@tenderprompt/accounts 0.2.0

package/dist/processes.js

@@ -0,0 +1,44 @@
+import { spawn } from "node:child_process";
+import { CliError } from "./errors.js";
+export async function runProjectCommand(input) {
+    await new Promise((resolvePromise, reject) => {
+        const child = spawn(input.command, {
+            cwd: input.cwd,
+            env: input.environment,
+            shell: true,
+            stdio: input.machineOutput ? ["inherit", "pipe", "pipe"] : "inherit",
+        });
+        if (input.machineOutput) {
+            child.stdout?.on("data", (chunk) => process.stderr.write(chunk));
+            child.stderr?.on("data", (chunk) => process.stderr.write(chunk));
+        }
+        child.on("error", reject);
+        child.on("exit", (code, signal) => {
+            if (code === 0)
+                resolvePromise();
+            else
+                reject(new CliError("project_command_failed", `Project command failed${signal ? ` with signal ${signal}` : ` with exit code ${code ?? "unknown"}`}: ${input.command}`));
+        });
+    });
+}
+export async function captureCommand(command, args, cwd) {
+    return await new Promise((resolvePromise, reject) => {
+        const child = spawn(command, args, { cwd, stdio: ["ignore", "pipe", "pipe"] });
+        const stdout = [];
+        const stderr = [];
+        child.stdout.on("data", (chunk) => stdout.push(Buffer.from(chunk)));
+        child.stderr.on("data", (chunk) => stderr.push(Buffer.from(chunk)));
+        child.on("error", reject);
+        child.on("exit", (code) => {
+            const result = {
+                stdout: Buffer.concat(stdout).toString("utf8").trim(),
+                stderr: Buffer.concat(stderr).toString("utf8").trim(),
+            };
+            if (code === 0)
+                resolvePromise(result);
+            else
+                reject(new CliError("project_git_unavailable", result.stderr || `${command} exited with code ${code ?? "unknown"}.`));
+        });
+    });
+}
+//# sourceMappingURL=processes.js.map

package/dist/processes.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"processes.js","sourceRoot":"","sources":["../src/processes.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,KAAK,EAAE,MAAM,oBAAoB,CAAC;AAC3C,OAAO,EAAE,QAAQ,EAAE,MAAM,aAAa,CAAC;AAOvC,MAAM,CAAC,KAAK,UAAU,iBAAiB,CAAC,KAKvC;IACC,MAAM,IAAI,OAAO,CAAO,CAAC,cAAc,EAAE,MAAM,EAAE,EAAE;QACjD,MAAM,KAAK,GAAG,KAAK,CAAC,KAAK,CAAC,OAAO,EAAE;YACjC,GAAG,EAAE,KAAK,CAAC,GAAG;YACd,GAAG,EAAE,KAAK,CAAC,WAAW;YACtB,KAAK,EAAE,IAAI;YACX,KAAK,EAAE,KAAK,CAAC,aAAa,CAAC,CAAC,CAAC,CAAC,SAAS,EAAE,MAAM,EAAE,MAAM,CAAC,CAAC,CAAC,CAAC,SAAS;SACrE,CAAC,CAAC;QACH,IAAI,KAAK,CAAC,aAAa,EAAE,CAAC;YACxB,KAAK,CAAC,MAAM,EAAE,EAAE,CAAC,MAAM,EAAE,CAAC,KAAK,EAAE,EAAE,CAAC,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,CAAC;YACjE,KAAK,CAAC,MAAM,EAAE,EAAE,CAAC,MAAM,EAAE,CAAC,KAAK,EAAE,EAAE,CAAC,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,CAAC;QACnE,CAAC;QACD,KAAK,CAAC,EAAE,CAAC,OAAO,EAAE,MAAM,CAAC,CAAC;QAC1B,KAAK,CAAC,EAAE,CAAC,MAAM,EAAE,CAAC,IAAI,EAAE,MAAM,EAAE,EAAE;YAChC,IAAI,IAAI,KAAK,CAAC;gBAAE,cAAc,EAAE,CAAC;;gBAC5B,MAAM,CAAC,IAAI,QAAQ,CACtB,wBAAwB,EACxB,yBAAyB,MAAM,CAAC,CAAC,CAAC,gBAAgB,MAAM,EAAE,CAAC,CAAC,CAAC,mBAAmB,IAAI,IAAI,SAAS,EAAE,KAAK,KAAK,CAAC,OAAO,EAAE,CACxH,CAAC,CAAC;QACL,CAAC,CAAC,CAAC;IACL,CAAC,CAAC,CAAC;AACL,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,cAAc,CAAC,OAAe,EAAE,IAAc,EAAE,GAAW;IAC/E,OAAO,MAAM,IAAI,OAAO,CAAgB,CAAC,cAAc,EAAE,MAAM,EAAE,EAAE;QACjE,MAAM,KAAK,GAAG,KAAK,CAAC,OAAO,EAAE,IAAI,EAAE,EAAE,GAAG,EAAE,KAAK,EAAE,CAAC,QAAQ,EAAE,MAAM,EAAE,MAAM,CAAC,EAAE,CAAC,CAAC;QAC/E,MAAM,MAAM,GAAa,EAAE,CAAC;QAC5B,MAAM,MAAM,GAAa,EAAE,CAAC;QAC5B,KAAK,CAAC,MAAM,CAAC,EAAE,CAAC,MAAM,EAAE,CAAC,KAAK,EAAE,EAAE,CAAC,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC;QACpE,KAAK,CAAC,MAAM,CAAC,EAAE,CAAC,MAAM,EAAE,CAAC,KAAK,EAAE,EAAE,CAAC,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC;QACpE,KAAK,CAAC,EAAE,CAAC,OAAO,EAAE,MAAM,CAAC,CAAC;QAC1B,KAAK,CAAC,EAAE,CAAC,MAAM,EAAE,CAAC,IAAI,EAAE,EAAE;YACxB,MAAM,MAAM,GAAG;gBACb,MAAM,EAAE,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC,IAAI,EAAE;gBACrD,MAAM,EAAE,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC,IAAI,EAAE;aACtD,CAAC;YACF,IAAI,IAAI,KAAK,CAAC;gBAAE,cAAc,CAAC,MAAM,CAAC,CAAC;;gBAClC,MAAM,CAAC,IAAI,QAAQ,CAAC,yBAAyB,EAAE,MAAM,CAAC,MAAM,IAAI,GAAG,OAAO,qBAAqB,IAAI,IAAI,SAAS,GAAG,CAAC,CAAC,CAAC;QAC7H,CAAC,CAAC,CAAC;IACL,CAAC,CAAC,CAAC;AACL,CAAC"}

