openpond 0.0.38 → 0.0.39

package/dist/chunks/chunk-XEJ7XXUQ.js

@@ -1,1301 +0,0 @@
-import { createRequire as __openpondCreateRequire } from "node:module"; var require = __openpondCreateRequire(import.meta.url);
-import {
-  external_exports,
-  yaml
-} from "./chunk-WYDVQOBL.js";
-
-// ../../packages/cloud/dist/sandbox-template/manifest.js
-var SANDBOX_TEMPLATE_PREVIEW_PORT_MIN = 3e3;
-var SANDBOX_TEMPLATE_PREVIEW_PORT_MAX = 9999;
-var OPENPOND_MANIFEST_FILE_NAME = "openpond.yaml";
-var SANDBOX_TEMPLATE_BUILD_PLAN_FILE_NAME = "openpond-template-plan.json";
-var SANDBOX_TEMPLATE_BUILD_PLAN_KIND = "openpond.sandboxTemplate.buildPlan.v1";
-var INTEGRATION_PROVIDERS = [
-  "google",
-  "github",
-  "x"
-];
-var RESERVED_PREVIEW_PORTS = /* @__PURE__ */ new Set([
-  22,
-  2222,
-  2375,
-  2376,
-  3108,
-  5900,
-  5901,
-  6080,
-  7818
-]);
-var CommandListSchema = external_exports.array(external_exports.string().trim().min(1).max(1e3)).max(50);
-var RelativeWorkspacePathSchema = external_exports.string().trim().min(1).max(4096).refine(isSafeRelativeWorkspacePath, {
-  message: "path must be a relative workspace path"
-});
-var OciImageRefSchema = external_exports.string().trim().min(1).max(500).refine((value) => !value.includes("\0") && !/\s/.test(value), "image ref must be a single OCI reference");
-var OciDigestSchema = external_exports.string().trim().regex(/^sha256:[0-9a-f]{64}$/i);
-var RuntimeWorkspaceRootSchema = external_exports.string().trim().min(1).max(500).refine((value) => value.startsWith("/") && !value.includes("\0"), "workspaceRoot must be an absolute guest path");
-var DockerfileRuntimeImageSchema = external_exports.object({
-  ref: OciImageRefSchema,
-  digest: OciDigestSchema.optional(),
-  registrySecretRef: external_exports.string().trim().min(1).max(500).optional(),
-  platform: external_exports.literal("linux/amd64").optional(),
-  workspaceRoot: RuntimeWorkspaceRootSchema.optional()
-}).strict();
-var DockerfileRuntimeSourceSchema = external_exports.object({
-  context: RelativeWorkspacePathSchema.default("."),
-  path: RelativeWorkspacePathSchema.default("Dockerfile"),
-  target: external_exports.string().trim().min(1).max(191).optional(),
-  buildArgs: external_exports.record(external_exports.string().max(191), external_exports.string().max(500)).optional(),
-  registrySecretRefs: external_exports.array(external_exports.string().trim().min(1).max(500)).max(10).optional(),
-  platform: external_exports.literal("linux/amd64").optional(),
-  workspaceRoot: RuntimeWorkspaceRootSchema.optional()
-}).strict();
-var SandboxTemplateRuntimeSchema = external_exports.object({
-  base: external_exports.string().trim().min(1).max(120).optional(),
-  snapshot: external_exports.string().trim().min(1).max(191).optional(),
-  image: DockerfileRuntimeImageSchema.optional(),
-  dockerfile: DockerfileRuntimeSourceSchema.optional()
-}).strict().superRefine((runtime, context) => {
-  const selected = [
-    runtime.base,
-    runtime.snapshot,
-    runtime.image,
-    runtime.dockerfile
-  ].filter(Boolean).length;
-  if (selected !== 1) {
-    context.addIssue({
-      code: external_exports.ZodIssueCode.custom,
-      message: "runtime must declare exactly one of base, snapshot, image, or dockerfile"
-    });
-  }
-});
-var SandboxTemplateResourcesSchema = external_exports.object({
-  cpu: external_exports.number().positive().max(8).optional(),
-  memoryGb: external_exports.number().positive().max(32).optional(),
-  diskGb: external_exports.number().positive().max(100).optional()
-}).strict();
-var SandboxTemplateRequiredLeaseSchema = external_exports.object({
-  provider: external_exports.enum(INTEGRATION_PROVIDERS),
-  scopes: external_exports.array(external_exports.string().trim().min(1).max(200)).max(100).default([]),
-  capabilities: external_exports.array(external_exports.string().trim().min(1).max(200)).max(100).default([])
-}).strict();
-var SandboxTemplateOpChatPermissionsSchema = external_exports.object({
-  models: external_exports.array(external_exports.string().trim().min(1).max(200)).max(100).default([]),
-  scopes: external_exports.array(external_exports.string().trim().min(1).max(200)).max(100).default([])
-}).strict();
-var SandboxTemplatePermissionsSchema = external_exports.object({
-  opchat: SandboxTemplateOpChatPermissionsSchema.optional()
-}).catchall(external_exports.record(external_exports.string(), external_exports.unknown())).default({});
-var SandboxTemplateVolumeSchema = external_exports.object({
-  name: external_exports.string().trim().regex(/^[A-Za-z_][A-Za-z0-9_-]*$/).max(63).optional(),
-  mountPath: external_exports.string().trim().min(1).max(256).optional(),
-  storageGb: external_exports.number().int().positive().max(100).optional(),
-  deleteOnSandboxDelete: external_exports.boolean().optional()
-}).strict();
-var SandboxTemplatePortSchema = external_exports.object({
-  port: external_exports.number().int().min(SANDBOX_TEMPLATE_PREVIEW_PORT_MIN).max(SANDBOX_TEMPLATE_PREVIEW_PORT_MAX).refine((port) => !RESERVED_PREVIEW_PORTS.has(port), {
-    message: "preview port is reserved"
-  }),
-  protocol: external_exports.literal("http").default("http"),
-  label: external_exports.string().trim().min(1).max(80).optional(),
-  access: external_exports.enum(["private", "public"]).default("private"),
-  path: external_exports.string().trim().min(1).max(512).refine((value) => value.startsWith("/"), {
-    message: "preview path must start with /"
-  }).default("/")
-}).strict();
-var SandboxTemplateCommandSchema = external_exports.object({
-  command: external_exports.string().trim().min(1).max(1e3),
-  cwd: RelativeWorkspacePathSchema.optional(),
-  timeoutSeconds: external_exports.number().int().positive().max(86400).optional(),
-  requiresStart: external_exports.boolean().default(false),
-  ports: external_exports.array(SandboxTemplatePortSchema).max(20).default([]),
-  artifactPaths: external_exports.array(RelativeWorkspacePathSchema).max(100).default([])
-}).strict();
-var SandboxTemplateNamedCommandSchema = SandboxTemplateCommandSchema.extend({
-  name: external_exports.string().trim().min(1).max(80)
-}).strict();
-var SandboxTemplateMcpEndpointSchema = external_exports.object({
-  name: external_exports.string().trim().min(1).max(80).optional(),
-  service: external_exports.string().trim().min(1).max(80).optional(),
-  port: external_exports.number().int().min(SANDBOX_TEMPLATE_PREVIEW_PORT_MIN).max(SANDBOX_TEMPLATE_PREVIEW_PORT_MAX).refine((port) => !RESERVED_PREVIEW_PORTS.has(port), {
-    message: "app MCP port is reserved"
-  }),
-  path: external_exports.string().trim().min(1).max(512).refine((value) => value.startsWith("/"), {
-    message: "app MCP path must start with /"
-  }).default("/mcp")
-}).strict();
-var SandboxTemplateValidationProbeSchema = external_exports.object({
-  name: external_exports.string().trim().min(1).max(80).optional(),
-  port: external_exports.number().int().min(SANDBOX_TEMPLATE_PREVIEW_PORT_MIN).max(SANDBOX_TEMPLATE_PREVIEW_PORT_MAX).refine((port) => !RESERVED_PREVIEW_PORTS.has(port), {
-    message: "validation probe port is reserved"
-  }),
-  path: external_exports.string().trim().min(1).max(512).refine((value) => value.startsWith("/"), {
-    message: "validation probe path must start with /"
-  }).default("/"),
-  expectedStatus: external_exports.number().int().min(100).max(599).default(200)
-}).strict();
-var SandboxTemplateJsonSchema = external_exports.record(external_exports.string(), external_exports.unknown()).refine((schema) => schema.type === "object", "input schema must be a JSON schema object");
-var SandboxTemplateEnvInputSchema = external_exports.object({
