openpond 0.2.0 → 0.2.1

package/dist/chunks/chunk-YVCYVDNP.js

@@ -1,746 +0,0 @@
-import { createRequire as __openpondCreateRequire } from "node:module"; var require = __openpondCreateRequire(import.meta.url);
-import {
-  yaml
-} from "./chunk-X7ZG4TSW.js";
-import {
-  external_exports
-} from "./chunk-FQS2QL5F.js";
-
-// ../../packages/cloud/src/sandbox-template/manifest.ts
-var SANDBOX_TEMPLATE_PREVIEW_PORT_MIN = 3e3;
-var SANDBOX_TEMPLATE_PREVIEW_PORT_MAX = 9999;
-var OPENPOND_MANIFEST_FILE_NAME = "openpond.yaml";
-var SANDBOX_TEMPLATE_BUILD_PLAN_FILE_NAME = "openpond-template-plan.json";
-var SANDBOX_TEMPLATE_BUILD_PLAN_KIND = "openpond.sandboxTemplate.buildPlan.v1";
-var INTEGRATION_PROVIDERS = [
-  "google",
-  "github",
-  "x"
-];
-var RESERVED_PREVIEW_PORTS = /* @__PURE__ */ new Set([
-  22,
-  2222,
-  2375,
-  2376,
-  3108,
-  5900,
-  5901,
-  6080,
-  7818
-]);
-var CommandListSchema = external_exports.array(external_exports.string().trim().min(1).max(1e3)).max(50);
-var RelativeWorkspacePathSchema = external_exports.string().trim().min(1).max(4096).refine(isSafeRelativeWorkspacePath, {
-  message: "path must be a relative workspace path"
-});
-var OciImageRefSchema = external_exports.string().trim().min(1).max(500).refine(
-  (value) => !value.includes("\0") && !/\s/.test(value),
-  "image ref must be a single OCI reference"
-);
-var OciDigestSchema = external_exports.string().trim().regex(/^sha256:[0-9a-f]{64}$/i);
-var RuntimeWorkspaceRootSchema = external_exports.string().trim().min(1).max(500).refine(
-  (value) => value.startsWith("/") && !value.includes("\0"),
-  "workspaceRoot must be an absolute guest path"
-);
-var DockerfileRuntimeImageSchema = external_exports.object({
-  ref: OciImageRefSchema,
-  digest: OciDigestSchema.optional(),
-  registrySecretRef: external_exports.string().trim().min(1).max(500).optional(),
-  platform: external_exports.literal("linux/amd64").optional(),
-  workspaceRoot: RuntimeWorkspaceRootSchema.optional()
-}).strict();
-var DockerfileRuntimeSourceSchema = external_exports.object({
-  context: RelativeWorkspacePathSchema.default("."),
-  path: RelativeWorkspacePathSchema.default("Dockerfile"),
-  target: external_exports.string().trim().min(1).max(191).optional(),
-  buildArgs: external_exports.record(external_exports.string().max(191), external_exports.string().max(500)).optional(),
-  registrySecretRefs: external_exports.array(external_exports.string().trim().min(1).max(500)).max(10).optional(),
-  platform: external_exports.literal("linux/amd64").optional(),
-  workspaceRoot: RuntimeWorkspaceRootSchema.optional()
-}).strict();
-var SandboxTemplateRuntimeSchema = external_exports.object({
-  base: external_exports.string().trim().min(1).max(120).optional(),
-  snapshot: external_exports.string().trim().min(1).max(191).optional(),
-  image: DockerfileRuntimeImageSchema.optional(),
-  dockerfile: DockerfileRuntimeSourceSchema.optional()
-}).strict().superRefine((runtime, context) => {
-  const selected = [
-    runtime.base,
-    runtime.snapshot,
-    runtime.image,
-    runtime.dockerfile
-  ].filter(Boolean).length;
-  if (selected !== 1) {
-    context.addIssue({
-      code: external_exports.ZodIssueCode.custom,
-      message: "runtime must declare exactly one of base, snapshot, image, or dockerfile"
-    });
-  }
-});
-var SandboxTemplateResourcesSchema = external_exports.object({
-  cpu: external_exports.number().positive().max(8).optional(),
-  memoryGb: external_exports.number().positive().max(32).optional(),
-  diskGb: external_exports.number().positive().max(100).optional()
-}).strict();
-var SandboxTemplateRequiredLeaseSchema = external_exports.object({
-  provider: external_exports.enum(INTEGRATION_PROVIDERS),
