open-managed-agents 0.1.0

package/dist/src/control-plane/egress/policy.js

@@ -0,0 +1,571 @@
+// Egress policy as data + resolution (plan 0117c; ADR 0016 §2, §3, §6).
+//
+// A session's egress policy is a plain serializable object parsed from the
+// environment's `config.networking`, resolved into (a) per-session sentinels
+// for the sandbox environment and (b) the hook set `createEgressProxy`
+// consumes. Policy is testable without a running proxy.
+//
+// Postures locked in here:
+//   - default deny: no `networking` config -> no policy -> no proxy at all
+//     (the environment stays at --network none, ADR 0016 §2);
+//   - strict parse: unknown keys are rejected — a typo must not silently
+//     widen policy;
+//   - inject grants are path-scoped (pathPrefix REQUIRED) and optionally
+//     method-scoped (ADR 0016 §6 — reflectivity is per-endpoint);
+//   - secrets never enter the sandbox: the sandbox gets a random per-session
+//     sentinel; the proxy substitutes the real secret at the boundary, lazily
+//     revealed per request (rotation is picked up, no long-lived plaintext);
+//   - injection hooks NEVER throw: a reveal failure strips the credential
+//     header (fail closed for the secret) instead of crashing the proxy;
+//   - opaque tunnels (no inspection, no injection) are per-host opt-ins.
+import { randomBytes } from "node:crypto";
+import { isIP } from "node:net";
+export class EgressPolicyError extends Error {
+}
+// ---------------------------------------------------------------------------
+// Parsing (strict)
+const ALLOW_KEYS = new Set(["host", "port", "pathPrefix", "opaqueTunnel"]);
+const CREDENTIAL_KEYS = new Set([
+    "secret",
+    "env",
+    "host",
+    "port",
+    "pathPrefix",
+    "methods",
+    "header",
+]);
+const NETWORKING_KEYS = new Set(["allow", "credentials"]);
+const HOSTED_NETWORKING_KEYS = new Set([
+    "type",
+    "allowed_hosts",
+    "allow_package_managers",
+    "allow_mcp_servers",
+]);
+/**
+ * Parse `config.networking` into OMA's internal egress policy.
+ *
+ * The public networking field has two deliberately disjoint shapes:
+ * OMA-native `{ allow, credentials }` and the CMA-shaped hosted
+ * `{ type, allowed_hosts, ... }`. Every present shape is classified and
+ * validated; an unknown or mixed shape is never treated as absent networking.
+ * Returns undefined only for absent networking or a valid hosted empty list.
+ */
+export function parseNetworkingConfig(config) {
+    const networking = config["networking"];
+    if (networking === undefined)
+        return undefined;
+    if (!isPlainObject(networking)) {
+        throw new EgressPolicyError("networking must be an object");
+    }
+    if (isHostedNetworkingShape(networking)) {
+        return parseHostedNetworkingConfig(networking);
+    }
+    if ("allow" in networking || "credentials" in networking) {
+        return parseNativeNetworkingConfig(networking);
+    }
+    throw new EgressPolicyError('networking must use either the OMA-native {allow, credentials} shape or the hosted {type, allowed_hosts} shape');
+}
+/**
+ * Validate networking and return the durable canonical representation.
+ *
+ * Native OMA policies are already structured records and are preserved after
+ * validation. CMA-shaped host lists are normalized to lowercase using the
+ * exact parser that runtime enforcement uses, so the console/API never show a
+ * different policy from the one the proxy will enforce.
