@tenderprompt/cli 0.1.35 → 0.1.37

package/dist/index.js

@@ -1,5 +1,6 @@
 #!/usr/bin/env node
 import { spawn } from 'node:child_process';
+import { createHash } from 'node:crypto';
 import { readFileSync } from 'node:fs';
 import { mkdir, readFile, rename, writeFile } from 'node:fs/promises';
 import os from 'node:os';
@@ -164,6 +165,12 @@ class TenderCliChildProcessError extends Error {
         this.stderr = input.stderr;
     }
 }
+class TenderCliDependencyInstallError extends TenderCliChildProcessError {
+    constructor(input) {
+        super(input);
+        this.name = 'TenderCliDependencyInstallError';
+    }
+}
 const DEFAULT_PROFILE_NAME = 'default';
 const DEFAULT_BASE_URL = 'https://app.tenderprompt.com';
 const ARTIFACT_SOURCE_EXPORT_MAX_FILES = 1000;
@@ -199,12 +206,6 @@ Commands:
   tender connectors shopify verify
                              Exchange credentials for an Admin API access token
   tender connectors bind     Print an app.json binding for a connector instance
-  tender shopify workspace connectors list
-                             List current-store Shopify connectors from a hosted workspace
-  tender shopify workspace link-runtime --connector <connector-id>
-                             Link the hosted runtime to a Shopify connector
-  tender shopify workspace deploy-source
-                             Deploy linked Shopify source from a hosted workspace
   tender app list            List Tender App records visible to the current token
   tender app create --name <name>
                              Create a new Tender App in the current account
@@ -282,9 +283,6 @@ Examples:
   printf "$SHOPIFY_APP_AUTOMATION_TOKEN" | tender connectors shopify app-automation-token set conn_123 --token-stdin --expires-at 2026-08-22 --profile account --json
   tender connectors shopify verify conn_123 --profile account --json
   tender connectors bind SHOPIFY_CONNECTOR conn_123 --instance default --json
-  tender shopify workspace connectors list --json
-  tender shopify workspace link-runtime --connector conn_123 --json
-  tender shopify workspace deploy-source --json
   tender app list --json
   tender app create --name "Exit Intent Widget" --json
   tender app create --name "Data Collection App" --init --dir ./data-collection-app --preview --json
@@ -499,33 +497,6 @@ Examples:
   tender connectors shopify source deploy conn_123 --dir ./shopify-app --confirm deploy --profile account --json
 	  tender connectors bind SHOPIFY_CONNECTOR conn_123 --instance default --json`;
 }
-function shopifyWorkspaceHelp() {
-    return `Usage: tender shopify workspace <command> [--json]
-
-Hosted Shopify workspace commands use the current terminal workspace identity.
-They do not read Tender profiles, account-scoped tokens, Shopify client secrets,
-or Shopify App Automation Tokens from the terminal.
-
-Commands:
-  tender shopify workspace connectors list
-                             List current-store Shopify connectors available to this runtime
-  tender shopify workspace link-runtime --connector <connector-id>
-                             Link this runtime to a Shopify connector source project
-  tender shopify workspace validate-source
-                             Validate the linked Shopify connector source
-  tender shopify workspace deploy-source
-                             Deploy the linked Shopify connector source
-
-Required environment:
-  TENDER_BASE_URL
-  TENDER_RUNTIME_ARTIFACT_ID
-
-Examples:
-  tender shopify workspace connectors list --json
-  tender shopify workspace link-runtime --connector conn_123 --json
-  tender shopify workspace validate-source --json
-  tender shopify workspace deploy-source --json`;
-}
 function connectorsShopifyCreateHelp() {
     return `Usage: tender connectors shopify create [--instance <id>] [--label <text>] [--app-name <text>] [--admin-api-version <version>] [--shop <myshopify-domain>] [--base-url <url>] [--token <token>] [--profile <name>] [--json]
 
@@ -611,7 +582,10 @@ function connectorsShopifySourceValidateHelp() {
     return `Usage: tender connectors shopify source validate <connector-id> [--dir <path>] [--client-id <shopify-client-id>] [--execute] [--base-url <url>] [--token <token>] [--profile <name>] [--json]
 
 Without --execute, prints the exact Shopify CLI validation command. With
-the --execute flag, runs npm exec --yes --package @shopify/cli@latest -- shopify app config validate with npm lifecycle environment variables scrubbed.
+the --execute flag, runs npm exec --yes --package @shopify/cli@latest -- shopify app config validate with npm lifecycle environment variables scrubbed. If
+SHOPIFY_APP_AUTOMATION_TOKEN is not set locally, the CLI requests the
+connector's stored App Automation Token and injects it only into the spawned
+Shopify CLI child process.
 
 Examples:
   tender connectors shopify source validate conn_123 --dir ./shopify-app --execute --json`;
@@ -625,12 +599,9 @@ SHOPIFY_APP_AUTOMATION_TOKEN is not set locally, the CLI requests the
 connector's stored App Automation Token and injects it only into the spawned
 Shopify CLI child process.
 
-Inside hosted Shopify project workspaces, direct shopify app deploy is allowed
-when Shopify CLI is already authenticated there. Otherwise use
-tender shopify workspace deploy-source so Tender can use the connector's
-stored App Automation Token server-side. Do not run this account-scoped command
-with a hosted workspace artifact token. Never ask the merchant to paste token
-material into the terminal.
+Inside the Shopify app, deploy connector source with the explicit **Deploy
+source** action after the chat editor validates the pushed commit. Never ask the
+merchant to paste token material into chat or a terminal.
 
 Examples:
   tender connectors shopify source deploy conn_123 --dir ./shopify-app --version connector-source-smoke --confirm deploy --profile account --json`;
@@ -1008,7 +979,8 @@ function analyticsChartsTemplatesHelp() {
 
 Print reusable chart spec templates for agents. Adapt templates to observed
 events, paths, and property keys from analytics capabilities before querying or
-saving.
+saving. The hourly_dimension_breakdown_24h template documents the bounded
+hour-by-property operator report.
 
 Examples:
   tender app analytics charts templates --json`;
@@ -1655,7 +1627,6 @@ function tenderCliCapabilities() {
                 'tender app outbound-auth --help',
                 'tender connectors --help',
                 'tender connectors shopify source init --help',
-                'tender shopify workspace --help',
             ],
         },
         workflows: [
@@ -1700,36 +1671,6 @@ function tenderCliCapabilities() {
                     'Fetch shopify-connector-customer-metadata-widget when the requested job involves customer metafields, metaobjects, or profile writes.',
                 ],
             },
-            {
-                name: 'hosted_shopify_project_release',
-                when: 'Inside a hosted Shopify project workspace after editing a runtime app and linked Shopify connector source, or when the merchant asks to deploy/release/publish the Shopify connector.',
-                commands: [
-                    'tender shopify workspace connectors list --json',
-                    'tender shopify workspace link-runtime --connector <connector-id> --json',
-                    'cd /workspace/runtime-project && git push origin HEAD:main',
-                    'cd /workspace/runtime-project && commit=$(git rev-parse HEAD) && tender app publish "$TENDER_RUNTIME_ARTIFACT_ID" --commit "$commit" --confirm publish --stream --json',
-                    'cd /workspace/shopify-connector && git push origin HEAD:main',
-                    'cd /workspace/shopify-connector && tender shopify workspace validate-source --json',
-                    'cd /workspace/shopify-connector && tender shopify workspace deploy-source --json',
-                ],
-                notes: [
-                    'If /workspace/shopify-connector is missing, list connectors, link the selected connector, then continue in /workspace/shopify-connector unless link-runtime explicitly returns reloadRequired:true.',
-                    'For connector selection or switching, use tender shopify workspace connectors list --json and tender shopify workspace link-runtime --connector <connector-id> --json; do not use tender connectors list or ask for a Shopify Client ID.',
-                    'When selecting by merchant-provided Shopify app name, prefer an exact normalized label/appName match before any partial match; do not choose a longer connector name that merely contains the requested name.',
