@ekanos/cli 0.17.1 → 0.19.0

package/dist/experience/clean-room.js

@@ -0,0 +1,150 @@
+import { EXPERIENCE_BUNDLE_OPTIONS, buildExperienceSurfaces, experienceExternals, } from '@ekanos/integration-schema';
+import { build } from 'esbuild';
+import { execFileSync } from 'node:child_process';
+import * as fs from 'node:fs';
+import * as os from 'node:os';
+import * as path from 'node:path';
+import { pathToFileURL } from 'node:url';
+import { preconditionError, validationError } from '../errors.js';
+/** Set to `off` to skip the clean-room build (offline work, tests); the host's gate still rebuilds. */
+export const CLEAN_ROOM_ENV = 'EKANOS_PUBLISH_CLEAN_ROOM';
+/** The npm binary the clean room runs. Defaults to `npm`; overridden by tests. */
+export const NPM_BIN_ENV = 'EKANOS_NPM_BIN';
+const LOCKFILE_ARGS = ['--ignore-scripts', '--no-audit', '--no-fund'];
+/** The lockfile the project itself carries, if it carries one. */
+function ownLockfile(dir) {
+    for (const [name, source] of [
+        ['npm-shrinkwrap.json', 'npm-shrinkwrap'],
+        ['package-lock.json', 'package-lock'],
+    ]) {
+        const file = path.join(dir, name);
+        if (fs.existsSync(file))
+            return { file, source };
+    }
+    return null;
+}
+/** A `pnpm-lock.yaml` at or above the project: it lives in a pnpm workspace. */
+export function findPnpmLockfile(dir) {
+    let current = path.resolve(dir);
+    for (;;) {
+        const candidate = path.join(current, 'pnpm-lock.yaml');
+        if (fs.existsSync(candidate))
+            return candidate;
+        const parent = path.dirname(current);
+        if (parent === current)
+            return null;
+        current = parent;
+    }
+}
+/** Whether the project has a lockfile of either kind to build from. */
+export function hasBuildableLockfile(dir) {
+    return ownLockfile(dir) !== null || findPnpmLockfile(dir) !== null;
+}
+function npm(bin, args, cwd, what) {
+    try {
+        execFileSync(bin, [...args], {
+            cwd,
+            encoding: 'utf8',
+            stdio: ['ignore', 'pipe', 'pipe'],
+        });
+    }
+    catch (error) {
+        const detail = error instanceof Error && 'stderr' in error
+            ? String(error.stderr)
+                .trim()
+                .slice(-1500)
+            : String(error);
+        throw preconditionError(`${what} failed in the clean room: ${detail}`, 'The host rebuilds your package the same way, from the public registry; fix the dependency problem and re-run.');
+    }
+}
+function copyIfExists(from, to) {
+    if (fs.existsSync(from))
+        fs.cpSync(from, to, { recursive: true });
+}
+/**
+ * Builds the experience bundle the way the host's gate will, so the bytes match
+ * by construction: in a temp directory holding only what ships (package.json,
+ * tsconfig, `src/`), with dependencies installed by `npm ci --ignore-scripts`
+ * from a standalone lockfile, and the shared bundle options.
+ *
+ * The lockfile is the project's own `package-lock.json`/`npm-shrinkwrap.json`
+ * when it has one. A project inside a pnpm workspace (a `pnpm-lock.yaml` at the
+ * repo root, no per-package npm lockfile) gets one generated for just its
+ * `package.json` (`npm install`), and that generated file
+ * is what ships, so the host resolves the dependencies the bundle was built
+ * with. It resolves the declared ranges from the registry, which can differ from
+ * the versions the workspace's pnpm lockfile pins; the bundle you ship is the
+ * one built from the shipped lockfile, not from your workspace's tree.
+ *
+ * The surfaces are recomputed from the rebuilt bundle's own definition (the host
+ * does the same), so a project whose local tree declares something else is
+ * caught here instead of at the gate.
+ */
+export async function buildInCleanRoom(project, env = {}) {
+    var _a;
+    var _b, _c;
+    const npmBin = (_b = env[NPM_BIN_ENV]) !== null && _b !== void 0 ? _b : 'npm';
+    const own = ownLockfile(project.dir);
+    const pnpm = own ? null : findPnpmLockfile(project.dir);
+    if (!own && !pnpm) {
+        throw preconditionError('There is no lockfile to build from: no package-lock.json, npm-shrinkwrap.json or pnpm-lock.yaml.', 'Run "npm install --package-lock-only" in the project (or install with pnpm in a workspace) and commit the lockfile.');
+    }
+    const room = fs.mkdtempSync(path.join(os.tmpdir(), 'ekanos-exp-room-'));
+    try {
+        fs.copyFileSync(path.join(project.dir, 'package.json'), path.join(room, 'package.json'));
+        copyIfExists(path.join(project.dir, 'src'), path.join(room, 'src'));
+        for (const name of fs.readdirSync(project.dir)) {
+            if (/^tsconfig[^/]*\.json$/.test(name)) {
+                fs.copyFileSync(path.join(project.dir, name), path.join(room, name));
+            }
+        }
+        let lockfileSource;
+        if (own) {
+            fs.copyFileSync(own.file, path.join(room, 'package-lock.json'));
+            lockfileSource = own.source;
+        }
+        else {
+            const manifest = fs.readFileSync(path.join(room, 'package.json'), 'utf8');
+            if (/"(?:workspace|catalog|link|file):/.test(manifest)) {
+                throw validationError('package.json depends on a workspace:, catalog:, link: or file: package, which a standalone lockfile cannot resolve.', 'An experience reaches integrations through pinned operations, not packages; publish a package that depends only on registry versions.');
+            }
+            // A real install, twice, not `--package-lock-only`: npm resolving an
+            // empty tree writes lockfiles that `npm ci` then rejects as out of sync
+            // (a peer range resolved two ways), and a first install over a fresh tree
+            // can too (seen with eslint's ajv). The second install reconciles the
+            // tree against its own lockfile; the `npm ci` below, after the tree is
+            // thrown away, is the install the host will repeat and proves it did.
+            for (let pass = 0; pass < 2; pass += 1) {
+                npm(npmBin, ['install', ...LOCKFILE_ARGS], room, 'generating a standalone lockfile from package.json');
+            }
+            fs.rmSync(path.join(room, 'node_modules'), {
+                recursive: true,
+                force: true,
+            });
+            lockfileSource = 'generated-from-pnpm';
+        }
+        const lockfile = fs.readFileSync(path.join(room, 'package-lock.json'), 'utf8');
+        npm(npmBin, ['ci', ...LOCKFILE_ARGS], room, '`npm ci`');
+        const built = await build(Object.assign(Object.assign({}, EXPERIENCE_BUNDLE_OPTIONS), { entryPoints: [path.join(room, project.entry)], absWorkingDir: room, external: experienceExternals(project.ekanos.allowImports) }));
+        const bundle = (_c = (_a = built.outputFiles[0]) === null || _a === void 0 ? void 0 : _a.text) !== null && _c !== void 0 ? _c : '';
+        const file = path.join(room, '.clean-room-experience.mjs');
+        fs.writeFileSync(file, bundle);
+        const loaded = (await import(pathToFileURL(file).href));
+        if (typeof loaded.default !== 'object' ||
+            loaded.default === null ||
+            !Array.isArray(loaded.default.widgets) ||
+            !Array.isArray(loaded.default.pages)) {
+            throw validationError('The rebuilt bundle does not export a defineExperience() result as default.', `Export the definition from ${project.entry} as the default export.`);
+        }
+        return {
+            bundle,
+            lockfile,
+            lockfileSource,
+            surfaces: buildExperienceSurfaces(project.slug, loaded.default),
+        };
+    }
+    finally {
+        fs.rmSync(room, { recursive: true, force: true });
+    }
+}
+//# sourceMappingURL=clean-room.js.map

package/dist/experience/clean-room.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"clean-room.js","sourceRoot":"","sources":["../../src/experience/clean-room.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,yBAAyB,EAGzB,uBAAuB,EACvB,mBAAmB,GACpB,MAAM,4BAA4B,CAAC;AACpC,OAAO,EAAE,KAAK,EAAE,MAAM,SAAS,CAAC;AAChC,OAAO,EAAE,YAAY,EAAE,MAAM,oBAAoB,CAAC;AAClD,OAAO,KAAK,EAAE,MAAM,SAAS,CAAC;AAC9B,OAAO,KAAK,EAAE,MAAM,SAAS,CAAC;AAC9B,OAAO,KAAK,IAAI,MAAM,WAAW,CAAC;AAClC,OAAO,EAAE,aAAa,EAAE,MAAM,UAAU,CAAC;AAEzC,OAAO,EAAE,iBAAiB,EAAE,eAAe,EAAE,MAAM,WAAW,CAAC;AAG/D,uGAAuG;AACvG,MAAM,CAAC,MAAM,cAAc,GAAG,2BAA2B,CAAC;AAC1D,kFAAkF;AAClF,MAAM,CAAC,MAAM,WAAW,GAAG,gBAAgB,CAAC;AAiB5C,MAAM,aAAa,GAAG,CAAC,kBAAkB,EAAE,YAAY,EAAE,WAAW,CAAU,CAAC;AAE/E,kEAAkE;AAClE,SAAS,WAAW,CAClB,GAAW;IAEX,KAAK,MAAM,CAAC,IAAI,EAAE,MAAM,CAAC,IAAI;QAC3B,CAAC,qBAAqB,EAAE,gBAAgB,CAAC;QACzC,CAAC,mBAAmB,EAAE,cAAc,CAAC;KAC7B,EAAE,CAAC;QACX,MAAM,IAAI,GAAG,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,IAAI,CAAC,CAAC;QAClC,IAAI,EAAE,CAAC,UAAU,CAAC,IAAI,CAAC;YAAE,OAAO,EAAE,IAAI,EAAE,MAAM,EAAE,CAAC;IACnD,CAAC;IAED,OAAO,IAAI,CAAC;AACd,CAAC;AAED,gFAAgF;AAChF,MAAM,UAAU,gBAAgB,CAAC,GAAW;IAC1C,IAAI,OAAO,GAAG,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;IAChC,SAAS,CAAC;QACR,MAAM,SAAS,GAAG,IAAI,CAAC,IAAI,CAAC,OAAO,EAAE,gBAAgB,CAAC,CAAC;QACvD,IAAI,EAAE,CAAC,UAAU,CAAC,SAAS,CAAC;YAAE,OAAO,SAAS,CAAC;QAC/C,MAAM,MAAM,GAAG,IAAI,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC;QACrC,IAAI,MAAM,KAAK,OAAO;YAAE,OAAO,IAAI,CAAC;QACpC,OAAO,GAAG,MAAM,CAAC;IACnB,CAAC;AACH,CAAC;AAED,uEAAuE;AACvE,MAAM,UAAU,oBAAoB,CAAC,GAAW;IAC9C,OAAO,WAAW,CAAC,GAAG,CAAC,KAAK,IAAI,IAAI,gBAAgB,CAAC,GAAG,CAAC,KAAK,IAAI,CAAC;AACrE,CAAC;AAED,SAAS,GAAG,CACV,GAAW,EACX,IAAuB,EACvB,GAAW,EACX,IAAY;IAEZ,IAAI,CAAC;QACH,YAAY,CAAC,GAAG,EAAE,CAAC,GAAG,IAAI,CAAC,EAAE;YAC3B,GAAG;YACH,QAAQ,EAAE,MAAM;YAChB,KAAK,EAAE,CAAC,QAAQ,EAAE,MAAM,EAAE,MAAM,CAAC;SAClC,CAAC,CAAC;IACL,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,MAAM,MAAM,GACV,KAAK,YAAY,KAAK,IAAI,QAAQ,IAAI,KAAK;YACzC,CAAC,CAAC,MAAM,CAAE,KAA6B,CAAC,MAAM,CAAC;iBAC1C,IAAI,EAAE;iBACN,KAAK,CAAC,CAAC,IAAI,CAAC;YACjB,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;QACpB,MAAM,iBAAiB,CACrB,GAAG,IAAI,8BAA8B,MAAM,EAAE,EAC7C,+GAA+G,CAChH,CAAC;IACJ,CAAC;AACH,CAAC;AAED,SAAS,YAAY,CAAC,IAAY,EAAE,EAAU;IAC5C,IAAI,EAAE,CAAC,UAAU,CAAC,IAAI,CAAC;QAAE,EAAE,CAAC,MAAM,CAAC,IAAI,EAAE,EAAE,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;AACpE,CAAC;AAED;;;;;;;;;;;;;;;;;;GAkBG;AACH,MAAM,CAAC,KAAK,UAAU,gBAAgB,CACpC,OAA0B,EAC1B,GAAG,GAAuC,EAAE;;;IAE5C,MAAM,MAAM,SAAG,GAAG,CAAC,WAAW,CAAC,mCAAI,KAAK,CAAC;IACzC,MAAM,GAAG,GAAG,WAAW,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;IACrC,MAAM,IAAI,GAAG,GAAG,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,gBAAgB,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;IAExD,IAAI,CAAC,GAAG,IAAI,CAAC,IAAI,EAAE,CAAC;QAClB,MAAM,iBAAiB,CACrB,kGAAkG,EAClG,qHAAqH,CACtH,CAAC;IACJ,CAAC;IAED,MAAM,IAAI,GAAG,EAAE,CAAC,WAAW,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,MAAM,EAAE,EAAE,kBAAkB,CAAC,CAAC,CAAC;IACxE,IAAI,CAAC;QACH,EAAE,CAAC,YAAY,CACb,IAAI,CAAC,IAAI,CAAC,OAAO,CAAC,GAAG,EAAE,cAAc,CAAC,EACtC,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,cAAc,CAAC,CAChC,CAAC;QACF,YAAY,CAAC,IAAI,CAAC,IAAI,CAAC,OAAO,CAAC,GAAG,EAAE,KAAK,CAAC,EAAE,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,KAAK,CAAC,CAAC,CAAC;QACpE,KAAK,MAAM,IAAI,IAAI,EAAE,CAAC,WAAW,CAAC,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC;YAC/C,IAAI,uBAAuB,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC;gBACvC,EAAE,CAAC,YAAY,CAAC,IAAI,CAAC,IAAI,CAAC,OAAO,CAAC,GAAG,EAAE,IAAI,CAAC,EAAE,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,IAAI,CAAC,CAAC,CAAC;YACvE,CAAC;QACH,CAAC;QAED,IAAI,cAA8B,CAAC;QACnC,IAAI,GAAG,EAAE,CAAC;YACR,EAAE,CAAC,YAAY,CAAC,GAAG,CAAC,IAAI,EAAE,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,mBAAmB,CAAC,CAAC,CAAC;YAChE,cAAc,GAAG,GAAG,CAAC,MAAM,CAAC;QAC9B,CAAC;aAAM,CAAC;YACN,MAAM,QAAQ,GAAG,EAAE,CAAC,YAAY,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,cAAc,CAAC,EAAE,MAAM,CAAC,CAAC;YAC1E,IAAI,mCAAmC,CAAC,IAAI,CAAC,QAAQ,CAAC,EAAE,CAAC;gBACvD,MAAM,eAAe,CACnB,qHAAqH,EACrH,uIAAuI,CACxI,CAAC;YACJ,CAAC;YACD,qEAAqE;YACrE,wEAAwE;YACxE,0EAA0E;YAC1E,sEAAsE;YACtE,uEAAuE;YACvE,sEAAsE;YACtE,KAAK,IAAI,IAAI,GAAG,CAAC,EAAE,IAAI,GAAG,CAAC,EAAE,IAAI,IAAI,CAAC,EAAE,CAAC;gBACvC,GAAG,CACD,MAAM,EACN,CAAC,SAAS,EAAE,GAAG,aAAa,CAAC,EAC7B,IAAI,EACJ,oDAAoD,CACrD,CAAC;YACJ,CAAC;YACD,EAAE,CAAC,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,cAAc,CAAC,EAAE;gBACzC,SAAS,EAAE,IAAI;gBACf,KAAK,EAAE,IAAI;aACZ,CAAC,CAAC;YACH,cAAc,GAAG,qBAAqB,CAAC;QACzC,CAAC;QAED,MAAM,QAAQ,GAAG,EAAE,CAAC,YAAY,CAC9B,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,mBAAmB,CAAC,EACpC,MAAM,CACP,CAAC;QACF,GAAG,CAAC,MAAM,EAAE,CAAC,IAAI,EAAE,GAAG,aAAa,CAAC,EAAE,IAAI,EAAE,UAAU,CAAC,CAAC;QAExD,MAAM,KAAK,GAAG,MAAM,KAAK,iCACpB,yBAAyB,KAC5B,WAAW,EAAE,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,OAAO,CAAC,KAAK,CAAC,CAAC,EAC7C,aAAa,EAAE,IAAI,EACnB,QAAQ,EAAE,mBAAmB,CAAC,OAAO,CAAC,MAAM,CAAC,YAAY,CAAC,IAC1D,CAAC;QACH,MAAM,MAAM,SAAG,MAAA,KAAK,CAAC,WAAW,CAAC,CAAC,CAAC,0CAAE,IAAI,mCAAI,EAAE,CAAC;QAEhD,MAAM,IAAI,GAAG,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,4BAA4B,CAAC,CAAC;QAC3D,EAAE,CAAC,aAAa,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC;QAC/B,MAAM,MAAM,GAAG,CAAC,MAAM,MAAM,CAAC,aAAa,CAAC,IAAI,CAAC,CAAC,IAAI,CAAC,CAErD,CAAC;QACF,IACE,OAAO,MAAM,CAAC,OAAO,KAAK,QAAQ;YAClC,MAAM,CAAC,OAAO,KAAK,IAAI;YACvB,CAAC,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC,OAAO,CAAC,OAAO,CAAC;YACtC,CAAC,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC,OAAO,CAAC,KAAK,CAAC,EACpC,CAAC;YACD,MAAM,eAAe,CACnB,4EAA4E,EAC5E,8BAA8B,OAAO,CAAC,KAAK,yBAAyB,CACrE,CAAC;QACJ,CAAC;QAED,OAAO;YACL,MAAM;YACN,QAAQ;YACR,cAAc;YACd,QAAQ,EAAE,uBAAuB,CAAC,OAAO,CAAC,IAAI,EAAE,MAAM,CAAC,OAAO,CAAC;SAChE,CAAC;IACJ,CAAC;YAAS,CAAC;QACT,EAAE,CAAC,MAAM,CAAC,IAAI,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC;IACpD,CAAC;AACH,CAAC","sourcesContent":["import {\n  EXPERIENCE_BUNDLE_OPTIONS,\n  type ExperienceSurfaces,\n  type SurfacesDefinitionInput,\n  buildExperienceSurfaces,\n  experienceExternals,\n} from '@ekanos/integration-schema';\nimport { build } from 'esbuild';\nimport { execFileSync } from 'node:child_process';\nimport * as fs from 'node:fs';\nimport * as os from 'node:os';\nimport * as path from 'node:path';\nimport { pathToFileURL } from 'node:url';\n\nimport { preconditionError, validationError } from '../errors';\nimport type { ExperienceProject } from './project';\n\n/** Set to `off` to skip the clean-room build (offline work, tests); the host's gate still rebuilds. */\nexport const CLEAN_ROOM_ENV = 'EKANOS_PUBLISH_CLEAN_ROOM';\n/** The npm binary the clean room runs. Defaults to `npm`; overridden by tests. */\nexport const NPM_BIN_ENV = 'EKANOS_NPM_BIN';\n\nexport type LockfileSource =\n  | 'package-lock'\n  | 'npm-shrinkwrap'\n  | 'generated-from-pnpm';\n\nexport interface CleanRoomBuild {\n  /** `dist/experience.js` exactly as the host's gate will rebuild it. */\n  bundle: string;\n  /** The standalone lockfile the bundle was built against; ships as npm-shrinkwrap.json. */\n  lockfile: string;\n  lockfileSource: LockfileSource;\n  /** `dist/surfaces.json` as the rebuilt bundle's own definition declares it. */\n  surfaces: ExperienceSurfaces;\n}\n\nconst LOCKFILE_ARGS = ['--ignore-scripts', '--no-audit', '--no-fund'] as const;\n\n/** The lockfile the project itself carries, if it carries one. */\nfunction ownLockfile(\n  dir: string,\n): { file: string; source: 'package-lock' | 'npm-shrinkwrap' } | null {\n  for (const [name, source] of [\n    ['npm-shrinkwrap.json', 'npm-shrinkwrap'],\n    ['package-lock.json', 'package-lock'],\n  ] as const) {\n    const file = path.join(dir, name);\n    if (fs.existsSync(file)) return { file, source };\n  }\n\n  return null;\n}\n\n/** A `pnpm-lock.yaml` at or above the project: it lives in a pnpm workspace. */\nexport function findPnpmLockfile(dir: string): string | null {\n  let current = path.resolve(dir);\n  for (;;) {\n    const candidate = path.join(current, 'pnpm-lock.yaml');\n    if (fs.existsSync(candidate)) return candidate;\n    const parent = path.dirname(current);\n    if (parent === current) return null;\n    current = parent;\n  }\n}\n\n/** Whether the project has a lockfile of either kind to build from. */\nexport function hasBuildableLockfile(dir: string): boolean {\n  return ownLockfile(dir) !== null || findPnpmLockfile(dir) !== null;\n}\n\nfunction npm(\n  bin: string,\n  args: readonly string[],\n  cwd: string,\n  what: string,\n): void {\n  try {\n    execFileSync(bin, [...args], {\n      cwd,\n      encoding: 'utf8',\n      stdio: ['ignore', 'pipe', 'pipe'],\n    });\n  } catch (error) {\n    const detail =\n      error instanceof Error && 'stderr' in error\n        ? String((error as { stderr: unknown }).stderr)\n            .trim()\n            .slice(-1500)\n        : String(error);\n    throw preconditionError(\n      `${what} failed in the clean room: ${detail}`,\n      'The host rebuilds your package the same way, from the public registry; fix the dependency problem and re-run.',\n    );\n  }\n}\n\nfunction copyIfExists(from: string, to: string): void {\n  if (fs.existsSync(from)) fs.cpSync(from, to, { recursive: true });\n}\n\n/**\n * Builds the experience bundle the way the host's gate will, so the bytes match\n * by construction: in a temp directory holding only what ships (package.json,\n * tsconfig, `src/`), with dependencies installed by `npm ci --ignore-scripts`\n * from a standalone lockfile, and the shared bundle options.\n *\n * The lockfile is the project's own `package-lock.json`/`npm-shrinkwrap.json`\n * when it has one. A project inside a pnpm workspace (a `pnpm-lock.yaml` at the\n * repo root, no per-package npm lockfile) gets one generated for just its\n * `package.json` (`npm install`), and that generated file\n * is what ships, so the host resolves the dependencies the bundle was built\n * with. It resolves the declared ranges from the registry, which can differ from\n * the versions the workspace's pnpm lockfile pins; the bundle you ship is the\n * one built from the shipped lockfile, not from your workspace's tree.\n *\n * The surfaces are recomputed from the rebuilt bundle's own definition (the host\n * does the same), so a project whose local tree declares something else is\n * caught here instead of at the gate.\n */\nexport async function buildInCleanRoom(\n  project: ExperienceProject,\n  env: Record<string, string | undefined> = {},\n): Promise<CleanRoomBuild> {\n  const npmBin = env[NPM_BIN_ENV] ?? 'npm';\n  const own = ownLockfile(project.dir);\n  const pnpm = own ? null : findPnpmLockfile(project.dir);\n\n  if (!own && !pnpm) {\n    throw preconditionError(\n      'There is no lockfile to build from: no package-lock.json, npm-shrinkwrap.json or pnpm-lock.yaml.',\n      'Run \"npm install --package-lock-only\" in the project (or install with pnpm in a workspace) and commit the lockfile.',\n    );\n  }\n\n  const room = fs.mkdtempSync(path.join(os.tmpdir(), 'ekanos-exp-room-'));\n  try {\n    fs.copyFileSync(\n      path.join(project.dir, 'package.json'),\n      path.join(room, 'package.json'),\n    );\n    copyIfExists(path.join(project.dir, 'src'), path.join(room, 'src'));\n    for (const name of fs.readdirSync(project.dir)) {\n      if (/^tsconfig[^/]*\\.json$/.test(name)) {\n        fs.copyFileSync(path.join(project.dir, name), path.join(room, name));\n      }\n    }\n\n    let lockfileSource: LockfileSource;\n    if (own) {\n      fs.copyFileSync(own.file, path.join(room, 'package-lock.json'));\n      lockfileSource = own.source;\n    } else {\n      const manifest = fs.readFileSync(path.join(room, 'package.json'), 'utf8');\n      if (/\"(?:workspace|catalog|link|file):/.test(manifest)) {\n        throw validationError(\n          'package.json depends on a workspace:, catalog:, link: or file: package, which a standalone lockfile cannot resolve.',\n          'An experience reaches integrations through pinned operations, not packages; publish a package that depends only on registry versions.',\n        );\n      }\n      // A real install, twice, not `--package-lock-only`: npm resolving an\n      // empty tree writes lockfiles that `npm ci` then rejects as out of sync\n      // (a peer range resolved two ways), and a first install over a fresh tree\n      // can too (seen with eslint's ajv). The second install reconciles the\n      // tree against its own lockfile; the `npm ci` below, after the tree is\n      // thrown away, is the install the host will repeat and proves it did.\n      for (let pass = 0; pass < 2; pass += 1) {\n        npm(\n          npmBin,\n          ['install', ...LOCKFILE_ARGS],\n          room,\n          'generating a standalone lockfile from package.json',\n        );\n      }\n      fs.rmSync(path.join(room, 'node_modules'), {\n        recursive: true,\n        force: true,\n      });\n      lockfileSource = 'generated-from-pnpm';\n    }\n\n    const lockfile = fs.readFileSync(\n      path.join(room, 'package-lock.json'),\n      'utf8',\n    );\n    npm(npmBin, ['ci', ...LOCKFILE_ARGS], room, '`npm ci`');\n\n    const built = await build({\n      ...EXPERIENCE_BUNDLE_OPTIONS,\n      entryPoints: [path.join(room, project.entry)],\n      absWorkingDir: room,\n      external: experienceExternals(project.ekanos.allowImports),\n    });\n    const bundle = built.outputFiles[0]?.text ?? '';\n\n    const file = path.join(room, '.clean-room-experience.mjs');\n    fs.writeFileSync(file, bundle);\n    const loaded = (await import(pathToFileURL(file).href)) as {\n      default?: SurfacesDefinitionInput;\n    };\n    if (\n      typeof loaded.default !== 'object' ||\n      loaded.default === null ||\n      !Array.isArray(loaded.default.widgets) ||\n      !Array.isArray(loaded.default.pages)\n    ) {\n      throw validationError(\n        'The rebuilt bundle does not export a defineExperience() result as default.',\n        `Export the definition from ${project.entry} as the default export.`,\n      );\n    }\n\n    return {\n      bundle,\n      lockfile,\n      lockfileSource,\n      surfaces: buildExperienceSurfaces(project.slug, loaded.default),\n    };\n  } finally {\n    fs.rmSync(room, { recursive: true, force: true });\n  }\n}\n"]}

