Invalid integration definition for "<slug>":
  - <path>: <message>

slug: slug must be kebab-case ([a-z0-9] segments separated by single hyphens), e.g. "acme-crm" — it becomes the product slug, route segment, and MCP namespace.

slug: 'my-integration'; // ✓
slug: '123-integration'; // ✓ (digits are allowed)
slug: 'My_Integration'; // ✗ (uppercase, underscore)
slug: 'my--integration'; // ✗ (double hyphen)

(root): Unrecognized key(s) in object: 'productId', 'kind'

Host-assigned fields are never partner-authorable: productId, kind, trust tier, and machine exposure (credentialModel) do not exist on IntegrationDefinition, per-tool effect/sensitivity belong in the `proposes` block, and host-resolved widget fields (productId, widgetConfigId, workspaceId, collapsed, isPinned, health, integrationMetadata) are populated by the platform at runtime — remove them from the definition.

components.widgets.0.id: Widget ids are kebab-case and globally unique, e.g. "acme-crm-pipeline" — prefix with the integration slug to stay collision-free.

components.widgets: Widget id "<id>" is declared more than once — give every widget a unique id.

components: {
  widgets: [
    {
      id: 'my-integration-summary',  // ✓
      // …
    },
  ],
}

tools.0.name: Tool names are lowercase snake_case starting with a letter, e.g. "list_invoices" — the model calls them by this exact string.

name: 'get_payments'; // ✓
name: 'getPayments'; // ✗ (camelCase)
name: 'get-payments'; // ✗ (hyphens)

webhooks.0.id: Webhook ids are kebab-case, e.g. "payment-updated" — the host ingress route addresses the handler by this exact string.

schedules.0.id: Schedule ids are kebab-case, e.g. "daily-reconcile" — the host scheduler addresses the handler by this exact string.

Action names are kebab-case, e.g. "create-record" — the host route and useIntegrationAction() address the handler by this exact string.

id: 'payment-updated'; // ✓
id: 'payment_updated'; // ✗

schedules["<id>"]: Cron expression "0 0 0 * *" is invalid: 0 is out of range for the day-of-month field (1-31). Expected 5 space-separated fields (minute hour day-of-month month day-of-week), numeric values only, with "*", lists ("1,15"), ranges ("1-5"), and steps ("*/15", "0-30/5") — e.g. "0 6 * * *" for 06:00 daily.

cron: '0 6 * * *'; // ✓ 06:00 daily
cron: '0 0 1 * *'; // ✓ Monthly on the 1st
cron: '*/15 * * * *'; // ✓ Every 15 minutes
cron: '0 0 0 * *'; // ✗ day-of-month 0 is out of range

oauth.provider.authorizationUrl: its origin https://provider.example is not covered by this definition's egress list []. The OAuth code exchange runs through the integration's declared egress, so add "https://provider.example" (or a covering "*." wildcard entry) to `egress` — widening egress is a security-posture change reviewed at promotion.

egress: [
  'https://provider.example', // covers /oauth/authorize and /oauth/token
];

storage.account.a/b/c: Storage key "a/b/c" is malformed. Keys are "<dataType>" or "<dataType>/<subtype>" in lowercase [a-z0-9_-], with at most one "/" and no empty segment.

storage.account.my-config/location: Storage key "my-config/location" is invalid for the account scope: "my-config" is not an allowed account data_type. Use one of [activation, settings, metrics_summary, sync_state, cache] (the database CHECK constraint).

'settings/location'; // ✓ (account)
'cache/forecast'; // ✓ (account or user)
'preferences/units'; // ✓ (user)
'my-config/location'; // ✗ (my-config is not a data type)
'settings/location.v2'; // ✗ (dots are not allowed)
'a/b/c'; // ✗ (two slashes)

tsconfig.json does not set noUncheckedIndexedAccess in compilerOptions. The gate re-checks your submission under the host's own stricter compiler rules — a project that typechecks cleanly under its own laxer tsconfig can still fail that pass.

{
  "compilerOptions": {
    "strict": true,
    "noUncheckedIndexedAccess": true
  }
}

ekanos.json declares slug "my-integration" for this entry, but the definition says "my-payments". The slug addresses the integration everywhere — its harness route, its product record, its widget ids — so the two must agree.

// ekanos.json
{ "slug": "my-integration", "entry": "src/integration.ts" }

// src/integration.ts
export const integration = defineIntegration({
  slug: 'my-integration', // must match ekanos.json
  // …
});

widget id "shared-summary" is declared by [my-integration, other-integration] — widget ids are global (widget_config rows key on them); prefix yours with the integration slug.

id: 'my-integration-summary'; // ✓

"fa-<name>" is not in the Font Awesome Free set. Ekanos itself loads Font Awesome Pro, so this renders fine there, but the generated harness (and any other Free-only host) shows the circle-question placeholder instead of the intended glyph.

// Add a new key alongside the old one
'settings/location': LocationSchema,
'settings/location-v2': NewLocationSchema,

// Or accept both shapes
'settings/location': z.union([LocationSchema, NewLocationSchema]),

Egress to https://api.untrusted.example is not in this integration's allowlist. Declare the origin in the integration's egress list — an exact origin ("https://api.example.com") or a "*." subdomain wildcard ("https://*.example.com") — or call an allowed origin instead. Allowlist changes are a security-posture change reviewed at promotion.

egress: [
  'https://api.acme.example',
  'https://api.untrusted.example', // add this
];

Secret "platform_key" resolves only from an admin-issued tier (source or global) and cannot be written from integration code. secrets.set() rotates account-tier values only — the ones this integration stored for the current account. If this credential needs a new value, an admin must update it where it was issued.

No recorded response for GET https://api.acme.example/payments.

fixtures: {
  default: [
    {
      request: 'GET https://api.acme.example/payments',
      response: { payments: [] },
    },
  ],
}

No IntegrationActivationProvider is mounted. The host application must bind its activation server actions (see @ekanos/sdk/hooks IntegrationActivationProvider) above any component that activates integrations.

import { IntegrationActivationProvider } from '@ekanos/sdk/hooks';

<IntegrationActivationProvider actions={{ activate, deactivate }}>
  <YourActivationForm />
</IntegrationActivationProvider>;

ctx.storage.user is unavailable for machine actors: there is no user to scope the row to. Store machine-written state in ctx.storage.account instead.

// ✗ Throws for machine actors
await ctx.storage.user.get('preferences/units');

// ✓ Works for any actor
await ctx.storage.account.get('settings/location');

Not logged in to https://your-ekanos-host.

ekanos login --host https://your-ekanos-host

This account does not hold a seat on source "other-source" on https://your-ekanos-host.

ekanos sources          # See which sources you hold a seat on
ekanos use my-source
ekanos publish

The project's @ekanos/integration-schema@0.4.1 is newer than 0.4.0, the version this @ekanos/cli build validates with. Findings from "ekanos validate" are UNRELIABLE in this state: a field the newer schema added parses here as an unrecognized key, and the usual hint for that tells you to delete code that is actually correct.

ekanos upgrade

Refusing to publish: 2 validation findings.

my-integration@1.0.0 was rejected by the gate (2 errors).