@tenderprompt/accounts 0.2.0

package/templates/shopify-customer-account/apps/gateway/src/platform/runtime-hostname.ts

@@ -0,0 +1,46 @@
+import { createHash } from "node:crypto";
+
+export function canonicalApplicationHostname(input: RuntimeIdentity): string {
+  return `a-${shortDigest(input.projectId, 14)}--t-${shortDigest(input.tenantId, 14)}.${normalizedDomain(input.baseDomain)}`;
+}
+
+export function immutablePreviewHostname(input: RuntimeIdentity & { releaseId: string }): string {
+  return [
+    `r-${shortDigest(input.releaseId, 12)}`,
+    `p-${shortDigest(input.projectId, 10)}`,
+    `t-${shortDigest(input.tenantId, 10)}`,
+  ].join("--") + `.${normalizedDomain(input.baseDomain)}`;
+}
+
+export function previewAliasHostname(input: RuntimeIdentity & { alias: string }): string {
+  const readable = input.alias.toLowerCase().replace(/[^a-z0-9-]+/gu, "-").replace(/^-+|-+$/gu, "").slice(0, 12);
+  if (readable.length < 2) throw new Error("The preview alias is invalid.");
+  return [
+    `b-${readable}-${rawDigest(input.alias, 8)}`,
+    `p-${shortDigest(input.projectId, 10)}`,
+    `t-${shortDigest(input.tenantId, 10)}`,
+  ].join("--") + `.${normalizedDomain(input.baseDomain)}`;
+}
+
+interface RuntimeIdentity {
+  tenantId: string;
+  projectId: string;
+  baseDomain: string;
+}
+
+function shortDigest(value: string, length: number): string {
+  if (!/^[A-Za-z0-9][A-Za-z0-9_-]{1,127}$/u.test(value)) throw new Error("The runtime identity is invalid.");
+  return rawDigest(value, length);
+}
+
+function rawDigest(value: string, length: number): string {
+  return createHash("sha256").update(value, "utf8").digest("hex").slice(0, length);
+}
+
+function normalizedDomain(value: string): string {
+  const domain = value.toLowerCase().replace(/\.$/u, "");
+  if (!/^(?:[a-z0-9](?:[a-z0-9-]{0,61}[a-z0-9])?\.)+[a-z]{2,63}$/u.test(domain)) {
+    throw new Error("The runtime base domain is invalid.");
+  }
+  return domain;
+}

package/templates/shopify-customer-account/apps/gateway/src/portal-service.test.ts

@@ -0,0 +1,18 @@
+import { describe, expect, it } from "vitest";
+import { forwardPortalRequest } from "./portal-service";
+
+describe("portal service binding", () => {
+  it("forwards the browser path without exposing platform headers", async () => {
+    const response = await forwardPortalRequest(new Request("https://account.example.test/account"), {
+      fetch: async (request) => {
+        const url = request instanceof Request ? request.url : request.toString();
+        return new Response(new URL(url).pathname, {
+          headers: { "cf-ray": "private", "content-type": "text/plain" },
+        });
+      },
+    });
+    expect(await response.text()).toBe("/account");
+    expect(response.headers.get("cf-ray")).toBeNull();
+    expect(response.headers.get("x-frame-options")).toBe("DENY");
+  });
+});

