@hs-x/codegen 0.2.7 → 0.3.0

package/dist/index.js

@@ -1,6 +1,7 @@
 import { mkdir, writeFile } from 'node:fs/promises';
 import { join } from 'node:path';
-export const CODEGEN_VERSION = '0.2.7';
+import { normalizeSyncSchedule } from '@hs-x/sdk';
+export const CODEGEN_VERSION = '0.3.0';
 export async function generateProjectArtifacts(options) {
     const manifest = {
         generatedAt: new Date().toISOString(),
@@ -17,7 +18,10 @@ export async function generateProjectArtifacts(options) {
     await writeFile(join(outDir, 'refs.d.ts'), renderRefsTypes(options.workers, options));
     await writeFile(join(outDir, 'refs.js'), renderRefsModule(options.workers, options));
     if (options.resourceScope) {
-        await writeFile(join(outDir, 'alchemy.run.ts'), renderAlchemyProgram({ ...options.resourceScope, workers: options.workers }));
+        await writeFile(join(outDir, 'alchemy.run.ts'), renderAlchemyProgram({
+            ...options.resourceScope,
+            workers: options.workers,
+        }));
     }
     return manifest;
 }
@@ -51,6 +55,39 @@ export function workerCloudflareResourcePlan(scope, worker) {
 export function cloudflareResourceName(scope, resource) {
     return `hsx-${toResourceSlug(scope.hsXAccountId)}-${toResourceSlug(resource)}`;
 }
+/**
+ * Translate a worker's declared sync schedules into a Cloudflare cron-trigger
+ * plan (ADR-023 S04). Only pull-capable syncs are scheduled — a push source is
+ * webhook-driven, and `event` / `manual` schedules produce no trigger. Two
+ * syncs that share a schedule collapse into a single cron entry that dispatches
+ * both: Cloudflare caps cron triggers per worker (5 on the base tier), so
+ * emitting one trigger per distinct cadence — rather than one per sync — both
+ * respects the cap and avoids duplicate scheduler wakeups. Schedules are
+ * normalized (and thus validated) here, so an unhonorable cadence that somehow
+ * reached deploy still throws rather than silently dropping the trigger.
+ */
+export function planWorkerCronTriggers(worker) {
+    const byCron = new Map();
+    for (const capability of worker.capabilities) {
+        if (capability.kind !== 'sync')
+            continue;
+        // Push sources ingest via the authenticated webhook route, never a cron.
+        if (capability.source?.kind === 'push')
+            continue;
+        if (capability.schedule === undefined)
+            continue;
+        const normalized = normalizeSyncSchedule(capability.schedule);
+        if (normalized.kind !== 'cron')
+            continue;
+        const ids = byCron.get(normalized.cron) ?? new Set();
+        ids.add(capability.id);
+        byCron.set(normalized.cron, ids);
+    }
+    const dispatch = [...byCron.entries()]
+        .map(([cron, ids]) => ({ cron, syncIds: [...ids].sort() }))
+        .sort((a, b) => (a.cron < b.cron ? -1 : a.cron > b.cron ? 1 : 0));
+    return { crons: dispatch.map((entry) => entry.cron), dispatch };
+}
 export function renderCloudflareWorkerEntrypoint(options) {
     return `// Generated by hs-x. Do not edit by hand.
 import {
@@ -60,6 +97,7 @@ import {
   createHubSpotTokenRefresh,
   createKvRuntimeSealedTokenBlobStore,
   createKvRuntimeTokenStateOwnerStore,
+  loggerRateLimitMetrics,
   createRuntimeTokenService,
   createSingleBucketRuntimeRateLimiter,
   RUNTIME_VERSION,
@@ -76,6 +114,9 @@ function getRuntime(env: Record<string, unknown>) {
   runtime ??= createRuntime({
     worker,
     env,
+${options.requireActiveCardInstall === false ? '    cards: { requireActiveInstall: false },\n' : ''}
+${renderAppEventBatching(options.appEventBatching)}
+${renderRedaction(options.redaction)}
 ${renderLinkedHeartbeat(options.heartbeat)}
 ${renderLinkedCheckpoint(options.heartbeat)}
     ...(hostedBilling ? { billing: hostedBilling.billing } : {}),
@@ -113,7 +154,9 @@ ${options.heartbeat?.mode === 'linked' ? '            ...hsxInstalledPortalTelem
             rateLimiter: createSingleBucketRuntimeRateLimiter({
               capacity: 100,
               refillPerSecond: 10,
+${renderHubSpotRateLimitBucket(options.rateLimits)}
             }),
+${renderManagedHubSpotRateLimitOptions(options.rateLimits)}
           },
         }
       : {}),
@@ -165,7 +208,41 @@ export default {
     ${options.heartbeat?.mode === 'anonymous' ? 'void emitAnonymousHeartbeat(env);' : ''}
     return getRuntime(env).fetch(request, ctx);
   },
-};
+${renderScheduledHandler(options.syncCron)}};
+`;
+}
+/**
+ * ADR-023 S04 scheduled handler. A Cloudflare cron fire carries the exact
+ * trigger string in `event.cron`; we map it to the syncs planned for that
+ * cadence and dispatch each through the runtime's `/sync/<id>/run` route with
+ * an empty body. That empty-body path is the install fan-out
+ * (`executeSyncDispatch`): it enumerates live installs and runs each active
+ * one exactly once under the S01 single-winner lease, isolating per-portal
+ * failures. `Promise.allSettled` keeps one sync's failure from aborting the
+ * others on the same tick. No trigger, no handler — a webhook/manual-only
+ * worker stays a pure `fetch` worker.