-                    'After link-runtime succeeds, tender shopify workspace validate-source and deploy-source automatically use that selected connector.',
-                    'For a deploy-only connector request, skip npm install, npm run check, tender app doctor, and other runtime-project checks; run cd /workspace/shopify-connector && tender shopify workspace deploy-source --json.',
-                    'For a validate-only connector request, run cd /workspace/shopify-connector && tender shopify workspace validate-source --json.',
-                    'Only run runtime-project checks when the merchant asks to change, validate, preview, or publish the runtime app.',
-                    'Publish the Tender runtime first and use the pinned runtime URL from publish JSON to update the linked connector source before deploying Shopify.',
-                    'Use TENDER_SHOPIFY_CONNECTOR_ID or connector.json for Tender connector commands; shopify.app.toml contains the Shopify client_id, not the Tender connector identity.',
-                    'Do not run tender connectors shopify source validate or tender connectors shopify source deploy from hosted workspaces; those commands require an account-scoped Tender CLI token.',
-                    'Use tender shopify workspace validate-source and deploy-source so the connector stored App Automation Token stays server-side.',
-                    'If Shopify CLI is already authenticated in the hosted workspace, direct shopify app config validate and shopify app deploy are allowed.',
-                    'Never ask for Shopify App Automation Tokens, client secrets, Tender tokens, or provider keys in the terminal.',
-                    'Do not release by pushing Git tags; Tender runtime publish plus tender shopify workspace deploy-source are the release path.',
-                    'If tender shopify workspace deploy-source reports a missing or expired App Automation Token, stop and ask the merchant to refresh the Custom App automation token in Tender.',
-                ],
-            },
             {
                 name: 'create_new_app_with_preview',
                 when: 'When the user wants a new Tender App that is immediately visible.',
@@ -2127,6 +2068,25 @@ function normalizeBaseUrl(value) {
 function readDefaultBaseUrl(env) {
     return normalizeBaseUrl(env.TENDER_BASE_URL ?? DEFAULT_BASE_URL);
 }
+function readDefaultShopifyApprovalContext(env) {
+    const shopifyAppUrl = env.TENDER_SHOPIFY_APP_URL?.trim();
+    if (shopifyAppUrl) {
+        const parsed = parseShopifyAppUrl(shopifyAppUrl, 'TENDER_SHOPIFY_APP_URL');
+        return {
+            shopifyAppUrl: parsed.appUrl,
+            shopifyStore: parsed.store,
+        };
+    }
+    const shopifyStore = env.TENDER_SHOPIFY_STORE?.trim();
+    if (shopifyStore) {
+        const store = parseShopifyStoreHandle(shopifyStore, 'TENDER_SHOPIFY_STORE');
+        return {
+            shopifyAppUrl: shopifyAppUrlForStore(store),
+            shopifyStore: store,
+        };
+    }
+    return null;
+}
 function readConfigPath(env) {
     return env.TENDER_CONFIG ? path.resolve(env.TENDER_CONFIG) : path.join(os.homedir(), '.tender', 'config.json');
 }
@@ -2318,17 +2278,6 @@ async function resolveApiCredentials(input) {
     };
 }
 async function resolveLifecycleApiCredentials(input) {
-    const baseUrl = normalizeBaseUrl(input.baseUrl ?? input.env.TENDER_BASE_URL ?? DEFAULT_BASE_URL);
-    if (!input.flagToken &&
-        !input.profileName &&
-        isHostedWorkspaceInternalApiBaseUrl(baseUrl)) {
-        return {
-            baseUrl,
-            token: null,
-            source: 'hosted-workspace',
-            profileName: null,
-        };
-    }
     return await resolveApiCredentials(input);
 }
 function apiHeadersForCredentials(input) {
@@ -4036,59 +3985,18 @@ function parseConnectorsShopifySourceDeployArgs(args) {
         }
         throw new TenderCliUsageError(`Unknown connectors shopify source deploy option: ${arg}`);
     }
-    return { command: 'connectors shopify source deploy', connectorId, dir, clientId, version, message, sourceControlUrl, allowDeletes, confirm, ...parsed };
-}
-function parseShopifyWorkspaceSourceArgs(args, command) {
-    if (args.includes('--help') || args.includes('-h')) {
-        return { command: 'help', topic: command };
-    }
-    let json = false;
-    for (const arg of args) {
-        if (arg === '--json') {
-            json = true;
-            continue;
-        }
-        throw new TenderCliUsageError(`Unknown ${command} option: ${arg}`);
-    }
-    return { command, json };
-}
-function parseShopifyWorkspaceConnectorsListArgs(args) {
-    if (args.includes('--help') || args.includes('-h')) {
-        return { command: 'help', topic: 'shopify workspace connectors list' };
-    }
-    let json = false;
-    for (const arg of args) {
-        if (arg === '--json') {
-            json = true;
-            continue;
-        }
-        throw new TenderCliUsageError(`Unknown shopify workspace connectors list option: ${arg}`);
-    }
-    return { command: 'shopify workspace connectors list', json };
-}
-function parseShopifyWorkspaceLinkRuntimeArgs(args) {
-    if (args.includes('--help') || args.includes('-h')) {
-        return { command: 'help', topic: 'shopify workspace link-runtime' };
-    }
-    let connectorId = null;
-    let json = false;
-    for (let index = 0; index < args.length; index += 1) {
-        const arg = args[index];
-        if (arg === '--json') {
-            json = true;
-            continue;
-        }
-        if (arg === '--connector') {
-            connectorId = parseConnectorId(parseRequiredFlagValue(args[index + 1], '--connector'), 'tender shopify workspace link-runtime --connector conn_123 --json');
-            index += 1;
-            continue;
-        }
-        throw new TenderCliUsageError(`Unknown shopify workspace link-runtime option: ${arg}`);
-    }
-    if (!connectorId) {
-        throw new TenderCliUsageError('--connector is required. Example: tender shopify workspace link-runtime --connector conn_123 --json');
-    }
-    return { command: 'shopify workspace link-runtime', connectorId, json };
+    return {
+        command: 'connectors shopify source deploy',
+        connectorId,
+        dir,
+        clientId,
+        version,
+        message,
+        sourceControlUrl,
+        allowDeletes,
+        confirm,
+        ...parsed,
+    };
 }
 function parseConnectorsShopifyDeleteArgs(args) {
     if (args.includes('--help') || args.includes('-h')) {
@@ -5614,6 +5522,10 @@ function analyticsAuthoringContract() {
             },
         ],
         charting: {
+            contractDiscovery: {
+                capabilities: 'tender app analytics capabilities <app-id> --include-catalog --json',
+                templates: 'tender app analytics charts templates --json',
+            },
             starterDashboardCommands: ANALYTICS_AGENT_GUIDANCE.starterDashboardCommands,
             completionProof: ANALYTICS_AGENT_GUIDANCE.dashboardCompletion.proofCommand,
             unitFunnel: 'After traffic exists, use tender app analytics capabilities <app-id> --include-catalog --json and create version 2 unit_step_count funnel specs from observedFlows and observedUnitTypes.',
@@ -5851,6 +5763,33 @@ function analyticsChartTemplates() {
                 limit: 10,
             },
         },
+        {
+            id: 'hourly_dimension_breakdown_24h',
+            title: 'Hourly dimension breakdown (24h)',
+            visualization: 'table',
+            purpose: 'Compare one low-cardinality promoted dimension by hour over the last 24 hours.',
+            usableAsIs: false,
+            placeholders: {
+                eventName: '<event_name>',
+                property: '<queryable_dimension_property>',
+            },
+            adaptWith: [
+                'Replace both placeholders with one observed custom event and one active dimension property for that event.',
+                'Use only non-sensitive categorical dimensions with at most 16 observed values.',
+                'Keep the 24h range, hour-first grouping order, table visualization, custom_event_count metric, and 400-row limit unchanged.',
+            ],
+            spec: {
+                version: 1,
+                dataset: 'events',
+                visualization: 'table',
+                metric: { name: 'custom_event_count' },
+                groupBy: [{ field: 'hour' }, { field: 'property:<queryable_dimension_property>' }],
+                filters: [{ field: 'event_name', op: '=', value: '<event_name>' }],
+                range: { preset: '24h' },
