@swell/cli 2.9.22 → 2.9.23

package/dist/commands/api/post.js

@@ -31,7 +31,7 @@ export default class ApiPost extends SwellApiCommand {
         'swell api post /products --body \'{"name": "Product", "price": 100}\'',
         'swell api post /products --body ./product.json',
         'swell api post /functions/my-app/create-order --body \'{"items":["sku-1"]}\'',
-        `swell api post /functions/my-app/webhook --body @./payload.json -H 'Stripe-Signature: t=123,v1=abc'`,
+        `swell api post /functions/my-app/webhook --body ./payload.json -H 'X-Webhook-Event: order.created'`,
         `swell api post /products --body '{"name": "Product"}' --api frontend`,
     ];
     get method() {

package/dist/commands/app/dev.d.ts

@@ -6,6 +6,7 @@ export default class AppDev extends PushAppCommand {
     static examples: string[];
     static flags: {
         'no-push': import("@oclif/core/lib/interfaces/parser.js").BooleanFlag<boolean>;
+        'store-user': import("@oclif/core/lib/interfaces/parser.js").BooleanFlag<boolean>;
         port: import("@oclif/core/lib/interfaces/parser.js").OptionFlag<number | undefined, import("@oclif/core/lib/interfaces/parser.js").CustomOptions>;
         'frontend-port': import("@oclif/core/lib/interfaces/parser.js").OptionFlag<number | undefined, import("@oclif/core/lib/interfaces/parser.js").CustomOptions>;
         function: import("@oclif/core/lib/interfaces/parser.js").OptionFlag<string | undefined, import("@oclif/core/lib/interfaces/parser.js").CustomOptions>;

package/dist/commands/app/dev.js

@@ -9,10 +9,30 @@ import * as path from 'node:path';
 import ora from 'ora';
 import { ConfigType, allConfigFilesInDir, appConfigFromFile, } from '../../lib/apps/index.js';
 import { bundleFunction } from '../../lib/bundle.js';
+import { getLocalFrontendHost } from '../../lib/constants.js';
 import { analyzeFunctionSource, hasKindDiagnostic, } from '../../lib/function-source-analysis.js';
 import { detectPackageManager, getExecSpawnArgs, } from '../../lib/package-manager.js';
 import style from '../../lib/style.js';
 import { PushAppCommand } from '../../push-app-command.js';
+/**
+ * Headers that show the frontend dev server the public host and scheme, as
+ * managed hosting does. The tunnel replaces both with its own, so without them
+ * same-origin checks in the dev server reject the browser's requests.
+ *
+ * @param req - Request received from the tunnel
+ * @returns Header overrides, empty when the request did not come through Swell
+ */
+function publicRequestHeaders(req) {
+    const host = String(req.headers['x-forwarded-host'] ?? '')
+        .split(',')[0]
+        .trim();
+    if (!host) {
+        return {};
+    }
+    // The tunnel always reports https; the preview URL has the browser's scheme.
+    const { protocol } = new URL(getLocalFrontendHost('store', 'local'));
+    return { host, 'x-forwarded-proto': protocol.slice(0, -1) };
+}
 export default class AppDev extends PushAppCommand {
     static delayOrientation = true;
     static examples = [
@@ -26,6 +46,10 @@ export default class AppDev extends PushAppCommand {
         'no-push': Flags.boolean({
             description: 'skip pushing app files initially',
         }),