+ */
+function renderScheduledHandler(plan) {
+    if (!plan || plan.dispatch.length === 0)
+        return '';
+    const table = JSON.stringify(Object.fromEntries(plan.dispatch.map((entry) => [entry.cron, [...entry.syncIds]])));
+    return `  async scheduled(event: { readonly cron: string; readonly scheduledTime: number }, env: Record<string, unknown>, ctx: { waitUntil(promise: Promise<unknown>): void }) {
+    const dispatch: Record<string, readonly string[]> = ${table};
+    const syncIds = dispatch[event.cron] ?? [];
+    const runtime = getRuntime(env);
+    await Promise.allSettled(
+      syncIds.map((id) =>
+        runtime.fetch(
+          new Request("https://hsx.internal/sync/" + encodeURIComponent(id) + "/run", {
+            method: "POST",
+            headers: { "content-type": "application/json" },
+            body: "{}",
+          }),
+          ctx,
+        ),
+      ),
+    );
+  },
 `;
 }
 function renderLinkedCheckpoint(heartbeat) {
@@ -225,6 +302,47 @@ function renderHostedBilling(billing) {
     runtimeToken: readRuntimeBillingToken(env, ${JSON.stringify(runtimeTokenBinding)}),
   })`;
 }
+function renderAppEventBatching(batching) {
+    if (batching === undefined)
+        return '';
+    if (batching === false)
+        return '    appEventBatching: false,\n';
+    return `    appEventBatching: ${JSON.stringify(batching)},\n`;
+}
+function renderRedaction(redaction) {
+    if (!redaction || !redaction.fields || redaction.fields.length === 0)
+        return '';
+    return `    redaction: ${JSON.stringify(redaction)},\n`;
+}
+function renderHubSpotRateLimitBucket(rateLimits) {
+    const bucket = rateLimits?.bucket;
+    if (!bucket)
+        return '';
+    const rateLimiterBucket = {
+        ...(bucket.capacity !== undefined ? { capacity: bucket.capacity } : {}),
+        ...(bucket.refillPerSecond !== undefined ? { refillPerSecond: bucket.refillPerSecond } : {}),
+        ...(bucket.searchCapacity !== undefined ? { searchCapacity: bucket.searchCapacity } : {}),
+        ...(bucket.searchRefillPerSecond !== undefined
+            ? { searchRefillPerSecond: bucket.searchRefillPerSecond }
+            : {}),
+    };
+    return Object.keys(rateLimiterBucket).length
+        ? `              ...${JSON.stringify(rateLimiterBucket)},\n`
+        : '';
+}
+function renderManagedHubSpotRateLimitOptions(rateLimits) {
+    const lines = [];
+    if (rateLimits?.bucket?.requestedTokensPerCall !== undefined) {
+        lines.push(`            requestedTokensPerCall: ${rateLimits.bucket.requestedTokensPerCall},`);
+    }
+    if (rateLimits?.retry !== undefined) {
+        lines.push(`            retry: ${JSON.stringify(rateLimits.retry)},`);
+    }
+    if (rateLimits?.metrics !== undefined && rateLimits.metrics !== false) {
+        lines.push('            metrics: loggerRateLimitMetrics(),');
+    }
+    return lines.length ? `${lines.join('\n')}\n` : '';
+}
 // ADR-015/ADR-014 tenant data plane. Emitted ONLY for linked workers (the
 // optional platform); an unlinked direct-to-HubSpot Worker gets none of this.
 // Each option then activates at runtime only when its bindings are present, so
@@ -238,10 +356,14 @@ function renderTenantDataPlaneImports(heartbeat) {
         return '';
     return `import {
   createControlPlaneRuntimeInstalledPortalTelemetryEmitter,
+  createD1RuntimeAppStore,
   createD1RuntimeFlagConfigStore,
   createD1RuntimeInstalledPortalUserStore,
   createD1RuntimePlatformEventOccurrenceStore,
+  createD1RuntimeSyncPoisonStore,
+  createD1RuntimeSyncStateStore,
   createD1RuntimeWebhookDedupStore,
+  createD1RuntimeWebhookDeliveryLog,
   createKvRuntimeFlagSnapshotStore,
 } from "@hs-x/runtime";
 `;
@@ -250,9 +372,38 @@ function renderTenantDataPlaneOptions(heartbeat) {
     if (heartbeat?.mode !== 'linked')
         return '';
     return `    // Webhook trigger dedup: durable per-delivery-id claims in tenant D1
-    // (migration 0004) — \`dedup: 'strict'\` holds across isolates.
+    // (migration 0004) — \`dedup: 'strict'\` holds across isolates. The
+    // delivery LOG (migration 0008) is the redacted history behind the
+    // dashboard delivery view — best-effort writes, never payload bodies.
+    ...(env.TENANT_DB
+      ? {
+          webhook: {
+            dedupStore: createD1RuntimeWebhookDedupStore(env.TENANT_DB as never),
+            deliveryLog: createD1RuntimeWebhookDeliveryLog(env.TENANT_DB as never),
+          },
+        }
+      : {}),
+    // ctx.store: durable, install-scoped app key/value storage in tenant D1
+    // (migration 0005). Falls back to per-isolate memory when TENANT_DB is absent.
     ...(env.TENANT_DB
-      ? { webhook: { dedupStore: createD1RuntimeWebhookDedupStore(env.TENANT_DB as never) } }
+      ? { appStore: (installId) => createD1RuntimeAppStore(env.TENANT_DB as never, installId) }
+      : {}),
+    // ADR-023 durable sync execution state — safe cursor, single-winner fenced
+    // lease, chunk checkpoints (migration 0006) — plus the poison-row DLQ
+    // (migration 0007) for rows that fail validation or a permanent upsert, in
+    // tenant D1. When TENANT_DB is absent the runtime falls back to its
+    // per-isolate memory stores (dev). Install enumeration for scheduled runs
+    // rides installOAuth's owner store; delivery rides managedHubSpot.
+    ...(env.TENANT_DB
+      ? {
+          sync: {
+            store: createD1RuntimeSyncStateStore(env.TENANT_DB as never),
+            poisonStore: createD1RuntimeSyncPoisonStore(env.TENANT_DB as never),
+            // Durable cross-isolate replay protection for signed push
+            // deliveries — reuses the webhook dedup table (push:-namespaced).
+            dedupStore: createD1RuntimeWebhookDedupStore(env.TENANT_DB as never),
+          },
+        }
       : {}),
     // ADR-015 ctx.flags + Path-B evaluate endpoint (KV snapshot read).
