import { normalizeOptionalLowercaseString } from "@openclaw/normalization-core/string-coerce";

/** Reason a requested network mode is blocked by sandbox policy. */

export type NetworkModeBlockReason = "host" | "container_namespace_join";

type NetworkModeBlockReason = "host" | "container_namespace_join";

/** Normalizes optional Docker network mode strings for policy checks. */

export function normalizeNetworkMode(network: string | undefined): string | undefined {

/^NODE_ENV$/i,

];

export type EnvVarSanitizationResult = {

type EnvVarSanitizationResult = {

allowed: Record<string, string>;

blocked: string[];

warnings: string[];

}

| undefined;

export type ValidateBindMountsOptions = {

type ValidateBindMountsOptions = {

allowedSourceRoots?: string[];

allowSourcesOutsideAllowedRoots?: boolean;

allowReservedContainerTargets?: boolean;

};

export type ValidateNetworkModeOptions = {

type ValidateNetworkModeOptions = {

allowContainerNamespaceJoin?: boolean;

};

export type BlockedBindReason =

type BlockedBindReason =

| { kind: "targets"; blockedPath: string }

| { kind: "covers"; blockedPath: string }

| { kind: "non_absolute"; sourcePath: string }