@ekanos/integration-schema 0.1.0

package/LICENSE

@@ -0,0 +1,21 @@
+MIT License
+
+Copyright (c) 2026 Vastly
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+SOFTWARE.

package/README.md

@@ -0,0 +1,48 @@
+# @ekanos/integration-schema
+
+The canonical, dependency-pure contract for Ekanos integration definitions.
+
+One zod schema and one set of types, imported by **both** `@ekanos/sdk`
+(authoring — `defineIntegration()`) and `@kit/integrations-core` (the host
+trust boundary — `registerPartnerIntegration()` re-parses against the same
+schema). This package depends on nothing but `zod`, so neither consumer forms
+a dependency cycle and there is no hand-written structural twin to drift.
+
+## Why it exists
+
+Adversarial review (GPT-5.6, 2026-08-27) found three problems a shared schema
+resolves at once:
+
+- **F3** — the host must re-parse partner exports at the trust boundary, not
+  trust a `.d.ts`. `registerPartnerIntegration()` calls
+  `parseIntegrationDefinition()` from here.
+- **F9** — hand-written structural twins in `@kit/integrations-core` could not
+  catch security-relevant drift. There are no twins now: one type, imported by
+  both sides.
+- **F10** — the SDK validated a weaker workspace contract than the host. The
+  workspace-target schema lives here; the host injects icon-name validity via
+  `createWorkspaceTargetListSchema({ isValidIcon })`.
+
+## What's here
+
+- `IntegrationDefinitionSchema` — the strict canonical zod schema.
+- `parseIntegrationDefinition(input)` — rejects non-plain containers, parses,
+  returns sanitized `result.data` (never the caller's object).
+- `validateIntegrationDefinitions(defs, firstParty?)` — cross-definition +
+  first-party collision detection.
+- `IntegrationDefinition<Schemas>` and friends — the generic authoring types.
+- The capability-context types (`IntegrationContext`, `StorageSchemas`, …) —
+  canonical home; `@ekanos/sdk` re-exports them.
+- The workspace-target schema + `normalizeWorkspaceTargets`.
+
+Dependency-pure by construction: `zod` only. No `@kit/*`, no React, no
+`server-only`.
+
+## Publishing
+
+This package is publishable (`version` set, not `private`) and is a **runtime
+dependency of `@ekanos/sdk`**, so it must be published **before** the SDK — a
+fresh `npm install @ekanos/sdk` resolves `@ekanos/integration-schema` from the
+registry. The compiled ESM in `dist/` uses explicit `.js` relative specifiers
+so a real Node import resolves without a bundler; the SDK's `pack:test`
+exercises that path end to end.

