showpane 0.4.11 → 0.4.13

package/bundle/meta/scaffold-manifest.json

@@ -1,6 +1,6 @@
 {
   "schemaVersion": 1,
-  "generatedAt": "2026-04-09T22:32:17.805Z",
+  "generatedAt": "2026-04-09T23:30:19.010Z",
   "scaffoldVersion": "0.2.4",
   "files": {
     ".env.example": "ed105f2bdcd1888a98181d55e3c9f7d6eff3ae9c3e2366c2e777a12e3caddfa7",
@@ -19,7 +19,7 @@
     "scripts/prisma-db-push.mjs": "76ac85fe65b5dc3d9cc7432e44618fcc84b7443574c8d88198d01f13ac23c040",
     "scripts/prisma-generate.mjs": "d371e63388fa39f963b7c3c7cb8f87e0d9cd43cbf69d254b999108e29b8738c8",
     "scripts/prisma-schema.mjs": "0a86cc1b5f84120948aed8f97a84f2d5b173f91a43ea34ad6767441894121d83",
-    "src/__tests__/client-portals.test.ts": "fe8e491e62fb2a84de52cdc1154d1451083f93bbccf1c5e65b42810d007eecc2",
+    "src/__tests__/client-portals.test.ts": "9c3236bf0f7190b7d5ba9082287dcb29bc00d28dd63782a89505125ead06c624",
     "src/__tests__/deploy-bundle.test.ts": "abd3216170f306c09df6abb0d2afad966a5741e8859f25a310a0a09693d37609",
     "src/__tests__/portal-contracts.test.ts": "80066377d3281786c2bb9ecc857514124e094a2e66dca2fb08ded994c25fa2bc",
     "src/app/(portal)/client/[slug]/page.tsx": "4f2f9253b2ad5d37a0f13759db52c786ae9c401f50fae9431da1417e9736e000",

package/bundle/scaffold/src/__tests__/client-portals.test.ts

@@ -16,7 +16,7 @@ vi.mock("@/lib/db", () => ({
 import { resolveDefaultOrganizationId } from "@/lib/client-portals";
 import { prisma } from "@/lib/db";
 
-const mockedPrisma = vi.mocked(prisma);
+const mockedFindFirst = vi.mocked(prisma.organization.findFirst);
 
 describe("resolveDefaultOrganizationId", () => {
   beforeEach(() => {
@@ -24,21 +24,21 @@ describe("resolveDefaultOrganizationId", () => {
   });
 
   it("falls back to first org in DB", async () => {
-    mockedPrisma.organization.findFirst.mockResolvedValue({
+    mockedFindFirst.mockResolvedValue({
       id: "local-org-1",
     } as never);
 
     const result = await resolveDefaultOrganizationId();
 
     expect(result).toBe("local-org-1");
-    expect(mockedPrisma.organization.findFirst).toHaveBeenCalledWith({
+    expect(mockedFindFirst).toHaveBeenCalledWith({
       select: { id: true },
       orderBy: { createdAt: "asc" },
     });
   });
 
   it("returns null when no orgs exist in DB", async () => {
-    mockedPrisma.organization.findFirst.mockResolvedValue(null);
+    mockedFindFirst.mockResolvedValue(null);
 
     const result = await resolveDefaultOrganizationId();
 

package/bundle/toolchain/bin/create-deploy-bundle.ts

@@ -1,10 +1,97 @@
-import { createDeployBundle } from "../app/src/lib/deploy-bundle";
+import AdmZip from "adm-zip";
+import {
+  lstatSync,
+  readdirSync,
+  readFileSync,
+  realpathSync,
+  statSync,
+} from "node:fs";
+import path from "node:path";
 
 function fail(message: string): never {
   console.error(JSON.stringify({ ok: false, error: message }));
   process.exit(1);
 }
 