+        'store-user': Flags.boolean({
+            default: false,
+            description: 'for dashboard apps, preview as your store user instead of a visitor',
+        }),
         port: Flags.integer({
             char: 'p',
             description: 'override the default port to run the app locally',
@@ -76,6 +100,7 @@ export default class AppDev extends PushAppCommand {
         const { port, 'frontend-port': frontendPort } = flags;
         const noPush = flags['no-push'];
         this.jsonEvents = flags['json-events'];
+        this.setStoreUser(flags['store-user']);
         this.functionFilter = flags.function ?? null;
         if (!(await this.ensureAppExists(undefined, false))) {
             return;
@@ -98,6 +123,7 @@ export default class AppDev extends PushAppCommand {
         this.emitLifecycleEvent('preview:proxy-ready', {
             proxyPort: serverPort,
             storefrontId: this.storefront?.id ?? null,
+            storeUser: this.storeUser,
         });
         await this.runAppFrontendDevIfApplicable(frontendPort);
     }
@@ -178,7 +204,10 @@ export default class AppDev extends PushAppCommand {
             }
             else if (this.frontendPort) {
                 // Proxy non-function requests to frontend dev server
-                proxy.web(req, res, { target: `http://localhost:${this.frontendPort}` }, (error) => fail(502, `Frontend dev server error: ${error.message}`));
+                proxy.web(req, res, {
+                    target: `http://localhost:${this.frontendPort}`,
+                    headers: publicRequestHeaders(req),
+                }, (error) => fail(502, `Frontend dev server error: ${error.message}`));
             }
             else {
                 res.writeHead(404);
@@ -196,7 +225,10 @@ export default class AppDev extends PushAppCommand {
                 socket.destroy();
                 return;
             }
-            proxy.ws(req, socket, head, { target: `http://localhost:${this.frontendPort}` }, () => socket.destroy());
+            proxy.ws(req, socket, head, {
+                target: `http://localhost:${this.frontendPort}`,
+                headers: publicRequestHeaders(req),
+            }, () => socket.destroy());
         });
         await new Promise((resolve, reject) => {
             server.once('error', reject);
@@ -298,6 +330,9 @@ ENVIRONMENT = "development"
             }
             if (analysis.kind === 'workflow') {
                 this.log(`    Workflow: deploys through ${style.command('swell app push')}`);
+                if (analysis.config?.action) {
+                    this.log(`    Trigger: Action (runs the pushed workflow)`);
+                }
                 return;
             }
             const { config } = await bundleFunction(fullPath);
@@ -312,6 +347,9 @@ ENVIRONMENT = "development"
                 this.log(`    Trigger: Cron`);
                 this.log(`    Schedule: ${style.dim(config.cron.schedule)}`);
             }
+            else if (config?.action) {
+                this.log(`    Trigger: Action`);
+            }
             else if (config?.route) {
                 this.log(`    Trigger: Route`);
                 if (config.route.methods?.length) {

