@ekanos/cli 0.15.0 → 0.17.0

package/dist/dev-experience.d.ts

@@ -0,0 +1,125 @@
+import { type Contract, type SourceCatalog } from '@ekanos/integration-schema';
+import type { ContractSource } from './experience/contract-sources.js';
+/**
+ * `ekanos dev` for an EXPERIENCE project: kind detection, loading the
+ * harness's integration resolver from the project's own install, the CLI session
+ * catalog hand-off, and the override helper `publish` uses.
+ */
+export type DevKind = 'integration' | 'experience';
+/** `kind` from the raw `ekanos.json`; anything unreadable is `integration`. */
+export declare function detectKind(projectDir: string): DevKind;
+export interface ExperienceProject {
+    slug: string;
+    entry: string;
+}
+export declare function readExperienceProject(projectDir: string): ExperienceProject;
+/** The slice of `@ekanos/harness/resolver` the CLI uses. */
+export interface HarnessResolver {
+    resolveIntegrations(options: {
+        projectRoot: string;
+        env?: Readonly<Record<string, string | undefined>>;
+        contractsDir?: string;
+        catalog?: SourceCatalog | null;
+    }): Promise<{
+        integrations: unknown[];
+        overrides: Array<{
+            integration: string;
+            path: string;
+            via: 'file' | 'env';
+        }>;
+        notices: string[];
+        errors: Array<{
+            integration: string;
+            message: string;
+        }>;
+    }>;
+    formatProvenanceLines(resolution: never): string[];
+    createRegistryContractSource(options: {
+        projectRoot: string;
+        env?: Readonly<Record<string, string | undefined>>;
+        contractsDir?: string;
+    }): ContractSource;
+    createPinsResolver?(options: {
+        projectRoot: string;
+        env?: Readonly<Record<string, string | undefined>>;
+        contractsDir?: string;
+    }): Promise<(integration: {
+        name: string;
+        version: string;
+    }) => {
+        contract: Contract;
+        lines: string[];
+    } | null>;
+    runOperationOnce?(options: {
+        projectRoot: string;
+        op: string;
+        input?: unknown;
+        mode?: 'fixtures' | 'live';
+        env?: Readonly<Record<string, string | undefined>>;
+        deriveContract?: (args: {
+            definition: unknown;
+            projectDir: string;
+            packageVersion: string;
+        }) => Contract | null;
+    }): Promise<{
+        ok: true;
+        data: unknown;
+    } | {
+        ok: false;
+        reason: string;
+        message: string;
+        detail?: string;
+    }>;
+    activeOverrides(projectRoot: string, env?: Readonly<Record<string, string | undefined>>): Array<{
+        integration: string;
+        path: string;
+        via: 'file' | 'env';
+    }>;
+}
+/**
+ * Import the resolver FROM THE PROJECT'S install of `@ekanos/harness`, so the
+ * integrations are resolved by exactly the harness version that will serve them.
+ */
+export declare function loadHarnessResolver(projectDir: string): Promise<HarnessResolver>;
+export declare const SESSION_CATALOG_FILE: string;
+/**
+ * Hand the harness the dev's Source catalog (no token in it) so it can answer
+ * availability and develop permission. Removes a stale file when there is no
+ * catalog, so yesterday's answer is never trusted today.
+ */
+export declare function writeSessionCatalog(projectDir: string, catalog: SourceCatalog | null): void;
+/**
+ * Local overrides in force for a project, for `ekanos publish` to refuse on.
+ * Reads the harness's own definition of an override (file and env var), so
+ * the two can never disagree. Falls back to none when the harness is absent
+ * (an integration project has no overrides).
+ */
+export declare function activeOverridesFor(projectDir: string, env: Readonly<Record<string, string | undefined>>): Promise<Array<{
+    integration: string;
+    path: string;
+    via: 'file' | 'env';
+}>>;
+/**
+ * The harness's pins resolver for `ekanos check` / `publish`: integration pins are
+ * checked against what the registry chain resolves (catalog, published-package
+ * cache, contracts directory), local overrides ignored. Null when the project
+ * has no installed harness that offers one; the committed snapshots then decide.
+ */
+export declare function harnessPinsResolver(projectDir: string, env: Readonly<Record<string, string | undefined>>): Promise<((integration: {
+    name: string;
+    version: string;
+}) => {
+    contract: Contract;
+    lines: string[];
+} | null) | null>;
+/**
+ * The harness resolver as an extra `add`/`sync` contract source (catalog,
+ * published-package cache, contracts directory). Empty when the project has
+ * no installed harness that offers one — the offline sources still apply.
+ */
+export declare function harnessContractSources(projectDir: string, env: Readonly<Record<string, string | undefined>>, options?: {
+    /** `--contracts-dir`: wins over `EKANOS_CONTRACTS_DIR`, as in `ekanos dev`. */
+    contractsDir?: string;
+    /** Told once when the project's harness cannot be asked at all. */
+    onUnavailable?: (reason: string) => void;
+}): Promise<ContractSource[]>;

package/dist/dev-experience.js

@@ -0,0 +1,128 @@
+import { SourceCatalogSchema, } from '@ekanos/integration-schema';
+import * as fs from 'node:fs';
+import { createRequire } from 'node:module';
+import * as path from 'node:path';
+import { pathToFileURL } from 'node:url';
+import { preconditionError } from './errors.js';
+/** `kind` from the raw `ekanos.json`; anything unreadable is `integration`. */
+export function detectKind(projectDir) {
+    try {
+        const raw = JSON.parse(fs.readFileSync(path.join(projectDir, 'ekanos.json'), 'utf8'));
+        return raw.kind === 'experience' ? 'experience' : 'integration';
+    }
+    catch (_a) {
+        return 'integration';
+    }
+}
+export function readExperienceProject(projectDir) {
+    const file = path.join(projectDir, 'ekanos.json');
+    let raw;
+    try {
+        raw = JSON.parse(fs.readFileSync(file, 'utf8'));
+    }
+    catch (error) {
+        throw preconditionError(`${file} could not be read: ${error instanceof Error ? error.message : String(error)}`, 'Fix ekanos.json, then re-run "ekanos dev".');
+    }
+    if (typeof raw.slug !== 'string' || typeof raw.entry !== 'string') {
+        throw preconditionError('An experience ekanos.json needs a "slug" and an "entry".', 'Add them (see "ekanos init --kind experience"), then re-run "ekanos dev".');
+    }
+    return { slug: raw.slug, entry: raw.entry };
+}
+/**
+ * Import the resolver FROM THE PROJECT'S install of `@ekanos/harness`, so the
+ * integrations are resolved by exactly the harness version that will serve them.
+ */
+export async function loadHarnessResolver(projectDir) {
+    let resolved = null;
+    // An experience installs the harness itself; an integration repo's lives in
+    // the generated shell under `.ekanos/harness`.
+    for (const base of [
+        projectDir,
+        path.join(projectDir, '.ekanos', 'harness'),
+    ]) {
+        try {
+            resolved = createRequire(path.join(base, 'package.json')).resolve('@ekanos/harness/resolver');
+            break;
+        }
+        catch (_a) {
+            resolved = null;
+        }
+    }
+    if (!resolved) {
+        throw preconditionError('The installed @ekanos/harness has no "./resolver" export, which an experience needs to resolve its integrations.', 'Upgrade @ekanos/harness and @ekanos/cli together, then re-run "ekanos dev".');
+    }
+    return (await import(pathToFileURL(resolved).href));
+}
+export const SESSION_CATALOG_FILE = path.join('.ekanos', 'session-catalog.json');
+/**
+ * Hand the harness the dev's Source catalog (no token in it) so it can answer
+ * availability and develop permission. Removes a stale file when there is no
+ * catalog, so yesterday's answer is never trusted today.
+ */
+export function writeSessionCatalog(projectDir, catalog) {
+    const file = path.join(projectDir, SESSION_CATALOG_FILE);
+    if (!catalog) {
+        fs.rmSync(file, { force: true });
+        return;
+    }
+    const parsed = SourceCatalogSchema.safeParse(catalog);
+    if (!parsed.success)
+        return;
+    fs.mkdirSync(path.dirname(file), { recursive: true });
+    fs.writeFileSync(file, `${JSON.stringify(parsed.data)}\n`, { mode: 0o600 });
+}
+/**
+ * Local overrides in force for a project, for `ekanos publish` to refuse on.
+ * Reads the harness's own definition of an override (file and env var), so
+ * the two can never disagree. Falls back to none when the harness is absent
+ * (an integration project has no overrides).
+ */
+export async function activeOverridesFor(projectDir, env) {
+    if (detectKind(projectDir) !== 'experience')
+        return [];
+    const resolver = await loadHarnessResolver(projectDir);
+    return resolver.activeOverrides(projectDir, env);
+}
+/**
+ * The harness's pins resolver for `ekanos check` / `publish`: integration pins are
+ * checked against what the registry chain resolves (catalog, published-package
+ * cache, contracts directory), local overrides ignored. Null when the project
+ * has no installed harness that offers one; the committed snapshots then decide.
+ */
+export async function harnessPinsResolver(projectDir, env) {
+    try {
+        const resolver = await loadHarnessResolver(projectDir);
+        if (typeof resolver.createPinsResolver !== 'function')
+            return null;
+        const contractsDir = env.EKANOS_CONTRACTS_DIR;
+        return await resolver.createPinsResolver(Object.assign({ projectRoot: projectDir, env }, (contractsDir ? { contractsDir: path.resolve(contractsDir) } : {})));
+    }
+    catch (_a) {
+        return null;
+    }
+}
+/**
+ * The harness resolver as an extra `add`/`sync` contract source (catalog,
+ * published-package cache, contracts directory). Empty when the project has
+ * no installed harness that offers one — the offline sources still apply.