-  name: external_exports.string().trim().regex(/^[A-Za-z_][A-Za-z0-9_]*$/).max(191),
-  required: external_exports.boolean().default(false),
-  secret: external_exports.boolean().default(true),
-  description: external_exports.string().trim().max(500).optional()
-}).strict();
-var SandboxTemplateScheduleDateSchema = external_exports.string().trim().min(1).max(120);
-var SandboxTemplateScheduleSchema = external_exports.object({
-  name: external_exports.string().trim().min(1).max(120),
-  description: external_exports.string().trim().max(500).optional(),
-  cron: external_exports.string().trim().min(1).max(500).optional(),
-  rate: external_exports.string().trim().min(1).max(500).optional(),
-  once: SandboxTemplateScheduleDateSchema.optional(),
-  scheduleType: external_exports.enum(["rate", "cron", "once"]).optional(),
-  scheduleExpression: external_exports.string().trim().min(1).max(500).optional(),
-  timezone: external_exports.string().trim().min(1).max(100).optional(),
-  enabled: external_exports.boolean().default(true),
-  startAt: SandboxTemplateScheduleDateSchema.optional(),
-  endAt: SandboxTemplateScheduleDateSchema.optional(),
-  maxRuns: external_exports.number().int().positive().nullable().optional(),
-  runtimePolicy: external_exports.enum([
-    "run_and_stop",
-    "run_and_archive",
-    "run_and_delete",
-    "use_existing_running"
-  ]).default("run_and_stop"),
-  action: external_exports.string().trim().min(1).max(120).optional(),
-  actionName: external_exports.string().trim().min(1).max(120).optional(),
-  command: external_exports.string().trim().min(1).max(2e3).optional(),
-  target: external_exports.object({
-    kind: external_exports.enum(["start", "action", "service", "command"]).optional(),
-    name: external_exports.string().trim().min(1).max(120).optional(),
-    actionName: external_exports.string().trim().min(1).max(120).optional(),
-    command: external_exports.string().trim().min(1).max(2e3).optional(),
-    requiresStart: external_exports.boolean().optional()
-  }).strict().optional(),
-  requiresStart: external_exports.boolean().optional(),
-  budget: external_exports.object({
-    maxUsd: external_exports.string().trim().min(1).max(40).optional()
-  }).strict().optional(),
-  resources: SandboxTemplateResourcesSchema.optional(),
-  quotas: external_exports.record(external_exports.string(), external_exports.unknown()).optional(),
-  lifecycle: external_exports.record(external_exports.string(), external_exports.unknown()).optional(),
-  retentionPolicy: external_exports.record(external_exports.string(), external_exports.unknown()).optional(),
-  env: external_exports.array(external_exports.object({
-    name: external_exports.string().trim().regex(/^[A-Za-z_][A-Za-z0-9_]*$/).max(191),
-    value: external_exports.string().optional(),
-    secretRef: external_exports.string().optional()
-  }).strict()).max(100).optional(),
-  integrationLeases: external_exports.array(external_exports.record(external_exports.string(), external_exports.unknown())).max(20).optional(),
-  metadata: external_exports.record(external_exports.string(), external_exports.unknown()).optional()
-}).strict().superRefine((schedule, context) => {
-  const expressionCount = [
-    schedule.cron,
-    schedule.rate,
-    schedule.once,
-    schedule.scheduleExpression
-  ].filter((value) => typeof value === "string" && value.trim()).length;
-  if (expressionCount !== 1) {
-    context.addIssue({
-      code: external_exports.ZodIssueCode.custom,
-      path: ["scheduleExpression"],
-      message: "schedule must declare exactly one of cron, rate, once, or scheduleExpression"
-    });
-  }
-  if (schedule.scheduleExpression && !schedule.scheduleType) {
-    context.addIssue({
-      code: external_exports.ZodIssueCode.custom,
-      path: ["scheduleType"],
-      message: "scheduleType is required with scheduleExpression"
-    });
-  }
-  const command = schedule.command ?? schedule.target?.command ?? null;
-  const targetName = schedule.target?.name ?? null;
-  const actionName = schedule.actionName ?? schedule.action ?? schedule.target?.actionName ?? (schedule.target?.kind === "action" ? targetName : null);
-  const kind = schedule.target?.kind ?? (command ? "command" : "action");
-  if (kind === "action" && !actionName) {
-    context.addIssue({
-      code: external_exports.ZodIssueCode.custom,
-      path: ["action"],
-      message: "schedule action target is required"
-    });
-  }
-  if (kind === "service" && !targetName) {
-    context.addIssue({
-      code: external_exports.ZodIssueCode.custom,
-      path: ["target", "name"],
-      message: "schedule service target name is required"
-    });
-  }
-  if (kind === "command" && !command) {
-    context.addIssue({
-      code: external_exports.ZodIssueCode.custom,
-      path: ["command"],
-      message: "schedule command target is required"
-    });
-  }
-});
-var SandboxTemplateManifestSchema = external_exports.object({
-  schemaVersion: external_exports.literal(1),
-  name: external_exports.string().trim().min(1).max(80).regex(/^[a-z0-9][a-z0-9-]*[a-z0-9]$/),
-  version: external_exports.string().trim().min(1).max(40),
-  useCase: external_exports.string().trim().min(1).max(80),
-  description: external_exports.string().trim().min(1).max(500),
-  runtime: SandboxTemplateRuntimeSchema,
-  resources: SandboxTemplateResourcesSchema.optional(),
-  setup: external_exports.object({
-    commands: CommandListSchema.default([])
-  }).strict().default({ commands: [] }),
-  validation: external_exports.object({
-    commands: CommandListSchema.min(1),
-    probes: external_exports.array(SandboxTemplateValidationProbeSchema).max(20).default([])
-  }).strict(),
-  start: SandboxTemplateCommandSchema,
-  actions: external_exports.array(SandboxTemplateNamedCommandSchema).max(20).default([]),
-  services: external_exports.array(SandboxTemplateNamedCommandSchema).max(20).default([]),
-  schedules: external_exports.array(SandboxTemplateScheduleSchema).max(20).default([]),
-  mcp: external_exports.object({
-    endpoints: external_exports.array(SandboxTemplateMcpEndpointSchema).max(10).default([])
-  }).strict().default({ endpoints: [] }),
-  volumes: external_exports.array(SandboxTemplateVolumeSchema).max(5).default([]),
-  integrations: external_exports.object({
-    requiredLeases: external_exports.array(SandboxTemplateRequiredLeaseSchema).max(20).default([])
-  }).strict().default({ requiredLeases: [] }),
-  permissions: SandboxTemplatePermissionsSchema,
-  inputs: external_exports.object({
-    schema: SandboxTemplateJsonSchema.default({ type: "object" }),
-    env: external_exports.array(SandboxTemplateEnvInputSchema).max(100).default([])
-  }).strict().default({ schema: { type: "object" }, env: [] }),
-  artifacts: external_exports.object({
-    paths: external_exports.array(RelativeWorkspacePathSchema).max(100).default([])
-  }).strict().default({ paths: [] }),
-  network: external_exports.object({
-    egress: external_exports.enum(["restricted", "allow", "block"]).default("restricted")
-  }).strict().default({ egress: "restricted" })
-}).strict().superRefine((manifest, context) => {
-  validateExecutableNames(manifest, context);
-  addDuplicateNameIssue(context, manifest.volumes.flatMap((volume) => volume.name ? [volume.name] : []), "volume names must be unique", "volumes");
-  validateInputSchemaUploadTargets(manifest, context);
-  validateEnvInputs(manifest, context);
-  validateMcpEndpoints(manifest, context);
-  validateScheduleTargets(manifest, context);
-});
-var SandboxTemplateValidationDiagnosticSchema = external_exports.object({
