trampoline-delta 0.1.5__tar.gz

trampoline_delta-0.1.5/.gitignore

@@ -0,0 +1,13 @@
+__pycache__/
+.venv
+.env.*
+.env
+.delta/
+gha-creds-*.json
+
+# Rust and maturin build artifacts. Keep Cargo.lock and toolchain manifests tracked.
+target/
+pkgs/mesa-fs/dist/
+pkgs/mesa-fs/python/mesa_fs/_native*.so
+pkgs/mesa-fs/python/mesa_fs/_native*.dylib
+pkgs/mesa-fs/python/mesa_fs/_native*.pyd

trampoline_delta-0.1.5/.python-version

@@ -0,0 +1 @@
+3.13

trampoline_delta-0.1.5/AGENTS.md

@@ -0,0 +1,15 @@
+# Agent Instructions
+
+## Tooling
+
+- Always use `uv` for Python commands, dependency management, test runs, and local execution.
+- Do not document or introduce `python`, `python3`, or `pip` workflows unless the user explicitly asks for a non-uv escape hatch.
+
+## Defensive Programming
+
+- Do not add silent fallbacks for core behavior. If the expected dependency, service, credential store, schema, or configuration is unavailable, fail loudly.
+- Do not store authentication secrets in plaintext fallback files. Auth credentials must use the intended secure store.
+- Do not mask unexpected states with `getattr(x, None)`, broad `except Exception`, generic default values, or long chains of conditional recovery.
+- Do not coerce external data into the type you hoped it had. Validate the type and fail if it is wrong.
+- Use explicit types. Avoid `Any` unless the code is genuinely accepting an arbitrary object by design.
+- Keep control flow direct. Prefer typed models and small validation functions over loose dictionaries and defensive branching.

