@shop-on/customer-runtime 0.1.0 → 0.2.0

package/dist/graphql.js

@@ -1,4 +1,5 @@
 import { relayHeaders } from "./relay.js";
+import { traceHeaders } from "./trace.js";
 import { evictStorefrontToken, getStorefrontToken } from "./oauth.js";
 import { ClientError, GraphQLClient } from "graphql-request";
 //#region src/graphql.ts
@@ -23,6 +24,7 @@ function buildClient(token, extra) {
 async function storefrontRequest(shopHandle, document, variables, options) {
 	const extra = {
 		...options?.customerSessionToken ? { "X-Customer-Session": options.customerSessionToken } : {},
+		...traceHeaders(),
 		...relayHeaders()
 	};
 	let token = await getStorefrontToken(shopHandle);

package/dist/internal-api.js

@@ -1,4 +1,5 @@
 import { relayHeaders } from "./relay.js";
+import { traceHeaders } from "./trace.js";
 //#region src/internal-api.ts
 function apiUrl() {
 	return process.env.SPN_CUSTOMER_API_URL ?? "http://localhost:3003";
@@ -40,6 +41,7 @@ async function internalPost(path, body, { signal } = {}) {
 		headers: {
 			"Content-Type": "application/json",
 			"X-Internal-Auth": secret,
+			...traceHeaders(),
 			...relayHeaders()
 		},
 		body: JSON.stringify(body),
@@ -59,6 +61,7 @@ async function internalDelete(path) {
 		method: "DELETE",
 		headers: {
 			"X-Internal-Auth": secret,
+			...traceHeaders(),
 			...relayHeaders()
 		}
 	});

package/dist/relay.js

@@ -1,6 +1,11 @@
 import { currentRequest } from "./request-scope.js";
-import { isIP } from "node:net";
 //#region src/relay.ts
+const IPV4_OCTET = "(25[0-5]|2[0-4]\\d|1\\d\\d|[1-9]?\\d)";
+const IPV4 = new RegExp(`^${IPV4_OCTET}(\\.${IPV4_OCTET}){3}$`);
+function isIP(value) {
+	if (IPV4.test(value)) return true;
+	return /^[\da-f:.]+$/i.test(value) && value.includes(":") && URL.canParse(`http://[${value}]`);
+}
 /**
 * `X-Buyer-IP` from Cloudflare's `CF-Connecting-IP` on the request this call
 * runs under, plus `X-Relay-Auth` when SPN_RELAY_SECRET is set. Empty outside

package/dist/request-scope.js

@@ -2,7 +2,7 @@
 const EVENT_STORAGE_KEY = Symbol.for("tanstack-start:event-storage");
 /** The request this call runs under; undefined outside one (browser, tests, pre-handler). */
 function currentRequest() {
-	return globalThis[EVENT_STORAGE_KEY]?.getStore()?.h3Event?.req;
+	return globalThis[EVENT_STORAGE_KEY]?.getStore()?.request;
 }
 const slots = /* @__PURE__ */ new WeakMap();
 /**

package/dist/sealed-session.d.ts

@@ -0,0 +1,27 @@
+//#region src/sealed-session.d.ts
+export interface SealedSessionConfig {
+  name: string;
+  /** At least 32 chars. */
+  password: string;
+  /** Seconds. Seal TTL plus an absolute cap counted from the first write. */
+  maxAge?: number;
+  cookie: {
+    secure: boolean;
+    httpOnly: true;
+    sameSite: "lax";
+    path: "/";
+    /** Seconds. Sent as Max-Age, refreshed on every write. */
+    maxAge?: number;
+  };
+}
+export interface SealedSession<T> {
+  /** Live: reflects every write committed so far in this request. */
+  readonly data: Partial<T>;
+  update(patch: Partial<T>): Promise<void>;
+  clear(): Promise<void>;
+}
+export declare class SessionTooLargeError extends Error {
+  constructor(name: string, length: number);
+}
+export declare function openSession<T>(config: SealedSessionConfig): Promise<SealedSession<T>>;
+//#endregion

