showpane 0.4.9 → 0.4.11

package/bundle/meta/scaffold-manifest.json

@@ -1,35 +1,26 @@
 {
   "schemaVersion": 1,
-  "generatedAt": "2026-04-09T15:11:53.818Z",
-  "scaffoldVersion": "0.2.3",
+  "generatedAt": "2026-04-09T22:32:17.805Z",
+  "scaffoldVersion": "0.2.4",
   "files": {
-    ".env.example": "0dd692f1c7e6bcabdf5dbdfe9abb73797d79d8e90da150d6098b63ddc695dc29",
+    ".env.example": "ed105f2bdcd1888a98181d55e3c9f7d6eff3ae9c3e2366c2e777a12e3caddfa7",
     ".gitignore": "998e5f43865ea56ac79a05acfd5d4b0d696f310bd5325a1ed458c3d40154d437",
-    "VERSION": "3ab94c04d24986f3af288ba1cda2c0bbddbc5a89dff097182805f54578e1ea75",
-    "docker-compose.yml": "420fd123da019c22f03662933537e24779b4c2c91f90c23abfec5965cd0f35ce",
-    "docker/Caddyfile": "d9c58086986795f5b3e42ff9b5942e60b8df946a1a0c40351381616c0b4d2bed",
-    "docker/Dockerfile": "340470e3735ea53b2c03003a13a91361652291add33c40a2bf13e6af2a8cb73a",
+    "VERSION": "1725bfa6524c5265e7c171cf06568417d39b947fff49c242f03859479c82334b",
     "next.config.ts": "cf27999cc274cce79bc4c8df11789807719abf40752b60e4b4967a3d2f0ed013",
     "package-lock.json": "d8e30eb86f08e70787d4459a084b4ab2a9f119696bbd3146ec4ba5675fffd3c2",
-    "package.json": "f5ee82c0447ee17c3bd4094f8c5c83b6d7f173b407458908d453e94664e6f41b",
+    "package.json": "b095e17e7fc181c630e87fe9f473c5a4ef969afcd4b110f9f9c6d6a6d93f1c0b",
     "postcss.config.js": "fa650b380adfabb151a0b352f7135e107e6352345f899060f1c5c231228f94bf",
-    "prisma/migrations/20260408000000_init/migration.sql": "a637c252920b45c7dd3e8225c939da373bbaeeccc6f208f9e52c3ff0133a3438",
-    "prisma/migrations/20260408010000_add_visitor_tracking/migration.sql": "a4432b5d037f069e97ed1765a5bf5a4f3b502e29af1a05406b2aa42bde735e28",
-    "prisma/migrations/20260409040000_add_portal_file_checksum/migration.sql": "bbfad517dea1257f40e5a0d7807677452fb893a34afbc6d81a3d2bbabc5932af",
-    "prisma/migrations/migration_lock.toml": "99836963713b4f5b269ad49af0ed3d7b0b2e336115c2f92dc9ac683d139d0900",
-    "prisma/schema.local.prisma": "4b36b52ef0ccfd5980f05ab97e821001a0f4bb658f13d693a6e3422233399eb8",
-    "prisma/schema.prisma": "904e517e8956e1b61534d18db6a27c104008ec1d57d474e22e67946c9a1f60ca",
-    "prisma/seed.ts": "1dea3de4b36263e6172817508e113ba416fbcd8caff80bc190f35cd3b4b3e2c5",
+    "prisma.config.ts": "36f56fd74eae70632e484443e38d08665158d72d5c978dc456651d8d5e1a636e",
+    "prisma/schema.local.prisma": "f5d6f3cb17d6d229f46ef82eef7c0ff4261596924f0173fef075ac394f423073",
+    "prisma/seed.ts": "398b645c31ea0d5b0291f27c32aded22bdb64021e581a547e85b3cccca65c551",
     "public/example-avatar.svg": "0edeb0d3fbefa89cc27ffe6564d20e3ee0fd073cb6d9f2a025248ef3b3f277fd",
     "public/example-logo.svg": "bc5cd933aff2a17698dee66a7b4ea940ad12238e9d813474d643b459b1e8d6da",
     "public/robots.txt": "331ea9090db0c9f6f597bd9840fd5b171830f6e0b3ba1cb24dfa91f0c95aedc1",
-    "scripts/backup.sh": "7d94758c5f1b0d3a722ec8a1a0b819f1a5f480b762790cf4eeccdd6fda46d11b",
-    "scripts/e2e-verify.sh": "48c5983b8f2facc228bb4ea1ac0998064268f0fdb0088208dcb12bb1e48c3244",
     "scripts/prisma-db-push.mjs": "76ac85fe65b5dc3d9cc7432e44618fcc84b7443574c8d88198d01f13ac23c040",
     "scripts/prisma-generate.mjs": "d371e63388fa39f963b7c3c7cb8f87e0d9cd43cbf69d254b999108e29b8738c8",
-    "scripts/prisma-schema.mjs": "4c502f640a24558b8000613a06cc956b2253849e3cd8e71849a48db9a94ed435",
-    "scripts/restore.sh": "4c1be4f0d19aa4572842981e818684349dacbb4ae319ad75ef2b03ee63f0cf98",
-    "src/__tests__/client-portals.test.ts": "c6999300e9289333c72cc4493dd13a2b344794839ee76232fc9ebdd08f021b89",
+    "scripts/prisma-schema.mjs": "0a86cc1b5f84120948aed8f97a84f2d5b173f91a43ea34ad6767441894121d83",