-  path: external_exports.string(),
-  message: external_exports.string(),
-  code: external_exports.string()
-});
-function validateSandboxTemplateYaml(source) {
-  let parsed;
-  try {
-    parsed = yaml.load(source);
-  } catch (error) {
-    return {
-      ok: false,
-      manifest: null,
-      diagnostics: [
-        {
-          path: "$",
-          code: "invalid_yaml",
-          message: error instanceof Error ? error.message : "Invalid YAML"
-        }
-      ]
-    };
-  }
-  return validateSandboxTemplateManifest(parsed);
-}
-function validateSandboxTemplateManifest(value) {
-  if (!value || typeof value !== "object" || Array.isArray(value)) {
-    return {
-      ok: false,
-      manifest: null,
-      diagnostics: [
-        {
-          path: "$",
-          code: "invalid_type",
-          message: `${OPENPOND_MANIFEST_FILE_NAME} must be an object`
-        }
-      ]
-    };
-  }
-  if (Object.prototype.hasOwnProperty.call(value, "databases")) {
-    return {
-      ok: false,
-      manifest: null,
-      diagnostics: [
-        {
-          path: "$.databases",
-          code: "database_resources_removed",
-          message: "managed database requests are unsupported for Firecracker sandbox templates; use a durable volume with SQLite or files instead"
-        }
-      ]
-    };
-  }
-  const result = SandboxTemplateManifestSchema.safeParse(value);
-  if (result.success)
-    return { ok: true, manifest: result.data, diagnostics: [] };
-  return {
-    ok: false,
-    manifest: null,
-    diagnostics: result.error.issues.map((issue) => ({
-      path: formatIssuePath(issue.path),
-      code: issue.code,
-      message: issue.message
-    }))
-  };
-}
-function formatSandboxTemplateDiagnostics(diagnostics) {
-  return diagnostics.map((diagnostic) => `${diagnostic.path}: ${diagnostic.message}`).join("\n");
-}
-function sandboxTemplateExecutableEntries(manifest) {
-  return [
-    {
-      kind: "start",
-      name: "start",
-      ...manifest.start,
-      artifactPaths: commandArtifactPaths(manifest.start, manifest)
-    },
-    ...manifest.actions.map((action) => ({
-      kind: "action",
-      name: action.name,
-      command: action.command,
-      cwd: action.cwd,
-      timeoutSeconds: action.timeoutSeconds,
-      requiresStart: action.requiresStart,
-      ports: action.ports,
-      artifactPaths: commandArtifactPaths(action, manifest)
-    })),
-    ...manifest.services.map((service) => ({
-      kind: "service",
-      name: service.name,
-      command: service.command,
-      cwd: service.cwd,
-      timeoutSeconds: service.timeoutSeconds,
-      requiresStart: service.requiresStart,
-      ports: service.ports,
-      artifactPaths: commandArtifactPaths(service, manifest)
-    }))
-  ];
-}
-function sandboxTemplateBuildMetadata(manifest) {
-  const executables = sandboxTemplateExecutableEntries(manifest);
-  return {
-    template: {
-      name: manifest.name,
-      version: manifest.version,
-      useCase: manifest.useCase,
-      runtime: manifest.runtime
-    },
-    resources: manifest.resources ?? null,
-    volumes: manifest.volumes,
-    executables: executables.map((entry) => ({
-      kind: entry.kind,
-      name: entry.name,
-      command: entry.command,
-      cwd: entry.cwd ?? null,
-      timeoutSeconds: entry.timeoutSeconds ?? null,
-      requiresStart: entry.requiresStart,
-      ports: entry.ports.map((port) => port.port),
-      artifactPaths: entry.artifactPaths
-    })),
-    ports: executables.flatMap((entry) => entry.ports.map((port) => ({
-      executable: entry.name,
-      kind: entry.kind,
-      port: port.port,
-      access: port.access,
-      label: port.label ?? null
-    }))),
-    appMcpEndpoints: manifest.mcp.endpoints.map((endpoint) => ({
-      name: endpoint.name ?? null,
-      service: endpoint.service ?? null,
-      port: endpoint.port,
-      path: endpoint.path
-    })),
-    validation: {
-      commands: manifest.validation.commands,
-      probes: manifest.validation.probes
-    },
-    schedules: manifest.schedules
-  };
-}
-function sandboxTemplateBuildPlan(input) {
-  return {
-    kind: SANDBOX_TEMPLATE_BUILD_PLAN_KIND,
-    schemaVersion: 1,
-    manifestFile: input.manifestFile,
-    projectRoot: input.projectRoot,
-    manifest: input.manifest,
-    metadata: sandboxTemplateBuildMetadata(input.manifest),
-    executables: sandboxTemplateExecutableEntries(input.manifest)
-  };
-}
-function sandboxTemplateScaffoldFiles(input) {
-  const displayName = input.name.trim() || "Sandbox Template";
-  const name = slug(displayName);
-  const description = input.description?.trim() || `Local scaffold for ${displayName}.`;
-  return {
-    ".gitignore": ["node_modules", "artifacts", ".DS_Store", ""].join("\n"),
-    "README.md": [
-      `# ${displayName}`,
-      "",
-      "Local sandbox template scaffold.",
-      "",
-      "## Commands",
-      "",
-      "- `pnpm dev` starts the preview service on port 3000.",
-      "- `pnpm process` writes a sample artifact.",
-      `- \`pnpm validate\` validates ${OPENPOND_MANIFEST_FILE_NAME}.`,
-      ""
-    ].join("\n"),
-    "package.json": `${JSON.stringify({
-      private: true,
-      type: "module",
-      scripts: {
-        dev: "node src/server.ts",
-        process: "node scripts/process.ts",
-        validate: `openpond sandbox-template validate --file ${OPENPOND_MANIFEST_FILE_NAME}`
-      }
-    }, null, 2)}
-`,
-    [OPENPOND_MANIFEST_FILE_NAME]: [
-      "schemaVersion: 1",
-      `name: ${name}`,
-      "version: 0.1.0",
-      "useCase: sandbox-template-scaffold",
-      `description: ${description}`,
-      "runtime:",
-      "  base: node-bun-workspace",
-      "resources:",
-      "  cpu: 1",
-      "  memoryGb: 1",
-      "  diskGb: 8",
-      "setup:",
-      "  commands:",
-      "    - mkdir -p artifacts",
-      "validation:",
-      "  commands:",
-      "    - test -f src/server.ts",
-      "    - test -f scripts/process.ts",
-      "start:",
-      "  command: pnpm process",
-      "  timeoutSeconds: 300",
-      "  ports: []",
-      "  artifactPaths:",
-      "    - artifacts/result.json",
-      "actions: []",
-      "schedules: []",
-      "services:",
-      "  - name: web",
-      "    command: pnpm dev",
-      "    timeoutSeconds: 3600",
-      "    ports:",
-      "      - port: 3000",
-      "        protocol: http",
-      "        label: web",
-      "        access: private",
-      "        path: /",
-      "    artifactPaths: []",
-      "inputs:",
-      "  env:",
-      "    - name: FOO_API_KEY",
-      "      required: false",
-      "      secret: true",
-      "      description: API key used by the sample action.",
-      "  schema:",
-      "    type: object",
-      "    properties:",
-      "      subject:",
-      "        type: string",
-      "        title: Subject",
-      "        default: Example",
-      "artifacts:",
-      "  paths:",
-      "    - artifacts/result.json",
-      "network:",
-      "  egress: restricted",
-      ""
-    ].join("\n"),
-    "src/server.ts": [
-      "import { createServer } from 'node:http';",
-      "",
-      "createServer((_request, response) => {",
-      "  response.setHeader('content-type', 'application/json');",
-      "  response.end(JSON.stringify({ ok: true, template: 'sandbox-template-scaffold' }));",
-      "}).listen(3000, '0.0.0.0');",
-      ""
-    ].join("\n"),
-    "scripts/process.ts": [
-      "import { mkdir, writeFile } from 'node:fs/promises';",
-      "",
-      "const raw = process.env.OPENPOND_REPLAY_PARAMS_BASE64;",
-      "const params = raw ? JSON.parse(Buffer.from(raw, 'base64').toString('utf8')).input ?? {} : {};",