package/dist/starter.d.ts

@@ -0,0 +1,20 @@
+export interface StarterInput {
+    cwd: string;
+    directory?: string;
+    name: string;
+    slug?: string;
+    template?: string;
+    dryRun: boolean;
+}
+export interface StarterResult {
+    status: "planned" | "created";
+    template: string;
+    name: string;
+    slug: string;
+    directory: string;
+    files: string[];
+    wroteFiles: boolean;
+    nextSteps: string[];
+}
+export declare function initializeStarter(input: StarterInput): Promise<StarterResult>;
+//# sourceMappingURL=starter.d.ts.map

package/dist/starter.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"starter.d.ts","sourceRoot":"","sources":["../src/starter.ts"],"names":[],"mappings":"AAUA,MAAM,WAAW,YAAY;IAC3B,GAAG,EAAE,MAAM,CAAC;IACZ,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,IAAI,EAAE,MAAM,CAAC;IACb,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,MAAM,EAAE,OAAO,CAAC;CACjB;AAED,MAAM,WAAW,aAAa;IAC5B,MAAM,EAAE,SAAS,GAAG,SAAS,CAAC;IAC9B,QAAQ,EAAE,MAAM,CAAC;IACjB,IAAI,EAAE,MAAM,CAAC;IACb,IAAI,EAAE,MAAM,CAAC;IACb,SAAS,EAAE,MAAM,CAAC;IAClB,KAAK,EAAE,MAAM,EAAE,CAAC;IAChB,UAAU,EAAE,OAAO,CAAC;IACpB,SAAS,EAAE,MAAM,EAAE,CAAC;CACrB;AAED,wBAAsB,iBAAiB,CAAC,KAAK,EAAE,YAAY,GAAG,OAAO,CAAC,aAAa,CAAC,CAwDnF"}

package/dist/starter.js

@@ -0,0 +1,159 @@
+import { fileURLToPath } from "node:url";
+import { lstat, mkdir, readFile, readdir, writeFile } from "node:fs/promises";
+import { dirname, isAbsolute, relative, resolve, sep } from "node:path";
+import { CliError } from "./errors.js";
+const DEFAULT_TEMPLATE = "shopify-customer-account";
+const TEMPLATE_FILE_MAX_BYTES = 2 * 1024 * 1024;
+const STARTER_NAME = /^[A-Za-z0-9][A-Za-z0-9 _-]{1,63}$/u;
+const STARTER_SLUG = /^[a-z0-9][a-z0-9-]{1,47}$/u;
+export async function initializeStarter(input) {
+    const template = input.template ?? DEFAULT_TEMPLATE;
+    if (template !== DEFAULT_TEMPLATE) {
+        throw new CliError("starter_template_unknown", `Unknown starter template: ${template}.`, `tender-accounts init --name "My account" --template ${DEFAULT_TEMPLATE}`);
+    }
+    const name = validStarterName(input.name);
+    const slug = validStarterSlug(input.slug ?? slugify(name));
+    const target = await safeStarterTarget(input.cwd, input.directory ?? ".");
+    await assertEmptyStarterTarget(target);
+    const templateRoot = fileURLToPath(new URL(`../templates/${template}/`, import.meta.url));
+    const templateFiles = await walkTemplate(templateRoot);
+    const files = templateFiles.map((path) => renderedRelativePath(relative(templateRoot, path)))
+        .concat(".agents/skills/tender-accounts/SKILL.md")
+        .sort((left, right) => left.localeCompare(right));
+    if (!input.dryRun) {
+        await mkdir(target, { recursive: true });
+        for (const source of templateFiles) {
+            const relativeSource = relative(templateRoot, source);
+            const destination = resolve(target, renderedRelativePath(relativeSource));
+            assertWithin(target, destination);
+            const entry = await lstat(source);
+            if (!entry.isFile() || entry.isSymbolicLink() || entry.size > TEMPLATE_FILE_MAX_BYTES) {
+                throw new CliError("starter_template_unsafe", `Starter template contains an unsafe file: ${relativeSource}.`);
+            }
+            const contents = new TextDecoder("utf-8", { fatal: true }).decode(await readFile(source));
+            await mkdir(dirname(destination), { recursive: true });
+            await writeFile(destination, renderTemplate(contents, { name, slug }), { encoding: "utf8", flag: "wx" });
+        }
+        const skillDestination = resolve(target, ".agents/skills/tender-accounts/SKILL.md");
+        await mkdir(dirname(skillDestination), { recursive: true });
+        await writeFile(skillDestination, await readFile(skillPath(), "utf8"), { encoding: "utf8", flag: "wx" });
+    }
+    const displayDirectory = relative(resolve(input.cwd), target) || ".";
+    const prefix = displayDirectory === "." ? "" : `cd ${shellSafePath(displayDirectory)} && `;
+    return {
+        status: input.dryRun ? "planned" : "created",
+        template,
+        name,
+        slug,
+        directory: target,
+        files,
+        wroteFiles: !input.dryRun,
+        nextSteps: [
+            `${prefix}npm install`,
+            `${prefix}git init && git add . && git commit -m "Initialize ${name}"`,
+            `${prefix}npm run dev`,
+            `${prefix}npx tender-accounts doctor --cwd apps/portal --json`,
+        ],
+    };
+}
+function validStarterName(value) {
+    const normalized = value.trim().replace(/\s+/gu, " ");