package/dist/experience/contract-sources.d.ts

@@ -22,11 +22,16 @@ export interface SourceOptions {
     fromPath?: string;
     env?: Record<string, string | undefined>;
 }
-/** Every `*.contract.json` of `dir` for `integration`, highest contract version within `line` first. */
+/**
+ * Every `*.contract.json` of `dir` for `integration` (a reference: `slug` or
+ * `ns/slug`; files are named by its token), highest contract version within
+ * `line` first. A namespaced reference never matches a global file of the same
+ * slug, nor the reverse.
+ */
 export declare function contractsInDir(dir: string, integration: string, line: string): Contract[];
 export declare function dirSource(dir: string): ContractSource;
 export declare function pathSource(projectPath: string): ContractSource;
-/** The committed pin: `<contractsDir>/<integration>@<version>.contract.json`. */
+/** The committed pin: `<contractsDir>/<token>@<version>.contract.json`, always flat. */
 export declare function snapshotFile(project: ExperienceProject, integration: string, line: string): string;
 export declare function snapshotSource(project: ExperienceProject): ContractSource;
 /** Sources in resolution order: explicit flags, env, then (optionally) the snapshot. */

package/dist/experience/contract-sources.js

@@ -1,4 +1,4 @@
-import { compareSemver, compatLine, verifyContract, } from '@ekanos/integration-schema';
+import { compareSemver, compatLine, contractMatchesRef, integrationRefToken, snapshotFileName, verifyContract, } from '@ekanos/integration-schema';
 import * as fs from 'node:fs';
 import * as path from 'node:path';
 import { notFoundError, validationError } from '../errors.js';
@@ -17,8 +17,16 @@ function readContractFile(file) {
     }
     return verified.contract;
 }
-/** Every `*.contract.json` of `dir` for `integration`, highest contract version within `line` first. */
+/**
+ * Every `*.contract.json` of `dir` for `integration` (a reference: `slug` or
+ * `ns/slug`; files are named by its token), highest contract version within
+ * `line` first. A namespaced reference never matches a global file of the same
+ * slug, nor the reverse.
+ */
 export function contractsInDir(dir, integration, line) {
+    const token = integrationRefToken(integration);
+    if (token === null)
+        return [];
     let names;
     try {
         names = fs.readdirSync(dir).filter((n) => n.endsWith('.contract.json'));
@@ -28,13 +36,12 @@ export function contractsInDir(dir, integration, line) {
     }
     const found = [];
     for (const name of names) {
-        if (!name.startsWith(`${integration}@`) &&
-            !name.startsWith(`${integration}.`)) {
+        if (!name.startsWith(`${token}@`) && !name.startsWith(`${token}.`)) {
             continue;
         }
         const contract = readContractFile(path.join(dir, name));
         if (contract &&
-            contract.integration === integration &&
+            contractMatchesRef(contract, integration) &&
             contract.compatLine === line) {
             found.push(contract);
         }
@@ -60,7 +67,7 @@ export function pathSource(projectPath) {
             }
             const contract = readContractFile(file);
             if (!contract ||
-                contract.integration !== integration ||
+                !contractMatchesRef(contract, integration) ||
                 contract.compatLine !== line) {
                 return null;
             }
@@ -68,9 +75,9 @@ export function pathSource(projectPath) {
         },
     };
 }
-/** The committed pin: `<contractsDir>/<integration>@<version>.contract.json`. */
+/** The committed pin: `<contractsDir>/<token>@<version>.contract.json`, always flat. */
 export function snapshotFile(project, integration, line) {
-    return path.join(project.contractsDir, `${integration}@${line}.contract.json`);
+    return path.join(project.contractsDir, snapshotFileName(integration, line));
 }
 export function snapshotSource(project) {
     return {

