openpond 0.0.30-bootstrap.0

package/dist/chunks/chunk-BYAPLT37.js

@@ -0,0 +1,744 @@
+import { createRequire as __openpondCreateRequire } from "node:module"; var require = __openpondCreateRequire(import.meta.url);
+import {
+  external_exports,
+  yaml
+} from "./chunk-WYDVQOBL.js";
+
+// ../../packages/cloud/src/sandbox-template/manifest.ts
+var SANDBOX_TEMPLATE_PREVIEW_PORT_MIN = 3e3;
+var SANDBOX_TEMPLATE_PREVIEW_PORT_MAX = 9999;
+var OPENPOND_MANIFEST_FILE_NAME = "openpond.yaml";
+var SANDBOX_TEMPLATE_BUILD_PLAN_FILE_NAME = "openpond-template-plan.json";
+var SANDBOX_TEMPLATE_BUILD_PLAN_KIND = "openpond.sandboxTemplate.buildPlan.v1";
+var INTEGRATION_PROVIDERS = [
+  "google",
+  "github",
+  "x"
+];
+var RESERVED_PREVIEW_PORTS = /* @__PURE__ */ new Set([
+  22,
+  2222,
+  2375,
+  2376,
+  3108,
+  5900,
+  5901,
+  6080,
+  7818
+]);
+var CommandListSchema = external_exports.array(external_exports.string().trim().min(1).max(1e3)).max(50);
+var RelativeWorkspacePathSchema = external_exports.string().trim().min(1).max(4096).refine(isSafeRelativeWorkspacePath, {
+  message: "path must be a relative workspace path"
+});
+var OciImageRefSchema = external_exports.string().trim().min(1).max(500).refine(
+  (value) => !value.includes("\0") && !/\s/.test(value),
+  "image ref must be a single OCI reference"
+);
+var OciDigestSchema = external_exports.string().trim().regex(/^sha256:[0-9a-f]{64}$/i);
+var RuntimeWorkspaceRootSchema = external_exports.string().trim().min(1).max(500).refine(
+  (value) => value.startsWith("/") && !value.includes("\0"),
+  "workspaceRoot must be an absolute guest path"
+);
+var DockerfileRuntimeImageSchema = external_exports.object({
+  ref: OciImageRefSchema,
+  digest: OciDigestSchema.optional(),
+  registrySecretRef: external_exports.string().trim().min(1).max(500).optional(),
+  platform: external_exports.literal("linux/amd64").optional(),
+  workspaceRoot: RuntimeWorkspaceRootSchema.optional()
+}).strict();
+var DockerfileRuntimeSourceSchema = external_exports.object({
+  context: RelativeWorkspacePathSchema.default("."),
+  path: RelativeWorkspacePathSchema.default("Dockerfile"),
+  target: external_exports.string().trim().min(1).max(191).optional(),
+  buildArgs: external_exports.record(external_exports.string().max(191), external_exports.string().max(500)).optional(),
+  registrySecretRefs: external_exports.array(external_exports.string().trim().min(1).max(500)).max(10).optional(),
+  platform: external_exports.literal("linux/amd64").optional(),
+  workspaceRoot: RuntimeWorkspaceRootSchema.optional()
+}).strict();
+var SandboxTemplateRuntimeSchema = external_exports.object({
+  base: external_exports.string().trim().min(1).max(120).optional(),
+  snapshot: external_exports.string().trim().min(1).max(191).optional(),
+  image: DockerfileRuntimeImageSchema.optional(),
+  dockerfile: DockerfileRuntimeSourceSchema.optional()
+}).strict().superRefine((runtime, context) => {
+  const selected = [
+    runtime.base,
+    runtime.snapshot,
+    runtime.image,
+    runtime.dockerfile
+  ].filter(Boolean).length;
+  if (selected !== 1) {
+    context.addIssue({
+      code: external_exports.ZodIssueCode.custom,
+      message: "runtime must declare exactly one of base, snapshot, image, or dockerfile"
+    });
+  }
+});
+var SandboxTemplateResourcesSchema = external_exports.object({
+  cpu: external_exports.number().positive().max(8).optional(),
+  memoryGb: external_exports.number().positive().max(32).optional(),
+  diskGb: external_exports.number().positive().max(100).optional()
+}).strict();
+var SandboxTemplateRequiredLeaseSchema = external_exports.object({
+  provider: external_exports.enum(INTEGRATION_PROVIDERS),
+  scopes: external_exports.array(external_exports.string().trim().min(1).max(200)).max(100).default([]),
