@swell/cli 2.9.21 → 2.9.23

package/dist/commands/api/post.js

@@ -31,7 +31,7 @@ export default class ApiPost extends SwellApiCommand {
         'swell api post /products --body \'{"name": "Product", "price": 100}\'',
         'swell api post /products --body ./product.json',
         'swell api post /functions/my-app/create-order --body \'{"items":["sku-1"]}\'',
-        `swell api post /functions/my-app/webhook --body @./payload.json -H 'Stripe-Signature: t=123,v1=abc'`,
+        `swell api post /functions/my-app/webhook --body ./payload.json -H 'X-Webhook-Event: order.created'`,
         `swell api post /products --body '{"name": "Product"}' --api frontend`,
     ];
     get method() {

package/dist/commands/app/dev.d.ts

@@ -6,6 +6,7 @@ export default class AppDev extends PushAppCommand {
     static examples: string[];
     static flags: {
         'no-push': import("@oclif/core/lib/interfaces/parser.js").BooleanFlag<boolean>;
+        'store-user': import("@oclif/core/lib/interfaces/parser.js").BooleanFlag<boolean>;
         port: import("@oclif/core/lib/interfaces/parser.js").OptionFlag<number | undefined, import("@oclif/core/lib/interfaces/parser.js").CustomOptions>;
         'frontend-port': import("@oclif/core/lib/interfaces/parser.js").OptionFlag<number | undefined, import("@oclif/core/lib/interfaces/parser.js").CustomOptions>;
         function: import("@oclif/core/lib/interfaces/parser.js").OptionFlag<string | undefined, import("@oclif/core/lib/interfaces/parser.js").CustomOptions>;

package/dist/commands/app/dev.js

@@ -9,10 +9,30 @@ import * as path from 'node:path';
 import ora from 'ora';
 import { ConfigType, allConfigFilesInDir, appConfigFromFile, } from '../../lib/apps/index.js';
 import { bundleFunction } from '../../lib/bundle.js';
+import { getLocalFrontendHost } from '../../lib/constants.js';
 import { analyzeFunctionSource, hasKindDiagnostic, } from '../../lib/function-source-analysis.js';
 import { detectPackageManager, getExecSpawnArgs, } from '../../lib/package-manager.js';
 import style from '../../lib/style.js';
 import { PushAppCommand } from '../../push-app-command.js';
+/**
+ * Headers that show the frontend dev server the public host and scheme, as
+ * managed hosting does. The tunnel replaces both with its own, so without them
+ * same-origin checks in the dev server reject the browser's requests.
+ *
+ * @param req - Request received from the tunnel
+ * @returns Header overrides, empty when the request did not come through Swell
+ */
+function publicRequestHeaders(req) {
+    const host = String(req.headers['x-forwarded-host'] ?? '')
+        .split(',')[0]
+        .trim();
+    if (!host) {
+        return {};
+    }
+    // The tunnel always reports https; the preview URL has the browser's scheme.
+    const { protocol } = new URL(getLocalFrontendHost('store', 'local'));
+    return { host, 'x-forwarded-proto': protocol.slice(0, -1) };
+}
 export default class AppDev extends PushAppCommand {
     static delayOrientation = true;
     static examples = [
@@ -26,6 +46,10 @@ export default class AppDev extends PushAppCommand {
         'no-push': Flags.boolean({
             description: 'skip pushing app files initially',
         }),
+        'store-user': Flags.boolean({
+            default: false,
+            description: 'for dashboard apps, preview as your store user instead of a visitor',
+        }),
         port: Flags.integer({
             char: 'p',
             description: 'override the default port to run the app locally',
@@ -76,6 +100,7 @@ export default class AppDev extends PushAppCommand {
         const { port, 'frontend-port': frontendPort } = flags;
         const noPush = flags['no-push'];
         this.jsonEvents = flags['json-events'];
+        this.setStoreUser(flags['store-user']);
         this.functionFilter = flags.function ?? null;
         if (!(await this.ensureAppExists(undefined, false))) {
             return;
@@ -98,6 +123,7 @@ export default class AppDev extends PushAppCommand {
         this.emitLifecycleEvent('preview:proxy-ready', {
             proxyPort: serverPort,
             storefrontId: this.storefront?.id ?? null,
+            storeUser: this.storeUser,
         });
         await this.runAppFrontendDevIfApplicable(frontendPort);
     }
@@ -178,7 +204,10 @@ export default class AppDev extends PushAppCommand {
             }
             else if (this.frontendPort) {
                 // Proxy non-function requests to frontend dev server
-                proxy.web(req, res, { target: `http://localhost:${this.frontendPort}` }, (error) => fail(502, `Frontend dev server error: ${error.message}`));
+                proxy.web(req, res, {
+                    target: `http://localhost:${this.frontendPort}`,
+                    headers: publicRequestHeaders(req),
+                }, (error) => fail(502, `Frontend dev server error: ${error.message}`));
             }
             else {
                 res.writeHead(404);
@@ -196,7 +225,10 @@ export default class AppDev extends PushAppCommand {
                 socket.destroy();
                 return;
             }
-            proxy.ws(req, socket, head, { target: `http://localhost:${this.frontendPort}` }, () => socket.destroy());
+            proxy.ws(req, socket, head, {
+                target: `http://localhost:${this.frontendPort}`,
+                headers: publicRequestHeaders(req),
+            }, () => socket.destroy());
         });
         await new Promise((resolve, reject) => {
             server.once('error', reject);
@@ -298,6 +330,9 @@ ENVIRONMENT = "development"
             }
             if (analysis.kind === 'workflow') {
                 this.log(`    Workflow: deploys through ${style.command('swell app push')}`);
+                if (analysis.config?.action) {
+                    this.log(`    Trigger: Action (runs the pushed workflow)`);
+                }
                 return;
             }
             const { config } = await bundleFunction(fullPath);
@@ -312,6 +347,9 @@ ENVIRONMENT = "development"
                 this.log(`    Trigger: Cron`);
                 this.log(`    Schedule: ${style.dim(config.cron.schedule)}`);
             }
+            else if (config?.action) {
+                this.log(`    Trigger: Action`);
+            }
             else if (config?.route) {
                 this.log(`    Trigger: Route`);
                 if (config.route.methods?.length) {

