@tenderprompt/accounts 0.2.0

package/templates/shopify-customer-account/apps/gateway/scripts/build-worker.mjs

@@ -0,0 +1,15 @@
+import { build } from "esbuild";
+
+await build({
+  entryPoints: ["src/worker.ts"],
+  outfile: ".tender/build/worker.mjs",
+  bundle: true,
+  format: "esm",
+  platform: "neutral",
+  target: "es2022",
+  external: ["node:*"],
+  legalComments: "none",
+  sourcemap: false,
+  minify: false,
+  logLevel: "info",
+});

package/templates/shopify-customer-account/apps/gateway/scripts/pack-tender-artifact.mjs

@@ -0,0 +1,84 @@
+import { mkdir, readFile, rename, rm, writeFile } from "node:fs/promises";
+import { dirname, join, resolve } from "node:path";
+import { fileURLToPath } from "node:url";
+import { parseEnv } from "node:util";
+import {
+  bundleDigest,
+  exactDatabaseSchema,
+  exactPublicVars,
+  exactResourceRequests,
+  sha256,
+} from "../../../scripts/artifact-contract.mjs";
+
+const appRoot = resolve(dirname(fileURLToPath(import.meta.url)), "..");
+const config = JSON.parse(await readFile(join(appRoot, "tender-app.config.json"), "utf8"));
+const packageJson = JSON.parse(await readFile(join(appRoot, "package.json"), "utf8"));
+const sourceRevision = (argumentValue("--source-revision") || process.env.TENDER_SOURCE_REVISION || "").trim().toLowerCase();
+if (!/^[a-f0-9]{40}$/u.test(sourceRevision)) throw new Error("A committed 40-character source revision is required.");
+if (config.schema !== "tender.account-source/v1" || config.runtime?.kind !== "worker"
+    || config.runtime?.compatibilityDate !== "2026-08-25" || config.runtime?.mainModule !== "worker.mjs") {
+  throw new Error("The gateway source contract is invalid.");
+}
+
+const varsPath = resolve(appRoot, argumentValue("--vars") || ".dev.vars");
+const publicVars = exactPublicVars(
+  parseEnv(await readFile(varsPath, "utf8")),
+  config.publicVarNames,
+  config.optionalPublicVarNames,
+);
+const resources = exactResourceRequests(config.resources);
+const databaseSchema = exactDatabaseSchema(JSON.parse(await readFile(resolve(appRoot, config.databaseSchema), "utf8")));
+if (JSON.stringify(resources) !== JSON.stringify([{ type: "d1", name: "APP_DB" }])
+    || JSON.stringify(config.services) !== JSON.stringify([{ name: "PORTAL_UI", targetProject: "portal-ui" }])) {
+  throw new Error("The gateway binding contract is invalid.");
+}
+
+const workerBytes = await readFile(join(appRoot, ".tender/build/worker.mjs"));
+const module = {
+  path: "worker.mjs",
+  sha256: sha256(workerBytes),
+  bytes: workerBytes.byteLength,
+  contentType: "application/javascript+module",
+};
+const files = [];
+const digest = bundleDigest(module, files, databaseSchema);
+const manifest = {
+  schema: "tender.account-artifact/v1",
+  app: { slug: config.app.slug, version: packageJson.version, label: config.app.label, fixture: false },
+  runtime: {
+    kind: "worker",
+    compatibilityDate: "2026-08-25",
+    mainModule: "worker.mjs",
+    assetPrefix: `/_tenant-artifacts/${digest}`,
+  },
+  module,
+  files,
+  health: { path: "/api/health" },
+  resources,
+  services: config.services,
+  vars: publicVars,
+  databaseSchema,
+};
+const artifactsRoot = join(appRoot, ".tender/artifacts");
+const nextRoot = join(artifactsRoot, "next");
+const outputRoot = join(artifactsRoot, "current");
+await rm(nextRoot, { recursive: true, force: true });
+await mkdir(nextRoot, { recursive: true });
+await writeFile(join(nextRoot, "worker.mjs"), workerBytes);
+await writeFile(join(nextRoot, "tender-accounts-build.json"), `${JSON.stringify({
+  schema: "tender.external-app-build/v1",
+  sourceRevision,
+  bundleDigest: digest,
+  manifest,
+}, null, 2)}\n`, "utf8");
+await rm(outputRoot, { recursive: true, force: true });
+await rename(nextRoot, outputRoot);
+process.stdout.write(`${JSON.stringify({ status: "packed", bundleDigest: digest, outputRoot })}\n`);
+
+function argumentValue(name) {
+  const index = process.argv.indexOf(name);
+  if (index === -1) return null;
+  const value = process.argv[index + 1];
+  if (!value || value.startsWith("--")) throw new Error(`Missing value for ${name}.`);
+  return value;
+}

package/templates/shopify-customer-account/apps/gateway/src/platform/customer-auth/hostname-policy.ts

