feat(compiler): harden v1 execution contracts

.github/workflows/ci.yml

@@ -66,6 +66,9 @@ jobs:
       - name: Build CLI
         run: go build ./cmd/gowdk
 
+      - name: Run broad Go static analysis
+        run: scripts/check-static-analysis.sh
+
       - name: Check VS Code extension
         run: |
           node editors/vscode/scripts/sync-version.js --check
@@ -75,6 +78,8 @@ jobs:
 
       - name: Check documentation
         run: |
+          sh scripts/check-cli-schema.sh
+          sh scripts/check-language-budget.sh
           sh scripts/check-docs-links.sh
           sh scripts/check-docs-style.sh
           sh scripts/check-removed-syntax.sh
@@ -93,6 +98,9 @@ jobs:
       - name: Check example reports
         run: sh scripts/check-example-reports.sh
 
+      - name: Check build-iteration contract
+        run: sh scripts/check-build-iteration-example.sh
+
       - name: Build login example
         run: |
           set -euxo pipefail

addons/actions/actions.go

@@ -7,5 +7,5 @@ const ImportPath = "github.com/cssbruno/gowdk/addons/actions"
 
 // Addon enables typed backend actions and form handling.
 func Addon() gowdk.Addon {
-	return gowdk.NewAddon("actions", gowdk.FeatureActions)
+	return gowdk.NewBuiltinAddon("actions", gowdk.FeatureActions)
 }

addons/api/api.go

@@ -7,5 +7,5 @@ const ImportPath = "github.com/cssbruno/gowdk/addons/api"
 
 // Addon enables generated API handlers.
 func Addon() gowdk.Addon {
-	return gowdk.NewAddon("api", gowdk.FeatureAPI)
+	return gowdk.NewBuiltinAddon("api", gowdk.FeatureAPI)
 }

addons/contracts/contracts.go

@@ -9,5 +9,5 @@ const ImportPath = "github.com/cssbruno/gowdk/addons/contracts"
 // Addon enables contract-driven runtime metadata and generated adapters once
 // the compiler integration lands.
 func Addon() gowdk.Addon {
-	return gowdk.NewAddon("contracts", gowdk.FeatureContracts)
+	return gowdk.NewBuiltinAddon("contracts", gowdk.FeatureContracts)
 }

addons/css/css.go

@@ -8,7 +8,7 @@ const ImportPath = "github.com/cssbruno/gowdk/addons/css"
 
 // Addon enables compile-time CSS processing.
 func Addon() gowdk.Addon {
-	return gowdk.NewAddon("css", gowdk.FeatureCSS)
+	return gowdk.NewBuiltinAddon("css", gowdk.FeatureCSS)
 }
 
 // Processor is the compile-time CSS plugin contract.

addons/db/db.go

@@ -25,7 +25,7 @@ const ImportPath = "github.com/cssbruno/gowdk/addons/db"
 
 // Addon enables the database plumbing feature.
 func Addon() gowdk.Addon {
-	return gowdk.NewAddon("db", gowdk.FeatureDB)
+	return gowdk.NewBuiltinAddon("db", gowdk.FeatureDB)
 }
 
 // Options tunes the connection pool. The zero value applies sensible defaults.

addons/embed/embed.go

@@ -7,5 +7,5 @@ const ImportPath = "github.com/cssbruno/gowdk/addons/embed"
 
 // Addon enables one-binary embedded asset serving.
 func Addon() gowdk.Addon {
-	return gowdk.NewAddon("embed", gowdk.FeatureEmbed)
+	return gowdk.NewBuiltinAddon("embed", gowdk.FeatureEmbed)
 }

addons/observability/observability.go

@@ -20,7 +20,7 @@ type Collector = gowdktrace.Collector
 
 // Addon enables generated app trace wiring.
 func Addon() gowdk.Addon {
-	return gowdk.NewAddon("observability", gowdk.FeatureObservability)
+	return gowdk.NewBuiltinAddon("observability", gowdk.FeatureObservability)
 }
 
 // CollectorOption configures a Collector.

addons/partial/partial.go

@@ -7,5 +7,5 @@ const ImportPath = "github.com/cssbruno/gowdk/addons/partial"
 
 // Addon enables server fragments and partial swaps.
 func Addon() gowdk.Addon {
-	return gowdk.NewAddon("partial", gowdk.FeaturePartial)
+	return gowdk.NewBuiltinAddon("partial", gowdk.FeaturePartial)
 }

addons/ratelimit/ratelimit.go

@@ -7,5 +7,5 @@ const ImportPath = "github.com/cssbruno/gowdk/addons/ratelimit"
 
 // Addon enables request-time rate limiting support.
 func Addon() gowdk.Addon {
-	return gowdk.NewAddon("ratelimit", gowdk.FeatureRateLimit)
+	return gowdk.NewBuiltinAddon("ratelimit", gowdk.FeatureRateLimit)
 }

addons/realtime/realtime.go

@@ -27,7 +27,7 @@ type SSEStats = runtimerealtime.SSEStats
 
 // Addon enables realtime presentation-event fanout support.
 func Addon() gowdk.Addon {
-	return gowdk.NewAddon("realtime", gowdk.FeatureRealtime)
+	return gowdk.NewBuiltinAddon("realtime", gowdk.FeatureRealtime)
 }
 
 // NewSSE creates a dependency-free server-sent events presentation fanout hub.

addons/spa/spa.go

@@ -7,5 +7,5 @@ const ImportPath = "github.com/cssbruno/gowdk/addons/spa"
 