+    "src/__tests__/client-portals.test.ts": "fe8e491e62fb2a84de52cdc1154d1451083f93bbccf1c5e65b42810d007eecc2",
+    "src/__tests__/deploy-bundle.test.ts": "abd3216170f306c09df6abb0d2afad966a5741e8859f25a310a0a09693d37609",
     "src/__tests__/portal-contracts.test.ts": "80066377d3281786c2bb9ecc857514124e094a2e66dca2fb08ded994c25fa2bc",
     "src/app/(portal)/client/[slug]/page.tsx": "4f2f9253b2ad5d37a0f13759db52c786ae9c401f50fae9431da1417e9736e000",
     "src/app/(portal)/client/[slug]/s/[token]/route.ts": "a445e54b9139e40dfe0bc039e34e6af224a27f75a614741ab224d317ad4d3ec9",
@@ -37,7 +28,7 @@
     "src/app/(portal)/client/example/page.tsx": "f330864f63c9feea76c8a62c3eba3ce57578627e0d4abd929fd7fefdfc7af058",
     "src/app/(portal)/client/layout.tsx": "4f43871510408a81da229d48ae316ec1d1c1beda93121922246300a2c8fd0999",
     "src/app/(portal)/client/page.tsx": "af36f1a6f359d6a7bd4a6ac550058c9d9c107e9885bb238b4c06ec26700e23e3",
-    "src/app/api/client-auth/route.ts": "46508351fce1902c1878efce86b5d4ebdd28a4977941100fdc77a48d79c5d765",
+    "src/app/api/client-auth/route.ts": "ce1858559b1e944d5b1dc719d1f03bebf66286671700b1b5397382109f0f1e0d",
     "src/app/api/client-auth/share/route.ts": "ed82414212dcd26af8c6c0f2bd44d9d79a727ed35cfedbac8c4077a6220aad14",
     "src/app/api/client-events/route.ts": "13d545537b7e8ce421e6169d25c105adf2a2de3d978ae0a2c6751ff5f7d2eb33",
     "src/app/api/client-files/[...path]/route.ts": "d6279a8eab48aa82d07ac8d467276968898c0d426eeec0a7d1fba1fa754ef405",
@@ -54,18 +45,20 @@
     "src/lib/abuse-controls.ts": "d79d58d93267aca48ad0b7b9b91f753c9a3c27263e4e98daf768a950c44a6fc6",
     "src/lib/branding.ts": "cc55f40e02bc3e486b227988f95739ca1cda8012c97b591295995eb4465efd57",
     "src/lib/client-auth.ts": "b9bdfe77dbe5d6ec6c6a930627fc43d3253f0d76fd8fc4093af5a75742bebe42",
-    "src/lib/client-portals.ts": "0a2c1ed8890bee35cd5f582554ede7da8a51466aec052395e44810198e6d48e2",
+    "src/lib/client-portals.ts": "9b531f9a9ea459b4ab85257b9dd282874fa1422838fe89d511940e417114216a",
     "src/lib/control-plane.ts": "e0cf39f28ec7de715fd5cfbb5f4240773fcd3d775cd1677588dd749fff740a0e",
     "src/lib/db.ts": "65fb87fde5a05fa033234f3a976f6730d99fab7982a83821c792d09fc659e439",
+    "src/lib/deploy-bundle.ts": "e9675cccb2c802e408639481986c6b629737541853e1c93f322c08a5b9dfc5f9",
     "src/lib/files.ts": "24fd8d1d53c180d62441019395fb140ba3baa28311918ac488284adcdda8eb9a",
     "src/lib/load-app-env.ts": "78b80e17d896885f0d72315ee9a6cf7a0a8c6c08171f26e3d599bb9b2e8afeee",
-    "src/lib/portal-contracts.ts": "5e9f5c747eb911a056bb5626d0710c37dbc8aba02a8e054203f736d13511bef7",
+    "src/lib/portal-contracts.ts": "519a97afe3ae618077c95aba5a9764383e7edf6c9effd62a5638a50a0b2a676a",
     "src/lib/prisma-client.ts": "28cd100129a0178a6c8fdfe49e6997b19983fcc427b9fa7caee3ac26226e5eb3",
-    "src/lib/runtime-state.ts": "2bbd9c2d9e963e544a52ac04cc7c5651558cc8b7efd45e179b4eb72d8a640122",
+    "src/lib/runtime-state.ts": "3d30de7dfeaaa48d8b6fd5d29976ecd001408172100c95b063d5d804fdce0a2e",
     "src/lib/storage.ts": "ae3b85fc6cccd39d4174a391dcbe6e91fb9460eb407ec9dbfedd63594a441d08",
     "src/lib/token.ts": "518898ca3cbba069f507f736ed80f5afa0c5af07b0b02fdd2d682e466598c803",
     "src/lib/utils.ts": "d1f1e0d62cb8d8d1e04c26e14de842d8a151f75812d81b046c65b5d1fe8e4b27",
     "src/middleware.ts": "5623ef170d9327e47373943eae33a8b07a6dda970525d0833e0865e4429df094",
+    "src/types/adm-zip.d.ts": "a9a32ea84d6d6cd89626ba5cd6f5519158a652362abbe5647474114c30ecc3c4",
     "tailwind.config.ts": "dc0dec22249b290b857190495ce7140327a6f4d94fedd5dffcdb298fa3928071",
     "tests/.gitkeep": "e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855",
     "tsconfig.json": "1b12f56ab16430b64622ff8512cb05b06cf633060dbec6ebad6f9e792a6dc2a0",

