code-sandboxes 1.9.22__tar.gz → 1.9.27__tar.gz

{code_sandboxes-1.9.22 → code_sandboxes-1.9.27}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.5
 Name: code_sandboxes
-Version: 1.9.22
+Version: 1.9.27
 Project-URL: Home, https://github.com/datalayer/code-sandboxes
 Author-email: Datalayer <info@datalayer.io>
 License: BSD 3-Clause License

{code_sandboxes-1.9.22 → code_sandboxes-1.9.27}/code_sandboxes/__version__.py

@@ -3,4 +3,4 @@
 
 """Code Sandboxes."""
 
-__version__ = "1.9.22"
+__version__ = "1.9.27"

{code_sandboxes-1.9.22 → code_sandboxes-1.9.27}/code_sandboxes/environments/adapters/datalayer.py

@@ -83,6 +83,7 @@ from ..resolve_conda import (
     conda_lock_pip_requirements,
     is_conda_lock,
     micromamba_bootstrap_dockerfile_line,
+    micromamba_install_command,
 )
 from ..spec import BuildSecret, Environment, command_names_secret
 
@@ -112,6 +113,24 @@ DEFAULT_MAX_ARTIFACT_BYTES = 20 * 1024**3
 # does; nothing about their behavior changed.
 
 
+#: The Dockerfile frontend the generated build asks for.
+#:
+#: At least **1.10**, because `_secret_mount` renders `mountAs: env` as
+#: `--mount=type=secret,env=NAME` and that key does not exist before it: 1.7,
+#: which this pinned for its first year, answers `unexpected key 'env' in
+#: 'env=NAME'` and fails the whole build. The mount and the pin were written
+#: against each other's assumptions and never ran together, because no build
+#: had ever carried a build secret — found on r1 on 2026-09-17 by the first
+#: one that did, and checked against both frontends before changing it.
+#:
+#: Raising this is a change to every Datalayer build, so it is one constant
+#: with one reason, not a literal inside the Dockerfile's own text.
+DOCKERFILE_FRONTEND = "docker/dockerfile:1.10"
+
+#: The first frontend with `--mount=type=secret,env=` (see above).
+SECRET_ENV_FRONTEND = (1, 10)
+
+
 def _secret_mount(secret: BuildSecret) -> str:
     """The ``--mount=type=secret`` flag one `BuildSecret` renders as (E3-05).
 
@@ -283,7 +302,7 @@ class Builder:
         spec = request.environment.spec
         apt = apt_pins_in(request.lock_text)
         lines = [
-            "# syntax=docker/dockerfile:1.7",
+            f"# syntax={DOCKERFILE_FRONTEND}",
             f"# Generated by Datalayer for {request.environment.metadata.name} "
             f"v{request.version}, build {request.build_uid}.",
             f"# Lock: {request.lock_digest}",
@@ -346,8 +365,9 @@ class Builder:
                     micromamba_bootstrap_dockerfile_line(),
                     "COPY lock.txt /opt/datalayer/lock.txt",
                     "RUN --mount=type=cache,target=/opt/conda/pkgs "
-                    f"{MICROMAMBA_BINARY} install --yes --name base "
-                    "--file /opt/datalayer/lock.txt",
+                    + micromamba_install_command(
+                        "/opt/datalayer/lock.txt", micromamba=MICROMAMBA_BINARY
+                    ),
                 ]
             )
             if pip_requirements:

{code_sandboxes-1.9.22 → code_sandboxes-1.9.27}/code_sandboxes/environments/adapters/daytona.py

