@webflow/cloud-app 0.1.0-beta.7

package/LICENSE

@@ -0,0 +1,21 @@
+MIT License
+
+Copyright (c) 2026 Webflow, Inc.
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+SOFTWARE.

package/README.md

@@ -0,0 +1,93 @@
+# @webflow/cloud-app
+
+Build a JS framework app into a [Webflow Cloud](https://webflow.com) bundle that
+runs on Cloudflare Workers — **without your app having to know anything about
+Cloudflare.**
+
+You declare what you need in `webflow.json`. `@webflow/cloud-app` figures out your
+framework (Vite, Next.js, Astro), injects the right Cloudflare adapter and
+config, runs the build, and produces a worker-ready output directory. No
+`wrangler.json`, no adapter packages in your `package.json`, no generated config
+files in your tree — all of that happens in an ephemeral build workspace.
+
+This is the same engine the Webflow CLI and Webflow Cloud's server-side builder
+use, so a build is identical wherever it runs.
+
+> **Status:** early. The public API and the host port seam below are stable; the
+> framework build pipeline is being extracted from the canonical
+> (cosmic-builder) implementation. `buildApp` throws `NotImplementedError` until
+> that lands.
+
+## Install
+
+```bash
+npm install @webflow/cloud-app
+```
+
+## Usage
+
+```ts
+import { buildApp, consoleLogger, nodeCommandRunner } from '@webflow/cloud-app';
+
+const result = await buildApp({
+  projectDir: process.cwd(),
+  outputDir: './.webflow-output',
+  ports: {
+    logger: consoleLogger,
+    runCommand: nodeCommandRunner,
+    // telemetry + fs fall back to no-op / node defaults
+  },
+});
+
+console.log(result.framework, result.deploymentType, result.entrypointPath);
+```
+
+## Ports — running the same engine anywhere
+
+Everything environment-specific is injected, so the engine itself is pure build
+logic and stays public-safe (no auth, upload, secrets, or vendor SDKs baked in).
+
+| Port         | Required | Default                                   | Why a host overrides it                                                |
+| ------------ | -------- | ----------------------------------------- | ---------------------------------------------------------------------- |
+| `logger`     | yes      | `consoleLogger` / `silentLogger` provided | route output into oclif spinners, ECS structured logs, etc.            |
+| `runCommand` | yes      | `nodeCommandRunner` provided              | control/sandbox how `npm`, the framework build, and `wrangler` execute |
+| `telemetry`  | no       | `noopTelemetry`                           | wrap `dd-trace` so existing dashboards keep working                    |
+| `fs`         | no       | `nodeFileSystem`                          | plug in a virtual filesystem (e.g. browser-based agents)               |
+
+## `webflow.json`
+
+The only Webflow-owned file in your project. Framework is auto-detected (you can
+pin it) and **bindings are declared here** rather than in `wrangler.json`:
+
+```jsonc
+{
+  "cloud": {
+    "framework": "nextjs",
+    "bindings": {
+      "kv": [{ "binding": "MY_KV" }],
+      "r2": [{ "binding": "MY_BUCKET", "bucket_name": "my-bucket" }],
+      "d1": [{ "binding": "DB", "database_name": "app-db", "migrations_dir": "./migrations" }],
+    },
+  },
+}
+```
+
+You declare the binding name (and, for R2/D1, the resource name) — Webflow Cloud
+provisions the resource and namespaces it per environment. KV ids / D1
+`database_id`s are assigned for you; omit them. Limits: up to 5 of each type; R2
+bucket names are lowercase alphanumeric + hyphens, ≤27 chars. (`vars` is not
+supported yet — it needs deployer support to propagate.)
+
+The deploy-contract fields (`contract_version`, `framework`, `deployment_type`,
+`entrypoint_path`, `skip_no_bundle`) are filled in by the build and validated
+against [`@webflow/cosmic-deploy-contract`](https://www.npmjs.com/package/@webflow/cosmic-deploy-contract)
+before output is produced.
+
+## Development
+
+```bash
+npm install      # from the monorepo root
+npm test         # jest
+npm run build    # tsc → dist/
+npm run type-check
+```