     ...(isHsxFlagsKvConfigured(env)
@@ -477,7 +628,8 @@ export function generateServerlessWorkerProject(input) {
             'hsproject.json': renderHubSpotProjectConfig(input.legacyApp.name),
             'hsx.config.ts': renderServerlessAppConfig(input.legacyApp.name),
             'src/app/app-hsmeta.json': renderServerlessAppMetadata(input.legacyApp.name),
-            'src/workers/functions.ts': renderServerlessWorker(portable),
+            'src/workers/functions.ts': renderServerlessWorker(portable, input.serverless.sources),
+            ...renderPreservedServerlessHelpers(input.serverless.sources),
         },
     };
 }
@@ -511,25 +663,47 @@ function renderServerlessAppMetadata(appName) {
         },
     }, null, 2)}\n`;
 }
-function renderServerlessWorker(portable) {
+function renderServerlessWorker(portable, sources, cardCalls = new Map()) {
     const tools = portable
         .map(([name, fn]) => {
         const slug = toKebabCase(name);
+        const source = fn.file ? sources?.[fn.file] : undefined;
+        const isCardBackend = cardCalls.has(name);
+        const inferredInput = mergeInferredMigrationFields(cardCalls.get(name), source ? inferLegacyParameterFields(source) : undefined);
+        const inputFields = [...inferredInput.entries()]
+            .sort(([a], [b]) => a.localeCompare(b))
+            .map(([field, type]) => `    ${JSON.stringify(field)}: { type: ${JSON.stringify(type)} },`)
+            .join('\n');
+        const preservedImports = source ? collectLegacyLibImports(source) : [];
+        const preservedImportsNote = preservedImports.length > 0
+            ? `\n    // Preserved local helper(s): ${preservedImports
+                .map((path) => `./legacy/${path.slice(2)}`)
+                .join(', ')}. Update imports when porting the body.`
+            : '';
         const secretsNote = fn.secrets && fn.secrets.length > 0
             ? `\n// Secrets used by the legacy function: ${fn.secrets.join(', ')}.\n// Store each with \`hs-x secrets\` so deploys inject them into this Worker.`
             : '';
+        const stubReturn = isCardBackend ? 'return { ok: true };' : 'return ok({ ok: true });';
+        const outputSchema = isCardBackend
+            ? ''
+            : `  output: {
+    ok: { type: "boolean" },
+  },
+`;
         return `${secretsNote}
-worker.tool(${JSON.stringify(slug)}, {
+worker.${isCardBackend ? 'cardBackend' : 'tool'}(${JSON.stringify(slug)}, {
   label: ${JSON.stringify(`Migrated: ${name}`)},
-  input: {},
-  output: {
-    ok: { type: "boolean" },
+  input: {
+${inputFields}
   },
-  async handler() {
+${outputSchema}
+  async handler({ input }) {
     // TODO(migration): port the body of ${JSON.stringify(fn.file ?? name)} here.
+${preservedImportsNote}
     // The legacy handler signature was \`async (context) => result\`; HS-X
-    // passes { input, enrolledObject } and returns ok(...)/err(...).
-    return ok({ ok: true });
+    // exposes its former context.parameters values as input.
+    void input;
+    ${stubReturn}
   },
 });`;
     })
@@ -537,7 +711,8 @@ worker.tool(${JSON.stringify(slug)}, {
     return `import { defineWorker, ok } from "@hs-x/sdk";
 
 // Generated by \`hs-x migrate\` from a legacy serverless.json source.
-// Each tool below replaces one appFunction; port the original function
+// Each capability below replaces one appFunction; card-called functions use
+// cardBackend while unclassified functions remain tools. Port the original
 // bodies, then test them with \`hs-x dev\`.
 const worker = defineWorker("functions");
 ${tools}
@@ -545,6 +720,320 @@ ${tools}
 export default worker;
 `;
 }
+function matchingDelimiter(source, start, open, close) {
+    let depth = 0;
+    let quote;
+    let escaped = false;
+    for (let index = start; index < source.length; index += 1) {
+        const char = source[index] ?? '';
+        if (quote) {
+            if (escaped) {
+                escaped = false;
+            }
+            else if (char === '\\') {
+                escaped = true;
+            }
+            else if (char === quote) {
+                quote = undefined;
+            }
+            continue;
+        }
+        if (char === '"' || char === "'" || char === '`') {
+            quote = char;
+            continue;
+        }
+        if (char === open)
+            depth += 1;
+        if (char === close) {
+            depth -= 1;
+            if (depth === 0)
+                return index;
+        }
+    }
+    return -1;
+}
+function topLevelColon(value) {
+    let braces = 0;
+    let brackets = 0;
+    let parens = 0;
+    let quote;
+    let escaped = false;
+    for (let index = 0; index < value.length; index += 1) {
+        const char = value[index] ?? '';
+        if (quote) {
+            if (escaped)
+                escaped = false;
+            else if (char === '\\')
+                escaped = true;
+            else if (char === quote)
+                quote = undefined;
+            continue;
+        }
+        if (char === '"' || char === "'" || char === '`')
+            quote = char;
+        else if (char === '{')
+            braces += 1;
+        else if (char === '}')
+            braces -= 1;
+        else if (char === '[')
+            brackets += 1;
+        else if (char === ']')
+            brackets -= 1;
+        else if (char === '(')
+            parens += 1;
+        else if (char === ')')
+            parens -= 1;
+        else if (char === ':' && braces === 0 && brackets === 0 && parens === 0)
+            return index;
+    }
+    return -1;
+}
+function splitTopLevelObject(value) {
+    const parts = [];
+    let start = 0;
+    let braces = 0;
+    let brackets = 0;
+    let parens = 0;
+    let quote;
+    let escaped = false;
+    for (let index = 0; index < value.length; index += 1) {
+        const char = value[index] ?? '';
+        if (quote) {
+            if (escaped)
+                escaped = false;
+            else if (char === '\\')
+                escaped = true;
+            else if (char === quote)
+                quote = undefined;
+            continue;
+        }
+        if (char === '"' || char === "'" || char === '`')
+            quote = char;
+        else if (char === '{')
+            braces += 1;
+        else if (char === '}')
+            braces -= 1;
+        else if (char === '[')
+            brackets += 1;
+        else if (char === ']')
+            brackets -= 1;
+        else if (char === '(')
+            parens += 1;
+        else if (char === ')')
+            parens -= 1;
+        else if (char === ',' && braces === 0 && brackets === 0 && parens === 0) {
+            parts.push(value.slice(start, index));
+            start = index + 1;
+        }
+    }
+    parts.push(value.slice(start));
+    return parts;
+}
+function inferMigrationExpressionType(expression) {
+    const value = expression.trim();
+    if (/^(?:["'`]|String\s*\(|toStringValue\s*\()/.test(value))
+        return 'string';
+    if (/^(?:[-+]?(?:\d+\.?\d*|\.\d+)\b|Number\s*\()/.test(value))
+        return 'number';
+    if (/^(?:true|false)\b/.test(value))
+        return 'boolean';
+    return 'json';
+}
+function parseMigrationParameterObject(objectSource) {
+    const fields = new Map();
+    for (const rawProperty of splitTopLevelObject(objectSource)) {
+        const property = rawProperty.trim();
+        if (!property || property.startsWith('...'))