package/dist/commands/app/frontend/dev.d.ts

@@ -8,6 +8,7 @@ export default class AppFrontendDev extends PushAppCommand {
         'app-dev': import("@oclif/core/lib/interfaces/parser.js").BooleanFlag<boolean>;
         yes: import("@oclif/core/lib/interfaces/parser.js").BooleanFlag<boolean>;
         'no-push': import("@oclif/core/lib/interfaces/parser.js").BooleanFlag<boolean>;
+        'store-user': import("@oclif/core/lib/interfaces/parser.js").BooleanFlag<boolean>;
         port: import("@oclif/core/lib/interfaces/parser.js").OptionFlag<number | undefined, import("@oclif/core/lib/interfaces/parser.js").CustomOptions>;
         'frontend-port': import("@oclif/core/lib/interfaces/parser.js").OptionFlag<number | undefined, import("@oclif/core/lib/interfaces/parser.js").CustomOptions>;
         function: import("@oclif/core/lib/interfaces/parser.js").OptionFlag<string | undefined, import("@oclif/core/lib/interfaces/parser.js").CustomOptions>;

package/dist/commands/app/frontend/dev.js

@@ -1,4 +1,5 @@
 import { Flags } from '@oclif/core';
+import { stripVTControlCharacters } from 'node:util';
 import { warnFrontendRouteCollisions } from '../../../lib/apps/frontend-routes.js';
 import { CUSTOM_FRAMEWORK_SLUG, getManualDevHint, getProjectCommands, } from '../../../lib/apps/index.js';
 import { PushAppCommand } from '../../../push-app-command.js';
@@ -40,6 +41,7 @@ export default class AppFrontendDev extends PushAppCommand {
         const { flags } = await this.parse(AppFrontendDev);
         const { port, 'proxy-port': proxyPort, 'app-dev': isAppDev } = flags;
         const noPush = flags['no-push'];
+        this.setStoreUser(flags['store-user']);
         if (!(await this.ensureAppExists(undefined, false))) {
             return;
         }
@@ -97,10 +99,7 @@ export default class AppFrontendDev extends PushAppCommand {
         const { devCommand } = await getProjectCommands(this.appPath, projectType);
         let serverReadyDetected = false;
         await this.execFrontend(devCommand.replace('${PORT}', String(serverPort)), (string) => {
-            // Shared: Hide Vite noise output common across frameworks
-            if (/press h \+ enter to show help/i.test(string)) {
-                return false;
-            }
+            const output = stripVTControlCharacters(string);
             // Framework-specific output handling and ready detection
             switch (projectType.slug) {
                 case 'nextjs': {
@@ -193,10 +192,11 @@ export default class AppFrontendDev extends PushAppCommand {
                 case 'react':
                 case 'react-storefront':
                 case 'vinext': {
-                    // Vite emits the Local URL as its ready signal — no separate
-                    // detector needed. Vinext dev delegates URL printing to Vite.
-                    if (/➜\s+local:\s+http:\/\//i.test(string) ||
-                        /➜\s+network:/i.test(string)) {
+                    // The ready banner can arrive without a URL. Detect readiness
+                    // before filtering help text, which may share the same chunk.
+                    if (/\bvite\s+v\S+\s+ready in\b/i.test(output) ||
+                        /➜\s+local:\s+http:\/\//i.test(output) ||
+                        /➜\s+network:/i.test(output)) {
                         if (!serverReadyDetected) {
                             serverReadyDetected = true;
                             this.log(`Started ${projectType.name} dev server on port ${serverPort}.\n`);
@@ -228,6 +228,9 @@ export default class AppFrontendDev extends PushAppCommand {
                 }
                 // No default
             }
+            if (/press h \+ enter to show help/i.test(output)) {
+                return false;
+            }
         });
     }
 }

package/dist/commands/inspect/functions.d.ts

@@ -7,6 +7,7 @@ interface FunctionRecord {
     cron?: {
         schedule?: string;
     };
+    action?: Record<string, unknown>;
     route?: {
         headers?: string[];
         methods?: string[];

package/dist/commands/inspect/functions.js

@@ -7,6 +7,10 @@ function deriveTrigger(r) {
         const n = r.model.events.length;
         return `model (${n} event${n === 1 ? '' : 's'})`;
     }
+    // Checked before route: an installed function can also carry `route: {}`.
+    if (r.action) {
+        return 'action';
+    }
     if (r.route) {
         const { methods } = r.route;
         if (!methods?.length)

package/dist/commands/schema.js

@@ -262,7 +262,7 @@ export default class Schema extends SwellCommand {
         // Validate trigger exclusivity
         const triggers = getFunctionTriggers(config);
         if (triggers.length === 0) {
-            throw new Error('Invalid function config:\n•  Config must specify one of: route, model, cron');
+            throw new Error('Invalid function config:\n•  Config must specify one of: route, model, cron, action');
         }
         if (triggers.length > 1) {
             throw new Error(`Invalid function config:\n•  Multiple triggers specified: ${triggers.join(', ')}. Use exactly one.`);

package/dist/lib/apps/frontend-package.js

@@ -301,10 +301,7 @@ export async function captureFrontendPackage(frontend, framework) {
             Buffer.from(await part.arrayBuffer())));
         }
         const bindings = (metadata.bindings ?? []).map((binding) => {
-            if ((binding.type === 'assets' && binding.name === 'ASSETS') ||
-                (framework === 'vinext' &&
-                    binding.type === 'version_metadata' &&
-                    binding.name === 'CF_VERSION_METADATA')) {
+            if (binding.type === 'assets' && binding.name === 'ASSETS') {
                 return binding.name;
             }
             throw new Error(`Unsupported managed frontend binding: ${binding.name}`);

package/dist/lib/apps/frontend-templates.d.ts

@@ -4,7 +4,7 @@ export declare const FRONTEND_HOSTING_LABELS: {
     'self-hosted': string;
 };
 export declare const C3_VERSION = "2.72.7";
-export declare const FRONTEND_TEMPLATE_REF = "v0.1";
+export declare const FRONTEND_TEMPLATE_REF = "v0.2";
 export interface FrontendTemplate {
     /** `--frontend` value and picker value. */
     slug: string;