trampoline_delta-0.1.5/PKG-INFO

@@ -0,0 +1,178 @@
+Metadata-Version: 2.5
+Name: trampoline-delta
+Version: 0.1.5
+Summary: Command line interface for the Delta service
+Requires-Python: >=3.13
+Requires-Dist: avalanche-ai==0.1.5rc1
+Requires-Dist: boto3<1.43.1,>=1.42.24
+Requires-Dist: botocore<1.43.1,>=1.42.24
+Requires-Dist: cryptography>=48.0.1
+Requires-Dist: google-auth>=2.38.0
+Requires-Dist: google-cloud-storage<4.0.0,>=3.13.0
+Requires-Dist: httpx<1.0,>=0.27.0
+Requires-Dist: pydantic>=2.13.4
+Requires-Dist: python-ulid>=3.1.0
+Requires-Dist: urllib3<3.0.0,>=2.7.0
+Requires-Dist: zstandard>=0.23.0
+Description-Content-Type: text/markdown
+
+# Delta CLI
+
+Delta CLI is a command line interface for the Delta service.
+
+This repository contains the Delta command router, version output, and
+browser-based CLI authentication.
+
+## Features
+
+- Built-in help via `delta --help` and per-command `--help`
+- Version output via `delta version` and `delta --version`
+- OAuth login with Authorization Code + PKCE
+- One-shot `127.0.0.1:8400` callback server or an optional Console callback handoff
+- Session storage in `~/.trampoline-ai/delta/auth.json` with owner-only permissions
+- Automatic bearer authentication for service API commands
+
+## Requirements
+
+- Python 3.13+
+- uv
+
+## Installation
+
+From this directory, install the CLI in editable mode:
+
+~~~bash
+uv tool install -e .
+~~~
+
+You can also run the CLI directly during development:
+
+~~~bash
+uv run --with-editable . delta --help
+uv run --with-editable . delta version
+~~~
+
+## Authentication Setup
+
+The CLI uses a public OAuth application. Do not use secret keys for interactive
+CLI user login.
+
+The local session is stored in `~/.trampoline-ai/delta/auth.json`. Delta creates the
+containing directory with mode `0700` and writes the credential file atomically with
+mode `0600`.
+
+Create an OAuth application in the same auth project as `../console`:
+
+- Default redirect URI: `http://127.0.0.1:8400/callback`
+- Console callback URI for `--manual-callback`:
+  `https://cloud.avalanche.run/oauth/callback`
+- Public client: enabled
+- PKCE required: enabled
+- Scopes: `profile email offline_access user:org:read`
+
+A Clerk administrator must register the applicable redirect URI before its login mode
+can succeed.
+
+The production issuer, public OAuth client ID, and callback port are built in.
+Sign in without configuration:
+
+~~~bash
+delta login
+~~~
+
+For another deployment, override the public auth configuration explicitly:
+
+~~~bash
+export DELTA_AUTH_ISSUER_URL="https://your-auth-issuer.example.com"
+export DELTA_AUTH_CLIENT_ID="your_oauth_client_id"
+~~~
+
+For local development in this monorepo, the CLI can also derive the issuer from
+`DELTA_AUTH_PUBLISHABLE_KEY`.
+
+## Command Overview
+
+### `delta version`
+
+Shows the installed Delta CLI version.
+
+### `delta auth login`
+
+Signs in to Delta through your browser.
+
+~~~bash
+delta login
+~~~
+
+The CLI uses the registered callback port `8400`. Pass `--callback-port 0` for a
+random loopback port when another provider supports RFC 8252 loopback redirects.
+
+Use `--no-browser` to print the sign-in URL instead of opening it:
+
+~~~bash
+delta auth login --no-browser
+~~~
+
+Use the Console callback when the browser cannot reach the local loopback listener:
+
+~~~bash
+delta auth login --manual-callback
+~~~
+
+Complete sign-in in the browser, select **Copy response** at the Console callback
+page, then paste that response into Delta's hidden terminal prompt. The response is
+bound to the in-memory PKCE sign-in attempt; do not paste it into logs or chat.
+
+### `delta auth status`
+
+Shows whether you are signed in.
+
+### `delta auth whoami`
+
+Shows the signed-in account.
+
+### `delta auth logout`
+
+Signs out of Delta.
+
+### `delta --help`
+
+Shows available commands and global options.
+
+### Portable Avalanche workspaces
+
+Capture one or more local directories as typed `ava.Workspace` run inputs:
+
+~~~bash
+delta runs create demo-flow \
+  --workspace source=./input-tree \
+  --workspace config=./config-tree
+~~~
+
+Each field name must be unique across `--workspace` and JSON inputs. Delta
+captures the directory with Avalanche's workspace manifest codec and uploads the
+manifest through the run-scoped artifact path; workflow code receives
+`ava.Workspace` when its declared input field uses that annotation. Manifests
+are limited to 48 MiB; the CLI rejects oversized trees from directory metadata
+before reading their file contents.
+
+Materialize terminal workspace trees into a new local directory:
+
+~~~bash
+delta runs output run_01KCVST2FP4QC5NKZNN5NS0Z2W --output-dir ./downloaded
+~~~
+
+The destination must not already exist. Workspace values are written as
+`workspace-0001`, `workspace-0002`, and so on in deterministic result order.
+Mixed `ava.File` references remain in the result envelope. Without
+`--output-dir`, `runs output` continues to print that standard Avalanche result
+document unchanged.
+
+Service API commands automatically load and refresh the signed-in session from
+`~/.trampoline-ai/delta/auth.json`. An explicit `--token` wins, then a nonblank
+`DELTA_TOKEN`, then the saved session; the user TOML configuration rejects plaintext
+tokens.
+
+The API enforces the selected Clerk organization and its role permissions. The
+signed-in user must belong to the requested organization, and that role must
+include the Delta action used by the service command.