+ */
+export function canonicalizeNetworkingConfig(config) {
+    const networking = config["networking"];
+    if (networking === undefined)
+        return config;
+    if (!isPlainObject(networking)) {
+        throw new EgressPolicyError("networking must be an object");
+    }
+    if (isHostedNetworkingShape(networking)) {
+        const policy = parseHostedNetworkingConfig(networking);
+        return {
+            ...config,
+            networking: {
+                ...networking,
+                allowed_hosts: policy?.allow.map((entry) => entry.host) ?? [],
+            },
+        };
+    }
+    parseNativeNetworkingConfig(networking);
+    return config;
+}
+export function canonicalizeHostedAllowedHosts(input) {
+    const policy = parseHostedNetworkingConfig({
+        type: "limited",
+        allowed_hosts: input,
+    });
+    return policy?.allow.map((entry) => entry.host) ?? [];
+}
+function isHostedNetworkingShape(networking) {
+    return ("type" in networking ||
+        "allowed_hosts" in networking ||
+        "allow_package_managers" in networking ||
+        "allow_mcp_servers" in networking);
+}
+function parseHostedNetworkingConfig(networking) {
+    rejectUnknownKeys(networking, HOSTED_NETWORKING_KEYS, "networking");
+    const type = networking["type"];
+    if (type === "unrestricted") {
+        throw new EgressPolicyError('networking.type "unrestricted" is not supported; use type "limited" with an allowed_hosts list');
+    }
+    if (type !== "limited") {
+        throw new EgressPolicyError('networking.type must be "limited" ("unrestricted" is not supported)');
+    }
+    const rawAllowedHosts = networking["allowed_hosts"];
+    if (!Array.isArray(rawAllowedHosts)) {
+        throw new EgressPolicyError("networking.allowed_hosts must be an array");
+    }
+    for (const flag of ["allow_package_managers", "allow_mcp_servers"]) {
+        const value = networking[flag];
+        if (value !== undefined && typeof value !== "boolean") {
+            throw new EgressPolicyError(`networking.${flag} must be a boolean`);
+        }
+        if (value === true) {
+            throw new EgressPolicyError(`networking.${flag}=true is not supported by this deployment`);
+        }
+    }
+    const seen = new Set();
+    const allow = [];
+    rawAllowedHosts.forEach((value, index) => {
+        const host = parseHostedHost(value, `networking.allowed_hosts[${index}]`);
+        if (seen.has(host)) {
+            throw new EgressPolicyError(`networking.allowed_hosts: duplicate entry ${host}`);
+        }
+        seen.add(host);
+        // Hosted limited networking is explicitly HTTPS-only. Termination is what
+        // lets the proxy distinguish TLS from arbitrary plaintext sent through a
+        // CONNECT tunnel; no credential or path grant is synthesized here.
+        allow.push({ host, port: 443, protocol: "https", opaqueTunnel: false });
+    });
+    // A hosted empty list is an explicit, valid default-deny request. It must
+    // remain distinct from native `{ allow: [] }`, whose existing OMA behavior
+    // returns an empty policy object and therefore still requires egress wiring.
+    if (allow.length === 0)
+        return undefined;
+    return { allow, credentials: [] };
+}
+function parseNativeNetworkingConfig(networking) {
+    rejectUnknownKeys(networking, NETWORKING_KEYS, "networking");
+    const rawAllow = networking["allow"];
+    if (!Array.isArray(rawAllow)) {
+        throw new EgressPolicyError("networking.allow must be an array");
+    }
+    const allow = rawAllow.map((entry, i) => parseAllowEntry(entry, i));
+    const seen = new Set();
+    for (const entry of allow) {
+        const key = `${entry.host}:${entry.port}`;
+        if (seen.has(key)) {
+            throw new EgressPolicyError(`networking.allow: duplicate entry ${key}`);
+        }
+        seen.add(key);
+    }
+    const rawCredentials = networking["credentials"] ?? [];
+    if (!Array.isArray(rawCredentials)) {
+        throw new EgressPolicyError("networking.credentials must be an array");
+    }
+    const credentials = rawCredentials.map((entry, i) => parseCredentialGrant(entry, i));
+    const envSeen = new Set();
+    for (const grant of credentials) {
+        // Every inject host must be an allowlisted, TERMINATED host: injection
+        // happens on the decrypted leg, so an opaque host can't carry a grant.