-  scopes: external_exports.array(external_exports.string().trim().min(1).max(200)).max(100).default([]),
-  capabilities: external_exports.array(external_exports.string().trim().min(1).max(200)).max(100).default([])
-}).strict();
-var SandboxTemplateOpChatPermissionsSchema = external_exports.object({
-  models: external_exports.array(external_exports.string().trim().min(1).max(200)).max(100).default([]),
-  scopes: external_exports.array(external_exports.string().trim().min(1).max(200)).max(100).default([])
-}).strict();
-var SandboxTemplatePermissionsSchema = external_exports.object({
-  opchat: SandboxTemplateOpChatPermissionsSchema.optional()
-}).catchall(external_exports.record(external_exports.string(), external_exports.unknown())).default({});
-var SandboxTemplateVolumeSchema = external_exports.object({
-  name: external_exports.string().trim().regex(/^[A-Za-z_][A-Za-z0-9_-]*$/).max(63).optional(),
-  mountPath: external_exports.string().trim().min(1).max(256).optional(),
-  storageGb: external_exports.number().int().positive().max(100).optional(),
-  deleteOnSandboxDelete: external_exports.boolean().optional()
-}).strict();
-var SandboxTemplatePortSchema = external_exports.object({
-  port: external_exports.number().int().min(SANDBOX_TEMPLATE_PREVIEW_PORT_MIN).max(SANDBOX_TEMPLATE_PREVIEW_PORT_MAX).refine((port) => !RESERVED_PREVIEW_PORTS.has(port), {
-    message: "preview port is reserved"
-  }),
-  protocol: external_exports.literal("http").default("http"),
-  label: external_exports.string().trim().min(1).max(80).optional(),
-  access: external_exports.enum(["private", "public"]).default("private"),
-  path: external_exports.string().trim().min(1).max(512).refine((value) => value.startsWith("/"), {
-    message: "preview path must start with /"
-  }).default("/")
-}).strict();
-var SandboxTemplateCommandSchema = external_exports.object({
-  command: external_exports.string().trim().min(1).max(1e3),
-  cwd: RelativeWorkspacePathSchema.optional(),
-  timeoutSeconds: external_exports.number().int().positive().max(86400).optional(),
-  requiresStart: external_exports.boolean().default(false),
-  ports: external_exports.array(SandboxTemplatePortSchema).max(20).default([]),
-  artifactPaths: external_exports.array(RelativeWorkspacePathSchema).max(100).default([])
-}).strict();
-var SandboxTemplateNamedCommandSchema = SandboxTemplateCommandSchema.extend({
-  name: external_exports.string().trim().min(1).max(80)
-}).strict();
-var SandboxTemplateMcpEndpointSchema = external_exports.object({
-  name: external_exports.string().trim().min(1).max(80).optional(),
-  service: external_exports.string().trim().min(1).max(80).optional(),
-  port: external_exports.number().int().min(SANDBOX_TEMPLATE_PREVIEW_PORT_MIN).max(SANDBOX_TEMPLATE_PREVIEW_PORT_MAX).refine((port) => !RESERVED_PREVIEW_PORTS.has(port), {
-    message: "app MCP port is reserved"
-  }),
-  path: external_exports.string().trim().min(1).max(512).refine((value) => value.startsWith("/"), {
-    message: "app MCP path must start with /"
-  }).default("/mcp")
-}).strict();
-var SandboxTemplateValidationProbeSchema = external_exports.object({
-  name: external_exports.string().trim().min(1).max(80).optional(),
-  port: external_exports.number().int().min(SANDBOX_TEMPLATE_PREVIEW_PORT_MIN).max(SANDBOX_TEMPLATE_PREVIEW_PORT_MAX).refine((port) => !RESERVED_PREVIEW_PORTS.has(port), {
-    message: "validation probe port is reserved"
-  }),
-  path: external_exports.string().trim().min(1).max(512).refine((value) => value.startsWith("/"), {
-    message: "validation probe path must start with /"
-  }).default("/"),
-  expectedStatus: external_exports.number().int().min(100).max(599).default(200)
-}).strict();
-var SandboxTemplateJsonSchema = external_exports.record(external_exports.string(), external_exports.unknown()).refine(
