diff --git a/internal/api/runme/runner/v2alpha1/runner.proto b/internal/api/runme/runner/v2alpha1/runner.proto
index 42f22fe6c..ffa386732 100644
--- a/internal/api/runme/runner/v2alpha1/runner.proto
+++ b/internal/api/runme/runner/v2alpha1/runner.proto
@@ -139,6 +139,63 @@ message ExecuteResponse {
   google.protobuf.UInt32Value pid = 4;
 }
 
+message ResolveEnvRequest {
+  oneof source {
+    // commands are commands to be executed by the program.
+    // The commands are joined and executed as a script.
+    CommandList commands = 1;
+
+    // script is code to be executed by the program.
+    // Individual lines are joined with the new line character.
+    string script = 2;
+  }
+
+  // env is a list of additional environment variables
+  // that will be injected to the executed program.
+  repeated string env = 3;
+
+  // session_strategy is a strategy for selecting the session.
+  SessionStrategy session_strategy = 4;
+
+  // project used to load environment variables from .env files.
+  optional Project project = 5;
+
+  message CommandList {
+    // commands are commands to be executed by the program.
+    // The commands are joined and executed as a script.
+    // For example: ["echo 'Hello, World'", "ls -l /etc"].
+    repeated string items = 1;
+  }
+}
+
+message ResolveEnvResponse {
+  // resolved_env is a list of resolved environment variables.
+  repeated ResolvedEnv resolved_env = 1;
+
+  // unresolved_env is a list of environment variables
+  // that couldn't be resolved.
+  repeated UnresolvedEnv unresolved_env = 2;
+
+  message ResolvedEnv {
+    string key = 1;
+    string original_value = 2;
+    string resolved_value = 3;
+    Source source = 4;
+  }
+
+  message UnresolvedEnv {
+    string key = 1;
+    string original_value = 2;
+  }
+
+  enum Source {
+    SOURCE_UNSPECIFIED = 0;
+    SOURCE_ENV = 1;
+    SOURCE_SESSION = 2;
+    SOURCE_PROJECT = 3;
+  }
+}
+
 service RunnerService {
   rpc CreateSession(CreateSessionRequest) returns (CreateSessionResponse) {}
   rpc GetSession(GetSessionRequest) returns (GetSessionResponse) {}
@@ -153,4 +210,6 @@ service RunnerService {
   // Subsequent "ExecuteRequest" should only contain "input_data" as
   // other fields will be ignored.
   rpc Execute(stream ExecuteRequest) returns (stream ExecuteResponse) {}
+
+  rpc ResolveEnv(ResolveEnvRequest) returns (ResolveEnvResponse) {}
 }
diff --git a/internal/gen/proto/go/runme/runner/v2alpha1/runner.pb.go b/internal/gen/proto/go/runme/runner/v2alpha1/runner.pb.go
index e4b9aea6f..2e83dbdc6 100644
--- a/internal/gen/proto/go/runme/runner/v2alpha1/runner.pb.go
+++ b/internal/gen/proto/go/runme/runner/v2alpha1/runner.pb.go
@@ -122,6 +122,58 @@ func (SessionStrategy) EnumDescriptor() ([]byte, []int) {
 	return file_runme_runner_v2alpha1_runner_proto_rawDescGZIP(), []int{1}
 }
 
+type ResolveEnvResponse_Source int32
+
+const (
+	ResolveEnvResponse_SOURCE_UNSPECIFIED ResolveEnvResponse_Source = 0
+	ResolveEnvResponse_SOURCE_ENV         ResolveEnvResponse_Source = 1
+	ResolveEnvResponse_SOURCE_SESSION     ResolveEnvResponse_Source = 2
+	ResolveEnvResponse_SOURCE_PROJECT     ResolveEnvResponse_Source = 3
+)
+
+// Enum value maps for ResolveEnvResponse_Source.
+var (
+	ResolveEnvResponse_Source_name = map[int32]string{
+		0: "SOURCE_UNSPECIFIED",
+		1: "SOURCE_ENV",
+		2: "SOURCE_SESSION",
+		3: "SOURCE_PROJECT",
+	}
+	ResolveEnvResponse_Source_value = map[string]int32{
+		"SOURCE_UNSPECIFIED": 0,
+		"SOURCE_ENV":         1,
+		"SOURCE_SESSION":     2,
+		"SOURCE_PROJECT":     3,
+	}
+)
+
+func (x ResolveEnvResponse_Source) Enum() *ResolveEnvResponse_Source {
+	p := new(ResolveEnvResponse_Source)
+	*p = x
+	return p
+}
+
+func (x ResolveEnvResponse_Source) String() string {
+	return protoimpl.X.EnumStringOf(x.Descriptor(), protoreflect.EnumNumber(x))
+}
+
+func (ResolveEnvResponse_Source) Descriptor() protoreflect.EnumDescriptor {
+	return file_runme_runner_v2alpha1_runner_proto_enumTypes[2].Descriptor()
+}
+
+func (ResolveEnvResponse_Source) Type() protoreflect.EnumType {
+	return &file_runme_runner_v2alpha1_runner_proto_enumTypes[2]
+}
+
+func (x ResolveEnvResponse_Source) Number() protoreflect.EnumNumber {
+	return protoreflect.EnumNumber(x)
+}
+
+// Deprecated: Use ResolveEnvResponse_Source.Descriptor instead.
+func (ResolveEnvResponse_Source) EnumDescriptor() ([]byte, []int) {
+	return file_runme_runner_v2alpha1_runner_proto_rawDescGZIP(), []int{14, 0}
+}
+
 type Project struct {
 	state         protoimpl.MessageState
 	sizeCache     protoimpl.SizeCache
@@ -893,6 +945,353 @@ func (x *ExecuteResponse) GetPid() *wrapperspb.UInt32Value {
 	return nil
 }
 
+type ResolveEnvRequest struct {
+	state         protoimpl.MessageState
+	sizeCache     protoimpl.SizeCache
+	unknownFields protoimpl.UnknownFields
+
+	// Types that are assignable to Source:
+	//
+	//	*ResolveEnvRequest_Commands
+	//	*ResolveEnvRequest_Script
+	Source isResolveEnvRequest_Source `protobuf_oneof:"source"`
+	// env is a list of additional environment variables
+	// that will be injected to the executed program.
+	Env []string `protobuf:"bytes,3,rep,name=env,proto3" json:"env,omitempty"`
+	// session_strategy is a strategy for selecting the session.
+	SessionStrategy SessionStrategy `protobuf:"varint,4,opt,name=session_strategy,json=sessionStrategy,proto3,enum=runme.runner.v2alpha1.SessionStrategy" json:"session_strategy,omitempty"`
+	// project used to load environment variables from .env files.
+	Project *Project `protobuf:"bytes,5,opt,name=project,proto3,oneof" json:"project,omitempty"`
+}
+
+func (x *ResolveEnvRequest) Reset() {
+	*x = ResolveEnvRequest{}
+	if protoimpl.UnsafeEnabled {
+		mi := &file_runme_runner_v2alpha1_runner_proto_msgTypes[13]
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		ms.StoreMessageInfo(mi)
+	}
+}
+
+func (x *ResolveEnvRequest) String() string {
+	return protoimpl.X.MessageStringOf(x)
+}
+
+func (*ResolveEnvRequest) ProtoMessage() {}
+
+func (x *ResolveEnvRequest) ProtoReflect() protoreflect.Message {
+	mi := &file_runme_runner_v2alpha1_runner_proto_msgTypes[13]
+	if protoimpl.UnsafeEnabled && x != nil {
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		if ms.LoadMessageInfo() == nil {
+			ms.StoreMessageInfo(mi)
+		}
+		return ms
+	}
+	return mi.MessageOf(x)
+}
+
+// Deprecated: Use ResolveEnvRequest.ProtoReflect.Descriptor instead.
+func (*ResolveEnvRequest) Descriptor() ([]byte, []int) {
+	return file_runme_runner_v2alpha1_runner_proto_rawDescGZIP(), []int{13}
+}
+
+func (m *ResolveEnvRequest) GetSource() isResolveEnvRequest_Source {
+	if m != nil {
+		return m.Source
+	}
+	return nil
+}
+
+func (x *ResolveEnvRequest) GetCommands() *ResolveEnvRequest_CommandList {
+	if x, ok := x.GetSource().(*ResolveEnvRequest_Commands); ok {
+		return x.Commands
+	}
+	return nil
+}
+
+func (x *ResolveEnvRequest) GetScript() string {
+	if x, ok := x.GetSource().(*ResolveEnvRequest_Script); ok {
+		return x.Script
+	}
+	return ""
+}
+
+func (x *ResolveEnvRequest) GetEnv() []string {
+	if x != nil {
+		return x.Env
+	}
+	return nil
+}
+
+func (x *ResolveEnvRequest) GetSessionStrategy() SessionStrategy {
+	if x != nil {
+		return x.SessionStrategy
+	}
+	return SessionStrategy_SESSION_STRATEGY_UNSPECIFIED
+}
+
+func (x *ResolveEnvRequest) GetProject() *Project {
+	if x != nil {
+		return x.Project
+	}
+	return nil
+}
+
+type isResolveEnvRequest_Source interface {
+	isResolveEnvRequest_Source()
+}
+
+type ResolveEnvRequest_Commands struct {
+	// commands are commands to be executed by the program.
+	// The commands are joined and executed as a script.
+	Commands *ResolveEnvRequest_CommandList `protobuf:"bytes,1,opt,name=commands,proto3,oneof"`
+}
+
+type ResolveEnvRequest_Script struct {
+	// script is code to be executed by the program.
+	// Individual lines are joined with the new line character.
+	Script string `protobuf:"bytes,2,opt,name=script,proto3,oneof"`
+}
+
+func (*ResolveEnvRequest_Commands) isResolveEnvRequest_Source() {}
+
+func (*ResolveEnvRequest_Script) isResolveEnvRequest_Source() {}
+
+type ResolveEnvResponse struct {
+	state         protoimpl.MessageState
+	sizeCache     protoimpl.SizeCache
+	unknownFields protoimpl.UnknownFields
+
+	// resolved_env is a list of resolved environment variables.
+	ResolvedEnv []*ResolveEnvResponse_ResolvedEnv `protobuf:"bytes,1,rep,name=resolved_env,json=resolvedEnv,proto3" json:"resolved_env,omitempty"`
+	// unresolved_env is a list of environment variables
+	// that couldn't be resolved.
+	UnresolvedEnv []*ResolveEnvResponse_UnresolvedEnv `protobuf:"bytes,2,rep,name=unresolved_env,json=unresolvedEnv,proto3" json:"unresolved_env,omitempty"`
+}
+
+func (x *ResolveEnvResponse) Reset() {
+	*x = ResolveEnvResponse{}
+	if protoimpl.UnsafeEnabled {
+		mi := &file_runme_runner_v2alpha1_runner_proto_msgTypes[14]
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		ms.StoreMessageInfo(mi)
+	}
+}
+
+func (x *ResolveEnvResponse) String() string {
+	return protoimpl.X.MessageStringOf(x)
+}
+
+func (*ResolveEnvResponse) ProtoMessage() {}
+
+func (x *ResolveEnvResponse) ProtoReflect() protoreflect.Message {
+	mi := &file_runme_runner_v2alpha1_runner_proto_msgTypes[14]
+	if protoimpl.UnsafeEnabled && x != nil {
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		if ms.LoadMessageInfo() == nil {
+			ms.StoreMessageInfo(mi)
+		}
+		return ms
+	}
+	return mi.MessageOf(x)
+}
+
+// Deprecated: Use ResolveEnvResponse.ProtoReflect.Descriptor instead.
+func (*ResolveEnvResponse) Descriptor() ([]byte, []int) {
+	return file_runme_runner_v2alpha1_runner_proto_rawDescGZIP(), []int{14}
+}
+
+func (x *ResolveEnvResponse) GetResolvedEnv() []*ResolveEnvResponse_ResolvedEnv {
+	if x != nil {
+		return x.ResolvedEnv
+	}
+	return nil
+}
+
+func (x *ResolveEnvResponse) GetUnresolvedEnv() []*ResolveEnvResponse_UnresolvedEnv {
+	if x != nil {
+		return x.UnresolvedEnv
+	}
+	return nil
+}
+
+type ResolveEnvRequest_CommandList struct {
+	state         protoimpl.MessageState
+	sizeCache     protoimpl.SizeCache
+	unknownFields protoimpl.UnknownFields
+
+	// commands are commands to be executed by the program.
+	// The commands are joined and executed as a script.
+	// For example: ["echo 'Hello, World'", "ls -l /etc"].
+	Items []string `protobuf:"bytes,1,rep,name=items,proto3" json:"items,omitempty"`
+}
+
+func (x *ResolveEnvRequest_CommandList) Reset() {
+	*x = ResolveEnvRequest_CommandList{}
+	if protoimpl.UnsafeEnabled {
+		mi := &file_runme_runner_v2alpha1_runner_proto_msgTypes[17]
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		ms.StoreMessageInfo(mi)
+	}
+}
+
+func (x *ResolveEnvRequest_CommandList) String() string {
+	return protoimpl.X.MessageStringOf(x)
+}
+
+func (*ResolveEnvRequest_CommandList) ProtoMessage() {}
+
+func (x *ResolveEnvRequest_CommandList) ProtoReflect() protoreflect.Message {
+	mi := &file_runme_runner_v2alpha1_runner_proto_msgTypes[17]
+	if protoimpl.UnsafeEnabled && x != nil {
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		if ms.LoadMessageInfo() == nil {
+			ms.StoreMessageInfo(mi)
+		}
+		return ms
+	}
+	return mi.MessageOf(x)
+}
+
+// Deprecated: Use ResolveEnvRequest_CommandList.ProtoReflect.Descriptor instead.
+func (*ResolveEnvRequest_CommandList) Descriptor() ([]byte, []int) {
+	return file_runme_runner_v2alpha1_runner_proto_rawDescGZIP(), []int{13, 0}
+}
+
+func (x *ResolveEnvRequest_CommandList) GetItems() []string {
+	if x != nil {
+		return x.Items
+	}
+	return nil
+}
+
+type ResolveEnvResponse_ResolvedEnv struct {
+	state         protoimpl.MessageState
+	sizeCache     protoimpl.SizeCache
+	unknownFields protoimpl.UnknownFields
+
+	Key           string                    `protobuf:"bytes,1,opt,name=key,proto3" json:"key,omitempty"`
+	OriginalValue string                    `protobuf:"bytes,2,opt,name=original_value,json=originalValue,proto3" json:"original_value,omitempty"`
+	ResolvedValue string                    `protobuf:"bytes,3,opt,name=resolved_value,json=resolvedValue,proto3" json:"resolved_value,omitempty"`
+	Source        ResolveEnvResponse_Source `protobuf:"varint,4,opt,name=source,proto3,enum=runme.runner.v2alpha1.ResolveEnvResponse_Source" json:"source,omitempty"`
+}
+
+func (x *ResolveEnvResponse_ResolvedEnv) Reset() {
+	*x = ResolveEnvResponse_ResolvedEnv{}
+	if protoimpl.UnsafeEnabled {
+		mi := &file_runme_runner_v2alpha1_runner_proto_msgTypes[18]
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		ms.StoreMessageInfo(mi)
+	}
+}
+
+func (x *ResolveEnvResponse_ResolvedEnv) String() string {
+	return protoimpl.X.MessageStringOf(x)
+}
+
+func (*ResolveEnvResponse_ResolvedEnv) ProtoMessage() {}
+
+func (x *ResolveEnvResponse_ResolvedEnv) ProtoReflect() protoreflect.Message {
+	mi := &file_runme_runner_v2alpha1_runner_proto_msgTypes[18]
+	if protoimpl.UnsafeEnabled && x != nil {
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		if ms.LoadMessageInfo() == nil {
+			ms.StoreMessageInfo(mi)
+		}
+		return ms
+	}
+	return mi.MessageOf(x)
+}
+
+// Deprecated: Use ResolveEnvResponse_ResolvedEnv.ProtoReflect.Descriptor instead.
+func (*ResolveEnvResponse_ResolvedEnv) Descriptor() ([]byte, []int) {
+	return file_runme_runner_v2alpha1_runner_proto_rawDescGZIP(), []int{14, 0}
+}
+
+func (x *ResolveEnvResponse_ResolvedEnv) GetKey() string {
+	if x != nil {
+		return x.Key
+	}
+	return ""
+}
+
+func (x *ResolveEnvResponse_ResolvedEnv) GetOriginalValue() string {
+	if x != nil {
+		return x.OriginalValue
+	}
+	return ""
+}
+
+func (x *ResolveEnvResponse_ResolvedEnv) GetResolvedValue() string {
+	if x != nil {
+		return x.ResolvedValue
+	}
+	return ""
+}
+
+func (x *ResolveEnvResponse_ResolvedEnv) GetSource() ResolveEnvResponse_Source {
+	if x != nil {
+		return x.Source
+	}
+	return ResolveEnvResponse_SOURCE_UNSPECIFIED
+}
+
+type ResolveEnvResponse_UnresolvedEnv struct {
+	state         protoimpl.MessageState
+	sizeCache     protoimpl.SizeCache
+	unknownFields protoimpl.UnknownFields
+
+	Key           string `protobuf:"bytes,1,opt,name=key,proto3" json:"key,omitempty"`
+	OriginalValue string `protobuf:"bytes,2,opt,name=original_value,json=originalValue,proto3" json:"original_value,omitempty"`
+}
+
+func (x *ResolveEnvResponse_UnresolvedEnv) Reset() {
+	*x = ResolveEnvResponse_UnresolvedEnv{}
+	if protoimpl.UnsafeEnabled {
+		mi := &file_runme_runner_v2alpha1_runner_proto_msgTypes[19]
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		ms.StoreMessageInfo(mi)
+	}
+}
+
+func (x *ResolveEnvResponse_UnresolvedEnv) String() string {
+	return protoimpl.X.MessageStringOf(x)
+}
+
+func (*ResolveEnvResponse_UnresolvedEnv) ProtoMessage() {}
+
+func (x *ResolveEnvResponse_UnresolvedEnv) ProtoReflect() protoreflect.Message {
+	mi := &file_runme_runner_v2alpha1_runner_proto_msgTypes[19]
+	if protoimpl.UnsafeEnabled && x != nil {
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		if ms.LoadMessageInfo() == nil {
+			ms.StoreMessageInfo(mi)
+		}
+		return ms
+	}
+	return mi.MessageOf(x)
+}
+
+// Deprecated: Use ResolveEnvResponse_UnresolvedEnv.ProtoReflect.Descriptor instead.
+func (*ResolveEnvResponse_UnresolvedEnv) Descriptor() ([]byte, []int) {
+	return file_runme_runner_v2alpha1_runner_proto_rawDescGZIP(), []int{14, 1}
+}
+
+func (x *ResolveEnvResponse_UnresolvedEnv) GetKey() string {
+	if x != nil {
+		return x.Key
+	}
+	return ""
+}
+
+func (x *ResolveEnvResponse_UnresolvedEnv) GetOriginalValue() string {
+	if x != nil {
+		return x.OriginalValue
+	}
+	return ""
+}
+
 var File_runme_runner_v2alpha1_runner_proto protoreflect.FileDescriptor
 
