@blamejs/blamejs-shop 0.5.22 → 0.5.23

package/CHANGELOG.md

@@ -8,6 +8,8 @@ upgrading across more than a few patches at a time.
 
 ## v0.5.x
 
+- v0.5.23 (2026-08-11) — **An operator can open the storefront as a customer to see what they are seeing — for an hour, with everything they do recorded, and with no way to take the account over.** Support work routinely needs the operator to see the store the way one specific customer sees it: to reproduce a cart total that looks wrong, a delivery estimate that will not appear, a discount that should apply and does not. Signing in as the customer is the obvious way to do that and the worst one — every action then reads as the customer's own, nothing tells the customer it happened, and a forgotten session stays open indefinitely. This is that capability built so none of those are true. An owner opens a customer's page, states a reason, and browses as them for an hour. The session shows as a banner on every page, ends the moment it is left, and appears on the customer's own account page with the reason the operator gave. The operator can act — fix the cart, correct an address, place the order — but everything that decides who owns the account is closed to them, so a support visit cannot become a takeover and cannot lock the customer out. **Added:** *View the storefront as a customer, from their page in the console* — A "View as customer" panel on each customer's admin page opens a support session. A reason is required, and it is not decoration: it is stored with the session and shown to the customer. Following the link lands on a confirmation naming the account and the stated reason before anything begins — so a link that is prefetched, previewed by a chat client, or fetched by a scanner cannot start a session on the operator's behalf, and the operator sees whose account they are entering before they are in it. The session lasts an hour. · *The customer is told, on their own account page* — An "Account access by our support team" section lists every session opened on the account: when, the reason the operator gave, and whether one is in progress right now. It is delivered this way rather than by email deliberately. This store keeps customer email as a hash, so there is no address to write to, and a notice that cannot be sent is not a notice — recording one as sent would put a line in an audit trail that never happened. Rendered on the account page it needs no address and cannot silently fail. A store that has wired its own plaintext-address store and a notification dispatcher can additionally pass the notifications handle to the primitive and get the out-of-band message as well. · *A banner on every page, and one control to leave* — While a session is live every storefront page carries a banner naming the customer and a button that ends it. It is filled in by the same small script that corrects the cart count, which is what lets it appear on cached pages too — those are served as one identical body to every visitor, so nothing about who is looking can be baked into them. Browsing the catalog during a support session therefore looks like a support session, not like an ordinary visit. **Security:** *A support session cannot become a takeover* — Everything that decides who owns the account is refused for the duration: enrolling or revoking a passkey, linking an identity provider, mailing a sign-in link, changing the email address, deleting the account, and exporting the whole record. The refusals are enforced at one point ahead of every route rather than inside each handler, so a route added under one of those paths later is closed by where it lives rather than by its author remembering. Each attempt is recorded against the session. · *Signing out ends the session, and does not sign the customer out* — The account page's own sign-out control revokes every session the customer has, on every device, and invalidates their pending sign-in links. An operator reaching for it means "get me out of here". Left alone it would have signed the customer out of their phone and laptop because someone helped them — the precise lock-out this feature promises an operator cannot cause. It ends the impersonation instead. · *Ending a session takes effect on the next request* — The session behind the cookie is re-read on every request made under it, so ending or revoking one stops the operator on their very next click rather than whenever the cookie would have expired. That check fails closed: where the equivalent gate for ordinary shoppers deliberately fails open so a database blip cannot sign everyone out, here a blip must not extend one person's authority over someone else's account. · *The handoff link is single-use* — The link is spent by being used. It remains in browser history and anywhere it was pasted, so a second holder must not be able to mint their own session from it — and cannot: the session's authority moves into a cookie bound to the browser that redeemed it. Two holders racing the same link resolve to exactly one, because the claim is a conditional write rather than a check followed by a write. · *Opening a session is its own permission* — `customers.impersonate` is separate from `customers.write`. A manager who can edit a customer record cannot become one; only the owner role holds it. A refusal names the missing authority in the audit record rather than reporting a generic write denial.
+
 - v0.5.22 (2026-08-11) — **A postal address written in Arabic or Hebrew can be saved again, a pixel event whose provider replied with a control byte stops re-sending forever, and the vendored framework moves to 0.18.24.** The previous release began refusing Unicode bidirectional characters in stored text, to stop a value being made to display as something other than what it says. It refused too many. The bidirectional set contains two groups that do not carry the same risk: the overrides and isolates, which reverse the display order of a whole run and have no legitimate use in a shop's stored text, and the direction marks, which resolve the direction of neighbouring characters and are simply how a Latin house number inside an Arabic street name is written. Refusing the marks turned away ordinary right-to-left addresses, names and messages at the point of sale. Only the overrides and isolates are refused now, and the marks are accepted wherever prose is accepted. Separately, a marketing pixel whose provider replied with a control byte could never record that reply, so the event stayed queued and the same request was re-sent on every scheduler tick indefinitely. **Changed:** *Vendored framework refreshed to 0.18.24* — Advances the vendored framework from 0.18.21 to 0.18.24, and the store inherits the following without application changes. A certificate revocation response that declared one signature algorithm while carrying another was accepted: the field the verifier reads to choose its digest was never checked against the key it verified with. Nothing was forgeable through it — a response signed by any other key was still refused — but what a response claimed and what was actually checked could differ silently, and a mismatch is now refused. In Certificate Transparency, a consistency proof was rebuilt against the log's new tree but not against the tree the operator had pinned, except when the pinned size happened to be a power of two; a log that quietly rewrote history before the pinned point would still have passed at eleven of the sixteen smallest sizes. Both roots are now rebuilt and both are checked. A tree is also consistent with itself, which the walk previously refused at most sizes — an operator re-checking a log that had not grown was told it was inconsistent. The bundled certificate toolkit additionally clears every key-establishment secret and password copy it allocates once the derivation has consumed it. **Fixed:** *A right-to-left address, name or message is accepted again* — U+200E, U+200F and U+061C are direction marks. They carry no text of their own; they tell the renderer which way to run the characters beside them, which is what makes a Latin house number inside an Arabic street name, or a Latin brand inside a Hebrew sentence, display in the right order. A correctly written Saudi or Israeli address routinely contains one. The previous release folded them in with the bidirectional overrides and refused both, so those addresses were rejected at checkout — and the refusal said the value contained control bytes, sending the customer to look for something that was not there. Every field that takes prose accepts the marks again: shipping and billing addresses, recipient and company names, gift messages, review titles and bodies, customer notes, support tickets, knowledge-base articles. The overrides and isolates — U+202A to U+202E and U+2066 to U+2069, the half that reverses a run — stay refused, and a refusal now names the character class it actually found. · *A pixel event whose provider replied with a control byte no longer re-sends forever* — Recording a dispatch validates the provider's response body before it marks the event delivered. The previous release tightened that validation to refuse control characters, which the surrounding contract explicitly permits — a provider's reply is captured for an operator to read, and it is not the shop's to reject. The validation threw, the event was never marked delivered, and the scheduler re-sent the identical request on every tick from then on. The response body is screened only for invisible characters now, which is what it was ever meant to catch, so a reply the shop dislikes is stored rather than retried. · *A failed broadcast's reason is fully scrubbed before it reaches the ledger* — When a message in an email campaign fails, the mailer's error is folded onto one line and stored against that recipient. The expression doing the folding replaced only the first control character it found, so a multi-line error left the rest in the stored row. All of them are removed now. · *A category's hero image URL is held to the same rule as a blog post's* — Both are an operator-supplied image URL emitted into a single attribute, and a line break in one is never legitimate. The blog article's field refused them; the category navigation's did not. It does now. **Security:** *Refusing a bidirectional override still holds, and now says what it found* — The protection the previous release added is unchanged where it matters: a value carrying U+202A to U+202E or U+2066 to U+2069 is still refused everywhere it was, including a link URL inside a marketing email, where the plain-text part of the message prints that URL for the recipient to read. What changed is the blast radius. A URL, a slug or an identifier is machine-plain and now refuses the direction marks as well; prose does not, because prose in a right-to-left script needs them. The two substrates that parse search filters are held to the same set by a test that compares them across every character in the basic multilingual plane, so the edge and the container cannot come apart on it.
 