package/dist/commands/app/frontend/dev.d.ts

@@ -8,6 +8,7 @@ export default class AppFrontendDev extends PushAppCommand {
         'app-dev': import("@oclif/core/lib/interfaces/parser.js").BooleanFlag<boolean>;
         yes: import("@oclif/core/lib/interfaces/parser.js").BooleanFlag<boolean>;
         'no-push': import("@oclif/core/lib/interfaces/parser.js").BooleanFlag<boolean>;
+        'store-user': import("@oclif/core/lib/interfaces/parser.js").BooleanFlag<boolean>;
         port: import("@oclif/core/lib/interfaces/parser.js").OptionFlag<number | undefined, import("@oclif/core/lib/interfaces/parser.js").CustomOptions>;
         'frontend-port': import("@oclif/core/lib/interfaces/parser.js").OptionFlag<number | undefined, import("@oclif/core/lib/interfaces/parser.js").CustomOptions>;
         function: import("@oclif/core/lib/interfaces/parser.js").OptionFlag<string | undefined, import("@oclif/core/lib/interfaces/parser.js").CustomOptions>;

package/dist/commands/app/frontend/dev.js

@@ -1,4 +1,5 @@
 import { Flags } from '@oclif/core';
+import { stripVTControlCharacters } from 'node:util';
 import { warnFrontendRouteCollisions } from '../../../lib/apps/frontend-routes.js';
 import { CUSTOM_FRAMEWORK_SLUG, getManualDevHint, getProjectCommands, } from '../../../lib/apps/index.js';
 import { PushAppCommand } from '../../../push-app-command.js';
@@ -40,6 +41,7 @@ export default class AppFrontendDev extends PushAppCommand {
         const { flags } = await this.parse(AppFrontendDev);
         const { port, 'proxy-port': proxyPort, 'app-dev': isAppDev } = flags;
         const noPush = flags['no-push'];
+        this.setStoreUser(flags['store-user']);
         if (!(await this.ensureAppExists(undefined, false))) {
             return;
         }
@@ -97,10 +99,7 @@ export default class AppFrontendDev extends PushAppCommand {
         const { devCommand } = await getProjectCommands(this.appPath, projectType);
         let serverReadyDetected = false;
         await this.execFrontend(devCommand.replace('${PORT}', String(serverPort)), (string) => {
-            // Shared: Hide Vite noise output common across frameworks
-            if (/press h \+ enter to show help/i.test(string)) {
-                return false;
-            }
+            const output = stripVTControlCharacters(string);
             // Framework-specific output handling and ready detection
             switch (projectType.slug) {
                 case 'nextjs': {
@@ -193,10 +192,11 @@ export default class AppFrontendDev extends PushAppCommand {
                 case 'react':
                 case 'react-storefront':
                 case 'vinext': {
-                    // Vite emits the Local URL as its ready signal — no separate
-                    // detector needed. Vinext dev delegates URL printing to Vite.
-                    if (/➜\s+local:\s+http:\/\//i.test(string) ||
-                        /➜\s+network:/i.test(string)) {
+                    // The ready banner can arrive without a URL. Detect readiness
+                    // before filtering help text, which may share the same chunk.
+                    if (/\bvite\s+v\S+\s+ready in\b/i.test(output) ||
+                        /➜\s+local:\s+http:\/\//i.test(output) ||
+                        /➜\s+network:/i.test(output)) {
                         if (!serverReadyDetected) {
                             serverReadyDetected = true;
                             this.log(`Started ${projectType.name} dev server on port ${serverPort}.\n`);
@@ -228,6 +228,9 @@ export default class AppFrontendDev extends PushAppCommand {
                 }
                 // No default
             }
+            if (/press h \+ enter to show help/i.test(output)) {
+                return false;
+            }
         });
     }
 }

package/dist/commands/app/push.d.ts

@@ -28,4 +28,5 @@ export default class AppPush extends PushAppCommand {
      */
     confirmPushConflicts(conflictsFlag?: string, file?: string): Promise<boolean>;
     run(): Promise<void>;
+    private exitIfFilesFailed;
 }