package/dist/bindings.d.ts

@@ -0,0 +1,185 @@
+/**
+ * Cloud resource bindings declared in `webflow.json`.
+ *
+ * NEW in @webflow/cloud-app: users declare KV / R2 / D1 bindings under
+ * `cloud.bindings` in webflow.json instead of hand-writing wrangler.json (which
+ * is now internal). The engine validates them and synthesizes a wrangler-shaped
+ * bridge (clouduser.wrangler.json) that the existing deployer consumes
+ * unchanged — the deployer namespaces resources as `<APP_NAME>-<name>` and
+ * fills in the real ids, so the placeholder ids below only need to satisfy the
+ * build-phase wrangler schema + dry-run.
+ *
+ * `vars` are intentionally NOT supported yet: the deployer's
+ * `processWranglerBindings` ships only d1/kv/r2 and drops everything else, so
+ * vars wouldn't survive to deploy without a deployer change.
+ */
+import { z } from 'zod';
+import type { WranglerJson } from './wrangler';
+/** Max number of each binding type, matching the deployer's limits. */
+export declare const MAX_BINDINGS_PER_TYPE = 5;
+export declare const KvBindingSchema: z.ZodObject<{
+    binding: z.ZodString;
+    id: z.ZodOptional<z.ZodString>;
+}, "passthrough", z.ZodTypeAny, z.objectOutputType<{
+    binding: z.ZodString;
+    id: z.ZodOptional<z.ZodString>;
+}, z.ZodTypeAny, "passthrough">, z.objectInputType<{
+    binding: z.ZodString;
+    id: z.ZodOptional<z.ZodString>;
+}, z.ZodTypeAny, "passthrough">>;
+export declare const R2BindingSchema: z.ZodObject<{
+    binding: z.ZodString;
+    bucket_name: z.ZodString;
+}, "passthrough", z.ZodTypeAny, z.objectOutputType<{
+    binding: z.ZodString;
+    bucket_name: z.ZodString;
+}, z.ZodTypeAny, "passthrough">, z.objectInputType<{
+    binding: z.ZodString;
+    bucket_name: z.ZodString;
+}, z.ZodTypeAny, "passthrough">>;
+export declare const D1BindingSchema: z.ZodObject<{
+    binding: z.ZodString;
+    database_name: z.ZodString;
+    database_id: z.ZodOptional<z.ZodString>;
+    migrations_dir: z.ZodOptional<z.ZodString>;
+}, "passthrough", z.ZodTypeAny, z.objectOutputType<{
+    binding: z.ZodString;
+    database_name: z.ZodString;
+    database_id: z.ZodOptional<z.ZodString>;
+    migrations_dir: z.ZodOptional<z.ZodString>;
+}, z.ZodTypeAny, "passthrough">, z.objectInputType<{
+    binding: z.ZodString;
+    database_name: z.ZodString;
+    database_id: z.ZodOptional<z.ZodString>;
+    migrations_dir: z.ZodOptional<z.ZodString>;
+}, z.ZodTypeAny, "passthrough">>;
+export declare const BindingsSchema: z.ZodObject<{
+    kv: z.ZodOptional<z.ZodArray<z.ZodObject<{
+        binding: z.ZodString;
+        id: z.ZodOptional<z.ZodString>;
+    }, "passthrough", z.ZodTypeAny, z.objectOutputType<{
+        binding: z.ZodString;
+        id: z.ZodOptional<z.ZodString>;
+    }, z.ZodTypeAny, "passthrough">, z.objectInputType<{
+        binding: z.ZodString;
+        id: z.ZodOptional<z.ZodString>;
+    }, z.ZodTypeAny, "passthrough">>, "many">>;
+    r2: z.ZodOptional<z.ZodArray<z.ZodObject<{
+        binding: z.ZodString;
+        bucket_name: z.ZodString;
+    }, "passthrough", z.ZodTypeAny, z.objectOutputType<{
+        binding: z.ZodString;
+        bucket_name: z.ZodString;
+    }, z.ZodTypeAny, "passthrough">, z.objectInputType<{
+        binding: z.ZodString;
+        bucket_name: z.ZodString;
+    }, z.ZodTypeAny, "passthrough">>, "many">>;
+    d1: z.ZodOptional<z.ZodArray<z.ZodObject<{
+        binding: z.ZodString;
+        database_name: z.ZodString;
+        database_id: z.ZodOptional<z.ZodString>;
+        migrations_dir: z.ZodOptional<z.ZodString>;
+    }, "passthrough", z.ZodTypeAny, z.objectOutputType<{
+        binding: z.ZodString;
+        database_name: z.ZodString;
+        database_id: z.ZodOptional<z.ZodString>;
+        migrations_dir: z.ZodOptional<z.ZodString>;
+    }, z.ZodTypeAny, "passthrough">, z.objectInputType<{
+        binding: z.ZodString;
+        database_name: z.ZodString;
+        database_id: z.ZodOptional<z.ZodString>;
+        migrations_dir: z.ZodOptional<z.ZodString>;
+    }, z.ZodTypeAny, "passthrough">>, "many">>;
+}, "passthrough", z.ZodTypeAny, z.objectOutputType<{
+    kv: z.ZodOptional<z.ZodArray<z.ZodObject<{
+        binding: z.ZodString;
+        id: z.ZodOptional<z.ZodString>;
+    }, "passthrough", z.ZodTypeAny, z.objectOutputType<{
+        binding: z.ZodString;
+        id: z.ZodOptional<z.ZodString>;
+    }, z.ZodTypeAny, "passthrough">, z.objectInputType<{
+        binding: z.ZodString;
+        id: z.ZodOptional<z.ZodString>;
+    }, z.ZodTypeAny, "passthrough">>, "many">>;
+    r2: z.ZodOptional<z.ZodArray<z.ZodObject<{
+        binding: z.ZodString;
+        bucket_name: z.ZodString;
+    }, "passthrough", z.ZodTypeAny, z.objectOutputType<{
+        binding: z.ZodString;
+        bucket_name: z.ZodString;
+    }, z.ZodTypeAny, "passthrough">, z.objectInputType<{
+        binding: z.ZodString;
+        bucket_name: z.ZodString;
+    }, z.ZodTypeAny, "passthrough">>, "many">>;
+    d1: z.ZodOptional<z.ZodArray<z.ZodObject<{
+        binding: z.ZodString;
+        database_name: z.ZodString;
+        database_id: z.ZodOptional<z.ZodString>;
+        migrations_dir: z.ZodOptional<z.ZodString>;
+    }, "passthrough", z.ZodTypeAny, z.objectOutputType<{
+        binding: z.ZodString;
+        database_name: z.ZodString;
+        database_id: z.ZodOptional<z.ZodString>;
+        migrations_dir: z.ZodOptional<z.ZodString>;
+    }, z.ZodTypeAny, "passthrough">, z.objectInputType<{
+        binding: z.ZodString;
+        database_name: z.ZodString;
+        database_id: z.ZodOptional<z.ZodString>;
+        migrations_dir: z.ZodOptional<z.ZodString>;
+    }, z.ZodTypeAny, "passthrough">>, "many">>;
+}, z.ZodTypeAny, "passthrough">, z.objectInputType<{
+    kv: z.ZodOptional<z.ZodArray<z.ZodObject<{
+        binding: z.ZodString;
+        id: z.ZodOptional<z.ZodString>;
+    }, "passthrough", z.ZodTypeAny, z.objectOutputType<{
+        binding: z.ZodString;
+        id: z.ZodOptional<z.ZodString>;
+    }, z.ZodTypeAny, "passthrough">, z.objectInputType<{
+        binding: z.ZodString;
+        id: z.ZodOptional<z.ZodString>;
+    }, z.ZodTypeAny, "passthrough">>, "many">>;
+    r2: z.ZodOptional<z.ZodArray<z.ZodObject<{
+        binding: z.ZodString;
+        bucket_name: z.ZodString;
+    }, "passthrough", z.ZodTypeAny, z.objectOutputType<{
+        binding: z.ZodString;
+        bucket_name: z.ZodString;
+    }, z.ZodTypeAny, "passthrough">, z.objectInputType<{
+        binding: z.ZodString;
+        bucket_name: z.ZodString;
+    }, z.ZodTypeAny, "passthrough">>, "many">>;
+    d1: z.ZodOptional<z.ZodArray<z.ZodObject<{
+        binding: z.ZodString;
+        database_name: z.ZodString;
+        database_id: z.ZodOptional<z.ZodString>;
+        migrations_dir: z.ZodOptional<z.ZodString>;
+    }, "passthrough", z.ZodTypeAny, z.objectOutputType<{
+        binding: z.ZodString;
+        database_name: z.ZodString;
+        database_id: z.ZodOptional<z.ZodString>;
+        migrations_dir: z.ZodOptional<z.ZodString>;
+    }, z.ZodTypeAny, "passthrough">, z.objectInputType<{
+        binding: z.ZodString;
+        database_name: z.ZodString;
+        database_id: z.ZodOptional<z.ZodString>;
+        migrations_dir: z.ZodOptional<z.ZodString>;
+    }, z.ZodTypeAny, "passthrough">>, "many">>;
+}, z.ZodTypeAny, "passthrough">>;
+export type WebflowBindings = z.infer<typeof BindingsSchema>;
+/** Parse the raw `cloud.bindings` block. Returns undefined if it's absent/invalid-shaped. */
+export declare function parseBindings(raw: unknown): WebflowBindings | undefined;
+/** Whether the binding block declares at least one binding. */
+export declare function hasAnyBindings(bindings: WebflowBindings | undefined): boolean;
+/** Validate an R2 bucket name (rules from Cloudflare; 27-char cap leaves room for the app-name prefix). */
+export declare function validateR2BucketName(name: string): void;
+/** Enforce per-type count limits and R2 naming rules. Mirrors the deployer's checks. */
+export declare function validateBindings(bindings: WebflowBindings): void;
+/**
+ * Synthesize the wrangler-shaped binding bridge from webflow.json bindings.
+ *
+ * Produces the same shape the build pipeline would otherwise read from a user's
+ * wrangler.json: `name` + `compatibility_date` (placeholders the deployer
+ * ignores) plus the kv/r2/d1 arrays with placeholder ids.
+ */
+export declare function bindingsToWranglerJson(bindings: WebflowBindings, name?: string): WranglerJson;
+//# sourceMappingURL=bindings.d.ts.map

