@webflow/cloud-app 0.1.0-beta.10

package/LICENSE

@@ -0,0 +1,21 @@
+MIT License
+
+Copyright (c) 2026 Webflow, Inc.
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+SOFTWARE.

package/README.md

@@ -0,0 +1,161 @@
+# @webflow/cloud-app
+
+Build a JS framework app into a [Webflow Cloud](https://webflow.com) bundle that
+runs on Cloudflare Workers — **without your app having to know anything about
+Cloudflare.**
+
+You declare what you need in `webflow.json`. `@webflow/cloud-app` figures out your
+framework (Vite, Next.js, Astro), injects the right Cloudflare adapter and
+config, runs the build, and produces a worker-ready output directory. No
+`wrangler.json`, no adapter packages in your `package.json`, no generated config
+files in your tree — all of that happens in an ephemeral build workspace.
+
+This is the same engine the Webflow CLI and Webflow Cloud's server-side builder
+use, so a build is identical wherever it runs.
+
+> **Status:** early. The public API and the host port seam below are stable; the
+> framework build pipeline is being extracted from the canonical
+> (cosmic-builder) implementation. `buildApp` throws `NotImplementedError` until
+> that lands.
+
+## Install
+
+```bash
+npm install @webflow/cloud-app
+```
+
+## Usage
+
+```ts
+import { buildApp, consoleLogger, nodeCommandRunner } from '@webflow/cloud-app';
+
+const result = await buildApp({
+  projectDir: process.cwd(),
+  outputDir: './.webflow-output',
+  ports: {
+    logger: consoleLogger,
+    runCommand: nodeCommandRunner,
+    // telemetry + fs fall back to no-op / node defaults
+  },
+});
+
+console.log(result.framework, result.deploymentType, result.entrypointPath);
+```
+
+## Ports — running the same engine anywhere
+
+Everything environment-specific is injected, so the engine itself is pure build
+logic and stays public-safe (no auth, upload, secrets, or vendor SDKs baked in).
+
+| Port         | Required | Default                                   | Why a host overrides it                                                |
+| ------------ | -------- | ----------------------------------------- | ---------------------------------------------------------------------- |
+| `logger`     | yes      | `consoleLogger` / `silentLogger` provided | route output into oclif spinners, ECS structured logs, etc.            |
+| `runCommand` | yes      | `nodeCommandRunner` provided              | control/sandbox how `npm`, the framework build, and `wrangler` execute |
+| `telemetry`  | no       | `noopTelemetry`                           | wrap `dd-trace` so existing dashboards keep working                    |
+| `fs`         | no       | `nodeFileSystem`                          | plug in a virtual filesystem (e.g. browser-based agents)               |
+
+## `webflow.json`
+
+The only Webflow-owned file in your project. Framework is auto-detected (you can
+pin it) and **bindings are declared here** rather than in `wrangler.json`:
+
+```jsonc
+{
+  "cloud": {
+    "framework": "nextjs",
+    "bindings": {
+      "kv": [{ "binding": "MY_KV" }],
+      "r2": [{ "binding": "MY_BUCKET", "bucket_name": "my-bucket" }],
+      "d1": [{ "binding": "DB", "database_name": "app-db", "migrations_dir": "./migrations" }],
+    },
+  },
+}
+```
+
+You declare the binding name (and, for R2/D1, the resource name) — Webflow Cloud
+provisions the resource and namespaces it per environment. KV ids / D1
+`database_id`s are assigned for you; omit them. Limits: up to 5 of each type; R2
+bucket names are lowercase alphanumeric + hyphens, ≤27 chars. (`vars` is not
+supported yet — it needs deployer support to propagate.)
+
+The deploy-contract fields (`contract_version`, `framework`, `deployment_type`,
+`entrypoint_path`, `skip_no_bundle`) are filled in by the build and validated
+against [`@webflow/cosmic-deploy-contract`](https://www.npmjs.com/package/@webflow/cosmic-deploy-contract)
+before output is produced.
+
+## Development
+
+```bash
+npm install      # from the monorepo root
+npm test         # jest
+npm run build    # tsc → dist/
+npm run type-check
+```
+
+## How consumers resolve this package
+
+Two consumers build with this engine: the Webflow CLI (`apps/webflow-cli`, same
+monorepo) and the cosmic-builder image (`webflow/infrastructure`, a separate
+repo). Which copy of `@webflow/cloud-app` they load is decided by **where
+`npm install` ran**, not by how the code is bundled and not at runtime — a
+`require("@webflow/cloud-app")` just reads whatever `npm` put in `node_modules`.