-  (schema) => schema.type === "object",
-  "input schema must be a JSON schema object"
-);
-var SandboxTemplateEnvInputSchema = external_exports.object({
-  name: external_exports.string().trim().regex(/^[A-Za-z_][A-Za-z0-9_]*$/).max(191),
-  required: external_exports.boolean().default(false),
-  secret: external_exports.boolean().default(true),
-  description: external_exports.string().trim().max(500).optional()
-}).strict();
-var SandboxTemplateScheduleDateSchema = external_exports.string().trim().min(1).max(120);
-var SandboxTemplateScheduleSchema = external_exports.object({
-  name: external_exports.string().trim().min(1).max(120),
-  description: external_exports.string().trim().max(500).optional(),
-  cron: external_exports.string().trim().min(1).max(500).optional(),
-  rate: external_exports.string().trim().min(1).max(500).optional(),
-  once: SandboxTemplateScheduleDateSchema.optional(),
-  scheduleType: external_exports.enum(["rate", "cron", "once"]).optional(),
-  scheduleExpression: external_exports.string().trim().min(1).max(500).optional(),
-  timezone: external_exports.string().trim().min(1).max(100).optional(),
-  enabled: external_exports.boolean().default(true),
-  startAt: SandboxTemplateScheduleDateSchema.optional(),
-  endAt: SandboxTemplateScheduleDateSchema.optional(),
-  maxRuns: external_exports.number().int().positive().nullable().optional(),
-  runtimePolicy: external_exports.enum([
-    "run_and_stop",
-    "run_and_archive",
-    "run_and_delete",
-    "use_existing_running"
-  ]).default("run_and_stop"),
-  action: external_exports.string().trim().min(1).max(120).optional(),
-  actionName: external_exports.string().trim().min(1).max(120).optional(),
-  command: external_exports.string().trim().min(1).max(2e3).optional(),
-  target: external_exports.object({
-    kind: external_exports.enum(["start", "action", "service", "command"]).optional(),
-    name: external_exports.string().trim().min(1).max(120).optional(),
-    actionName: external_exports.string().trim().min(1).max(120).optional(),
-    command: external_exports.string().trim().min(1).max(2e3).optional(),
-    requiresStart: external_exports.boolean().optional()
-  }).strict().optional(),
-  requiresStart: external_exports.boolean().optional(),
-  budget: external_exports.object({
-    maxUsd: external_exports.string().trim().min(1).max(40).optional()
-  }).strict().optional(),
-  resources: SandboxTemplateResourcesSchema.optional(),
-  quotas: external_exports.record(external_exports.string(), external_exports.unknown()).optional(),
-  lifecycle: external_exports.record(external_exports.string(), external_exports.unknown()).optional(),
-  retentionPolicy: external_exports.record(external_exports.string(), external_exports.unknown()).optional(),
-  env: external_exports.array(
-    external_exports.object({
-      name: external_exports.string().trim().regex(/^[A-Za-z_][A-Za-z0-9_]*$/).max(191),
-      value: external_exports.string().optional(),
-      secretRef: external_exports.string().optional()
-    }).strict()
-  ).max(100).optional(),
-  integrationLeases: external_exports.array(external_exports.record(external_exports.string(), external_exports.unknown())).max(20).optional(),
-  metadata: external_exports.record(external_exports.string(), external_exports.unknown()).optional()
-}).strict().superRefine((schedule, context) => {
-  const expressionCount = [
-    schedule.cron,
-    schedule.rate,
-    schedule.once,
-    schedule.scheduleExpression
-  ].filter((value) => typeof value === "string" && value.trim()).length;
-  if (expressionCount !== 1) {
-    context.addIssue({
-      code: external_exports.ZodIssueCode.custom,
-      path: ["scheduleExpression"],