+  capabilities: external_exports.array(external_exports.string().trim().min(1).max(200)).max(100).default([])
+}).strict();
+var SandboxTemplateOpChatPermissionsSchema = external_exports.object({
+  models: external_exports.array(external_exports.string().trim().min(1).max(200)).max(100).default([]),
+  scopes: external_exports.array(external_exports.string().trim().min(1).max(200)).max(100).default([])
+}).strict();
+var SandboxTemplatePermissionsSchema = external_exports.object({
+  opchat: SandboxTemplateOpChatPermissionsSchema.optional()
+}).catchall(external_exports.record(external_exports.string(), external_exports.unknown())).default({});
+var SandboxTemplateVolumeSchema = external_exports.object({
+  name: external_exports.string().trim().regex(/^[A-Za-z_][A-Za-z0-9_-]*$/).max(63).optional(),
+  mountPath: external_exports.string().trim().min(1).max(256).optional(),
+  storageGb: external_exports.number().int().positive().max(100).optional(),
+  deleteOnSandboxDelete: external_exports.boolean().optional()
+}).strict();
+var SandboxTemplatePortSchema = external_exports.object({
+  port: external_exports.number().int().min(SANDBOX_TEMPLATE_PREVIEW_PORT_MIN).max(SANDBOX_TEMPLATE_PREVIEW_PORT_MAX).refine((port) => !RESERVED_PREVIEW_PORTS.has(port), {
+    message: "preview port is reserved"
+  }),
+  protocol: external_exports.literal("http").default("http"),
+  label: external_exports.string().trim().min(1).max(80).optional(),
+  access: external_exports.enum(["private", "public"]).default("private"),
+  path: external_exports.string().trim().min(1).max(512).refine((value) => value.startsWith("/"), {
+    message: "preview path must start with /"
+  }).default("/")
+}).strict();
+var SandboxTemplateCommandSchema = external_exports.object({
+  command: external_exports.string().trim().min(1).max(1e3),
+  cwd: RelativeWorkspacePathSchema.optional(),
+  timeoutSeconds: external_exports.number().int().positive().max(86400).optional(),
+  requiresStart: external_exports.boolean().default(false),
+  ports: external_exports.array(SandboxTemplatePortSchema).max(20).default([]),
+  artifactPaths: external_exports.array(RelativeWorkspacePathSchema).max(100).default([])
+}).strict();
+var SandboxTemplateNamedCommandSchema = SandboxTemplateCommandSchema.extend({
+  name: external_exports.string().trim().min(1).max(80)
+}).strict();
+var SandboxTemplateMcpEndpointSchema = external_exports.object({
+  name: external_exports.string().trim().min(1).max(80).optional(),
+  service: external_exports.string().trim().min(1).max(80).optional(),
+  port: external_exports.number().int().min(SANDBOX_TEMPLATE_PREVIEW_PORT_MIN).max(SANDBOX_TEMPLATE_PREVIEW_PORT_MAX).refine((port) => !RESERVED_PREVIEW_PORTS.has(port), {
+    message: "app MCP port is reserved"
+  }),
+  path: external_exports.string().trim().min(1).max(512).refine((value) => value.startsWith("/"), {
+    message: "app MCP path must start with /"
+  }).default("/mcp")
+}).strict();
+var SandboxTemplateValidationProbeSchema = external_exports.object({
+  name: external_exports.string().trim().min(1).max(80).optional(),
+  port: external_exports.number().int().min(SANDBOX_TEMPLATE_PREVIEW_PORT_MIN).max(SANDBOX_TEMPLATE_PREVIEW_PORT_MAX).refine((port) => !RESERVED_PREVIEW_PORTS.has(port), {
+    message: "validation probe port is reserved"
+  }),
+  path: external_exports.string().trim().min(1).max(512).refine((value) => value.startsWith("/"), {
+    message: "validation probe path must start with /"
+  }).default("/"),
+  expectedStatus: external_exports.number().int().min(100).max(599).default(200)
+}).strict();
+var SandboxTemplateJsonSchema = external_exports.record(external_exports.string(), external_exports.unknown()).refine(