+        const target = allow.find((entry) => entry.host === grant.host && entry.port === grant.port);
+        if (!target) {
+            throw new EgressPolicyError(`networking.credentials: ${grant.host}:${grant.port} is not in networking.allow`);
+        }
+        if (target.opaqueTunnel) {
+            throw new EgressPolicyError(`networking.credentials: ${grant.host}:${grant.port} is an opaqueTunnel host — ` +
+                "injection requires TLS termination");
+        }
+        if (envSeen.has(grant.env)) {
+            throw new EgressPolicyError(`networking.credentials: duplicate env ${grant.env}`);
+        }
+        envSeen.add(grant.env);
+    }
+    return { allow, credentials };
+}
+function parseAllowEntry(value, index) {
+    const at = `networking.allow[${index}]`;
+    if (!isPlainObject(value)) {
+        throw new EgressPolicyError(`${at} must be an object`);
+    }
+    rejectUnknownKeys(value, ALLOW_KEYS, at);
+    const host = parseHost(value["host"], at);
+    const port = parsePort(value["port"], at);
+    const opaqueTunnel = value["opaqueTunnel"] ?? false;
+    if (typeof opaqueTunnel !== "boolean") {
+        throw new EgressPolicyError(`${at}.opaqueTunnel must be a boolean`);
+    }
+    const entry = { host, port, opaqueTunnel };
+    if (value["pathPrefix"] !== undefined) {
+        if (opaqueTunnel) {
+            throw new EgressPolicyError(`${at}: pathPrefix cannot apply to an opaqueTunnel host (no inspection)`);
+        }
+        entry.pathPrefix = parsePathPrefix(value["pathPrefix"], at);
+    }
+    return entry;
+}
+function parseCredentialGrant(value, index) {
+    const at = `networking.credentials[${index}]`;
+    if (!isPlainObject(value)) {
+        throw new EgressPolicyError(`${at} must be an object`);
+    }
+    rejectUnknownKeys(value, CREDENTIAL_KEYS, at);
+    const secret = value["secret"];
+    if (typeof secret !== "string" || secret === "") {
+        throw new EgressPolicyError(`${at}.secret must be a non-empty string`);
+    }
+    const env = value["env"];
+    if (typeof env !== "string" || !/^[A-Z][A-Z0-9_]*$/.test(env)) {
+        throw new EgressPolicyError(`${at}.env must be an UPPER_SNAKE_CASE env var name`);
+    }
+    const grant = {
+        secret,
+        env,
+        host: parseHost(value["host"], at),
+        port: parsePort(value["port"], at),
+        // ADR 0016 §6: pathPrefix is mandatory for inject grants.
+        pathPrefix: parsePathPrefix(value["pathPrefix"], at),
+        header: parseHeader(value["header"], at),
+    };
+    if (value["methods"] !== undefined) {
+        const methods = value["methods"];
+        if (!Array.isArray(methods) ||
+            methods.length === 0 ||
+            !methods.every((m) => typeof m === "string" && /^[A-Za-z]+$/.test(m))) {
+            throw new EgressPolicyError(`${at}.methods must be a non-empty array of HTTP method names`);
+        }
+        grant.methods = methods.map((m) => m.toUpperCase());
+    }
+    return grant;
+}
+function parseHost(value, at) {
+    if (typeof value !== "string" ||
+        value === "" ||
+        value !== value.toLowerCase() ||
+        value.includes("*") ||
+        value.endsWith(".")) {
+        throw new EgressPolicyError(`${at}.host must be a lowercase hostname (no wildcards, no trailing dot)`);
+    }
+    return value;
+}
+/**
+ * CMA-hosted hostname grammar. This is intentionally stricter than the
+ * pre-existing native OMA parser: hosted values are a closed, safe subset and
+ * are normalized only for the internal policy, never in persisted JSON.