+function walkFiles(dir: string, root: string, out: Set<string>) {
+  for (const entry of readdirSync(dir, { withFileTypes: true })) {
+    const fullPath = path.join(dir, entry.name);
+    if (entry.isDirectory()) {
+      walkFiles(fullPath, root, out);
+      continue;
+    }
+    out.add(path.relative(root, fullPath));
+  }
+}
+
+function collectTracedFiles(appPath: string): Set<string> {
+  const files = new Set<string>();
+  const outputRoot = path.join(appPath, ".vercel", "output");
+  const functionsRoot = path.join(outputRoot, "functions");
+
+  walkFiles(outputRoot, appPath, files);
+
+  const queue = [functionsRoot];
+  while (queue.length > 0) {
+    const current = queue.pop();
+    if (!current) continue;
+    for (const entry of readdirSync(current, { withFileTypes: true })) {
+      const fullPath = path.join(current, entry.name);
+      if (entry.isDirectory()) {
+        queue.push(fullPath);
+        continue;
+      }
+      if (entry.name !== ".vc-config.json") continue;
+
+      const config = JSON.parse(readFileSync(fullPath, "utf8")) as {
+        filePathMap?: Record<string, string>;
+      };
+      for (const relativePath of Object.values(config.filePathMap ?? {})) {
+        files.add(relativePath);
+      }
+    }
+  }
+
+  return files;
+}
+
+function addPathToZip(zip: AdmZip, sourcePath: string, zipPath: string): number {
+  const zipPathPosix = zipPath.replace(/\\/g, "/");
+
+  if (zipPathPosix === ".env" || zipPathPosix.startsWith(".env.")) {
+    zip.addFile(zipPathPosix, Buffer.from("NODE_ENV=production\n"));
+    return 1;
+  }
+
+  const entry = lstatSync(sourcePath, { throwIfNoEntry: false });
+  if (!entry) {
+    return 0;
+  }
+
+  if (entry.isSymbolicLink()) {
+    return addPathToZip(zip, realpathSync(sourcePath), zipPathPosix);
+  }
+
+  if (entry.isDirectory()) {
+    let count = 0;
+    for (const child of readdirSync(sourcePath, { withFileTypes: true })) {
+      count += addPathToZip(
+        zip,
+        path.join(sourcePath, child.name),
+        path.posix.join(zipPathPosix, child.name),
+      );
+    }
+    return count;
+  }
+
+  if (!entry.isFile() && !statSync(sourcePath, { throwIfNoEntry: false })?.isFile()) {
+    return 0;
+  }
+
+  zip.addLocalFile(sourcePath, path.posix.dirname(zipPathPosix), path.posix.basename(zipPathPosix));
+  return 1;
+}
+
 async function main() {
   const args = process.argv.slice(2);
   const outputIndex = args.indexOf("--output");
@@ -15,7 +102,20 @@ async function main() {
   }
 
   const appPath = process.cwd();
-  const { fileCount } = createDeployBundle(appPath, outputPath);
+  const outputRoot = path.join(appPath, ".vercel", "output");
+  if (!statSync(outputRoot, { throwIfNoEntry: false })?.isDirectory()) {
+    fail("Missing .vercel/output. Run `npm run cloud:build` first.");
+  }
+
+  const zip = new AdmZip();
+  const tracedFiles = collectTracedFiles(appPath);
+  let fileCount = 0;
+
+  for (const relativePath of tracedFiles) {
+    fileCount += addPathToZip(zip, path.join(appPath, relativePath), relativePath);
+  }
+
+  zip.writeZip(outputPath);
   console.log(JSON.stringify({ ok: true, outputPath, fileCount }));
 }
 

package/bundle/toolchain/skills/portal-deploy/SKILL.md

@@ -110,7 +110,7 @@ Expected: HTTP 200. If Showpane Cloud is unreachable, stop and show the error. T
 Run the standard type check:
 
 ```bash
-cd "$APP_PATH" && npx tsc --noEmit 2>&1
+cd "$APP_PATH" && npx tsc --noEmit
 ```
 