+  (schema) => schema.type === "object",
+  "input schema must be a JSON schema object"
+);
+var SandboxTemplateEnvInputSchema = external_exports.object({
+  name: external_exports.string().trim().regex(/^[A-Za-z_][A-Za-z0-9_]*$/).max(191),
+  required: external_exports.boolean().default(false),
+  secret: external_exports.boolean().default(true),
+  description: external_exports.string().trim().max(500).optional()
+}).strict();
+var SandboxTemplateScheduleDateSchema = external_exports.string().trim().min(1).max(120);
+var SandboxTemplateScheduleSchema = external_exports.object({
+  name: external_exports.string().trim().min(1).max(120),
+  description: external_exports.string().trim().max(500).optional(),
+  cron: external_exports.string().trim().min(1).max(500).optional(),
+  rate: external_exports.string().trim().min(1).max(500).optional(),
+  once: SandboxTemplateScheduleDateSchema.optional(),
+  scheduleType: external_exports.enum(["rate", "cron", "once"]).optional(),
+  scheduleExpression: external_exports.string().trim().min(1).max(500).optional(),
+  timezone: external_exports.string().trim().min(1).max(100).optional(),
+  enabled: external_exports.boolean().default(true),
+  startAt: SandboxTemplateScheduleDateSchema.optional(),
+  endAt: SandboxTemplateScheduleDateSchema.optional(),
+  maxRuns: external_exports.number().int().positive().nullable().optional(),
+  runtimePolicy: external_exports.enum([
+    "run_and_stop",
+    "run_and_archive",
+    "run_and_delete",
+    "use_existing_running"
+  ]).default("run_and_stop"),
+  action: external_exports.string().trim().min(1).max(120).optional(),
+  actionName: external_exports.string().trim().min(1).max(120).optional(),
+  command: external_exports.string().trim().min(1).max(2e3).optional(),
+  target: external_exports.object({
+    kind: external_exports.enum(["start", "action", "service", "command"]).optional(),
+    name: external_exports.string().trim().min(1).max(120).optional(),
+    actionName: external_exports.string().trim().min(1).max(120).optional(),
+    command: external_exports.string().trim().min(1).max(2e3).optional(),
+    requiresStart: external_exports.boolean().optional()
+  }).strict().optional(),
+  requiresStart: external_exports.boolean().optional(),
+  budget: external_exports.object({
+    maxUsd: external_exports.string().trim().min(1).max(40).optional()
+  }).strict().optional(),
+  resources: SandboxTemplateResourcesSchema.optional(),
+  quotas: external_exports.record(external_exports.string(), external_exports.unknown()).optional(),
+  lifecycle: external_exports.record(external_exports.string(), external_exports.unknown()).optional(),
+  retentionPolicy: external_exports.record(external_exports.string(), external_exports.unknown()).optional(),
+  env: external_exports.array(
+    external_exports.object({
+      name: external_exports.string().trim().regex(/^[A-Za-z_][A-Za-z0-9_]*$/).max(191),
+      value: external_exports.string().optional(),
+      secretRef: external_exports.string().optional()
+    }).strict()
+  ).max(100).optional(),
+  integrationLeases: external_exports.array(external_exports.record(external_exports.string(), external_exports.unknown())).max(20).optional(),
+  metadata: external_exports.record(external_exports.string(), external_exports.unknown()).optional()
+}).strict().superRefine((schedule, context) => {
+  const expressionCount = [
+    schedule.cron,
+    schedule.rate,
+    schedule.once,
+    schedule.scheduleExpression
+  ].filter((value) => typeof value === "string" && value.trim()).length;
+  if (expressionCount !== 1) {
+    context.addIssue({
+      code: external_exports.ZodIssueCode.custom,
+      path: ["scheduleExpression"],