package/dist/capability-context.d.ts

@@ -0,0 +1,178 @@
+/**
+ * The capability context — the one object partner code receives.
+ *
+ * Canonical home (moved here from `@ekanos/sdk`'s `context/types.ts` so the
+ * definition schema below can reference `IntegrationContext` without a
+ * package cycle; `@ekanos/sdk` re-exports every type from here). Pure types,
+ * zod-type-only, erased at compile time. The value half of the contract —
+ * error classes, the egress matcher, the storage validators — lives in
+ * `@ekanos/sdk/context`; the in-memory mock in `@ekanos/sdk/testing`.
+ * Spec: docs/devex/capability-context-proposal.md (all six §7 rulings).
+ */
+import type { z } from 'zod';
+/**
+ * Who is executing. A closed union: a machine context without a grant is
+ * unrepresentable rather than merely checked (proposal §2).
+ */
+export type IntegrationActor = {
+    readonly kind: 'user';
+    readonly userId: string;
+} | {
+    readonly kind: 'machine';
+    readonly tokenId: string;
+    readonly createdBy: string | null;
+};
+/**
+ * One storage key's declaration in EXPLICIT form: the zod schema plus the
+ * exposure flags that decide which host surfaces may serve the key.
+ *
+ * Exposure is opt-in and fails closed. A declaration's keys are server-side
+ * by construction — partner code reaches them only through `ctx.storage`,
+ * which runs behind the capability layer. The generic browser-readable
+ * storage route (`GET /api/integrations/[slug]/storage`) would otherwise
+ * turn EVERY declared key into a browser-readable one, including keys a
+ * partner reasonably treated as server-only: sync cursors, cached upstream
+ * responses, internal bookkeeping. So the route serves a key only when its
+ * declaration opts in with `clientReadable: true`.
+ */
+export interface StorageKeyDeclaration<S extends z.ZodType = z.ZodType> {
+    readonly schema: S;
+    /**
+     * Opt in to the generic browser-readable storage route. **Defaults to
+     * `false`** — an omitted flag, and the bare-schema declaration form, both
+     * mean server-only. Set it only for values the browser legitimately needs
+     * and that are safe for any active member of the account to read (widget
+     * settings, display preferences). Never for cursors, cached upstream
+     * payloads, or anything a `secret` would be a better home for.
+     */
+    readonly clientReadable?: boolean;
+}
+/**
+ * How a single storage key may be declared: a bare zod schema (the original
+ * form — always server-only), or a `StorageKeyDeclaration` descriptor that
+ * carries exposure flags alongside the schema. Both forms validate reads and
+ * writes identically; only the descriptor can widen exposure.
+ */
+export type StorageKeyDeclarationInput<S extends z.ZodType = z.ZodType> = S | StorageKeyDeclaration<S>;
+/**
+ * Storage schemas for one scope: key → zod schema, or key → declaration
+ * descriptor (ruling 1). Keys are strict — a key with no declared schema
+ * cannot be read, written, or deleted; the attempt is a type error where the
+ * schema map is statically known, and always a runtime
+ * `StorageValidationError`.
+ */
+export type StorageSchemaMap = Record<string, StorageKeyDeclarationInput>;
+/**
+ * Resolves the zod schema out of either declaration form, so `ScopedStore`
+ * stays schema-typed whichever form the author chose.
+ */
+export type StorageKeySchema<D> = [D] extends [z.ZodType] ? D : D extends StorageKeyDeclaration<infer S> ? S : D extends z.ZodType ? D : never;
+/**
+ * The storage declaration `defineIntegration({ storage })` consumes and
+ * `createMockContext({ storageSchemas })` enforces (ruling 1). A scope left
+ * undeclared has no usable keys.
+ */
+export interface StorageSchemas {
+    account?: StorageSchemaMap;
+    user?: StorageSchemaMap;
+}
+/**
+ * Resolves the schema map for one scope of a declaration. A scope the
+ * integration did not declare resolves to an empty map (no key typechecks);
+ * only the unparameterized default (`StorageSchemas` itself) stays
+ * permissive, for signatures that cannot know the integration's schemas.
+ */
+export type StorageScopeSchemas<Schemas extends StorageSchemas, Scope extends keyof StorageSchemas> = [Schemas[Scope]] extends [undefined] ? Record<never, never> : NonNullable<Schemas[Scope]>;