@@ -0,0 +1,66 @@
+import { createHash } from "node:crypto";
+import {
+  canonicalApplicationHostname,
+  immutablePreviewHostname,
+  previewAliasHostname,
+} from "../runtime-hostname";
+import type { CustomerAuthHostnamePolicy } from "./session-store";
+
+/**
+ * Secure default for a Tender-hosted application. It authorizes only the
+ * canonical application host plus immutable and alias hosts whose trusted
+ * tenant/project digests match this application. Merchants using custom host
+ * shapes can replace this policy in their own source.
+ */
+export function createTenderRuntimeHostnamePolicy(input: {
+  tenantId: string;
+  projectId: string;
+  baseDomain: string;
+  additionalHostnames?: readonly string[];
+}): CustomerAuthHostnamePolicy {
+  const canonicalHostname = canonicalApplicationHostname(input);
+  const domain = canonicalHostname.slice(canonicalHostname.indexOf(".") + 1);
+  const projectDigest = shortDigest(input.projectId, 10);
+  const tenantDigest = shortDigest(input.tenantId, 10);
+  const immutablePattern = new RegExp(
+    `^r-[a-f0-9]{12}--p-${projectDigest}--t-${tenantDigest}\\.${escaped(domain)}$`,
+  );
+  const aliasPattern = new RegExp(
+    `^b-[a-z0-9][a-z0-9-]{1,11}-[a-f0-9]{8}`
+      + `--p-${projectDigest}--t-${tenantDigest}\\.${escaped(domain)}$`,
+  );
+  const additionalHostnames = new Set((input.additionalHostnames ?? []).map(normalizedHostname));
+
+  return ({ projectId, hostname }) => (
+    projectId === input.projectId
+    && (
+      hostname === canonicalHostname
+      || additionalHostnames.has(hostname)
+      || immutablePattern.test(hostname)
+      || aliasPattern.test(hostname)
+    )
+  );
+}
+
+function normalizedHostname(value: string): string {
+  const hostname = value.trim().toLowerCase().replace(/\.$/u, "");
+  if (!/^(?=.{4,253}$)(?:[a-z0-9](?:[a-z0-9-]{0,61}[a-z0-9])?\.)+[a-z]{2,63}$/u.test(hostname)) {
+    throw new Error("The additional runtime hostname is invalid.");
+  }
+  return hostname;
+}
+
+/** Compile-time references keep this policy aligned with all three host constructors. */
+export const PUBLIC_CUSTOMER_AUTH_RUNTIME_HOST_CONSTRUCTORS = Object.freeze({
+  canonicalApplicationHostname,
+  immutablePreviewHostname,
+  previewAliasHostname,
+});
+
+function shortDigest(value: string, length: number): string {
+  return createHash("sha256").update(value).digest("hex").slice(0, length);
+}
+
+function escaped(value: string): string {
+  return value.replace(/[.*+?^${}()|[\]\\]/g, "\\$&");
+}

package/templates/shopify-customer-account/apps/gateway/src/platform/customer-auth/schema.ts