+                sort: [{ field: 'hour', direction: 'asc' }],
+                limit: 400,
+            },
+        },
         {
             id: 'experiment_readout',
             title: 'Experiment readout',
@@ -5871,10 +5810,7 @@ function analyticsChartTemplates() {
                 dataset: 'events',
                 visualization: 'table',
                 metric: { name: 'custom_event_count' },
-                groupBy: [
-                    { field: 'event_name' },
-                    { field: 'property:experiment_variant' },
-                ],
+                groupBy: [{ field: 'event_name' }, { field: 'property:experiment_variant' }],
                 filters: [
                     {
                         field: 'event_name',
@@ -7185,30 +7121,6 @@ function parseTenderArgs(args) {
         }
         throw new TenderCliUsageError(`Unknown connectors command: ${args[1]}`);
     }
-    if (args[0] === 'shopify') {
-        if (args[1] === undefined || args[1] === '--help' || args[1] === '-h') {
-            return { command: 'help', topic: 'shopify' };
-        }
-        if (args[1] === 'workspace') {
-            if (args[2] === undefined || args[2] === '--help' || args[2] === '-h') {
-                return { command: 'help', topic: 'shopify workspace' };
-            }
-            if (args[2] === 'connectors' && args[3] === 'list') {
-                return parseShopifyWorkspaceConnectorsListArgs(args.slice(4));
-            }
-            if (args[2] === 'link-runtime') {
-                return parseShopifyWorkspaceLinkRuntimeArgs(args.slice(3));
-            }
-            if (args[2] === 'validate-source') {
-                return parseShopifyWorkspaceSourceArgs(args.slice(3), 'shopify workspace validate-source');
-            }
-            if (args[2] === 'deploy-source') {
-                return parseShopifyWorkspaceSourceArgs(args.slice(3), 'shopify workspace deploy-source');
-            }
-            throw new TenderCliUsageError(`Unknown shopify workspace command: ${args[2]}`);
-        }
-        throw new TenderCliUsageError(`Unknown shopify command: ${args[1]}`);
-    }
     if (args[0] === 'apps') {
         throw new TenderCliUsageError('Unknown command: apps. Use `tender app ...` for Tender App workflows.');
     }
@@ -7274,7 +7186,8 @@ function parseTenderArgs(args) {
         if (resourceArgs[1] === 'bindings' && (resourceArgs[2] === undefined || resourceArgs[2] === '--help' || resourceArgs[2] === '-h')) {
             return { command: 'help', topic: 'app bindings outbound' };
         }
-        if (resourceArgs[1] === 'outbound-auth' && (resourceArgs[2] === undefined || resourceArgs[2] === '--help' || resourceArgs[2] === '-h')) {
+        if (resourceArgs[1] === 'outbound-auth' &&
+            (resourceArgs[2] === undefined || resourceArgs[2] === '--help' || resourceArgs[2] === '-h')) {
             return { command: 'help', topic: 'app outbound-auth' };
         }
         if (resourceArgs[1] === 'outbound-auth' && resourceArgs[2] === 'list') {
@@ -7884,12 +7797,7 @@ async function requestAppDbDashboardApi(input) {
             (typeof payload?.reasonCode === 'string' && payload.reasonCode) ||
             `App database dashboard request failed with HTTP ${response.status}.`;
         const example = appDbDashboardCorrectedExample(input.artifactId, input.path);
-        throw new TenderCliDbApiError([
-            message,
-            `Scope: artifact ${input.artifactId}, app-db-dashboards.`,
-            `Reason: ${reasonCode}.`,
-            `Example: ${example}.`,
-        ].join('\n'), reasonCode, {
+        throw new TenderCliDbApiError([message, `Scope: artifact ${input.artifactId}, app-db-dashboards.`, `Reason: ${reasonCode}.`, `Example: ${example}.`].join('\n'), reasonCode, {
             artifactId: input.artifactId,
             surface: 'db/dashboards',
         }, example);
@@ -7945,189 +7853,13 @@ async function requestConnectorsApi(input) {
         const message = (typeof payload?.message === 'string' && payload.message) ||
             (typeof payload?.reasonCode === 'string' && payload.reasonCode) ||
             `Connector request failed with HTTP ${response.status}.`;
-        const example = input.hostedWorkspaceHint && reasonCode === 'account_scope_required'
-            ? 'Hosted workspace example: tender shopify workspace connectors list --json.'
-            : 'Example: tender connectors list --profile account --json.';
-        throw new TenderCliConnectorsApiError([message, `Reason: ${reasonCode}.`, example].join('\n'), reasonCode, response.status, payload ?? null, example.replace(/^Example:\s*/i, '').replace(/^Hosted workspace example:\s*/i, '').replace(/\.$/, ''));
+        const example = 'Example: tender connectors list --profile account --json.';
+        throw new TenderCliConnectorsApiError([message, `Reason: ${reasonCode}.`, example].join('\n'), reasonCode, response.status, payload ?? null, example
+            .replace(/^Example:\s*/i, '')
+            .replace(/\.$/, ''));
     }
     return payload;
 }
-function normalizeHostedWorkspaceBaseUrl(value) {
-    const baseUrl = value?.trim().replace(/\/+$/, '') ?? '';
-    if (!baseUrl) {
-        return null;
-    }
-    try {
-        const url = new URL(baseUrl);
-        return url.protocol === 'https:' || url.protocol === 'http:' ? url.toString().replace(/\/+$/, '') : null;
-    }
-    catch {
-        return null;
-    }
-}
-function readHostedWorkspaceArtifactId(value) {
-    const artifactId = value?.trim() ?? '';
-    return /^artifact_[A-Za-z0-9_-]+$/.test(artifactId) ? artifactId : null;
-}
-function isHostedWorkspaceInternalApiBaseUrl(baseUrl) {
-    try {
-        return new URL(baseUrl).hostname === 'tender-api.tender.test';
-    }
-    catch {
-        return false;
-    }
-}
-function hostedWorkspaceApiHeaders(input) {
-    return {
-        accept: 'application/json',
-        ...(input.jsonBody ? { 'content-type': 'application/json' } : {}),
-    };
-}
-function readHostedWorkspaceConnectorId(value) {
-    const connectorId = value?.trim() ?? '';
-    return /^conn_[A-Za-z0-9_-]+$/.test(connectorId) ? connectorId : null;
-}
-function errorCodeMatches(error, code) {
-    return Boolean(error &&
-        typeof error === 'object' &&
-        'code' in error &&
-        error.code === code);
-}
-function hostedWorkspaceSelectionFilePath(runtime) {
-    const env = runtime.env ?? process.env;
-    const explicitPath = env.TENDER_WORKSPACE_STATE_FILE?.trim();
-    if (explicitPath) {
-        return path.resolve(explicitPath);
-    }
-    const runtimeProjectDir = env.TENDER_RUNTIME_PROJECT_DIR?.trim();
-    if (runtimeProjectDir && path.isAbsolute(runtimeProjectDir)) {
-        return path.join(path.dirname(runtimeProjectDir), '.tender', 'shopify-workspace.json');
-    }
-    const cwd = process.cwd();
-    if (cwd === '/workspace' || cwd.startsWith('/workspace/')) {
-        return '/workspace/.tender/shopify-workspace.json';
-    }
-    return null;
-}
-async function writeHostedWorkspaceConnectorSelection(input, runtime) {
-    const filePath = hostedWorkspaceSelectionFilePath(runtime);
-    if (!filePath) {
-        return;
-    }
-    await mkdir(path.dirname(filePath), { recursive: true, mode: 0o700 });
-    await writeFile(filePath, `${JSON.stringify({
-        version: 1,
-        runtimeArtifactId: input.runtimeArtifactId,
-        connectorId: input.connectorId,
-        selectedAt: Date.now(),
-    }, null, 2)}\n`, { encoding: 'utf8', mode: 0o600 });
-}
-async function readHostedWorkspaceConnectorSelection(runtimeArtifactId, runtime) {
-    const env = runtime.env ?? process.env;
-    const envConnectorId = readHostedWorkspaceConnectorId(env.TENDER_SHOPIFY_CONNECTOR_ID);
-    if (envConnectorId) {
-        return envConnectorId;
-    }
-    const filePath = hostedWorkspaceSelectionFilePath(runtime);
-    if (!filePath) {
-        return null;
-    }
-    let content;
-    try {
-        content = await readFile(filePath, 'utf8');
-    }
-    catch (error) {
-        if (errorCodeMatches(error, 'ENOENT')) {
-            return null;
-        }
-        throw error;
-    }
-    let parsed;
-    try {
-        parsed = JSON.parse(content);
-    }
-    catch {
-        return null;
-    }
-    if (!parsed || typeof parsed !== 'object' || Array.isArray(parsed)) {
-        return null;
-    }
-    const record = parsed;
-    if (record.runtimeArtifactId !== runtimeArtifactId) {
-        return null;
-    }
-    return readHostedWorkspaceConnectorId(typeof record.connectorId === 'string' ? record.connectorId : undefined);
-}
-function shopifyWorkspaceCommandApiPath(command) {
-    return command === 'shopify workspace deploy-source' ? 'deploy' : 'validate';
