@tenderprompt/cli 0.1.34 → 0.1.36

package/dist/index.js

@@ -32,6 +32,8 @@ function readCliPackageVersion() {
 }
 const CLI_PACKAGE_VERSION = readCliPackageVersion();
 const GIT_COMMIT_SHA_PATTERN = /^[0-9a-f]{40}$/i;
+const SHOPIFY_CLI_PACKAGE = '@shopify/cli@latest';
+const SHOPIFY_CLI_BIN = 'shopify';
 const ANALYTICS_AUTHORING_PLAYBOOK_ID = 'analytics-event-authoring';
 const ANALYTICS_AUTHORING_COMMAND = 'tender app analytics authoring --json';
 const ANALYTICS_AUTHORING_PLAYBOOK_COMMAND = `tender playbooks get ${ANALYTICS_AUTHORING_PLAYBOOK_ID} --json`;
@@ -145,6 +147,23 @@ class TenderCliConnectorsApiError extends Error {
         this.example = example;
     }
 }
+class TenderCliChildProcessError extends Error {
+    command;
+    args;
+    exitCode;
+    stdout;
+    stderr;
+    constructor(input) {
+        const detail = input.stderr.trim() || input.stdout.trim();
+        super([`${input.command} ${input.args.join(' ')} failed with exit code ${input.exitCode}.`, detail].filter(Boolean).join('\n'));
+        this.name = 'TenderCliChildProcessError';
+        this.command = input.command;
+        this.args = input.args;
+        this.exitCode = input.exitCode;
+        this.stdout = input.stdout;
+        this.stderr = input.stderr;
+    }
+}
 const DEFAULT_PROFILE_NAME = 'default';
 const DEFAULT_BASE_URL = 'https://app.tenderprompt.com';
 const ARTIFACT_SOURCE_EXPORT_MAX_FILES = 1000;
@@ -180,12 +199,6 @@ Commands:
   tender connectors shopify verify
                              Exchange credentials for an Admin API access token
   tender connectors bind     Print an app.json binding for a connector instance
-  tender shopify workspace connectors list
-                             List current-store Shopify connectors from a hosted workspace
-  tender shopify workspace link-runtime --connector <connector-id>
-                             Link the hosted runtime to a Shopify connector
-  tender shopify workspace deploy-source
-                             Deploy linked Shopify source from a hosted workspace
   tender app list            List Tender App records visible to the current token
   tender app create --name <name>
                              Create a new Tender App in the current account
@@ -263,9 +276,6 @@ Examples:
   printf "$SHOPIFY_APP_AUTOMATION_TOKEN" | tender connectors shopify app-automation-token set conn_123 --token-stdin --expires-at 2026-08-22 --profile account --json
   tender connectors shopify verify conn_123 --profile account --json
   tender connectors bind SHOPIFY_CONNECTOR conn_123 --instance default --json
-  tender shopify workspace connectors list --json
-  tender shopify workspace link-runtime --connector conn_123 --json
-  tender shopify workspace deploy-source --json
   tender app list --json
   tender app create --name "Exit Intent Widget" --json
   tender app create --name "Data Collection App" --init --dir ./data-collection-app --preview --json
@@ -480,33 +490,6 @@ Examples:
   tender connectors shopify source deploy conn_123 --dir ./shopify-app --confirm deploy --profile account --json
 	  tender connectors bind SHOPIFY_CONNECTOR conn_123 --instance default --json`;
 }
-function shopifyWorkspaceHelp() {
-    return `Usage: tender shopify workspace <command> [--json]
-
-Hosted Shopify workspace commands use the current terminal workspace identity.
-They do not read Tender profiles, account-scoped tokens, Shopify client secrets,
-or Shopify App Automation Tokens from the terminal.
-
-Commands:
-  tender shopify workspace connectors list
-                             List current-store Shopify connectors available to this runtime
-  tender shopify workspace link-runtime --connector <connector-id>
-                             Link this runtime to a Shopify connector source project
-  tender shopify workspace validate-source
-                             Validate the linked Shopify connector source
-  tender shopify workspace deploy-source
-                             Deploy the linked Shopify connector source
-
-Required environment:
-  TENDER_BASE_URL
-  TENDER_RUNTIME_ARTIFACT_ID
-
-Examples:
-  tender shopify workspace connectors list --json
-  tender shopify workspace link-runtime --connector conn_123 --json
-  tender shopify workspace validate-source --json
-  tender shopify workspace deploy-source --json`;
-}
 function connectorsShopifyCreateHelp() {
     return `Usage: tender connectors shopify create [--instance <id>] [--label <text>] [--app-name <text>] [--admin-api-version <version>] [--shop <myshopify-domain>] [--base-url <url>] [--token <token>] [--profile <name>] [--json]
 
@@ -592,7 +575,10 @@ function connectorsShopifySourceValidateHelp() {
     return `Usage: tender connectors shopify source validate <connector-id> [--dir <path>] [--client-id <shopify-client-id>] [--execute] [--base-url <url>] [--token <token>] [--profile <name>] [--json]
 
 Without --execute, prints the exact Shopify CLI validation command. With
---execute, runs npx --yes @shopify/cli@latest app config validate.
+the --execute flag, runs npm exec --yes --package @shopify/cli@latest -- shopify app config validate with npm lifecycle environment variables scrubbed. If
+SHOPIFY_APP_AUTOMATION_TOKEN is not set locally, the CLI requests the
+connector's stored App Automation Token and injects it only into the spawned
+Shopify CLI child process.
 
 Examples:
   tender connectors shopify source validate conn_123 --dir ./shopify-app --execute --json`;
@@ -601,17 +587,14 @@ function connectorsShopifySourceDeployHelp() {
     return `Usage: tender connectors shopify source deploy <connector-id> [--dir <path>] [--client-id <shopify-client-id>] [--version <tag>] [--message <text>] [--source-control-url <url>] [--allow-deletes] [--confirm deploy] [--base-url <url>] [--token <token>] [--profile <name>] [--json]
 
 Without --confirm deploy, prints the exact Shopify CLI deployment command. With
---confirm deploy, runs npx --yes @shopify/cli@latest app deploy. If
+the --confirm deploy flag, runs npm exec --yes --package @shopify/cli@latest -- shopify app deploy with npm lifecycle environment variables scrubbed. If
 SHOPIFY_APP_AUTOMATION_TOKEN is not set locally, the CLI requests the
 connector's stored App Automation Token and injects it only into the spawned
 Shopify CLI child process.
 
-Inside hosted Shopify project workspaces, direct shopify app deploy is allowed
-when Shopify CLI is already authenticated there. Otherwise use
-tender shopify workspace deploy-source so Tender can use the connector's
-stored App Automation Token server-side. Do not run this account-scoped command
-with a hosted workspace artifact token. Never ask the merchant to paste token
-material into the terminal.
+Inside the Shopify app, deploy connector source with the explicit **Deploy
+source** action after the chat editor validates the pushed commit. Never ask the
+merchant to paste token material into chat or a terminal.
 
 Examples:
   tender connectors shopify source deploy conn_123 --dir ./shopify-app --version connector-source-smoke --confirm deploy --profile account --json`;
@@ -989,7 +972,8 @@ function analyticsChartsTemplatesHelp() {
 
 Print reusable chart spec templates for agents. Adapt templates to observed
 events, paths, and property keys from analytics capabilities before querying or
-saving.
+saving. The hourly_dimension_breakdown_24h template documents the bounded
+hour-by-property operator report.