trampoline_delta-0.1.5/README.md

@@ -0,0 +1,160 @@
+# Delta CLI
+
+Delta CLI is a command line interface for the Delta service.
+
+This repository contains the Delta command router, version output, and
+browser-based CLI authentication.
+
+## Features
+
+- Built-in help via `delta --help` and per-command `--help`
+- Version output via `delta version` and `delta --version`
+- OAuth login with Authorization Code + PKCE
+- One-shot `127.0.0.1:8400` callback server or an optional Console callback handoff
+- Session storage in `~/.trampoline-ai/delta/auth.json` with owner-only permissions
+- Automatic bearer authentication for service API commands
+
+## Requirements
+
+- Python 3.13+
+- uv
+
+## Installation
+
+From this directory, install the CLI in editable mode:
+
+~~~bash
+uv tool install -e .
+~~~
+
+You can also run the CLI directly during development:
+
+~~~bash
+uv run --with-editable . delta --help
+uv run --with-editable . delta version
+~~~
+
+## Authentication Setup
+
+The CLI uses a public OAuth application. Do not use secret keys for interactive
+CLI user login.
+
+The local session is stored in `~/.trampoline-ai/delta/auth.json`. Delta creates the
+containing directory with mode `0700` and writes the credential file atomically with
+mode `0600`.
+
+Create an OAuth application in the same auth project as `../console`:
+
+- Default redirect URI: `http://127.0.0.1:8400/callback`
+- Console callback URI for `--manual-callback`:
+  `https://cloud.avalanche.run/oauth/callback`
+- Public client: enabled
+- PKCE required: enabled
+- Scopes: `profile email offline_access user:org:read`
+
+A Clerk administrator must register the applicable redirect URI before its login mode
+can succeed.
+
+The production issuer, public OAuth client ID, and callback port are built in.
+Sign in without configuration:
+
+~~~bash
+delta login
+~~~
+
+For another deployment, override the public auth configuration explicitly:
+
+~~~bash
+export DELTA_AUTH_ISSUER_URL="https://your-auth-issuer.example.com"
+export DELTA_AUTH_CLIENT_ID="your_oauth_client_id"
+~~~
+
+For local development in this monorepo, the CLI can also derive the issuer from
+`DELTA_AUTH_PUBLISHABLE_KEY`.
+
+## Command Overview
+
+### `delta version`
+
+Shows the installed Delta CLI version.
+
+### `delta auth login`
+
+Signs in to Delta through your browser.
+
+~~~bash
+delta login
+~~~
+
+The CLI uses the registered callback port `8400`. Pass `--callback-port 0` for a
+random loopback port when another provider supports RFC 8252 loopback redirects.
+
+Use `--no-browser` to print the sign-in URL instead of opening it:
+
+~~~bash
+delta auth login --no-browser
+~~~
+
+Use the Console callback when the browser cannot reach the local loopback listener:
+
+~~~bash
+delta auth login --manual-callback
+~~~
+
+Complete sign-in in the browser, select **Copy response** at the Console callback
+page, then paste that response into Delta's hidden terminal prompt. The response is
+bound to the in-memory PKCE sign-in attempt; do not paste it into logs or chat.
+
+### `delta auth status`
+
+Shows whether you are signed in.
+
+### `delta auth whoami`
+
+Shows the signed-in account.
+
+### `delta auth logout`
+
+Signs out of Delta.
+
+### `delta --help`
+
+Shows available commands and global options.
+
+### Portable Avalanche workspaces
+
+Capture one or more local directories as typed `ava.Workspace` run inputs:
+
+~~~bash
+delta runs create demo-flow \
+  --workspace source=./input-tree \
+  --workspace config=./config-tree
+~~~
+
+Each field name must be unique across `--workspace` and JSON inputs. Delta
+captures the directory with Avalanche's workspace manifest codec and uploads the
+manifest through the run-scoped artifact path; workflow code receives
+`ava.Workspace` when its declared input field uses that annotation. Manifests
+are limited to 48 MiB; the CLI rejects oversized trees from directory metadata
+before reading their file contents.
+
+Materialize terminal workspace trees into a new local directory:
+
+~~~bash
+delta runs output run_01KCVST2FP4QC5NKZNN5NS0Z2W --output-dir ./downloaded
+~~~
+
+The destination must not already exist. Workspace values are written as
+`workspace-0001`, `workspace-0002`, and so on in deterministic result order.
+Mixed `ava.File` references remain in the result envelope. Without
+`--output-dir`, `runs output` continues to print that standard Avalanche result
+document unchanged.
+
+Service API commands automatically load and refresh the signed-in session from
+`~/.trampoline-ai/delta/auth.json`. An explicit `--token` wins, then a nonblank
+`DELTA_TOKEN`, then the saved session; the user TOML configuration rejects plaintext
+tokens.
+
+The API enforces the selected Clerk organization and its role permissions. The
+signed-in user must belong to the requested organization, and that role must
+include the Delta action used by the service command.

trampoline_delta-0.1.5/delta_cli/__init__.py

@@ -0,0 +1,5 @@
+"""Delta CLI package."""
+
+__all__ = ["__version__"]
+
+__version__ = "0.1.0"

trampoline_delta-0.1.5/delta_cli/_contracts.py

@@ -0,0 +1,3 @@
+"""Workspace alias for the canonical API contract package."""
+
+from delta_api_spec import *  # noqa: F403