-}
-async function requestShopifyWorkspaceSourceCommand(input) {
-    const url = `${input.baseUrl}/api/account/connectors/${encodeURIComponent(input.connectorId)}/source/${shopifyWorkspaceCommandApiPath(input.command)}`;
-    const response = await input.fetcher(url, {
-        method: 'POST',
-        headers: hostedWorkspaceApiHeaders({
-            jsonBody: true,
-        }),
-        body: JSON.stringify({
-            sourceArtifactId: input.sourceArtifactId,
-            runtimeArtifactId: input.runtimeArtifactId,
-        }),
-    });
-    const payload = response.status === 204 ? { ok: true } : await parseJsonResponse(response);
-    if (payload) {
-        return { status: response.status, payload };
-    }
-    return {
-        status: response.status,
-        payload: {
-            ok: false,
-            reasonCode: `http_${response.status}`,
-            message: `Shopify workspace request failed with HTTP ${response.status}.`,
-        },
-    };
-}
-async function requestShopifyWorkspaceConnectorsList(input) {
-    const params = new URLSearchParams({ runtimeArtifactId: input.runtimeArtifactId });
-    const url = `${input.baseUrl}/api/account/connectors?${params.toString()}`;
-    const response = await input.fetcher(url, {
-        method: 'GET',
-        headers: hostedWorkspaceApiHeaders({}),
-    });
-    const payload = response.status === 204 ? { ok: true } : await parseJsonResponse(response);
-    if (payload) {
-        return { status: response.status, payload };
-    }
-    return {
-        status: response.status,
-        payload: {
-            ok: false,
-            reasonCode: `http_${response.status}`,
-            message: `Shopify workspace connectors request failed with HTTP ${response.status}.`,
-        },
-    };
-}
-async function requestShopifyWorkspaceLinkRuntime(input) {
-    const url = `${input.baseUrl}/api/account/connectors/${encodeURIComponent(input.connectorId)}/runtime-links`;
-    const response = await input.fetcher(url, {
-        method: 'POST',
-        headers: hostedWorkspaceApiHeaders({
-            jsonBody: true,
-        }),
-        body: JSON.stringify({ runtimeArtifactId: input.runtimeArtifactId }),
-    });
-    const payload = response.status === 204 ? { ok: true } : await parseJsonResponse(response);
-    if (payload) {
-        return { status: response.status, payload };
-    }
-    return {
-        status: response.status,
-        payload: {
-            ok: false,
-            reasonCode: `http_${response.status}`,
-            message: `Shopify workspace link request failed with HTTP ${response.status}.`,
-        },
-    };
-}
 function dbCorrectedExample(artifactId, dbPath) {
     if (dbPath === 'capabilities') {
         return `tender app db capabilities ${artifactId} --json`;
@@ -8242,26 +7974,29 @@ function readAnalyticsSpecMetricName(spec) {
     }
     return readCliStringField(spec.metric, 'name');
 }
-function readAnalyticsSpecGroupField(spec) {
+function readAnalyticsSpecGroupFields(spec) {
     if (!isCliJsonRecord(spec) || !Array.isArray(spec.groupBy)) {
-        return null;
+        return [];
     }
-    const [group] = spec.groupBy.filter(isCliJsonRecord);
-    return group ? readCliStringField(group, 'field') : null;
+    return spec.groupBy
+        .filter(isCliJsonRecord)
+        .map((group) => readCliStringField(group, 'field'))
+        .filter((field) => field !== null);
 }
 function readRequiredAnalyticsPropertiesFromSpec(spec) {
     const eventName = readAnalyticsSpecEventNameFilter(spec);
     const requirements = [];
-    const groupField = readAnalyticsSpecGroupField(spec);
-    if (groupField?.startsWith('property:')) {
-        if (!eventName) {
-            throw new TenderCliUsageError('Property group-by chart specs require an event_name = filter so the CLI can make the property available to dashboard queries.');
+    for (const groupField of readAnalyticsSpecGroupFields(spec)) {
+        if (groupField.startsWith('property:')) {
+            if (!eventName) {
+                throw new TenderCliUsageError('Property group-by chart specs require an event_name = filter so the CLI can make the property available to dashboard queries.');
+            }
+            requirements.push({
+                eventName,
+                propertyKey: groupField.slice('property:'.length),
+                propertyType: 'dimension',
+            });
         }
-        requirements.push({
-            eventName,
-            propertyKey: groupField.slice('property:'.length),
-            propertyType: 'dimension',
-        });
     }
     const metricName = readAnalyticsSpecMetricName(spec);
     if (metricName?.startsWith('sum:') || metricName?.startsWith('avg:')) {
@@ -8432,7 +8167,16 @@ function csvCell(value) {
     return text;
 }
 function rowsToCsv(rows) {
-    const records = rows.filter((row) => Boolean(row) && typeof row === 'object' && !Array.isArray(row));
+    const records = rows
+        .filter((row) => Boolean(row) && typeof row === 'object' && !Array.isArray(row))
+        .map((row) => {
+        const dimensions = row.dimensions;
+        if (!dimensions || typeof dimensions !== 'object' || Array.isArray(dimensions)) {
+            return row;
+        }
+        const { dimensions: _dimensions, ...rest } = row;
+        return { ...dimensions, ...rest };
+    });
     const headers = Array.from(records.reduce((set, row) => {
         for (const key of Object.keys(row)) {
             set.add(key);
@@ -9058,11 +8802,13 @@ async function runAuthLogin(command, io, runtime) {
     const fetcher = runtime.fetcher ?? fetch;
     const sleeper = runtime.sleeper ?? ((milliseconds) => new Promise((resolve) => setTimeout(resolve, milliseconds)));
     const now = runtime.now ?? Date.now;
+    const agentAutoPoll = command.json && env.TENDER_AGENT_DEVICE_AUTH_AUTO_POLL === '1';
     const config = await readConfig(env);
     const existingProfile = config.profiles?.[command.saveProfile] ?? null;
     const baseUrl = command.baseUrl ?? existingProfile?.baseUrl ?? readDefaultBaseUrl(env);
-    const shopifyAppUrl = command.shopifyAppUrl ?? existingProfile?.shopifyAppUrl ?? null;
-    const shopifyStore = command.shopifyStore ?? existingProfile?.shopifyStore ?? null;
+    const defaultShopifyApprovalContext = readDefaultShopifyApprovalContext(env);
+    const shopifyAppUrl = command.shopifyAppUrl ?? existingProfile?.shopifyAppUrl ?? defaultShopifyApprovalContext?.shopifyAppUrl ?? null;
+    const shopifyStore = command.shopifyStore ?? existingProfile?.shopifyStore ?? defaultShopifyApprovalContext?.shopifyStore ?? null;
     const deviceResponse = await fetcher(`${baseUrl}/oauth/device/code`, {
         method: 'POST',
         headers: {
@@ -9135,7 +8881,7 @@ async function runAuthLogin(command, io, runtime) {
         configPath: readConfigPath(env),
         nextCommand: buildAuthStatusNextCommand(command.saveProfile),
     };
-    if (command.noPoll) {
+    if (command.noPoll && !agentAutoPoll) {
         if (command.json) {
             io.stdout(JSON.stringify(pendingResult, null, 2));
         }
@@ -9148,10 +8894,7 @@ async function runAuthLogin(command, io, runtime) {
         io.stderr(JSON.stringify(pendingResult, null, 2));
     }
     else {
-        io.stdout([
-            `Open this URL to approve Tender CLI access: ${verificationUriComplete}`,
-            `User code: ${devicePayload.user_code}`,
-        ].join('\n'));
+        io.stdout([`Open this URL to approve Tender CLI access: ${verificationUriComplete}`, `User code: ${devicePayload.user_code}`].join('\n'));
     }
     let intervalSeconds = Math.max(1, devicePayload.interval ?? 5);
     let attemptsRemaining = Math.max(1, Math.ceil(command.pollTimeoutSeconds / intervalSeconds));
@@ -9848,12 +9591,7 @@ async function resolveGitCommitArgument(input) {
         return commitSha.toLowerCase();
     }
     const detail = result.stderr.trim() || result.stdout.trim();
-    throw new TenderCliUsageError([
-        `--commit must be a 40-character commit SHA or a Git ref resolvable in this checkout: ${value}`,
-        detail,
-    ]
-        .filter(Boolean)
-        .join('\n'));
+    throw new TenderCliUsageError([`--commit must be a 40-character commit SHA or a Git ref resolvable in this checkout: ${value}`, detail].filter(Boolean).join('\n'));
 }
 function readCommandCommitSha(command) {
     const commitSha = 'commitSha' in command ? command.commitSha : null;
@@ -10824,9 +10562,7 @@ async function postLifecycle(input) {
         },
         runtime: input.runtime,
     });
-    const memorySync = input.operation === 'publish'