 - v0.5.21 (2026-08-11) — **Text that one person writes and another reads can no longer be made to display in an order it was not written in, a link in a marketing email can no longer show one destination and go to another, and a sale's cost is attributed across stock layers in proportion rather than by a rounded average.** A Unicode bidirectional override is invisible, and it reverses how the characters after it are displayed. Dropped into a review title, an order-rating comment, a customer note, a support ticket or a knowledge-base article, it makes the stored text read on screen as something other than what it says — a one-star review that reads as five, a note that reads as its own opposite. Every field of that kind refused control bytes; none refused the overrides. They all do now. The same character in a campaign email's link URL was worse, because the plain-text part of the message prints that URL for the recipient to read: a link could display a bank's hostname and resolve somewhere else. Separately, the cost of a sale is now split across the stock layers it consumed in proportion to each layer's share, rather than by an average rounded to a whole minor unit with the remainder dropped on the last layer — which made the last layer consumed look more expensive than it was in every margin and inventory-valuation report. **Changed:** *A refusal now names the character class it found* — Validation messages described everything in this family as "control bytes", whatever had actually been found. A refusal now says which: a null byte, a C0 control character, a line break in a field that must stay on one line, a zero-width or invisible formatting character, or a bidirectional override. The value refused is the same in every case; only the message changed. · *The soft hyphen is refused wherever invisible characters already were* — U+00AD is invisible and carries no meaning at the point it appears; it marks a place a word may be broken across lines. The fields that already refused the zero-width family did not refuse it, and now do. It matters because text pasted out of a hyphenating word processor or a PDF carries them silently, which makes stored text that looks identical to two different values and does not match a search for either. **Fixed:** *A sale's cost is attributed across stock layers in proportion* — Weighted-average consumption priced every debited layer at the average unit cost rounded to a whole minor unit, then gave the last layer whatever was left over. Rounding loses a fraction per unit, and all of those fractions landed in one place. Consuming 40, 40 and 20 units at an average of 100.4 attributed 4000, 4000 and 2040 where the true shares are 4016, 4016 and 2008 — a 32-minor-unit misattribution from a single sale, growing with the quantities ahead of the last layer. The line total was always right, so no order was ever over- or under-charged; what was wrong was the per-layer cost that the margin and inventory-valuation reports read, where the last layer consumed absorbed everyone else's rounding and looked more expensive than it was. The split now distributes by largest remainder, so the shares sum exactly to the line total without any one layer absorbing the difference. · *A visitor's language preference is read the same way at the edge and in the container* — The edge decides whether a visitor's language needs the container, and the container decides which locale to render. Each parsed the Accept-Language header itself, and they disagreed: a header spelling the quality parameter as Q=0.9 was understood by the container and missed by the edge, whose match was case-sensitive. The edge read that tag as carrying no preference at all, ranked it first, and could route — and cache — a visitor into a different locale than the container would have chosen. The parameter name is case-insensitive, so the edge was simply wrong, and because both sides agreed on every lowercase header the disagreement never showed. Both also treated q=0 as merely lowest priority; it means the tag is not acceptable, so a locale a visitor explicitly ruled out could still be selected when nothing else matched. Both now read the header through one parser, and q=0 drops the tag. **Security:** *A bidirectional override can no longer be stored in text that renders to another person* — U+202E and its relatives are invisible characters that reverse the display order of everything after them. They are the trick behind Trojan Source, and they work the same way on a page as they do in source code. The fields where one person's writing is shown to another — a review title and body, an order-rating comment and the operator's public reply, a product question, a customer note, a support ticket, a suggestion, a knowledge-base article, a gift message — each screened their input for control bytes and null bytes, and none of them screened for the overrides. A shopper reading a product page, or an operator reading a ticket queue, could be shown text in an order nobody wrote it in. Every one of those fields now refuses them. · *A link in a marketing email can no longer display one destination and resolve to another* — A campaign body is written in a light markup where a link carries its own display text. In the HTML part of the message the URL only ever appears in the anchor, but the plain-text part prints it in full for the recipient to read — that is the whole point of the plain-text part. The screen on that URL refused the zero-width characters and the control bytes but not the bidirectional overrides, so a URL could be written to display a trusted hostname while resolving elsewhere, and a recipient checking the link before clicking would be reading the spoof. The URL is now screened for the whole class, and a link that fails is dropped while its display text is kept. · *The search filters could be made to read differently depending on the cache* — A /search facet is applied from the query string, and that query string is parsed on both substrates — at the edge for a cached page, in the container otherwise. The two screens for what a facet value may contain had come apart: the container refused the bidirectional overrides and the edge did not. The same URL therefore filtered one way off the cache and another way from the container, and the active-filter chip could be made to name a value nobody selected. Both sides now apply the same screen, and a test compares them across every character in the basic multilingual plane so that they cannot drift again.

package/README.md

@@ -102,6 +102,7 @@ Every primitive is composed on the vendored blamejs surface — no npm runtime d
 | **`lib/newsletter.js`** | Operator-collected email broadcast list — `signup({ email, source })` composes `b.guardEmail` for shape validation, `b.crypto.namespaceHash` for the dedup key, and `INSERT OR IGNORE` for idempotency. Storefront POST `/newsletter` route renders a designed thank-you card with separate copy for the `new` vs `dedup` branches. |
 | **`lib/admin.js`** | Bearer-token-gated CRUD over catalog + orders + refunds + bulk CSV import + subscription plans + review moderation + return moderation. Token compared via `b.crypto.timingSafeEqual`. Errors as RFC 9457 problem documents via `b.problemDetails`. Audit emission on every mutation. Also serves a **browser admin console**: sign in at `/admin` by pasting the API key (sealed `shop_admin` session cookie, SameSite=Strict, /admin-scoped), with a persistent nav across every signed-in page. A guided **setup wizard** at `/admin/setup` writes shop identity to config; **Products** (`/admin/products`) browses the catalog and creates / archives / restores, and each product opens a management screen that edits its fields, adds / edits / removes variants, sets a variant's price and shows its price history, and attaches / uploads / removes images — the full path to a sellable product; **Inventory** (`/admin/inventory`) lists stock per SKU (on-hand / held / available) with a low-stock filter, restocks, sets per-SKU thresholds, tracks new SKUs, and opens the low-stock alert history (`/admin/inventory/alerts`) — each alert row is written when a checkout decrement crosses a SKU's threshold, alongside an `inventory.low_stock` webhook to subscribed endpoints; **Stock locations** (`/admin/inventory/locations`) defines warehouse / retail / virtual locations with per-location stock levels (a single-location store needs no configuration — the default location stays implicit), **Receive stock** (`/admin/inventory/receive`) records reason-coded inbound stock against a location with a batched receipt history, **Transfers** (`/admin/inventory/transfers`) moves stock between locations through a dispatch → receive state machine — the source is debited at dispatch, the destination credited on receive, and a dispatch racing a checkout hold for the last unit has exactly one winner — and **Write-offs** (`/admin/inventory/writeoffs`) records reason-coded stock losses with an audit trail, refusing a write-off that would eat into stock already held for paid orders; **Orders** (`/admin/orders`) lists recent orders with status filters, opens an order's items, totals, and shipping address, and drives the lifecycle (mark paid → fulfil → ship → deliver, cancel — Refund goes through the payment provider) through the order FSM, with a rate-bounded resend of the order confirmation to an operator-supplied address (the buyer's email is stored only as a hash, so the operator types the recipient), and attaches a shipment (carrier + tracking number) with recorded shipment events that surface a public tracking link to the customer, plus a customer-service notes thread per order (internal or customer-visible, pinnable, resolvable); **Customers** (`/admin/customers`) is a read-only roster, newest first — display name, short id, join date, sign-in method (passkey count + linked OAuth providers), and order count, with the count and sign-in methods resolved by bounded aggregate queries so a page of customers costs no per-row trips (email addresses aren't stored in the clear, so they're not shown); each customer opens to an aggregated activity timeline (orders, loyalty, wishlist, reviews, support) read from the tables those primitives already populate; customer segments export their members as a streamed CSV — id, display name, join date, order count, deliberately no email column; **Returns** (`/admin/returns`) is the RMA moderation queue — filter by status, open a request's items and reason, and approve (with refund amount) → mark received → refund, or reject with a reason, over the return FSM; **Reviews** (`/admin/reviews`) is the review moderation queue — filter by status and publish, reject (with a reason), or take down each submission inline; **Q&A** (`/admin/questions`) is the question moderation queue — filter by status, open a question to its full answer thread, approve / reject the question, post the seller answer, and approve / reject / pin individual answers; **Subscriptions** (`/admin/subscription-plans`) is the recurring-offer catalog — filter active / archived, create a plan (Stripe price id, interval, amount, trial), and archive one, with archiving terminal because the mirrored Stripe price can go stale; **Collections** (`/admin/collections`) manages manual + smart product collections — filter active / archived, create a collection (manual or smart with a starter rule), and per collection edit title / description / sort strategy, manage manual members (add by product id, remove, reorder) or edit a smart collection's rule set with a live preview of the products the rules currently match, and archive; **Gift cards** (`/admin/gift-cards`) is the gift-card ledger — list issued cards (masked code, original + remaining balance, status, issued date) filtered by lifecycle status, issue a new card (the bearer code shown once, right after creation), open a card to see its full credit / debit / expire ledger, and void an active card through a confirmation step; **Webhooks** (`/admin/webhooks`) registers outbound endpoints (https:// only) with a one-time signing-secret reveal, enables / disables / deletes them, and opens an endpoint's delivery feed to retry a failed delivery — the signing secret is shown once on create and never in the list, and order transitions fan out signed deliveries to subscribed endpoints. **Operators** (`/admin/operators`) is the staff-account console — create operators with their own credential (Argon2id password and/or a per-operator API key shown once) and a least-privilege role (owner / manager / viewer), enforced at the single admin write chokepoint on every POST/PUT/DELETE rather than by hiding menu items; disable takes effect on the operator's next request, `ADMIN_API_KEY` stays the bootstrap / break-glass owner credential so an upgrade can never lock the store out, and every operator-management action plus every role-denied attempt is audited. **Email campaigns** (`/admin/campaigns`) is the consent-gated broadcast console — author a campaign (escape-by-default Markdown body), target a mailing audience, preview, test-send to an operator-supplied address, and send to the recipients who are actually reachable: the recipient set resolves at send time from the newsletter list (the only place a deliverable address exists — customer accounts keep only an email hash), every recipient is re-checked against the unsubscribe flag and the marketing suppression list at the send moment, every message carries RFC 8058 one-click unsubscribe headers plus an in-body link, and a per-recipient send ledger makes a resumed broadcast never re-mail. Sending drains in rate-bounded batches on the scheduled tick; per-campaign delivered / failed / skipped counts show on the detail screen. **Quotes** (`/admin/quotes`) is the RFQ response queue — open a request's lines and customer message, respond with per-line pricing and a validity window, or withdraw a responded quote; an accepted quote converts to an order through the storefront's normal checkout path, holds included. **Tax** (`/admin/tax-rates`), **Shipping** (`/admin/shipping`), and **Discounts** (`/admin/discounts`) configure tax rates per jurisdiction, shipping zones + rates, and automatic-discount rules — including code-unlocked rules a shopper redeems with a discount code on the cart page — + coupon-stacking policies — create / edit / archive each. **Audit** (`/admin/audit`) is a read-only activity log of every privileged action — filtered by outcome (success / failure / denied) and paginated — composed on the framework's tamper-evident `b.audit` chain; opening it is itself recorded as an `audit.read` event. **Errors** (`/admin/errors`) lists captured server-error detail — time, status, route, and a truncated message for scrubbed 500-class failures (checkout confirm, public API, admin actions) — newest-first, with the same path answering a bearer-token request with JSON so the log is one `curl` away. **Carts** (`/admin/carts`) lists abandoned carts — active, has items, idle past a tunable window (24h default) — with line counts, value at risk, and guest/signed-in attribution; a per-cart action mints a single-use, code-gated discount the operator shares through their own channel (recovery email is impossible by design: buyer addresses are stored only as hashes, and the screen says so). **Analytics** (`/admin/analytics`) is the pre-purchase view the sales report can't see — browse-to-buy funnel with conversion rate, top search terms, most-viewed products, units-ranked top SKUs, and a revenue-by-day sparkline — cross-linked with the Reports screen, read-only, every aggregate window- and limit-bounded. **Search suggestions** (`/admin/search-suggestions`) curates the storefront autocomplete — pin a featured link to a typed prefix, set its priority / status / active window, edit or remove it inline — and surfaces a read-only popular-searches report (each term's 30-day count, zero-result share, and last-seen) so an unmatched term flags a stock or naming gap. The Customers, Returns, Reviews, Q&A, Subscriptions, Collections, Gift cards, Webhooks, Tax, Shipping, Discounts, Delivery estimates, Analytics, Search suggestions, Carts, Errors, Stock locations, Receive stock, Transfers, Write-offs, Quotes, Email campaigns, and Operators links appear only when those primitives are wired. Each console path content-negotiates: a bearer-token client still gets the JSON API unchanged, a signed-in browser gets HTML. Reachable by the cookie or the bearer token. The console's styling is an external, integrity-pinned stylesheet (`themes/default/assets/css/admin.css`) with the same self-hosted typeface — no inline styles and no third-party font host, so it renders correctly under the strict `style-src 'self'` / `font-src 'self'` CSP that governs the route. |
 | **`lib/catalog-import.js`** | Bulk CSV import — `POST /admin/catalog/import` accepts a `text/csv` body, parses via `b.csv`, content-safety-filters every cell through `b.guardCsv` (formula-injection / bidi / control / dangerous-function denylist), validates exact header order, de-dupes rows by `product_slug`, returns per-row errors without aborting. Default 1 MiB / 10000 rows caps. |
+| **`lib/customer-impersonation.js`** | Operator "view as customer" — a support session on the storefront carrying the customer's own session, so an operator can see what the customer sees. Started from the customer's admin page with a required reason, gated on `customers.impersonate` (owner-only; separate from `customers.write`, so a manager who can edit a customer cannot become one). One-hour TTL. The handoff bearer is minted once, hashed at rest (`namespaceHash`), redeemed through a confirmation page — a GET never spends it, so a prefetcher or link-preview bot cannot — and claimed by a conditional write, so two holders racing one link resolve to exactly one. The live session is re-read on every request, so `end` / `revoke` bite on the next click rather than at cookie expiry, failing closed. Credential surfaces (passkeys, identity linking, sign-in links, email, deletion, data export) are refused at one chokepoint ahead of every route, and `/account/logout` ends the session instead of revoking the customer's own logins. Every request under the session is recorded to an append-only action log; the customer sees each session, with its reason, on their own account page. `cleanupExpired` runs on the minute tick. |
 | **`lib/text-guard.js`** | The shared input screen every other module validates through, composed on the framework's codepoint catalog (`b.codepointClass`) rather than a per-module character class. `freeText(v, label, policy)` throws on a refused codepoint; `hasCodepointThreat(v, policy)` answers the same question without throwing, for a reader that drops a bad value rather than refusing the request; `scrubInvisible(v)` strips instead, for a value that must be accepted whatever it holds (a search query — refusing one is a denial-of-search against the shopper who pasted a stray BOM). All three run one decision, so no two fields disagree about what "dangerous" means. Bidi overrides and isolates (CVE-2021-42574), null bytes and C0 controls are refused by default; the bidi direction MARKS are permitted by default and `bidiMarks` refuses them, for a value that is machine-plain rather than prose (an Arabic address needs a mark; a URL does not); `singleLine` adds tabs, line breaks and U+2028/U+2029 for a value rendered on one line; `zeroWidth` adds the invisible-formatting family; `mixedScript` refuses a confusable across writing systems. Also holds the ASCII-shape validators — `currencyCode` (ISO 4217 membership, not just shape), `slugLabel`, `asciiUpperLetters`, and `hostLabel` (SSRF classification + by-name internal denylist). |
 | **`lib/theme.js`** | File-backed templates with fallback chain. Operators register a named theme under `<themesDir>/<name>/*.html` and the storefront dispatches every renderer through it. `assetUrl(path)` resolves to `/assets/themes/<name>/<path>`. The shipped `default` theme is the fallback. |
 

