@webflow/webflow-cli 2.1.0 → 2.2.0-next.0

package/CHANGELOG.md

@@ -1,5 +1,13 @@
 # @webflow/webflow-cli
 
+## 2.1.1
+
+### Patch Changes
+
+- 15b87be: CLD-1629: send framework + framework_version in CLI deploy payload so Webflow Cloud SLOs and dashboards can split metrics by framework and version. No user-facing behavior change.
+- 8988847: security: bump tar to 7.5.16 to address known vulnerabilities
+- 043e99d: security: pin transitive dependencies axios, fast-uri, and tmp to address known vulnerabilities
+
 ## 2.1.0
 
 ### Minor Changes

package/README.md

@@ -18,6 +18,7 @@ npm install -g @webflow/webflow-cli
 - [DevLink Import (Code Components)](#devlink-import-code-components)
 - [DevLink Export](#devlink-export)
 - [Designer Extensions](#designer-extensions)
+- [Apps (Webflow Cloud)](#apps-webflow-cloud)
 - [Global Options](#global-options)
 
 ---
@@ -234,6 +235,57 @@ webflow extension bundle        # Build and package for upload (outputs bundle.z
 
 ---
 
+## Apps (Webflow Cloud)
+
+Manage Webflow Cloud app environment variables non-interactively. `--app-id` and
+`--environment-id` default from `webflow.json` (`cloud.app_id` / `cloud.environment_id`)
+when omitted.
+
+```shell
+webflow apps env-vars list --app-id <appId> --environment-id <envId>            # List variables
+webflow apps env-vars set <key> <value> --app-id <appId> --environment-id <envId>   # Create or update (plaintext; for secrets use stdin/prompt below)
+webflow apps env-vars set <key> --secret                         # Prompt (hidden) for a secret value
+printf %s "$VALUE" | webflow apps env-vars set <key> --secret    # Read a secret from stdin
+webflow apps env-vars delete <key> --app-id <appId> --environment-id <envId>   # Delete a variable
+webflow apps env-vars import .env --app-id <appId> --environment-id <envId>    # Bulk import from a .env file
+webflow apps env-vars import .env.secrets --secret               # Import every key as a secret
+```
+
+Secret values are encrypted server-side and are never displayed: reads return
+them masked, and `set` / `import` never echo values to stdout, logs, or
+telemetry.
+
+For `set`, the value is optional: omit it to read from piped **stdin** or to be
+prompted with hidden input. Prefer this for secrets — passing a value as a
+command-line argument leaves it in your shell history and the process list
+(`set` warns when you do so with `--secret`).
+
+### `env-vars list` options
+
+| Flag                    | Description                                                                                       |
+| ----------------------- | ------------------------------------------------------------------------------------------------- |
+| `--app-id <id>`         | Cloud app ID (default: `cloud.app_id` in `webflow.json`)                                          |
+| `--environment-id <id>` | Environment ID (default: `cloud.environment_id` in `webflow.json`)                                |
+| `--fields <fields>`     | Comma-separated columns (key, isSecret, value, id, environmentId). `value` is excluded by default |
+| `--json`                | Output as JSON                                                                                    |
+
+### `env-vars set` / `delete` / `import` options
+
+| Flag                    | Description                                                        |
+| ----------------------- | ------------------------------------------------------------------ |
+| `--app-id <id>`         | Cloud app ID (default: `cloud.app_id` in `webflow.json`)           |
+| `--environment-id <id>` | Environment ID (default: `cloud.environment_id` in `webflow.json`) |
+| `--secret`              | (`set`, `import`) Mark the variable(s) as an encrypted secret      |
+| `--dry-run`             | Preview without making any API calls                               |
+| `--json`                | Output as JSON                                                     |
+
+A plain `set` on an existing secret preserves its secrecy (it never silently
+downgrades a secret to plaintext). `import` reports a per-key
+created/updated/skipped/errors breakdown and exits non-zero if any key fails
+(e.g. a reserved or invalid name). The bulk import is capped at 100 variables.
+
+---
+
 ## Global Options
 
 Available on all commands:

package/dist/cloud-scaffolds/fetcher.ts

@@ -7,6 +7,7 @@ import { getFrameworkDefinition, toMinimalScaffoldId } from "./registry";
 import type { ScaffoldContent } from "./types";
 import { ScaffoldError } from "./types";
 import logger from "../../utils/logger";
+import { isBetaBuild } from "../../utils/release-tag";
 
 const GITHUB_TARBALL_BASE = "https://github.com";
 
@@ -87,7 +88,10 @@ async function fetchScaffoldFromGitHub(
     );
   }
 
-  const ref = def.source.ref ?? "main";
+  const ref =
+    (isBetaBuild() ? def.source.betaRef : undefined) ??
+    def.source.ref ??
+    "main";
   const tarballUrl = `${GITHUB_TARBALL_BASE}/${def.source.repo}/archive/${ref}.tar.gz`;
 
   const extractDir = await fs.promises.mkdtemp(

package/dist/cloud-scaffolds/registry.ts

@@ -24,6 +24,14 @@ import { ScaffoldError } from "./types";
  *      ships the breaking change.
  *
  * Old `vN` branches stay frozen — we don't backport fixes.
+ *
+ * Exception: the `astro-minimal`/`astro` entries additionally set `betaRef`
+ * to a framework-version branch name (`astro7`) rather than the next `vN`.
+ * `betaRef` is only used on beta (`@next`) builds — see `isBetaBuild()` and
+ * `fetcher.ts` — so `cloud init` keeps scaffolding Astro 6 (`ref: "v2"`) on
+ * stable until Astro 7 support lands on the cosmic-builder side (CLD-2148)
+ * and the CLI's own E2E coverage (CLD-2216) is green, at which point `betaRef`
+ * is promoted to `ref`.
  */
 export const FRAMEWORK_REGISTRY: Record<string, FrameworkDefinition> = {
   "astro-minimal": {
@@ -33,6 +41,7 @@ export const FRAMEWORK_REGISTRY: Record<string, FrameworkDefinition> = {
       type: "github",
       repo: "Webflow-Examples/hello-world-astro",
       ref: "v2",
+      betaRef: "astro7",
     },
   },
   "nextjs-minimal": {
@@ -51,6 +60,7 @@ export const FRAMEWORK_REGISTRY: Record<string, FrameworkDefinition> = {
       type: "github",
       repo: "Webflow-Examples/hello-world-astro-devlink",
       ref: "v2",
+      betaRef: "astro7",
     },
   },
   nextjs: {

package/dist/cloud-scaffolds/types.ts

@@ -8,6 +8,12 @@ export interface GitHubScaffoldSource {
   repo: string;
   /** Branch or tag. Default: "main" */
   ref?: string;
+  /**
+   * Branch or tag used instead of `ref` on beta (`@next`) builds — see
+   * `isBetaBuild()`. Lets a scaffold's contract move ahead on the pre-release
+   * channel before it's promoted to `ref` for stable.
+   */
+  betaRef?: string;
 }
 
 /**