+            continue;
+        const colon = topLevelColon(property);
+        const rawName = (colon >= 0 ? property.slice(0, colon) : property).trim();
+        const nameMatch = rawName.match(/^(?:([A-Za-z_$][\w$]*)|["']([^"']+)["'])$/);
+        const name = nameMatch?.[1] ?? nameMatch?.[2];
+        if (!name)
+            continue;
+        const expression = colon >= 0 ? property.slice(colon + 1) : property;
+        fields.set(name, inferMigrationExpressionType(expression));
+    }
+    return fields;
+}
+function mergeInferredMigrationField(prior, next) {
+    if (!prior || prior === next)
+        return next;
+    if (prior === 'json')
+        return next;
+    if (next === 'json')
+        return prior;
+    return 'json';
+}
+function mergeInferredMigrationFields(...maps) {
+    const merged = new Map();
+    for (const fields of maps) {
+        for (const [name, type] of fields ?? []) {
+            merged.set(name, mergeInferredMigrationField(merged.get(name), type));
+        }
+    }
+    return merged;
+}
+function collectFrontendServerlessCalls(sources) {
+    let count = 0;
+    const fieldsByFunction = new Map();
+    for (const source of Object.values(sources ?? {})) {
+        let cursor = 0;
+        while (cursor < source.length) {
+            const callIndex = source.indexOf('runServerlessFunction', cursor);
+            if (callIndex < 0)
+                break;
+            const open = source.indexOf('(', callIndex + 'runServerlessFunction'.length);
+            if (open < 0 || !/^\s*$/.test(source.slice(callIndex + 21, open))) {
+                cursor = callIndex + 21;
+                continue;
+            }
+            const close = matchingDelimiter(source, open, '(', ')');
+            if (close < 0)
+                break;
+            const argument = source.slice(open + 1, close);
+            const name = argument.match(/\bname\s*:\s*(["'`])([^"'`]+)\1/)?.[2];
+            if (name) {
+                count += 1;
+                const current = fieldsByFunction.get(name) ?? new Map();
+                const parameters = /\bparameters\s*:/.exec(argument);
+                if (parameters) {
+                    const afterColon = argument.slice((parameters.index ?? 0) + parameters[0].length);
+                    const leading = afterColon.length - afterColon.trimStart().length;
+                    if (afterColon[leading] === '{') {
+                        const end = matchingDelimiter(afterColon, leading, '{', '}');
+                        if (end >= 0) {
+                            const inferred = parseMigrationParameterObject(afterColon.slice(leading + 1, end));
+                            for (const [field, type] of inferred) {
+                                current.set(field, mergeInferredMigrationField(current.get(field), type));
+                            }
+                        }
+                    }
+                }
+                fieldsByFunction.set(name, current);
+            }
+            cursor = close + 1;
+        }
+    }
+    return { count, fieldsByFunction };
+}
+function inferLegacyParameterFields(source) {
+    const fields = new Map();
+    const pattern = /\bcontext\.parameters(?:\?\.)?\.?([A-Za-z_$][\w$]*)/g;
+    for (const match of source.matchAll(pattern)) {
+        const name = match[1];
+        if (!name)
+            continue;
+        const before = source.slice(Math.max(0, (match.index ?? 0) - 80), match.index ?? 0);
+        const type = /Number\s*\([^)]*$/.test(before)
+            ? 'number'
+            : /(?:String|toStringValue)\s*\([^)]*$/.test(before)
+                ? 'string'
+                : 'json';
+        fields.set(name, mergeInferredMigrationField(fields.get(name), type));
+    }
+    return fields;
+}
+export const MIGRATED_RUNTIME_ORIGIN_PLACEHOLDER = 'https://runtime-origin.invalid';
+export const MIGRATED_SERVERLESS_SHIM_PATH = 'src/app/cards/_hsx-migration-run-serverless.ts';
+export function renderMigratedRunServerlessShim(runtimeOrigin, backendIds = {}) {
+    return `// Generated by hs-x migrate. The deploy command stamps the resolved
+// workers.dev origin into this compatibility bridge before HubSpot upload.
+import { hubspot } from "@hubspot/ui-extensions";
+
+const RUNTIME_ORIGIN = ${JSON.stringify(stripTrailingSlash(runtimeOrigin))};
+const BACKEND_IDS: Readonly<Record<string, string>> = ${JSON.stringify(backendIds, null, 2)};
+
+export interface LegacyServerlessFunctionResult<TResponse = unknown> {
+  readonly status: "SUCCESS" | "ERROR";
+  readonly message?: string;
+  readonly response?: TResponse;
+}
+
+export async function runServerlessFunction<TResponse = unknown>({
+  name,
+  parameters,
+}: {
+  readonly name: string;
+  readonly parameters?: Record<string, unknown>;
+}): Promise<LegacyServerlessFunctionResult<TResponse>> {
+  try {
+    const backendId = BACKEND_IDS[name] ?? name;
+    const response = await hubspot.fetch(
+      \`\${RUNTIME_ORIGIN}/_hsx/cards/\${encodeURIComponent(backendId)}\`,
+      {
+        method: "POST",
+        body: { input: parameters ?? {} },
+      },
+    );
+    const payload = (await response.json().catch(() => undefined)) as
+      | { ok?: boolean; result?: TResponse; message?: string; error?: string }
+      | undefined;
+    if (!response.ok || payload?.ok !== true) {
+      return {
+        status: "ERROR",
+        message: payload?.message ?? payload?.error ?? \`Backend request failed (\${response.status}).\`,
+      };
+    }
+    return { status: "SUCCESS", response: payload.result };
+  } catch (error) {
+    return {
+      status: "ERROR",
+      message: error instanceof Error ? error.message : String(error),
+    };
+  }
+}
+`;
+}
+export function stampMigratedRunServerlessShimOrigin(source, runtimeOrigin) {
+    const value = JSON.stringify(stripTrailingSlash(runtimeOrigin));
+    return source.replace(/const RUNTIME_ORIGIN = ["'][^"']*["'];/, `const RUNTIME_ORIGIN = ${value};`);
+}
+function rewriteMigratedCardProvider(source, entrypoint) {