package/SECURITY.md

@@ -279,6 +279,24 @@ node -e "
   an unmoderated reply can ever surface publicly. Author identity is the
   customer id (verified against the customers primitive) or a hash-only
   email — the raw address is never persisted.
+- **An operator viewing a customer's account cannot take it over.** Support
+  can open the storefront as a specific customer to reproduce what that
+  customer is seeing. The session is gated on its own permission
+  (`customers.impersonate`, held by `owner` and not by `manager`, so editing
+  a customer and becoming one are different authorities), requires a stated
+  reason, lasts an hour, and shows as a banner on every page with one control
+  to leave. Everything that decides who owns the account is refused for its
+  duration — enrolling or revoking a passkey, linking an identity provider,
+  mailing a sign-in link, changing the email address, deleting the account,
+  exporting the record — enforced ahead of every route rather than per
+  handler, so a route added under one of those paths later is closed by where
+  it lives. Signing out ends the session rather than revoking the customer's
+  own logins on their other devices. Ending or revoking a session stops the
+  operator on their next request, not at cookie expiry, and that check fails
+  closed. The handoff link is single-use and cannot be spent by a prefetch.
+  Every request made under the session lands in an append-only log, and the
+  customer sees each session — with the reason the operator gave — on their
+  own account page.
 - **Text one person writes and another reads is screened for invisible
   characters.** A Unicode bidirectional override reverses the display
   order of everything after it while itself rendering as nothing, so

package/lib/admin.js

@@ -173,6 +173,12 @@ var _ACTION_PERMISSION = Object.freeze({
   inbox: "orders.write",
   // customers
   customer: "customers.write", customer_segment: "customers.write",
+  // Opening a session as a customer is its own permission, NOT
+  // `customers.write`. A manager who can edit a customer record still cannot
+  // become one: `customers:impersonate` is covered only by the owner role's
+  // root `*` scope. Naming it separately also means the denial audit row says
+  // which authority was missing rather than the generic customer write.
+  impersonation: "customers.impersonate",
   // shop configuration
   config: "settings.write",
   // operator management (mounted by this feature)
@@ -882,6 +888,7 @@ function mount(router, deps) {
   var customers     = deps.customers     || null;   // read-only customers console disabled when absent
   var storeCredit      = deps.storeCredit      || null;  // per-customer store-credit panel + grant/deduct disabled when absent
   var customerNotes    = deps.customerNotes    || null;  // per-customer CRM notes panel disabled when absent
+  var customerImpersonation = deps.customerImpersonation || null;  // "view as customer" hidden + route unmounted when absent
   var customerSegments = deps.customerSegments || null;  // per-customer segment-membership panel disabled when absent
   var customerActivity = deps.customerActivity || null;  // per-customer chronological activity-timeline panel disabled when absent
   var orderNotes       = deps.orderNotes       || null;  // per-order customer-service notes panel + add/lifecycle disabled when absent
@@ -3767,6 +3774,8 @@ function mount(router, deps) {
         store_credit_history: creditHistory,
         loyalty:        loyaltyInfo,
         loyalty_link:   !!deps.loyalty,
+        impersonation_enabled: !!customerImpersonation,
+        impersonation_error:   flags.impersonation_error || null,
         can_notes:      !!customerNotes,
         notes:          notes,
         show_archived_notes: showArchivedNotes,
@@ -3819,6 +3828,7 @@ function mount(router, deps) {
           credit_notice: url && url.searchParams.get("credit_err") ? url.searchParams.get("credit_err") : null,
           note_notice:   url && url.searchParams.get("note_err") ? url.searchParams.get("note_err") : null,
           show_archived_notes: !!(url && url.searchParams.get("notes_archived") === "1"),
+          impersonation_error: url && url.searchParams.get("imp_err") ? url.searchParams.get("imp_err") : null,
         };
         _sendHtml(res, 200, renderAdminCustomerDetail(await _customerDetailModel(c, flags)));
       },
@@ -3906,6 +3916,81 @@ function mount(router, deps) {
       ));
     }
 