@@ -116,6 +116,7 @@ from ..resolve_conda import (
     conda_lock_pip_requirements,
     is_conda_lock,
     micromamba_bootstrap_command,
+    micromamba_install_command,
 )
 from ..spec import GPU_SIZE_CLASSES, Environment
 from .managed import ManagedBuilder
@@ -178,15 +179,18 @@ class Builder(ManagedBuilder):
     variant = "daytona"
     item = "E2-04"
     title = "Daytona"
-    #: A `packages` list and, for conda (E3-02), an `environment.yml`
-    #: dependency file installed with `micromamba`.
+    #: A `packages` list, or a dependency file: a conda `environment.yml`
+    #: installed with `micromamba` (E3-02), and a `requirements.txt` or a
+    #: `pyproject.toml` with its lock (E3-01), both of which resolve to the
+    #: very pip lock a `packages` list does — `build` tells a conda lock from
+    #: a pip one and nothing finer, so nothing here is format-specific.
     build_sources = ("packages", "dependencyFile", "dockerfile")
     #: None beyond the contract's own (E3-03): `Image.from_dockerfile` keeps
     #: the Dockerfile text as it is and Daytona builds it on a real Docker
     #: builder, so the grammar it accepts is Docker's. Checked in the SDK on
     #: 2026-09-17.
     forbidden_instructions = ()
-    dependency_formats = ("conda",)
+    dependency_formats = ("requirements", "pyproject", "conda")
     #: Daytona runs GPUs, on its own hardware and the owner's account (E2-17).
     #: This builder does not build one yet: see `_own_findings`.
     gpu = True
@@ -370,9 +374,7 @@ class Builder(ManagedBuilder):
                     # present the same as for a pip source. micromamba is
                     # installed first: the approved base bakes uv but not it.
                     image = image.run_commands(micromamba_bootstrap_command())
-                    image = image.run_commands(
-                        f"micromamba install --yes --name base --file {_LOCK_PATH}"
-                    )
+                    image = image.run_commands(micromamba_install_command(_LOCK_PATH))
                     pip_requirements = conda_lock_pip_requirements(request.lock_text)
                     if pip_requirements:
                         requirements = " ".join(shlex.quote(req) for req in pip_requirements)
@@ -568,6 +570,29 @@ class Builder(ManagedBuilder):
             raise self._provider_error("ask whether the snapshot exists", error) from error
         return True
 
+    def delete(self, artifact: ArtifactReference) -> None:
+        """Remove the snapshot, by id; one already gone is removed (E2-18).
+
+        Deleting what is gone is a success because the collector deletes
+        first and marks second (E1-17): a sweep that died between the two
+        deletes again tomorrow, and must not be refused for having worked.
+
+        **By id, never by name.** The SDK takes either, and a name is reused
+        once its snapshot is deleted (E0-04) — deleting by name could remove
+        a later build's snapshot that inherited it.
+        """
+        sdk = self._daytona_sdk()
+        client = self._client(sdk)
+        snapshot = artifact.provider_artifact_id or artifact.immutable_reference
+        try:
+            client.snapshot.delete(snapshot)
+        except sdk.DaytonaNotFoundError:
+            self._log(f"The Daytona snapshot {snapshot} was already gone")
+            return
+        except Exception as error:
+            raise self._provider_error("delete the snapshot", error) from error
+        self._log(f"Deleted the Daytona snapshot {snapshot}")
+
     def smoke_test(
         self,
         artifact: ArtifactReference,

{code_sandboxes-1.9.22 → code_sandboxes-1.9.27}/code_sandboxes/environments/adapters/modal.py

@@ -124,7 +124,7 @@ import contextlib
 import io
 import os
 import tempfile
-from collections.abc import Callable
+from collections.abc import Callable, Sequence
 from pathlib import Path
 from typing import Any
 
@@ -135,6 +135,7 @@ from ..builders import (
     ArtifactReference,
     BuildRequest,
     CapabilityFinding,
+    ValidationResult,
 )
 from ..contract import SANDBOX_CONTRACT_V1
 from ..errors import (
@@ -535,23 +536,31 @@ class Builder(ManagedBuilder):
         return declared, values
 
