@tenderprompt/cli 0.1.33 → 0.1.34

package/dist/index.js

@@ -31,6 +31,7 @@ function readCliPackageVersion() {
     return UNKNOWN_CLI_VERSION;
 }
 const CLI_PACKAGE_VERSION = readCliPackageVersion();
+const GIT_COMMIT_SHA_PATTERN = /^[0-9a-f]{40}$/i;
 const ANALYTICS_AUTHORING_PLAYBOOK_ID = 'analytics-event-authoring';
 const ANALYTICS_AUTHORING_COMMAND = 'tender app analytics authoring --json';
 const ANALYTICS_AUTHORING_PLAYBOOK_COMMAND = `tender playbooks get ${ANALYTICS_AUTHORING_PLAYBOOK_ID} --json`;
@@ -89,7 +90,7 @@ const ANALYTICS_AGENT_GUIDANCE = {
         'clear split between shopper-facing UI and operator-facing analytics',
     ],
 };
-const DEFAULT_TENDER_APP_SCAFFOLD_TEMPLATE = 'shopify-pdp-survey-runtime';
+const DEFAULT_TENDER_APP_SCAFFOLD_TEMPLATE = 'server-backed';
 class TenderCliUsageError extends Error {
     constructor(message) {
         super(message);
@@ -134,12 +135,14 @@ class TenderCliConnectorsApiError extends Error {
     reasonCode;
     status;
     payload;
-    constructor(message, reasonCode, status, payload = null) {
+    example;
+    constructor(message, reasonCode, status, payload = null, example = 'tender connectors list --profile account --json') {
         super(message);
         this.name = 'TenderCliConnectorsApiError';
         this.reasonCode = reasonCode;
         this.status = status;
         this.payload = payload;
+        this.example = example;
     }
 }
 const DEFAULT_PROFILE_NAME = 'default';
@@ -177,6 +180,12 @@ Commands:
   tender connectors shopify verify
                              Exchange credentials for an Admin API access token
   tender connectors bind     Print an app.json binding for a connector instance
+  tender shopify workspace connectors list
+                             List current-store Shopify connectors from a hosted workspace
+  tender shopify workspace link-runtime --connector <connector-id>
+                             Link the hosted runtime to a Shopify connector
+  tender shopify workspace deploy-source
+                             Deploy linked Shopify source from a hosted workspace
   tender app list            List Tender App records visible to the current token
   tender app create --name <name>
                              Create a new Tender App in the current account
@@ -239,8 +248,8 @@ Commands:
 Examples:
   tender --version
   tender capabilities --json
-  tender auth login --device --profile edit-preview --artifact artifact_123 --ttl 7d
-  tender auth status --json
+  tender auth login --device --profile edit-preview --artifact artifact_123 --ttl 7d --save-profile agent --json
+  tender auth status --profile agent --json
   tender memory add --kind decision --summary "Kept auth in the host gateway" --json
   tender memory handoff --reason "Preview publish is blocked" --summary "Need Tender support" --json
   tender memory brief --json
@@ -254,15 +263,18 @@ Examples:
   printf "$SHOPIFY_APP_AUTOMATION_TOKEN" | tender connectors shopify app-automation-token set conn_123 --token-stdin --expires-at 2026-08-22 --profile account --json
   tender connectors shopify verify conn_123 --profile account --json
   tender connectors bind SHOPIFY_CONNECTOR conn_123 --instance default --json
+  tender shopify workspace connectors list --json
+  tender shopify workspace link-runtime --connector conn_123 --json
+  tender shopify workspace deploy-source --json
   tender app list --json
   tender app create --name "Exit Intent Widget" --json
-  tender app create --name "Product Page Survey Runtime" --init --dir ./product-survey-runtime --preview --json
-  tender app create --name "Backend Widget" --init --dir ./widget --scaffold server-backed --preview --json
+  tender app create --name "Data Collection App" --init --dir ./data-collection-app --preview --json
+  tender app create --name "Product Page Survey Runtime" --init --dir ./product-survey-runtime --scaffold shopify-pdp-survey-runtime --preview --json
   tender app update artifact_123 --name "Sale Widget" --json
   tender app share create artifact_123 --expires 7d --claims 1 --json
   tender app claim tok_share_123 --dir ./widget --confirm source-and-setup --json
-  tender app init artifact_123 --dir ./product-survey-runtime --preview --json
-  tender app init artifact_123 --dir ./widget --scaffold server-backed --preview --json
+  tender app init artifact_123 --dir ./data-collection-app --preview --json
+  tender app init artifact_123 --dir ./product-survey-runtime --scaffold shopify-pdp-survey-runtime --preview --json
   tender app validate artifact_123 --json
   tender app build artifact_123 --commit $(git rev-parse HEAD) --json
   tender app preview artifact_123 --commit $(git rev-parse HEAD) --stream --json
@@ -297,12 +309,13 @@ Commands:
 
 Examples:
   tender auth login --device --profile edit-preview --artifact artifact_123 --ttl 7d
-  tender auth login --device --profile publish --artifact artifact_123 --ttl 7d --save-profile publish
+  tender auth login --device --profile publish --artifact artifact_123 --ttl 7d --save-profile publish --json
+  tender auth status --profile publish --json
   tender auth login --device --profile create --shopify-store tender-prompt --json
   tender auth status --json`;
 }
 function authLoginHelp() {
-    return `Usage: tender auth login --device [--base-url <url>] [--shopify-store <store>] [--shopify-app-url <url>] [--profile <edit-preview|publish|create|db-read>] [--artifact <artifact-id>] [--ttl <7d|14d|30d>] [--save-profile <name>] [--no-poll] [--json]
+    return `Usage: tender auth login --device [--base-url <url>] [--shopify-store <store>] [--shopify-app-url <url>] [--profile <edit-preview|publish|create|db-read>] [--artifact <artifact-id>] [--ttl <7d|14d|30d>] [--save-profile <name>] [--no-poll|--poll] [--json]
 
 Options:
   --device                 Use the OAuth device-code flow.
@@ -313,12 +326,14 @@ Options:
   --artifact <artifact-id> Scope the token to one artifact. Required for normal edit-preview agent work.
   --ttl <value>            Token lifetime: 7d, 14d, or 30d. Defaults to 7d.
   --save-profile <name>    Local config profile name. Defaults to default, or shopify-<store> with Shopify approval.
-  --no-poll                Print the verification URL and exit without waiting for approval.
-  --json                   Emit stable JSON for coding agents.
+  --no-poll                Print the verification URL, store the pending device auth, and exit without waiting.
+  --poll                   With --json, wait for approval and save the profile after printing the pending handoff to stderr.
+  --json                   Emit stable JSON for coding agents. Defaults to --no-poll unless --poll is provided.
 
 Examples:
   tender auth login --device --profile edit-preview --artifact artifact_123 --ttl 7d
-  tender auth login --device --profile publish --artifact artifact_123 --ttl 7d --save-profile publish --json
+  tender auth login --device --profile publish --artifact artifact_123 --ttl 7d --save-profile publish --no-poll --json
+  tender auth status --profile publish --json
   tender auth login --device --profile create --ttl 7d --save-profile account
   tender auth login --device --profile create --shopify-store tender-prompt --json
   tender auth login --device --profile db-read --artifact artifact_123 --ttl 7d --save-profile db`;
@@ -463,7 +478,34 @@ Examples:
   tender connectors shopify source init conn_123 --dir ./shopify-app --client-id abc --profile account --json
   tender connectors shopify source validate conn_123 --dir ./shopify-app --execute --json
   tender connectors shopify source deploy conn_123 --dir ./shopify-app --confirm deploy --profile account --json
-  tender connectors bind SHOPIFY_CONNECTOR conn_123 --instance default --json`;
+	  tender connectors bind SHOPIFY_CONNECTOR conn_123 --instance default --json`;
+}
+function shopifyWorkspaceHelp() {
+    return `Usage: tender shopify workspace <command> [--json]
+
+Hosted Shopify workspace commands use the current terminal workspace identity.
+They do not read Tender profiles, account-scoped tokens, Shopify client secrets,
+or Shopify App Automation Tokens from the terminal.
+
+Commands:
+  tender shopify workspace connectors list
+                             List current-store Shopify connectors available to this runtime
+  tender shopify workspace link-runtime --connector <connector-id>
+                             Link this runtime to a Shopify connector source project
+  tender shopify workspace validate-source
+                             Validate the linked Shopify connector source
+  tender shopify workspace deploy-source
+                             Deploy the linked Shopify connector source
+
+Required environment:
+  TENDER_BASE_URL
+  TENDER_RUNTIME_ARTIFACT_ID
+
+Examples:
+  tender shopify workspace connectors list --json
+  tender shopify workspace link-runtime --connector conn_123 --json
+  tender shopify workspace validate-source --json
+  tender shopify workspace deploy-source --json`;
 }
 function connectorsShopifyCreateHelp() {
     return `Usage: tender connectors shopify create [--instance <id>] [--label <text>] [--app-name <text>] [--admin-api-version <version>] [--shop <myshopify-domain>] [--base-url <url>] [--token <token>] [--profile <name>] [--json]
@@ -564,10 +606,12 @@ SHOPIFY_APP_AUTOMATION_TOKEN is not set locally, the CLI requests the
 connector's stored App Automation Token and injects it only into the spawned
 Shopify CLI child process.
 
-For interactive agent work where Shopify CLI is already logged in, run the
-printed npx --yes @shopify/cli@latest app deploy command directly instead of
---confirm deploy. That uses the local Shopify CLI session and bypasses Tender
-deploy-token handoff.
+Inside hosted Shopify project workspaces, direct shopify app deploy is allowed
+when Shopify CLI is already authenticated there. Otherwise use
+tender shopify workspace deploy-source so Tender can use the connector's
+stored App Automation Token server-side. Do not run this account-scoped command
+with a hosted workspace artifact token. Never ask the merchant to paste token
+material into the terminal.
 
 Examples:
   tender connectors shopify source deploy conn_123 --dir ./shopify-app --version connector-source-smoke --confirm deploy --profile account --json`;
@@ -687,14 +731,14 @@ Commands:
 Examples:
   tender app list --json
   tender app create --name "Exit Intent Widget" --json
-  tender app create --name "Product Page Survey Runtime" --init --dir ./product-survey-runtime --preview --json
-  tender app create --name "Backend Widget" --init --dir ./widget --scaffold server-backed --preview --json
+  tender app create --name "Data Collection App" --init --dir ./data-collection-app --preview --json
+  tender app create --name "Product Page Survey Runtime" --init --dir ./product-survey-runtime --scaffold shopify-pdp-survey-runtime --preview --json
   tender app update artifact_123 --name "Sale Widget" --json
   tender app share create artifact_123 --expires 7d --claims 1 --json
   tender app share inspect tok_share_123 --json
   tender app claim tok_share_123 --dir ./widget --confirm source-and-setup --json
-  tender app init artifact_123 --dir ./product-survey-runtime --preview --json
-  tender app init artifact_123 --dir ./widget --scaffold server-backed --preview --json
+  tender app init artifact_123 --dir ./data-collection-app --preview --json
+  tender app init artifact_123 --dir ./product-survey-runtime --scaffold shopify-pdp-survey-runtime --preview --json
   tender app validate artifact_123 --json
   tender app build artifact_123 --commit $(git rev-parse HEAD) --json
   tender app preview artifact_123 --commit $(git rev-parse HEAD) --stream --json
@@ -1124,7 +1168,7 @@ Options:
   --name <name>                  App name.
   --init                         Initialize a local checkout after creating the app.
   --dir <path>                   Local checkout directory for --init. Defaults to current directory.
-  --scaffold <value>             API-derived scaffold for empty app source: server-backed, shopify-pdp-survey-runtime, or none. Defaults to shopify-pdp-survey-runtime.