package/templates/shopify-customer-account/apps/gateway/src/portal-service.ts

@@ -0,0 +1,51 @@
+export type PortalService = Pick<Fetcher, "fetch">;
+
+const FORWARDED_HEADERS = [
+  "accept", "accept-language", "cache-control", "content-type", "cookie",
+  "if-match", "if-none-match", "origin", "pragma", "referer", "user-agent",
+] as const;
+
+export async function forwardPortalRequest(request: Request, portal: PortalService): Promise<Response> {
+  if (!portal || typeof portal.fetch !== "function") return gatewayError(503, "portal_ui_unavailable");
+  try {
+    const response = await portal.fetch(portalRequest(request));
+    const headers = new Headers(response.headers);
+    for (const name of [...headers.keys()]) {
+      const normalized = name.toLowerCase();
+      if (normalized.startsWith("cf-") || normalized.startsWith("cloudflare-") || normalized.startsWith("x-tender-")) {
+        headers.delete(name);
+      }
+    }
+    headers.set("Referrer-Policy", "strict-origin-when-cross-origin");
+    headers.set("X-Content-Type-Options", "nosniff");
+    headers.set("X-Frame-Options", "DENY");
+    return new Response(request.method === "HEAD" ? null : response.body, {
+      status: response.status,
+      statusText: response.statusText,
+      headers,
+    });
+  } catch {
+    return gatewayError(502, "portal_ui_failed");
+  }
+}
+
+function portalRequest(request: Request): Request {
+  const headers = new Headers();
+  for (const name of FORWARDED_HEADERS) {
+    const value = request.headers.get(name);
+    if (value !== null) headers.set(name, value);
+  }
+  return new Request(request.url, { method: request.method, headers, redirect: "manual" });
+}
+
+function gatewayError(status: number, code: string): Response {
+  return Response.json({ error: { code } }, {
+    status,
+    headers: {
+      "Cache-Control": "no-store",
+      "Content-Security-Policy": "default-src 'none'; frame-ancestors 'none'",
+      "Referrer-Policy": "no-referrer",
+      "X-Content-Type-Options": "nosniff",
+    },
+  });
+}

package/templates/shopify-customer-account/apps/gateway/src/runtime-config.test.ts

@@ -0,0 +1,30 @@
+import { describe, expect, it } from "vitest";
+import { readRuntimeConfig } from "./runtime-config";
+
+describe("runtime config", () => {
+  it("derives a stable canonical host from public runtime identity", () => {
+    const config = readRuntimeConfig({
+      ACCOUNT_TENANT_ID: "ten_example",
+      ACCOUNT_PROJECT_ID: "prj_example",
+      ACCOUNT_RUNTIME_BASE_DOMAIN: "tenderprompt.dev",
+      ACCOUNT_VANITY_HOSTNAMES: "account.example.com, members.example.com",
+      SHOPIFY_STOREFRONT_DOMAIN: "example.myshopify.com",
+      SHOPIFY_CUSTOMER_ACCOUNT_CLIENT_ID: "client_12345678",
+      SHOPIFY_CUSTOMER_ACCOUNT_DOMAIN: "shopify.com",
+    } as Env);
+    expect(config.canonicalHostname).toMatch(/^a-[a-f0-9]{14}--t-[a-f0-9]{14}\.tenderprompt\.dev$/u);
+    expect(config.vanityHostnames).toEqual(["account.example.com", "members.example.com"]);
+  });
+
+  it("rejects an invalid Shopify hostname", () => {
+    expect(() => readRuntimeConfig({
+      ACCOUNT_TENANT_ID: "ten_example",
+      ACCOUNT_PROJECT_ID: "prj_example",
+      ACCOUNT_RUNTIME_BASE_DOMAIN: "tenderprompt.dev",
+      ACCOUNT_VANITY_HOSTNAMES: "",
+      SHOPIFY_STOREFRONT_DOMAIN: "https://example.myshopify.com",
+      SHOPIFY_CUSTOMER_ACCOUNT_CLIENT_ID: "client_12345678",
+      SHOPIFY_CUSTOMER_ACCOUNT_DOMAIN: "shopify.com",
+    } as Env)).toThrow(/Shopify storefront domain/u);
+  });
+});