+    if (!STARTER_NAME.test(normalized)) {
+        throw new CliError("starter_name_invalid", "--name must be 2-64 letters, numbers, spaces, hyphens, or underscores.", "tender-accounts init --name \"My customer account\" --directory ./my-account");
+    }
+    return normalized;
+}
+function validStarterSlug(value) {
+    const normalized = value.trim().toLowerCase();
+    if (!STARTER_SLUG.test(normalized) || normalized.endsWith("-")) {
+        throw new CliError("starter_slug_invalid", "--slug must be 2-48 lowercase letters, numbers, or hyphens and cannot end with a hyphen.", "tender-accounts init --name \"My account\" --slug my-account");
+    }
+    return normalized;
+}
+function slugify(value) {
+    return value.toLowerCase().replace(/[^a-z0-9]+/gu, "-").replace(/^-+|-+$/gu, "").slice(0, 48).replace(/-+$/u, "");
+}
+async function safeStarterTarget(cwd, value) {
+    if (isAbsolute(value) || value.includes("\\") || value.includes("%") || /[\r\n\0]/u.test(value)) {
+        throw new CliError("starter_directory_unsafe", "--directory must be a safe path relative to the current directory.");
+    }
+    const segments = value === "." ? [] : value.split("/");
+    if (segments.some((segment) => !segment || segment === "." || segment === ".." || !/^[A-Za-z0-9._-]+$/u.test(segment))) {
+        throw new CliError("starter_directory_unsafe", "--directory must be a safe path relative to the current directory.");
+    }
+    const root = resolve(cwd);
+    const target = resolve(root, ...segments);
+    if (target !== root)
+        assertWithin(root, target);
+    let cursor = root;
+    for (const segment of segments) {
+        cursor = resolve(cursor, segment);
+        const entry = await optionalLstat(cursor);
+        if (entry?.isSymbolicLink()) {
+            throw new CliError("starter_directory_unsafe", `Starter path cannot traverse a symbolic link: ${cursor}.`);
+        }
+        if (entry && !entry.isDirectory()) {
+            throw new CliError("starter_directory_unsafe", `Starter path is not a directory: ${cursor}.`);
+        }
+    }
+    return target;
+}
+async function assertEmptyStarterTarget(target) {
+    const entry = await optionalLstat(target);
+    if (!entry)
+        return;
+    if (!entry.isDirectory() || entry.isSymbolicLink()) {
+        throw new CliError("starter_target_unsafe", "The starter target must be a regular directory.");
+    }
+    const existing = (await readdir(target)).filter((name) => name !== ".git");
+    if (existing.length > 0) {
+        throw new CliError("starter_target_not_empty", `The starter target contains existing files: ${existing.slice(0, 5).join(", ")}.`, "Choose a new empty --directory. Existing applications should adopt tender-accounts.json instead of using init.");
+    }
+}
+async function walkTemplate(root) {
+    const entries = await readdir(root, { withFileTypes: true });
+    const files = [];
+    for (const entry of entries.sort((left, right) => left.name.localeCompare(right.name))) {
+        const path = resolve(root, entry.name);
+        if (entry.isSymbolicLink())
+            throw new CliError("starter_template_unsafe", `Starter template contains a symbolic link: ${path}.`);
+        if (entry.isDirectory())
+            files.push(...await walkTemplate(path));
+        else if (entry.isFile())
+            files.push(path);
+        else
+            throw new CliError("starter_template_unsafe", `Starter template contains an unsupported entry: ${path}.`);
+    }
+    return files;
+}
+function renderedRelativePath(value) {
+    return value.split(sep).map((segment) => segment.startsWith("dot.") ? `.${segment.slice(4)}` : segment).join("/");
+}
+function renderTemplate(value, input) {
+    return value
+        .replaceAll("__APP_NAME__", input.name)
+        .replaceAll("__APP_SLUG__", input.slug);
+}
+function assertWithin(root, target) {
+    const suffix = relative(resolve(root), resolve(target));
+    if (!suffix || suffix === ".." || suffix.startsWith(`..${sep}`) || isAbsolute(suffix)) {
+        throw new CliError("starter_directory_unsafe", "Starter files must stay inside the selected directory.");
+    }
+}
+async function optionalLstat(path) {
+    try {
+        return await lstat(path);
+    }
+    catch (error) {
+        if (error instanceof Error && "code" in error && error.code === "ENOENT")
+            return null;
+        throw error;
+    }
+}
+function skillPath() {
+    return fileURLToPath(new URL("../skill/tender-accounts/SKILL.md", import.meta.url));
+}
+function shellSafePath(value) {
+    return /^[A-Za-z0-9._/-]+$/u.test(value) ? value : JSON.stringify(value);
+}
+//# sourceMappingURL=starter.js.map