+
+| Scenario                                                                     | `node_modules/@webflow/cloud-app` is… | Source                |
+| ---------------------------------------------------------------------------- | ------------------------------------- | --------------------- |
+| End user runs `npm i -g @webflow/webflow-cli`                                | the registry copy npm fetched         | npm registry          |
+| Engineer working in the webflow-cli repo (`npm ci`, build, run local `dist`) | a symlink to `apps/webflow-cloud-app` | workspace (repo tree) |
+| CI for webflow-cli (unit, regression, e2e)                                   | a symlink to `apps/webflow-cloud-app` | workspace (repo tree) |
+| cosmic-builder (separate repo)                                               | the registry copy npm fetched         | npm registry          |
+
+- **Inside this monorepo the CLI always uses the workspace copy.**
+  `apps/webflow-cloud-app` is a workspace member, so npm links it by name
+  while the declared version matches — `apps/webflow-cli`
+  depends on it at an exact pin equal to this package's version (enforced in CI
+  by `npm run check:cloud-app-pin`; a mismatched pin would make npm silently
+  install the registry copy instead). Edit the source here and it takes effect on
+  the next build.
+- **The published CLI uses the registry copy.** The engine is kept external in
+  the CLI's tsup bundle (it is CJS, not inlined), so the shipped `dist` keeps
+  `require("@webflow/cloud-app")` and resolves it at the user's install time.
+  The CLI's `package.json` carries an exact pin (not a caret, since this is a
+  prerelease line the CLI is built and tested against), so released builds
+  resolve exactly that version from npm.
+- **cosmic-builder is a different repo**, so it has no workspace copy and always
+  resolves from the registry. That is why publishing to npm (below) still
+  matters even though the CLI links the workspace in development.
+
+## Publishing
+
+Published **manually** from this folder — there is no GitHub Action. Its release
+cadence follows the build engine, not the CLI. It is a regular changesets
+workspace package, but `changeset publish` always publishes with `--tag latest`,
+which would move `latest` onto a beta, so it must already be on npm before a CLI
+release: `publish-packages.sh` refuses to run otherwise, and skips it once it is.
+Don't add changesets for this package — changesets can't increment a prerelease
+(it would turn `0.1.0-beta.7` into `0.1.0`); bump the version by hand. CI fails
+(`npm run check:cloud-app-pin`) if a changeset names it.
+
+This is a prerelease line (`0.1.0-beta.x`), so always pass an explicit
+`--tag` — npm would otherwise move the `latest` tag onto a beta. The CLI pins
+this exact version, so move the pin in the same PR (CI runs
+`npm run check:cloud-app-pin`):
+
+```bash
+# from apps/webflow-cloud-app
+npm version prerelease --preid beta --no-git-tag-version   # 0.1.0-beta.7 → 0.1.0-beta.8
+# set "@webflow/cloud-app" in apps/webflow-cli/package.json to the same version
+# and run `npm install` from the repo root
+npm publish --tag beta                                     # installs via @webflow/cloud-app@beta
+```
+
+To test a build against the consumers (webflow-cli, cosmic-builder) before a
+real release, publish the same version under a throwaway ticket-scoped tag so
+it never touches `latest` or `beta`:
+
+```bash
+npm publish --tag beta7-cloud888     # installs via @webflow/cloud-app@beta7-cloud888
+```
+
+Consumers then pin that exact version (e.g. `"@webflow/cloud-app": "0.1.0-beta.8"`)
+and CI resolves it from the registry. Remove a throwaway tag when done with
+`npm dist-tag rm @webflow/cloud-app beta7-cloud888`.

package/dist/bindings.d.ts

@@ -0,0 +1,190 @@
+/**
+ * Cloud resource bindings declared in `webflow.json`.
+ *
+ * NEW in @webflow/cloud-app: users declare KV / R2 / D1 bindings under
+ * `cloud.bindings` in webflow.json instead of hand-writing wrangler.json (which
+ * is now internal). The engine validates them and synthesizes a wrangler-shaped
+ * bridge (clouduser.wrangler.json) that the existing deployer consumes
+ * unchanged — the deployer namespaces resources as `<APP_NAME>-<name>` and
+ * fills in the real ids, so the placeholder ids below only need to satisfy the
+ * build-phase wrangler schema + dry-run.
+ *
+ * `vars` are intentionally NOT supported yet: the deployer's
+ * `processWranglerBindings` ships only d1/kv/r2 and drops everything else, so
+ * vars wouldn't survive to deploy without a deployer change.