+ */
+export async function harnessContractSources(projectDir, env, options = {}) {
+    var _a, _b;
+    var _c;
+    try {
+        const resolver = await loadHarnessResolver(projectDir);
+        if (typeof resolver.createRegistryContractSource !== 'function') {
+            (_a = options.onUnavailable) === null || _a === void 0 ? void 0 : _a.call(options, 'the installed @ekanos/harness has no registry contract source');
+            return [];
+        }
+        const contractsDir = (_c = options.contractsDir) !== null && _c !== void 0 ? _c : env.EKANOS_CONTRACTS_DIR;
+        return [
+            resolver.createRegistryContractSource(Object.assign({ projectRoot: projectDir, env }, (contractsDir ? { contractsDir: path.resolve(contractsDir) } : {}))),
+        ];
+    }
+    catch (error) {
+        (_b = options.onUnavailable) === null || _b === void 0 ? void 0 : _b.call(options, error instanceof Error ? error.message : String(error));
+        return [];
+    }
+}
+//# sourceMappingURL=dev-experience.js.map

package/dist/dev-experience.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"dev-experience.js","sourceRoot":"","sources":["../src/dev-experience.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,mBAAmB,GAGpB,MAAM,4BAA4B,CAAC;AACpC,OAAO,KAAK,EAAE,MAAM,SAAS,CAAC;AAC9B,OAAO,EAAE,aAAa,EAAE,MAAM,aAAa,CAAC;AAC5C,OAAO,KAAK,IAAI,MAAM,WAAW,CAAC;AAClC,OAAO,EAAE,aAAa,EAAE,MAAM,UAAU,CAAC;AAEzC,OAAO,EAAE,iBAAiB,EAAE,MAAM,UAAU,CAAC;AAW7C,+EAA+E;AAC/E,MAAM,UAAU,UAAU,CAAC,UAAkB;IAC3C,IAAI,CAAC;QACH,MAAM,GAAG,GAAG,IAAI,CAAC,KAAK,CACpB,EAAE,CAAC,YAAY,CAAC,IAAI,CAAC,IAAI,CAAC,UAAU,EAAE,aAAa,CAAC,EAAE,MAAM,CAAC,CACxC,CAAC;QACxB,OAAO,GAAG,CAAC,IAAI,KAAK,YAAY,CAAC,CAAC,CAAC,YAAY,CAAC,CAAC,CAAC,aAAa,CAAC;IAClE,CAAC;eAAO,CAAC;QACP,OAAO,aAAa,CAAC;IACvB,CAAC;AACH,CAAC;AAOD,MAAM,UAAU,qBAAqB,CAAC,UAAkB;IACtD,MAAM,IAAI,GAAG,IAAI,CAAC,IAAI,CAAC,UAAU,EAAE,aAAa,CAAC,CAAC;IAClD,IAAI,GAAwC,CAAC;IAC7C,IAAI,CAAC;QACH,GAAG,GAAG,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC,YAAY,CAAC,IAAI,EAAE,MAAM,CAAC,CAAe,CAAC;IAChE,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,MAAM,iBAAiB,CACrB,GAAG,IAAI,uBAAuB,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,EAAE,EACtF,4CAA4C,CAC7C,CAAC;IACJ,CAAC;IACD,IAAI,OAAO,GAAG,CAAC,IAAI,KAAK,QAAQ,IAAI,OAAO,GAAG,CAAC,KAAK,KAAK,QAAQ,EAAE,CAAC;QAClE,MAAM,iBAAiB,CACrB,0DAA0D,EAC1D,2EAA2E,CAC5E,CAAC;IACJ,CAAC;IACD,OAAO,EAAE,IAAI,EAAE,GAAG,CAAC,IAAI,EAAE,KAAK,EAAE,GAAG,CAAC,KAAK,EAAE,CAAC;AAC9C,CAAC;AAwDD;;;GAGG;AACH,MAAM,CAAC,KAAK,UAAU,mBAAmB,CACvC,UAAkB;IAElB,IAAI,QAAQ,GAAkB,IAAI,CAAC;IACnC,4EAA4E;IAC5E,+CAA+C;IAC/C,KAAK,MAAM,IAAI,IAAI;QACjB,UAAU;QACV,IAAI,CAAC,IAAI,CAAC,UAAU,EAAE,SAAS,EAAE,SAAS,CAAC;KAC5C,EAAE,CAAC;QACF,IAAI,CAAC;YACH,QAAQ,GAAG,aAAa,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,cAAc,CAAC,CAAC,CAAC,OAAO,CAC/D,0BAA0B,CAC3B,CAAC;YACF,MAAM;QACR,CAAC;mBAAO,CAAC;YACP,QAAQ,GAAG,IAAI,CAAC;QAClB,CAAC;IACH,CAAC;IACD,IAAI,CAAC,QAAQ,EAAE,CAAC;QACd,MAAM,iBAAiB,CACrB,kHAAkH,EAClH,6EAA6E,CAC9E,CAAC;IACJ,CAAC;IACD,OAAO,CAAC,MAAM,MAAM,CAAC,aAAa,CAAC,QAAQ,CAAC,CAAC,IAAI,CAAC,CAAoB,CAAC;AACzE,CAAC;AAED,MAAM,CAAC,MAAM,oBAAoB,GAAG,IAAI,CAAC,IAAI,CAC3C,SAAS,EACT,sBAAsB,CACvB,CAAC;AAEF;;;;GAIG;AACH,MAAM,UAAU,mBAAmB,CACjC,UAAkB,EAClB,OAA6B;IAE7B,MAAM,IAAI,GAAG,IAAI,CAAC,IAAI,CAAC,UAAU,EAAE,oBAAoB,CAAC,CAAC;IACzD,IAAI,CAAC,OAAO,EAAE,CAAC;QACb,EAAE,CAAC,MAAM,CAAC,IAAI,EAAE,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC;QACjC,OAAO;IACT,CAAC;IACD,MAAM,MAAM,GAAG,mBAAmB,CAAC,SAAS,CAAC,OAAO,CAAC,CAAC;IACtD,IAAI,CAAC,MAAM,CAAC,OAAO;QAAE,OAAO;IAC5B,EAAE,CAAC,SAAS,CAAC,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;IACtD,EAAE,CAAC,aAAa,CAAC,IAAI,EAAE,GAAG,IAAI,CAAC,SAAS,CAAC,MAAM,CAAC,IAAI,CAAC,IAAI,EAAE,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC;AAC9E,CAAC;AAED;;;;;GAKG;AACH,MAAM,CAAC,KAAK,UAAU,kBAAkB,CACtC,UAAkB,EAClB,GAAiD;IAEjD,IAAI,UAAU,CAAC,UAAU,CAAC,KAAK,YAAY;QAAE,OAAO,EAAE,CAAC;IACvD,MAAM,QAAQ,GAAG,MAAM,mBAAmB,CAAC,UAAU,CAAC,CAAC;IACvD,OAAO,QAAQ,CAAC,eAAe,CAAC,UAAU,EAAE,GAAG,CAAC,CAAC;AACnD,CAAC;AAED;;;;;GAKG;AACH,MAAM,CAAC,KAAK,UAAU,mBAAmB,CACvC,UAAkB,EAClB,GAAiD;IAEjD,IAAI,CAAC;QACH,MAAM,QAAQ,GAAG,MAAM,mBAAmB,CAAC,UAAU,CAAC,CAAC;QACvD,IAAI,OAAO,QAAQ,CAAC,kBAAkB,KAAK,UAAU;YAAE,OAAO,IAAI,CAAC;QACnE,MAAM,YAAY,GAAG,GAAG,CAAC,oBAAoB,CAAC;QAC9C,OAAO,MAAM,QAAQ,CAAC,kBAAkB,iBACtC,WAAW,EAAE,UAAU,EACvB,GAAG,IACA,CAAC,YAAY,CAAC,CAAC,CAAC,EAAE,YAAY,EAAE,IAAI,CAAC,OAAO,CAAC,YAAY,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,EACrE,CAAC;IACL,CAAC;eAAO,CAAC;QACP,OAAO,IAAI,CAAC;IACd,CAAC;AACH,CAAC;AAED;;;;GAIG;AACH,MAAM,CAAC,KAAK,UAAU,sBAAsB,CAC1C,UAAkB,EAClB,GAAiD,EACjD,OAAO,GAKH,EAAE;;;IAEN,IAAI,CAAC;QACH,MAAM,QAAQ,GAAG,MAAM,mBAAmB,CAAC,UAAU,CAAC,CAAC;QACvD,IAAI,OAAO,QAAQ,CAAC,4BAA4B,KAAK,UAAU,EAAE,CAAC;YAChE,MAAA,OAAO,CAAC,aAAa,+CAArB,OAAO,EACL,+DAA+D,CAChE,CAAC;YACF,OAAO,EAAE,CAAC;QACZ,CAAC;QACD,MAAM,YAAY,SAAG,OAAO,CAAC,YAAY,mCAAI,GAAG,CAAC,oBAAoB,CAAC;QACtE,OAAO;YACL,QAAQ,CAAC,4BAA4B,iBACnC,WAAW,EAAE,UAAU,EACvB,GAAG,IACA,CAAC,YAAY,CAAC,CAAC,CAAC,EAAE,YAAY,EAAE,IAAI,CAAC,OAAO,CAAC,YAAY,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,EACrE;SACH,CAAC;IACJ,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,MAAA,OAAO,CAAC,aAAa,+CAArB,OAAO,EACL,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CACvD,CAAC;QACF,OAAO,EAAE,CAAC;IACZ,CAAC;AACH,CAAC","sourcesContent":["import {\n  SourceCatalogSchema,\n  type Contract,\n  type SourceCatalog,\n} from '@ekanos/integration-schema';\nimport * as fs from 'node:fs';\nimport { createRequire } from 'node:module';\nimport * as path from 'node:path';\nimport { pathToFileURL } from 'node:url';\n\nimport { preconditionError } from './errors';\nimport type { ContractSource } from './experience/contract-sources';\n\n/**\n * `ekanos dev` for an EXPERIENCE project: kind detection, loading the\n * harness's integration resolver from the project's own install, the CLI session\n * catalog hand-off, and the override helper `publish` uses.\n */\n\nexport type DevKind = 'integration' | 'experience';\n\n/** `kind` from the raw `ekanos.json`; anything unreadable is `integration`. */\nexport function detectKind(projectDir: string): DevKind {\n  try {\n    const raw = JSON.parse(\n      fs.readFileSync(path.join(projectDir, 'ekanos.json'), 'utf8'),\n    ) as { kind?: unknown };\n    return raw.kind === 'experience' ? 'experience' : 'integration';\n  } catch {\n    return 'integration';\n  }\n}\n\nexport interface ExperienceProject {\n  slug: string;\n  entry: string;\n}\n\nexport function readExperienceProject(projectDir: string): ExperienceProject {\n  const file = path.join(projectDir, 'ekanos.json');\n  let raw: { slug?: unknown; entry?: unknown };\n  try {\n    raw = JSON.parse(fs.readFileSync(file, 'utf8')) as typeof raw;\n  } catch (error) {\n    throw preconditionError(\n      `${file} could not be read: ${error instanceof Error ? error.message : String(error)}`,\n      'Fix ekanos.json, then re-run \"ekanos dev\".',\n    );\n  }\n  if (typeof raw.slug !== 'string' || typeof raw.entry !