 
 Examples:
   tender app analytics charts templates --json`;
@@ -1636,7 +1620,6 @@ function tenderCliCapabilities() {
                 'tender app outbound-auth --help',
                 'tender connectors --help',
                 'tender connectors shopify source init --help',
-                'tender shopify workspace --help',
             ],
         },
         workflows: [
@@ -1681,36 +1664,6 @@ function tenderCliCapabilities() {
                     'Fetch shopify-connector-customer-metadata-widget when the requested job involves customer metafields, metaobjects, or profile writes.',
                 ],
             },
-            {
-                name: 'hosted_shopify_project_release',
-                when: 'Inside a hosted Shopify project workspace after editing a runtime app and linked Shopify connector source, or when the merchant asks to deploy/release/publish the Shopify connector.',
-                commands: [
-                    'tender shopify workspace connectors list --json',
-                    'tender shopify workspace link-runtime --connector <connector-id> --json',
-                    'cd /workspace/runtime-project && git push origin HEAD:main',
-                    'cd /workspace/runtime-project && commit=$(git rev-parse HEAD) && tender app publish "$TENDER_RUNTIME_ARTIFACT_ID" --commit "$commit" --confirm publish --stream --json',
-                    'cd /workspace/shopify-connector && git push origin HEAD:main',
-                    'cd /workspace/shopify-connector && tender shopify workspace validate-source --json',
-                    'cd /workspace/shopify-connector && tender shopify workspace deploy-source --json',
-                ],
-                notes: [
-                    'If /workspace/shopify-connector is missing, list connectors, link the selected connector, then continue in /workspace/shopify-connector unless link-runtime explicitly returns reloadRequired:true.',
-                    'For connector selection or switching, use tender shopify workspace connectors list --json and tender shopify workspace link-runtime --connector <connector-id> --json; do not use tender connectors list or ask for a Shopify Client ID.',
-                    'When selecting by merchant-provided Shopify app name, prefer an exact normalized label/appName match before any partial match; do not choose a longer connector name that merely contains the requested name.',
-                    'After link-runtime succeeds, tender shopify workspace validate-source and deploy-source automatically use that selected connector.',
-                    'For a deploy-only connector request, skip npm install, npm run check, tender app doctor, and other runtime-project checks; run cd /workspace/shopify-connector && tender shopify workspace deploy-source --json.',
-                    'For a validate-only connector request, run cd /workspace/shopify-connector && tender shopify workspace validate-source --json.',
-                    'Only run runtime-project checks when the merchant asks to change, validate, preview, or publish the runtime app.',
-                    'Publish the Tender runtime first and use the pinned runtime URL from publish JSON to update the linked connector source before deploying Shopify.',
-                    'Use TENDER_SHOPIFY_CONNECTOR_ID or connector.json for Tender connector commands; shopify.app.toml contains the Shopify client_id, not the Tender connector identity.',
-                    'Do not run tender connectors shopify source validate or tender connectors shopify source deploy from hosted workspaces; those commands require an account-scoped Tender CLI token.',
-                    'Use tender shopify workspace validate-source and deploy-source so the connector stored App Automation Token stays server-side.',
-                    'If Shopify CLI is already authenticated in the hosted workspace, direct shopify app config validate and shopify app deploy are allowed.',
-                    'Never ask for Shopify App Automation Tokens, client secrets, Tender tokens, or provider keys in the terminal.',
-                    'Do not release by pushing Git tags; Tender runtime publish plus tender shopify workspace deploy-source are the release path.',
-                    'If tender shopify workspace deploy-source reports a missing or expired App Automation Token, stop and ask the merchant to refresh the Custom App automation token in Tender.',
-                ],
-            },
             {
                 name: 'create_new_app_with_preview',
                 when: 'When the user wants a new Tender App that is immediately visible.',
@@ -2108,6 +2061,25 @@ function normalizeBaseUrl(value) {
 function readDefaultBaseUrl(env) {
     return normalizeBaseUrl(env.TENDER_BASE_URL ?? DEFAULT_BASE_URL);
 }
+function readDefaultShopifyApprovalContext(env) {
+    const shopifyAppUrl = env.TENDER_SHOPIFY_APP_URL?.trim();
+    if (shopifyAppUrl) {
+        const parsed = parseShopifyAppUrl(shopifyAppUrl, 'TENDER_SHOPIFY_APP_URL');
+        return {
+            shopifyAppUrl: parsed.appUrl,
+            shopifyStore: parsed.store,
+        };
+    }
+    const shopifyStore = env.TENDER_SHOPIFY_STORE?.trim();
+    if (shopifyStore) {
+        const store = parseShopifyStoreHandle(shopifyStore, 'TENDER_SHOPIFY_STORE');
+        return {
+            shopifyAppUrl: shopifyAppUrlForStore(store),
+            shopifyStore: store,
+        };
+    }
+    return null;
+}
 function readConfigPath(env) {
     return env.TENDER_CONFIG ? path.resolve(env.TENDER_CONFIG) : path.join(os.homedir(), '.tender', 'config.json');
 }
@@ -2299,17 +2271,6 @@ async function resolveApiCredentials(input) {
     };
 }
 async function resolveLifecycleApiCredentials(input) {
-    const baseUrl = normalizeBaseUrl(input.baseUrl ?? input.env.TENDER_BASE_URL ?? DEFAULT_BASE_URL);
-    if (!input.flagToken &&
-        !input.profileName &&
-        isHostedWorkspaceInternalApiBaseUrl(baseUrl)) {
-        return {
-            baseUrl,
-            token: null,
-            source: 'hosted-workspace',
-            profileName: null,
-        };
-    }
     return await resolveApiCredentials(input);
 }
 function apiHeadersForCredentials(input) {
@@ -4017,59 +3978,18 @@ function parseConnectorsShopifySourceDeployArgs(args) {
         }
         throw new TenderCliUsageError(`Unknown connectors shopify source deploy option: ${arg}`);
     }
-    return { command: 'connectors shopify source deploy', connectorId, dir, clientId, version, message, sourceControlUrl, allowDeletes, confirm, ...parsed };
-}
-function parseShopifyWorkspaceSourceArgs(args, command) {
-    if (args.includes('--help') || args.includes('-h')) {
-        return { command: 'help', topic: command };
-    }
-    let json = false;
-    for (const arg of args) {
-        if (arg === '--json') {
-            json = true;
-            continue;
-        }
-        throw new TenderCliUsageError(`Unknown ${command} option: ${arg}`);
-    }
-    return { command, json };
-}
-function parseShopifyWorkspaceConnectorsListArgs(args) {
-    if (args.includes('--help') || args.includes('-h')) {
-        return { command: 'help', topic: 'shopify workspace connectors list' };
-    }
-    let json = false;
-    for (const arg of args) {
-        if (arg === '--json') {
-            json = true;
-            continue;
-        }
-        throw new TenderCliUsageError(`Unknown shopify workspace connectors list option: ${arg}`);
-    }
-    return { command: 'shopify workspace connectors list', json };
-}
-function parseShopifyWorkspaceLinkRuntimeArgs(args) {
-    if (args.includes('--help') || args.includes('-h')) {
-        return { command: 'help', topic: 'shopify workspace link-runtime' };
-    }
-    let connectorId = null;
-    let json = false;
-    for (let index = 0; index < args.length; index += 1) {
-        const arg = args[index];
-        if (arg === '--json') {
-            json = true;
-            continue;
-        }
-        if (arg === '--connector') {
-            connectorId = parseConnectorId(parseRequiredFlagValue(args[index + 1], '--connector'), 'tender shopify workspace link-runtime --connector conn_123 --json');
-            index += 1;
-            continue;
-        }
-        throw new TenderCliUsageError(`Unknown shopify workspace link-runtime option: ${arg}`);
-    }
-    if (!connectorId) {
-        throw new TenderCliUsageError('--connector is required. Example: tender shopify workspace link-runtime --connector conn_123 --json');
-    }
-    return { command: 'shopify workspace link-runtime', connectorId, json };
+    return {
+        command: 'connectors shopify source deploy',
+        connectorId,
+        dir,
+        clientId,
+        version,
+        message,
+        sourceControlUrl,
+        allowDeletes,
+        confirm,
+        ...parsed,
+    };
 }
 function parseConnectorsShopifyDeleteArgs(args) {
     if (args.includes('--help') || args.includes('-h')) {
@@ -5595,6 +5515,10 @@ function analyticsAuthoringContract() {
             },
         ],
         charting: {
+            contractDiscovery: {
+                capabilities: 'tender app analytics capabilities <app-id> --include-catalog --json',
+                templates: 'tender app analytics charts templates --json',
+            },
             starterDashboardCommands: ANALYTICS_AGENT_GUIDANCE.starterDashboardCommands,
             completionProof: ANALYTICS_AGENT_GUIDANCE.dashboardCompletion.proofCommand,
             unitFunnel: 'After traffic exists, use tender app analytics capabilities <app-id> --include-catalog --json and create version 2 unit_step_count funnel specs from observedFlows and observedUnitTypes.',
@@ -5832,6 +5756,33 @@ function analyticsChartTemplates() {
                 limit: 10,