package/dist/starter.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"starter.js","sourceRoot":"","sources":["../src/starter.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,aAAa,EAAE,MAAM,UAAU,CAAC;AACzC,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,QAAQ,EAAE,OAAO,EAAE,SAAS,EAAE,MAAM,kBAAkB,CAAC;AAC9E,OAAO,EAAE,OAAO,EAAE,UAAU,EAAE,QAAQ,EAAE,OAAO,EAAE,GAAG,EAAE,MAAM,WAAW,CAAC;AACxE,OAAO,EAAE,QAAQ,EAAE,MAAM,aAAa,CAAC;AAEvC,MAAM,gBAAgB,GAAG,0BAA0B,CAAC;AACpD,MAAM,uBAAuB,GAAG,CAAC,GAAG,IAAI,GAAG,IAAI,CAAC;AAChD,MAAM,YAAY,GAAG,oCAAoC,CAAC;AAC1D,MAAM,YAAY,GAAG,4BAA4B,CAAC;AAsBlD,MAAM,CAAC,KAAK,UAAU,iBAAiB,CAAC,KAAmB;IACzD,MAAM,QAAQ,GAAG,KAAK,CAAC,QAAQ,IAAI,gBAAgB,CAAC;IACpD,IAAI,QAAQ,KAAK,gBAAgB,EAAE,CAAC;QAClC,MAAM,IAAI,QAAQ,CAChB,0BAA0B,EAC1B,6BAA6B,QAAQ,GAAG,EACxC,uDAAuD,gBAAgB,EAAE,CAC1E,CAAC;IACJ,CAAC;IACD,MAAM,IAAI,GAAG,gBAAgB,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;IAC1C,MAAM,IAAI,GAAG,gBAAgB,CAAC,KAAK,CAAC,IAAI,IAAI,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC;IAC3D,MAAM,MAAM,GAAG,MAAM,iBAAiB,CAAC,KAAK,CAAC,GAAG,EAAE,KAAK,CAAC,SAAS,IAAI,GAAG,CAAC,CAAC;IAC1E,MAAM,wBAAwB,CAAC,MAAM,CAAC,CAAC;IAEvC,MAAM,YAAY,GAAG,aAAa,CAAC,IAAI,GAAG,CAAC,gBAAgB,QAAQ,GAAG,EAAE,OAAO,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC;IAC1F,MAAM,aAAa,GAAG,MAAM,YAAY,CAAC,YAAY,CAAC,CAAC;IACvD,MAAM,KAAK,GAAG,aAAa,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,oBAAoB,CAAC,QAAQ,CAAC,YAAY,EAAE,IAAI,CAAC,CAAC,CAAC;SAC1F,MAAM,CAAC,yCAAyC,CAAC;SACjD,IAAI,CAAC,CAAC,IAAI,EAAE,KAAK,EAAE,EAAE,CAAC,IAAI,CAAC,aAAa,CAAC,KAAK,CAAC,CAAC,CAAC;IAEpD,IAAI,CAAC,KAAK,CAAC,MAAM,EAAE,CAAC;QAClB,MAAM,KAAK,CAAC,MAAM,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;QACzC,KAAK,MAAM,MAAM,IAAI,aAAa,EAAE,CAAC;YACnC,MAAM,cAAc,GAAG,QAAQ,CAAC,YAAY,EAAE,MAAM,CAAC,CAAC;YACtD,MAAM,WAAW,GAAG,OAAO,CAAC,MAAM,EAAE,oBAAoB,CAAC,cAAc,CAAC,CAAC,CAAC;YAC1E,YAAY,CAAC,MAAM,EAAE,WAAW,CAAC,CAAC;YAClC,MAAM,KAAK,GAAG,MAAM,KAAK,CAAC,MAAM,CAAC,CAAC;YAClC,IAAI,CAAC,KAAK,CAAC,MAAM,EAAE,IAAI,KAAK,CAAC,cAAc,EAAE,IAAI,KAAK,CAAC,IAAI,GAAG,uBAAuB,EAAE,CAAC;gBACtF,MAAM,IAAI,QAAQ,CAAC,yBAAyB,EAAE,6CAA6C,cAAc,GAAG,CAAC,CAAC;YAChH,CAAC;YACD,MAAM,QAAQ,GAAG,IAAI,WAAW,CAAC,OAAO,EAAE,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC,MAAM,CAAC,MAAM,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC;YAC1F,MAAM,KAAK,CAAC,OAAO,CAAC,WAAW,CAAC,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;YACvD,MAAM,SAAS,CAAC,WAAW,EAAE,cAAc,CAAC,QAAQ,EAAE,EAAE,IAAI,EAAE,IAAI,EAAE,CAAC,EAAE,EAAE,QAAQ,EAAE,MAAM,EAAE,IAAI,EAAE,IAAI,EAAE,CAAC,CAAC;QAC3G,CAAC;QACD,MAAM,gBAAgB,GAAG,OAAO,CAAC,MAAM,EAAE,yCAAyC,CAAC,CAAC;QACpF,MAAM,KAAK,CAAC,OAAO,CAAC,gBAAgB,CAAC,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;QAC5D,MAAM,SAAS,CAAC,gBAAgB,EAAE,MAAM,QAAQ,CAAC,SAAS,EAAE,EAAE,MAAM,CAAC,EAAE,EAAE,QAAQ,EAAE,MAAM,EAAE,IAAI,EAAE,IAAI,EAAE,CAAC,CAAC;IAC3G,CAAC;IAED,MAAM,gBAAgB,GAAG,QAAQ,CAAC,OAAO,CAAC,KAAK,CAAC,GAAG,CAAC,EAAE,MAAM,CAAC,IAAI,GAAG,CAAC;IACrE,MAAM,MAAM,GAAG,gBAAgB,KAAK,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,MAAM,aAAa,CAAC,gBAAgB,CAAC,MAAM,CAAC;IAC3F,OAAO;QACL,MAAM,EAAE,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,SAAS;QAC5C,QAAQ;QACR,IAAI;QACJ,IAAI;QACJ,SAAS,EAAE,MAAM;QACjB,KAAK;QACL,UAAU,EAAE,CAAC,KAAK,CAAC,MAAM;QACzB,SAAS,EAAE;YACT,GAAG,MAAM,aAAa;YACtB,GAAG,MAAM,sDAAsD,IAAI,GAAG;YACtE,GAAG,MAAM,aAAa;YACtB,GAAG,MAAM,qDAAqD;SAC/D;KACF,CAAC;AACJ,CAAC;AAED,SAAS,gBAAgB,CAAC,KAAa;IACrC,MAAM,UAAU,GAAG,KAAK,CAAC,IAAI,EAAE,CAAC,OAAO,CAAC,OAAO,EAAE,GAAG,CAAC,CAAC;IACtD,IAAI,CAAC,YAAY,CAAC,IAAI,CAAC,UAAU,CAAC,EAAE,CAAC;QACnC,MAAM,IAAI,QAAQ,CAChB,sBAAsB,EACtB,wEAAwE,EACxE,8EAA8E,CAC/E,CAAC;IACJ,CAAC;IACD,OAAO,UAAU,CAAC;AACpB,CAAC;AAED,SAAS,gBAAgB,CAAC,KAAa;IACrC,MAAM,UAAU,GAAG,KAAK,CAAC,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC;IAC9C,IAAI,CAAC,YAAY,CAAC,IAAI,CAAC,UAAU,CAAC,IAAI,UAAU,CAAC,QAAQ,CAAC,GAAG,CAAC,EAAE,CAAC;QAC/D,MAAM,IAAI,QAAQ,CAChB,sBAAsB,EACtB,0FAA0F,EAC1F,8DAA8D,CAC/D,CAAC;IACJ,CAAC;IACD,OAAO,UAAU,CAAC;AACpB,CAAC;AAED,SAAS,OAAO,CAAC,KAAa;IAC5B,OAAO,KAAK,CAAC,WAAW,EAAE,CAAC,OAAO,CAAC,cAAc,EAAE,GAAG,CAAC,CAAC,OAAO,CAAC,WAAW,EAAE,