+export interface StorageEntry<T> {
+    data: T;
+    externalId: string | null;
+    expiresAt: string | null;
+    updatedAt: string;
+}
+export interface StorageWriteOptions {
+    externalId?: string;
+    /** ISO-8601 timestamp; an entry past it reads as `null`. */
+    expiresAt?: string;
+}
+/**
+ * One scope of `ctx.storage`, bound to `{account, product}` (and `userId`
+ * for the user scope) at construction — there is no id parameter to lie in.
+ *
+ * Schema-typed (ruling 1): `get` returns the declared schema's output type,
+ * `set` validates before write, and a read whose stored data no longer
+ * matches the schema throws `StorageValidationError` — schema evolution is
+ * handled explicitly (versioned keys or `z.union`), never silently.
+ * All methods are async (ruling 4).
+ */
+export interface ScopedStore<Schemas extends StorageSchemaMap = StorageSchemaMap> {
+    get<K extends keyof Schemas & string>(key: K): Promise<StorageEntry<z.output<StorageKeySchema<Schemas[K]>>> | null>;
+    set<K extends keyof Schemas & string>(key: K, data: z.input<StorageKeySchema<Schemas[K]>>, options?: StorageWriteOptions): Promise<void>;
+    delete<K extends keyof Schemas & string>(key: K): Promise<void>;
+}
+export interface IntegrationStorage<Schemas extends StorageSchemas = StorageSchemas> {
+    /** account_product_data, bound to {accountId, productId}. */
+    readonly account: ScopedStore<StorageScopeSchemas<Schemas, 'account'>>;
+    /**
+     * user_product_data, bound to {userId, accountId, productId}.
+     * Throws for machine actors.
+     */
+    readonly user: ScopedStore<StorageScopeSchemas<Schemas, 'user'>>;
+}
+/**
+ * Reads from the credential set the host resolved (account → source →
+ * global tiers + hydrated activation secrets) before partner code ran.
+ * All methods are async (ruling 4).
+ */
+export interface IntegrationSecrets {
+    /** A named field of the resolved credential set + hydrated activation secrets. */
+    get(name: string): Promise<string | null>;
+    /** All resolved secret names (values not included) — for capability probing. */
+    names(): Promise<string[]>;
+    /**
+     * Write back a rotated value (OAuth refresh). Tier-bound (ruling 2):
+     * writes go only to the account-tier store bound to {account, product} at
+     * construction. Source- and global-tier credentials (admin-issued) are
+     * structurally unreachable from this path; a write against a name that
+     * resolves only from those tiers throws `SecretAccessError`.
+     */
+    set(name: string, value: string): Promise<void>;
+}
+/**
+ * Host-allowlisted egress (ruling 3): origin-only allowlist with explicit
+ * `*.` subdomain wildcards, enforced against the RESOLVED URL's origin —
+ * redirect targets included. A denied call throws `EgressDeniedError`
+ * synchronously, before any network I/O.
+ */
+export type IntegrationFetch = (input: string | URL, init?: RequestInit) => Promise<Response>;
+/**
+ * Structured, pino-style. The host pre-binds `{integration, accountId,
+ * actor}` so every partner log line is attributable.
+ */
+export interface IntegrationLogger {
+    debug(context: Record<string, unknown>, message: string): void;
+    info(context: Record<string, unknown>, message: string): void;
+    warn(context: Record<string, unknown>, message: string): void;
+    error(context: Record<string, unknown>, message: string): void;
+}
+/**
+ * One host-constructed object whose every method is already scoped to
+ * `{account, integration}` before partner code runs. Handed to MCP tool
+ * `run()` and SDK server handlers alike (ruling 5: one type, one mock).
+ */
+export interface IntegrationContext<Schemas extends StorageSchemas = StorageSchemas> {
+    /** Identity facts — read-only, informational. Authorization already happened. */
+    readonly accountId: string;
+    readonly accountSlug: string | null;
+    readonly userId: string | null;
+    readonly actor: IntegrationActor;
+    readonly sourceId: string | null;
+    readonly integration: {
+        readonly slug: string;
+        readonly productId: string;
+    };
+    readonly timezone: string | null;
+    readonly storage: IntegrationStorage<Schemas>;
+    readonly secrets: IntegrationSecrets;
+    readonly fetch: IntegrationFetch;
+    readonly logger: IntegrationLogger;
+}