-        ? await flushAutomaticMemory({ repoPath, remoteName: 'tender', runtime: input.runtime })
-        : null;
+    const memorySync = input.operation === 'publish' ? await flushAutomaticMemory({ repoPath, remoteName: 'tender', runtime: input.runtime }) : null;
     const resultWithMemory = {
         ...result,
         memory,
@@ -11153,7 +10889,7 @@ async function runOutboundAuthApprove(command, io, runtime) {
     });
     const fetcher = runtime.fetcher ?? fetch;
     const grants = command.approveAll
-        ? (await requestOutboundAuthList({ command, credentials, fetcher })).grants?.filter((grant) => !grant.approved) ?? []
+        ? ((await requestOutboundAuthList({ command, credentials, fetcher })).grants?.filter((grant) => !grant.approved) ?? [])
         : [readExplicitOutboundAuthGrant(command)];
     const approved = [];
     for (const grant of grants) {
@@ -11173,11 +10909,7 @@ async function runOutboundAuthApprove(command, io, runtime) {
         io.stdout(JSON.stringify(result, null, 2));
     }
     else {
-        io.stdout([
-            `app_id: ${command.artifactId}`,
-            `approved: ${approved.length}`,
-            ...approved.map((grant) => formatOutboundAuthGrant(grant)),
-        ].join('\n'));
+        io.stdout([`app_id: ${command.artifactId}`, `approved: ${approved.length}`, ...approved.map((grant) => formatOutboundAuthGrant(grant))].join('\n'));
     }
     return 0;
 }
@@ -11596,7 +11328,9 @@ async function runMemoryBrief(command, io, runtime) {
     const unresolved = entries
         .filter((entry) => entry.status === 'open' || entry.kind === 'failure' || entry.kind === 'open_question' || entry.kind === 'support_handoff')
         .slice(-command.limit);
-    const briefEntries = latestSummary ? [latestSummary, ...unresolved.filter((entry) => entry.entryId !== latestSummary.entryId)] : unresolved;
+    const briefEntries = latestSummary
+        ? [latestSummary, ...unresolved.filter((entry) => entry.entryId !== latestSummary.entryId)]
+        : unresolved;
     const result = {
         ok: true,
         command: command.command,
@@ -11632,11 +11366,7 @@ async function runMemoryFlush(command, io, runtime) {
         io.stdout(JSON.stringify(result, null, 2));
     }
     else {
-        io.stdout([
-            `memory_sync: ${sync.status}`,
-            sync.error ? `error: ${sync.error}` : null,
-            result.next ? `next: ${result.next}` : null,
-        ]
+        io.stdout([`memory_sync: ${sync.status}`, sync.error ? `error: ${sync.error}` : null, result.next ? `next: ${result.next}` : null]
             .filter((line) => Boolean(line))
             .join('\n'));
     }
@@ -11854,7 +11584,6 @@ async function runConnectorsList(command, io, runtime) {
         baseUrl: credentials.baseUrl,
         token: credentials.token,
         fetcher: runtime.fetcher ?? fetch,
-        hostedWorkspaceHint: Boolean((runtime.env ?? process.env).TENDER_RUNTIME_ARTIFACT_ID),
     });
     const connectors = readConnectorArray(payload);
     printConnectorsPayload(command, io, payload, connectors.length > 0
@@ -11907,10 +11636,7 @@ async function runConnectorsShopifySetupUrl(command, io, runtime) {
         token: credentials.token,
         fetcher: runtime.fetcher ?? fetch,
     });
-    printConnectorsPayload(command, io, payload, [
-        `connector_id: ${command.connectorId}`,
-        `setup_url: ${String(payload.setupUrl ?? '')}`,
-    ]);
+    printConnectorsPayload(command, io, payload, [`connector_id: ${command.connectorId}`, `setup_url: ${String(payload.setupUrl ?? '')}`]);
     return 0;
 }
 function readClientSecret(command, runtime) {
@@ -12147,7 +11873,10 @@ merchant-editable settings.
 `;
     return new Map([
         ['extensions/tender-product-survey/README.md', readme],
-        ['extensions/tender-product-survey/package.json', '{\n  "name": "tender-product-survey",\n  "private": true,\n  "version": "0.0.0"\n}\n'],
+        [
+            'extensions/tender-product-survey/package.json',
+            '{\n  "name": "tender-product-survey",\n  "private": true,\n  "version": "0.0.0"\n}\n',
+        ],
         ['extensions/tender-product-survey/shopify.extension.toml', extensionToml],
         ['extensions/tender-product-survey/blocks/product_survey.liquid', blockLiquid],
         ['extensions/tender-product-survey/locales/en.default.json', '{}\n'],
@@ -12248,16 +11977,10 @@ npm exec --yes --package @shopify/cli@latest -- shopify app config validate --pa
 tender connectors shopify source deploy ${input.connectorId} --dir . --confirm deploy --profile account --json
 \`\`\`
 
-Inside the hosted Shopify workspace, commit and push source changes, then
-validate or deploy from the embedded Shopify app's Deploy source action so
-Tender can use the connector's stored App Automation Token server-side. If
-Shopify CLI is already authenticated in the hosted workspace, direct
-\`shopify app config validate\` and \`shopify app deploy\` are allowed. Do not run
-\`tender connectors shopify source validate\` or
-\`tender connectors shopify source deploy\` from hosted workspaces; those
-commands require an account-scoped Tender CLI token. Never ask for Shopify App
-Automation Tokens, client secrets, Tender tokens, or provider keys in the
-terminal.
+Inside Shopify, request source changes in the Custom app editor. Tender
+validates the pushed commit, and the explicit Deploy source action uses the
+connector's stored App Automation Token server-side. Never ask for Shopify App
+Automation Tokens, client secrets, Tender tokens, or provider keys in chat.
 `;
     const files = new Map([
         ['.gitignore', '.shopify/\nnode_modules/\n.env\n.env.*\n'],
@@ -12500,15 +12223,7 @@ async function commitAndPushSourceFiles(input) {
     };
 }
 function shopifyValidateArgs(input) {
-    return [
-        'app',
-        'config',
-        'validate',
-        '--path',
-        input.dir,
-        '--json',
-        ...(input.clientId ? ['--client-id', input.clientId] : []),
-    ];
+    return ['app', 'config', 'validate', '--path', input.dir, '--json', ...(input.clientId ? ['--client-id', input.clientId] : [])];
 }
 function shopifyDeployArgs(input) {
     return [
@@ -12580,6 +12295,85 @@ function redactSensitiveText(value, secrets = []) {
         .replace(/\b(authorization\s*[:=]\s*(?:Bearer\s+)?)([^\s'"]+)/gi, '$1[REDACTED]')
         .replace(/\b(x-shopify-access-token\s*[:=]\s*)([^\s'"]+)/gi, '$1[REDACTED]');
 }
+const SHOPIFY_SOURCE_DEPENDENCY_STATE_VERSION = 1;
+const SHOPIFY_SOURCE_DEPENDENCY_STATE_FILE = '.tender-shopify-dependencies.json';
+function dependencyInstallChildEnv(runtime) {
+    const env = shopifyCliChildEnv(runtime);
+    for (const key of Object.keys(env)) {
+        const normalized = key.toUpperCase();
+        if (/(?:TOKEN|SECRET|PASSWORD|PASSWD|AUTHORIZATION|COOKIE|API_KEY|PRIVATE_KEY|CREDENTIAL)/.test(normalized)) {
+            delete env[key];
+        }
+    }
+    return {
+        ...env,
+        NPM_CONFIG_USERCONFIG: '/dev/null',
+    };
+}
+async function prepareShopifySourceDependencies(input) {
+    const packageJsonPath = path.join(input.dir, 'package.json');
+    if (!(await fileExists(packageJsonPath))) {
+        return {
+            status: 'not_required',
+            packageManager: null,
+            lockfile: null,
+            installed: false,
+        };
+    }
+    const lockfileName = 'package-lock.json';
+    const lockfilePath = path.join(input.dir, lockfileName);
+    if (!(await fileExists(lockfilePath))) {
+        throw new TenderCliUsageError('Missing package-lock.json. Shopify connector source with package.json must commit a lockfile before validation or deployment.');
+    }
+    const dependencyStateHash = createHash('sha256')
+        .update(await readFile(packageJsonPath))
+        .update('\0')
+        .update(await readFile(lockfilePath))
+        .digest('hex');
+    const statePath = path.join(input.dir, 'node_modules', SHOPIFY_SOURCE_DEPENDENCY_STATE_FILE);
+    try {
+        const state = JSON.parse(await readFile(statePath, 'utf8'));
+        if (typeof state === 'object' &&
+            state !== null &&
+            'version' in state &&
+            state.version === SHOPIFY_SOURCE_DEPENDENCY_STATE_VERSION &&
+            'dependencyStateHash' in state &&
+            state.dependencyStateHash === dependencyStateHash) {
+            return {
+                status: 'ready',
+                packageManager: 'npm',
+                lockfile: lockfileName,
+                installed: false,
+            };
+        }
+    }
+    catch {
+        // A missing or stale marker means the locked dependency tree must be rebuilt.