+    // ---- view as customer ------------------------------------------------
+    //
+    // Opens a support session on the storefront carrying the customer's own
+    // session. Gated at the write chokepoint on `customers.impersonate` — the
+    // `impersonation.` action prefix maps to it, and only `owner` holds it, so
+    // a manager with `customers.write` is refused here.
+    //
+    // A reason is REQUIRED and stored on the row. An impersonation with no
+    // stated purpose is the one an audit cannot evaluate afterwards, and the
+    // customer sees this text on their own account page.
+    if (customerImpersonation) {
+      router.post("/admin/customers/:id/impersonate", _pageOrApi(false,
+        W("impersonation.start", async function (req, res) {
+          var c = await _resolveCustomer(req.params.id);
+          if (!c) return _problem(res, 404, "customer-not-found");
+          var reason = (req.body && req.body.reason) || "";
+          if (typeof reason !== "string" || !reason.trim().length) {
+            return _problem(res, 400, "bad-request", "A reason is required to view as a customer.");
+          }
+          var started;
+          try {
+            started = await customerImpersonation.startImpersonation({
+              operator_id: req.operatorActor && req.operatorActor.operator_id,
+              customer_id: c.id,
+              reason:      reason.trim(),
+            });
+          } catch (e) {
+            if (e instanceof TypeError) return _problem(res, 400, "bad-request", e.message);
+            throw e;
+          }
+          // Best-effort out-of-band notice. This store has no plaintext
+          // customer address, so it reports `notified: false` and stamps
+          // nothing — the customer is told on their own account page instead,
+          // which needs no address and cannot silently fail.
+          try { await customerImpersonation.notifyCustomer({ impersonation_id: started.impersonation_id }); }
+          catch (_e) { /* the account-page record is the delivery that matters */ }
+          // The plaintext bearer leaves the primitive exactly once. It goes
+          // straight back to the operator who asked for it and is never
+          // stored or logged.
+          _json(res, 200, {
+            impersonation_id: started.impersonation_id,
+            expires_at:       started.expires_at,
+            open_url:         "/account/impersonate/" + encodeURIComponent(started.plaintext_token),
+          });
+          return { id: c.id };
+        }),
+        async function (req, res) {
+          var c = await _resolveCustomer(req.params.id);
+          if (!c) return _redirect(res, "/admin/customers");
+          var reason = (req.body && req.body.reason) || "";
+          if (typeof reason !== "string" || !reason.trim().length) {
+            return _redirect(res, "/admin/customers/" + encodeURIComponent(c.id) +
+              "?imp_err=" + encodeURIComponent("Give a reason before viewing as this customer."));
+          }
+          var started;
+          try {
+            started = await customerImpersonation.startImpersonation({
+              operator_id: req.operatorActor && req.operatorActor.operator_id,
+              customer_id: c.id,
+              reason:      reason.trim(),
+            });
+          } catch (e) {
+            var n = _safeNotice(e, "impersonation.start");
+            return _redirect(res, "/admin/customers/" + encodeURIComponent(c.id) +
+              "?imp_err=" + encodeURIComponent(n.message.replace(/^admin[.:]\s*/, "")));
+          }
+          try { await customerImpersonation.notifyCustomer({ impersonation_id: started.impersonation_id }); }
+          catch (_e) { /* as above */ }
+          // Straight into the storefront as the customer. The token is spent
+          // by the redemption route on arrival.
+          return _redirect(res, "/account/impersonate/" +
+            encodeURIComponent(started.plaintext_token));
+        }));
+    }
+
     // ---- customer notes (add) ------------------------------------------
     // Scoped to the :id customer — the note attaches to the path customer.
     // Composes customerNotes.addNote (the body is required + length-capped by
@@ -17131,6 +17216,36 @@ function renderAdminCustomerDetail(opts) {
     "</div>";
   }
 
+  // ---- view as customer ----------------------------------------------
+  //
+  // Rendered only when the primitive is wired, like every other optional
+  // panel. The reason field is required by the route and is not decoration:
+  // it is written to the session row and shown to the CUSTOMER on their own
+  // account page, which is what makes the whole feature answerable to the
+  // person whose account it is. The panel says so, so an operator knows
+  // before they type.
+  var impersonationPanel = "";
+  if (opts.impersonation_enabled) {
+    var impNotice = opts.impersonation_error
+      ? "<p class=\"notice notice--error\" role=\"alert\">" + _htmlEscape(String(opts.impersonation_error)) + "</p>"
+      : "";
+    impersonationPanel = "<div class=\"panel\"><h3 class=\"subhead\">View as customer</h3>" +
+      impNotice +
+      "<p class=\"meta\">Opens the storefront signed in as this customer so you can see exactly " +
+      "what they see. The session lasts one hour and ends when you leave it. You will not be " +
+      "able to change their password, passkeys, email address or linked sign-ins, delete the " +
+      "account, or export their data.</p>" +
+      "<form method=\"post\" action=\"/admin/customers/" + _htmlEscape(enc) + "/impersonate\">" +
+        "<label class=\"form-field\"><span>Reason</span>" +
+          "<input type=\"text\" name=\"reason\" required maxlength=\"200\" " +
+            "placeholder=\"e.g. customer reports the cart total is wrong\">" +
+          "<small>Required. Recorded against the session and shown to the customer on their " +
+          "own account page.</small></label>" +
+        "<div class=\"actions-row\"><button class=\"btn\" type=\"submit\">Start viewing as this customer</button></div>" +
+      "</form>" +
+    "</div>";
+  }
+
   // ---- loyalty -------------------------------------------------------
   var loyaltyPanel = "";
   if (opts.loyalty_link) {
@@ -17262,7 +17377,7 @@ function renderAdminCustomerDetail(opts) {
     "<div class=\"actions-row\"><h2>" + _htmlEscape(c.display_name) + "</h2>" +
       "<a class=\"btn btn--ghost\" href=\"/admin/customers\"><span aria-hidden=\"true\">←</span> All customers</a></div>" +
     saved +
-    identity + ordersPanel + creditPanel + loyaltyPanel + notesPanel + segmentsPanel + activityPanel +
+    identity + ordersPanel + creditPanel + loyaltyPanel + impersonationPanel + notesPanel + segmentsPanel + activityPanel +
   "</section>";
   return _renderAdminShell(opts.shop_name, c.display_name || "Customer", body, "customers", opts.nav_available);
 }

package/lib/asset-manifest.json

@@ -1,13 +1,13 @@
 {
-  "version": "0.5.22",
+  "version": "0.5.23",
   "assets": {
     "css/admin.css": {
       "integrity": "sha384-imfe0otYErcB8rr2h6KLSGTtStirysptpXETSPY4zLv3bZoIT75Lo1dOvkOav+xL",
       "fingerprinted": "css/admin.6941d5151488a7c1.css"
     },
     "css/main.css": {
-      "integrity": "sha384-wm9Kgl9osJlGxNW9swpY/yaFoS07Sw6ek5e9sce9RLd5W5BPwz9DcXs0wxym4oAn",
-      "fingerprinted": "css/main.9f60d689ff4715d7.css"
+      "integrity": "sha384-rZSWtyj5fcR9Bi8nZKLJZQLPAlkatv+A69WL2Bao7GD8nnNDf4IWmXDkYEDeJgq+",
+      "fingerprinted": "css/main.25ab2735c1a3acac.css"
     },
     "js/announcement.js": {
       "integrity": "sha384-z4zcEMn+tScoVnYRE4nEf8N/oyvpxdpaxTNrT4QO/jURChid4+qjAvWkzatCaAPq",
@@ -18,8 +18,8 @@
       "fingerprinted": "js/captcha.2aab5803642f8ac5.js"
     },
     "js/cart-count.js": {
-      "integrity": "sha384-K/rkm//Dzg8nuOfpaeenJvLKKl+6DEuvuJi1LLgd46BK+dd1HYmU8R7/gHHjtEsr",
-      "fingerprinted": "js/cart-count.bfc2eb434b19c00a.js"
+      "integrity": "sha384-ysSvGfg0EZ1rXQNHp3ZEFm21ApD7D2a6LKySj6Xl+cG3+2JQ577SaE+lWcodMfpE",
+      "fingerprinted": "js/cart-count.9ee112584156bc04.js"
     },
     "js/consent.js": {
       "integrity": "sha384-XY3GHA5QDj/Nri03ZO1t7nsr9RGepZuanY45CTpFQnnTorQnygbtAVG4vVGfkNIP",

package/lib/compliance-export.js

@@ -207,6 +207,10 @@ var SCOPE_SECTIONS = Object.freeze({
     // both directions (as referrer and as referred friend).
     "guestOrderReconciliations", "stockAlerts", "quotes", "orderRatings",
     "productQa", "customerNotes", "giftcards", "referrals",
+    // Support sessions opened on the account, and what was done under each.
+    // When someone looked at your account, who, why, and which pages is
+    // personal data about you, so a subject-access request returns it.
+    "customerImpersonation",
   ]),
   orders_only: Object.freeze(["order", "orderNotes"]),
   identity_only: Object.freeze(["customers", "addresses"]),
@@ -392,6 +396,7 @@ function create(opts) {
     orderRatings:   opts.orderRatings   || null,
     productQa:      opts.productQa      || null,
     customerNotes:  opts.customerNotes  || null,
+    customerImpersonation: opts.customerImpersonation || null,
     giftcards:      opts.giftcards      || null,
     referrals:      opts.referrals      || null,
   };
@@ -655,6 +660,14 @@ function create(opts) {
       "supportTickets", "orderNotes", "order", "guestOrderReconciliations",
       "subscriptions", "paymentMethods", "loyalty", "storeCredit",
       "giftcards", "referrals", "addresses",
+      // Retains rather than erases, and the report says so with a reason.
+      // Listed here precisely BECAUSE it retains: a domain absent from this
+      // walk is never asked, so the erasure report would neither erase it nor
+      // explain why it did not — the customer would be told their record was
+      // erased while an audit trail about them quietly remained, unmentioned.
+      // Named last so the accountability record is the final line of the
+      // report rather than buried among the erasures.
+      "customerImpersonation",
     ];
     var perDomain     = [];
     var domainsAbsent = [];
@@ -680,11 +693,28 @@ function create(opts) {
           throw new TypeError("reader " + JSON.stringify(name) +
             ".forCustomerDeletion returned non-object — must return { table, deleted }");
         }
-        perDomain.push({
+        var entry = {
           domain:  name,
           table:   effect.table  == null ? name : effect.table,
           deleted: effect.deleted == null ? 0    : Number(effect.deleted),
-        });
+        };
+        // A domain that RETAINS its rows on purpose says so, and says why.
+        // Without this the report shows a plain `deleted: 0`, which reads as
+        // "there was nothing to erase" — indistinguishable from a domain the
+        // customer had no data in. An erasure report that cannot tell those
+        // apart is the one an auditor cannot rely on, and retention here is a
+        // deliberate legal position (accounting records, accountability logs)
+        // that has to be stated rather than inferred.
+        if (effect.retained === true) {
+          entry.retained = true;
+          if (typeof effect.reason === "string" && effect.reason.length) {
+            entry.reason = effect.reason;
+          }
+        } else if (typeof effect.note === "string" && effect.note.length) {
+          // Older readers carry the same meaning as a free-text `note`.
+          entry.note = effect.note;
+        }
+        perDomain.push(entry);
       } catch (e) {
         failures.push({ domain: name, error: (e && e.message) ? e.message : String(e) });
       }