package/dist/commands/app/push.js

@@ -153,6 +153,7 @@ ${Object.values(AllConfigPaths)
                 }
                 this.log();
                 this.logDashboardUrl(flags);
+                this.exitIfFilesFailed();
                 return;
             }
         }
@@ -162,5 +163,12 @@ ${Object.values(AllConfigPaths)
             this.log();
         }
         this.logDashboardUrl(flags);
+        this.exitIfFilesFailed();
+    }
+    // A skipped file is a failed push, for scripts and CI too
+    exitIfFilesFailed() {
+        if (this.failedFiles.length > 0) {
+            this.error(`${this.failedFiles.length} file(s) failed to push: ${this.failedFiles.join(', ')}`);
+        }
     }
 }

package/dist/commands/inspect/functions.d.ts

@@ -7,6 +7,7 @@ interface FunctionRecord {
     cron?: {
         schedule?: string;
     };
+    action?: Record<string, unknown>;
     route?: {
         headers?: string[];
         methods?: string[];

package/dist/commands/inspect/functions.js

@@ -7,6 +7,10 @@ function deriveTrigger(r) {
         const n = r.model.events.length;
         return `model (${n} event${n === 1 ? '' : 's'})`;
     }
+    // Checked before route: an installed function can also carry `route: {}`.
+    if (r.action) {
+        return 'action';
+    }
     if (r.route) {
         const { methods } = r.route;
         if (!methods?.length)

package/dist/commands/schema.js

@@ -262,7 +262,7 @@ export default class Schema extends SwellCommand {
         // Validate trigger exclusivity
         const triggers = getFunctionTriggers(config);
         if (triggers.length === 0) {
-            throw new Error('Invalid function config:\n•  Config must specify one of: route, model, cron');
+            throw new Error('Invalid function config:\n•  Config must specify one of: route, model, cron, action');
         }
         if (triggers.length > 1) {
             throw new Error(`Invalid function config:\n•  Multiple triggers specified: ${triggers.join(', ')}. Use exactly one.`);

package/dist/lib/apps/app-config.d.ts

@@ -45,6 +45,16 @@ export declare abstract class AppConfig {
     version?: string;
     constructor(attrs?: Partial<AppConfig>);
     load(): Promise<void>;
+    /**
+     * The hash push compares with the pushed config to skip unchanged files
+     * @returns {Promise<string | undefined>} the hash
+     */
+    protected contentHash(): Promise<string | undefined>;
+    /**
+     * Full path of the app directory this config belongs to
+     * @returns {string} the path
+     */
+    protected appRoot(): string;
     static create(attrs?: Partial<AppConfig>): Promise<AppConfig>;
     isRootConfig(configDir: string): boolean;
     postData(): Promise<any>;
@@ -88,6 +98,7 @@ export declare class AppConfigFunction extends AppConfig {
     hasValues: boolean;
     type: ConfigType;
     isRootFunction(): boolean;
+    protected contentHash(): Promise<string | undefined>;
     preparePostData(postData: any): Promise<any>;
 }
 export declare class AppConfigComponent extends AppConfig {

package/dist/lib/apps/app-config.js

@@ -3,9 +3,9 @@ import isEmpty from 'lodash/isEmpty.js';
 import { detectFilenameMime } from 'mime-detect';
 import * as fs from 'node:fs/promises';
 import * as path from 'node:path';
-import { bundleFunction, bundleComponent, bundleWorkflow } from '../bundle.js';
+import { bundleFunction, bundleComponent, bundleWorkflow, getLocalInputs, } from '../bundle.js';
 import { analyzeFunctionSource, hasKindDiagnostic, workflowStaticConfigError, } from '../function-source-analysis.js';
-import { AllConfigPaths, ConfigType, filePathExistsAsync, hashFile, } from './index.js';
+import { AllConfigPaths, ConfigType, filePathExistsAsync, hashFile, hashString, } from './index.js';
 export class IgnoringFileError extends Error {
     constructor(message) {
         super(message);
@@ -83,11 +83,25 @@ export class AppConfig {
         if (await filePathExistsAsync(this.appPath)) {
             this.fileData = await fs.readFile(this.appPath);
             this.fileHash = hashFile(this.appPath, this.fileData, this.filePath);
-            this.hash = this.hash || this.fileHash;
+            this.hash = this.hash || (await this.contentHash());
             this.byteSize = this.fileData.length;
             this.mbSize = this.byteSize / 1024 / 1024;
         }
     }
+    /**
+     * The hash push compares with the pushed config to skip unchanged files
+     * @returns {Promise<string | undefined>} the hash
+     */
+    async contentHash() {
+        return this.fileHash;
+    }
+    /**
+     * Full path of the app directory this config belongs to
+     * @returns {string} the path
+     */
+    appRoot() {
+        return path.resolve(this.appPath, ...this.filePath.split('/').map(() => '..'));
+    }
     static async create(attrs = {}) {
         let instance;
         switch (attrs.type) {
@@ -263,6 +277,27 @@ export class AppConfigFunction extends AppConfig {
         return (this.isRootConfig('functions') &&
             (this.filePath.endsWith('.js') || this.filePath.endsWith('.ts')));
     }
+    // A function deploys as a bundle, so the hash includes the local files it
+    // imports: a change in shared code under functions/lib redeploys it
+    async contentHash() {
+        if (!this.isRootFunction() || !this.fileHash) {
+            return this.fileHash;
+        }
+        const appRoot = this.appRoot();
+        let inputs;
+        try {
+            inputs = await getLocalInputs(this.appPath, appRoot);
+        }
+        catch {
+            // Unknown until it compiles: push tries it and reports the error
+            return undefined;
+        }
+        const imports = inputs
+            .filter((input) => input !== this.filePath)
+            .sort()
+            .map((input) => hashFile(path.join(appRoot, input), undefined, input));
+        return hashString(this.fileHash, ...imports);
+    }
     async preparePostData(postData) {
         if (this.isRootFunction()) {
             try {