+    }
+    const runner = input.runtime.commandRunner ?? defaultCommandRunner;
+    const args = ['ci', '--ignore-scripts'];
+    const result = await runner('npm', args, {
+        cwd: input.dir,
+        env: dependencyInstallChildEnv(input.runtime),
+    });
+    if (result.exitCode !== 0) {
+        throw new TenderCliDependencyInstallError({
+            command: 'npm',
+            args,
+            exitCode: result.exitCode,
+            stdout: redactSensitiveText(result.stdout),
+            stderr: redactSensitiveText(result.stderr),
+        });
+    }
+    await mkdir(path.dirname(statePath), { recursive: true });
+    await writeFile(statePath, `${JSON.stringify({ version: SHOPIFY_SOURCE_DEPENDENCY_STATE_VERSION, dependencyStateHash })}\n`, 'utf8');
+    return {
+        status: 'ready',
+        packageManager: 'npm',
+        lockfile: lockfileName,
+        installed: true,
+    };
+}
 async function runShopifyCliCommand(input) {
     const runner = input.runtime.commandRunner ?? defaultCommandRunner;
     const invocation = shopifyCliCommand(input.args);
@@ -12636,18 +12430,18 @@ function childShopifyDeployEnv(_runtime, token) {
 function connectorsProfileFlag(command) {
     return command.profileName ? `--profile ${command.profileName}` : '--profile account';
 }
-function shopifyDeployTokenRecoveryMessage(command, reasonCode) {
+function shopifyCliTokenRecoveryMessage(command, reasonCode) {
     const profileFlag = connectorsProfileFlag(command);
     return [
         reasonCode === 'shopify_deploy_token_expired'
             ? 'The connector stored Shopify App Automation Token is expired.'
-            : 'The connector does not have a stored Shopify App Automation Token for source deploys.',
+            : 'The connector does not have a stored Shopify App Automation Token for source validation and deployment.',
         `Store a fresh token: printf "$SHOPIFY_APP_AUTOMATION_TOKEN" | tender connectors shopify app-automation-token set ${command.connectorId} --token-stdin ${profileFlag} --json`,
         `Setup URL: tender connectors shopify setup-url ${command.connectorId} ${profileFlag} --json`,
-        'Fallback: export SHOPIFY_APP_AUTOMATION_TOKEN locally before running source deploy.',
+        'Fallback: export SHOPIFY_APP_AUTOMATION_TOKEN locally before running source validation or deployment.',
     ].join('\n');
 }
-async function resolveShopifyDeployTokenEnvironment(input) {
+async function resolveShopifyCliTokenEnvironment(input) {
     const localToken = localShopifyDeployToken(input.runtime);
     if (localToken) {
         return {
@@ -12660,7 +12454,9 @@ async function resolveShopifyDeployTokenEnvironment(input) {
         const handoff = await fetchShopifyDeployToken({
             connectorId: input.command.connectorId,
             sourceArtifactId: input.sourceArtifactId,
-            version: input.command.version,
+            version: input.command.command === 'connectors shopify source deploy'
+                ? input.command.version
+                : null,
             credentials: input.credentials,
             fetcher: input.fetcher,
         });
@@ -12673,7 +12469,7 @@ async function resolveShopifyDeployTokenEnvironment(input) {
     catch (error) {
         if (error instanceof TenderCliConnectorsApiError &&
             (error.reasonCode === 'shopify_deploy_token_required' || error.reasonCode === 'shopify_deploy_token_expired')) {
-            const recovery = shopifyDeployTokenRecoveryMessage(input.command, error.reasonCode);
+            const recovery = shopifyCliTokenRecoveryMessage(input.command, error.reasonCode);
             throw new TenderCliGuidedUsageError(recovery, recovery);
         }
         throw error;
@@ -12739,7 +12535,14 @@ async function runConnectorsShopifySourceInit(command, io, runtime) {
             commit: gitCommit,
         },
         validateCommand: shopifyCliCommandLine(shopifyValidateArgs({ dir, clientId: command.clientId })),
-        deployCommand: shopifyCliCommandLine(shopifyDeployArgs({ dir, clientId: command.clientId, version: 'connector-source', message: null, sourceControlUrl: null, allowDeletes: false })),
+        deployCommand: shopifyCliCommandLine(shopifyDeployArgs({
+            dir,
+            clientId: command.clientId,
+            version: 'connector-source',
+            message: null,
+            sourceControlUrl: null,
+            allowDeletes: false,
+        })),
     };
     printConnectorsPayload(command, io, result, [
         `connector_id: ${command.connectorId}`,
@@ -12787,7 +12590,7 @@ async function runConnectorsShopifySourceCheckout(command, io, runtime) {
     return 0;
 }
 async function runConnectorsShopifySourceValidate(command, io, runtime) {
-    const { connector } = await requestConnector(command, runtime);
+    const { credentials, connector } = await requestConnector(command, runtime);
     const sourceArtifactId = readConnectorSourceArtifactId(connector);
     if (!sourceArtifactId) {
         throw new TenderCliUsageError('Connector does not have a source artifact yet. Run tender connectors shopify source init <connector-id> --dir ./shopify-app first.');
@@ -12801,11 +12604,54 @@ async function runConnectorsShopifySourceValidate(command, io, runtime) {
         }
     }
     if (!command.execute) {
-        printConnectorsPayload(command, io, { ok: true, dryRun: true, command: command.command, connectorId: command.connectorId, sourceArtifactId, dir, shopifyCommand: shopifyCliCommandLine(args) }, [`connector_id: ${command.connectorId}`, `source_artifact_id: ${sourceArtifactId}`, `source_dir: ${dir}`, `shopify_command: ${shopifyCliCommandLine(args)}`]);
+        printConnectorsPayload(command, io, {
+            ok: true,
+            dryRun: true,
+            command: command.command,
+            connectorId: command.connectorId,
+            sourceArtifactId,
+            dir,
+            shopifyCommand: shopifyCliCommandLine(args),
+        }, [
+            `connector_id: ${command.connectorId}`,
+            `source_artifact_id: ${sourceArtifactId}`,
+            `source_dir: ${dir}`,
+            `shopify_command: ${shopifyCliCommandLine(args)}`,
+        ]);
         return 0;
     }
-    const result = await runShopifyCliCommand({ args, cwd: dir, runtime });
-    printConnectorsPayload(command, io, { ok: true, command: command.command, connectorId: command.connectorId, sourceArtifactId, dir, exitCode: result.exitCode, stdout: result.stdout, stderr: result.stderr }, [`connector_id: ${command.connectorId}`, `source_artifact_id: ${sourceArtifactId}`, `source_dir: ${dir}`, 'validation: passed']);
+    const dependencies = await prepareShopifySourceDependencies({ dir, runtime });
+    const validationToken = await resolveShopifyCliTokenEnvironment({
+        command,
+        sourceArtifactId,
+        credentials,
+        runtime,
+        fetcher: runtime.fetcher ?? fetch,
+    });
+    const result = await runShopifyCliCommand({
+        args,
+        cwd: dir,
+        runtime,
+        env: validationToken.env,
+        redactions: validationToken.redactions,
+    });
+    printConnectorsPayload(command, io, {