package/dist/capability-context.js

@@ -0,0 +1,2 @@
+export {};
+//# sourceMappingURL=capability-context.js.map

package/dist/capability-context.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"capability-context.js","sourceRoot":"","sources":["../src/capability-context.ts"],"names":[],"mappings":"","sourcesContent":["/**\n * The capability context — the one object partner code receives.\n *\n * Canonical home (moved here from `@ekanos/sdk`'s `context/types.ts` so the\n * definition schema below can reference `IntegrationContext` without a\n * package cycle; `@ekanos/sdk` re-exports every type from here). Pure types,\n * zod-type-only, erased at compile time. The value half of the contract —\n * error classes, the egress matcher, the storage validators — lives in\n * `@ekanos/sdk/context`; the in-memory mock in `@ekanos/sdk/testing`.\n * Spec: docs/devex/capability-context-proposal.md (all six §7 rulings).\n */\nimport type { z } from 'zod';\n\n/**\n * Who is executing. A closed union: a machine context without a grant is\n * unrepresentable rather than merely checked (proposal §2).\n */\nexport type IntegrationActor =\n  | { readonly kind: 'user'; readonly userId: string }\n  | {\n      readonly kind: 'machine';\n      readonly tokenId: string;\n      readonly createdBy: string | null;\n    };\n\n/**\n * One storage key's declaration in EXPLICIT form: the zod schema plus the\n * exposure flags that decide which host surfaces may serve the key.\n *\n * Exposure is opt-in and fails closed. A declaration's keys are server-side\n * by construction — partner code reaches them only through `ctx.storage`,\n * which runs behind the capability layer. The generic browser-readable\n * storage route (`GET /api/integrations/[slug]/storage`) would otherwise\n * turn EVERY declared key into a browser-readable one, including keys a\n * partner reasonably treated as server-only: sync cursors, cached upstream\n * responses, internal bookkeeping. So the route serves a key only when its\n * declaration opts in with `clientReadable: true`.\n */\nexport interface StorageKeyDeclaration<S extends z.ZodType = z.ZodType> {\n  readonly schema: S;\n  /**\n   * Opt in to the generic browser-readable storage route. **Defaults to\n   * `false`** — an omitted flag, and the bare-schema declaration form, both\n   * mean server-only. Set it only for values the browser legitimately needs\n   * and that are safe for any active member of the account to read (widget\n   * settings, display preferences). Never for cursors, cached upstream\n   * payloads, or anything a `secret` would be a better home for.\n   */\n  readonly clientReadable?: boolean;\n}\n\n/**\n * How a single storage key may be declared: a bare zod schema (the original\n * form — always server-only), or a `StorageKeyDeclaration` descriptor that\n * carries exposure flags alongside the schema. Both forms validate reads and\n * writes identically; only the descriptor can widen exposure.\n */\nexport type StorageKeyDeclarationInput<S extends z.ZodType = z.ZodType> =\n  | S\n  | StorageKeyDeclaration<S>;\n\n/**\n * Storage schemas for one scope: key → zod schema, or key → declaration\n * descriptor (ruling 1). Keys are strict — a key with no declared schema\n * cannot be read, written, or deleted; the attempt is a type error where the\n * schema map is statically known, and always a runtime\n * `StorageValidationError`.\n */\nexport type StorageSchemaMap = Record<string, StorageKeyDeclarationInput>;\n\n/**\n * Resolves the zod schema out of either declaration form, so `ScopedStore`\n * stays schema-typed whichever form the author chose.\n */\nexport type StorageKeySchema<D> = [D] extends [z.ZodType]\n  ? D\n  : D extends StorageKeyDeclaration<infer S>\n    ? S\n    : D extends z.ZodType\n      ? D\n      : never;\n\n/**\n * The storage declaration `defineIntegration({ storage })` consumes and\n * `createMockContext({ storageSchemas })` enforces (ruling 1). A scope left\n * undeclared has no usable keys.\n */\nexport interface StorageSchemas {\n  account?: StorageSchemaMap;\n  user?: StorageSchemaMap;\n}\n\n/**\n * Resolves the schema map for one scope of a declaration. A scope the\n * integration did not declare resolves to an empty map (no key typechecks);\n * only the unparameterized default (`StorageSchemas` itself) stays\n * permissive, for signatures that cannot know the integration's schemas.