== 'string') {\n    throw preconditionError(\n      'An experience ekanos.json needs a \"slug\" and an \"entry\".',\n      'Add them (see \"ekanos init --kind experience\"), then re-run \"ekanos dev\".',\n    );\n  }\n  return { slug: raw.slug, entry: raw.entry };\n}\n\n/** The slice of `@ekanos/harness/resolver` the CLI uses. */\nexport interface HarnessResolver {\n  resolveIntegrations(options: {\n    projectRoot: string;\n    env?: Readonly<Record<string, string | undefined>>;\n    contractsDir?: string;\n    catalog?: SourceCatalog | null;\n  }): Promise<{\n    integrations: unknown[];\n    overrides: Array<{\n      integration: string;\n      path: string;\n      via: 'file' | 'env';\n    }>;\n    notices: string[];\n    errors: Array<{ integration: string; message: string }>;\n  }>;\n  formatProvenanceLines(resolution: never): string[];\n  createRegistryContractSource(options: {\n    projectRoot: string;\n    env?: Readonly<Record<string, string | undefined>>;\n    contractsDir?: string;\n  }): ContractSource;\n  createPinsResolver?(options: {\n    projectRoot: string;\n    env?: Readonly<Record<string, string | undefined>>;\n    contractsDir?: string;\n  }): Promise<\n    (integration: { name: string; version: string }) => {\n      contract: Contract;\n      lines: string[];\n    } | null\n  >;\n  runOperationOnce?(options: {\n    projectRoot: string;\n    op: string;\n    input?: unknown;\n    mode?: 'fixtures' | 'live';\n    env?: Readonly<Record<string, string | undefined>>;\n    deriveContract?: (args: {\n      definition: unknown;\n      projectDir: string;\n      packageVersion: string;\n    }) => Contract | null;\n  }): Promise<\n    | { ok: true; data: unknown }\n    | { ok: false; reason: string; message: string; detail?: string }\n  >;\n  activeOverrides(\n    projectRoot: string,\n    env?: Readonly<Record<string, string | undefined>>,\n  ): Array<{ integration: string; path: string; via: 'file' | 'env' }>;\n}\n\n/**\n * Import the resolver FROM THE PROJECT'S install of `@ekanos/harness`, so the\n * integrations are resolved by exactly the harness version that will serve them.\n */\nexport async function loadHarnessResolver(\n  projectDir: string,\n): Promise<HarnessResolver> {\n  let resolved: string | null = null;\n  // An experience installs the harness itself; an integration repo's lives in\n  // the generated shell under `.ekanos/harness`.\n  for (const base of [\n    projectDir,\n    path.join(projectDir, '.ekanos', 'harness'),\n  ]) {\n    try {\n      resolved = createRequire(path.join(base, 'package.json')).resolve(\n        '@ekanos/harness/resolver',\n      );\n      break;\n    } catch {\n      resolved = null;\n    }\n  }\n  if (!resolved) {\n    throw preconditionError(\n      'The installed @ekanos/harness has no \"./resolver\" export, which an experience needs to resolve its integrations.',\n      'Upgrade @ekanos/harness and @ekanos/cli together, then re-run \"ekanos dev\".',\n    );\n  }\n  return (await import(pathToFileURL(resolved).href)) as HarnessResolver;\n}\n\nexport const SESSION_CATALOG_FILE = path.join(\n  '.ekanos',\n  'session-catalog.json',\n);\n\n/**\n * Hand the harness the dev's Source catalog (no token in it) so it can answer\n * availability and develop permission. Removes a stale file when there is no\n * catalog, so yesterday's answer is never trusted today.\n */\nexport function writeSessionCatalog(\n  projectDir: string,\n  catalog: SourceCatalog | null,\n): void {\n  const file = path.join(projectDir, SESSION_CATALOG_FILE);\n  if (!catalog) {\n    fs.rmSync(file, { force: true });\n    return;\n  }\n  const parsed = SourceCatalogSchema.safeParse(catalog);\n  if (!parsed.success) return;\n  fs.mkdirSync(path.dirname(file), { recursive: true });\n  fs.writeFileSync(file, `${JSON.stringify(parsed.data)}\\n`, { mode: 0o600 });\n}\n\n/**\n * Local overrides in force for a project, for `ekanos publish` to refuse on.\n * Reads the harness's own definition of an override (file and env var), so\n * the two can never disagree. Falls back to none when the harness is absent\n * (an integration project has no overrides).\n */\nexport async function activeOverridesFor(\n  projectDir: string,\n  env: Readonly<Record<string, string | undefined>>,\n): Promise<Array<{ integration: string; path: string; via: 'file' | 'env' }>> {\n  if (detectKind(projectDir) !== 'experience') return [];\n  const resolver = await loadHarnessResolver(projectDir);\n  return resolver.activeOverrides(projectDir, env);\n}\n\n/**\n * The harness's pins resolver for `ekanos check` / `publish`: integration pins are\n * checked against what the registry chain resolves (catalog, published-package\n * cache, contracts directory), local overrides ignored. Null when the project\n * has no installed harness that offers one; the committed snapshots then decide.\n */\nexport async function harnessPinsResolver(\n  projectDir: string,\n  env: Readonly<Record<string, string | undefined>>,\n) {\n  try {\n    const resolver = await loadHarnessResolver(projectDir);\n    if (typeof resolver.createPinsResolver !== 'function') return null;\n    const contractsDir = env.EKANOS_CONTRACTS_DIR;\n    return await resolver.createPinsResolver({\n      projectRoot: projectDir,\n      env,\n      ...(contractsDir ? { contractsDir: path.resolve(contractsDir) } : {}),\n    });\n  } catch {\n    return null;\n  }\n}\n\n/**\n * The harness resolver as an extra `add`/`sync` contract source (catalog,\n * published-package cache, contracts directory). Empty when the project has\n * no installed harness that offers one — the offline sources still apply.\n */\nexport async function harnessContractSources(\n  projectDir: string,\n  env: Readonly<Record<string, string | undefined>>,\n  options: {\n    /** `--contracts-dir`: wins over `EKANOS_CONTRACTS_DIR`, as in `ekanos dev`. */\n    contractsDir?: string;\n    /** Told once when the project's harness cannot be asked at all. */\n    onUnavailable?: (reason: string) => void;\n  } = {},\n): Promise<ContractSource[]> {\n  try {\n    const resolver = await loadHarnessResolver(projectDir);\n    if (typeof resolver.createRegistryContractSource !== 'function') {\n      options.onUnavailable?.(\n        'the installed @ekanos/harness has no registry contract source',\n      );\n      return [];\n    }\n    const contractsDir = options.contractsDir ?? env.EKANOS_CONTRACTS_DIR;\n    return [\n      resolver.createRegistryContractSource({\n        projectRoot: projectDir,\n        env,\n        ...(contractsDir ? { contractsDir: path.resolve(contractsDir) } : {}),\n      }),\n    ];\n  } catch (error) {\n    options.onUnavailable?.(\n      error instanceof Error ? error.message : String(error),\n    );\n    return [];\n  }\n}\n"]}

package/dist/experience/boundary.d.ts

@@ -0,0 +1,12 @@
+import type { Finding } from '@ekanos/integration-schema';
+import type { ExperienceProject } from './project.js';
+export declare const BOUNDARY_CHECK = "checks/experience-boundary";
+/** Packages that may stay external at runtime (the host provides them). */
+export declare const ALLOWED_EXTERNALS: readonly ['react', 'react-dom', '@ekanos/sdk', '@ekanos/ui', 'zod', '@tanstack/react-query', 'next-intl', 'react-hook-form', '@hookform/resolvers'];
+/** Nearest `ekanos.json` at or above `start`, with its kind, or null. */
+export declare function nearestEkanosKind(start: string): {
+    dir: string;
+    kind: string;
+} | null;
+/** The authoritative boundary: package.json, source scan, bundle scan. */