 var file_runme_runner_v2alpha1_runner_proto_rawDesc = []byte{
@@ -1006,57 +1405,121 @@ var file_runme_runner_v2alpha1_runner_proto_rawDesc = []byte{
 	0x61, 0x74, 0x61, 0x12, 0x2e, 0x0a, 0x03, 0x70, 0x69, 0x64, 0x18, 0x04, 0x20, 0x01, 0x28, 0x0b,
 	0x32, 0x1c, 0x2e, 0x67, 0x6f, 0x6f, 0x67, 0x6c, 0x65, 0x2e, 0x70, 0x72, 0x6f, 0x74, 0x6f, 0x62,
 	0x75, 0x66, 0x2e, 0x55, 0x49, 0x6e, 0x74, 0x33, 0x32, 0x56, 0x61, 0x6c, 0x75, 0x65, 0x52, 0x03,
-	0x70, 0x69, 0x64, 0x2a, 0x5e, 0x0a, 0x0b, 0x45, 0x78, 0x65, 0x63, 0x75, 0x74, 0x65, 0x53, 0x74,
-	0x6f, 0x70, 0x12, 0x1c, 0x0a, 0x18, 0x45, 0x58, 0x45, 0x43, 0x55, 0x54, 0x45, 0x5f, 0x53, 0x54,
-	0x4f, 0x50, 0x5f, 0x55, 0x4e, 0x53, 0x50, 0x45, 0x43, 0x49, 0x46, 0x49, 0x45, 0x44, 0x10, 0x00,
-	0x12, 0x1a, 0x0a, 0x16, 0x45, 0x58, 0x45, 0x43, 0x55, 0x54, 0x45, 0x5f, 0x53, 0x54, 0x4f, 0x50,
-	0x5f, 0x49, 0x4e, 0x54, 0x45, 0x52, 0x52, 0x55, 0x50, 0x54, 0x10, 0x01, 0x12, 0x15, 0x0a, 0x11,
-	0x45, 0x58, 0x45, 0x43, 0x55, 0x54, 0x45, 0x5f, 0x53, 0x54, 0x4f, 0x50, 0x5f, 0x4b, 0x49, 0x4c,
-	0x4c, 0x10, 0x02, 0x2a, 0x55, 0x0a, 0x0f, 0x53, 0x65, 0x73, 0x73, 0x69, 0x6f, 0x6e, 0x53, 0x74,
-	0x72, 0x61, 0x74, 0x65, 0x67, 0x79, 0x12, 0x20, 0x0a, 0x1c, 0x53, 0x45, 0x53, 0x53, 0x49, 0x4f,
-	0x4e, 0x5f, 0x53, 0x54, 0x52, 0x41, 0x54, 0x45, 0x47, 0x59, 0x5f, 0x55, 0x4e, 0x53, 0x50, 0x45,
-	0x43, 0x49, 0x46, 0x49, 0x45, 0x44, 0x10, 0x00, 0x12, 0x20, 0x0a, 0x1c, 0x53, 0x45, 0x53, 0x53,
-	0x49, 0x4f, 0x4e, 0x5f, 0x53, 0x54, 0x52, 0x41, 0x54, 0x45, 0x47, 0x59, 0x5f, 0x4d, 0x4f, 0x53,
-	0x54, 0x5f, 0x52, 0x45, 0x43, 0x45, 0x4e, 0x54, 0x10, 0x01, 0x32, 0x9b, 0x04, 0x0a, 0x0d, 0x52,
-	0x75, 0x6e, 0x6e, 0x65, 0x72, 0x53, 0x65, 0x72, 0x76, 0x69, 0x63, 0x65, 0x12, 0x6c, 0x0a, 0x0d,
-	0x43, 0x72, 0x65, 0x61, 0x74, 0x65, 0x53, 0x65, 0x73, 0x73, 0x69, 0x6f, 0x6e, 0x12, 0x2b, 0x2e,
+	0x70, 0x69, 0x64, 0x22, 0xe0, 0x02, 0x0a, 0x11, 0x52, 0x65, 0x73, 0x6f, 0x6c, 0x76, 0x65, 0x45,
+	0x6e, 0x76, 0x52, 0x65, 0x71, 0x75, 0x65, 0x73, 0x74, 0x12, 0x52, 0x0a, 0x08, 0x63, 0x6f, 0x6d,
+	0x6d, 0x61, 0x6e, 0x64, 0x73, 0x18, 0x01, 0x20, 0x01, 0x28, 0x0b, 0x32, 0x34, 0x2e, 0x72, 0x75,
+	0x6e, 0x6d, 0x65, 0x2e, 0x72, 0x75, 0x6e, 0x6e, 0x65, 0x72, 0x2e, 0x76, 0x32, 0x61, 0x6c, 0x70,
+	0x68, 0x61, 0x31, 0x2e, 0x52, 0x65, 0x73, 0x6f, 0x6c, 0x76, 0x65, 0x45, 0x6e, 0x76, 0x52, 0x65,
+	0x71, 0x75, 0x65, 0x73, 0x74, 0x2e, 0x43, 0x6f, 0x6d, 0x6d, 0x61, 0x6e, 0x64, 0x4c, 0x69, 0x73,
+	0x74, 0x48, 0x00, 0x52, 0x08, 0x63, 0x6f, 0x6d, 0x6d, 0x61, 0x6e, 0x64, 0x73, 0x12, 0x18, 0x0a,
+	0x06, 0x73, 0x63, 0x72, 0x69, 0x70, 0x74, 0x18, 0x02, 0x20, 0x01, 0x28, 0x09, 0x48, 0x00, 0x52,
+	0x06, 0x73, 0x63, 0x72, 0x69, 0x70, 0x74, 0x12, 0x10, 0x0a, 0x03, 0x65, 0x6e, 0x76, 0x18, 0x03,
+	0x20, 0x03, 0x28, 0x09, 0x52, 0x03, 0x65, 0x6e, 0x76, 0x12, 0x51, 0x0a, 0x10, 0x73, 0x65, 0x73,
+	0x73, 0x69, 0x6f, 0x6e, 0x5f, 0x73, 0x74, 0x72, 0x61, 0x74, 0x65, 0x67, 0x79, 0x18, 0x04, 0x20,
+	0x01, 0x28, 0x0e, 0x32, 0x26, 0x2e, 0x72, 0x75, 0x6e, 0x6d, 0x65, 0x2e, 0x72, 0x75, 0x6e, 0x6e,
+	0x65, 0x72, 0x2e, 0x76, 0x32, 0x61, 0x6c, 0x70, 0x68, 0x61, 0x31, 0x2e, 0x53, 0x65, 0x73, 0x73,
+	0x69, 0x6f, 0x6e, 0x53, 0x74, 0x72, 0x61, 0x74, 0x65, 0x67, 0x79, 0x52, 0x0f, 0x73, 0x65, 0x73,
+	0x73, 0x69, 0x6f, 0x6e, 0x53, 0x74, 0x72, 0x61, 0x74, 0x65, 0x67, 0x79, 0x12, 0x3d, 0x0a, 0x07,
+	0x70, 0x72, 0x6f, 0x6a, 0x65, 0x63, 0x74, 0x18, 0x05, 0x20, 0x01, 0x28, 0x0b, 0x32, 0x1e, 0x2e,
+	0x72, 0x75, 0x6e, 0x6d, 0x65, 0x2e, 0x72, 0x75, 0x6e, 0x6e, 0x65, 0x72, 0x2e, 0x76, 0x32, 0x61,
+	0x6c, 0x70, 0x68, 0x61, 0x31, 0x2e, 0x50, 0x72, 0x6f, 0x6a, 0x65, 0x63, 0x74, 0x48, 0x01, 0x52,
+	0x07, 0x70, 0x72, 0x6f, 0x6a, 0x65, 0x63, 0x74, 0x88, 0x01, 0x01, 0x1a, 0x23, 0x0a, 0x0b, 0x43,
+	0x6f, 0x6d, 0x6d, 0x61, 0x6e, 0x64, 0x4c, 0x69, 0x73, 0x74, 0x12, 0x14, 0x0a, 0x05, 0x69, 0x74,
+	0x65, 0x6d, 0x73, 0x18, 0x01, 0x20, 0x03, 0x28, 0x09, 0x52, 0x05, 0x69, 0x74, 0x65, 0x6d, 0x73,
+	0x42, 0x08, 0x0a, 0x06, 0x73, 0x6f, 0x75, 0x72, 0x63, 0x65, 0x42, 0x0a, 0x0a, 0x08, 0x5f, 0x70,
+	0x72, 0x6f, 0x6a, 0x65, 0x63, 0x74, 0x22, 0xac, 0x04, 0x0a, 0x12, 0x52, 0x65, 0x73, 0x6f, 0x6c,
+	0x76, 0x65, 0x45, 0x6e, 0x76, 0x52, 0x65, 0x73, 0x70, 0x6f, 0x6e, 0x73, 0x65, 0x12, 0x58, 0x0a,
+	0x0c, 0x72, 0x65, 0x73, 0x6f, 0x6c, 0x76, 0x65, 0x64, 0x5f, 0x65, 0x6e, 0x76, 0x18, 0x01, 0x20,
+	0x03, 0x28, 0x0b, 0x32, 0x35, 0x2e, 0x72, 0x75, 0x6e, 0x6d, 0x65, 0x2e, 0x72, 0x75, 0x6e, 0x6e,
+	0x65, 0x72, 0x2e, 0x76, 0x32, 0x61, 0x6c, 0x70, 0x68, 0x61, 0x31, 0x2e, 0x52, 0x65, 0x73, 0x6f,
+	0x6c, 0x76, 0x65, 0x45, 0x6e, 0x76, 0x52, 0x65, 0x73, 0x70, 0x6f, 0x6e, 0x73, 0x65, 0x2e, 0x52,
+	0x65, 0x73, 0x6f, 0x6c, 0x76, 0x65, 0x64, 0x45, 0x6e, 0x76, 0x52, 0x0b, 0x72, 0x65, 0x73, 0x6f,
+	0x6c, 0x76, 0x65, 0x64, 0x45, 0x6e, 0x76, 0x12, 0x5e, 0x0a, 0x0e, 0x75, 0x6e, 0x72, 0x65, 0x73,
+	0x6f, 0x6c, 0x76, 0x65, 0x64, 0x5f, 0x65, 0x6e, 0x76, 0x18, 0x02, 0x20, 0x03, 0x28, 0x0b, 0x32,
+	0x37, 0x2e, 0x72, 0x75, 0x6e, 0x6d, 0x65, 0x2e, 0x72, 0x75, 0x6e, 0x6e, 0x65, 0x72, 0x2e, 0x76,
+	0x32, 0x61, 0x6c, 0x70, 0x68, 0x61, 0x31, 0x2e, 0x52, 0x65, 0x73, 0x6f, 0x6c, 0x76, 0x65, 0x45,
+	0x6e, 0x76, 0x52, 0x65, 0x73, 0x70, 0x6f, 0x6e, 0x73, 0x65, 0x2e, 0x55, 0x6e, 0x72, 0x65, 0x73,
+	0x6f, 0x6c, 0x76, 0x65, 0x64, 0x45, 0x6e, 0x76, 0x52, 0x0d, 0x75, 0x6e, 0x72, 0x65, 0x73, 0x6f,
+	0x6c, 0x76, 0x65, 0x64, 0x45, 0x6e, 0x76, 0x1a, 0xb7, 0x01, 0x0a, 0x0b, 0x52, 0x65, 0x73, 0x6f,
+	0x6c, 0x76, 0x65, 0x64, 0x45, 0x6e, 0x76, 0x12, 0x10, 0x0a, 0x03, 0x6b, 0x65, 0x79, 0x18, 0x01,
+	0x20, 0x01, 0x28, 0x09, 0x52, 0x03, 0x6b, 0x65, 0x79, 0x12, 0x25, 0x0a, 0x0e, 0x6f, 0x72, 0x69,
+	0x67, 0x69, 0x6e, 0x61, 0x6c, 0x5f, 0x76, 0x61, 0x6c, 0x75, 0x65, 0x18, 0x02, 0x20, 0x01, 0x28,
+	0x09, 0x52, 0x0d, 0x6f, 0x72, 0x69, 0x67, 0x69, 0x6e, 0x61, 0x6c, 0x56, 0x61, 0x6c, 0x75, 0x65,
+	0x12, 0x25, 0x0a, 0x0e, 0x72, 0x65, 0x73, 0x6f, 0x6c, 0x76, 0x65, 0x64, 0x5f, 0x76, 0x61, 0x6c,
+	0x75, 0x65, 0x18, 0x03, 0x20, 0x01, 0x28, 0x09, 0x52, 0x0d, 0x72, 0x65, 0x73, 0x6f, 0x6c, 0x76,
+	0x65, 0x64, 0x56, 0x61, 0x6c, 0x75, 0x65, 0x12, 0x48, 0x0a, 0x06, 0x73, 0x6f, 0x75, 0x72, 0x63,
+	0x65, 0x18, 0x04, 0x20, 0x01, 0x28, 0x0e, 0x32, 0x30, 0x2e, 0x72, 0x75, 0x6e, 0x6d, 0x65, 0x2e,
+	0x72, 0x75, 0x6e, 0x6e, 0x65, 0x72, 0x2e, 0x76, 0x32, 0x61, 0x6c, 0x70, 0x68, 0x61, 0x31, 0x2e,
+	0x52, 0x65, 0x73, 0x6f, 0x6c, 0x76, 0x65, 0x45, 0x6e, 0x76, 0x52, 0x65, 0x73, 0x70, 0x6f, 0x6e,
+	0x73, 0x65, 0x2e, 0x53, 0x6f, 0x75, 0x72, 0x63, 0x65, 0x52, 0x06, 0x73, 0x6f, 0x75, 0x72, 0x63,
+	0x65, 0x1a, 0x48, 0x0a, 0x0d, 0x55, 0x6e, 0x72, 0x65, 0x73, 0x6f, 0x6c, 0x76, 0x65, 0x64, 0x45,
+	0x6e, 0x76, 0x12, 0x10, 0x0a, 0x03, 0x6b, 0x65, 0x79, 0x18, 0x01, 0x20, 0x01, 0x28, 0x09, 0x52,
+	0x03, 0x6b, 0x65, 0x79, 0x12, 0x25, 0x0a, 0x0e, 0x6f, 0x72, 0x69, 0x67, 0x69, 0x6e, 0x61, 0x6c,
+	0x5f, 0x76, 0x61, 0x6c, 0x75, 0x65, 0x18, 0x02, 0x20, 0x01, 0x28, 0x09, 0x52, 0x0d, 0x6f, 0x72,
+	0x69, 0x67, 0x69, 0x6e, 0x61, 0x6c, 0x56, 0x61, 0x6c, 0x75, 0x65, 0x22, 0x58, 0x0a, 0x06, 0x53,
+	0x6f, 0x75, 0x72, 0x63, 0x65, 0x12, 0x16, 0x0a, 0x12, 0x53, 0x4f, 0x55, 0x52, 0x43, 0x45, 0x5f,
+	0x55, 0x4e, 0x53, 0x50, 0x45, 0x43, 0x49, 0x46, 0x49, 0x45, 0x44, 0x10, 0x00, 0x12, 0x0e, 0x0a,
+	0x0a, 0x53, 0x4f, 0x55, 0x52, 0x43, 0x45, 0x5f, 0x45, 0x4e, 0x56, 0x10, 0x01, 0x12, 0x12, 0x0a,
+	0x0e, 0x53, 0x4f, 0x55, 0x52, 0x43, 0x45, 0x5f, 0x53, 0x45, 0x53, 0x53, 0x49, 0x4f, 0x4e, 0x10,
+	0x02, 0x12, 0x12, 0x0a, 0x0e, 0x53, 0x4f, 0x55, 0x52, 0x43, 0x45, 0x5f, 0x50, 0x52, 0x4f, 0x4a,
+	0x45, 0x43, 0x54, 0x10, 0x03, 0x2a, 0x5e, 0x0a, 0x0b, 0x45, 0x78, 0x65, 0x63, 0x75, 0x74, 0x65,
+	0x53, 0x74, 0x6f, 0x70, 0x12, 0x1c, 0x0a, 0x18, 0x45, 0x58, 0x45, 0x43, 0x55, 0x54, 0x45, 0x5f,
+	0x53, 0x54, 0x4f, 0x50, 0x5f, 0x55, 0x4e, 0x53, 0x50, 0x45, 0x43, 0x49, 0x46, 0x49, 0x45, 0x44,
+	0x10, 0x00, 0x12, 0x1a, 0x0a, 0x16, 0x45, 0x58, 0x45, 0x43, 0x55, 0x54, 0x45, 0x5f, 0x53, 0x54,
+	0x4f, 0x50, 0x5f, 0x49, 0x4e, 0x54, 0x45, 0x52, 0x52, 0x55, 0x50, 0x54, 0x10, 0x01, 0x12, 0x15,
+	0x0a, 0x11, 0x45, 0x58, 0x45, 0x43, 0x55, 0x54, 0x45, 0x5f, 0x53, 0x54, 0x4f, 0x50, 0x5f, 0x4b,
+	0x49, 0x4c, 0x4c, 0x10, 0x02, 0x2a, 0x55, 0x0a, 0x0f, 0x53, 0x65, 0x73, 0x73, 0x69, 0x6f, 0x6e,