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC;AACpH,CAAC;AAED,KAAK,UAAU,iBAAiB,CAAC,GAAW,EAAE,KAAa;IACzD,IAAI,UAAU,CAAC,KAAK,CAAC,IAAI,KAAK,CAAC,QAAQ,CAAC,IAAI,CAAC,IAAI,KAAK,CAAC,QAAQ,CAAC,GAAG,CAAC,IAAI,WAAW,CAAC,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC;QAChG,MAAM,IAAI,QAAQ,CAAC,0BAA0B,EAAE,oEAAoE,CAAC,CAAC;IACvH,CAAC;IACD,MAAM,QAAQ,GAAG,KAAK,KAAK,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,KAAK,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;IACvD,IAAI,QAAQ,CAAC,IAAI,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC,CAAC,OAAO,IAAI,OAAO,KAAK,GAAG,IAAI,OAAO,KAAK,IAAI,IAAI,CAAC,oBAAoB,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC,EAAE,CAAC;QACvH,MAAM,IAAI,QAAQ,CAAC,0BAA0B,EAAE,oEAAoE,CAAC,CAAC;IACvH,CAAC;IACD,MAAM,IAAI,GAAG,OAAO,CAAC,GAAG,CAAC,CAAC;IAC1B,MAAM,MAAM,GAAG,OAAO,CAAC,IAAI,EAAE,GAAG,QAAQ,CAAC,CAAC;IAC1C,IAAI,MAAM,KAAK,IAAI;QAAE,YAAY,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC;IAChD,IAAI,MAAM,GAAG,IAAI,CAAC;IAClB,KAAK,MAAM,OAAO,IAAI,QAAQ,EAAE,CAAC;QAC/B,MAAM,GAAG,OAAO,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;QAClC,MAAM,KAAK,GAAG,MAAM,aAAa,CAAC,MAAM,CAAC,CAAC;QAC1C,IAAI,KAAK,EAAE,cAAc,EAAE,EAAE,CAAC;YAC5B,MAAM,IAAI,QAAQ,CAAC,0BAA0B,EAAE,iDAAiD,MAAM,GAAG,CAAC,CAAC;QAC7G,CAAC;QACD,IAAI,KAAK,IAAI,CAAC,KAAK,CAAC,WAAW,EAAE,EAAE,CAAC;YAClC,MAAM,IAAI,QAAQ,CAAC,0BAA0B,EAAE,oCAAoC,MAAM,GAAG,CAAC,CAAC;QAChG,CAAC;IACH,CAAC;IACD,OAAO,MAAM,CAAC;AAChB,CAAC;AAED,KAAK,UAAU,wBAAwB,CAAC,MAAc;IACpD,MAAM,KAAK,GAAG,MAAM,aAAa,CAAC,MAAM,CAAC,CAAC;IAC1C,IAAI,CAAC,KAAK;QAAE,OAAO;IACnB,IAAI,CAAC,KAAK,CAAC,WAAW,EAAE,IAAI,KAAK,CAAC,cAAc,EAAE,EAAE,CAAC;QACnD,MAAM,IAAI,QAAQ,CAAC,uBAAuB,EAAE,iDAAiD,CAAC,CAAC;IACjG,CAAC;IACD,MAAM,QAAQ,GAAG,CAAC,MAAM,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,KAAK,MAAM,CAAC,CAAC;IAC3E,IAAI,QAAQ,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QACxB,MAAM,IAAI,QAAQ,CAChB,0BAA0B,EAC1B,+CAA+C,QAAQ,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,EACjF,gHAAgH,CACjH,CAAC;IACJ,CAAC;AACH,CAAC;AAED,KAAK,UAAU,YAAY,CAAC,IAAY;IACtC,MAAM,OAAO,GAAG,MAAM,OAAO,CAAC,IAAI,EAAE,EAAE,aAAa,EAAE,IAAI,EAAE,CAAC,CAAC;IAC7D,MAAM,KAAK,GAAa,EAAE,CAAC;IAC3B,KAAK,MAAM,KAAK,IAAI,OAAO,CAAC,IAAI,CAAC,CAAC,IAAI,EAAE,KAAK,EAAE,EAAE,CAAC,IAAI,CAAC,IAAI,CAAC,aAAa,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,EAAE,CAAC;QACvF,MAAM,IAAI,GAAG,OAAO,CAAC,IAAI,EAAE,KAAK,CAAC,IAAI,CAAC,CAAC;QACvC,IAAI,KAAK,CAAC,cAAc,EAAE;YAAE,MAAM,IAAI,QAAQ,CAAC,yBAAyB,EAAE,8CAA8C,IAAI,GAAG,CAAC,CAAC;QACjI,IAAI,KAAK,CAAC,WAAW,EAAE;YAAE,KAAK,CAAC,IAAI,CAAC,GAAG,MAAM,YAAY,CAAC,IAAI,CAAC,CAAC,CAAC;aAC5D,IAAI,KAAK,CAAC,MAAM,EAAE;YAAE,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;;YACrC,MAAM,IAAI,QAAQ,CAAC,yBAAyB,EAAE,mDAAmD,IAAI,GAAG,CAAC,CAAC;IACjH,CAAC;IACD,OAAO,KAAK,CAAC;AACf,CAAC;AAED,SAAS,oBAAoB,CAAC,KAAa;IACzC,OAAO,KAAK,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,GAAG,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC,OAAO,CAAC,UAAU,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,IAAI,OAAO,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;AACpH,CAAC;AAED,SAAS,cAAc,CAAC,KAAa,EAAE,KAAqC;IAC1E,OAAO,KAAK;SACT,UAAU,CAAC,cAAc,EAAE,KAAK,CAAC,IAAI,CAAC;SACtC,UAAU,CAAC,cAAc,EAAE,KAAK,CAAC,IAAI,CAAC,CAAC;AAC5C,CAAC;AAED,SAAS,YAAY,CAAC,IAAY,EAAE,MAAc;IAChD,MAAM,MAAM,GAAG,QAAQ,CAAC,OAAO,CAAC,IAAI,CAAC,EAAE,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC;IACxD,IAAI,CAAC,MAAM,IAAI,MAAM,KAAK,IAAI,IAAI,MAAM,CAAC,UAAU,CAAC,KAAK,GAAG,EAAE,CAAC,IAAI,UAAU,CAAC,MAAM,CAAC,EAAE,CAAC;QACtF,MAAM,IAAI,QAAQ,CAAC,0BAA0B,EAAE,wDAAwD,CAAC,CAAC;IAC3G,CAAC;AACH,CAAC;AAED,KAAK,UAAU,aAAa,CAAC,IAAY;IACvC,IAAI,CAAC;QACH,OAAO,MAAM,KAAK,CAAC,IAAI,CAAC,CAAC;IAC3B,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,IAAI,KAAK,YAAY,KAAK,IAAI,MAAM,IAAI,KAAK,IAAI,KAAK,CAAC,IAAI,KAAK,QAAQ;YAAE,OAAO,IAAI,CAAC;QACtF,MAAM,KAAK,CAAC;IACd,CAAC;AACH,CAAC;AAED,SAAS,SAAS;IAChB,OAAO,aAAa,CAAC,IAAI,GAAG,CAAC,mCAAmC,EAAE,OAAO,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC;AACtF,CAAC;AAED,SAAS,aAAa,CAAC,KAAa;IAClC,OAAO,qBAAqB,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,CAAC;AAC3E,CAAC"}