             },
         },
+        {
+            id: 'hourly_dimension_breakdown_24h',
+            title: 'Hourly dimension breakdown (24h)',
+            visualization: 'table',
+            purpose: 'Compare one low-cardinality promoted dimension by hour over the last 24 hours.',
+            usableAsIs: false,
+            placeholders: {
+                eventName: '<event_name>',
+                property: '<queryable_dimension_property>',
+            },
+            adaptWith: [
+                'Replace both placeholders with one observed custom event and one active dimension property for that event.',
+                'Use only non-sensitive categorical dimensions with at most 16 observed values.',
+                'Keep the 24h range, hour-first grouping order, table visualization, custom_event_count metric, and 400-row limit unchanged.',
+            ],
+            spec: {
+                version: 1,
+                dataset: 'events',
+                visualization: 'table',
+                metric: { name: 'custom_event_count' },
+                groupBy: [{ field: 'hour' }, { field: 'property:<queryable_dimension_property>' }],
+                filters: [{ field: 'event_name', op: '=', value: '<event_name>' }],
+                range: { preset: '24h' },
+                sort: [{ field: 'hour', direction: 'asc' }],
+                limit: 400,
+            },
+        },
         {
             id: 'experiment_readout',
             title: 'Experiment readout',
@@ -5852,10 +5803,7 @@ function analyticsChartTemplates() {
                 dataset: 'events',
                 visualization: 'table',
                 metric: { name: 'custom_event_count' },
-                groupBy: [
-                    { field: 'event_name' },
-                    { field: 'property:experiment_variant' },
-                ],
+                groupBy: [{ field: 'event_name' }, { field: 'property:experiment_variant' }],
                 filters: [
                     {
                         field: 'event_name',
@@ -7166,30 +7114,6 @@ function parseTenderArgs(args) {
         }
         throw new TenderCliUsageError(`Unknown connectors command: ${args[1]}`);
     }
-    if (args[0] === 'shopify') {
-        if (args[1] === undefined || args[1] === '--help' || args[1] === '-h') {
-            return { command: 'help', topic: 'shopify' };
-        }
-        if (args[1] === 'workspace') {
-            if (args[2] === undefined || args[2] === '--help' || args[2] === '-h') {
-                return { command: 'help', topic: 'shopify workspace' };
-            }
-            if (args[2] === 'connectors' && args[3] === 'list') {
-                return parseShopifyWorkspaceConnectorsListArgs(args.slice(4));
-            }
-            if (args[2] === 'link-runtime') {
-                return parseShopifyWorkspaceLinkRuntimeArgs(args.slice(3));
-            }
-            if (args[2] === 'validate-source') {
-                return parseShopifyWorkspaceSourceArgs(args.slice(3), 'shopify workspace validate-source');
-            }
-            if (args[2] === 'deploy-source') {
-                return parseShopifyWorkspaceSourceArgs(args.slice(3), 'shopify workspace deploy-source');
-            }
-            throw new TenderCliUsageError(`Unknown shopify workspace command: ${args[2]}`);
-        }
-        throw new TenderCliUsageError(`Unknown shopify command: ${args[1]}`);
-    }
     if (args[0] === 'apps') {
         throw new TenderCliUsageError('Unknown command: apps. Use `tender app ...` for Tender App workflows.');
     }
@@ -7255,7 +7179,8 @@ function parseTenderArgs(args) {
         if (resourceArgs[1] === 'bindings' && (resourceArgs[2] === undefined || resourceArgs[2] === '--help' || resourceArgs[2] === '-h')) {
             return { command: 'help', topic: 'app bindings outbound' };
         }
-        if (resourceArgs[1] === 'outbound-auth' && (resourceArgs[2] === undefined || resourceArgs[2] === '--help' || resourceArgs[2] === '-h')) {
+        if (resourceArgs[1] === 'outbound-auth' &&
+            (resourceArgs[2] === undefined || resourceArgs[2] === '--help' || resourceArgs[2] === '-h')) {
             return { command: 'help', topic: 'app outbound-auth' };
         }
         if (resourceArgs[1] === 'outbound-auth' && resourceArgs[2] === 'list') {
@@ -7865,12 +7790,7 @@ async function requestAppDbDashboardApi(input) {
             (typeof payload?.reasonCode === 'string' && payload.reasonCode) ||
             `App database dashboard request failed with HTTP ${response.status}.`;
         const example = appDbDashboardCorrectedExample(input.artifactId, input.path);
-        throw new TenderCliDbApiError([
-            message,
-            `Scope: artifact ${input.artifactId}, app-db-dashboards.`,
-            `Reason: ${reasonCode}.`,
-            `Example: ${example}.`,
-        ].join('\n'), reasonCode, {
+        throw new TenderCliDbApiError([message, `Scope: artifact ${input.artifactId}, app-db-dashboards.`, `Reason: ${reasonCode}.`, `Example: ${example}.`].join('\n'), reasonCode, {
             artifactId: input.artifactId,
             surface: 'db/dashboards',
         }, example);
@@ -7926,189 +7846,13 @@ async function requestConnectorsApi(input) {
         const message = (typeof payload?.message === 'string' && payload.message) ||
             (typeof payload?.reasonCode === 'string' && payload.reasonCode) ||
             `Connector request failed with HTTP ${response.status}.`;
-        const example = input.hostedWorkspaceHint && reasonCode === 'account_scope_required'
-            ? 'Hosted workspace example: tender shopify workspace connectors list --json.'
-            : 'Example: tender connectors list --profile account --json.';
-        throw new TenderCliConnectorsApiError([message, `Reason: ${reasonCode}.`, example].join('\n'), reasonCode, response.status, payload ?? null, example.replace(/^Example:\s*/i, '').replace(/^Hosted workspace example:\s*/i, '').replace(/\.$/, ''));
+        const example = 'Example: tender connectors list --profile account --json.';
+        throw new TenderCliConnectorsApiError([message, `Reason: ${reasonCode}.`, example].join('\n'), reasonCode, response.status, payload ?? null, example
+            .replace(/^Example:\s*/i, '')
+            .replace(/\.$/, ''));
     }
     return payload;
 }
-function normalizeHostedWorkspaceBaseUrl(value) {
-    const baseUrl = value?.trim().replace(/\/+$/, '') ?? '';
-    if (!baseUrl) {
-        return null;
-    }
-    try {
-        const url = new URL(baseUrl);
-        return url.protocol === 'https:' || url.protocol === 'http:' ? url.toString().replace(/\/+$/, '') : null;
-    }
-    catch {
-        return null;
-    }
-}
-function readHostedWorkspaceArtifactId(value) {
-    const artifactId = value?.trim() ?? '';
-    return /^artifact_[A-Za-z0-9_-]+$/.test(artifactId) ? artifactId : null;
-}
-function isHostedWorkspaceInternalApiBaseUrl(baseUrl) {
-    try {
-        return new URL(baseUrl).hostname === 'tender-api.tender.test';
-    }
-    catch {
-        return false;
-    }
-}
-function hostedWorkspaceApiHeaders(input) {
-    return {
-        accept: 'application/json',
-        ...(input.jsonBody ? { 'content-type': 'application/json' } : {}),
-    };
-}
-function readHostedWorkspaceConnectorId(value) {
-    const connectorId = value?.trim() ?? '';
-    return /^conn_[A-Za-z0-9_-]+$/.test(connectorId) ? connectorId : null;
-}
-function errorCodeMatches(error, code) {
-    return Boolean(error &&
-        typeof error === 'object' &&
-        'code' in error &&
-        error.code === code);
-}
-function hostedWorkspaceSelectionFilePath(runtime) {
-    const env = runtime.env ?? process.env;
-    const explicitPath = env.TENDER_WORKSPACE_STATE_FILE?.trim();
-    if (explicitPath) {
-        return path.resolve(explicitPath);
-    }
-    const runtimeProjectDir = env.TENDER_RUNTIME_PROJECT_DIR?.trim();
-    if (runtimeProjectDir && path.isAbsolute(runtimeProjectDir)) {
-        return path.join(path.dirname(runtimeProjectDir), '.tender', 'shopify-workspace.json');
-    }
-    const cwd = process.cwd();
-    if (cwd === '/workspace' || cwd.startsWith('/workspace/')) {
-        return '/workspace/.tender/shopify-workspace.json';
-    }
-    return null;
-}
-async function writeHostedWorkspaceConnectorSelection(input, runtime) {
-    const filePath = hostedWorkspaceSelectionFilePath(runtime);
-    if (!filePath) {
-        return;
-    }
-    await mkdir(path.dirname(filePath), { recursive: true, mode: 0o700 });
-    await writeFile(filePath, `${JSON.stringify({
-        version: 1,
-        runtimeArtifactId: input.runtimeArtifactId,
-        connectorId: input.connectorId,
-        selectedAt: Date.now(),
-    }, null, 2)}\n`, { encoding: 'utf8', mode: 0o600 });
-}
-async function readHostedWorkspaceConnectorSelection(runtimeArtifactId, runtime) {
-    const env = runtime.env ?? process.env;
-    const envConnectorId = readHostedWorkspaceConnectorId(env.TENDER_SHOPIFY_CONNECTOR_ID);
-    if (envConnectorId) {
-        return envConnectorId;
-    }
-    const filePath = hostedWorkspaceSelectionFilePath(runtime);
-    if (!filePath) {
-        return null;
-    }
-    let content;
-    try {
-        content = await readFile(filePath, 'utf8');
-    }
-    catch (error) {
-        if (errorCodeMatches(error, 'ENOENT')) {
-            return null;
-        }
-        throw error;
-    }
-    let parsed;
-    try {
-        parsed = JSON.parse(content);
-    }
-    catch {
-        return null;
-    }
-    if (!parsed || typeof parsed !== 'object' || Array.isArray(parsed)) {
-        return null;
-    }
-    const record = parsed;
-    if (record.runtimeArtifactId !== runtimeArtifactId) {
-        return null;
-    }