package/dist/lib/apps/frontend-templates.js

@@ -9,7 +9,7 @@ export const C3_VERSION = '2.72.7';
 // template hotfixes need no CLI release; a breaking template change gets a new
 // minor tag and a CLI release that points at it. degit resolves only branch
 // and tag tips, never arbitrary commits.
-export const FRONTEND_TEMPLATE_REF = 'v0.1';
+export const FRONTEND_TEMPLATE_REF = 'v0.2';
 // npx pins the generator even on Yarn Classic. The caller passes the selected
 // manager's user agent for C3's dependency edits.
 const managedInstallCommand = (directory) => `npx --yes create-cloudflare@${C3_VERSION} frontend --template=swellstores/swell-app-templates/${directory}#${FRONTEND_TEMPLATE_REF} --deploy=false --git=false --no-agents --no-auto-update --lang=ts`;

package/dist/lib/function-source-analysis.js

@@ -2,7 +2,7 @@ import * as fs from 'node:fs/promises';
 import { createRequire } from 'node:module';
 const require = createRequire(import.meta.url);
 const ts = require('typescript');
-const ORDINARY_TRIGGER_KEYS = ['route', 'model', 'cron'];
+const ORDINARY_TRIGGER_KEYS = ['route', 'model', 'cron', 'action'];
 const WORKFLOW_FORBIDDEN_KEYS = [
     'route',
     'model',

package/dist/lib/swell-function-wrapper.js

@@ -111,8 +111,9 @@ class SwellRequest {
         this.swell = new SwellAPI(this, context);
         // URL of the original request
         this.url;
-        // Raw request body text, untouched by parsing.
-        // Use on route triggers for HMAC/webhook signature verification.
+        // Request body text. On a route called through the storefront gateway with
+        // a JSON body, this is the exact text the caller sent, so verify HMAC/webhook
+        // signatures against it. Other bodies arrive re-serialized as JSON.
         this.rawBody = '';
         // Parsed JSON body as object, or raw text string when body isn't JSON.
         this.body = {};

package/dist/lib/workflows/operations.d.ts

@@ -27,6 +27,9 @@ export interface WorkflowFailure {
     message?: string;
 }
 export interface WorkflowRunRecord {
+    action?: {
+        id?: string;
+    };
     app_id?: string;
     cf_instance_id?: string;
     date_completed?: string;

package/dist/lib/workflows/operations.js

@@ -113,6 +113,9 @@ export function workflowRunMeta(run) {
     if (run.status) {
         parts.push(run.status);
     }
+    if (run.trigger === 'action') {
+        parts.push(run.action?.id ? `action (${run.action.id})` : 'action');
+    }
     const date = workflowRunDate(run);
     if (date) {
         parts.push(formatWorkflowRelativeTime(date));

package/dist/push-app-command.d.ts

@@ -13,6 +13,7 @@ interface WatchingChange {
 export declare abstract class PushAppCommand extends RemoteAppCommand {
     frontendPath: string;
     hasLoggedLocalPreviewUrl: boolean;
+    storeUser: boolean;
     logWatchChanges: boolean;
     onWatchChange?: (appConfig?: AppConfig, action?: string, result?: any) => void;
     watchingChangeQueue: Map<string, WatchingChange>;
@@ -90,6 +91,7 @@ export declare abstract class PushAppCommand extends RemoteAppCommand {
     runWatchChangeQueue(): Promise<void>;
     saveCurrentStorefront(): void;
     logLocalPreviewUrl(): void;
+    setStoreUser(storeUser: boolean): void;
     setWatchingFiles(): Promise<void>;
     startProxyServer(port?: number): Promise<number>;
     updateFrontendDeployment(currentStore: string, projectType: FrontendProjectType, deploymentUrl: string, deploymentHash: string): Promise<void>;

