deploteka-app-fleet-legacy

Runtime authentication adapter for applications onboarded with DeploTeka that run on a legacy @shopify/shopify-app-remix v2 or v3 — the pre-Vite 2023–24 template era. It resolves the dedicated Shopify app credentials for each shop, delegates to the app's own Shopify framework, and keeps a local credential replica so application authentication does not depend on DeploTeka being online.

DeploTeka captures apps as they are. Running an app you shipped in 2023 is not a reason to be told to migrate first — this package gives it the same one-command onboarding a brand-new React Router app gets.

// app/shopify.server.js
import { shopifyAppFleet } from 'deploteka-app-fleet-legacy';

Install it through the official onboarding command, which detects your framework major and picks this package for you:

npx deploteka onboard . --apply

Direct installation is supported for custom integrations:

npm install deploteka-app-fleet-legacy

Relationship to deploteka-app-fleet

This is not a fork. The fleet wire contract (POST /api/fleet/register, GET /api/fleet/installed, contractVersion: 1, the secretFingerprint algorithm) and the whole multi-tenant runtime are imported from deploteka-app-fleet, which this package depends on. There is exactly one implementation of the contract across every DeploTeka runtime, so the modern and legacy adapters cannot drift apart.

It exists as a separate package for one reason: npm allows a single peer range per package name, and this adapter peers on @shopify/shopify-app-remix >=2 <4 where the modern entry point needs >=4 <5.

What is different about v2/v3

Everything the fleet touches is either identical to v4 or passed straight through:

| Area | v2/v3 | Handling | |---|---|---| | authenticate.public | Callable and an object (until the v3_authenticatePublic future flag) | The shared runtime's per-shop proxy supports both call and property forms | | sessionStorage | Required in the config (optional in v4) | Required here too — the fleet needs one shared store anyway | | Auth strategy | Authorization-code grant with /auth routes by default; token exchange only behind unstable_newEmbeddedAuthStrategy | No branch needed: each shop's grant runs against that shop's own injected apiKey/apiSecretKey/appUrl | | Future flags | Older set (v3_*, unstable_newEmbeddedAuthStrategy) | Passed through untouched | | Session model | No refreshToken/refreshTokenExpires columns | The install-proof loader only reads isOnline/accessToken/scope | | restResources, apiVersion, webhooks, hooks, authPathPrefix | Same config keys | Passed through untouched | | authenticate.fulfillmentService | Only exists from v2.5.0 | Exposed unconditionally and dispatched lazily — on 2.4.x it fails exactly as it would without the wrapper |

Published as both ESM and CommonJS: legacy Remix templates build their server with serverModuleFormat: "cjs" and leave node_modules external, so the CommonJS build is what makes the runtime actually loadable at boot.

Documentation: https://deploteka.com