package/templates/shopify-customer-account/apps/gateway/src/runtime-config.ts

@@ -0,0 +1,56 @@
+import { canonicalApplicationHostname } from "./platform/runtime-hostname";
+
+const PUBLIC_CLIENT_ID = /^[A-Za-z0-9_-]{8,256}$/u;
+const RUNTIME_ID = /^[A-Za-z0-9][A-Za-z0-9_-]{1,127}$/u;
+const HOSTNAME = /^(?:[a-z0-9](?:[a-z0-9-]{0,61}[a-z0-9])?\.)+[a-z]{2,63}$/u;
+
+export interface RuntimeConfig {
+  tenantId: string;
+  projectId: string;
+  runtimeBaseDomain: string;
+  canonicalHostname: string;
+  storefrontDomain: string;
+  customerAccountClientId: string;
+  customerAccountDomain: string;
+  vanityHostnames: string[];
+}
+
+export function readRuntimeConfig(env: Env): RuntimeConfig {
+  const tenantId = requiredMatch(env.ACCOUNT_TENANT_ID, RUNTIME_ID, "tenant identity");
+  const projectId = requiredMatch(env.ACCOUNT_PROJECT_ID, RUNTIME_ID, "project identity");
+  const runtimeBaseDomain = requiredHostname(env.ACCOUNT_RUNTIME_BASE_DOMAIN, "runtime base domain");
+  return {
+    tenantId,
+    projectId,
+    runtimeBaseDomain,
+    canonicalHostname: canonicalApplicationHostname({ tenantId, projectId, baseDomain: runtimeBaseDomain }),
+    storefrontDomain: requiredHostname(env.SHOPIFY_STOREFRONT_DOMAIN, "Shopify storefront domain"),
+    customerAccountClientId: requiredMatch(
+      env.SHOPIFY_CUSTOMER_ACCOUNT_CLIENT_ID,
+      PUBLIC_CLIENT_ID,
+      "Shopify public customer-account client ID",
+    ),
+    customerAccountDomain: requiredHostname(env.SHOPIFY_CUSTOMER_ACCOUNT_DOMAIN, "Shopify customer-account domain"),
+    vanityHostnames: optionalHostnameList(env.ACCOUNT_VANITY_HOSTNAMES),
+  };
+}
+
+function optionalHostnameList(value: string | undefined): string[] {
+  if (value === undefined) return [];
+  if (value.trim() === "") return [];
+  const hostnames = [...new Set(value.split(",").map((hostname) => requiredHostname(hostname, "vanity hostname")))];
+  if (hostnames.length > 8) throw new Error("Too many vanity hostnames are configured.");
+  return hostnames;
+}
+
+function requiredHostname(value: string, label: string): string {
+  const hostname = value.trim().toLowerCase().replace(/\.$/u, "");
+  if (!HOSTNAME.test(hostname)) throw new Error(`The ${label} is invalid.`);
+  return hostname;
+}
+
+function requiredMatch(value: string, pattern: RegExp, label: string): string {
+  const normalized = value.trim();
+  if (!pattern.test(normalized)) throw new Error(`The ${label} is invalid.`);
+  return normalized;
+}