package/bundle/scaffold/VERSION

@@ -1 +1 @@
-0.2.3
+0.2.4

package/bundle/scaffold/__dot__env.example

@@ -1,11 +1,7 @@
 # Database
 # Local development (SQLite, zero config):
+# Prisma commands auto-select the matching schema from this value.
 DATABASE_URL="file:./dev.db"
-# Production (PostgreSQL):
-# DATABASE_URL="postgresql://portal:change-me-in-.env@db:5432/portal"
-# POSTGRES_USER="portal"
-# POSTGRES_PASSWORD="change-me-in-.env"
-# POSTGRES_DB="portal"
 
 # Auth — generate with: openssl rand -base64 32
 AUTH_SECRET=""
@@ -22,3 +18,5 @@ STORAGE_PROVIDER="local"
 
 # Public URL (used for share links)
 # NEXT_PUBLIC_APP_URL="https://portal.example.com"
+
+# Showpane Cloud publish builds a prebuilt artifact locally during /portal deploy.

package/bundle/scaffold/package.json

@@ -2,14 +2,15 @@
   "name": "showpane-portal",
   "version": "0.1.0",
   "private": true,
+  "packageManager": "npm@10.9.2",
   "scripts": {
     "dev": "next dev",
     "prisma:generate": "node scripts/prisma-generate.mjs",
     "prisma:db-push": "node scripts/prisma-db-push.mjs",
+    "cloud:build": "npm run prisma:generate && npx --yes vercel build --prod",
     "build": "npm run prisma:generate && next build",
     "start": "next start",
     "postinstall": "npm run prisma:generate",
-    "db:migrate": "prisma migrate deploy",
     "db:push": "npm run prisma:db-push",
     "db:seed": "npx tsx prisma/seed.ts",
     "test": "vitest"

package/bundle/scaffold/prisma/schema.local.prisma

@@ -1,5 +1,5 @@
 // Local development schema — SQLite provider for zero-config local dev.
-// Used by `npx showpane` installer via: prisma db push --schema prisma/schema.local.prisma
+// Canonical Prisma schema for the Showpane app.
 