package/lib/customer-impersonation.js

@@ -113,8 +113,14 @@
  *         → `{ notified: boolean, customer_notified_at: <ms> | null }`
  *     - `listForOperator(operator_id, { active_only? })`
  *         → array of session rows, newest-first.
- *     - `listForCustomer(customer_id)`
- *         → array of session rows, newest-first.
+ *     - `listForCustomer(customer_id, { limit?, offset? })`
+ *         → the customer's most recent sessions, newest-first. BOUNDED:
+ *           20 by default, 200 at most. The storefront renders this on
+ *           every account page load and the rows are never pruned, so an
+ *           unbounded read would make a customer's own dashboard slower
+ *           for the rest of the account's life. Nothing becomes unreadable:
+ *           `offset` walks the older pages, so a customer or a regulator
+ *           asking for the whole history can still get it.
  *     - `currentlyImpersonating()`
  *         → array of active session rows.
  *     - `cleanupExpired({ now? })`
@@ -138,6 +144,13 @@
 var TOKEN_NAMESPACE         = "customer-impersonation-token";
 var TOKEN_BYTES             = 32;
 var DEFAULT_TTL_SECONDS     = 60 * 60;                  // allow:raw-time-literal — seconds value; C.TIME returns ms (60-minute default)
+
+// How much of a customer's access history their own account page shows by
+// default, and the ceiling a caller may ask for. Bounded because the rows are
+// an audit trail that is never pruned: an unbounded read would make a
+// customer's dashboard slower every time support helped them.
+var DEFAULT_CUSTOMER_HISTORY = 20;
+var MAX_CUSTOMER_HISTORY     = 200;
 var MIN_TTL_SECONDS         = 60;                       // refuse sub-minute
 var MAX_TTL_SECONDS         = 8 * 60 * 60;              // allow:raw-time-literal — seconds value; C.TIME returns ms (hard ceiling — eight hours)
 var MAX_REASON_LEN          = 280;
@@ -165,6 +178,24 @@ function _uuid(s, label) {
   }
 }
 
+// The admin console has two kinds of operator identity: a staff account, whose
+// id is a v7 UUID, and the bootstrap / break-glass credential, whose id is the
+// reserved literal below. Both are real operators and both must be recordable
+// here — a store running the single-credential console (the common deploy) has
+// no UUID to offer, and refusing it would make the feature unreachable exactly
+// where the audit trail matters most.
+//
+// Only this one literal is admitted; anything else still has to be a UUID, so
+// the column cannot fill up with free-form operator labels. It matches the id
+// the rest of the console records against the same action, which keeps an
+// impersonation row joinable to its audit entries.
+var BOOTSTRAP_OPERATOR_ID = "owner";
+
+function _operatorId(s, label) {
+  if (s === BOOTSTRAP_OPERATOR_ID) return s;
+  return _uuid(s, label);
+}
+
 function _requiredString(s, label, maxLen) {
   if (typeof s !== "string") {
     throw new TypeError("customer-impersonation: " + label + " must be a string");
@@ -308,7 +339,7 @@ function create(opts) {
       if (!input || typeof input !== "object") {
         throw new TypeError("customer-impersonation.startImpersonation: input object required");
       }
-      var operatorId = _uuid(input.operator_id, "operator_id");
+      var operatorId = _operatorId(input.operator_id, "operator_id");
       var customerId = _uuid(input.customer_id, "customer_id");
       var reason     = _requiredString(input.reason, "reason", MAX_REASON_LEN);
       var ttl        = _ttlSeconds(input.ttl_seconds);
@@ -543,7 +574,7 @@ function create(opts) {
     // started, newest-first. `active_only: true` filters to live
     // sessions only.
     listForOperator: async function (operatorId, listOpts) {
-      var oid = _uuid(operatorId, "operator_id");
+      var oid = _operatorId(operatorId, "operator_id");
       listOpts = listOpts || {};
       if (typeof listOpts !== "object") {
         throw new TypeError("customer-impersonation.listForOperator: opts must be an object");
@@ -568,12 +599,33 @@ function create(opts) {
     // Returns every impersonation session ever opened against the
     // customer, newest-first. The customer-side "show me who's looked
     // at my account" page reads this directly.
-    listForCustomer: async function (customerId) {
+    // `limit` is bounded and defaulted because the storefront renders this on
+    // every /account load. These rows are an audit trail and are never
+    // deleted, so an unbounded read would grow the query cost and the page
+    // weight of a customer's own dashboard for the rest of the account's life
+    // — worst for exactly the customers support has helped most often.
+    listForCustomer: async function (customerId, listOpts) {
       var cid = _uuid(customerId, "customer_id");
+      var opts = listOpts || {};
+      var limit = opts.limit == null ? DEFAULT_CUSTOMER_HISTORY : opts.limit;
+      if (typeof limit !== "number" || !Number.isInteger(limit) || limit <= 0 ||
+          limit > MAX_CUSTOMER_HISTORY) {
+        throw new TypeError("customer-impersonation.listForCustomer: limit must be an integer in [1, " +
+          MAX_CUSTOMER_HISTORY + "]");
+      }
+      // Offset paging, so capping the page does not put older rows out of
+      // reach. These are audit records: a bounded default protects the
+      // account page from growing heavier with every support visit, but
+      // nothing may become unreadable — a customer or a regulator asking for
+      // the whole history has to be able to walk it.
+      var offset = opts.offset == null ? 0 : opts.offset;
+      if (typeof offset !== "number" || !Number.isInteger(offset) || offset < 0) {
+        throw new TypeError("customer-impersonation.listForCustomer: offset must be a non-negative integer");
+      }
       var r = await query(
         "SELECT * FROM impersonations WHERE customer_id = ?1 " +
-        "ORDER BY started_at DESC, id DESC",
-        [cid],
+        "ORDER BY started_at DESC, id DESC LIMIT ?2 OFFSET ?3",
+        [cid, limit, offset],
       );
       return r.rows.map(_projectRow);
     },
@@ -703,6 +755,52 @@ function create(opts) {
     // `endImpersonation` because the audit log distinguishes
     // operator-driven completion from operator-side termination.
     // Idempotent on already-terminal rows.
+    // ---- consumeToken -----------------------------------------------------
+    //
+    // Spend the handoff bearer WITHOUT ending the session.
+    //
+    // `startImpersonation` mints a single plaintext token and the operator
+    // follows it once, out of the console and into the storefront. Verifying
+    // it is a read, though, so until the token stops matching, that URL keeps
+    // working: it sits in browser history, in a chat message if it was pasted,
+    // in a proxy log — and anyone holding it can mint their own cookie for
+    // that customer for the rest of the hour. The handoff is meant to be
+    // one-time; this is what makes it so.
+    //
+    // Rotating the hash to a fresh random value is what spends it. The row's
+    // authority now lives entirely in the cookie the redemption sealed, which
+    // is bound to the operator's browser; the session stays `active` and
+    // `end` / `revoke` / the sweep are unaffected. Rotating (rather than
+    // nulling) also keeps the NOT NULL UNIQUE column honest.
+    //
+    // Takes the PLAINTEXT the caller was presented, and spends only that one.
+    //
+    // The match on the current hash is what makes this single-use under
+    // concurrency. Verification is a read, so two requests carrying the same
+    // link can both pass it before either writes; if the update only keyed on
+    // the row id they would both succeed and both mint a cookie, which is the
+    // guarantee this exists to provide, broken. Conditioning the write on the
+    // hash it verified means exactly one request can win — the second finds
+    // the hash already rotated and gets `consumed: false`.
+    //
+    // Deliberately NOT idempotent: a caller that cannot claim the token must
+    // not be handed a session.
+    consumeToken: async function (impersonationId, plaintext) {
+      var impId = _uuid(impersonationId, "impersonation_id");
+      if (typeof plaintext !== "string" || !plaintext.length) {
+        throw new TypeError("customer-impersonation.consumeToken: plaintext token required");
+      }
+      var presented = b.crypto.namespaceHash(TOKEN_NAMESPACE, plaintext);
+      var spent = b.crypto.namespaceHash(
+        TOKEN_NAMESPACE, "spent:" + impId + ":" + b.crypto.toBase64Url(b.crypto.generateBytes(32)));
+      var r = await query(
+        "UPDATE impersonations SET token_hash = ?1 " +
+        "WHERE id = ?2 AND status = 'active' AND token_hash = ?3",
+        [spent, impId, presented],
+      );
+      return { consumed: r.rowCount === 1 };
+    },
+
     revoke: async function (input) {
       if (!input || typeof input !== "object") {
         throw new TypeError("customer-impersonation.revoke: input object required");

package/lib/storefront.js

@@ -352,6 +352,14 @@ var LAYOUT =
   "    </div>\n" +
   "  </header>\n" +
   "\n" +
+  // Empty on every render, on both substrates — the session-chrome island
+  // fills it when /cart/count reports this browser is an operator viewing a
+  // customer's account. Emitting it always (rather than server-rendering the
+  // banner) keeps the edge-cached body identical for every visitor, so the
+  // cache still serves one page to everyone. It sits OUTSIDE <main> because
+  // the render-parity tests compare that region byte for byte.
+  "  <div id=\"impersonation-banner\"></div>\n" +
+  "\n" +
   "  <div class=\"page-shell\">\n" +
   "  <main id=\"main\">{{body}}</main>\n" +
   "RAW_SIDEBAR_RAIL" +
@@ -5602,6 +5610,91 @@ function renderAccountDelete(opts) {
   });
 }
 