+ */
+import { z } from 'zod';
+import type { WranglerJson } from './wrangler';
+/** Max number of each binding type, matching the deployer's limits. */
+export declare const MAX_BINDINGS_PER_TYPE = 5;
+export declare const KvBindingSchema: z.ZodObject<{
+    binding: z.ZodString;
+    id: z.ZodOptional<z.ZodString>;
+}, "passthrough", z.ZodTypeAny, z.objectOutputType<{
+    binding: z.ZodString;
+    id: z.ZodOptional<z.ZodString>;
+}, z.ZodTypeAny, "passthrough">, z.objectInputType<{
+    binding: z.ZodString;
+    id: z.ZodOptional<z.ZodString>;
+}, z.ZodTypeAny, "passthrough">>;
+export declare const R2BindingSchema: z.ZodObject<{
+    binding: z.ZodString;
+    bucket_name: z.ZodString;
+}, "passthrough", z.ZodTypeAny, z.objectOutputType<{
+    binding: z.ZodString;
+    bucket_name: z.ZodString;
+}, z.ZodTypeAny, "passthrough">, z.objectInputType<{
+    binding: z.ZodString;
+    bucket_name: z.ZodString;
+}, z.ZodTypeAny, "passthrough">>;
+export declare const D1BindingSchema: z.ZodObject<{
+    binding: z.ZodString;
+    database_name: z.ZodString;
+    database_id: z.ZodOptional<z.ZodString>;
+    migrations_dir: z.ZodOptional<z.ZodString>;
+}, "passthrough", z.ZodTypeAny, z.objectOutputType<{
+    binding: z.ZodString;
+    database_name: z.ZodString;
+    database_id: z.ZodOptional<z.ZodString>;
+    migrations_dir: z.ZodOptional<z.ZodString>;
+}, z.ZodTypeAny, "passthrough">, z.objectInputType<{
+    binding: z.ZodString;
+    database_name: z.ZodString;
+    database_id: z.ZodOptional<z.ZodString>;
+    migrations_dir: z.ZodOptional<z.ZodString>;
+}, z.ZodTypeAny, "passthrough">>;
+export declare const BindingsSchema: z.ZodObject<{
+    kv: z.ZodOptional<z.ZodArray<z.ZodObject<{
+        binding: z.ZodString;
+        id: z.ZodOptional<z.ZodString>;
+    }, "passthrough", z.ZodTypeAny, z.objectOutputType<{
+        binding: z.ZodString;
+        id: z.ZodOptional<z.ZodString>;
+    }, z.ZodTypeAny, "passthrough">, z.objectInputType<{
+        binding: z.ZodString;
+        id: z.ZodOptional<z.ZodString>;
+    }, z.ZodTypeAny, "passthrough">>, "many">>;
+    r2: z.ZodOptional<z.ZodArray<z.ZodObject<{
+        binding: z.ZodString;
+        bucket_name: z.ZodString;
+    }, "passthrough", z.ZodTypeAny, z.objectOutputType<{
+        binding: z.ZodString;
+        bucket_name: z.ZodString;
+    }, z.ZodTypeAny, "passthrough">, z.objectInputType<{
+        binding: z.ZodString;
+        bucket_name: z.ZodString;
+    }, z.ZodTypeAny, "passthrough">>, "many">>;
+    d1: z.ZodOptional<z.ZodArray<z.ZodObject<{
+        binding: z.ZodString;
+        database_name: z.ZodString;
+        database_id: z.ZodOptional<z.ZodString>;
+        migrations_dir: z.ZodOptional<z.ZodString>;
+    }, "passthrough", z.ZodTypeAny, z.objectOutputType<{
+        binding: z.ZodString;
+        database_name: z.ZodString;
+        database_id: z.ZodOptional<z.ZodString>;
+        migrations_dir: z.ZodOptional<z.ZodString>;
+    }, z.ZodTypeAny, "passthrough">, z.objectInputType<{
+        binding: z.ZodString;
+        database_name: z.ZodString;
+        database_id: z.ZodOptional<z.ZodString>;
+        migrations_dir: z.ZodOptional<z.ZodString>;
+    }, z.ZodTypeAny, "passthrough">>, "many">>;
+}, "passthrough", z.ZodTypeAny, z.objectOutputType<{
+    kv: z.ZodOptional<z.ZodArray<z.ZodObject<{
+        binding: z.ZodString;
+        id: z.ZodOptional<z.ZodString>;
+    }, "passthrough", z.ZodTypeAny, z.objectOutputType<{
+        binding: z.ZodString;
+        id: z.ZodOptional<z.ZodString>;
+    }, z.ZodTypeAny, "passthrough">, z.objectInputType<{
+        binding: z.ZodString;
+        id: z.ZodOptional<z.ZodString>;
+    }, z.ZodTypeAny, "passthrough">>, "many">>;
+    r2: z.ZodOptional<z.ZodArray<z.ZodObject<{
+        binding: z.ZodString;
+        bucket_name: z.ZodString;
+    }, "passthrough", z.ZodTypeAny, z.objectOutputType<{
+        binding: z.ZodString;
+        bucket_name: z.ZodString;
+    }, z.ZodTypeAny, "passthrough">, z.objectInputType<{
+        binding: z.ZodString;
+        bucket_name: z.ZodString;
+    }, z.ZodTypeAny, "passthrough">>, "many">>;
+    d1: z.ZodOptional<z.ZodArray<z.ZodObject<{
+        binding: z.ZodString;
+        database_name: z.ZodString;
+        database_id: z.ZodOptional<z.ZodString>;
+        migrations_dir: z.ZodOptional<z.ZodString>;
+    }, "passthrough", z.ZodTypeAny, z.objectOutputType<{
+        binding: z.ZodString;
+        database_name: z.ZodString;
+        database_id: z.ZodOptional<z.ZodString>;
+        migrations_dir: z.ZodOptional<z.ZodString>;
+    }, z.ZodTypeAny, "passthrough">, z.objectInputType<{
+        binding: z.ZodString;
+        database_name: z.ZodString;
+        database_id: z.ZodOptional<z.ZodString>;
+        migrations_dir: z.ZodOptional<z.ZodString>;
