@ekanos/integration-schema 0.1.0

package/dist/integration-definition.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"integration-definition.js","sourceRoot":"","sources":["../src/integration-definition.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;GAUG;AACH,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAQxB,OAAO,EAAE,oBAAoB,EAAE,MAAM,uBAAuB,CAAC;AAC7D,OAAO,EAEL,yBAAyB,GAC1B,MAAM,oBAAoB,CAAC;AAU5B,MAAM,eAAe,GAAyB,CAAC,CAAC,IAAI,CAAC,GAAG,EAAE,CACxD,CAAC,CAAC,KAAK,CAAC;IACN,CAAC,CAAC,MAAM,EAAE;IACV,yEAAyE;IACzE,oEAAoE;IACpE,+BAA+B;IAC/B,CAAC,CAAC,MAAM,EAAE,CAAC,MAAM,EAAE;IACnB,CAAC,CAAC,OAAO,EAAE;IACX,CAAC,CAAC,IAAI,EAAE;IACR,CAAC,CAAC,KAAK,CAAC,eAAe,CAAC;IACxB,CAAC,CAAC,MAAM,CAAC,eAAe,CAAC;CAC1B,CAAC,CACH,CAAC;AAEF,+EAA+E;AAE/E,SAAS,kBAAkB,CAAC,IAAY;IACtC,OAAO,CAAC,CAAC,MAAM,CAAqB,oBAAoB,EAAE;QACxD,OAAO,EAAE,GAAG,IAAI,8JAA8J;KAC/K,CAAC,CAAC;AACL,CAAC;AAED,MAAM,YAAY,GAAG,CAAC,CAAC,MAAM,CAC3B,CAAC,KAAK,EAAE,EAAE,CACR,OAAO,CAAC,KAAwC,aAAxC,KAAK,uBAAL,KAAK,CAAqC,SAAS,CAAA,KAAK,UAAU,EAC5E;IACE,OAAO,EACL,uJAAuJ;CAC1J,CACF,CAAC;AAEF,MAAM,QAAQ,GAAG,CAAC,IAAY,EAAE,EAAE,CAChC,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,EAAE,EAAE,OAAO,EAAE,GAAG,IAAI,8BAA8B,EAAE,CAAC,CAAC;AAExE,MAAM,UAAU,GAAG,CAAC,CAAC,MAAM,EAAE,CAAC,KAAK,CAAC,4BAA4B,EAAE;IAChE,OAAO,EACL,2JAA2J;CAC9J,CAAC,CAAC;AAEH,MAAM,cAAc,GAAG,CAAC,CAAC,MAAM,EAAE,CAAC,KAAK,CAAC,4BAA4B,EAAE;IACpE,OAAO,EACL,oIAAoI;CACvI,CAAC,CAAC;AAEH,MAAM,gBAAgB,GAAG,CAAC,CAAC,MAAM,EAAE,CAAC,KAAK,CAAC,iCAAiC,EAAE;IAC3E,OAAO,EACL,sKAAsK;CACzK,CAAC,CAAC;AAEH,MAAM,cAAc,GAAG,CAAC,CAAC,MAAM,EAAE,CAAC,KAAK,CAAC,mBAAmB,EAAE;IAC3D,OAAO,EACL,+HAA+H;CAClI,CAAC,CAAC;AAEH,MAAM,eAAe,GAAG,CAAC,CAAC,MAAM,EAAE,CAAC,KAAK,CAAC,4BAA4B,EAAE;IACrE,OAAO,EACL,yHAAyH;CAC5H,CAAC,CAAC;AAEH,MAAM,gBAAgB,GAAG,CAAC,CAAC,MAAM,EAAE,CAAC,KAAK,CAAC,4BAA4B,EAAE;IACtE,OAAO,EACL,sHAAsH;CACzH,CAAC,CAAC;AAEH,0EAA0E;AAC1E,0EAA0E;AAC1E,uEAAuE;AACvE,4EAA4E;AAC5E,cAAc;AACd,MAAM,iBAAiB,GAAG,CAAC,CAAC,MAAM,EAAE,CAAC,WAAW,CAAC,CAAC,KAAK,EAAE,GAAG,EAAE,EAAE;;IAC9D,MAAM,KAAK,GAAG,8CAA8C,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;IACzE,IAAI,CAAC,KAAK,EAAE,CAAC;QACX,GAAG,CAAC,QAAQ,CAAC;YACX,IAAI,EAAE,CAAC,CAAC,YAAY,CAAC,MAAM;YAC3B,OAAO,EACL,iBAAiB,KAAK,iDAAiD;gBACvE,+DAA+D;gBAC/D,uEAAuE;gBACvE,sEAAsE;SACzE,CAAC,CAAC;QACH,OAAO;IACT,CAAC;IACD,MAAM,IAAI,GAAG,MAAA,KAAK,CAAC,CAAC,CAAC,mCAAI,EAAE,CAAC;IAC5B,IAAI,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,IAAI,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,IAAI,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,EAAE,CAAC;QACrE,GAAG,CAAC,QAAQ,CAAC;YACX,IAAI,EAAE,CAAC,CAAC,YAAY,CAAC,MAAM;YAC3B,OAAO,EAAE,iBAAiB,KAAK,gHAAgH;SAChJ,CAAC,CAAC;IACL,CAAC;AACH,CAAC,CAAC,CAAC;AAEH,+EAA+E;AAE/E,MAAM,gBAAgB,GAAG,CAAC;KACvB,MAAM,CAAC;IACN,KAAK,EAAE,QAAQ,CAAC,sBAAsB,CAAC;IACvC,WAAW,EAAE,QAAQ,CAAC,4BAA4B,CAAC;IACnD,IAAI,EAAE,kBAAkB,CAAC,qBAAqB,CAAC,CAAC,QAAQ,EAAE;CAC3D,CAAC;KACD,MAAM,EAAE,CAAC;AAEZ,MAAM,gBAAgB,GAAG,CAAC;KACvB,MAAM,CAAC;IACN,KAAK,EAAE,QAAQ,CAAC,qBAAqB,CAAC;IACtC,MAAM,EAAE,QAAQ,CAAC,sBAAsB,CAAC;IACxC,IAAI,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;CAChC,CAAC;KACD,MAAM,EAAE,CAAC;AAEZ,MAAM,cAAc,GAAG,CAAC;KACrB,MAAM,CAAC;IACN,IAAI,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,QAAQ,EAAE;IACjC,IAAI,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,QAAQ,EAAE;CAClC,CAAC;KACD,MAAM,EAAE,CAAC;AAEZ,MAAM,eAAe,GAAG,CAAC;KACtB,MAAM,CAAC;IACN,CAAC,EAAE,CAAC,CAAC,MAAM,EAAE;IACb,CAAC,EAAE,CAAC,CAAC,MAAM,EAAE;IACb,CAAC,EAAE,CAAC,CAAC,MAAM,EAAE;IACb,CAAC,EAAE,CAAC,CAAC,MAAM,EAAE;IACb,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;CACjC,CAAC;KACD,MAAM,EAAE,CAAC;AAEZ;;;;;;GAMG;AACH,MAAM,YAAY,GAAG,CAAC;KACnB,MAAM,CAAC;IACN,EAAE,EAAE,cAAc;IAClB,IAAI,EAAE,QAAQ,CAAC,gBAAgB,CAAC;IAChC,SAAS,EAAE,kBAAkB,CAAC,qBAAqB,CAAC;IACpD,WAAW,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,QAAQ,EAAE,UAAU,EAAE,UAAU,CAAC,CAAC;IACvD,QAAQ,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,cAAc,EAAE,CAAC,CAAC,KAAK,CAAC,cAAc,CAAC,CAAC,CAAC,CAAC,QAAQ,EAAE;IACvE,YAAY,EAAE,CAAC;SACZ,MAAM,CAAC,EAAE,GAAG,EAAE,CAAC,CAAC,MAAM,EAAE,EAAE,GAAG,EAAE,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC;SAC5C,MAAM,EAAE;SACR,QAAQ,EAAE;IACb,OAAO,EAAE,CAAC;SACP,MAAM,CAAC;QACN,EAAE,EAAE,eAAe,CAAC,QAAQ,EAAE;QAC9B,EAAE,EAAE,eAAe,CAAC,QAAQ,EAAE;QAC9B,EAAE,EAAE,eAAe,CAAC,QAAQ,EAAE;KAC/B,CAAC;SACD,MAAM,EAAE;SACR,QAAQ,EAAE;IACb,QAAQ,EAAE,CAAC;SACR,MAAM,CAAC;QACN,EAAE,EAAE,CAAC,CAAC,MAAM,EAAE;QACd,IAAI,EAAE,CAAC,CAAC,MAAM,EAAE;QAChB,IAAI,EAAE,CAAC,CAAC,MAAM,EAAE;QAChB,IAAI,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;KAC5B,CAAC;SACD,MAAM,EAAE;SACR,QAAQ,EAAE;IACb,aAAa,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,QAAQ,EAAE;IACrC,UAAU,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,QAAQ,EAAE;IAClC,eAAe,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,QAAQ,EAAE;CACxC,CAAC;KACD,MAAM,EAAE,CAAC;AAEZ,MAAM,oBAAoB,GAAG,CAAC;KAC3B,MAAM,CAAC;IACN,IAAI,EAAE,CAAC,CAAC,OAAO,CAAC,QAAQ,CAAC;IACzB,UAAU,EAAE,CAAC,CAAC,MAAM,CAAC,eAAe,CAAC,CAAC,QAAQ,EAAE;IAChD,QAAQ,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC,QAAQ,EAAE;IACxC,oBAAoB,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,QAAQ,EAAE;CAC7C,CAAC;KACD,MAAM,EAAE,CAAC;AAEZ,MAAM,aAAa,GAAG,CAAC,CAAC,MAAM,CAE5B,CAAC,KAAK,EAAE,EAAE,CAAC,OAAO,KAAK,KAAK,UAAU,EAAE;IACxC,OAAO,EACL,qIAAqI;CACxI,CAAC,CAAC;AAEH,MAAM,UAAU,GAAG,CAAC;KACjB,MAAM,CAAC;IACN,IAAI,EAAE,cAAc;IACpB,WAAW,EAAE,QAAQ,CAAC,qBAAqB,CAAC;IAC5C,UAAU,EAAE,oBAAoB,CAAC,QAAQ,EAAE;IAC3C,GAAG,EAAE,aAAa;IAClB,aAAa,EAAE,CAAC,CAAC,MAAM,CAAC,eAAe,CAAC,CAAC,QAAQ,EAAE;CACpD,CAAC;KACD,MAAM,EAAE,CAAC;AAEZ,+EAA+E;AAC/E,EAAE;AACF,8EAA8E;AAC9E,uEAAuE;AACvE,4EAA4E;AAC5E,6EAA6E;AAC7E,0EAA0E;AAC1E,0BAA0B;AAE1B,SAAS,aAAa,CAAC,IAAY,EAAE,KAAa;IAChD,OAAO,CAAC,CAAC,MAAM,CACb,CAAC,KAAK,EAAE,EAAE,CAAC,OAAO,KAAK,KAAK,UAAU,EACtC;QACE,OAAO,EAAE,GAAG,IAAI,uBAAuB,KAAK,mFAAmF;KAChI,CACF,CAAC;AACJ,CAAC;AAED,MAAM,gBAAgB,GAAG,CAAC,CAAC,MAAM,CAC/B,CAAC,KAAK,EAAE,EAAE,CACR,OAAO,CAAC,KAAwC,aAAxC,KAAK,uBAAL,KAAK,CAAqC,SAAS,CAAA,KAAK,UAAU,EAC5E;IACE,OAAO,EACL,mJAAmJ;CACtJ,CACF,CAAC;AAEF;;;;;GAKG;AACH,MAAM,sBAAsB,GAAG,CAAC,CAAC,KAAK,CAAC;IACrC,CAAC,CAAC,OAAO,CAAC,MAAM,CAAC;IACjB,CAAC;SACE,MAAM,CAAC;QACN,MAAM,EAAE,QAAQ,CAAC,6BAA6B,CAAC;QAC/C,UAAU,EAAE,QAAQ,CAAC,iCAAiC,CAAC;KACxD,CAAC;SACD,MAAM,EAAE;CACZ,CAAC,CAAC;AAEH,MAAM,aAAa,GAAG,CAAC;KACpB,MAAM,CAAC;IACN,EAAE,EAAE,eAAe;IACnB,WAAW,EAAE,QAAQ,CAAC,wBAAwB,CAAC;IAC/C,aAAa,EAAE,gBAAgB;IAC/B,SAAS,EAAE,sBAAsB;IACjC,cAAc,EAAE,CAAC,CAAC,MAAM,CAAC,eAAe,CAAC,CAAC,QAAQ,EAAE;IACpD,OAAO,EAAE,aAAa,CACpB,oBAAoB,EACpB,wCAAwC,CACzC;CACF,CAAC;KACD,MAAM,EAAE,CAAC;AAEZ,MAAM,cAAc,GAAG,CAAC;KACrB,MAAM,CAAC;IACN,EAAE,EAAE,gBAAgB;IACpB,WAAW,EAAE,QAAQ,CAAC,yBAAyB,CAAC;IAChD,0EAA0E;IAC1E,+DAA+D;IAC/D,2EAA2E;IAC3E,IAAI,EAAE,QAAQ,CAAC,kBAAkB,CAAC;IAClC,OAAO,EAAE,aAAa,CACpB,qBAAqB,EACrB,8CAA8C,CAC/C;CACF,CAAC;KACD,MAAM,EAAE,CAAC;AAEZ,MAAM,cAAc,GAAG,CAAC,IAAY,EAAE,EAAE,CACtC,CAAC,CAAC,MAAM,EAAE,CAAC,WAAW,CAAC,CAAC,KAAK,EAAE,GAAG,EAAE,EAAE;IACpC,IAAI,MAAW,CAAC;IAChB,IAAI,CAAC;QACH,MAAM,GAAG,IAAI,GAAG,CAAC,KAAK,CAAC,CAAC;IAC1B,CAAC;IAAC,WAAM,CAAC;QACP,GAAG,CAAC,QAAQ,CAAC;YACX,IAAI,EAAE,CAAC,CAAC,YAAY,CAAC,MAAM;YAC3B,OAAO,EAAE,GAAG,IAAI,4EAA4E;SAC7F,CAAC,CAAC;QACH,OAAO;IACT,CAAC;IACD,IAAI,MAAM,CAAC,QAAQ,KAAK,QAAQ,EAAE,CAAC;QACjC,GAAG,CAAC,QAAQ,CAAC;YACX,IAAI,EAAE,CAAC,CAAC,YAAY,CAAC,MAAM;YAC3B,OAAO,EAAE,GAAG,IAAI,yDAAyD;SAC1E,CAAC,CAAC;IACL,CAAC;IACD,IAAI,MAAM,CAAC,QAAQ,KAAK,EAAE,IAAI,MAAM,CAAC,QAAQ,KAAK,EAAE,EAAE,CAAC;QACrD,GAAG,CAAC,QAAQ,CAAC;YACX,IAAI,EAAE,CAAC,CAAC,YAAY,CAAC,MAAM;YAC3B,OAAO,EAAE,GAAG,IAAI,8BAA8B;SAC/C,CAAC,CAAC;IACL,CAAC;AACH,CAAC,CAAC,CAAC;AAEL,MAAM,WAAW,GAAG,CAAC;KAClB,MAAM,CAAC;IACN,QAAQ,EAAE,CAAC;SACR,MAAM,CAAC;QACN,gBAAgB,EAAE,cAAc,CAAC,iCAAiC,CAAC;QACnE,QAAQ,EAAE,cAAc,CAAC,yBAAyB,CAAC;QACnD,MAAM,EAAE,CAAC,CAAC,KAAK,CAAC,QAAQ,CAAC,yBAAyB,CAAC,CAAC;QACpD,IAAI,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,QAAQ,EAAE;KAC7B,CAAC;SACD,MAAM,EAAE;IACX,WAAW,EAAE,CAAC;SACX,MAAM,CAAC;QACN,kBAAkB,EAAE,QAAQ,CAAC,sCAAsC,CAAC;QACpE,sBAAsB,EAAE,QAAQ,CAC9B,0CAA0C,CAC3C;KACF,CAAC;SACD,MAAM,EAAE;IACX,QAAQ,EAAE,aAAa,CAAC,gBAAgB,EAAE,gCAAgC,CAAC;CAC5E,CAAC;KACD,MAAM,EAAE,CAAC;AAEZ,MAAM,gCAAgC,GAAG,CAAC;KACvC,MAAM,CAAC;IACN,MAAM,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC,CAAC,QAAQ,EAAE;IAC5C,WAAW,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,QAAQ,EAAE,UAAU,EAAE,KAAK,EAAE,WAAW,CAAC,CAAC,CAAC,QAAQ,EAAE;CAC3E,CAAC;KACD,MAAM,EAAE,CAAC;AAEZ,MAAM,eAAe,GAAG,CAAC;KACtB,MAAM,CAAC;IACN,eAAe,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,SAAS,EAAE,MAAM,EAAE,QAAQ,CAAC,CAAC,CAAC,QAAQ,EAAE;IACjE,KAAK,EAAE,CAAC,CAAC,MAAM,CAAC,gCAAgC,CAAC,CAAC,QAAQ,EAAE;CAC7D,CAAC;KACD,MAAM,EAAE,CAAC;AAEZ;;;;;;;;GAQG;AACH,MAAM,2BAA2B,GAAG,CAAC;KAClC,MAAM,CAAC;IACN,MAAM,EAAE,YAAY;IACpB,cAAc,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,QAAQ,EAAE;CACvC,CAAC;KACD,MAAM,EAAE,CAAC;AAEZ,8EAA8E;AAC9E,SAAS,eAAe,CAAC,KAAc;IACrC,OAAO,CACL,OAAO,CAAC,KAAwC,aAAxC,KAAK,uBAAL,KAAK,CAAqC,SAAS,CAAA,KAAK,UAAU,CAC3E,CAAC;AACJ,CAAC;AAED;;;;;;GAMG;AACH,MAAM,wBAAwB,GAAG,CAAC;KAC/B,MAAM,CAA6B,GAAG,EAAE,CAAC,IAAI,CAAC;KAC9C,WAAW,CAAC,CAAC,KAAK,EAAE,GAAG,EAAE,EAAE;IAC1B,IAAI,eAAe,CAAC,KAAK,CAAC;QAAE,OAAO;IAEnC,MAAM,mBAAmB,GACvB,KAAK,KAAK,IAAI,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC;IAEvE,yEAAyE;IACzE,IACE,CAAC,mBAAmB;QACpB,CAAC,eAAe,CAAE,KAA8B,CAAC,MAAM,CAAC,EACxD,CAAC;QACD,GAAG,CAAC,QAAQ,CAAC;YACX,IAAI,EAAE,CAAC,CAAC,YAAY,CAAC,MAAM;YAC3B,OAAO,EACL,mTAAmT;SACtT,CAAC,CAAC;QACH,OAAO;IACT,CAAC;IAED,wEAAwE;IACxE,uEAAuE;IACvE,2EAA2E;IAC3E,MAAM,MAAM,GAAG,2BAA2B,CAAC,SAAS,CAAC,KAAK,CAAC,CAAC;IAC5D,IAAI,MAAM,CAAC,OAAO;QAAE,OAAO;IAE3B,KAAK,MAAM,KAAK,IAAI,MAAM,CAAC,KAAK,CAAC,MAAM,EAAE,CAAC;QACxC,GAAG,CAAC,QAAQ,CAAC;YACX,IAAI,EAAE,CAAC,CAAC,YAAY,CAAC,MAAM;YAC3B,IAAI,EAAE,KAAK,CAAC,IAAI;YAChB,OAAO,EAAE,KAAK,CAAC,OAAO;SACvB,CAAC,CAAC;IACL,CAAC;AACH,CAAC,CAAC,CAAC;AAEL,MAAM,kBAAkB,GAAG,CAAC,CAAC,MAAM,CAAC,gBAAgB,EAAE,wBAAwB,CAAC,CAAC;AAEhF,MAAM,gBAAgB,GAAG,CAAC;KACvB,MAAM,CAAC;IACN,cAAc,EAAE,kBAAkB,CAAC,2BAA2B,CAAC,CAAC,QAAQ,EAAE;IAC1E,eAAe,EAAE,kBAAkB,CACjC,4BAA4B,CAC7B,CAAC,QAAQ,EAAE;IACZ,OAAO,EAAE,CAAC,CAAC,KAAK,CAAC,YAAY,CAAC,CAAC,QAAQ,EAAE;CAC1C,CAAC;KACD,MAAM,EAAE,CAAC;AAEZ;;;;;GAKG;AACH,MAAM,CAAC,MAAM,2BAA2B,GAAG,CAAC;KACzC,MAAM,CAAC;IACN,IAAI,EAAE,UAAU;IAChB,IAAI,EAAE,QAAQ,CAAC,MAAM,CAAC;IACtB,WAAW,EAAE,QAAQ,CAAC,aAAa,CAAC;IACpC,OAAO,EAAE,CAAC;SACP,MAAM,EAAE;SACR,KAAK,CACJ,gGAAgG,EAChG;QACE,OAAO,EACL,kHAAkH;KACrH,CACF;IACH,YAAY,EAAE,CAAC,CAAC,KAAK,CAAC,gBAAgB,CAAC,CAAC,QAAQ,EAAE;IAClD,WAAW,EAAE,CAAC,CAAC,KAAK,CAAC,gBAAgB,CAAC,CAAC,QAAQ,EAAE;IACjD,UAAU,EAAE,gBAAgB,CAAC,QAAQ,EAAE;IACvC,gBAAgB,EAAE,yBAAyB,CAAC,QAAQ,EAAE;IACtD,KAAK,EAAE,CAAC,CAAC,KAAK,CAAC,UAAU,CAAC,CAAC,QAAQ,EAAE;IACrC,OAAO,EAAE,CAAC;SACP,MAAM,CAAC;QACN,OAAO,EAAE,kBAAkB,CAAC,QAAQ,EAAE;QACtC,IAAI,EAAE,kBAAkB,CAAC,QAAQ,EAAE;KACpC,CAAC;SACD,MAAM,EAAE;SACR,QAAQ,EAAE;IACb,MAAM,EAAE,CAAC,CAAC,KAAK,CAAC,iBAAiB,CAAC,CAAC,QAAQ,EAAE;IAC7C,QAAQ,EAAE,CAAC,CAAC,KAAK,CAAC,aAAa,CAAC,CAAC,QAAQ,EAAE;IAC3C,SAAS,EAAE,CAAC,CAAC,KAAK,CAAC,cAAc,CAAC,CAAC,QAAQ,EAAE;IAC7C,KAAK,EAAE,WAAW,CAAC,QAAQ,EAAE;