+ */
+function parseHostedHost(value, at) {
+    if (typeof value !== "string" || value.length === 0) {
+        throw new EgressPolicyError(`${at} must be a hostname`);
+    }
+    const wildcard = value.startsWith("*.");
+    const hostname = wildcard ? value.slice(2) : value;
+    if (value.includes("*") && !wildcard) {
+        throw new EgressPolicyError(`${at} must use only a leading *. wildcard`);
+    }
+    if (value.length > 253 || hostname.length === 0 || isIP(hostname) !== 0) {
+        throw new EgressPolicyError(`${at} is not a valid DNS hostname`);
+    }
+    const labels = hostname.split(".");
+    if (labels.length < 2) {
+        throw new EgressPolicyError(`${at} must contain at least two hostname labels`);
+    }
+    for (const label of labels) {
+        if (!isHostnameLabel(label)) {
+            throw new EgressPolicyError(`${at} contains an invalid hostname label`);
+        }
+    }
+    return `${wildcard ? "*." : ""}${hostname.toLowerCase()}`;
+}
+function parsePort(value, at) {
+    if (value === undefined)
+        return 443;
+    if (!Number.isSafeInteger(value) || value < 1 || value > 65535) {
+        throw new EgressPolicyError(`${at}.port must be an integer in 1..65535`);
+    }
+    return value;
+}
+function parsePathPrefix(value, at) {
+    if (typeof value !== "string" || !value.startsWith("/")) {
+        throw new EgressPolicyError(`${at}.pathPrefix must be a string starting with "/"`);
+    }
+    return value;
+}
+function parseHeader(value, at) {
+    if (value === undefined)
+        return "authorization";
+    if (typeof value !== "string" || !/^[a-z0-9-]+$/.test(value)) {
+        throw new EgressPolicyError(`${at}.header must be a lowercase header name`);
+    }
+    return value;
+}
+function isPlainObject(value) {
+    return typeof value === "object" && value !== null && !Array.isArray(value);
+}
+function rejectUnknownKeys(value, known, at) {
+    for (const key of Object.keys(value)) {
+        if (!known.has(key)) {
+            throw new EgressPolicyError(`${at}: unknown key "${key}"`);
+        }
+    }
+}
+// ---------------------------------------------------------------------------
+// Path matching
+/**
+ * Segment-boundary prefix match with encoding hardening (probed):
+ *   - the URL parser normalizes `..` and `%2e%2e` dot segments, but
+ *     `..%2f` / `%2f..` survive in pathname — an upstream that decodes %2f
+ *     would escape the prefix, so any decoded form containing a ".." path
+ *     step is denied outright;
+ *   - `/repos` matches `/repos` and `/repos/x`, never `/repositories`.
+ */
+export function pathWithinPrefix(pathname, prefix) {
+    let decoded;
+    try {
+        decoded = decodeURIComponent(pathname);
+    }
+    catch {
+        return false; // malformed percent-encoding: fail closed
+    }
+    if (/(^|[/\\])\.\.([/\\]|$)/.test(decoded))
+        return false;
+    if (pathname === prefix)
+        return true;
+    const boundary = prefix.endsWith("/") ? prefix : `${prefix}/`;
+    return pathname.startsWith(boundary);
+}
+/**
+ * Resolve an environment's networking config into per-session egress: the
+ * sandbox env (sentinels) and the proxy hook set. Returns undefined when the
+ * environment grants no egress (no proxy is stood up; --network none).