package/dist/lib/apps/frontend-package.js

@@ -3,7 +3,7 @@ import { execa } from 'execa';
 import { isIgnoredByIgnoreFiles } from 'globby';
 import { createHash } from 'node:crypto';
 import * as fs from 'node:fs/promises';
-import { createRequire } from 'node:module';
+import { createRequire, isBuiltin } from 'node:module';
 import * as os from 'node:os';
 import * as path from 'node:path';
 const sha256 = (bytes) => createHash('sha256').update(bytes).digest('hex');
@@ -155,13 +155,25 @@ export async function checkModuleGraph(pkg) {
                 name: 'retained-frontend-modules',
                 setup(builder) {
                     builder.onResolve({ filter: /.*/ }, (args) => {
-                        if (/^(?:node|cloudflare):/.test(args.path))
+                        // The provider validates runtime module names at upload, so a
+                        // scheme is never checked against the Node version running here.
+                        if (args.kind !== 'entry-point' &&
+                            (/^(?:node|cloudflare):/.test(args.path) || isBuiltin(args.path)))
                             return { path: args.path, external: true };
+                        // Like the runtime, resolve any other name, bare or relative,
+                        // against the importer's directory.
                         const name = args.kind === 'entry-point'
                             ? args.path
                             : path.posix.join(path.posix.dirname(args.importer), args.path);
-                        if (!modules.has(name))
-                            throw new Error(`Missing frontend Worker module: ${name}`);
+                        if (!modules.has(name)) {
+                            const from = args.importer
+                                ? ` (imported as "${args.path}" from "${args.importer}")`
+                                : '';
+                            const hint = args.importer && /^[\w@]/.test(args.path)
+                                ? '. npm dependencies must be bundled.'
+                                : '';
+                            throw new Error(`Missing frontend Worker module: ${name}${from}${hint}`);
+                        }
                         return { path: name, namespace: 'frontend' };
                     });
                     builder.onLoad({ filter: /.*/, namespace: 'frontend' }, (args) => {
@@ -289,10 +301,7 @@ export async function captureFrontendPackage(frontend, framework) {
             Buffer.from(await part.arrayBuffer())));
         }
         const bindings = (metadata.bindings ?? []).map((binding) => {
-            if ((binding.type === 'assets' && binding.name === 'ASSETS') ||
-                (framework === 'vinext' &&
-                    binding.type === 'version_metadata' &&
-                    binding.name === 'CF_VERSION_METADATA')) {
+            if (binding.type === 'assets' && binding.name === 'ASSETS') {
                 return binding.name;
             }
             throw new Error(`Unsupported managed frontend binding: ${binding.name}`);

package/dist/lib/apps/frontend-templates.d.ts

@@ -4,7 +4,7 @@ export declare const FRONTEND_HOSTING_LABELS: {
     'self-hosted': string;
 };
 export declare const C3_VERSION = "2.72.7";
-export declare const FRONTEND_TEMPLATE_REF = "v0.1";
+export declare const FRONTEND_TEMPLATE_REF = "v0.2";
 export interface FrontendTemplate {
     /** `--frontend` value and picker value. */
     slug: string;

package/dist/lib/apps/frontend-templates.js

@@ -9,7 +9,7 @@ export const C3_VERSION = '2.72.7';
 // template hotfixes need no CLI release; a breaking template change gets a new
 // minor tag and a CLI release that points at it. degit resolves only branch
 // and tag tips, never arbitrary commits.
-export const FRONTEND_TEMPLATE_REF = 'v0.1';
+export const FRONTEND_TEMPLATE_REF = 'v0.2';
 // npx pins the generator even on Yarn Classic. The caller passes the selected
 // manager's user agent for C3's dependency edits.
 const managedInstallCommand = (directory) => `npx --yes create-cloudflare@${C3_VERSION} frontend --template=swellstores/swell-app-templates/${directory}#${FRONTEND_TEMPLATE_REF} --deploy=false --git=false --no-agents --no-auto-update --lang=ts`;

package/dist/lib/bundle.d.ts

@@ -1,4 +1,12 @@
 import type { FunctionSourceAnalysis } from './function-source-analysis.js';
+/**
+ * Local source files an entry point imports, itself included, relative to
+ * rootDir. Packages are not followed: only the app's own files are listed.
+ * @param {string} entryPoint path of the entry point, relative to rootDir
+ * @param {string} rootDir directory the paths are relative to
+ * @returns {Promise<string[]>} paths of the imported files
+ */
+export declare function getLocalInputs(entryPoint: string, rootDir: string): Promise<string[]>;
 export declare function bundleFunction(filePath: string): Promise<any>;
 export declare function bundleWorkflow(filePath: string, analysis: FunctionSourceAnalysis): Promise<any>;
 export declare function bundleComponent(filePath: string): Promise<any>;