+    }, z.ZodTypeAny, "passthrough">>, "many">>;
+}, z.ZodTypeAny, "passthrough">, z.objectInputType<{
+    kv: z.ZodOptional<z.ZodArray<z.ZodObject<{
+        binding: z.ZodString;
+        id: z.ZodOptional<z.ZodString>;
+    }, "passthrough", z.ZodTypeAny, z.objectOutputType<{
+        binding: z.ZodString;
+        id: z.ZodOptional<z.ZodString>;
+    }, z.ZodTypeAny, "passthrough">, z.objectInputType<{
+        binding: z.ZodString;
+        id: z.ZodOptional<z.ZodString>;
+    }, z.ZodTypeAny, "passthrough">>, "many">>;
+    r2: z.ZodOptional<z.ZodArray<z.ZodObject<{
+        binding: z.ZodString;
+        bucket_name: z.ZodString;
+    }, "passthrough", z.ZodTypeAny, z.objectOutputType<{
+        binding: z.ZodString;
+        bucket_name: z.ZodString;
+    }, z.ZodTypeAny, "passthrough">, z.objectInputType<{
+        binding: z.ZodString;
+        bucket_name: z.ZodString;
+    }, z.ZodTypeAny, "passthrough">>, "many">>;
+    d1: z.ZodOptional<z.ZodArray<z.ZodObject<{
+        binding: z.ZodString;
+        database_name: z.ZodString;
+        database_id: z.ZodOptional<z.ZodString>;
+        migrations_dir: z.ZodOptional<z.ZodString>;
+    }, "passthrough", z.ZodTypeAny, z.objectOutputType<{
+        binding: z.ZodString;
+        database_name: z.ZodString;
+        database_id: z.ZodOptional<z.ZodString>;
+        migrations_dir: z.ZodOptional<z.ZodString>;
+    }, z.ZodTypeAny, "passthrough">, z.objectInputType<{
+        binding: z.ZodString;
+        database_name: z.ZodString;
+        database_id: z.ZodOptional<z.ZodString>;
+        migrations_dir: z.ZodOptional<z.ZodString>;
+    }, z.ZodTypeAny, "passthrough">>, "many">>;
+}, z.ZodTypeAny, "passthrough">>;
+export type WebflowBindings = z.infer<typeof BindingsSchema>;
+/** Parse the raw `cloud.bindings` block. Returns undefined if it's absent/invalid-shaped. */
+export declare function parseBindings(raw: unknown): WebflowBindings | undefined;
+/** Whether the binding block declares at least one binding. */
+export declare function hasAnyBindings(bindings: WebflowBindings | undefined): boolean;
+/** Validate an R2 bucket name (rules from Cloudflare; 27-char cap leaves room for the app-name prefix). */
+export declare function validateR2BucketName(name: string): void;
+/** Enforce per-type count limits and R2 naming rules. Mirrors the deployer's checks. */
+export declare function validateBindings(bindings: WebflowBindings): void;
+/**
+ * `compatibility_date` written into the binding bridge. A schema placeholder the deployer
+ * ignores, not a date the user chose; the compat date policy never treats it as one.
+ */
+export declare const BINDINGS_BRIDGE_COMPAT_DATE = "2025-01-01";
+/**
+ * Synthesize the wrangler-shaped binding bridge from webflow.json bindings.
+ *
+ * Produces the same shape the build pipeline would otherwise read from a user's
+ * wrangler.json: `name` + `compatibility_date` (placeholders the deployer
+ * ignores) plus the kv/r2/d1 arrays with placeholder ids.
+ */
+export declare function bindingsToWranglerJson(bindings: WebflowBindings, name?: string): WranglerJson;
+//# sourceMappingURL=bindings.d.ts.map

package/dist/bindings.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"bindings.d.ts","sourceRoot":"","sources":["../src/bindings.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;GAcG;AACH,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAGxB,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,YAAY,CAAC;AAE/C,uEAAuE;AACvE,eAAO,MAAM,qBAAqB,IAAI,CAAC;AAUvC,eAAO,MAAM,eAAe;;;;;;;;;gCAEZ,CAAC;AACjB,eAAO,MAAM,eAAe;;;;;;;;;gCAEZ,CAAC;AACjB,eAAO,MAAM,eAAe;;;;;;;;;;;;;;;gCAOZ,CAAC;AAEjB,eAAO,MAAM,cAAc;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;gCAMX,CAAC;AAEjB,MAAM,MAAM,eAAe,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,cAAc,CAAC,CAAC;AAE7D,6FAA6F;AAC7F,wBAAgB,aAAa,CAAC,GAAG,EAAE,OAAO,GAAG,eAAe,GAAG,SAAS,CAGvE;AAED,+DAA+D;AAC/D,wBAAgB,cAAc,CAAC,QAAQ,EAAE,eAAe,GAAG,SAAS,GAAG,OAAO,CAG7E;AAED,2GAA2G;AAC3G,wBAAgB,oBAAoB,CAAC,IAAI,EAAE,MAAM,GAAG,IAAI,CAgBvD;AAED,wFAAwF;AACxF,wBAAgB,gBAAgB,CAAC,QAAQ,EAAE,eAAe,GAAG,IAAI,CAmBhE;AAED;;;GAGG;AACH,eAAO,MAAM,2BAA2B,eAAe,CAAC;AAExD;;;;;;GAMG;AACH,wBAAgB,sBAAsB,CACpC,QAAQ,EAAE,eAAe,EACzB,IAAI,SAAgB,GACnB,YAAY,CAmBd"}

package/dist/bindings.js

@@ -0,0 +1,126 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.BINDINGS_BRIDGE_COMPAT_DATE = exports.BindingsSchema = exports.D1BindingSchema = exports.R2BindingSchema = exports.KvBindingSchema = exports.MAX_BINDINGS_PER_TYPE = void 0;
+exports.parseBindings = parseBindings;
+exports.hasAnyBindings = hasAnyBindings;
+exports.validateR2BucketName = validateR2BucketName;
+exports.validateBindings = validateBindings;
+exports.bindingsToWranglerJson = bindingsToWranglerJson;
+/**
+ * Cloud resource bindings declared in `webflow.json`.