+    const provider = /(hubspot\.extend(?:<[^>]+>)?\s*\(\s*\(\s*\{)([^}]*)(\}\s*\)\s*=>)/m;
+    const match = provider.exec(source);
+    if (!match || !/\brunServerlessFunction\b/.test(match[2] ?? ''))
+        return source;
+    const rewrittenProps = (match[2] ?? '')
+        .split(',')
+        .map((part) => part.trim())
+        .filter((part) => part && part !== 'runServerlessFunction')
+        .join(', ');
+    let rewritten = source.replace(provider, `$1${rewrittenProps}$3`);
+    const beforeProp = rewritten;
+    rewritten = rewritten.replace(/runServerlessFunction=\{\s*runServerlessFunction(\s+as\s+[^}]+)?\}/g, (_whole, cast) => `runServerlessFunction={hsxRunServerlessFunction${cast ?? ''}}`);
+    if (rewritten === beforeProp)
+        return source;
+    const depth = Math.max(0, entrypoint.replace(/\\/g, '/').split('/').length - 1);
+    const modulePath = `${depth === 0 ? './' : '../'.repeat(depth)}_hsx-migration-run-serverless`;
+    return `import { runServerlessFunction as hsxRunServerlessFunction } from ${JSON.stringify(modulePath)};
+${rewritten}`;
+}
+function canRewriteMigratedCardProvider(sources, entrypoint) {
+    const source = sources[entrypoint];
+    return (typeof source === 'string' &&
+        /hubspot\.extend(?:<[^>]+>)?\s*\(\s*\(\s*\{[^}]*\brunServerlessFunction\b[^}]*\}\s*\)\s*=>/m.test(source) &&
+        /runServerlessFunction=\{\s*runServerlessFunction(?:\s+as\s+[^}]+)?\}/.test(source));
+}
+function collectLegacyLibImports(source) {
+    const imports = new Set();
+    const pattern = /(?:require\s*\(\s*|from\s+)(['"])(\.\/lib\/[^'"]+)\1/g;
+    for (const match of source.matchAll(pattern)) {
+        if (match[2])
+            imports.add(match[2]);
+    }
+    return [...imports].sort();
+}
+function renderPreservedServerlessHelpers(sources) {
+    const files = {};
+    for (const [rawPath, contents] of Object.entries(sources ?? {})) {
+        const path = rawPath.replace(/\\/g, '/').replace(/^\.\/+/, '');
+        if (!path.startsWith('lib/') || path.split('/').includes('..'))
+            continue;
+        files[`src/workers/legacy/${path}`] = contents;
+    }
+    return files;
+}
 /** Read scope a card needs for the object it renders on (validator's map). */
 function cardReadScope(objectType) {
     const t = objectType.toLowerCase();
@@ -576,6 +1065,36 @@ export function generateMigratedHsxProject(input) {
     };
     const scopes = new Set(['crm.objects.contacts.read']);
     const permittedFetch = new Set();
+    const migratedCardRuntimeDependencies = collectMigratedCardRuntimeDependencies(input.projectCards ?? []);
+    const callsByCard = new Map();
+    const providerRewritableCards = new Set();
+    const allCardCalls = new Map();
+    for (const projectCard of input.projectCards ?? []) {
+        const scan = collectFrontendServerlessCalls(projectCard.sources);
+        callsByCard.set(projectCard, scan);
+        if (projectCard.entrypoint &&
+            canRewriteMigratedCardProvider(projectCard.sources ?? {}, projectCard.entrypoint)) {
+            providerRewritableCards.add(projectCard);
+        }
+        for (const [name, fields] of scan.fieldsByFunction) {
+            allCardCalls.set(name, mergeInferredMigrationFields(allCardCalls.get(name), fields));
+        }
+    }
+    const portableServerlessNames = new Set(Object.entries(input.serverless?.appFunctions ?? {})
+        .filter(([, fn]) => typeof fn.file === 'string' && fn.file.length > 0 && fn.endpoint === undefined)
+        .map(([name]) => name));
+    const routedCardCalls = new Map([...allCardCalls].filter(([name]) => portableServerlessNames.has(name)));
+    const shimBackendNames = new Set();
+    for (const projectCard of providerRewritableCards) {
+        for (const name of callsByCard.get(projectCard)?.fieldsByFunction.keys() ?? []) {
+            if (portableServerlessNames.has(name))
+                shimBackendNames.add(name);
+        }
+    }
+    if (shimBackendNames.size > 0) {
+        permittedFetch.add(MIGRATED_RUNTIME_ORIGIN_PLACEHOLDER);
+        files[MIGRATED_SERVERLESS_SHIM_PATH] = renderMigratedRunServerlessShim(MIGRATED_RUNTIME_ORIGIN_PLACEHOLDER, Object.fromEntries([...shimBackendNames].map((name) => [name, toKebabCase(name)])));
+    }
     const card = input.legacyCard;
     if (card && typeof card.fetchUrl === 'string' && card.fetchUrl.length > 0) {
         const cardSlug = toKebabCase(card.title || card.id);
@@ -590,7 +1109,7 @@ export function generateMigratedHsxProject(input) {
                 scopes.add(scope);
         }
         if (!files['src/app/cards/package.json']) {
-            files['src/app/cards/package.json'] = renderMigratedCardsPackage();
+            files['src/app/cards/package.json'] = renderMigratedCardsPackage(migratedCardRuntimeDependencies);
         }
         files[`src/app/cards/${componentName}.tsx`] = renderMigratedCardComponent(componentName, card.fetchUrl);
         files[`src/app/cards/${cardSlug}-hsmeta.json`] = renderMigratedCardMetadata({
@@ -607,14 +1126,24 @@ export function generateMigratedHsxProject(input) {
         const name = projectCard.name || projectCard.uid || 'Migrated Card';
         const slug = toKebabCase(projectCard.uid || name);
         const sources = projectCard.sources ?? {};
-        // Carry the React component tree over wholesale; identical paths from
-        // sibling cards sharing a directory dedupe naturally.
-        for (const [rel, contents] of Object.entries(sources)) {
-            files[`src/app/cards/${rel}`] = contents;
-        }
         const entryFile = Object.keys(sources).includes(projectCard.entrypoint)
             ? projectCard.entrypoint
             : (Object.keys(sources).find((f) => /\.(t|j)sx?$/.test(f)) ?? projectCard.entrypoint);
+        // Carry the React component tree over wholesale; identical paths from
+        // sibling cards sharing a directory dedupe naturally. For a card that
+        // called portable serverless functions, rewrite only the provider in the
+        // entrypoint and leave every hook/call site untouched.