+        ok: true,
+        command: command.command,
+        connectorId: command.connectorId,
+        sourceArtifactId,
+        dir,
+        exitCode: result.exitCode,
+        stdout: result.stdout,
+        stderr: result.stderr,
+        dependencies,
+    }, [
+        `connector_id: ${command.connectorId}`,
+        `source_artifact_id: ${sourceArtifactId}`,
+        `source_dir: ${dir}`,
+        `dependencies: ${dependencies.status === 'ready' ? (dependencies.installed ? 'installed' : 'cached') : 'not_required'}`,
+        'validation: passed',
+    ]);
     return 0;
 }
 async function runConnectorsShopifySourceDeploy(command, io, runtime) {
@@ -12825,10 +12671,26 @@ async function runConnectorsShopifySourceDeploy(command, io, runtime) {
         allowDeletes: command.allowDeletes,
     });
     if (command.confirm !== 'deploy') {
-        printConnectorsPayload(command, io, { ok: true, dryRun: true, command: command.command, connectorId: command.connectorId, sourceArtifactId, dir, shopifyCommand: shopifyCliCommandLine(args), confirmRequired: 'deploy' }, [`connector_id: ${command.connectorId}`, `source_artifact_id: ${sourceArtifactId}`, `source_dir: ${dir}`, `shopify_command: ${shopifyCliCommandLine(args)}`, 'confirm_required: --confirm deploy']);
+        printConnectorsPayload(command, io, {
+            ok: true,
+            dryRun: true,
+            command: command.command,
+            connectorId: command.connectorId,
+            sourceArtifactId,
+            dir,
+            shopifyCommand: shopifyCliCommandLine(args),
+            confirmRequired: 'deploy',
+        }, [
+            `connector_id: ${command.connectorId}`,
+            `source_artifact_id: ${sourceArtifactId}`,
+            `source_dir: ${dir}`,
+            `shopify_command: ${shopifyCliCommandLine(args)}`,
+            'confirm_required: --confirm deploy',
+        ]);
         return 0;
     }
-    const deployToken = await resolveShopifyDeployTokenEnvironment({
+    const dependencies = await prepareShopifySourceDependencies({ dir, runtime });
+    const deployToken = await resolveShopifyCliTokenEnvironment({
         command,
         sourceArtifactId,
         credentials,
@@ -12836,266 +12698,24 @@ async function runConnectorsShopifySourceDeploy(command, io, runtime) {
         fetcher,
     });
     const result = await runShopifyCliCommand({ args, cwd: dir, runtime, env: deployToken.env, redactions: deployToken.redactions });
-    printConnectorsPayload(command, io, { ok: true, command: command.command, connectorId: command.connectorId, sourceArtifactId, dir, exitCode: result.exitCode, stdout: result.stdout, stderr: result.stderr }, [`connector_id: ${command.connectorId}`, `source_artifact_id: ${sourceArtifactId}`, `source_dir: ${dir}`, 'deploy: completed']);
-    return 0;
-}
-function shopifyWorkspaceResultKey(command) {
-    return command === 'shopify workspace deploy-source' ? 'deployment' : 'validation';
-}
-function shopifyWorkspaceCommandSucceeded(command, payload) {
-    if (payload.ok !== true) {
-        return false;
-    }
-    const result = payload[shopifyWorkspaceResultKey(command.command)];
-    if (result && typeof result === 'object' && !Array.isArray(result)) {
-        const ok = result.ok;
-        return ok !== false;
-    }
-    return true;
-}
-function shopifyWorkspaceTextLines(command, payload) {
-    const connector = payload.connector && typeof payload.connector === 'object' && !Array.isArray(payload.connector)
-        ? payload.connector
-        : {};
-    const source = payload.source && typeof payload.source === 'object' && !Array.isArray(payload.source)
-        ? payload.source
-        : {};
-    const result = payload[shopifyWorkspaceResultKey(command.command)];
-    const resultRecord = result && typeof result === 'object' && !Array.isArray(result)
-        ? result
-        : {};
-    const succeeded = shopifyWorkspaceCommandSucceeded(command, payload);
-    const verb = command.command === 'shopify workspace deploy-source' ? 'deploy' : 'validate';
-    return [
-        `${verb}: ${succeeded ? 'completed' : 'failed'}`,
-        `connector_id: ${String(connector.connectorId ?? '')}`,
-        `source_artifact_id: ${String(source.sourceArtifactId ?? '')}`,
-        ...(payload.reasonCode ? [`reason: ${String(payload.reasonCode)}`] : []),
-        ...(resultRecord.exitCode !== undefined ? [`exit_code: ${String(resultRecord.exitCode)}`] : []),
-        ...(resultRecord.stderr ? [`stderr: ${String(resultRecord.stderr).trim()}`] : []),
-    ].filter((line) => !line.endsWith(': '));
-}
-function readShopifyWorkspaceRuntimeIdentity(runtime) {
-    const env = runtime.env ?? process.env;
-    const baseUrl = normalizeHostedWorkspaceBaseUrl(env.TENDER_BASE_URL);
-    if (!baseUrl) {
-        throw new TenderCliUsageError('TENDER_BASE_URL is required. Open or reload the hosted Shopify workspace and run this command inside its terminal.');
-    }
-    if (!isHostedWorkspaceInternalApiBaseUrl(baseUrl)) {
-        throw new TenderCliUsageError('TENDER_BASE_URL must be http://tender-api.tender.test inside a hosted Shopify workspace. Reload the workspace terminal and try again.');
-    }
-    const runtimeArtifactId = readHostedWorkspaceArtifactId(env.TENDER_RUNTIME_ARTIFACT_ID);
-    if (!runtimeArtifactId) {
-        throw new TenderCliUsageError('TENDER_RUNTIME_ARTIFACT_ID is required. This command only runs inside a hosted Shopify project workspace.');
-    }
-    return { baseUrl, runtimeArtifactId };
-}
-function readShopifyWorkspaceConnectorRecords(payload) {
-    return Array.isArray(payload.connectors)
-        ? payload.connectors.filter((connector) => Boolean(connector) && typeof connector === 'object' && !Array.isArray(connector))
-        : [];
-}
-function readShopifyWorkspaceConnectorSourceArtifactId(connector) {
-    const sourceProject = connector.sourceProject && typeof connector.sourceProject === 'object' && !Array.isArray(connector.sourceProject)
-        ? connector.sourceProject
-        : null;
-    return readHostedWorkspaceArtifactId(typeof sourceProject?.sourceArtifactId === 'string' ? sourceProject.sourceArtifactId : undefined);
-}
-function resolveShopifyWorkspaceSourceCommandConnector(input) {
-    const connectors = readShopifyWorkspaceConnectorRecords(input.payload);
-    const connector = input.selectedConnectorId
-        ? connectors.find((candidate) => candidate.connectorId === input.selectedConnectorId) ?? null
-        : (() => {
-            const linked = connectors.filter((candidate) => candidate.linked === true);
-            return linked.length === 1 ? linked[0] ?? null : null;
-        })();
-    if (!connector) {
-        return {
-            ok: false,
-            payload: {
-                ok: false,
-                reasonCode: input.selectedConnectorId
-                    ? 'shopify_workspace_selected_connector_not_found'
-                    : 'shopify_workspace_connector_selection_required',
-                message: input.selectedConnectorId
-                    ? 'The selected Shopify connector is no longer available to this workspace.'