package/dist/experience/contract-sources.js.map

@@ -1 +1 @@
-{"version":3,"file":"contract-sources.js","sourceRoot":"","sources":["../../src/experience/contract-sources.ts"],"names":[],"mappings":"AAAA,OAAO,EAEL,aAAa,EACb,UAAU,EACV,cAAc,GACf,MAAM,4BAA4B,CAAC;AACpC,OAAO,KAAK,EAAE,MAAM,SAAS,CAAC;AAC9B,OAAO,KAAK,IAAI,MAAM,WAAW,CAAC;AAElC,OAAO,EAAE,aAAa,EAAE,eAAe,EAAE,MAAM,WAAW,CAAC;AA+B3D,SAAS,gBAAgB,CAAC,IAAY;IACpC,IAAI,IAAa,CAAC;IAClB,IAAI,CAAC;QACH,IAAI,GAAG,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC,YAAY,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC,CAAC;IACnD,CAAC;eAAO,CAAC;QACP,OAAO,IAAI,CAAC;IACd,CAAC;IACD,MAAM,QAAQ,GAAG,cAAc,CAAC,IAAI,CAAC,CAAC;IACtC,IAAI,CAAC,QAAQ,CAAC,QAAQ,IAAI,QAAQ,CAAC,QAAQ,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QACvD,MAAM,KAAK,GAAG,QAAQ,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC;QACnC,MAAM,eAAe,CACnB,GAAG,IAAI,6BAA6B,KAAK,CAAC,CAAC,CAAC,GAAG,KAAK,CAAC,IAAI,KAAK,KAAK,CAAC,OAAO,EAAE,CAAC,CAAC,CAAC,YAAY,EAAE,EAC9F,mGAAmG,CACpG,CAAC;IACJ,CAAC;IAED,OAAO,QAAQ,CAAC,QAAQ,CAAC;AAC3B,CAAC;AAED,wGAAwG;AACxG,MAAM,UAAU,cAAc,CAC5B,GAAW,EACX,WAAmB,EACnB,IAAY;IAEZ,IAAI,KAAe,CAAC;IACpB,IAAI,CAAC;QACH,KAAK,GAAG,EAAE,CAAC,WAAW,CAAC,GAAG,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,QAAQ,CAAC,gBAAgB,CAAC,CAAC,CAAC;IAC1E,CAAC;eAAO,CAAC;QACP,OAAO,EAAE,CAAC;IACZ,CAAC;IACD,MAAM,KAAK,GAAe,EAAE,CAAC;IAC7B,KAAK,MAAM,IAAI,IAAI,KAAK,EAAE,CAAC;QACzB,IACE,CAAC,IAAI,CAAC,UAAU,CAAC,GAAG,WAAW,GAAG,CAAC;YACnC,CAAC,IAAI,CAAC,UAAU,CAAC,GAAG,WAAW,GAAG,CAAC,EACnC,CAAC;YACD,SAAS;QACX,CAAC;QACD,MAAM,QAAQ,GAAG,gBAAgB,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,IAAI,CAAC,CAAC,CAAC;QACxD,IACE,QAAQ;YACR,QAAQ,CAAC,WAAW,KAAK,WAAW;YACpC,QAAQ,CAAC,UAAU,KAAK,IAAI,EAC5B,CAAC;YACD,KAAK,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;QACvB,CAAC;IACH,CAAC;IAED,OAAO,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CACzB,aAAa,CAAC,CAAC,CAAC,eAAe,EAAE,CAAC,CAAC,eAAe,CAAC,CACpD,CAAC;AACJ,CAAC;AAED,MAAM,UAAU,SAAS,CAAC,GAAW;IACnC,OAAO;QACL,IAAI,EAAE,OAAO,GAAG,EAAE;QAClB,OAAO,CAAC,WAAW,EAAE,IAAI;YACvB,MAAM,CAAC,IAAI,CAAC,GAAG,cAAc,CAAC,GAAG,EAAE,WAAW,EAAE,IAAI,CAAC,CAAC;YAEtD,OAAO,IAAI,CAAC,CAAC,CAAC,EAAE,QAAQ,EAAE,IAAI,EAAE,MAAM,EAAE,GAAG,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC;QACpE,CAAC;KACF,CAAC;AACJ,CAAC;AAED,MAAM,UAAU,UAAU,CAAC,WAAmB;IAC5C,OAAO;QACL,IAAI,EAAE,QAAQ,WAAW,EAAE;QAC3B,OAAO,CAAC,WAAW,EAAE,IAAI;YACvB,MAAM,IAAI,GAAG,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,OAAO,CAAC,WAAW,CAAC,EAAE,eAAe,CAAC,CAAC;YACnE,IAAI,CAAC,EAAE,CAAC,UAAU,CAAC,IAAI,CAAC,EAAE,CAAC;gBACzB,MAAM,aAAa,CACjB,GAAG,IAAI,kBAAkB,EACzB,wEAAwE,CACzE,CAAC;YACJ,CAAC;YACD,MAAM,QAAQ,GAAG,gBAAgB,CAAC,IAAI,CAAC,CAAC;YACxC,IACE,CAAC,QAAQ;gBACT,QAAQ,CAAC,WAAW,KAAK,WAAW;gBACpC,QAAQ,CAAC,UAAU,KAAK,IAAI,EAC5B,CAAC;gBACD,OAAO,IAAI,CAAC;YACd,CAAC;YAED,OAAO,EAAE,QAAQ,EAAE,MAAM,EAAE,IAAI,EAAE,IAAI,EAAE,MAAM,EAAE,CAAC;QAClD,CAAC;KACF,CAAC;AACJ,CAAC;AAED,iFAAiF;AACjF,MAAM,UAAU,YAAY,CAC1B,OAA0B,EAC1B,WAAmB,EACnB,IAAY;IAEZ,OAAO,IAAI,CAAC,IAAI,CACd,OAAO,CAAC,YAAY,EACpB,GAAG,WAAW,IAAI,IAAI,gBAAgB,CACvC,CAAC;AACJ,CAAC;AAED,MAAM,UAAU,cAAc,CAAC,OAA0B;IACvD,OAAO;QACL,IAAI,EAAE,oBAAoB;QAC1B,OAAO,CAAC,WAAW,EAAE,IAAI;YACvB,MAAM,IAAI,GAAG,YAAY,CAAC,OAAO,EAAE,WAAW,EAAE,IAAI,CAAC,CAAC;YACtD,MAAM,QAAQ,GAAG,EAAE,CAAC,UAAU,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,gBAAgB,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC;YAErE,OAAO,QAAQ,CAAC,CAAC,CAAC,EAAE,QAAQ,EAAE,MAAM,EAAE,IAAI,EAAE,IAAI,EAAE,UAAU,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC;QACxE,CAAC;KACF,CAAC;AACJ,CAAC;AAED,wFAAwF;AACxF,MAAM,UAAU,cAAc,CAC5B,OAA0B,EAC1B,OAAsB,EACtB,KAAK,GAA8B,EAAE,EACrC,eAAe,GAAG,IAAI;;IAEtB,MAAM,OAAO,GAAqB,EAAE,CAAC;IACrC,IAAI,OAAO,CAAC,QAAQ;QAAE,OAAO,CAAC,IAAI,CAAC,UAAU,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAC,CAAC;IACjE,IAAI,OAAO,CAAC,OAAO;QAAE,OAAO,CAAC,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,OAAO,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC;IAC5E,MAAM,MAAM,GAAG,MAAA,OAAO,CAAC,GAAG,0CAAE,oBAAoB,CAAC;IACjD,IAAI,CAAC,OAAO,CAAC,OAAO,IAAI,MAAM;QAAE,OAAO,CAAC,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC;IAC9E,OAAO,CAAC,IAAI,CAAC,GAAG,KAAK,CAAC,CAAC;IACvB,IAAI,eAAe;QAAE,OAAO,CAAC,IAAI,CAAC,cAAc,CAAC,OAAO,CAAC,CAAC,CAAC;IAE3D,OAAO,OAAO,CAAC;AACjB,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,eAAe,CACnC,OAAkC,EAClC,WAAmB,EACnB,IAAY;IAEZ,KAAK,MAAM,MAAM,IAAI,OAAO,EAAE,CAAC;QAC7B,MAAM,GAAG,GAAG,MAAM,MAAM,CAAC,OAAO,CAAC,WAAW,EAAE,IAAI,CAAC,CAAC;QACpD,IAAI,GAAG;YAAE,OAAO,GAAG,CAAC;IACtB,CAAC;IAED,MAAM,aAAa,CACjB,mBAAmB,WAAW,IAAI,IAAI,gBAAgB,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,SAAS,IAAI,EAC5G,uGAAuG,CACxG,CAAC;AACJ,CAAC;AAED,gFAAgF;AAChF,OAAO,EAAE,UAAU,EAAE,CAAC","sourcesContent":["import {\n  type Contract,\n  compareSemver,\n  compatLine,\n  verifyContract,\n} from '@ekanos/integration-schema';\nimport * as fs from 'node:fs';\nimport * as path from 'node:path';\n\nimport { notFoundError, validationError } from '../errors';\nimport type { ExperienceProject } from './project';\n\n/** Where an integration's contract came from, for messages and `sync` bookkeeping. */\nexport interface ResolvedContract {\n  contract: Contract;\n  origin: string;\n  kind: 'dir' | 'path' | 'snapshot';\n}\n\n/**\n * A pluggable contract source. The dir/path/snapshot sources below are the\n * offline defaults; the harness resolver (catalog, published packages) plugs\n * in here as another source, so `add`/`sync` never learn where contracts live.\n */\nexport interface ContractSource {\n  name: string;\n  resolve(\n    integration: string,\n    line: string,\n  ): Promise<ResolvedContract | null> | ResolvedContract | null;\n}\n\nexport interface SourceOptions {\n  /** A directory of `*.contract.json` (the monorepo contracts folder or a registry mirror). */\n  fromDir?: string;\n  /** An integration project directory; its `contract.json` is read. */\n  fromPath?: string;\n  env?: Record<string, string | undefined>;\n}\n\nfunction readContractFile(file: string): Contract | null {\n  let json: unknown;\n  try {\n    json = JSON.parse(fs.readFileSync(file, 'utf8'));\n  } catch {\n    return null;\n  }\n  const verified = verifyContract(json);\n  if (!verified.contract || verified.problems.length > 0) {\n    const first = verified.problems[0];\n    throw validationError(\n      `${file} is not a valid contract: ${first ? `${first.rule}: ${first.message}` : 'unreadable'}`,\n      'Regenerate it with \"ekanos contract\" in the integration, or point at a valid contracts directory.',\n    );\n  }\n\n  return verified.contract;\n}\n\n/** Every `*.contract.json` of `dir` for `integration`, highest contract version within `line` first. */\nexport function contractsInDir(\n  dir: string,\n  integration: string,\n  line: string,\n): Contract[] {\n  let names: string[];\n  try {\n    names = fs.readdirSync(dir).filter((n) => n.endsWith('.contract.json'));\n  } catch {\n    return [];\n  }\n  const found: Contract[] = [];\n  for (const name of names) {\n    if (\n      !name.startsWith(`${integration}@`) &&\n      !name.startsWith(`${integration}.`)\n    ) {\n      continue;\n    }\n    const contract = readContractFile(path.join(dir, name));\n    if (\n      contract &&\n      contract.integration === integration &&\n      contract.compatLine === line\n    ) {\n      found.push(contract);\n    }\n  }\n\n  return found.sort((a, b) =>\n    compareSemver(b.contractVersion, a.contractVersion),\n  );\n}\n\nexport function dirSource(dir: string): ContractSource {\n  return {\n    name: `dir ${dir}`,\n    resolve(integration, line) {\n      const [best] = contractsInDir(dir, integration, line);\n\n      return best ? { contract: best, origin: dir, kind: 'dir' } : null;\n    },\n  };\n}\n\nexport function pathSource(projectPath: string): ContractSource {\n  return {\n    name: `path ${projectPath}`,\n    resolve(integration, line) {\n      const file = path.join(path.resolve(projectPath), 'contract.json');\n      if (!fs.existsSync(file)) {\n        throw notFoundError(\n          `${file} does not exist.`,\n          'Run \"ekanos contract\" in that integration to derive its contract.json.',\n        );\n      }\n      const contract = readContractFile(file);\n      if (\n        !contract ||\n        contract.integration !== integration ||\n        contract.compatLine !== line\n      ) {\n        return null;\n      }\n\n      return { contract, origin: file, kind: 'path' };\n    },\n  };\n}\n\n/** The committed pin: `<contractsDir>/<integration>@<version>.contract.json`. */\nexport function snapshotFile(\n  project: ExperienceProject,\n  integration: string,\n  line: string,\n): string {\n  return path.join(\n    project.contractsDir,\n    `${integration}@${line}.contract.json`,\n  );\n}\n\nexport function snapshotSource(project: ExperienceProject): ContractSource {\n  return {\n    name: 'committed snapshot',\n    resolve(integration, line) {\n      const file = snapshotFile(project, integration, line);\n      const contract = fs.existsSync(file) ? readContractFile(file) : null;\n\n      return contract ? { contract, origin: file, kind: 'snapshot' } : null;\n    },\n  };\n}\n\n/** Sources in resolution order: explicit flags, env, then (optionally) the snapshot. */\nexport function defaultSources(\n  project: ExperienceProject,\n  options: SourceOptions,\n  extra: readonly ContractSource[] = [],\n  includeSnapshot = true,\n): ContractSource[] {\n  const sources: ContractSource[] = [];\n  if (options.fromPath) sources.push(pathSource(options.fromPath));\n  if (options.fromDir) sources.push(dirSource(path.resolve(options.fromDir)));\n  const envDir = options.env?.EKANOS_CONTRACTS_DIR;\n  if (!options.fromDir && envDir) sources.push(dirSource(path.resolve(envDir)));\n  sources.push(...extra);\n  if (includeSnapshot) sources.push(snapshotSource(project));\n\n  return sources;\n}\n\nexport async function resolveContract(\n  sources: readonly ContractSource[],\n  integration: string,\n  line: string,\n): Promise<ResolvedContract> {\n  for (const source of sources) {\n    const hit = await source.resolve(integration, line);\n    if (hit) return hit;\n  }\n\n  throw notFoundError(\n    `No contract for ${integration}@${line} (looked in: ${sources.map((s) => s.name).join(', ') || 'nothing'}).`,\n    'Pass --from-dir <contracts folder> or --from-path <integration project>, or set EKANOS_CONTRACTS_DIR.',\n  );\n}\n\n/** Line for a package version, re-exported so callers need no schema import. */\nexport { compatLine };\n"]}
+{"version":3,"file":"contract-sources.js","sourceRoot":"","sources":["../../src/experience/contract-sources.ts"],"names":[],"mappings":"AAAA,OAAO,EAEL,aAAa,EACb,UAAU,EACV,kBAAkB,EAClB,mBAAmB,EACnB,gBAAgB,EAChB,cAAc,GACf,MAAM,4BAA4B,CAAC;AACpC,OAAO,KAAK,EAAE,MAAM,SAAS,CAAC;AAC9B,OAAO,KAAK,IAAI,MAAM,WAAW,CAAC;AAElC,OAAO,EAAE,aAAa,EAAE,eAAe,EAAE,MAAM,WAAW,CAAC;AA+B3D,SAAS,gBAAgB,CAAC,IAAY;IACpC,IAAI,IAAa,CAAC;IAClB,IAAI,CAAC;QACH,IAAI,GAAG,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC,YAAY,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC,CAAC;IACnD,CAAC;eAAO,CAAC;QACP,OAAO,IAAI,CAAC;IACd,CAAC;IACD,MAAM,QAAQ,GAAG,cAAc,CAAC,IAAI,CAAC,CAAC;IACtC,IAAI,CAAC,QAAQ,CAAC,QAAQ,IAAI,QAAQ,CAAC,QAAQ,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QACvD,MAAM,KAAK,GAAG,QAAQ,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC;QACnC,MAAM,eAAe,CACnB,GAAG,IAAI,6BAA6B,KAAK,CAAC,CAAC,CAAC,GAAG,KAAK,CAAC,IAAI,KAAK,KAAK,CAAC,OAAO,EAAE,CAAC,CAAC,CAAC,YAAY,EAAE,EAC9F,mGAAmG,CACpG,CAAC;IACJ,CAAC;IAED,OAAO,QAAQ,CAAC,QAAQ,CAAC;AAC3B,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,cAAc,CAC5B,GAAW,EACX,WAAmB,EACnB,IAAY;IAEZ,MAAM,KAAK,GAAG,mBAAmB,CAAC,WAAW,CAAC,CAAC;IAC/C,IAAI,KAAK,KAAK,IAAI;QAAE,OAAO,EAAE,CAAC;IAC9B,IAAI,KAAe,CAAC;IACpB,IAAI,CAAC;QACH,KAAK,GAAG,EAAE,CAAC,WAAW,CAAC,GAAG,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,QAAQ,CAAC,gBAAgB,CAAC,CAAC,CAAC;IAC1E,CAAC;eAAO,CAAC;QACP,OAAO,EAAE,CAAC;IACZ,CAAC;IACD,MAAM,KAAK,GAAe,EAAE,CAAC;IAC7B,KAAK,MAAM,IAAI,IAAI,KAAK,EAAE,CAAC;QACzB,IAAI,CAAC,IAAI,CAAC,UAAU,CAAC,GAAG,KAAK,GAAG,CAAC,IAAI,CAAC,IAAI,CAAC,UAAU,CAAC,GAAG,KAAK,GAAG,CAAC,EAAE,CAAC;YACnE,SAAS;QACX,CAAC;QACD,MAAM,QAAQ,GAAG,gBAAgB,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,IAAI,CAAC,CAAC,CAAC;QACxD,IACE,QAAQ;YACR,kBAAkB,CAAC,QAAQ,EAAE,WAAW,CAAC;YACzC,QAAQ,CAAC,UAAU,KAAK,IAAI,EAC5B,CAAC;YACD,KAAK,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;QACvB,CAAC;IACH,CAAC;IAED,OAAO,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CACzB,aAAa,CAAC,CAAC,CAAC,eAAe,EAAE,CAAC,CAAC,eAAe,CAAC,CACpD,CAAC;AACJ,CAAC;AAED,MAAM,UAAU,SAAS,CAAC,GAAW;IACnC,OAAO;QACL,IAAI,EAAE,OAAO,GAAG,EAAE;QAClB,OAAO,CAAC,WAAW,EAAE,IAAI;YACvB,MAAM,CAAC,IAAI,CAAC,GAAG,cAAc,CAAC,GAAG,EAAE,WAAW,EAAE,IAAI,CAAC,CAAC;YAEtD,OAAO,IAAI,CAAC,CAAC,CAAC,EAAE,QAAQ,EAAE,IAAI,EAAE,MAAM,EAAE,GAAG,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC;QACpE,CAAC;KACF,CAAC;AACJ,CAAC;AAED,MAAM,UAAU,UAAU,CAAC,WAAmB;IAC5C,OAAO;QACL,IAAI,EAAE,QAAQ,WAAW,EAAE;QAC3B,OAAO,CAAC,WAAW,EAAE,IAAI;YACvB,MAAM,IAAI,GAAG,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,OAAO,CAAC,WAAW,CAAC,EAAE,eAAe,CAAC,CAAC;YACnE,IAAI,CAAC,EAAE,CAAC,UAAU,CAAC,IAAI,CAAC,EAAE,CAAC;gBACzB,MAAM,aAAa,CACjB,GAAG,IAAI,kBAAkB,EACzB,wEAAwE,CACzE,CAAC;YACJ,CAAC;YACD,MAAM,QAAQ,GAAG,gBAAgB,CAAC,IAAI,CAAC,CAAC;YACxC,IACE,CAAC,QAAQ;gBACT,CAAC,kBAAkB,CAAC,QAAQ,EAAE,WAAW,CAAC;gBAC1C,QAAQ,CAAC,UAAU,KAAK,IAAI,EAC5B,CAAC;gBACD,OAAO,IAAI,CAAC;YACd,CAAC;YAED,OAAO,EAAE,QAAQ,EAAE,MAAM,EAAE,IAAI,EAAE,IAAI,EAAE,MAAM,EAAE,CAAC;QAClD,CAAC;KACF,CAAC;AACJ,CAAC;AAED,wFAAwF;AACxF,MAAM,UAAU,YAAY,CAC1B,OAA0B,EAC1B,WAAmB,EACnB,IAAY;IAEZ,OAAO,IAAI,CAAC,IAAI,CAAC,OAAO,CAAC,YAAY,EAAE,gBAAgB,CAAC,WAAW,EAAE,IAAI,CAAC,CAAC,CAAC;AAC9E,CAAC;AAED,MAAM,UAAU,cAAc,CAAC,OAA0B;IACvD,OAAO;QACL,IAAI,EAAE,oBAAoB;QAC1B,OAAO,CAAC,WAAW,EAAE,IAAI;YACvB,MAAM,IAAI,GAAG,YAAY,CAAC,OAAO,EAAE,WAAW,EAAE,IAAI,CAAC,CAAC;YACtD,MAAM,QAAQ,GAAG,EAAE,CAAC,UAAU,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,gBAAgB,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC;YAErE,OAAO,QAAQ,CAAC,CAAC,CAAC,EAAE,QAAQ,EAAE,MAAM,EAAE,IAAI,EAAE,IAAI,EAAE,UAAU,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC;QACxE,CAAC;KACF,CAAC;AACJ,CAAC;AAED,wFAAwF;AACxF,MAAM,UAAU,cAAc,CAC5B,OAA0B,EAC1B,OAAsB,EACtB,KAAK,GAA8B,EAAE,EACrC,eAAe,GAAG,IAAI;;IAEtB,MAAM,OAAO,GAAqB,EAAE,CAAC;IACrC,IAAI,OAAO,CAAC,QAAQ;QAAE,OAAO,CAAC,IAAI,CAAC,UAAU,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAC,CAAC;IACjE,IAAI,OAAO,CAAC,OAAO;QAAE,OAAO,CAAC,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,OAAO,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC;IAC5E,MAAM,MAAM,GAAG,MAAA,OAAO,CAAC,GAAG,0CAAE,oBAAoB,CAAC;IACjD,IAAI,CAAC,OAAO,CAAC,OAAO,IAAI,MAAM;QAAE,OAAO,CAAC,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC;IAC9E,OAAO,CAAC,IAAI,CAAC,GAAG,KAAK,CAAC,CAAC;IACvB,IAAI,eAAe;QAAE,OAAO,CAAC,IAAI,CAAC,cAAc,CAAC,OAAO,CAAC,CAAC,CAAC;IAE3D,OAAO,OAAO,CAAC;AACjB,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,eAAe,CACnC,OAAkC,EAClC,WAAmB,EACnB,IAAY;IAEZ,KAAK,MAAM,MAAM,IAAI,OAAO,EAAE,CAAC;QAC7B,MAAM,GAAG,GAAG,MAAM,MAAM,CAAC,OAAO,CAAC,WAAW,EAAE,IAAI,CAAC,CAAC;QACpD,IAAI,GAAG;YAAE,OAAO,GAAG,CAAC;IACtB,CAAC;IAED,MAAM,aAAa,CACjB,mBAAmB,WAAW,IAAI,IAAI,gBAAgB,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,SAAS,IAAI,EAC5G,uGAAuG,CACxG,CAAC;AACJ,CAAC;AAED,gFAAgF;AAChF,OAAO,EAAE,UAAU,EAAE,CAAC","sourcesContent":["import {\n  type Contract,\n  compareSemver,\n  compatLine,\n  contractMatchesRef,\n  integrationRefToken,\n  snapshotFileName,\n  verifyContract,\n} from '@ekanos/integration-schema';\nimport * as fs from 'node:fs';\nimport * as path from 'node:path';\n\nimport { notFoundError, validationError } from '../errors';\nimport type { ExperienceProject } from './project';\n\n/** Where an integration's contract came from, for messages and `sync` bookkeeping. */\nexport interface ResolvedContract {\n  contract: Contract;\n  origin: string;\n  kind: 'dir' | 'path' | 'snapshot';\n}\n\n/**\n * A pluggable contract source. The dir/path/snapshot sources below are the\n * offline defaults; the harness resolver (catalog, published packages) plugs\n * in here as another source, so `add`/`sync` never learn where contracts live.\n */\nexport interface ContractSource {\n  name: string;\n  resolve(\n    integration: string,\n    line: string,\n  ): Promise<ResolvedContract | null> | ResolvedContract | null;\n}\n\nexport interface SourceOptions {\n  /** A directory of `*.contract.json` (the monorepo contracts folder or a registry mirror). */\n  fromDir?: string;\n  /** An integration project directory; its `contract.json` is read. */\n  fromPath?: string;\n  env?: Record<string, string | undefined>;\n}\n\nfunction readContractFile(file: string): Contract | null {\n  let json: unknown;\n  try {\n    json = JSON.parse(fs.readFileSync(file, 'utf8'));\n  } catch {\n    return null;\n  }\n  const verified = verifyContract(json);\n  if (!verified.contract || verified.problems.length > 0) {\n    const first = verified.problems[0];\n    throw validationError(\n      `${file} is not a valid contract: ${first ? `${first.rule}: ${first.message}` : 'unreadable'}`,\n      'Regenerate it with \"ekanos contract\" in the integration, or point at a valid contracts directory.',\n    );\n  }\n\n  return verified.contract;\n}\n\n/**\n * Every `*.contract.json` of `dir` for `integration` (a reference: `slug` or\n * `ns/slug`; files are named by its token), highest contract version within\n * `line` first. A namespaced reference never matches a global file of the same\n * slug, nor the reverse.\n */\nexport function contractsInDir(\n  dir: string,\n  integration: string,\n  line: string,\n): Contract[] {\n  const token = integrationRefToken(integration);\n  if (token === null) return [];\n  let names: string[];\n  try {\n    names = fs.readdirSync(dir).filter((n) => n.endsWith('.contract.json'));\n  } catch {\n    return [];\n  }\n  const found: Contract[] = [];\n  for (const name of names) {\n    if (!name.startsWith(`${token}@`) && !name.startsWith(`${token}.`)) {\n      continue;\n    }\n    const contract = readContractFile(path.join(dir, name));\n    if (\n      contract &&\n      contractMatchesRef(contract, integration) &&\n      contract.compatLine === line\n    ) {\n      found.push(contract);\n    }\n  }\n\n  return found.sort((a, b) =>\n    compareSemver(b.contractVersion, a.contractVersion),\n  );\n}\n\nexport function dirSource(dir: string): ContractSource {\n  return {\n    name: `dir ${dir}`,\n    resolve(integration, line) {\n      const [best] = contractsInDir(dir, integration, line);\n\n      return best ? { contract: best, origin: dir, kind: 'dir' } : null;\n    },\n  };\n}\n\nexport function pathSource(projectPath: string): ContractSource {\n  return {\n    name: `path ${projectPath}`,\n    resolve(integration, line) {\n      const file = path.join(path.resolve(projectPath), 'contract.json');\n      if (!fs.existsSync(file)) {\n        throw notFoundError(\n          `${file} does not exist.`,\n          'Run \"ekanos contract\" in that integration to derive its contract.json.',\n        );\n      }\n      const contract = readContractFile(file);\n      if (\n        !contract ||\n        !contractMatchesRef(contract, integration) ||\n        contract.compatLine !== line\n      ) {\n        return null;\n      }\n\n      return { contract, origin: file, kind: 'path' };\n    },\n  };\n}\n\n/** The committed pin: `<contractsDir>/<token>@<version>.contract.json`, always flat. */\nexport function snapshotFile(\n  project: ExperienceProject,\n  integration: string,\n  line: string,\n): string {\n  return path.join(project.contractsDir, snapshotFileName(integration, line));\n}\n\nexport function snapshotSource(project: ExperienceProject): ContractSource {\n  return {\n    name: 'committed snapshot',\n    resolve(integration, line) {\n      const file = snapshotFile(project, integration, line);\n      const contract = fs.existsSync(file) ? readContractFile(file) : null;\n\n      return contract ? { contract, origin: file, kind: 'snapshot' } : null;\n    },\n  };\n}\n\n/** Sources in resolution order: explicit flags, env, then (optionally) the snapshot. */\nexport function defaultSources(\n  project: ExperienceProject,\n  options: SourceOptions,\n  extra: readonly ContractSource[] = [],\n  includeSnapshot = true,\n): ContractSource[] {\n  const sources: ContractSource[] = [];\n  if (options.fromPath) sources.push(pathSource(options.fromPath));\n  if (options.fromDir) sources.push(dirSource(path.resolve(options.fromDir)));\n  const envDir = options.env?.EKANOS_CONTRACTS_DIR;\n  if (!options.fromDir && envDir) sources.push(dirSource(path.resolve(envDir)));\n  sources.push(...extra);\n  if (includeSnapshot) sources.push(snapshotSource(project));\n\n  return sources;\n}\n\nexport async function resolveContract(\n  sources: readonly ContractSource[],\n  integration: string,\n  line: string,\n): Promise<ResolvedContract> {\n  for (const source of sources) {\n    const hit = await source.resolve(integration, line);\n    if (hit) return hit;\n  }\n\n  throw notFoundError(\n    `No contract for ${integration}@${line} (looked in: ${sources.map((s) => s.name).join(', ') || 'nothing'}).`,\n    'Pass --from-dir <contracts folder> or --from-path <integration project>, or set EKANOS_CONTRACTS_DIR.',\n  );\n}\n\n/** Line for a package version, re-exported so callers need no schema import. */\nexport { compatLine };\n"]}