-      "await mkdir('artifacts', { recursive: true });",
-      "await writeFile('artifacts/result.json', JSON.stringify({ ok: true, input: params }, null, 2));",
-      "console.log('wrote artifacts/result.json');",
-      ""
-    ].join("\n"),
-    "fixtures/input.txt": "Example input\n"
-  };
-}
-function isSafeRelativeWorkspacePath(value) {
-  return !value.includes("\0") && !value.startsWith("/") && !value.split(/[\\/]+/).some((segment) => segment === ".." || segment === "");
-}
-function formatIssuePath(path) {
-  if (path.length === 0)
-    return "$";
-  return `$${path.map((part) => typeof part === "number" ? `[${part}]` : `.${String(part)}`).join("")}`;
-}
-function addDuplicateNameIssue(context, names, message, path) {
-  const seen = /* @__PURE__ */ new Set();
-  for (const name of names) {
-    if (seen.has(name)) {
-      context.addIssue({
-        code: external_exports.ZodIssueCode.custom,
-        path: [path],
-        message
-      });
-      return;
-    }
-    seen.add(name);
-  }
-}
-function validateExecutableNames(manifest, context) {
-  const names = [
-    "start",
-    ...manifest.actions.map((action) => action.name),
-    ...manifest.services.map((service) => service.name)
-  ];
-  addDuplicateNameIssue(context, names, "start, action, and service names must be unique", "actions");
-}
-function validateInputSchemaUploadTargets(manifest, context) {
-  const properties = asRecord(manifest.inputs.schema.properties);
-  const volumeNames = new Set(manifest.volumes.map((volume) => volume.name).filter((name) => Boolean(name)));
-  for (const [inputName, rawProperty] of Object.entries(properties)) {
-    const property = asRecord(rawProperty);
-    const upload = asRecord(property["x-openpond-upload"] ?? property.xOpenPondUpload);
-    const targetPath = typeof upload.targetPath === "string" && upload.targetPath.trim() ? upload.targetPath.trim() : typeof upload.path === "string" && upload.path.trim() ? upload.path.trim() : "";
-    if (!targetPath)
-      continue;
-    const normalizedTargetPath = targetPath.replace(/^workspace\//, "").replace(/^\/+/, "").replace(/\/+$/, "");
-    if (!isSafeRelativeWorkspacePath(normalizedTargetPath)) {
-      context.addIssue({
-        code: external_exports.ZodIssueCode.custom,
-        path: [
-          "inputs",
-          "schema",
-          "properties",
-          inputName,
-          "x-openpond-upload",
-          "targetPath"
-        ],
-        message: "upload target must be a relative workspace path"
-      });
-      continue;
-    }
-    const parts = normalizedTargetPath.split("/");
-    if (parts[0] === "volumes" && (!parts[1] || !volumeNames.has(parts[1]))) {
-      context.addIssue({
-        code: external_exports.ZodIssueCode.custom,
-        path: [
-          "inputs",
-          "schema",
-          "properties",
-          inputName,
-          "x-openpond-upload",
-          "targetPath"
-        ],
-        message: "upload target references an undeclared volume"
-      });
-    }
-  }
-}
-function validateEnvInputs(manifest, context) {
-  addDuplicateNameIssue(context, manifest.inputs.env.map((env) => env.name), "env input names must be unique", "inputs");
-}
-function validateMcpEndpoints(manifest, context) {
-  const servicePorts = new Map(manifest.services.map((service) => [
-    service.name,
-    new Set(service.ports.map((port) => port.port))
-  ]));
-  const declaredPorts = /* @__PURE__ */ new Set([
-    ...manifest.start.ports.map((port) => port.port),
-    ...manifest.services.flatMap((service) => service.ports.map((port) => port.port))
-  ]);
-  for (const [index, endpoint] of manifest.mcp.endpoints.entries()) {
-    if (endpoint.service) {
-      const ports = servicePorts.get(endpoint.service);
-      if (!ports) {
-        context.addIssue({
-          code: external_exports.ZodIssueCode.custom,
-          path: ["mcp", "endpoints", index, "service"],
-          message: `app MCP service does not exist: ${endpoint.service}`
-        });
-        continue;
-      }
-      if (!ports.has(endpoint.port)) {
-        context.addIssue({
-          code: external_exports.ZodIssueCode.custom,
-          path: ["mcp", "endpoints", index, "port"],
-          message: `app MCP port ${endpoint.port} is not declared on service ${endpoint.service}`
-        });
-      }
-      continue;
-    }
-    if (!declaredPorts.has(endpoint.port)) {
-      context.addIssue({
-        code: external_exports.ZodIssueCode.custom,
-        path: ["mcp", "endpoints", index, "port"],
-        message: `app MCP port ${endpoint.port} is not declared on start or services`
-      });
-    }
-  }
-}
-function validateScheduleTargets(manifest, context) {
-  const actionNames = new Set(manifest.actions.map((action) => action.name));
-  const serviceNames = new Set(manifest.services.map((service) => service.name));
-  for (const [index, schedule] of manifest.schedules.entries()) {
-    const command = schedule.command ?? schedule.target?.command ?? null;
-    if (schedule.target?.kind === "command" || command) {
-      continue;
-    }
-    const actionName = schedule.actionName ?? schedule.action ?? schedule.target?.actionName ?? (schedule.target?.kind === "action" ? schedule.target?.name : null);
-    if (actionName && !actionNames.has(actionName)) {
-      context.addIssue({
-        code: external_exports.ZodIssueCode.custom,
-        path: ["schedules", index, "action"],
-        message: `schedule action target does not exist: ${actionName}`
-      });
-    }
-    if (schedule.target?.kind === "service") {
-      const serviceName = schedule.target.name ?? "";
-      if (serviceName && !serviceNames.has(serviceName)) {
-        context.addIssue({
-          code: external_exports.ZodIssueCode.custom,
-          path: ["schedules", index, "target", "name"],
-          message: `schedule service target does not exist: ${serviceName}`
-        });
-      }
-    }
-  }
-}
-function asRecord(value) {
-  return value && typeof value === "object" && !Array.isArray(value) ? value : {};
-}
-function commandArtifactPaths(command, manifest) {
-  return command.artifactPaths.length > 0 ? command.artifactPaths : manifest.artifacts.paths;
-}
-function slug(value) {
-  return value.toLowerCase().replace(/[^a-z0-9-]+/g, "-").replace(/^-+|-+$/g, "").replace(/-{2,}/g, "-").slice(0, 80) || "sandbox-template";
-}
-
-// ../../packages/connected-apps/dist/index.js
-var CONNECTED_APP_PROVIDER_TOOL_NAMES = [
-  "connected_app_search",
-  "connected_app_read",
-  "connected_app_write"
-];
-var CONNECTED_APP_TOOL_CALL_ENDPOINT = "/v1/integrations/tool-calls";
-var DEFAULT_OPENPOND_WEB_BASE_URL = "https://openpond.ai";
-var CONNECTED_APP_PROVIDER_ORDER = [
-  "slack",
-  "google",
-  "github",
-  "x",
-  "microsoft_teams",
-  "mcp"
-];
-var CAPABILITIES = {
-  slack: [
-    capability("slack.channel.bind", "Bind channels", "Bind Slack channels or threads to OpenPond profiles.", "setup", false),
-    capability("slack.message.ingest", "Ingest messages", "Ingest Slack channel or thread activity into OpenPond context.", "setup", false)
-  ],
-  microsoft_teams: [
-    capability("microsoft_teams.channel.bind", "Bind channels", "Bind Teams channels or chats to OpenPond profiles.", "setup", false),
-    capability("microsoft_teams.message.ingest", "Ingest messages", "Ingest Teams channel or chat activity into OpenPond context.", "setup", false)
-  ],
-  google: [
-    capability("google.drive.file.read", "Read Drive files", "Find and read Google Drive files.", "read", true),
-    capability("google.drive.file.write", "Write Drive files", "Create or update approved Google Drive files.", "write", true),