package/dist/bindings.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"bindings.d.ts","sourceRoot":"","sources":["../src/bindings.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;GAcG;AACH,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAGxB,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,YAAY,CAAC;AAE/C,uEAAuE;AACvE,eAAO,MAAM,qBAAqB,IAAI,CAAC;AASvC,eAAO,MAAM,eAAe;;;;;;;;;gCAEZ,CAAC;AACjB,eAAO,MAAM,eAAe;;;;;;;;;gCAEZ,CAAC;AACjB,eAAO,MAAM,eAAe;;;;;;;;;;;;;;;gCAOZ,CAAC;AAEjB,eAAO,MAAM,cAAc;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;gCAMX,CAAC;AAEjB,MAAM,MAAM,eAAe,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,cAAc,CAAC,CAAC;AAE7D,6FAA6F;AAC7F,wBAAgB,aAAa,CAAC,GAAG,EAAE,OAAO,GAAG,eAAe,GAAG,SAAS,CAGvE;AAED,+DAA+D;AAC/D,wBAAgB,cAAc,CAAC,QAAQ,EAAE,eAAe,GAAG,SAAS,GAAG,OAAO,CAG7E;AAED,2GAA2G;AAC3G,wBAAgB,oBAAoB,CAAC,IAAI,EAAE,MAAM,GAAG,IAAI,CAgBvD;AAED,wFAAwF;AACxF,wBAAgB,gBAAgB,CAAC,QAAQ,EAAE,eAAe,GAAG,IAAI,CAmBhE;AAED;;;;;;GAMG;AACH,wBAAgB,sBAAsB,CACpC,QAAQ,EAAE,eAAe,EACzB,IAAI,SAAgB,GACnB,YAAY,CAmBd"}