+// The confirmation an operator sees before entering a customer's account.
+//
+// Exists so that FOLLOWING the handoff link changes nothing: a prefetcher, a
+// link-preview bot or a scanner that fetches this URL gets a page, not a
+// session. Only the POST underneath spends the token. It also puts the two
+// facts the operator should see before they are inside someone else's account
+// in front of them — whose account, and the reason they themselves gave.
+function renderImpersonationConfirm(opts) {
+  var esc = b.template.escapeHtml;
+  var who = opts.customer_name
+    ? esc(String(opts.customer_name)) + " (" + esc(String(opts.customer_id)) + ")"
+    : esc(String(opts.customer_id));
+  var until = Number(opts.expires_at);
+  var untilStr = Number.isFinite(until)
+    ? new Date(until).toISOString().slice(0, 16).replace("T", " ") + " UTC"
+    : "one hour";
+  var csrf = opts.csrf_token
+    ? "<input type=\"hidden\" name=\"_csrf\" value=\"" + esc(String(opts.csrf_token)) + "\">"
+    : "";
+  var body =
+    "<section class=\"return-form-page\">" +
+      "<h1 class=\"return-form-page__title\">View the store as this customer?</h1>" +
+      "<p class=\"form-notice\" role=\"note\">You are about to browse as <strong>" + who + "</strong>. " +
+        "Everything you do will be recorded against this session and shown to the customer " +
+        "on their own account page. The session ends automatically at " + esc(untilStr) + ".</p>" +
+      "<p class=\"form-notice\" role=\"note\">Your stated reason: <em>" +
+        esc(String(opts.reason || "—")) + "</em></p>" +
+      "<p class=\"form-notice\" role=\"note\">You will not be able to change their password, " +
+        "passkeys, email address or linked sign-ins, delete the account, or export their data.</p>" +
+      "<form method=\"post\" action=\"/account/impersonate/start\">" +
+        csrf +
+        "<input type=\"hidden\" name=\"token\" value=\"" + esc(String(opts.token || "")) + "\">" +
+        "<div class=\"actions-row\">" +
+          "<button type=\"submit\" class=\"btn-primary\">Start viewing as this customer</button>" +
+          "<a class=\"btn-secondary\" href=\"/\">Cancel</a>" +
+        "</div>" +
+      "</form>" +
+    "</section>";
+  return _wrap({
+    title:      "View as customer",
+    shop_name:  opts.shop_name || "blamejs.shop",
+    cart_count: opts.cart_count == null ? 0 : opts.cart_count,
+    theme_css:  opts.theme_css,
+    body:       body,
+  });
+}
+
+// Shown to an operator who reached a credential surface while viewing a
+// customer's account. Addressed to the operator, not the customer — nobody
+// else can see this page, because reaching it requires the impersonation
+// cookie. It names the boundary rather than just refusing, so the operator
+// knows the account is intact and what to do instead.
+function renderAccountImpersonationRefused(opts) {
+  var esc = b.template.escapeHtml;
+  var body =
+    "<section class=\"return-form-page\">" +
+      "<h1 class=\"return-form-page__title\">Not available while viewing as a customer</h1>" +
+      "<p class=\"form-notice form-notice--error\" role=\"alert\">" +
+        "You are signed in as this customer for support. Anything that decides who owns " +
+        "the account — a passkey, a linked sign-in, the email address, erasure, or a data " +
+        "export — stays closed while you are here, so a support session can never become " +
+        "a takeover and you cannot lock the customer out." +
+      "</p>" +
+      "<p class=\"form-notice\" role=\"note\">Refused: <code>" + esc(String(opts.path || "")) + "</code>. " +
+        "This attempt is recorded against the session. If the customer needs one of these " +
+        "changed, walk them through it on their own device.</p>" +
+      "<div class=\"actions-row\">" +
+        "<a class=\"btn-secondary\" href=\"/account\">Back to the account</a>" +
+        "<form method=\"post\" action=\"/account/impersonate/end\" style=\"display:inline\">" +
+          (opts.csrf_token
+            ? "<input type=\"hidden\" name=\"_csrf\" value=\"" + esc(String(opts.csrf_token)) + "\">"
+            : "") +
+          "<button type=\"submit\" class=\"btn-primary\">Stop viewing as customer</button>" +
+        "</form>" +
+      "</div>" +
+    "</section>";
+  return _wrap({
+    title:      "Not available while viewing as a customer",
+    shop_name:  opts.shop_name || "blamejs.shop",
+    cart_count: opts.cart_count == null ? 0 : opts.cart_count,
+    theme_css:  opts.theme_css,
+    body:       body,
+  });
+}
+
 // Loyalty transaction-type pill — reuses the `pdp__badge` class the
 // theme already styles. The type is one of the ledger's closed enum
 // (earn / redeem / expire / adjust / tier-bonus).
@@ -9742,6 +9835,17 @@ var SESSION_COOKIE_NAME = "shop_sid";
 // initiated logout-everywhere).
 var AUTH_COOKIE_NAME    = "shop_auth";
 
+// How many support-session records the account page shows per page. Paged
+// rather than capped: the rows are the customer's only view of who opened
+// their account, so an older one must stay reachable however many there are.
+var ACCESS_PAGE_SIZE = 10;
+
+// Longest page path the impersonation action log will store, matching that
+// primitive's own `resource_id` cap. Kept in step deliberately: a value this
+// side accepts and the primitive refuses would be dropped by the recorder's
+// catch, losing the page from the trail silently.
+var IMPERSONATION_PATH_MAX = 256;
+
 // Cookie-prefix-hardened names for the two Path=/ session cookies. The
 // `__Host-` prefix is a browser-enforced integrity marker (RFC 6265bis
 // §4.1.3.2): a `__Host-`-named cookie is only stored when it was set
@@ -10659,6 +10763,68 @@ var ACCOUNT_DASH_ORDER_ROW =
   "  <td data-label=\"Actions\">RAW_ACCOUNT_ORDER_ACTIONS</td>\n" +
   "</tr>\n";
 