trampoline_delta-0.1.5/delta_cli/_embedded_contracts/SHA256SUMS.json

@@ -0,0 +1,16 @@
+{
+  "__init__.py": "ea868b1f0c99a0b0860ecf22265acbc8710433fc918c32938d7a45f112924f77",
+  "environment.py": "461f421e18deb66c6aaf93790ead6346e869471faa48c09bf914f6f296140130",
+  "ids.py": "519b8afd2b5ab7a6cc1ed449825498eeb190795c2bbf3d75a002988ee90d33e6",
+  "invocation.py": "2f3e68e3890201c375793295791b6e4077a25b8e8ec724a9f622a8c5fdcc5bf2",
+  "manifests.py": "3c2bf35db026cdda4f274860f9bc5c91bfae32ea2d656ee1ce6a46043a3d7703",
+  "public_http_v2.py": "010d37d54f674cc9b904397a1f43724c4a0d23702b6ac6de62aaa763c2c02a40",
+  "run_activity.py": "b0976579be5342dbf7cc6986f2211496474ea7aefd35bc9585977c887be8e146",
+  "run_lifecycle.py": "4970e702fb793788d0b3e600e2c8a93b1bdca0cde2b3cf5e18a37071eb1b3102",
+  "run_listing.py": "a3aa8296c8844e52fd970a566037f92ad4a6715278140c9d06fcba1c1c60198f",
+  "s3.py": "fb42613bf808e86dfae2125b8426b1e48d9c8bde190e63bfbe988ede96c040e1",
+  "scheduling.py": "3c340c9b03d5b0009e5f94d9d9bc63a628a535591459d3cd44db158a7939dad3",
+  "storage.py": "0fbf64af66b93590579e7dc3f87d8537966da302fab391894aa3e3abeaa07fe5",
+  "webhooks.py": "de509ace329823351a6162e69d3abb0e33a954cfc7652dac63f477b024aa44c9",
+  "workspace.py": "1cdf605b1d664404c28316e777c242f5c8410ef82d3e953e5297a45ebcfd529a"
+}