IAC7B,QAAQ,EAAE,eAAe,CAAC,QAAQ,EAAE;CACrC,CAAC;KACD,MAAM,EAAE;KACR,WAAW,CAAC,CAAC,UAAU,EAAE,GAAG,EAAE,EAAE;;IAC/B,MAAM,UAAU,GAAG,CAAC,MAAA,UAAU,CAAC,QAAQ,mCAAI,EAAE,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC;IAChE,KAAK,MAAM,EAAE,IAAI,cAAc,CAAC,UAAU,CAAC,EAAE,CAAC;QAC5C,GAAG,CAAC,QAAQ,CAAC;YACX,IAAI,EAAE,CAAC,CAAC,YAAY,CAAC,MAAM;YAC3B,IAAI,EAAE,CAAC,UAAU,CAAC;YAClB,OAAO,EAAE,eAAe,EAAE,gEAAgE;SAC3F,CAAC,CAAC;IACL,CAAC;IAED,MAAM,WAAW,GAAG,CAAC,MAAA,UAAU,CAAC,SAAS,mCAAI,EAAE,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC;IAClE,KAAK,MAAM,EAAE,IAAI,cAAc,CAAC,WAAW,CAAC,EAAE,CAAC;QAC7C,GAAG,CAAC,QAAQ,CAAC;YACX,IAAI,EAAE,CAAC,CAAC,YAAY,CAAC,MAAM;YAC3B,IAAI,EAAE,CAAC,WAAW,CAAC;YACnB,OAAO,EAAE,gBAAgB,EAAE,iEAAiE;SAC7F,CAAC,CAAC;IACL,CAAC;IAED,MAAM,SAAS,GAAG,CAAC,MAAA,MAAA,UAAU,CAAC,UAAU,0CAAE,OAAO,mCAAI,EAAE,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC;IAC1E,KAAK,MAAM,EAAE,IAAI,cAAc,CAAC,SAAS,CAAC,EAAE,CAAC;QAC3C,GAAG,CAAC,QAAQ,CAAC;YACX,IAAI,EAAE,CAAC,CAAC,YAAY,CAAC,MAAM;YAC3B,IAAI,EAAE,CAAC,YAAY,EAAE,SAAS,CAAC;YAC/B,OAAO,EAAE,cAAc,EAAE,+DAA+D;SACzF,CAAC,CAAC;IACL,CAAC;IAED,MAAM,SAAS,GAAG,CAAC,MAAA,UAAU,CAAC,KAAK,mCAAI,EAAE,CAAC,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IACpE,KAAK,MAAM,IAAI,IAAI,cAAc,CAAC,SAAS,CAAC,EAAE,CAAC;QAC7C,GAAG,CAAC,QAAQ,CAAC;YACX,IAAI,EAAE,CAAC,CAAC,YAAY,CAAC,MAAM;YAC3B,IAAI,EAAE,CAAC,OAAO,CAAC;YACf,OAAO,EAAE,SAAS,IAAI,+DAA+D;SACtF,CAAC,CAAC;IACL,CAAC;IAED,MAAM,aAAa,GAAG,IAAI,GAAG,CAAC,SAAS,CAAC,CAAC;IACzC,KAAK,MAAM,YAAY,IAAI,MAAM,CAAC,IAAI,CAAC,MAAA,MAAA,UAAU,CAAC,QAAQ,0CAAE,KAAK,mCAAI,EAAE,CAAC,EAAE,CAAC;QACzE,IAAI,CAAC,aAAa,CAAC,GAAG,CAAC,YAAY,CAAC,EAAE,CAAC;YACrC,GAAG,CAAC,QAAQ,CAAC;gBACX,IAAI,EAAE,CAAC,CAAC,YAAY,CAAC,MAAM;gBAC3B,IAAI,EAAE,CAAC,UAAU,EAAE,OAAO,EAAE,YAAY,CAAC;gBACzC,OAAO,EAAE,mBAAmB,YAAY,gGAAgG;aACzI,CAAC,CAAC;QACL,CAAC;IACH,CAAC;AACH,CAAC,CAAC,CAAC;AAmNL,+EAA+E;AAE/E,SAAS,cAAc,CAAC,MAAyB;IAC/C,MAAM,IAAI,GAAG,IAAI,GAAG,EAAU,CAAC;IAC/B,MAAM,UAAU,GAAG,IAAI,GAAG,EAAU,CAAC;IACrC,KAAK,MAAM,KAAK,IAAI,MAAM,EAAE,CAAC;QAC3B,IAAI,IAAI,CAAC,GAAG,CAAC,KAAK,CAAC;YAAE,UAAU,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC;QAC3C,IAAI,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC;IAClB,CAAC;IACD,OAAO,CAAC,GAAG,UAAU,CAAC,CAAC;AACzB,CAAC;AAED,SAAS,YAAY,CAAC,MAA6B;IACjD,OAAO,MAAM;SACV,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE;QACb,MAAM,IAAI,GAAG,KAAK,CAAC,IAAI,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC;QACrE,OAAO,OAAO,IAAI,KAAK,KAAK,CAAC,OAAO,EAAE,CAAC;IACzC,CAAC,CAAC;SACD,IAAI,CAAC,IAAI,CAAC,CAAC;AAChB,CAAC;AAED,MAAM,sBAAsB,GAC1B,4EAA4E;IAC5E,+DAA+D;IAC/D,mEAAmE;IACnE,gEAAgE;IAChE,4DAA4D;IAC5D,yEAAyE;IACzE,2BAA2B,CAAC;AAE9B;;;;;GAKG;AACH,SAAS,iBAAiB,CAAC,KAAa;IACtC,OAAO,KAAK,YAAY,CAAC,CAAC,OAAO,IAAI,UAAU,IAAI,KAAK,CAAC;AAC3D,CAAC;AAED;;;;;;;;;;;;;;;;GAgBG;AACH,MAAM,UAAU,sBAAsB,CACpC,KAAc,EACd,IAAI,GAAG,QAAQ,EACf,YAA6B,IAAI,OAAO,EAAE;IAE1C,IAAI,KAAK,KAAK,IAAI,IAAI,OAAO,KAAK,KAAK,QAAQ;QAAE,OAAO;IAExD,IAAI,OAAO,KAAK,KAAK,UAAU;QAAE,OAAO;IAExC,yEAAyE;IACzE,IAAI,iBAAiB,CAAC,KAAK,CAAC;QAAE,OAAO;IAErC,IAAI,SAAS,CAAC,GAAG,CAAC,KAAK,CAAC,EAAE,CAAC;QACzB,MAAM,IAAI,KAAK,CACb,8CAA8C,IAAI,IAAI;YACpD,uEAAuE,sBAAsB,EAAE,CAClG,CAAC;IACJ,CAAC;IAED,MAAM,KAAK,GAAG,MAAM,CAAC,cAAc,CAAC,KAAK,CAAY,CAAC;IACtD,MAAM,OAAO,GAAG,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC;IACrC,IAAI,CAAC,OAAO,IAAI,KAAK,KAAK,MAAM,CAAC,SAAS,IAAI,KAAK,KAAK,IAAI,EAAE,CAAC;QAC7D,MAAM,IAAI,KAAK,CACb,mCAAmC,IAAI,mDAAmD;YACxF,8GAA8G,sBAAsB,EAAE,CACzI,CAAC;IACJ,CAAC;IAED,SAAS,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC;IACrB,KAAK,MAAM,GAAG,IAAI,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC;QACrC,MAAM,UAAU,GAAG,MAAM,CAAC,wBAAwB,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC;QAC/D,IAAI,UAAU,IAAI,CAAC,UAAU,CAAC,GAAG,IAAI,UAAU,CAAC,GAAG,CAAC,EAAE,CAAC;YACrD,MAAM,IAAI,KAAK,CACb,sCAAsC,IAAI,IAAI,GAAG,4CAA4C;gBAC3F,mGAAmG,sBAAsB,EAAE,CAC9H,CAAC;QACJ,CAAC;QACD,sBAAsB,CACnB,KAAiC,CAAC,GAAG,CAAC,EACvC,GAAG,IAAI,IAAI,GAAG,EAAE,EAChB,SAAS,CACV,CAAC;IACJ,CAAC;IACD,SAAS,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;AAC1B,CAAC;AAED,MAAM,MAAM,GAAG,IAAI,OAAO,EAAU,CAAC;AAErC,SAAS,aAAa,CAAC,KAAc;IACnC,IAAI,KAAK,KAAK,IAAI,IAAI,OAAO,KAAK,KAAK,QAAQ;QAAE,OAAO,KAAK,CAAC;IAC9D,MAAM,KAAK,GAAG,MAAM,CAAC,cAAc,CAAC,KAAK,CAAY,CAAC;IACtD,OAAO,KAAK,KAAK,MAAM,CAAC,SAAS,IAAI,KAAK,KAAK,IAAI,CAAC;AACtD,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,oBAAoB,CAAC,KAAc;IACjD,IAAI,KAAK,KAAK,IAAI,IAAI,OAAO,KAAK,KAAK,QAAQ;QAAE,OAAO;IACxD,IAAI,MAAM,CAAC,GAAG,CAAC,KAAK,CAAC;QAAE,OAAO;IAE9B,IAAI,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,EAAE,CAAC;QACzB,MAAM,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC;QAClB,MAAM,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;QACrB,KAAK,MAAM,IAAI,IAAI,KAAK;YAAE,oBAAoB,CAAC,IAAI,CAAC,CAAC;QACrD,OAAO;IACT,CAAC;IACD,IAAI,aAAa,CAAC,KAAK,CAAC,EAAE,CAAC;QACzB,MAAM,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC;QAClB,MAAM,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;QACrB,KAAK,MAAM,IAAI,IAAI,MAAM,CAAC,MAAM,CAAC,KAAK,CAAC;YAAE,oBAAoB,CAAC,IAAI,CAAC,CAAC;IACtE,CAAC;AACH,CAAC;AAED;;;;;;;GAOG;AACH,MAAM,UAAU,0BAA0B,CACxC,KAAc;IAEd,sBAAsB,CAAC,KAAK,CAAC,CAAC;IAE9B,MAAM,MAAM,GAAG,2BAA2B,CAAC,SAAS,CAAC,KAAK,CAAC,CAAC;IAC5D,IAAI,CAAC,MAAM,CAAC,OAAO,EAAE,CAAC;QACpB,MAAM,IAAI,GACR,OAAO,CAAC,KAAmC,aAAnC,KAAK,uBAAL,KAAK,CAAgC,IAAI,CAAA,KAAK,QAAQ;YAC5D,CAAC,CAAC,SAAU,KAA0B,CAAC,IAAI,GAAG;YAC9C,CAAC,CAAC,EAAE,CAAC;QACT,MAAM,IAAI,KAAK,CACb,iCAAiC,IAAI,KAAK;YACxC,GAAG,YAAY,CAAC,MAAM,CAAC,KAAK,CAAC,MAAM,CAAC,IAAI;YACxC,sBAAsB,CACzB,CAAC;IACJ,CAAC;IAED,yEAAyE;IACzE,6EAA6E;IAC7E,2EAA2E;IAC3E,oEAAoE;IACpE,cAAc;IACd,oBAAoB,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC;IAElC,sEAAsE;IACtE,yEAAyE;IACzE,oEAAoE;IACpE,OAAO,MAAM,CAAC,IAAwC,CAAC;AACzD,CAAC;AAED,+EAA+E;AAE/E;;;;;;;;;;GAUG;AACH,MAAM,UAAU,qBAAqB,CAAC,IAAY,EAAE,OAAe;IACjE,MAAM,UAAU,GAAG,IAAI,CAAC,OAAO,CAAC,IAAI,EAAE,GAAG,CAAC,CAAC;IAC3C,OAAO,OAAO,CAAC,UAAU,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,GAAG,UAAU,IAAI,OAAO,EAAE,CAAC;AAC/E,CAAC;AA8BD;;;;;;;;;GASG;AACH,MAAM,UAAU,8BAA8B,CAC5C,WAAgD,EAChD,aAAkC,EAAE;;IAEpC,MAAM,UAAU,GAAG,IAAI,GAAG,EAAkB,CAAC;IAC7C,MAAM,YAAY,GAAG,IAAI,GAAG,EAAoB,CAAC;IACjD,MAAM,UAAU,GAAG,IAAI,GAAG,EAAoB,CAAC;IAE/C,KAAK,MAAM,UAAU,IAAI,WAAW,EAAE,CAAC;QACrC,UAAU,CAAC,GAAG,CAAC,UAAU,CAAC,IAAI,EAAE,CAAC,MAAA,UAAU,CAAC,GAAG,CAAC,UAAU,CAAC,IAAI,CAAC,mCAAI,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC;QAC5E,KAAK,MAAM,MAAM,IAAI,MAAA,MAAA,UAAU,CAAC,UAAU,0CAAE,OAAO,mCAAI,EAAE,EAAE,CAAC;YAC1D,YAAY,CAAC,GAAG,CAAC,MAAM,CAAC,EAAE,EAAE;gBAC1B,GAAG,CAAC,MAAA,YAAY,CAAC,GAAG,CAAC,MAAM,CAAC,EAAE,CAAC,mCAAI,EAAE,CAAC;gBACtC,UAAU,CAAC,IAAI;aAChB,CAAC,CAAC;QACL,CAAC;QACD,KAAK,MAAM,IAAI,IAAI,MAAA,UAAU,CAAC,KAAK,mCAAI,EAAE,EAAE,CAAC;YAC1C,wEAAwE;YACxE,gDAAgD;YAChD,MAAM,SAAS,GAAG,qBAAqB,CAAC,UAAU,CAAC,IAAI,EAAE,IAAI,CAAC,IAAI,CAAC,CAAC;YACpE,UAAU,CAAC,GAAG,CAAC,SAAS,EAAE;gBACxB,GAAG,CAAC,MAAA,UAAU,CAAC,GAAG,CAAC,SAAS,CAAC,mCAAI,EAAE,CAAC;gBACpC,UAAU,CAAC,IAAI;aAChB,CAAC,CAAC;QACL,CAAC;IACH,CAAC;IAED,MAAM,UAAU,GAAa,EAAE,CAAC;IAEhC,KAAK,MAAM,CAAC,IAAI,EAAE,KAAK,CAAC,IAAI,UAAU,EAAE,CAAC;QACvC,IAAI,KAAK,GAAG,CAAC,EAAE,CAAC;YACd,UAAU,CAAC,IAAI,CACb,SAAS,IAAI,oBAAoB,KAAK,gFAAgF,CACvH,CAAC;QACJ,CAAC;IACH,CAAC;IACD,KAAK,MAAM,CAAC,EAAE,EAAE,MAAM,CAAC,IAAI,YAAY,EAAE,CAAC;QACxC,IAAI,MAAM,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YACtB,UAAU,CAAC,IAAI,CACb,cAAc,EAAE,qBAAqB,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,qGAAqG,CAC5J,CAAC;QACJ,CAAC;IACH,CAAC;IACD,KAAK,MAAM,CAAC,IAAI,EAAE,MAAM,CAAC,IAAI,UAAU,EAAE,CAAC;QACxC,IAAI,MAAM,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YACtB,UAAU,CAAC,IAAI,CACb,wBAAwB,IAAI,qBAAqB,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,oJAAoJ,CACvN,CAAC;QACJ,CAAC;IACH,CAAC;IAED,MAAM,aAAa,GAAG,IAAI,GAAG,CAAC,MAAA,UAAU,CAAC,KAAK,mCAAI,EAAE,CAAC,CAAC;IACtD,MAAM,eAAe,GAAG,IAAI,GAAG,CAAC,MAAA,UAAU,CAAC,SAAS,mCAAI,EAAE,CAAC,CAAC;IAC5D,MAAM,aAAa,GAAG,IAAI,GAAG,CAAC,MAAA,UAAU,CAAC,SAAS,mCAAI,EAAE,CAAC,CAAC;IAE1D,KAAK,MAAM,CAAC,IAAI,EAAE,MAAM,CAAC,IAAI,WAAW,CAAC,WAAW,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,EAAE,CAAC;QACvE,IAAI,aAAa,CAAC,GAAG,CAAC,IAAI,CAAC,EAAE,CAAC;YAC5B,UAAU,CAAC,IAAI,CACb,SAAS,IAAI,mBAAmB,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,oFAAoF,CACtI,CAAC;QACJ,CAAC;IACH,CAAC;IACD,KAAK,MAAM,CAAC,EAAE,EAAE,MAAM,CAAC,IAAI,YAAY,EAAE,CAAC;QACxC,IAAI,eAAe,CAAC,GAAG,CAAC,EAAE,CAAC,EAAE,CAAC;YAC5B,UAAU,CAAC,IAAI,CACb,cAAc,EAAE,mBAAmB,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,0IAA0I,CAC/L,CAAC;QACJ,CAAC;IACH,CAAC;IACD,KAAK,MAAM,CAAC,IAAI,EAAE,MAAM,CAAC,IAAI,UAAU,EAAE,CAAC;QACxC,IAAI,aAAa,CAAC,GAAG,CAAC,IAAI,CAAC,EAAE,CAAC;YAC5B,UAAU,CAAC,IAAI,CACb,wBAAwB,IAAI,mBAAmB,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,8HAA8H,CAC/L,CAAC;QACJ,CAAC;IACH,CAAC;IAED,IAAI,UAAU,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QAC1B,MAAM,IAAI,KAAK,CACb,oCAAoC,UAAU,CAAC,MAAM,aAAa,UAAU,CAAC,MAAM,KAAK,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,GAAG,MAAM;YACxG,UAAU,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,OAAO,IAAI,EAAE,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC;YAClD,8IAA8I,CACjJ,CAAC;IACJ,CAAC;AACH,CAAC;AAED,SAAS,WAAW,CAClB,WAAgD,EAChD,MAA0D;;IAE1D,MAAM,MAAM,GAAG,IAAI,GAAG,EAAoB,CAAC;IAC3C,KAAK,MAAM,UAAU,IAAI,WAAW,EAAE,CAAC;QACrC,KAAK,MAAM,GAAG,IAAI,MAAM,CAAC,UAAU,CAAC,EAAE,CAAC;YACrC,MAAM,CAAC,GAAG,CAAC,GAAG,EAAE,CAAC,GAAG,CAAC,MAAA,MAAM,CAAC,GAAG,CAAC,GAAG,CAAC,mCAAI,EAAE,CAAC,EAAE,UAAU,CAAC,IAAI,CAAC,CAAC,CAAC;QACjE,CAAC;IACH,CAAC;IACD,OAAO,MAAM,CAAC;AAChB,CAAC","sourcesContent":["/**\n * The canonical integration-definition contract: ONE zod schema and ONE set\n * of inferred/hand-written types (F9). `@ekanos/sdk`'s `defineIntegration()`\n * validates against this schema at authoring time; `@kit/integrations-core`'s\n * `registerPartnerIntegration()` re-validates against the SAME schema at the\n * host trust boundary (F3). Both packages depend on this one; it depends on\n * neither, so there is no cycle and no hand-written structural twin.\n *\n * Dependency-pure (zod only): partner component refs are checked\n * structurally via `ComponentReference`, so no React dependency leaks in.\n */\nimport { z } from 'zod';\n\nimport type {\n  IntegrationContext,\n  StorageKeyDeclarationInput,\n  StorageSchemas,\n} from './capability-context';\nimport type { ComponentReference } from './component-reference';\nimport { isComponentReference } from './component-reference';\nimport {\n  type WorkspaceTargetDefinition,\n  WorkspaceTargetListSchema,\n} from './workspace-target';\n\n// ---- JSON-compatible values (F4) ------------------------------------------\n\ntype JsonPrimitive = string | number | boolean | null;\nexport type JsonValue =\n  | JsonPrimitive\n  | JsonValue[]\n  | { [key: string]: JsonValue };\n\nconst jsonValueSchema: z.ZodType<JsonValue> = z.lazy(() =>\n  z.union([\n    z.string(),\n    // `.finite()` rejects Infinity/-Infinity AND NaN (Number.isFinite) — all\n    // of which JSON.stringify silently turns to `null`, so they are not\n    // JSON-compatible values (F4).