-                    : 'Link this runtime to one Shopify connector before validating or deploying source.',
-            },
-        };
-    }
-    const connectorId = typeof connector.connectorId === 'string' ? connector.connectorId : null;
-    const sourceArtifactId = readShopifyWorkspaceConnectorSourceArtifactId(connector);
-    if (!connectorId || !sourceArtifactId) {
-        return {
-            ok: false,
-            payload: {
-                ok: false,
-                reasonCode: 'shopify_source_project_required',
-                message: 'The selected Shopify connector does not have a source project.',
-            },
-        };
-    }
-    return {
+    printConnectorsPayload(command, io, {
         ok: true,
-        connectorId,
-        sourceArtifactId,
-    };
-}
-async function runShopifyWorkspaceSourceCommand(command, io, runtime) {
-    const { baseUrl, runtimeArtifactId } = readShopifyWorkspaceRuntimeIdentity(runtime);
-    const selectedConnectorId = await readHostedWorkspaceConnectorSelection(runtimeArtifactId, runtime);
-    const connectorsResult = await requestShopifyWorkspaceConnectorsList({
-        baseUrl,
-        runtimeArtifactId,
-        fetcher: runtime.fetcher ?? fetch,
-    });
-    if (!shopifyWorkspaceRequestSucceeded(connectorsResult)) {
-        const payload = {
-            ...connectorsResult.payload,
-            command: command.command,
-            runtimeArtifactId,
-            ...(selectedConnectorId ? { selectedConnectorId } : {}),
-        };
-        if (command.json) {
-            io.stdout(JSON.stringify(payload, null, 2));
-        }
-        else {
-            io.stdout(shopifyWorkspaceTextLines(command, payload).join('\n'));
-        }
-        return 1;
-    }
-    const resolvedConnector = resolveShopifyWorkspaceSourceCommandConnector({
-        payload: connectorsResult.payload,
-        selectedConnectorId,
-    });
-    if (!resolvedConnector.ok) {
-        const payload = {
-            ...resolvedConnector.payload,
-            command: command.command,
-            runtimeArtifactId,
-            ...(selectedConnectorId ? { selectedConnectorId } : {}),
-        };
-        if (command.json) {
-            io.stdout(JSON.stringify(payload, null, 2));
-        }
-        else {
-            io.stdout(shopifyWorkspaceTextLines(command, payload).join('\n'));
-        }
-        return 1;
-    }
-    const result = await requestShopifyWorkspaceSourceCommand({
-        command: command.command,
-        baseUrl,
-        runtimeArtifactId,
-        fetcher: runtime.fetcher ?? fetch,
-        connectorId: resolvedConnector.connectorId,
-        sourceArtifactId: resolvedConnector.sourceArtifactId,
-    });
-    const payload = {
-        ...result.payload,
         command: command.command,
-        runtimeArtifactId,
-        selectedConnectorId: resolvedConnector.connectorId,
-    };
-    if (command.json) {
-        io.stdout(JSON.stringify(payload, null, 2));
-    }
-    else {
-        io.stdout(shopifyWorkspaceTextLines(command, payload).join('\n'));
-    }
-    return shopifyWorkspaceCommandSucceeded(command, payload) ? 0 : 1;
-}
-function shopifyWorkspaceRequestSucceeded(result) {
-    return result.status >= 200 && result.status < 300 && result.payload.ok !== false;
-}
-function shopifyWorkspaceConnectorListTextLines(payload) {
-    const connectors = readShopifyWorkspaceConnectorRecords(payload);
-    const lines = [
-        `runtime_artifact_id: ${String(payload.runtimeArtifactId ?? '')}`,
-        `shop_domain: ${String(payload.shopDomain ?? '')}`,
-        `connectors: ${connectors.length}`,
-    ];
-    for (const connector of connectors) {
-        lines.push([
-            String(connector.connectorId ?? ''),
-            String(connector.label ?? connector.appName ?? ''),
-            connector.linked ? 'linked' : 'not_linked',
-            connector.ready ? 'ready' : 'needs_setup',
-        ]
-            .filter(Boolean)
-            .join(' | '));
-    }
-    if (typeof payload.reasonCode === 'string') {
-        lines.push(`reason: ${payload.reasonCode}`);
-    }
-    return lines.filter((line) => !line.endsWith(': '));
-}
-function shopifyWorkspaceLinkRuntimeTextLines(payload) {
-    const connector = payload.connector && typeof payload.connector === 'object' && !Array.isArray(payload.connector)
-        ? payload.connector
-        : {};
-    const source = payload.source && typeof payload.source === 'object' && !Array.isArray(payload.source)
-        ? payload.source
-        : {};
-    const workspace = payload.workspace && typeof payload.workspace === 'object' && !Array.isArray(payload.workspace)
-        ? payload.workspace
-        : {};
-    return [
-        `link: ${payload.ok === false ? 'failed' : 'created'}`,
-        `runtime_artifact_id: ${String(payload.runtimeArtifactId ?? '')}`,
-        `connector_id: ${String(connector.connectorId ?? '')}`,
-        `source_artifact_id: ${String(source.sourceArtifactId ?? '')}`,
-        workspace.reloadRequired ? 'next: reload the hosted workspace to mount /workspace/shopify-connector' : '',
-        ...(payload.reasonCode ? [`reason: ${String(payload.reasonCode)}`] : []),
-    ].filter(Boolean);
-}
-async function runShopifyWorkspaceConnectorsList(command, io, runtime) {
-    const { baseUrl, runtimeArtifactId } = readShopifyWorkspaceRuntimeIdentity(runtime);
-    const result = await requestShopifyWorkspaceConnectorsList({
-        baseUrl,
-        runtimeArtifactId,
-        fetcher: runtime.fetcher ?? fetch,
-    });
-    const payload = {
-        ...result.payload,
-        command: command.command,
-        runtimeArtifactId,
-    };
-    if (command.json) {
-        io.stdout(JSON.stringify(payload, null, 2));
-    }
-    else {
-        io.stdout(shopifyWorkspaceConnectorListTextLines(payload).join('\n'));
-    }
-    return shopifyWorkspaceRequestSucceeded(result) ? 0 : 1;
-}
-async function runShopifyWorkspaceLinkRuntime(command, io, runtime) {
-    const { baseUrl, runtimeArtifactId } = readShopifyWorkspaceRuntimeIdentity(runtime);
-    const result = await requestShopifyWorkspaceLinkRuntime({
-        baseUrl,
-        runtimeArtifactId,
-        connectorId: command.connectorId,
-        fetcher: runtime.fetcher ?? fetch,
-    });
-    if (shopifyWorkspaceRequestSucceeded(result)) {
-        await writeHostedWorkspaceConnectorSelection({
-            runtimeArtifactId,
-            connectorId: command.connectorId,
-        }, runtime);
-    }
-    const payload = {
-        ...result.payload,
-        command: command.command,
-        runtimeArtifactId,
         connectorId: command.connectorId,
-    };
-    if (command.json) {
-        io.stdout(JSON.stringify(payload, null, 2));
-    }
-    else {
-        io.stdout(shopifyWorkspaceLinkRuntimeTextLines(payload).join('\n'));
-    }
-    return shopifyWorkspaceRequestSucceeded(result) ? 0 : 1;
+        sourceArtifactId,
+        dir,
+        exitCode: result.exitCode,
+        stdout: result.stdout,
+        stderr: result.stderr,
+        dependencies,
+    }, [
+        `connector_id: ${command.connectorId}`,
+        `source_artifact_id: ${sourceArtifactId}`,
+        `source_dir: ${dir}`,
+        `dependencies: ${dependencies.status === 'ready' ? (dependencies.installed ? 'installed' : 'cached') : 'not_required'}`,
+        'deploy: completed',
+    ]);
+    return 0;
 }
 async function runConnectorsShopifyDelete(command, io, runtime) {
     if (command.confirm !== 'delete') {
@@ -13109,7 +12729,10 @@ async function runConnectorsShopifyDelete(command, io, runtime) {
         token: credentials.token,
         fetcher: runtime.fetcher ?? fetch,
     });
-    printConnectorsPayload(command, io, { ...payload, connectorId: command.connectorId }, [`connector_id: ${command.connectorId}`, 'status: deleted']);
+    printConnectorsPayload(command, io, { ...payload, connectorId: command.connectorId }, [
+        `connector_id: ${command.connectorId}`,
+        'status: deleted',
+    ]);
     return 0;
 }
 function runConnectorsBind(command, io) {
@@ -13936,6 +13559,9 @@ function cliErrorMessage(error) {
     return String(error);
 }
 function cliErrorCode(error) {
+    if (error instanceof TenderCliDependencyInstallError) {
+        return 'dependency_install_failed';
+    }
     if (error instanceof TenderCliChildProcessError) {
         return 'child_process_failed';
     }
@@ -14148,14 +13774,6 @@ export async function runTenderCli(args, io = {
             else if (command.topic === 'connectors bind') {
                 io.stdout(connectorsBindHelp());
             }
-            else if (command.topic === 'shopify' ||
-                command.topic === 'shopify workspace' ||
-                command.topic === 'shopify workspace connectors list' ||
-                command.topic === 'shopify workspace link-runtime' ||
-                command.topic === 'shopify workspace validate-source' ||
-                command.topic === 'shopify workspace deploy-source') {
-                io.stdout(shopifyWorkspaceHelp());
-            }
             else if (command.topic === 'auth') {
                 io.stdout(authHelp());
             }
@@ -14416,15 +14034,6 @@ export async function runTenderCli(args, io = {
         if (command.command === 'connectors shopify source deploy') {
             return await runConnectorsShopifySourceDeploy(command, io, runtime);
         }
-        if (command.command === 'shopify workspace validate-source' || command.command === 'shopify workspace deploy-source') {
-            return await runShopifyWorkspaceSourceCommand(command, io, runtime);
-        }
-        if (command.command === 'shopify workspace connectors list') {
-            return await runShopifyWorkspaceConnectorsList(command, io, runtime);
-        }
-        if (command.command === 'shopify workspace link-runtime') {
-            return await runShopifyWorkspaceLinkRuntime(command, io, runtime);
-        }
         if (command.command === 'connectors shopify delete') {
             return await runConnectorsShopifyDelete(command, io, runtime);
         }
@@ -14597,7 +14206,10 @@ export async function runTenderCli(args, io = {
     }
     catch (error) {
         if (args.includes('--json') &&
-            ((args[0] === 'app' && (args[1] === 'db' || (args[1] === 'agent' && args[2] === 'heartbeat'))) || args[0] === 'playbooks' || args[0] === 'connectors' || args[0] === 'shopify')) {
+            ((args[0] === 'app' && (args[1] === 'db' || (args[1] === 'agent' && args[2] === 'heartbeat'))) ||
+                args[0] === 'playbooks' ||
+                args[0] === 'connectors' ||
+                args[0] === 'shopify')) {
             io.stdout(JSON.stringify(cliErrorPayload(error, args, command), null, 2));
             return error instanceof TenderCliUsageError ? 2 : 1;
         }