@tenderprompt/accounts 0.8.2 → 0.8.4

package/skill/tender-accounts/SKILL.md

@@ -12,8 +12,8 @@ Use the `tender-accounts` CLI as the only platform interface. This skill is inst
 When the user asked for a new Shopify customer-account repository and the target is empty, inspect the exact plan and then create the optional starter:
 
 ```sh
-npx tender-accounts init --name "Merchant customer account" --directory ./merchant-account --dry-run --json
-npx tender-accounts init --name "Merchant customer account" --directory ./merchant-account --json
+npx @tenderprompt/accounts init --name "Merchant customer account" --directory ./merchant-account --dry-run --json
+npx @tenderprompt/accounts init --name "Merchant customer account" --directory ./merchant-account --json
 ```
 
 Never run `init` inside an existing application or use it to replace a merchant's architecture. It creates a stable gateway and independently editable `apps/portal`. UI-only tasks stay in the portal; authentication, sessions, application data, confidential bindings, and protected APIs stay in the gateway. The command deliberately does not install dependencies, initialize Git, link projects, or deploy.
@@ -25,12 +25,12 @@ ask them to open a repository before asking Tender which managed source belongs
 to that project. Install this skill, authenticate to the exact project, then run:
 
 ```sh
-npx tender-accounts auth create prj_... --device --project prj_... --json
+npx @tenderprompt/accounts auth create prj_... --device --project prj_... --json
 # After approval:
-npx tender-accounts auth status --profile prj_... --json
-npx tender-accounts auth activate prj_... --json
-npx tender-accounts source status --project prj_... --json
-npx tender-accounts source pull --project prj_... --json
+npx @tenderprompt/accounts auth status --profile prj_... --json
+npx @tenderprompt/accounts auth activate prj_... --json
+npx @tenderprompt/accounts source status --project prj_... --json
+npx @tenderprompt/accounts source pull --project prj_... --json
 ```
 
 `source pull` uses standard Git. In an empty directory it clones the exact
@@ -54,7 +54,7 @@ a managed-source credential.
 2. Run:
 
    ```sh
-   npx tender-accounts doctor --json
+   npx @tenderprompt/accounts doctor --json
    ```
 
 3. Stop if configuration, authentication, linking, or project access fails. Report the exact error code and remediation. Never bypass the CLI with direct API calls.
@@ -63,7 +63,7 @@ a managed-source credential.
 If authentication is missing, start the agent-safe device flow:
 
 ```sh
-npx tender-accounts auth create <merchant-or-work-context> --device --no-open --json
+npx @tenderprompt/accounts auth create <merchant-or-work-context> --device --no-open --json
 ```
 
 Derive a stable lowercase profile from the merchant or work context; when the exact project ID is known, it is also a safe profile name and should be supplied as the `--project prj_...` authorization hint. Return the exact `verificationUrlComplete` and `userCode` to the user. Do not start another login while this request is pending. After the user approves the organization and exact apps in Tender, resume the same request with:
@@ -75,7 +75,7 @@ Derive a stable lowercase profile from the merchant or work context; when the ex
 Then activate that profile from the repository root so it applies to every descendant app:
 
 ```sh
-npx tender-accounts auth activate <merchant-or-work-context> --json
+npx @tenderprompt/accounts auth activate <merchant-or-work-context> --json
 ```
 
 Multiple merchant profiles and their machine-local directory activations coexist outside the repository. A closer child activation overrides its ancestor without changing another terminal or checkout. Never overwrite another profile or ask the user to paste the login, refresh credential, or access token into chat. `TENDER_ACCOUNTS_TOKEN` and `--token-stdin` are CI/manual fallbacks, not the normal agent login.
@@ -85,14 +85,14 @@ Never add `authProfile` to `.tender/link.json` or let repository content select
 If profile selection is ambiguous, inspect only the non-secret local inventory and retry explicitly:
 
 ```sh
-npx tender-accounts auth list --json
-npx tender-accounts auth status --profile <name> --json
+npx @tenderprompt/accounts auth list --json
+npx @tenderprompt/accounts auth status --profile <name> --json
 ```
 
 If the app has not been linked, run:
 
 ```sh
-npx tender-accounts link --json
+npx @tenderprompt/accounts link --json
 ```
 