+	0x53, 0x74, 0x72, 0x61, 0x74, 0x65, 0x67, 0x79, 0x12, 0x20, 0x0a, 0x1c, 0x53, 0x45, 0x53, 0x53,
+	0x49, 0x4f, 0x4e, 0x5f, 0x53, 0x54, 0x52, 0x41, 0x54, 0x45, 0x47, 0x59, 0x5f, 0x55, 0x4e, 0x53,
+	0x50, 0x45, 0x43, 0x49, 0x46, 0x49, 0x45, 0x44, 0x10, 0x00, 0x12, 0x20, 0x0a, 0x1c, 0x53, 0x45,
+	0x53, 0x53, 0x49, 0x4f, 0x4e, 0x5f, 0x53, 0x54, 0x52, 0x41, 0x54, 0x45, 0x47, 0x59, 0x5f, 0x4d,
+	0x4f, 0x53, 0x54, 0x5f, 0x52, 0x45, 0x43, 0x45, 0x4e, 0x54, 0x10, 0x01, 0x32, 0x80, 0x05, 0x0a,
+	0x0d, 0x52, 0x75, 0x6e, 0x6e, 0x65, 0x72, 0x53, 0x65, 0x72, 0x76, 0x69, 0x63, 0x65, 0x12, 0x6c,
+	0x0a, 0x0d, 0x43, 0x72, 0x65, 0x61, 0x74, 0x65, 0x53, 0x65, 0x73, 0x73, 0x69, 0x6f, 0x6e, 0x12,
+	0x2b, 0x2e, 0x72, 0x75, 0x6e, 0x6d, 0x65, 0x2e, 0x72, 0x75, 0x6e, 0x6e, 0x65, 0x72, 0x2e, 0x76,
+	0x32, 0x61, 0x6c, 0x70, 0x68, 0x61, 0x31, 0x2e, 0x43, 0x72, 0x65, 0x61, 0x74, 0x65, 0x53, 0x65,
+	0x73, 0x73, 0x69, 0x6f, 0x6e, 0x52, 0x65, 0x71, 0x75, 0x65, 0x73, 0x74, 0x1a, 0x2c, 0x2e, 0x72,
+	0x75, 0x6e, 0x6d, 0x65, 0x2e, 0x72, 0x75, 0x6e, 0x6e, 0x65, 0x72, 0x2e, 0x76, 0x32, 0x61, 0x6c,
+	0x70, 0x68, 0x61, 0x31, 0x2e, 0x43, 0x72, 0x65, 0x61, 0x74, 0x65, 0x53, 0x65, 0x73, 0x73, 0x69,
+	0x6f, 0x6e, 0x52, 0x65, 0x73, 0x70, 0x6f, 0x6e, 0x73, 0x65, 0x22, 0x00, 0x12, 0x63, 0x0a, 0x0a,
+	0x47, 0x65, 0x74, 0x53, 0x65, 0x73, 0x73, 0x69, 0x6f, 0x6e, 0x12, 0x28, 0x2e, 0x72, 0x75, 0x6e,
+	0x6d, 0x65, 0x2e, 0x72, 0x75, 0x6e, 0x6e, 0x65, 0x72, 0x2e, 0x76, 0x32, 0x61, 0x6c, 0x70, 0x68,
+	0x61, 0x31, 0x2e, 0x47, 0x65, 0x74, 0x53, 0x65, 0x73, 0x73, 0x69, 0x6f, 0x6e, 0x52, 0x65, 0x71,
+	0x75, 0x65, 0x73, 0x74, 0x1a, 0x29, 0x2e, 0x72, 0x75, 0x6e, 0x6d, 0x65, 0x2e, 0x72, 0x75, 0x6e,
+	0x6e, 0x65, 0x72, 0x2e, 0x76, 0x32, 0x61, 0x6c, 0x70, 0x68, 0x61, 0x31, 0x2e, 0x47, 0x65, 0x74,
+	0x53, 0x65, 0x73, 0x73, 0x69, 0x6f, 0x6e, 0x52, 0x65, 0x73, 0x70, 0x6f, 0x6e, 0x73, 0x65, 0x22,
+	0x00, 0x12, 0x69, 0x0a, 0x0c, 0x4c, 0x69, 0x73, 0x74, 0x53, 0x65, 0x73, 0x73, 0x69, 0x6f, 0x6e,
+	0x73, 0x12, 0x2a, 0x2e, 0x72, 0x75, 0x6e, 0x6d, 0x65, 0x2e, 0x72, 0x75, 0x6e, 0x6e, 0x65, 0x72,
+	0x2e, 0x76, 0x32, 0x61, 0x6c, 0x70, 0x68, 0x61, 0x31, 0x2e, 0x4c, 0x69, 0x73, 0x74, 0x53, 0x65,
+	0x73, 0x73, 0x69, 0x6f, 0x6e, 0x73, 0x52, 0x65, 0x71, 0x75, 0x65, 0x73, 0x74, 0x1a, 0x2b, 0x2e,
 	0x72, 0x75, 0x6e, 0x6d, 0x65, 0x2e, 0x72, 0x75, 0x6e, 0x6e, 0x65, 0x72, 0x2e, 0x76, 0x32, 0x61,
-	0x6c, 0x70, 0x68, 0x61, 0x31, 0x2e, 0x43, 0x72, 0x65, 0x61, 0x74, 0x65, 0x53, 0x65, 0x73, 0x73,
+	0x6c, 0x70, 0x68, 0x61, 0x31, 0x2e, 0x4c, 0x69, 0x73, 0x74, 0x53, 0x65, 0x73, 0x73, 0x69, 0x6f,
+	0x6e, 0x73, 0x52, 0x65, 0x73, 0x70, 0x6f, 0x6e, 0x73, 0x65, 0x22, 0x00, 0x12, 0x6c, 0x0a, 0x0d,
+	0x44, 0x65, 0x6c, 0x65, 0x74, 0x65, 0x53, 0x65, 0x73, 0x73, 0x69, 0x6f, 0x6e, 0x12, 0x2b, 0x2e,
+	0x72, 0x75, 0x6e, 0x6d, 0x65, 0x2e, 0x72, 0x75, 0x6e, 0x6e, 0x65, 0x72, 0x2e, 0x76, 0x32, 0x61,
+	0x6c, 0x70, 0x68, 0x61, 0x31, 0x2e, 0x44, 0x65, 0x6c, 0x65, 0x74, 0x65, 0x53, 0x65, 0x73, 0x73,
 	0x69, 0x6f, 0x6e, 0x52, 0x65, 0x71, 0x75, 0x65, 0x73, 0x74, 0x1a, 0x2c, 0x2e, 0x72, 0x75, 0x6e,
 	0x6d, 0x65, 0x2e, 0x72, 0x75, 0x6e, 0x6e, 0x65, 0x72, 0x2e, 0x76, 0x32, 0x61, 0x6c, 0x70, 0x68,
-	0x61, 0x31, 0x2e, 0x43, 0x72, 0x65, 0x61, 0x74, 0x65, 0x53, 0x65, 0x73, 0x73, 0x69, 0x6f, 0x6e,
-	0x52, 0x65, 0x73, 0x70, 0x6f, 0x6e, 0x73, 0x65, 0x22, 0x00, 0x12, 0x63, 0x0a, 0x0a, 0x47, 0x65,
-	0x74, 0x53, 0x65, 0x73, 0x73, 0x69, 0x6f, 0x6e, 0x12, 0x28, 0x2e, 0x72, 0x75, 0x6e, 0x6d, 0x65,
+	0x61, 0x31, 0x2e, 0x44, 0x65, 0x6c, 0x65, 0x74, 0x65, 0x53, 0x65, 0x73, 0x73, 0x69, 0x6f, 0x6e,
+	0x52, 0x65, 0x73, 0x70, 0x6f, 0x6e, 0x73, 0x65, 0x22, 0x00, 0x12, 0x5e, 0x0a, 0x07, 0x45, 0x78,
+	0x65, 0x63, 0x75, 0x74, 0x65, 0x12, 0x25, 0x2e, 0x72, 0x75, 0x6e, 0x6d, 0x65, 0x2e, 0x72, 0x75,
+	0x6e, 0x6e, 0x65, 0x72, 0x2e, 0x76, 0x32, 0x61, 0x6c, 0x70, 0x68, 0x61, 0x31, 0x2e, 0x45, 0x78,
+	0x65, 0x63, 0x75, 0x74, 0x65, 0x52, 0x65, 0x71, 0x75, 0x65, 0x73, 0x74, 0x1a, 0x26, 0x2e, 0x72,
+	0x75, 0x6e, 0x6d, 0x65, 0x2e, 0x72, 0x75, 0x6e, 0x6e, 0x65, 0x72, 0x2e, 0x76, 0x32, 0x61, 0x6c,
+	0x70, 0x68, 0x61, 0x31, 0x2e, 0x45, 0x78, 0x65, 0x63, 0x75, 0x74, 0x65, 0x52, 0x65, 0x73, 0x70,
+	0x6f, 0x6e, 0x73, 0x65, 0x22, 0x00, 0x28, 0x01, 0x30, 0x01, 0x12, 0x63, 0x0a, 0x0a, 0x52, 0x65,
+	0x73, 0x6f, 0x6c, 0x76, 0x65, 0x45, 0x6e, 0x76, 0x12, 0x28, 0x2e, 0x72, 0x75, 0x6e, 0x6d, 0x65,
 	0x2e, 0x72, 0x75, 0x6e, 0x6e, 0x65, 0x72, 0x2e, 0x76, 0x32, 0x61, 0x6c, 0x70, 0x68, 0x61, 0x31,
-	0x2e, 0x47, 0x65, 0x74, 0x53, 0x65, 0x73, 0x73, 0x69, 0x6f, 0x6e, 0x52, 0x65, 0x71, 0x75, 0x65,
+	0x2e, 0x52, 0x65, 0x73, 0x6f, 0x6c, 0x76, 0x65, 0x45, 0x6e, 0x76, 0x52, 0x65, 0x71, 0x75, 0x65,
 	0x73, 0x74, 0x1a, 0x29, 0x2e, 0x72, 0x75, 0x6e, 0x6d, 0x65, 0x2e, 0x72, 0x75, 0x6e, 0x6e, 0x65,
-	0x72, 0x2e, 0x76, 0x32, 0x61, 0x6c, 0x70, 0x68, 0x61, 0x31, 0x2e, 0x47, 0x65, 0x74, 0x53, 0x65,
-	0x73, 0x73, 0x69, 0x6f, 0x6e, 0x52, 0x65, 0x73, 0x70, 0x6f, 0x6e, 0x73, 0x65, 0x22, 0x00, 0x12,
-	0x69, 0x0a, 0x0c, 0x4c, 0x69, 0x73, 0x74, 0x53, 0x65, 0x73, 0x73, 0x69, 0x6f, 0x6e, 0x73, 0x12,
-	0x2a, 0x2e, 0x72, 0x75, 0x6e, 0x6d, 0x65, 0x2e, 0x72, 0x75, 0x6e, 0x6e, 0x65, 0x72, 0x2e, 0x76,
-	0x32, 0x61, 0x6c, 0x70, 0x68, 0x61, 0x31, 0x2e, 0x4c, 0x69, 0x73, 0x74, 0x53, 0x65, 0x73, 0x73,
-	0x69, 0x6f, 0x6e, 0x73, 0x52, 0x65, 0x71, 0x75, 0x65, 0x73, 0x74, 0x1a, 0x2b, 0x2e, 0x72, 0x75,
-	0x6e, 0x6d, 0x65, 0x2e, 0x72, 0x75, 0x6e, 0x6e, 0x65, 0x72, 0x2e, 0x76, 0x32, 0x61, 0x6c, 0x70,
-	0x68, 0x61, 0x31, 0x2e, 0x4c, 0x69, 0x73, 0x74, 0x53, 0x65, 0x73, 0x73, 0x69, 0x6f, 0x6e, 0x73,
-	0x52, 0x65, 0x73, 0x70, 0x6f, 0x6e, 0x73, 0x65, 0x22, 0x00, 0x12, 0x6c, 0x0a, 0x0d, 0x44, 0x65,
-	0x6c, 0x65, 0x74, 0x65, 0x53, 0x65, 0x73, 0x73, 0x69, 0x6f, 0x6e, 0x12, 0x2b, 0x2e, 0x72, 0x75,
-	0x6e, 0x6d, 0x65, 0x2e, 0x72, 0x75, 0x6e, 0x6e, 0x65, 0x72, 0x2e, 0x76, 0x32, 0x61, 0x6c, 0x70,
-	0x68, 0x61, 0x31, 0x2e, 0x44, 0x65, 0x6c, 0x65, 0x74, 0x65, 0x53, 0x65, 0x73, 0x73, 0x69, 0x6f,
-	0x6e, 0x52, 0x65, 0x71, 0x75, 0x65, 0x73, 0x74, 0x1a, 0x2c, 0x2e, 0x72, 0x75, 0x6e, 0x6d, 0x65,
-	0x2e, 0x72, 0x75, 0x6e, 0x6e, 0x65, 0x72, 0x2e, 0x76, 0x32, 0x61, 0x6c, 0x70, 0x68, 0x61, 0x31,
-	0x2e, 0x44, 0x65, 0x6c, 0x65, 0x74, 0x65, 0x53, 0x65, 0x73, 0x73, 0x69, 0x6f, 0x6e, 0x52, 0x65,
-	0x73, 0x70, 0x6f, 0x6e, 0x73, 0x65, 0x22, 0x00, 0x12, 0x5e, 0x0a, 0x07, 0x45, 0x78, 0x65, 0x63,
-	0x75, 0x74, 0x65, 0x12, 0x25, 0x2e, 0x72, 0x75, 0x6e, 0x6d, 0x65, 0x2e, 0x72, 0x75, 0x6e, 0x6e,
-	0x65, 0x72, 0x2e, 0x76, 0x32, 0x61, 0x6c, 0x70, 0x68, 0x61, 0x31, 0x2e, 0x45, 0x78, 0x65, 0x63,
-	0x75, 0x74, 0x65, 0x52, 0x65, 0x71, 0x75, 0x65, 0x73, 0x74, 0x1a, 0x26, 0x2e, 0x72, 0x75, 0x6e,
-	0x6d, 0x65, 0x2e, 0x72, 0x75, 0x6e, 0x6e, 0x65, 0x72, 0x2e, 0x76, 0x32, 0x61, 0x6c, 0x70, 0x68,
-	0x61, 0x31, 0x2e, 0x45, 0x78, 0x65, 0x63, 0x75, 0x74, 0x65, 0x52, 0x65, 0x73, 0x70, 0x6f, 0x6e,
-	0x73, 0x65, 0x22, 0x00, 0x28, 0x01, 0x30, 0x01, 0x42, 0x4a, 0x5a, 0x48, 0x67, 0x69, 0x74, 0x68,
-	0x75, 0x62, 0x2e, 0x63, 0x6f, 0x6d, 0x2f, 0x73, 0x74, 0x61, 0x74, 0x65, 0x66, 0x75, 0x6c, 0x2f,
-	0x72, 0x75, 0x6e, 0x6d, 0x65, 0x2f, 0x69, 0x6e, 0x74, 0x65, 0x72, 0x6e, 0x61, 0x6c, 0x2f, 0x67,
-	0x65, 0x6e, 0x2f, 0x70, 0x72, 0x6f, 0x74, 0x6f, 0x2f, 0x67, 0x6f, 0x2f, 0x72, 0x75, 0x6e, 0x6d,
-	0x65, 0x2f, 0x72, 0x75, 0x6e, 0x6e, 0x65, 0x72, 0x2f, 0x76, 0x31, 0x3b, 0x72, 0x75, 0x6e, 0x6e,
-	0x65, 0x72, 0x76, 0x31, 0x62, 0x06, 0x70, 0x72, 0x6f, 0x74, 0x6f, 0x33,
+	0x72, 0x2e, 0x76, 0x32, 0x61, 0x6c, 0x70, 0x68, 0x61, 0x31, 0x2e, 0x52, 0x65, 0x73, 0x6f, 0x6c,
+	0x76, 0x65, 0x45, 0x6e, 0x76, 0x52, 0x65, 0x73, 0x70, 0x6f, 0x6e, 0x73, 0x65, 0x22, 0x00, 0x42,
+	0x4a, 0x5a, 0x48, 0x67, 0x69, 0x74, 0x68, 0x75, 0x62, 0x2e, 0x63, 0x6f, 0x6d, 0x2f, 0x73, 0x74,
+	0x61, 0x74, 0x65, 0x66, 0x75, 0x6c, 0x2f, 0x72, 0x75, 0x6e, 0x6d, 0x65, 0x2f, 0x69, 0x6e, 0x74,
+	0x65, 0x72, 0x6e, 0x61, 0x6c, 0x2f, 0x67, 0x65, 0x6e, 0x2f, 0x70, 0x72, 0x6f, 0x74, 0x6f, 0x2f,
+	0x67, 0x6f, 0x2f, 0x72, 0x75, 0x6e, 0x6d, 0x65, 0x2f, 0x72, 0x75, 0x6e, 0x6e, 0x65, 0x72, 0x2f,
+	0x76, 0x31, 0x3b, 0x72, 0x75, 0x6e, 0x6e, 0x65, 0x72, 0x76, 0x31, 0x62, 0x06, 0x70, 0x72, 0x6f,
+	0x74, 0x6f, 0x33,
 }
 