     def _ecr_secret(self, sdk: Any, client: Any) -> Any | None:
-        """A Modal Secret carrying this build's own base-reader credential (D-17, D-18).
-
-        `None` when the credential carries no registry login: the base is
-        then whatever the ambient workspace can already reach, the same
-        fallback `_client` takes with no owner token.
+        """A Modal Secret carrying this build's base-reader session (D-17, D-18).
+
+        `from_aws_ecr` wants the IAM session itself — keys, token and region —
+        not the docker-login `AWS`/token pair Daytona and E2B take, which is
+        what the credential's `username`/`password` hold. So it reads
+        `aws_session`. Reading the login pair as IAM keys is what this did
+        until 2026-09-18: the worker minted `AWS`/<ECR token>, this wrote it
+        as `AWS_ACCESS_KEY_ID`/`AWS_SECRET_ACCESS_KEY`, and AWS answered "The
+        security token included in the request is invalid" on the base pull,
+        so no Modal build through the worker could ever succeed.
+
+        `None` when the credential carries no session: the base is then
+        whatever the ambient workspace can already reach, the same fallback
+        `_client` takes with no owner token.
         """
-        username = str(getattr(self._credential, "username", "") or "")
-        password = str(getattr(self._credential, "password", "") or "")
-        if not (username and password):
+        session = dict(getattr(self._credential, "aws_session", None) or {})
+        if not (session.get("AWS_ACCESS_KEY_ID") and session.get("AWS_SECRET_ACCESS_KEY")):
             return None
-        # `from_aws_ecr` wants IAM-shaped credentials, not the docker-login
-        # `AWS`/token pair Daytona and E2B take (found live, 2026-09-13):
-        # the same D-17 session, read differently.
         secret = sdk.Secret.from_dict(
             {
-                "AWS_ACCESS_KEY_ID": username,
-                "AWS_SECRET_ACCESS_KEY": password,
+                **{
+                    name: str(session[name])
+                    for name in ("AWS_ACCESS_KEY_ID", "AWS_SECRET_ACCESS_KEY", "AWS_SESSION_TOKEN")
+                    if session.get(name)
+                },
                 "AWS_REGION": self._region,
             }
         )
@@ -665,6 +674,84 @@ class Builder(ManagedBuilder):
             raise self._provider_error("ask whether the image exists", error) from error
         return True
 
+    def smoke_test(
+        self,
+        artifact: ArtifactReference,
+        *,
+        environment: Any = None,
+        lock_text: str | None = None,
+        secret_values: Sequence[str] = (),
+    ) -> ValidationResult:
+        """Launch the image and run Appendix B's core tier in it (E2-05).
+
+        This box's own `Done when` asks for exactly this — "the live test
+        launches by image id and passes the core tier" — and it refused
+        through `ManagedBuilder`, so **no Modal build could reach
+        `succeeded`**: the image was built in the owner's workspace and the
+        build recorded failed at this step, the same state Daytona was in
+        until 2026-09-17.
+
+        **Launched by image id, never by name**: a published name is mutable
+        by design (§6), so only the id says which artifact ran. Launched
+        through `ModalSandbox` — the same class a person's launch uses —
+        rather than a hand-rolled `Sandbox.create`, because a hand-rolled
+        launch is exactly what hid, on 2026-09-13, that every image this
+        builder made died the instant it was launched for real.
+
+        **As the owner** (D-8): the sandbox is created with the same client
+        the build used, so it runs in the workspace the image is in.
+
+        **Restarted by replacing the sandbox.** Modal has no in-place
+        restart, so check 7's restart stops this sandbox and starts another
+        from the same image, which is the stronger form of the question.
+
+        The sandbox is terminated whether the tier passed or not.
+        """
+        if environment is None:
+            raise EnvironmentsError(
+                CAPABILITY_UNSUPPORTED,
+                "A Modal smoke test needs the version's spec: the core tier "
+                "asks for the Python version it declared and the packages its "
+                "lock pinned, and an artifact carries neither",
+                detail={"variant": self.variant},
+            )
+        from ...modal_sandbox import ModalSandbox
+        from ...models import SandboxConfig
+        from ..conformance import expected_packages, run_core_tier
+
+        sdk = self._modal_sdk()
+        sandbox = ModalSandbox(
+            config=SandboxConfig(name=f"smoke-{artifact.provider_artifact_id}"),
+            app_name=f"dl-{environment.metadata.name}",
+            image_id=artifact.provider_artifact_id,
+            client=self._client(sdk),
+        )
+        self._log(f"Launching {artifact.provider_artifact_id} to smoke-test it")
+        try:
+            sandbox.start()
+            return run_core_tier(
+                sandbox,
+                python_version=environment.spec.language.version,
+                expected_packages=expected_packages(environment, lock_text or ""),
+                secret_values=tuple(secret_values),
+                restart=lambda: self._restart(sandbox),
+            )
+        except EnvironmentsError:
+            raise
+        except Exception as error:
+            raise self._provider_error("smoke-test the image", error) from error
+        finally:
+            try:
+                sandbox.stop()
+            except Exception as error:
+                self._log(f"The smoke-test sandbox could not be stopped: {error}")
+
+    @staticmethod
+    def _restart(sandbox: Any) -> None:
+        """Check 7's restart, as Modal can do it: a new sandbox from the same image."""
+        sandbox.stop()
+        sandbox.start()
+
     def delete(self, artifact: ArtifactReference) -> None:
         """Delete the image, and every intermediate layer this build recorded (E2-05, E2-09).
 