@@ -0,0 +1,90 @@
+import type { CustomerAuthD1Database } from "./session-store";
+
+export const PUBLIC_CUSTOMER_AUTH_SCHEMA = [
+  `CREATE TABLE IF NOT EXISTS public_customer_auth_flows (
+    project_id TEXT NOT NULL,
+    state_digest TEXT NOT NULL,
+    browser_binding_digest TEXT NOT NULL,
+    client_key_digest TEXT NOT NULL,
+    interaction_mode TEXT NOT NULL,
+    pkce_verifier TEXT NOT NULL,
+    return_hostname TEXT NOT NULL,
+    created_at INTEGER NOT NULL,
+    expires_at INTEGER NOT NULL,
+    consumed_at INTEGER,
+    PRIMARY KEY (project_id, state_digest),
+    CHECK (length(project_id) BETWEEN 2 AND 128),
+    CHECK (length(state_digest) = 64),
+    CHECK (state_digest NOT GLOB '*[^0-9a-f]*'),
+    CHECK (length(browser_binding_digest) = 64),
+    CHECK (browser_binding_digest NOT GLOB '*[^0-9a-f]*'),
+    CHECK (length(client_key_digest) = 64),
+    CHECK (client_key_digest NOT GLOB '*[^0-9a-f]*'),
+    CHECK (interaction_mode IN ('interactive', 'silent')),
+    CHECK (length(pkce_verifier) BETWEEN 43 AND 128),
+    CHECK (length(return_hostname) BETWEEN 1 AND 253),
+    CHECK (return_hostname = lower(return_hostname)),
+    CHECK (expires_at > created_at),
+    CHECK (consumed_at IS NULL OR consumed_at BETWEEN created_at AND expires_at)
+  )`,
+  `CREATE INDEX IF NOT EXISTS public_customer_auth_flows_by_expiry
+    ON public_customer_auth_flows (expires_at)`,
+  `CREATE TABLE IF NOT EXISTS public_customer_auth_sessions (
+    project_id TEXT NOT NULL,
+    session_digest TEXT NOT NULL,
+    audience_hostname TEXT NOT NULL,
+    session_data TEXT NOT NULL,
+    created_at INTEGER NOT NULL,
+    expires_at INTEGER NOT NULL,
+    PRIMARY KEY (project_id, session_digest),
+    CHECK (length(project_id) BETWEEN 2 AND 128),
+    CHECK (length(session_digest) = 64),
+    CHECK (session_digest NOT GLOB '*[^0-9a-f]*'),
+    CHECK (length(audience_hostname) BETWEEN 1 AND 253),
+    CHECK (audience_hostname = lower(audience_hostname)),
+    CHECK (length(session_data) BETWEEN 1 AND 65536),
+    CHECK (expires_at > created_at)
+  )`,
+  `CREATE INDEX IF NOT EXISTS public_customer_auth_sessions_by_expiry
+    ON public_customer_auth_sessions (expires_at)`,
+  `CREATE TABLE IF NOT EXISTS public_customer_auth_handoffs (
+    project_id TEXT NOT NULL,
+    handoff_digest TEXT NOT NULL,
+    return_hostname TEXT NOT NULL,
+    session_digest TEXT NOT NULL,
+    session_seal TEXT NOT NULL,
+    created_at INTEGER NOT NULL,
+    expires_at INTEGER NOT NULL,
+    claimed_at INTEGER,
+    PRIMARY KEY (project_id, handoff_digest),
+    CHECK (length(project_id) BETWEEN 2 AND 128),
+    CHECK (length(handoff_digest) = 64),
+    CHECK (handoff_digest NOT GLOB '*[^0-9a-f]*'),
+    CHECK (length(return_hostname) BETWEEN 1 AND 253),
+    CHECK (return_hostname = lower(return_hostname)),
+    CHECK (length(session_digest) = 64),
+    CHECK (session_digest NOT GLOB '*[^0-9a-f]*'),
+    CHECK (length(session_seal) BETWEEN 80 AND 100000),
+    CHECK (expires_at > created_at),
+    CHECK (claimed_at IS NULL OR claimed_at BETWEEN created_at AND expires_at)
+  )`,
+  `CREATE INDEX IF NOT EXISTS public_customer_auth_handoffs_by_expiry
+    ON public_customer_auth_handoffs (expires_at)`,
+] as const;
+
+/**
+ * Prototype bootstrap for the merchant-owned runtime D1. The statements are
+ * idempotent, so a template can await one isolate-cached initialization promise
+ * before serving auth routes. A future application migration runner can replace
+ * this without changing the session-store contract.
+ */
+export async function initializePublicCustomerAuthSchema(
+  database: CustomerAuthD1Database,
+): Promise<void> {
+  for (const statement of PUBLIC_CUSTOMER_AUTH_SCHEMA) {
+    const result = await database.prepare(statement).bind().run();
+    if (result.success === false) {
+      throw new Error("The public customer authentication schema could not be initialized.");
+    }
+  }
+}