+      message: "schedule must declare exactly one of cron, rate, once, or scheduleExpression"
+    });
+  }
+  if (schedule.scheduleExpression && !schedule.scheduleType) {
+    context.addIssue({
+      code: external_exports.ZodIssueCode.custom,
+      path: ["scheduleType"],
+      message: "scheduleType is required with scheduleExpression"
+    });
+  }
+  const command = schedule.command ?? schedule.target?.command ?? null;
+  const targetName = schedule.target?.name ?? null;
+  const actionName = schedule.actionName ?? schedule.action ?? schedule.target?.actionName ?? (schedule.target?.kind === "action" ? targetName : null);
+  const kind = schedule.target?.kind ?? (command ? "command" : "action");
+  if (kind === "action" && !actionName) {
+    context.addIssue({
+      code: external_exports.ZodIssueCode.custom,
+      path: ["action"],
+      message: "schedule action target is required"
+    });
+  }
+  if (kind === "service" && !targetName) {
+    context.addIssue({
+      code: external_exports.ZodIssueCode.custom,
+      path: ["target", "name"],
+      message: "schedule service target name is required"
+    });
+  }
+  if (kind === "command" && !command) {
+    context.addIssue({
+      code: external_exports.ZodIssueCode.custom,
+      path: ["command"],
+      message: "schedule command target is required"
+    });
+  }
+});
+var SandboxTemplateManifestSchema = external_exports.object({
+  schemaVersion: external_exports.literal(1),
+  name: external_exports.string().trim().min(1).max(80).regex(/^[a-z0-9][a-z0-9-]*[a-z0-9]$/),
+  version: external_exports.string().trim().min(1).max(40),
+  useCase: external_exports.string().trim().min(1).max(80),
+  description: external_exports.string().trim().min(1).max(500),
+  runtime: SandboxTemplateRuntimeSchema,
+  resources: SandboxTemplateResourcesSchema.optional(),
+  setup: external_exports.object({
+    commands: CommandListSchema.default([])
+  }).strict().default({ commands: [] }),
+  validation: external_exports.object({
+    commands: CommandListSchema.min(1),
+    probes: external_exports.array(SandboxTemplateValidationProbeSchema).max(20).default([])
+  }).strict(),
+  start: SandboxTemplateCommandSchema,
+  actions: external_exports.array(SandboxTemplateNamedCommandSchema).max(20).default([]),
+  services: external_exports.array(SandboxTemplateNamedCommandSchema).max(20).default([]),
+  schedules: external_exports.array(SandboxTemplateScheduleSchema).max(20).default([]),
+  mcp: external_exports.object({
+    endpoints: external_exports.array(SandboxTemplateMcpEndpointSchema).max(10).default([])
+  }).strict().default({ endpoints: [] }),
+  volumes: external_exports.array(SandboxTemplateVolumeSchema).max(5).default([]),
+  integrations: external_exports.object({
+    requiredLeases: external_exports.array(SandboxTemplateRequiredLeaseSchema).max(20).default([])
+  }).strict().default({ requiredLeases: [] }),
+  permissions: SandboxTemplatePermissionsSchema,
+  inputs: external_exports.object({
+    schema: SandboxTemplateJsonSchema.default({ type: "object" }),
+    env: external_exports.array(SandboxTemplateEnvInputSchema).max(100).default([])
+  }).strict().default({ schema: { type: "object" }, env: [] }),
+  artifacts: external_exports.object({
+    paths: external_exports.array(RelativeWorkspacePathSchema).max(100).default([])
+  }).strict().default({ paths: [] }),
+  network: external_exports.object({
+    egress: external_exports.enum(["restricted", "allow", "block"]).default("restricted")
+  }).strict().default({ egress: "restricted" })
+}).strict().superRefine((manifest, context) => {
+  validateExecutableNames(manifest, context);
+  addDuplicateNameIssue(
+    context,
+    manifest.volumes.flatMap((volume) => volume.name ? [volume.name] : []),