package/dist/lib/bundle.js

@@ -2,6 +2,27 @@ import * as esbuild from 'esbuild';
 import * as fs from 'node:fs/promises';
 import * as path from 'node:path';
 import { fileURLToPath } from 'node:url';
+/**
+ * Local source files an entry point imports, itself included, relative to
+ * rootDir. Packages are not followed: only the app's own files are listed.
+ * @param {string} entryPoint path of the entry point, relative to rootDir
+ * @param {string} rootDir directory the paths are relative to
+ * @returns {Promise<string[]>} paths of the imported files
+ */
+export async function getLocalInputs(entryPoint, rootDir) {
+    const { metafile } = await esbuild.build({
+        absWorkingDir: rootDir,
+        bundle: true,
+        entryPoints: [entryPoint],
+        external: ['cloudflare:*'],
+        logLevel: 'silent',
+        metafile: true,
+        packages: 'external',
+        platform: 'node',
+        write: false,
+    });
+    return Object.keys(metafile.inputs);
+}
 export async function bundleFunction(filePath) {
     try {
         const buildResult = await esbuild.build({

package/dist/lib/create/tests/templates/mock-request.js

@@ -46,6 +46,7 @@ export function createMockRequest(options: MockRequestOptions = {}): SwellReques
   } = options;
 
   const requestHeaders = new Headers(headers);
+  const requestQuery = { ...Object.fromEntries(new URL(url).searchParams), ...query };
   const originalRequest = new Request(url, {
     method,
     headers: requestHeaders,
@@ -88,40 +89,20 @@ export function createMockRequest(options: MockRequestOptions = {}): SwellReques
     apiHost: env.SWELL_API_BASE_URL || "",
     logParams: undefined,
     swell: swellClient as SwellAPI,
-    body: data,
-    data,
-    query,
+    rawBody: method === "GET" ? "" : JSON.stringify(data),
+    body: method === "GET" ? "" : { ...data },
+    data: { ...(method === "GET" ? {} : data), ...requestQuery },
+    query: requestQuery,
     initialize: async () => {},
-    parseJson: (input: string) => JSON.parse(input),
+    parseJson: (input: string) => {
+      try { return JSON.parse(input); } catch { return {}; }
+    },
     reject: (
       code: string,
       message: string,
       options: { status?: number } = {}
     ) => {
-      const status =
-        typeof options.status === "number" &&
-        options.status >= 400 &&
-        options.status < 500
-          ? options.status
-          : 422;
-      const error = new Error(
-        message || "Request rejected by function"
-      ) as Error & {
-        body: { $reject: { code: string; message: string; status: number } };
-        code: string;
-        status: number;
-      };
-      error.name = "SwellRejection";
-      error.code = code;
-      error.status = status;
-      error.body = {
-        $reject: {
-          code,
-          message: error.message,
-          status,
-        },
-      };
-      return error;
+      return new SwellRejection(code, message, options);
     },
     appValues: (idOrValues: string | SwellData, values?: SwellData) => {
       const targetAppId =

package/dist/lib/create/tests/templates/setup-globals.js

@@ -1,21 +1,6 @@
 export function setupGlobalsTemplate() {
     return `\
-class SwellErrorImpl extends Error {
-  status: number;
-  body?: unknown;
-
-  constructor(message: string | object, options: { status?: number } = {}) {
-    const text =
-      typeof message === "string"
-        ? message
-        : JSON.stringify(message, null, 2);
-
-    super(text);
-    this.name = "SwellError";
-    this.status = options.status ?? 500;
-    this.body = typeof message === "string" ? undefined : message;
-  }
-}
+import { SwellError } from "@swell/apps-sdk";
 
 class SwellRejectionImpl extends Error {
   status: number;
@@ -51,7 +36,7 @@ class SwellRejectionImpl extends Error {
 }
 
 // eslint-disable-next-line @typescript-eslint/no-explicit-any
-(globalThis as any).SwellError = SwellErrorImpl;
+(globalThis as any).SwellError = SwellError;
 // eslint-disable-next-line @typescript-eslint/no-explicit-any
 (globalThis as any).SwellRejection = SwellRejectionImpl;
 

package/dist/lib/create/tests/templates/unit-test.js

@@ -14,7 +14,7 @@ describe("Unit test examples", () => {
     });
 
     expect(req.data.product_id).toBe("prod_123");
-    expect(req.session.account_id).toBe("acc_456");
+    expect(req.session?.account_id).toBe("acc_456");
   });
 
   it("mocks swell.get", async () => {

package/dist/lib/create/tests.js

@@ -7,6 +7,7 @@ const TEST_DEV_DEPENDENCIES = {
     '@cloudflare/vitest-pool-workers': '0.12.x',
     vitest: '3.2.x',
     '@swell/app-types': 'latest',
+    '@swell/apps-sdk': '2.0.0-alpha.0',
 };
 async function writeTextFile(filePath, contents, overwrite) {
     if (!overwrite && (await filePathExistsAsync(filePath))) {
@@ -52,6 +53,9 @@ async function updatePackageJson(appPath) {
     if (!devDeps['@swell/app-types'] && !deps['@swell/app-types']) {
         devDeps['@swell/app-types'] = TEST_DEV_DEPENDENCIES['@swell/app-types'];
     }
+    if (!devDeps['@swell/apps-sdk'] && !deps['@swell/apps-sdk']) {
+        devDeps['@swell/apps-sdk'] = TEST_DEV_DEPENDENCIES['@swell/apps-sdk'];
+    }
     pkg.devDependencies = devDeps;
     const scripts = (pkg.scripts || {});
     scripts.test = scripts.test || 'vitest run';