\n    z.number().finite(),\n    z.boolean(),\n    z.null(),\n    z.array(jsonValueSchema),\n    z.record(jsonValueSchema),\n  ]),\n);\n\n// ---- Leaf validators -------------------------------------------------------\n\nfunction componentRefSchema(what: string) {\n  return z.custom<ComponentReference>(isComponentReference, {\n    message: `${what} must be a React component reference (a function component, or a memo/forwardRef/lazy wrapper) — pass the component itself, not an element or a module path.`,\n  });\n}\n\nconst zodSchemaRef = z.custom<z.ZodType>(\n  (value) =>\n    typeof (value as { safeParse?: unknown } | null)?.safeParse === 'function',\n  {\n    message:\n      'Every storage key must declare a zod schema (e.g. z.object({ … })) — ctx.storage validates reads and writes against it (capability-context ruling 1).',\n  },\n);\n\nconst nonEmpty = (what: string) =>\n  z.string().min(1, { message: `${what} must be a non-empty string.` });\n\nconst slugSchema = z.string().regex(/^[a-z0-9]+(?:-[a-z0-9]+)*$/, {\n  message:\n    'slug must be kebab-case ([a-z0-9] segments separated by single hyphens), e.g. \"acme-crm\" — it becomes the product slug, route segment, and MCP namespace.',\n});\n\nconst widgetIdSchema = z.string().regex(/^[a-z0-9]+(?:-[a-z0-9]+)*$/, {\n  message:\n    'Widget ids are kebab-case and globally unique, e.g. \"acme-crm-pipeline\" — prefix with the integration slug to stay collision-free.',\n});\n\nconst storageKeySchema = z.string().regex(/^[a-z0-9_-]+(?:\\/[a-z0-9_-]+)?$/, {\n  message:\n    'Storage keys are \"<dataType>\" or \"<dataType>/<subtype>\" in lowercase [a-z0-9_-] — they map onto the account/user product-data columns (capability-context ruling 6).',\n});\n\nconst toolNameSchema = z.string().regex(/^[a-z][a-z0-9_]*$/, {\n  message:\n    'Tool names are lowercase snake_case starting with a letter, e.g. \"list_invoices\" — the model calls them by this exact string.',\n});\n\nconst webhookIdSchema = z.string().regex(/^[a-z0-9]+(?:-[a-z0-9]+)*$/, {\n  message:\n    'Webhook ids are kebab-case, e.g. \"payment-updated\" — the host ingress route addresses the handler by this exact string.',\n});\n\nconst scheduleIdSchema = z.string().regex(/^[a-z0-9]+(?:-[a-z0-9]+)*$/, {\n  message:\n    'Schedule ids are kebab-case, e.g. \"daily-reconcile\" — the host scheduler addresses the handler by this exact string.',\n});\n\n// Origin-only egress entries (ruling 3): absolute https origins, optional\n// `*.` subdomain wildcard, no path/query/hash/credentials/http. Kept as a\n// pure regex here so this package depends on nothing; the SDK's shared\n// `parseEgressEntry`/`isEgressAllowed` matcher enforces the identical shape\n// at runtime.\nconst egressEntrySchema = z.string().superRefine((entry, ctx) => {\n  const match = /^https:\\/\\/(\\*\\.)?([a-z0-9.-]+)(?::(\\d+))?$/i.exec(entry);\n  if (!match) {\n    ctx.addIssue({\n      code: z.ZodIssueCode.custom,\n      message:\n        `Egress entry \"${entry}\" is invalid. Entries are https origins only — ` +\n        `\"https://api.example.com\" (exact) or \"https://*.example.com\" ` +\n        `(subdomain wildcard): scheme + host + optional port, no path, query, ` +\n        `hash, credentials, or http. Fix it in the integration's egress list.`,\n    });\n    return;\n  }\n  const host = match[2] ?? '';\n  if (host.includes('*') || host.startsWith('.') || host.endsWith('.')) {\n    ctx.addIssue({\n      code: z.ZodIssueCode.custom,\n      message: `Egress entry \"${entry}\" has a malformed host — wildcards are only supported as a single leading \"*.\" (e.g. \"https://*.example.com\").`,\n    });\n  }\n});\n\n// ---- Sub-object schemas ----------------------------------------------------\n\nconst capabilitySchema = z\n  .object({\n    label: nonEmpty('capabilities[].label'),\n    description: nonEmpty('capabilities[].description'),\n    icon: componentRefSchema('capabilities[].icon').optional(),\n  })\n  .strict();\n\nconst permissionSchema = z\n  .object({\n    label: nonEmpty('permissions[].label'),\n    detail: nonEmpty('permissions[].detail'),\n    type: z.enum(['read', 'write']),\n  })\n  .strict();\n\nconst gridUnitSchema = z\n  .object({\n    cols: z.number().int().positive(),\n    rows: z.number().int().positive(),\n  })\n  .strict();\n\nconst layoutBoxSchema = z\n  .object({\n    x: z.number(),\n    y: z.number(),\n    w: z.number(),\n    h: z.number(),\n    maxHeight: z.number().optional(),\n  })\n  .strict();\n\n/**\n * F7: authorable widget fields ONLY. Host-resolved fields (`productId`,\n * `widgetConfigId`, `workspaceId`, `collapsed`, `isPinned`, `health`,\n * `integrationMetadata`) are absent by design and rejected at runtime by\n * `.strict()` — the type and the runtime agree. The host adapter maps this\n * into the full `WidgetConfig`.\n */\nconst widgetSchema = z\n  .object({\n    id: widgetIdSchema,\n    name: nonEmpty('widgets[].name'),\n    component: componentRefSchema('widgets[].component'),\n    widgetState: z.enum(['active', 'inactive', 'disabled']),\n    gridSize: z.union([gridUnitSchema, z.array(gridUnitSchema)]).optional(),\n    gridPosition: z\n      .object({ col: z.number(), row: z.number() })\n      .strict()\n      .optional(),\n    layouts: z\n      .object({\n        lg: layoutBoxSchema.optional(),\n        md: layoutBoxSchema.optional(),\n        sm: layoutBoxSchema.optional(),\n      })\n      .strict()\n      .optional(),\n    category: z\n      .object({\n        id: z.string(),\n        name: z.string(),\n        slug: z.string(),\n        icon: z.string().nullable(),\n      })\n      .strict()\n      .optional(),\n    isCollapsible: z.boolean().optional(),\n    isPinnable: z.boolean().optional(),\n    aiFooterEnabled: z.boolean().optional(),\n  })\n  .strict();\n\nconst toolParametersSchema = z\n  .object({\n    type: z.literal('object'),\n    properties: z.record(jsonValueSchema).optional(),\n    required: z.array(z.string()).optional(),\n    additionalProperties: z.boolean().optional(),\n  })\n  .strict();\n\nconst toolRunSchema = z.custom<\n  (ctx: never, args: Record<string, unknown>) => Promise<unknown>\n>((value) => typeof value === 'function', {\n  message:\n    'tools[].run must be a function (ctx, args) => Promise<result> — it receives the host-scoped IntegrationContext, never a raw client.',\n});\n\nconst toolSchema = z\n  .object({\n    name: toolNameSchema,\n    description: nonEmpty('tools[].description'),\n    parameters: toolParametersSchema.optional(),\n    run: toolRunSchema,\n    outputExample: z.record(jsonValueSchema).optional(),\n  })\n  .strict();\n\n// ---- Event surfaces (webhooks, schedules, OAuth) ---------------------------\n//\n// Declared exactly like MCP tools: metadata parsed strictly, handlers checked\n// structurally as functions (`z.custom`) and carried through the parse\n// untouched. The declarations are the CONTRACT; every transport — the local\n// harness today, the host's public ingress/scheduler/hosted-callback later —\n// binds to these same fields, so a partner package never changes when the\n// real transports arrive.\n\nfunction handlerSchema(what: string, shape: string) {\n  return z.custom<(ctx: never, arg: never) => Promise<unknown>>(\n    (value) => typeof value === 'function',\n    {\n      message: `${what} must be a function ${shape} — it receives the host-scoped IntegrationContext, never a raw request or client.`,\n    },\n  );\n}\n\nconst payloadSchemaRef = z.custom<z.ZodType>(\n  (value) =>\n    typeof (value as { safeParse?: unknown } | null)?.safeParse === 'function',\n  {\n    message:\n      'webhooks[].payloadSchema must be a zod schema (e.g. z.object({ … })) — the transport validates every delivery against it before the handler runs.',\n  },\n);\n\n/**\n * How the TRANSPORT verifies a delivery. Verification is never the partner's\n * job: the declaration names the signature header and the secret that signs\n * it; the host ingress enforces it (the local harness logs it as skipped).\n * `'none'` is an explicit statement that the source is unsigned.\n */\nconst webhookSignatureSchema = z.union([\n  z.literal('none'),\n  z\n    .object({\n      header: nonEmpty('webhooks[].signature.header'),\n      secretName: nonEmpty('webhooks[].signature.secretName'),\n    })\n    .strict(),\n]);\n\nconst webhookSchema = z\n  .object({\n    id: webhookIdSchema,\n    description: nonEmpty('webhooks[].description'),\n    payloadSchema: payloadSchemaRef,\n    signature: webhookSignatureSchema,\n    examplePayload: z.record(jsonValueSchema).optional(),\n    handler: handlerSchema(\n      'webhooks[].handler',\n      '(ctx, event) => Promise<WebhookResult>',\n    ),\n  })\n  .strict();\n\nconst scheduleSchema = z\n  .object({\n    id: scheduleIdSchema,\n    description: nonEmpty('schedules[].description'),\n    // Presence only here — the dependency-pure schema package stays zod-only,\n    // so the real 5-field cron syntax check lives in the SDK layer\n    // (`defineIntegration()`), the same way it layers cross-field rules today.\n    cron: nonEmpty('schedules[].cron'),\n    handler: handlerSchema(\n      'schedules[].handler',\n      '(ctx, invocation) => Promise<ScheduleResult>',\n    ),\n  })\n  .strict();\n\nconst httpsUrlSchema = (what: string) =>\n  z.string().superRefine((value, ctx) => {\n    let parsed: URL;\n    try {\n      parsed = new URL(value);\n    } catch {\n      ctx.addIssue({\n        code: z.ZodIssueCode.custom,\n        message: `${what} must be an absolute URL, e.g. \"https://provider.example/oauth/authorize\".`,\n      });\n      return;\n    }\n    if (parsed.protocol !== 'https:') {\n      ctx.addIssue({\n        code: z.ZodIssueCode.custom,\n        message: `${what} must use https — OAuth endpoints are never plain http.`,\n      });\n    }\n    if (parsed.username !== '' || parsed.password !== '') {\n      ctx.addIssue({\n        code: z.ZodIssueCode.custom,\n        message: `${what} must not embed credentials.`,\n      });\n    }\n  });\n\nconst oauthSchema = z\n  .object({\n    provider: z\n      .object({\n        authorizationUrl: httpsUrlSchema('oauth.provider.authorizationUrl'),\n        tokenUrl: httpsUrlSchema('oauth.provider.tokenUrl'),\n        scopes: z.array(nonEmpty('oauth.provider.scopes[]')),\n        pkce: z.boolean().optional(),\n      })\n      .strict(),\n    credentials: z\n      .object({\n        clientIdSecretName: nonEmpty('oauth.credentials.clientIdSecretName'),\n        clientSecretSecretName: nonEmpty(\n          'oauth.credentials.clientSecretSecretName',\n        ),\n      })\n      .strict(),\n    onTokens: handlerSchema('oauth.onTokens', '(ctx, tokens) => Promise<void>'),\n  })\n  .strict();\n\nconst toolClassificationProposalSchema = z\n  .object({\n    effect: z.enum(['read', 'write']).optional(),\n    sensitivity: z.enum(['public', 'internal', 'pii', 'financial']).optional(),\n  })\n  .strict();\n\nconst proposalsSchema = z\n  .object({\n    credentialModel: z.enum(['account', 'user', 'source']).optional(),\n    tools: z.record(toolClassificationProposalSchema).optional(),\n  })\n  .strict();\n\n/**\n * A storage key's EXPLICIT declaration: the zod schema plus its exposure\n * flags. `clientReadable` is the only way a declared key becomes readable by\n * the browser through the generic storage route — and it defaults to false,\n * so the bare-schema form stays server-only exactly as it always was.