-    capability("google.docs.read", "Read Docs", "Read Google Docs content and structure.", "read", true),
-    capability("google.docs.write", "Edit Docs", "Apply approved Google Docs edits.", "write", true),
-    capability("google.comments.read", "Read comments", "Read Google file comments.", "read", true),
-    capability("google.comments.write", "Write comments", "Create or resolve approved Google comments.", "write", true)
-  ],
-  github: [
-    capability("github.repo.read", "Read repositories", "Read repository metadata and file context.", "read", true),
-    capability("github.issue.read", "Read issues", "Read GitHub issues and comments.", "read", true),
-    capability("github.issue.write", "Update issues", "Create or update approved GitHub issue content.", "write", true),
-    capability("github.pull_request.read", "Read pull requests", "Read pull request metadata, diffs, checks, and reviews.", "read", true),
-    capability("github.pull_request.write", "Update pull requests", "Create approved comments or pull request updates.", "write", true)
-  ],
-  x: [
-    capability("x.profile.read", "Read profile", "Read the connected X profile.", "read", true),
-    capability("x.search.read", "Search X", "Search public X posts when granted.", "read", true),
-    capability("x.mentions.read", "Read mentions", "Read mentions for the connected X account.", "read", true),
-    capability("x.post.write", "Post", "Create approved X posts.", "write", true),
-    capability("x.reply.write", "Reply", "Create approved X replies.", "write", true)
-  ],
-  mcp: [
-    capability("mcp.tool.discover", "Discover tools", "Discover team-scoped MCP tools.", "tooling", false),
-    capability("mcp.tool.call", "Call tools", "Call approved MCP tools through the team endpoint.", "tooling", false)
-  ]
-};
-var PROVIDER_OPERATIONS = {
-  slack: [],
-  microsoft_teams: [],
-  google: [
-    providerOperation("google.drive.search", "search", "Search Drive", "Search Google Drive files by grounded query.", ["google.drive.file.read"]),
-    providerOperation("google.drive.read_file", "read", "Read Drive file", "Read Drive file metadata or exported content by stable ref.", ["google.drive.file.read"], { requiredKeys: ["ref"] }),
-    providerOperation("google.docs.read", "read", "Read Google Doc", "Read Google Docs content and structure by stable ref.", ["google.docs.read"], { requiredKeys: ["ref"] }),
-    providerOperation("google.comments.read", "read", "Read comments", "Read comments for a grounded Google file ref.", ["google.comments.read"], { requiredKeys: ["ref"] }),
-    providerOperation("google.docs.update", "write", "Update Google Doc", "Apply an explicitly approved Google Docs edit and return readback verification.", ["google.docs.write"], { requiredKeys: ["ref", "patch"] }),
-    providerOperation("google.comments.create", "write", "Create comment", "Create an explicitly approved Google file comment and return readback verification.", ["google.comments.write"], { requiredKeys: ["ref", "body"] }),
-    providerOperation("google.comments.resolve", "write", "Resolve comment", "Resolve an explicitly approved Google comment and return readback verification.", ["google.comments.write"], { requiredKeys: ["ref", "commentId"] })
-  ],
-  github: [
-    providerOperation("github.repo.search", "search", "Search repositories", "Search accessible repositories by owner, name, or topic.", ["github.repo.read"]),
-    providerOperation("github.issue.search", "search", "Search issues", "Search accessible GitHub issues.", ["github.issue.read"]),
-    providerOperation("github.pull_request.search", "search", "Search pull requests", "Search accessible GitHub pull requests.", ["github.pull_request.read"]),
-    providerOperation("github.repo.read", "read", "Read repository", "Read grounded repository metadata or file context.", ["github.repo.read"], { requiredKeys: ["ref"] }),
-    providerOperation("github.issue.read", "read", "Read issue", "Read a grounded GitHub issue and comments.", ["github.issue.read"], { requiredKeys: ["ref"] }),
-    providerOperation("github.pull_request.read", "read", "Read pull request", "Read a grounded pull request, checks, reviews, or diff summary.", ["github.pull_request.read"], { requiredKeys: ["ref"] }),
-    providerOperation("github.issue.create", "write", "Create issue", "Create an explicitly approved GitHub issue and return readback verification.", ["github.issue.write"], { requiredKeys: ["repo", "title", "body"] }),
-    providerOperation("github.issue.comment", "write", "Comment on issue", "Create an explicitly approved GitHub issue comment and return readback verification.", ["github.issue.write"], { requiredKeys: ["ref", "body"] }),
-    providerOperation("github.issue.update", "write", "Update issue", "Apply an explicitly approved issue metadata/content update and return readback verification.", ["github.issue.write"], { requiredKeys: ["ref"] }),
-    providerOperation("github.pull_request.comment", "write", "Comment on pull request", "Create an explicitly approved pull request comment and return readback verification.", ["github.pull_request.write"], { requiredKeys: ["ref", "body"] }),
-    providerOperation("github.pull_request.update", "write", "Update pull request", "Apply an explicitly approved pull request metadata update and return readback verification.", ["github.pull_request.write"], { requiredKeys: ["ref"] })
-  ],
-  x: [
-    providerOperation("x.profile.read", "read", "Read profile", "Read the connected X account profile.", ["x.profile.read"]),
-    providerOperation("x.post.read", "read", "Read post", "Read a public X post by stable ref, status URL, or post id.", ["x.search.read"], { requiredKeys: ["ref"] }),
-    providerOperation("x.search.posts", "search", "Search recent posts", "Search public X posts from the X recent-search window by grounded query.", ["x.search.read"]),
-    providerOperation("x.mentions.search", "search", "Search mentions", "Search mentions for the connected X account.", ["x.mentions.read"]),
-    providerOperation("x.mention.read", "read", "Read mention", "Read a grounded mention or post ref.", ["x.mentions.read"], { requiredKeys: ["ref"] }),
-    providerOperation("x.post.create", "write", "Create post", "Create an explicitly approved X post and return readback verification.", ["x.post.write"], { requiredKeys: ["text"] }),
-    providerOperation("x.reply.create", "write", "Create reply", "Create an explicitly approved X reply and return readback verification.", ["x.reply.write"], { requiredKeys: ["inReplyToRef", "text"] })
-  ],
-  mcp: []
-};
-var INTEGRATION_SKILL_BODIES = {
-  google: [
-    "# Google Connected App",
-    "",
-    "Use Google only through server-provided connected app tools. Never ask for or infer OAuth tokens.",
-    "Before reading or editing, identify the exact Drive file, Doc, Sheet, Slide, or comment thread. If the target is ambiguous, ask a short clarification or search first.",
-    "Use only declared Google operation ids: google.drive.search, google.drive.read_file, google.docs.read, google.comments.read, google.docs.update, google.comments.create, google.comments.resolve.",
-    "For writes, require explicit user intent, summarize the planned change, and verify the target identity before applying updates.",
-    "After a write, read back the changed object or relevant range and report the result with the provider file name or stable reference.",
-    "Prefer narrow reads over broad Drive scans. Do not expose private file ids unless the tool result already presents them as stable refs."