package/dist/sealed-session.js

@@ -0,0 +1,154 @@
+import { requestSlot } from "./request-scope.js";
+import { deleteCookie, getCookie, setCookie } from "@tanstack/react-start/server";
+import { defaults, seal, unseal } from "iron-webcrypto";
+//#region src/sealed-session.ts
+/**
+* Encrypted cookie sessions, wire-compatible with the `useSession` TanStack
+* Start 1.168 shipped (h3 2.0.1-rc.20) and 1.169 removed. Both seal
+* `{ id, createdAt, data }` with iron (Fe26.2, iron's defaults), so a cookie
+* either one wrote opens in the other — no sign-out on deploy, and a rollback
+* stays safe. `test/fixtures/h3-sessions.json` holds cookies Start 1.168
+* minted; `test/sealed-session.test.ts` keeps them opening.
+*
+* Where it deliberately differs from h3:
+* - A read never writes. h3 minted and set an empty session on every
+*   cookieless read.
+* - `clear()` sticks for the rest of the request. h3 re-read the stale
+*   request cookie afterwards.
+* - Writes are one cookie, never chunked. A seal over 3,800 chars throws
+*   `SessionTooLargeError` instead. h3's chunked cookies still open, and
+*   the next write or clear deletes their chunks.
+* - No `x-<name>-session` request header.
+*
+* Each request shares one state per cookie name (`requestSlot`), so parallel
+* opens unseal once, and writes queue: each merges onto the state the one
+* before it committed, in call order.
+*/
+var SessionTooLargeError = class extends Error {
+	constructor(name, length) {
+		super(`Session "${name}" seals to ${length} chars, over the ${MAX_SEALED_LENGTH} limit`);
+		this.name = "SessionTooLargeError";
+	}
+};
+const MAX_SEALED_LENGTH = 3800;
+const CHUNKED = "__chunked__";
+const MAX_CHUNKS = 100;
+const DEFAULT_COOKIE = {
+	path: "/",
+	secure: true,
+	httpOnly: true
+};
+const empty = () => ({
+	id: "",
+	createdAt: 0,
+	data: {}
+});
+async function openSession(config) {
+	if (typeof config.password !== "string" || config.password.length < 32) throw new Error(`Session "${config.name}" needs a password of at least 32 characters`);
+	const init = () => {
+		const slot = {
+			chain: Promise.resolve(),
+			state: empty()
+		};
+		slot.chain = read(config).then((state) => {
+			slot.state = state;
+		});
+		return slot;
+	};
+	const slot = requestSlot(Symbol.for(`shop-on:sealed-session:${config.name}`), init) ?? init();
+	await slot.chain;
+	const enqueue = (run) => {
+		const result = slot.chain.then(run);
+		slot.chain = result.catch(() => {});
+		return result;
+	};
+	return {
+		get data() {
+			return slot.state.data;
+		},
+		update: (patch) => enqueue(() => write(config, slot, patch)),
+		clear: () => enqueue(() => {
+			slot.state = empty();
+			deleteCookie(config.name, {
+				...DEFAULT_COOKIE,
+				...config.cookie
+			});
+			deleteChunks(config);
+		})
+	};
+}
+function sealOptions(config) {
+	return {
+		...defaults,
+		ttl: config.maxAge ? config.maxAge * 1e3 : 0
+	};
+}
+async function read(config) {
+	const sealed = readSealed(config.name);
+	if (!sealed) return empty();
+	try {
+		const opened = await unseal(sealed, config.password, sealOptions(config));
+		if (typeof opened?.id !== "string" || !opened.id || typeof opened.createdAt !== "number") return empty();
+		if (config.maxAge && Date.now() - opened.createdAt > config.maxAge * 1e3) return empty();
+		const data = opened.data && typeof opened.data === "object" ? { ...opened.data } : {};
+		return {
+			id: opened.id,
+			createdAt: opened.createdAt,
+			data
+		};
+	} catch {
+		return empty();
+	}
+}
+/** The request's sealed value, reassembled from h3's chunks when it split one. */
+function readSealed(name) {
+	const value = getCookie(name);
+	const count = chunkCount(value);
+	if (!count) return value?.startsWith(CHUNKED) ? void 0 : value;
+	const chunks = [];
+	for (let i = 1; i <= count; i++) {
+		const chunk = getCookie(`${name}.${i}`);
+		if (!chunk) return void 0;
+		chunks.push(chunk);
+	}
+	return chunks.join("");
+}
+function chunkCount(value) {
+	if (!value?.startsWith(CHUNKED)) return 0;
+	const count = Number.parseInt(value.slice(11), 10);
+	return Number.isInteger(count) && count >= 1 && count <= MAX_CHUNKS ? count : 0;
+}
+function deleteChunks(config) {
+	const count = chunkCount(getCookie(config.name));
+	for (let i = 1; i <= count; i++) deleteCookie(`${config.name}.${i}`, {
+		...DEFAULT_COOKIE,
+		...config.cookie
+	});
+}
+async function write(config, slot, patch) {
+	const previous = slot.state;
+	const fresh = !previous.id || Object.keys(previous.data).length === 0;
+	const data = JSON.parse(JSON.stringify({
+		...previous.data,
+		...patch
+	}));
+	const next = fresh ? {
+		id: globalThis.crypto.randomUUID(),
+		createdAt: Date.now(),
+		data
+	} : {
+		...previous,
+		data
+	};
+	const sealed = await seal(next, config.password, sealOptions(config));
+	if (sealed.length > MAX_SEALED_LENGTH) throw new SessionTooLargeError(config.name, sealed.length);
+	slot.state = next;
+	setCookie(config.name, sealed, {
+		...DEFAULT_COOKIE,
+		expires: config.maxAge ? new Date(next.createdAt + config.maxAge * 1e3) : void 0,
+		...config.cookie
+	});
+	deleteChunks(config);
+}
+//#endregion
+export { SessionTooLargeError, openSession };