+ *
+ * NEW in @webflow/cloud-app: users declare KV / R2 / D1 bindings under
+ * `cloud.bindings` in webflow.json instead of hand-writing wrangler.json (which
+ * is now internal). The engine validates them and synthesizes a wrangler-shaped
+ * bridge (clouduser.wrangler.json) that the existing deployer consumes
+ * unchanged — the deployer namespaces resources as `<APP_NAME>-<name>` and
+ * fills in the real ids, so the placeholder ids below only need to satisfy the
+ * build-phase wrangler schema + dry-run.
+ *
+ * `vars` are intentionally NOT supported yet: the deployer's
+ * `processWranglerBindings` ships only d1/kv/r2 and drops everything else, so
+ * vars wouldn't survive to deploy without a deployer change.
+ */
+const zod_1 = require("zod");
+const errors_1 = require("./frameworks/errors");
+/** Max number of each binding type, matching the deployer's limits. */
+exports.MAX_BINDINGS_PER_TYPE = 5;
+// Cloudflare assigns the real ids at deploy time. The user wrangler schema and
+// `wrangler deploy --dry-run` accept bindings without ids; the placeholders keep
+// the bridge valid against the strict `loadWranglerJson` schema.
+const KV_ID_PLACEHOLDER = '0'.repeat(32);
+const D1_ID_PLACEHOLDER = '00000000-0000-0000-0000-000000000000';
+// `binding` is the JS binding name (e.g. `env.MY_KV`). `id` / `database_id` are
+// optional — users normally omit them (the deployer assigns real ones).
+exports.KvBindingSchema = zod_1.z
+    .object({ binding: zod_1.z.string(), id: zod_1.z.string().optional() })
+    .passthrough();
+exports.R2BindingSchema = zod_1.z
+    .object({ binding: zod_1.z.string(), bucket_name: zod_1.z.string() })
+    .passthrough();
+exports.D1BindingSchema = zod_1.z
+    .object({
+    binding: zod_1.z.string(),
+    database_name: zod_1.z.string(),
+    database_id: zod_1.z.string().optional(),
+    migrations_dir: zod_1.z.string().optional(),
+})
+    .passthrough();
+exports.BindingsSchema = zod_1.z
+    .object({
+    kv: zod_1.z.array(exports.KvBindingSchema).optional(),
+    r2: zod_1.z.array(exports.R2BindingSchema).optional(),
+    d1: zod_1.z.array(exports.D1BindingSchema).optional(),
+})
+    .passthrough();
+/** Parse the raw `cloud.bindings` block. Returns undefined if it's absent/invalid-shaped. */
+function parseBindings(raw) {
+    const result = exports.BindingsSchema.safeParse(raw);
+    return result.success ? result.data : undefined;
+}
+/** Whether the binding block declares at least one binding. */
+function hasAnyBindings(bindings) {
+    if (!bindings)
+        return false;
+    return Boolean(bindings.kv?.length || bindings.r2?.length || bindings.d1?.length);
+}
+/** Validate an R2 bucket name (rules from Cloudflare; 27-char cap leaves room for the app-name prefix). */
+function validateR2BucketName(name) {
+    if (!/^[a-z0-9-]+$/.test(name)) {
+        throw new errors_1.FrameworkConfigError(`Invalid object storage bucket name ${JSON.stringify(name)}: Only lowercase letters, numbers, and hyphens are allowed.`);
+    }
+    if (name.startsWith('-') || name.endsWith('-')) {
+        throw new errors_1.FrameworkConfigError(`Invalid object storage bucket name "${name}": Cannot begin or end with a hyphen.`);
+    }
+    if (name.length > 27) {
+        throw new errors_1.FrameworkConfigError(`Invalid object storage bucket name "${name}": Must be 27 characters or fewer (currently ${name.length} characters).`);
+    }
+}
+/** Enforce per-type count limits and R2 naming rules. Mirrors the deployer's checks. */
+function validateBindings(bindings) {
+    if ((bindings.kv?.length ?? 0) > exports.MAX_BINDINGS_PER_TYPE) {
+        throw new errors_1.FrameworkConfigError(`Too many KV namespaces configured: ${bindings.kv.length}. Maximum allowed is ${exports.MAX_BINDINGS_PER_TYPE}.`);
+    }
+    if ((bindings.d1?.length ?? 0) > exports.MAX_BINDINGS_PER_TYPE) {
+        throw new errors_1.FrameworkConfigError(`Too many D1 databases configured: ${bindings.d1.length}. Maximum allowed is ${exports.MAX_BINDINGS_PER_TYPE}.`);
+    }
+    if ((bindings.r2?.length ?? 0) > exports.MAX_BINDINGS_PER_TYPE) {
+        throw new errors_1.FrameworkConfigError(`Too many R2 buckets configured: ${bindings.r2.length}. Maximum allowed is ${exports.MAX_BINDINGS_PER_TYPE}.`);
+    }
+    for (const bucket of bindings.r2 ?? []) {
+        validateR2BucketName(bucket.bucket_name);
+    }
+}
+/**
+ * `compatibility_date` written into the binding bridge. A schema placeholder the deployer
+ * ignores, not a date the user chose; the compat date policy never treats it as one.