{code_sandboxes-1.9.22 → code_sandboxes-1.9.27}/code_sandboxes/environments/attest.py

@@ -49,7 +49,16 @@ from .errors import (
     SCAN_BLOCKED,
     EnvironmentsError,
 )
-from .policy import DEFAULT_POLICY, PolicyDecision, ScanPolicy, decide, findings_of
+from .policy import (
+    DEFAULT_POLICY,
+    UNRESTRICTED_POLICY,
+    EnvironmentsPolicy,
+    PolicyDecision,
+    ScanPolicy,
+    decide,
+    findings_of,
+    refuse_unlicensed,
+)
 
 logger = logging.getLogger(__name__)
 
@@ -116,47 +125,72 @@ _SPDX_LICENSE_KEYS = ("licenseConcluded", "licenseDeclared")
 _SPDX_UNKNOWN = frozenset({"NOASSERTION", "NONE", ""})
 
 
-def _spdx_licenses(document: Mapping[str, Any]) -> set[str]:
-    """What an SPDX document names, which is what BuildKit's `attest:sbom=` writes.
+def _spdx_license_pairs(document: Mapping[str, Any]) -> list[tuple[str, str]]:
+    """Every SPDX package with a licence, as `(package, licence)`.
 
     `licenseConcluded` is what the tool decided and `licenseDeclared` what the
     package claimed, so the concluded one is read first and the declared one
     only when it said nothing.
     """
-    found: set[str] = set()
+    found: list[tuple[str, str]] = []
     for package in document.get("packages") or ():
         if not isinstance(package, Mapping):
             continue
+        name = str(package.get("name") or "").strip()
         for key in _SPDX_LICENSE_KEYS:
             value = str(package.get(key) or "").strip()
             if value and value.upper() not in _SPDX_UNKNOWN:
-                found.add(value)
+                # Kept even with no name: `licenses_of` reads only the licence
+                # half, and dropping an unnamed package's licence there would
+                # be exactly the silent behavior change this refactor must
+                # not make. `licenses_by_package`'s own callers decide what an
+                # empty package name means for them.
+                found.append((name, value))
                 break
     return found
 
 
-def _cyclonedx_licenses(document: Mapping[str, Any]) -> set[str]:
-    """What a CycloneDX document names, by id, by name, or as an expression."""
-    found: set[str] = set()
+def _cyclonedx_license_pairs(document: Mapping[str, Any]) -> list[tuple[str, str]]:
+    """Every CycloneDX component with a licence, as `(component, licence)`."""
+    found: list[tuple[str, str]] = []
     for component in document.get("components") or ():
         if not isinstance(component, Mapping):
             continue
+        name = str(component.get("name") or "").strip()
         for entry in component.get("licenses") or ():
             if not isinstance(entry, Mapping):
                 continue
             licence = entry.get("license")
+            value = ""
             if isinstance(licence, Mapping):
                 for key in _CYCLONEDX_LICENSE_KEYS:
                     value = str(licence.get(key) or "").strip()
                     if value:
-                        found.add(value)
                         break
-            expression = str(entry.get("expression") or "").strip()
-            if expression:
-                found.add(expression)
+            if not value:
+                value = str(entry.get("expression") or "").strip()
+            if value:
+                # Kept even with no component name; see the SPDX reader's own
+                # note above.
+                found.append((name, value))
     return found
 