\n */\nexport type StorageScopeSchemas<\n  Schemas extends StorageSchemas,\n  Scope extends keyof StorageSchemas,\n> = [Schemas[Scope]] extends [undefined]\n  ? Record<never, never>\n  : NonNullable<Schemas[Scope]>;\n\nexport interface StorageEntry<T> {\n  data: T;\n  externalId: string | null;\n  expiresAt: string | null;\n  updatedAt: string;\n}\n\nexport interface StorageWriteOptions {\n  externalId?: string;\n  /** ISO-8601 timestamp; an entry past it reads as `null`. */\n  expiresAt?: string;\n}\n\n/**\n * One scope of `ctx.storage`, bound to `{account, product}` (and `userId`\n * for the user scope) at construction — there is no id parameter to lie in.\n *\n * Schema-typed (ruling 1): `get` returns the declared schema's output type,\n * `set` validates before write, and a read whose stored data no longer\n * matches the schema throws `StorageValidationError` — schema evolution is\n * handled explicitly (versioned keys or `z.union`), never silently.\n * All methods are async (ruling 4).\n */\nexport interface ScopedStore<\n  Schemas extends StorageSchemaMap = StorageSchemaMap,\n> {\n  get<K extends keyof Schemas & string>(\n    key: K,\n  ): Promise<StorageEntry<z.output<StorageKeySchema<Schemas[K]>>> | null>;\n  set<K extends keyof Schemas & string>(\n    key: K,\n    data: z.input<StorageKeySchema<Schemas[K]>>,\n    options?: StorageWriteOptions,\n  ): Promise<void>;\n  delete<K extends keyof Schemas & string>(key: K): Promise<void>;\n}\n\nexport interface IntegrationStorage<\n  Schemas extends StorageSchemas = StorageSchemas,\n> {\n  /** account_product_data, bound to {accountId, productId}. */\n  readonly account: ScopedStore<StorageScopeSchemas<Schemas, 'account'>>;\n  /**\n   * user_product_data, bound to {userId, accountId, productId}.\n   * Throws for machine actors.\n   */\n  readonly user: ScopedStore<StorageScopeSchemas<Schemas, 'user'>>;\n}\n\n/**\n * Reads from the credential set the host resolved (account → source →\n * global tiers + hydrated activation secrets) before partner code ran.\n * All methods are async (ruling 4).\n */\nexport interface IntegrationSecrets {\n  /** A named field of the resolved credential set + hydrated activation secrets. */\n  get(name: string): Promise<string | null>;\n  /** All resolved secret names (values not included) — for capability probing. */\n  names(): Promise<string[]>;\n  /**\n   * Write back a rotated value (OAuth refresh). Tier-bound (ruling 2):\n   * writes go only to the account-tier store bound to {account, product} at\n   * construction. Source- and global-tier credentials (admin-issued) are\n   * structurally unreachable from this path; a write against a name that\n   * resolves only from those tiers throws `SecretAccessError`.\n   */\n  set(name: string, value: string): Promise<void>;\n}\n\n/**\n * Host-allowlisted egress (ruling 3): origin-only allowlist with explicit\n * `*.` subdomain wildcards, enforced against the RESOLVED URL's origin —\n * redirect targets included. A denied call throws `EgressDeniedError`\n * synchronously, before any network I/O.\n */\nexport type IntegrationFetch = (\n  input: string | URL,\n  init?: RequestInit,\n) => Promise<Response>;\n\n/**\n * Structured, pino-style. The host pre-binds `{integration, accountId,\n * actor}` so every partner log line is attributable.\n */\nexport interface IntegrationLogger {\n  debug(context: Record<string, unknown>, message: string): void;\n  info(context: Record<string, unknown>, message: string): void;\n  warn(context: Record<string, unknown>, message: string): void;\n  error(context: Record<string, unknown>, message: string): void;\n}\n\n/**\n * One host-constructed object whose every method is already scoped to\n * `{account, integration}` before partner code runs. Handed to MCP tool\n * `run()` and SDK server handlers alike (ruling 5: one type, one mock).\n */\nexport interface IntegrationContext<\n  Schemas extends StorageSchemas = StorageSchemas,\n> {\n  /** Identity facts — read-only, informational. Authorization already happened. */\n  readonly accountId: string;\n  readonly accountSlug: string | null;\n  readonly userId: string | null; // null for machine actors\n  readonly actor: IntegrationActor;\n  readonly sourceId: string | null;\n  readonly integration: { readonly slug: string; readonly productId: string };\n  readonly timezone: string | null;\n\n  readonly storage: IntegrationStorage<Schemas>;\n  readonly secrets: IntegrationSecrets;\n  readonly fetch: IntegrationFetch;\n  readonly logger: IntegrationLogger;\n}\n"]}