-  ].join("\n"),
-  github: [
-    "# GitHub Connected App",
-    "",
-    "Use GitHub only through server-provided connected app tools. Repository, issue, and pull request identity must be grounded before action.",
-    "Use only declared GitHub operation ids: github.repo.search, github.issue.search, github.pull_request.search, github.repo.read, github.issue.read, github.pull_request.read, github.issue.create, github.issue.comment, github.issue.update, github.pull_request.comment, github.pull_request.update.",
-    "For reads, name the owner/repo and issue or pull request number when available. If several targets match, ask or inspect before proceeding.",
-    "For writes, require explicit user intent and avoid destructive repository changes. Create issues only when the user clearly asks to submit or file a new issue. Prefer comments, labels, or metadata updates unless a stronger operation is clearly requested.",
-    "Do not claim CI, review, branch, or PR state changed until a tool result confirms it.",
-    "Keep local workspace git operations separate from connected GitHub operations unless the user explicitly asks to bridge them."
-  ].join("\n"),
-  x: [
-    "# X Connected App",
-    "",
-    "Use X only through server-provided connected app tools. Distinguish profile, recent search, mention, post, and reply operations.",
-    "Use only declared X operation ids: x.profile.read, x.post.read, x.search.posts, x.mentions.search, x.mention.read, x.post.create, x.reply.create.",
-    "For x.com, twitter.com, or stable status URLs, first parse the status/post id and read the post with connected_app_read using operation x.post.read and ref set to the original URL, stable ref, or id. Do not open a browser before trying the X connector.",
-    "Use x.search.posts for discovery, related public posts, replies, quote-post searches, and conversation scans. It uses X API recent search, so report zero-result searches as zero recent public posts returned by X.",
-    "For conversation or reply collection, dedupe by returned post id/ref. Do not repeat the same search call unless the result exposes a usable cursor or next token; if pagination is unavailable, state that coverage is limited to returned recent-search results.",
-    "Reads can summarize recent public posts, connected-account profile details, and mentions when the capability is available.",
-    "Writes require explicit user intent for the exact post or reply. Do not publish drafts, jokes, endorsements, or replies unless the user clearly approves the content.",
-    "Before posting or replying, preserve account identity, quote the proposed content in summary form, and respect provider limits and policy boundaries.",
-    "After a write, verify the returned post or reply ref before reporting success."
-  ].join("\n"),
-  microsoft_teams: [
-    "# Microsoft Teams Connected App",
-    "",
-    "Microsoft Teams is currently an ingestion/native binding surface only. Do not expose Teams OAuth reads, replies, file operations, or sandbox leases.",
-    "Native Teams setup can bind chats or channels to OpenPond profiles and ingest activity into OpenPond context.",
-    "If the user asks for Teams actions beyond ingestion or binding status, explain that the connector is not available yet rather than inventing tool access."
-  ].join("\n"),
-  slack: [
-    "# Slack Connected App",
-    "",
-    "Slack is currently an ingestion/native binding surface only. Do not expose Slack OAuth reads, replies, file operations, or sandbox leases.",
-    "Native Slack setup can bind channels or threads to OpenPond profiles and ingest activity into OpenPond context.",
-    "If the user asks for Slack actions beyond ingestion or binding status, explain that the connector is not available yet rather than inventing tool access."
-  ].join("\n"),
-  mcp: [
-    "# OpenPond MCP Connected App",
-    "",
-    "Use OpenPond MCP only through server-provided tool discovery and call paths. Do not invent MCP tools or endpoints.",
-    "Treat MCP as team-scoped tooling, not an OAuth connector. Tool availability must come from server-confirmed discovery results.",
-    "Before calling an MCP tool, match the requested operation to the tool name, description, input schema, and allowed team context.",
-    "For writes or side effects, require explicit user intent and report only confirmed tool results."
-  ].join("\n")
-};
-var CONNECTED_APP_INTEGRATION_SKILLS = CONNECTED_APP_PROVIDER_ORDER.map((provider) => {
-  const descriptor = integrationSkillDescriptor(provider);
-  const body = INTEGRATION_SKILL_BODIES[provider];
-  return {
-    ...descriptor,
-    provider,
-    body,
-    sourceHash: `connected-app-skill:${provider}:${hashString(body)}`,
-    charCount: body.length
-  };
-});
-function connectedAppIntegrationSkillByProvider(provider) {
-  const normalized = normalizeConnectedAppProviderFamilyId(provider);
-  if (!normalized)
-    return null;
-  return CONNECTED_APP_INTEGRATION_SKILLS.find((skill) => skill.provider === normalized) ?? null;
-}
-function validateConnectedAppToolCallRequest(request) {
-  const bundle = connectedAppBundleByProvider(request.provider);
-  if (!bundle) {
-    return { ok: false, error: `Connected app provider is not supported: ${request.provider}` };
-  }
-  if (!bundle.leasePolicy.leaseable) {
-    return {
-      ok: false,
-      error: `Connected app provider ${request.provider} is not leaseable for cloud connector execution.`
-    };
-  }
-  const expectedToolName = toolNameForOperation(request.operation);
-  if (request.toolName !== expectedToolName) {
-    return {
-      ok: false,
-      error: `Connected app tool ${request.toolName} does not match ${request.operation} operation.`
-    };
-  }
-  const access = request.operation === "write" ? "write" : "read";
-  const allowedCapabilityIds = new Set(bundle.capabilities.filter((capability2) => capability2.access === access && capability2.leaseable).map((capability2) => capability2.id));
-  const unauthorized = request.capabilityIds.filter((capabilityId) => !allowedCapabilityIds.has(capabilityId));
-  if (unauthorized.length > 0) {
-    return {
-      ok: false,
-      error: `Connected app capability ${unauthorized[0]} is not allowed for ${request.provider} ${request.operation}.`
-    };
-  }
-  const operationValidation = validateConnectedAppProviderOperationRequest(request);
-  if (!operationValidation.ok)
-    return operationValidation;
-  return { ok: true, request };
-}
-function connectedAppProviderOperations(provider) {
-  const normalized = normalizeConnectedAppProviderFamilyId(provider);
-  return normalized ? PROVIDER_OPERATIONS[normalized] : [];
-}
-function connectedAppProviderOperationById(provider, operationId) {
-  const normalizedId = normalizeProviderOperationId(operationId);
-  if (!normalizedId)
-    return null;
-  return connectedAppProviderOperations(provider).find((operation) => operation.id === normalizedId) ?? null;
-}
-function validateConnectedAppProviderOperationRequest(request) {
-  const requestedOperation = providerOperationIdFromArgs(request.args);
-  const operations = connectedAppProviderOperations(request.provider).filter((operation2) => operation2.operation === request.operation);