-      message: "schedule must declare exactly one of cron, rate, once, or scheduleExpression"
-    });
-  }
-  if (schedule.scheduleExpression && !schedule.scheduleType) {
-    context.addIssue({
-      code: external_exports.ZodIssueCode.custom,
-      path: ["scheduleType"],
-      message: "scheduleType is required with scheduleExpression"
-    });
-  }
-  const command = schedule.command ?? schedule.target?.command ?? null;
-  const targetName = schedule.target?.name ?? null;
-  const actionName = schedule.actionName ?? schedule.action ?? schedule.target?.actionName ?? (schedule.target?.kind === "action" ? targetName : null);
-  const kind = schedule.target?.kind ?? (command ? "command" : "action");
-  if (kind === "action" && !actionName) {
-    context.addIssue({
-      code: external_exports.ZodIssueCode.custom,
-      path: ["action"],
-      message: "schedule action target is required"
-    });
-  }
-  if (kind === "service" && !targetName) {
-    context.addIssue({
-      code: external_exports.ZodIssueCode.custom,
-      path: ["target", "name"],
-      message: "schedule service target name is required"
-    });
-  }
-  if (kind === "command" && !command) {
-    context.addIssue({
-      code: external_exports.ZodIssueCode.custom,
-      path: ["command"],
-      message: "schedule command target is required"
-    });
-  }
-});
-var SandboxTemplateManifestSchema = external_exports.object({
-  schemaVersion: external_exports.literal(1),
-  name: external_exports.string().trim().min(1).max(80).regex(/^[a-z0-9][a-z0-9-]*[a-z0-9]$/),
-  version: external_exports.string().trim().min(1).max(40),
-  useCase: external_exports.string().trim().min(1).max(80),
-  description: external_exports.string().trim().min(1).max(500),
-  runtime: SandboxTemplateRuntimeSchema,
-  resources: SandboxTemplateResourcesSchema.optional(),
-  setup: external_exports.object({
-    commands: CommandListSchema.default([])
-  }).strict().default({ commands: [] }),
-  validation: external_exports.object({
-    commands: CommandListSchema.min(1),
-    probes: external_exports.array(SandboxTemplateValidationProbeSchema).max(20).default([])
-  }).strict(),
-  start: SandboxTemplateCommandSchema,
-  actions: external_exports.array(SandboxTemplateNamedCommandSchema).max(20).default([]),
-  services: external_exports.array(SandboxTemplateNamedCommandSchema).max(20).default([]),
-  schedules: external_exports.array(SandboxTemplateScheduleSchema).max(20).default([]),
-  mcp: external_exports.object({
-    endpoints: external_exports.array(SandboxTemplateMcpEndpointSchema).max(10).default([])
-  }).strict().default({ endpoints: [] }),
-  volumes: external_exports.array(SandboxTemplateVolumeSchema).max(5).default([]),
-  integrations: external_exports.object({
-    requiredLeases: external_exports.array(SandboxTemplateRequiredLeaseSchema).max(20).default([])
-  }).strict().default({ requiredLeases: [] }),
-  permissions: SandboxTemplatePermissionsSchema,
-  inputs: external_exports.object({
-    schema: SandboxTemplateJsonSchema.default({ type: "object" }),
-    env: external_exports.array(SandboxTemplateEnvInputSchema).max(100).default([])
-  }).strict().default({ schema: { type: "object" }, env: [] }),
-  artifacts: external_exports.object({
-    paths: external_exports.array(RelativeWorkspacePathSchema).max(100).default([])
-  }).strict().default({ paths: [] }),
-  network: external_exports.object({
-    egress: external_exports.enum(["restricted", "allow", "block"]).default("restricted")
-  }).strict().default({ egress: "restricted" })
-}).strict().superRefine((manifest, context) => {
-  validateExecutableNames(manifest, context);
-  addDuplicateNameIssue(
-    context,
-    manifest.volumes.flatMap((volume) => volume.name ? [volume.name] : []),