package/dist/component-reference.d.ts

@@ -0,0 +1,14 @@
+/**
+ * A dependency-pure structural stand-in for a React component reference.
+ *
+ * This package validates integration definitions without depending on React
+ * (it depends on nothing but zod). A component is, structurally, either a
+ * function (function components, and `React.lazy`'s returned function) or a
+ * React "exotic" object tagged with `$$typeof` (`memo`, `forwardRef`,
+ * `Context.Provider`, …). `@ekanos/sdk` re-narrows these to the real
+ * `ComponentType<…>` for authoring DX; the host adapter casts back.
+ */
+export type ComponentReference = ((...args: never[]) => unknown) | {
+    readonly $$typeof: symbol;
+};
+export declare function isComponentReference(value: unknown): value is ComponentReference;

package/dist/component-reference.js

@@ -0,0 +1,6 @@
+export function isComponentReference(value) {
+    if (typeof value === 'function')
+        return true;
+    return typeof value === 'object' && value !== null && '$$typeof' in value;
+}
+//# sourceMappingURL=component-reference.js.map

package/dist/component-reference.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"component-reference.js","sourceRoot":"","sources":["../src/component-reference.ts"],"names":[],"mappings":"AAcA,MAAM,UAAU,oBAAoB,CAClC,KAAc;IAEd,IAAI,OAAO,KAAK,KAAK,UAAU;QAAE,OAAO,IAAI,CAAC;IAC7C,OAAO,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,KAAK,IAAI,IAAI,UAAU,IAAI,KAAK,CAAC;AAC5E,CAAC","sourcesContent":["/**\n * A dependency-pure structural stand-in for a React component reference.\n *\n * This package validates integration definitions without depending on React\n * (it depends on nothing but zod). A component is, structurally, either a\n * function (function components, and `React.lazy`'s returned function) or a\n * React \"exotic\" object tagged with `$$typeof` (`memo`, `forwardRef`,\n * `Context.Provider`, …). `@ekanos/sdk` re-narrows these to the real\n * `ComponentType<…>` for authoring DX; the host adapter casts back.\n */\nexport type ComponentReference =\n  | ((...args: never[]) => unknown)\n  | { readonly $$typeof: symbol };\n\nexport function isComponentReference(\n  value: unknown,\n): value is ComponentReference {\n  if (typeof value === 'function') return true;\n  return typeof value === 'object' && value !== null && '$$typeof' in value;\n}\n"]}

package/dist/index.d.ts

@@ -0,0 +1,26 @@
+/**
+ * @ekanos/integration-schema — the canonical, dependency-pure contract for
+ * Ekanos integration definitions.
+ *
+ * ONE zod schema, ONE set of types, imported by BOTH `@ekanos/sdk`
+ * (authoring: `defineIntegration()`) and `@kit/integrations-core` (host trust
+ * boundary: `registerPartnerIntegration()` re-parses against this schema).
+ * This package depends on nothing but zod, so neither consumer forms a cycle
+ * and there is no hand-written structural twin to drift (F3/F9/F10).
+ *
+ * Depends on: zod. Nothing else — no `@kit/*`, no React, no `server-only`.
+ *
+ * Relative specifiers are extensionless here on purpose. Workspace consumers
+ * resolve this package's raw `src/*.ts` through a bundler, so a `./x.js`
+ * specifier would point at a file that does not exist. The published ESM still
+ * needs the extension for a real Node import, so `scripts/rewrite-esm-specifiers.mjs`
+ * adds it to `dist/` after the compiler runs — see that file for the full
+ * rationale. Do not hand-write `.js` extensions back into this source tree.
+ */
+export type { IntegrationActor, IntegrationContext, IntegrationStorage, ScopedStore, IntegrationSecrets, IntegrationFetch, IntegrationLogger, StorageEntry, StorageWriteOptions, StorageSchemas, StorageSchemaMap, StorageScopeSchemas, StorageKeyDeclaration, StorageKeyDeclarationInput, StorageKeySchema, } from './capability-context.js';
+export type { ComponentReference } from './component-reference.js';
+export { isComponentReference } from './component-reference.js';
+export { DNS_NAMESPACE, EKANOS_INTEGRATION_NAMESPACE, derivePlanId, deriveProductId, uuidv5, } from './product-id.js';
+export { WorkspaceTargetSchema, WorkspaceTargetListSchema, WorkspaceTargetSlugSchema, WorkspaceTargetLayoutSchema, createWorkspaceTargetSchema, createWorkspaceTargetListSchema, normalizeWorkspaceTargets, type WorkspaceTargetSchemaOptions, type WorkspaceTargetDefinition, type ResolvedWorkspaceTarget, } from './workspace-target.js';
+export { IntegrationDefinitionSchema, parseIntegrationDefinition, validateIntegrationDefinitions, getDiscoveredToolName, assertPlainDeclaration, deepFreezeDefinition, } from './integration-definition.js';
+export type { IntegrationDefinition, IntegrationComponentDeclarations, IntegrationProposals, IntegrationCapabilityDeclaration, IntegrationPermissionDeclaration, PartnerWidgetDeclaration, PartnerToolModule, PartnerToolParameters, ToolClassificationProposal, DefinitionCollisionInput, FirstPartyInventory, JsonValue, PartnerWebhookDeclaration, WebhookSignatureDeclaration, WebhookEvent, WebhookResult, PartnerScheduleDeclaration, ScheduleInvocation, ScheduleResult, PartnerOAuthDeclaration, OAuthProviderDeclaration, OAuthTokens, } from './integration-definition.js';