+    "volume names must be unique",
+    "volumes"
+  );
+  validateInputSchemaUploadTargets(manifest, context);
+  validateEnvInputs(manifest, context);
+  validateMcpEndpoints(manifest, context);
+  validateScheduleTargets(manifest, context);
+});
+var SandboxTemplateValidationDiagnosticSchema = external_exports.object({
+  path: external_exports.string(),
+  message: external_exports.string(),
+  code: external_exports.string()
+});
+function validateSandboxTemplateYaml(source) {
+  let parsed;
+  try {
+    parsed = yaml.load(source);
+  } catch (error) {
+    return {
+      ok: false,
+      manifest: null,
+      diagnostics: [
+        {
+          path: "$",
+          code: "invalid_yaml",
+          message: error instanceof Error ? error.message : "Invalid YAML"
+        }
+      ]
+    };
+  }
+  return validateSandboxTemplateManifest(parsed);
+}
+function validateSandboxTemplateManifest(value) {
+  if (!value || typeof value !== "object" || Array.isArray(value)) {
+    return {
+      ok: false,
+      manifest: null,
+      diagnostics: [
+        {
+          path: "$",
+          code: "invalid_type",
+          message: `${OPENPOND_MANIFEST_FILE_NAME} must be an object`
+        }
+      ]
+    };
+  }
+  if (Object.prototype.hasOwnProperty.call(value, "databases")) {
+    return {
+      ok: false,
+      manifest: null,
+      diagnostics: [
+        {
+          path: "$.databases",
+          code: "database_resources_removed",
+          message: "managed database requests are unsupported for Firecracker sandbox templates; use a durable volume with SQLite or files instead"
+        }
+      ]
+    };
+  }
+  const result = SandboxTemplateManifestSchema.safeParse(value);
+  if (result.success)
+    return { ok: true, manifest: result.data, diagnostics: [] };
+  return {
+    ok: false,
+    manifest: null,
+    diagnostics: result.error.issues.map((issue) => ({
+      path: formatIssuePath(issue.path),
+      code: issue.code,
+      message: issue.message
+    }))
+  };
+}
+function formatSandboxTemplateDiagnostics(diagnostics) {
+  return diagnostics.map((diagnostic) => `${diagnostic.path}: ${diagnostic.message}`).join("\n");
+}
+function sandboxTemplateExecutableEntries(manifest) {
+  return [
+    {
+      kind: "start",
+      name: "start",
+      ...manifest.start,
+      artifactPaths: commandArtifactPaths(manifest.start, manifest)
+    },
+    ...manifest.actions.map((action) => ({
+      kind: "action",
+      name: action.name,
+      command: action.command,
+      cwd: action.cwd,
+      timeoutSeconds: action.timeoutSeconds,
+      requiresStart: action.requiresStart,
+      ports: action.ports,
+      artifactPaths: commandArtifactPaths(action, manifest)
+    })),
+    ...manifest.services.map((service) => ({
+      kind: "service",
+      name: service.name,
+      command: service.command,
+      cwd: service.cwd,
+      timeoutSeconds: service.timeoutSeconds,
+      requiresStart: service.requiresStart,
+      ports: service.ports,
+      artifactPaths: commandArtifactPaths(service, manifest)
+    }))
+  ];
+}
+function sandboxTemplateBuildMetadata(manifest) {
+  const executables = sandboxTemplateExecutableEntries(manifest);
+  return {
+    template: {
+      name: manifest.name,
+      version: manifest.version,
+      useCase: manifest.useCase,
+      runtime: manifest.runtime
+    },
+    resources: manifest.resources ?? null,
+    volumes: manifest.volumes,
+    executables: executables.map((entry) => ({
+      kind: entry.kind,
+      name: entry.name,
+      command: entry.command,
+      cwd: entry.cwd ?? null,
+      timeoutSeconds: entry.timeoutSeconds ?? null,
+      requiresStart: entry.requiresStart,
+      ports: entry.ports.map((port) => port.port),