+ */
+export function resolveSessionEgress(opts) {
+    const policy = parseNetworkingConfig(opts.environmentConfig);
+    if (policy === undefined)
+        return undefined;
+    const { grants, sandboxEnv } = mintSentinelGrants(policy);
+    return {
+        policy,
+        sandboxEnv,
+        hooks: buildHooks(policy, grants, opts.revealSecret),
+    };
+}
+function mintSentinelGrants(policy) {
+    const grants = policy.credentials.map((grant) => ({
+        ...grant,
+        sentinel: `oma-sentinel-${randomBytes(16).toString("hex")}`,
+    }));
+    const sandboxEnv = {};
+    for (const grant of grants) {
+        sandboxEnv[grant.env] = grant.sentinel;
+    }
+    return { grants, sandboxEnv };
+}
+/**
+ * Control-plane side of the sidecar seam (0117d). Parses the env's networking
+ * config, mints per-session sentinels, and resolves the session's granted
+ * secrets ONCE into a serializable {@link SessionEgressBundle}. Returns
+ * undefined when the environment grants no egress (no sidecar; --network none).
+ *
+ * A grant whose secret cannot be revealed is simply absent from `secrets` —
+ * the sidecar's injection hook strips that credential header (fail closed),
+ * exactly as the in-process path does.
+ */
+export function resolveSessionEgressBundle(opts) {
+    // The token rides in a proxy-URL userinfo slot; constrain it to a URL-safe
+    // charset so a delimiter can't malform the URL or alter the credential the
+    // sandbox client sends. OMA mints the token, so this is a contract, not a
+    // parser — callers should pass hex / base64url.
+    if (typeof opts.proxyAuthToken !== "string" ||
+        !/^[A-Za-z0-9._~-]+$/.test(opts.proxyAuthToken)) {
+        throw new EgressPolicyError("resolveSessionEgressBundle requires a non-empty URL-safe proxyAuthToken " +
+            "([A-Za-z0-9._~-]); use hex or base64url");
+    }
+    const policy = parseNetworkingConfig(opts.environmentConfig);
+    if (policy === undefined)
+        return undefined;
+    const { grants, sandboxEnv } = mintSentinelGrants(policy);
+    const secrets = {};
+    for (const grant of grants) {
+        if (grant.secret in secrets)
+            continue; // resolve each secret once
+        let real;
+        try {
+            real = opts.revealSecret(grant.secret);
+        }
+        catch {
+            real = undefined;
+        }
+        if (real !== undefined)
+            secrets[grant.secret] = real;
+    }
+    return {
+        sandboxEnv,
+        bundle: {
+            policy,
+            grants,
+            secrets,
+            proxyAuthToken: opts.proxyAuthToken,
+            listenPort: opts.listenPort,
+        },
+    };
+}
+/**
+ * Sidecar side of the seam: rebuild the proxy hook set from a serialized
+ * {@link SessionEgressBundle}. `revealSecret` becomes a lookup into the
+ * launch-time resolved map, and the SAME {@link buildHooks} runs — so the
+ * sidecar and the in-process path share one enforcement implementation.
+ */
+export function buildHooksFromBundle(bundle) {
+    return buildHooks(bundle.policy, bundle.grants, (name) => bundle.secrets[name]);
+}
+/**
+ * Match one policy hostname against a request hostname. A hosted `*.` entry
+ * matches one or more labels before its suffix, never the bare suffix itself.
+ * Native entries never contain wildcards, but use this same matcher so every
+ * proxy enforcement layer shares one rule.
+ */
+export function hostMatchesAllowPattern(pattern, host) {
+    const normalizedHost = host.toLowerCase();
+    if (!pattern.startsWith("*."))
+        return pattern === normalizedHost;
+    const suffix = pattern.slice(2);
+    if (!normalizedHost.endsWith(`.${suffix}`))
+        return false;
+    const prefix = normalizedHost.slice(0, -(suffix.length + 1));
+    return prefix.length > 0 && prefix.split(".").every(isHostnameLabel);
+}
+function isHostnameLabel(label) {
+    return (label.length >= 1 &&
+        label.length <= 63 &&
+        /^[A-Za-z0-9](?:[A-Za-z0-9-]*[A-Za-z0-9])?$/.test(label));
+}
+function buildHooks(policy, grants, revealSecret) {
+    const findAllow = (host, port) => policy.allow.find((entry) => entry.port === port && hostMatchesAllowPattern(entry.host, host));
+    const grantInScope = (grant, host, port, pathname, method) => grant.host === host.toLowerCase() &&
+        grant.port === port &&
+        pathWithinPrefix(pathname, grant.pathPrefix) &&
+        (grant.methods === undefined || grant.methods.includes(method.toUpperCase()));
+    return {
+        filter: (port, host) => findAllow(host, port) !== undefined,
+        shouldTerminateTLS: (host, port) => findAllow(host, port)?.opaqueTunnel !== true,
+        // ADR 0016 §3: an uninspected byte tunnel is an explicit per-host grant.