+export declare function checkExperienceBoundary(project: ExperienceProject): Promise<Finding[]>;

package/dist/experience/boundary.js

@@ -0,0 +1,260 @@
+import { build } from 'esbuild';
+import * as fs from 'node:fs';
+import * as path from 'node:path';
+import { isContained } from '../safe-fs.js';
+export const BOUNDARY_CHECK = 'checks/experience-boundary';
+/** Packages that may stay external at runtime (the host provides them). */
+export const ALLOWED_EXTERNALS = [
+    'react',
+    'react-dom',
+    '@ekanos/sdk',
+    '@ekanos/ui',
+    'zod',
+    '@tanstack/react-query',
+    'next-intl',
+    'react-hook-form',
+    '@hookform/resolvers',
+];
+const INTEGRATION_PACKAGE = /^@companydotcom\/integration-[a-z0-9-]+/;
+/** A pnpm-store or plain node_modules path of an integration package. */
+const INTEGRATION_IN_PATH = /@companydotcom[/+]integration-[a-z0-9-]+/;
+const HOST_INTERNAL = /^@kit\//;
+const SOURCE_EXT = /\.(?:[cm]?[jt]sx?)$/;
+const SKIP_DIRS = new Set(['node_modules', 'dist', '.ekanos', '.git']);
+const finding = (message, hint, file, line) => (Object.assign(Object.assign({ check: BOUNDARY_CHECK, severity: 'error', message,
+    hint }, (file ? { file } : {})), (line ? { line } : {})));
+const INTEGRATION_HINT = 'An experience reaches an integration only through its pinned contract: useOperation / operation() / step.tool. Add the integration with "ekanos add <integration>@<version>".';
+/** Nearest `ekanos.json` at or above `start`, with its kind, or null. */
+export function nearestEkanosKind(start) {
+    var _a;
+    let current = fs.existsSync(start) && fs.statSync(start).isDirectory()
+        ? start
+        : path.dirname(start);
+    for (;;) {
+        const file = path.join(current, 'ekanos.json');
+        if (fs.existsSync(file)) {
+            try {
+                const parsed = JSON.parse(fs.readFileSync(file, 'utf8'));
+                return { dir: current, kind: (_a = parsed.kind) !== null && _a !== void 0 ? _a : 'integration' };
+            }
+            catch (_b) {
+                return { dir: current, kind: 'integration' };
+            }
+        }
+        const parent = path.dirname(current);
+        if (parent === current)
+            return null;
+        current = parent;
+    }
+}
+// ─── 1. package.json ────────────────────────────────────────────────────────
+const DEP_FIELDS = [
+    'dependencies',
+    'devDependencies',
+    'peerDependencies',
+    'optionalDependencies',
+];
+function checkPackageJson(project) {
+    const file = path.join(project.dir, 'package.json');
+    if (!fs.existsSync(file))
+        return [];
+    const findings = [];
+    const pkg = JSON.parse(fs.readFileSync(file, 'utf8'));
+    const specs = [];
+    for (const field of DEP_FIELDS) {
+        const block = pkg[field];
+        if (block && typeof block === 'object') {
+            specs.push(...Object.entries(block));
+        }
+    }
+    const pnpm = pkg.pnpm;
+    for (const block of [
+        pnpm === null || pnpm === void 0 ? void 0 : pnpm.overrides,
+        pkg.overrides,
+    ]) {
+        if (block && typeof block === 'object')
+            specs.push(...Object.entries(block));
+    }
+    for (const [name, spec] of specs) {
+        if (INTEGRATION_PACKAGE.test(name)) {
+            findings.push(finding(`package.json depends on the integration package ${name}.`, INTEGRATION_HINT, 'package.json'));
+            continue;
+        }
+        const linked = /^(?:file|link|workspace):(.*)$/.exec(String(spec));
+        if ((linked === null || linked === void 0 ? void 0 : linked[1]) !== undefined && linked[1] !== '*' && linked[1] !== '^') {
+            const target = path.resolve(project.dir, linked[1]);
+            const kind = nearestEkanosKind(target);
+            if (kind &&
+                kind.kind === 'integration' &&
+                path.resolve(kind.dir) !== project.dir) {
+                findings.push(finding(`package.json links ${name} to ${linked[1]}, an integration project.`, INTEGRATION_HINT, 'package.json'));
+            }
+        }
+        // A resolved dependency that is itself an integration, whatever its name.
+        const installed = path.join(project.dir, 'node_modules', name, 'ekanos.json');
+        if (fs.existsSync(installed)) {
+            try {
+                const kind = JSON.parse(fs.readFileSync(installed, 'utf8')).kind;
+                if ((kind !== null && kind !== void 0 ? kind : 'integration') === 'integration') {
+                    findings.push(finding(`package.json depends on ${name}, which is an integration (its ekanos.json is kind "integration").`, INTEGRATION_HINT, 'package.json'));
+                }
+            }
+            catch (_a) {
+                // unreadable ekanos.json in a dependency: the bundle scan still applies
+            }
+        }
+    }
+    return findings;
+}
+// ─── 2. source scan ─────────────────────────────────────────────────────────
+const IMPORT_PATTERN = /(?:\bfrom\s*|\bimport\s*\(\s*|\bimport\s+|\brequire\s*\(\s*)(['"`])([^'"`\n]+)\1/g;
+const COMPUTED_IMPORT = /\bimport\s*\(\s*(?!['"`])/g;
+function* walkSources(dir, ignore, root) {
+    for (const entry of fs.readdirSync(dir, { withFileTypes: true })) {
+        if (entry.isSymbolicLink())
+            continue;
+        const full = path.join(dir, entry.name);
+        if (entry.isDirectory()) {
+            if (SKIP_DIRS.has(entry.name))
+                continue;
+            const rel = path.relative(root, full).split(path.sep).join('/');
+            if (ignore.includes(rel))
+                continue;
+            yield* walkSources(full, ignore, root);
+        }
+        else if (SOURCE_EXT.test(entry.name)) {
+            yield full;
+        }
+    }
+}
+const lineOf = (text, index) => text.slice(0, index).split('\n').length;
+function checkSources(project) {
+    var _a, _b, _c;
+    const findings = [];
+    const srcDir = path.join(project.dir, 'src');
+    if (!fs.existsSync(srcDir))
+        return findings;
+    const ignore = (_a = project.ekanos.ignore) !== null && _a !== void 0 ? _a : [];
+    for (const file of walkSources(srcDir, ignore, project.dir)) {
+        const text = fs.readFileSync(file, 'utf8');
+        const rel = path.relative(project.dir, file).split(path.sep).join('/');
+        for (const match of text.matchAll(IMPORT_PATTERN)) {
+            const spec = match[2];
+            const line = lineOf(text, (_b = match.index) !== null && _b !== void 0 ? _b : 0);
+            if (INTEGRATION_PACKAGE.test(spec) || INTEGRATION_IN_PATH.test(spec)) {
+                findings.push(finding(`${rel}:${line} imports the integration "${spec}".`, INTEGRATION_HINT, rel, line));
+            }
+            else if (HOST_INTERNAL.test(spec)) {
+                findings.push(finding(`${rel}:${line} imports "${spec}", which is host-internal.`, 'Build with @ekanos/ui and @ekanos/sdk; @kit/* does not exist for a partner.', rel, line));
+            }
+            else if (spec.startsWith('.')) {
+                const target = path.resolve(path.dirname(file), spec);
+                if (!isContained(project.dir, target)) {