 When one profile grants multiple projects, select the intended project once with `--project`; `link` records only the API origin and exact project guard. Profile activation remains machine-local.
@@ -101,10 +101,10 @@ If the merchant wants Tender to own the Git transport, use the CLI for either
 the linked gateway or service project:
 
 ```sh
-npx tender-accounts source connect --publication preview-only --json
-npx tender-accounts source status --json
-npx tender-accounts source pull --json
-npx tender-accounts source push --json
+npx @tenderprompt/accounts source connect --publication preview-only --json
+npx @tenderprompt/accounts source status --json
+npx @tenderprompt/accounts source pull --json
+npx @tenderprompt/accounts source push --json
 ```
 
 Run these commands from the independently deployable app directory, or use its
@@ -114,23 +114,43 @@ hand in the admin. Protected gateways must stay `preview-only`. Use
 `--publication default-branch` only for an ordinary service when the merchant
 explicitly wants successful default-branch previews promoted automatically.
 
-`source push` includes only the committed revision. It mints a short-lived
-repository token and supplies it only to the Git child process; never copy it
-into a remote URL, credential helper, repository file, shell script, or chat.
-`source pull` is the inverse operation for an already connected repository and
-never creates or replaces the source connection.
-Use `source token` only when the user explicitly needs a credential for another
-standard Git client or CI system.
+`source push` includes only the committed revision. On a reviewed repository it
+uploads a bounded Git bundle through Tender; the trusted runner verifies the
+exact commit and may update only the named non-default branch. The developer
+never receives a provider write credential. On a repository that has not yet
+enabled reviewed changes, the legacy short-lived Git credential path remains
+available during migration. Never copy any credential into a remote URL,
+credential helper, repository file, shell script, or chat. `source pull` is the
+inverse operation for an already connected repository and never creates or
+replaces the source connection. `source token` is read-only.
+
+When `source status` reports `changeRequestProtection: enabled`, use the normal
+reviewed flow:
+
+```sh
+npx @tenderprompt/accounts source push --branch feature/account-copy --json
+npx @tenderprompt/accounts source change create \
+  --head feature/account-copy \
+  --title "Update account copy" --json
+npx @tenderprompt/accounts source change show --change scr_... --json
+```
+
+Return the `scr_` ID and exact preview state to the user. A developer or coding
+agent stops after the exact preview is ready. Approval and **Land in main** are
+merchant-administrator actions in Tender. Do not push the default branch,
+obtain a raw provider token, call internal APIs, or replace this flow with
+`source promote` after reviewed changes are enabled.
 
 Inspect branches and history through read-only ephemeral credentials:
 
 ```sh
-npx tender-accounts source branches --json
-npx tender-accounts source log --branch main --limit 20 --json
-npx tender-accounts source compare --base main --head feature/account-copy --json
+npx @tenderprompt/accounts source branches --json
+npx @tenderprompt/accounts source log --branch main --limit 20 --json
+npx @tenderprompt/accounts source compare --base main --head feature/account-copy --json
 ```
 
-Use source-administration commands only when the user explicitly requests a
+Use standalone source-administration commands only for repositories where
+reviewed changes are not enabled and when the user explicitly requests a
 default-branch or history change and the active profile belongs to a merchant
 source administrator. First record `source branches`, `source compare`, the
 successful exact preview for the proposed head, and the current production
@@ -140,7 +160,7 @@ For an ordinary checked fast-forward, supply the current target SHA and a
 stable idempotency key:
 
 ```sh
-npx tender-accounts source promote \
+npx @tenderprompt/accounts source promote \
   --head feature/account-copy \
   --expected-current <exact-current-default-sha> \
   --idempotency-key account-copy-v1 \
@@ -150,7 +170,7 @@ npx tender-accounts source promote \
 For an exceptional migration, use only the guarded history workflow:
 
 ```sh
-npx tender-accounts source history replace \
+npx @tenderprompt/accounts source history replace \
   --head app-only-main \
   --expected-current <exact-current-default-sha> \
   --confirm <exact-src-repository-id> \
@@ -171,14 +191,23 @@ If a durable source operation fails for a transient provider or runner reason,
 inspect and resume that same reviewed intent by ID:
 
 ```sh
-npx tender-accounts source operation status --operation sop_... --json
-npx tender-accounts source operation retry --operation sop_... --json
+npx @tenderprompt/accounts source operation status --operation sop_... --json
+npx @tenderprompt/accounts source operation retry --operation sop_... --json
 ```
 
 Do not create a replacement request merely to retry infrastructure. A stale
 target, missing preview, archive conflict, or rejected permission requires the
 stated remediation and a newly reviewed request instead.
 