 
+def licenses_by_package(document: Any) -> list[tuple[str, str]]:
+    """Every `(package, licence)` an SBOM names, package first (E3-06).
+
+    The same two shapes `licenses_of` reads, kept attributed rather than
+    flattened: a policy that denies a licence has to name the package that
+    carries it, which `licenses_of`'s own deduplicated set of licence strings
+    alone cannot answer. Insertion order, not sorted — the order the SBOM's
+    own packages/components came in, which is what a refusal naming "the
+    first one" should mean deterministically for the same document.
+    """
+    if not isinstance(document, Mapping):
+        return []
+    return _spdx_license_pairs(document) + _cyclonedx_license_pairs(document)
+
+
 def licenses_of(document: Any) -> list[str]:
     """Every licence an SBOM names, deduplicated and sorted.
 
@@ -173,7 +207,7 @@ def licenses_of(document: Any) -> list[str]:
     """
     if not isinstance(document, Mapping):
         return []
-    return sorted(_spdx_licenses(document) | _cyclonedx_licenses(document))
+    return sorted({licence for _package, licence in licenses_by_package(document)})
 
 
 @dataclass(frozen=True)
@@ -589,12 +623,21 @@ class Attestor:
         sbom_ref: str = "",
         provenance_ref: str = "",
         sbom: Any = None,
+        environments_policy: EnvironmentsPolicy = UNRESTRICTED_POLICY,
     ) -> AttestationResult:
         """Scan, then sign: the order the Operator's check depends on (D-11).
 
         `sbom`, when the caller has the document, is read for the licences a
         publication carries; the registry's scanner reports vulnerabilities
         and never licences, so there is nowhere else they come from.
+
+        **Refused before signing, never after (E3-06).** A licence an
+        organization's own policy denies is checked against the same `sbom`,
+        naming the package that carries it, and raised before `sign` runs —
+        an artifact whose licence policy denies it is never signed, the same
+        as one whose scan blocks it: a signature is Datalayer's word that an
+        artifact may run, and this is the second of the two words that go
+        into it.
         """
         self.can_sign()
         decision = self.scan(repository=repository, digest=digest)
@@ -609,6 +652,8 @@ class Attestor:
                     "blocking": [finding.id for finding in decision.blocking],
                 },
             )
+        pairs = licenses_by_package(sbom)
+        refuse_unlicensed(pairs, environments_policy)
         signature, signed_now = self.sign(registry=registry, repository=repository, digest=digest)
         return AttestationResult(
             decision=decision,
@@ -619,7 +664,7 @@ class Attestor:
             if size_bytes is not None
             else self.size_of(repository=repository, digest=digest),
             signed_now=signed_now,
-            licenses=tuple(licenses_of(sbom)),
+            licenses=tuple(sorted({licence for _package, licence in pairs})),
         )
 
     def size_of(self, *, repository: str, digest: str) -> int | None:
@@ -665,8 +710,10 @@ def attest_artifact(
     artifact: Any,
     credential: Any = None,
     policy: ScanPolicy = DEFAULT_POLICY,
+    environments_policy: EnvironmentsPolicy = UNRESTRICTED_POLICY,
     log: Callable[[str], None] | None = None,
     size_bytes: int | None = None,
+    sbom: Any = None,
     attestor: Attestor | None = None,
 ) -> dict[str, Any]:
     """The `attest` seam of `EnvironmentBuildWorkflow` (E1-08, E1-09).
@@ -674,6 +721,13 @@ def attest_artifact(
     Takes the artifact the builder recorded and the build's credential, and
     answers the mapping the workflow stores: the scan's decision, the
     signature, the SBOM and provenance references, and the size.
+
+    `environments_policy` is the caller's organization's own narrowing of
+    what licence a build may carry (E3-06); `sbom`, when the caller has the
+    document, is what it is checked against — nobody fetches one here. A
+    caller with neither passes nothing through, and nothing is refused: the
+    platform default is unrestricted on licences, the same as every other
+    dimension of this policy until an organization writes one.
     """
     variant = str(getattr(artifact, "variant", "") or "")
     reference = str(getattr(artifact, "immutable_reference", "") or "")
@@ -724,6 +778,8 @@ def attest_artifact(
         repository=repository,
         digest=digest,
         size_bytes=size_bytes,
+        sbom=sbom,
+        environments_policy=environments_policy,
     ).body()
 