package/dist/bindings.js

@@ -0,0 +1,120 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.BindingsSchema = exports.D1BindingSchema = exports.R2BindingSchema = exports.KvBindingSchema = exports.MAX_BINDINGS_PER_TYPE = void 0;
+exports.parseBindings = parseBindings;
+exports.hasAnyBindings = hasAnyBindings;
+exports.validateR2BucketName = validateR2BucketName;
+exports.validateBindings = validateBindings;
+exports.bindingsToWranglerJson = bindingsToWranglerJson;
+/**
+ * Cloud resource bindings declared in `webflow.json`.
+ *
+ * NEW in @webflow/cloud-app: users declare KV / R2 / D1 bindings under
+ * `cloud.bindings` in webflow.json instead of hand-writing wrangler.json (which
+ * is now internal). The engine validates them and synthesizes a wrangler-shaped
+ * bridge (clouduser.wrangler.json) that the existing deployer consumes
+ * unchanged — the deployer namespaces resources as `<APP_NAME>-<name>` and
+ * fills in the real ids, so the placeholder ids below only need to satisfy the
+ * build-phase wrangler schema + dry-run.
+ *
+ * `vars` are intentionally NOT supported yet: the deployer's
+ * `processWranglerBindings` ships only d1/kv/r2 and drops everything else, so
+ * vars wouldn't survive to deploy without a deployer change.
+ */
+const zod_1 = require("zod");
+const errors_1 = require("./frameworks/errors");
+/** Max number of each binding type, matching the deployer's limits. */
+exports.MAX_BINDINGS_PER_TYPE = 5;
+// Cloudflare assigns the real ids at deploy time; these only satisfy the
+// build-phase wrangler schema + `wrangler deploy --dry-run`.
+const KV_ID_PLACEHOLDER = '0'.repeat(32);
+const D1_ID_PLACEHOLDER = '00000000-0000-0000-0000-000000000000';
+// `binding` is the JS binding name (e.g. `env.MY_KV`). `id` / `database_id` are
+// optional — users normally omit them (the deployer assigns real ones).
+exports.KvBindingSchema = zod_1.z
+    .object({ binding: zod_1.z.string(), id: zod_1.z.string().optional() })
+    .passthrough();
+exports.R2BindingSchema = zod_1.z
+    .object({ binding: zod_1.z.string(), bucket_name: zod_1.z.string() })
+    .passthrough();
+exports.D1BindingSchema = zod_1.z
+    .object({
+    binding: zod_1.z.string(),
+    database_name: zod_1.z.string(),
+    database_id: zod_1.z.string().optional(),
+    migrations_dir: zod_1.z.string().optional(),
+})
+    .passthrough();
+exports.BindingsSchema = zod_1.z
+    .object({
+    kv: zod_1.z.array(exports.KvBindingSchema).optional(),
+    r2: zod_1.z.array(exports.R2BindingSchema).optional(),
+    d1: zod_1.z.array(exports.D1BindingSchema).optional(),
+})
+    .passthrough();
+/** Parse the raw `cloud.bindings` block. Returns undefined if it's absent/invalid-shaped. */
+function parseBindings(raw) {
+    const result = exports.BindingsSchema.safeParse(raw);
+    return result.success ? result.data : undefined;
+}
+/** Whether the binding block declares at least one binding. */
+function hasAnyBindings(bindings) {
+    if (!bindings)
+        return false;
+    return Boolean(bindings.kv?.length || bindings.r2?.length || bindings.d1?.length);
+}
+/** Validate an R2 bucket name (rules from Cloudflare; 27-char cap leaves room for the app-name prefix). */
+function validateR2BucketName(name) {
+    if (!/^[a-z0-9-]+$/.test(name)) {
+        throw new errors_1.FrameworkConfigError(`Invalid object storage bucket name ${JSON.stringify(name)}: Only lowercase letters, numbers, and hyphens are allowed.`);
+    }
+    if (name.startsWith('-') || name.endsWith('-')) {
+        throw new errors_1.FrameworkConfigError(`Invalid object storage bucket name "${name}": Cannot begin or end with a hyphen.`);
+    }
+    if (name.length > 27) {
+        throw new errors_1.FrameworkConfigError(`Invalid object storage bucket name "${name}": Must be 27 characters or fewer (currently ${name.length} characters).`);
+    }
+}
+/** Enforce per-type count limits and R2 naming rules. Mirrors the deployer's checks. */
+function validateBindings(bindings) {
+    if ((bindings.kv?.length ?? 0) > exports.MAX_BINDINGS_PER_TYPE) {
+        throw new errors_1.FrameworkConfigError(`Too many KV namespaces configured: ${bindings.kv.length}. Maximum allowed is ${exports.MAX_BINDINGS_PER_TYPE}.`);
+    }
+    if ((bindings.d1?.length ?? 0) > exports.MAX_BINDINGS_PER_TYPE) {
+        throw new errors_1.FrameworkConfigError(`Too many D1 databases configured: ${bindings.d1.length}. Maximum allowed is ${exports.MAX_BINDINGS_PER_TYPE}.`);
+    }
+    if ((bindings.r2?.length ?? 0) > exports.MAX_BINDINGS_PER_TYPE) {
+        throw new errors_1.FrameworkConfigError(`Too many R2 buckets configured: ${bindings.r2.length}. Maximum allowed is ${exports.MAX_BINDINGS_PER_TYPE}.`);
+    }
+    for (const bucket of bindings.r2 ?? []) {
+        validateR2BucketName(bucket.bucket_name);
+    }
+}
+/**
+ * Synthesize the wrangler-shaped binding bridge from webflow.json bindings.
+ *
+ * Produces the same shape the build pipeline would otherwise read from a user's
+ * wrangler.json: `name` + `compatibility_date` (placeholders the deployer
+ * ignores) plus the kv/r2/d1 arrays with placeholder ids.
+ */
+function bindingsToWranglerJson(bindings, name = 'webflow-app') {
+    return {
+        name,
+        compatibility_date: '2025-01-01',
+        kv_namespaces: (bindings.kv ?? []).map((k) => ({
+            binding: k.binding,
+            id: k.id ?? KV_ID_PLACEHOLDER,
+        })),
+        r2_buckets: (bindings.r2 ?? []).map((r) => ({
+            binding: r.binding,
+            bucket_name: r.bucket_name,
+        })),
+        d1_databases: (bindings.d1 ?? []).map((d) => ({
+            binding: d.binding,
+            database_name: d.database_name,
+            database_id: d.database_id ?? D1_ID_PLACEHOLDER,
+            ...(d.migrations_dir ? { migrations_dir: d.migrations_dir } : {}),
+        })),
+    };
+}
+//# sourceMappingURL=bindings.js.map