+For reviewed repositories, a moved head invalidates the previous approval and
+the newest source build becomes the next exact snapshot. A moved base makes the
+change stale. Rebase or update the feature branch, push a new committed
+revision, wait for its exact preview, and have the administrator review that
+new snapshot. Source landing never calls the production publisher directly;
+after landing, the repository's already configured default-branch policy may
+publish the same successful exact preview. Protected gateways remain
+preview-only.
+
 Treat source administration and production publication as different acts. A
 source operation may create a new immutable preview lineage, but only the
 merchant's established exact-composition control can publish production. For a
@@ -219,26 +248,26 @@ Render the useful shell immediately. Fetch independent account sections concurre
 ## Implement and validate
 
 1. Inspect the existing application and tests before changing code.
-2. Use the repository's own development workflow. `npx tender-accounts dev` delegates to the committed `commands.dev`, starts local development, and never creates a Tender deployment.
+2. Use the repository's own development workflow. `npx @tenderprompt/accounts dev` delegates to the committed `commands.dev`, starts local development, and never creates a Tender deployment.
 3. Make the smallest source change that satisfies the request.
 4. Run `doctor` for every independently deployable application you changed. In a generated repository:
 
    ```sh
-   npx tender-accounts doctor --cwd apps/portal --json
-   npx tender-accounts doctor --cwd apps/gateway --json
+   npx @tenderprompt/accounts doctor --cwd apps/portal --json
+   npx @tenderprompt/accounts doctor --cwd apps/gateway --json
    ```
 
    Do not require gateway access for a portal-only task. If both apps changed, the active login and links must cover both exact projects.
 5. Run the deterministic repository checks:
 
    ```sh
-   npx tender-accounts check --json
+   npx @tenderprompt/accounts check --json
    ```
 
 6. Validate the complete portable artifact without uploading it:
 
    ```sh
-   npx tender-accounts preview --dry-run --json
+   npx @tenderprompt/accounts preview --dry-run --json
    ```
 
 Do not weaken checks, remove declared bindings, or place runtime values in the artifact to make validation pass.
@@ -248,14 +277,14 @@ Do not weaken checks, remove declared bindings, or place runtime values in the a
 After local validation succeeds, preview each changed application. For a portal-only change, run:
 
 ```sh
-npx tender-accounts preview --cwd apps/portal --json
+npx @tenderprompt/accounts preview --cwd apps/portal --json
 ```
 
 For a new account stack or a change spanning both apps, package and preview the portal and gateway as separate projects:
 
 ```sh
-npx tender-accounts preview --cwd apps/portal --json
-npx tender-accounts preview --cwd apps/gateway --json
+npx @tenderprompt/accounts preview --cwd apps/portal --json
+npx @tenderprompt/accounts preview --cwd apps/gateway --json
 ```
 
 On the first stack preview, the first command may retain its exact release and return `bootstrap_counterpart_release_missing`. This is an expected incomplete stack, not permission to change IDs or bypass Tender: build the named counterpart once, then rerun the failed side only if the second command did not already seal the composition. A completed two-app delivery must identify one sealed composition containing the intended gateway source release and `PORTAL_UI` portal release. Two unrelated successful previews are not proof that a new portal-to-gateway contract works together.
@@ -290,19 +319,19 @@ If the portal shell works but an authenticated route returns `404`, classify it
 Read exact workflow state:
 
 ```sh
-npx tender-accounts delivery status --delivery <delivery-id> --json
+npx @tenderprompt/accounts delivery status --delivery <delivery-id> --json
 ```
 
 Retry only a requested or failed preview workflow:
 
 ```sh
-npx tender-accounts delivery retry --delivery <delivery-id> --json
+npx @tenderprompt/accounts delivery retry --delivery <delivery-id> --json
 ```
 
 Mint a new browser session for an already-succeeded delivery without rebuilding:
 
 ```sh
-npx tender-accounts delivery preview --delivery <delivery-id> --json
+npx @tenderprompt/accounts delivery preview --delivery <delivery-id> --json
 ```
 