package/dist/lib/function-source-analysis.js

@@ -2,7 +2,7 @@ import * as fs from 'node:fs/promises';
 import { createRequire } from 'node:module';
 const require = createRequire(import.meta.url);
 const ts = require('typescript');
-const ORDINARY_TRIGGER_KEYS = ['route', 'model', 'cron'];
+const ORDINARY_TRIGGER_KEYS = ['route', 'model', 'cron', 'action'];
 const WORKFLOW_FORBIDDEN_KEYS = [
     'route',
     'model',

package/dist/lib/swell-function-wrapper.js

@@ -111,8 +111,9 @@ class SwellRequest {
         this.swell = new SwellAPI(this, context);
         // URL of the original request
         this.url;
-        // Raw request body text, untouched by parsing.
-        // Use on route triggers for HMAC/webhook signature verification.
+        // Request body text. On a route called through the storefront gateway with
+        // a JSON body, this is the exact text the caller sent, so verify HMAC/webhook
+        // signatures against it. Other bodies arrive re-serialized as JSON.
         this.rawBody = '';
         // Parsed JSON body as object, or raw text string when body isn't JSON.
         this.body = {};

package/dist/lib/workflows/operations.d.ts

@@ -27,6 +27,9 @@ export interface WorkflowFailure {
     message?: string;
 }
 export interface WorkflowRunRecord {
+    action?: {
+        id?: string;
+    };
     app_id?: string;
     cf_instance_id?: string;
     date_completed?: string;

package/dist/lib/workflows/operations.js

@@ -113,6 +113,9 @@ export function workflowRunMeta(run) {
     if (run.status) {
         parts.push(run.status);
     }
+    if (run.trigger === 'action') {
+        parts.push(run.action?.id ? `action (${run.action.id})` : 'action');
+    }
     const date = workflowRunDate(run);
     if (date) {
         parts.push(formatWorkflowRelativeTime(date));

package/dist/push-app-command.d.ts

@@ -13,6 +13,7 @@ interface WatchingChange {
 export declare abstract class PushAppCommand extends RemoteAppCommand {
     frontendPath: string;
     hasLoggedLocalPreviewUrl: boolean;
+    storeUser: boolean;
     logWatchChanges: boolean;
     onWatchChange?: (appConfig?: AppConfig, action?: string, result?: any) => void;
     watchingChangeQueue: Map<string, WatchingChange>;
@@ -48,6 +49,13 @@ export declare abstract class PushAppCommand extends RemoteAppCommand {
     }, shouldChoose?: boolean): Promise<App | undefined>;
     getExistingApp(appId: string): Promise<App>;
     getFrontendDeploymentHash(): Promise<string | undefined>;
+    /**
+     * Files outside frontend/ that the worker's entry point imports, relative to
+     * the app path. Only a local entry point set by `main` in the wrangler
+     * config is followed; frameworks that build their own entry are not.
+     * @returns {Promise<string[]>} paths of the imported files
+     */
+    getFrontendSharedInputs(): Promise<string[]>;
     getFrontendProjectType(required?: boolean): Promise<FrontendProjectType | null>;
     getStorefrontToPull(args?: {
         appId?: string;
@@ -83,6 +91,7 @@ export declare abstract class PushAppCommand extends RemoteAppCommand {
     runWatchChangeQueue(): Promise<void>;
     saveCurrentStorefront(): void;
     logLocalPreviewUrl(): void;
+    setStoreUser(storeUser: boolean): void;
     setWatchingFiles(): Promise<void>;
     startProxyServer(port?: number): Promise<number>;
     updateFrontendDeployment(currentStore: string, projectType: FrontendProjectType, deploymentUrl: string, deploymentHash: string): Promise<void>;