+        const cardCalls = callsByCard.get(projectCard);
+        const cardHasRoutedBackend = providerRewritableCards.has(projectCard) &&
+            [...(cardCalls?.fieldsByFunction.keys() ?? [])].some((name) => portableServerlessNames.has(name));
+        for (const [rel, contents] of Object.entries(sources)) {
+            if (rel === 'package.json' || rel.endsWith('/package.json'))
+                continue;
+            files[`src/app/cards/${rel}`] =
+                rel === entryFile && cardHasRoutedBackend
+                    ? rewriteMigratedCardProvider(contents, entryFile)
+                    : contents;
+        }
         const objectTypes = projectCard.objectTypes?.length ? projectCard.objectTypes : ['contacts'];
         for (const objectType of objectTypes) {
             const scope = cardReadScope(objectType);
@@ -622,7 +1151,7 @@ export function generateMigratedHsxProject(input) {
                 scopes.add(scope);
         }
         if (!files['src/app/cards/package.json']) {
-            files['src/app/cards/package.json'] = renderMigratedCardsPackage();
+            files['src/app/cards/package.json'] = renderMigratedCardsPackage(migratedCardRuntimeDependencies);
         }
         files[`src/app/cards/${slug}-hsmeta.json`] = `${JSON.stringify({
             uid: slug,
@@ -641,7 +1170,8 @@ export function generateMigratedHsxProject(input) {
             .filter(([, fn]) => typeof fn.file === 'string' && fn.file.length > 0 && fn.endpoint === undefined)
             .sort(([a], [b]) => a.localeCompare(b));
         if (portable.length > 0) {
-            files['src/workers/functions.ts'] = renderServerlessWorker(portable);
+            files['src/workers/functions.ts'] = renderServerlessWorker(portable, input.serverless.sources, routedCardCalls);
+            Object.assign(files, renderPreservedServerlessHelpers(input.serverless.sources));
         }
     }
     if (input.webhooks) {
@@ -667,11 +1197,22 @@ export function generateMigratedHsxProject(input) {
     // Workers, or upload — the original run-003 blocker; the composed generator
     // must emit it like the single-kind generators did.
     files['package.json'] = renderMigratedRootPackage(input.legacyApp.name);
-    files['hsx.config.ts'] = renderComposedAppConfig(appConfig.name ?? input.legacyApp.name, appConfig, [...scopes].sort(), [...permittedFetch].sort());
+    files['hsx.config.ts'] = renderComposedAppConfig(appConfig.name ?? input.legacyApp.name, appConfig, [...scopes].sort(), [...permittedFetch].sort(), (input.projectCards ?? []).map((projectCard) => {
+        const name = projectCard.name || projectCard.uid || 'Migrated Card';
+        const calledBackend = [...(callsByCard.get(projectCard)?.fieldsByFunction.keys() ?? [])].find((candidate) => providerRewritableCards.has(projectCard) && portableServerlessNames.has(candidate));
+        return {
+            id: toKebabCase(projectCard.uid || name),
+            name,
+            location: projectCard.location ?? 'crm.record.tab',
+            objectTypes: projectCard.objectTypes?.length ? projectCard.objectTypes : ['contacts'],
+            entrypoint: `./src/app/cards/${projectCard.entrypoint ?? 'Card.tsx'}`,
+            ...(calledBackend ? { backend: toKebabCase(calledBackend) } : {}),
+        };
+    }));
     files['src/app/app-hsmeta.json'] = renderComposedAppMetadata(appConfig.name ?? input.legacyApp.name, appConfig, [...scopes].sort(), [...permittedFetch].sort());
     return { files };
 }
-function renderComposedAppConfig(appName, appConfig, scopes, permittedFetch) {
+function renderComposedAppConfig(appName, appConfig, scopes, permittedFetch, cards = []) {
     const distribution = appConfig.distribution === 'marketplace' ? 'marketplace' : 'private';
     const auth = appConfig.authType === 'static' || !appConfig.redirectUrls?.length ? 'static' : 'oauth';
     const description = appConfig.description
@@ -690,14 +1231,25 @@ function renderComposedAppConfig(appName, appConfig, scopes, permittedFetch) {
         img.length > 0 ? `    img: ${JSON.stringify(img)},` : undefined,
     ].filter((entry) => entry !== undefined);
     const permitted = permittedEntries.length > 0 ? `\n  permittedUrls: {\n${permittedEntries.join('\n')}\n  },` : '';
-    return `import { defineApp } from "@hs-x/sdk";
+    const cardDeclarations = cards.length > 0
+        ? `\n  cards: [\n${cards
+            .map((cardDefinition) => `    card({
+      id: ${JSON.stringify(cardDefinition.id)},
+      name: ${JSON.stringify(cardDefinition.name)},
+      location: ${JSON.stringify(cardDefinition.location)},
+      objectTypes: ${JSON.stringify(cardDefinition.objectTypes)},
+      entrypoint: ${JSON.stringify(cardDefinition.entrypoint)},${cardDefinition.backend ? `\n      backend: ${JSON.stringify(cardDefinition.backend)},` : ''}
+    }),`)
+            .join('\n')}\n  ],`
+        : '';
+    return `import { ${cards.length > 0 ? 'card, ' : ''}defineApp } from "@hs-x/sdk";
 
 export default defineApp({
   name: ${JSON.stringify(appName.replace(/\s+Legacy$/i, ''))},${description}
   distribution: ${JSON.stringify(distribution)},
   auth: ${JSON.stringify(auth)},
   platformVersion: "2026.03",
-  scopes: ${JSON.stringify(scopes)},${optional}${permitted}
+  scopes: ${JSON.stringify(scopes)},${optional}${permitted}${cardDeclarations}
 });
 `;
 }
@@ -877,6 +1429,29 @@ export function generateHubSpotRuntimeProject(options) {
             renderAppEventMetadata(event);
     }
     const cards = options.cards ?? [];
+    const linkedCards = cards.filter((card) => card.backend);
+    if (linkedCards.length > 0) {
+        // C03 (ADR-018): a card that declares a `backend` is validated against the
+        // worker capabilities and the app's fetch allowlist BEFORE any file is
+        // emitted, so a broken link fails codegen rather than shipping a card whose
+        // `hubspot.fetch` is dead. The effective allowlist mirrors the app-hsmeta
+        // computation (the runtime origin is always auto-permitted).