 var (
@@ -1071,58 +1534,72 @@ func file_runme_runner_v2alpha1_runner_proto_rawDescGZIP() []byte {
 	return file_runme_runner_v2alpha1_runner_proto_rawDescData
 }
 
-var file_runme_runner_v2alpha1_runner_proto_enumTypes = make([]protoimpl.EnumInfo, 2)
-var file_runme_runner_v2alpha1_runner_proto_msgTypes = make([]protoimpl.MessageInfo, 15)
+var file_runme_runner_v2alpha1_runner_proto_enumTypes = make([]protoimpl.EnumInfo, 3)
+var file_runme_runner_v2alpha1_runner_proto_msgTypes = make([]protoimpl.MessageInfo, 20)
 var file_runme_runner_v2alpha1_runner_proto_goTypes = []interface{}{
-	(ExecuteStop)(0),               // 0: runme.runner.v2alpha1.ExecuteStop
-	(SessionStrategy)(0),           // 1: runme.runner.v2alpha1.SessionStrategy
-	(*Project)(nil),                // 2: runme.runner.v2alpha1.Project
-	(*Session)(nil),                // 3: runme.runner.v2alpha1.Session
-	(*CreateSessionRequest)(nil),   // 4: runme.runner.v2alpha1.CreateSessionRequest
-	(*CreateSessionResponse)(nil),  // 5: runme.runner.v2alpha1.CreateSessionResponse
-	(*GetSessionRequest)(nil),      // 6: runme.runner.v2alpha1.GetSessionRequest
-	(*GetSessionResponse)(nil),     // 7: runme.runner.v2alpha1.GetSessionResponse
-	(*ListSessionsRequest)(nil),    // 8: runme.runner.v2alpha1.ListSessionsRequest
-	(*ListSessionsResponse)(nil),   // 9: runme.runner.v2alpha1.ListSessionsResponse
-	(*DeleteSessionRequest)(nil),   // 10: runme.runner.v2alpha1.DeleteSessionRequest
-	(*DeleteSessionResponse)(nil),  // 11: runme.runner.v2alpha1.DeleteSessionResponse
-	(*Winsize)(nil),                // 12: runme.runner.v2alpha1.Winsize
-	(*ExecuteRequest)(nil),         // 13: runme.runner.v2alpha1.ExecuteRequest
-	(*ExecuteResponse)(nil),        // 14: runme.runner.v2alpha1.ExecuteResponse
-	nil,                            // 15: runme.runner.v2alpha1.Session.MetadataEntry
-	nil,                            // 16: runme.runner.v2alpha1.CreateSessionRequest.MetadataEntry
-	(*ProgramConfig)(nil),          // 17: runme.runner.v2alpha1.ProgramConfig
-	(*wrapperspb.UInt32Value)(nil), // 18: google.protobuf.UInt32Value
+	(ExecuteStop)(0),                         // 0: runme.runner.v2alpha1.ExecuteStop
+	(SessionStrategy)(0),                     // 1: runme.runner.v2alpha1.SessionStrategy
+	(ResolveEnvResponse_Source)(0),           // 2: runme.runner.v2alpha1.ResolveEnvResponse.Source
+	(*Project)(nil),                          // 3: runme.runner.v2alpha1.Project
+	(*Session)(nil),                          // 4: runme.runner.v2alpha1.Session
+	(*CreateSessionRequest)(nil),             // 5: runme.runner.v2alpha1.CreateSessionRequest
+	(*CreateSessionResponse)(nil),            // 6: runme.runner.v2alpha1.CreateSessionResponse
+	(*GetSessionRequest)(nil),                // 7: runme.runner.v2alpha1.GetSessionRequest
+	(*GetSessionResponse)(nil),               // 8: runme.runner.v2alpha1.GetSessionResponse
+	(*ListSessionsRequest)(nil),              // 9: runme.runner.v2alpha1.ListSessionsRequest
+	(*ListSessionsResponse)(nil),             // 10: runme.runner.v2alpha1.ListSessionsResponse
+	(*DeleteSessionRequest)(nil),             // 11: runme.runner.v2alpha1.DeleteSessionRequest
+	(*DeleteSessionResponse)(nil),            // 12: runme.runner.v2alpha1.DeleteSessionResponse
+	(*Winsize)(nil),                          // 13: runme.runner.v2alpha1.Winsize
+	(*ExecuteRequest)(nil),                   // 14: runme.runner.v2alpha1.ExecuteRequest
+	(*ExecuteResponse)(nil),                  // 15: runme.runner.v2alpha1.ExecuteResponse
+	(*ResolveEnvRequest)(nil),                // 16: runme.runner.v2alpha1.ResolveEnvRequest
+	(*ResolveEnvResponse)(nil),               // 17: runme.runner.v2alpha1.ResolveEnvResponse
+	nil,                                      // 18: runme.runner.v2alpha1.Session.MetadataEntry
+	nil,                                      // 19: runme.runner.v2alpha1.CreateSessionRequest.MetadataEntry
+	(*ResolveEnvRequest_CommandList)(nil),    // 20: runme.runner.v2alpha1.ResolveEnvRequest.CommandList
+	(*ResolveEnvResponse_ResolvedEnv)(nil),   // 21: runme.runner.v2alpha1.ResolveEnvResponse.ResolvedEnv
+	(*ResolveEnvResponse_UnresolvedEnv)(nil), // 22: runme.runner.v2alpha1.ResolveEnvResponse.UnresolvedEnv
+	(*ProgramConfig)(nil),                    // 23: runme.runner.v2alpha1.ProgramConfig
+	(*wrapperspb.UInt32Value)(nil),           // 24: google.protobuf.UInt32Value
 }
 var file_runme_runner_v2alpha1_runner_proto_depIdxs = []int32{
-	15, // 0: runme.runner.v2alpha1.Session.metadata:type_name -> runme.runner.v2alpha1.Session.MetadataEntry
-	16, // 1: runme.runner.v2alpha1.CreateSessionRequest.metadata:type_name -> runme.runner.v2alpha1.CreateSessionRequest.MetadataEntry
-	2,  // 2: runme.runner.v2alpha1.CreateSessionRequest.project:type_name -> runme.runner.v2alpha1.Project
-	3,  // 3: runme.runner.v2alpha1.CreateSessionResponse.session:type_name -> runme.runner.v2alpha1.Session
-	3,  // 4: runme.runner.v2alpha1.GetSessionResponse.session:type_name -> runme.runner.v2alpha1.Session
-	3,  // 5: runme.runner.v2alpha1.ListSessionsResponse.sessions:type_name -> runme.runner.v2alpha1.Session
-	17, // 6: runme.runner.v2alpha1.ExecuteRequest.config:type_name -> runme.runner.v2alpha1.ProgramConfig
+	18, // 0: runme.runner.v2alpha1.Session.metadata:type_name -> runme.runner.v2alpha1.Session.MetadataEntry
+	19, // 1: runme.runner.v2alpha1.CreateSessionRequest.metadata:type_name -> runme.runner.v2alpha1.CreateSessionRequest.MetadataEntry
+	3,  // 2: runme.runner.v2alpha1.CreateSessionRequest.project:type_name -> runme.runner.v2alpha1.Project
+	4,  // 3: runme.runner.v2alpha1.CreateSessionResponse.session:type_name -> runme.runner.v2alpha1.Session
+	4,  // 4: runme.runner.v2alpha1.GetSessionResponse.session:type_name -> runme.runner.v2alpha1.Session
+	4,  // 5: runme.runner.v2alpha1.ListSessionsResponse.sessions:type_name -> runme.runner.v2alpha1.Session
+	23, // 6: runme.runner.v2alpha1.ExecuteRequest.config:type_name -> runme.runner.v2alpha1.ProgramConfig
 	0,  // 7: runme.runner.v2alpha1.ExecuteRequest.stop:type_name -> runme.runner.v2alpha1.ExecuteStop
-	12, // 8: runme.runner.v2alpha1.ExecuteRequest.winsize:type_name -> runme.runner.v2alpha1.Winsize
+	13, // 8: runme.runner.v2alpha1.ExecuteRequest.winsize:type_name -> runme.runner.v2alpha1.Winsize
 	1,  // 9: runme.runner.v2alpha1.ExecuteRequest.session_strategy:type_name -> runme.runner.v2alpha1.SessionStrategy
-	2,  // 10: runme.runner.v2alpha1.ExecuteRequest.project:type_name -> runme.runner.v2alpha1.Project
-	18, // 11: runme.runner.v2alpha1.ExecuteResponse.exit_code:type_name -> google.protobuf.UInt32Value
-	18, // 12: runme.runner.v2alpha1.ExecuteResponse.pid:type_name -> google.protobuf.UInt32Value
-	4,  // 13: runme.runner.v2alpha1.RunnerService.CreateSession:input_type -> runme.runner.v2alpha1.CreateSessionRequest
-	6,  // 14: runme.runner.v2alpha1.RunnerService.GetSession:input_type -> runme.runner.v2alpha1.GetSessionRequest
-	8,  // 15: runme.runner.v2alpha1.RunnerService.ListSessions:input_type -> runme.runner.v2alpha1.ListSessionsRequest
-	10, // 16: runme.runner.v2alpha1.RunnerService.DeleteSession:input_type -> runme.runner.v2alpha1.DeleteSessionRequest
-	13, // 17: runme.runner.v2alpha1.RunnerService.Execute:input_type -> runme.runner.v2alpha1.ExecuteRequest
-	5,  // 18: runme.runner.v2alpha1.RunnerService.CreateSession:output_type -> runme.runner.v2alpha1.CreateSessionResponse
-	7,  // 19: runme.runner.v2alpha1.RunnerService.GetSession:output_type -> runme.runner.v2alpha1.GetSessionResponse
-	9,  // 20: runme.runner.v2alpha1.RunnerService.ListSessions:output_type -> runme.runner.v2alpha1.ListSessionsResponse
-	11, // 21: runme.runner.v2alpha1.RunnerService.DeleteSession:output_type -> runme.runner.v2alpha1.DeleteSessionResponse
-	14, // 22: runme.runner.v2alpha1.RunnerService.Execute:output_type -> runme.runner.v2alpha1.ExecuteResponse
-	18, // [18:23] is the sub-list for method output_type
-	13, // [13:18] is the sub-list for method input_type
-	13, // [13:13] is the sub-list for extension type_name
-	13, // [13:13] is the sub-list for extension extendee
-	0,  // [0:13] is the sub-list for field type_name
+	3,  // 10: runme.runner.v2alpha1.ExecuteRequest.project:type_name -> runme.runner.v2alpha1.Project
+	24, // 11: runme.runner.v2alpha1.ExecuteResponse.exit_code:type_name -> google.protobuf.UInt32Value
+	24, // 12: runme.runner.v2alpha1.ExecuteResponse.pid:type_name -> google.protobuf.UInt32Value
+	20, // 13: runme.runner.v2alpha1.ResolveEnvRequest.commands:type_name -> runme.runner.v2alpha1.ResolveEnvRequest.CommandList
+	1,  // 14: runme.runner.v2alpha1.ResolveEnvRequest.session_strategy:type_name -> runme.runner.v2alpha1.SessionStrategy
+	3,  // 15: runme.runner.v2alpha1.ResolveEnvRequest.project:type_name -> runme.runner.v2alpha1.Project
+	21, // 16: runme.runner.v2alpha1.ResolveEnvResponse.resolved_env:type_name -> runme.runner.v2alpha1.ResolveEnvResponse.ResolvedEnv
+	22, // 17: runme.runner.v2alpha1.ResolveEnvResponse.unresolved_env:type_name -> runme.runner.v2alpha1.ResolveEnvResponse.UnresolvedEnv
+	2,  // 18: runme.runner.v2alpha1.ResolveEnvResponse.ResolvedEnv.source:type_name -> runme.runner.v2alpha1.ResolveEnvResponse.Source
+	5,  // 19: runme.runner.v2alpha1.RunnerService.CreateSession:input_type -> runme.runner.v2alpha1.CreateSessionRequest
+	7,  // 20: runme.runner.v2alpha1.RunnerService.GetSession:input_type -> runme.runner.v2alpha1.GetSessionRequest
+	9,  // 21: runme.runner.v2alpha1.RunnerService.ListSessions:input_type -> runme.runner.v2alpha1.ListSessionsRequest
+	11, // 22: runme.runner.v2alpha1.RunnerService.DeleteSession:input_type -> runme.runner.v2alpha1.DeleteSessionRequest
+	14, // 23: runme.runner.v2alpha1.RunnerService.Execute:input_type -> runme.runner.v2alpha1.ExecuteRequest
+	16, // 24: runme.runner.v2alpha1.RunnerService.ResolveEnv:input_type -> runme.runner.v2alpha1.ResolveEnvRequest
+	6,  // 25: runme.runner.v2alpha1.RunnerService.CreateSession:output_type -> runme.runner.v2alpha1.CreateSessionResponse
+	8,  // 26: runme.runner.v2alpha1.RunnerService.GetSession:output_type -> runme.runner.v2alpha1.GetSessionResponse
+	10, // 27: runme.runner.v2alpha1.RunnerService.ListSessions:output_type -> runme.runner.v2alpha1.ListSessionsResponse
+	12, // 28: runme.runner.v2alpha1.RunnerService.DeleteSession:output_type -> runme.runner.v2alpha1.DeleteSessionResponse
+	15, // 29: runme.runner.v2alpha1.RunnerService.Execute:output_type -> runme.runner.v2alpha1.ExecuteResponse
+	17, // 30: runme.runner.v2alpha1.RunnerService.ResolveEnv:output_type -> runme.runner.v2alpha1.ResolveEnvResponse
+	25, // [25:31] is the sub-list for method output_type
+	19, // [19:25] is the sub-list for method input_type
+	19, // [19:19] is the sub-list for extension type_name
+	19, // [19:19] is the sub-list for extension extendee
+	0,  // [0:19] is the sub-list for field type_name
 }
 