 // Addon enables build-time prerendering.
 func Addon() gowdk.Addon {
-	return gowdk.NewAddon("spa", gowdk.FeatureSPA)
+	return gowdk.NewBuiltinAddon("spa", gowdk.FeatureSPA)
 }

addons/ssr/ssr.go

@@ -7,5 +7,5 @@ const ImportPath = "github.com/cssbruno/gowdk/addons/ssr"
 
 // Addon enables request-time full-page rendering.
 func Addon() gowdk.Addon {
-	return gowdk.NewAddon("ssr", gowdk.FeatureSSR)
+	return gowdk.NewBuiltinAddon("ssr", gowdk.FeatureSSR)
 }

addons/static/static.go

@@ -7,5 +7,5 @@ const ImportPath = "github.com/cssbruno/gowdk/addons/static"
 
 // Addon enables build-time static page output.
 func Addon() gowdk.Addon {
-	return gowdk.NewAddon("static", gowdk.FeatureSPA)
+	return gowdk.NewBuiltinAddon("static", gowdk.FeatureSPA)
 }

config.go

@@ -0,0 +1,45 @@
+package gowdk
+
+// Config is the root application configuration. Each field delegates to a
+// focused config type; ValidateStructural rejects invalid cross-field states.
+type Config struct {
+	AppName    string
+	Source     SourceConfig
+	Modules    []ModuleConfig
+	Render     RenderConfig
+	I18N       I18NConfig
+	Env        EnvConfig
+	Lifecycle  LifecycleConfig
+	Interop    InteropConfig
+	Build      BuildConfig
+	CSS        CSSConfig
+	Features   FeatureConfig
+	Extensions []Extension
+	// Addons is the deprecated 0.x compatibility lane. New config should use
+	// Features for built-ins and Extensions for build-time behavior.
+	Addons []Addon
+}
+
+// SourceConfig selects portable .gwdk files for discovery.
+type SourceConfig struct {
+	Include []string
+	Exclude []string
+}
+
+// ModuleConfig names a source group inside a GOWDK app.
+type ModuleConfig struct {
+	Name   string
+	Type   string
+	Source SourceConfig
+}
+
+// RenderConfig controls default render behavior. SPA is the default.
+type RenderConfig struct {
+	Default RenderMode
+}
+
+// BuildParams carries compile-time route values into Go build helpers.
+type BuildParams struct {
+	Route  map[string]string `json:"route,omitempty"`
+	Locale string            `json:"locale,omitempty"`
+}

config_build.go

@@ -0,0 +1,108 @@
+package gowdk
+
+// BuildConfig controls output artifacts and frontend asset packaging.
+type BuildConfig struct {
+	Output              string
+	Mode                BuildMode
+	Assets              AssetMode
+	ObfuscateAssets     bool
+	Head                HeadConfig
+	CSRF                CSRFConfig
+	CORS                CORSConfig
+	SecurityHeaders     SecurityHeadersConfig
+	BodyLimits          BodyLimitsConfig
+	AllowMissingBackend bool
+	Stylesheets         []Stylesheet
+	Scripts             []Script
+	Worker              ContractWorkerConfig
+	Cron                ContractCronConfig
+	Targets             []BuildTargetConfig
+}
+
+type HeadConfig struct {
+	SiteName    string
+	Favicon     string
+	Image       string
+	TwitterCard string
+}
+
+type SecurityHeadersConfig struct {
+	Enabled bool
+	Headers map[string]string
+}
+
+type CORSConfig struct {
+	Enabled          bool
+	AllowedOrigins   []string
+	AllowedMethods   []string
+	AllowedHeaders   []string
+	ExposedHeaders   []string
+	AllowCredentials bool
+	MaxAgeSeconds    int
+}
+
+// CSRFConfig is enabled by default. Disabled is its single explicit opt-out.
+type CSRFConfig struct {
+	Disabled               bool
+	SecretEnv              string
+	VerificationSecretEnvs []string
+	CookieName             string
+	FieldName              string
+	HeaderName             string
+	Insecure               bool
+}
+
+type BodyLimitsConfig struct {
+	ActionBytes int64
+	APIBytes    int64
+}
+
+// BuildTargetConfig declares one independently publishable artifact set.
+type BuildTargetConfig struct {
+	Name          string
+	Modules       []string
+	Output        string
+	App           string
+	Binary        string
+	WASM          string
+	BackendApp    string
+	BackendBinary string
+	WorkerApp     string
+	WorkerBinary  string
+	Worker        ContractWorkerConfig
+	CronApp       string
+	CronBinary    string
+	Cron          ContractCronConfig
+	DeployRecipes []string
+}
+
+type ContractWorkerConfig struct {
+	EventSource ServiceRef
+	SeenStore   ServiceRef
+	Backoff     ServiceRef
+}
+
+type ContractCronConfig struct {
+	Jobs []ContractCronJobConfig
+}
+
+type ContractCronJobConfig struct {
+	Type            string
+	Schedule        string
+	OverlapPolicy   string
+	MissedRunPolicy string
+}
+
+type AssetMode string
+
+const (
+	AssetExternal AssetMode = "external"
+	Embed         AssetMode = "embed"
+)
+
+type BuildMode string
+
+const (
+	Development BuildMode = "development"
+	Production  BuildMode = "production"
+)

config_css.go

@@ -0,0 +1,14 @@
+package gowdk
+
+// CSSConfig controls discovered CSS inputs and page CSS output.
+type CSSConfig struct {
+	Include []string
+	Exclude []string
+	Default []string
+	Output  CSSOutputConfig
+}
+
+type CSSOutputConfig struct {
+	Dir        string
+	HrefPrefix string
+}