 If type errors are found, display them and stop. Offer to fix simple issues (missing imports, typos).
@@ -167,12 +167,9 @@ Export the current local portal-runtime state so Showpane Cloud can sync credent
 ```bash
 RUNTIME_DATA_PATH="/tmp/showpane-runtime-${CLOUD_ORG_SLUG:-portal}.json"
 rm -f "$RUNTIME_DATA_PATH"
-if [ -n "$ORG_SLUG" ]; then
-  cd "$APP_PATH" && NODE_PATH="$APP_PATH/node_modules" npx tsx --tsconfig "$APP_PATH/tsconfig.json" "$SKILL_DIR/bin/export-runtime-state.ts" --org-slug "$ORG_SLUG" > "$RUNTIME_DATA_PATH"
-else
-  cd "$APP_PATH" && NODE_PATH="$APP_PATH/node_modules" npx tsx --tsconfig "$APP_PATH/tsconfig.json" "$SKILL_DIR/bin/export-runtime-state.ts" > "$RUNTIME_DATA_PATH"
-fi
-test -f "$RUNTIME_DATA_PATH" || { echo "ERROR: Runtime payload was not created"; exit 1; }
+cd "$APP_PATH" && NODE_PATH="$APP_PATH/node_modules" npx tsx --tsconfig "$APP_PATH/tsconfig.json" "$SKILL_DIR/bin/export-runtime-state.ts" > "$RUNTIME_DATA_PATH" \
+  || { echo "ERROR: Runtime payload export failed"; exit 1; }
+test -s "$RUNTIME_DATA_PATH" || { echo "ERROR: Runtime payload was not created"; exit 1; }
 echo "Runtime payload ready: $RUNTIME_DATA_PATH"
 ```
 
@@ -183,12 +180,9 @@ Export uploaded document metadata and checksums so Showpane Cloud can determine
 ```bash
 FILE_MANIFEST_PATH="/tmp/showpane-files-${CLOUD_ORG_SLUG:-portal}.json"
 rm -f "$FILE_MANIFEST_PATH"
-if [ -n "$ORG_SLUG" ]; then
-  cd "$APP_PATH" && NODE_PATH="$APP_PATH/node_modules" npx tsx --tsconfig "$APP_PATH/tsconfig.json" "$SKILL_DIR/bin/export-file-manifest.ts" --org-slug "$ORG_SLUG" > "$FILE_MANIFEST_PATH"
-else
-  cd "$APP_PATH" && NODE_PATH="$APP_PATH/node_modules" npx tsx --tsconfig "$APP_PATH/tsconfig.json" "$SKILL_DIR/bin/export-file-manifest.ts" > "$FILE_MANIFEST_PATH"
-fi
-test -f "$FILE_MANIFEST_PATH" || { echo "ERROR: File manifest was not created"; exit 1; }
+cd "$APP_PATH" && NODE_PATH="$APP_PATH/node_modules" npx tsx --tsconfig "$APP_PATH/tsconfig.json" "$SKILL_DIR/bin/export-file-manifest.ts" > "$FILE_MANIFEST_PATH" \
+  || { echo "ERROR: File manifest export failed"; exit 1; }
+test -s "$FILE_MANIFEST_PATH" || { echo "ERROR: File manifest was not created"; exit 1; }
 echo "File manifest ready: $FILE_MANIFEST_PATH"
 ```
 
@@ -247,41 +241,90 @@ for item in json.load(sys.stdin).get(\"missing\", []):
 fi
 ```
 
-### Cloud Step 7: Upload the artifact to Showpane Cloud
+### Cloud Step 7: Start the staged deployment
 
 ```bash
 PORTAL_COUNT=$(cd "$APP_PATH" && NODE_PATH="$APP_PATH/node_modules" npx tsx --tsconfig "$APP_PATH/tsconfig.json" "$SKILL_DIR/bin/list-portals.ts" \
   | python3 -c "import sys,json; print(len(json.load(sys.stdin).get('portals', [])))")
 
-DEPLOY_RESPONSE=$(curl -s -X POST "$CLOUD_API_BASE/api/deployments" \
+INIT_RESPONSE=$(curl -s -X POST "$CLOUD_API_BASE/api/deployments" \
   -H "Authorization: Bearer $CLOUD_API_TOKEN" \
-  -F "artifact=@$ARTIFACT_PATH" \
-  -F "source=claude-portal-deploy" \
-  -F "app_path=$APP_PATH" \
-  -F "portalCount=$PORTAL_COUNT" \
-  -F "runtimeData=@$RUNTIME_DATA_PATH;type=application/json")
+  -H "Content-Type: application/json" \
+  --data-binary '{}')
 