 generator client {
   provider      = "prisma-client"

package/bundle/scaffold/prisma/seed.ts

@@ -27,7 +27,12 @@ async function main() {
         slug: "example",
       },
     },
-    update: {},
+    update: {
+      companyName: "Acme Health",
+      username: "example",
+      passwordHash,
+      lastUpdated: "2 April 2026",
+    },
     create: {
       organizationId: org.id,
       slug: "example",

package/bundle/scaffold/prisma.config.ts

@@ -0,0 +1,5 @@
+import { defineConfig } from "prisma/config";
+
+export default defineConfig({
+  schema: "./prisma/schema.local.prisma",
+});

package/bundle/scaffold/scripts/prisma-schema.mjs

@@ -1,64 +1,12 @@
 import { execFileSync } from "node:child_process";
-import fs from "node:fs";
 import path from "node:path";
 import { fileURLToPath } from "node:url";
 
 const scriptDir = path.dirname(fileURLToPath(import.meta.url));
 const appRoot = path.resolve(scriptDir, "..");
 
-function parseEnvValue(rawValue) {
-  const value = rawValue.trim();
-  if (
-    (value.startsWith("\"") && value.endsWith("\"")) ||
-    (value.startsWith("'") && value.endsWith("'"))
-  ) {
-    return value.slice(1, -1);
-  }
-  return value;
-}
-
-function parseEnvFile(filePath) {
-  if (!fs.existsSync(filePath)) return {};
-
-  const env = {};
-  for (const line of fs.readFileSync(filePath, "utf8").split(/\r?\n/)) {
-    const trimmed = line.trim();
-    if (!trimmed || trimmed.startsWith("#")) continue;
-
-    const separator = trimmed.indexOf("=");
-    if (separator === -1) continue;
-
-    const key = trimmed.slice(0, separator).trim();
-    const value = trimmed.slice(separator + 1);
-    env[key] = parseEnvValue(value);
-  }
-
-  return env;
-}
-
-export function getDatabaseUrl() {
-  if (process.env.DATABASE_URL) return process.env.DATABASE_URL;
-
-  const envPaths = [
-    path.join(appRoot, ".env"),
-    path.join(appRoot, ".env.local"),
-  ];
-
-  const merged = {};
-  for (const envPath of envPaths) {
-    Object.assign(merged, parseEnvFile(envPath));
-  }
-
-  return merged.DATABASE_URL ?? null;
-}
-
 export function getSchemaPath() {
-  const databaseUrl = getDatabaseUrl();
-  const schemaName = databaseUrl?.startsWith("file:")
-    ? "schema.local.prisma"
-    : "schema.prisma";
-
-  return path.join(appRoot, "prisma", schemaName);
+  return path.join(appRoot, "prisma", "schema.local.prisma");
 }
 
 export function runPrismaCommand(args) {

package/bundle/scaffold/src/__tests__/client-portals.test.ts

@@ -21,56 +21,23 @@ const mockedPrisma = vi.mocked(prisma);
 describe("resolveDefaultOrganizationId", () => {
   beforeEach(() => {
     vi.resetAllMocks();
-    delete process.env.ORG_ID;
   });
 
-  it("returns org id from ORG_ID env var when set and org exists", async () => {
-    process.env.ORG_ID = "cloud-org-123";
-    mockedPrisma.organization.findUnique.mockResolvedValue({
-      id: "cloud-org-123",
-    } as never);
-
-    const result = await resolveDefaultOrganizationId();
-
-    expect(result).toBe("cloud-org-123");
-    expect(mockedPrisma.organization.findUnique).toHaveBeenCalledWith({
-      where: { id: "cloud-org-123" },
-      select: { id: true },
-    });
-    expect(mockedPrisma.organization.findFirst).not.toHaveBeenCalled();
-  });
-
-  it("returns null when ORG_ID is set but org not in DB", async () => {
-    process.env.ORG_ID = "nonexistent-org";
-    mockedPrisma.organization.findUnique.mockResolvedValue(null);
-
-    const result = await resolveDefaultOrganizationId();
-
-    expect(result).toBeNull();
-    expect(mockedPrisma.organization.findUnique).toHaveBeenCalledWith({
-      where: { id: "nonexistent-org" },
-      select: { id: true },
-    });
-    expect(mockedPrisma.organization.findFirst).not.toHaveBeenCalled();
-  });
-
-  it("falls back to first org in DB when ORG_ID not set", async () => {
-    // ORG_ID is not set (deleted in beforeEach)
+  it("falls back to first org in DB", async () => {
     mockedPrisma.organization.findFirst.mockResolvedValue({
-      id: "self-hosted-org-1",
+      id: "local-org-1",
     } as never);
 
