !== 'string' || !NETWORK_GLOBAL_POSTURES.includes(posture)) {
+        return null;
+    }
+    const decisions = checks.flatMap(check => (check.kind === 'network' && typeof check.details?.network_target === 'string'
+        ? [{
+                target: check.details.network_target,
+                decision: check.details.network_decision ?? 'unknown',
+                state: check.state,
+            }]
+        : []));
+    const allDestinationsAllowed = decisions.length > 0 && decisions.every(decision => (decision.state === 'passed' && decision.decision === 'allow'));
+    const enforcement = requestedMode === 'unrestricted'
+        ? 'none'
+        : posture === 'deny_all' && allDestinationsAllowed
+            ? 'enforced_scoped'
+            : posture === 'allow_all' && allDestinationsAllowed
+                ? 'declarative_only'
+                : 'unknown';
+    return {
+        observed_global_posture: posture,
+        enforcement,
+        decisions,
+    };
+};
+const serializeRequestedNetworkMode = (rawValidation) => {
+    const mode = rawValidation?.requestedNetworkMode ?? rawValidation?.requested_network_mode;
+    return mode === 'allowlist' || mode === 'unrestricted' ? mode : null;
+};
 const getEnvironmentValidations = (projectId, environment) => {
     const validations = {};
     const providerValidations = {};
@@ -232,12 +289,15 @@ const getEnvironmentValidations = (projectId, environment) => {
             }
         }
         const rawValidation = event?.metadata?.validation;
-        const validation = typeof rawValidation === 'object' && rawValidation !== null
+        const eventValidation = typeof rawValidation === 'object' && rawValidation !== null
             ? rawValidation
             : null;
+        const validation = { ...(run.metadata ?? {}), ...(eventValidation ?? {}) };
         const validationAgent = typeof validation?.agent === 'object' && validation.agent !== null && !Array.isArray(validation.agent)
             ? validation.agent
             : null;
+        const checks = serializeValidationChecks(validation?.checks);
+        const requestedNetworkMode = serializeRequestedNetworkMode(validation);
         const serialized = {
             agent,
             environment_id: environment.id,
@@ -253,7 +313,9 @@ const getEnvironmentValidations = (projectId, environment) => {
                 ? validation.model
                 : typeof validationAgent?.model === 'string' ? validationAgent.model : null,
             credential_capability: serializeCredentialCapability(validation?.credentialCapability ?? validationAgent?.credentialCapability),
-            checks: serializeValidationChecks(validation?.checks),
+            network_evidence: serializeValidationNetworkEvidence(validation, checks, requestedNetworkMode),
+            requested_network_mode: requestedNetworkMode,
+            checks,
         };
         validations[agent] ??= serialized;
         if (serialized.provider && !seenProviderValidationKeys.has(providerValidationKey)) {
@@ -413,7 +475,7 @@ export const registerExecutionEnvironmentRoutes = (app, dependencies = {}) => {
         const environmentId = Array.isArray(req.params.environmentId) ? req.params.environmentId[0] : req.params.environmentId;
         const agent = parseExecutionEnvironmentAgent(req.body?.agent);
         const body = req.body;
-        const model = parseExecutionEnvironmentModel(body?.model);
+        const model = parseUserRouteModel(agent, body?.model);
         const provider = agent === 'claude' ? 'anthropic' : parseExecutionEnvironmentProvider(body?.provider, model);
         return res.json(await validateExecutionEnvironment({ projectId, environmentId, agent, model, provider, signal }, validationDependencies));
     }));
@@ -422,7 +484,7 @@ export const registerExecutionEnvironmentRoutes = (app, dependencies = {}) => {
         const projectId = Array.isArray(req.params.id) ? req.params.id[0] : req.params.id;
         const body = req.body;
         const agent = parseExecutionEnvironmentAgent(body?.agent);
-        const model = parseExecutionEnvironmentModel(body?.model);
+        const model = parseUserRouteModel(agent, body?.model);
         const provider = agent === 'claude' ? 'anthropic' : parseExecutionEnvironmentProvider(body?.provider, model);
         return res.json(await prepareAndValidateExecutionEnvironment({ projectId, agent, model, provider, signal }, validationDependencies));
     }))));