\n * `.strict()` keeps an unrecognized flag (a typo like `clientReadible`) an\n * error rather than a silently-ignored key whose author believes it is\n * exposed — or, worse, believes it is not.\n */\nconst storageKeyDeclarationSchema = z\n  .object({\n    schema: zodSchemaRef,\n    clientReadable: z.boolean().optional(),\n  })\n  .strict();\n\n/** Duck-typed so a partner's own bundled zod copy still reads as a schema. */\nfunction isZodSchemaLike(value: unknown): boolean {\n  return (\n    typeof (value as { safeParse?: unknown } | null)?.safeParse === 'function'\n  );\n}\n\n/**\n * Either declaration form, hand-routed rather than expressed as `z.union` so\n * the failure message stays specific. A union reports a bare \"Invalid input\"\n * for every wrong shape, which would lose both the \"declare a zod schema\"\n * guidance AND the strict-descriptor typo report — the two errors an author\n * is actually going to hit.\n */\nconst storageKeyDeclarationRef = z\n  .custom<StorageKeyDeclarationInput>(() => true)\n  .superRefine((value, ctx) => {\n    if (isZodSchemaLike(value)) return;\n\n    const looksLikeDescriptor =\n      value !== null && typeof value === 'object' && !Array.isArray(value);\n\n    // Neither form: name both, since the descriptor is the less obvious one.\n    if (\n      !looksLikeDescriptor ||\n      !isZodSchemaLike((value as { schema?: unknown }).schema)\n    ) {\n      ctx.addIssue({\n        code: z.ZodIssueCode.custom,\n        message:\n          'Every storage key must declare either a zod schema (e.g. z.object({ … })) or a { schema, clientReadable } descriptor — ctx.storage validates reads and writes against the schema (capability-context ruling 1), and clientReadable (default false) is what opts the key in to the browser-readable storage route.',\n      });\n      return;\n    }\n\n    // A real descriptor with a real schema — report its own issues verbatim\n    // (an unrecognized flag, a non-boolean clientReadable) rather than the\n    // generic message, which would send the author looking in the wrong place.\n    const result = storageKeyDeclarationSchema.safeParse(value);\n    if (result.success) return;\n\n    for (const issue of result.error.issues) {\n      ctx.addIssue({\n        code: z.ZodIssueCode.custom,\n        path: issue.path,\n        message: issue.message,\n      });\n    }\n  });\n\nconst storageScopeSchema = z.record(storageKeySchema, storageKeyDeclarationRef);\n\nconst componentsSchema = z\n  .object({\n    activationForm: componentRefSchema('components.activationForm').optional(),\n    marketplaceTile: componentRefSchema(\n      'components.marketplaceTile',\n    ).optional(),\n    widgets: z.array(widgetSchema).optional(),\n  })\n  .strict();\n\n/**\n * THE canonical schema. Strict everywhere: an unrecognized key is an error,\n * which is what keeps host-assigned fields (productId, kind, trust tier,\n * credentialModel, per-tool effect/sensitivity, host-resolved widget fields)\n * structurally un-settable at runtime, not merely absent from the type.\n */\nexport const IntegrationDefinitionSchema = z\n  .object({\n    slug: slugSchema,\n    name: nonEmpty('name'),\n    description: nonEmpty('description'),\n    version: z\n      .string()\n      .regex(\n        /^\\d+\\.\\d+\\.\\d+(?:-[0-9A-Za-z-]+(?:\\.[0-9A-Za-z-]+)*)?(?:\\+[0-9A-Za-z-]+(?:\\.[0-9A-Za-z-]+)*)?$/,\n        {\n          message:\n            'version must be semver (\"1.0.0\", optionally with a prerelease/build suffix) — promotion diffs definitions by it.',\n        },\n      ),\n    capabilities: z.array(capabilitySchema).optional(),\n    permissions: z.array(permissionSchema).optional(),\n    components: componentsSchema.optional(),\n    workspaceTargets: WorkspaceTargetListSchema.optional(),\n    tools: z.array(toolSchema).optional(),\n    storage: z\n      .object({\n        account: storageScopeSchema.optional(),\n        user: storageScopeSchema.optional(),\n      })\n      .strict()\n      .optional(),\n    egress: z.array(egressEntrySchema).optional(),\n    webhooks: z.array(webhookSchema).optional(),\n    schedules: z.array(scheduleSchema).optional(),\n    oauth: oauthSchema.optional(),\n    proposes: proposalsSchema.optional(),\n  })\n  .strict()\n  .superRefine((definition, ctx) => {\n    const webhookIds = (definition.webhooks ?? []).map((w) => w.id);\n    for (const id of findDuplicates(webhookIds)) {\n      ctx.addIssue({\n        code: z.ZodIssueCode.custom,\n        path: ['webhooks'],\n        message: `Webhook id \"${id}\" is declared more than once — give every webhook a unique id.`,\n      });\n    }\n\n    const scheduleIds = (definition.schedules ?? []).map((s) => s.id);\n    for (const id of findDuplicates(scheduleIds)) {\n      ctx.addIssue({\n        code: z.ZodIssueCode.custom,\n        path: ['schedules'],\n        message: `Schedule id \"${id}\" is declared more than once — give every schedule a unique id.`,\n      });\n    }\n\n    const widgetIds = (definition.components?.widgets ?? []).map((w) => w.id);\n    for (const id of findDuplicates(widgetIds)) {\n      ctx.addIssue({\n        code: z.ZodIssueCode.custom,\n        path: ['components', 'widgets'],\n        message: `Widget id \"${id}\" is declared more than once — give every widget a unique id.`,\n      });\n    }\n\n    const toolNames = (definition.tools ?? []).map((tool) => tool.name);\n    for (const name of findDuplicates(toolNames)) {\n      ctx.addIssue({\n        code: z.ZodIssueCode.custom,\n        path: ['tools'],\n        message: `Tool \"${name}\" is declared more than once — give every tool a unique name.`,\n      });\n    }\n\n    const declaredTools = new Set(toolNames);\n    for (const proposedName of Object.keys(definition.proposes?.tools ?? {})) {\n      if (!declaredTools.has(proposedName)) {\n        ctx.addIssue({\n          code: z.ZodIssueCode.custom,\n          path: ['proposes', 'tools', proposedName],\n          message: `proposes.tools[\"${proposedName}\"] does not match any declared tool — proposals are keyed by the exact tool name in \\`tools\\`.`,\n        });\n      }\n    }\n  });\n\n// ---- Hand-written generic types (the parts a non-generic schema cannot\n// express) plus inferred types for everything else. One home, imported by\n// both @ekanos/sdk and @kit/integrations-core. -------------------------------\n\nexport type ToolClassificationProposal = z.infer<\n  typeof toolClassificationProposalSchema\n>;\nexport type IntegrationProposals = z.infer<typeof proposalsSchema>;\nexport type PartnerToolParameters = z.infer<typeof toolParametersSchema>;\nexport type IntegrationCapabilityDeclaration = z.infer<typeof capabilitySchema>;\nexport type IntegrationPermissionDeclaration = z.infer<typeof permissionSchema>;\nexport type PartnerWidgetDeclaration = z.infer<typeof widgetSchema>;\n\nexport interface PartnerToolModule<\n  Schemas extends StorageSchemas = StorageSchemas,\n> {\n  name: string;\n  description: string;\n  parameters?: PartnerToolParameters;\n  /**\n   * Contravariant function property (F8): the declared `Schemas` generic\n   * types `ctx.storage` for the author. The generic cannot survive the\n   * by-value, monomorphic host registration boundary — the adapter erases it\n   * — but nothing rests on it surviving: the host constructs `ctx` FROM the\n   * definition's own `storage` schemas, and `ctx.storage` validates every\n   * read/write against them at runtime regardless of the handler's\n   * annotation. The static generic is DX; the runtime schema is the guard.\n   */\n  run: (\n    ctx: IntegrationContext<Schemas>,\n    args: Record<string, unknown>,\n  ) => Promise<unknown>;\n  outputExample?: Record<string, JsonValue>;\n}\n\nexport interface IntegrationComponentDeclarations {\n  activationForm?: ComponentReference;\n  marketplaceTile?: ComponentReference;\n  widgets?: PartnerWidgetDeclaration[];\n}\n\n// ---- Event-surface types (webhooks, schedules, OAuth) ----------------------\n//\n// Hand-written generics like `PartnerToolModule`: the `Schemas` generic types\n// `ctx.storage` for the author and is erased at the host boundary, where the\n// runtime storage validator — built from the definition's own `storage`\n// schemas — is the guard.\n\n/**\n * How the transport verifies a webhook delivery. `'none'` states explicitly\n * that the source is unsigned; otherwise the transport reads the named header\n * and verifies it against the named secret. Verification is the TRANSPORT's\n * job (the local harness logs it as skipped; the host ingress enforces it) —\n * never the partner handler's.\n */\nexport type WebhookSignatureDeclaration =\n  | 'none'\n  | { header: string; secretName: string };\n\n/**\n * One delivery, as the handler receives it: transport-assigned id and receipt\n * time, the delivery headers, and the payload ALREADY parsed and validated\n * against the declaration's `payloadSchema`. A payload that fails the schema\n * never reaches the handler.\n */\nexport interface WebhookEvent {\n  id: string;\n  /** ISO-8601 — when the transport accepted the delivery. */\n  receivedAt: string;\n  headers: Record<string, string>;\n  /** The parsed, schema-validated payload (output of `payloadSchema`). */\n  payload: unknown;\n}\n\n/**\n * What the handler tells the transport. `processed` acknowledges the event;\n * `ignored` acknowledges it as irrelevant (still a 2xx — the sender must not\n * retry). A handler that cannot process a valid event THROWS, which the\n * transport maps to a retryable failure.\n */\nexport interface WebhookResult {\n  status: 'processed' | 'ignored';\n  detail?: string;\n}\n\nexport interface PartnerWebhookDeclaration<\n  Schemas extends StorageSchemas = StorageSchemas,\n> {\n  id: string;\n  description: string;\n  /** Validates every delivery before the handler runs. */\n  payloadSchema: z.ZodType;\n  signature: WebhookSignatureDeclaration;\n  /**\n   * A representative payload, JSON-compatible. Seeds the harness's payload\n   * editor and documents the shape beside the schema.\n   */\n  examplePayload?: Record<string, JsonValue>;\n  handler: (\n    ctx: IntegrationContext<Schemas>,\n    event: WebhookEvent,\n  ) => Promise<WebhookResult>;\n}\n\n/**\n * One firing, as the handler receives it. `trigger` distinguishes the real\n * scheduler from a human pressing \"Run now\" (harness or admin) — handlers may\n * branch on it (e.g. skip idempotency windows for manual runs) but must be\n * safe under both.