-    return readHostedWorkspaceConnectorId(typeof record.connectorId === 'string' ? record.connectorId : undefined);
-}
-function shopifyWorkspaceCommandApiPath(command) {
-    return command === 'shopify workspace deploy-source' ? 'deploy' : 'validate';
-}
-async function requestShopifyWorkspaceSourceCommand(input) {
-    const url = `${input.baseUrl}/api/account/connectors/${encodeURIComponent(input.connectorId)}/source/${shopifyWorkspaceCommandApiPath(input.command)}`;
-    const response = await input.fetcher(url, {
-        method: 'POST',
-        headers: hostedWorkspaceApiHeaders({
-            jsonBody: true,
-        }),
-        body: JSON.stringify({
-            sourceArtifactId: input.sourceArtifactId,
-            runtimeArtifactId: input.runtimeArtifactId,
-        }),
-    });
-    const payload = response.status === 204 ? { ok: true } : await parseJsonResponse(response);
-    if (payload) {
-        return { status: response.status, payload };
-    }
-    return {
-        status: response.status,
-        payload: {
-            ok: false,
-            reasonCode: `http_${response.status}`,
-            message: `Shopify workspace request failed with HTTP ${response.status}.`,
-        },
-    };
-}
-async function requestShopifyWorkspaceConnectorsList(input) {
-    const params = new URLSearchParams({ runtimeArtifactId: input.runtimeArtifactId });
-    const url = `${input.baseUrl}/api/account/connectors?${params.toString()}`;
-    const response = await input.fetcher(url, {
-        method: 'GET',
-        headers: hostedWorkspaceApiHeaders({}),
-    });
-    const payload = response.status === 204 ? { ok: true } : await parseJsonResponse(response);
-    if (payload) {
-        return { status: response.status, payload };
-    }
-    return {
-        status: response.status,
-        payload: {
-            ok: false,
-            reasonCode: `http_${response.status}`,
-            message: `Shopify workspace connectors request failed with HTTP ${response.status}.`,
-        },
-    };
-}
-async function requestShopifyWorkspaceLinkRuntime(input) {
-    const url = `${input.baseUrl}/api/account/connectors/${encodeURIComponent(input.connectorId)}/runtime-links`;
-    const response = await input.fetcher(url, {
-        method: 'POST',
-        headers: hostedWorkspaceApiHeaders({
-            jsonBody: true,
-        }),
-        body: JSON.stringify({ runtimeArtifactId: input.runtimeArtifactId }),
-    });
-    const payload = response.status === 204 ? { ok: true } : await parseJsonResponse(response);
-    if (payload) {
-        return { status: response.status, payload };
-    }
-    return {
-        status: response.status,
-        payload: {
-            ok: false,
-            reasonCode: `http_${response.status}`,
-            message: `Shopify workspace link request failed with HTTP ${response.status}.`,
-        },
-    };
-}
 function dbCorrectedExample(artifactId, dbPath) {
     if (dbPath === 'capabilities') {
         return `tender app db capabilities ${artifactId} --json`;
@@ -8223,26 +7967,29 @@ function readAnalyticsSpecMetricName(spec) {
     }
     return readCliStringField(spec.metric, 'name');
 }
-function readAnalyticsSpecGroupField(spec) {
+function readAnalyticsSpecGroupFields(spec) {
     if (!isCliJsonRecord(spec) || !Array.isArray(spec.groupBy)) {
-        return null;
+        return [];
     }
-    const [group] = spec.groupBy.filter(isCliJsonRecord);
-    return group ? readCliStringField(group, 'field') : null;
+    return spec.groupBy
+        .filter(isCliJsonRecord)
+        .map((group) => readCliStringField(group, 'field'))
+        .filter((field) => field !== null);
 }
 function readRequiredAnalyticsPropertiesFromSpec(spec) {
     const eventName = readAnalyticsSpecEventNameFilter(spec);
     const requirements = [];
-    const groupField = readAnalyticsSpecGroupField(spec);
-    if (groupField?.startsWith('property:')) {
-        if (!eventName) {
-            throw new TenderCliUsageError('Property group-by chart specs require an event_name = filter so the CLI can make the property available to dashboard queries.');
+    for (const groupField of readAnalyticsSpecGroupFields(spec)) {
+        if (groupField.startsWith('property:')) {
+            if (!eventName) {
+                throw new TenderCliUsageError('Property group-by chart specs require an event_name = filter so the CLI can make the property available to dashboard queries.');
+            }
+            requirements.push({
+                eventName,
+                propertyKey: groupField.slice('property:'.length),
+                propertyType: 'dimension',
+            });
         }
-        requirements.push({
-            eventName,
-            propertyKey: groupField.slice('property:'.length),
-            propertyType: 'dimension',
-        });
     }
     const metricName = readAnalyticsSpecMetricName(spec);
     if (metricName?.startsWith('sum:') || metricName?.startsWith('avg:')) {
@@ -8413,7 +8160,16 @@ function csvCell(value) {
     return text;
 }
 function rowsToCsv(rows) {
-    const records = rows.filter((row) => Boolean(row) && typeof row === 'object' && !Array.isArray(row));
+    const records = rows
+        .filter((row) => Boolean(row) && typeof row === 'object' && !Array.isArray(row))
+        .map((row) => {
+        const dimensions = row.dimensions;
+        if (!dimensions || typeof dimensions !== 'object' || Array.isArray(dimensions)) {
+            return row;
+        }
+        const { dimensions: _dimensions, ...rest } = row;
+        return { ...dimensions, ...rest };
+    });
     const headers = Array.from(records.reduce((set, row) => {
         for (const key of Object.keys(row)) {
             set.add(key);
@@ -9039,11 +8795,13 @@ async function runAuthLogin(command, io, runtime) {
     const fetcher = runtime.fetcher ?? fetch;
     const sleeper = runtime.sleeper ?? ((milliseconds) => new Promise((resolve) => setTimeout(resolve, milliseconds)));
     const now = runtime.now ?? Date.now;
+    const agentAutoPoll = command.json && env.TENDER_AGENT_DEVICE_AUTH_AUTO_POLL === '1';
     const config = await readConfig(env);
     const existingProfile = config.profiles?.[command.saveProfile] ?? null;
     const baseUrl = command.baseUrl ?? existingProfile?.baseUrl ?? readDefaultBaseUrl(env);
-    const shopifyAppUrl = command.shopifyAppUrl ?? existingProfile?.shopifyAppUrl ?? null;
-    const shopifyStore = command.shopifyStore ?? existingProfile?.shopifyStore ?? null;
+    const defaultShopifyApprovalContext = readDefaultShopifyApprovalContext(env);
+    const shopifyAppUrl = command.shopifyAppUrl ?? existingProfile?.shopifyAppUrl ?? defaultShopifyApprovalContext?.shopifyAppUrl ?? null;
+    const shopifyStore = command.shopifyStore ?? existingProfile?.shopifyStore ?? defaultShopifyApprovalContext?.shopifyStore ?? null;
     const deviceResponse = await fetcher(`${baseUrl}/oauth/device/code`, {
         method: 'POST',
         headers: {
@@ -9116,7 +8874,7 @@ async function runAuthLogin(command, io, runtime) {
         configPath: readConfigPath(env),
         nextCommand: buildAuthStatusNextCommand(command.saveProfile),
     };
-    if (command.noPoll) {
+    if (command.noPoll && !agentAutoPoll) {
         if (command.json) {
             io.stdout(JSON.stringify(pendingResult, null, 2));
         }
@@ -9129,10 +8887,7 @@ async function runAuthLogin(command, io, runtime) {
         io.stderr(JSON.stringify(pendingResult, null, 2));
     }
     else {
-        io.stdout([
-            `Open this URL to approve Tender CLI access: ${verificationUriComplete}`,
-            `User code: ${devicePayload.user_code}`,
-        ].join('\n'));
+        io.stdout([`Open this URL to approve Tender CLI access: ${verificationUriComplete}`, `User code: ${devicePayload.user_code}`].join('\n'));
     }
     let intervalSeconds = Math.max(1, devicePayload.interval ?? 5);
     let attemptsRemaining = Math.max(1, Math.ceil(command.pollTimeoutSeconds / intervalSeconds));
@@ -9829,12 +9584,7 @@ async function resolveGitCommitArgument(input) {
         return commitSha.toLowerCase();
     }
     const detail = result.stderr.trim() || result.stdout.trim();
-    throw new TenderCliUsageError([
-        `--commit must be a 40-character commit SHA or a Git ref resolvable in this checkout: ${value}`,
-        detail,
-    ]
-        .filter(Boolean)
-        .join('\n'));
+    throw new TenderCliUsageError([`--commit must be a 40-character commit SHA or a Git ref resolvable in this checkout: ${value}`, detail].filter(Boolean).join('\n'));
 }
 function readCommandCommitSha(command) {
     const commitSha = 'commitSha' in command ? command.commitSha : null;
@@ -10805,9 +10555,7 @@ async function postLifecycle(input) {
         },
         runtime: input.runtime,
     });
-    const memorySync = input.operation === 'publish'
-        ? await flushAutomaticMemory({ repoPath, remoteName: 'tender', runtime: input.runtime })
-        : null;
+    const memorySync = input.operation === 'publish' ? await flushAutomaticMemory({ repoPath, remoteName: 'tender', runtime: input.runtime }) : null;
     const resultWithMemory = {
         ...result,
         memory,
@@ -11134,7 +10882,7 @@ async function runOutboundAuthApprove(command, io, runtime) {
     });
     const fetcher = runtime.fetcher ?? fetch;
     const grants = command.approveAll
-        ? (await requestOutboundAuthList({ command, credentials, fetcher })).grants?.filter((grant) => !grant.approved) ?? []
+        ? ((await requestOutboundAuthList({ command, credentials, fetcher })).grants?.filter((grant) => !grant.approved) ?? [])
         : [readExplicitOutboundAuthGrant(command)];
     const approved = [];
     for (const grant of grants) {
@@ -11154,11 +10902,7 @@ async function runOutboundAuthApprove(command, io, runtime) {