+        allowOpaqueTunnel: (host, port) => findAllow(host, port)?.opaqueTunnel === true,
+        filterRequest: async (request, context) => {
+            const url = new URL(request.url);
+            const host = url.hostname.toLowerCase();
+            const port = url.port
+                ? Number.parseInt(url.port, 10)
+                : url.protocol === "https:"
+                    ? 443
+                    : 80;
+            const entry = findAllow(host, port);
+            if (!entry) {
+                // The connection filter already gates hosts; this fires only if the
+                // two ever disagree. Fail closed.
+                return { action: "deny", reason: `${host}:${port} is not allowlisted` };
+            }
+            if (entry.protocol !== undefined && url.protocol !== `${entry.protocol}:`) {
+                return {
+                    action: "deny",
+                    reason: `${host}:${port} requires ${entry.protocol.toUpperCase()} transport`,
+                };
+            }
+            if (entry.pathPrefix && !pathWithinPrefix(url.pathname, entry.pathPrefix)) {
+                return {
+                    action: "deny",
+                    reason: `path ${url.pathname} is outside the allowed prefix for ${host}`,
+                };
+            }
+            // Sentinel scope enforcement (ADR 0016 §6): a request carrying a
+            // sentinel ANYWHERE outside its grant's (host, port, path, method,
+            // header) scope is denied — the agent cannot steer a granted
+            // credential to an ungranted endpoint. The vendor leg discriminator is
+            // also load-bearing: only the TLS-terminated leg runs mutateHeaders, so
+            // a sentinel on the plain request leg must fail closed before forwarding.
+            for (const grant of grants) {
+                for (const [headerName, headerValue] of request.headers) {
+                    if (!headerValue.includes(grant.sentinel))
+                        continue;
+                    if (context.leg === "plain") {
+                        return {
+                            action: "deny",
+                            reason: `credential ${grant.env} cannot transit the plain proxy leg`,
+                        };
+                    }
+                    if (headerName.toLowerCase() !== grant.header) {
+                        return {
+                            action: "deny",
+                            reason: `credential ${grant.env} used outside its ${grant.header} header`,
+                        };
+                    }
+                    if (url.protocol !== "https:" ||
+                        !grantInScope(grant, host, port, url.pathname, request.method)) {
+                        return {
+                            action: "deny",
+                            reason: `credential ${grant.env} is not granted for ` +
+                                `${request.method} ${host}:${port}${url.pathname}`,
+                        };
+                    }
+                }
+            }
+            return { action: "allow" };
+        },
+        // Injection at the boundary (ADR 0016 §3). Runs only on the terminated
+        // TLS leg (we never set mutateHeadersPlaintext, so a secret cannot be
+        // injected into cleartext HTTP). MUST NOT throw: forwardUpstream treats
+        // a hook throw as a hard failure, and the secret's fail-closed shape is
+        // "strip the credential header", not "kill the proxy".
+        mutateHeaders: (headers, destHost, context) => {
+            if (!context)
+                return; // no request context -> no injection
+            const pathname = pathnameOf(context.path);
+            for (const grant of grants) {
+                const value = headers[grant.header];
+                if (value === undefined)
+                    continue;
+                const values = Array.isArray(value) ? value : [value];
+                if (!values.some((v) => v.includes(grant.sentinel)))
+                    continue;
+                if (pathname === undefined ||
+                    !grantInScope(grant, destHost, context.port, pathname, context.method)) {
+                    // filterRequest already denies off-scope sentinels; if a request
+                    // reaches here anyway, never let the sentinel transit either.