     const result = await resolveDefaultOrganizationId();
 
-    expect(result).toBe("self-hosted-org-1");
+    expect(result).toBe("local-org-1");
     expect(mockedPrisma.organization.findFirst).toHaveBeenCalledWith({
       select: { id: true },
       orderBy: { createdAt: "asc" },
     });
-    expect(mockedPrisma.organization.findUnique).not.toHaveBeenCalled();
   });
 
-  it("returns null when ORG_ID not set and no orgs in DB", async () => {
+  it("returns null when no orgs exist in DB", async () => {
     mockedPrisma.organization.findFirst.mockResolvedValue(null);
 
     const result = await resolveDefaultOrganizationId();

package/bundle/scaffold/src/__tests__/deploy-bundle.test.ts

@@ -0,0 +1,48 @@
+import AdmZip from "adm-zip";
+import { afterEach, describe, expect, it } from "vitest";
+import {
+  mkdtempSync,
+  mkdirSync,
+  rmSync,
+  symlinkSync,
+  writeFileSync,
+} from "node:fs";
+import os from "node:os";
+import path from "node:path";
+import { createDeployBundle } from "@/lib/deploy-bundle";
+
+const tempDirs: string[] = [];
+
+afterEach(() => {
+  for (const dir of tempDirs.splice(0)) {
+    rmSync(dir, { recursive: true, force: true });
+  }
+});
+
+describe("createDeployBundle", () => {
+  it("materializes symlinked function aliases into the artifact", () => {
+    const appRoot = mkdtempSync(path.join(os.tmpdir(), "showpane-bundle-"));
+    tempDirs.push(appRoot);
+
+    const outputRoot = path.join(appRoot, ".vercel", "output");
+    const realFuncDir = path.join(outputRoot, "functions", "real.func");
+    mkdirSync(realFuncDir, { recursive: true });
+    writeFileSync(path.join(outputRoot, "config.json"), JSON.stringify({ version: 3 }));
+    writeFileSync(path.join(realFuncDir, ".vc-config.json"), JSON.stringify({ handler: "index.js" }));
+    writeFileSync(path.join(realFuncDir, "index.js"), "module.exports = {};\n");
+
+    const aliasDir = path.join(outputRoot, "functions", "alias.func");
+    symlinkSync("real.func", aliasDir);
+
+    const artifactPath = path.join(appRoot, "artifact.zip");
+    const result = createDeployBundle(appRoot, artifactPath);
+    expect(result.fileCount).toBe(5);
+
+    const names = new Set(new AdmZip(artifactPath).getEntries().map((entry) => entry.entryName));
+    expect(names.has(".vercel/output/config.json")).toBe(true);
+    expect(names.has(".vercel/output/functions/real.func/.vc-config.json")).toBe(true);
+    expect(names.has(".vercel/output/functions/real.func/index.js")).toBe(true);
+    expect(names.has(".vercel/output/functions/alias.func/.vc-config.json")).toBe(true);
+    expect(names.has(".vercel/output/functions/alias.func/index.js")).toBe(true);
+  });
+});

package/bundle/scaffold/src/app/api/client-auth/route.ts

@@ -60,7 +60,7 @@ export async function POST(req: NextRequest) {
     return NextResponse.json({ error: "Invalid credentials" }, { status: 401 });
   }
 