         io.stdout(JSON.stringify(result, null, 2));
     }
     else {
-        io.stdout([
-            `app_id: ${command.artifactId}`,
-            `approved: ${approved.length}`,
-            ...approved.map((grant) => formatOutboundAuthGrant(grant)),
-        ].join('\n'));
+        io.stdout([`app_id: ${command.artifactId}`, `approved: ${approved.length}`, ...approved.map((grant) => formatOutboundAuthGrant(grant))].join('\n'));
     }
     return 0;
 }
@@ -11577,7 +11321,9 @@ async function runMemoryBrief(command, io, runtime) {
     const unresolved = entries
         .filter((entry) => entry.status === 'open' || entry.kind === 'failure' || entry.kind === 'open_question' || entry.kind === 'support_handoff')
         .slice(-command.limit);
-    const briefEntries = latestSummary ? [latestSummary, ...unresolved.filter((entry) => entry.entryId !== latestSummary.entryId)] : unresolved;
+    const briefEntries = latestSummary
+        ? [latestSummary, ...unresolved.filter((entry) => entry.entryId !== latestSummary.entryId)]
+        : unresolved;
     const result = {
         ok: true,
         command: command.command,
@@ -11613,11 +11359,7 @@ async function runMemoryFlush(command, io, runtime) {
         io.stdout(JSON.stringify(result, null, 2));
     }
     else {
-        io.stdout([
-            `memory_sync: ${sync.status}`,
-            sync.error ? `error: ${sync.error}` : null,
-            result.next ? `next: ${result.next}` : null,
-        ]
+        io.stdout([`memory_sync: ${sync.status}`, sync.error ? `error: ${sync.error}` : null, result.next ? `next: ${result.next}` : null]
             .filter((line) => Boolean(line))
             .join('\n'));
     }
@@ -11835,7 +11577,6 @@ async function runConnectorsList(command, io, runtime) {
         baseUrl: credentials.baseUrl,
         token: credentials.token,
         fetcher: runtime.fetcher ?? fetch,
-        hostedWorkspaceHint: Boolean((runtime.env ?? process.env).TENDER_RUNTIME_ARTIFACT_ID),
     });
     const connectors = readConnectorArray(payload);
     printConnectorsPayload(command, io, payload, connectors.length > 0
@@ -11888,10 +11629,7 @@ async function runConnectorsShopifySetupUrl(command, io, runtime) {
         token: credentials.token,
         fetcher: runtime.fetcher ?? fetch,
     });
-    printConnectorsPayload(command, io, payload, [
-        `connector_id: ${command.connectorId}`,
-        `setup_url: ${String(payload.setupUrl ?? '')}`,
-    ]);
+    printConnectorsPayload(command, io, payload, [`connector_id: ${command.connectorId}`, `setup_url: ${String(payload.setupUrl ?? '')}`]);
     return 0;
 }
 function readClientSecret(command, runtime) {
@@ -12128,7 +11866,10 @@ merchant-editable settings.
 `;
     return new Map([
         ['extensions/tender-product-survey/README.md', readme],
-        ['extensions/tender-product-survey/package.json', '{\n  "name": "tender-product-survey",\n  "private": true,\n  "version": "0.0.0"\n}\n'],
+        [
+            'extensions/tender-product-survey/package.json',
+            '{\n  "name": "tender-product-survey",\n  "private": true,\n  "version": "0.0.0"\n}\n',
+        ],
         ['extensions/tender-product-survey/shopify.extension.toml', extensionToml],
         ['extensions/tender-product-survey/blocks/product_survey.liquid', blockLiquid],
         ['extensions/tender-product-survey/locales/en.default.json', '{}\n'],
@@ -12220,7 +11961,7 @@ spawned Shopify CLI child process.
 ## Validate
 
 \`\`\`sh
-npx --yes @shopify/cli@latest app config validate --path . --json
+npm exec --yes --package @shopify/cli@latest -- shopify app config validate --path . --json
 \`\`\`
 
 ## Deploy
@@ -12229,16 +11970,10 @@ npx --yes @shopify/cli@latest app config validate --path . --json
 tender connectors shopify source deploy ${input.connectorId} --dir . --confirm deploy --profile account --json
 \`\`\`
 
-Inside the hosted Shopify workspace, commit and push source changes, then
-validate or deploy from the embedded Shopify app's Deploy source action so
-Tender can use the connector's stored App Automation Token server-side. If
-Shopify CLI is already authenticated in the hosted workspace, direct
-\`shopify app config validate\` and \`shopify app deploy\` are allowed. Do not run
-\`tender connectors shopify source validate\` or
-\`tender connectors shopify source deploy\` from hosted workspaces; those
-commands require an account-scoped Tender CLI token. Never ask for Shopify App
-Automation Tokens, client secrets, Tender tokens, or provider keys in the
-terminal.
+Inside Shopify, request source changes in the Custom app editor. Tender
+validates the pushed commit, and the explicit Deploy source action uses the
+connector's stored App Automation Token server-side. Never ask for Shopify App
+Automation Tokens, client secrets, Tender tokens, or provider keys in chat.
 `;
     const files = new Map([
         ['.gitignore', '.shopify/\nnode_modules/\n.env\n.env.*\n'],
@@ -12481,22 +12216,10 @@ async function commitAndPushSourceFiles(input) {
     };
 }
 function shopifyValidateArgs(input) {
-    return [
-        '--yes',
-        '@shopify/cli@latest',
-        'app',
-        'config',
-        'validate',
-        '--path',
-        input.dir,
-        '--json',
-        ...(input.clientId ? ['--client-id', input.clientId] : []),
-    ];
+    return ['app', 'config', 'validate', '--path', input.dir, '--json', ...(input.clientId ? ['--client-id', input.clientId] : [])];
 }
 function shopifyDeployArgs(input) {
     return [
-        '--yes',
-        '@shopify/cli@latest',
         'app',
         'deploy',
         '--path',
@@ -12508,9 +12231,50 @@ function shopifyDeployArgs(input) {
         ...(input.sourceControlUrl ? ['--source-control-url', input.sourceControlUrl] : []),
     ];
 }
+function shopifyCliCommand(args) {
+    return {
+        command: 'npm',
+        args: ['exec', '--yes', '--package', SHOPIFY_CLI_PACKAGE, '--', SHOPIFY_CLI_BIN, ...args],
+    };
+}
+function shopifyCliCommandLine(args) {
+    const invocation = shopifyCliCommand(args);
+    return commandLine(invocation.command, invocation.args);
+}
 function commandLine(command, args) {
     return [command, ...args.map(shellQuote)].join(' ');
 }
+function shouldDropNestedNpmEnv(key) {
+    const normalized = key.toLowerCase();
+    return (normalized === 'init_cwd' ||
+        normalized === 'npm_command' ||
+        normalized === 'npm_config_argv' ||
+        normalized === 'npm_config_call' ||
+        normalized === 'npm_config_package' ||
+        normalized === 'npm_execpath' ||
+        normalized === 'npm_node_execpath' ||
+        normalized.startsWith('npm_lifecycle_') ||
+        normalized.startsWith('npm_package_'));
+}
+function sanitizeNestedNpmEnvironment(env) {
+    const sanitized = {};
+    for (const [key, value] of Object.entries(env)) {
+        if (shouldDropNestedNpmEnv(key)) {
+            continue;
+        }
+        sanitized[key] = value;
+    }
+    return sanitized;
+}
+function shopifyCliChildEnv(runtime, overrides = {}) {
+    return {
+        ...sanitizeNestedNpmEnvironment({
+            ...process.env,
+            ...(runtime.env ?? {}),
+        }),
+        ...overrides,
+    };
+}
 function redactSensitiveText(value, secrets = []) {
     let redacted = value;
     for (const secret of secrets) {
@@ -12524,11 +12288,12 @@ function redactSensitiveText(value, secrets = []) {
         .replace(/\b(authorization\s*[:=]\s*(?:Bearer\s+)?)([^\s'"]+)/gi, '$1[REDACTED]')
         .replace(/\b(x-shopify-access-token\s*[:=]\s*)([^\s'"]+)/gi, '$1[REDACTED]');
 }
-async function runNpxCommand(input) {
+async function runShopifyCliCommand(input) {
     const runner = input.runtime.commandRunner ?? defaultCommandRunner;
-    const result = await runner('npx', input.args, {
+    const invocation = shopifyCliCommand(input.args);
+    const result = await runner(invocation.command, invocation.args, {
         cwd: input.cwd,
-        ...(input.env ? { env: input.env } : {}),
+        env: shopifyCliChildEnv(input.runtime, input.env),
     });
     const redactedResult = {
         ...result,
@@ -12536,12 +12301,13 @@ async function runNpxCommand(input) {
         stderr: redactSensitiveText(result.stderr, input.redactions),
     };
     if (redactedResult.exitCode !== 0) {
-        throw new Error([
-            `npx ${input.args.join(' ')} failed with exit code ${redactedResult.exitCode}.`,
-            redactedResult.stderr.trim() || redactedResult.stdout.trim(),
-        ]
-            .filter(Boolean)
-            .join('\n'));
+        throw new TenderCliChildProcessError({
+            command: invocation.command,
+            args: invocation.args,
+            exitCode: redactedResult.exitCode,
+            stdout: redactedResult.stdout,
+            stderr: redactedResult.stderr,
+        });
     }
     return redactedResult;
 }
@@ -12570,28 +12336,26 @@ function localShopifyDeployToken(runtime) {
     const token = env.SHOPIFY_APP_AUTOMATION_TOKEN;
     return token?.trim() ? token.trim() : null;
 }
-function childShopifyDeployEnv(runtime, token) {
+function childShopifyDeployEnv(_runtime, token) {
     return {
-        ...process.env,
-        ...(runtime.env ?? {}),
         SHOPIFY_APP_AUTOMATION_TOKEN: token,
     };
 }
 function connectorsProfileFlag(command) {
     return command.profileName ? `--profile ${command.profileName}` : '--profile account';
 }
-function shopifyDeployTokenRecoveryMessage(command, reasonCode) {
+function shopifyCliTokenRecoveryMessage(command, reasonCode) {
     const profileFlag = connectorsProfileFlag(command);
     return [
         reasonCode === 'shopify_deploy_token_expired'
             ? 'The connector stored Shopify App Automation Token is expired.'