+  --scaffold <value>             API-derived scaffold for empty app source: server-backed, shopify-pdp-survey-runtime, or none. Defaults to server-backed.
   --no-scaffold                  Alias for --scaffold none.
   --preview                      After --init writes and pushes initial source, request a preview build.
   --remote <name>                Git remote name for --init. Defaults to tender.
@@ -1139,8 +1183,8 @@ Options:
 
 Examples:
   tender app create --name "Exit Intent Widget" --json
-  tender app create --name "Product Page Survey Runtime" --init --dir ./product-survey-runtime --preview --json
-  tender app create --name "Backend Widget" --init --dir ./widget --scaffold server-backed --preview --json
+  tender app create --name "Data Collection App" --init --dir ./data-collection-app --preview --json
+  tender app create --name "Product Page Survey Runtime" --init --dir ./product-survey-runtime --scaffold shopify-pdp-survey-runtime --preview --json
   tender app create --name "Exit Intent Widget" --profile account --json`;
 }
 function artifactsUpdateHelp() {
@@ -1162,7 +1206,7 @@ function artifactsInitHelp() {
 Options:
   --dir <path>      Local checkout directory to create/update. Defaults to current directory.
   --remote <name>   Git remote name to add or update. Defaults to tender.
-  --scaffold <value> API-derived scaffold for empty app source: server-backed, shopify-pdp-survey-runtime, or none. Defaults to shopify-pdp-survey-runtime.
+  --scaffold <value> API-derived scaffold for empty app source: server-backed, shopify-pdp-survey-runtime, or none. Defaults to server-backed.
   --no-scaffold     Alias for --scaffold none.
   --preview         Request a preview build for the initialized source commit.
   --base-url <url>  Tender base URL. Defaults to TENDER_BASE_URL, saved profile base URL, or https://app.tenderprompt.com.
@@ -1175,8 +1219,8 @@ Options:
 
 Examples:
   tender app init artifact_123 --dir ./widget --dry-run --json
-  tender app init artifact_123 --dir ./product-survey-runtime --preview --json
-  tender app init artifact_123 --dir ./widget --scaffold server-backed --json
+  tender app init artifact_123 --dir ./data-collection-app --preview --json
+  tender app init artifact_123 --dir ./product-survey-runtime --scaffold shopify-pdp-survey-runtime --json
   tender app init artifact_123 --dir ./widget --force --json`;
 }
 function artifactsContextFetchHelp() {
@@ -1319,10 +1363,10 @@ Examples:
   tender app git credential artifact_123 get --remote-url https://app.tenderprompt.com/git/artifacts/artifact_123.git`;
 }
 function previewRebuildHelp() {
-    return `Usage: tender app preview rebuild <app-id> [--commit <sha>] [--base-url <url>] [--token <token>] [--profile <name>] [--stream] [--json]
+    return `Usage: tender app preview rebuild <app-id> [--commit <sha-or-ref>] [--base-url <url>] [--token <token>] [--profile <name>] [--stream] [--json]
 
 Options:
-  --commit <sha>   Rebuild preview only if the app workspace is at this Git commit.
+  --commit <sha-or-ref>  Rebuild preview only if the app workspace is at this Git commit. Git refs like HEAD are resolved locally.
   --base-url <url>  Tender base URL. Defaults to TENDER_BASE_URL, saved profile base URL, or https://app.tenderprompt.com.
   --token <token>   Tender API token. Precedence: --token, explicit --profile, TENDER_API_TOKEN, saved default profile.
   --profile <name>  Local config profile name. Defaults to the saved default profile.
@@ -1348,10 +1392,10 @@ Examples:
   tender app validate artifact_123 --stream --json`;
 }
 function buildHelp() {
-    return `Usage: tender app build <app-id> [--commit <sha>] [--base-url <url>] [--token <token>] [--profile <name>] [--stream] [--json]
+    return `Usage: tender app build <app-id> [--commit <sha-or-ref>] [--base-url <url>] [--token <token>] [--profile <name>] [--stream] [--json]
 
 Options:
-  --commit <sha>   Build only if the app workspace is at this Git commit.
+  --commit <sha-or-ref>  Build only if the app workspace is at this Git commit. Git refs like HEAD are resolved locally.
   --base-url <url>  Tender base URL. Defaults to TENDER_BASE_URL, saved profile base URL, or https://app.tenderprompt.com.
   --token <token>   Tender API token. Precedence: --token, explicit --profile, TENDER_API_TOKEN, saved default profile.
   --profile <name>  Local config profile name. Defaults to the saved default profile.
@@ -1363,10 +1407,10 @@ Examples:
   tender app build artifact_123 --stream --json`;
 }
 function previewStatusHelp() {
-    return `Usage: tender app preview status <app-id> [--commit <sha> | --job <job-id>] [--base-url <url>] [--token <token>] [--profile <name>] [--json]
+    return `Usage: tender app preview status <app-id> [--commit <sha-or-ref> | --job <job-id>] [--base-url <url>] [--token <token>] [--profile <name>] [--json]
 
 Options:
-  --commit <sha>    Show the latest preview job for one artifact Git commit.
+  --commit <sha-or-ref>  Show the latest preview job for one artifact Git commit. Git refs like HEAD are resolved locally.
   --job <job-id>    Show one lifecycle job directly.
   --base-url <url>  Tender base URL. Defaults to TENDER_BASE_URL, saved profile base URL, or https://app.tenderprompt.com.
   --token <token>   Tender API token. Precedence: --token, explicit --profile, TENDER_API_TOKEN, saved default profile.
@@ -1378,10 +1422,10 @@ Examples:
   tender app preview status artifact_123 --job job_123 --json`;
 }
 function previewWatchHelp() {
-    return `Usage: tender app preview watch <app-id> [--commit <sha> | --job <job-id>] [--base-url <url>] [--token <token>] [--profile <name>] [--stream] [--json]
+    return `Usage: tender app preview watch <app-id> [--commit <sha-or-ref> | --job <job-id>] [--base-url <url>] [--token <token>] [--profile <name>] [--stream] [--json]
 
 Options:
-  --commit <sha>    Watch the latest preview job for one artifact Git commit.
+  --commit <sha-or-ref>  Watch the latest preview job for one artifact Git commit. Git refs like HEAD are resolved locally.
   --job <job-id>    Watch one lifecycle job directly.
   --base-url <url>  Tender base URL. Defaults to TENDER_BASE_URL, saved profile base URL, or https://app.tenderprompt.com.
   --token <token>   Tender API token. Precedence: --token, explicit --profile, TENDER_API_TOKEN, saved default profile.
@@ -1394,12 +1438,12 @@ Examples:
   tender app preview watch artifact_123 --job job_123 --stream --json`;
 }
 function publishHelp() {
-    return `Usage: tender app publish <app-id> (--dry-run | --confirm publish) [--commit <sha>] [--message <text>] [--base-url <url>] [--token <token>] [--profile <name>] [--stream] [--json]
+    return `Usage: tender app publish <app-id> (--dry-run | --confirm publish) [--commit <sha-or-ref>] [--message <text>] [--base-url <url>] [--token <token>] [--profile <name>] [--stream] [--json]
 
 Options:
   --dry-run          Show the publish request without calling the API.
   --confirm publish  Required to call the production-facing publish API.
-  --commit <sha>     Publish only if the app workspace is at this Git commit.
+  --commit <sha-or-ref>  Publish only if the app workspace is at this Git commit. Git refs like HEAD are resolved locally.
   --message <text>   Human audit message returned in CLI output.
   --base-url <url>   Tender base URL. Defaults to TENDER_BASE_URL, saved profile base URL, or https://app.tenderprompt.com.
   --token <token>    Tender API token. Precedence: --token, explicit --profile, TENDER_API_TOKEN, saved default profile.
@@ -1592,6 +1636,7 @@ function tenderCliCapabilities() {
                 'tender app outbound-auth --help',
                 'tender connectors --help',
                 'tender connectors shopify source init --help',
+                'tender shopify workspace --help',
             ],
         },
         workflows: [
@@ -1600,7 +1645,8 @@ function tenderCliCapabilities() {
                 when: 'Before reading or changing remote Tender App records.',
                 commands: [
                     'tender auth status --json',
-                    'tender auth login --device --profile edit-preview --artifact <artifact-id> --ttl 7d --json',
+                    'tender auth login --device --profile edit-preview --artifact <artifact-id> --ttl 7d --save-profile agent --json',
+                    'tender auth status --profile agent --json',
                 ],
             },
             {
@@ -1635,16 +1681,46 @@ function tenderCliCapabilities() {
                     'Fetch shopify-connector-customer-metadata-widget when the requested job involves customer metafields, metaobjects, or profile writes.',
                 ],
             },
+            {
+                name: 'hosted_shopify_project_release',
+                when: 'Inside a hosted Shopify project workspace after editing a runtime app and linked Shopify connector source, or when the merchant asks to deploy/release/publish the Shopify connector.',
+                commands: [
+                    'tender shopify workspace connectors list --json',
+                    'tender shopify workspace link-runtime --connector <connector-id> --json',
+                    'cd /workspace/runtime-project && git push origin HEAD:main',
+                    'cd /workspace/runtime-project && commit=$(git rev-parse HEAD) && tender app publish "$TENDER_RUNTIME_ARTIFACT_ID" --commit "$commit" --confirm publish --stream --json',
+                    'cd /workspace/shopify-connector && git push origin HEAD:main',
+                    'cd /workspace/shopify-connector && tender shopify workspace validate-source --json',
+                    'cd /workspace/shopify-connector && tender shopify workspace deploy-source --json',
+                ],
+                notes: [
+                    'If /workspace/shopify-connector is missing, list connectors, link the selected connector, then continue in /workspace/shopify-connector unless link-runtime explicitly returns reloadRequired:true.',
+                    'For connector selection or switching, use tender shopify workspace connectors list --json and tender shopify workspace link-runtime --connector <connector-id> --json; do not use tender connectors list or ask for a Shopify Client ID.',
+                    'When selecting by merchant-provided Shopify app name, prefer an exact normalized label/appName match before any partial match; do not choose a longer connector name that merely contains the requested name.',
+                    'After link-runtime succeeds, tender shopify workspace validate-source and deploy-source automatically use that selected connector.',
+                    'For a deploy-only connector request, skip npm install, npm run check, tender app doctor, and other runtime-project checks; run cd /workspace/shopify-connector && tender shopify workspace deploy-source --json.',
+                    'For a validate-only connector request, run cd /workspace/shopify-connector && tender shopify workspace validate-source --json.',
+                    'Only run runtime-project checks when the merchant asks to change, validate, preview, or publish the runtime app.',
+                    'Publish the Tender runtime first and use the pinned runtime URL from publish JSON to update the linked connector source before deploying Shopify.',
+                    'Use TENDER_SHOPIFY_CONNECTOR_ID or connector.json for Tender connector commands; shopify.app.toml contains the Shopify client_id, not the Tender connector identity.',
+                    'Do not run tender connectors shopify source validate or tender connectors shopify source deploy from hosted workspaces; those commands require an account-scoped Tender CLI token.',
+                    'Use tender shopify workspace validate-source and deploy-source so the connector stored App Automation Token stays server-side.',
+                    'If Shopify CLI is already authenticated in the hosted workspace, direct shopify app config validate and shopify app deploy are allowed.',
+                    'Never ask for Shopify App Automation Tokens, client secrets, Tender tokens, or provider keys in the terminal.',
+                    'Do not release by pushing Git tags; Tender runtime publish plus tender shopify workspace deploy-source are the release path.',
+                    'If tender shopify workspace deploy-source reports a missing or expired App Automation Token, stop and ask the merchant to refresh the Custom App automation token in Tender.',
+                ],
+            },
             {
                 name: 'create_new_app_with_preview',
-                when: 'When the user wants a new Shopify-first Tender App that is immediately visible.',
+                when: 'When the user wants a new Tender App that is immediately visible.',
                 commands: [
-                    'tender app create --name "Product Page Survey Runtime" --init --dir ./product-survey-runtime --preview --json',
-                    'tender app create --name <name> --init --dir <dir> --scaffold server-backed --preview --json',
+                    'tender app create --name "Data Collection App" --init --dir ./data-collection-app --preview --json',
+                    'tender app create --name "Product Page Survey Runtime" --init --dir ./product-survey-runtime --scaffold shopify-pdp-survey-runtime --preview --json',
                 ],
                 notes: [
-                    'create --init defaults to the Shopify product page survey runtime scaffold when the new app has no source.',
-                    'Pass --scaffold server-backed only when the first app is a generic backend app instead of the Shopify survey starter.',
+                    'create --init defaults to the server-backed scaffold when the new app has no source.',
+                    'Pass --scaffold shopify-pdp-survey-runtime only for the Shopify product page survey starter.',