-echo "$DEPLOY_RESPONSE" | python3 -c "
+echo \"$INIT_RESPONSE\" | python3 -c "
 import sys, json
 d = json.load(sys.stdin)
 if 'error' in d:
     print('ERROR: ' + str(d['error']))
     sys.exit(1)
-print('Deployment accepted')
-print('ID: ' + d.get('deploymentId', d.get('id', 'unknown')))
+print('Deployment initialized')
+print('ID: ' + d.get('deploymentId', 'unknown'))
 print('Status: ' + d.get('status', 'unknown'))
 "
 ```
 
-Extract the deployment ID from the response. If the API returns an error, show it and stop.
+Extract the deployment ID and the presigned artifact upload URL from the response. If the API returns an error, show it and stop.
 
-### Cloud Step 8: Wait for cloud publish to finish
+### Cloud Step 8: Upload the artifact directly to storage
 
-Poll Showpane Cloud until the deployment reaches `live` or `failed`:
+```bash
+DEPLOY_ID=$(echo "$INIT_RESPONSE" | python3 -c "import sys,json; d=json.load(sys.stdin); print(d.get('deploymentId',''))")
+ARTIFACT_UPLOAD_URL=$(echo "$INIT_RESPONSE" | python3 -c "import sys,json; d=json.load(sys.stdin); print(d.get('artifactUploadUrl',''))")
+
+if [ -z "$DEPLOY_ID" ] || [ -z "$ARTIFACT_UPLOAD_URL" ]; then
+  echo "ERROR: Missing deploymentId or artifact upload URL"
+  exit 1
+fi
+
+UPLOAD_STATUS=$(curl -s -o /dev/null -w "%{http_code}" -X PUT "$ARTIFACT_UPLOAD_URL" \
+  -H "Content-Type: application/zip" \
+  --data-binary @"$ARTIFACT_PATH" \
+)
+
+if [ "$UPLOAD_STATUS" != "200" ]; then
+  echo "ERROR: Artifact upload failed with HTTP $UPLOAD_STATUS"
+  exit 1
+fi
+```
+
+### Cloud Step 9: Finalize the deployment
 
 ```bash
-DEPLOY_ID=$(echo "$DEPLOY_RESPONSE" | python3 -c "import sys,json; d=json.load(sys.stdin); print(d.get('deploymentId', d.get('id','')))")
+FINALIZE_PAYLOAD="/tmp/showpane-deploy-finalize-${DEPLOY_ID}.json"
+python3 - <<'PY' "$RUNTIME_DATA_PATH" "$PORTAL_COUNT" > "$FINALIZE_PAYLOAD"
+import json, sys
+runtime_path = sys.argv[1]
+portal_count = int(sys.argv[2])
+payload = {
+  "portalCount": portal_count,
+  "runtimeData": json.load(open(runtime_path)),
+}
+print(json.dumps(payload))
+PY
+
+FINALIZE_RESPONSE=$(curl -s -X POST "$CLOUD_API_BASE/api/deployments/$DEPLOY_ID/finalize" \
+  -H "Authorization: Bearer $CLOUD_API_TOKEN" \
+  -H "Content-Type: application/json" \
+  --data-binary @"$FINALIZE_PAYLOAD")
+
+echo "$FINALIZE_RESPONSE" | python3 -c "
+import sys, json
+d = json.load(sys.stdin)
+if 'error' in d:
+    print('ERROR: ' + str(d['error']))
+    sys.exit(1)
+print('Deployment accepted')
+print('ID: ' + d.get('deploymentId', 'unknown'))
+print('Status: ' + d.get('status', 'unknown'))
+"
+```
 
+### Cloud Step 10: Wait for cloud publish to finish
+
+Poll Showpane Cloud until the deployment reaches `live` or `failed`:
+
+```bash
 echo "Waiting for deployment to go live..."
 for i in $(seq 1 60); do
   sleep 5
@@ -314,7 +357,7 @@ fi
 
 The publish typically takes 15-60 seconds. Poll every 5 seconds for up to 5 minutes.
 