package/dist/index.js

@@ -0,0 +1,29 @@
+/**
+ * @ekanos/integration-schema — the canonical, dependency-pure contract for
+ * Ekanos integration definitions.
+ *
+ * ONE zod schema, ONE set of types, imported by BOTH `@ekanos/sdk`
+ * (authoring: `defineIntegration()`) and `@kit/integrations-core` (host trust
+ * boundary: `registerPartnerIntegration()` re-parses against this schema).
+ * This package depends on nothing but zod, so neither consumer forms a cycle
+ * and there is no hand-written structural twin to drift (F3/F9/F10).
+ *
+ * Depends on: zod. Nothing else — no `@kit/*`, no React, no `server-only`.
+ *
+ * Relative specifiers are extensionless here on purpose. Workspace consumers
+ * resolve this package's raw `src/*.ts` through a bundler, so a `./x.js`
+ * specifier would point at a file that does not exist. The published ESM still
+ * needs the extension for a real Node import, so `scripts/rewrite-esm-specifiers.mjs`
+ * adds it to `dist/` after the compiler runs — see that file for the full
+ * rationale. Do not hand-write `.js` extensions back into this source tree.
+ */
+export { isComponentReference } from './component-reference.js';
+// Deterministic slug → uuid derivation. One slug, one product id, everywhere
+// and forever — the SDK, the seed generator and any future gate all agree by
+// computing rather than choosing.
+export { DNS_NAMESPACE, EKANOS_INTEGRATION_NAMESPACE, derivePlanId, deriveProductId, uuidv5, } from './product-id.js';
+// Workspace-target contract (F10): one schema, host injects icon validity
+export { WorkspaceTargetSchema, WorkspaceTargetListSchema, WorkspaceTargetSlugSchema, WorkspaceTargetLayoutSchema, createWorkspaceTargetSchema, createWorkspaceTargetListSchema, normalizeWorkspaceTargets, } from './workspace-target.js';
+// The integration-definition contract
+export { IntegrationDefinitionSchema, parseIntegrationDefinition, validateIntegrationDefinitions, getDiscoveredToolName, assertPlainDeclaration, deepFreezeDefinition, } from './integration-definition.js';
+//# sourceMappingURL=index.js.map