-  // Resolve organization — self-hosted uses first org, cloud reads ORG_ID env var
+  // Resolve organization — local uses the first org, hosted runtime uses runtime-state
   const orgId = await resolveDefaultOrganizationId();
   if (!orgId) {
     return NextResponse.json({ error: "No organization configured" }, { status: 503 });

package/bundle/scaffold/src/lib/client-portals.ts

@@ -77,6 +77,10 @@ export async function getClientPortalId(
   organizationId: string,
   slug: string
 ): Promise<string | null> {
+  if (isRuntimeSnapshotMode()) {
+    return null;
+  }
+
   const portal = await prisma.clientPortal.findFirst({
     where: { organizationId, slug, isActive: true },
     select: { id: true },
@@ -108,24 +112,15 @@ export async function getCredentialVersion(
 
 /**
  * Resolve the organizationId for the current request context.
- * Cloud: each Vercel project has ORG_ID set during provisioning.
- * Self-hosted: returns the single org in the DB.
+ * Hosted runtime reads it from the runtime snapshot.
+ * Local workspace returns the first org from the SQLite database.
  */
 export async function resolveDefaultOrganizationId(): Promise<string | null> {
   if (isRuntimeSnapshotMode()) {
     const state = await getRuntimeState();
-    return state?.organization.id ?? process.env.ORG_ID ?? null;
-  }
-
-  // Cloud: each Vercel project has ORG_ID set during provisioning
-  if (process.env.ORG_ID) {
-    const org = await prisma.organization.findUnique({
-      where: { id: process.env.ORG_ID },
-      select: { id: true },
-    });
-    return org?.id ?? null;
+    return state?.organization.id ?? null;
   }
-  // Self-hosted: use the single org in the DB
+  // Local workspace: use the first org in the DB
   const org = await prisma.organization.findFirst({
     select: { id: true },
     orderBy: { createdAt: "asc" },

package/bundle/scaffold/src/lib/deploy-bundle.ts

@@ -0,0 +1,106 @@
+import AdmZip from "adm-zip";
+import {
+  lstatSync,
+  readdirSync,
+  readFileSync,
+  realpathSync,
+  statSync,
+} from "node:fs";
+import path from "node:path";
+
+function walkFiles(dir: string, root: string, out: Set<string>) {
+  for (const entry of readdirSync(dir, { withFileTypes: true })) {
+    const fullPath = path.join(dir, entry.name);
+    if (entry.isDirectory()) {
+      walkFiles(fullPath, root, out);
+      continue;
+    }
+    out.add(path.relative(root, fullPath));
+  }
+}
+
+export function collectTracedFiles(appPath: string): Set<string> {
+  const files = new Set<string>();
+  const outputRoot = path.join(appPath, ".vercel", "output");
+  const functionsRoot = path.join(outputRoot, "functions");
+
+  walkFiles(outputRoot, appPath, files);
+
+  const queue = [functionsRoot];
+  while (queue.length > 0) {
+    const current = queue.pop();
+    if (!current) continue;
+    for (const entry of readdirSync(current, { withFileTypes: true })) {
+      const fullPath = path.join(current, entry.name);
+      if (entry.isDirectory()) {
+        queue.push(fullPath);
+        continue;
+      }
+      if (entry.name !== ".vc-config.json") continue;
+
+      const config = JSON.parse(readFileSync(fullPath, "utf8")) as {
+        filePathMap?: Record<string, string>;
+      };
+      for (const relativePath of Object.values(config.filePathMap ?? {})) {
+        files.add(relativePath);
+      }
+    }
+  }
+
+  return files;
+}
+
+function addPathToZip(zip: AdmZip, sourcePath: string, zipPath: string): number {
+  const zipPathPosix = zipPath.replace(/\\/g, "/");
+
+  if (zipPathPosix === ".env" || zipPathPosix.startsWith(".env.")) {
+    zip.addFile(zipPathPosix, Buffer.from("NODE_ENV=production\n"));
+    return 1;
+  }
+
+  const entry = lstatSync(sourcePath, { throwIfNoEntry: false });
+  if (!entry) {
+    return 0;
+  }
+
+  if (entry.isSymbolicLink()) {
+    return addPathToZip(zip, realpathSync(sourcePath), zipPathPosix);
+  }
+
+  if (entry.isDirectory()) {
+    let count = 0;
+    for (const child of readdirSync(sourcePath, { withFileTypes: true })) {
+      count += addPathToZip(
+        zip,
+        path.join(sourcePath, child.name),
+        path.posix.join(zipPathPosix, child.name),
+      );
+    }
+    return count;
+  }
+
+  if (!entry.isFile() && !statSync(sourcePath, { throwIfNoEntry: false })?.isFile()) {
+    return 0;
+  }
+
+  zip.addLocalFile(sourcePath, path.posix.dirname(zipPathPosix), path.posix.basename(zipPathPosix));
+  return 1;
+}
+
+export function createDeployBundle(appPath: string, outputPath: string): { fileCount: number } {
+  const outputRoot = path.join(appPath, ".vercel", "output");
+  if (!statSync(outputRoot, { throwIfNoEntry: false })?.isDirectory()) {
+    throw new Error("Missing .vercel/output. Run `npm run cloud:build` first.");
+  }
+
+  const zip = new AdmZip();
+  const tracedFiles = collectTracedFiles(appPath);
+  let fileCount = 0;
+
+  for (const relativePath of tracedFiles) {
+    fileCount += addPathToZip(zip, path.join(appPath, relativePath), relativePath);
+  }
+
+  zip.writeZip(outputPath);
+  return { fileCount };
+}