 func init() { file_runme_runner_v2alpha1_runner_proto_init() }
@@ -1288,16 +1765,80 @@ func file_runme_runner_v2alpha1_runner_proto_init() {
 				return nil
 			}
 		}
+		file_runme_runner_v2alpha1_runner_proto_msgTypes[13].Exporter = func(v interface{}, i int) interface{} {
+			switch v := v.(*ResolveEnvRequest); i {
+			case 0:
+				return &v.state
+			case 1:
+				return &v.sizeCache
+			case 2:
+				return &v.unknownFields
+			default:
+				return nil
+			}
+		}
+		file_runme_runner_v2alpha1_runner_proto_msgTypes[14].Exporter = func(v interface{}, i int) interface{} {
+			switch v := v.(*ResolveEnvResponse); i {
+			case 0:
+				return &v.state
+			case 1:
+				return &v.sizeCache
+			case 2:
+				return &v.unknownFields
+			default:
+				return nil
+			}
+		}
+		file_runme_runner_v2alpha1_runner_proto_msgTypes[17].Exporter = func(v interface{}, i int) interface{} {
+			switch v := v.(*ResolveEnvRequest_CommandList); i {
+			case 0:
+				return &v.state
+			case 1:
+				return &v.sizeCache
+			case 2:
+				return &v.unknownFields
+			default:
+				return nil
+			}
+		}
+		file_runme_runner_v2alpha1_runner_proto_msgTypes[18].Exporter = func(v interface{}, i int) interface{} {
+			switch v := v.(*ResolveEnvResponse_ResolvedEnv); i {
+			case 0:
+				return &v.state
+			case 1:
+				return &v.sizeCache
+			case 2:
+				return &v.unknownFields
+			default:
+				return nil
+			}
+		}
+		file_runme_runner_v2alpha1_runner_proto_msgTypes[19].Exporter = func(v interface{}, i int) interface{} {
+			switch v := v.(*ResolveEnvResponse_UnresolvedEnv); i {
+			case 0:
+				return &v.state
+			case 1:
+				return &v.sizeCache
+			case 2:
+				return &v.unknownFields
+			default:
+				return nil
+			}
+		}
 	}
 	file_runme_runner_v2alpha1_runner_proto_msgTypes[2].OneofWrappers = []interface{}{}
 	file_runme_runner_v2alpha1_runner_proto_msgTypes[11].OneofWrappers = []interface{}{}
+	file_runme_runner_v2alpha1_runner_proto_msgTypes[13].OneofWrappers = []interface{}{
+		(*ResolveEnvRequest_Commands)(nil),
+		(*ResolveEnvRequest_Script)(nil),
+	}
 	type x struct{}
 	out := protoimpl.TypeBuilder{
 		File: protoimpl.DescBuilder{
 			GoPackagePath: reflect.TypeOf(x{}).PkgPath(),
 			RawDescriptor: file_runme_runner_v2alpha1_runner_proto_rawDesc,
-			NumEnums:      2,
-			NumMessages:   15,
+			NumEnums:      3,
+			NumMessages:   20,
 			NumExtensions: 0,
 			NumServices:   1,
 		},
diff --git a/internal/gen/proto/go/runme/runner/v2alpha1/runner_grpc.pb.go b/internal/gen/proto/go/runme/runner/v2alpha1/runner_grpc.pb.go
index 738fdde0b..dfabf7e3f 100644
--- a/internal/gen/proto/go/runme/runner/v2alpha1/runner_grpc.pb.go
+++ b/internal/gen/proto/go/runme/runner/v2alpha1/runner_grpc.pb.go
@@ -24,6 +24,7 @@ const (
 	RunnerService_ListSessions_FullMethodName  = "/runme.runner.v2alpha1.RunnerService/ListSessions"
 	RunnerService_DeleteSession_FullMethodName = "/runme.runner.v2alpha1.RunnerService/DeleteSession"
 	RunnerService_Execute_FullMethodName       = "/runme.runner.v2alpha1.RunnerService/Execute"
+	RunnerService_ResolveEnv_FullMethodName    = "/runme.runner.v2alpha1.RunnerService/ResolveEnv"
 )
 
