Add guarded build-time secret probe for Webflow Cloud E2E tests

next.config.ts

@@ -1,4 +1,6 @@
 import type { NextConfig } from 'next';
+import { execSync } from 'node:child_process';
+import { PHASE_PRODUCTION_BUILD } from 'next/constants';
 
 // User's custom Next.js configuration
 // NOTE: basePath is handled by Webflow Cloud builder
@@ -21,4 +23,20 @@ const nextConfig: NextConfig = {
   },
 };
 
-export default nextConfig;
+// Webflow Cloud end-to-end test hook. During the production build (what
+// `opennextjs-cloudflare build` runs when deploying to Webflow Cloud), emit the
+// build-time secret probe so its output flows through the build log pipeline
+// and the tests can verify build-time secret values are redacted from build
+// logs. Guarded on E2E_TEST_SECRET, so it is a complete no-op for `next dev`
+// and for normal builds that never set that variable.
+export default (phase: string): NextConfig => {
+  if (phase === PHASE_PRODUCTION_BUILD && process.env.E2E_TEST_SECRET) {
+    try {
+      execSync('npm run e2e:buildtime-secret-probe', { stdio: 'inherit' });
+    } catch (error) {
+      console.error('[webflow-cloud-e2e] build-time secret probe failed', error);
+    }
+  }
+
+  return nextConfig;
+};

package.json

@@ -6,6 +6,7 @@
     "dev": "next dev",
     "dev:cf": "opennextjs-cloudflare build && wrangler dev",
     "build": "next build",
+    "e2e:buildtime-secret-probe": "node ./scripts/e2e-buildtime-secret-probe.mjs",
     "start": "next start",
     "lint": "eslint",
     "db:setup": "wrangler d1 migrations apply DB --local",

scripts/e2e-buildtime-secret-probe.mjs

@@ -0,0 +1,17 @@
+// Webflow Cloud build-time secret probe (used by Webflow Cloud's end-to-end
+// tests).
+//
+// Prints the E2E_TEST_SECRET environment variable during the production build,
+// behind a stable marker, so the end-to-end tests can verify that Webflow Cloud
+// redacts build-time secret values from build logs. It is a deliberate no-op
+// unless E2E_TEST_SECRET is set, so a normal build (local dev or a real deploy)
+// prints nothing and behaves identically.
+const MARKER = '[webflow-cloud-e2e] build-time secret probe';
+
+const value = process.env.E2E_TEST_SECRET;
+if (value) {
+  // Emit line by line so a multiline secret is printed one line at a time.
+  for (const line of value.split('\n')) {
+    console.log(`${MARKER} E2E_TEST_SECRET=${line}`);
+  }
+}