                     '--preview requests a preview build for the initial source commit after the push.',
                 ],
             },
@@ -1739,6 +1815,7 @@ function tenderCliCapabilities() {
                 when: 'When inspecting app-local database tables from a scoped token.',
                 commands: [
                     'tender auth login --device --profile db-read --artifact <artifact-id> --ttl 7d --save-profile db --json',
+                    'tender auth status --profile db --json',
                     'tender app db capabilities <artifact-id> --profile db --json',
                     'tender app db tables <artifact-id> --env published --profile db --json',
                     'tender app db schema <artifact-id> --env published --table <table-name> --profile db --json',
@@ -1807,7 +1884,7 @@ function tenderCliCapabilities() {
             },
             {
                 command: 'tender app create --name <name> --init --dir <dir> --preview --json',
-                purpose: 'Create a new Tender App, initialize the default Shopify product page survey runtime source in a local checkout, push it, and request a preview build.',
+                purpose: 'Create a new Tender App, initialize the default server-backed source in a local checkout, push it, and request a preview build.',
                 requiresAuth: true,
                 writes: true,
                 dryRun: false,
@@ -2058,6 +2135,45 @@ function normalizeStoredProfile(value) {
         ...normalizeStoredShopifyContext(record),
     };
 }
+function normalizeStoredPendingDeviceAuthorization(value) {
+    if (!value || typeof value !== 'object' || Array.isArray(value)) {
+        return null;
+    }
+    const record = value;
+    if (typeof record.baseUrl !== 'string' ||
+        typeof record.deviceCode !== 'string' ||
+        typeof record.userCode !== 'string' ||
+        typeof record.verificationUri !== 'string' ||
+        typeof record.verificationUriComplete !== 'string' ||
+        typeof record.expiresAt !== 'number' ||
+        typeof record.tokenProfile !== 'string' ||
+        typeof record.ttl !== 'string') {
+        return null;
+    }
+    let tokenProfile;
+    let ttl;
+    try {
+        tokenProfile = parseTokenProfile(record.tokenProfile);
+        ttl = parseTtl(record.ttl);
+    }
+    catch {
+        return null;
+    }
+    const artifactId = typeof record.artifactId === 'string' || record.artifactId === null ? record.artifactId : undefined;
+    return {
+        baseUrl: normalizeBaseUrl(record.baseUrl),
+        deviceCode: record.deviceCode,
+        userCode: record.userCode,
+        verificationUri: record.verificationUri,
+        verificationUriComplete: record.verificationUriComplete,
+        expiresAt: record.expiresAt,
+        interval: typeof record.interval === 'number' ? record.interval : undefined,
+        tokenProfile,
+        artifactId,
+        ttl,
+        ...normalizeStoredShopifyContext(record),
+    };
+}
 function normalizeStoredShopifyContext(record) {
     const shopifyAppUrl = typeof record.shopifyAppUrl === 'string' ? record.shopifyAppUrl : null;
     if (shopifyAppUrl) {
@@ -2101,9 +2217,21 @@ function normalizeConfig(value) {
             }
         }
     }
+    const pendingDeviceAuthorizations = {};
+    if (record.pendingDeviceAuthorizations &&
+        typeof record.pendingDeviceAuthorizations === 'object' &&
+        !Array.isArray(record.pendingDeviceAuthorizations)) {
+        for (const [name, pendingAuthorization] of Object.entries(record.pendingDeviceAuthorizations)) {
+            const normalized = normalizeStoredPendingDeviceAuthorization(pendingAuthorization);
+            if (normalized) {
+                pendingDeviceAuthorizations[name] = normalized;
+            }
+        }
+    }
     return {
         defaultProfile: typeof record.defaultProfile === 'string' && record.defaultProfile ? record.defaultProfile : undefined,
         profiles: Object.keys(profiles).length > 0 ? profiles : undefined,
+        pendingDeviceAuthorizations: Object.keys(pendingDeviceAuthorizations).length > 0 ? pendingDeviceAuthorizations : undefined,
     };
 }
 async function readConfig(env) {
@@ -2170,6 +2298,30 @@ async function resolveApiCredentials(input) {
         profileName,
     };
 }
+async function resolveLifecycleApiCredentials(input) {
+    const baseUrl = normalizeBaseUrl(input.baseUrl ?? input.env.TENDER_BASE_URL ?? DEFAULT_BASE_URL);
+    if (!input.flagToken &&
+        !input.profileName &&
+        isHostedWorkspaceInternalApiBaseUrl(baseUrl)) {
+        return {
+            baseUrl,
+            token: null,
+            source: 'hosted-workspace',
+            profileName: null,
+        };
+    }
+    return await resolveApiCredentials(input);
+}
+function apiHeadersForCredentials(input) {
+    const headers = {
+        accept: input.accept ?? 'application/json',
+        ...(input.jsonBody ? { 'content-type': 'application/json' } : {}),
+    };
+    if (input.credentials.token) {
+        headers.authorization = `Bearer ${input.credentials.token}`;
+    }
+    return headers;
+}
 function parseProfileName(value, flag) {
     if (!value || value.startsWith('-')) {
         throw new TenderCliUsageError(`${flag} requires a profile name.`);
@@ -2560,7 +2712,7 @@ function parseBuildArgs(args) {
         if (arg === '--commit') {
             const value = args[index + 1];
             if (!value || value.startsWith('-')) {
-                throw new TenderCliUsageError('--commit requires a Git commit SHA.');
+                throw new TenderCliUsageError('--commit requires a Git commit SHA or Git ref.');
             }
             commitSha = value;
             index += 1;
@@ -2621,7 +2773,7 @@ function parsePreviewRebuildArgs(args) {
         if (arg === '--commit') {
             const value = args[index + 1];
             if (!value || value.startsWith('-')) {
-                throw new TenderCliUsageError('--commit requires a Git commit SHA.');
+                throw new TenderCliUsageError('--commit requires a Git commit SHA or Git ref.');
             }
             commitSha = value;
             index += 1;
@@ -2676,7 +2828,7 @@ function readPreviewLookupOptions(input) {
         if (arg === '--commit') {
             const value = input.args[index + 1];
             if (!value || value.startsWith('-')) {
-                throw new TenderCliUsageError('--commit requires a commit SHA.');
+                throw new TenderCliUsageError('--commit requires a Git commit SHA or Git ref.');
             }
             commitSha = value;
             index += 1;
@@ -2825,7 +2977,7 @@ function parsePublishArgs(args) {
         if (arg === '--commit') {
             const value = args[index + 1];
             if (!value || value.startsWith('-')) {
-                throw new TenderCliUsageError('--commit requires a commit SHA.');
+                throw new TenderCliUsageError('--commit requires a Git commit SHA or Git ref.');
             }
             commitSha = value;
             index += 1;
@@ -3320,7 +3472,7 @@ function parseArtifactsCreateArgs(args) {
     }
     if (!init) {
         if (preview) {
-            throw new TenderCliUsageError('--preview requires --init. Example: tender app create --name "Product Page Survey Runtime" --init --dir ./product-survey-runtime --preview --json');
+            throw new TenderCliUsageError('--preview requires --init. Example: tender app create --name "Data Collection App" --init --dir ./data-collection-app --preview --json');
         }
         if (force) {
             throw new TenderCliUsageError('--force is only valid with --init.');
@@ -3867,6 +4019,58 @@ function parseConnectorsShopifySourceDeployArgs(args) {
     }
     return { command: 'connectors shopify source deploy', connectorId, dir, clientId, version, message, sourceControlUrl, allowDeletes, confirm, ...parsed };
 }
+function parseShopifyWorkspaceSourceArgs(args, command) {
+    if (args.includes('--help') || args.includes('-h')) {
+        return { command: 'help', topic: command };
+    }
+    let json = false;
+    for (const arg of args) {
+        if (arg === '--json') {
+            json = true;
+            continue;
+        }
+        throw new TenderCliUsageError(`Unknown ${command} option: ${arg}`);
+    }
+    return { command, json };
+}
+function parseShopifyWorkspaceConnectorsListArgs(args) {
+    if (args.includes('--help') || args.includes('-h')) {
+        return { command: 'help', topic: 'shopify workspace connectors list' };
+    }
+    let json = false;
+    for (const arg of args) {
+        if (arg === '--json') {
+            json = true;
+            continue;
+        }
+        throw new TenderCliUsageError(`Unknown shopify workspace connectors list option: ${arg}`);
+    }
+    return { command: 'shopify workspace connectors list', json };
+}
+function parseShopifyWorkspaceLinkRuntimeArgs(args) {
+    if (args.includes('--help') || args.includes('-h')) {
+        return { command: 'help', topic: 'shopify workspace link-runtime' };
+    }
+    let connectorId = null;
+    let json = false;
+    for (let index = 0; index < args.length; index += 1) {
+        const arg = args[index];
+        if (arg === '--json') {
+            json = true;
+            continue;
+        }
+        if (arg === '--connector') {
+            connectorId = parseConnectorId(parseRequiredFlagValue(args[index + 1], '--connector'), 'tender shopify workspace link-runtime --connector conn_123 --json');
+            index += 1;
+            continue;
+        }
+        throw new TenderCliUsageError(`Unknown shopify workspace link-runtime option: ${arg}`);
+    }
+    if (!connectorId) {
+        throw new TenderCliUsageError('--connector is required. Example: tender shopify workspace link-runtime --connector conn_123 --json');
+    }
+    return { command: 'shopify workspace link-runtime', connectorId, json };
+}
 function parseConnectorsShopifyDeleteArgs(args) {
     if (args.includes('--help') || args.includes('-h')) {
         return { command: 'help', topic: 'connectors shopify delete' };
@@ -4522,6 +4726,7 @@ function parseAuthLoginArgs(args) {
     let ttl = '7d';
     let json = false;
     let noPoll = false;
+    let poll = false;
     let pollTimeoutSeconds = 600;
     for (let index = 0; index < args.length; index += 1) {
         const arg = args[index];
@@ -4534,9 +4739,19 @@ function parseAuthLoginArgs(args) {
             continue;
         }
         if (arg === '--no-poll') {
+            if (poll) {
+                throw new TenderCliUsageError('--no-poll cannot be combined with --poll.');
+            }
             noPoll = true;
             continue;
         }
+        if (arg === '--poll') {
+            if (noPoll) {
+                throw new TenderCliUsageError('--poll cannot be combined with --no-poll.');
+            }
+            poll = true;
+            continue;
+        }
         if (arg === '--base-url') {
             baseUrl = parseBaseUrlFlag(args, index);
             index += 1;
@@ -4583,6 +4798,10 @@ function parseAuthLoginArgs(args) {
             continue;
         }
         if (arg === '--poll-timeout') {
+            if (noPoll) {
+                throw new TenderCliUsageError('--poll-timeout cannot be combined with --no-poll.');
+            }
+            poll = true;
             pollTimeoutSeconds = parsePositiveIntegerFlag(args[index + 1], '--poll-timeout');
             index += 1;
             continue;
@@ -4612,7 +4831,7 @@ function parseAuthLoginArgs(args) {
         artifactId,
         ttl,
         json,
-        noPoll,
+        noPoll: noPoll || (json && !poll),
         pollTimeoutSeconds,
     };
 }
@@ -6947,6 +7166,30 @@ function parseTenderArgs(args) {
         }
         throw new TenderCliUsageError(`Unknown connectors command: ${args[1]}`);
     }
+    if (args[0] === 'shopify') {
+        if (args[1] === undefined || args[1] === '--help' || args[1] === '-h') {
+            return { command: 'help', topic: 'shopify' };
+        }
+        if (args[1] === 'workspace') {
+            if (args[2] === undefined || args[2] === '--help' || args[2] === '-h') {
+                return { command: 'help', topic: 'shopify workspace' };
+            }
+            if (args[2] === 'connectors' && args[3] === 'list') {
+                return parseShopifyWorkspaceConnectorsListArgs(args.slice(4));
+            }
+            if (args[2] === 'link-runtime') {
+                return parseShopifyWorkspaceLinkRuntimeArgs(args.slice(3));
+            }
+            if (args[2] === 'validate-source') {
+                return parseShopifyWorkspaceSourceArgs(args.slice(3), 'shopify workspace validate-source');
+            }
+            if (args[2] === 'deploy-source') {
+                return parseShopifyWorkspaceSourceArgs(args.slice(3), 'shopify workspace deploy-source');
+            }
+            throw new TenderCliUsageError(`Unknown shopify workspace command: ${args[2]}`);
+        }
+        throw new TenderCliUsageError(`Unknown shopify command: ${args[1]}`);
+    }
     if (args[0] === 'apps') {
         throw new TenderCliUsageError('Unknown command: apps. Use `tender app ...` for Tender App workflows.');
     }
@@ -7657,7 +7900,7 @@ async function requestPlaybooksApi(input) {
             (typeof payload?.reasonCode === 'string' && payload.reasonCode) ||
             `Playbooks request failed with HTTP ${response.status}.`;
         const authHint = response.status === 401
-            ? '\nAuthenticate first: tender auth login --device --profile edit-preview --save-profile agent --ttl 7d --json'
+            ? '\nAuthenticate first: tender auth login --device --profile edit-preview --save-profile agent --ttl 7d --json, approve the URL, then run tender auth status --profile agent --json.'