+        const effectiveFetch = [
+            options.runtimeBaseUrl,
+            ...(options.permittedUrls?.fetch ?? []).filter((url) => url !== options.runtimeBaseUrl),
+        ];
+        const errors = validateCardBackends({
+            cards,
+            workers: options.workers,
+            runtimeOrigin: options.runtimeBaseUrl,
+            fetchAllowlist: effectiveFetch,
+        });
+        if (errors.length > 0) {
+            throw new Error(`Card backend linkage is invalid:\n${errors
+                .map((error) => `  - [${error.code}] ${error.message}`)
+                .join('\n')}`);
+        }
+    }
     for (const card of cards) {
         files[`src/app/cards/${toKebabCase(card.id)}-hsmeta.json`] = renderRuntimeCardMetadata(card);
     }
@@ -884,6 +1459,16 @@ export function generateHubSpotRuntimeProject(options) {
         // A single package.json is shared by all cards (HubSpot's convention).
         files['src/app/cards/package.json'] = renderCardsPackage();
     }
+    if (linkedCards.length > 0) {
+        // The typed, secret-free client the card components import to reach their
+        // backend. Server/client separation is the file boundary: this module holds
+        // only the public runtime origin + dispatch path.
+        files['src/app/cards/_hsx-backend.ts'] = renderCardBackendClient({
+            cards: linkedCards,
+            workers: options.workers,
+            runtimeOrigin: options.runtimeBaseUrl,
+        });
+    }
     return { files };
 }
 /** The component filename a card's hsmeta `entrypoint` points at, e.g. `DealSummary`. */
@@ -918,6 +1503,150 @@ function renderCardsPackage() {
         },
     }, null, 2)}\n`;
 }
+function originOf(url) {
+    try {
+        return new URL(url).origin;
+    }
+    catch {
+        return url.replace(/\/+$/, '');
+    }
+}
+function stripTrailingSlash(url) {
+    return url.replace(/\/+$/, '');
+}
+/**
+ * Cross-check every card that declares a `backend` against the worker
+ * capabilities and the app's fetch allowlist. Pure and side-effect-free so both
+ * codegen (which throws) and callers doing author-time linting can consume it.
+ *
+ * Errors:
+ *  - `card.backend.missing`         — no `card-backend` capability with that id.
+ *  - `card.backend.permission-missing` — the runtime origin the generated
+ *    `hubspot.fetch` targets is not in `permittedUrls.fetch`, so HubSpot would
+ *    block the call.
+ *  - `card.backend.scope-mismatch`  — the backend declares `objectTypes` and the
+ *    card renders on an object type the backend does not serve.
+ */
+export function validateCardBackends(input) {
+    const backends = new Map();
+    for (const capability of cardBackendCapabilities(input.workers)) {
+        backends.set(capability.id, capability);
+    }
+    const runtimeOrigin = originOf(input.runtimeOrigin);
+    const originPermitted = input.fetchAllowlist.some((url) => originOf(url) === runtimeOrigin);
+    const diagnostics = [];
+    for (const card of input.cards) {
+        if (!card.backend)
+            continue;
+        const backendId = card.backend;
+        const backend = backends.get(backendId);
+        if (!backend) {
+            diagnostics.push({
+                code: 'card.backend.missing',
+                severity: 'error',
+                cardId: card.id,
+                backendId,
+                message: `Card "${card.id}" declares backend "${backendId}", but no cardBackend capability with that id is defined in any worker.`,
+            });
+            continue;
+        }
+        if (!originPermitted) {
+            diagnostics.push({
+                code: 'card.backend.permission-missing',
+                severity: 'error',
+                cardId: card.id,
+                backendId,
+                message: `Card "${card.id}" calls backend "${backendId}" at ${runtimeOrigin}, but that origin is not in permittedUrls.fetch; HubSpot would block the UI extension's hubspot.fetch. Add it to permittedUrls.fetch.`,
+            });
+        }
+        // A backend that declares `objectTypes` constrains which cards may call it;
+        // a backend without them serves any object and skips this check.
+        if (backend.objectTypes && backend.objectTypes.length > 0) {
+            const served = new Set(backend.objectTypes.map(toHubSpotObjectType));
+            const unserved = card.objectTypes.filter((type) => !served.has(toHubSpotObjectType(type)));
+            if (unserved.length > 0) {
+                diagnostics.push({
+                    code: 'card.backend.scope-mismatch',
+                    severity: 'error',
+                    cardId: card.id,
+                    backendId,
+                    message: `Card "${card.id}" renders on ${unserved.join(', ')}, but backend "${backendId}" only serves ${backend.objectTypes.join(', ')}. Add the object type(s) to the cardBackend or narrow the card.`,
+                });
+            }
+        }
+    }
+    return diagnostics;
+}
+/**
+ * The typed, secret-free client a UI-extension card imports to call its backend.
+ * One exported callable per referenced `card-backend`, each wrapping
+ * `hubspot.fetch(<runtimeOrigin>/_hsx/cards/<id>)`. The server/client boundary
+ * is the file boundary: this module never contains handler source, credentials,
+ * signing keys, or env — only the public origin and dispatch path.
+ */
+export function renderCardBackendClient(input) {
+    const backends = new Map();
+    for (const capability of cardBackendCapabilities(input.workers)) {
+        backends.set(capability.id, capability);
+    }
+    const referenced = new Map();
+    for (const card of input.cards) {
+        if (!card.backend)
+            continue;
+        const backend = backends.get(card.backend);
+        if (backend)
+            referenced.set(backend.id, backend);
+    }
+    const callables = [...referenced.values()]
+        .map((backend) => {
+        const fn = toIdentifier(backend.id);
+        const path = cardBackendDispatchPath(backend.id);
+        const label = backend.label ? ` (${backend.label})` : '';
+        return `/** Call the \`${backend.id}\` card backend${label}. */
+export function ${fn}<TResponse = unknown>(
+  body?: Record<string, unknown>,
+): Promise<CardBackendResponse<TResponse>> {
+  return callCardBackend<TResponse>(${JSON.stringify(path)}, body);
+}
+`;
+    })
+        .join('\n');
+    return `// Generated by hs-x. Do not edit.
+//
+// Typed card→backend client for the UI-extension bundle. It references only the
+// public runtime origin and the ADR-018 card dispatch path — nothing from the
+// server side crosses this file boundary. Import a callable into a card
+// component and call it like a fetch; HS-X authenticates the request on the
+// runtime (v3 signature + active-install binding).