package/templates/shopify-customer-account/apps/gateway/src/worker.ts

@@ -0,0 +1,85 @@
+import { createTenderRuntimeHostnamePolicy } from "./platform/customer-auth/hostname-policy";
+import { PublicCustomerAuthSessionStore } from "./platform/customer-auth/session-store";
+import { createShopifyCustomerAccountRouteAdapter } from "./platform/customer-auth/shopify-route-adapter";
+import { forwardPortalRequest } from "./portal-service";
+import { readRuntimeConfig } from "./runtime-config";
+
+const LOOPBACK_HOSTNAMES = new Set(["localhost", "127.0.0.1", "[::1]"]);
+
+export default {
+  async fetch(request: Request, env: Env): Promise<Response> {
+    let config;
+    try {
+      config = readRuntimeConfig(env);
+    } catch {
+      return jsonResponse(503, "application_not_configured");
+    }
+
+    const url = new URL(request.url);
+    if (request.method === "GET" && url.pathname === "/api/health") {
+      return Response.json({ ok: true, service: "shopify-customer-account-gateway" });
+    }
+
+    const localDevelopment = (url.protocol === "http:" || url.protocol === "https:")
+      && LOOPBACK_HOSTNAMES.has(url.hostname.toLowerCase());
+    if (localDevelopment && request.method === "GET" && url.pathname === "/api/bootstrap") {
+      return Response.json({ canonicalHostname: config.canonicalHostname, loginUrl: null, localDevelopment: true });
+    }
+    if (localDevelopment && request.method === "GET" && url.pathname === "/api/session") {
+      return Response.json({ authenticated: false, localDevelopment: true });
+    }
+    if (localDevelopment && url.pathname.startsWith("/auth/")) {
+      return jsonResponse(409, "authentication_requires_https_preview");
+    }
+
+    const hostnamePolicy = createTenderRuntimeHostnamePolicy({
+      tenantId: config.tenantId,
+      projectId: config.projectId,
+      baseDomain: config.runtimeBaseDomain,
+      additionalHostnames: config.vanityHostnames,
+    });
+    const auth = createShopifyCustomerAccountRouteAdapter({
+      config: {
+        projectId: config.projectId,
+        canonicalHostname: config.canonicalHostname,
+        additionalCallbackHostnames: config.vanityHostnames,
+        storefrontDomain: config.storefrontDomain,
+        clientId: config.customerAccountClientId,
+        additionalProviderHostnames: [config.customerAccountDomain],
+      },
+      sessionStore: new PublicCustomerAuthSessionStore(env.APP_DB, hostnamePolicy),
+      hostnamePolicy,
+    });
+    const authResponse = await auth.handle(request);
+    if (authResponse) return authResponse;
+
+    if (request.method === "GET" && url.pathname === "/api/bootstrap") {
+      const hostname = url.hostname.toLowerCase().replace(/\.$/u, "");
+      if (!await hostnamePolicy({ projectId: config.projectId, hostname })) return jsonResponse(404, "not_found");
+      const loginHostname = config.vanityHostnames.includes(hostname)
+        ? hostname
+        : config.canonicalHostname;
+      const loginUrl = new URL(`https://${loginHostname}/auth/login`);
+      loginUrl.searchParams.set("return_host", hostname);
+      return Response.json({ canonicalHostname: config.canonicalHostname, loginUrl: loginUrl.toString() });
+    }
+
+    if (url.pathname.startsWith("/api/") || url.pathname.startsWith("/auth/")) return jsonResponse(404, "not_found");
+    if (request.method !== "GET" && request.method !== "HEAD") {
+      return new Response(null, { status: 405, headers: { Allow: "GET, HEAD" } });
+    }
+    return await forwardPortalRequest(request, env.PORTAL_UI);
+  },
+} satisfies ExportedHandler<Env>;
+
+function jsonResponse(status: number, code: string): Response {
+  return Response.json({ error: { code } }, {
+    status,
+    headers: {
+      "Cache-Control": "no-store",
+      "Content-Security-Policy": "default-src 'none'; frame-ancestors 'none'",
+      "Referrer-Policy": "no-referrer",
+      "X-Content-Type-Options": "nosniff",
+    },
+  });
+}

package/templates/shopify-customer-account/apps/gateway/tender-accounts.json

@@ -0,0 +1,10 @@
+{
+  "schema": "tender.accounts-cli/v1",
+  "commands": {
+    "dev": "npm run dev",
+    "check": "npm run check",
+    "package": "npm run pack:tender"
+  },
+  "artifactDirectory": ".tender/artifacts/current",
+  "returnPath": "/account"
+}

package/templates/shopify-customer-account/apps/gateway/tender-app.config.json

@@ -0,0 +1,40 @@
+{
+  "schema": "tender.account-source/v1",
+  "app": {
+    "slug": "shopify-customer-account",
+    "label": "__APP_NAME__ gateway",
+    "fixture": false
+  },
+  "runtime": {
+    "kind": "worker",
+    "compatibilityDate": "2026-08-25",
+    "mainModule": "worker.mjs"
+  },
+  "health": {
+    "path": "/api/health"
+  },
+  "resources": [
+    {
+      "type": "d1",
+      "name": "APP_DB"
+    }
+  ],
+  "services": [
+    {
+      "name": "PORTAL_UI",
+      "targetProject": "portal-ui"
+    }
+  ],
+  "publicVarNames": [
+    "ACCOUNT_PROJECT_ID",
+    "ACCOUNT_RUNTIME_BASE_DOMAIN",
+    "ACCOUNT_TENANT_ID",
+    "SHOPIFY_CUSTOMER_ACCOUNT_CLIENT_ID",
+    "SHOPIFY_CUSTOMER_ACCOUNT_DOMAIN",
+    "SHOPIFY_STOREFRONT_DOMAIN"
+  ],
+  "optionalPublicVarNames": [
+    "ACCOUNT_VANITY_HOSTNAMES"
+  ],
+  "databaseSchema": "./database-schema.json"
+}