+                    findings.push(finding(`${rel}:${line} imports "${spec}", a path outside the project.`, `${INTEGRATION_HINT} Code outside this project is not part of the experience.`, rel, line));
+                }
+                else {
+                    const owner = nearestEkanosKind(target);
+                    if (owner && owner.kind === 'integration') {
+                        findings.push(finding(`${rel}:${line} imports "${spec}", inside an integration project.`, INTEGRATION_HINT, rel, line));
+                    }
+                }
+            }
+        }
+        for (const match of text.matchAll(COMPUTED_IMPORT)) {
+            const line = lineOf(text, (_c = match.index) !== null && _c !== void 0 ? _c : 0);
+            findings.push(finding(`${rel}:${line} uses a computed dynamic import(), which cannot be checked.`, 'Import a static specifier.', rel, line));
+        }
+    }
+    return findings;
+}
+// ─── 3. bundle scan ─────────────────────────────────────────────────────────
+function externalsFor(project) {
+    var _a;
+    const names = [...ALLOWED_EXTERNALS, ...((_a = project.ekanos.allowImports) !== null && _a !== void 0 ? _a : [])];
+    return names.flatMap((name) => [name, `${name}/*`]);
+}
+/** Bundle the entry and fail on any input that is integration code. */
+async function checkBundle(project) {
+    var _a;
+    const entry = path.join(project.dir, project.entry);
+    if (!fs.existsSync(entry)) {
+        return [
+            finding(`entry ${project.entry} does not exist.`, 'Fix "entry" in ekanos.json.', 'ekanos.json'),
+        ];
+    }
+    let result;
+    try {
+        result = await build({
+            entryPoints: [entry],
+            bundle: true,
+            write: false,
+            metafile: true,
+            platform: 'browser',
+            format: 'esm',
+            jsx: 'automatic',
+            logLevel: 'silent',
+            absWorkingDir: project.dir,
+            external: externalsFor(project),
+            loader: { '.css': 'empty', '.svg': 'dataurl', '.png': 'dataurl' },
+        });
+    }
+    catch (error) {
+        const errors = (_a = error.errors) !== null && _a !== void 0 ? _a : [];
+        if (errors.length === 0) {
+            return [
+                finding(`the entry could not be bundled: ${error instanceof Error ? error.message : String(error)}`, 'Fix the error and re-run.'),
+            ];
+        }
+        return errors.map((e) => { var _a, _b; return finding(`bundle: ${e.text}`, 'Install the dependency, fix the import, or add a reviewed specifier to ekanos.json "allowImports".', (_a = e.location) === null || _a === void 0 ? void 0 : _a.file, (_b = e.location) === null || _b === void 0 ? void 0 : _b.line); });
+    }
+    const findings = [];
+    const reported = new Set();
+    for (const input of Object.keys(result.metafile.inputs)) {
+        const absolute = path.resolve(project.dir, input);
+        let problem = null;
+        if (INTEGRATION_IN_PATH.test(absolute)) {
+            problem = 'is integration package code';
+        }
+        else if (!isContained(project.dir, absolute) &&
+            !absolute.includes(`${path.sep}node_modules${path.sep}`)) {
+            problem = 'is outside the project';
+        }
+        else if (absolute.includes(`${path.sep}node_modules${path.sep}`)) {
+            const owner = packageRootOf(absolute);
+            const kind = owner ? nearestEkanosKind(owner) : null;
+            if (kind && kind.dir === owner && kind.kind === 'integration') {
+                problem = 'is code of an integration package';
+            }
+        }
+        else {
+            const owner = nearestEkanosKind(absolute);
+            if (owner && owner.kind === 'integration')
+                problem = 'is inside an integration project';
+        }
+        if (problem && !reported.has(input)) {
+            reported.add(input);
+            findings.push(finding(`the bundle contains ${input}, which ${problem}.`, `${INTEGRATION_HINT} It reached the bundle through an import chain; the source scan cannot always see this.`, input));
+        }
+    }
+    return findings;
+}
+function packageRootOf(file) {
+    let current = path.dirname(file);
+    for (;;) {
+        if (fs.existsSync(path.join(current, 'package.json')))
+            return current;
+        const parent = path.dirname(current);
+        if (parent === current)
+            return null;
+        current = parent;
+    }
+}
+/** The authoritative boundary: package.json, source scan, bundle scan. */
+export async function checkExperienceBoundary(project) {
+    return [
+        ...checkPackageJson(project),
+        ...checkSources(project),
+        ...(await checkBundle(project)),
+    ];
+}
+//# sourceMappingURL=boundary.js.map

package/dist/experience/boundary.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"boundary.js","sourceRoot":"","sources":["../../src/experience/boundary.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,KAAK,EAAE,MAAM,SAAS,CAAC;AAChC,OAAO,KAAK,EAAE,MAAM,SAAS,CAAC;AAC9B,OAAO,KAAK,IAAI,MAAM,WAAW,CAAC;AAElC,OAAO,EAAE,WAAW,EAAE,MAAM,YAAY,CAAC;AAGzC,MAAM,CAAC,MAAM,cAAc,GAAG,4BAA4B,CAAC;AAE3D,2EAA2E;AAC3E,MAAM,CAAC,MAAM,iBAAiB,GAAG;IAC/B,OAAO;IACP,WAAW;IACX,aAAa;IACb,YAAY;IACZ,KAAK;IACL,uBAAuB;IACvB,WAAW;IACX,iBAAiB;IACjB,qBAAqB;CACb,CAAC;AAEX,MAAM,mBAAmB,GAAG,yCAAyC,CAAC;AACtE,yEAAyE;AACzE,MAAM,mBAAmB,GAAG,0CAA0C,CAAC;AACvE,MAAM,aAAa,GAAG,SAAS,CAAC;AAEhC,MAAM,UAAU,GAAG,qBAAqB,CAAC;AACzC,MAAM,SAAS,GAAG,IAAI,GAAG,CAAC,CAAC,cAAc,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,CAAC,CAAC,CAAC;AAEvE,MAAM,OAAO,GAAG,CACd,OAAe,EACf,IAAY,EACZ,IAAa,EACb,IAAa,EACJ,EAAE,CAAC,+BACZ,KAAK,EAAE,cAAc,EACrB,QAAQ,EAAE,OAAO,EACjB,OAAO;IACP,IAAI,IACD,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,GACtB,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,EACzB,CAAC;AAEH,MAAM,gBAAgB,GACpB,+KAA+K,CAAC;AAElL,yEAAyE;AACzE,MAAM,UAAU,iBAAiB,CAC/B,KAAa;;IAEb,IAAI,OAAO,GACT,EAAE,CAAC,UAAU,CAAC,KAAK,CAAC,IAAI,EAAE,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC,WAAW,EAAE;QACtD,CAAC,CAAC,KAAK;QACP,CAAC,CAAC,IAAI,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC;IAC1B,SAAS,CAAC;QACR,MAAM,IAAI,GAAG,IAAI,CAAC,IAAI,CAAC,OAAO,EAAE,aAAa,CAAC,CAAC;QAC/C,IAAI,EAAE,CAAC,UAAU,CAAC,IAAI,CAAC,EAAE,CAAC;YACxB,IAAI,CAAC;gBACH,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC,YAAY,CAAC,IAAI,EAAE,MAAM,CAAC,CAEtD,CAAC;gBAEF,OAAO,EAAE,GAAG,EAAE,OAAO,EAAE,IAAI,QAAE,MAAM,CAAC,IAAI,mCAAI,aAAa,EAAE,CAAC;YAC9D,CAAC;uBAAO,CAAC;gBACP,OAAO,EAAE,GAAG,EAAE,OAAO,EAAE,IAAI,EAAE,aAAa,EAAE,CAAC;YAC/C,CAAC;QACH,CAAC;QACD,MAAM,MAAM,GAAG,IAAI,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC;QACrC,IAAI,MAAM,KAAK,OAAO;YAAE,OAAO,IAAI,CAAC;QACpC,OAAO,GAAG,MAAM,CAAC;IACnB,CAAC;AACH,CAAC;AAED,+EAA+E;AAE/E,MAAM,UAAU,GAAG;IACjB,cAAc;IACd,iBAAiB;IACjB,kBAAkB;IAClB,sBAAsB;CACd,CAAC;AAEX,SAAS,gBAAgB,CAAC,OAA0B;IAClD,MAAM,IAAI,GAAG,IAAI,CAAC,IAAI,CAAC,OAAO,CAAC,GAAG,EAAE,cAAc,CAAC,CAAC;IACpD,IAAI,CAAC,EAAE,CAAC,UAAU,CAAC,IAAI,CAAC;QAAE,OAAO,EAAE,CAAC;IACpC,MAAM,QAAQ,GAAc,EAAE,CAAC;IAC/B,MAAM,GAAG,GAAG,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC,YAAY,CAAC,IAAI,EAAE,MAAM,CAAC,CAGnD,CAAC;IAEF,MAAM,KAAK,GAA4B,EAAE,CAAC;IAC1C,KAAK,MAAM,KAAK,IAAI,UAAU,EAAE,CAAC;QAC/B,MAAM,KAAK,GAAG,GAAG,CAAC,KAAK,CAAC,CAAC;QACzB,