             : '';
         throw new Error([message, `Reason: ${reasonCode}.`, 'Example: tender playbooks list --profile agent --json.'].join('\n') + authHint);
     }
@@ -7665,13 +7908,16 @@ async function requestPlaybooksApi(input) {
 }
 async function requestConnectorsApi(input) {
     const suffix = input.connectorsPath ? `/${input.connectorsPath.replace(/^\/+/, '')}` : '';
+    const headers = {
+        accept: 'application/json',
+        ...(input.body === undefined ? {} : { 'content-type': 'application/json' }),
+    };
+    if (input.token) {
+        headers.authorization = `Bearer ${input.token}`;
+    }
     const response = await input.fetcher(`${input.baseUrl}/api/account/connectors${suffix}`, {
         method: input.method,
-        headers: {
-            authorization: `Bearer ${input.token}`,
-            accept: 'application/json',
-            ...(input.body === undefined ? {} : { 'content-type': 'application/json' }),
-        },
+        headers,
         body: input.body === undefined ? undefined : JSON.stringify(input.body),
     });
     const payload = response.status === 204 ? { ok: true } : await parseJsonResponse(response);
@@ -7680,10 +7926,189 @@ async function requestConnectorsApi(input) {
         const message = (typeof payload?.message === 'string' && payload.message) ||
             (typeof payload?.reasonCode === 'string' && payload.reasonCode) ||
             `Connector request failed with HTTP ${response.status}.`;
-        throw new TenderCliConnectorsApiError([message, `Reason: ${reasonCode}.`, 'Example: tender connectors list --profile account --json.'].join('\n'), reasonCode, response.status, payload ?? null);
+        const example = input.hostedWorkspaceHint && reasonCode === 'account_scope_required'
+            ? 'Hosted workspace example: tender shopify workspace connectors list --json.'
+            : 'Example: tender connectors list --profile account --json.';
+        throw new TenderCliConnectorsApiError([message, `Reason: ${reasonCode}.`, example].join('\n'), reasonCode, response.status, payload ?? null, example.replace(/^Example:\s*/i, '').replace(/^Hosted workspace example:\s*/i, '').replace(/\.$/, ''));
     }
     return payload;
 }
+function normalizeHostedWorkspaceBaseUrl(value) {
+    const baseUrl = value?.trim().replace(/\/+$/, '') ?? '';
+    if (!baseUrl) {
+        return null;
+    }
+    try {
+        const url = new URL(baseUrl);
+        return url.protocol === 'https:' || url.protocol === 'http:' ? url.toString().replace(/\/+$/, '') : null;
+    }
+    catch {
+        return null;
+    }
+}
+function readHostedWorkspaceArtifactId(value) {
+    const artifactId = value?.trim() ?? '';
+    return /^artifact_[A-Za-z0-9_-]+$/.test(artifactId) ? artifactId : null;
+}
+function isHostedWorkspaceInternalApiBaseUrl(baseUrl) {
+    try {
+        return new URL(baseUrl).hostname === 'tender-api.tender.test';
+    }
+    catch {
+        return false;
+    }
+}
+function hostedWorkspaceApiHeaders(input) {
+    return {
+        accept: 'application/json',
+        ...(input.jsonBody ? { 'content-type': 'application/json' } : {}),
+    };
+}
+function readHostedWorkspaceConnectorId(value) {
+    const connectorId = value?.trim() ?? '';
+    return /^conn_[A-Za-z0-9_-]+$/.test(connectorId) ? connectorId : null;
+}
+function errorCodeMatches(error, code) {
+    return Boolean(error &&
+        typeof error === 'object' &&
+        'code' in error &&
+        error.code === code);
+}
+function hostedWorkspaceSelectionFilePath(runtime) {
+    const env = runtime.env ?? process.env;
+    const explicitPath = env.TENDER_WORKSPACE_STATE_FILE?.trim();
+    if (explicitPath) {
+        return path.resolve(explicitPath);
+    }
+    const runtimeProjectDir = env.TENDER_RUNTIME_PROJECT_DIR?.trim();
+    if (runtimeProjectDir && path.isAbsolute(runtimeProjectDir)) {
+        return path.join(path.dirname(runtimeProjectDir), '.tender', 'shopify-workspace.json');
+    }
+    const cwd = process.cwd();
+    if (cwd === '/workspace' || cwd.startsWith('/workspace/')) {
+        return '/workspace/.tender/shopify-workspace.json';
+    }
+    return null;
+}
+async function writeHostedWorkspaceConnectorSelection(input, runtime) {
+    const filePath = hostedWorkspaceSelectionFilePath(runtime);
+    if (!filePath) {
+        return;
+    }
+    await mkdir(path.dirname(filePath), { recursive: true, mode: 0o700 });
+    await writeFile(filePath, `${JSON.stringify({
+        version: 1,
+        runtimeArtifactId: input.runtimeArtifactId,
+        connectorId: input.connectorId,
+        selectedAt: Date.now(),
+    }, null, 2)}\n`, { encoding: 'utf8', mode: 0o600 });
+}
+async function readHostedWorkspaceConnectorSelection(runtimeArtifactId, runtime) {
+    const env = runtime.env ?? process.env;
+    const envConnectorId = readHostedWorkspaceConnectorId(env.TENDER_SHOPIFY_CONNECTOR_ID);
+    if (envConnectorId) {
+        return envConnectorId;
+    }
+    const filePath = hostedWorkspaceSelectionFilePath(runtime);
+    if (!filePath) {
+        return null;
+    }
+    let content;
+    try {
+        content = await readFile(filePath, 'utf8');
+    }
+    catch (error) {
+        if (errorCodeMatches(error, 'ENOENT')) {
+            return null;
+        }
+        throw error;
+    }
+    let parsed;
+    try {
+        parsed = JSON.parse(content);
+    }
+    catch {
+        return null;
+    }
+    if (!parsed || typeof parsed !== 'object' || Array.isArray(parsed)) {
+        return null;
+    }
+    const record = parsed;
+    if (record.runtimeArtifactId !== runtimeArtifactId) {
+        return null;
+    }
+    return readHostedWorkspaceConnectorId(typeof record.connectorId === 'string' ? record.connectorId : undefined);
+}
+function shopifyWorkspaceCommandApiPath(command) {
+    return command === 'shopify workspace deploy-source' ? 'deploy' : 'validate';
+}
+async function requestShopifyWorkspaceSourceCommand(input) {
+    const url = `${input.baseUrl}/api/account/connectors/${encodeURIComponent(input.connectorId)}/source/${shopifyWorkspaceCommandApiPath(input.command)}`;
+    const response = await input.fetcher(url, {
+        method: 'POST',
+        headers: hostedWorkspaceApiHeaders({
+            jsonBody: true,
+        }),
+        body: JSON.stringify({
+            sourceArtifactId: input.sourceArtifactId,
+            runtimeArtifactId: input.runtimeArtifactId,
+        }),
+    });
+    const payload = response.status === 204 ? { ok: true } : await parseJsonResponse(response);
+    if (payload) {
+        return { status: response.status, payload };
+    }
+    return {
+        status: response.status,
+        payload: {
+            ok: false,
+            reasonCode: `http_${response.status}`,
+            message: `Shopify workspace request failed with HTTP ${response.status}.`,
+        },
+    };
+}
+async function requestShopifyWorkspaceConnectorsList(input) {
+    const params = new URLSearchParams({ runtimeArtifactId: input.runtimeArtifactId });
+    const url = `${input.baseUrl}/api/account/connectors?${params.toString()}`;
+    const response = await input.fetcher(url, {
+        method: 'GET',
+        headers: hostedWorkspaceApiHeaders({}),
+    });
+    const payload = response.status === 204 ? { ok: true } : await parseJsonResponse(response);
+    if (payload) {
+        return { status: response.status, payload };
+    }
+    return {
+        status: response.status,
+        payload: {
+            ok: false,
+            reasonCode: `http_${response.status}`,
+            message: `Shopify workspace connectors request failed with HTTP ${response.status}.`,
+        },
+    };
+}
+async function requestShopifyWorkspaceLinkRuntime(input) {
+    const url = `${input.baseUrl}/api/account/connectors/${encodeURIComponent(input.connectorId)}/runtime-links`;
+    const response = await input.fetcher(url, {
+        method: 'POST',
+        headers: hostedWorkspaceApiHeaders({
+            jsonBody: true,
+        }),
+        body: JSON.stringify({ runtimeArtifactId: input.runtimeArtifactId }),
+    });
+    const payload = response.status === 204 ? { ok: true } : await parseJsonResponse(response);
+    if (payload) {
+        return { status: response.status, payload };
+    }
+    return {
+        status: response.status,
+        payload: {
+            ok: false,
+            reasonCode: `http_${response.status}`,
+            message: `Shopify workspace link request failed with HTTP ${response.status}.`,
+        },
+    };
+}
 function dbCorrectedExample(artifactId, dbPath) {
     if (dbPath === 'capabilities') {
         return `tender app db capabilities ${artifactId} --json`;
@@ -8290,10 +8715,208 @@ async function planSourceFiles(input) {
     }
     return planned.sort((left, right) => left.path.localeCompare(right.path));
 }
+function buildAuthStatusNextCommand(profileName) {
+    return `tender auth status --profile ${profileName} --json`;
+}
+function buildAuthLoginRetryCommand(profileName, pendingAuthorization) {
+    const parts = [
+        'tender auth login --device',
+        `--base-url ${pendingAuthorization.baseUrl}`,
+        `--profile ${pendingAuthorization.tokenProfile}`,
+    ];
+    if (pendingAuthorization.artifactId) {
+        parts.push(`--artifact ${pendingAuthorization.artifactId}`);
+    }
+    parts.push(`--ttl ${pendingAuthorization.ttl}`, `--save-profile ${profileName}`);
+    if (pendingAuthorization.shopifyAppUrl) {
+        parts.push(`--shopify-app-url ${pendingAuthorization.shopifyAppUrl}`);
+    }
+    parts.push('--json');
+    return parts.join(' ');
+}
+function pendingDeviceAuthorizationOutput(input) {
+    return {
+        ok: false,
+        command: input.command,
+        status: 'authorization_pending',
+        authenticated: false,
+        pending: true,
+        baseUrl: input.baseUrl,
+        profile: input.pendingAuthorization.tokenProfile,
+        saveProfile: input.profileName,
+        pendingProfile: input.profileName,
+        artifactId: input.pendingAuthorization.artifactId ?? null,
+        shopifyAppUrl: input.pendingAuthorization.shopifyAppUrl ?? null,
+        shopifyStore: input.pendingAuthorization.shopifyStore ?? null,
+        userCode: input.pendingAuthorization.userCode,
+        verificationUri: input.pendingAuthorization.verificationUri,
+        verificationUriComplete: input.pendingAuthorization.verificationUriComplete,
+        expiresAt: formatExpiry(input.pendingAuthorization.expiresAt),
+        interval: input.pendingAuthorization.interval ?? null,
+        configPath: input.configPath,
+        nextCommand: buildAuthStatusNextCommand(input.profileName),
+    };
+}
+function storedProfileFromOAuthToken(input) {
+    return {
+        baseUrl: input.baseUrl,
+        token: input.tokenPayload.access_token ?? '',
+        tokenPrefix: input.tokenPayload.token_prefix,
+        tenantId: input.tokenPayload.tenant_id,
+        artifactId: input.tokenPayload.artifact_id,
+        expiresAt: input.tokenPayload.expires_at,
+        permissions: splitScope(input.tokenPayload.scope),
+        ...(input.shopifyAppUrl ? { shopifyAppUrl: input.shopifyAppUrl } : {}),
+        ...(input.shopifyStore ? { shopifyStore: input.shopifyStore } : {}),
+    };
+}
+function authLoginSuccessOutput(input) {
+    return {
+        ok: true,
+        command: input.command,
+        baseUrl: input.baseUrl,
+        profile: input.tokenProfile,
+        savedProfile: input.saveProfile,
+        tokenPrefix: input.tokenPayload.token_prefix ?? null,
+        tenantId: input.tokenPayload.tenant_id ?? null,