+// "Account access" — every time a support operator opened this account,
+// shown to the person it belongs to.
+//
+// This IS the customer's notification. The store keeps their email as a hash
+// only, so there is no address to write to; a notice that cannot be delivered
+// is not a notice, and stamping one as sent would put a false line in an audit
+// trail. Rendered here it needs no address, cannot bounce, and cannot fail
+// silently — the customer sees it the next time they sign in.
+//
+// Renders NOTHING when the account has never been opened, so an ordinary
+// customer is never shown a scary empty security panel.
+function _accountAccessSection(sessions, page, hasMore) {
+  if (!Array.isArray(sessions) || !sessions.length) return "";
+  var esc = b.template.escapeHtml;
+  page = page || 0;
+
+  var rows = sessions.map(function (s) {
+    var started = Number(s.started_at);
+    var when = Number.isFinite(started)
+      ? new Date(started).toISOString().slice(0, 16).replace("T", " ") + " UTC"
+      : "—";
+    // `ended` and `expired` both mean the session is over; only `active`
+    // means someone may be looking right now, and saying so plainly is the
+    // point of the panel.
+    var live = s.status === "active";
+    return "<tr>" +
+      "<td>" + esc(when) + "</td>" +
+      "<td>" + esc(String(s.reason || "—")) + "</td>" +
+      "<td>" + (live
+        ? "<strong>in progress now</strong>"
+        : esc(String(s.status || "ended"))) + "</td>" +
+    "</tr>";
+  }).join("");
+
+  return "<section class=\"account-access\" aria-labelledby=\"account-access-title\">" +
+    "<h2 id=\"account-access-title\">Account access by our support team</h2>" +
+    "<p>For your security we record every time a member of our team opened your " +
+    "account to help with a problem, and why. They cannot change your password, " +
+    "your passkeys, your email address, or any other way of signing in — and they " +
+    "cannot delete your account or export your data.</p>" +
+    "<table class=\"account-access__table\">" +
+      "<thead><tr><th scope=\"col\">When</th><th scope=\"col\">Reason</th>" +
+      "<th scope=\"col\">Status</th></tr></thead>" +
+      "<tbody>" + rows + "</tbody>" +
+    "</table>" +
+    // Paging, not truncation: this is the customer's only view of who opened
+    // their account, so an older session must never become unreachable.
+    "<div class=\"actions-row\">" +
+      (page > 0
+        ? "<a class=\"btn-secondary\" href=\"/account?access_page=" + (page - 1) +
+          "#account-access-title\">Newer</a>"
+        : "") +
+      (hasMore
+        ? "<a class=\"btn-secondary\" href=\"/account?access_page=" + (page + 1) +
+          "#account-access-title\">Older</a>"
+        : "") +
+    "</div>" +
+    "<p class=\"form-notice\" role=\"note\">If any of this looks wrong, contact us — " +
+    "reply to any order email and mention the date above.</p>" +
+  "</section>";
+}
+
 function renderAccount(opts) {
   if (!opts || !opts.customer) throw new TypeError("storefront.renderAccount: opts.customer required");
   var orders = opts.orders || [];
@@ -10751,6 +10917,8 @@ function renderAccount(opts) {
     .replace("RAW_QUOTES_LINK", opts.quotes_enabled
       ? "<a class=\"btn-secondary\" href=\"/account/quotes\">Quotes</a>"
       : "");
+  body += _accountAccessSection(
+    opts.account_accesses, opts.account_access_page, opts.account_access_has_more);
   return _wrap({
     title:      "Account",
     shop_name:  opts.shop_name || "blamejs.shop",
@@ -12453,6 +12621,133 @@ function mount(router, deps) {
   // request. Resolution is best-effort (falls back to the English
   // baseline). The audit-log write is fired off without awaiting so it
   // never blocks the render. Only mounted when the router exposes `.use`.
+  // An impersonating operator can act as the customer — fix a cart, update an
+  // address, place an order. They cannot touch anything that decides WHO the
+  // account belongs to. That distinction is the whole reason impersonation is
+  // defensible: a support session must never become a takeover, and an
+  // operator must never be able to lock a customer out of their own account.
+  //
+  // Prefix-matched, so a route added under one of these later is closed by
+  // where it lives rather than by its author remembering.
+  var IMPERSONATION_CLOSED_PREFIXES = [
+    "/account/delete",          // destroying the account
+    "/account/passkey/",        // enrolling a credential
+    "/account/passkeys/",       // revoking someone else's credential
+    "/account/auth/",           // linking an identity provider
+    "/account/login/link",      // mailing a sign-in link to the address
+    "/account/privacy/",        // exporting or erasing the whole record
+  ];
+
+  // ---- impersonation guard, ahead of EVERY route ------------------------
+  //
+  // Mounted here rather than beside the account routes because `router.use`
+  // only sees routes registered after it. Down there it would have left
+  // /cart, /checkout and their mutation endpoints uncovered — so an operator
+  // whose session had been ended could still have gone on spending the
+  // customer's money until the cookie expired, which is the precise opposite
+  // of the next-request revocation this feature promises.
+  //
+  // Ordinary visitors leave in the first line: no marker on the cookie, no
+  // work, no database read.
+  if (typeof router.use === "function" && deps.customerImpersonation) {
+    router.use(async function impersonationGuard(req, res, next) {
+      var imp = _impersonationOf(req);
+      if (!imp) return next();
+
+      // Is the session behind this cookie still live? Re-read on every
+      // impersonated request so `end` and `revoke` bite on the operator's
+      // very next click rather than whenever the cookie happens to expire.
+      var live = await _impersonationStillLive(_currentCustomerEnv(req));
+      if (!live) {
+        _clearAuthCookie(req, res);
+        res.status(303);
+        res.setHeader && res.setHeader("location",
+          "/account/login?error=" + encodeURIComponent("that view-as-customer session has ended"));
+        return res.end ? res.end() : res.send("");
+      }
+
+      var pathname = req.pathname || req.url || "/";
+      var q = pathname.indexOf("?");
+      if (q !== -1) pathname = pathname.slice(0, q);
+
+      // Everything the operator does under this session is recorded, not just
+      // what is refused — that is the whole basis on which impersonation is
+      // defensible. Reads and writes both: knowing an operator LOOKED at an
+      // order is as much a part of the trail as knowing they changed it.
+      // Awaited, so the row is durable before the response goes out and a
+      // failure lands in the surrounding handler rather than as an unhandled
+      // rejection.
+      // "Sign out" means LEAVE, not "sign the customer out".
+      //
+      // The account page's own sign-out control posts to /account/logout,
+      // which revokes every session the customer has and invalidates their
+      // pending sign-in links. An operator reaching for it means "get me out
+      // of here" — and letting it through would log the customer out of their
+      // phone and laptop, which is precisely the lock-out this feature
+      // promises an operator cannot cause. Ending the impersonation is what
+      // they meant, so that is what it does.
+      if (pathname === "/account/logout") {
+        // Recorded before it is acted on — leaving is part of the trail, and
+        // this path returns before the common recording block below.
+        if (typeof deps.customerImpersonation.actionsRecord === "function") {
+          try {
+            await deps.customerImpersonation.actionsRecord({
+              impersonation_id: imp.impersonation_id,
+              action:           "exit",
+              resource_kind:    "route",
+              resource_id:      pathname,
+            });
+          } catch (_e) { /* observability sink — must not block the exit */ }
+        }
+        try {
+          await deps.customerImpersonation.endImpersonation({
+            impersonation_id: imp.impersonation_id,
+            ended_by:         "operator",
+            reason:           "operator signed out of the session",
+          });
+        } catch (_e) { /* clearing the cookie below is what protects the customer */ }
+        _clearAuthCookie(req, res);
+        res.status(303);
+        res.setHeader && res.setHeader("location", "/");
+        return res.end ? res.end() : res.send("");
+      }
+
+      var closed = IMPERSONATION_CLOSED_PREFIXES.some(function (p) {
+        return pathname === p || pathname.indexOf(p) === 0;
+      });
+
+      if (typeof deps.customerImpersonation.actionsRecord === "function") {
+        try {
+          await deps.customerImpersonation.actionsRecord({
+            impersonation_id: imp.impersonation_id,
+            action:           closed ? "refused" : String(req.method || "GET").toUpperCase(),
+            resource_kind:    closed ? "credential_surface" : "route",
+            resource_id:      pathname,
+          });
+        } catch (_e) {
+          // Drop-silent by design: this is an observability sink on the hot
+          // path, and a failed audit insert must not take down the request
+          // the operator is making. The refusal below still happens.
+        }
+      }
+
+      if (!closed) return next();
+      res.status(403);
+      return _send(res, 403, renderAccountImpersonationRefused({
+        shop_name: shopName,
+        path:      pathname,
+        // Passed explicitly. This guard runs ahead of every route — including
+        // ahead of the locale middleware that normally puts the token where
+        // `_wrap` finds it — so without this the exit form on the refusal page
+        // would carry no `_csrf` and the csrf guard would reject it. That
+        // button is the operator's way OUT of someone else's account; a
+        // silently dead one is worse than none. The app-level csrf middleware
+        // has already run by here, so the token is on the request.
+        csrf_token: req.csrfToken,
+      }));
+    });
+  }
+
   if (typeof router.use === "function") {
     router.use(function localeMiddleware(req, _res, next) {
       try {
@@ -13218,6 +13513,53 @@ function mount(router, deps) {
     return env;
   }
 
+  // ---- operator impersonation ------------------------------------------
+  //
+  // An impersonated session is an ordinary auth cookie whose sealed envelope
+  // carries `imp` — the impersonation row's id. Everything downstream reads
+  // the target customer through the same `_currentCustomerEnv`, so the
+  // operator sees precisely the storefront that customer sees, with no
+  // parallel code path to drift out of sync.
+  //
+  // Two things hang off the marker: the banner (so the operator can never
+  // forget whose account they are in) and the credential-surface refusal.
+
+  // Whether THIS request is an impersonation, and of what. Returns null for
+  // an ordinary visitor, so a caller can branch on truthiness.
+  function _impersonationOf(req) {
+    var env = _currentCustomerEnv(req);
+    if (!env || typeof env.imp !== "string" || !env.imp.length) return null;
+    return { impersonation_id: env.imp, customer_id: env.customer_id };
+  }
+
+  // Is the impersonation row behind this cookie STILL live?
+  //
+  // The cookie is self-validating for its own lifetime, which would leave an
+  // operator browsing as a customer for hours after the session was ended or
+  // revoked. Every impersonated request re-reads the row, so `end` and
+  // `revoke` take effect on the operator's very next click rather than at
+  // cookie expiry. Only impersonated requests pay for the read.
+  //
+  // Fails CLOSED, unlike the customer-revocation gate beside it: that one
+  // fails open because a D1 blip must not sign out every shopper, but here a
+  // blip must not extend an operator's authority over someone else's account.
+  // The cost of failing closed is that the operator signs in again.
+  async function _impersonationStillLive(env) {
+    if (!env || typeof env.imp !== "string" || !env.imp.length) return true;
+    if (!deps.customerImpersonation ||
+        typeof deps.customerImpersonation.getSession !== "function") {
+      return false;
+    }
+    var row;
+    try { row = await deps.customerImpersonation.getSession(env.imp); }
+    catch (_e) { return false; }
+    if (!row || row.status !== "active") return false;
+    if (Number(row.expires_at) <= Date.now()) return false;
+    // The row must still name the customer the cookie claims, so a resealed
+    // or replayed envelope cannot point a live session at a different account.
+    return row.customer_id === env.customer_id;
+  }
+
   // Server-side session-revocation gate. The sealed cookie is otherwise
   // self-validating for its 14-day TTL, so erasure / passkey-revoke /
   // sign-out have no way to kill a LIVE cookie without this check. Resolves
@@ -14757,7 +15099,62 @@ function mount(router, deps) {
     res.status(200);
     res.setHeader && res.setHeader("content-type", "application/json; charset=utf-8");
     res.setHeader && res.setHeader("cache-control", "no-store");
-    var payload = JSON.stringify({ count: count });
+    // The impersonation flag rides this response rather than getting an
+    // endpoint of its own. Every page already calls this to fill the cart
+    // count, including the edge-cached ones where per-session chrome cannot
+    // be rendered server-side — so this is the one place a banner can be
+    // raised on a cached product page without routing the visitor to the
+    // container and destroying the cache hit rate.
+    //
+    // Read from the sealed cookie only: no database round trip, so an
+    // ordinary shopper's call costs exactly what it did before. The
+    // per-request liveness check still runs on the routes that matter; a
+    // banner shown a few seconds after a session ended is harmless, and the
+    // operator's next real request is refused regardless.
+    var imp = _impersonationOf(req);
+
+    // Record the page the island reported. With edge rendering on, most of
+    // the operator's browsing is answered by the Worker and never reaches the
+    // guard, so without this the session's trail would be a run of
+    // /cart/count calls naming nothing the operator actually looked at.
+    //
+    // The value comes from a browser and is treated that way: screened
+    // through the shared codepoint guard, required to look like a rooted
+    // path, and length-capped. A value that fails any of those is dropped
+    // rather than refused — this is an observability sink on a hot path, and
+    // the cart count must still come back.
+    if (imp && deps.customerImpersonation &&
+        typeof deps.customerImpersonation.actionsRecord === "function") {
+      var reported = null;
+      try {
+        var u = req.url ? new URL(req.url, "http://localhost") : null;
+        var p = u && u.searchParams.get("p");
+        // 256 is the action log's own cap on `resource_id`. Accepting more
+        // here would hand the primitive a value it refuses, and the catch
+        // below would swallow the refusal — so a long product URL would
+        // vanish from the trail without a trace. Truncate rather than drop:
+        // a shortened path still says which page, and losing the record
+        // entirely is the worse failure.
+        if (typeof p === "string" && p.length && p.charAt(0) === "/" &&
+            !textGuard.hasCodepointThreat(p, { singleLine: "reject" })) {
+          reported = p.length > IMPERSONATION_PATH_MAX ? p.slice(0, IMPERSONATION_PATH_MAX) : p;
+        }
+      } catch (_e) { reported = null; }
+      if (reported) {
+        try {
+          await deps.customerImpersonation.actionsRecord({
+            impersonation_id: imp.impersonation_id,
+            action:           "VIEW",
+            resource_kind:    "page",
+            resource_id:      reported,
+          });
+        } catch (_e) { /* drop-silent — the cart count must still return */ }
+      }
+    }
+
+    var payload = JSON.stringify(imp
+      ? { count: count, impersonating: { customer_id: imp.customer_id } }
+      : { count: count });
     return res.end ? res.end(payload) : res.send(payload);
   });
 