-    "volume names must be unique",
-    "volumes"
-  );
-  validateInputSchemaUploadTargets(manifest, context);
-  validateEnvInputs(manifest, context);
-  validateMcpEndpoints(manifest, context);
-  validateScheduleTargets(manifest, context);
-});
-var SandboxTemplateValidationDiagnosticSchema = external_exports.object({
-  path: external_exports.string(),
-  message: external_exports.string(),
-  code: external_exports.string()
-});
-function validateSandboxTemplateYaml(source) {
-  let parsed;
-  try {
-    parsed = yaml.load(source);
-  } catch (error) {
-    return {
-      ok: false,
-      manifest: null,
-      diagnostics: [
-        {
-          path: "$",
-          code: "invalid_yaml",
-          message: error instanceof Error ? error.message : "Invalid YAML"
-        }
-      ]
-    };
-  }
-  return validateSandboxTemplateManifest(parsed);
-}
-function validateSandboxTemplateManifest(value) {
-  if (!value || typeof value !== "object" || Array.isArray(value)) {
-    return {
-      ok: false,
-      manifest: null,
-      diagnostics: [
-        {
-          path: "$",
-          code: "invalid_type",
-          message: `${OPENPOND_MANIFEST_FILE_NAME} must be an object`
-        }
-      ]
-    };
-  }
-  if (Object.prototype.hasOwnProperty.call(value, "databases")) {
-    return {
-      ok: false,
-      manifest: null,
-      diagnostics: [
-        {
-          path: "$.databases",
-          code: "database_resources_removed",
-          message: "managed database requests are unsupported for Firecracker sandbox templates; use a durable volume with SQLite or files instead"
-        }
-      ]
-    };
-  }
-  const result = SandboxTemplateManifestSchema.safeParse(value);
-  if (result.success)
-    return { ok: true, manifest: result.data, diagnostics: [] };
-  return {
-    ok: false,
-    manifest: null,
-    diagnostics: result.error.issues.map((issue) => ({
-      path: formatIssuePath(issue.path),
-      code: issue.code,
-      message: issue.message
-    }))
-  };
-}
-function formatSandboxTemplateDiagnostics(diagnostics) {
-  return diagnostics.map((diagnostic) => `${diagnostic.path}: ${diagnostic.message}`).join("\n");
-}
-function sandboxTemplateExecutableEntries(manifest) {
-  return [
-    {
-      kind: "start",
-      name: "start",
-      ...manifest.start,
-      artifactPaths: commandArtifactPaths(manifest.start, manifest)
-    },
-    ...manifest.actions.map((action) => ({
-      kind: "action",
-      name: action.name,
-      command: action.command,
-      cwd: action.cwd,
-      timeoutSeconds: action.timeoutSeconds,
-      requiresStart: action.requiresStart,
-      ports: action.ports,
-      artifactPaths: commandArtifactPaths(action, manifest)
-    })),
-    ...manifest.services.map((service) => ({
-      kind: "service",
-      name: service.name,
-      command: service.command,
-      cwd: service.cwd,
-      timeoutSeconds: service.timeoutSeconds,
-      requiresStart: service.requiresStart,
-      ports: service.ports,
-      artifactPaths: commandArtifactPaths(service, manifest)
-    }))
-  ];
-}
-function sandboxTemplateBuildMetadata(manifest) {
-  const executables = sandboxTemplateExecutableEntries(manifest);
-  return {
-    template: {
-      name: manifest.name,
-      version: manifest.version,
-      useCase: manifest.useCase,
-      runtime: manifest.runtime
-    },
-    resources: manifest.resources ?? null,
-    volumes: manifest.volumes,
-    executables: executables.map((entry) => ({
-      kind: entry.kind,
-      name: entry.name,
-      command: entry.command,
-      cwd: entry.cwd ?? null,
-      timeoutSeconds: entry.timeoutSeconds ?? null,
-      requiresStart: entry.requiresStart,
-      ports: entry.ports.map((port) => port.port),