package/dist/push-app-command.js

@@ -8,9 +8,10 @@ import ora from 'ora';
 import { default as swellConfig } from './lib/app-config.js';
 import { buildFrontendPackage, getManagedFrontendFramework, } from './lib/apps/frontend-package.js';
 import { warnFrontendRouteCollisions } from './lib/apps/frontend-routes.js';
-import { ConfigType, getFrontendProjectValidValues, allConfigFilesInDir, CUSTOM_FRAMEWORK_SLUG, appConfigFromFile, filePathExistsAsync, findAppConfig, getConfigTypeFromPath, getConfigTypeKeyFromValue, getFrontendProjectType, getProjectCommands, globAllFilesByPath, hashString, isPathDirectory, toPosixPath, } from './lib/apps/index.js';
+import { ConfigType, getFrontendProjectValidValues, allConfigFilesInDir, CUSTOM_FRAMEWORK_SLUG, appConfigFromFile, filePathExistsAsync, findAppConfig, getConfigTypeFromPath, getConfigTypeKeyFromValue, getFrontendProjectType, getProjectCommands, globAllFilesByPath, hashFile, hashString, isPathDirectory, toPosixPath, } from './lib/apps/index.js';
 import { getGlobIgnorePathsChecker } from './lib/apps/paths.js';
 import { slugFromApp } from './lib/apps/slug.js';
+import { getLocalInputs } from './lib/bundle.js';
 import { default as localConfig } from './lib/config.js';
 import { toAppId } from './lib/create/index.js';
 import { detectPackageManager, transformCommand, } from './lib/package-manager.js';
@@ -21,9 +22,31 @@ import { RemoteAppCommand } from './remote-app-command.js';
 const PUSH_CONCURRENCY = 3;
 const WATCH_WINDOW_MS = 100;
 const DEV_SERVER_FALLBACK_PORT = 3000;
+const WRANGLER_CONFIG_FILES = [
+    'wrangler.jsonc',
+    'wrangler.json',
+    'wrangler.toml',
+];
+/**
+ * The `main` entry point of a wrangler config (JSON, JSONC or TOML)
+ * @param {string} frontendPath directory of the wrangler config
+ * @returns {string | undefined} the entry point, relative to frontendPath
+ */
+function readWranglerMain(frontendPath) {
+    for (const name of WRANGLER_CONFIG_FILES) {
+        const configPath = path.join(frontendPath, name);
+        if (fs.existsSync(configPath)) {
+            // "main": "src/index.ts" in JSON, main = "src/index.ts" in TOML
+            return fs
+                .readFileSync(configPath, 'utf8')
+                .match(/^\s*"?main"?\s*[:=]\s*"([^"]+)"/m)?.[1];
+        }
+    }
+}
 export class PushAppCommand extends RemoteAppCommand {
     frontendPath = '';
     hasLoggedLocalPreviewUrl = false;
+    storeUser = false;
     logWatchChanges = true;
     onWatchChange;
     watchingChangeQueue = new Map();
@@ -466,9 +489,34 @@ export class PushAppCommand extends RemoteAppCommand {
         if (frontendHashes.length > 0) {
             const packageHash = localConfigs.find((config) => config.filePath === 'package.json')?.hash;
             frontendHashes += `|${packageHash}`;
+            // Shared code the worker imports from outside frontend/, e.g. functions/lib
+            for (const input of await this.getFrontendSharedInputs()) {
+                frontendHashes += `|${hashFile(path.join(this.appPath, input), undefined, input)}`;
+            }
         }
         return frontendHashes.length > 0 ? hashString(frontendHashes) : undefined;
     }
+    /**
+     * Files outside frontend/ that the worker's entry point imports, relative to
+     * the app path. Only a local entry point set by `main` in the wrangler
+     * config is followed; frameworks that build their own entry are not.
+     * @returns {Promise<string[]>} paths of the imported files
+     */
+    async getFrontendSharedInputs() {
+        const main = readWranglerMain(path.join(this.appPath, 'frontend'));
+        const entry = main && toPosixPath(path.join('frontend', main));
+        if (!entry || !fs.existsSync(path.join(this.appPath, entry))) {
+            return [];
+        }
+        try {
+            const inputs = await getLocalInputs(entry, this.appPath);
+            return inputs.filter((input) => !input.startsWith('frontend/')).sort();
+        }
+        catch {
+            // Build errors surface when wrangler deploys the worker
+            return [];
+        }
+    }
     async getFrontendProjectType(required = true) {
         this.frontendPath = path.join(this.appPath, 'frontend');
         const frontendExists = await filePathExistsAsync(this.frontendPath);
@@ -823,8 +871,17 @@ export class PushAppCommand extends RemoteAppCommand {
             ? `/${this.app.private_id}`
             : '';
         this.log(`View it at ${style.link(`${this.localFrontendUrl(currentStore, localId)}${frontendAppRoute}`)}\n`);
+        if (this.app.type !== 'storefront') {
+            this.log(`${this.storeUser ? 'Store-user' : 'Visitor'} preview. Anyone with the link sees the same view.\n`);
+        }
         this.hasLoggedLocalPreviewUrl = true;
     }
+    setStoreUser(storeUser) {
+        this.storeUser = storeUser;
+        if (storeUser && this.app.type === 'storefront') {
+            this.error('--store-user is not supported for storefront previews.');
+        }
+    }
     async setWatchingFiles() {
         this.watchingFiles = new Set(await globAllFilesByPath(this.appPath));
     }
@@ -865,13 +922,25 @@ export class PushAppCommand extends RemoteAppCommand {
     async updateLocalProxy(proxyUrl, storefrontId) {
         const storefront = this.app.type === 'storefront' &&
             (await this.getAppStorefront({ storefront_id: storefrontId }));
-        await this.handleRequestErrors(async () => this.api.put({ adminPath: `/client/apps/${this.app.id}/local-proxy` }, {
+        const storeUser = Boolean(proxyUrl && this.storeUser);
+        const putLocalProxy = (proxy_url, store_user) => this.api.put({ adminPath: `/client/apps/${this.app.id}/local-proxy` }, {
             body: {
-                proxy_url: proxyUrl,
+                proxy_url,
                 storefront_id: storefront?.id || null,
                 storefront_slug: storefront?.slug || null,
+                store_user,
             },
-        }));
+        });
+        const response = await this.handleRequestErrors(async () => putLocalProxy(proxyUrl, storeUser));
+        if (storeUser && response?.local_proxy?.store_user !== true) {
+            try {
+                await putLocalProxy(null, false);
+            }
+            catch {
+                // Cleanup is best-effort and silent; the unsupported-mode error follows.
+            }
+            this.error('This Swell server does not support --store-user. Restart without the flag.');
+        }
     }
     async watchForChanges({ logChanges, onChange, syncAll, } = {}) {
         this.watchingIgnoreFilter = await getGlobIgnorePathsChecker(this.appPath);