@@ -16179,6 +16576,12 @@ function mount(router, deps) {
     var rpId   = deps.rpId || (deps.shop_origin ? new URL(deps.shop_origin).hostname : "localhost");
     var expectedOrigin = deps.shop_origin || ("https://" + rpId);
 
+    // The impersonation guard that closes these surfaces is mounted at the
+    // TOP of this router, ahead of every route — see `impersonationGuard`
+    // near the locale middleware. It cannot live here: `router.use` only
+    // applies to routes registered after it, and /cart and /checkout are
+    // registered before this block.
+
     function _b64u(buf) {
       return b.crypto.toBase64Url(buf);
     }
@@ -16447,6 +16850,134 @@ function mount(router, deps) {
       });
     }
 
+    // ---- impersonation: redeem, and exit --------------------------------
+    //
+    // The operator arrives here from the admin console holding the one-time
+    // bearer the primitive minted. Redeeming it seals an ordinary auth cookie
+    // for the target customer, marked with the impersonation row's id.
+    //
+    // Two steps, and the split is load-bearing.
+    //
+    // The GET only LOOKS: it verifies the token and paints a confirmation page
+    // naming the customer and the stated reason. It changes nothing. The POST
+    // spends the token and mints the session.
+    //
+    // Doing both in the GET would mean anything that follows a link ahead of
+    // the operator — a browser prefetcher, a link-preview bot in whatever chat
+    // the console was open next to, a security scanner walking history — burns
+    // the one-time bearer. The operator then arrives to be told their link is
+    // invalid, and something that is not the operator is holding the only
+    // session that link will ever mint. A GET must not spend a credential.
+    //
+    // The confirmation is worth having on its own: the operator sees whose
+    // account they are about to enter, and why they said they were entering
+    // it, before they are inside it.
+    var _impersonationRefused = function (res) {
+      // One outcome for every failure — expired, ended, revoked, already
+      // spent, never existed. An operator who mistypes learns nothing about
+      // which, and a visitor guessing URLs learns nothing at all.
+      res.status(303);
+      res.setHeader && res.setHeader("location",
+        "/account/login?error=" + encodeURIComponent("view-as-customer link is no longer valid"));
+      return res.end ? res.end() : res.send("");
+    };
+
+    if (deps.customerImpersonation) {
+      router.get("/account/impersonate/:token", async function (req, res) {
+        var ctx = null;
+        try { ctx = await deps.customerImpersonation.verifyImpersonationToken(req.params.token); }
+        catch (_e) { ctx = null; }
+        if (!ctx) return _impersonationRefused(res);
+
+        var target = null;
+        try { target = await deps.customers.get(ctx.customer_id); }
+        catch (_e) { target = null; }
+
+        return _send(res, 200, renderImpersonationConfirm({
+          shop_name:     shopName,
+          token:         req.params.token,
+          customer_id:   ctx.customer_id,
+          customer_name: (target && target.display_name) || "",
+          reason:        ctx.reason,
+          expires_at:    ctx.expires_at,
+          csrf_token:    req.csrfToken,
+        }));
+      });
+
+      router.post("/account/impersonate/start", async function (req, res) {
+        var token = (req.body && req.body.token) || "";
+        var ctx = null;
+        try { ctx = await deps.customerImpersonation.verifyImpersonationToken(token); }
+        catch (_e) { ctx = null; }
+        if (!ctx) return _impersonationRefused(res);
+
+        // The claim authorizes the cookie, not the verify above: verification
+        // is a read, so two requests carrying the same token can both pass it.
+        // Only the one whose UPDATE still matched the hash gets a session.
+        // Fails CLOSED on a handle that cannot claim. An older or custom
+        // implementation without `consumeToken` would otherwise skip the claim
+        // and still be handed a cookie, turning the single-use link back into
+        // a bearer any number of holders could replay for the session's life.
+        // No claim, no session.
+        if (typeof deps.customerImpersonation.consumeToken !== "function") {
+          return _impersonationRefused(res);
+        }
+        var claim = null;
+        try { claim = await deps.customerImpersonation.consumeToken(ctx.impersonation_id, token); }
+        catch (_e) { claim = null; }
+        if (!claim || !claim.consumed) return _impersonationRefused(res);
+
+        // If this browser is already in a session, close it before the cookie
+        // naming it is overwritten. The cookie is the only handle on it: once
+        // replaced, the operator cannot reach the exit control for the old one
+        // and its row would sit `active` until the hourly sweep — telling the
+        // first customer "in progress now" about a session nobody is in, and
+        // showing operator dashboards a session that has been abandoned.
+        var previous = _impersonationOf(req);
+        if (previous && previous.impersonation_id !== ctx.impersonation_id) {
+          try {
+            await deps.customerImpersonation.endImpersonation({
+              impersonation_id: previous.impersonation_id,
+              ended_by:         "operator",
+              reason:           "operator moved to another customer's session",
+            });
+          } catch (_e) { /* the new cookie below is what the operator gets either way */ }
+        }
+
+        _setAuthCookie(req, res, {
+          customer_id: ctx.customer_id,
+          // The cookie must not outlive the session it represents. The auth
+          // cookie's usual 14 days would leave a sealed envelope naming a
+          // dead impersonation long after it ended; the per-request liveness
+          // read would refuse it, but there is no reason to hand out a
+          // credential that outlives its authority.
+          exp:         ctx.expires_at,
+          imp:         ctx.impersonation_id,
+        });
+        res.status(303); res.setHeader && res.setHeader("location", "/account");
+        return res.end ? res.end() : res.send("");
+      });
+
+      // Leaving. Ends the row so the operator's next request is refused by
+      // the liveness read even if the cookie survives, then clears the cookie
+      // so the browser stops carrying the customer's session at all.
+      router.post("/account/impersonate/end", async function (req, res) {
+        var imp = _impersonationOf(req);
+        if (imp) {
+          try {
+            await deps.customerImpersonation.endImpersonation({
+              impersonation_id: imp.impersonation_id,
+              ended_by:         "operator",
+              reason:           "operator left the session",
+            });
+          } catch (_e) { /* clearing the cookie below is what protects the customer */ }
+        }
+        _clearAuthCookie(req, res);
+        res.status(303); res.setHeader && res.setHeader("location", "/");
+        return res.end ? res.end() : res.send("");
+      });
+    }
+
     router.post("/account/passkey/register-begin", async function (req, res) {
       try {
         var body = _readJsonBody(req);
@@ -16845,11 +17376,48 @@ function mount(router, deps) {
       } catch (_e) { /* drop-silent — primitive may not expose listPasskeys on every build */ }
 
       var cartCount = await _cartCountForReq(req);
+      // Every time an operator has opened this account for support, shown to
+      // the person it belongs to. This is the customer's notification: the
+      // store keeps their email as a hash only, so there is no address to
+      // send to, and a notice that cannot be delivered is not a notice. Here
+      // it needs no address, cannot bounce, and cannot silently fail to send.
+      //
+      // Read-only and best-effort: a lookup failure must never keep a
+      // customer out of their own account.
+      var accountAccesses = [];
+      var accessPage = 0;
+      var accessHasMore = false;
+      if (deps.customerImpersonation &&
+          typeof deps.customerImpersonation.listForCustomer === "function") {
+        var acctUrl = req.url ? new URL(req.url, "http://localhost") : null;
+        // Bounded per page, because these rows are never pruned and an
+        // unbounded read would make this page slower for the rest of the
+        // account's life — worst for the customers support has helped most
+        // often. Paged rather than truncated: this is the customer's only
+        // view of who opened their account, so nothing may become
+        // permanently unreachable. `?access_page=N` walks back.
+        accessPage = Math.max(0, parseInt((acctUrl && acctUrl.searchParams.get("access_page")) || "0", 10) || 0);
+        try {
+          // One extra row than the page shows, purely to learn whether there
+          // is another page — cheaper than a second COUNT query.
+          var fetched = await deps.customerImpersonation.listForCustomer(customer.id, {
+            limit:  ACCESS_PAGE_SIZE + 1,
+            offset: accessPage * ACCESS_PAGE_SIZE,
+          });
+          accessHasMore = fetched.length > ACCESS_PAGE_SIZE;
+          accountAccesses = accessHasMore ? fetched.slice(0, ACCESS_PAGE_SIZE) : fetched;
+        }
+        catch (_e) { accountAccesses = []; }
+      }
+
       _send(res, 200, renderAccount({
         asset_prefix:          deps.asset_prefix || "/assets/",
         customer:              customer,
         orders:                orders,
         order_product_lookup:  orderProductLookup,
+        account_accesses:      accountAccesses,
+        account_access_page:     accessPage,
+        account_access_has_more: accessHasMore,
         passkey_count:         passkeyCount,
         preorders_enabled:     !!preorder,
         pickups_enabled:       !!deps.clickAndCollect,

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@blamejs/blamejs-shop",
-  "version": "0.5.22",
+  "version": "0.5.23",
   "description": "Open-source framework built on blamejs. Vendored stack, zero npm runtime deps, PQC-first crypto, security-on by default.",
   "main": "lib/index.js",
   "scripts": {