 // RunnerServiceClient is the client API for RunnerService service.
@@ -42,6 +43,7 @@ type RunnerServiceClient interface {
 	// Subsequent "ExecuteRequest" should only contain "input_data" as
 	// other fields will be ignored.
 	Execute(ctx context.Context, opts ...grpc.CallOption) (RunnerService_ExecuteClient, error)
+	ResolveEnv(ctx context.Context, in *ResolveEnvRequest, opts ...grpc.CallOption) (*ResolveEnvResponse, error)
 }
 
 type runnerServiceClient struct {
@@ -119,6 +121,15 @@ func (x *runnerServiceExecuteClient) Recv() (*ExecuteResponse, error) {
 	return m, nil
 }
 
+func (c *runnerServiceClient) ResolveEnv(ctx context.Context, in *ResolveEnvRequest, opts ...grpc.CallOption) (*ResolveEnvResponse, error) {
+	out := new(ResolveEnvResponse)
+	err := c.cc.Invoke(ctx, RunnerService_ResolveEnv_FullMethodName, in, out, opts...)
+	if err != nil {
+		return nil, err
+	}
+	return out, nil
+}
+
 // RunnerServiceServer is the server API for RunnerService service.
 // All implementations must embed UnimplementedRunnerServiceServer
 // for forward compatibility
@@ -135,6 +146,7 @@ type RunnerServiceServer interface {
 	// Subsequent "ExecuteRequest" should only contain "input_data" as
 	// other fields will be ignored.
 	Execute(RunnerService_ExecuteServer) error
+	ResolveEnv(context.Context, *ResolveEnvRequest) (*ResolveEnvResponse, error)
 	mustEmbedUnimplementedRunnerServiceServer()
 }
 
@@ -157,6 +169,9 @@ func (UnimplementedRunnerServiceServer) DeleteSession(context.Context, *DeleteSe
 func (UnimplementedRunnerServiceServer) Execute(RunnerService_ExecuteServer) error {
 	return status.Errorf(codes.Unimplemented, "method Execute not implemented")
 }
+func (UnimplementedRunnerServiceServer) ResolveEnv(context.Context, *ResolveEnvRequest) (*ResolveEnvResponse, error) {
+	return nil, status.Errorf(codes.Unimplemented, "method ResolveEnv not implemented")
+}
 func (UnimplementedRunnerServiceServer) mustEmbedUnimplementedRunnerServiceServer() {}
 
 // UnsafeRunnerServiceServer may be embedded to opt out of forward compatibility for this service.
@@ -268,6 +283,24 @@ func (x *runnerServiceExecuteServer) Recv() (*ExecuteRequest, error) {
 	return m, nil
 }
 
+func _RunnerService_ResolveEnv_Handler(srv interface{}, ctx context.Context, dec func(interface{}) error, interceptor grpc.UnaryServerInterceptor) (interface{}, error) {
+	in := new(ResolveEnvRequest)
+	if err := dec(in); err != nil {
+		return nil, err
+	}
+	if interceptor == nil {
+		return srv.(RunnerServiceServer).ResolveEnv(ctx, in)
+	}
+	info := &grpc.UnaryServerInfo{
+		Server:     srv,
+		FullMethod: RunnerService_ResolveEnv_FullMethodName,
+	}
+	handler := func(ctx context.Context, req interface{}) (interface{}, error) {
+		return srv.(RunnerServiceServer).ResolveEnv(ctx, req.(*ResolveEnvRequest))
+	}
+	return interceptor(ctx, in, info, handler)
+}
+
 // RunnerService_ServiceDesc is the grpc.ServiceDesc for RunnerService service.
 // It's only intended for direct use with grpc.RegisterService,
 // and not to be introspected or modified (even as a copy)
@@ -291,6 +324,10 @@ var RunnerService_ServiceDesc = grpc.ServiceDesc{
 			MethodName: "DeleteSession",
 			Handler:    _RunnerService_DeleteSession_Handler,
 		},
+		{
+			MethodName: "ResolveEnv",
+			Handler:    _RunnerService_ResolveEnv_Handler,
+		},
 	},
 	Streams: []grpc.StreamDesc{
 		{
diff --git a/internal/gen/proto/go/runme/runner/v2alpha1/runnerv1connect/runner.connect.go b/internal/gen/proto/go/runme/runner/v2alpha1/runnerv1connect/runner.connect.go
index f891e438d..f3974b870 100644
--- a/internal/gen/proto/go/runme/runner/v2alpha1/runnerv1connect/runner.connect.go
+++ b/internal/gen/proto/go/runme/runner/v2alpha1/runnerv1connect/runner.connect.go
@@ -47,6 +47,9 @@ const (
 	RunnerServiceDeleteSessionProcedure = "/runme.runner.v2alpha1.RunnerService/DeleteSession"
 	// RunnerServiceExecuteProcedure is the fully-qualified name of the RunnerService's Execute RPC.
 	RunnerServiceExecuteProcedure = "/runme.runner.v2alpha1.RunnerService/Execute"
+	// RunnerServiceResolveEnvProcedure is the fully-qualified name of the RunnerService's ResolveEnv
+	// RPC.
+	RunnerServiceResolveEnvProcedure = "/runme.runner.v2alpha1.RunnerService/ResolveEnv"
 )
 
 // RunnerServiceClient is a client for the runme.runner.v2alpha1.RunnerService service.
@@ -63,6 +66,7 @@ type RunnerServiceClient interface {
 	// Subsequent "ExecuteRequest" should only contain "input_data" as
 	// other fields will be ignored.
 	Execute(context.Context) *connect_go.BidiStreamForClient[v1.ExecuteRequest, v1.ExecuteResponse]
+	ResolveEnv(context.Context, *connect_go.Request[v1.ResolveEnvRequest]) (*connect_go.Response[v1.ResolveEnvResponse], error)
 }
 
 // NewRunnerServiceClient constructs a client for the runme.runner.v2alpha1.RunnerService service.
@@ -100,6 +104,11 @@ func NewRunnerServiceClient(httpClient connect_go.HTTPClient, baseURL string, op
 			baseURL+RunnerServiceExecuteProcedure,
 			opts...,
 		),
+		resolveEnv: connect_go.NewClient[v1.ResolveEnvRequest, v1.ResolveEnvResponse](
+			httpClient,
+			baseURL+RunnerServiceResolveEnvProcedure,
+			opts...,
+		),
 	}
 }
 
@@ -110,6 +119,7 @@ type runnerServiceClient struct {
 	listSessions  *connect_go.Client[v1.ListSessionsRequest, v1.ListSessionsResponse]
 	deleteSession *connect_go.Client[v1.DeleteSessionRequest, v1.DeleteSessionResponse]
 	execute       *connect_go.Client[v1.ExecuteRequest, v1.ExecuteResponse]
+	resolveEnv    *connect_go.Client[v1.ResolveEnvRequest, v1.ResolveEnvResponse]
 }
 
 // CreateSession calls runme.runner.v2alpha1.RunnerService.CreateSession.
@@ -137,6 +147,11 @@ func (c *runnerServiceClient) Execute(ctx context.Context) *connect_go.BidiStrea
 	return c.execute.CallBidiStream(ctx)
 }
 
+// ResolveEnv calls runme.runner.v2alpha1.RunnerService.ResolveEnv.
+func (c *runnerServiceClient) ResolveEnv(ctx context.Context, req *connect_go.Request[v1.ResolveEnvRequest]) (*connect_go.Response[v1.ResolveEnvResponse], error) {
+	return c.resolveEnv.CallUnary(ctx, req)
+}
+
 // RunnerServiceHandler is an implementation of the runme.runner.v2alpha1.RunnerService service.
 type RunnerServiceHandler interface {
 	CreateSession(context.Context, *connect_go.Request[v1.CreateSessionRequest]) (*connect_go.Response[v1.CreateSessionResponse], error)
@@ -151,6 +166,7 @@ type RunnerServiceHandler interface {
 	// Subsequent "ExecuteRequest" should only contain "input_data" as
 	// other fields will be ignored.
 	Execute(context.Context, *connect_go.BidiStream[v1.ExecuteRequest, v1.ExecuteResponse]) error
+	ResolveEnv(context.Context, *connect_go.Request[v1.ResolveEnvRequest]) (*connect_go.Response[v1.ResolveEnvResponse], error)
 }
 