+ */
+exports.BINDINGS_BRIDGE_COMPAT_DATE = '2025-01-01';
+/**
+ * Synthesize the wrangler-shaped binding bridge from webflow.json bindings.
+ *
+ * Produces the same shape the build pipeline would otherwise read from a user's
+ * wrangler.json: `name` + `compatibility_date` (placeholders the deployer
+ * ignores) plus the kv/r2/d1 arrays with placeholder ids.
+ */
+function bindingsToWranglerJson(bindings, name = 'webflow-app') {
+    return {
+        name,
+        compatibility_date: exports.BINDINGS_BRIDGE_COMPAT_DATE,
+        kv_namespaces: (bindings.kv ?? []).map((k) => ({
+            binding: k.binding,
+            id: k.id ?? KV_ID_PLACEHOLDER,
+        })),
+        r2_buckets: (bindings.r2 ?? []).map((r) => ({
+            binding: r.binding,
+            bucket_name: r.bucket_name,
+        })),
+        d1_databases: (bindings.d1 ?? []).map((d) => ({
+            binding: d.binding,
+            database_name: d.database_name,
+            database_id: d.database_id ?? D1_ID_PLACEHOLDER,
+            ...(d.migrations_dir ? { migrations_dir: d.migrations_dir } : {}),
+        })),
+    };
+}
+//# sourceMappingURL=bindings.js.map

package/dist/bindings.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"bindings.js","sourceRoot":"","sources":["../src/bindings.ts"],"names":[],"mappings":";;;AAyDA,sCAGC;AAGD,wCAGC;AAGD,oDAgBC;AAGD,4CAmBC;AAeD,wDAsBC;AAhJD;;;;;;;;;;;;;;GAcG;AACH,6BAAwB;AAExB,gDAA2D;AAG3D,uEAAuE;AAC1D,QAAA,qBAAqB,GAAG,CAAC,CAAC;AAEvC,+EAA+E;AAC/E,iFAAiF;AACjF,iEAAiE;AACjE,MAAM,iBAAiB,GAAG,GAAG,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC;AACzC,MAAM,iBAAiB,GAAG,sCAAsC,CAAC;AAEjE,gFAAgF;AAChF,wEAAwE;AAC3D,QAAA,eAAe,GAAG,OAAC;KAC7B,MAAM,CAAC,EAAE,OAAO,EAAE,OAAC,CAAC,MAAM,EAAE,EAAE,EAAE,EAAE,OAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE,EAAE,CAAC;KAC1D,WAAW,EAAE,CAAC;AACJ,QAAA,eAAe,GAAG,OAAC;KAC7B,MAAM,CAAC,EAAE,OAAO,EAAE,OAAC,CAAC,MAAM,EAAE,EAAE,WAAW,EAAE,OAAC,CAAC,MAAM,EAAE,EAAE,CAAC;KACxD,WAAW,EAAE,CAAC;AACJ,QAAA,eAAe,GAAG,OAAC;KAC7B,MAAM,CAAC;IACN,OAAO,EAAE,OAAC,CAAC,MAAM,EAAE;IACnB,aAAa,EAAE,OAAC,CAAC,MAAM,EAAE;IACzB,WAAW,EAAE,OAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IAClC,cAAc,EAAE,OAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;CACtC,CAAC;KACD,WAAW,EAAE,CAAC;AAEJ,QAAA,cAAc,GAAG,OAAC;KAC5B,MAAM,CAAC;IACN,EAAE,EAAE,OAAC,CAAC,KAAK,CAAC,uBAAe,CAAC,CAAC,QAAQ,EAAE;IACvC,EAAE,EAAE,OAAC,CAAC,KAAK,CAAC,uBAAe,CAAC,CAAC,QAAQ,EAAE;IACvC,EAAE,EAAE,OAAC,CAAC,KAAK,CAAC,uBAAe,CAAC,CAAC,QAAQ,EAAE;CACxC,CAAC;KACD,WAAW,EAAE,CAAC;AAIjB,6FAA6F;AAC7F,SAAgB,aAAa,CAAC,GAAY;IACxC,MAAM,MAAM,GAAG,sBAAc,CAAC,SAAS,CAAC,GAAG,CAAC,CAAC;IAC7C,OAAO,MAAM,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,SAAS,CAAC;AAClD,CAAC;AAED,+DAA+D;AAC/D,SAAgB,cAAc,CAAC,QAAqC;IAClE,IAAI,CAAC,QAAQ;QAAE,OAAO,KAAK,CAAC;IAC5B,OAAO,OAAO,CAAC,QAAQ,CAAC,EAAE,EAAE,MAAM,IAAI,QAAQ,CAAC,EAAE,EAAE,MAAM,IAAI,QAAQ,CAAC,EAAE,EAAE,MAAM,CAAC,CAAC;AACpF,CAAC;AAED,2GAA2G;AAC3G,SAAgB,oBAAoB,CAAC,IAAY;IAC/C,IAAI,CAAC,cAAc,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC;QAC/B,MAAM,IAAI,6BAAoB,CAC5B,sCAAsC,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,6DAA6D,CACxH,CAAC;IACJ,CAAC;IACD,IAAI,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,IAAI,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,EAAE,CAAC;QAC/C,MAAM,IAAI,6BAAoB,CAC5B,uCAAuC,IAAI,uCAAuC,CACnF,CAAC;IACJ,CAAC;IACD,IAAI,IAAI,CAAC,MAAM,GAAG,EAAE,EAAE,CAAC;QACrB,MAAM,IAAI,6BAAoB,CAC5B,uCAAuC,IAAI,gDAAgD,IAAI,CAAC,MAAM,eAAe,CACtH,CAAC;IACJ,CAAC;AACH,CAAC;AAED,wFAAwF;AACxF,SAAgB,gBAAgB,CAAC,QAAyB;IACxD,IAAI,CAAC,QAAQ,CAAC,EAAE,EAAE,MAAM,IAAI,CAAC,CAAC,GAAG,6BAAqB,EAAE,CAAC;QACvD,MAAM,IAAI,6BAAoB,CAC5B,sCAAsC,QAAQ,CAAC,EAAG,CAAC,MAAM,wBAAwB,6BAAqB,GAAG,CAC1G,CAAC;IACJ,CAAC;IACD,IAAI,CAAC,QAAQ,CAAC,EAAE,EAAE,MAAM,IAAI,CAAC,CAAC,GAAG,6BAAqB,EAAE,CAAC;QACvD,MAAM,IAAI,6BAAoB,CAC5B,qCAAqC,QAAQ,CAAC,EAAG,CAAC,MAAM,wBAAwB,6BAAqB,GAAG,CACzG,CAAC;IACJ,CAAC;IACD,IAAI,CAAC,QAAQ,CAAC,EAAE,EAAE,MAAM,IAAI,CAAC,CAAC,GAAG,6BAAqB,EAAE,CAAC;QACvD,MAAM,IAAI,6BAAoB,CAC5B,mCAAmC,QAAQ,CAAC,EAAG,CAAC,MAAM,wBAAwB,6BAAqB,GAAG,CACvG,CAAC;IACJ,CAAC;IACD,KAAK,MAAM,MAAM,IAAI,QAAQ,CAAC,EAAE,IAAI,EAAE,EAAE,CAAC;QACvC,oBAAoB,CAAC,MAAM,CAAC,WAAW,CAAC,CAAC;IAC3C,CAAC;AACH,CAAC;AAED;;;GAGG;AACU,QAAA,2BAA2B,GAAG,YAAY,CAAC;AAExD;;;;;;GAMG;AACH,SAAgB,sBAAsB,CACpC,QAAyB,EACzB,IAAI,GAAG,aAAa;IAEpB,OAAO;QACL,IAAI;QACJ,kBAAkB,EAAE,mCAA2B;QAC/C,aAAa,EAAE,CAAC,QAAQ,CAAC,EAAE,IAAI,EAAE,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;YAC7C,OAAO,EAAE,CAAC,CAAC,OAAO;YAClB,EAAE,EAAE,CAAC,CAAC,EAAE,IAAI,iBAAiB;SAC9B,CAAC,CAAC;QACH,UAAU,EAAE,CAAC,QAAQ,CAAC,EAAE,IAAI,EAAE,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;YAC1C,OAAO,EAAE,CAAC,CAAC,OAAO;YAClB,WAAW,EAAE,CAAC,CAAC,WAAW;SAC3B,CAAC,CAAC;QACH,YAAY,EAAE,CAAC,QAAQ,CAAC,EAAE,IAAI,EAAE,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;YAC5C,OAAO,EAAE,CAAC,CAAC,OAAO;YAClB,aAAa,EAAE,CAAC,CAAC,aAAa;YAC9B,WAAW,EAAE,CAAC,CAAC,WAAW,IAAI,iBAAiB;YAC/C,GAAG,CAAC,CAAC,CAAC,cAAc,CAAC,CAAC,CAAC,EAAE,cAAc,EAAE,CAAC,CAAC,cAAc,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;SAClE,CAAC,CAAC;KACJ,CAAC;AACJ,CAAC"}

package/dist/compat-date.d.ts

@@ -0,0 +1,68 @@
+import type { Logger } from './ports';
+/**
+ * Lowest `compatibility_date` the platform runs a worker at once the policy is on.