package/dist/bindings.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"bindings.js","sourceRoot":"","sources":["../src/bindings.ts"],"names":[],"mappings":";;;AAwDA,sCAGC;AAGD,wCAGC;AAGD,oDAgBC;AAGD,4CAmBC;AASD,wDAsBC;AAzID;;;;;;;;;;;;;;GAcG;AACH,6BAAwB;AAExB,gDAA2D;AAG3D,uEAAuE;AAC1D,QAAA,qBAAqB,GAAG,CAAC,CAAC;AAEvC,yEAAyE;AACzE,6DAA6D;AAC7D,MAAM,iBAAiB,GAAG,GAAG,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC;AACzC,MAAM,iBAAiB,GAAG,sCAAsC,CAAC;AAEjE,gFAAgF;AAChF,wEAAwE;AAC3D,QAAA,eAAe,GAAG,OAAC;KAC7B,MAAM,CAAC,EAAE,OAAO,EAAE,OAAC,CAAC,MAAM,EAAE,EAAE,EAAE,EAAE,OAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE,EAAE,CAAC;KAC1D,WAAW,EAAE,CAAC;AACJ,QAAA,eAAe,GAAG,OAAC;KAC7B,MAAM,CAAC,EAAE,OAAO,EAAE,OAAC,CAAC,MAAM,EAAE,EAAE,WAAW,EAAE,OAAC,CAAC,MAAM,EAAE,EAAE,CAAC;KACxD,WAAW,EAAE,CAAC;AACJ,QAAA,eAAe,GAAG,OAAC;KAC7B,MAAM,CAAC;IACN,OAAO,EAAE,OAAC,CAAC,MAAM,EAAE;IACnB,aAAa,EAAE,OAAC,CAAC,MAAM,EAAE;IACzB,WAAW,EAAE,OAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IAClC,cAAc,EAAE,OAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;CACtC,CAAC;KACD,WAAW,EAAE,CAAC;AAEJ,QAAA,cAAc,GAAG,OAAC;KAC5B,MAAM,CAAC;IACN,EAAE,EAAE,OAAC,CAAC,KAAK,CAAC,uBAAe,CAAC,CAAC,QAAQ,EAAE;IACvC,EAAE,EAAE,OAAC,CAAC,KAAK,CAAC,uBAAe,CAAC,CAAC,QAAQ,EAAE;IACvC,EAAE,EAAE,OAAC,CAAC,KAAK,CAAC,uBAAe,CAAC,CAAC,QAAQ,EAAE;CACxC,CAAC;KACD,WAAW,EAAE,CAAC;AAIjB,6FAA6F;AAC7F,SAAgB,aAAa,CAAC,GAAY;IACxC,MAAM,MAAM,GAAG,sBAAc,CAAC,SAAS,CAAC,GAAG,CAAC,CAAC;IAC7C,OAAO,MAAM,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,SAAS,CAAC;AAClD,CAAC;AAED,+DAA+D;AAC/D,SAAgB,cAAc,CAAC,QAAqC;IAClE,IAAI,CAAC,QAAQ;QAAE,OAAO,KAAK,CAAC;IAC5B,OAAO,OAAO,CAAC,QAAQ,CAAC,EAAE,EAAE,MAAM,IAAI,QAAQ,CAAC,EAAE,EAAE,MAAM,IAAI,QAAQ,CAAC,EAAE,EAAE,MAAM,CAAC,CAAC;AACpF,CAAC;AAED,2GAA2G;AAC3G,SAAgB,oBAAoB,CAAC,IAAY;IAC/C,IAAI,CAAC,cAAc,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC;QAC/B,MAAM,IAAI,6BAAoB,CAC5B,sCAAsC,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,6DAA6D,CACxH,CAAC;IACJ,CAAC;IACD,IAAI,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,IAAI,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,EAAE,CAAC;QAC/C,MAAM,IAAI,6BAAoB,CAC5B,uCAAuC,IAAI,uCAAuC,CACnF,CAAC;IACJ,CAAC;IACD,IAAI,IAAI,CAAC,MAAM,GAAG,EAAE,EAAE,CAAC;QACrB,MAAM,IAAI,6BAAoB,CAC5B,uCAAuC,IAAI,gDAAgD,IAAI,CAAC,MAAM,eAAe,CACtH,CAAC;IACJ,CAAC;AACH,CAAC;AAED,wFAAwF;AACxF,SAAgB,gBAAgB,CAAC,QAAyB;IACxD,IAAI,CAAC,QAAQ,CAAC,EAAE,EAAE,MAAM,IAAI,CAAC,CAAC,GAAG,6BAAqB,EAAE,CAAC;QACvD,MAAM,IAAI,6BAAoB,CAC5B,sCAAsC,QAAQ,CAAC,EAAG,CAAC,MAAM,wBAAwB,6BAAqB,GAAG,CAC1G,CAAC;IACJ,CAAC;IACD,IAAI,CAAC,QAAQ,CAAC,EAAE,EAAE,MAAM,IAAI,CAAC,CAAC,GAAG,6BAAqB,EAAE,CAAC;QACvD,MAAM,IAAI,6BAAoB,CAC5B,qCAAqC,QAAQ,CAAC,EAAG,CAAC,MAAM,wBAAwB,6BAAqB,GAAG,CACzG,CAAC;IACJ,CAAC;IACD,IAAI,CAAC,QAAQ,CAAC,EAAE,EAAE,MAAM,IAAI,CAAC,CAAC,GAAG,6BAAqB,EAAE,CAAC;QACvD,MAAM,IAAI,6BAAoB,CAC5B,mCAAmC,QAAQ,CAAC,EAAG,CAAC,MAAM,wBAAwB,6BAAqB,GAAG,CACvG,CAAC;IACJ,CAAC;IACD,KAAK,MAAM,MAAM,IAAI,QAAQ,CAAC,EAAE,IAAI,EAAE,EAAE,CAAC;QACvC,oBAAoB,CAAC,MAAM,CAAC,WAAW,CAAC,CAAC;IAC3C,CAAC;AACH,CAAC;AAED;;;;;;GAMG;AACH,SAAgB,sBAAsB,CACpC,QAAyB,EACzB,IAAI,GAAG,aAAa;IAEpB,OAAO;QACL,IAAI;QACJ,kBAAkB,EAAE,YAAY;QAChC,aAAa,EAAE,CAAC,QAAQ,CAAC,EAAE,IAAI,EAAE,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;YAC7C,OAAO,EAAE,CAAC,CAAC,OAAO;YAClB,EAAE,EAAE,CAAC,CAAC,EAAE,IAAI,iBAAiB;SAC9B,CAAC,CAAC;QACH,UAAU,EAAE,CAAC,QAAQ,CAAC,EAAE,IAAI,EAAE,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;YAC1C,OAAO,EAAE,CAAC,CAAC,OAAO;YAClB,WAAW,EAAE,CAAC,CAAC,WAAW;SAC3B,CAAC,CAAC;QACH,YAAY,EAAE,CAAC,QAAQ,CAAC,EAAE,IAAI,EAAE,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;YAC5C,OAAO,EAAE,CAAC,CAAC,OAAO;YAClB,aAAa,EAAE,CAAC,CAAC,aAAa;YAC9B,WAAW,EAAE,CAAC,CAAC,WAAW,IAAI,iBAAiB;YAC/C,GAAG,CAAC,CAAC,CAAC,cAAc,CAAC,CAAC,CAAC,EAAE,cAAc,EAAE,CAAC,CAAC,cAAc,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;SAClE,CAAC,CAAC;KACJ,CAAC;AACJ,CAAC"}