 

{code_sandboxes-1.9.22 → code_sandboxes-1.9.27}/code_sandboxes/environments/conformance.py

@@ -477,6 +477,14 @@ def expected_packages(environment: Any, lock_text: str) -> dict[str, str]:
 
     from .resolve import locked_versions
 
+    dependency_file = environment.spec.build.dependency_file
+    if dependency_file is not None and dependency_file.source_format == "conda":
+        # A conda source names its packages in the file, not in
+        # `packages.python`, and its lock is not a pip one (E3-02). Read the
+        # other way, check 5 was handed nothing and passed for it.
+        from .resolve_conda import conda_expected_packages
+
+        return conda_expected_packages(dependency_file.content, lock_text or "")
     pinned = locked_versions(lock_text) if lock_text else {}
     names: list[str] = []
     for text in environment.spec.packages.python.dependencies:

{code_sandboxes-1.9.22 → code_sandboxes-1.9.27}/code_sandboxes/environments/policy.py

@@ -32,17 +32,20 @@ from collections.abc import Iterable, Mapping, Sequence
 from dataclasses import dataclass, field
 from typing import Any
 
-from .errors import SCAN_BLOCKED, EnvironmentsError
+from .errors import POLICY_DENIED, SCAN_BLOCKED, EnvironmentsError
 
 __all__ = [
     "DEFAULT_POLICY",
     "SEVERITIES",
+    "EnvironmentsPolicy",
     "Finding",
     "PolicyDecision",
     "ScanPolicy",
     "decide",
+    "environments_policy_from_rules",
     "findings_of",
     "refuse_if_blocked",
+    "refuse_unlicensed",
 ]
 