-            : 'The connector does not have a stored Shopify App Automation Token for source deploys.',
+            : 'The connector does not have a stored Shopify App Automation Token for source validation and deployment.',
         `Store a fresh token: printf "$SHOPIFY_APP_AUTOMATION_TOKEN" | tender connectors shopify app-automation-token set ${command.connectorId} --token-stdin ${profileFlag} --json`,
         `Setup URL: tender connectors shopify setup-url ${command.connectorId} ${profileFlag} --json`,
-        'Fallback: export SHOPIFY_APP_AUTOMATION_TOKEN locally before running source deploy.',
+        'Fallback: export SHOPIFY_APP_AUTOMATION_TOKEN locally before running source validation or deployment.',
     ].join('\n');
 }
-async function resolveShopifyDeployTokenEnvironment(input) {
+async function resolveShopifyCliTokenEnvironment(input) {
     const localToken = localShopifyDeployToken(input.runtime);
     if (localToken) {
         return {
@@ -12604,7 +12368,9 @@ async function resolveShopifyDeployTokenEnvironment(input) {
         const handoff = await fetchShopifyDeployToken({
             connectorId: input.command.connectorId,
             sourceArtifactId: input.sourceArtifactId,
-            version: input.command.version,
+            version: input.command.command === 'connectors shopify source deploy'
+                ? input.command.version
+                : null,
             credentials: input.credentials,
             fetcher: input.fetcher,
         });
@@ -12617,7 +12383,7 @@ async function resolveShopifyDeployTokenEnvironment(input) {
     catch (error) {
         if (error instanceof TenderCliConnectorsApiError &&
             (error.reasonCode === 'shopify_deploy_token_required' || error.reasonCode === 'shopify_deploy_token_expired')) {
-            const recovery = shopifyDeployTokenRecoveryMessage(input.command, error.reasonCode);
+            const recovery = shopifyCliTokenRecoveryMessage(input.command, error.reasonCode);
             throw new TenderCliGuidedUsageError(recovery, recovery);
         }
         throw error;
@@ -12682,8 +12448,15 @@ async function runConnectorsShopifySourceInit(command, io, runtime) {
             sourceCheckout: checkout.sourceCheckout,
             commit: gitCommit,
         },
-        validateCommand: commandLine('npx', shopifyValidateArgs({ dir, clientId: command.clientId })),
-        deployCommand: commandLine('npx', shopifyDeployArgs({ dir, clientId: command.clientId, version: 'connector-source', message: null, sourceControlUrl: null, allowDeletes: false })),
+        validateCommand: shopifyCliCommandLine(shopifyValidateArgs({ dir, clientId: command.clientId })),
+        deployCommand: shopifyCliCommandLine(shopifyDeployArgs({
+            dir,
+            clientId: command.clientId,
+            version: 'connector-source',
+            message: null,
+            sourceControlUrl: null,
+            allowDeletes: false,
+        })),
     };
     printConnectorsPayload(command, io, result, [
         `connector_id: ${command.connectorId}`,
@@ -12731,7 +12504,7 @@ async function runConnectorsShopifySourceCheckout(command, io, runtime) {
     return 0;
 }
 async function runConnectorsShopifySourceValidate(command, io, runtime) {
-    const { connector } = await requestConnector(command, runtime);
+    const { credentials, connector } = await requestConnector(command, runtime);
     const sourceArtifactId = readConnectorSourceArtifactId(connector);
     if (!sourceArtifactId) {
         throw new TenderCliUsageError('Connector does not have a source artifact yet. Run tender connectors shopify source init <connector-id> --dir ./shopify-app first.');
@@ -12745,11 +12518,46 @@ async function runConnectorsShopifySourceValidate(command, io, runtime) {
         }
     }
     if (!command.execute) {
-        printConnectorsPayload(command, io, { ok: true, dryRun: true, command: command.command, connectorId: command.connectorId, sourceArtifactId, dir, shopifyCommand: commandLine('npx', args) }, [`connector_id: ${command.connectorId}`, `source_artifact_id: ${sourceArtifactId}`, `source_dir: ${dir}`, `shopify_command: ${commandLine('npx', args)}`]);
+        printConnectorsPayload(command, io, {
+            ok: true,
+            dryRun: true,
+            command: command.command,
+            connectorId: command.connectorId,
+            sourceArtifactId,
+            dir,
+            shopifyCommand: shopifyCliCommandLine(args),
+        }, [
+            `connector_id: ${command.connectorId}`,
+            `source_artifact_id: ${sourceArtifactId}`,
+            `source_dir: ${dir}`,
+            `shopify_command: ${shopifyCliCommandLine(args)}`,
+        ]);
         return 0;
     }
-    const result = await runNpxCommand({ args, cwd: dir, runtime });
-    printConnectorsPayload(command, io, { ok: true, command: command.command, connectorId: command.connectorId, sourceArtifactId, dir, exitCode: result.exitCode, stdout: result.stdout, stderr: result.stderr }, [`connector_id: ${command.connectorId}`, `source_artifact_id: ${sourceArtifactId}`, `source_dir: ${dir}`, 'validation: passed']);
+    const validationToken = await resolveShopifyCliTokenEnvironment({
+        command,
+        sourceArtifactId,
+        credentials,
+        runtime,
+        fetcher: runtime.fetcher ?? fetch,
+    });
+    const result = await runShopifyCliCommand({
+        args,
+        cwd: dir,
+        runtime,
+        env: validationToken.env,
+        redactions: validationToken.redactions,
+    });
+    printConnectorsPayload(command, io, {
+        ok: true,
+        command: command.command,
+        connectorId: command.connectorId,
+        sourceArtifactId,
+        dir,
+        exitCode: result.exitCode,
+        stdout: result.stdout,
+        stderr: result.stderr,
+    }, [`connector_id: ${command.connectorId}`, `source_artifact_id: ${sourceArtifactId}`, `source_dir: ${dir}`, 'validation: passed']);
     return 0;
 }
 async function runConnectorsShopifySourceDeploy(command, io, runtime) {
@@ -12769,277 +12577,43 @@ async function runConnectorsShopifySourceDeploy(command, io, runtime) {
         allowDeletes: command.allowDeletes,
     });
     if (command.confirm !== 'deploy') {
-        printConnectorsPayload(command, io, { ok: true, dryRun: true, command: command.command, connectorId: command.connectorId, sourceArtifactId, dir, shopifyCommand: commandLine('npx', args), confirmRequired: 'deploy' }, [`connector_id: ${command.connectorId}`, `source_artifact_id: ${sourceArtifactId}`, `source_dir: ${dir}`, `shopify_command: ${commandLine('npx', args)}`, 'confirm_required: --confirm deploy']);
+        printConnectorsPayload(command, io, {
+            ok: true,
+            dryRun: true,
+            command: command.command,
+            connectorId: command.connectorId,
+            sourceArtifactId,
+            dir,
+            shopifyCommand: shopifyCliCommandLine(args),
+            confirmRequired: 'deploy',
+        }, [
+            `connector_id: ${command.connectorId}`,
+            `source_artifact_id: ${sourceArtifactId}`,
+            `source_dir: ${dir}`,
+            `shopify_command: ${shopifyCliCommandLine(args)}`,
+            'confirm_required: --confirm deploy',
+        ]);
         return 0;
     }
-    const deployToken = await resolveShopifyDeployTokenEnvironment({
+    const deployToken = await resolveShopifyCliTokenEnvironment({
         command,
         sourceArtifactId,
         credentials,
         runtime,
         fetcher,
     });
-    const result = await runNpxCommand({ args, cwd: dir, runtime, env: deployToken.env, redactions: deployToken.redactions });
-    printConnectorsPayload(command, io, { ok: true, command: command.command, connectorId: command.connectorId, sourceArtifactId, dir, exitCode: result.exitCode, stdout: result.stdout, stderr: result.stderr }, [`connector_id: ${command.connectorId}`, `source_artifact_id: ${sourceArtifactId}`, `source_dir: ${dir}`, 'deploy: completed']);
-    return 0;
-}
-function shopifyWorkspaceResultKey(command) {