\n */\nexport interface ScheduleInvocation {\n  /** ISO-8601 — the tick this invocation stands for. */\n  scheduledFor: string;\n  /** ISO-8601 — when the handler actually started. */\n  invokedAt: string;\n  trigger: 'schedule' | 'manual';\n}\n\n/**\n * `completed` means the run did its work; `skipped` means it correctly did\n * nothing (not configured, nothing to do). A handler that fails THROWS, which\n * the transport records as a failed run.\n */\nexport interface ScheduleResult {\n  status: 'completed' | 'skipped';\n  detail?: string;\n}\n\nexport interface PartnerScheduleDeclaration<\n  Schemas extends StorageSchemas = StorageSchemas,\n> {\n  id: string;\n  description: string;\n  /**\n   * Standard 5-field cron (minute hour day-of-month month day-of-week),\n   * validated by `defineIntegration()`. The schema package checks presence\n   * only — full syntax validation is the SDK layer's job.\n   */\n  cron: string;\n  handler: (\n    ctx: IntegrationContext<Schemas>,\n    invocation: ScheduleInvocation,\n  ) => Promise<ScheduleResult>;\n}\n\n/**\n * The token set the transport hands `onTokens` after a code exchange (and\n * after each refresh). `raw` carries provider-specific extras verbatim.\n */\nexport interface OAuthTokens {\n  accessToken: string;\n  refreshToken?: string;\n  /** ISO-8601 expiry, when the provider reports one. */\n  expiresAt?: string;\n  scope?: string;\n  tokenType?: string;\n  raw?: Record<string, JsonValue>;\n}\n\nexport interface OAuthProviderDeclaration {\n  authorizationUrl: string;\n  tokenUrl: string;\n  scopes: string[];\n  pkce?: boolean;\n}\n\n/**\n * The OAuth contract. The TRANSPORT owns the flow (authorize redirect, state,\n * callback, code exchange — localhost in the harness, hosted later); the\n * partner declares the provider endpoints, names the client-credential\n * secrets, and persists tokens in `onTokens` via `ctx.secrets` — so token\n * storage policy is the existing capability layer, nothing new.\n * `defineIntegration()` rejects the declaration unless both endpoint origins\n * are covered by the definition's `egress` list.\n */\nexport interface PartnerOAuthDeclaration<\n  Schemas extends StorageSchemas = StorageSchemas,\n> {\n  provider: OAuthProviderDeclaration;\n  credentials: {\n    clientIdSecretName: string;\n    clientSecretSecretName: string;\n  };\n  onTokens: (\n    ctx: IntegrationContext<Schemas>,\n    tokens: OAuthTokens,\n  ) => Promise<void>;\n}\n\nexport interface IntegrationDefinition<\n  Schemas extends StorageSchemas = StorageSchemas,\n> {\n  slug: string;\n  name: string;\n  description: string;\n  version: string;\n  capabilities?: IntegrationCapabilityDeclaration[];\n  permissions?: IntegrationPermissionDeclaration[];\n  components?: IntegrationComponentDeclarations;\n  workspaceTargets?: WorkspaceTargetDefinition[];\n  tools?: PartnerToolModule<Schemas>[];\n  storage?: Schemas;\n  egress?: string[];\n  webhooks?: PartnerWebhookDeclaration<Schemas>[];\n  schedules?: PartnerScheduleDeclaration<Schemas>[];\n  oauth?: PartnerOAuthDeclaration<Schemas>;\n  proposes?: IntegrationProposals;\n}\n\n// ---- Shared helpers --------------------------------------------------------\n\nfunction findDuplicates(values: readonly string[]): string[] {\n  const seen = new Set<string>();\n  const duplicates = new Set<string>();\n  for (const value of values) {\n    if (seen.has(value)) duplicates.add(value);\n    seen.add(value);\n  }\n  return [...duplicates];\n}\n\nfunction formatIssues(issues: readonly z.ZodIssue[]): string {\n  return issues\n    .map((issue) => {\n      const path = issue.path.length > 0 ? issue.path.join('.') : '(root)';\n      return `  - ${path}: ${issue.message}`;\n    })\n    .join('\\n');\n}\n\nconst HOST_ASSIGNED_REMINDER =\n  'Host-assigned fields are never partner-authorable: productId, kind, trust ' +\n  'tier, and machine exposure (credentialModel) do not exist on ' +\n  'IntegrationDefinition, per-tool effect/sensitivity belong in the ' +\n  '`proposes` block, and host-resolved widget fields (productId, ' +\n  'widgetConfigId, workspaceId, collapsed, isPinned, health, ' +\n  'integrationMetadata) are populated by the platform at runtime — remove ' +\n  'them from the definition.';\n\n/**\n * A zod schema (storage leaf) — detected via `instanceof` so we NEVER read a\n * property (like `.safeParse`) that could be a malicious getter (F4). A React\n * exotic (`memo`/`forwardRef`) is an object tagged with `$$typeof`; the `in`\n * check uses [[HasProperty]], which does not invoke a getter either.\n */\nfunction isDeclarationLeaf(value: object): boolean {\n  return value instanceof z.ZodType || '$$typeof' in value;\n}\n\n/**\n * F4: reject accessor/proxy/class-instance/cyclic declaration containers\n * before parsing. An object with getters (or a proxy) can return validated\n * values during parse and different values later; a non-plain prototype can\n * smuggle mutable state past `z.object()`; a cycle would recurse into zod\n * rather than fail cleanly. We walk every CONTAINER (plain object / array),\n * and stop at legitimate leaves: functions (component refs, `run`) and zod\n * schemas (storage). Leaf detection happens BEFORE any own-property read, so\n * a `safeParse` getter cannot execute. Proxy detection is best-effort — the\n * re-parse at the host boundary (which materializes fresh values via zod) is\n * the real guard.\n *\n * Cycle detection tracks the ANCESTOR chain only (add on enter, remove on\n * exit): a genuine back-edge is a cycle, but the same object referenced from\n * two sibling branches (a DAG — e.g. a shallow-cloned widget sharing a\n * `layouts` object) is not, and must not be rejected.\n */\nexport function assertPlainDeclaration(\n  value: unknown,\n  path = '(root)',\n  ancestors: WeakSet<object> = new WeakSet(),\n): void {\n  if (value === null || typeof value !== 'object') return;\n\n  if (typeof value === 'function') return;\n\n  // Leaf detection first — instanceof / HasProperty never invoke a getter.\n  if (isDeclarationLeaf(value)) return;\n\n  if (ancestors.has(value)) {\n    throw new Error(\n      `Integration definition contains a cycle at ${path}. ` +\n        `Declarations must be finite plain data — remove the self-reference. ${HOST_ASSIGNED_REMINDER}`,\n    );\n  }\n\n  const proto = Object.getPrototypeOf(value) as unknown;\n  const isArray = Array.isArray(value);\n  if (!isArray && proto !== Object.prototype && proto !== null) {\n    throw new Error(\n      `Integration definition value at ${path} is a class/exotic instance, not a plain object. ` +\n        `Declaration containers must be plain object/array literals so their values cannot mutate after validation. ${HOST_ASSIGNED_REMINDER}`,\n    );\n  }\n\n  ancestors.add(value);\n  for (const key of Object.keys(value)) {\n    const descriptor = Object.getOwnPropertyDescriptor(value, key);\n    if (descriptor && (descriptor.get || descriptor.set)) {\n      throw new Error(\n        `Integration definition property at ${path}.${key} is a getter/setter, not a data property. ` +\n          `Declaration values must be plain data — a getter can return a different value after validation. ${HOST_ASSIGNED_REMINDER}`,\n      );\n    }\n    assertPlainDeclaration(\n      (value as Record<string, unknown>)[key],\n      `${path}.${key}`,\n      ancestors,\n    );\n  }\n  ancestors.delete(value);\n}\n\nconst frozen = new WeakSet<object>();\n\nfunction isPlainObject(value: unknown): value is Record<string, unknown> {\n  if (value === null || typeof value !== 'object') return false;\n  const proto = Object.getPrototypeOf(value) as unknown;\n  return proto === Object.prototype || proto === null;\n}\n\n/**\n * Cycle-aware deep freeze (F4). Freezes plain objects and arrays; leaves zod\n * schemas (freezing breaks their internal caches) and functions alone.\n */\nexport function deepFreezeDefinition(value: unknown): void {\n  if (value === null || typeof value !== 'object') return;\n  if (frozen.has(value)) return;\n\n  if (Array.isArray(value)) {\n    frozen.add(value);\n    Object.freeze(value);\n    for (const item of value) deepFreezeDefinition(item);\n    return;\n  }\n  if (isPlainObject(value)) {\n    frozen.add(value);\n    Object.freeze(value);\n    for (const item of Object.values(value)) deepFreezeDefinition(item);\n  }\n}\n\n/**\n * The single validation entry point used by BOTH `defineIntegration()` (SDK,\n * authoring time) and `registerPartnerIntegration()` (core, host trust\n * boundary — F3). Rejects non-plain containers, then parses against the\n * canonical schema, and returns the SANITIZED `result.data` (fresh, plain,\n * strict-stripped — never the caller's original object). Throws an Error\n * whose message is a remediation instruction.\n */\nexport function parseIntegrationDefinition(\n  input: unknown,\n): IntegrationDefinition {\n  assertPlainDeclaration(input);\n\n  const result = IntegrationDefinitionSchema.safeParse(input);\n  if (!result.success) {\n    const slug =\n      typeof (input as { slug?: unknown } | null)?.slug === 'string'\n        ? ` for \"${(input as { slug: string }).slug}\"`\n        : '';\n    throw new Error(\n      `Invalid integration definition${slug}:\\n` +\n        `${formatIssues(result.error.issues)}\\n` +\n        HOST_ASSIGNED_REMINDER,\n    );\n  }\n\n  // F4: freeze inside the canonical parser so BOTH defineIntegration() and\n  // registerPartnerIntegration() register immutable output — the host boundary\n  // no longer hands back mutable arrays. Function/zod leaves stay executable\n  // by design (the T1 model), so this is structural immutability, not\n  // behavioral.\n  deepFreezeDefinition(result.data);\n\n  // The schema's inferred output matches IntegrationDefinition in every\n  // non-generic field; the storage/tool generics default to the permissive\n  // base, which is exactly right for the loose registration boundary.\n  return result.data as unknown as IntegrationDefinition;\n}\n\n// ---- Cross-definition collision detection (F5) -----------------------------\n\n/**\n * THE canonical effective MCP tool name — the single source of truth for how\n * discovery keys a tool. Tool discovery namespaces each raw tool name with the\n * integration slug (`slug.replace(/-/g,'_')`), skipping the prefix when the\n * name already carries it. Two collision-free RAW pairs can therefore collapse\n * to the same EFFECTIVE name (`{slug:\"foo\",tool:\"bar_baz\"}` and\n * `{slug:\"foo-bar\",tool:\"baz\"}` both become `foo_bar_baz`), so collision\n * checking MUST compare effective names, and runtime discovery MUST throw on a\n * duplicate assignment. Both call this one helper\n * (`packages/agents/src/tools/tool-discovery.ts`).\n */\nexport function getDiscoveredToolName(slug: string, rawName: string): string {\n  const slugPrefix = slug.replace(/-/g, '_');\n  return rawName.startsWith(slugPrefix) ? rawName : `${slugPrefix}_${rawName}`;\n}\n\n/**\n * The metadata-only shape collision checking needs — no handlers, no schemas\n * (F8: collision validation must not force widening the tool handlers). A\n * full `IntegrationDefinition` is assignable to it.