+import { hubspot } from '@hubspot/ui-extensions';
+
+const RUNTIME_ORIGIN = ${JSON.stringify(stripTrailingSlash(input.runtimeOrigin))};
+
+export interface CardBackendResponse<TData = unknown> {
+  readonly ok: boolean;
+  readonly status: number;
+  readonly data: TData;
+}
+
+async function callCardBackend<TData>(
+  path: string,
+  body?: Record<string, unknown>,
+): Promise<CardBackendResponse<TData>> {
+  // hubspot.fetch serializes \`body\` itself (its contract types \`body\` as an
+  // object, not a string). Passing a pre-stringified body double-encodes it —
+  // the runtime then parses a JSON string, not a record, and rejects it with
+  // 400 invalid_payload. So hand the object straight through.
+  const response = await hubspot.fetch(\`\${RUNTIME_ORIGIN}\${path}\`, {
+    method: 'POST',
+    ...(body === undefined ? {} : { body }),
+  });
+  const data = (await response.json().catch(() => undefined)) as TData;
+  return { ok: response.ok, status: response.status, data };
+}
+
+${callables}`;
+}
+// ─────────────────────────────────────────────────────────────────────────────
 // HubSpot project names become part of URLs and must agree with the scaffolded
 // package.json name and the deploy's project identity. Slugify to a lowercase,
 // url-safe form so e.g. "HSX E2E 006" -> "hsx-e2e-006" rather than a spaced name
@@ -959,9 +1688,14 @@ function renderRuntimeAppMetadata(options) {
                 conditionallyRequiredScopes: [],
             },
             permittedUrls: {
-                fetch: [options.runtimeBaseUrl],
-                iframe: [],
-                img: [],
+                // The worker URL is always fetch-permitted (UI extensions and the
+                // runtime call it); author-declared fetch hosts are merged in.
+                fetch: [
+                    options.runtimeBaseUrl,
+                    ...(options.permittedUrls?.fetch ?? []).filter((url) => url !== options.runtimeBaseUrl),
+                ],
+                iframe: [...(options.permittedUrls?.iframe ?? [])],
+                img: [...(options.permittedUrls?.img ?? [])],
             },
             support: {
                 supportEmail: 'support@example.com',
@@ -1035,7 +1769,9 @@ function renderAppObjectMetadata(object) {
             ...(object.appPrefix ? { appPrefix: object.appPrefix } : {}),
             primaryDisplayLabelPropertyName: object.primaryDisplayLabelPropertyName,
             ...(object.secondaryDisplayLabelPropertyNames
-                ? { secondaryDisplayLabelPropertyNames: object.secondaryDisplayLabelPropertyNames }
+                ? {
+                    secondaryDisplayLabelPropertyNames: object.secondaryDisplayLabelPropertyNames,
+                }
                 : {}),
             ...(object.requiredProperties ? { requiredProperties: object.requiredProperties } : {}),
             ...(object.searchableProperties
@@ -1191,14 +1927,24 @@ function hubSpotWorkflowInputFields(fields) {
         else if (options) {
             typeDefinition.options = options;
         }
-        const supportedValueTypes = Array.isArray(record.supportedValueTypes)
+        const declaredValueTypes = Array.isArray(record.supportedValueTypes)
             ? record.supportedValueTypes.filter((value) => typeof value === 'string')
-            : ['STATIC_VALUE'];
+            : [];
+        // HubSpot rejects an input field that declares more than one
+        // supportedValueType ("must have exactly one supportedValueType"), so fail
+        // here with a clear message rather than letting the HubSpot build error out.
+        if (declaredValueTypes.length > 1) {
+            throw new Error(`Workflow action input field "${name}" declares ${declaredValueTypes.length} supportedValueTypes (${declaredValueTypes.join(', ')}). HubSpot requires exactly one per field — choose STATIC_VALUE (user enters a value) or OBJECT_PROPERTY (user picks a property or a prior action's output).`);
+        }
+        const supportedValueTypes = declaredValueTypes.length === 1 ? declaredValueTypes : ['STATIC_VALUE'];
+        // Match HubSpot's platform default: input fields are optional unless the
+        // author opts in. (HubSpot's custom-action schema treats isRequired as
+        // false-by-default.) Honor either `isRequired` or the `required` alias.
         const isRequired = typeof record.isRequired === 'boolean'
             ? record.isRequired
             : typeof record.required === 'boolean'
                 ? record.required
-                : true;
+                : false;
         return {
             typeDefinition,
             supportedValueTypes,
@@ -1337,7 +2083,45 @@ function renderMigratedRootPackage(appName) {
         },
     }, null, 2)}\n`;
 }
-function renderMigratedCardsPackage() {
+function collectMigratedCardRuntimeDependencies(cards) {
+    const importedPackages = new Set();
+    const declaredDependencies = new Map();
+    for (const card of cards) {
+        for (const [file, contents] of Object.entries(card.sources ?? {})) {
+            if (file === 'package.json' || file.endsWith('/package.json')) {
+                try {
+                    const pkg = JSON.parse(contents);
+                    for (const [name, version] of Object.entries({
+                        ...(pkg.dependencies ?? {}),
+                        ...(pkg.optionalDependencies ?? {}),
+                    })) {
+                        if (typeof version === 'string')
+                            declaredDependencies.set(name, version);
+                    }
+                }
+                catch {
+                    // Invalid legacy package metadata is ignored; the normalized base
+                    // dependencies still produce a valid card package.
+                }
+                continue;
+            }
+            for (const match of contents.matchAll(/(?:\bfrom\s+|\bimport\s*\(\s*|\brequire\s*\(\s*)(["'])([^"'./][^"']*)\1/g)) {
+                const specifier = match[2];
+                if (!specifier)
+                    continue;
+                const segments = specifier.split('/');
+                importedPackages.add(specifier.startsWith('@') ? segments.slice(0, 2).join('/') : (segments[0] ?? specifier));
+            }
+        }
+    }
+    return Object.fromEntries([...declaredDependencies]
+        .filter(([name]) => importedPackages.has(name) &&
+        name !== '@hubspot/ui-extensions-dev-server' &&
+        name !== '@hubspot/ui-extensions' &&
+        name !== 'react')
+        .sort(([a], [b]) => a.localeCompare(b)));
+}
+function renderMigratedCardsPackage(runtimeDependencies = {}) {
     return `${JSON.stringify({
         name: 'hs-x-migrated-cards',
         version: '0.1.0',
@@ -1345,6 +2129,7 @@ function renderMigratedCardsPackage() {
         dependencies: {
             '@hubspot/ui-extensions': 'latest',
             react: '^18.2.0',
+            ...runtimeDependencies,
         },
     }, null, 2)}\n`;
 }