+                    delete headers[grant.header];
+                    continue;
+                }
+                let real;
+                try {
+                    real = revealSecret(grant.secret);
+                }
+                catch {
+                    real = undefined;
+                }
+                if (real === undefined) {
+                    // Reveal failed (missing secret, rotated key): strip rather than
+                    // forward the sentinel — the upstream 401 tells the agent, and
+                    // neither the sentinel nor a secret leaves the boundary.
+                    delete headers[grant.header];
+                    continue;
+                }
+                const replaced = values.map((v) => v.replaceAll(grant.sentinel, real));
+                headers[grant.header] = Array.isArray(value) ? replaced : replaced[0];
+            }
+        },
+    };
+}
+// context.path is the raw origin-form request-target; normalize through the
+// URL parser exactly like filterRequest does, so both layers see the same
+// pathname. Returns undefined (no injection) if the path cannot parse.
+function pathnameOf(rawPath) {
+    try {
+        return new URL(`https://x${rawPath.startsWith("/") ? "" : "/"}${rawPath}`)
+            .pathname;
+    }
+    catch {
+        return undefined;
+    }
+}

package/dist/src/control-plane/egress/presets.js

@@ -0,0 +1,77 @@
+import { invalidRequest } from "../errors.js";
+import { canonicalizeHostedAllowedHosts, EgressPolicyError } from "./policy.js";
+const DEFINITIONS = [
+    {
+        id: "offline-v1",
+        version: 1,
+        name: "Offline",
+        description: "No network access. This is the default.",
+        allowedHosts: [],
+    },
+    {
+        id: "npm-pypi-v1",
+        version: 1,
+        name: "npm + PyPI",
+        description: "Install packages from the npm and Python package registries.",
+        allowedHosts: [
+            "registry.npmjs.org",
+            "pypi.org",
+            "files.pythonhosted.org",
+        ],
+    },
+    {
+        id: "github-packages-v1",
+        version: 1,
+        name: "GitHub + package registries",
+        description: "Clone and download from GitHub, npm, and PyPI.",
+        allowedHosts: [
+            "registry.npmjs.org",
+            "pypi.org",
+            "files.pythonhosted.org",
+            "github.com",
+            "api.github.com",
+            "codeload.github.com",
+            "*.githubusercontent.com",
+        ],
+    },
+];
+export const ENVIRONMENT_NETWORKING_PRESETS = Object.freeze(DEFINITIONS.map((definition) => Object.freeze({
+    id: definition.id,
+    version: definition.version,
+    name: definition.name,
+    description: definition.description,
+    networking: Object.freeze({
+        type: "limited",
+        allowed_hosts: Object.freeze(canonicalizeHostedAllowedHosts([...definition.allowedHosts])),
+    }),
+})));
+export function environmentNetworkingPresetCatalog(deployment) {
+    return {
+        type: "environment_networking_presets",
+        deployment,
+        presets: ENVIRONMENT_NETWORKING_PRESETS,
+        custom: {
+            https_only: true,
+            wildcard_matches_bare_domain: false,
+        },
+    };
+}
+export function validateEnvironmentNetworkingHosts(input) {
+    if (typeof input !== "object" ||
+        input === null ||
+        Array.isArray(input) ||
+        Object.keys(input).some((key) => key !== "allowed_hosts")) {
+        throw invalidRequest("Request body must contain only `allowed_hosts`");
+    }
+    try {
+        return {
+            allowed_hosts: canonicalizeHostedAllowedHosts(input["allowed_hosts"]),
+        };
+    }
+    catch (error) {
+        if (error instanceof EgressPolicyError) {
+            throw invalidRequest(`Invalid environment networking config: ${error.message}`);
+        }
+        throw error;
+    }
+}