trampoline_delta-0.1.5/delta_cli/_embedded_contracts/__init__.py

@@ -0,0 +1,228 @@
+"""Client-safe Delta wire contracts assembled from the canonical API-spec source."""
+
+# ruff: noqa: F401
+
+from .environment import (
+    DEPLOYMENT_ENVIRONMENT_RESERVED_NAMES,
+    DEPLOYMENT_ENVIRONMENT_RESERVED_PREFIXES,
+    is_reserved_deployment_environment_name,
+)
+from .ids import IdPrefix, artifact_upload_id, assert_typed_id, flow_id, run_id
+from .invocation import assert_safe_system_context_aliases, validate_artifact_binding_name
+from .manifests import (
+    AVALANCHE_WORKSPACE_MANIFEST_CONTENT_TYPE,
+    AVALANCHE_WORKSPACE_MANIFEST_MAX_BYTES,
+    AwsKmsDeploymentEnvironmentRecipient,
+    DEPLOYMENT_ENVIRONMENT_PLAINTEXT_MAX_BYTES,
+    BuildBundleManifest,
+    CreateRunRequestV2,
+    DeploymentEnvironmentAad,
+    DeploymentEnvironmentEnvelope,
+    DeploymentEnvironmentPin,
+    DeploymentEnvironmentRecipient,
+    DeploymentManifest,
+    DirectClientSourceTransport,
+    DirectObjectStoreClient,
+    DirectStorageOperation,
+    FinalizeDeploymentRequest,
+    FlowManifest,
+    FlowRecord,
+    GcpKmsDeploymentEnvironmentRecipient,
+    PrepareDeploymentRequest,
+    PrepareDeploymentResponse,
+    ProjectSummary,
+    RunEvent,
+    RunEventsPage,
+    RunInputArtifactRef,
+    RunManifest,
+    RunRerunSpecV2,
+    SetLiveDeploymentRequest,
+    SignStorageUploadRequest,
+    SignStorageUploadResponse,
+    SignedHttpSourceTransport,
+    SignedStorageOperation,
+    SourceManifest,
+    StorageAccessGrant,
+    StorageSessionCredentials,
+    StorageWriteOperation,
+    canonical_json_bytes,
+    deployment_flow_id,
+    validate_context_json_object,
+    validate_input_json_object,
+)
+from .run_listing import RUN_LIST_DEFAULT_LIMIT, validate_run_list_limit
+from .run_activity import (
+    RUN_ACTIVITY_PAGE_MAX_ITEMS,
+    RunActivity,
+    RunActivityLifecycleFact,
+    RunActivityLifecycleFactV3,
+    RunActivityLogFact,
+    RunActivityPage,
+    RunActivityTerminalSealFact,
+)
+from .scheduling import _validate_cron, _validate_timezone
+from .run_lifecycle import RunLifecyclePhase
+from .s3 import JSON_CONTENT_TYPE, S3Uri
+from .storage import (
+    ObjectUri,
+    bundle_build_log_key,
+    bundle_manifest_key,
+    deployment_environment_key,
+    deployment_flows_key,
+    deployment_source_git_remote_key,
+    object_uri,
+    project_uri,
+    source_manifest_key,
+    wheelhouse_artifact_key,
+)
+from .webhooks import WebhookInfo, WebhookTarget
+from .public_http_v2 import (
+    ArtifactUploadContentResponseV2,
+    ArtifactUploadFileV2,
+    ArtifactUploadOperationV2,
+    AwsKmsDeploymentEnvironmentRecipientV2,
+    BuildBundleManifestV2,
+    CreateWorkflowScheduleRequestV2,
+    DeploymentEnvironmentPinV2,
+    DeploymentEnvironmentRecipientV2,
+    DeploymentListResponseV2,
+    DeploymentResponseV2,
+    DeploymentStorageTransportV2,
+    DeploymentViewV2,
+    DisableWorkflowScheduleRequestV2,
+    DirectClientSourceTransportV2,
+    DirectObjectStoreClientV2,
+    DirectStorageOperationV2,
+    FinalizeArtifactUploadResponseV2,
+    FinalizeDeploymentRequestV2,
+    FlowListResponseV2,
+    FlowManifestV2,
+    FlowRecordV2,
+    FlowResponseV2,
+    GcsScopedSourceGrantCredentialsV2,
+    GcpKmsDeploymentEnvironmentRecipientV2,
+    JsonObjectV2,
+    JsonValue,
+    PrepareArtifactUploadRequestV2,
+    PrepareArtifactUploadResponseV2,
+    PrepareDeploymentRequestV2,
+    PrepareDeploymentResponseV2,
+    PreparedArtifactUploadFileV2,
+    ProjectListResponseV2,
+    ProjectResponseV2,
+    ProjectSummaryV2,
+    RunActivityPageV2,
+    RunActivityResponseV2,
+    RunListResponseV2,
+    RunOutputArtifactBindingV2,
+    RunOutputArtifactDownloadResponseV2,
+    RunOutputArtifactFileV2,
+    RunOutputArtifactListingV2,
+    RunOutputArtifactsResponseV2,
+    RunOutputResponseV2,
+    RunRerunViewV2,
+    RunResponseV2,
+    RunViewV2,
+    ScheduleCreateRequestV2,
+    ScheduleDisableRequestV2,
+    ScheduleUpdateRequestV2,
+    ScopedSourceGrantCredentialsV2,
+    ScopedSourceGrantTransportV2,
+    SetLiveDeploymentRequestV2,
+    S3ScopedSourceGrantCredentialsV2,
+    SignStorageDownloadRequestV2,
+    SignStorageDownloadResponseV2,
+    SignStorageUploadRequestV2,
+    SignStorageUploadResponseV2,
+    SignedHttpSourceTransportV2,
+    SignedStorageOperationV2,
+    SourceManifestV2,
+    StorageAccessGrantV2,
+    StorageWriteOperationV2,
+    UpdateWorkflowScheduleRequestV2,
+    WebhookInfoV2,
+    WebhookListResponseV2,
+    WebhookPayloadV2,
+    WebhookResponseV2,
+    WebhookRunAcceptedV2,
+    WebhookTargetV2,
+    WEBHOOK_PAYLOAD_MAX_BYTES,
+    WorkflowScheduleListResponseV2,
+    WorkflowScheduleResponseAliasV2,
+    WorkflowScheduleResponseV2,
+    WorkflowScheduleV2,
+    WorkspaceBlobRefV2,
+    WorkspaceSnapshotRefV2,
+    assert_v2_scope,
+    artifact_upload_content_response_v2_from_internal,
+    artifact_upload_content_response_v2_to_internal,
+    deployment_view_v2_from_internal,
+    deployment_view_v2_to_internal,
+    finalize_artifact_upload_response_v2_from_internal,
+    finalize_artifact_upload_response_v2_to_internal,
+    finalize_deployment_request_v2_from_internal,
+    finalize_deployment_request_v2_to_internal,
+    flow_record_v2_from_internal,
+    flow_record_v2_to_internal,
+    prepare_artifact_upload_request_v2_from_internal,
+    prepare_artifact_upload_request_v2_to_internal,
+    prepare_artifact_upload_response_v2_from_internal,
+    prepare_artifact_upload_response_v2_to_internal,
+    prepare_deployment_request_v2_from_internal,
+    prepare_deployment_request_v2_to_internal,
+    prepare_deployment_response_v2_from_internal,
+    prepare_deployment_response_v2_to_internal,
+    project_summary_v2_from_internal,
+    project_summary_v2_to_internal,
+    require_v2_scope,
+    run_activity_page_v2_from_internal,
+    run_activity_page_v2_to_internal,
+    run_list_response_v2_from_internal,
+    run_list_response_v2_to_internal,
+    run_output_artifact_download_response_v2_to_internal,
+    run_output_artifact_download_response_v2_from_internal,
+    run_output_artifacts_response_v2_to_internal,
+    run_output_artifacts_response_v2_from_internal,
+    run_output_response_v2_from_internal,
+    run_response_v2_from_internal,
+    run_response_v2_to_internal,
+    run_view_v2_from_internal,
+    run_view_v2_to_internal,
+    schedule_create_request_v2_to_internal,
+    schedule_disable_request_v2_to_internal,
+    schedule_update_request_v2_to_internal,
+    set_live_deployment_request_v2_from_internal,
+    set_live_deployment_request_v2_to_internal,
+    sign_storage_upload_request_v2_from_internal,
+    sign_storage_upload_request_v2_to_internal,
+    sign_storage_upload_response_v2_from_internal,
+    sign_storage_upload_response_v2_to_internal,
+    sign_storage_download_request_v2_from_internal,
+    sign_storage_download_request_v2_to_internal,
+    sign_storage_download_response_v2_from_internal,
+    sign_storage_download_response_v2_to_internal,
+    storage_write_operation_v2_from_internal,
+    storage_write_operation_v2_to_internal,
+    validate_webhook_payload_v2,
+    webhook_info_v2_from_internal,
+    webhook_info_v2_to_internal,
+    webhook_payload_v2_to_internal,
+    webhook_run_accepted_v2_from_internal,
+    webhook_run_accepted_v2_to_internal,
+    webhook_target_v2_from_internal,
+    webhook_target_v2_to_internal,
+    workflow_schedule_v2_from_internal,
+    workflow_schedule_v2_to_internal,
+)
+from .workspace import (
+    ArtifactUploadContentResponse,
+    ArtifactUploadFile,
+    FinalizeArtifactUploadResponse,
+    PrepareArtifactUploadRequest,
+    PrepareArtifactUploadResponse,
+    PreparedArtifactUploadFile,
+    WorkspaceSnapshotRef,
+    workspace_blob_id,
+)
+
+__all__ = [name for name in globals() if not name.startswith("_")]