package/dist/experience/definition-checks.d.ts

@@ -1,8 +1,9 @@
-import { type ExperienceManifest, type Finding, type WorkflowTemplate } from '@ekanos/integration-schema';
+import { type ExperienceManifest, type ExperienceSurfaces, type Finding, type WorkflowTemplate } from '@ekanos/integration-schema';
 import type { LoadedExperienceDefinition, LoadedExperienceModule } from './definition-shape.js';
 import { type PinnedIntegration } from './pins.js';
 import type { ExperienceProject } from './project.js';
 export declare const DEFINITION_CHECK = "checks/experience-definition";
+export declare const SURFACES_CHECK: "checks/experience-surfaces";
 export interface DefinitionAnalysis {
     findings: Finding[];
     workflows: WorkflowTemplate[];
@@ -14,6 +15,15 @@ export interface DefinitionAnalysis {
  * review queue reads only, and each template serializes to the engine's DSL.
  */
 export declare function analyzeDefinition(project: ExperienceProject, loaded: LoadedExperienceModule, pinned: readonly PinnedIntegration[]): DefinitionAnalysis;
+/**
+ * The surfaces contract: page kinds, canvas widgets, routes and the suggested
+ * layout must be well formed and refer only to what the experience declares.
+ * The same rules `defineExperience` enforces, re-run on the loaded definition
+ * so a definition built by an older SDK, or by hand, cannot slip past.
+ */
+export declare function checkSurfaces(project: ExperienceProject, definition: LoadedExperienceDefinition): Finding[];
+/** `dist/surfaces.json`: the surfaces and suggested layout as data, no code. */
+export declare function buildSurfaces(project: ExperienceProject, definition: LoadedExperienceDefinition): ExperienceSurfaces;
 /** `fixtures/<integration>/<kind>-<name>.<variant>.json` must satisfy the pinned output schema. */
 export declare function checkFixtures(project: ExperienceProject, pinned: readonly PinnedIntegration[]): Finding[];
 export declare function buildManifest(input: {
@@ -23,4 +33,5 @@ export declare function buildManifest(input: {
     workflows: readonly WorkflowTemplate[];
     version: string;
     sdk: string;
+    surfaces: ExperienceSurfaces;
 }): ExperienceManifest;

package/dist/experience/definition-checks.js

@@ -1,9 +1,10 @@
-import { WorkflowTemplateSchema, canonicalJson, sha256Hex, validateAgainstSchema, workflowTemplateProblems, } from '@ekanos/integration-schema';
+import { ExperienceSurfacesSchema, WorkflowTemplateSchema, EKANOS_CHECK_STAGE_IDS, buildExperienceSurfaces, canonicalJson, sha256Hex, validateAgainstSchema, workflowTemplateProblems, } from '@ekanos/integration-schema';
 import * as fs from 'node:fs';
 import * as path from 'node:path';
 import { declaredOperationKeys } from './integrations-codegen.js';
 import { effectLookup } from './pins.js';
 export const DEFINITION_CHECK = 'checks/experience-definition';
+export const SURFACES_CHECK = EKANOS_CHECK_STAGE_IDS.experienceSurfaces;
 const err = (message, hint, file) => (Object.assign({ check: DEFINITION_CHECK, severity: 'error', message,
     hint }, (file ? { file } : {})));
 const warn = (message, hint, file) => (Object.assign({ check: DEFINITION_CHECK, severity: 'warn', message,
@@ -16,7 +17,7 @@ const warn = (message, hint, file) => (Object.assign({ check: DEFINITION_CHECK,
  */
 export function analyzeDefinition(project, loaded, pinned) {
     var _a, _b, _c, _d, _e;
-    var _f, _g;
+    var _f, _g, _h;
     const { definition } = loaded;
     const findings = [];
     const workflows = [];
@@ -44,10 +45,11 @@ export function analyzeDefinition(project, loaded, pinned) {
             checkIntegration(integration, `widget "${widget.id}"`);
     }
     for (const page of definition.pages) {
-        for (const integration of page.integrations)
+        for (const integration of (_f = page.integrations) !== null && _f !== void 0 ? _f : [])
             checkIntegration(integration, `page "${page.id}"`);
     }
-    for (const section of (_f = (_a = definition.reviewQueue) === null || _a === void 0 ? void 0 : _a.sections) !== null && _f !== void 0 ? _f : []) {
+    findings.push(...checkSurfaces(project, definition));
+    for (const section of (_g = (_a = definition.reviewQueue) === null || _a === void 0 ? void 0 : _a.sections) !== null && _g !== void 0 ? _g : []) {
         if (!checkIntegration(section.integration, `review section "${section.id}"`))
             continue;
         if (!((_b = declared.get(section.integration)) === null || _b === void 0 ? void 0 : _b.has(section.read))) {
@@ -101,7 +103,7 @@ export function analyzeDefinition(project, loaded, pinned) {
         const gated = new Set();
         const preds = new Map();
         for (const e of parsed.data.edges)
-            preds.set(e.to, [...((_g = preds.get(e.to)) !== null && _g !== void 0 ? _g : []), e.from]);
+            preds.set(e.to, [...((_h = preds.get(e.to)) !== null && _h !== void 0 ? _h : []), e.from]);
         const hasGate = (id, seen = new Set()) => {
             var _a;
             if (seen.has(id))
@@ -122,6 +124,30 @@ export function analyzeDefinition(project, loaded, pinned) {
     }
     return { findings, workflows };
 }
+// ─── surfaces ───────────────────────────────────────────────────────────────
+/**
+ * The surfaces contract: page kinds, canvas widgets, routes and the suggested
+ * layout must be well formed and refer only to what the experience declares.
+ * The same rules `defineExperience` enforces, re-run on the loaded definition
+ * so a definition built by an older SDK, or by hand, cannot slip past.
+ */
+export function checkSurfaces(project, definition) {
+    const built = buildSurfaces(project, definition);
+    const parsed = ExperienceSurfacesSchema.safeParse(built);
+    if (parsed.success)
+        return [];
+    return parsed.error.issues.map((issue) => ({
+        check: SURFACES_CHECK,
+        severity: 'error',
+        message: `${issue.path.length > 0 ? `${issue.path.join('.')}: ` : ''}${issue.message}`,
+        hint: 'Fix the page kinds, canvas widgets or suggestedLayout in the experience definition.',
+        file: project.entry,
+    }));
+}
+/** `dist/surfaces.json`: the surfaces and suggested layout as data, no code. */
+export function buildSurfaces(project, definition) {
+    return buildExperienceSurfaces(project.slug, definition);
+}
 // ─── fixtures ───────────────────────────────────────────────────────────────
 const FIXTURE_NAME = /^(tool|action)-(.+)\.(default|empty|error)\.json$/;
 /** `fixtures/<integration>/<kind>-<name>.<variant>.json` must satisfy the pinned output schema. */
@@ -179,12 +205,9 @@ export function buildManifest(input) {
             ? {}
             : { isCollapsible: w.isCollapsible })), (w.aiFooterEnabled === undefined
             ? {}
-            : { aiFooterEnabled: w.aiFooterEnabled })))), pages: definition.pages.map((p) => ({
-            id: p.id,
-            path: p.path,
-            title: p.title,
-            integrations: [...p.integrations],
-        })), workflowTemplates: [...input.workflows] }), (definition.reviewQueue
+            : { aiFooterEnabled: w.aiFooterEnabled })))), pages: definition.pages.map((p) => { var _a; return (Object.assign(Object.assign(Object.assign(Object.assign(Object.assign({ id: p.id }, (p.path === undefined ? {} : { path: p.path })), { title: p.title, integrations: [...((_a = p.integrations) !== null && _a !== void 0 ? _a : [])] }), (p.kind === undefined ? {} : { kind: p.kind })), (p.widgets === undefined ? {} : { widgets: [...p.widgets] })), (p.routes && p.routes.length > 0
+            ? { routes: p.routes.map((r) => ({ path: r.path, title: r.title })) }
+            : {}))); }), surfacesDigest: input.surfaces.digest, workflowTemplates: [...input.workflows] }), (definition.reviewQueue
         ? {
             reviewQueue: {
                 readsOnly: true,