package/dist/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;GAkBG;AAsBH,OAAO,EAAE,oBAAoB,EAAE,MAAM,uBAAuB,CAAC;AAE7D,6EAA6E;AAC7E,6EAA6E;AAC7E,kCAAkC;AAClC,OAAO,EACL,aAAa,EACb,4BAA4B,EAC5B,YAAY,EACZ,eAAe,EACf,MAAM,GACP,MAAM,cAAc,CAAC;AAEtB,0EAA0E;AAC1E,OAAO,EACL,qBAAqB,EACrB,yBAAyB,EACzB,yBAAyB,EACzB,2BAA2B,EAC3B,2BAA2B,EAC3B,+BAA+B,EAC/B,yBAAyB,GAI1B,MAAM,oBAAoB,CAAC;AAE5B,sCAAsC;AACtC,OAAO,EACL,2BAA2B,EAC3B,0BAA0B,EAC1B,8BAA8B,EAC9B,qBAAqB,EACrB,sBAAsB,EACtB,oBAAoB,GACrB,MAAM,0BAA0B,CAAC","sourcesContent":["/**\n * @ekanos/integration-schema — the canonical, dependency-pure contract for\n * Ekanos integration definitions.\n *\n * ONE zod schema, ONE set of types, imported by BOTH `@ekanos/sdk`\n * (authoring: `defineIntegration()`) and `@kit/integrations-core` (host trust\n * boundary: `registerPartnerIntegration()` re-parses against this schema).\n * This package depends on nothing but zod, so neither consumer forms a cycle\n * and there is no hand-written structural twin to drift (F3/F9/F10).\n *\n * Depends on: zod. Nothing else — no `@kit/*`, no React, no `server-only`.\n *\n * Relative specifiers are extensionless here on purpose. Workspace consumers\n * resolve this package's raw `src/*.ts` through a bundler, so a `./x.js`\n * specifier would point at a file that does not exist. The published ESM still\n * needs the extension for a real Node import, so `scripts/rewrite-esm-specifiers.mjs`\n * adds it to `dist/` after the compiler runs — see that file for the full\n * rationale. Do not hand-write `.js` extensions back into this source tree.\n */\n\n// Capability-context types (canonical home; @ekanos/sdk re-exports these)\nexport type {\n  IntegrationActor,\n  IntegrationContext,\n  IntegrationStorage,\n  ScopedStore,\n  IntegrationSecrets,\n  IntegrationFetch,\n  IntegrationLogger,\n  StorageEntry,\n  StorageWriteOptions,\n  StorageSchemas,\n  StorageSchemaMap,\n  StorageScopeSchemas,\n  StorageKeyDeclaration,\n  StorageKeyDeclarationInput,\n  StorageKeySchema,\n} from './capability-context';\n\nexport type { ComponentReference } from './component-reference';\nexport { isComponentReference } from './component-reference';\n\n// Deterministic slug → uuid derivation. One slug, one product id, everywhere\n// and forever — the SDK, the seed generator and any future gate all agree by\n// computing rather than choosing.\nexport {\n  DNS_NAMESPACE,\n  EKANOS_INTEGRATION_NAMESPACE,\n  derivePlanId,\n  deriveProductId,\n  uuidv5,\n} from './product-id';\n\n// Workspace-target contract (F10): one schema, host injects icon validity\nexport {\n  WorkspaceTargetSchema,\n  WorkspaceTargetListSchema,\n  WorkspaceTargetSlugSchema,\n  WorkspaceTargetLayoutSchema,\n  createWorkspaceTargetSchema,\n  createWorkspaceTargetListSchema,\n  normalizeWorkspaceTargets,\n  type WorkspaceTargetSchemaOptions,\n  type WorkspaceTargetDefinition,\n  type ResolvedWorkspaceTarget,\n} from './workspace-target';\n\n// The integration-definition contract\nexport {\n  IntegrationDefinitionSchema,\n  parseIntegrationDefinition,\n  validateIntegrationDefinitions,\n  getDiscoveredToolName,\n  assertPlainDeclaration,\n  deepFreezeDefinition,\n} from './integration-definition';\n\nexport type {\n  IntegrationDefinition,\n  IntegrationComponentDeclarations,\n  IntegrationProposals,\n  IntegrationCapabilityDeclaration,\n  IntegrationPermissionDeclaration,\n  PartnerWidgetDeclaration,\n  PartnerToolModule,\n  PartnerToolParameters,\n  ToolClassificationProposal,\n  DefinitionCollisionInput,\n  FirstPartyInventory,\n  JsonValue,\n  // Event surfaces (webhooks, schedules, OAuth) — interface-first: the local\n  // harness executes them today; the host transports bind to them later.\n  PartnerWebhookDeclaration,\n  WebhookSignatureDeclaration,\n  WebhookEvent,\n  WebhookResult,\n  PartnerScheduleDeclaration,\n  ScheduleInvocation,\n  ScheduleResult,\n  PartnerOAuthDeclaration,\n  OAuthProviderDeclaration,\n  OAuthTokens,\n} from './integration-definition';\n"]}