package/dist/session-cookie.d.ts

@@ -8,9 +8,9 @@
  * `undefined` for both "missing" and "wrong shop" so callers handle them
  * uniformly (treat as logged-out).
  *
- * The returned `ShopBoundCookieConfig` is shape-compatible with TanStack
- * Start's `SessionConfig` — pass it straight to `useSession`. We don't
- * import the TanStack type here so the package stays runtime-agnostic.
+ * The returned `ShopBoundCookieConfig` is shape-compatible with
+ * `SealedSessionConfig` — pass it straight to `openSession`
+ * (`./sealed-session`). This module stays free of TanStack imports.
  */
 export interface ShopBoundSession {
   shopHandle: string;

package/dist/trace.d.ts

@@ -0,0 +1,13 @@
+//#region src/trace.d.ts
+export interface TraceOptions {
+  /** Continue a valid incoming `traceparent`. Only behind a proxy that started the trace (Traefik). */
+  continueIncoming?: boolean;
+}
+/**
+ * `traceparent` for the request this call runs under: one minted once per
+ * request, or with `continueIncoming` the incoming ids when valid; always
+ * sampled. Empty outside a request. Send it to our own api only, never to a
+ * third party.
+ */
+export declare function traceHeaders({ continueIncoming }?: TraceOptions): Record<string, string>;
+//#endregion

package/dist/trace.js

@@ -0,0 +1,25 @@
+import { currentRequest, requestSlot } from "./request-scope.js";
+//#region src/trace.ts
+const TRACEPARENT = /^00-((?!0{32})[\da-f]{32})-((?!0{16})[\da-f]{16})-[\da-f]{2}$/;
+const MINTED = Symbol("minted traceparent");
+function randomHex(bytes) {
+	const buf = crypto.getRandomValues(new Uint8Array(bytes));
+	if (buf.every((b) => b === 0)) buf[0] = 1;
+	return Array.from(buf, (b) => b.toString(16).padStart(2, "0")).join("");
+}
+/**
+* `traceparent` for the request this call runs under: one minted once per
+* request, or with `continueIncoming` the incoming ids when valid; always
+* sampled. Empty outside a request. Send it to our own api only, never to a
+* third party.
+*/
+function traceHeaders({ continueIncoming = false } = {}) {
+	if (continueIncoming) {
+		const incoming = currentRequest()?.headers.get("traceparent")?.match(TRACEPARENT);
+		if (incoming) return { traceparent: `00-${incoming[1]}-${incoming[2]}-01` };
+	}
+	const traceparent = requestSlot(MINTED, () => `00-${randomHex(16)}-${randomHex(8)}-01`);
+	return traceparent ? { traceparent } : {};
+}
+//#endregion
+export { traceHeaders };

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@shop-on/customer-runtime",
-  "version": "0.1.0",
+  "version": "0.2.0",
   "license": "SEE LICENSE IN dist/LICENSE.md",
   "files": [
     "dist"
@@ -14,23 +14,29 @@
     "./oauth": "./dist/oauth.js",
     "./relay": "./dist/relay.js",
     "./request-scope": "./dist/request-scope.js",
+    "./sealed-session": "./dist/sealed-session.js",
     "./session-cookie": "./dist/session-cookie.js",
     "./shop-context": "./dist/shop-context.js",
+    "./trace": "./dist/trace.js",
     "./package.json": "./package.json"
   },
   "dependencies": {
-    "gql.tada": "1.11.3",
-    "graphql-request": "7.4.0"
+    "gql.tada": "1.11.4",
+    "graphql-request": "7.4.0",
+    "iron-webcrypto": "2.0.0"
   },
   "devDependencies": {
-    "@tanstack/react-start": "1.168.60",
-    "@types/node": "26.6.3",
+    "@tanstack/react-start": "1.169.3",
+    "@types/node": "26.6.5",
     "typescript": "7.0.2",
-    "vitest": "5.0.3"
+    "vitest": "5.0.5"
+  },
+  "peerDependencies": {
+    "@tanstack/react-start": "~1.169.3"
   },
   "scripts": {
     "check-types": "tsc --noEmit",
-    "test": "vitest run",
+    "test": "vitest run --maxWorkers=2",
     "test:watch": "vitest"
   }
 }