package/package.json

@@ -0,0 +1,32 @@
+{
+  "name": "@tenderprompt/accounts",
+  "version": "0.2.0",
+  "description": "Project-scoped developer CLI for Tender Accounts applications",
+  "type": "module",
+  "license": "UNLICENSED",
+  "bin": {
+    "tender-accounts": "./dist/cli.js"
+  },
+  "files": [
+    "dist",
+    "skill",
+    "templates",
+    "README.md"
+  ],
+  "engines": {
+    "node": ">=22.0.0"
+  },
+  "scripts": {
+    "build": "tsc -p tsconfig.build.json",
+    "check": "npm run typecheck && npm run test && npm run build",
+    "sync:starter": "node ./scripts/sync-starter-template.mjs",
+    "test": "vitest run",
+    "typecheck": "tsc --noEmit -p tsconfig.json",
+    "prepack": "npm run sync:starter && npm run check"
+  },
+  "devDependencies": {
+    "@types/node": "^26.2.0",
+    "typescript": "^7.0.2",
+    "vitest": "^4.1.11"
+  }
+}

package/skill/tender-accounts/SKILL.md

@@ -0,0 +1,111 @@
+---
+name: tender-accounts
+description: Create, build, validate, and preview merchant-owned Tender Accounts applications with the project-scoped CLI. Use when starting a new customer account, changing a repository that contains tender-accounts.json, implementing a customer-account feature, diagnosing a Tender Accounts preview, or preparing an exact preview for review.
+---
+
+# Tender Accounts application delivery
+
+Use the repository-installed `tender-accounts` CLI as the only platform interface. Let the merchant repository own its framework, build commands, Worker code, and commerce integrations.
+
+## Start a new application only when requested
+
+When the user asked for a new Shopify customer-account repository and the target is empty, inspect the exact plan and then create the optional starter:
+
+```sh
+npx tender-accounts init --name "Merchant customer account" --directory ./merchant-account --dry-run --json
+npx tender-accounts init --name "Merchant customer account" --directory ./merchant-account --json
+```
+
+Never run `init` inside an existing application or use it to replace a merchant's architecture. It creates a stable gateway and independently editable `apps/portal`. UI-only tasks stay in the portal; authentication, sessions, D1, confidential bindings, and protected APIs stay in the gateway. The command deliberately does not install dependencies, initialize Git, link projects, or deploy.
+
+## Start every task with scope discovery
+
+1. Read the closest `AGENTS.md` files and `tender-accounts.json`. In a generated two-service repository, identify whether the request belongs to `apps/portal` or `apps/gateway` before editing.
+2. Run:
+
+   ```sh
+   npx tender-accounts doctor --json
+   ```
+
+3. Stop if configuration, authentication, linking, or project access fails. Report the exact error code and remediation. Never bypass the CLI with direct API calls.
+4. Confirm the linked project is the application the user requested. Use `--cwd apps/portal` or `--cwd apps/gateway` from a generated repository. Do not edit a gateway, service, or portal outside the current repository and credential scope.
+
+If the app has not been linked, ask the merchant administrator for a short-lived credential scoped to this project. Put it only in ignored `.dev.vars`, then run:
+
+```sh
+npx tender-accounts link --json
+```
+
+When one credential grants multiple projects, select the intended project once with `--project`.
+
+## Implement and validate
+
+1. Inspect the existing application and tests before changing code.
+2. Use the repository's own development workflow. `npx tender-accounts dev` delegates to the committed `commands.dev` and never performs a Cloudflare deployment.
+3. Make the smallest source change that satisfies the request.
+4. Run the deterministic repository checks:
+
+   ```sh
+   npx tender-accounts check --json
+   ```
+
+5. Validate the complete portable artifact without uploading it:
+
+   ```sh
+   npx tender-accounts preview --dry-run --json
+   ```
+
+Do not weaken checks, remove declared bindings, or place runtime values in the artifact to make validation pass.
+
+## Create an exact preview
+
+After local validation succeeds, run:
+
+```sh
+npx tender-accounts preview --json
+```
+
+Treat stdout as one machine-readable JSON object. Preserve and report:
+
+- `previewUrl`;
+- `deliveryId`;
+- `releaseId`;
+- `bundleDigest`;
+- validation performed before delivery.
+
+The CLI may label an uncommitted local preview with a `local-...` source revision. The immutable bundle digest remains the content identity. Do not claim the change is committed or pushed unless separately verified.
+
+## Diagnose a delivery
+
+Read exact workflow state:
+
+```sh
+npx tender-accounts delivery status --delivery <delivery-id> --json
+```
+
+Retry only a requested or failed preview workflow:
+
+```sh
+npx tender-accounts delivery retry --delivery <delivery-id> --json
+```
+
+Mint a new browser session for an already-succeeded delivery without rebuilding:
+
+```sh
+npx tender-accounts delivery preview --delivery <delivery-id> --json
+```
+
+Use the error code, request ID, and suggested command from the CLI. Do not retry with altered IDs, another project, or raw HTTP requests.
+
+## Hard boundaries
+
+- Never run `wrangler deploy` or use Cloudflare deployment credentials.
+- Never call Tender Accounts internal APIs with `curl` or custom scripts.
+- Never print, read back, commit, or copy `.dev.vars` values.
+- Never put Shopify, subscription-provider, or other merchant credentials in source, build output, logs, or screenshots.
+- Never change `.tender/link.json` by hand; use `tender-accounts link`.
+- Never publish production from an agent credential. The CLI intentionally has no publish command.
+- Never expand project scope. Ask a merchant administrator for a different credential when the requested app is outside the current grant.
+- Never treat a successful preview as a production release, merge, commit, or push.
+
+Production moves only through the merchant's protected default-branch policy or an authenticated merchant administrator in the Tender Accounts console.

package/templates/shopify-customer-account/AGENTS.md

@@ -0,0 +1,14 @@
+# __APP_NAME__ application boundary
+
+This is a merchant-owned Tender Accounts application. The gateway and portal are independently deployable projects.
+
+## Working rules
+
+- For portal-only requests, change `apps/portal` and do not edit `apps/gateway`.
+- Keep Shopify authentication, confidential bindings, sessions, and protected API routes in `apps/gateway`.
+- Keep `apps/portal` free of Shopify customer tokens, session storage, D1 access, and provider secrets.
+- Use `npx tender-accounts` for project linking, validation, and previews. Never call Tender internal APIs directly.
+- Never run `wrangler deploy`; production and preview delivery are controlled by Tender Accounts.
+- Never commit `.dev.vars`, `.tender/`, credentials, customer data, or provider responses.
+- Shopify and selected commerce providers remain systems of record. Do not duplicate their durable business state without an explicit design.
+- Run the closest app checks and `npx tender-accounts preview --dry-run --json` before creating a preview.

package/templates/shopify-customer-account/README.md

@@ -0,0 +1,44 @@
+# __APP_NAME__
+
+Merchant-owned Shopify customer account built as two independently deployable Tender Accounts applications:
+
+```text
+customer hostname
+       |
+       v
+apps/gateway  -- PORTAL_UI service binding -->  apps/portal
+Shopify auth                                  React UI
+HttpOnly sessions                             no customer tokens
+application D1                                no confidential bindings
+/auth/* and /api/*
+```
+
+The gateway owns Shopify Customer Account authentication and application sessions. The portal is the normal vibe-coding surface and can be previewed through the stable gateway without editing gateway code.
+
+## Start locally
+
+1. Install dependencies with `npm install`.
+2. Initialize Git and make the first commit.
+3. Copy `apps/gateway/.dev.vars.example` to `apps/gateway/.dev.vars` and replace only the public configuration values.
+4. Run `npm run dev`.
+
+Local development intentionally stays signed out because Shopify requires registered HTTPS callback URLs. Use an immutable Tender preview to test real sign-in.
+
+## Create a preview
+
+Each app is linked and delivered independently. A merchant administrator provides a short-lived developer credential scoped to the correct Tender project. Put it in the ignored root `.dev.vars` file; the CLI searches up to the repository root when `--cwd` selects an app.
+
+```sh
+npx tender-accounts link --cwd apps/portal --json
+npx tender-accounts doctor --cwd apps/portal --json
+npx tender-accounts preview --cwd apps/portal --dry-run --json
+npx tender-accounts preview --cwd apps/portal --json
+```
+
+Use `apps/gateway` instead only when gateway code or bindings changed. The CLI intentionally cannot publish production.
+
+## Configure Shopify
+
+Register the canonical gateway hostname as the JavaScript origin and use its `/auth/callback` and `/auth/logout/callback` URLs in Shopify Customer Account settings. Put the public client ID and Shopify domains in the gateway's local `.dev.vars`; Tender injects the environment values for previews and production.
+
+If the platform connects a merchant vanity domain, add that exact origin plus its `/auth/callback` and `/auth/logout/callback` URLs in Shopify, then set `ACCOUNT_VANITY_HOSTNAMES` in the gateway environment. Production sign-in and renewal will stay on the vanity hostname. Unregistered preview hosts continue to use the canonical callback and a one-time exact-host handoff. This value is public hostname policy, not a credential. The React portal needs no vanity-domain configuration.