-      artifactPaths: entry.artifactPaths
-    })),
-    ports: executables.flatMap(
-      (entry) => entry.ports.map((port) => ({
-        executable: entry.name,
-        kind: entry.kind,
-        port: port.port,
-        access: port.access,
-        label: port.label ?? null
-      }))
-    ),
-    appMcpEndpoints: manifest.mcp.endpoints.map((endpoint) => ({
-      name: endpoint.name ?? null,
-      service: endpoint.service ?? null,
-      port: endpoint.port,
-      path: endpoint.path
-    })),
-    validation: {
-      commands: manifest.validation.commands,
-      probes: manifest.validation.probes
-    },
-    schedules: manifest.schedules
-  };
-}
-function sandboxTemplateBuildPlan(input) {
-  return {
-    kind: SANDBOX_TEMPLATE_BUILD_PLAN_KIND,
-    schemaVersion: 1,
-    manifestFile: input.manifestFile,
-    projectRoot: input.projectRoot,
-    manifest: input.manifest,
-    metadata: sandboxTemplateBuildMetadata(input.manifest),
-    executables: sandboxTemplateExecutableEntries(input.manifest)
-  };
-}
-function sandboxTemplateScaffoldFiles(input) {
-  const displayName = input.name.trim() || "Sandbox Template";
-  const name = slug(displayName);
-  const description = input.description?.trim() || `Local scaffold for ${displayName}.`;
-  return {
-    ".gitignore": ["node_modules", "artifacts", ".DS_Store", ""].join("\n"),
-    "README.md": [
-      `# ${displayName}`,
-      "",
-      "Local sandbox template scaffold.",
-      "",
-      "## Commands",
-      "",
-      "- `pnpm dev` starts the preview service on port 3000.",
-      "- `pnpm process` writes a sample artifact.",
-      `- \`pnpm validate\` validates ${OPENPOND_MANIFEST_FILE_NAME}.`,
-      ""
-    ].join("\n"),
-    "package.json": `${JSON.stringify(
-      {
-        private: true,
-        type: "module",
-        scripts: {
-          dev: "node src/server.ts",
-          process: "node scripts/process.ts",
-          validate: `openpond sandbox-template validate --file ${OPENPOND_MANIFEST_FILE_NAME}`
-        }
-      },
-      null,
-      2
-    )}
-`,
-    [OPENPOND_MANIFEST_FILE_NAME]: [
-      "schemaVersion: 1",
-      `name: ${name}`,
-      "version: 0.1.0",
-      "useCase: sandbox-template-scaffold",
-      `description: ${description}`,
-      "runtime:",
-      "  base: node-bun-workspace",
-      "resources:",
-      "  cpu: 1",
-      "  memoryGb: 1",
-      "  diskGb: 8",
-      "setup:",
-      "  commands:",
-      "    - mkdir -p artifacts",
-      "validation:",
-      "  commands:",
-      "    - test -f src/server.ts",
-      "    - test -f scripts/process.ts",
-      "start:",
-      "  command: pnpm process",
-      "  timeoutSeconds: 300",
-      "  ports: []",
-      "  artifactPaths:",
-      "    - artifacts/result.json",
-      "actions: []",
-      "schedules: []",
-      "services:",
-      "  - name: web",
-      "    command: pnpm dev",
-      "    timeoutSeconds: 3600",
-      "    ports:",
-      "      - port: 3000",
-      "        protocol: http",
-      "        label: web",
-      "        access: private",
-      "        path: /",
-      "    artifactPaths: []",
-      "inputs:",
-      "  env:",
-      "    - name: FOO_API_KEY",
-      "      required: false",
-      "      secret: true",
-      "      description: API key used by the sample action.",
-      "  schema:",
-      "    type: object",
-      "    properties:",
-      "      subject:",
-      "        type: string",
-      "        title: Subject",
-      "        default: Example",
-      "artifacts:",
-      "  paths:",
-      "    - artifacts/result.json",
-      "network:",
-      "  egress: restricted",
-      ""
-    ].join("\n"),
-    "src/server.ts": [
-      "import { createServer } from 'node:http';",