+        artifactId: input.tokenPayload.artifact_id ?? null,
+        permissions: splitScope(input.tokenPayload.scope),
+        expiresAt: formatExpiry(input.tokenPayload.expires_at),
+        shopifyAppUrl: input.shopifyAppUrl,
+        shopifyStore: input.shopifyStore,
+        configPath: input.configPath,
+    };
+}
+function configWithoutPendingDeviceAuthorization(config, profileName) {
+    const pendingDeviceAuthorizations = { ...(config.pendingDeviceAuthorizations ?? {}) };
+    delete pendingDeviceAuthorizations[profileName];
+    return {
+        ...config,
+        pendingDeviceAuthorizations: Object.keys(pendingDeviceAuthorizations).length > 0 ? pendingDeviceAuthorizations : undefined,
+    };
+}
+async function completePendingDeviceAuthorization(input) {
+    const configPath = readConfigPath(input.env);
+    if (input.pendingAuthorization.expiresAt <= input.now()) {
+        const updatedConfig = configWithoutPendingDeviceAuthorization(input.config, input.profileName);
+        await writeConfig(input.env, updatedConfig);
+        const expiredResult = {
+            ok: false,
+            command: input.command,
+            status: 'authorization_expired',
+            authenticated: false,
+            pending: false,
+            profile: input.profileName,
+            configPath,
+            nextCommand: buildAuthLoginRetryCommand(input.profileName, input.pendingAuthorization),
+        };
+        if (input.json) {
+            input.io.stdout(JSON.stringify(expiredResult, null, 2));
+        }
+        else {
+            input.io.stdout([
+                'authenticated: false',
+                `profile: ${input.profileName}`,
+                'pending_device_auth: expired',
+                `next: ${expiredResult.nextCommand}`,
+            ].join('\n'));
+        }
+        return 1;
+    }
+    const tokenResponse = await input.fetcher(`${input.pendingAuthorization.baseUrl}/oauth/token`, {
+        method: 'POST',
+        headers: {
+            'content-type': 'application/json',
+        },
+        body: JSON.stringify({
+            grant_type: 'urn:ietf:params:oauth:grant-type:device_code',
+            device_code: input.pendingAuthorization.deviceCode,
+        }),
+    });
+    const tokenPayload = await parseJsonResponse(tokenResponse);
+    if (tokenResponse.ok && tokenPayload?.access_token) {
+        const profiles = input.config.profiles ?? {};
+        profiles[input.profileName] = storedProfileFromOAuthToken({
+            baseUrl: input.pendingAuthorization.baseUrl,
+            tokenPayload,
+            shopifyAppUrl: input.pendingAuthorization.shopifyAppUrl ?? null,
+            shopifyStore: input.pendingAuthorization.shopifyStore ?? null,
+        });
+        const updatedConfig = configWithoutPendingDeviceAuthorization({
+            ...input.config,
+            defaultProfile: input.config.defaultProfile ?? input.profileName,
+            profiles,
+        }, input.profileName);
+        await writeConfig(input.env, updatedConfig);
+        const result = authLoginSuccessOutput({
+            command: input.command,
+            baseUrl: input.pendingAuthorization.baseUrl,
+            tokenProfile: input.pendingAuthorization.tokenProfile,
+            saveProfile: input.profileName,
+            tokenPayload,
+            shopifyAppUrl: input.pendingAuthorization.shopifyAppUrl ?? null,
+            shopifyStore: input.pendingAuthorization.shopifyStore ?? null,
+            configPath,
+        });
+        if (input.json) {
+            input.io.stdout(JSON.stringify(result, null, 2));
+        }
+        else {
+            input.io.stdout([
+                'authenticated: true',
+                `profile: ${input.profileName}`,
+                `tenant_id: ${result.tenantId ?? '(unknown)'}`,
+                `app_id: ${result.artifactId ?? '(account)'}`,
+                `permissions: ${result.permissions.join(' ') || '(unknown)'}`,
+                `expires_at: ${result.expiresAt ?? '(unknown)'}`,
+            ].join('\n'));
+        }
+        return 0;
+    }
+    if (tokenPayload?.error === 'authorization_pending' || tokenPayload?.error === 'slow_down') {
+        const result = pendingDeviceAuthorizationOutput({
+            command: input.command,
+            baseUrl: input.pendingAuthorization.baseUrl,
+            profileName: input.profileName,
+            pendingAuthorization: input.pendingAuthorization,
+            configPath,
+        });
+        if (input.json) {
+            input.io.stdout(JSON.stringify(result, null, 2));
+        }
+        else {
+            input.io.stdout([
+                'authenticated: false',
+                `profile: ${input.profileName}`,
+                `verification_url: ${input.pendingAuthorization.verificationUriComplete}`,
+                `user_code: ${input.pendingAuthorization.userCode}`,
+                `next: ${result.nextCommand}`,
+            ].join('\n'));
+        }
+        return 1;
+    }
+    throw new Error(tokenPayload?.error_description ?? tokenPayload?.error ?? `Token exchange failed with HTTP ${tokenResponse.status}.`);
+}
 async function runAuthStatus(command, io, runtime) {
     const env = runtime.env ?? process.env;
+    const fetcher = runtime.fetcher ?? fetch;
+    const now = runtime.now ?? Date.now;
     if (command.profileName) {
         const config = await readConfig(env);
+        const pendingAuthorization = config.pendingDeviceAuthorizations?.[command.profileName] ?? null;
+        if (pendingAuthorization) {
+            return await completePendingDeviceAuthorization({
+                command: command.command,
+                profileName: command.profileName,
+                config,
+                pendingAuthorization,
+                env,
+                fetcher,
+                io,
+                json: command.json,
+                now,
+            });
+        }
         const profile = config.profiles?.[command.profileName] ?? null;
         const result = {
             ok: Boolean(profile),
@@ -8355,6 +8978,20 @@ async function runAuthStatus(command, io, runtime) {
     }
     const config = await readConfig(env);
     const profileName = command.profileName ?? config.defaultProfile ?? DEFAULT_PROFILE_NAME;
+    const pendingAuthorization = config.pendingDeviceAuthorizations?.[profileName] ?? null;
+    if (pendingAuthorization) {
+        return await completePendingDeviceAuthorization({
+            command: command.command,
+            profileName,
+            config,
+            pendingAuthorization,
+            env,
+            fetcher,
+            io,
+            json: command.json,
+            now,
+        });
+    }
     const profile = config.profiles?.[profileName] ?? null;
     const result = {
         ok: Boolean(profile),
@@ -8419,7 +9056,11 @@ async function runAuthLogin(command, io, runtime) {
         }),
     });
     const devicePayload = await parseJsonResponse(deviceResponse);
-    if (!deviceResponse.ok || !devicePayload?.device_code || !devicePayload.user_code || !devicePayload.verification_uri_complete) {
+    if (!deviceResponse.ok ||
+        !devicePayload?.device_code ||
+        !devicePayload.user_code ||
+        !devicePayload.verification_uri ||
+        !devicePayload.verification_uri_complete) {
         throw new Error(devicePayload?.error_description ?? devicePayload?.error ?? `Device authorization failed with HTTP ${deviceResponse.status}.`);
     }
     const verificationUriComplete = shopifyAppUrl
@@ -8429,19 +9070,51 @@ async function runAuthLogin(command, io, runtime) {
         })
         : devicePayload.verification_uri_complete;
     const verificationUri = shopifyAppUrl ? shopifyDeviceVerificationUri(shopifyAppUrl) : devicePayload.verification_uri;
+    const expiresAtMs = now() + Math.max(1, devicePayload.expires_in ?? 600) * 1000;
+    const pendingAuthorization = {
+        baseUrl,
+        deviceCode: devicePayload.device_code,
+        userCode: devicePayload.user_code,
+        verificationUri,
+        verificationUriComplete,
+        expiresAt: expiresAtMs,
+        interval: devicePayload.interval,
+        tokenProfile: command.tokenProfile,
+        artifactId: command.artifactId,
+        ttl: command.ttl,
+        ...(shopifyAppUrl ? { shopifyAppUrl } : {}),
+        ...(shopifyStore ? { shopifyStore } : {}),
+    };
+    const pendingDeviceAuthorizations = {
+        ...(config.pendingDeviceAuthorizations ?? {}),
+        [command.saveProfile]: pendingAuthorization,
+    };
+    const configWithPendingAuthorization = {
+        ...config,
+        pendingDeviceAuthorizations: pendingDeviceAuthorizations,
+    };
+    await writeConfig(env, configWithPendingAuthorization);
     const pendingResult = {
-        ok: true,
+        ok: false,
         command: command.command,
+        status: 'authorization_pending',
+        authenticated: false,
+        pending: true,
         baseUrl,
         shopifyAppUrl,
         shopifyStore,
         profile: command.tokenProfile,
         saveProfile: command.saveProfile,
+        pendingProfile: command.saveProfile,
+        artifactId: command.artifactId,
         userCode: devicePayload.user_code,
         verificationUri,
         verificationUriComplete,
         expiresIn: devicePayload.expires_in ?? null,
+        expiresAt: formatExpiry(expiresAtMs),
         interval: devicePayload.interval ?? null,
+        configPath: readConfigPath(env),
+        nextCommand: buildAuthStatusNextCommand(command.saveProfile),
     };
     if (command.noPoll) {
         if (command.json) {
@@ -8452,14 +9125,16 @@ async function runAuthLogin(command, io, runtime) {
         }
         return 0;
     }
-    if (!command.json) {
+    if (command.json) {
+        io.stderr(JSON.stringify(pendingResult, null, 2));
+    }
+    else {
         io.stdout([
             `Open this URL to approve Tender CLI access: ${verificationUriComplete}`,
             `User code: ${devicePayload.user_code}`,
         ].join('\n'));
     }
     let intervalSeconds = Math.max(1, devicePayload.interval ?? 5);
-    const expiresAtMs = now() + Math.max(1, devicePayload.expires_in ?? 600) * 1000;
     let attemptsRemaining = Math.max(1, Math.ceil(command.pollTimeoutSeconds / intervalSeconds));
     while (attemptsRemaining > 0 && now() < expiresAtMs) {
         attemptsRemaining -= 1;
@@ -8475,38 +9150,29 @@ async function runAuthLogin(command, io, runtime) {
         });
         const tokenPayload = await parseJsonResponse(tokenResponse);
         if (tokenResponse.ok && tokenPayload?.access_token) {
-            const profiles = config.profiles ?? {};
-            profiles[command.saveProfile] = {
+            const profiles = configWithPendingAuthorization.profiles ?? {};
+            profiles[command.saveProfile] = storedProfileFromOAuthToken({
                 baseUrl,
-                token: tokenPayload.access_token,
-                tokenPrefix: tokenPayload.token_prefix,
-                tenantId: tokenPayload.tenant_id,
-                artifactId: tokenPayload.artifact_id,
-                expiresAt: tokenPayload.expires_at,
-                permissions: splitScope(tokenPayload.scope),
-                ...(shopifyAppUrl ? { shopifyAppUrl } : {}),
-                ...(shopifyStore ? { shopifyStore } : {}),
-            };
-            await writeConfig(env, {
-                ...config,
-                defaultProfile: config.defaultProfile ?? command.saveProfile,
-                profiles,
+                tokenPayload,
+                shopifyAppUrl,
+                shopifyStore,
             });