package/templates/shopify-customer-account/apps/gateway/AGENTS.md

@@ -0,0 +1,9 @@
+# Gateway boundary
+
+This app owns authentication, HttpOnly sessions, application D1 state, `/auth/*`, and protected `/api/*` routes.
+
+- Do not put presentation-only changes here; make those in `../portal`.
+- Preserve exact-host preview session isolation and Shopify PKCE protections.
+- Never expose customer access tokens, ID tokens, D1 data, or confidential provider credentials to the portal.
+- Add new resources and services to both `wrangler.jsonc` and `tender-app.config.json`; packaging must fail if they disagree.
+- Run `npm run check` from this directory after gateway changes.

package/templates/shopify-customer-account/apps/gateway/README.md

@@ -0,0 +1,9 @@
+# Gateway
+
+Stable backend for __APP_NAME__. It owns Shopify Customer Account PKCE authentication, shopper sessions in D1, application API routes, and the `PORTAL_UI` service binding.
+
+The customer-auth implementation is normal merchant source code copied by the starter. The merchant can inspect, edit, or replace it. Shopify remains the customer system of record; D1 stores only transient auth state and application sessions.
+
+Local HTTP development returns an explicit signed-out state. Real Shopify sign-in must use an HTTPS Tender preview whose canonical callback and logout URLs are registered in Shopify.
+
+The generated `.dev` hostname stays the Shopify callback anchor. When a merchant vanity domain is activated, add it to the public comma-separated `ACCOUNT_VANITY_HOSTNAMES` environment value so the exact-host session policy can safely return the shopper there. Do not move Shopify callback configuration to the vanity hostname.

package/templates/shopify-customer-account/apps/gateway/database-schema.json

@@ -0,0 +1,49 @@
+{
+  "schema": "tender.d1-schema/v1",
+  "statements": [
+    "CREATE TABLE IF NOT EXISTS public_customer_auth_flows (\n    project_id TEXT NOT NULL,\n    state_digest TEXT NOT NULL,\n    browser_binding_digest TEXT NOT NULL,\n    client_key_digest TEXT NOT NULL,\n    interaction_mode TEXT NOT NULL,\n    pkce_verifier TEXT NOT NULL,\n    return_hostname TEXT NOT NULL,\n    created_at INTEGER NOT NULL,\n    expires_at INTEGER NOT NULL,\n    consumed_at INTEGER,\n    PRIMARY KEY (project_id, state_digest),\n    CHECK (length(project_id) BETWEEN 2 AND 128),\n    CHECK (length(state_digest) = 64),\n    CHECK (state_digest NOT GLOB '*[^0-9a-f]*'),\n    CHECK (length(browser_binding_digest) = 64),\n    CHECK (browser_binding_digest NOT GLOB '*[^0-9a-f]*'),\n    CHECK (length(client_key_digest) = 64),\n    CHECK (client_key_digest NOT GLOB '*[^0-9a-f]*'),\n    CHECK (interaction_mode IN ('interactive', 'silent')),\n    CHECK (length(pkce_verifier) BETWEEN 43 AND 128),\n    CHECK (length(return_hostname) BETWEEN 1 AND 253),\n    CHECK (return_hostname = lower(return_hostname)),\n    CHECK (expires_at > created_at),\n    CHECK (consumed_at IS NULL OR consumed_at BETWEEN created_at AND expires_at)\n  )",
+    "CREATE INDEX IF NOT EXISTS public_customer_auth_flows_by_expiry\n    ON public_customer_auth_flows (expires_at)",
+    "CREATE TABLE IF NOT EXISTS public_customer_auth_sessions (\n    project_id TEXT NOT NULL,\n    session_digest TEXT NOT NULL,\n    audience_hostname TEXT NOT NULL,\n    session_data TEXT NOT NULL,\n    created_at INTEGER NOT NULL,\n    expires_at INTEGER NOT NULL,\n    PRIMARY KEY (project_id, session_digest),\n    CHECK (length(project_id) BETWEEN 2 AND 128),\n    CHECK (length(session_digest) = 64),\n    CHECK (session_digest NOT GLOB '*[^0-9a-f]*'),\n    CHECK (length(audience_hostname) BETWEEN 1 AND 253),\n    CHECK (audience_hostname = lower(audience_hostname)),\n    CHECK (length(session_data) BETWEEN 1 AND 65536),\n    CHECK (expires_at > created_at)\n  )",
+    "CREATE INDEX IF NOT EXISTS public_customer_auth_sessions_by_expiry\n    ON public_customer_auth_sessions (expires_at)",
+    "CREATE TABLE IF NOT EXISTS public_customer_auth_handoffs (\n    project_id TEXT NOT NULL,\n    handoff_digest TEXT NOT NULL,\n    return_hostname TEXT NOT NULL,\n    session_digest TEXT NOT NULL,\n    session_seal TEXT NOT NULL,\n    created_at INTEGER NOT NULL,\n    expires_at INTEGER NOT NULL,\n    claimed_at INTEGER,\n    PRIMARY KEY (project_id, handoff_digest),\n    CHECK (length(project_id) BETWEEN 2 AND 128),\n    CHECK (length(handoff_digest) = 64),\n    CHECK (handoff_digest NOT GLOB '*[^0-9a-f]*'),\n    CHECK (length(return_hostname) BETWEEN 1 AND 253),\n    CHECK (return_hostname = lower(return_hostname)),\n    CHECK (length(session_digest) = 64),\n    CHECK (session_digest NOT GLOB '*[^0-9a-f]*'),\n    CHECK (length(session_seal) BETWEEN 80 AND 100000),\n    CHECK (expires_at > created_at),\n    CHECK (claimed_at IS NULL OR claimed_at BETWEEN created_at AND expires_at)\n  )",
+    "CREATE INDEX IF NOT EXISTS public_customer_auth_handoffs_by_expiry\n    ON public_customer_auth_handoffs (expires_at)"
+  ],
+  "objects": [
+    {
+      "type": "table",
+      "name": "public_customer_auth_flows",
+      "tableName": "public_customer_auth_flows",
+      "statementIndex": 0
+    },
+    {
+      "type": "index",
+      "name": "public_customer_auth_flows_by_expiry",
+      "tableName": "public_customer_auth_flows",
+      "statementIndex": 1
+    },
+    {
+      "type": "table",
+      "name": "public_customer_auth_sessions",
+      "tableName": "public_customer_auth_sessions",
+      "statementIndex": 2
+    },
+    {
+      "type": "index",
+      "name": "public_customer_auth_sessions_by_expiry",
+      "tableName": "public_customer_auth_sessions",
+      "statementIndex": 3
+    },
+    {
+      "type": "table",
+      "name": "public_customer_auth_handoffs",
+      "tableName": "public_customer_auth_handoffs",
+      "statementIndex": 4
+    },
+    {
+      "type": "index",
+      "name": "public_customer_auth_handoffs_by_expiry",
+      "tableName": "public_customer_auth_handoffs",
+      "statementIndex": 5
+    }
+  ]
+}