-### Cloud Step 9: Post-deploy verification
+### Cloud Step 11: Post-deploy verification
 
 Once the deployment is live, verify the portal is accessible:
 
@@ -333,7 +376,7 @@ Also check the API health endpoint:
 curl -s -o /dev/null -w "%{http_code}" "$PORTAL_URL/api/health"
 ```
 
-### Cloud Step 10: Deployment summary
+### Cloud Step 12: Deployment summary
 
 Print a clear summary:
 
@@ -351,7 +394,7 @@ Cloud deploy complete!
   Deploy ID:  dep_xxxxxxxxxxxx
 ```
 
-### Cloud Step 11: Record deployment
+### Cloud Step 13: Record deployment
 
 Log the cloud deployment for operational memory:
 
@@ -359,7 +402,7 @@ Log the cloud deployment for operational memory:
 echo '{"skill":"portal-deploy","key":"deploy","insight":"Cloud deploy to '$CLOUD_ORG_SLUG'.showpane.com. Migrations: <count>. Portals: <count> active. Deploy ID: '$DEPLOY_ID'.","confidence":10,"ts":"'$(date -u +%Y-%m-%dT%H:%M:%SZ)'"}' >> "$HOME/.showpane/learnings.jsonl"
 ```
 
-### Cloud Step 12: Clean up
+### Cloud Step 14: Clean up
 
 Remove the temporary artifact:
 
@@ -367,6 +410,7 @@ Remove the temporary artifact:
 rm -f "$ARTIFACT_PATH"
 rm -f "$RUNTIME_DATA_PATH"
 rm -f "$FILE_MANIFEST_PATH"
+rm -f "$FINALIZE_PAYLOAD"
 [ -n "${TMP_SYNC_DIR:-}" ] && rm -rf "$TMP_SYNC_DIR"
 ```
 
@@ -448,9 +492,9 @@ If the Showpane Cloud API returns 401/403 during pre-flight or publish:
 - **409 organization_required**: The user authenticated but has no org yet. Send them to Showpane Cloud checkout to start the trial, then re-run `showpane login`.
 
 ### Cloud: Artifact upload failure
-If the POST to `/api/deployments` fails:
-- **400 Bad Request**: The artifact is missing or malformed. Rebuild locally and retry.
-- **413 Payload Too Large**: The build artifact is too large. Remove oversized static assets from the portal app.
+If the deployment init or finalize call fails:
+- **400 Bad Request**: The runtime payload is missing or malformed. Rebuild locally and retry.
+- **409 Conflict**: The deployment was not initialized, the artifact was not uploaded yet, or the org has no hosted project provisioned.
 - **422 Validation Error**: The cloud control plane rejected the deploy metadata. Show the response body directly.
 
 ### Cloud: File sync failure
@@ -481,7 +525,9 @@ echo '{"skill":"portal-deploy","event":"completed","ts":"'$(date -u +%Y-%m-%dT%H
 - If any pre-flight check fails (type errors, missing deploy config), stop and explain
 - Show the full deployment summary with portal count, migration status, and health
 - If this is the first deploy, suggest running `/portal credentials` for all portals before deploying so clients can actually log in
+- For Cloud deploys: use the local workspace's current SQLite org for runtime exports, not the cloud org slug from config
 - For Cloud deploys: build locally, upload the artifact to Showpane Cloud, and let the control plane publish it
+- For Cloud deploys: upload the artifact directly to storage using the presigned URL, not through the deployment function body
 - For Cloud deploys: always wait for the deployment to reach `live` before declaring success
 - For Cloud deploys: the portal URL is `https://{org}.showpane.com` — verify it returns 200 after deploy
 - For Cloud deploys: clean up the temporary artifact after deploy completes

package/package.json

@@ -1,7 +1,7 @@
 {
   "name": "showpane",
-  "version": "0.4.11",
-  "description": "CLI for Showpane \u2014 AI-generated client portals",
+  "version": "0.4.13",
+  "description": "CLI for Showpane — AI-generated client portals",
   "type": "module",
   "bin": {
     "showpane": "./dist/index.js"