package/dist/config/package-json.d.ts

@@ -0,0 +1,57 @@
+import { z } from 'zod';
+/**
+ * Package.json schema (minimal fields we need).
+ *
+ * Only the fields used by the framework builder are validated here.
+ */
+export declare const PackageJsonSchema: z.ZodObject<{
+    /** Package name */
+    name: z.ZodOptional<z.ZodString>;
+    /** Package version */
+    version: z.ZodOptional<z.ZodString>;
+    /** Production dependencies (package name -> version specifier) */
+    dependencies: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodString>>;
+    /** Development dependencies (package name -> version specifier) */
+    devDependencies: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodString>>;
+    /** Runtime declarations. `node` is deliberately retained as unknown so the
+     * toolchain resolver can warn and fall back for a malformed customer
+     * declaration rather than rejecting the entire package.json. */
+    engines: z.ZodOptional<z.ZodObject<{
+        node: z.ZodOptional<z.ZodUnknown>;
+    }, "passthrough", z.ZodTypeAny, z.objectOutputType<{
+        node: z.ZodOptional<z.ZodUnknown>;
+    }, z.ZodTypeAny, "passthrough">, z.objectInputType<{
+        node: z.ZodOptional<z.ZodUnknown>;
+    }, z.ZodTypeAny, "passthrough">>>;
+}, "strip", z.ZodTypeAny, {
+    name?: string | undefined;
+    version?: string | undefined;
+    dependencies?: Record<string, string> | undefined;
+    devDependencies?: Record<string, string> | undefined;
+    engines?: z.objectOutputType<{
+        node: z.ZodOptional<z.ZodUnknown>;
+    }, z.ZodTypeAny, "passthrough"> | undefined;
+}, {
+    name?: string | undefined;
+    version?: string | undefined;
+    dependencies?: Record<string, string> | undefined;
+    devDependencies?: Record<string, string> | undefined;
+    engines?: z.objectInputType<{
+        node: z.ZodOptional<z.ZodUnknown>;
+    }, z.ZodTypeAny, "passthrough"> | undefined;
+}>;
+/**
+ * Package.json structure (minimal fields we need).
+ */
+export type PackageJson = z.infer<typeof PackageJsonSchema>;
+/**
+ * Load and validate package.json from `cwd`. Returns `undefined` when the file
+ * is absent.
+ *
+ * NOTE: unlike the original cosmic-builder implementation this does NOT cache
+ * across calls — a single long-lived host process (the server-side builder, an
+ * MCP server) builds many different projects, so a module-level cache would
+ * leak one project's package.json into the next build.
+ */
+export declare function loadPackageJson(cwd: string): PackageJson | undefined;
+//# sourceMappingURL=package-json.d.ts.map