package/templates/shopify-customer-account/apps/gateway/dot.dev.vars.example

@@ -0,0 +1,11 @@
+# Public Shopify and Tender runtime configuration. Replace these locally.
+ACCOUNT_TENANT_ID=ten_replace_me
+ACCOUNT_PROJECT_ID=prj_replace_me
+ACCOUNT_RUNTIME_BASE_DOMAIN=tenderprompt.dev
+ACCOUNT_VANITY_HOSTNAMES=
+SHOPIFY_STOREFRONT_DOMAIN=example.myshopify.com
+SHOPIFY_CUSTOMER_ACCOUNT_CLIENT_ID=replace_me
+SHOPIFY_CUSTOMER_ACCOUNT_DOMAIN=shopify.com
+
+# Keep the short-lived developer credential only in ignored .dev.vars when using the CLI.
+# TENDER_ACCOUNTS_TOKEN=ta_agent_...

package/templates/shopify-customer-account/apps/gateway/migrations/0001_customer_auth.sql

@@ -0,0 +1,76 @@
+-- Application-owned auth/session state. Shopify remains the customer system of record.
+
+CREATE TABLE IF NOT EXISTS public_customer_auth_flows (
+    project_id TEXT NOT NULL,
+    state_digest TEXT NOT NULL,
+    browser_binding_digest TEXT NOT NULL,
+    client_key_digest TEXT NOT NULL,
+    interaction_mode TEXT NOT NULL,
+    pkce_verifier TEXT NOT NULL,
+    return_hostname TEXT NOT NULL,
+    created_at INTEGER NOT NULL,
+    expires_at INTEGER NOT NULL,
+    consumed_at INTEGER,
+    PRIMARY KEY (project_id, state_digest),
+    CHECK (length(project_id) BETWEEN 2 AND 128),
+    CHECK (length(state_digest) = 64),
+    CHECK (state_digest NOT GLOB '*[^0-9a-f]*'),
+    CHECK (length(browser_binding_digest) = 64),
+    CHECK (browser_binding_digest NOT GLOB '*[^0-9a-f]*'),
+    CHECK (length(client_key_digest) = 64),
+    CHECK (client_key_digest NOT GLOB '*[^0-9a-f]*'),
+    CHECK (interaction_mode IN ('interactive', 'silent')),
+    CHECK (length(pkce_verifier) BETWEEN 43 AND 128),
+    CHECK (length(return_hostname) BETWEEN 1 AND 253),
+    CHECK (return_hostname = lower(return_hostname)),
+    CHECK (expires_at > created_at),
+    CHECK (consumed_at IS NULL OR consumed_at BETWEEN created_at AND expires_at)
+  );
+
+CREATE INDEX IF NOT EXISTS public_customer_auth_flows_by_expiry
+    ON public_customer_auth_flows (expires_at);
+
+CREATE TABLE IF NOT EXISTS public_customer_auth_sessions (
+    project_id TEXT NOT NULL,
+    session_digest TEXT NOT NULL,
+    audience_hostname TEXT NOT NULL,
+    session_data TEXT NOT NULL,
+    created_at INTEGER NOT NULL,
+    expires_at INTEGER NOT NULL,
+    PRIMARY KEY (project_id, session_digest),
+    CHECK (length(project_id) BETWEEN 2 AND 128),
+    CHECK (length(session_digest) = 64),
+    CHECK (session_digest NOT GLOB '*[^0-9a-f]*'),
+    CHECK (length(audience_hostname) BETWEEN 1 AND 253),
+    CHECK (audience_hostname = lower(audience_hostname)),
+    CHECK (length(session_data) BETWEEN 1 AND 65536),
+    CHECK (expires_at > created_at)
+  );
+
+CREATE INDEX IF NOT EXISTS public_customer_auth_sessions_by_expiry
+    ON public_customer_auth_sessions (expires_at);
+
+CREATE TABLE IF NOT EXISTS public_customer_auth_handoffs (
+    project_id TEXT NOT NULL,
+    handoff_digest TEXT NOT NULL,
+    return_hostname TEXT NOT NULL,
+    session_digest TEXT NOT NULL,
+    session_seal TEXT NOT NULL,
+    created_at INTEGER NOT NULL,
+    expires_at INTEGER NOT NULL,
+    claimed_at INTEGER,
+    PRIMARY KEY (project_id, handoff_digest),
+    CHECK (length(project_id) BETWEEN 2 AND 128),
+    CHECK (length(handoff_digest) = 64),
+    CHECK (handoff_digest NOT GLOB '*[^0-9a-f]*'),
+    CHECK (length(return_hostname) BETWEEN 1 AND 253),
+    CHECK (return_hostname = lower(return_hostname)),
+    CHECK (length(session_digest) = 64),
+    CHECK (session_digest NOT GLOB '*[^0-9a-f]*'),
+    CHECK (length(session_seal) BETWEEN 80 AND 100000),
+    CHECK (expires_at > created_at),
+    CHECK (claimed_at IS NULL OR claimed_at BETWEEN created_at AND expires_at)
+  );
+
+CREATE INDEX IF NOT EXISTS public_customer_auth_handoffs_by_expiry
+    ON public_customer_auth_handoffs (expires_at);

package/templates/shopify-customer-account/apps/gateway/package.json

@@ -0,0 +1,25 @@
+{
+  "name": "__APP_SLUG__-gateway",
+  "version": "0.1.0",
+  "private": true,
+  "type": "module",
+  "scripts": {
+    "build": "node ./scripts/build-worker.mjs",
+    "cf:types": "wrangler types --include-runtime false",
+    "check": "npm run typecheck && npm run test && npm run build && npm run pack:check",
+    "db:migrate:local": "wrangler d1 migrations apply __APP_SLUG__-sessions --local",
+    "dev": "wrangler dev",
+    "pack:tender": "node ./scripts/pack-tender-artifact.mjs",
+    "pack:check": "node ./scripts/pack-tender-artifact.mjs --vars .dev.vars.example --source-revision ffffffffffffffffffffffffffffffffffffffff",
+    "test": "vitest run",
+    "typecheck": "tsc --noEmit"
+  },
+  "devDependencies": {
+    "@cloudflare/workers-types": "^5.20260825.1",
+    "@types/node": "^26.2.0",
+    "esbuild": "^0.25.9",
+    "typescript": "^7.0.2",
+    "vitest": "^4.1.11",
+    "wrangler": "^4.125.0"
+  }
+}