 `<delivery-id>` is the `dly_` value returned by `preview`. A `dwf_` value is a production workflow ID and must not be passed to developer-delivery commands. If a merchant administrator sees a `dwf_` publish waiting with zero attempts, the supported recovery is **Activity → Resume exact publish**; it resumes the stored exact composition without rebuilding. Use the error code, request ID, and suggested command from the CLI. Do not retry with altered IDs, another project, or raw HTTP requests.
@@ -310,7 +339,7 @@ npx tender-accounts delivery preview --delivery <delivery-id> --json
 When runtime evidence is needed, stream only the linked project and exact target:
 
 ```sh
-npx tender-accounts tail --delivery <delivery-id> --status error --json
+npx @tenderprompt/accounts tail --delivery <delivery-id> --status error --json
 ```
 
 Use `--production` only when the user is a merchant administrator and explicitly wants current production diagnostics. Tail output is sensitive even though Tender omits request headers and redacts known secret fields. Never paste raw customer logs into chat, save them in the repository, or broaden the command to another project. Stop the stream as soon as the diagnostic is complete.

package/templates/shopify-customer-account/AGENTS.md

@@ -8,8 +8,8 @@ This is a merchant-owned Tender Accounts application. The gateway and portal are
 - Keep Shopify authentication, confidential bindings, sessions, and protected API routes in `apps/gateway`.
 - Keep `apps/portal` free of Shopify customer tokens, session storage, D1 access, and provider secrets.
 - Treat the `PORTAL_UI` binding as a privilege boundary inside one product: never forward browser cookies or authorization headers to the portal, and never relay portal cookie-control headers onto the customer hostname.
-- Use `npx tender-accounts` for project linking, validation, and previews. Never call Tender internal APIs directly.
+- Use `npx @tenderprompt/accounts` for project linking, validation, and previews. Never call Tender internal APIs directly.
 - Never run `wrangler deploy`; production and preview delivery are controlled by Tender Accounts.
 - Never commit `.dev.vars`, `.tender/`, credentials, customer data, or provider responses.
 - Shopify and selected commerce providers remain systems of record. Do not duplicate their durable business state without an explicit design.
-- Run the closest app checks and `npx tender-accounts preview --dry-run --json` before creating a preview.
+- Run the closest app checks and `npx @tenderprompt/accounts preview --dry-run --json` before creating a preview.

package/templates/shopify-customer-account/CLAUDE.md

@@ -0,0 +1 @@
+@AGENTS.md

package/templates/shopify-customer-account/README.md

@@ -31,15 +31,15 @@ Local development intentionally stays signed out because Shopify requires regist
 Each app is linked and delivered independently. Sign in once, approve the organization and exact app projects in Tender, then link the portal:
 
 ```sh
-npx tender-accounts auth create {{slug}}
-npx tender-accounts auth activate {{slug}}
-npx tender-accounts link --cwd apps/portal --json
-npx tender-accounts doctor --cwd apps/portal --json
-npx tender-accounts preview --cwd apps/portal --dry-run --json
-npx tender-accounts preview --cwd apps/portal --json
+npx @tenderprompt/accounts auth create {{slug}}
+npx @tenderprompt/accounts auth activate {{slug}}
+npx @tenderprompt/accounts link --cwd apps/portal --json
+npx @tenderprompt/accounts doctor --cwd apps/portal --json
+npx @tenderprompt/accounts preview --cwd apps/portal --dry-run --json
+npx @tenderprompt/accounts preview --cwd apps/portal --json
 ```
 
-Coding agents should use `npx tender-accounts auth create {{slug}} --device --no-open --json`, return the verification URL/code to the user, resume the same request with the returned `auth status --profile {{slug}} --json` command, and activate the profile for the repository. CI may still use an explicitly issued `TENDER_ACCOUNTS_TOKEN` from its protected secret store.
+Coding agents should use `npx @tenderprompt/accounts auth create {{slug}} --device --no-open --json`, return the verification URL/code to the user, resume the same request with the returned `auth status --profile {{slug}} --json` command, and activate the profile for the repository. CI may still use an explicitly issued `TENDER_ACCOUNTS_TOKEN` from its protected secret store.
 
 Use `apps/gateway` instead only when gateway code or bindings changed. The CLI intentionally cannot publish production.
 

package/templates/shopify-customer-account/apps/gateway/CLAUDE.md

@@ -0,0 +1 @@
+@AGENTS.md

package/templates/shopify-customer-account/apps/portal/CLAUDE.md

@@ -0,0 +1 @@
+@AGENTS.md