-      "",
-      "createServer((_request, response) => {",
-      "  response.setHeader('content-type', 'application/json');",
-      "  response.end(JSON.stringify({ ok: true, template: 'sandbox-template-scaffold' }));",
-      "}).listen(3000, '0.0.0.0');",
-      ""
-    ].join("\n"),
-    "scripts/process.ts": [
-      "import { mkdir, writeFile } from 'node:fs/promises';",
-      "",
-      "const raw = process.env.OPENPOND_REPLAY_PARAMS_BASE64;",
-      "const params = raw ? JSON.parse(Buffer.from(raw, 'base64').toString('utf8')).input ?? {} : {};",
-      "await mkdir('artifacts', { recursive: true });",
-      "await writeFile('artifacts/result.json', JSON.stringify({ ok: true, input: params }, null, 2));",
-      "console.log('wrote artifacts/result.json');",
-      ""
-    ].join("\n"),
-    "fixtures/input.txt": "Example input\n"
-  };
-}
-function sandboxTemplateJsonSchema() {
-  return external_exports.toJSONSchema(SandboxTemplateManifestSchema);
-}
-function isSafeRelativeWorkspacePath(value) {
-  return !value.includes("\0") && !value.startsWith("/") && !value.split(/[\\/]+/).some((segment) => segment === ".." || segment === "");
-}
-function formatIssuePath(path) {
-  if (path.length === 0) return "$";
-  return `$${path.map(
-    (part) => typeof part === "number" ? `[${part}]` : `.${String(part)}`
-  ).join("")}`;
-}
-function addDuplicateNameIssue(context, names, message, path) {
-  const seen = /* @__PURE__ */ new Set();
-  for (const name of names) {
-    if (seen.has(name)) {
-      context.addIssue({
-        code: external_exports.ZodIssueCode.custom,
-        path: [path],
-        message
-      });
-      return;
-    }
-    seen.add(name);
-  }
-}
-function validateExecutableNames(manifest, context) {
-  const names = [
-    "start",
-    ...manifest.actions.map((action) => action.name),
-    ...manifest.services.map((service) => service.name)
-  ];
-  addDuplicateNameIssue(
-    context,
-    names,
-    "start, action, and service names must be unique",
-    "actions"
-  );
-}
-function validateInputSchemaUploadTargets(manifest, context) {
-  const properties = asRecord(manifest.inputs.schema.properties);
-  const volumeNames = new Set(
-    manifest.volumes.map((volume) => volume.name).filter((name) => Boolean(name))
-  );
-  for (const [inputName, rawProperty] of Object.entries(properties)) {
-    const property = asRecord(rawProperty);
-    const upload = asRecord(
-      property["x-openpond-upload"] ?? property.xOpenPondUpload
-    );
-    const targetPath = typeof upload.targetPath === "string" && upload.targetPath.trim() ? upload.targetPath.trim() : typeof upload.path === "string" && upload.path.trim() ? upload.path.trim() : "";
-    if (!targetPath) continue;
-    const normalizedTargetPath = targetPath.replace(/^workspace\//, "").replace(/^\/+/, "").replace(/\/+$/, "");
-    if (!isSafeRelativeWorkspacePath(normalizedTargetPath)) {
-      context.addIssue({
-        code: external_exports.ZodIssueCode.custom,
-        path: [
-          "inputs",
-          "schema",
-          "properties",
-          inputName,
-          "x-openpond-upload",
-          "targetPath"
-        ],
-        message: "upload target must be a relative workspace path"
-      });
-      continue;
-    }
-    const parts = normalizedTargetPath.split("/");
-    if (parts[0] === "volumes" && (!parts[1] || !volumeNames.has(parts[1]))) {
-      context.addIssue({
-        code: external_exports.ZodIssueCode.custom,
-        path: [
-          "inputs",
-          "schema",
-          "properties",
-          inputName,
-          "x-openpond-upload",
-          "targetPath"
-        ],
-        message: "upload target references an undeclared volume"
-      });
-    }
-  }
-}