package/dist/push-app-command.js

@@ -46,6 +46,7 @@ function readWranglerMain(frontendPath) {
 export class PushAppCommand extends RemoteAppCommand {
     frontendPath = '';
     hasLoggedLocalPreviewUrl = false;
+    storeUser = false;
     logWatchChanges = true;
     onWatchChange;
     watchingChangeQueue = new Map();
@@ -870,8 +871,17 @@ export class PushAppCommand extends RemoteAppCommand {
             ? `/${this.app.private_id}`
             : '';
         this.log(`View it at ${style.link(`${this.localFrontendUrl(currentStore, localId)}${frontendAppRoute}`)}\n`);
+        if (this.app.type !== 'storefront') {
+            this.log(`${this.storeUser ? 'Store-user' : 'Visitor'} preview. Anyone with the link sees the same view.\n`);
+        }
         this.hasLoggedLocalPreviewUrl = true;
     }
+    setStoreUser(storeUser) {
+        this.storeUser = storeUser;
+        if (storeUser && this.app.type === 'storefront') {
+            this.error('--store-user is not supported for storefront previews.');
+        }
+    }
     async setWatchingFiles() {
         this.watchingFiles = new Set(await globAllFilesByPath(this.appPath));
     }
@@ -912,13 +922,25 @@ export class PushAppCommand extends RemoteAppCommand {
     async updateLocalProxy(proxyUrl, storefrontId) {
         const storefront = this.app.type === 'storefront' &&
             (await this.getAppStorefront({ storefront_id: storefrontId }));
-        await this.handleRequestErrors(async () => this.api.put({ adminPath: `/client/apps/${this.app.id}/local-proxy` }, {
+        const storeUser = Boolean(proxyUrl && this.storeUser);
+        const putLocalProxy = (proxy_url, store_user) => this.api.put({ adminPath: `/client/apps/${this.app.id}/local-proxy` }, {
             body: {
-                proxy_url: proxyUrl,
+                proxy_url,
                 storefront_id: storefront?.id || null,
                 storefront_slug: storefront?.slug || null,
+                store_user,
             },
-        }));
+        });
+        const response = await this.handleRequestErrors(async () => putLocalProxy(proxyUrl, storeUser));
+        if (storeUser && response?.local_proxy?.store_user !== true) {
+            try {
+                await putLocalProxy(null, false);
+            }
+            catch {
+                // Cleanup is best-effort and silent; the unsupported-mode error follows.
+            }
+            this.error('This Swell server does not support --store-user. Restart without the flag.');
+        }
     }
     async watchForChanges({ logChanges, onChange, syncAll, } = {}) {
         this.watchingIgnoreFilter = await getGlobIgnorePathsChecker(this.appPath);

package/oclif.manifest.json

@@ -546,7 +546,7 @@
         "swell api post /products --body '{\"name\": \"Product\", \"price\": 100}'",
         "swell api post /products --body ./product.json",
         "swell api post /functions/my-app/create-order --body '{\"items\":[\"sku-1\"]}'",
-        "swell api post /functions/my-app/webhook --body @./payload.json -H 'Stripe-Signature: t=123,v1=abc'",
+        "swell api post /functions/my-app/webhook --body ./payload.json -H 'X-Webhook-Event: order.created'",
         "swell api post /products --body '{\"name\": \"Product\"}' --api frontend"
       ],
       "flags": {
@@ -745,6 +745,12 @@
           "allowNo": false,
           "type": "boolean"
         },
+        "store-user": {
+          "description": "for dashboard apps, preview as your store user instead of a visitor",
+          "name": "store-user",
+          "allowNo": false,
+          "type": "boolean"
+        },
         "port": {
           "char": "p",
           "description": "override the default port to run the app locally",
@@ -3510,6 +3516,12 @@
           "allowNo": false,
           "type": "boolean"
         },
+        "store-user": {
+          "description": "for dashboard apps, preview as your store user instead of a visitor",
+          "name": "store-user",
+          "allowNo": false,
+          "type": "boolean"
+        },
         "port": {
           "char": "p",
           "description": "override the default port to run the app locally",
@@ -3594,5 +3606,5 @@
       ]
     }
   },
-  "version": "2.9.22"
+  "version": "2.9.23"
 }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@swell/cli",
-  "version": "2.9.22",
+  "version": "2.9.23",
   "type": "module",
   "description": "Swell's command line interface/utility",
   "keywords": [