package/dist/experience/definition-checks.js.map

@@ -1 +1 @@
-{"version":3,"file":"definition-checks.js","sourceRoot":"","sources":["../../src/experience/definition-checks.ts"],"names":[],"mappings":"AAAA,OAAO,EAIL,sBAAsB,EACtB,aAAa,EACb,SAAS,EACT,qBAAqB,EACrB,wBAAwB,GACzB,MAAM,4BAA4B,CAAC;AACpC,OAAO,KAAK,EAAE,MAAM,SAAS,CAAC;AAC9B,OAAO,KAAK,IAAI,MAAM,WAAW,CAAC;AAMlC,OAAO,EAAE,qBAAqB,EAAE,MAAM,wBAAwB,CAAC;AAC/D,OAAO,EAA0B,YAAY,EAAE,MAAM,QAAQ,CAAC;AAG9D,MAAM,CAAC,MAAM,gBAAgB,GAAG,8BAA8B,CAAC;AAE/D,MAAM,GAAG,GAAG,CAAC,OAAe,EAAE,IAAY,EAAE,IAAa,EAAW,EAAE,CAAC,iBACrE,KAAK,EAAE,gBAAgB,EACvB,QAAQ,EAAE,OAAO,EACjB,OAAO;IACP,IAAI,IACD,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,EACzB,CAAC;AAEH,MAAM,IAAI,GAAG,CAAC,OAAe,EAAE,IAAY,EAAE,IAAa,EAAW,EAAE,CAAC,iBACtE,KAAK,EAAE,gBAAgB,EACvB,QAAQ,EAAE,MAAM,EAChB,OAAO;IACP,IAAI,IACD,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,EACzB,CAAC;AAOH;;;;;GAKG;AACH,MAAM,UAAU,iBAAiB,CAC/B,OAA0B,EAC1B,MAA8B,EAC9B,MAAoC;;;IAEpC,MAAM,EAAE,UAAU,EAAE,GAAG,MAAM,CAAC;IAC9B,MAAM,QAAQ,GAAc,EAAE,CAAC;IAC/B,MAAM,SAAS,GAAuB,EAAE,CAAC;IACzC,MAAM,oBAAoB,GAAG,IAAI,GAAG,CAClC,OAAO,CAAC,YAAY,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,CAC7C,CAAC;IACF,MAAM,QAAQ,GAAG,IAAI,GAAG,CACtB,OAAO,CAAC,YAAY,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC;QAC9B,CAAC,CAAC,IAAI;QACN,IAAI,GAAG,CAAC,qBAAqB,CAAC,CAAC,CAAC,CAAC;KAClC,CAAC,CACH,CAAC;IACF,MAAM,WAAW,GAAG,IAAI,GAAG,CACzB,MAAM,CAAC,GAAG,CAAC,CAAC,EAAE,GAAG,EAAE,QAAQ,EAAE,EAAE,EAAE,CAAC;QAChC,GAAG,CAAC,IAAI;QACR,IAAI,GAAG,CAAC,QAAQ,CAAC,UAAU,CAAC,GAAG,CAAC,CAAC,EAAE,EAAE,EAAE,CAAC,CAAC,GAAG,EAAE,CAAC,IAAI,IAAI,EAAE,CAAC,IAAI,EAAE,EAAE,EAAE,CAAC,CAAC,CAAC;KACxE,CAAC,CACH,CAAC;IAEF,IAAI,UAAU,CAAC,IAAI,KAAK,OAAO,CAAC,IAAI,EAAE,CAAC;QACrC,QAAQ,CAAC,IAAI,CACX,GAAG,CACD,0BAA0B,UAAU,CAAC,IAAI,+BAA+B,OAAO,CAAC,IAAI,IAAI,EACxF,kBAAkB,EAClB,OAAO,CAAC,KAAK,CACd,CACF,CAAC;IACJ,CAAC;IAED,MAAM,gBAAgB,GAAG,CAAC,WAAmB,EAAE,KAAa,EAAE,EAAE;QAC9D,IAAI,CAAC,oBAAoB,CAAC,GAAG,CAAC,WAAW,CAAC,EAAE,CAAC;YAC3C,QAAQ,CAAC,IAAI,CACX,GAAG,CACD,GAAG,KAAK,sBAAsB,WAAW,uDAAuD,EAChG,2BAA2B,WAAW,cAAc,EACpD,OAAO,CAAC,KAAK,CACd,CACF,CAAC;YAEF,OAAO,KAAK,CAAC;QACf,CAAC;QAED,OAAO,IAAI,CAAC;IACd,CAAC,CAAC;IAEF,KAAK,MAAM,MAAM,IAAI,UAAU,CAAC,OAAO,EAAE,CAAC;QACxC,KAAK,MAAM,WAAW,IAAI,MAAM,CAAC,YAAY;YAC3C,gBAAgB,CAAC,WAAW,EAAE,WAAW,MAAM,CAAC,EAAE,GAAG,CAAC,CAAC;IAC3D,CAAC;IACD,KAAK,MAAM,IAAI,IAAI,UAAU,CAAC,KAAK,EAAE,CAAC;QACpC,KAAK,MAAM,WAAW,IAAI,IAAI,CAAC,YAAY;YACzC,gBAAgB,CAAC,WAAW,EAAE,SAAS,IAAI,CAAC,EAAE,GAAG,CAAC,CAAC;IACvD,CAAC;IAED,KAAK,MAAM,OAAO,UAAI,MAAA,UAAU,CAAC,WAAW,0CAAE,QAAQ,mCAAI,EAAE,EAAE,CAAC;QAC7D,IACE,CAAC,gBAAgB,CAAC,OAAO,CAAC,WAAW,EAAE,mBAAmB,OAAO,CAAC,EAAE,GAAG,CAAC;YAExE,SAAS;QACX,IAAI,EAAC,MAAA,QAAQ,CAAC,GAAG,CAAC,OAAO,CAAC,WAAW,CAAC,0CAAE,GAAG,CAAC,OAAO,CAAC,IAAI,CAAC,CAAA,EAAE,CAAC;YAC1D,QAAQ,CAAC,IAAI,CACX,GAAG,CACD,mBAAmB,OAAO,CAAC,EAAE,WAAW,OAAO,CAAC,IAAI,wBAAwB,OAAO,CAAC,WAAW,qBAAqB,EACpH,2EAA2E,EAC3E,OAAO,CAAC,KAAK,CACd,CACF,CAAC;QACJ,CAAC;aAAM,IACL,CAAA,MAAA,MAAA,WAAW,CAAC,GAAG,CAAC,OAAO,CAAC,WAAW,CAAC,0CAAE,GAAG,CAAC,OAAO,CAAC,IAAI,CAAC,0CAAE,MAAM,MAAK,MAAM,EAC1E,CAAC;YACD,QAAQ,CAAC,IAAI,CACX,GAAG,CACD,mBAAmB,OAAO,CAAC,EAAE,WAAW,OAAO,CAAC,IAAI,kCAAkC,EACtF,2EAA2E,EAC3E,OAAO,CAAC,KAAK,CACd,CACF,CAAC;QACJ,CAAC;IACH,CAAC;IAED,MAAM,QAAQ,GAAG,YAAY,CAAC,MAAM,CAAC,CAAC;IACtC,KAAK,MAAM,QAAQ,IAAI,UAAU,CAAC,SAAS,EAAE,CAAC;QAC5C,MAAM,KAAK,GAAG,aAAa,QAAQ,CAAC,EAAE,GAAG,CAAC;QAC1C,IAAI,KAAwC,CAAC;QAC7C,IAAI,CAAC;YACH,KAAK,GAAG,QAAQ,CAAC,KAAK,EAAE,CAAC;QAC3B,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,QAAQ,CAAC,IAAI,CACX,GAAG,CACD,GAAG,KAAK,oBAAoB,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,EAAE,EACpF,mBAAmB,EACnB,OAAO,CAAC,KAAK,CACd,CACF,CAAC;YACF,SAAS;QACX,CAAC;QAED,IAAI,OAAO,GAAG,IAAI,CAAC;QACnB,KAAK,MAAM,IAAI,IAAI,KAAK,EAAE,CAAC;YACzB,IAAI,IAAI,CAAC,IAAI,KAAK,MAAM,IAAI,CAAC,IAAI,CAAC,WAAW,IAAI,CAAC,IAAI,CAAC,EAAE;gBAAE,SAAS;YACpE,IAAI,CAAC,gBAAgB,CAAC,IAAI,CAAC,WAAW,EAAE,GAAG,KAAK,UAAU,IAAI,CAAC,EAAE,GAAG,CAAC,EAAE,CAAC;gBACtE,OAAO,GAAG,KAAK,CAAC;YAClB,CAAC;iBAAM,IAAI,EAAC,MAAA,QAAQ,CAAC,GAAG,CAAC,IAAI,CAAC,WAAW,CAAC,0CAAE,GAAG,CAAC,IAAI,CAAC,EAAE,CAAC,CAAA,EAAE,CAAC;gBACzD,OAAO,GAAG,KAAK,CAAC;gBAChB,QAAQ,CAAC,IAAI,CACX,GAAG,CACD,GAAG,KAAK,UAAU,IAAI,CAAC,EAAE,WAAW,IAAI,CAAC,WAAW,IAAI,IAAI,CAAC,EAAE,2CAA2C,EAC1G,yFAAyF,EACzF,OAAO,CAAC,KAAK,CACd,CACF,CAAC;YACJ,CAAC;QACH,CAAC;QACD,IAAI,CAAC,OAAO;YAAE,SAAS;QAEvB,IAAI,GAAY,CAAC;QACjB,IAAI,CAAC;YACH,GAAG,GAAG,MAAM,CAAC,yBAAyB,CAAC,QAAQ,EAAE,EAAE,QAAQ,EAAE,CAAC,CAAC;QACjE,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,QAAQ,CAAC,IAAI,CACX,GAAG,CACD,GAAG,KAAK,KAAK,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,EAAE,EACrE,mBAAmB,EACnB,OAAO,CAAC,KAAK,CACd,CACF,CAAC;YACF,SAAS;QACX,CAAC;QACD,MAAM,MAAM,GAAG,sBAAsB,CAAC,SAAS,CAAC,GAAG,CAAC,CAAC;QACrD,IAAI,CAAC,MAAM,CAAC,OAAO,EAAE,CAAC;YACpB,QAAQ,CAAC,IAAI,CACX,GAAG,CACD,GAAG,KAAK,4CAA4C,MAAM,CAAC,KAAK,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC,OAAO,EAAE,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,EACpI,2BAA2B,EAC3B,OAAO,CAAC,KAAK,CACd,CACF,CAAC;YACF,SAAS;QACX,CAAC;QACD,KAAK,MAAM,OAAO,IAAI,wBAAwB,CAAC,MAAM,CAAC,IAAI,CAAC,EAAE,CAAC;YAC5D,QAAQ,CAAC,IAAI,CACX,GAAG,CAAC,GAAG,KAAK,KAAK,OAAO,GAAG,EAAE,mBAAmB,EAAE,OAAO,CAAC,KAAK,CAAC,CACjE,CAAC;QACJ,CAAC;QAED,MAAM,KAAK,GAAG,IAAI,GAAG,EAAU,CAAC;QAChC,MAAM,KAAK,GAAG,IAAI,GAAG,EAAoB,CAAC;QAC1C,KAAK,MAAM,CAAC,IAAI,MAAM,CAAC,IAAI,CAAC,KAAK;YAC/B,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,GAAG,OAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,mCAAI,EAAE,CAAC,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC;QACxD,MAAM,OAAO,GAAG,CAAC,EAAU,EAAE,IAAI,GAAG,IAAI,GAAG,EAAU,EAAW,EAAE;;YAChE,IAAI,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC;gBAAE,OAAO,KAAK,CAAC;YAC/B,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;YAEb,OAAO,OAAC,KAAK,CAAC,GAAG,CAAC,EAAE,CAAC,mCAAI,EAAE,CAAC,CAAC,IAAI,CAC/B,CAAC,CAAC,EAAE,EAAE,kBACJ,CAAA,MAAA,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,KAAK,CAAC,CAAC,0CAAE,IAAI,MAAK,eAAe;gBACnE,OAAO,CAAC,CAAC,EAAE,IAAI,CAAC,GAAA,CACnB,CAAC;QACJ,CAAC,CAAC;QACF,KAAK,MAAM,CAAC,IAAI,MAAM,CAAC,IAAI,CAAC,KAAK,EAAE,CAAC;YAClC,IAAI,CAAC,CAAC,IAAI,KAAK,aAAa,IAAI,CAAC,CAAC,MAAM,KAAK,OAAO,IAAI,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,CAAC;gBACvE,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC;YAClB,CAAC;QACH,CAAC;QACD,KAAK,MAAM,EAAE,IAAI,KAAK,EAAE,CAAC;YACvB,QAAQ,CAAC,IAAI,CACX,IAAI,CACF,GAAG,KAAK,iBAAiB,EAAE,kCAAkC,EAC7D,gEAAgE,EAChE,OAAO,CAAC,KAAK,CACd,CACF,CAAC;QACJ,CAAC;QAED,SAAS,CAAC,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC;IAC9B,CAAC;IAED,OAAO,EAAE,QAAQ,EAAE,SAAS,EAAE,CAAC;AACjC,CAAC;AAED,+EAA+E;AAE/E,MAAM,YAAY,GAAG,mDAAmD,CAAC;AAEzE,mGAAmG;AACnG,MAAM,UAAU,aAAa,CAC3B,OAA0B,EAC1B,MAAoC;IAEpC,MAAM,QAAQ,GAAc,EAAE,CAAC;IAC/B,MAAM,IAAI,GAAG,IAAI,CAAC,IAAI,CAAC,OAAO,CAAC,GAAG,EAAE,UAAU,CAAC,CAAC;IAChD,IAAI,CAAC,EAAE,CAAC,UAAU,CAAC,IAAI,CAAC;QAAE,OAAO,QAAQ,CAAC;IAE1C,KAAK,MAAM,EAAE,GAAG,EAAE,QAAQ,EAAE,IAAI,MAAM,EAAE,CAAC;QACvC,MAAM,GAAG,GAAG,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,GAAG,CAAC,IAAI,CAAC,CAAC;QACtC,IAAI,CAAC,EAAE,CAAC,UAAU,CAAC,GAAG,CAAC;YAAE,SAAS;QAClC,KAAK,MAAM,IAAI,IAAI,EAAE,CAAC,WAAW,CAAC,GAAG,CAAC,EAAE,CAAC;YACvC,MAAM,GAAG,GAAG,YAAY,GAAG,CAAC,IAAI,IAAI,IAAI,EAAE,CAAC;YAC3C,MAAM,KAAK,GAAG,YAAY,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;YACtC,IAAI,CAAC,KAAK,EAAE,CAAC;gBACX,QAAQ,CAAC,IAAI,CACX,IAAI,CACF,GAAG,GAAG,mDAAmD,EACzD,uCAAuC,EACvC,GAAG,CACJ,CACF,CAAC;gBACF,SAAS;YACX,CAAC;YACD,MAAM,CAAC,EAAE,IAAI,EAAE,EAAE,EAAE,OAAO,CAAC,GAAG,KAAK,CAAC;YACpC,IAAI,OAAO,KAAK,OAAO;gBAAE,SAAS;YAClC,MAAM,SAAS,GAAG,QAAQ,CAAC,UAAU,CAAC,IAAI,CACxC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,KAAK,IAAI,IAAI,CAAC,CAAC,IAAI,KAAK,EAAE,CACxC,CAAC;YACF,IAAI,CAAC,SAAS,EAAE,CAAC;gBACf,QAAQ,CAAC,IAAI,CACX,GAAG,CACD,GAAG,GAAG,KAAK,GAAG,CAAC,IAAI,IAAI,GAAG,CAAC,OAAO,WAAW,IAAI,IAAI,EAAE,GAAG,EAC1D,qCAAqC,EACrC,GAAG,CACJ,CACF,CAAC;gBACF,SAAS;YACX,CAAC;YACD,IAAI,SAAS,CAAC,MAAM,CAAC,MAAM;gBAAE,SAAS;YACtC,IAAI,KAAc,CAAC;YACnB,IAAI,CAAC;gBACH,KAAK,GAAG,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC,YAAY,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,IAAI,CAAC,EAAE,MAAM,CAAC,CAAC,CAAC;YACpE,CAAC;uBAAO,CAAC;gBACP,QAAQ,CAAC,IAAI,CAAC,GAAG,CAAC,GAAG,GAAG,qBAAqB,EAAE,iBAAiB,EAAE,GAAG,CAAC,CAAC,CAAC;gBACxE,SAAS;YACX,CAAC;YACD,MAAM,QAAQ,GAAG,qBAAqB,CAAC,SAAS,CAAC,MAAM,EAAE,KAAK,CAAC,CAAC;YAChE,IAAI,QAAQ,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;gBACxB,QAAQ,CAAC,IAAI,CACX,GAAG,CACD,GAAG,GAAG,uCAAuC,QAAQ,CAAC,CAAC,CAAC,EAAE,EAC1D,uGAAuG,EACvG,GAAG,CACJ,CACF,CAAC;YACJ,CAAC;QACH,CAAC;IACH,CAAC;IAED,OAAO,QAAQ,CAAC;AAClB,CAAC;AAED,+EAA+E;AAE/E,MAAM,UAAU,aAAa,CAAC,KAO7B;IACC,MAAM,EAAE,OAAO,EAAE,UAAU,EAAE,MAAM,EAAE,GAAG,KAAK,CAAC;IAC9C,MAAM,IAAI,+CACR,aAAa,EAAE,CAAU,EACzB,IAAI,EAAE,OAAO,CAAC,IAAI,EAClB,IAAI,EAAE,UAAmB,EACzB,OAAO,EAAE,KAAK,CAAC,OAAO,EACtB,GAAG,EAAE,KAAK,CAAC,GAAG,EACd,YAAY,EAAE,OAAO,CAAC,YAAY,EAClC,YAAY,EAAE,MAAM,CAAC,GAAG,CAAC,CAAC,EAAE,GAAG,EAAE,QAAQ,EAAE,EAAE,EAAE,CAAC,CAAC;YAC/C,WAAW,EAAE,GAAG,CAAC,IAAI;YACrB,OAAO,EAAE,GAAG,CAAC,OAAO;YACpB,eAAe,EAAE,QAAQ,CAAC,eAAe;YACzC,MAAM,EAAE,QAAQ,CAAC,MAAM;SACxB,CAAC,CAAC,IACA,CAAC,UAAU,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,OAAO,EAAE,UAAU,CAAC,OAAO,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,KAC9D,OAAO,EAAE,UAAU,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,6CACrC,EAAE,EAAE,CAAC,CAAC,EAAE,EACR,KAAK,EAAE,CAAC,CAAC,KAAK,EACd,YAAY,EAAE,CAAC,GAAG,CAAC,CAAC,YAAY,CAAC,IAC9B,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,CAAC,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,GACnC,CAAC,CAAC,CAAC,aAAa,KAAK,SAAS;YAC/B,CAAC,CAAC,EAAE;YACJ,CAAC,CAAC,EAAE,aAAa,EAAE,CAAC,CAAC,aAAa,EAAE,CAAC,GACpC,CAAC,CAAC,CAAC,eAAe,KAAK,SAAS;YACjC,CAAC,CAAC,EAAE;YACJ,CAAC,CAAC,EAAE,eAAe,EAAE,CAAC,CAAC,eAAe,EAAE,CAAC,EAC3C,CAAC,EACH,KAAK,EAAE,UAAU,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;YAClC,EAAE,EAAE,CAAC,CAAC,EAAE;YACR,IAAI,EAAE,CAAC,CAAC,IAAI;YACZ,KAAK,EAAE,CAAC,CAAC,KAAK;YACd,YAAY,EAAE,CAAC,GAAG,CAAC,CAAC,YAAY,CAAC;SAClC,CAAC,CAAC,EACH,iBAAiB,EAAE,CAAC,GAAG,KAAK,CAAC,SAAS,CAAC,KACpC,CAAC,UAAU,CAAC,WAAW;QACxB,CAAC,CAAC;YACE,WAAW,EAAE;gBACX,SAAS,EAAE,IAAa;gBACxB,QAAQ,EAAE,UAAU,CAAC,WAAW,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;oBACpD,EAAE,EAAE,CAAC,CAAC,EAAE;oBACR,WAAW,EAAE,CAAC,CAAC,WAAW;oBAC1B,IAAI,EAAE,CAAC,CAAC,IAAI;iBACb,CAAC,CAAC;aACJ;SACF;QACH,CAAC,CAAC,EAAE,CAAC,CACR,CAAC;IAEF,uCACK,IAAI,KACP,MAAM,EAAE,UAAU,SAAS,CAAC,aAAa,CAAC,IAAI,CAAC,CAAC,EAAE,IAClD;AACJ,CAAC","sourcesContent":["import {\n  type ExperienceManifest,\n  type Finding,\n  type WorkflowTemplate,\n  WorkflowTemplateSchema,\n  canonicalJson,\n  sha256Hex,\n  validateAgainstSchema,\n  workflowTemplateProblems,\n} from '@ekanos/integration-schema';\nimport * as fs from 'node:fs';\nimport * as path from 'node:path';\n\nimport type {\n  LoadedExperienceDefinition,\n  LoadedExperienceModule,\n} from './definition-shape';\nimport { declaredOperationKeys } from './integrations-codegen';\nimport { type PinnedIntegration, effectLookup } from './pins';\nimport type { ExperienceProject } from './project';\n\nexport const DEFINITION_CHECK = 'checks/experience-definition';\n\nconst err = (message: string, hint: string, file?: string): Finding => ({\n  check: DEFINITION_CHECK,\n  severity: 'error',\n  message,\n  hint,\n  ...(file ? { file } : {}),\n});\n\nconst warn = (message: string, hint: string, file?: string): Finding => ({\n  check: DEFINITION_CHECK,\n  severity: 'warn',\n  message,\n  hint,\n  ...(file ? { file } : {}),\n});\n\nexport interface DefinitionAnalysis {\n  findings: Finding[];\n  workflows: WorkflowTemplate[];\n}\n\n/**\n * Cross-check the loaded definition against `ekanos.json` and the pinned\n * contracts: every integration a widget, page, review section or workflow step names\n * must be declared, every operation must be in that integration's allowlist, the\n * review queue reads only, and each template serializes to the engine's DSL.\n */\nexport function analyzeDefinition(\n  project: ExperienceProject,\n  loaded: LoadedExperienceModule,\n  pinned: readonly PinnedIntegration[],\n): DefinitionAnalysis {\n  const { definition } = loaded;\n  const findings: Finding[] = [];\n  const workflows: WorkflowTemplate[] = [];\n  const declaredIntegrations = new Map(\n    project.integrations.map((u) => [u.name, u]),\n  );\n  const declared = new Map(\n    project.integrations.map((u) => [\n      u.name,\n      new Set(declaredOperationKeys(u)),\n    ]),\n  );\n  const contractOps = new Map(\n    pinned.map(({ use, contract }) => [\n      use.name,\n      new Map(contract.operations.map((op) => [`${op.kind}/${op.name}`, op])),\n    ]),\n  );\n\n  if (definition.slug !== project.slug) {\n    findings.push(\n      err(\n        `the definition's slug \"${definition.slug}\" differs from ekanos.json \"${project.slug}\".`,\n        'Make them equal.',\n        project.entry,\n      ),\n    );\n  }\n\n  const checkIntegration = (integration: string, owner: string) => {\n    if (!declaredIntegrations.has(integration)) {\n      findings.push(\n        err(\n          `${owner} uses integration \"${integration}\", which ekanos.json \"integrations\" does not declare.`,\n          `Add it with \"ekanos add ${integration}@<version>\".`,\n          project.entry,\n        ),\n      );\n\n      return false;\n    }\n\n    return true;\n  };\n\n  for (const widget of definition.widgets) {\n    for (const integration of widget.integrations)\n      checkIntegration(integration, `widget \"${widget.id}\"`);\n  }\n  for (const page of definition.pages) {\n    for (const integration of page.integrations)\n      checkIntegration(integration, `page \"${page.id}\"`);\n  }\n\n  for (const section of definition.reviewQueue?.sections ?? []) {\n    if (\n      !checkIntegration(section.integration, `review section \"${section.id}\"`)\n    )\n      continue;\n    if (!declared.get(section.integration)?.has(section.read)) {\n      findings.push(\n        err(\n          `review section \"${section.id}\" reads ${section.read}, which integration \"${section.integration}\" does not declare.`,\n          'Add the operation to the integration in ekanos.json, or read another one.',\n          project.entry,\n        ),\n      );\n    } else if (\n      contractOps.get(section.integration)?.get(section.read)?.effect !== 'read'\n    ) {\n      findings.push(\n        err(\n          `review section \"${section.id}\" reads ${section.read}, which is not a read operation.`,\n          'The review queue is reads-only; writes belong behind a workflow approval.',\n          project.entry,\n        ),\n      );\n    }\n  }\n\n  const effectOf = effectLookup(pinned);\n  for (const template of definition.workflows) {\n    const where = `workflow \"${template.id}\"`;\n    let steps: ReturnType<typeof template.build>;\n    try {\n      steps = template.build();\n    } catch (error) {\n      findings.push(\n        err(\n          `${where}: build() threw: ${error instanceof Error ? error.message : String(error)}`,\n          'Fix the template.',\n          project.entry,\n        ),\n      );\n      continue;\n    }\n\n    let stepsOk = true;\n    for (const step of steps) {\n      if (step.type !== 'tool' || !step.integration || !step.op) continue;\n      if (!checkIntegration(step.integration, `${where} step \"${step.id}\"`)) {\n        stepsOk = false;\n      } else if (!declared.get(step.integration)?.has(step.op)) {\n        stepsOk = false;\n        findings.push(\n          err(\n            `${where} step \"${step.id}\" calls ${step.integration} ${step.op}, which the integration does not declare.