-            const result = {
-                ok: true,
+            const updatedConfig = configWithoutPendingDeviceAuthorization({
+                ...configWithPendingAuthorization,
+                defaultProfile: configWithPendingAuthorization.defaultProfile ?? command.saveProfile,
+                profiles,
+            }, command.saveProfile);
+            await writeConfig(env, updatedConfig);
+            const result = authLoginSuccessOutput({
                 command: command.command,
                 baseUrl,
-                profile: command.tokenProfile,
-                savedProfile: command.saveProfile,
-                tokenPrefix: tokenPayload.token_prefix ?? null,
-                tenantId: tokenPayload.tenant_id ?? null,
-                artifactId: tokenPayload.artifact_id ?? null,
-                permissions: splitScope(tokenPayload.scope),
-                expiresAt: formatExpiry(tokenPayload.expires_at),
+                tokenProfile: command.tokenProfile,
+                saveProfile: command.saveProfile,
+                tokenPayload,
                 shopifyAppUrl,
                 shopifyStore,
                 configPath: readConfigPath(env),
-            };
+            });
             if (command.json) {
                 io.stdout(JSON.stringify(result, null, 2));
             }
@@ -9144,6 +9810,48 @@ async function runGitCommand(input) {
     }
     return result;
 }
+async function resolveGitCommitArgument(input) {
+    const value = input.value.trim();
+    if (GIT_COMMIT_SHA_PATTERN.test(value)) {
+        return value.toLowerCase();
+    }
+    if (!value || value.length > 256 || /[\0\r\n]/.test(value)) {
+        throw new TenderCliUsageError('--commit must be a 40-character commit SHA or a Git ref resolvable in this checkout.');
+    }
+    const result = await runGitCommand({
+        runtime: input.runtime,
+        cwd: input.cwd,
+        args: ['rev-parse', '--verify', `${value}^{commit}`],
+        allowFailure: true,
+    });
+    const commitSha = result.stdout.trim().split(/\s+/)[0] ?? '';
+    if (GIT_COMMIT_SHA_PATTERN.test(commitSha)) {
+        return commitSha.toLowerCase();
+    }
+    const detail = result.stderr.trim() || result.stdout.trim();
+    throw new TenderCliUsageError([
+        `--commit must be a 40-character commit SHA or a Git ref resolvable in this checkout: ${value}`,
+        detail,
+    ]
+        .filter(Boolean)
+        .join('\n'));
+}
+function readCommandCommitSha(command) {
+    const commitSha = 'commitSha' in command ? command.commitSha : null;
+    return typeof commitSha === 'string' && commitSha.trim() ? commitSha : null;
+}
+async function resolveCommandCommitSha(command, runtime) {
+    const requestedCommitSha = readCommandCommitSha(command);
+    if (!requestedCommitSha) {
+        return command;
+    }
+    const commitSha = await resolveGitCommitArgument({
+        runtime,
+        cwd: process.cwd(),
+        value: requestedCommitSha,
+    });
+    return commitSha === requestedCommitSha ? command : { ...command, commitSha };
+}
 function shellQuote(value) {
     return `'${value.replaceAll("'", "'\\''")}'`;
 }
@@ -10004,29 +10712,30 @@ async function runArtifactsInit(command, io, runtime) {
     return 0;
 }
 async function postLifecycle(input) {
-    const credentials = await resolveApiCredentials({
-        baseUrl: input.command.baseUrl,
-        flagToken: input.command.flagToken,
-        profileName: input.command.profileName,
+    const command = await resolveCommandCommitSha(input.command, input.runtime);
+    const credentials = await resolveLifecycleApiCredentials({
+        baseUrl: command.baseUrl,
+        flagToken: command.flagToken,
+        profileName: command.profileName,
         env: input.runtime.env ?? process.env,
     });
     const fetcher = input.runtime.fetcher ?? fetch;
-    const stream = input.command.stream;
+    const stream = command.stream;
     const url = `${credentials.baseUrl}${input.path}${stream ? '?stream=1' : ''}`;
     const requestBody = {};
-    if ('commitSha' in input.command && input.command.commitSha) {
-        requestBody.commitSha = input.command.commitSha;
+    if ('commitSha' in command && command.commitSha) {
+        requestBody.commitSha = command.commitSha;
     }
-    if ('message' in input.command && input.command.message) {
-        requestBody.message = input.command.message;
+    if ('message' in command && command.message) {
+        requestBody.message = command.message;
     }
     const response = await fetcher(url, {
         method: 'POST',
-        headers: {
-            authorization: `Bearer ${credentials.token}`,
+        headers: apiHeadersForCredentials({
+            credentials,
             accept: stream ? 'text/event-stream' : 'application/json',
-            ...(Object.keys(requestBody).length > 0 ? { 'content-type': 'application/json' } : {}),
-        },
+            jsonBody: Object.keys(requestBody).length > 0,
+        }),
         body: Object.keys(requestBody).length > 0 ? JSON.stringify(requestBody) : undefined,
     });
     if (stream) {
@@ -10036,19 +10745,19 @@ async function postLifecycle(input) {
         await emitSseLifecycleStream({
             response,
             io: input.io,
-            json: input.command.json,
+            json: command.json,
         });
         await appendAutomaticMemory({
             repoPath: process.cwd(),
-            artifactId: input.command.artifactId,
+            artifactId: command.artifactId,
             kind: input.operation === 'publish' ? 'change' : 'validation',
-            summary: `${input.command.command} streamed`,
+            summary: `${command.command} streamed`,
             body: `Operation: ${input.operation}\nStatus: streamed`,
             tags: [input.operation, 'stream'],
             status: 'resolved',
             related: {
-                commands: [input.command.command],
-                ...('commitSha' in input.command && input.command.commitSha ? { releaseId: input.command.commitSha } : {}),
+                commands: [command.command],
+                ...('commitSha' in command && command.commitSha ? { releaseId: command.commitSha } : {}),
             },
             runtime: input.runtime,
         });
@@ -10066,12 +10775,12 @@ async function postLifecycle(input) {
     }
     const result = {
         ok: true,
-        command: input.command.command,
+        command: command.command,
         baseUrl: credentials.baseUrl,
         authSource: credentials.source,
         profile: credentials.profileName,
-        artifactId: input.command.artifactId,
-        appId: input.command.artifactId,
+        artifactId: command.artifactId,
+        appId: command.artifactId,
         operation: payload.operation ?? input.operation,
         job: payload.job ?? null,
         result: payload.result ?? null,
@@ -10081,15 +10790,15 @@ async function postLifecycle(input) {
     const releaseGitRef = input.operation === 'publish' ? readReleaseGitRefFromResult(result.result) : null;
     const memory = await appendAutomaticMemory({
         repoPath,
-        artifactId: input.command.artifactId,
+        artifactId: command.artifactId,
         kind: input.operation === 'validate' ? 'validation' : input.operation === 'publish' ? 'change' : 'validation',
-        summary: `${input.command.command} completed`,
+        summary: `${command.command} completed`,
         body: `Operation: ${result.operation}\nStatus: completed`,
         tags: [input.operation],
         status: 'resolved',
         related: {
             files: changedFiles,
-            commands: [input.command.command],
+            commands: [command.command],
             ...(input.operation === 'preview' ? { previewUrl: readPreviewUrlFromJob(result.job) ?? undefined } : {}),
             ...(input.operation === 'publish' ? { publishedUrl: readObjectString(readObject(result.result), 'publishedUrl') ?? undefined } : {}),
             ...(releaseGitRef?.tagName ? { releaseId: releaseGitRef.tagName } : {}),
@@ -10104,12 +10813,12 @@ async function postLifecycle(input) {
         memory,
         ...(memorySync ? { memorySync } : {}),
     };
-    if (input.command.json) {
+    if (command.json) {
         input.io.stdout(JSON.stringify(resultWithMemory, null, 2));
     }
     else {
         input.io.stdout([
-            `app_id: ${input.command.artifactId}`,
+            `app_id: ${command.artifactId}`,
             `operation: ${result.operation}`,
             'status: completed',
             ...(input.operation === 'publish' ? formatPublishResultLines(result.result) : []),
@@ -10204,35 +10913,36 @@ async function requestPreviewStatus(input) {
     };
 }
 async function runPreviewStatus(command, io, runtime) {
+    const resolvedCommand = await resolveCommandCommitSha(command, runtime);
     const credentials = await resolveApiCredentials({
-        baseUrl: command.baseUrl,
-        flagToken: command.flagToken,
-        profileName: command.profileName,
+        baseUrl: resolvedCommand.baseUrl,
+        flagToken: resolvedCommand.flagToken,
+        profileName: resolvedCommand.profileName,
         env: runtime.env ?? process.env,
     });
     const { job, preview } = await requestPreviewStatus({
-        command,
+        command: resolvedCommand,
         credentials,
         fetcher: runtime.fetcher ?? fetch,
     });
     const result = {
         ok: true,
-        command: command.command,
+        command: resolvedCommand.command,
         baseUrl: credentials.baseUrl,
         authSource: credentials.source,
         profile: credentials.profileName,
-        artifactId: command.artifactId,
-        commitSha: preview.commitSha ?? command.commitSha,
+        artifactId: resolvedCommand.artifactId,
+        commitSha: preview.commitSha ?? resolvedCommand.commitSha,
         status: preview.status ?? job.status ?? null,
         previewUrl: preview.previewUrl ?? readPreviewUrlFromJob(job),
         job,
     };
-    if (command.json) {
+    if (resolvedCommand.json) {
         io.stdout(JSON.stringify(result, null, 2));
     }
     else {
         io.stdout([
-            `app_id: ${command.artifactId}`,
+            `app_id: ${resolvedCommand.artifactId}`,
             `job_id: ${job.jobId}`,
             `status: ${result.status ?? 'unknown'}`,
             ...(result.previewUrl ? [`preview_url: ${result.previewUrl}`] : []),
@@ -10241,19 +10951,20 @@ async function runPreviewStatus(command, io, runtime) {
     return 0;
 }
 async function runPreviewWatch(command, io, runtime) {
+    const resolvedCommand = await resolveCommandCommitSha(command, runtime);
     const credentials = await resolveApiCredentials({
-        baseUrl: command.baseUrl,
-        flagToken: command.flagToken,
-        profileName: command.profileName,
+        baseUrl: resolvedCommand.baseUrl,
+        flagToken: resolvedCommand.flagToken,
+        profileName: resolvedCommand.profileName,
         env: runtime.env ?? process.env,
     });
     const { job } = await requestPreviewStatus({
-        command,
+        command: resolvedCommand,
         credentials,
         fetcher: runtime.fetcher ?? fetch,
     });
-    const stream = command.stream;
-    const response = await (runtime.fetcher ?? fetch)(`${credentials.baseUrl}/api/v1/artifacts/${encodeURIComponent(command.artifactId)}/jobs/${encodeURIComponent(job.jobId)}/events${stream ? '?stream=1' : ''}`, {
+    const stream = resolvedCommand.stream;
+    const response = await (runtime.fetcher ?? fetch)(`${credentials.baseUrl}/api/v1/artifacts/${encodeURIComponent(resolvedCommand.artifactId)}/jobs/${encodeURIComponent(job.jobId)}/events${stream ? '?stream=1' : ''}`, {