+      artifactPaths: entry.artifactPaths
+    })),
+    ports: executables.flatMap(
+      (entry) => entry.ports.map((port) => ({
+        executable: entry.name,
+        kind: entry.kind,
+        port: port.port,
+        access: port.access,
+        label: port.label ?? null
+      }))
+    ),
+    appMcpEndpoints: manifest.mcp.endpoints.map((endpoint) => ({
+      name: endpoint.name ?? null,
+      service: endpoint.service ?? null,
+      port: endpoint.port,
+      path: endpoint.path
+    })),
+    validation: {
+      commands: manifest.validation.commands,
+      probes: manifest.validation.probes
+    },
+    schedules: manifest.schedules
+  };
+}
+function sandboxTemplateBuildPlan(input) {
+  return {
+    kind: SANDBOX_TEMPLATE_BUILD_PLAN_KIND,
+    schemaVersion: 1,
+    manifestFile: input.manifestFile,
+    projectRoot: input.projectRoot,
+    manifest: input.manifest,
+    metadata: sandboxTemplateBuildMetadata(input.manifest),
+    executables: sandboxTemplateExecutableEntries(input.manifest)
+  };
+}
+function sandboxTemplateScaffoldFiles(input) {
+  const displayName = input.name.trim() || "Sandbox Template";
+  const name = slug(displayName);
+  const description = input.description?.trim() || `Local scaffold for ${displayName}.`;
+  return {
+    ".gitignore": ["node_modules", "artifacts", ".DS_Store", ""].join("\n"),
+    "README.md": [
+      `# ${displayName}`,
+      "",
+      "Local sandbox template scaffold.",
+      "",
+      "## Commands",
+      "",
+      "- `pnpm dev` starts the preview service on port 3000.",
+      "- `pnpm process` writes a sample artifact.",
+      `- \`pnpm validate\` validates ${OPENPOND_MANIFEST_FILE_NAME}.`,
+      ""
+    ].join("\n"),
+    "package.json": `${JSON.stringify(
+      {
+        private: true,
+        type: "module",
+        scripts: {
+          dev: "node src/server.ts",
+          process: "node scripts/process.ts",
+          validate: `openpond sandbox-template validate --file ${OPENPOND_MANIFEST_FILE_NAME}`
+        }
+      },
+      null,
+      2
+    )}
+`,
+    [OPENPOND_MANIFEST_FILE_NAME]: [
+      "schemaVersion: 1",
+      `name: ${name}`,
+      "version: 0.1.0",
+      "useCase: sandbox-template-scaffold",
+      `description: ${description}`,
+      "runtime:",
+      "  base: node-bun-workspace",
+      "resources:",
+      "  cpu: 1",
+      "  memoryGb: 1",
+      "  diskGb: 8",
+      "setup:",
+      "  commands:",
+      "    - mkdir -p artifacts",
+      "validation:",
+      "  commands:",
+      "    - test -f src/server.ts",
+      "    - test -f scripts/process.ts",
+      "start:",
+      "  command: pnpm process",
+      "  timeoutSeconds: 300",
+      "  ports: []",
+      "  artifactPaths:",
+      "    - artifacts/result.json",
+      "actions: []",
+      "schedules: []",
+      "services:",
+      "  - name: web",
+      "    command: pnpm dev",
+      "    timeoutSeconds: 3600",
+      "    ports:",
+      "      - port: 3000",
+      "        protocol: http",
+      "        label: web",
+      "        access: private",
+      "        path: /",
+      "    artifactPaths: []",
+      "inputs:",
+      "  env:",
+      "    - name: FOO_API_KEY",
+      "      required: false",
+      "      secret: true",
+      "      description: API key used by the sample action.",
+      "  schema:",
+      "    type: object",
+      "    properties:",
+      "      subject:",
+      "        type: string",
+      "        title: Subject",
+      "        default: Example",
+      "artifacts:",
+      "  paths:",
+      "    - artifacts/result.json",
+      "network:",
+      "  egress: restricted",
+      ""
+    ].join("\n"),
+    "src/server.ts": [
+      "import { createServer } from 'node:http';",