 // NewRunnerServiceHandler builds an HTTP handler from the service implementation. It returns the
@@ -184,6 +200,11 @@ func NewRunnerServiceHandler(svc RunnerServiceHandler, opts ...connect_go.Handle
 		svc.Execute,
 		opts...,
 	)
+	runnerServiceResolveEnvHandler := connect_go.NewUnaryHandler(
+		RunnerServiceResolveEnvProcedure,
+		svc.ResolveEnv,
+		opts...,
+	)
 	return "/runme.runner.v2alpha1.RunnerService/", http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
 		switch r.URL.Path {
 		case RunnerServiceCreateSessionProcedure:
@@ -196,6 +217,8 @@ func NewRunnerServiceHandler(svc RunnerServiceHandler, opts ...connect_go.Handle
 			runnerServiceDeleteSessionHandler.ServeHTTP(w, r)
 		case RunnerServiceExecuteProcedure:
 			runnerServiceExecuteHandler.ServeHTTP(w, r)
+		case RunnerServiceResolveEnvProcedure:
+			runnerServiceResolveEnvHandler.ServeHTTP(w, r)
 		default:
 			http.NotFound(w, r)
 		}
@@ -224,3 +247,7 @@ func (UnimplementedRunnerServiceHandler) DeleteSession(context.Context, *connect
 func (UnimplementedRunnerServiceHandler) Execute(context.Context, *connect_go.BidiStream[v1.ExecuteRequest, v1.ExecuteResponse]) error {
 	return connect_go.NewError(connect_go.CodeUnimplemented, errors.New("runme.runner.v2alpha1.RunnerService.Execute is not implemented"))
 }
+
+func (UnimplementedRunnerServiceHandler) ResolveEnv(context.Context, *connect_go.Request[v1.ResolveEnvRequest]) (*connect_go.Response[v1.ResolveEnvResponse], error) {
+	return nil, connect_go.NewError(connect_go.CodeUnimplemented, errors.New("runme.runner.v2alpha1.RunnerService.ResolveEnv is not implemented"))
+}
diff --git a/internal/gen/proto/go/runme/runner/v2alpha1/runnerv2alpha1connect/runner.connect.go b/internal/gen/proto/go/runme/runner/v2alpha1/runnerv2alpha1connect/runner.connect.go
deleted file mode 100644
index 11e24539a..000000000
--- a/internal/gen/proto/go/runme/runner/v2alpha1/runnerv2alpha1connect/runner.connect.go
+++ /dev/null
@@ -1,118 +0,0 @@
-// Code generated by protoc-gen-connect-go. DO NOT EDIT.
-//
-// Source: runme/runner/v2alpha1/runner.proto
-
-package runnerv2alpha1connect
-
-import (
-	context "context"
-	errors "errors"
-	connect_go "github.com/bufbuild/connect-go"
-	v2alpha1 "github.com/stateful/runme/internal/gen/proto/go/runme/runner/v2alpha1"
-	http "net/http"
-	strings "strings"
-)
-
-// This is a compile-time assertion to ensure that this generated file and the connect package are
-// compatible. If you get a compiler error that this constant is not defined, this code was
-// generated with a version of connect newer than the one compiled into your binary. You can fix the
-// problem by either regenerating this code with an older version of connect or updating the connect
-// version compiled into your binary.
-const _ = connect_go.IsAtLeastVersion0_1_0
-
-const (
-	// RunnerServiceName is the fully-qualified name of the RunnerService service.
-	RunnerServiceName = "runme.runner.v2alpha1.RunnerService"
-)
-
-// These constants are the fully-qualified names of the RPCs defined in this package. They're
-// exposed at runtime as Spec.Procedure and as the final two segments of the HTTP route.
-//
-// Note that these are different from the fully-qualified method names used by
-// google.golang.org/protobuf/reflect/protoreflect. To convert from these constants to
-// reflection-formatted method names, remove the leading slash and convert the remaining slash to a
-// period.
-const (
-	// RunnerServiceExecuteProcedure is the fully-qualified name of the RunnerService's Execute RPC.
-	RunnerServiceExecuteProcedure = "/runme.runner.v2alpha1.RunnerService/Execute"
-)
-
-// RunnerServiceClient is a client for the runme.runner.v2alpha1.RunnerService service.
-type RunnerServiceClient interface {
-	// Execute executes a program. Examine "ExecuteRequest" to explore
-	// configuration options.
-	//
-	// It's a bidirectional stream RPC method. It expects the first
-	// "ExecuteRequest" to contain details of a program to execute.
-	// Subsequent "ExecuteRequest" should only contain "input_data" as
-	// other fields will be ignored.
-	Execute(context.Context) *connect_go.BidiStreamForClient[v2alpha1.ExecuteRequest, v2alpha1.ExecuteResponse]
-}
-
-// NewRunnerServiceClient constructs a client for the runme.runner.v2alpha1.RunnerService service.
-// By default, it uses the Connect protocol with the binary Protobuf Codec, asks for gzipped
-// responses, and sends uncompressed requests. To use the gRPC or gRPC-Web protocols, supply the
-// connect.WithGRPC() or connect.WithGRPCWeb() options.
-//
-// The URL supplied here should be the base URL for the Connect or gRPC server (for example,
-// http://api.acme.com or https://acme.com/grpc).
-func NewRunnerServiceClient(httpClient connect_go.HTTPClient, baseURL string, opts ...connect_go.ClientOption) RunnerServiceClient {
-	baseURL = strings.TrimRight(baseURL, "/")
-	return &runnerServiceClient{
-		execute: connect_go.NewClient[v2alpha1.ExecuteRequest, v2alpha1.ExecuteResponse](
-			httpClient,
-			baseURL+RunnerServiceExecuteProcedure,
-			opts...,
-		),
-	}
-}
-
-// runnerServiceClient implements RunnerServiceClient.
-type runnerServiceClient struct {
-	execute *connect_go.Client[v2alpha1.ExecuteRequest, v2alpha1.ExecuteResponse]
-}
-
-// Execute calls runme.runner.v2alpha1.RunnerService.Execute.
-func (c *runnerServiceClient) Execute(ctx context.Context) *connect_go.BidiStreamForClient[v2alpha1.ExecuteRequest, v2alpha1.ExecuteResponse] {
-	return c.execute.CallBidiStream(ctx)
-}
-
-// RunnerServiceHandler is an implementation of the runme.runner.v2alpha1.RunnerService service.
-type RunnerServiceHandler interface {
-	// Execute executes a program. Examine "ExecuteRequest" to explore
-	// configuration options.
-	//
-	// It's a bidirectional stream RPC method. It expects the first
-	// "ExecuteRequest" to contain details of a program to execute.
-	// Subsequent "ExecuteRequest" should only contain "input_data" as
-	// other fields will be ignored.
-	Execute(context.Context, *connect_go.BidiStream[v2alpha1.ExecuteRequest, v2alpha1.ExecuteResponse]) error
-}
-
-// NewRunnerServiceHandler builds an HTTP handler from the service implementation. It returns the
-// path on which to mount the handler and the handler itself.
-//
-// By default, handlers support the Connect, gRPC, and gRPC-Web protocols with the binary Protobuf
-// and JSON codecs. They also support gzip compression.
-func NewRunnerServiceHandler(svc RunnerServiceHandler, opts ...connect_go.HandlerOption) (string, http.Handler) {
-	runnerServiceExecuteHandler := connect_go.NewBidiStreamHandler(
-		RunnerServiceExecuteProcedure,
-		svc.Execute,
-		opts...,
-	)
-	return "/runme.runner.v2alpha1.RunnerService/", http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
-		switch r.URL.Path {
-		case RunnerServiceExecuteProcedure:
-			runnerServiceExecuteHandler.ServeHTTP(w, r)
-		default:
-			http.NotFound(w, r)
-		}
-	})
-}
-
-// UnimplementedRunnerServiceHandler returns CodeUnimplemented from all methods.
-type UnimplementedRunnerServiceHandler struct{}
-
-func (UnimplementedRunnerServiceHandler) Execute(context.Context, *connect_go.BidiStream[v2alpha1.ExecuteRequest, v2alpha1.ExecuteResponse]) error {
-	return connect_go.NewError(connect_go.CodeUnimplemented, errors.New("runme.runner.v2alpha1.RunnerService.Execute is not implemented"))
-}
diff --git a/internal/gen/proto/ts/runme/runner/v2alpha1/runner_pb.client.d.ts b/internal/gen/proto/ts/runme/runner/v2alpha1/runner_pb.client.d.ts
index e01e3bec2..f996d0c92 100644
--- a/internal/gen/proto/ts/runme/runner/v2alpha1/runner_pb.client.d.ts
+++ b/internal/gen/proto/ts/runme/runner/v2alpha1/runner_pb.client.d.ts
@@ -5,6 +5,8 @@
 // @ts-nocheck
 import type { RpcTransport } from "@protobuf-ts/runtime-rpc";
 import type { ServiceInfo } from "@protobuf-ts/runtime-rpc";
+import type { ResolveEnvResponse } from "./runner_pb";
+import type { ResolveEnvRequest } from "./runner_pb";
 import type { ExecuteResponse } from "./runner_pb";
 import type { ExecuteRequest } from "./runner_pb";
 import type { DuplexStreamingCall } from "@protobuf-ts/runtime-rpc";
@@ -50,6 +52,10 @@ export interface IRunnerServiceClient {
      * @generated from protobuf rpc: Execute(stream runme.runner.v2alpha1.ExecuteRequest) returns (stream runme.runner.v2alpha1.ExecuteResponse);
      */
     execute(options?: RpcOptions): DuplexStreamingCall<ExecuteRequest, ExecuteResponse>;
+    /**
+     * @generated from protobuf rpc: ResolveEnv(runme.runner.v2alpha1.ResolveEnvRequest) returns (runme.runner.v2alpha1.ResolveEnvResponse);
+     */
+    resolveEnv(input: ResolveEnvRequest, options?: RpcOptions): UnaryCall<ResolveEnvRequest, ResolveEnvResponse>;
 }
 /**
  * @generated from protobuf service runme.runner.v2alpha1.RunnerService
@@ -88,4 +94,8 @@ export declare class RunnerServiceClient implements IRunnerServiceClient, Servic
      * @generated from protobuf rpc: Execute(stream runme.runner.v2alpha1.ExecuteRequest) returns (stream runme.runner.v2alpha1.ExecuteResponse);
      */
     execute(options?: RpcOptions): DuplexStreamingCall<ExecuteRequest, ExecuteResponse>;
+    /**
+     * @generated from protobuf rpc: ResolveEnv(runme.runner.v2alpha1.ResolveEnvRequest) returns (runme.runner.v2alpha1.ResolveEnvResponse);
+     */
+    resolveEnv(input: ResolveEnvRequest, options?: RpcOptions): UnaryCall<ResolveEnvRequest, ResolveEnvResponse>;
 }
diff --git a/internal/gen/proto/ts/runme/runner/v2alpha1/runner_pb.client.js b/internal/gen/proto/ts/runme/runner/v2alpha1/runner_pb.client.js
index c1f8d5beb..7327eef25 100644
--- a/internal/gen/proto/ts/runme/runner/v2alpha1/runner_pb.client.js
+++ b/internal/gen/proto/ts/runme/runner/v2alpha1/runner_pb.client.js
@@ -58,4 +58,11 @@ export class RunnerServiceClient {
         const method = this.methods[4], opt = this._transport.mergeOptions(options);
         return stackIntercept("duplex", this._transport, method, opt);
     }
+    /**
+     * @generated from protobuf rpc: ResolveEnv(runme.runner.v2alpha1.ResolveEnvRequest) returns (runme.runner.v2alpha1.ResolveEnvResponse);
+     */
+    resolveEnv(input, options) {
+        const method = this.methods[5], opt = this._transport.mergeOptions(options);
+        return stackIntercept("unary", this._transport, method, opt, input);
+    }
 }
diff --git a/internal/gen/proto/ts/runme/runner/v2alpha1/runner_pb.d.ts b/internal/gen/proto/ts/runme/runner/v2alpha1/runner_pb.d.ts
index 481bf4986..0e29b29bf 100644
--- a/internal/gen/proto/ts/runme/runner/v2alpha1/runner_pb.d.ts
+++ b/internal/gen/proto/ts/runme/runner/v2alpha1/runner_pb.d.ts
@@ -243,6 +243,140 @@ export interface ExecuteResponse {
      */
     pid?: UInt32Value;
 }
+/**
+ * @generated from protobuf message runme.runner.v2alpha1.ResolveEnvRequest
+ */
+export interface ResolveEnvRequest {
+    /**
+     * @generated from protobuf oneof: source
+     */
+    source: {
+        oneofKind: "commands";
+        /**
+         * commands are commands to be executed by the program.
+         * The commands are joined and executed as a script.
+         *
+         * @generated from protobuf field: runme.runner.v2alpha1.ResolveEnvRequest.CommandList commands = 1;
+         */
+        commands: ResolveEnvRequest_CommandList;
+    } | {
+        oneofKind: "script";
+        /**
+         * script is code to be executed by the program.
+         * Individual lines are joined with the new line character.
+         *
+         * @generated from protobuf field: string script = 2;
+         */
+        script: string;
+    } | {
+        oneofKind: undefined;
+    };
+    /**