         headers: {
             authorization: `Bearer ${credentials.token}`,
             accept: stream ? 'text/event-stream' : 'application/json',
@@ -10266,7 +10977,7 @@ async function runPreviewWatch(command, io, runtime) {
         await emitSseLifecycleStream({
             response,
             io,
-            json: command.json,
+            json: resolvedCommand.json,
         });
         return 0;
     }
@@ -10276,15 +10987,15 @@ async function runPreviewWatch(command, io, runtime) {
     }
     const result = {
         ok: true,
-        command: command.command,
+        command: resolvedCommand.command,
         baseUrl: credentials.baseUrl,
         authSource: credentials.source,
         profile: credentials.profileName,
-        artifactId: command.artifactId,
+        artifactId: resolvedCommand.artifactId,
         job: payload.job ?? job,
         events: payload.events ?? [],
     };
-    if (command.json) {
+    if (resolvedCommand.json) {
         io.stdout(JSON.stringify(result, null, 2));
     }
     else {
@@ -10293,38 +11004,39 @@ async function runPreviewWatch(command, io, runtime) {
     return 0;
 }
 async function runPublish(command, io, runtime) {
-    if (command.dryRun) {
+    const resolvedCommand = await resolveCommandCommitSha(command, runtime);
+    if (resolvedCommand.dryRun) {
         const result = {
             ok: true,
-            command: command.command,
-            artifactId: command.artifactId,
-            appId: command.artifactId,
-            commitSha: command.commitSha,
+            command: resolvedCommand.command,
+            artifactId: resolvedCommand.artifactId,
+            appId: resolvedCommand.artifactId,
+            commitSha: resolvedCommand.commitSha,
             dryRun: true,
             confirmed: false,
-            message: command.message,
+            message: resolvedCommand.message,
             wouldRequest: {
                 method: 'POST',
-                path: `/api/v1/artifacts/${command.artifactId}/publish`,
-                stream: command.stream,
+                path: `/api/v1/artifacts/${resolvedCommand.artifactId}/publish`,
+                stream: resolvedCommand.stream,
                 body: {
-                    ...(command.commitSha ? { commitSha: command.commitSha } : {}),
-                    ...(command.message ? { message: command.message } : {}),
+                    ...(resolvedCommand.commitSha ? { commitSha: resolvedCommand.commitSha } : {}),
+                    ...(resolvedCommand.message ? { message: resolvedCommand.message } : {}),
                 },
             },
         };
-        if (command.json) {
+        if (resolvedCommand.json) {
             io.stdout(JSON.stringify(result, null, 2));
         }
         else {
-            io.stdout([`app_id: ${command.artifactId}`, 'dry_run: true', 'next: rerun with --confirm publish to publish.'].join('\n'));
+            io.stdout([`app_id: ${resolvedCommand.artifactId}`, 'dry_run: true', 'next: rerun with --confirm publish to publish.'].join('\n'));
         }
         return 0;
     }
     return await postLifecycle({
-        command,
+        command: resolvedCommand,
         operation: 'publish',
-        path: `/api/v1/artifacts/${encodeURIComponent(command.artifactId)}/publish`,
+        path: `/api/v1/artifacts/${encodeURIComponent(resolvedCommand.artifactId)}/publish`,
         io,
         runtime,
     });
@@ -10994,7 +11706,7 @@ async function resolvePlaybooksCredentials(command, runtime) {
         if (error instanceof TenderCliUsageError) {
             throw new TenderCliUsageError([
                 'Playbooks require Tender authentication.',
-                'Run `tender auth login --device --profile edit-preview --save-profile agent --ttl 7d --json`, set TENDER_API_TOKEN, or pass --token <token>.',
+                'Run `tender auth login --device --profile edit-preview --save-profile agent --ttl 7d --json`, approve the URL, then run `tender auth status --profile agent --json`; or set TENDER_API_TOKEN or pass --token <token>.',
             ].join('\n'));
         }
         throw error;
@@ -11098,7 +11810,7 @@ async function resolveConnectorsCredentials(command, runtime) {
         if (error instanceof TenderCliUsageError) {
             throw new TenderCliUsageError([
                 'Connectors require Tender account authentication.',
-                'Run `tender auth login --device --profile create --ttl 7d --save-profile account --json`, set TENDER_API_TOKEN, or pass --token <token>.',
+                'Run `tender auth login --device --profile create --ttl 7d --save-profile account --json`, approve the URL, then run `tender auth status --profile account --json`; or set TENDER_API_TOKEN or pass --token <token>.',
             ].join('\n'));
         }
         throw error;
@@ -11123,6 +11835,7 @@ async function runConnectorsList(command, io, runtime) {
         baseUrl: credentials.baseUrl,
         token: credentials.token,
         fetcher: runtime.fetcher ?? fetch,
+        hostedWorkspaceHint: Boolean((runtime.env ?? process.env).TENDER_RUNTIME_ARTIFACT_ID),
     });
     const connectors = readConnectorArray(payload);
     printConnectorsPayload(command, io, payload, connectors.length > 0
@@ -11418,6 +12131,7 @@ merchant-editable settings.
         ['extensions/tender-product-survey/package.json', '{\n  "name": "tender-product-survey",\n  "private": true,\n  "version": "0.0.0"\n}\n'],
         ['extensions/tender-product-survey/shopify.extension.toml', extensionToml],
         ['extensions/tender-product-survey/blocks/product_survey.liquid', blockLiquid],
+        ['extensions/tender-product-survey/locales/en.default.json', '{}\n'],
     ]);
 }
 function buildShopifySourceFiles(input) {
@@ -11514,6 +12228,17 @@ npx --yes @shopify/cli@latest app config validate --path . --json
 \`\`\`sh
 tender connectors shopify source deploy ${input.connectorId} --dir . --confirm deploy --profile account --json
 \`\`\`
+
+Inside the hosted Shopify workspace, commit and push source changes, then
+validate or deploy from the embedded Shopify app's Deploy source action so
+Tender can use the connector's stored App Automation Token server-side. If
+Shopify CLI is already authenticated in the hosted workspace, direct
+\`shopify app config validate\` and \`shopify app deploy\` are allowed. Do not run
+\`tender connectors shopify source validate\` or
+\`tender connectors shopify source deploy\` from hosted workspaces; those
+commands require an account-scoped Tender CLI token. Never ask for Shopify App
+Automation Tokens, client secrets, Tender tokens, or provider keys in the
+terminal.
 `;
     const files = new Map([
         ['.gitignore', '.shopify/\nnode_modules/\n.env\n.env.*\n'],
@@ -12058,6 +12783,264 @@ async function runConnectorsShopifySourceDeploy(command, io, runtime) {
     printConnectorsPayload(command, io, { ok: true, command: command.command, connectorId: command.connectorId, sourceArtifactId, dir, exitCode: result.exitCode, stdout: result.stdout, stderr: result.stderr }, [`connector_id: ${command.connectorId}`, `source_artifact_id: ${sourceArtifactId}`, `source_dir: ${dir}`, 'deploy: completed']);
     return 0;
 }
+function shopifyWorkspaceResultKey(command) {
+    return command === 'shopify workspace deploy-source' ? 'deployment' : 'validation';
+}
+function shopifyWorkspaceCommandSucceeded(command, payload) {
+    if (payload.ok !== true) {
+        return false;
+    }
+    const result = payload[shopifyWorkspaceResultKey(command.command)];
+    if (result && typeof result === 'object' && !Array.isArray(result)) {
+        const ok = result.ok;
+        return ok !== false;
+    }
+    return true;
+}
+function shopifyWorkspaceTextLines(command, payload) {
+    const connector = payload.connector && typeof payload.connector === 'object' && !Array.isArray(payload.connector)
+        ? payload.connector
+        : {};
+    const source = payload.source && typeof payload.source === 'object' && !Array.isArray(payload.source)
+        ? payload.source
+        : {};
+    const result = payload[shopifyWorkspaceResultKey(command.command)];
+    const resultRecord = result && typeof result === 'object' && !Array.isArray(result)
+        ? result
+        : {};
+    const succeeded = shopifyWorkspaceCommandSucceeded(command, payload);
+    const verb = command.command === 'shopify workspace deploy-source' ? 'deploy' : 'validate';
+    return [
+        `${verb}: ${succeeded ? 'completed' : 'failed'}`,
+        `connector_id: ${String(connector.connectorId ?? '')}`,
+        `source_artifact_id: ${String(source.sourceArtifactId ?? '')}`,
+        ...(payload.reasonCode ? [`reason: ${String(payload.reasonCode)}`] : []),
+        ...(resultRecord.exitCode !== undefined ? [`exit_code: ${String(resultRecord.exitCode)}`] : []),
+        ...(resultRecord.stderr ? [`stderr: ${String(resultRecord.stderr).trim()}`] : []),
+    ].filter((line) => !line.endsWith(': '));
+}
+function readShopifyWorkspaceRuntimeIdentity(runtime) {
+    const env = runtime.env ?? process.env;
+    const baseUrl = normalizeHostedWorkspaceBaseUrl(env.TENDER_BASE_URL);
+    if (!baseUrl) {
+        throw new TenderCliUsageError('TENDER_BASE_URL is required. Open or reload the hosted Shopify workspace and run this command inside its terminal.');
+    }
+    if (!isHostedWorkspaceInternalApiBaseUrl(baseUrl)) {
+        throw new TenderCliUsageError('TENDER_BASE_URL must be http://tender-api.tender.test inside a hosted Shopify workspace. Reload the workspace terminal and try again.');
+    }
+    const runtimeArtifactId = readHostedWorkspaceArtifactId(env.TENDER_RUNTIME_ARTIFACT_ID);
+    if (!runtimeArtifactId) {
+        throw new TenderCliUsageError('TENDER_RUNTIME_ARTIFACT_ID is required. This command only runs inside a hosted Shopify project workspace.');
+    }
+    return { baseUrl, runtimeArtifactId };
+}
+function readShopifyWorkspaceConnectorRecords(payload) {
+    return Array.isArray(payload.connectors)
+        ? payload.connectors.filter((connector) => Boolean(connector) && typeof connector === 'object' && !Array.isArray(connector))
+        : [];
+}
+function readShopifyWorkspaceConnectorSourceArtifactId(connector) {
+    const sourceProject = connector.sourceProject && typeof connector.sourceProject === 'object' && !Array.isArray(connector.sourceProject)
+        ? connector.sourceProject
+        : null;
+    return readHostedWorkspaceArtifactId(typeof sourceProject?.sourceArtifactId === 'string' ? sourceProject.sourceArtifactId : undefined);
+}
+function resolveShopifyWorkspaceSourceCommandConnector(input) {
+    const connectors = readShopifyWorkspaceConnectorRecords(input.payload);
+    const connector = input.selectedConnectorId
+        ? connectors.find((candidate) => candidate.connectorId === input.selectedConnectorId) ?? null
+        : (() => {
+            const linked = connectors.filter((candidate) => candidate.linked === true);
+            return linked.length === 1 ? linked[0] ?? null : null;
+        })();
+    if (!connector) {
+        return {
+            ok: false,
+            payload: {
+                ok: false,
+                reasonCode: input.selectedConnectorId
+                    ? 'shopify_workspace_selected_connector_not_found'
+                    : 'shopify_workspace_connector_selection_required',
+                message: input.selectedConnectorId
+                    ? 'The selected Shopify connector is no longer available to this workspace.'