\n */\nexport interface DefinitionCollisionInput {\n  slug: string;\n  components?: { widgets?: readonly { id: string }[] } | null;\n  tools?: readonly { name: string }[] | null;\n}\n\n/**\n * First-party identifiers a partner definition must not collide with (F5).\n * Widget lookup matches on `widget.id` and the assistant's tool list is a\n * flat name-keyed map where a later registration overwrites an earlier one,\n * so a partner reusing a first-party id/name silently hijacks it. Sourced\n * from the reviewed registry inventory, not from executing partner handlers.\n */\nexport interface FirstPartyInventory {\n  slugs?: readonly string[];\n  widgetIds?: readonly string[];\n  /**\n   * EFFECTIVE (discovery) tool names — `getDiscoveredToolName(slug, rawName)` —\n   * NOT raw names, since discovery keys the flat registry by the effective name.\n   */\n  toolNames?: readonly string[];\n}\n\n/**\n * Detects cross-definition collisions (duplicate slugs, widget ids, tool\n * names across the partner set) AND collisions against the first-party\n * inventory, throwing one error listing EVERY collision.\n *\n * This is the build-time gate the host registry deliberately lacks:\n * `integrationRegistry.register()` keys by slug via `Map.set` and silently\n * OVERWRITES, and duplicate widget/tool ids resolve last- or\n * first-registration-wins by import order.\n */\nexport function validateIntegrationDefinitions(\n  definitions: readonly DefinitionCollisionInput[],\n  firstParty: FirstPartyInventory = {},\n): void {\n  const slugCounts = new Map<string, number>();\n  const widgetOwners = new Map<string, string[]>();\n  const toolOwners = new Map<string, string[]>();\n\n  for (const definition of definitions) {\n    slugCounts.set(definition.slug, (slugCounts.get(definition.slug) ?? 0) + 1);\n    for (const widget of definition.components?.widgets ?? []) {\n      widgetOwners.set(widget.id, [\n        ...(widgetOwners.get(widget.id) ?? []),\n        definition.slug,\n      ]);\n    }\n    for (const tool of definition.tools ?? []) {\n      // EFFECTIVE (discovery) name, not the raw name — two collision-free raw\n      // names can collapse to the same effective key.\n      const effective = getDiscoveredToolName(definition.slug, tool.name);\n      toolOwners.set(effective, [\n        ...(toolOwners.get(effective) ?? []),\n        definition.slug,\n      ]);\n    }\n  }\n\n  const collisions: string[] = [];\n\n  for (const [slug, count] of slugCounts) {\n    if (count > 1) {\n      collisions.push(\n        `slug \"${slug}\" is declared by ${count} partner definitions — slugs are the registry key and must be globally unique.`,\n      );\n    }\n  }\n  for (const [id, owners] of widgetOwners) {\n    if (owners.length > 1) {\n      collisions.push(\n        `widget id \"${id}\" is declared by [${owners.join(', ')}] — widget ids are global (widget_config rows key on them); prefix yours with the integration slug.`,\n      );\n    }\n  }\n  for (const [name, owners] of toolOwners) {\n    if (owners.length > 1) {\n      collisions.push(\n        `effective tool name \"${name}\" is declared by [${owners.join(', ')}] — discovery namespaces tool names by slug, so these collapse to one flat key and overwrite each other. Rename so the slug-prefixed names differ.`,\n      );\n    }\n  }\n\n  const reservedSlugs = new Set(firstParty.slugs ?? []);\n  const reservedWidgets = new Set(firstParty.widgetIds ?? []);\n  const reservedTools = new Set(firstParty.toolNames ?? []);\n\n  for (const [slug, owners] of groupOwners(definitions, (d) => [d.slug])) {\n    if (reservedSlugs.has(slug)) {\n      collisions.push(\n        `slug \"${slug}\" (declared by [${owners.join(', ')}]) collides with a first-party integration — pick a slug no built-in product uses.`,\n      );\n    }\n  }\n  for (const [id, owners] of widgetOwners) {\n    if (reservedWidgets.has(id)) {\n      collisions.push(\n        `widget id \"${id}\" (declared by [${owners.join(', ')}]) collides with a first-party widget — the dashboard resolves widgets by id, so this would hijack it. Prefix with the integration slug.`,\n      );\n    }\n  }\n  for (const [name, owners] of toolOwners) {\n    if (reservedTools.has(name)) {\n      collisions.push(\n        `effective tool name \"${name}\" (declared by [${owners.join(', ')}]) collides with a first-party tool — the flat, slug-namespaced tool registry would overwrite one with the other. Rename it.`,\n      );\n    }\n  }\n\n  if (collisions.length > 0) {\n    throw new Error(\n      `Integration definitions collide (${collisions.length} collision${collisions.length === 1 ? '' : 's'}):\\n` +\n        collisions.map((line) => `  - ${line}`).join('\\n') +\n        '\\nRename until every slug, widget id, and tool name is unique — the host registry would otherwise silently overwrite or drop a registration.',\n    );\n  }\n}\n\nfunction groupOwners(\n  definitions: readonly DefinitionCollisionInput[],\n  keysOf: (definition: DefinitionCollisionInput) => string[],\n): Map<string, string[]> {\n  const owners = new Map<string, string[]>();\n  for (const definition of definitions) {\n    for (const key of keysOf(definition)) {\n      owners.set(key, [...(owners.get(key) ?? []), definition.slug]);\n    }\n  }\n  return owners;\n}\n"]}

package/dist/product-id.d.ts

@@ -0,0 +1,64 @@
+/**
+ * Deterministic identifiers derived from an integration's slug.
+ *
+ * The problem this solves: every hand-written seed in
+ * `apps/web/supabase/seeds/` invents a `products.id` by hand — hex-word puns
+ * (`0d80b007` for dropbox, `1ea7b007` for learnworlds) and random v4s — and
+ * nothing checks them for collisions or reproduces them anywhere else. A slug
+ * therefore maps to a DIFFERENT uuid in every environment it was seeded into
+ * by hand, and re-deriving one after the fact is impossible.
+ *
+ * Here a slug maps to the same uuid everywhere, forever, computed rather than
+ * chosen: RFC 4122 version 5 (SHA-1, name-based) under one fixed Ekanos
+ * namespace. The SDK, the seed generator, and any future gate all call this
+ * one function and agree by construction.
+ *
+ * Dependency-pure and isomorphic on purpose. This package is imported by
+ * `@ekanos/sdk` and `@kit/integrations-core`, both of which reach the browser
+ * bundle, so SHA-1 is implemented here in ~50 lines rather than pulled from
+ * `node:crypto` (server-only) or a dependency (this package depends on zod and
+ * nothing else).
+ */
+/**
+ * The standard RFC 4122 DNS namespace. Present only so
+ * {@link EKANOS_INTEGRATION_NAMESPACE} below is auditable rather than
+ * arbitrary — nothing else should derive ids under it.
+ */
+export declare const DNS_NAMESPACE = "6ba7b810-9dad-11d1-80b4-00c04fd430c8";
+/**
+ * THE Ekanos integration namespace. Every id this module derives descends
+ * from it, so it is a permanent constant: changing it re-points every slug at
+ * a different uuid and orphans every row already written.
+ *
+ * It is not a hand-picked random value either — it is itself
+ * `uuidv5('ekanos.dev', DNS)`, which `__tests__/product-id.test.ts` asserts,
+ * so a reader can verify where it came from instead of trusting it.
+ */
+export declare const EKANOS_INTEGRATION_NAMESPACE = "269944fc-4736-5497-b751-381be92fb8df";
+/**
+ * The uuid `products.id` MUST carry for this integration.
+ *
+ * Derived as `uuidv5(slug, EKANOS_INTEGRATION_NAMESPACE)` — the name is the
+ * bare slug, with no prefix, so the derivation is trivially reproducible by
+ * any uuid tool (`uuidgen`, python's `uuid.uuid5`) against the namespace above.
+ */
+export declare function deriveProductId(slug: string): string;
+/**
+ * The uuid a named `plans` row for this integration MUST carry.
+ *
+ * Derived from `plan:<slug>:<planName>` under the same namespace. The prefix
+ * keeps the plan-id space disjoint from the product-id space: a bare slug is
+ * always the product, so no plan can ever collide with a product id.
+ *
+ * `planName` is lowercased before hashing, because `plans.name` is free text
+ * ('Default') while the id must not depend on how it was capitalised.
+ */
+export declare function derivePlanId(slug: string, planName: string): string;
+/**
+ * RFC 4122 §4.3 version 5: SHA-1 over (namespace bytes ‖ UTF-8 name bytes),
+ * with the version and variant bits overwritten in the first 16 bytes.
+ *
+ * Exported so tests can check it against the RFC's published vectors — the
+ * only way to be sure the hand-rolled SHA-1 below is the real one.
+ */
+export declare function uuidv5(name: string, namespace: string): string;

package/dist/product-id.js

@@ -0,0 +1,201 @@
+/**
+ * Deterministic identifiers derived from an integration's slug.
+ *
+ * The problem this solves: every hand-written seed in
+ * `apps/web/supabase/seeds/` invents a `products.id` by hand — hex-word puns
+ * (`0d80b007` for dropbox, `1ea7b007` for learnworlds) and random v4s — and
+ * nothing checks them for collisions or reproduces them anywhere else. A slug
+ * therefore maps to a DIFFERENT uuid in every environment it was seeded into
+ * by hand, and re-deriving one after the fact is impossible.
+ *
+ * Here a slug maps to the same uuid everywhere, forever, computed rather than
+ * chosen: RFC 4122 version 5 (SHA-1, name-based) under one fixed Ekanos
+ * namespace. The SDK, the seed generator, and any future gate all call this
+ * one function and agree by construction.
+ *
+ * Dependency-pure and isomorphic on purpose. This package is imported by
+ * `@ekanos/sdk` and `@kit/integrations-core`, both of which reach the browser
+ * bundle, so SHA-1 is implemented here in ~50 lines rather than pulled from
+ * `node:crypto` (server-only) or a dependency (this package depends on zod and
+ * nothing else).
+ */
+/**
+ * The standard RFC 4122 DNS namespace. Present only so
+ * {@link EKANOS_INTEGRATION_NAMESPACE} below is auditable rather than
+ * arbitrary — nothing else should derive ids under it.
+ */
+export const DNS_NAMESPACE = '6ba7b810-9dad-11d1-80b4-00c04fd430c8';
+/**
+ * THE Ekanos integration namespace. Every id this module derives descends
+ * from it, so it is a permanent constant: changing it re-points every slug at
+ * a different uuid and orphans every row already written.
+ *
+ * It is not a hand-picked random value either — it is itself
+ * `uuidv5('ekanos.dev', DNS)`, which `__tests__/product-id.test.ts` asserts,
+ * so a reader can verify where it came from instead of trusting it.
+ */
+export const EKANOS_INTEGRATION_NAMESPACE = '269944fc-4736-5497-b751-381be92fb8df';
+/**
+ * The slug shape `IntegrationDefinitionSchema` accepts. Re-stated (not
+ * imported) so this module stays a leaf: derivation must reject anything the
+ * definition schema would, because `deriveProductId('Acme')` and
+ * `deriveProductId('acme')` are different uuids and only one of them is the
+ * product.