package/templates/shopify-customer-account/apps/gateway/tsconfig.json

@@ -0,0 +1,13 @@
+{
+  "compilerOptions": {
+    "target": "ES2022",
+    "lib": ["ES2022", "WebWorker"],
+    "module": "ESNext",
+    "moduleResolution": "Bundler",
+    "strict": true,
+    "noEmit": true,
+    "skipLibCheck": true,
+    "types": ["@cloudflare/workers-types", "node", "vitest/globals"]
+  },
+  "include": ["src", "worker-configuration.d.ts", "vitest.config.ts"]
+}

package/templates/shopify-customer-account/apps/gateway/vitest.config.ts

@@ -0,0 +1,8 @@
+import { defineConfig } from "vitest/config";
+
+export default defineConfig({
+  test: {
+    environment: "node",
+    include: ["src/**/*.test.ts"],
+  },
+});

package/templates/shopify-customer-account/apps/gateway/worker-configuration.d.ts

@@ -0,0 +1,26 @@
+/* eslint-disable */
+// Generated by Wrangler by running `wrangler types --include-runtime=false` (hash: 23b400f970c42d12c11b32e966d43d91)
+interface __BaseEnv_Env {
+	APP_DB: D1Database;
+	ACCOUNT_TENANT_ID: string;
+	ACCOUNT_PROJECT_ID: string;
+	ACCOUNT_RUNTIME_BASE_DOMAIN: string;
+	ACCOUNT_VANITY_HOSTNAMES?: string;
+	SHOPIFY_STOREFRONT_DOMAIN: string;
+	SHOPIFY_CUSTOMER_ACCOUNT_CLIENT_ID: string;
+	SHOPIFY_CUSTOMER_ACCOUNT_DOMAIN: string;
+	PORTAL_UI: Fetcher /* __APP_SLUG__-portal */;
+}
+declare namespace Cloudflare {
+	interface GlobalProps {
+		mainModule: typeof import("./src/worker");
+	}
+	interface Env extends __BaseEnv_Env {}
+}
+interface Env extends __BaseEnv_Env {}
+type StringifyValues<EnvType extends Record<string, unknown>> = {
+	[Binding in keyof EnvType]: EnvType[Binding] extends string ? EnvType[Binding] : string;
+};
+declare namespace NodeJS {
+	interface ProcessEnv extends StringifyValues<Pick<Cloudflare.Env, "ACCOUNT_TENANT_ID" | "ACCOUNT_PROJECT_ID" | "ACCOUNT_RUNTIME_BASE_DOMAIN" | "ACCOUNT_VANITY_HOSTNAMES" | "SHOPIFY_STOREFRONT_DOMAIN" | "SHOPIFY_CUSTOMER_ACCOUNT_CLIENT_ID" | "SHOPIFY_CUSTOMER_ACCOUNT_DOMAIN">> {}
+}