 #: The severities a scanner reports, weakest first. Anything it reports that is
@@ -300,3 +303,132 @@ def refuse_if_blocked(decision: PolicyDecision, *, reference: str = "") -> None:
             "blocking": [finding.id for finding in decision.blocking],
         },
     )
+
+
+@dataclass(frozen=True)
+class EnvironmentsPolicy:
+    """An organization's own narrowing of what a build may do (E3-06).
+
+    Every allowlist is ``None`` until an organization writes one, meaning
+    that dimension is unrestricted beyond the platform's own defaults — the
+    approved bases, the public registries a spec's own validation already
+    checks, and nothing at all for indexes, packages or licences. Setting a
+    list, even an empty one, is a real policy: an organization that writes
+    ``allowed_licenses=()`` has denied every licence, and this does not
+    second-guess a policy that strict — the refusal it produces names
+    exactly why.
+
+    This narrows; it never widens. A base, index, registry, package or
+    licence the platform already refuses stays refused whatever an
+    organization allows — the same rule `refuse_widening` already keeps for
+    the gateway's own policy layers (`iam/datalayer_iam/services/
+    mcp_policies.py`), applied here to a different set of rules.
+    """
+
+    allowed_bases: tuple[str, ...] | None = None
+    allowed_indexes: tuple[str, ...] | None = None
+    allowed_registries: tuple[str, ...] | None = None
+    allowed_packages: tuple[str, ...] | None = None
+    allowed_licenses: tuple[str, ...] | None = None
+    scan: ScanPolicy = DEFAULT_POLICY
+    #: The policy document's own version, carried into E1-08's decision
+    #: record so a build made under one policy is not misread once an
+    #: organization changes it — the version answers "which policy" without
+    #: needing IAM asked again.
+    version: int | None = None
+
+    def allows(self, dimension: str, value: str) -> bool:
+        """Whether `value` clears this policy's allowlist for `dimension`.
+
+        `True` when the dimension is unrestricted (`None`) or the value is on
+        the list; the comparison is exact, not a prefix or a host match — an
+        index or a registry is compared the way `image_registry_allowed`
+        already compares one, and a base or a package by its own name.
+        """
+        allowed = getattr(self, f"allowed_{dimension}")
+        return allowed is None or value in allowed
+
+
+#: No organization has written a policy: every dimension unrestricted, the
+#: platform's own default scan threshold. The reading a caller with no
+#: policy document gets, and what every check below is a no-op against.
+UNRESTRICTED_POLICY = EnvironmentsPolicy()
+
+#: What `environments_policy_from_rules` reads a list-shaped field as. Kept
+#: beside `ScanPolicy`'s own fields so the two are validated the same way.
+_LIST_FIELDS: tuple[str, ...] = (
+    "allowedBases",
+    "allowedIndexes",
+    "allowedRegistries",
+    "allowedPackages",
+    "allowedLicenses",
+)
+
+
+def environments_policy_from_rules(
+    rules: Mapping[str, Any] | None, *, version: int | None = None
+) -> EnvironmentsPolicy:
+    """The `environments` section of an organization's MCP policy document,
+    as the shape this module checks against (E3-06).
+
+    `rules` is the raw object IAM stores under the policy's own
+    ``environments`` key — camelCase, the same convention every other rule in
+    `iam/datalayer_iam/services/mcp_policies.py` already uses. Absent, or not
+    an object, answers :data:`UNRESTRICTED_POLICY`: an organization that has
+    not written this section has narrowed nothing, the same reading every
+    other rule in that module gives an unset one.
+
+    Never raises. A caller holding an organization's policy already trusts
+    IAM to have validated it at the write (`mcp_policies.validate_rules`);
+    asking twice, differently, would let the two readings disagree about
+    what a stored policy means.
+    """
+    if not isinstance(rules, Mapping):
+        return UNRESTRICTED_POLICY
+    lists: dict[str, tuple[str, ...] | None] = {}
+    for camel in _LIST_FIELDS:
+        value = rules.get(camel)
+        snake = "".join(
+            f"_{c.lower()}" if c.isupper() else c for c in camel
+        )  # allowedBases -> allowed_bases
+        lists[snake] = (
+            tuple(str(item) for item in value) if isinstance(value, (list, tuple)) else None
+        )
+    scan_rules = rules.get("scan") if isinstance(rules.get("scan"), Mapping) else {}
+    blocks_at = str(scan_rules.get("blocksAt") or DEFAULT_POLICY.blocks_at).upper()
+    scan = ScanPolicy(
+        blocks_at=blocks_at if blocks_at in SEVERITIES else DEFAULT_POLICY.blocks_at,
+        only_fixable=bool(scan_rules.get("onlyFixable", DEFAULT_POLICY.only_fixable)),
+        allowed=tuple(str(item) for item in (scan_rules.get("allowed") or ()))
+        or DEFAULT_POLICY.allowed,
+    )
+    return EnvironmentsPolicy(scan=scan, version=version, **lists)
+
+
+def refuse_unlicensed(
+    pairs: Sequence[tuple[str, str]], policy: EnvironmentsPolicy = UNRESTRICTED_POLICY
+) -> None:
+    """Raise `DL_ENV_POLICY_DENIED` on the first licence this policy does not
+    allow, naming the package that carries it (E3-06).
+
+    `pairs` is `attest.licenses_by_package`'s own output: `(package,
+    licence)`, in the SBOM's own order, so the same artifact always names the
+    same first offender. A no-op when `policy.allowed_licenses` is unset —
+    every artifact today, until an organization writes one.
+    """
+    if policy.allowed_licenses is None:
+        return
+    for package, licence in pairs:
+        if not policy.allows("licenses", licence):
+            raise EnvironmentsError(
+                POLICY_DENIED,
+                f"`{licence}` ({package or 'an unnamed package'}) is not an allowed "
+                f"licence (the allowed ones are {', '.join(policy.allowed_licenses) or '(none)'})",
+                detail={
+                    "field": "licenses",
+                    "package": package,
+                    "license": licence,
+                    "allowed": list(policy.allowed_licenses),
+                    **({"policyVersion": policy.version} if policy.version is not None else {}),
+                },
+            )