+ */
+const SLUG = /^[a-z0-9]+(?:-[a-z0-9]+)*$/;
+function assertSlug(slug, what) {
+    if (!SLUG.test(slug)) {
+        throw new Error(`Cannot derive a ${what} from "${slug}": slugs are kebab-case ` +
+            `([a-z0-9] segments separated by single hyphens), e.g. "acme-crm". ` +
+            `Derivation is case- and punctuation-sensitive, so a slug that differs ` +
+            `only in case would silently become a different product.`);
+    }
+}
+/**
+ * The uuid `products.id` MUST carry for this integration.
+ *
+ * Derived as `uuidv5(slug, EKANOS_INTEGRATION_NAMESPACE)` — the name is the
+ * bare slug, with no prefix, so the derivation is trivially reproducible by
+ * any uuid tool (`uuidgen`, python's `uuid.uuid5`) against the namespace above.
+ */
+export function deriveProductId(slug) {
+    assertSlug(slug, 'product id');
+    return uuidv5(slug, EKANOS_INTEGRATION_NAMESPACE);
+}
+/**
+ * The uuid a named `plans` row for this integration MUST carry.
+ *
+ * Derived from `plan:<slug>:<planName>` under the same namespace. The prefix
+ * keeps the plan-id space disjoint from the product-id space: a bare slug is
+ * always the product, so no plan can ever collide with a product id.
+ *
+ * `planName` is lowercased before hashing, because `plans.name` is free text
+ * ('Default') while the id must not depend on how it was capitalised.
+ */
+export function derivePlanId(slug, planName) {
+    assertSlug(slug, 'plan id');
+    const normalized = planName.trim().toLowerCase();
+    if (normalized.length === 0) {
+        throw new Error(`Cannot derive a plan id for "${slug}": planName must be a non-empty string (e.g. "Default").`);
+    }
+    return uuidv5(`plan:${slug}:${normalized}`, EKANOS_INTEGRATION_NAMESPACE);
+}
+// ---- RFC 4122 v5 ------------------------------------------------------------
+const UUID = /^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$/i;
+/**
+ * RFC 4122 §4.3 version 5: SHA-1 over (namespace bytes ‖ UTF-8 name bytes),
+ * with the version and variant bits overwritten in the first 16 bytes.
+ *
+ * Exported so tests can check it against the RFC's published vectors — the
+ * only way to be sure the hand-rolled SHA-1 below is the real one.
+ */
+export function uuidv5(name, namespace) {
+    var _a, _b;
+    if (!UUID.test(namespace)) {
+        throw new Error(`uuidv5 namespace "${namespace}" is not a uuid — pass the canonical 8-4-4-4-12 hex form.`);
+    }
+    const namespaceBytes = uuidToBytes(namespace);
+    const nameBytes = new TextEncoder().encode(name);
+    const input = new Uint8Array(namespaceBytes.length + nameBytes.length);
+    input.set(namespaceBytes, 0);
+    input.set(nameBytes, namespaceBytes.length);
+    const hash = sha1(input);
+    // Version 5 in the high nibble of byte 6; RFC 4122 variant (10xx) in byte 8.
+    hash[6] = (((_a = hash[6]) !== null && _a !== void 0 ? _a : 0) & 0x0f) | 0x50;
+    hash[8] = (((_b = hash[8]) !== null && _b !== void 0 ? _b : 0) & 0x3f) | 0x80;
+    const hex = [...hash.slice(0, 16)]
+        .map((byte) => byte.toString(16).padStart(2, '0'))
+        .join('');
+    return [
+        hex.slice(0, 8),
+        hex.slice(8, 12),
+        hex.slice(12, 16),
+        hex.slice(16, 20),
+        hex.slice(20, 32),
+    ].join('-');
+}
+function uuidToBytes(uuid) {
+    const hex = uuid.replace(/-/g, '');
+    const bytes = new Uint8Array(16);
+    for (let i = 0; i < 16; i += 1) {
+        bytes[i] = Number.parseInt(hex.slice(i * 2, i * 2 + 2), 16);
+    }
+    return bytes;
+}
+function rotl(value, shift) {
+    return ((value << shift) | (value >>> (32 - shift))) >>> 0;
+}
+/** FIPS 180-4 SHA-1. Returns the 20-byte digest. */
+function sha1(message) {
+    var _a, _b, _c, _d, _e;
+    const bitLength = message.length * 8;
+    // Padded to a multiple of 64 with room for the 0x80 marker and the 8-byte
+    // big-endian length: (len + 1 + 8) rounded up to the next 64.
+    const padded = new Uint8Array(Math.ceil((message.length + 9) / 64) * 64);
+    padded.set(message, 0);
+    padded[message.length] = 0x80;
+    const view = new DataView(padded.buffer);
+    view.setUint32(padded.length - 8, Math.floor(bitLength / 4294967296), false);
+    view.setUint32(padded.length - 4, bitLength >>> 0, false);
+    let h0 = 0x67452301;
+    let h1 = 0xefcdab89;
+    let h2 = 0x98badcfe;
+    let h3 = 0x10325476;
+    let h4 = 0xc3d2e1f0;
+    const w = new Array(80).fill(0);
+    for (let offset = 0; offset < padded.length; offset += 64) {
+        for (let i = 0; i < 16; i += 1) {
+            w[i] = view.getUint32(offset + i * 4, false);
+        }
+        for (let i = 16; i < 80; i += 1) {
+            w[i] = rotl(((_a = w[i - 3]) !== null && _a !== void 0 ? _a : 0) ^ ((_b = w[i - 8]) !== null && _b !== void 0 ? _b : 0) ^ ((_c = w[i - 14]) !== null && _c !== void 0 ? _c : 0) ^ ((_d = w[i - 16]) !== null && _d !== void 0 ? _d : 0), 1);
+        }
+        let a = h0;
+        let b = h1;
+        let c = h2;
+        let d = h3;
+        let e = h4;
+        for (let i = 0; i < 80; i += 1) {
+            let f;
+            let k;
+            if (i < 20) {
+                f = ((b & c) | (~b & d)) >>> 0;
+                k = 0x5a827999;
+            }
+            else if (i < 40) {
+                f = (b ^ c ^ d) >>> 0;
+                k = 0x6ed9eba1;
+            }
+            else if (i < 60) {
+                f = ((b & c) | (b & d) | (c & d)) >>> 0;
+                k = 0x8f1bbcdc;
+            }
+            else {
+                f = (b ^ c ^ d) >>> 0;
+                k = 0xca62c1d6;
+            }
+            // Every term is < 2^32, so the five-way sum stays well inside the
+            // 2^53 exact-integer range; >>> 0 folds it back to uint32.
+            const temp = (rotl(a, 5) + f + e + k + ((_e = w[i]) !== null && _e !== void 0 ? _e : 0)) >>> 0;
+            e = d;
+            d = c;
+            c = rotl(b, 30);
+            b = a;
+            a = temp;
+        }
+        h0 = (h0 + a) >>> 0;
+        h1 = (h1 + b) >>> 0;
+        h2 = (h2 + c) >>> 0;
+        h3 = (h3 + d) >>> 0;
+        h4 = (h4 + e) >>> 0;
+    }
+    const digest = new Uint8Array(20);
+    const digestView = new DataView(digest.buffer);
+    digestView.setUint32(0, h0, false);
+    digestView.setUint32(4, h1, false);
+    digestView.setUint32(8, h2, false);
+    digestView.setUint32(12, h3, false);
+    digestView.setUint32(16, h4, false);
+    return digest;
+}
+//# sourceMappingURL=product-id.js.map

package/dist/product-id.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"product-id.js","sourceRoot":"","sources":["../src/product-id.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;GAoBG;AAEH;;;;GAIG;AACH,MAAM,CAAC,MAAM,aAAa,GAAG,sCAAsC,CAAC;AAEpE;;;;;;;;GAQG;AACH,MAAM,CAAC,MAAM,4BAA4B,GACvC,sCAAsC,CAAC;AAEzC;;;;;;GAMG;AACH,MAAM,IAAI,GAAG,4BAA4B,CAAC;AAE1C,SAAS,UAAU,CAAC,IAAY,EAAE,IAAY;IAC5C,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC;QACrB,MAAM,IAAI,KAAK,CACb,mBAAmB,IAAI,UAAU,IAAI,0BAA0B;YAC7D,oEAAoE;YACpE,wEAAwE;YACxE,yDAAyD,CAC5D,CAAC;IACJ,CAAC;AACH,CAAC;AAED;;;;;;GAMG;AACH,MAAM,UAAU,eAAe,CAAC,IAAY;IAC1C,UAAU,CAAC,IAAI,EAAE,YAAY,CAAC,CAAC;IAC/B,OAAO,MAAM,CAAC,IAAI,EAAE,4BAA4B,CAAC,CAAC;AACpD,CAAC;AAED;;;;;;;;;GASG;AACH,MAAM,UAAU,YAAY,CAAC,IAAY,EAAE,QAAgB;IACzD,UAAU,CAAC,IAAI,EAAE,SAAS,CAAC,CAAC;IAC5B,MAAM,UAAU,GAAG,QAAQ,CAAC,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC;IACjD,IAAI,UAAU,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QAC5B,MAAM,IAAI,KAAK,CACb,gCAAgC,IAAI,0DAA0D,CAC/F,CAAC;IACJ,CAAC;IACD,OAAO,MAAM,CAAC,QAAQ,IAAI,IAAI,UAAU,EAAE,EAAE,4BAA4B,CAAC,CAAC;AAC5E,CAAC;AAED,gFAAgF;AAEhF,MAAM,IAAI,GAAG,iEAAiE,CAAC;AAE/E;;;;;;GAMG;AACH,MAAM,UAAU,MAAM,CAAC,IAAY,EAAE,SAAiB;;IACpD,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,SAAS,CAAC,EAAE,CAAC;QAC1B,MAAM,IAAI,KAAK,CACb,qBAAqB,SAAS,2DAA2D,CAC1F,CAAC;IACJ,CAAC;IAED,MAAM,cAAc,GAAG,WAAW,CAAC,SAAS,CAAC,CAAC;IAC9C,MAAM,SAAS,GAAG,IAAI,WAAW,EAAE,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC;IACjD,MAAM,KAAK,GAAG,IAAI,UAAU,CAAC,cAAc,CAAC,MAAM,GAAG,SAAS,CAAC,MAAM,CAAC,CAAC;IACvE,KAAK,CAAC,GAAG,CAAC,cAAc,EAAE,CAAC,CAAC,CAAC;IAC7B,KAAK,CAAC,GAAG,CAAC,SAAS,EAAE,cAAc,CAAC,MAAM,CAAC,CAAC;IAE5C,MAAM,IAAI,GAAG,IAAI,CAAC,KAAK,CAAC,CAAC;IACzB,6EAA6E;IAC7E,IAAI,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,MAAA,IAAI,CAAC,CAAC,CAAC,mCAAI,CAAC,CAAC,GAAG,IAAI,CAAC,GAAG,IAAI,CAAC;IACzC,IAAI,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,MAAA,IAAI,CAAC,CAAC,CAAC,mCAAI,CAAC,CAAC,GAAG,IAAI,CAAC,GAAG,IAAI,CAAC;IAEzC,MAAM,GAAG,GAAG,CAAC,GAAG,IAAI,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;SAC/B,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAC,QAAQ,CAAC,CAAC,EAAE,GAAG,CAAC,CAAC;SACjD,IAAI,CAAC,EAAE,CAAC,CAAC;IAEZ,OAAO;QACL,GAAG,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC;QACf,GAAG,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC;QAChB,GAAG,CAAC,KAAK,CAAC,EAAE,EAAE,EAAE,CAAC;QACjB,GAAG,CAAC,KAAK,CAAC,EAAE,EAAE,EAAE,CAAC;QACjB,GAAG,CAAC,KAAK,CAAC,EAAE,EAAE,EAAE,CAAC;KAClB,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;AACd,CAAC;AAED,SAAS,WAAW,CAAC,IAAY;IAC/B,MAAM,GAAG,GAAG,IAAI,CAAC,OAAO,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC;IACnC,MAAM,KAAK,GAAG,IAAI,UAAU,CAAC,EAAE,CAAC,CAAC;IACjC,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,EAAE,EAAE,CAAC,IAAI,CAAC,EAAE,CAAC;QAC/B,KAAK,CAAC,CAAC,CAAC,GAAG,MAAM,CAAC,QAAQ,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;IAC9D,CAAC;IACD,OAAO,KAAK,CAAC;AACf,CAAC;AAED,SAAS,IAAI,CAAC,KAAa,EAAE,KAAa;IACxC,OAAO,CAAC,CAAC,KAAK,IAAI,KAAK,CAAC,GAAG,CAAC,KAAK,KAAK,CAAC,EAAE,GAAG,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC;AAC7D,CAAC;AAED,oDAAoD;AACpD,SAAS,IAAI,CAAC,OAAmB;;IAC/B,MAAM,SAAS,GAAG,OAAO,CAAC,MAAM,GAAG,CAAC,CAAC;IACrC,0EAA0E;IAC1E,8DAA8D;IAC9D,MAAM,MAAM,GAAG,IAAI,UAAU,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,OAAO,CAAC,MAAM,GAAG,CAAC,CAAC,GAAG,EAAE,CAAC,GAAG,EAAE,CAAC,CAAC;IACzE,MAAM,CAAC,GAAG,CAAC,OAAO,EAAE,CAAC,CAAC,CAAC;IACvB,MAAM,CAAC,OAAO,CAAC,MAAM,CAAC,GAAG,IAAI,CAAC;IAE9B,MAAM,IAAI,GAAG,IAAI,QAAQ,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC;IACzC,IAAI,CAAC,SAAS,CACZ,MAAM,CAAC,MAAM,GAAG,CAAC,EACjB,IAAI,CAAC,KAAK,CAAC,SAAS,GAAG,UAAa,CAAC,EACrC,KAAK,CACN,CAAC;IACF,IAAI,CAAC,SAAS,CAAC,MAAM,CAAC,MAAM,GAAG,CAAC,EAAE,SAAS,KAAK,CAAC,EAAE,KAAK,CAAC,CAAC;IAE1D,IAAI,EAAE,GAAG,UAAU,CAAC;IACpB,IAAI,EAAE,GAAG,UAAU,CAAC;IACpB,IAAI,EAAE,GAAG,UAAU,CAAC;IACpB,IAAI,EAAE,GAAG,UAAU,CAAC;IACpB,IAAI,EAAE,GAAG,UAAU,CAAC;IAEpB,MAAM,CAAC,GAAG,IAAI,KAAK,CAAS,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IAExC,KAAK,IAAI,MAAM,GAAG,CAAC,EAAE,MAAM,GAAG,MAAM,CAAC,MAAM,EAAE,MAAM,IAAI,EAAE,EAAE,CAAC;QAC1D,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,EAAE,EAAE,CAAC,IAAI,CAAC,EAAE,CAAC;YAC/B,CAAC,CAAC,CAAC,CAAC,GAAG,IAAI,CAAC,SAAS,CAAC,MAAM,GAAG,CAAC,GAAG,CAAC,EAAE,KAAK,CAAC,CAAC;QAC/C,CAAC