-function validateEnvInputs(manifest, context) {
-  addDuplicateNameIssue(
-    context,
-    manifest.inputs.env.map((env) => env.name),
-    "env input names must be unique",
-    "inputs"
-  );
-}
-function validateMcpEndpoints(manifest, context) {
-  const servicePorts = new Map(
-    manifest.services.map((service) => [
-      service.name,
-      new Set(service.ports.map((port) => port.port))
-    ])
-  );
-  const declaredPorts = /* @__PURE__ */ new Set([
-    ...manifest.start.ports.map((port) => port.port),
-    ...manifest.services.flatMap(
-      (service) => service.ports.map((port) => port.port)
-    )
-  ]);
-  for (const [index, endpoint] of manifest.mcp.endpoints.entries()) {
-    if (endpoint.service) {
-      const ports = servicePorts.get(endpoint.service);
-      if (!ports) {
-        context.addIssue({
-          code: external_exports.ZodIssueCode.custom,
-          path: ["mcp", "endpoints", index, "service"],
-          message: `app MCP service does not exist: ${endpoint.service}`
-        });
-        continue;
-      }
-      if (!ports.has(endpoint.port)) {
-        context.addIssue({
-          code: external_exports.ZodIssueCode.custom,
-          path: ["mcp", "endpoints", index, "port"],
-          message: `app MCP port ${endpoint.port} is not declared on service ${endpoint.service}`
-        });
-      }
-      continue;
-    }
-    if (!declaredPorts.has(endpoint.port)) {
-      context.addIssue({
-        code: external_exports.ZodIssueCode.custom,
-        path: ["mcp", "endpoints", index, "port"],
-        message: `app MCP port ${endpoint.port} is not declared on start or services`
-      });
-    }
-  }
-}
-function validateScheduleTargets(manifest, context) {
-  const actionNames = new Set(manifest.actions.map((action) => action.name));
-  const serviceNames = new Set(
-    manifest.services.map((service) => service.name)
-  );
-  for (const [index, schedule] of manifest.schedules.entries()) {
-    const command = schedule.command ?? schedule.target?.command ?? null;
-    if (schedule.target?.kind === "command" || command) {
-      continue;
-    }
-    const actionName = schedule.actionName ?? schedule.action ?? schedule.target?.actionName ?? (schedule.target?.kind === "action" ? schedule.target?.name : null);
-    if (actionName && !actionNames.has(actionName)) {
-      context.addIssue({
-        code: external_exports.ZodIssueCode.custom,
-        path: ["schedules", index, "action"],
-        message: `schedule action target does not exist: ${actionName}`
-      });
-    }
-    if (schedule.target?.kind === "service") {
-      const serviceName = schedule.target.name ?? "";
-      if (serviceName && !serviceNames.has(serviceName)) {
-        context.addIssue({
-          code: external_exports.ZodIssueCode.custom,
-          path: ["schedules", index, "target", "name"],
-          message: `schedule service target does not exist: ${serviceName}`
-        });
-      }
-    }
-  }
-}
-function asRecord(value) {
-  return value && typeof value === "object" && !Array.isArray(value) ? value : {};
-}
-function commandArtifactPaths(command, manifest) {
-  return command.artifactPaths.length > 0 ? command.artifactPaths : manifest.artifacts.paths;
-}
-function slug(value) {
-  return value.toLowerCase().replace(/[^a-z0-9-]+/g, "-").replace(/^-+|-+$/g, "").replace(/-{2,}/g, "-").slice(0, 80) || "sandbox-template";
-}
-
-export {
-  OPENPOND_MANIFEST_FILE_NAME,
-  SANDBOX_TEMPLATE_BUILD_PLAN_FILE_NAME,
-  SANDBOX_TEMPLATE_BUILD_PLAN_KIND,
-  validateSandboxTemplateYaml,
-  formatSandboxTemplateDiagnostics,
-  sandboxTemplateExecutableEntries,
-  sandboxTemplateBuildMetadata,
-  sandboxTemplateBuildPlan,
-  sandboxTemplateScaffoldFiles,
-  sandboxTemplateJsonSchema
-};