IAAI,KAAK,IAAI,OAAO,KAAK,KAAK,QAAQ,EAAE,CAAC;YACvC,KAAK,CAAC,IAAI,CAAC,GAAG,MAAM,CAAC,OAAO,CAAC,KAA+B,CAAC,CAAC,CAAC;QACjE,CAAC;IACH,CAAC;IACD,MAAM,IAAI,GAAG,GAAG,CAAC,IAA0D,CAAC;IAC5E,KAAK,MAAM,KAAK,IAAI;QAClB,IAAI,aAAJ,IAAI,uBAAJ,IAAI,CAAE,SAAS;QACf,GAAG,CAAC,SAA+C;KACpD,EAAE,CAAC;QACF,IAAI,KAAK,IAAI,OAAO,KAAK,KAAK,QAAQ;YACpC,KAAK,CAAC,IAAI,CAAC,GAAG,MAAM,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,CAAC;IACzC,CAAC;IAED,KAAK,MAAM,CAAC,IAAI,EAAE,IAAI,CAAC,IAAI,KAAK,EAAE,CAAC;QACjC,IAAI,mBAAmB,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC;YACnC,QAAQ,CAAC,IAAI,CACX,OAAO,CACL,mDAAmD,IAAI,GAAG,EAC1D,gBAAgB,EAChB,cAAc,CACf,CACF,CAAC;YACF,SAAS;QACX,CAAC;QACD,MAAM,MAAM,GAAG,gCAAgC,CAAC,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC;QACnE,IAAI,CAAA,MAAM,aAAN,MAAM,uBAAN,MAAM,CAAG,CAAC,CAAC,MAAK,SAAS,IAAI,MAAM,CAAC,CAAC,CAAC,KAAK,GAAG,IAAI,MAAM,CAAC,CAAC,CAAC,KAAK,GAAG,EAAE,CAAC;YACxE,MAAM,MAAM,GAAG,IAAI,CAAC,OAAO,CAAC,OAAO,CAAC,GAAG,EAAE,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC;YACpD,MAAM,IAAI,GAAG,iBAAiB,CAAC,MAAM,CAAC,CAAC;YACvC,IACE,IAAI;gBACJ,IAAI,CAAC,IAAI,KAAK,aAAa;gBAC3B,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,GAAG,CAAC,KAAK,OAAO,CAAC,GAAG,EACtC,CAAC;gBACD,QAAQ,CAAC,IAAI,CACX,OAAO,CACL,sBAAsB,IAAI,OAAO,MAAM,CAAC,CAAC,CAAC,2BAA2B,EACrE,gBAAgB,EAChB,cAAc,CACf,CACF,CAAC;YACJ,CAAC;QACH,CAAC;QACD,0EAA0E;QAC1E,MAAM,SAAS,GAAG,IAAI,CAAC,IAAI,CACzB,OAAO,CAAC,GAAG,EACX,cAAc,EACd,IAAI,EACJ,aAAa,CACd,CAAC;QACF,IAAI,EAAE,CAAC,UAAU,CAAC,SAAS,CAAC,EAAE,CAAC;YAC7B,IAAI,CAAC;gBACH,MAAM,IAAI,GACR,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC,YAAY,CAAC,SAAS,EAAE,MAAM,CAAC,CAC9C,CAAC,IAAI,CAAC;gBACP,IAAI,CAAC,IAAI,aAAJ,IAAI,cAAJ,IAAI,GAAI,aAAa,CAAC,KAAK,aAAa,EAAE,CAAC;oBAC9C,QAAQ,CAAC,IAAI,CACX,OAAO,CACL,2BAA2B,IAAI,oEAAoE,EACnG,gBAAgB,EAChB,cAAc,CACf,CACF,CAAC;gBACJ,CAAC;YACH,CAAC;uBAAO,CAAC;gBACP,wEAAwE;YAC1E,CAAC;QACH,CAAC;IACH,CAAC;IAED,OAAO,QAAQ,CAAC;AAClB,CAAC;AAED,+EAA+E;AAE/E,MAAM,cAAc,GAClB,mFAAmF,CAAC;AACtF,MAAM,eAAe,GAAG,4BAA4B,CAAC;AAErD,QAAQ,CAAC,CAAC,WAAW,CACnB,GAAW,EACX,MAAyB,EACzB,IAAY;IAEZ,KAAK,MAAM,KAAK,IAAI,EAAE,CAAC,WAAW,CAAC,GAAG,EAAE,EAAE,aAAa,EAAE,IAAI,EAAE,CAAC,EAAE,CAAC;QACjE,IAAI,KAAK,CAAC,cAAc,EAAE;YAAE,SAAS;QACrC,MAAM,IAAI,GAAG,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,KAAK,CAAC,IAAI,CAAC,CAAC;QACxC,IAAI,KAAK,CAAC,WAAW,EAAE,EAAE,CAAC;YACxB,IAAI,SAAS,CAAC,GAAG,CAAC,KAAK,CAAC,IAAI,CAAC;gBAAE,SAAS;YACxC,MAAM,GAAG,GAAG,IAAI,CAAC,QAAQ,CAAC,IAAI,EAAE,IAAI,CAAC,CAAC,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;YAChE,IAAI,MAAM,CAAC,QAAQ,CAAC,GAAG,CAAC;gBAAE,SAAS;YACnC,KAAK,CAAC,CAAC,WAAW,CAAC,IAAI,EAAE,MAAM,EAAE,IAAI,CAAC,CAAC;QACzC,CAAC;aAAM,IAAI,UAAU,CAAC,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,EAAE,CAAC;YACvC,MAAM,IAAI,CAAC;QACb,CAAC;IACH,CAAC;AACH,CAAC;AAED,MAAM,MAAM,GAAG,CAAC,IAAY,EAAE,KAAa,EAAE,EAAE,CAC7C,IAAI,CAAC,KAAK,CAAC,CAAC,EAAE,KAAK,CAAC,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,MAAM,CAAC;AAE1C,SAAS,YAAY,CAAC,OAA0B;;IAC9C,MAAM,QAAQ,GAAc,EAAE,CAAC;IAC/B,MAAM,MAAM,GAAG,IAAI,CAAC,IAAI,CAAC,OAAO,CAAC,GAAG,EAAE,KAAK,CAAC,CAAC;IAC7C,IAAI,CAAC,EAAE,CAAC,UAAU,CAAC,MAAM,CAAC;QAAE,OAAO,QAAQ,CAAC;IAC5C,MAAM,MAAM,SAAG,OAAO,CAAC,MAAM,CAAC,MAAM,mCAAI,EAAE,CAAC;IAE3C,KAAK,MAAM,IAAI,IAAI,WAAW,CAAC,MAAM,EAAE,MAAM,EAAE,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC;QAC5D,MAAM,IAAI,GAAG,EAAE,CAAC,YAAY,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC;QAC3C,MAAM,GAAG,GAAG,IAAI,CAAC,QAAQ,CAAC,OAAO,CAAC,GAAG,EAAE,IAAI,CAAC,CAAC,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;QAEvE,KAAK,MAAM,KAAK,IAAI,IAAI,CAAC,QAAQ,CAAC,cAAc,CAAC,EAAE,CAAC;YAClD,MAAM,IAAI,GAAG,KAAK,CAAC,CAAC,CAAW,CAAC;YAChC,MAAM,IAAI,GAAG,MAAM,CAAC,IAAI,QAAE,KAAK,CAAC,KAAK,mCAAI,CAAC,CAAC,CAAC;YAE5C,IAAI,mBAAmB,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,mBAAmB,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC;gBACrE,QAAQ,CAAC,IAAI,CACX,OAAO,CACL,GAAG,GAAG,IAAI,IAAI,6BAA6B,IAAI,IAAI,EACnD,gBAAgB,EAChB,GAAG,EACH,IAAI,CACL,CACF,CAAC;YACJ,CAAC;iBAAM,IAAI,aAAa,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC;gBACpC,QAAQ,CAAC,IAAI,CACX,OAAO,CACL,GAAG,GAAG,IAAI,IAAI,aAAa,IAAI,4BAA4B,EAC3D,6EAA6E,EAC7E,GAAG,EACH,IAAI,CACL,CACF,CAAC;YACJ,CAAC;iBAAM,IAAI,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,EAAE,CAAC;gBAChC,MAAM,MAAM,GAAG,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,EAAE,IAAI,CAAC,CAAC;gBACtD,IAAI,CAAC,WAAW,CAAC,OAAO,CAAC,GAAG,EAAE,MAAM,CAAC,EAAE,CAAC;oBACtC,QAAQ,CAAC,IAAI,CACX,OAAO,CACL,GAAG,GAAG,IAAI,IAAI,aAAa,IAAI,gCAAgC,EAC/D,GAAG,gBAAgB,2DAA2D,EAC9E,GAAG,EACH,IAAI,CACL,CACF,CAAC;gBACJ,CAAC;qBAAM,CAAC;oBACN,MAAM,KAAK,GAAG,iBAAiB,CAAC,MAAM,CAAC,CAAC;oBACxC,IAAI,KAAK,IAAI,KAAK,CAAC,IAAI,KAAK,aAAa,EAAE,CAAC;wBAC1C,QAAQ,CAAC,IAAI,CACX,OAAO,CACL,GAAG,GAAG,IAAI,IAAI,aAAa,IAAI,mCAAmC,EAClE,gBAAgB,EAChB,GAAG,EACH,IAAI,CACL,CACF,CAAC;oBACJ,CAAC;gBACH,CAAC;YACH,CAAC;QACH,CAAC;QAED,KAAK,MAAM,KAAK,IAAI,IAAI,CAAC,QAAQ,CAAC,eAAe,CAAC,EAAE,CAAC;YACnD,MAAM,IAAI,GAAG,MAAM,CAAC,IAAI,QAAE,KAAK,CAAC,KAAK,mCAAI,CAAC,CAAC,CAAC;YAC5C,QAAQ,CAAC,IAAI,CACX,OAAO,CACL,GAAG,GAAG,IAAI,IAAI,6DAA6D,EAC3E,4BAA4B,EAC5B,GAAG,EACH,IAAI,CACL,CACF,CAAC;QACJ,CAAC;IACH,CAAC;IAED,OAAO,QAAQ,CAAC;AAClB,CAAC;AAED,+EAA+E;AAE/E,SAAS,YAAY,CAAC,OAA0B;;IAC9C,MAAM,KAAK,GAAG,CAAC,GAAG,iBAAiB,EAAE,GAAG,OAAC,OAAO,CAAC,MAAM,CAAC,YAAY,mCAAI,EAAE,CAAC,CAAC,CAAC;IAE7E,OAAO,KAAK,CAAC,OAAO,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC,IAAI,EAAE,GAAG,IAAI,IAAI,CAAC,CAAC,CAAC;AACtD,CAAC;AAED,uEAAuE;AACvE,KAAK,UAAU,WAAW,CAAC,OAA0B;;IACnD,MAAM,KAAK,GAAG,IAAI,CAAC,IAAI,CAAC,OAAO,CAAC,GAAG,EAAE,OAAO,CAAC,KAAK,CAAC,CAAC;IACpD,IAAI,CAAC,EAAE,CAAC,UAAU,CAAC,KAAK,CAAC,EAAE,CAAC;QAC1B,OAAO;YACL,OAAO,CACL,SAAS,OAAO,CAAC,KAAK,kBAAkB,EACxC,6BAA6B,EAC7B,aAAa,CACd;SACF,CAAC;IACJ,CAAC;IAED,IAAI,MAAM,CAAC;IACX,IAAI,CAAC;QACH,MAAM,GAAG,MAAM,KAAK,CAAC;YACnB,WAAW,EAAE,CAAC,KAAK,CAAC;YACpB,MAAM,EAAE,IAAI;YACZ,KAAK,EAAE,KAAK;YACZ,QAAQ,EAAE,IAAI;YACd,QAAQ,EAAE,SAAS;YACnB,MAAM,EAAE,KAAK;YACb,GAAG,EAAE,WAAW;YAChB,QAAQ,EAAE,QAAQ;YAClB,aAAa,EAAE,OAAO,CAAC,GAAG;YAC1B,QAAQ,EAAE,YAAY,CAAC,OAAO,CAAC;YAC/B,MAAM,EAAE,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,EAAE,SAAS,EAAE;SAClE,CAAC,CAAC;IACL,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,MAAM,MAAM,SAER,KAMD,CAAC,MAAM,mCAAI,EAAE,CAAC;QACjB,IAAI,MAAM,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YACxB,OAAO;gBACL,OAAO,CACL,mCAAmC,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,EAAE,EAC3F,2BAA2B,CAC5B;aACF,CAAC;QACJ,CAAC;QAED,OAAO,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,sBACtB,OAAO,CACL,WAAW,CAAC,CAAC,IAAI,EAAE,EACnB,oGAAoG,EACpG,MAAA,CAAC,CAAC,QAAQ,0CAAE,IAAI,EAChB,MAAA,CAAC,CAAC,QAAQ,0CAAE,IAAI,CACjB,GAAA,CACF,CAAC;IACJ,CAAC;IAED,MAAM,QAAQ,GAAc,EAAE,CAAC;IAC/B,MAAM,QAAQ,GAAG,IAAI,GAAG,EAAU,CAAC;IACnC,KAAK,MAAM,KAAK,IAAI,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,MAAM,CAAC,EAAE,CAAC;QACxD,MAAM,QAAQ,GAAG,IAAI,CAAC,OAAO,CAAC,OAAO,CAAC,GAAG,EAAE,KAAK,CAAC,CAAC;QAClD,IAAI,OAAO,GAAkB,IAAI,CAAC;QAElC,IAAI,mBAAmB,CAAC,IAAI,CAAC,QAAQ,CAAC,EAAE,CAAC;YACvC,OAAO,GAAG,6BAA6B,CAAC;QAC1C,CAAC;aAAM,IACL,CAAC,WAAW,CAAC,OAAO,CAAC,GAAG,EAAE,QAAQ,CAAC;YACnC,CAAC,QAAQ,CAAC,QAAQ,CAAC,GAAG,IAAI,CAAC,GAAG,eAAe,IAAI,CAAC,GAAG,EAAE,CAAC,EACxD,CAAC;YACD,OAAO,GAAG,wBAAwB,CAAC;QACrC,CAAC;aAAM,IAAI,QAAQ,CAAC,QAAQ,CAAC,GAAG,IAAI,CAAC,GAAG,eAAe,IAAI,CAAC,GAAG,EAAE,CAAC,EAAE,CAAC;YACnE,MAAM,KAAK,GAAG,aAAa,CAAC,QAAQ,CAAC,CAAC;YACtC,MAAM,IAAI,GAAG,KAAK,CAAC,CAAC,CAAC,iBAAiB,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC;YACrD,IAAI,IAAI,IAAI,IAAI,CAAC,GAAG,KAAK,KAAK,IAAI,IAAI,CAAC,IAAI,KAAK,aAAa,EAAE,CAAC;gBAC9D,OAAO,GAAG,mCAAmC,CAAC;YAChD,CAAC;QACH,CAAC;aAAM,CAAC;YACN,MAAM,KAAK,GAAG,iBAAiB,CAAC,QAAQ,CAAC,CAAC;YAC1C,IAAI,KAAK,IAAI,KAAK,CAAC,IAAI,KAAK,aAAa;gBACvC,OAAO,GAAG,kCAAkC,CAAC;QACjD,CAAC;QAED,IAAI,OAAO,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,KAAK,CAAC,EAAE,CAAC;YACpC,QAAQ,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC;YACpB,QAAQ,CAAC,IAAI,CACX,OAAO,CACL,uBAAuB,KAAK,WAAW,OAAO,GAAG,EACjD,GAAG,gBAAgB,yFAAyF,EAC5G,KAAK,CACN,CACF,CAAC;QACJ,CAAC;IACH,CAAC;IAED,OAAO,QAAQ,CAAC;AAClB,CAAC;AAED,SAAS,aAAa,CAAC,IAAY;IACjC,IAAI,OAAO,GAAG,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC;IACjC,SAAS,CAAC;QACR,IAAI,EAAE,CAAC,UAAU,CAAC,IAAI,CAAC,IAAI,CAAC,OAAO,EAAE,cAAc,CAAC,CAAC;YAAE,OAAO,OAAO,CAAC;QACtE,MAAM,MAAM,GAAG,IAAI,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC;QACrC,IAAI,MAAM,KAAK,OAAO;YAAE,OAAO,IAAI,CAAC;QACpC,OAAO,GAAG,MAAM,CAAC;IACnB,CAAC;AACH,CAAC;AAED,0EAA0E;AAC1E,MAAM,CAAC,KAAK,UAAU,uBAAuB,CAC3C,OAA0B;IAE1B,OAAO;QACL,GAAG,gBAAgB,CAAC,OAAO,CAAC;QAC5B,GAAG,YAAY,CAAC,OAAO,CAAC;QACxB,GAAG,CAAC,MAAM,WAAW,CAAC,OAAO,CAAC,CAAC;KAChC,CAAC;AACJ,CAAC","sourcesContent":["import type { Finding } from '@ekanos/integration-schema';\nimport { build } from 'esbuild';\nimport * as fs from 'node:fs';\nimport * as path from 'node:path';\n\nimport { isContained } from '../safe-fs';\nimport type { ExperienceProject } from './project';\n\nexport const BOUNDARY_CHECK = 'checks/experience-boundary';\n\n/** Packages that may stay external at runtime (the host provides them). */\nexport const ALLOWED_EXTERNALS = [\n  'react',\n  'react-dom',\n  '@ekanos/sdk',\n  '@ekanos/ui',\n  'zod',\n  '@tanstack/react-query',\n  'next-intl',\n  'react-hook-form',\n  '@hookform/resolvers',\n] as const;\n\nconst INTEGRATION_PACKAGE = /^@companydotcom\\/integration-[a-z0-9-]+/;\n/** A pnpm-store or plain node_modules path of an integration package. */\nconst INTEGRATION_IN_PATH = /@companydotcom[/+]integration-[a-z0-9-]+/;\nconst HOST_INTERNAL = /^@kit\\//;\n\nconst SOURCE_EXT = /\\.(?:[cm]?[jt]sx?)$/;\nconst SKIP_DIRS = new Set(['node_modules', 'dist', '.ekanos', '.git']);\n\nconst finding = (\n  message: string,\n  hint: string,\n  file?: string,\n  line?: number,\n): Finding => ({\n  check: BOUNDARY_CHECK,\n  severity: 'error',\n  message,\n  hint,\n  ...(file ? { file } : {}),\n  ...(line ? { line } : {}),\n});\n\nconst INTEGRATION_HINT =\n  'An experience reaches an integration only through its pinned contract: useOperation / operation() / step.tool. Add the integration with \"ekanos add <integration>@<version>\".';\n\n/** Nearest `ekanos.json` at or above `start`, with its kind, or null. */\nexport function nearestEkanosKind(\n  start: string,\n): { dir: string; kind: string } | null {\n  let current =\n    fs.existsSync(start) && fs.statSync(start).isDirectory()\n      ? start\n      : path.dirname(start);\n  for (;;) {\n    const file = path.join(current, 'ekanos.json');\n    if (fs.existsSync(file)) {\n      try {\n        const parsed = JSON.parse(fs.readFileSync(file, 'utf8')) as {\n          kind?: string;\n        };\n\n        return { dir: current, kind: parsed.kind ?? 'integration' };\n      } catch {\n        return { dir: current, kind: 'integration' };\n      }\n    }\n    const parent = path.dirname(current);\n    if (parent === current) return null;\n    current = parent;\n  }\n}\n\n// ─── 1. package.json ────────────────────────────────────────────────────────\n\nconst DEP_FIELDS = [\n  'dependencies',\n  'devDependencies',\n  'peerDependencies',\n  'optionalDependencies',\n] as const;\n\nfunction checkPackageJson(project: ExperienceProject): Finding[] {\n  const file = path.join(project.dir, 'package.json');\n  if (!fs.existsSync(file)) return [];\n  const findings: Finding[] = [];\n  const pkg = JSON.parse(fs.readFileSync(file, 'utf8')) as Record<\n    string,\n    unknown\n  >;\n\n  const specs: Array<[string, string]> = [];\n  for (const field of DEP_FIELDS) {\n    const block = pkg[field];\n    if (block && typeof block === 'object') {\n      specs.push(...Object.entries(block as Record<string, string>));\n    }\n  }\n  const pnpm = pkg.pnpm as { overrides?: Record<string, string> } | undefined;\n  for (const block of [\n    pnpm?.overrides,\n    pkg.overrides as Record<string, string> | undefined,\n  ]) {\n    if (block && typeof block === 'object')\n      specs.push(...Object.entries(block));\n  }\n\n  for (const [name, spec] of specs) {\n    if (INTEGRATION_PACKAGE.test(name)) {\n      findings.push(\n        finding(\n          `package.json depends on the integration package ${name}.`,\n          INTEGRATION_HINT,\n          'package.json',\n        ),\n      );\n      continue;\n    }\n    const linked = /^(?:file|link|workspace):(.*)$/.exec(String(spec));\n    if (linked?.[1] !== undefined && linked[1] !== '*' && linked[1] !== '^') {\n      const target = path.resolve(project.dir, linked[1]);\n      const kind = nearestEkanosKind(target);\n      if (\n        kind &&\n        kind.kind === 'integration' &&\n        path.resolve(kind.dir) !== project.dir\n      ) {\n        findings.push(\n          finding(\n            `package.json links ${name} to ${linked[1]}, an integration project.`,\n            INTEGRATION_HINT,\n            'package.json',\n          ),\n        );\n      }\n    }\n    // A resolved dependency that is itself an integration, whatever its name.\n    const installed = path.join(\n      project.dir,\n      'node_modules',\n      name,\n      'ekanos.json',\n    );\n    if (fs.existsSync(installed)) {\n      try {\n        const kind = (\n          JSON.parse(fs.readFileSync(installed, 'utf8')) as { kind?: string }\n        ).kind;\n        if ((kind ?? 'integration') === 'integration') {\n          findings.push(\n            finding(\n              `package.json depends on ${name}, which is an integration (its ekanos.json is kind \"integration\").`,\n              INTEGRATION_HINT,\n              'package.json',\n            ),\n          );\n        }\n      } catch {\n        // unreadable ekanos.json in a dependency: the bundle scan still applies\n      }\n    }\n  }\n\n  return findings;\n}\n\n// ─── 2. source scan ─────────────────────────────────────────────────────────\n\nconst IMPORT_PATTERN =\n  /(?:\\bfrom\\s*|\\bimport\\s*\\(\\s*|\\bimport\\s+|\\brequire\\s*\\(\\s*)(['\"`])([^'\"`\\n]+)\\1/g;\nconst COMPUTED_IMPORT = /\\bimport\\s*\\(\\s*(?!