+ * workerd only provides a working `node:http` / `node:https` client from this date.
+ */
+export declare const COMPAT_DATE_FLOOR = "2025-08-16";
+/**
+ * Where the build records the date it settled on, next to `clouduser.wrangler.json`
+ * (which already travels from the build to the deploy). Keep in sync with the
+ * deployer.
+ */
+export declare const COMPAT_DATE_RECORD_FILE = "clouduser.compat-date.json";
+export type CompatDateSource = 'template' | 'floor' | 'user';
+export interface CompatDateInputs {
+    /** `compatibility_date` of the template the build's wrangler.json was copied from. */
+    templateDate: string;
+    /** `compatibility_date` from the user's own wrangler config, if any. */
+    userDate?: string;
+    /**
+     * When false the template date is used unchanged. When true, the result is always
+     * a valid date at or above COMPAT_DATE_FLOOR: the user's date when it qualifies,
+     * otherwise the template's date or the floor, whichever is later.
+     */
+    policyEnabled: boolean;
+    /** Injected for tests. */
+    now?: Date;
+}
+export interface CompatDateResolution {
+    date: string;
+    source: CompatDateSource;
+    /** Present when the user's date was unusable. */
+    warning?: string;
+}
+/** What the build leaves for the deploy. */
+export interface CompatDateRecord {
+    compatibilityDate: string;
+    source: CompatDateSource;
+}
+/**
+ * Pure resolution of the date a worker is built and deployed with.
+ *
+ *   policy off                                     -> template date, unchanged
+ *   policy on, user date valid, <= today, >= floor -> user date
+ *   policy on, otherwise                           -> default, plus a warning if a
+ *                                                     user date was given but unusable
+ *
+ * where default = the template date if it is a valid date at or above the floor,
+ * else the floor.
+ */
+export declare function resolveCompatDate(inputs: CompatDateInputs): CompatDateResolution;
+/**
+ * Settles the date on `<cwd>/wrangler.json` (just copied from the framework
+ * template) and records it for the deploy.
+ *
+ * `userCompatDate` is the date from the user's own wrangler config, if any. The
+ * bindings-bridge placeholder is not a user choice and is ignored. With the policy
+ * off nothing changes and no record is written; a record already in the checkout is
+ * removed either way, because the deploy trusts that file and a repo must not be
+ * able to supply it.
+ *
+ * Never throws: an error keeps the template date and logs a warning, so this cannot
+ * fail a build.
+ */
+export declare function applyCompatDateAtBuild(log: Logger, cwd: string, userCompatDate: string | undefined, opts?: {
+    policyEnabled?: boolean;
+    now?: Date;
+}): CompatDateResolution | undefined;
+//# sourceMappingURL=compat-date.d.ts.map

package/dist/compat-date.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"compat-date.d.ts","sourceRoot":"","sources":["../src/compat-date.ts"],"names":[],"mappings":"AAiBA,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,SAAS,CAAC;AAGtC;;;GAGG;AACH,eAAO,MAAM,iBAAiB,eAAe,CAAC;AAE9C;;;;GAIG;AACH,eAAO,MAAM,uBAAuB,+BAA+B,CAAC;AAEpE,MAAM,MAAM,gBAAgB,GAAG,UAAU,GAAG,OAAO,GAAG,MAAM,CAAC;AAE7D,MAAM,WAAW,gBAAgB;IAC/B,sFAAsF;IACtF,YAAY,EAAE,MAAM,CAAC;IACrB,wEAAwE;IACxE,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB;;;;OAIG;IACH,aAAa,EAAE,OAAO,CAAC;IACvB,0BAA0B;IAC1B,GAAG,CAAC,EAAE,IAAI,CAAC;CACZ;AAED,MAAM,WAAW,oBAAoB;IACnC,IAAI,EAAE,MAAM,CAAC;IACb,MAAM,EAAE,gBAAgB,CAAC;IACzB,iDAAiD;IACjD,OAAO,CAAC,EAAE,MAAM,CAAC;CAClB;AAED,4CAA4C;AAC5C,MAAM,WAAW,gBAAgB;IAC/B,iBAAiB,EAAE,MAAM,CAAC;IAC1B,MAAM,EAAE,gBAAgB,CAAC;CAC1B;AAUD;;;;;;;;;;GAUG;AACH,wBAAgB,iBAAiB,CAAC,MAAM,EAAE,gBAAgB,GAAG,oBAAoB,CAgChF;AAMD;;;;;;;;;;;;GAYG;AACH,wBAAgB,sBAAsB,CACpC,GAAG,EAAE,MAAM,EACX,GAAG,EAAE,MAAM,EACX,cAAc,EAAE,MAAM,GAAG,SAAS,EAClC,IAAI,GAAE;IAAE,aAAa,CAAC,EAAE,OAAO,CAAC;IAAC,GAAG,CAAC,EAAE,IAAI,CAAA;CAAO,GACjD,oBAAoB,GAAG,SAAS,CAwClC"}