+      "",
+      "createServer((_request, response) => {",
+      "  response.setHeader('content-type', 'application/json');",
+      "  response.end(JSON.stringify({ ok: true, template: 'sandbox-template-scaffold' }));",
+      "}).listen(3000, '0.0.0.0');",
+      ""
+    ].join("\n"),
+    "scripts/process.ts": [
+      "import { mkdir, writeFile } from 'node:fs/promises';",
+      "",
+      "const raw = process.env.OPENPOND_REPLAY_PARAMS_BASE64;",
+      "const params = raw ? JSON.parse(Buffer.from(raw, 'base64').toString('utf8')).input ?? {} : {};",
+      "await mkdir('artifacts', { recursive: true });",
+      "await writeFile('artifacts/result.json', JSON.stringify({ ok: true, input: params }, null, 2));",
+      "console.log('wrote artifacts/result.json');",
+      ""
+    ].join("\n"),
+    "fixtures/input.txt": "Example input\n"
+  };
+}
+function sandboxTemplateJsonSchema() {
+  return external_exports.toJSONSchema(SandboxTemplateManifestSchema);
+}
+function isSafeRelativeWorkspacePath(value) {
+  return !value.includes("\0") && !value.startsWith("/") && !value.split(/[\\/]+/).some((segment) => segment === ".." || segment === "");
+}
+function formatIssuePath(path) {
+  if (path.length === 0) return "$";
+  return `$${path.map(
+    (part) => typeof part === "number" ? `[${part}]` : `.${String(part)}`
+  ).join("")}`;
+}
+function addDuplicateNameIssue(context, names, message, path) {
+  const seen = /* @__PURE__ */ new Set();
+  for (const name of names) {
+    if (seen.has(name)) {
+      context.addIssue({
+        code: external_exports.ZodIssueCode.custom,
+        path: [path],
+        message
+      });
+      return;
+    }
+    seen.add(name);
+  }
+}
+function validateExecutableNames(manifest, context) {
+  const names = [
+    "start",
+    ...manifest.actions.map((action) => action.name),
+    ...manifest.services.map((service) => service.name)
+  ];
+  addDuplicateNameIssue(
+    context,
+    names,
+    "start, action, and service names must be unique",
+    "actions"
+  );
+}
+function validateInputSchemaUploadTargets(manifest, context) {
+  const properties = asRecord(manifest.inputs.schema.properties);
+  const volumeNames = new Set(
+    manifest.volumes.map((volume) => volume.name).filter((name) => Boolean(name))
+  );
+  for (const [inputName, rawProperty] of Object.entries(properties)) {
+    const property = asRecord(rawProperty);
+    const upload = asRecord(
+      property["x-openpond-upload"] ?? property.xOpenPondUpload
+    );
+    const targetPath = typeof upload.targetPath === "string" && upload.targetPath.trim() ? upload.targetPath.trim() : typeof upload.path === "string" && upload.path.trim() ? upload.path.trim() : "";
+    if (!targetPath) continue;
+    const normalizedTargetPath = targetPath.replace(/^workspace\//, "").replace(/^\/+/, "").replace(/\/+$/, "");
+    if (!isSafeRelativeWorkspacePath(normalizedTargetPath)) {
+      context.addIssue({
+        code: external_exports.ZodIssueCode.custom,
+        path: [
+          "inputs",
+          "schema",
+          "properties",
+          inputName,
+          "x-openpond-upload",
+          "targetPath"
+        ],
+        message: "upload target must be a relative workspace path"
+      });
+      continue;
+    }
+    const parts = normalizedTargetPath.split("/");
+    if (parts[0] === "volumes" && (!parts[1] || !volumeNames.has(parts[1]))) {
+      context.addIssue({
+        code: external_exports.ZodIssueCode.custom,
+        path: [
+          "inputs",
+          "schema",
+          "properties",
+          inputName,
+          "x-openpond-upload",
+          "targetPath"
+        ],
+        message: "upload target references an undeclared volume"
+      });
+    }
+  }
+}