`,\n            'Add the operation to the integration\\'s \"operations\" in ekanos.json (ekanos add --ops).',\n            project.entry,\n          ),\n        );\n      }\n    }\n    if (!stepsOk) continue;\n\n    let dsl: unknown;\n    try {\n      dsl = loaded.serializeWorkflowTemplate(template, { effectOf });\n    } catch (error) {\n      findings.push(\n        err(\n          `${where}: ${error instanceof Error ? error.message : String(error)}`,\n          'Fix the template.',\n          project.entry,\n        ),\n      );\n      continue;\n    }\n    const parsed = WorkflowTemplateSchema.safeParse(dsl);\n    if (!parsed.success) {\n      findings.push(\n        err(\n          `${where} does not serialize to a valid workflow: ${parsed.error.issues.map((i) => `${i.path.join('.')}: ${i.message}`).join('; ')}`,\n          'Fix the step definitions.',\n          project.entry,\n        ),\n      );\n      continue;\n    }\n    for (const problem of workflowTemplateProblems(parsed.data)) {\n      findings.push(\n        err(`${where}: ${problem}.`, 'Fix the template.', project.entry),\n      );\n    }\n\n    const gated = new Set<string>();\n    const preds = new Map<string, string[]>();\n    for (const e of parsed.data.edges)\n      preds.set(e.to, [...(preds.get(e.to) ?? []), e.from]);\n    const hasGate = (id: string, seen = new Set<string>()): boolean => {\n      if (seen.has(id)) return false;\n      seen.add(id);\n\n      return (preds.get(id) ?? []).some(\n        (p) =>\n          parsed.data.steps.find((s) => s.id === p)?.type === 'approval_gate' ||\n          hasGate(p, seen),\n      );\n    };\n    for (const s of parsed.data.steps) {\n      if (s.type === 'fusion_tool' && s.effect === 'write' && !hasGate(s.id)) {\n        gated.add(s.id);\n      }\n    }\n    for (const id of gated) {\n      findings.push(\n        warn(\n          `${where}: write step \"${id}\" has no approval gate upstream.`,\n          'Put step.approval(...) before a write so a person confirms it.',\n          project.entry,\n        ),\n      );\n    }\n\n    workflows.push(parsed.data);\n  }\n\n  return { findings, workflows };\n}\n\n// ─── fixtures ───────────────────────────────────────────────────────────────\n\nconst FIXTURE_NAME = /^(tool|action)-(.+)\\.(default|empty|error)\\.json$/;\n\n/** `fixtures/<integration>/<kind>-<name>.<variant>.json` must satisfy the pinned output schema. */\nexport function checkFixtures(\n  project: ExperienceProject,\n  pinned: readonly PinnedIntegration[],\n): Finding[] {\n  const findings: Finding[] = [];\n  const root = path.join(project.dir, 'fixtures');\n  if (!fs.existsSync(root)) return findings;\n\n  for (const { use, contract } of pinned) {\n    const dir = path.join(root, use.name);\n    if (!fs.existsSync(dir)) continue;\n    for (const name of fs.readdirSync(dir)) {\n      const rel = `fixtures/${use.name}/${name}`;\n      const match = FIXTURE_NAME.exec(name);\n      if (!match) {\n        findings.push(\n          warn(\n            `${rel} is not <kind>-<name>.<default|empty|error>.json.`,\n            'Rename it so the harness can find it.',\n            rel,\n          ),\n        );\n        continue;\n      }\n      const [, kind, op, variant] = match;\n      if (variant === 'error') continue;\n      const operation = contract.operations.find(\n        (o) => o.kind === kind && o.name === op,\n      );\n      if (!operation) {\n        findings.push(\n          err(\n            `${rel}: ${use.name}@${use.version} has no ${kind}/${op}.`,\n            'Delete the fixture or fix its name.',\n            rel,\n          ),\n        );\n        continue;\n      }\n      if (operation.opaque.output) continue;\n      let value: unknown;\n      try {\n        value = JSON.parse(fs.readFileSync(path.join(dir, name), 'utf8'));\n      } catch {\n        findings.push(err(`${rel} is not valid JSON.`, 'Fix the syntax.', rel));\n        continue;\n      }\n      const problems = validateAgainstSchema(operation.output, value);\n      if (problems.length > 0) {\n        findings.push(\n          err(\n            `${rel} violates the pinned output schema: ${problems[0]}`,\n            'A fixture must satisfy the contract, or the harness would show data the integration can never return.',\n            rel,\n          ),\n        );\n      }\n    }\n  }\n\n  return findings;\n}\n\n// ─── manifest ───────────────────────────────────────────────────────────────\n\nexport function buildManifest(input: {\n  project: ExperienceProject;\n  definition: LoadedExperienceDefinition;\n  pinned: readonly PinnedIntegration[];\n  workflows: readonly WorkflowTemplate[];\n  version: string;\n  sdk: string;\n}): ExperienceManifest {\n  const { project, definition, pinned } = input;\n  const body = {\n    schemaVersion: 1 as const,\n    slug: project.slug,\n    form: 'composed' as const,\n    version: input.version,\n    sdk: input.sdk,\n    integrations: project.integrations,\n    contractRefs: pinned.map(({ use, contract }) => ({\n      integration: use.name,\n      version: use.version,\n      contractVersion: contract.contractVersion,\n      digest: contract.digest,\n    })),\n    ...(definition.sidebar ? { sidebar: definition.sidebar } : {}),\n    widgets: definition.widgets.map((w) => ({\n      id: w.id,\n      title: w.title,\n      integrations: [...w.integrations],\n      ...(w.width ? { width: w.width } : {}),\n      ...(w.isCollapsible === undefined\n        ? {}\n        : { isCollapsible: w.isCollapsible }),\n      ...(w.aiFooterEnabled === undefined\n        ? {}\n        : { aiFooterEnabled: w.aiFooterEnabled }),\n    })),\n    pages: definition.pages.map((p) => ({\n      id: p.id,\n      path: p.path,\n      title: p.title,\n      integrations: [...p.integrations],\n    })),\n    workflowTemplates: [...input.workflows],\n    ...(definition.reviewQueue\n      ? {\n          reviewQueue: {\n            readsOnly: true as const,\n            sections: definition.reviewQueue.sections.map((s) => ({\n              id: s.id,\n              integration: s.integration,\n              read: s.read,\n            })),\n          },\n        }\n      : {}),\n  };\n\n  return {\n    ...body,\n    digest: `sha256:${sha256Hex(canonicalJson(body))}`,\n  };\n}\n"]}
+{"version":3,"file":"definition-checks.js","sourceRoot":"","sources":["../../src/experience/definition-checks.ts"],"names":[],"mappings":"AAAA,OAAO,EAGL,wBAAwB,EAGxB,sBAAsB,EACtB,sBAAsB,EACtB,uBAAuB,EACvB,aAAa,EACb,SAAS,EACT,qBAAqB,EACrB,wBAAwB,GACzB,MAAM,4BAA4B,CAAC;AACpC,OAAO,KAAK,EAAE,MAAM,SAAS,CAAC;AAC9B,OAAO,KAAK,IAAI,MAAM,WAAW,CAAC;AAMlC,OAAO,EAAE,qBAAqB,EAAE,MAAM,wBAAwB,CAAC;AAC/D,OAAO,EAA0B,YAAY,EAAE,MAAM,QAAQ,CAAC;AAG9D,MAAM,CAAC,MAAM,gBAAgB,GAAG,8BAA8B,CAAC;AAC/D,MAAM,CAAC,MAAM,cAAc,GAAG,sBAAsB,CAAC,kBAAkB,CAAC;AAExE,MAAM,GAAG,GAAG,CAAC,OAAe,EAAE,IAAY,EAAE,IAAa,EAAW,EAAE,CAAC,iBACrE,KAAK,EAAE,gBAAgB,EACvB,QAAQ,EAAE,OAAO,EACjB,OAAO;IACP,IAAI,IACD,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,EACzB,CAAC;AAEH,MAAM,IAAI,GAAG,CAAC,OAAe,EAAE,IAAY,EAAE,IAAa,EAAW,EAAE,CAAC,iBACtE,KAAK,EAAE,gBAAgB,EACvB,QAAQ,EAAE,MAAM,EAChB,OAAO;IACP,IAAI,IACD,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,EACzB,CAAC;AAOH;;;;;GAKG;AACH,MAAM,UAAU,iBAAiB,CAC/B,OAA0B,EAC1B,MAA8B,EAC9B,MAAoC;;;IAEpC,MAAM,EAAE,UAAU,EAAE,GAAG,MAAM,CAAC;IAC9B,MAAM,QAAQ,GAAc,EAAE,CAAC;IAC/B,MAAM,SAAS,GAAuB,EAAE,CAAC;IACzC,MAAM,oBAAoB,GAAG,IAAI,GAAG,CAClC,OAAO,CAAC,YAAY,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,CAC7C,CAAC;IACF,MAAM,QAAQ,GAAG,IAAI,GAAG,CACtB,OAAO,CAAC,YAAY,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC;QAC9B,CAAC,CAAC,IAAI;QACN,IAAI,GAAG,CAAC,qBAAqB,CAAC,CAAC,CAAC,CAAC;KAClC,CAAC,CACH,CAAC;IACF,MAAM,WAAW,GAAG,IAAI,GAAG,CACzB,MAAM,CAAC,GAAG,CAAC,CAAC,EAAE,GAAG,EAAE,QAAQ,EAAE,EAAE,EAAE,CAAC;QAChC,GAAG,CAAC,IAAI;QACR,IAAI,GAAG,CAAC,QAAQ,CAAC,UAAU,CAAC,GAAG,CAAC,CAAC,EAAE,EAAE,EAAE,CAAC,CAAC,GAAG,EAAE,CAAC,IAAI,IAAI,EAAE,CAAC,IAAI,EAAE,EAAE,EAAE,CAAC,CAAC,CAAC;KACxE,CAAC,CACH,CAAC;IAEF,IAAI,UAAU,CAAC,IAAI,KAAK,OAAO,CAAC,IAAI,EAAE,CAAC;QACrC,QAAQ,CAAC,IAAI,CACX,GAAG,CACD,0BAA0B,UAAU,CAAC,IAAI,+BAA+B,OAAO,CAAC,IAAI,IAAI,EACxF,kBAAkB,EAClB,OAAO,CAAC,KAAK,CACd,CACF,CAAC;IACJ,CAAC;IAED,MAAM,gBAAgB,GAAG,CAAC,WAAmB,EAAE,KAAa,EAAE,EAAE;QAC9D,IAAI,CAAC,oBAAoB,CAAC,GAAG,CAAC,WAAW,CAAC,EAAE,CAAC;YAC3C,QAAQ,CAAC,IAAI,CACX,GAAG,CACD,GAAG,KAAK,sBAAsB,WAAW,uDAAuD,EAChG,2BAA2B,WAAW,cAAc,EACpD,OAAO,CAAC,KAAK,CACd,CACF,CAAC;YAEF,OAAO,KAAK,CAAC;QACf,CAAC;QAED,OAAO,IAAI,CAAC;IACd,CAAC,CAAC;IAEF,KAAK,MAAM,MAAM,IAAI,UAAU,CAAC,OAAO,EAAE,CAAC;QACxC,KAAK,MAAM,WAAW,IAAI,MAAM,CAAC,YAAY;YAC3C,gBAAgB,CAAC,WAAW,EAAE,WAAW,MAAM,CAAC,EAAE,GAAG,CAAC,CAAC;IAC3D,CAAC;IACD,KAAK,MAAM,IAAI,IAAI,UAAU,CAAC,KAAK,EAAE,CAAC;QACpC,KAAK,MAAM,WAAW,UAAI,IAAI,CAAC,YAAY,mCAAI,EAAE;YAC/C,gBAAgB,CAAC,WAAW,EAAE,SAAS,IAAI,CAAC,EAAE,GAAG,CAAC,CAAC;IACvD,CAAC;IAED,QAAQ,CAAC,IAAI,CAAC,GAAG,aAAa,CAAC,OAAO,EAAE,UAAU,CAAC,CAAC,CAAC;IAErD,KAAK,MAAM,OAAO,UAAI,MAAA,UAAU,CAAC,WAAW,0CAAE,QAAQ,mCAAI,EAAE,EAAE,CAAC;QAC7D,IACE,CAAC,gBAAgB,CAAC,OAAO,CAAC,WAAW,EAAE,mBAAmB,OAAO,CAAC,EAAE,GAAG,CAAC;YAExE,SAAS;QACX,IAAI,EAAC,MAAA,QAAQ,CAAC,GAAG,CAAC,OAAO,CAAC,WAAW,CAAC,0CAAE,GAAG,CAAC,OAAO,CAAC,IAAI,CAAC,CAAA,EAAE,CAAC;YAC1D,QAAQ,CAAC,IAAI,CACX,GAAG,CACD,mBAAmB,OAAO,CAAC,EAAE,WAAW,OAAO,CAAC,IAAI,wBAAwB,OAAO,CAAC,WAAW,qBAAqB,EACpH,2EAA2E,EAC3E,OAAO,CAAC,KAAK,CACd,CACF,CAAC;QACJ,CAAC;aAAM,IACL,CAAA,MAAA,MAAA,WAAW,CAAC,GAAG,CAAC,OAAO,CAAC,WAAW,CAAC,0CAAE,GAAG,CAAC,OAAO,CAAC,IAAI,CAAC,0CAAE,MAAM,MAAK,MAAM,EAC1E,CAAC;YACD,QAAQ,CAAC,IAAI,CACX,GAAG,CACD,mBAAmB,OAAO,CAAC,EAAE,WAAW,OAAO,CAAC,IAAI,kCAAkC,EACtF,2EAA2E,EAC3E,OAAO,CAAC,KAAK,CACd,CACF,CAAC;QACJ,CAAC;IACH,CAAC;IAED,MAAM,QAAQ,GAAG,YAAY,CAAC,MAAM,CAAC,CAAC;IACtC,KAAK,MAAM,QAAQ,IAAI,UAAU,CAAC,SAAS,EAAE,CAAC;QAC5C,MAAM,KAAK,GAAG,aAAa,QAAQ,CAAC,EAAE,GAAG,CAAC;QAC1C,IAAI,KAAwC,CAAC;QAC7C,IAAI,CAAC;YACH,KAAK,GAAG,QAAQ,CAAC,KAAK,EAAE,CAAC;QAC3B,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,QAAQ,CAAC,IAAI,CACX,GAAG,CACD,GAAG,KAAK,oBAAoB,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,EAAE,EACpF,mBAAmB,EACnB,OAAO,CAAC,KAAK,CACd,CACF,CAAC;YACF,SAAS;QACX,CAAC;QAED,IAAI,OAAO,GAAG,IAAI,CAAC;QACnB,KAAK,MAAM,IAAI,IAAI,KAAK,EAAE,CAAC;YACzB,IAAI,IAAI,CAAC,IAAI,KAAK,MAAM,IAAI,CAAC,IAAI,CAAC,WAAW,IAAI,CAAC,IAAI,CAAC,EAAE;gBAAE,SAAS;YACpE,IAAI,CAAC,gBAAgB,CAAC,IAAI,CAAC,WAAW,EAAE,GAAG,KAAK,UAAU,IAAI,CAAC,EAAE,GAAG,CAAC,EAAE,CAAC;gBACtE,OAAO,GAAG,KAAK,CAAC;YAClB,CAAC;iBAAM,IAAI,EAAC,MAAA,QAAQ,CAAC,GAAG,CAAC,IAAI,CAAC,WAAW,CAAC,0CAAE,GAAG,CAAC,IAAI,CAAC,EAAE,CAAC,CAAA,EAAE,CAAC;gBACzD,OAAO,GAAG,KAAK,CAAC;gBAChB,QAAQ,CAAC,IAAI,CACX,GAAG,CACD,GAAG,KAAK,UAAU,IAAI,CAAC,EAAE,WAAW,IAAI,CAAC,WAAW,IAAI,IAAI,CAAC,EAAE,2CAA2C,EAC1G,yFAAyF,EACzF,OAAO,CAAC,KAAK,CACd,CACF,CAAC;YACJ,CAAC;QACH,CAAC;QACD,IAAI,CAAC,OAAO;YAAE,SAAS;QAEvB,IAAI,GAAY,CAAC;QACjB,IAAI,CAAC;YACH,GAAG,GAAG,MAAM,CAAC,yBAAyB,CAAC,QAAQ,EAAE,EAAE,QAAQ,EAAE,CAAC,CAAC;QACjE,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,QAAQ,CAAC,IAAI,CACX,GAAG,CACD,GAAG,KAAK,KAAK,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,EAAE,EACrE,mBAAmB,EACnB,OAAO,CAAC,KAAK,CACd,CACF,CAAC;YACF,SAAS;QACX,CAAC;QACD,MAAM,MAAM,GAAG,sBAAsB,CAAC,SAAS,CAAC,GAAG,CAAC,CAAC;QACrD,IAAI,CAAC,MAAM,CAAC,OAAO,EAAE,CAAC;YACpB,QAAQ,CAAC,IAAI,CACX,GAAG,CACD,GAAG,KAAK,4CAA4C,MAAM,CAAC,KAAK,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC,OAAO,EAAE,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,EACpI,2BAA2B,EAC3B,OAAO,CAAC,KAAK,CACd,CACF,CAAC;YACF,SAAS;QACX,CAAC;QACD,KAAK,MAAM,OAAO,IAAI,wBAAwB,CAAC,MAAM,CAAC,IAAI,CAAC,EAAE,CAAC;YAC5D,QAAQ,CAAC,IAAI,CACX,GAAG,CAAC,GAAG,KAAK,KAAK,OAAO,GAAG,EAAE,mBAAmB,EAAE,OAAO,CAAC,KAAK,CAAC,CACjE,CAAC;QACJ,CAAC;QAED,MAAM,KAAK,GAAG,IAAI,GAAG,EAAU,CAAC;QAChC,MAAM,KAAK,GAAG,IAAI,GAAG,EAAoB,CAAC;QAC1C,KAAK,MAAM,CAAC,IAAI,MAAM,CAAC,IAAI,CAAC,KAAK;YAC/B,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,GAAG,OAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,mCAAI,EAAE,CAAC,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC;QACxD,MAAM,OAAO,GAAG,CAAC,EAAU,EAAE,IAAI,GAAG,IAAI,GAAG,EAAU,EAAW,EAAE;;YAChE,IAAI,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC;gBAAE,OAAO,KAAK,CAAC;YAC/B,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;YAEb,OAAO,OAAC,KAAK,CAAC,GAAG,CAAC,EAAE,CAAC,mCAAI,EAAE,CAAC,CAAC,IAAI,CAC/B,CAAC,CAAC,EAAE,EAAE,kBACJ,CAAA,MAAA,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,KAAK,CAAC,CAAC,0CAAE,IAAI,MAAK,eAAe;gBACnE,OAAO,CAAC,CAAC,EAAE,IAAI,CAAC,GAAA,CACnB,CAAC;QACJ,CAAC,CAAC;QACF,KAAK,MAAM,CAAC,IAAI,MAAM,CAAC,IAAI,CAAC,KAAK,EAAE,CAAC;YAClC,IAAI,CAAC,CAAC,IAAI,KAAK,aAAa,IAAI,CAAC,CAAC,MAAM,KAAK,OAAO,IAAI,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,CAAC;gBACvE,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC;YAClB,CAAC;QACH,CAAC;QACD,KAAK,MAAM,EAAE,IAAI,KAAK,EAAE,CAAC;YACvB,QAAQ,CAAC,IAAI,CACX,IAAI,CACF,GAAG,KAAK,iBAAiB,EAAE,kCAAkC,EAC7D,gEAAgE,EAChE,OAAO,CAAC,KAAK,CACd,CACF,CAAC;QACJ,CAAC;QAED,SAAS,CAAC,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC;IAC9B,CAAC;IAED,OAAO,EAAE,QAAQ,EAAE,SAAS,EAAE,CAAC;AACjC,CAAC;AAED,+EAA+E;AAE/E;;;;;GAKG;AACH,MAAM,UAAU,aAAa,CAC3B,OAA0B,EAC1B,UAAsC;IAEtC,MAAM,KAAK,GAAG,aAAa,CAAC,OAAO,EAAE,UAAU,CAAC,CAAC;IACjD,MAAM,MAAM,GAAG,wBAAwB,CAAC,SAAS,CAAC,KAAK,CAAC,CAAC;IACzD,IAAI,MAAM,CAAC,OAAO;QAAE,OAAO,EAAE,CAAC;IAE9B,OAAO,MAAM,CAAC,KAAK,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC;QACzC,KAAK,EAAE,cAAc;QACrB,QAAQ,EAAE,OAAgB;QAC1B,OAAO,EAAE,GAAG,KAAK,CAAC,IAAI,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,GAAG,KAAK,CAAC,OAAO,EAAE;QACtF,IAAI,EAAE,qFAAqF;QAC3F,IAAI,EAAE,OAAO,CAAC,KAAK;KACpB,CAAC,CAAC,CAAC;AACN,CAAC;AAED,gFAAgF;AAChF,MAAM,UAAU,aAAa,CAC3B,OAA0B,EAC1B,UAAsC;IAEtC,OAAO,uBAAuB,CAAC,OAAO,CAAC,IAAI,EAAE,UAAU,CAAC,CAAC;AAC3D,CAAC;AAED,+EAA+E;AAE/E,MAAM,YAAY,GAAG,mDAAmD,CAAC;AAEzE,mGAAmG;AACnG,MAAM,UAAU,aAAa,CAC3B,OAA0B,EAC1B,MAAoC;IAEpC,MAAM,QAAQ,GAAc,EAAE,CAAC;IAC/B,MAAM,IAAI,GAAG,IAAI,CAAC,IAAI,CAAC,OAAO,CAAC,GAAG,EAAE,UAAU,CAAC,CAAC;IAChD,IAAI,CAAC,EAAE,CAAC,UAAU,CAAC,IAAI,CAAC;QAAE,OAAO,QAAQ,CAAC;IAE1C,KAAK,MAAM,EAAE,GAAG,EAAE,QAAQ,EAAE,IAAI,MAAM,EAAE,CAAC;QACvC,MAAM,GAAG,GAAG,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,GAAG,CAAC,IAAI,CAAC,CAAC;QACtC,IAAI,CAAC,EAAE,CAAC,UAAU,CAAC,GAAG,CAAC;YAAE,SAAS;QAClC,KAAK,MAAM,IAAI,IAAI,EAAE,CAAC,WAAW,CAAC,GAAG,CAAC,EAAE,CAAC;YACvC,MAAM,GAAG,GAAG,YAAY,GAAG,CAAC,IAAI,IAAI,IAAI,EAAE,CAAC;YAC3C,MAAM,KAAK,GAAG,YAAY,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;YACtC,IAAI,CAAC,KAAK,EAAE,CAAC;gBACX,QAAQ,CAAC,IAAI,CACX,IAAI,CACF,GAAG,GAAG,mDAAmD,EACzD,uCAAuC,EACvC,GAAG,CACJ,CACF,CAAC;gBACF,SAAS;YACX,CAAC;YACD,MAAM,CAAC,EAAE,IAAI,EAAE,EAAE,EAAE,OAAO,CAAC,GAAG,KAAK,CAAC;YACpC,IAAI,OAAO,KAAK,OAAO;gBAAE,SAAS;YAClC,MAAM,SAAS,GAAG,QAAQ,CAAC,UAAU,CAAC,IAAI,CACxC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,KAAK,IAAI,IAAI,CAAC,CAAC,IAAI,KAAK,EAAE,CACxC,CAAC;YACF,IAAI,CAAC,SAAS,EAAE,CAAC;gBACf,QAAQ,CAAC,IAAI,CACX,GAAG,CACD,GAAG,GAAG,KAAK,GAAG,CAAC,IAAI,IAAI,GAAG,CAAC,OAAO,WAAW,IAAI,IAAI,EAAE,GAAG,EAC1D,qCAAqC,EACrC,GAAG,CACJ,CACF,CAAC;gBACF,SAAS;YACX,CAAC;YACD,IAAI,SAAS,CAAC,MAAM,CAAC,MAAM;gBAAE,SAAS;YACtC,IAAI,KAAc,CAAC;YACnB,IAAI,CAAC;gBACH,KAAK,GAAG,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC,YAAY,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,IAAI,CAAC,EAAE,MAAM,CAAC,CAAC,CAAC;YACpE,CAAC;uBAAO,CAAC;gBACP,QAAQ,CAAC,IAAI,CAAC,GAAG,CAAC,GAAG,GAAG,qBAAqB,EAAE,iBAAiB,EAAE,GAAG,CAAC,CAAC,CAAC;gBACxE,SAAS;YACX,CAAC;YACD,MAAM,QAAQ,GAAG,qBAAqB,CAAC,SAAS,CAAC,MAAM,EAAE,KAAK,CAAC,CAAC;YAChE,IAAI,QAAQ,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;gBACxB,QAAQ,CAAC,IAAI,CACX,GAAG,CACD,GAAG,GAAG,uCAAuC,QAAQ,CAAC,CAAC,CAAC,EAAE,EAC1D,uGAAuG,EACvG,GAAG,CACJ,CACF,CAAC;YACJ,CAAC;QACH,CAAC;IACH,CAAC;IAED,OAAO,QAAQ,CAAC;AAClB,CAAC;AAED,+EAA+E;AAE/E,MAAM,UAAU,aAAa,CAAC,KAQ7B;IACC,MAAM,EAAE,OAAO,EAAE,UAAU,EAAE,MAAM,EAAE,GAAG,KAAK,CAAC;IAC9C,MAAM,IAAI,+CACR,aAAa,EAAE,CAAU,EACzB,IAAI,EAAE,OAAO,CAAC,IAAI,EAClB,IAAI,EAAE,UAAmB,EACzB,OAAO,EAAE,KAAK,CAAC,OAAO,EACtB,GAAG,EAAE,KAAK,CAAC,GAAG,EACd,YAAY,EAAE,OAAO,CAAC,YAAY,EAClC,YAAY,EAAE,MAAM,CAAC,GAAG,CAAC,CAAC,EAAE,GAAG,EAAE,QAAQ,EAAE,EAAE,EAAE,CAAC,CAAC;YAC/C,WAAW,EAAE,GAAG,CAAC,IAAI;YACrB,OAAO,EAAE,GAAG,CAAC,OAAO;YACpB,eAAe,EAAE,QAAQ,CAAC,eAAe;YACzC,MAAM,EAAE,QAAQ,CAAC,MAAM;SACxB,CAAC,CAAC,IACA,CAAC,UAAU,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,OAAO,EAAE,UAAU,CAAC,OAAO,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,KAC9D,OAAO,EAAE,UAAU,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,6CACrC,EAAE,EAAE,CAAC,CAAC,EAAE,EACR,KAAK,EAAE,CAAC,CAAC,KAAK,EACd,YAAY,EAAE,CAAC,GAAG,CAAC,CAAC,YAAY,CAAC,IAC9B,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,CAAC,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,GACnC,CAAC,CAAC,CAAC,aAAa,KAAK,SAAS;YAC/B,CAAC,CAAC,EAAE;YACJ,CAAC,CAAC,EAAE,aAAa,EAAE,CAAC,CAAC,aAAa,EAAE,CAAC,GACpC,CAAC,CAAC,CAAC,eAAe,KAAK,SAAS;YACjC,CAAC,CAAC,EAAE;YACJ,CAAC,CAAC,EAAE,eAAe,EAAE,CAAC,CAAC,eAAe,EAAE,CAAC,EAC3C,CAAC,EACH,KAAK,EAAE,UAAU,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,kBAAC,yEACjC,EAAE,EAAE,CAAC,CAAC,EAAE,IACL,CAAC,CAAC,CAAC,IAAI,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC,KACjD,KAAK,EAAE,CAAC,CAAC,KAAK,EACd,YAAY,EAAE,CAAC,GAAG,OAAC,CAAC,CAAC,YAAY,mCAAI,EAAE,CAAC,CAAC,KACtC,CAAC,CAAC,CAAC,IAAI,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC,GAC9C,CAAC,CAAC,CAAC,OAAO,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,OAAO,EAAE,CAAC,GAAG,CAAC,CAAC,OAAO,CAAC,EAAE,CAAC,GAC5D,CAAC,CAAC,CAAC,MAAM,IAAI,CAAC,CAAC,MAAM,CAAC,MAAM,GAAG,CAAC;YACjC,CAAC,CAAC,EAAE,MAAM,EAAE,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,EAAE,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC,KAAK,EAAE,CAAC,CAAC,EAAE;YACrE,CAAC,CAAC,EAAE,CAAC,EACP,GAAA,CAAC,EACH,cAAc,EAAE,KAAK,CAAC,QAAQ,CAAC,MAAM,EACrC,iBAAiB,EAAE,CAAC,GAAG,KAAK,CAAC,SAAS,CAAC,KACpC,CAAC,UAAU,CAAC,WAAW;QACxB,CAAC,CAAC;YACE,WAAW,EAAE;gBACX,SAAS,EAAE,IAAa;gBACxB,QAAQ,EAAE,UAAU,CAAC,WAAW,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;oBACpD,EAAE,EAAE,CAAC,CAAC,EAAE;oBACR,WAAW,EAAE,CAAC,CAAC,WAAW;oBAC1B,IAAI,EAAE,CAAC,CAAC,IAAI;iBACb,CAAC,CAAC;aACJ;SACF;QACH,CAAC,CAAC,EAAE,CAAC,CACR,CAAC;IAEF,uCACK,IAAI,KACP,MAAM,EAAE,UAAU,SAAS,CAAC,aAAa,CAAC,IAAI,CAAC,CAAC,EAAE,IAClD;AACJ,CAAC","sourcesContent":["import {\n  type ExperienceManifest,\n  type ExperienceSurfaces,\n  ExperienceSurfacesSchema,\n  type Finding,\n  type WorkflowTemplate,\n  WorkflowTemplateSchema,\n  EKANOS_CHECK_STAGE_IDS,\n  buildExperienceSurfaces,\n  canonicalJson,\n  sha256Hex,\n  validateAgainstSchema,\n  workflowTemplateProblems,\n} from '@ekanos/integration-schema';\nimport * as fs from 'node:fs';\nimport * as path from 'node:path';\n\nimport type {\n  LoadedExperienceDefinition,\n  LoadedExperienceModule,\n} from './definition-shape';\nimport { declaredOperationKeys } from './integrations-codegen';\nimport { type PinnedIntegration, effectLookup } from './pins';\nimport type { ExperienceProject } from './project';\n\nexport const DEFINITION_CHECK = 'checks/experience-definition';\nexport const SURFACES_CHECK = EKANOS_CHECK_STAGE_IDS.experienceSurfaces;\n\nconst err = (message: string, hint: string, file?: string): Finding => ({\n  check: DEFINITION_CHECK,\n  severity: 'error',\n  message,\n  hint,\n  ...(file ? { file } : {}),\n});\n\nconst warn = (message: string, hint: string, file?: string): Finding => ({\n  check: DEFINITION_CHECK,\n  severity: 'warn',\n  message,\n  hint,\n  ...(file ? { file } : {}),\n});\n\nexport interface DefinitionAnalysis {\n  findings: Finding[];\n  workflows: WorkflowTemplate[];\n}\n\n/**\n * Cross-check the loaded definition against `ekanos.json` and the pinned\n * contracts: every integration a widget, page, review section or workflow step names\n * must be declared, every operation must be in that integration's allowlist, the\n * review queue reads only, and each template serializes to the engine's DSL.\n */\nexport function analyzeDefinition(\n  project: ExperienceProject,\n  loaded: LoadedExperienceModule,\n  pinned: readonly PinnedIntegration[],\n): DefinitionAnalysis {\n  const { definition } = loaded;\n  const findings: Finding[] = [];\n  const workflows: WorkflowTemplate[] = [];\n  const declaredIntegrations = new Map(\n    project.integrations.map((u) => [u.name, u]),\n  );\n  const declared = new Map(\n    project.integrations.map((u) => [\n      u.name,\n      new Set(declaredOperationKeys(u)),\n    ]),\n  );\n  const contractOps = new Map(\n    pinned.map(({ use, contract }) => [\n      use.name,\n      new Map(contract.operations.map((op) => [`${op.kind}/${op.name}`, op])),\n    ]),\n  );\n\n  if (definition.slug !== project.slug) {\n    findings.push(\n      err(\n        `the definition's slug \"${definition.slug}\" differs from ekanos.json \"${project.slug}\".`,\n        'Make them equal.',\n        project.entry,\n      ),\n    );\n  }\n\n  const checkIntegration = (integration: string, owner: string) => {\n    if (!declaredIntegrations.has(integration)) {\n      findings.push(\n        err(\n          `${owner} uses integration \"${integration}\", which ekanos.json \"integrations\" does not declare.`,\n          `Add it with \"ekanos add ${integration}@<version>\".`,\n          project.entry,\n        ),\n      );\n\n      return false;\n    }\n\n    return true;\n  };\n\n  for (const widget of definition.widgets) {\n    for (const integration of widget.integrations)\n      checkIntegration(integration, `widget \"${widget.id}\"`);\n  }\n  for (const page of definition.pages) {\n    for (const integration of page.integrations ?? [])\n      checkIntegration(integration, `page \"${page.id}\"`);\n  }\n\n  findings.push(...checkSurfaces(project, definition));\n\n  for (const section of definition.reviewQueue?.sections ?? []) {\n    if (\n      !checkIntegration(section.integration, `review section \"${section.id}\"`)\n    )\n      continue;\n    if (!declared.get(section.integration)?.has(section.read)) {\n      findings.push(\n        err(\n          `review section \"${section.id}\" reads ${section.read}, which integration \"${section.integration}\" does not declare.`,\n          'Add the operation to the integration in ekanos.json, or read another one.',\n          project.entry,\n        ),\n      );\n    } else if (\n      contractOps.get(section.integration)?.get(section.read)?.effect !== 'read'\n    ) {\n      findings.push(\n        err(\n          `review section \"${section.id}\" reads ${section.read}, which is not a read operation.`,\n          'The review queue is reads-only; writes belong behind a workflow approval.',\n          project.entry,\n        ),\n      );\n    }\n  }\n\n  const effectOf = effectLookup(pinned);\n  for (const template of definition.workflows) {\n    const where = `workflow \"${template.id}\"`;\n    let steps: ReturnType<typeof template.build>;\n    try {\n      steps = template.build();\n    } catch (error) {\n      findings.push(\n        err(\n          `${where}: build() threw: ${error instanceof Error ? error.message : String(error)}`,\n          'Fix the template.',\n          project.entry,\n        ),\n      );\n      continue;\n    }\n\n    let stepsOk = true;\n    for (const step of steps) {\n      if (step.type !== 'tool' || !step.integration || !step.op) continue;\n      if (!checkIntegration(step.integration, `${where} step \"${step.id}\"`)) {\n        stepsOk = false;\n      } else if (!declared.get(step.integration)?.has(step.op)) {\n        stepsOk = false;\n        findings.push(\n          err(\n            `${where} step \"${step.id}\" calls ${step.integration} ${step.op}, which the integration does not declare.`,\n            'Add the operation to the integration\\'s \"operations\" in ekanos.json (ekanos add --ops).',\n            project.entry,\n          ),\n        );\n      }\n    }\n    if (!stepsOk) continue;\n\n    let dsl: unknown;\n    try {\n      dsl = loaded.serializeWorkflowTemplate(template, { effectOf });\n    } catch (error) {\n      findings.push(\n        err(\n          `${where}: ${error instanceof Error ? error.message : String(error)}`,\n          'Fix the template.',\n          project.entry,\n        ),\n      );\n      continue;\n    }\n    const parsed = WorkflowTemplateSchema.safeParse(dsl);\n    if (!parsed.success) {\n      findings.push(\n        err(\n          `${where} does not serialize to a valid workflow: ${parsed.error.issues.map((i) => `${i.path.join('.')}: ${i.message}`).join('; ')}`,\n          'Fix the step definitions.',\n          project.entry,\n        ),\n      );\n      continue;\n    }\n    for (const problem of workflowTemplateProblems(parsed.data)) {\n      findings.push(\n        err(`${where}: ${problem}.`, 'Fix the template.', project.entry),\n      );\n    }\n\n    const gated = new Set<string>();\n    const preds = new Map<string, string[]>();\n    for (const e of parsed.data.edges)\n      preds.set(e.to, [...(preds.get(e.to) ?? []), e.from]);\n    const hasGate = (id: string, seen = new Set<string>()): boolean => {\n      if (seen.has(id)) return false;\n      seen.add(id);\n\n      return (preds.get(id) ?? []).some(\n        (p) =>\n          parsed.data.steps.find((s) => s.id === p)?.type === 'approval_gate' ||\n          hasGate(p, seen),\n      );\n    };\n    for (const s of parsed.data.steps) {\n      if (s.type === 'fusion_tool' && s.effect === 'write' && !hasGate(s.id)) {\n        gated.add(s.id);\n      }\n    }\n    for (const id of gated) {\n      findings.push(\n        warn(\n          `${where}: write step \"${id}\" has no approval gate upstream.`,\n          'Put step.approval(...) before a write so a person confirms it.',\n          project.entry,\n        ),\n      );\n    }\n\n    workflows.push(parsed.data);\n  }\n\n  return { findings, workflows };\n}\n\n// ─── surfaces ───────────────────────────────────────────────────────────────\n\n/**\n * The surfaces contract: page kinds, canvas widgets, routes and the suggested\n * layout must be well formed and refer only to what the experience declares.\n * The same rules `defineExperience` enforces, re-run on the loaded definition\n * so a definition built by an older SDK, or by hand, cannot slip past.\n */\nexport function checkSurfaces(\n  project: ExperienceProject,\n  definition: LoadedExperienceDefinition,\n): Finding[] {\n  const built = buildSurfaces(project, definition);\n  const parsed = ExperienceSurfacesSchema.safeParse(built);\n  if (parsed.success) return [];\n\n  return parsed.error.issues.map((issue) => ({\n    check: SURFACES_CHECK,\n    severity: 'error' as const,\n    message: `${issue.path.length > 0 ? `${issue.path.join('.')}: ` : ''}${issue.message}`,\n    hint: 'Fix the page kinds, canvas widgets or suggestedLayout in the experience definition.',\n    file: project.entry,\n  }));\n}\n\n/** `dist/surfaces.json`: the surfaces and suggested layout as data, no code. */\nexport function buildSurfaces(\n  project: ExperienceProject,\n  definition: LoadedExperienceDefinition,\n): ExperienceSurfaces {\n  return buildExperienceSurfaces(project.slug, definition);\n}\n\n// ─── fixtures ───────────────────────────────────────────────────────────────\n\nconst FIXTURE_NAME = /^(tool|action)-(.+)\\.(default|empty|error)\\.json$/;\n\n/** `fixtures/<integration>/<kind>-<name>.<variant>.json` must satisfy the pinned output schema. */\nexport function checkFixtures(\n  project: ExperienceProject,\n  pinned: readonly PinnedIntegration[],\n): Finding[] {\n  const findings: Finding[] = [];\n  const root = path.join(project.dir, 'fixtures');\n  if (!fs.existsSync(root)) return findings;\n\n  for (const { use, contract } of pinned) {\n    const dir = path.join(root, use.name);\n    if (!fs.existsSync(dir)) continue;\n    for (const name of fs.readdirSync(dir)) {\n      const rel = `fixtures/${use.name}/${name}`;\n      const match = FIXTURE_NAME.exec(name);\n      if (!match) {\n        findings.push(\n          warn(\n            `${rel} is not <kind>-<name>.<default|empty|error>.json.`,\n            'Rename it so the harness can find it.',\n            rel,\n          ),\n        );\n        continue;\n      }\n      const [, kind, op, variant] = match;\n      if (variant === 'error') continue;\n      const operation = contract.operations.find(\n        (o) => o.kind === kind && o.name === op,\n      );\n      if (!operation) {\n        findings.push(\n          err(\n            `${rel}: ${use.name}@${use.version} has no ${kind}/${op}.`,\n            'Delete the fixture or fix its name.',\n            rel,\n          ),\n        );\n        continue;\n      }\n      if (operation.opaque.output) continue;\n      let value: unknown;\n      try {\n        value = JSON.parse(fs.readFileSync(path.join(dir, name), 'utf8'));\n      } catch {\n        findings.push(err(`${rel} is not valid JSON.`, 'Fix the syntax.', rel));\n        continue;\n      }\n      const problems = validateAgainstSchema(operation.output, value);\n      if (problems.length > 0) {\n        findings.push(\n          err(\n            `${rel} violates the pinned output schema: ${problems[0]}`,\n            'A fixture must satisfy the contract, or the harness would show data the integration can never return.',\n            rel,\n          ),\n        );\n      }\n    }\n  }\n\n  return findings;\n}\n\n// ─── manifest ───────────────────────────────────────────────────────────────\n\nexport function buildManifest(input: {\n  project: ExperienceProject;\n  definition: LoadedExperienceDefinition;\n  pinned: readonly PinnedIntegration[];\n  workflows: readonly WorkflowTemplate[];\n  version: string;\n  sdk: string;\n  surfaces: ExperienceSurfaces;\n}): ExperienceManifest {\n  const { project, definition, pinned } = input;\n  const body = {\n    schemaVersion: 1 as const,\n    slug: project.slug,\n    form: 'composed' as const,\n    version: input.version,\n    sdk: input.sdk,\n    integrations: project.integrations,\n    contractRefs: pinned.map(({ use, contract }) => ({\n      integration: use.name,\n      version: use.version,\n      contractVersion: contract.contractVersion,\n      digest: contract.digest,\n    })),\n    ...(definition.sidebar ? { sidebar: definition.sidebar } : {}),\n    widgets: definition.widgets.map((w) => ({\n      id: w.id,\n      title: w.title,\n      integrations: [...w.integrations],\n      ...(w.width ? { width: w.width } : {}),\n      ...(w.isCollapsible === undefined\n        ? {}\n        : { isCollapsible: w.isCollapsible }),\n      ...(w.aiFooterEnabled === undefined\n        ? {}\n        : { aiFooterEnabled: w.aiFooterEnabled }),\n    })),\n    pages: definition.pages.map((p) => ({\n      id: p.id,\n      ...(p.path === undefined ? {} : { path: p.path }),\n      title: p.title,\n      integrations: [...(p.integrations ?? [])],\n      ...(p.kind === undefined ? {} : { kind: p.kind }),\n      ...(p.widgets === undefined ? {} : { widgets: [...p.widgets] }),\n      ...(p.routes && p.routes.length > 0\n        ? { routes: p.routes.map((r) => ({ path: r.path, title: r.title })) }\n        : {}),\n    })),\n    surfacesDigest: input.surfaces.digest,\n    workflowTemplates: [...input.workflows],\n    ...(definition.reviewQueue\n      ? {\n          reviewQueue: {\n            readsOnly: true as const,\n            sections: definition.reviewQueue.sections.map((s) => ({\n              id: s.id,\n              integration: s.integration,\n              read: s.read,\n            })),\n          },\n        }\n      : {}),\n  };\n\n  return {\n    ...body,\n    digest: `sha256:${sha256Hex(canonicalJson(body))}`,\n  };\n}\n"]}