+     * env is a list of additional environment variables
+     * that will be injected to the executed program.
+     *
+     * @generated from protobuf field: repeated string env = 3;
+     */
+    env: string[];
+    /**
+     * session_strategy is a strategy for selecting the session.
+     *
+     * @generated from protobuf field: runme.runner.v2alpha1.SessionStrategy session_strategy = 4;
+     */
+    sessionStrategy: SessionStrategy;
+    /**
+     * project used to load environment variables from .env files.
+     *
+     * @generated from protobuf field: optional runme.runner.v2alpha1.Project project = 5;
+     */
+    project?: Project;
+}
+/**
+ * @generated from protobuf message runme.runner.v2alpha1.ResolveEnvRequest.CommandList
+ */
+export interface ResolveEnvRequest_CommandList {
+    /**
+     * commands are commands to be executed by the program.
+     * The commands are joined and executed as a script.
+     * For example: ["echo 'Hello, World'", "ls -l /etc"].
+     *
+     * @generated from protobuf field: repeated string items = 1;
+     */
+    items: string[];
+}
+/**
+ * @generated from protobuf message runme.runner.v2alpha1.ResolveEnvResponse
+ */
+export interface ResolveEnvResponse {
+    /**
+     * resolved_env is a list of resolved environment variables.
+     *
+     * @generated from protobuf field: repeated runme.runner.v2alpha1.ResolveEnvResponse.ResolvedEnv resolved_env = 1;
+     */
+    resolvedEnv: ResolveEnvResponse_ResolvedEnv[];
+    /**
+     * unresolved_env is a list of environment variables
+     * that couldn't be resolved.
+     *
+     * @generated from protobuf field: repeated runme.runner.v2alpha1.ResolveEnvResponse.UnresolvedEnv unresolved_env = 2;
+     */
+    unresolvedEnv: ResolveEnvResponse_UnresolvedEnv[];
+}
+/**
+ * @generated from protobuf message runme.runner.v2alpha1.ResolveEnvResponse.ResolvedEnv
+ */
+export interface ResolveEnvResponse_ResolvedEnv {
+    /**
+     * @generated from protobuf field: string key = 1;
+     */
+    key: string;
+    /**
+     * @generated from protobuf field: string original_value = 2;
+     */
+    originalValue: string;
+    /**
+     * @generated from protobuf field: string resolved_value = 3;
+     */
+    resolvedValue: string;
+    /**
+     * @generated from protobuf field: runme.runner.v2alpha1.ResolveEnvResponse.Source source = 4;
+     */
+    source: ResolveEnvResponse_Source;
+}
+/**
+ * @generated from protobuf message runme.runner.v2alpha1.ResolveEnvResponse.UnresolvedEnv
+ */
+export interface ResolveEnvResponse_UnresolvedEnv {
+    /**
+     * @generated from protobuf field: string key = 1;
+     */
+    key: string;
+    /**
+     * @generated from protobuf field: string original_value = 2;
+     */
+    originalValue: string;
+}
+/**
+ * @generated from protobuf enum runme.runner.v2alpha1.ResolveEnvResponse.Source
+ */
+export declare enum ResolveEnvResponse_Source {
+    /**
+     * @generated from protobuf enum value: SOURCE_UNSPECIFIED = 0;
+     */
+    UNSPECIFIED = 0,
+    /**
+     * @generated from protobuf enum value: SOURCE_ENV = 1;
+     */
+    ENV = 1,
+    /**
+     * @generated from protobuf enum value: SOURCE_SESSION = 2;
+     */
+    SESSION = 2,
+    /**
+     * @generated from protobuf enum value: SOURCE_PROJECT = 3;
+     */
+    PROJECT = 3
+}
 /**
  * @generated from protobuf enum runme.runner.v2alpha1.ExecuteStop
  */
@@ -373,6 +507,41 @@ declare class ExecuteResponse$Type extends MessageType<ExecuteResponse> {
  * @generated MessageType for protobuf message runme.runner.v2alpha1.ExecuteResponse
  */
 export declare const ExecuteResponse: ExecuteResponse$Type;
+declare class ResolveEnvRequest$Type extends MessageType<ResolveEnvRequest> {
+    constructor();
+}
+/**
+ * @generated MessageType for protobuf message runme.runner.v2alpha1.ResolveEnvRequest
+ */
+export declare const ResolveEnvRequest: ResolveEnvRequest$Type;
+declare class ResolveEnvRequest_CommandList$Type extends MessageType<ResolveEnvRequest_CommandList> {
+    constructor();
+}
+/**
+ * @generated MessageType for protobuf message runme.runner.v2alpha1.ResolveEnvRequest.CommandList
+ */
+export declare const ResolveEnvRequest_CommandList: ResolveEnvRequest_CommandList$Type;
+declare class ResolveEnvResponse$Type extends MessageType<ResolveEnvResponse> {
+    constructor();
+}
+/**
+ * @generated MessageType for protobuf message runme.runner.v2alpha1.ResolveEnvResponse
+ */
+export declare const ResolveEnvResponse: ResolveEnvResponse$Type;
+declare class ResolveEnvResponse_ResolvedEnv$Type extends MessageType<ResolveEnvResponse_ResolvedEnv> {
+    constructor();
+}
+/**
+ * @generated MessageType for protobuf message runme.runner.v2alpha1.ResolveEnvResponse.ResolvedEnv
+ */
+export declare const ResolveEnvResponse_ResolvedEnv: ResolveEnvResponse_ResolvedEnv$Type;
+declare class ResolveEnvResponse_UnresolvedEnv$Type extends MessageType<ResolveEnvResponse_UnresolvedEnv> {
+    constructor();
+}
+/**
+ * @generated MessageType for protobuf message runme.runner.v2alpha1.ResolveEnvResponse.UnresolvedEnv
+ */
+export declare const ResolveEnvResponse_UnresolvedEnv: ResolveEnvResponse_UnresolvedEnv$Type;
 /**
  * @generated ServiceType for protobuf service runme.runner.v2alpha1.RunnerService
  */
diff --git a/internal/gen/proto/ts/runme/runner/v2alpha1/runner_pb.js b/internal/gen/proto/ts/runme/runner/v2alpha1/runner_pb.js
index d43e90fad..440d82b2c 100644
--- a/internal/gen/proto/ts/runme/runner/v2alpha1/runner_pb.js
+++ b/internal/gen/proto/ts/runme/runner/v2alpha1/runner_pb.js
@@ -12,6 +12,28 @@ import { ServiceType } from "@protobuf-ts/runtime-rpc";
 import { MessageType } from "@protobuf-ts/runtime";
 import { UInt32Value } from "../../../google/protobuf/wrappers_pb";
 import { ProgramConfig } from "./config_pb";
+/**
+ * @generated from protobuf enum runme.runner.v2alpha1.ResolveEnvResponse.Source
+ */
+export var ResolveEnvResponse_Source;
+(function (ResolveEnvResponse_Source) {
+    /**
+     * @generated from protobuf enum value: SOURCE_UNSPECIFIED = 0;
+     */
+    ResolveEnvResponse_Source[ResolveEnvResponse_Source["UNSPECIFIED"] = 0] = "UNSPECIFIED";
+    /**
+     * @generated from protobuf enum value: SOURCE_ENV = 1;
+     */
+    ResolveEnvResponse_Source[ResolveEnvResponse_Source["ENV"] = 1] = "ENV";
+    /**
+     * @generated from protobuf enum value: SOURCE_SESSION = 2;
+     */
+    ResolveEnvResponse_Source[ResolveEnvResponse_Source["SESSION"] = 2] = "SESSION";
+    /**
+     * @generated from protobuf enum value: SOURCE_PROJECT = 3;
+     */
+    ResolveEnvResponse_Source[ResolveEnvResponse_Source["PROJECT"] = 3] = "PROJECT";
+})(ResolveEnvResponse_Source || (ResolveEnvResponse_Source = {}));
 /**
  * @generated from protobuf enum runme.runner.v2alpha1.ExecuteStop
  */
@@ -223,6 +245,75 @@ class ExecuteResponse$Type extends MessageType {
  * @generated MessageType for protobuf message runme.runner.v2alpha1.ExecuteResponse
  */
 export const ExecuteResponse = new ExecuteResponse$Type();
+// @generated message type with reflection information, may provide speed optimized methods
+class ResolveEnvRequest$Type extends MessageType {
+    constructor() {
+        super("runme.runner.v2alpha1.ResolveEnvRequest", [
+            { no: 1, name: "commands", kind: "message", oneof: "source", T: () => ResolveEnvRequest_CommandList },
+            { no: 2, name: "script", kind: "scalar", oneof: "source", T: 9 /*ScalarType.STRING*/ },
+            { no: 3, name: "env", kind: "scalar", repeat: 2 /*RepeatType.UNPACKED*/, T: 9 /*ScalarType.STRING*/ },
+            { no: 4, name: "session_strategy", kind: "enum", T: () => ["runme.runner.v2alpha1.SessionStrategy", SessionStrategy, "SESSION_STRATEGY_"] },
+            { no: 5, name: "project", kind: "message", T: () => Project }
+        ]);
+    }
+}
+/**
+ * @generated MessageType for protobuf message runme.runner.v2alpha1.ResolveEnvRequest
+ */
+export const ResolveEnvRequest = new ResolveEnvRequest$Type();
+// @generated message type with reflection information, may provide speed optimized methods
+class ResolveEnvRequest_CommandList$Type extends MessageType {
+    constructor() {
+        super("runme.runner.v2alpha1.ResolveEnvRequest.CommandList", [
+            { no: 1, name: "items", kind: "scalar", repeat: 2 /*RepeatType.UNPACKED*/, T: 9 /*ScalarType.STRING*/ }
+        ]);
+    }
+}
+/**
+ * @generated MessageType for protobuf message runme.runner.v2alpha1.ResolveEnvRequest.CommandList
+ */
+export const ResolveEnvRequest_CommandList = new ResolveEnvRequest_CommandList$Type();
+// @generated message type with reflection information, may provide speed optimized methods
+class ResolveEnvResponse$Type extends MessageType {
+    constructor() {
+        super("runme.runner.v2alpha1.ResolveEnvResponse", [
+            { no: 1, name: "resolved_env", kind: "message", repeat: 1 /*RepeatType.PACKED*/, T: () => ResolveEnvResponse_ResolvedEnv },
+            { no: 2, name: "unresolved_env", kind: "message", repeat: 1 /*RepeatType.PACKED*/, T: () => ResolveEnvResponse_UnresolvedEnv }
+        ]);
+    }
+}
+/**
+ * @generated MessageType for protobuf message runme.runner.v2alpha1.ResolveEnvResponse
+ */
+export const ResolveEnvResponse = new ResolveEnvResponse$Type();
+// @generated message type with reflection information, may provide speed optimized methods
+class ResolveEnvResponse_ResolvedEnv$Type extends MessageType {
+    constructor() {
+        super("runme.runner.v2alpha1.ResolveEnvResponse.ResolvedEnv", [
+            { no: 1, name: "key", kind: "scalar", T: 9 /*ScalarType.STRING*/ },
+            { no: 2, name: "original_value", kind: "scalar", T: 9 /*ScalarType.STRING*/ },
+            { no: 3, name: "resolved_value", kind: "scalar", T: 9 /*ScalarType.STRING*/ },
+            { no: 4, name: "source", kind: "enum", T: () => ["runme.runner.v2alpha1.ResolveEnvResponse.Source", ResolveEnvResponse_Source, "SOURCE_"] }
+        ]);
+    }
+}
+/**
+ * @generated MessageType for protobuf message runme.runner.v2alpha1.ResolveEnvResponse.ResolvedEnv
+ */
+export const ResolveEnvResponse_ResolvedEnv = new ResolveEnvResponse_ResolvedEnv$Type();
+// @generated message type with reflection information, may provide speed optimized methods
+class ResolveEnvResponse_UnresolvedEnv$Type extends MessageType {
+    constructor() {
+        super("runme.runner.v2alpha1.ResolveEnvResponse.UnresolvedEnv", [
+            { no: 1, name: "key", kind: "scalar", T: 9 /*ScalarType.STRING*/ },
+            { no: 2, name: "original_value", kind: "scalar", T: 9 /*ScalarType.STRING*/ }
+        ]);
+    }
+}
+/**
+ * @generated MessageType for protobuf message runme.runner.v2alpha1.ResolveEnvResponse.UnresolvedEnv
+ */
+export const ResolveEnvResponse_UnresolvedEnv = new ResolveEnvResponse_UnresolvedEnv$Type();
 /**
  * @generated ServiceType for protobuf service runme.runner.v2alpha1.RunnerService
  */
@@ -231,5 +322,6 @@ export const RunnerService = new ServiceType("runme.runner.v2alpha1.RunnerServic
     { name: "GetSession", options: {}, I: GetSessionRequest, O: GetSessionResponse },
     { name: "ListSessions", options: {}, I: ListSessionsRequest, O: ListSessionsResponse },
     { name: "DeleteSession", options: {}, I: DeleteSessionRequest, O: DeleteSessionResponse },
-    { name: "Execute", serverStreaming: true, clientStreaming: true, options: {}, I: ExecuteRequest, O: ExecuteResponse }
+    { name: "Execute", serverStreaming: true, clientStreaming: true, options: {}, I: ExecuteRequest, O: ExecuteResponse },
+    { name: "ResolveEnv", options: {}, I: ResolveEnvRequest, O: ResolveEnvResponse }
 ]);