;QACD,KAAK,IAAI,CAAC,GAAG,EAAE,EAAE,CAAC,GAAG,EAAE,EAAE,CAAC,IAAI,CAAC,EAAE,CAAC;YAChC,CAAC,CAAC,CAAC,CAAC,GAAG,IAAI,CACT,CAAC,MAAA,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,mCAAI,CAAC,CAAC,GAAG,CAAC,MAAA,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,mCAAI,CAAC,CAAC,GAAG,CAAC,MAAA,CAAC,CAAC,CAAC,GAAG,EAAE,CAAC,mCAAI,CAAC,CAAC,GAAG,CAAC,MAAA,CAAC,CAAC,CAAC,GAAG,EAAE,CAAC,mCAAI,CAAC,CAAC,EACvE,CAAC,CACF,CAAC;QACJ,CAAC;QAED,IAAI,CAAC,GAAG,EAAE,CAAC;QACX,IAAI,CAAC,GAAG,EAAE,CAAC;QACX,IAAI,CAAC,GAAG,EAAE,CAAC;QACX,IAAI,CAAC,GAAG,EAAE,CAAC;QACX,IAAI,CAAC,GAAG,EAAE,CAAC;QAEX,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,EAAE,EAAE,CAAC,IAAI,CAAC,EAAE,CAAC;YAC/B,IAAI,CAAS,CAAC;YACd,IAAI,CAAS,CAAC;YACd,IAAI,CAAC,GAAG,EAAE,EAAE,CAAC;gBACX,CAAC,GAAG,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC;gBAC/B,CAAC,GAAG,UAAU,CAAC;YACjB,CAAC;iBAAM,IAAI,CAAC,GAAG,EAAE,EAAE,CAAC;gBAClB,CAAC,GAAG,CAAC,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,KAAK,CAAC,CAAC;gBACtB,CAAC,GAAG,UAAU,CAAC;YACjB,CAAC;iBAAM,IAAI,CAAC,GAAG,EAAE,EAAE,CAAC;gBAClB,CAAC,GAAG,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,GAAG,CAAC,CAAC,GAAG,CAAC,CAAC,GAAG,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC;gBACxC,CAAC,GAAG,UAAU,CAAC;YACjB,CAAC;iBAAM,CAAC;gBACN,CAAC,GAAG,CAAC,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,KAAK,CAAC,CAAC;gBACtB,CAAC,GAAG,UAAU,CAAC;YACjB,CAAC;YAED,kEAAkE;YAClE,2DAA2D;YAC3D,MAAM,IAAI,GAAG,CAAC,IAAI,CAAC,CAAC,EAAE,CAAC,CAAC,GAAG,CAAC,GAAG,CAAC,GAAG,CAAC,GAAG,CAAC,MAAA,CAAC,CAAC,CAAC,CAAC,mCAAI,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC;YAC1D,CAAC,GAAG,CAAC,CAAC;YACN,CAAC,GAAG,CAAC,CAAC;YACN,CAAC,GAAG,IAAI,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;YAChB,CAAC,GAAG,CAAC,CAAC;YACN,CAAC,GAAG,IAAI,CAAC;QACX,CAAC;QAED,EAAE,GAAG,CAAC,EAAE,GAAG,CAAC,CAAC,KAAK,CAAC,CAAC;QACpB,EAAE,GAAG,CAAC,EAAE,GAAG,CAAC,CAAC,KAAK,CAAC,CAAC;QACpB,EAAE,GAAG,CAAC,EAAE,GAAG,CAAC,CAAC,KAAK,CAAC,CAAC;QACpB,EAAE,GAAG,CAAC,EAAE,GAAG,CAAC,CAAC,KAAK,CAAC,CAAC;QACpB,EAAE,GAAG,CAAC,EAAE,GAAG,CAAC,CAAC,KAAK,CAAC,CAAC;IACtB,CAAC;IAED,MAAM,MAAM,GAAG,IAAI,UAAU,CAAC,EAAE,CAAC,CAAC;IAClC,MAAM,UAAU,GAAG,IAAI,QAAQ,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC;IAC/C,UAAU,CAAC,SAAS,CAAC,CAAC,EAAE,EAAE,EAAE,KAAK,CAAC,CAAC;IACnC,UAAU,CAAC,SAAS,CAAC,CAAC,EAAE,EAAE,EAAE,KAAK,CAAC,CAAC;IACnC,UAAU,CAAC,SAAS,CAAC,CAAC,EAAE,EAAE,EAAE,KAAK,CAAC,CAAC;IACnC,UAAU,CAAC,SAAS,CAAC,EAAE,EAAE,EAAE,EAAE,KAAK,CAAC,CAAC;IACpC,UAAU,CAAC,SAAS,CAAC,EAAE,EAAE,EAAE,EAAE,KAAK,CAAC,CAAC;IACpC,OAAO,MAAM,CAAC;AAChB,CAAC","sourcesContent":["/**\n * Deterministic identifiers derived from an integration's slug.\n *\n * The problem this solves: every hand-written seed in\n * `apps/web/supabase/seeds/` invents a `products.id` by hand — hex-word puns\n * (`0d80b007` for dropbox, `1ea7b007` for learnworlds) and random v4s — and\n * nothing checks them for collisions or reproduces them anywhere else. A slug\n * therefore maps to a DIFFERENT uuid in every environment it was seeded into\n * by hand, and re-deriving one after the fact is impossible.\n *\n * Here a slug maps to the same uuid everywhere, forever, computed rather than\n * chosen: RFC 4122 version 5 (SHA-1, name-based) under one fixed Ekanos\n * namespace. The SDK, the seed generator, and any future gate all call this\n * one function and agree by construction.\n *\n * Dependency-pure and isomorphic on purpose. This package is imported by\n * `@ekanos/sdk` and `@kit/integrations-core`, both of which reach the browser\n * bundle, so SHA-1 is implemented here in ~50 lines rather than pulled from\n * `node:crypto` (server-only) or a dependency (this package depends on zod and\n * nothing else).\n */\n\n/**\n * The standard RFC 4122 DNS namespace. Present only so\n * {@link EKANOS_INTEGRATION_NAMESPACE} below is auditable rather than\n * arbitrary — nothing else should derive ids under it.\n */\nexport const DNS_NAMESPACE = '6ba7b810-9dad-11d1-80b4-00c04fd430c8';\n\n/**\n * THE Ekanos integration namespace. Every id this module derives descends\n * from it, so it is a permanent constant: changing it re-points every slug at\n * a different uuid and orphans every row already written.\n *\n * It is not a hand-picked random value either — it is itself\n * `uuidv5('ekanos.dev', DNS)`, which `__tests__/product-id.test.ts` asserts,\n * so a reader can verify where it came from instead of trusting it.\n */\nexport const EKANOS_INTEGRATION_NAMESPACE =\n  '269944fc-4736-5497-b751-381be92fb8df';\n\n/**\n * The slug shape `IntegrationDefinitionSchema` accepts. Re-stated (not\n * imported) so this module stays a leaf: derivation must reject anything the\n * definition schema would, because `deriveProductId('Acme')` and\n * `deriveProductId('acme')` are different uuids and only one of them is the\n * product.\n */\nconst SLUG = /^[a-z0-9]+(?:-[a-z0-9]+)*$/;\n\nfunction assertSlug(slug: string, what: string): void {\n  if (!SLUG.test(slug)) {\n    throw new Error(\n      `Cannot derive a ${what} from \"${slug}\": slugs are kebab-case ` +\n        `([a-z0-9] segments separated by single hyphens), e.g. \"acme-crm\". ` +\n        `Derivation is case- and punctuation-sensitive, so a slug that differs ` +\n        `only in case would silently become a different product.`,\n    );\n  }\n}\n\n/**\n * The uuid `products.id` MUST carry for this integration.\n *\n * Derived as `uuidv5(slug, EKANOS_INTEGRATION_NAMESPACE)` — the name is the\n * bare slug, with no prefix, so the derivation is trivially reproducible by\n * any uuid tool (`uuidgen`, python's `uuid.uuid5`) against the namespace above.\n */\nexport function deriveProductId(slug: string): string {\n  assertSlug(slug, 'product id');\n  return uuidv5(slug, EKANOS_INTEGRATION_NAMESPACE);\n}\n\n/**\n * The uuid a named `plans` row for this integration MUST carry.\n *\n * Derived from `plan:<slug>:<planName>` under the same namespace. The prefix\n * keeps the plan-id space disjoint from the product-id space: a bare slug is\n * always the product, so no plan can ever collide with a product id.\n *\n * `planName` is lowercased before hashing, because `plans.name` is free text\n * ('Default') while the id must not depend on how it was capitalised.\n */\nexport function derivePlanId(slug: string, planName: string): string {\n  assertSlug(slug, 'plan id');\n  const normalized = planName.trim().toLowerCase();\n  if (normalized.length === 0) {\n    throw new Error(\n      `Cannot derive a plan id for \"${slug}\": planName must be a non-empty string (e.g. \"Default\").`,\n    );\n  }\n  return uuidv5(`plan:${slug}:${normalized}`, EKANOS_INTEGRATION_NAMESPACE);\n}\n\n// ---- RFC 4122 v5 ------------------------------------------------------------\n\nconst UUID = /^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$/i;\n\n/**\n * RFC 4122 §4.3 version 5: SHA-1 over (namespace bytes ‖ UTF-8 name bytes),\n * with the version and variant bits overwritten in the first 16 bytes.\n *\n * Exported so tests can check it against the RFC's published vectors — the\n * only way to be sure the hand-rolled SHA-1 below is the real one.\n */\nexport function uuidv5(name: string, namespace: string): string {\n  if (!UUID.test(namespace)) {\n    throw new Error(\n      `uuidv5 namespace \"${namespace}\" is not a uuid — pass the canonical 8-4-4-4-12 hex form.`,\n    );\n  }\n\n  const namespaceBytes = uuidToBytes(namespace);\n  const nameBytes = new TextEncoder().encode(name);\n  const input = new Uint8Array(namespaceBytes.length + nameBytes.length);\n  input.set(namespaceBytes, 0);\n  input.set(nameBytes, namespaceBytes.length);\n\n  const hash = sha1(input);\n  // Version 5 in the high nibble of byte 6; RFC 4122 variant (10xx) in byte 8.\n  hash[6] = ((hash[6] ?? 0) & 0x0f) | 0x50;\n  hash[8] = ((hash[8] ?? 0) & 0x3f) | 0x80;\n\n  const hex = [...hash.slice(0, 16)]\n    .map((byte) => byte.toString(16).padStart(2, '0'))\n    .join('');\n\n  return [\n    hex.slice(0, 8),\n    hex.slice(8, 12),\n    hex.slice(12, 16),\n    hex.slice(16, 20),\n    hex.slice(20, 32),\n  ].join('-');\n}\n\nfunction uuidToBytes(uuid: string): Uint8Array {\n  const hex = uuid.replace(/-/g, '');\n  const bytes = new Uint8Array(16);\n  for (let i = 0; i < 16; i += 1) {\n    bytes[i] = Number.parseInt(hex.slice(i * 2, i * 2 + 2), 16);\n  }\n  return bytes;\n}\n\nfunction rotl(value: number, shift: number): number {\n  return ((value << shift) | (value >>> (32 - shift))) >>> 0;\n}\n\n/** FIPS 180-4 SHA-1. Returns the 20-byte digest. */\nfunction sha1(message: Uint8Array): Uint8Array {\n  const bitLength = message.length * 8;\n  // Padded to a multiple of 64 with room for the 0x80 marker and the 8-byte\n  // big-endian length: (len + 1 + 8) rounded up to the next 64.\n  const padded = new Uint8Array(Math.ceil((message.length + 9) / 64) * 64);\n  padded.set(message, 0);\n  padded[message.length] = 0x80;\n\n  const view = new DataView(padded.buffer);\n  view.setUint32(\n    padded.length - 8,\n    Math.floor(bitLength / 0x1_0000_0000),\n    false,\n  );\n  view.setUint32(padded.length - 4, bitLength >>> 0, false);\n\n  let h0 = 0x67452301;\n  let h1 = 0xefcdab89;\n  let h2 = 0x98badcfe;\n  let h3 = 0x10325476;\n  let h4 = 0xc3d2e1f0;\n\n  const w = new Array<number>(80).fill(0);\n\n  for (let offset = 0; offset < padded.length; offset += 64) {\n    for (let i = 0; i < 16; i += 1) {\n      w[i] = view.getUint32(offset + i * 4, false);\n    }\n    for (let i = 16; i < 80; i += 1) {\n      w[i] = rotl(\n        (w[i - 3] ?? 0) ^ (w[i - 8] ?? 0) ^ (w[i - 14] ?? 0) ^ (w[i - 16] ?? 0),\n        1,\n      );\n    }\n\n    let a = h0;\n    let b = h1;\n    let c = h2;\n    let d = h3;\n    let e = h4;\n\n    for (let i = 0; i < 80; i += 1) {\n      let f: number;\n      let k: number;\n      if (i < 20) {\n        f = ((b & c) | (~b & d)) >>> 0;\n        k = 0x5a827999;\n      } else if (i < 40) {\n        f = (b ^ c ^ d) >>> 0;\n        k = 0x6ed9eba1;\n      } else if (i < 60) {\n        f = ((b & c) | (b & d) | (c & d)) >>> 0;\n        k = 0x8f1bbcdc;\n      } else {\n        f = (b ^ c ^ d) >>> 0;\n        k = 0xca62c1d6;\n      }\n\n      // Every term is < 2^32, so the five-way sum stays well inside the\n      // 2^53 exact-integer range; >>> 0 folds it back to uint32.\n      const temp = (rotl(a, 5) + f + e + k + (w[i] ?? 0)) >>> 0;\n      e = d;\n      d = c;\n      c = rotl(b, 30);\n      b = a;\n      a = temp;\n    }\n\n    h0 = (h0 + a) >>> 0;\n    h1 = (h1 + b) >>> 0;\n    h2 = (h2 + c) >>> 0;\n    h3 = (h3 + d) >>> 0;\n    h4 = (h4 + e) >>> 0;\n  }\n\n  const digest = new Uint8Array(20);\n  const digestView = new DataView(digest.buffer);\n  digestView.setUint32(0, h0, false);\n  digestView.setUint32(4, h1, false);\n  digestView.setUint32(8, h2, false);\n  digestView.setUint32(12, h3, false);\n  digestView.setUint32(16, h4, false);\n  return digest;\n}\n"]}