-    return command === 'shopify workspace deploy-source' ? 'deployment' : 'validation';
-}
-function shopifyWorkspaceCommandSucceeded(command, payload) {
-    if (payload.ok !== true) {
-        return false;
-    }
-    const result = payload[shopifyWorkspaceResultKey(command.command)];
-    if (result && typeof result === 'object' && !Array.isArray(result)) {
-        const ok = result.ok;
-        return ok !== false;
-    }
-    return true;
-}
-function shopifyWorkspaceTextLines(command, payload) {
-    const connector = payload.connector && typeof payload.connector === 'object' && !Array.isArray(payload.connector)
-        ? payload.connector
-        : {};
-    const source = payload.source && typeof payload.source === 'object' && !Array.isArray(payload.source)
-        ? payload.source
-        : {};
-    const result = payload[shopifyWorkspaceResultKey(command.command)];
-    const resultRecord = result && typeof result === 'object' && !Array.isArray(result)
-        ? result
-        : {};
-    const succeeded = shopifyWorkspaceCommandSucceeded(command, payload);
-    const verb = command.command === 'shopify workspace deploy-source' ? 'deploy' : 'validate';
-    return [
-        `${verb}: ${succeeded ? 'completed' : 'failed'}`,
-        `connector_id: ${String(connector.connectorId ?? '')}`,
-        `source_artifact_id: ${String(source.sourceArtifactId ?? '')}`,
-        ...(payload.reasonCode ? [`reason: ${String(payload.reasonCode)}`] : []),
-        ...(resultRecord.exitCode !== undefined ? [`exit_code: ${String(resultRecord.exitCode)}`] : []),
-        ...(resultRecord.stderr ? [`stderr: ${String(resultRecord.stderr).trim()}`] : []),
-    ].filter((line) => !line.endsWith(': '));
-}
-function readShopifyWorkspaceRuntimeIdentity(runtime) {
-    const env = runtime.env ?? process.env;
-    const baseUrl = normalizeHostedWorkspaceBaseUrl(env.TENDER_BASE_URL);
-    if (!baseUrl) {
-        throw new TenderCliUsageError('TENDER_BASE_URL is required. Open or reload the hosted Shopify workspace and run this command inside its terminal.');
-    }
-    if (!isHostedWorkspaceInternalApiBaseUrl(baseUrl)) {
-        throw new TenderCliUsageError('TENDER_BASE_URL must be http://tender-api.tender.test inside a hosted Shopify workspace. Reload the workspace terminal and try again.');
-    }
-    const runtimeArtifactId = readHostedWorkspaceArtifactId(env.TENDER_RUNTIME_ARTIFACT_ID);
-    if (!runtimeArtifactId) {
-        throw new TenderCliUsageError('TENDER_RUNTIME_ARTIFACT_ID is required. This command only runs inside a hosted Shopify project workspace.');
-    }
-    return { baseUrl, runtimeArtifactId };
-}
-function readShopifyWorkspaceConnectorRecords(payload) {
-    return Array.isArray(payload.connectors)
-        ? payload.connectors.filter((connector) => Boolean(connector) && typeof connector === 'object' && !Array.isArray(connector))
-        : [];
-}
-function readShopifyWorkspaceConnectorSourceArtifactId(connector) {
-    const sourceProject = connector.sourceProject && typeof connector.sourceProject === 'object' && !Array.isArray(connector.sourceProject)
-        ? connector.sourceProject
-        : null;
-    return readHostedWorkspaceArtifactId(typeof sourceProject?.sourceArtifactId === 'string' ? sourceProject.sourceArtifactId : undefined);
-}
-function resolveShopifyWorkspaceSourceCommandConnector(input) {
-    const connectors = readShopifyWorkspaceConnectorRecords(input.payload);
-    const connector = input.selectedConnectorId
-        ? connectors.find((candidate) => candidate.connectorId === input.selectedConnectorId) ?? null
-        : (() => {
-            const linked = connectors.filter((candidate) => candidate.linked === true);
-            return linked.length === 1 ? linked[0] ?? null : null;
-        })();
-    if (!connector) {
-        return {
-            ok: false,
-            payload: {
-                ok: false,
-                reasonCode: input.selectedConnectorId
-                    ? 'shopify_workspace_selected_connector_not_found'
-                    : 'shopify_workspace_connector_selection_required',
-                message: input.selectedConnectorId
-                    ? 'The selected Shopify connector is no longer available to this workspace.'
-                    : 'Link this runtime to one Shopify connector before validating or deploying source.',
-            },
-        };
-    }
-    const connectorId = typeof connector.connectorId === 'string' ? connector.connectorId : null;
-    const sourceArtifactId = readShopifyWorkspaceConnectorSourceArtifactId(connector);
-    if (!connectorId || !sourceArtifactId) {
-        return {
-            ok: false,
-            payload: {
-                ok: false,
-                reasonCode: 'shopify_source_project_required',
-                message: 'The selected Shopify connector does not have a source project.',
-            },
-        };
-    }
-    return {
+    const result = await runShopifyCliCommand({ args, cwd: dir, runtime, env: deployToken.env, redactions: deployToken.redactions });
+    printConnectorsPayload(command, io, {
         ok: true,
-        connectorId,
-        sourceArtifactId,
-    };
-}
-async function runShopifyWorkspaceSourceCommand(command, io, runtime) {
-    const { baseUrl, runtimeArtifactId } = readShopifyWorkspaceRuntimeIdentity(runtime);
-    const selectedConnectorId = await readHostedWorkspaceConnectorSelection(runtimeArtifactId, runtime);
-    const connectorsResult = await requestShopifyWorkspaceConnectorsList({
-        baseUrl,
-        runtimeArtifactId,
-        fetcher: runtime.fetcher ?? fetch,
-    });
-    if (!shopifyWorkspaceRequestSucceeded(connectorsResult)) {
-        const payload = {
-            ...connectorsResult.payload,
-            command: command.command,
-            runtimeArtifactId,
-            ...(selectedConnectorId ? { selectedConnectorId } : {}),
-        };
-        if (command.json) {
-            io.stdout(JSON.stringify(payload, null, 2));
-        }
-        else {
-            io.stdout(shopifyWorkspaceTextLines(command, payload).join('\n'));
-        }
-        return 1;
-    }
-    const resolvedConnector = resolveShopifyWorkspaceSourceCommandConnector({
-        payload: connectorsResult.payload,
-        selectedConnectorId,
-    });
-    if (!resolvedConnector.ok) {
-        const payload = {
-            ...resolvedConnector.payload,
-            command: command.command,
-            runtimeArtifactId,
-            ...(selectedConnectorId ? { selectedConnectorId } : {}),
-        };
-        if (command.json) {
-            io.stdout(JSON.stringify(payload, null, 2));
-        }
-        else {
-            io.stdout(shopifyWorkspaceTextLines(command, payload).join('\n'));
-        }
-        return 1;
-    }
-    const result = await requestShopifyWorkspaceSourceCommand({
-        command: command.command,
-        baseUrl,
-        runtimeArtifactId,
-        fetcher: runtime.fetcher ?? fetch,
-        connectorId: resolvedConnector.connectorId,
-        sourceArtifactId: resolvedConnector.sourceArtifactId,
-    });
-    const payload = {
-        ...result.payload,
         command: command.command,
-        runtimeArtifactId,
-        selectedConnectorId: resolvedConnector.connectorId,
-    };
-    if (command.json) {
-        io.stdout(JSON.stringify(payload, null, 2));
-    }
-    else {
-        io.stdout(shopifyWorkspaceTextLines(command, payload).join('\n'));
-    }
-    return shopifyWorkspaceCommandSucceeded(command, payload) ? 0 : 1;
-}
-function shopifyWorkspaceRequestSucceeded(result) {
-    return result.status >= 200 && result.status < 300 && result.payload.ok !== false;
-}
-function shopifyWorkspaceConnectorListTextLines(payload) {
-    const connectors = readShopifyWorkspaceConnectorRecords(payload);
-    const lines = [
-        `runtime_artifact_id: ${String(payload.runtimeArtifactId ?? '')}`,
-        `shop_domain: ${String(payload.shopDomain ?? '')}`,
-        `connectors: ${connectors.length}`,
-    ];