+function validateEnvInputs(manifest, context) {
+  addDuplicateNameIssue(
+    context,
+    manifest.inputs.env.map((env) => env.name),
+    "env input names must be unique",
+    "inputs"
+  );
+}
+function validateMcpEndpoints(manifest, context) {
+  const servicePorts = new Map(
+    manifest.services.map((service) => [
+      service.name,
+      new Set(service.ports.map((port) => port.port))
+    ])
+  );
+  const declaredPorts = /* @__PURE__ */ new Set([
+    ...manifest.start.ports.map((port) => port.port),
+    ...manifest.services.flatMap(
+      (service) => service.ports.map((port) => port.port)
+    )
+  ]);
+  for (const [index, endpoint] of manifest.mcp.endpoints.entries()) {
+    if (endpoint.service) {
+      const ports = servicePorts.get(endpoint.service);
+      if (!ports) {
+        context.addIssue({
+          code: external_exports.ZodIssueCode.custom,
+          path: ["mcp", "endpoints", index, "service"],
+          message: `app MCP service does not exist: ${endpoint.service}`
+        });
+        continue;
+      }
+      if (!ports.has(endpoint.port)) {
+        context.addIssue({
+          code: external_exports.ZodIssueCode.custom,
+          path: ["mcp", "endpoints", index, "port"],
+          message: `app MCP port ${endpoint.port} is not declared on service ${endpoint.service}`
+        });
+      }
+      continue;
+    }
+    if (!declaredPorts.has(endpoint.port)) {
+      context.addIssue({
+        code: external_exports.ZodIssueCode.custom,
+        path: ["mcp", "endpoints", index, "port"],
+        message: `app MCP port ${endpoint.port} is not declared on start or services`
+      });
+    }
+  }
+}
+function validateScheduleTargets(manifest, context) {
+  const actionNames = new Set(manifest.actions.map((action) => action.name));
+  const serviceNames = new Set(
+    manifest.services.map((service) => service.name)
+  );
+  for (const [index, schedule] of manifest.schedules.entries()) {
+    const command = schedule.command ?? schedule.target?.command ?? null;
+    if (schedule.target?.kind === "command" || command) {
+      continue;
+    }
+    const actionName = schedule.actionName ?? schedule.action ?? schedule.target?.actionName ?? (schedule.target?.kind === "action" ? schedule.target?.name : null);
+    if (actionName && !actionNames.has(actionName)) {
+      context.addIssue({
+        code: external_exports.ZodIssueCode.custom,
+        path: ["schedules", index, "action"],
+        message: `schedule action target does not exist: ${actionName}`
+      });
+    }
+    if (schedule.target?.kind === "service") {
+      const serviceName = schedule.target.name ?? "";
+      if (serviceName && !serviceNames.has(serviceName)) {
+        context.addIssue({
+          code: external_exports.ZodIssueCode.custom,
+          path: ["schedules", index, "target", "name"],
+          message: `schedule service target does not exist: ${serviceName}`
+        });
+      }
+    }
+  }
+}
+function asRecord(value) {
+  return value && typeof value === "object" && !Array.isArray(value) ? value : {};
+}
+function commandArtifactPaths(command, manifest) {
+  return command.artifactPaths.length > 0 ? command.artifactPaths : manifest.artifacts.paths;
+}
+function slug(value) {
+  return value.toLowerCase().replace(/[^a-z0-9-]+/g, "-").replace(/^-+|-+$/g, "").replace(/-{2,}/g, "-").slice(0, 80) || "sandbox-template";
+}
+
+export {
+  OPENPOND_MANIFEST_FILE_NAME,
+  SANDBOX_TEMPLATE_BUILD_PLAN_FILE_NAME,
+  SANDBOX_TEMPLATE_BUILD_PLAN_KIND,
+  validateSandboxTemplateYaml,
+  formatSandboxTemplateDiagnostics,
+  sandboxTemplateExecutableEntries,
+  sandboxTemplateBuildMetadata,
+  sandboxTemplateBuildPlan,
+  sandboxTemplateScaffoldFiles,
+  sandboxTemplateJsonSchema
+};