-  if (operations.length === 0) {
-    return {
-      ok: false,
-      error: `Connected app provider ${request.provider} does not declare ${request.operation} operations.`
-    };
-  }
-  if (!requestedOperation) {
-    if (request.operation === "write") {
-      return {
-        ok: false,
-        error: `Connected app ${request.provider} write calls require a provider operation id.`
-      };
-    }
-    return { ok: true, request };
-  }
-  const operation = operations.find((candidate) => candidate.id === requestedOperation);
-  if (!operation) {
-    return {
-      ok: false,
-      error: `Connected app operation ${requestedOperation} is not allowed for ${request.provider} ${request.operation}.`
-    };
-  }
-  const deniedCapabilities = request.capabilityIds.filter((capabilityId) => !operation.capabilityIds.includes(capabilityId));
-  if (deniedCapabilities.length > 0) {
-    return {
-      ok: false,
-      error: `Connected app operation ${operation.id} does not allow capability ${deniedCapabilities[0]}.`
-    };
-  }
-  const input = providerOperationInputFromArgs(request.args, request.operation);
-  for (const key of operation.input?.requiredKeys ?? []) {
-    const value = input[key];
-    if (value === void 0 || value === null || typeof value === "string" && !value.trim()) {
-      return {
-        ok: false,
-        error: `Connected app operation ${operation.id} requires input.${key}.`
-      };
-    }
-  }
-  return { ok: true, request };
-}
-var CATALOG = [
-  catalogEntry({
-    id: "slack",
-    providerFamily: "slack",
-    setupSurface: "native_bot",
-    statusSource: "native_binding",
-    label: "Slack",
-    shortLabel: "Slack",
-    kind: "native",
-    category: "Chat",
-    description: "Bind Slack channels or threads for ingestion into OpenPond profiles.",
-    icon: "/connected-apps/slack.svg",
-    installLabel: "Continue to Slack details"
-  }),
-  catalogEntry({
-    id: "google",
-    providerFamily: "google",
-    setupSurface: "oauth_connector",
-    statusSource: "integration_connection",
-    label: "Google",
-    shortLabel: "Google",
-    kind: "oauth",
-    category: "Productivity",
-    description: "Docs, Drive files, and comments for sandbox workflows.",
-    icon: "/connected-apps/google.svg",
-    installLabel: "Continue to Google details"
-  }),
-  catalogEntry({
-    id: "github",
-    providerFamily: "github",
-    setupSurface: "oauth_connector",
-    statusSource: "integration_connection",
-    label: "GitHub",
-    shortLabel: "GitHub",
-    kind: "oauth",
-    category: "Developer tools",
-    description: "Access repositories, issues, and pull requests.",
-    icon: "/connected-apps/github.svg",
-    installLabel: "Continue to GitHub details"
-  }),
-  catalogEntry({
-    id: "x",
-    providerFamily: "x",
-    setupSurface: "oauth_connector",
-    statusSource: "integration_connection",
-    label: "X",
-    shortLabel: "X",
-    kind: "oauth",
-    category: "Productivity",
-    description: "User profile, mentions, and approved reply access.",
-    icon: "/connected-apps/x.svg",
-    installLabel: "Continue to X details"
-  }),
-  catalogEntry({
-    id: "microsoft_teams",
-    providerFamily: "microsoft_teams",
-    setupSurface: "native_bot",
-    statusSource: "native_binding",
-    label: "Teams",
-    shortLabel: "Teams",
-    kind: "native",
-    category: "Chat",
-    description: "Bind Teams chats or channels for ingestion into OpenPond profiles.",
-    icon: "/connected-apps/microsoft.svg",
-    installLabel: "Continue to Teams details"
-  }),
-  catalogEntry({
-    id: "mcp",
-    providerFamily: "mcp",
-    setupSurface: "mcp_endpoint",
-    statusSource: "mcp_endpoint",
-    label: "OpenPond MCP",
-    shortLabel: "MCP",
-    kind: "mcp",
-    category: "Tools",
-    description: "Expose workspace tools through a team-scoped MCP endpoint.",
-    icon: "/connected-apps/openpond-mcp.svg",
-    installLabel: "Open MCP settings"
-  })
-];
-var CONNECTED_APP_CATALOG = CATALOG;
-var CONNECTED_APP_BUNDLES = CONNECTED_APP_PROVIDER_ORDER.map((providerFamily) => {
-  const setupSurfaces = CONNECTED_APP_CATALOG.filter((entry) => entry.providerFamily === providerFamily);
-  const firstSurface = setupSurfaces[0];
-  return {
-    id: providerFamily,
-    label: providerFamilyLabel(providerFamily),
-    shortLabel: firstSurface.shortLabel,
-    category: firstSurface.category,
-    icon: firstSurface.icon,
-    description: firstSurface.description,
-    setupSurfaces,
-    capabilities: CAPABILITIES[providerFamily],
-    skills: providerSkills(providerFamily),
-    tools: providerTools(providerFamily),
-    operations: PROVIDER_OPERATIONS[providerFamily],
-    leasePolicy: leasePolicy(providerFamily)
-  };
-});
-function connectedAppById(appId) {
-  const normalized = normalizeConnectedAppId(appId);
-  if (!normalized)
-    return null;
-  return CONNECTED_APP_CATALOG.find((app) => app.id === normalized) ?? null;
-}
-function connectedAppBundleByProvider(provider) {
-  const normalized = normalizeConnectedAppProviderFamilyId(provider);
-  if (!normalized)
-    return null;
-  return CONNECTED_APP_BUNDLES.find((bundle) => bundle.id === normalized) ?? null;
-}
-function buildConnectedAppInstallUrl(input) {
-  const app = connectedAppById(input.appId);
-  const baseUrl = normalizeOpenPondWebBaseUrl(input.baseUrl);
-  const path = app?.kind === "mcp" ? "/sandboxes/mcp" : "/sandboxes/apps";
-  const url = new URL(path, baseUrl);
-  if (app?.kind !== "mcp") {
-    url.searchParams.set("app", app?.deepLinkAppId ?? input.appId);
-  }
-  const teamId = input.teamId?.trim();
-  if (teamId)
-    url.searchParams.set("teamId", teamId);
-  return url.toString();
-}
-function normalizeConnectedAppId(value) {
-  const normalized = value?.trim().toLowerCase().replace(/[-\s]+/g, "_");
-  if (!normalized)
-    return null;
-  if (normalized === "teams" || normalized === "microsoft")
-    return "microsoft_teams";
-  return CONNECTED_APP_CATALOG.some((app) => app.id === normalized) ? normalized : null;
-}
-function normalizeConnectedAppProviderFamilyId(value) {
-  const normalized = value?.trim().toLowerCase().replace(/[-\s]+/g, "_");
-  if (!normalized)
-    return null;
-  if (normalized === "teams" || normalized === "microsoft") {
-    return "microsoft_teams";
-  }
-  if (CONNECTED_APP_PROVIDER_ORDER.includes(normalized)) {
-    return normalized;
-  }
-  const app = connectedAppById(normalized);
-  return app?.providerFamily ?? null;
-}
-function buildConnectedAppStatusRows(input = {}) {
-  const connections = normalizeConnections(input.connections ?? []);
-  return CONNECTED_APP_CATALOG.map((entry) => {
-    const bundle = connectedAppBundleByProvider(entry.providerFamily);
-    const matchingConnections = entry.statusSource === "integration_connection" ? connections.filter((connection) => connection.provider === entry.providerFamily) : [];
-    const connected = matchingConnections.some((connection) => connection.status === "active");
-    const status = surfaceStatus(entry, connected);
-    return {
-      ...entry,
-      providerLabel: bundle.label,
-      setupSurfaceLabel: setupSurfaceLabel(entry.setupSurface),
-      status,