package/templates/shopify-customer-account/apps/gateway/wrangler.jsonc

@@ -0,0 +1,42 @@
+{
+  "$schema": "../../node_modules/wrangler/config-schema.json",
+  "name": "__APP_SLUG__-gateway",
+  "main": "./src/worker.ts",
+  "workers_dev": false,
+  "preview_urls": false,
+  "compatibility_date": "2026-08-25",
+  "compatibility_flags": ["nodejs_compat"],
+  "dev": {
+    "ip": "127.0.0.1",
+    "port": 8787,
+    "local_protocol": "http"
+  },
+  "services": [
+    {
+      "binding": "PORTAL_UI",
+      "service": "__APP_SLUG__-portal"
+    }
+  ],
+  "d1_databases": [
+    {
+      "binding": "APP_DB",
+      "database_name": "__APP_SLUG__-sessions",
+      "database_id": "00000000-0000-0000-0000-000000000000",
+      "migrations_dir": "./migrations"
+    }
+  ],
+  "secrets": {
+    "required": [
+      "ACCOUNT_TENANT_ID",
+      "ACCOUNT_PROJECT_ID",
+      "ACCOUNT_RUNTIME_BASE_DOMAIN",
+      "SHOPIFY_STOREFRONT_DOMAIN",
+      "SHOPIFY_CUSTOMER_ACCOUNT_CLIENT_ID",
+      "SHOPIFY_CUSTOMER_ACCOUNT_DOMAIN"
+    ]
+  },
+  "observability": {
+    "enabled": true,
+    "head_sampling_rate": 1
+  }
+}

package/templates/shopify-customer-account/apps/portal/AGENTS.md

@@ -0,0 +1,9 @@
+# Portal UI boundary
+
+This React app is the normal merchant and marketing-team editing surface.
+
+- Keep it presentation-only. It may call same-origin gateway routes but must not receive Shopify customer tokens, D1 bindings, or provider secrets.
+- For UI-only work, never edit `../gateway`.
+- Use real gateway responses; do not add fake authenticated customer data to production code.
+- Keep keyboard navigation, focus states, reduced-motion behavior, and responsive layouts intact.
+- Run `npm run check` and a Tender dry-run preview after changes.

package/templates/shopify-customer-account/apps/portal/README.md

@@ -0,0 +1,5 @@
+# Portal UI
+
+React customer-account surface for __APP_NAME__. This app is independently deployable and intentionally has no confidential bindings or customer-token storage.
+
+The portal calls only same-origin gateway routes such as `/api/bootstrap` and `/api/session`. Most vibe-coded visual and content changes should stay in this directory.

package/templates/shopify-customer-account/apps/portal/index.html

@@ -0,0 +1,13 @@
+<!doctype html>
+<html lang="en">
+  <head>
+    <meta charset="UTF-8" />
+    <meta name="viewport" content="width=device-width, initial-scale=1.0" />
+    <meta name="theme-color" content="#18261f" />
+    <title>__APP_NAME__</title>
+  </head>
+  <body>
+    <div id="root"></div>
+    <script type="module" src="/src/main.tsx"></script>
+  </body>
+</html>

package/templates/shopify-customer-account/apps/portal/package.json

@@ -0,0 +1,33 @@
+{
+  "name": "__APP_SLUG__-portal",
+  "version": "0.1.0",
+  "private": true,
+  "type": "module",
+  "scripts": {
+    "build": "npm run build:client && npm run build:worker",
+    "build:client": "vite build",
+    "build:worker": "node ./scripts/build-worker.mjs",
+    "cf:types": "npm run build && wrangler types --include-runtime false",
+    "check": "npm run typecheck && npm run test && npm run build && npm run pack:check",
+    "dev": "wrangler dev",
+    "dev:ui": "vite",
+    "pack:tender": "node ./scripts/pack-tender-artifact.mjs",
+    "pack:check": "node ./scripts/pack-tender-artifact.mjs --source-revision ffffffffffffffffffffffffffffffffffffffff",
+    "test": "node --test ./scripts/*.test.mjs",
+    "typecheck": "tsc --noEmit"
+  },
+  "dependencies": {
+    "react": "^19.2.8",
+    "react-dom": "^19.2.8"
+  },
+  "devDependencies": {
+    "@cloudflare/workers-types": "^5.20260825.1",
+    "@types/node": "^26.2.0",
+    "@types/react": "^19.2.18",
+    "@types/react-dom": "^19.2.5",
+    "@vitejs/plugin-react": "^6.1.0",
+    "typescript": "^7.0.2",
+    "vite": "^8.2.2",
+    "wrangler": "^4.125.0"
+  }
+}