package/dist/config/package-json.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"package-json.d.ts","sourceRoot":"","sources":["../../src/config/package-json.ts"],"names":[],"mappings":"AAGA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAExB;;;;GAIG;AACH,eAAO,MAAM,iBAAiB;IAC5B,mBAAmB;;IAEnB,sBAAsB;;IAEtB,kEAAkE;;IAElE,mEAAmE;;IAEnE;;oEAEgE;;;;;;;;;;;;;;;;;;;;;;;;EAOhE,CAAC;AAEH;;GAEG;AACH,MAAM,MAAM,WAAW,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,iBAAiB,CAAC,CAAC;AAE5D;;;;;;;;GAQG;AACH,wBAAgB,eAAe,CAAC,GAAG,EAAE,MAAM,GAAG,WAAW,GAAG,SAAS,CAoBpE"}

package/dist/config/package-json.js

@@ -0,0 +1,94 @@
+"use strict";
+var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    var desc = Object.getOwnPropertyDescriptor(m, k);
+    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
+      desc = { enumerable: true, get: function() { return m[k]; } };
+    }
+    Object.defineProperty(o, k2, desc);
+}) : (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    o[k2] = m[k];
+}));
+var __setModuleDefault = (this && this.__setModuleDefault) || (Object.create ? (function(o, v) {
+    Object.defineProperty(o, "default", { enumerable: true, value: v });
+}) : function(o, v) {
+    o["default"] = v;
+});
+var __importStar = (this && this.__importStar) || (function () {
+    var ownKeys = function(o) {
+        ownKeys = Object.getOwnPropertyNames || function (o) {
+            var ar = [];
+            for (var k in o) if (Object.prototype.hasOwnProperty.call(o, k)) ar[ar.length] = k;
+            return ar;
+        };
+        return ownKeys(o);
+    };
+    return function (mod) {
+        if (mod && mod.__esModule) return mod;
+        var result = {};
+        if (mod != null) for (var k = ownKeys(mod), i = 0; i < k.length; i++) if (k[i] !== "default") __createBinding(result, mod, k[i]);
+        __setModuleDefault(result, mod);
+        return result;
+    };
+})();
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.PackageJsonSchema = void 0;
+exports.loadPackageJson = loadPackageJson;
+const fs = __importStar(require("node:fs"));
+const path = __importStar(require("node:path"));
+const zod_1 = require("zod");
+/**
+ * Package.json schema (minimal fields we need).
+ *
+ * Only the fields used by the framework builder are validated here.
+ */
+exports.PackageJsonSchema = zod_1.z.object({
+    /** Package name */
+    name: zod_1.z.string().optional(),
+    /** Package version */
+    version: zod_1.z.string().optional(),
+    /** Production dependencies (package name -> version specifier) */
+    dependencies: zod_1.z.record(zod_1.z.string()).optional(),
+    /** Development dependencies (package name -> version specifier) */
+    devDependencies: zod_1.z.record(zod_1.z.string()).optional(),
+    /** Runtime declarations. `node` is deliberately retained as unknown so the
+     * toolchain resolver can warn and fall back for a malformed customer
+     * declaration rather than rejecting the entire package.json. */
+    engines: zod_1.z
+        .object({
+        node: zod_1.z.unknown().optional(),
+    })
+        .passthrough()
+        .optional(),
+});
+/**
+ * Load and validate package.json from `cwd`. Returns `undefined` when the file
+ * is absent.
+ *
+ * NOTE: unlike the original cosmic-builder implementation this does NOT cache
+ * across calls — a single long-lived host process (the server-side builder, an
+ * MCP server) builds many different projects, so a module-level cache would
+ * leak one project's package.json into the next build.
+ */
+function loadPackageJson(cwd) {
+    const filePath = path.join(cwd, 'package.json');
+    if (!fs.statSync(filePath, { throwIfNoEntry: false })) {
+        return undefined;
+    }
+    const raw = fs.readFileSync(filePath).toString('utf8');
+    let unparsed;
+    try {
+        unparsed = JSON.parse(raw);
+    }
+    catch (e) {
+        throw new Error(`package.json was not valid JSON`, { cause: e });
+    }
+    try {
+        return exports.PackageJsonSchema.parse(unparsed);
+    }
+    catch (e) {
+        throw new Error('package.json schema validation failed', { cause: e });
+    }
+}
+//# sourceMappingURL=package-json.js.map