-    for (const connector of connectors) {
-        lines.push([
-            String(connector.connectorId ?? ''),
-            String(connector.label ?? connector.appName ?? ''),
-            connector.linked ? 'linked' : 'not_linked',
-            connector.ready ? 'ready' : 'needs_setup',
-        ]
-            .filter(Boolean)
-            .join(' | '));
-    }
-    if (typeof payload.reasonCode === 'string') {
-        lines.push(`reason: ${payload.reasonCode}`);
-    }
-    return lines.filter((line) => !line.endsWith(': '));
-}
-function shopifyWorkspaceLinkRuntimeTextLines(payload) {
-    const connector = payload.connector && typeof payload.connector === 'object' && !Array.isArray(payload.connector)
-        ? payload.connector
-        : {};
-    const source = payload.source && typeof payload.source === 'object' && !Array.isArray(payload.source)
-        ? payload.source
-        : {};
-    const workspace = payload.workspace && typeof payload.workspace === 'object' && !Array.isArray(payload.workspace)
-        ? payload.workspace
-        : {};
-    return [
-        `link: ${payload.ok === false ? 'failed' : 'created'}`,
-        `runtime_artifact_id: ${String(payload.runtimeArtifactId ?? '')}`,
-        `connector_id: ${String(connector.connectorId ?? '')}`,
-        `source_artifact_id: ${String(source.sourceArtifactId ?? '')}`,
-        workspace.reloadRequired ? 'next: reload the hosted workspace to mount /workspace/shopify-connector' : '',
-        ...(payload.reasonCode ? [`reason: ${String(payload.reasonCode)}`] : []),
-    ].filter(Boolean);
-}
-async function runShopifyWorkspaceConnectorsList(command, io, runtime) {
-    const { baseUrl, runtimeArtifactId } = readShopifyWorkspaceRuntimeIdentity(runtime);
-    const result = await requestShopifyWorkspaceConnectorsList({
-        baseUrl,
-        runtimeArtifactId,
-        fetcher: runtime.fetcher ?? fetch,
-    });
-    const payload = {
-        ...result.payload,
-        command: command.command,
-        runtimeArtifactId,
-    };
-    if (command.json) {
-        io.stdout(JSON.stringify(payload, null, 2));
-    }
-    else {
-        io.stdout(shopifyWorkspaceConnectorListTextLines(payload).join('\n'));
-    }
-    return shopifyWorkspaceRequestSucceeded(result) ? 0 : 1;
-}
-async function runShopifyWorkspaceLinkRuntime(command, io, runtime) {
-    const { baseUrl, runtimeArtifactId } = readShopifyWorkspaceRuntimeIdentity(runtime);
-    const result = await requestShopifyWorkspaceLinkRuntime({
-        baseUrl,
-        runtimeArtifactId,
-        connectorId: command.connectorId,
-        fetcher: runtime.fetcher ?? fetch,
-    });
-    if (shopifyWorkspaceRequestSucceeded(result)) {
-        await writeHostedWorkspaceConnectorSelection({
-            runtimeArtifactId,
-            connectorId: command.connectorId,
-        }, runtime);
-    }
-    const payload = {
-        ...result.payload,
-        command: command.command,
-        runtimeArtifactId,
         connectorId: command.connectorId,
-    };
-    if (command.json) {
-        io.stdout(JSON.stringify(payload, null, 2));
-    }
-    else {
-        io.stdout(shopifyWorkspaceLinkRuntimeTextLines(payload).join('\n'));
-    }
-    return shopifyWorkspaceRequestSucceeded(result) ? 0 : 1;
+        sourceArtifactId,
+        dir,
+        exitCode: result.exitCode,
+        stdout: result.stdout,
+        stderr: result.stderr,
+    }, [`connector_id: ${command.connectorId}`, `source_artifact_id: ${sourceArtifactId}`, `source_dir: ${dir}`, 'deploy: completed']);
+    return 0;
 }
 async function runConnectorsShopifyDelete(command, io, runtime) {
     if (command.confirm !== 'delete') {
@@ -13053,7 +12627,10 @@ async function runConnectorsShopifyDelete(command, io, runtime) {
         token: credentials.token,
         fetcher: runtime.fetcher ?? fetch,
     });
-    printConnectorsPayload(command, io, { ...payload, connectorId: command.connectorId }, [`connector_id: ${command.connectorId}`, 'status: deleted']);
+    printConnectorsPayload(command, io, { ...payload, connectorId: command.connectorId }, [
+        `connector_id: ${command.connectorId}`,
+        'status: deleted',
+    ]);
     return 0;
 }
 function runConnectorsBind(command, io) {
@@ -13880,6 +13457,9 @@ function cliErrorMessage(error) {
     return String(error);
 }
 function cliErrorCode(error) {
+    if (error instanceof TenderCliChildProcessError) {
+        return 'child_process_failed';
+    }
     if (error instanceof TenderCliDbApiError || error instanceof TenderCliAnalyticsApiError || error instanceof TenderCliConnectorsApiError) {
         return error.reasonCode;
     }
@@ -13967,6 +13547,16 @@ function cliErrorPayload(error, args, command) {
     const scope = scopeForError(error, args, command);
     const example = exampleForError(error, args, command);
     const nextAction = nextActionForError(error);
+    const childProcess = error instanceof TenderCliChildProcessError
+        ? {
+            command: error.command,
+            args: error.args,
+            commandLine: commandLine(error.command, error.args),
+            exitCode: error.exitCode,
+            stdout: error.stdout,
+            stderr: error.stderr,
+        }
+        : null;
     return {
         ok: false,
         command: commandNameForError(args, command),
@@ -13975,6 +13565,7 @@ function cliErrorPayload(error, args, command) {
         ...(scope ? { scope } : {}),
         ...(nextAction ? { nextAction } : {}),
         ...(example ? { example } : {}),
+        ...(childProcess ? { childProcess } : {}),
     };
 }
 export async function runTenderCli(args, io = {
@@ -14078,14 +13669,6 @@ export async function runTenderCli(args, io = {
             else if (command.topic === 'connectors bind') {
                 io.stdout(connectorsBindHelp());
             }
-            else if (command.topic === 'shopify' ||
-                command.topic === 'shopify workspace' ||
-                command.topic === 'shopify workspace connectors list' ||
-                command.topic === 'shopify workspace link-runtime' ||
-                command.topic === 'shopify workspace validate-source' ||
-                command.topic === 'shopify workspace deploy-source') {
-                io.stdout(shopifyWorkspaceHelp());
-            }
             else if (command.topic === 'auth') {
                 io.stdout(authHelp());
             }
@@ -14346,15 +13929,6 @@ export async function runTenderCli(args, io = {
         if (command.command === 'connectors shopify source deploy') {
             return await runConnectorsShopifySourceDeploy(command, io, runtime);
         }
-        if (command.command === 'shopify workspace validate-source' || command.command === 'shopify workspace deploy-source') {
-            return await runShopifyWorkspaceSourceCommand(command, io, runtime);
-        }
-        if (command.command === 'shopify workspace connectors list') {
-            return await runShopifyWorkspaceConnectorsList(command, io, runtime);
-        }
-        if (command.command === 'shopify workspace link-runtime') {
-            return await runShopifyWorkspaceLinkRuntime(command, io, runtime);
-        }
         if (command.command === 'connectors shopify delete') {
             return await runConnectorsShopifyDelete(command, io, runtime);
         }
@@ -14527,7 +14101,10 @@ export async function runTenderCli(args, io = {
     }
     catch (error) {
         if (args.includes('--json') &&
-            ((args[0] === 'app' && (args[1] === 'db' || (args[1] === 'agent' && args[2] === 'heartbeat'))) || args[0] === 'playbooks' || args[0] === 'connectors' || args[0] === 'shopify')) {
+            ((args[0] === 'app' && (args[1] === 'db' || (args[1] === 'agent' && args[2] === 'heartbeat'))) ||
+                args[0] === 'playbooks' ||
+                args[0] === 'connectors' ||
+                args[0] === 'shopify')) {
             io.stdout(JSON.stringify(cliErrorPayload(error, args, command), null, 2));
             return error instanceof TenderCliUsageError ? 2 : 1;
         }