-      statusLabel: statusLabel(entry, status, matchingConnections),
-      connections: matchingConnections,
-      connected,
-      capabilities: capabilitiesForSurface(entry, bundle.capabilities),
-      capabilityLabels: capabilitiesForSurface(entry, bundle.capabilities).map((capability2) => capability2.label),
-      leasePolicy: bundle.leasePolicy
-    };
-  });
-}
-function capability(id, label, description, access, leaseable) {
-  return { id, label, description, access, leaseable };
-}
-function catalogEntry(entry) {
-  return entry;
-}
-function providerOperation(id, operation, label, description, capabilityIds, input) {
-  return {
-    id,
-    operation,
-    label,
-    description,
-    capabilityIds,
-    ...input ? { input } : {},
-    requiresReadback: operation === "write",
-    requiresRuntimeLease: false
-  };
-}
-function providerOperationIdFromArgs(args) {
-  return normalizeProviderOperationId(args.operation);
-}
-function normalizeProviderOperationId(value) {
-  return typeof value === "string" && value.trim() ? value.trim() : null;
-}
-function providerOperationInputFromArgs(args, operation) {
-  if (operation === "write") {
-    return isRecord(args.input) ? args.input : {};
-  }
-  return args;
-}
-function isRecord(value) {
-  return Boolean(value) && typeof value === "object" && !Array.isArray(value);
-}
-function normalizeOpenPondWebBaseUrl(value) {
-  const trimmed = value?.trim();
-  if (!trimmed)
-    return DEFAULT_OPENPOND_WEB_BASE_URL;
-  try {
-    const url = new URL(trimmed);
-    if (url.protocol !== "http:" && url.protocol !== "https:")
-      return DEFAULT_OPENPOND_WEB_BASE_URL;
-    url.pathname = "/";
-    url.search = "";
-    url.hash = "";
-    return url.toString();
-  } catch {
-    return DEFAULT_OPENPOND_WEB_BASE_URL;
-  }
-}
-function providerFamilyLabel(provider) {
-  if (provider === "microsoft_teams")
-    return "Microsoft Teams";
-  if (provider === "mcp")
-    return "OpenPond MCP";
-  if (provider === "x")
-    return "X";
-  return provider[0].toUpperCase() + provider.slice(1);
-}
-function setupSurfaceLabel(surface) {
-  if (surface === "native_bot")
-    return "Native app";
-  if (surface === "oauth_connector")
-    return "OAuth connector";
-  return "MCP endpoint";
-}
-function providerSkills(provider) {
-  return [integrationSkillDescriptor(provider)];
-}
-function integrationSkillDescriptor(provider) {
-  return {
-    name: `${provider}-connected-app`,
-    description: `Use ${providerFamilyLabel(provider)} safely through connected app tools.`,
-    path: `integration_skills/${provider}.md`
-  };
-}
-function providerTools(provider) {
-  if (provider === "mcp")
-    return [];
-  const capabilities = CAPABILITIES[provider];
-  const readCapabilityIds = capabilities.filter((capability2) => capability2.access === "read").map((capability2) => capability2.id);
-  const writeCapabilityIds = capabilities.filter((capability2) => capability2.access === "write").map((capability2) => capability2.id);
-  const tools = [];
-  if (readCapabilityIds.length > 0) {
-    tools.push({
-      name: "connected_app_search",
-      description: `Search ${providerFamilyLabel(provider)} through a server-owned connected app connector.`,
-      capabilityIds: readCapabilityIds,
-      write: false
-    }, {
-      name: "connected_app_read",
-      description: `Read a grounded ${providerFamilyLabel(provider)} object through a server-owned connected app connector.`,
-      capabilityIds: readCapabilityIds,
-      write: false
-    });
-  }
-  if (writeCapabilityIds.length > 0) {
-    tools.push({
-      name: "connected_app_write",
-      description: `Perform an explicitly approved ${providerFamilyLabel(provider)} write through a server-owned connected app connector.`,
-      capabilityIds: writeCapabilityIds,
-      write: true
-    });
-  }
-  return tools;
-}
-function toolNameForOperation(operation) {
-  if (operation === "search")
-    return "connected_app_search";
-  if (operation === "read")
-    return "connected_app_read";
-  return "connected_app_write";
-}
-function leasePolicy(provider) {
-  const capabilities = CAPABILITIES[provider].filter((item) => item.leaseable).map((item) => item.id);
-  const leaseable = provider !== "mcp" && capabilities.length > 0;
-  return {
-    leaseable,
-    defaultTtlSeconds: leaseable ? 3600 : null,
-    allowedCapabilityIds: capabilities,
-    requiresProxy: leaseable
-  };
-}
-function capabilitiesForSurface(entry, capabilities) {
-  if (entry.setupSurface === "native_bot") {
-    return capabilities.filter((capability2) => capability2.access === "setup");
-  }
-  if (entry.setupSurface === "mcp_endpoint")
-    return capabilities;
-  return capabilities.filter((capability2) => capability2.access !== "setup");
-}
-function normalizeConnections(connections) {
-  return connections.flatMap((connection) => {
-    const provider = normalizeConnectedAppProviderFamilyId(connection.provider);
-    if (!provider)
-      return [];
-    return [
-      {
-        id: connection.id ?? null,
-        teamId: connection.teamId?.trim() || null,
-        provider,
-        accountLabel: connection.providerAccountName ?? null,
-        workspaceLabel: connection.providerWorkspaceName ?? null,
-        scopes: Array.isArray(connection.scopes) ? connection.scopes : [],
-        capabilities: Array.isArray(connection.capabilities) ? connection.capabilities : [],
-        status: connection.status?.trim().toLowerCase() || "active"
-      }
-    ];
-  });
-}
-function surfaceStatus(entry, connected) {
-  if (entry.statusSource === "integration_connection") {
-    return connected ? "connected" : "disconnected";
-  }
-  return "setup_available";
-}
-function statusLabel(entry, status, connections) {
-  if (status === "connected") {
-    const activeCount = connections.filter((connection) => connection.status === "active").length;
-    return activeCount > 1 ? `${activeCount} connected` : "Connected";
-  }
-  if (status === "disconnected")
-    return "Not connected";
-  if (entry.statusSource === "native_binding")
-    return "Bot setup";
-  return "Configure";
-}
-function hashString(value) {
-  let hash = 5381;
-  for (let index = 0; index < value.length; index += 1) {
-    hash = (hash << 5) + hash ^ value.charCodeAt(index);
-  }
-  return (hash >>> 0).toString(36);
-}
-
-export {
-  SANDBOX_TEMPLATE_PREVIEW_PORT_MIN,
-  SANDBOX_TEMPLATE_PREVIEW_PORT_MAX,
-  OPENPOND_MANIFEST_FILE_NAME,
-  SANDBOX_TEMPLATE_BUILD_PLAN_FILE_NAME,
-  SandboxTemplateManifestSchema,
-  SandboxTemplateValidationDiagnosticSchema,
-  validateSandboxTemplateYaml,
-  formatSandboxTemplateDiagnostics,
-  sandboxTemplateExecutableEntries,
-  sandboxTemplateBuildPlan,
-  sandboxTemplateScaffoldFiles,
-  CONNECTED_APP_PROVIDER_TOOL_NAMES,
-  CONNECTED_APP_TOOL_CALL_ENDPOINT,
-  CONNECTED_APP_INTEGRATION_SKILLS,
-  connectedAppIntegrationSkillByProvider,
-  validateConnectedAppToolCallRequest,
-  connectedAppProviderOperationById,
-  validateConnectedAppProviderOperationRequest,
-  CONNECTED_APP_CATALOG,
-  connectedAppById,
-  connectedAppBundleByProvider,
-  buildConnectedAppInstallUrl,
-  normalizeConnectedAppProviderFamilyId,
-  buildConnectedAppStatusRows
-};