package/bundle/scaffold/src/lib/portal-contracts.ts

@@ -49,6 +49,39 @@ export interface PortalFileSyncManifestPayload {
   files: PortalFileSyncManifestEntry[];
 }
 
+export interface RuntimePortalSnapshot {
+  slug: string;
+  companyName: string;
+  logoUrl?: string | null;
+  username: string;
+  passwordHash: string;
+  credentialVersion: string;
+  isActive: boolean;
+  lastUpdated?: string | null;
+}
+
+export interface RuntimeOrganizationSnapshot {
+  id: string;
+  slug: string;
+  name: string;
+  logoUrl?: string | null;
+  primaryColor?: string;
+  portalLabel?: string;
+  websiteUrl?: string | null;
+  contactName?: string | null;
+  contactTitle?: string | null;
+  contactEmail?: string | null;
+  contactPhone?: string | null;
+  contactAvatar?: string | null;
+  supportEmail?: string | null;
+  customDomain?: string | null;
+}
+
+export interface RuntimeStatePayload {
+  organization: RuntimeOrganizationSnapshot;
+  portals: RuntimePortalSnapshot[];
+}
+
 const PORTAL_EVENT_TYPE_SET = new Set<string>(PORTAL_EVENT_TYPES);
 
 export function isPortalEventType(value: unknown): value is PortalEventType {

package/bundle/scaffold/src/lib/runtime-state.ts

@@ -1,38 +1,8 @@
 import { readFile } from "fs/promises";
 import path from "path";
+import type { RuntimeStatePayload } from "@/lib/portal-contracts";
 
-export type RuntimePortalSnapshot = {
-  slug: string;
-  companyName: string;
-  logoUrl?: string | null;
-  username: string;
-  passwordHash: string;
-  credentialVersion: string;
-  isActive: boolean;
-  lastUpdated?: string | null;
-};
-
-export type RuntimeOrganizationSnapshot = {
-  id: string;
-  slug: string;
-  name: string;
-  logoUrl?: string | null;
-  primaryColor?: string;
-  portalLabel?: string;
-  websiteUrl?: string | null;
-  contactName?: string | null;
-  contactTitle?: string | null;
-  contactEmail?: string | null;
-  contactPhone?: string | null;
-  contactAvatar?: string | null;
-  supportEmail?: string | null;
-  customDomain?: string | null;
-};
-
-export type RuntimeState = {
-  organization: RuntimeOrganizationSnapshot;
-  portals: RuntimePortalSnapshot[];
-};
+export type RuntimeState = RuntimeStatePayload;
 
 let cachedState: RuntimeState | null | undefined;
 

package/bundle/scaffold/src/types/adm-zip.d.ts

@@ -0,0 +1,15 @@
+declare module "adm-zip" {
+  export type AdmZipEntry = {
+    entryName: string;
+    isDirectory: boolean;
+    getData(): Buffer;
+  };
+
+  export default class AdmZip {
+    constructor(path?: string);
+    addFile(entryName: string, content: Buffer): void;
+    addLocalFile(filePath: string, zipPath?: string, zipName?: string): void;
+    getEntries(): AdmZipEntry[];
+    writeZip(targetFileName: string): void;
+  }
+}

package/bundle/toolchain/VERSION

@@ -1 +1 @@
-1.1.3 (requires app >= 0.2.3)
+1.1.4 (requires app >= 0.2.4)