['\"`])/g;\n\nfunction* walkSources(\n  dir: string,\n  ignore: readonly string[],\n  root: string,\n): Generator<string> {\n  for (const entry of fs.readdirSync(dir, { withFileTypes: true })) {\n    if (entry.isSymbolicLink()) continue;\n    const full = path.join(dir, entry.name);\n    if (entry.isDirectory()) {\n      if (SKIP_DIRS.has(entry.name)) continue;\n      const rel = path.relative(root, full).split(path.sep).join('/');\n      if (ignore.includes(rel)) continue;\n      yield* walkSources(full, ignore, root);\n    } else if (SOURCE_EXT.test(entry.name)) {\n      yield full;\n    }\n  }\n}\n\nconst lineOf = (text: string, index: number) =>\n  text.slice(0, index).split('\\n').length;\n\nfunction checkSources(project: ExperienceProject): Finding[] {\n  const findings: Finding[] = [];\n  const srcDir = path.join(project.dir, 'src');\n  if (!fs.existsSync(srcDir)) return findings;\n  const ignore = project.ekanos.ignore ?? [];\n\n  for (const file of walkSources(srcDir, ignore, project.dir)) {\n    const text = fs.readFileSync(file, 'utf8');\n    const rel = path.relative(project.dir, file).split(path.sep).join('/');\n\n    for (const match of text.matchAll(IMPORT_PATTERN)) {\n      const spec = match[2] as string;\n      const line = lineOf(text, match.index ?? 0);\n\n      if (INTEGRATION_PACKAGE.test(spec) || INTEGRATION_IN_PATH.test(spec)) {\n        findings.push(\n          finding(\n            `${rel}:${line} imports the integration \"${spec}\".`,\n            INTEGRATION_HINT,\n            rel,\n            line,\n          ),\n        );\n      } else if (HOST_INTERNAL.test(spec)) {\n        findings.push(\n          finding(\n            `${rel}:${line} imports \"${spec}\", which is host-internal.`,\n            'Build with @ekanos/ui and @ekanos/sdk; @kit/* does not exist for a partner.',\n            rel,\n            line,\n          ),\n        );\n      } else if (spec.startsWith('.')) {\n        const target = path.resolve(path.dirname(file), spec);\n        if (!isContained(project.dir, target)) {\n          findings.push(\n            finding(\n              `${rel}:${line} imports \"${spec}\", a path outside the project.`,\n              `${INTEGRATION_HINT} Code outside this project is not part of the experience.`,\n              rel,\n              line,\n            ),\n          );\n        } else {\n          const owner = nearestEkanosKind(target);\n          if (owner && owner.kind === 'integration') {\n            findings.push(\n              finding(\n                `${rel}:${line} imports \"${spec}\", inside an integration project.`,\n                INTEGRATION_HINT,\n                rel,\n                line,\n              ),\n            );\n          }\n        }\n      }\n    }\n\n    for (const match of text.matchAll(COMPUTED_IMPORT)) {\n      const line = lineOf(text, match.index ?? 0);\n      findings.push(\n        finding(\n          `${rel}:${line} uses a computed dynamic import(), which cannot be checked.`,\n          'Import a static specifier.',\n          rel,\n          line,\n        ),\n      );\n    }\n  }\n\n  return findings;\n}\n\n// ─── 3. bundle scan ─────────────────────────────────────────────────────────\n\nfunction externalsFor(project: ExperienceProject): string[] {\n  const names = [...ALLOWED_EXTERNALS, ...(project.ekanos.allowImports ?? [])];\n\n  return names.flatMap((name) => [name, `${name}/*`]);\n}\n\n/** Bundle the entry and fail on any input that is integration code. */\nasync function checkBundle(project: ExperienceProject): Promise<Finding[]> {\n  const entry = path.join(project.dir, project.entry);\n  if (!fs.existsSync(entry)) {\n    return [\n      finding(\n        `entry ${project.entry} does not exist.`,\n        'Fix \"entry\" in ekanos.json.',\n        'ekanos.json',\n      ),\n    ];\n  }\n\n  let result;\n  try {\n    result = await build({\n      entryPoints: [entry],\n      bundle: true,\n      write: false,\n      metafile: true,\n      platform: 'browser',\n      format: 'esm',\n      jsx: 'automatic',\n      logLevel: 'silent',\n      absWorkingDir: project.dir,\n      external: externalsFor(project),\n      loader: { '.css': 'empty', '.svg': 'dataurl', '.png': 'dataurl' },\n    });\n  } catch (error) {\n    const errors =\n      (\n        error as {\n          errors?: Array<{\n            text: string;\n            location?: { file: string; line: number } | null;\n          }>;\n        }\n      ).errors ?? [];\n    if (errors.length === 0) {\n      return [\n        finding(\n          `the entry could not be bundled: ${error instanceof Error ? error.message : String(error)}`,\n          'Fix the error and re-run.',\n        ),\n      ];\n    }\n\n    return errors.map((e) =>\n      finding(\n        `bundle: ${e.text}`,\n        'Install the dependency, fix the import, or add a reviewed specifier to ekanos.json \"allowImports\".',\n        e.location?.file,\n        e.location?.line,\n      ),\n    );\n  }\n\n  const findings: Finding[] = [];\n  const reported = new Set<string>();\n  for (const input of Object.keys(result.metafile.inputs)) {\n    const absolute = path.resolve(project.dir, input);\n    let problem: string | null = null;\n\n    if (INTEGRATION_IN_PATH.test(absolute)) {\n      problem = 'is integration package code';\n    } else if (\n      !isContained(project.dir, absolute) &&\n      !absolute.includes(`${path.sep}node_modules${path.sep}`)\n    ) {\n      problem = 'is outside the project';\n    } else if (absolute.includes(`${path.sep}node_modules${path.sep}`)) {\n      const owner = packageRootOf(absolute);\n      const kind = owner ? nearestEkanosKind(owner) : null;\n      if (kind && kind.dir === owner && kind.kind === 'integration') {\n        problem = 'is code of an integration package';\n      }\n    } else {\n      const owner = nearestEkanosKind(absolute);\n      if (owner && owner.kind === 'integration')\n        problem = 'is inside an integration project';\n    }\n\n    if (problem && !reported.has(input)) {\n      reported.add(input);\n      findings.push(\n        finding(\n          `the bundle contains ${input}, which ${problem}.`,\n          `${INTEGRATION_HINT} It reached the bundle through an import chain; the source scan cannot always see this.`,\n          input,\n        ),\n      );\n    }\n  }\n\n  return findings;\n}\n\nfunction packageRootOf(file: string): string | null {\n  let current = path.dirname(file);\n  for (;;) {\n    if (fs.existsSync(path.join(current, 'package.json'))) return current;\n    const parent = path.dirname(current);\n    if (parent === current) return null;\n    current = parent;\n  }\n}\n\n/** The authoritative boundary: package.json, source scan, bundle scan. */\nexport async function checkExperienceBoundary(\n  project: ExperienceProject,\n): Promise<Finding[]> {\n  return [\n    ...checkPackageJson(project),\n    ...checkSources(project),\n    ...(await checkBundle(project)),\n  ];\n}\n"]}

package/dist/experience/build.d.ts

@@ -0,0 +1,16 @@
+import { type ExperienceManifest } from '@ekanos/integration-schema';
+import type { ExperienceCheckResult } from './checks.js';
+import { type ExperienceProject } from './project.js';
+export declare const DIST_ENTRY = "dist/experience.js";
+export declare const DIST_TYPES = "dist/experience.d.ts";
+export declare const MANIFEST_FILE = "manifest.json";
+export interface BuildOutput {
+    manifest: ExperienceManifest;
+    files: string[];
+    changed: boolean;
+}
+/**
+ * Emit `dist/experience.js` (browser ESM, runtime packages left external),
+ * `dist/experience.d.ts` and `manifest.json`. Assumes the checks passed.
+ */
+export declare function emitExperience(project: ExperienceProject, result: ExperienceCheckResult): Promise<BuildOutput>;