package/dist/experience/definition-shape.d.ts

@@ -35,10 +35,28 @@ export interface LoadedExperienceDefinition {
     }>;
     pages: ReadonlyArray<{
         id: string;
-        path: string;
+        /** The SDK sets it; a definition from before page kinds has none (custom). */
+        kind?: 'overview' | 'canvas' | 'custom';
+        path?: string;
         title: string;
-        integrations: readonly string[];
+        integrations?: readonly string[];
+        widgets?: readonly string[];
+        routes?: ReadonlyArray<{
+            path: string;
+            title: string;
+        }>;
     }>;
+    suggestedLayout?: {
+        workspaces: ReadonlyArray<{
+            slug: string;
+            name: string;
+            icon?: string;
+            items: ReadonlyArray<{
+                ref: string;
+                audiences?: readonly string[];
+            }>;
+        }>;
+    };
     workflows: readonly LoadedWorkflowTemplate[];
     reviewQueue?: {
         readsOnly: true;

package/dist/experience/definition-shape.js.map

@@ -1 +1 @@
-{"version":3,"file":"definition-shape.js","sourceRoot":"","sources":["../../src/experience/definition-shape.ts"],"names":[],"mappings":"","sourcesContent":["/**\n * The structural slice of an `ExperienceDefinition` the CLI reads. The CLI does\n * not depend on `@ekanos/sdk`: the definition is produced by whichever SDK the\n * project installed, and anything the CLI needs computed (workflow\n * serialization) is obtained from that same SDK at load time.\n */\nexport interface LoadedWorkflowTemplate {\n  id: string;\n  name: string;\n  build(): ReadonlyArray<{\n    type: string;\n    id: string;\n    integration?: string;\n    op?: string;\n  }>;\n}\n\nexport interface LoadedExperienceDefinition {\n  kind: 'experience';\n  slug: string;\n  name: string;\n  description?: string;\n  sidebar?: { section: string; icon: string; label: string };\n  widgets: ReadonlyArray<{\n    id: string;\n    title: string;\n    integrations: readonly string[];\n    width?: string;\n    isCollapsible?: boolean;\n    isPinnable?: boolean;\n    aiFooterEnabled?: boolean;\n  }>;\n  pages: ReadonlyArray<{\n    id: string;\n    path: string;\n    title: string;\n    integrations: readonly string[];\n  }>;\n  workflows: readonly LoadedWorkflowTemplate[];\n  reviewQueue?: {\n    readsOnly: true;\n    sections: ReadonlyArray<{ id: string; integration: string; read: string }>;\n  };\n}\n\nexport interface SerializedWorkflowOptions {\n  effectOf: (integration: string, op: string) => 'read' | 'write' | undefined;\n}\n\nexport interface LoadedExperienceModule {\n  definition: LoadedExperienceDefinition;\n  /** The project's own SDK serializer, so the output matches the SDK that authored it. */\n  serializeWorkflowTemplate(\n    template: LoadedWorkflowTemplate,\n    options: SerializedWorkflowOptions,\n  ): unknown;\n  slotsUsedBy(definition: LoadedExperienceDefinition): string[];\n}\n"]}
+{"version":3,"file":"definition-shape.js","sourceRoot":"","sources":["../../src/experience/definition-shape.ts"],"names":[],"mappings":"","sourcesContent":["/**\n * The structural slice of an `ExperienceDefinition` the CLI reads. The CLI does\n * not depend on `@ekanos/sdk`: the definition is produced by whichever SDK the\n * project installed, and anything the CLI needs computed (workflow\n * serialization) is obtained from that same SDK at load time.\n */\nexport interface LoadedWorkflowTemplate {\n  id: string;\n  name: string;\n  build(): ReadonlyArray<{\n    type: string;\n    id: string;\n    integration?: string;\n    op?: string;\n  }>;\n}\n\nexport interface LoadedExperienceDefinition {\n  kind: 'experience';\n  slug: string;\n  name: string;\n  description?: string;\n  sidebar?: { section: string; icon: string; label: string };\n  widgets: ReadonlyArray<{\n    id: string;\n    title: string;\n    integrations: readonly string[];\n    width?: string;\n    isCollapsible?: boolean;\n    isPinnable?: boolean;\n    aiFooterEnabled?: boolean;\n  }>;\n  pages: ReadonlyArray<{\n    id: string;\n    /** The SDK sets it; a definition from before page kinds has none (custom). */\n    kind?: 'overview' | 'canvas' | 'custom';\n    path?: string;\n    title: string;\n    integrations?: readonly string[];\n    widgets?: readonly string[];\n    routes?: ReadonlyArray<{ path: string; title: string }>;\n  }>;\n  suggestedLayout?: {\n    workspaces: ReadonlyArray<{\n      slug: string;\n      name: string;\n      icon?: string;\n      items: ReadonlyArray<{ ref: string; audiences?: readonly string[] }>;\n    }>;\n  };\n  workflows: readonly LoadedWorkflowTemplate[];\n  reviewQueue?: {\n    readsOnly: true;\n    sections: ReadonlyArray<{ id: string; integration: string; read: string }>;\n  };\n}\n\nexport interface SerializedWorkflowOptions {\n  effectOf: (integration: string, op: string) => 'read' | 'write' | undefined;\n}\n\nexport interface LoadedExperienceModule {\n  definition: LoadedExperienceDefinition;\n  /** The project's own SDK serializer, so the output matches the SDK that authored it. */\n  serializeWorkflowTemplate(\n    template: LoadedWorkflowTemplate,\n    options: SerializedWorkflowOptions,\n  ): unknown;\n  slotsUsedBy(definition: LoadedExperienceDefinition): string[];\n}\n"]}

package/dist/experience/project.js

@@ -95,9 +95,15 @@ export function readExperienceProject(dir) {
         raw: record,
     };
 }
-/** Operations as canonical `<integration>@<version>/<kind>/<name>` ids, for lookups against a contract. */
+/**
+ * Operations as canonical `<slug>@<version>/<kind>/<name>` ids, for lookups
+ * against a contract. A contract's ids carry the bare slug even when the
+ * package is named under a namespace, so a `vastly/news` entry canonicalises to
+ * `news@0.1/...`.
+ */
 function withCanonicalOperations(entry) {
-    return Object.assign(Object.assign({}, entry), { operations: entry.operations.map((id) => canonicalOperationId(entry, id)) });
+    const slug = entry.name.slice(entry.name.indexOf('/') + 1);
+    return Object.assign(Object.assign({}, entry), { operations: entry.operations.map((id) => canonicalOperationId({ name: slug, version: entry.version }, id)) });
 }
 /** 2-space JSON with a trailing newline: the format every written file uses. */
 export function formatJson(value) {