trampoline_delta-0.1.5/delta_cli/_embedded_contracts/environment.py

@@ -0,0 +1,54 @@
+from __future__ import annotations
+
+DEPLOYMENT_ENVIRONMENT_RESERVED_PREFIXES = (
+    "AVALANCHE_",
+    "AWS_",
+    "BOTO_",
+    "CLOUDSDK_",
+    "DELTA_",
+    "DYLD_",
+    "GCP_",
+    "GCLOUD_",
+    "GCS_",
+    "GOOGLE_",
+    "GRPC_",
+    "KMS_",
+    "KUBERNETES_",
+    "KUBERAY_",
+    "MESA_",
+    "RAY_",
+    "S3_",
+)
+
+DEPLOYMENT_ENVIRONMENT_RESERVED_NAMES = frozenset(
+    {
+        "ALL_PROXY",
+        "BASH_ENV",
+        "CURL_CA_BUNDLE",
+        "ENV",
+        "FTP_PROXY",
+        "HTTP_PROXY",
+        "HTTPS_PROXY",
+        "LD_LIBRARY_PATH",
+        "LD_PRELOAD",
+        "NO_PROXY",
+        "PATH",
+        "PS4",
+        "PYTHONHOME",
+        "PYTHONINSPECT",
+        "PYTHONPATH",
+        "PYTHONSTARTUP",
+        "REQUESTS_CA_BUNDLE",
+        "SHELLOPTS",
+        "SSL_CERT_DIR",
+        "SSL_CERT_FILE",
+        "SSLKEYLOGFILE",
+        "STORAGE_EMULATOR_HOST",
+    }
+)
+
+def is_reserved_deployment_environment_name(name: str) -> bool:
+    normalized = name.upper()
+    return normalized in DEPLOYMENT_ENVIRONMENT_RESERVED_NAMES or normalized.startswith(
+        DEPLOYMENT_ENVIRONMENT_RESERVED_PREFIXES
+    )