package/dist/config/package-json.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"package-json.js","sourceRoot":"","sources":["../../src/config/package-json.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AA4CA,0CAoBC;AAhED,4CAA8B;AAC9B,gDAAkC;AAElC,6BAAwB;AAExB;;;;GAIG;AACU,QAAA,iBAAiB,GAAG,OAAC,CAAC,MAAM,CAAC;IACxC,mBAAmB;IACnB,IAAI,EAAE,OAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IAC3B,sBAAsB;IACtB,OAAO,EAAE,OAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IAC9B,kEAAkE;IAClE,YAAY,EAAE,OAAC,CAAC,MAAM,CAAC,OAAC,CAAC,MAAM,EAAE,CAAC,CAAC,QAAQ,EAAE;IAC7C,mEAAmE;IACnE,eAAe,EAAE,OAAC,CAAC,MAAM,CAAC,OAAC,CAAC,MAAM,EAAE,CAAC,CAAC,QAAQ,EAAE;IAChD;;oEAEgE;IAChE,OAAO,EAAE,OAAC;SACP,MAAM,CAAC;QACN,IAAI,EAAE,OAAC,CAAC,OAAO,EAAE,CAAC,QAAQ,EAAE;KAC7B,CAAC;SACD,WAAW,EAAE;SACb,QAAQ,EAAE;CACd,CAAC,CAAC;AAOH;;;;;;;;GAQG;AACH,SAAgB,eAAe,CAAC,GAAW;IACzC,MAAM,QAAQ,GAAG,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,cAAc,CAAC,CAAC;IAChD,IAAI,CAAC,EAAE,CAAC,QAAQ,CAAC,QAAQ,EAAE,EAAE,cAAc,EAAE,KAAK,EAAE,CAAC,EAAE,CAAC;QACtD,OAAO,SAAS,CAAC;IACnB,CAAC;IAED,MAAM,GAAG,GAAG,EAAE,CAAC,YAAY,CAAC,QAAQ,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC;IAEvD,IAAI,QAAiB,CAAC;IACtB,IAAI,CAAC;QACH,QAAQ,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;IAC7B,CAAC;IAAC,OAAO,CAAC,EAAE,CAAC;QACX,MAAM,IAAI,KAAK,CAAC,iCAAiC,EAAE,EAAE,KAAK,EAAE,CAAC,EAAE,CAAC,CAAC;IACnE,CAAC;IAED,IAAI,CAAC;QACH,OAAO,yBAAiB,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAC;IAC3C,CAAC;IAAC,OAAO,CAAC,EAAE,CAAC;QACX,MAAM,IAAI,KAAK,CAAC,uCAAuC,EAAE,EAAE,KAAK,EAAE,CAAC,EAAE,CAAC,CAAC;IACzE,CAAC;AACH,CAAC"}

package/dist/config/webflow-json.d.ts

@@ -0,0 +1,53 @@
+import type { Logger } from '../ports';
+import type { WebflowBindings } from '../bindings';
+/**
+ * Build-time, permissive view of webflow.json.
+ *
+ * The user's source webflow.json may not yet contain a complete deploy
+ * contract — that's emitted by `createWebflowJson` later in the build. Reads
+ * here treat every field as optional and `framework` as an arbitrary `string`
+ * (it's user input until the contract validates it at deploy time).
+ *
+ * Deploy-time reads MUST use `validateForDeploy` from
+ * `@webflow/cosmic-deploy-contract`, which is strict and fails fast on contract
+ * violations. Do not introduce a second permissive deploy reader here.
+ */
+export type WebflowJson = {
+    cloud?: {
+        /** User-specified or producer-written framework hint. Validated strictly only at deploy time. */
+        framework?: string;
+        contract_version?: string;
+        framework_version?: string;
+        entrypoint_path?: string;
+        deployment_type?: string;
+        skip_no_bundle?: boolean;
+        /**
+         * User-declared KV / R2 / D1 bindings. The single user-facing place to
+         * declare bindings (replacing hand-written wrangler.json). Parsed/validated
+         * by `bindings.ts` and synthesized into the wrangler bridge at build time.
+         */
+        bindings?: WebflowBindings;
+        /**
+         * Build-only: URL prefix for static assets. NOT part of the deploy contract.
+         */
+        assets_path_prefix?: string;
+        /**
+         * Build-only: skip appending the mount path to the assets source dir
+         * (Astro 6 writes to `dist/client/` regardless of mount config). NOT part
+         * of the deploy contract.
+         */
+        assets_source_skip_mount_path?: boolean;
+        [key: string]: unknown;
+    };
+    [key: string]: unknown;
+};
+/**
+ * Load and JSONC-parse webflow.json (or webflow.jsonc) at `cwd`.
+ *
+ * Returns `undefined` when the file is absent or fails to parse as JSONC.
+ * Intentionally permissive — used by build-phase code that reads optional hints
+ * (user-specified framework, build-only flags). The deploy phase uses
+ * `validateForDeploy` from the contract package instead.
+ */
+export declare function loadWebflowJson(log: Logger, cwd: string, file?: string): WebflowJson | undefined;
+//# sourceMappingURL=webflow-json.d.ts.map

package/dist/config/webflow-json.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"webflow-json.d.ts","sourceRoot":"","sources":["../../src/config/webflow-json.ts"],"names":[],"mappings":"AAKA,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,UAAU,CAAC;AACvC,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,aAAa,CAAC;AAEnD;;;;;;;;;;;GAWG;AACH,MAAM,MAAM,WAAW,GAAG;IACxB,KAAK,CAAC,EAAE;QACN,iGAAiG;QACjG,SAAS,CAAC,EAAE,MAAM,CAAC;QACnB,gBAAgB,CAAC,EAAE,MAAM,CAAC;QAC1B,iBAAiB,CAAC,EAAE,MAAM,CAAC;QAC3B,eAAe,CAAC,EAAE,MAAM,CAAC;QACzB,eAAe,CAAC,EAAE,MAAM,CAAC;QACzB,cAAc,CAAC,EAAE,OAAO,CAAC;QACzB;;;;WAIG;QACH,QAAQ,CAAC,EAAE,eAAe,CAAC;QAC3B;;WAEG;QACH,kBAAkB,CAAC,EAAE,MAAM,CAAC;QAC5B;;;;WAIG;QACH,6BAA6B,CAAC,EAAE,OAAO,CAAC;QACxC,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC;KACxB,CAAC;IACF,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC;CACxB,CAAC;AAEF;;;;;;;GAOG;AACH,wBAAgB,eAAe,CAC7B,GAAG,EAAE,MAAM,EACX,GAAG,EAAE,MAAM,EACX,IAAI,SAAiB,GACpB,WAAW,GAAG,SAAS,CAyBzB"}