package/dist/remote-app-command.d.ts

@@ -12,6 +12,7 @@ export declare abstract class RemoteAppCommand extends AppCommand {
     app: App;
     appCreated: boolean;
     appType: string;
+    failedFiles: string[];
     protected pendingConflicts?: AppConflict[];
     storefront?: any;
     storefrontLocalUrl?: string;

package/dist/remote-app-command.js

@@ -5,7 +5,7 @@ import * as path from 'node:path';
 import { default as ora } from 'ora';
 import { AppCommand } from './app-command.js';
 import { readRcFile, writeRcFile } from './lib/app-config.js';
-import { AppConfig, ConfigType, FunctionProcessingError, IgnoringFileError, SwellJsonFields, allBaseFilesInDir, allConfigFilesPaths, appConfigFromFile, batchAppFilesByType, deleteFile, hashFile, writeFile, writeJsonFile, PUSH_CONCURRENCY, } from './lib/apps/index.js';
+import { AppConfig, ConfigType, FunctionProcessingError, IgnoringFileError, SwellJsonFields, allBaseFilesInDir, allConfigFilesPaths, appConfigFromFile, batchAppFilesByType, deleteFile, writeFile, writeJsonFile, PUSH_CONCURRENCY, } from './lib/apps/index.js';
 import { default as localConfig } from './lib/config.js';
 import { getAppFrontendHost, getLocalFrontendHost, getLoginHost, getStorefrontFrontendHost, } from './lib/constants.js';
 import { toAppId } from './lib/create/index.js';
@@ -24,6 +24,8 @@ export class RemoteAppCommand extends AppCommand {
     // Indicates the app was created during the command execution
     appCreated = false;
     appType = 'any';
+    // Files skipped because they could not be read or compiled
+    failedFiles = [];
     // Conflicts the user chose to disable, held until the command commits
     pendingConflicts;
     // API instance of the target storefront, if applicable
@@ -498,11 +500,11 @@ export class RemoteAppCommand extends AppCommand {
                     return true;
                 try {
                     const localConfig = localBatchConfigs.find((config) => config.filePath === batchConfig.filePath);
-                    if (localConfig) {
-                        const hash = hashFile(batchConfig.appPath, localConfig.fileData, batchConfig.filePath);
-                        if (hash === batchConfig.hash) {
-                            return false;
-                        }
+                    // Functions pushed by earlier CLI versions carry the plain file hash
+                    if (localConfig &&
+                        (localConfig.hash === batchConfig.hash ||
+                            localConfig.fileHash === batchConfig.hash)) {
+                        return false;
                     }
                 }
                 catch {
@@ -675,11 +677,13 @@ export class RemoteAppCommand extends AppCommand {
             if (error instanceof IgnoringFileError) {
                 log &&
                     spinner.fail(`Ignoring file: ${error.message} in ${config.filePath}`);
+                this.failedFiles.push(config.filePath);
                 return;
             }
             if (error instanceof FunctionProcessingError) {
                 log &&
                     spinner.fail(`${error.message} ${error.cause?.message?.toLowerCase()}`);
+                this.failedFiles.push(config.filePath);
                 return;
             }
             log && spinner.fail(error.message);

package/oclif.manifest.json

@@ -546,7 +546,7 @@
         "swell api post /products --body '{\"name\": \"Product\", \"price\": 100}'",
         "swell api post /products --body ./product.json",
         "swell api post /functions/my-app/create-order --body '{\"items\":[\"sku-1\"]}'",
-        "swell api post /functions/my-app/webhook --body @./payload.json -H 'Stripe-Signature: t=123,v1=abc'",
+        "swell api post /functions/my-app/webhook --body ./payload.json -H 'X-Webhook-Event: order.created'",
         "swell api post /products --body '{\"name\": \"Product\"}' --api frontend"
       ],
       "flags": {
@@ -745,6 +745,12 @@
           "allowNo": false,
           "type": "boolean"
         },
+        "store-user": {
+          "description": "for dashboard apps, preview as your store user instead of a visitor",
+          "name": "store-user",
+          "allowNo": false,
+          "type": "boolean"
+        },
         "port": {
           "char": "p",
           "description": "override the default port to run the app locally",
@@ -3510,6 +3516,12 @@
           "allowNo": false,
           "type": "boolean"
         },
+        "store-user": {
+          "description": "for dashboard apps, preview as your store user instead of a visitor",
+          "name": "store-user",
+          "allowNo": false,
+          "type": "boolean"
+        },
         "port": {
           "char": "p",
           "description": "override the default port to run the app locally",
@@ -3594,5 +3606,5 @@
       ]
     }
   },
-  "version": "2.9.21"
+  "version": "2.9.23"
 }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@swell/cli",
-  "version": "2.9.21",
+  "version": "2.9.23",
   "type": "module",
   "description": "Swell's command line interface/utility",
   "keywords": [