package/templates/shopify-customer-account/apps/portal/scripts/build-worker.mjs

@@ -0,0 +1,11 @@
+import { mkdir, writeFile } from "node:fs/promises";
+import { dirname, join, resolve } from "node:path";
+import { fileURLToPath } from "node:url";
+import { readPortalAssets, renderPortalWorker } from "./portal-worker.mjs";
+
+const appRoot = resolve(dirname(fileURLToPath(import.meta.url)), "..");
+const assets = await readPortalAssets(join(appRoot, "dist/client"));
+const output = join(appRoot, ".tender/build/worker.mjs");
+await mkdir(dirname(output), { recursive: true });
+await writeFile(output, renderPortalWorker(assets), "utf8");
+process.stdout.write(`Built portal Worker with ${assets.length} embedded assets.\n`);

package/templates/shopify-customer-account/apps/portal/scripts/pack-tender-artifact.mjs

@@ -0,0 +1,63 @@
+import { mkdir, readFile, rename, rm, writeFile } from "node:fs/promises";
+import { dirname, join, resolve } from "node:path";
+import { fileURLToPath } from "node:url";
+import { bundleDigest, sha256 } from "../../../scripts/artifact-contract.mjs";
+
+const appRoot = resolve(dirname(fileURLToPath(import.meta.url)), "..");
+const config = JSON.parse(await readFile(join(appRoot, "tender-app.config.json"), "utf8"));
+const packageJson = JSON.parse(await readFile(join(appRoot, "package.json"), "utf8"));
+const sourceRevision = (argumentValue("--source-revision") || process.env.TENDER_SOURCE_REVISION || "").trim().toLowerCase();
+if (!/^[a-f0-9]{40}$/u.test(sourceRevision)) throw new Error("A committed 40-character source revision is required.");
+if (config.schema !== "tender.account-source/v1" || config.app?.slug !== "portal-ui"
+    || config.runtime?.compatibilityDate !== "2026-08-25" || config.runtime?.mainModule !== "worker.mjs"
+    || JSON.stringify(config.resources) !== "[]" || JSON.stringify(config.services) !== "[]") {
+  throw new Error("The portal source contract is invalid.");
+}
+
+const workerBytes = await readFile(join(appRoot, ".tender/build/worker.mjs"));
+const module = {
+  path: "worker.mjs",
+  sha256: sha256(workerBytes),
+  bytes: workerBytes.byteLength,
+  contentType: "application/javascript+module",
+};
+const files = [];
+const digest = bundleDigest(module, files);
+const manifest = {
+  schema: "tender.account-artifact/v1",
+  app: { slug: "portal-ui", version: packageJson.version, label: config.app.label, fixture: false },
+  runtime: {
+    kind: "worker",
+    compatibilityDate: "2026-08-25",
+    mainModule: "worker.mjs",
+    assetPrefix: `/_tenant-artifacts/${digest}`,
+  },
+  module,
+  files,
+  health: { path: "/api/health" },
+  resources: [],
+  services: [],
+};
+const artifactsRoot = join(appRoot, ".tender/artifacts");
+const nextRoot = join(artifactsRoot, "next");
+const outputRoot = join(artifactsRoot, "current");
+await rm(nextRoot, { recursive: true, force: true });
+await mkdir(nextRoot, { recursive: true });
+await writeFile(join(nextRoot, "worker.mjs"), workerBytes);
+await writeFile(join(nextRoot, "tender-accounts-build.json"), `${JSON.stringify({
+  schema: "tender.external-app-build/v1",
+  sourceRevision,
+  bundleDigest: digest,
+  manifest,
+}, null, 2)}\n`, "utf8");
+await rm(outputRoot, { recursive: true, force: true });
+await rename(nextRoot, outputRoot);
+process.stdout.write(`${JSON.stringify({ status: "packed", bundleDigest: digest, outputRoot })}\n`);
+
+function argumentValue(name) {
+  const index = process.argv.indexOf(name);
+  if (index === -1) return null;
+  const value = process.argv[index + 1];
+  if (!value || value.startsWith("--")) throw new Error(`Missing value for ${name}.`);
+  return value;
+}