@withandeo/cli 0.13.0 → 0.15.0

package/skill/tender-accounts/references/managed-source.md

@@ -13,9 +13,7 @@ npx @withandeo/cli source push --json
 Run these commands from the independently deployable app directory, or use its
 exact `--cwd`. `source connect` derives the project working directory and build
 contract from Git plus `tender-accounts.json`; do not recreate that contract by
-hand in the admin. Protected gateways must stay `preview-only`. Use
-`--publication default-branch` only for an ordinary service when the merchant
-explicitly wants successful default-branch previews promoted automatically.
+hand in the admin. New connections default to preview-only. Both gateways and services support `--publication default-branch` when a merchant administrator explicitly enables automatic publication. For an existing connection use `source policy show`, then `source policy set --repository SRC_ID --publication default-branch --expected-revision N --idempotency-key KEY`. Saving the policy affects future source builds; it does not publish an existing build. Reconnecting never changes the policy.
 
 `source push` includes only the committed revision. On a reviewed repository it
 uploads a bounded Git bundle through Andeo; the trusted runner verifies the
@@ -99,8 +97,7 @@ intended repository, project, branches, SHA, preview build, and composition.
 Never substitute a raw token, direct API, Git force push, ref deletion, or database
 edit. Andeo creates and verifies an archive before history replacement and
 uses an expected-SHA compare-and-swap for the target. History migration always
-suppresses automatic production publication; protected gateways always remain
-preview-only.
+suppresses automatic production publication.
 
 If a durable source operation fails for a transient provider or runner reason,
 inspect and resume that same reviewed intent by ID:
@@ -120,12 +117,38 @@ change stale. Rebase or update the feature branch, push a new committed
 revision, wait for its exact preview, and have the administrator review that
 new snapshot. Source landing never calls the production publisher directly;
 after landing, the repository's already configured default-branch policy may
-publish the same successful exact preview. Protected gateways remain
-preview-only.
+publish the same artifact after its exact preview and production validation succeed.
 
 Treat source administration and production publication as different acts. A
 source operation may create a new immutable preview lineage, but only the
-merchant's established exact-composition control can publish production. For a
-portal and gateway changed together, preview both immutable revisions and
-review the sealed combined composition; do not pretend two repository refs can
-be changed atomically or publish whatever happens to be on each default branch.
+merchant's saved policy or explicit publication approval can authorize production. Portal and gateway remain independent apps: configure variables, policy and delivery for each. Do not imply that two repository refs or apps publish atomically.
+
+## Move a legacy managed repository to its tenant namespace
+
+New managed repositories use a namespace derived from the project's immutable tenant ID. Existing connections keep their recorded address until an administrator explicitly reconnects them. No repository-transfer script runs.
+
+Finish source builds, pushes, operations, deployment work, and open reviews first. Keep your existing checkout and commit any source you intend to push. Read the current repository ID:
+
+```sh
+andeo source status --json
+andeo source reconnect prepare --repository SRC_OLD --idempotency-key tenant-move-20260925 --json
+andeo source reconnect status --reconnection RECONNECT_ID --json
+andeo source push --reconnection RECONNECT_ID --branch main --json
+andeo source reconnect complete --reconnection RECONNECT_ID --expected-sha EXACT_DEFAULT_BRANCH_SHA --json
+```
+
+Use the actual default branch instead of `main`. The push sends local `HEAD` to the explicit destination branch, without force and without changing your managed remote. Push any other required branches from the corresponding commits before completion. The commands do not assume your checkout contains every remote branch or tag.
+
+Preparation pauses the old connection and revokes its write credentials; deployed production continues serving. The destination is not a connected source while it is being seeded, so seed events do not build or publish. Reviewed repositories use this administrator-only seeding path too.
+
+Completion revokes all destination write credentials, verifies the exact default-branch SHA, preserves the old source history, and activates the new connection with the same review protection and automatic publication disabled. It explicitly starts an initial preview build. When `initialBuild.startPending` is true, repeat the same completion command to repair the build start. In a linked checkout, completion updates the named managed remote only if it still matches the expected old address (or already matches the new one). Use `--remote NAME` to select the correct existing managed remote.
+
+Retry prepare with the same repository ID and idempotency key after an interrupted request. Completion is bound to its first expected SHA; inspect a mismatch instead of changing that input. To abandon a pending move:
+
+```sh
+andeo source reconnect cancel --reconnection RECONNECT_ID --json
+```
+
+Cancellation revokes destination access and restores the old connection. It retains any unused destination repository for explicit operator cleanup; it never deletes Git contents or adopts another request's destination. A completed reconnect cannot be cancelled.
+
+After verifying the new preview, inspect `andeo source policy show --json` and use the existing administrator policy command to restore automatic publication if wanted. Changing policy does not publish an existing build; push a new qualifying revision under the new policy.

package/templates/shopify-customer-account/apps/gateway/scripts/pack-tender-artifact.mjs

@@ -22,7 +22,10 @@ if (config.schema !== "tender.account-source/v1" || config.runtime?.kind !== "wo
 
 const retainedConfigPath = process.env.TENDER_PUBLIC_VARS_SOURCE;
 let parsedVars;
-if (retainedConfigPath) {
+if (config.runtimeVars === true) {
+  // Deployment resolves saved environment configuration; no values enter this artifact.
+  parsedVars = Object.fromEntries(config.publicVarNames.map(name => [name, "declared"]));
+} else if (retainedConfigPath) {
   const retained = JSON.parse(await readFile(resolve(retainedConfigPath), "utf8"));
   if (retained?.schema !== "tender.external-app-build/v1") {
     throw new Error("The retained configuration must be an app build envelope.");
@@ -74,7 +77,7 @@ const manifest = {
   health: { path: "/api/health" },
   resources,
   services: config.services,
-  vars: publicVars,
+  ...(config.runtimeVars === true ? {runtimeVars: Object.keys(publicVars).sort()} : {vars: publicVars}),
   databaseSchema,
 };
 const artifactsRoot = join(appRoot, ".tender/artifacts");