+                    : 'Link this runtime to one Shopify connector before validating or deploying source.',
+            },
+        };
+    }
+    const connectorId = typeof connector.connectorId === 'string' ? connector.connectorId : null;
+    const sourceArtifactId = readShopifyWorkspaceConnectorSourceArtifactId(connector);
+    if (!connectorId || !sourceArtifactId) {
+        return {
+            ok: false,
+            payload: {
+                ok: false,
+                reasonCode: 'shopify_source_project_required',
+                message: 'The selected Shopify connector does not have a source project.',
+            },
+        };
+    }
+    return {
+        ok: true,
+        connectorId,
+        sourceArtifactId,
+    };
+}
+async function runShopifyWorkspaceSourceCommand(command, io, runtime) {
+    const { baseUrl, runtimeArtifactId } = readShopifyWorkspaceRuntimeIdentity(runtime);
+    const selectedConnectorId = await readHostedWorkspaceConnectorSelection(runtimeArtifactId, runtime);
+    const connectorsResult = await requestShopifyWorkspaceConnectorsList({
+        baseUrl,
+        runtimeArtifactId,
+        fetcher: runtime.fetcher ?? fetch,
+    });
+    if (!shopifyWorkspaceRequestSucceeded(connectorsResult)) {
+        const payload = {
+            ...connectorsResult.payload,
+            command: command.command,
+            runtimeArtifactId,
+            ...(selectedConnectorId ? { selectedConnectorId } : {}),
+        };
+        if (command.json) {
+            io.stdout(JSON.stringify(payload, null, 2));
+        }
+        else {
+            io.stdout(shopifyWorkspaceTextLines(command, payload).join('\n'));
+        }
+        return 1;
+    }
+    const resolvedConnector = resolveShopifyWorkspaceSourceCommandConnector({
+        payload: connectorsResult.payload,
+        selectedConnectorId,
+    });
+    if (!resolvedConnector.ok) {
+        const payload = {
+            ...resolvedConnector.payload,
+            command: command.command,
+            runtimeArtifactId,
+            ...(selectedConnectorId ? { selectedConnectorId } : {}),
+        };
+        if (command.json) {
+            io.stdout(JSON.stringify(payload, null, 2));
+        }
+        else {
+            io.stdout(shopifyWorkspaceTextLines(command, payload).join('\n'));
+        }
+        return 1;
+    }
+    const result = await requestShopifyWorkspaceSourceCommand({
+        command: command.command,
+        baseUrl,
+        runtimeArtifactId,
+        fetcher: runtime.fetcher ?? fetch,
+        connectorId: resolvedConnector.connectorId,
+        sourceArtifactId: resolvedConnector.sourceArtifactId,
+    });
+    const payload = {
+        ...result.payload,
+        command: command.command,
+        runtimeArtifactId,
+        selectedConnectorId: resolvedConnector.connectorId,
+    };
+    if (command.json) {
+        io.stdout(JSON.stringify(payload, null, 2));
+    }
+    else {
+        io.stdout(shopifyWorkspaceTextLines(command, payload).join('\n'));
+    }
+    return shopifyWorkspaceCommandSucceeded(command, payload) ? 0 : 1;
+}
+function shopifyWorkspaceRequestSucceeded(result) {
+    return result.status >= 200 && result.status < 300 && result.payload.ok !== false;
+}
+function shopifyWorkspaceConnectorListTextLines(payload) {
+    const connectors = readShopifyWorkspaceConnectorRecords(payload);
+    const lines = [
+        `runtime_artifact_id: ${String(payload.runtimeArtifactId ?? '')}`,
+        `shop_domain: ${String(payload.shopDomain ?? '')}`,
+        `connectors: ${connectors.length}`,
+    ];
+    for (const connector of connectors) {
+        lines.push([
+            String(connector.connectorId ?? ''),
+            String(connector.label ?? connector.appName ?? ''),
+            connector.linked ? 'linked' : 'not_linked',
+            connector.ready ? 'ready' : 'needs_setup',
+        ]
+            .filter(Boolean)
+            .join(' | '));
+    }
+    if (typeof payload.reasonCode === 'string') {
+        lines.push(`reason: ${payload.reasonCode}`);
+    }
+    return lines.filter((line) => !line.endsWith(': '));
+}
+function shopifyWorkspaceLinkRuntimeTextLines(payload) {
+    const connector = payload.connector && typeof payload.connector === 'object' && !Array.isArray(payload.connector)
+        ? payload.connector
+        : {};
+    const source = payload.source && typeof payload.source === 'object' && !Array.isArray(payload.source)
+        ? payload.source
+        : {};
+    const workspace = payload.workspace && typeof payload.workspace === 'object' && !Array.isArray(payload.workspace)
+        ? payload.workspace
+        : {};
+    return [
+        `link: ${payload.ok === false ? 'failed' : 'created'}`,
+        `runtime_artifact_id: ${String(payload.runtimeArtifactId ?? '')}`,
+        `connector_id: ${String(connector.connectorId ?? '')}`,
+        `source_artifact_id: ${String(source.sourceArtifactId ?? '')}`,
+        workspace.reloadRequired ? 'next: reload the hosted workspace to mount /workspace/shopify-connector' : '',
+        ...(payload.reasonCode ? [`reason: ${String(payload.reasonCode)}`] : []),
+    ].filter(Boolean);
+}
+async function runShopifyWorkspaceConnectorsList(command, io, runtime) {
+    const { baseUrl, runtimeArtifactId } = readShopifyWorkspaceRuntimeIdentity(runtime);
+    const result = await requestShopifyWorkspaceConnectorsList({
+        baseUrl,
+        runtimeArtifactId,
+        fetcher: runtime.fetcher ?? fetch,
+    });
+    const payload = {
+        ...result.payload,
+        command: command.command,
+        runtimeArtifactId,
+    };
+    if (command.json) {
+        io.stdout(JSON.stringify(payload, null, 2));
+    }
+    else {
+        io.stdout(shopifyWorkspaceConnectorListTextLines(payload).join('\n'));
+    }
+    return shopifyWorkspaceRequestSucceeded(result) ? 0 : 1;
+}
+async function runShopifyWorkspaceLinkRuntime(command, io, runtime) {
+    const { baseUrl, runtimeArtifactId } = readShopifyWorkspaceRuntimeIdentity(runtime);
+    const result = await requestShopifyWorkspaceLinkRuntime({
+        baseUrl,
+        runtimeArtifactId,
+        connectorId: command.connectorId,
+        fetcher: runtime.fetcher ?? fetch,
+    });
+    if (shopifyWorkspaceRequestSucceeded(result)) {
+        await writeHostedWorkspaceConnectorSelection({
+            runtimeArtifactId,
+            connectorId: command.connectorId,
+        }, runtime);
+    }
+    const payload = {
+        ...result.payload,
+        command: command.command,
+        runtimeArtifactId,
+        connectorId: command.connectorId,
+    };
+    if (command.json) {
+        io.stdout(JSON.stringify(payload, null, 2));
+    }
+    else {
+        io.stdout(shopifyWorkspaceLinkRuntimeTextLines(payload).join('\n'));
+    }
+    return shopifyWorkspaceRequestSucceeded(result) ? 0 : 1;
+}
 async function runConnectorsShopifyDelete(command, io, runtime) {
     if (command.confirm !== 'delete') {
         throw new TenderCliUsageError('--confirm delete is required. Example: tender connectors shopify delete conn_123 --confirm delete --json');
@@ -12966,6 +13949,9 @@ function exampleForError(error, args, command) {
     if (error instanceof TenderCliDbApiError || error instanceof TenderCliAnalyticsApiError) {
         return error.example;
     }
+    if (error instanceof TenderCliConnectorsApiError) {
+        return error.example;
+    }
     const commandName = commandNameForError(args, command);
     const dbPath = dbPathFromCommandName(commandName);
     const artifactId = artifactIdForError(args, command) ?? 'artifact_123';
@@ -13092,6 +14078,14 @@ export async function runTenderCli(args, io = {
             else if (command.topic === 'connectors bind') {
                 io.stdout(connectorsBindHelp());
             }
+            else if (command.topic === 'shopify' ||
+                command.topic === 'shopify workspace' ||
+                command.topic === 'shopify workspace connectors list' ||
+                command.topic === 'shopify workspace link-runtime' ||
+                command.topic === 'shopify workspace validate-source' ||
+                command.topic === 'shopify workspace deploy-source') {
+                io.stdout(shopifyWorkspaceHelp());
+            }
             else if (command.topic === 'auth') {
                 io.stdout(authHelp());
             }
@@ -13352,6 +14346,15 @@ export async function runTenderCli(args, io = {
         if (command.command === 'connectors shopify source deploy') {
             return await runConnectorsShopifySourceDeploy(command, io, runtime);
         }
+        if (command.command === 'shopify workspace validate-source' || command.command === 'shopify workspace deploy-source') {
+            return await runShopifyWorkspaceSourceCommand(command, io, runtime);
+        }
+        if (command.command === 'shopify workspace connectors list') {
+            return await runShopifyWorkspaceConnectorsList(command, io, runtime);
+        }
+        if (command.command === 'shopify workspace link-runtime') {
+            return await runShopifyWorkspaceLinkRuntime(command, io, runtime);
+        }
         if (command.command === 'connectors shopify delete') {
             return await runConnectorsShopifyDelete(command, io, runtime);
         }
@@ -13524,7 +14527,7 @@ export async function runTenderCli(args, io = {
     }
     catch (error) {
         if (args.includes('--json') &&
-            ((args[0] === 'app' && (args[1] === 'db' || (args[1] === 'agent' && args[2] === 'heartbeat'))) || args[0] === 'playbooks' || args[0] === 'connectors')) {
+            ((args[0] === 'app' && (args[1] === 'db' || (args[1] === 'agent' && args[2] === 'heartbeat'))) || args[0] === 'playbooks' || args[0] === 'connectors' || args[0] === 'shopify')) {
             io.stdout(JSON.stringify(cliErrorPayload(error, args, command), null, 2));
             return error instanceof TenderCliUsageError ? 2 : 1;
         }