@shopify/hydrogen 2026.4.5 → 2026.10.0-preview.2

package/dist/customer-account/session.mjs

@@ -0,0 +1,733 @@
+import { getLogger } from "../core/logging/logging.mjs";
+import { DEFAULT_TIMEOUT_IN_MS } from "../core/constants.mjs";
+import { CUSTOMER_ACCOUNT_PATHS } from "../core/url.mjs";
+import { createCallableRouteHandler } from "../core/request-routing/registered-routes.mjs";
+import { getCartBuyerIdentitySync } from "../core/cart/buyer-identity-sync.mjs";
+import { CustomerAccountApiError, CustomerAccountOAuthError } from "./errors.mjs";
+
+//#region src/customer-account/session.ts
+const log = getLogger("customer-account");
+const CUSTOMER_ACCOUNT_AUTHORIZE_PATH = CUSTOMER_ACCOUNT_PATHS.authorize;
+const CUSTOMER_ACCOUNT_LOGIN_PATH = CUSTOMER_ACCOUNT_PATHS.login;
+const CUSTOMER_ACCOUNT_LOGOUT_PATH = CUSTOMER_ACCOUNT_PATHS.logout;
+const CUSTOMER_ACCOUNT_REFRESH_PATH = CUSTOMER_ACCOUNT_PATHS.refresh;
+const CUSTOMER_ACCOUNT_SESSION_KEY = "customerAccount";
+const DEFAULT_LOGIN_RETURN_TO_PATH = "/account";
+const DEFAULT_POST_LOGIN_REDIRECT_PATHNAME = "/";
+const DEFAULT_POST_LOGOUT_REDIRECT_URI = "/";
+const FAILED_LOGIN_PATH = "/account?login=failed";
+const FORBIDDEN_STATUS = 403;
+const FORBIDDEN_ERROR_CODE = "forbidden";
+const FORBIDDEN_ERROR_MESSAGE = "Forbidden";
+const NO_STORE_CACHE_CONTROL = "no-store";
+const AUTHORIZATION_CODE_GRANT_TYPE = "authorization_code";
+const REFRESH_TOKEN_GRANT_TYPE = "refresh_token";
+const CUSTOMER_ACCOUNT_SCOPE = "openid email customer-account-api:full";
+const CODE_CHALLENGE_METHOD = "S256";
+const USER_AGENT = `Hydrogen 2026.10.0-preview.2`;
+const EXPIRY_BUFFER_IN_SECONDS = 120;
+const PENDING_LOGIN_TTL_IN_MINUTES = 10;
+const SECONDS_PER_MINUTE = 60;
+const MILLISECONDS_PER_SECOND = 1e3;
+const PENDING_LOGIN_TTL_IN_MS = PENDING_LOGIN_TTL_IN_MINUTES * SECONDS_PER_MINUTE * MILLISECONDS_PER_SECOND;
+const RANDOM_BYTES_LENGTH = 32;
+const MAX_RETURN_TO_LENGTH_IN_BYTES = 2048;
+const MAX_SET_TIMEOUT_IN_MS = 2147483647;
+const SHOP_ID_RE = /^\d+$/;
+const CUSTOMER_SESSION_ACCESS_TOKEN_PERSONALIZATION_REASON = "customer-session-access-token";
+const CUSTOMER_SESSION_MUTATION_PERSONALIZATION_REASON = "customer-session-mutation";
+const CUSTOMER_SESSION_INTERNAL_BRAND = Symbol("hydrogen.customerSessionInternal");
+const customerSessionInternals = /* @__PURE__ */ new WeakMap();
+function createCustomerSession({ shopId, customerAccountApiClientId, customerAccountApiUrl, fetch: customFetch, defaultTimeoutInMs = DEFAULT_TIMEOUT_IN_MS }) {
+	if (typeof document !== "undefined") throw new Error("Customer Account OAuth sessions cannot be used in a browser context. Use this helper from server or edge routes only.");
+	validateShopId(shopId);
+	validateCustomerAccountApiClientId(customerAccountApiClientId);
+	validateTimeout(defaultTimeoutInMs);
+	const fetch = customFetch ?? globalThis.fetch;
+	if (typeof fetch !== "function") throw new Error("No fetch function available. Pass a fetch option or ensure globalThis.fetch exists.");
+	const endpoints = createCustomerAccountEndpoints(shopId, customerAccountApiUrl);
+	const refreshFlights = /* @__PURE__ */ new Map();
+	async function getAccessToken(sessionManager, requestContext) {
+		requestContext.markResponseAsPersonalized(CUSTOMER_SESSION_ACCESS_TOKEN_PERSONALIZATION_REASON);
+		return getUsableAccessToken(await readSessionData(sessionManager));
+	}
+	async function getOrRefreshAccessToken(sessionManager, requestContext, options = {}) {
+		return (await getOrRefreshAccessTokenResult(sessionManager, requestContext, options)).accessToken;
+	}
+	async function getOrRefreshAccessTokenResult(sessionManager, requestContext, options = {}) {
+		requestContext.markResponseAsPersonalized(CUSTOMER_SESSION_ACCESS_TOKEN_PERSONALIZATION_REASON);
+		const sessionData = await readSessionData(sessionManager);
+		const accessToken = getUsableAccessToken(sessionData);
+		if (accessToken) return {
+			status: "authenticated",
+			accessToken
+		};
+		const refreshToken = getRefreshToken(sessionData);
+		if (!refreshToken) return {
+			status: "unauthenticated",
+			accessToken: void 0
+		};
+		const origin = await getResolvedOrigin(sessionManager, options.origin);
+		const idToken = sessionData.tokens?.idToken;
+		const refreshResult = await getRefreshResult({
+			refreshFlights,
+			refreshToken,
+			idToken,
+			origin,
+			endpoints,
+			customerAccountApiClientId,
+			fetch,
+			timeoutInMs: defaultTimeoutInMs
+		});
+		if (refreshResult.type === "success") {
+			const refreshedAccessToken = refreshResult.tokens.accessToken;
+			if (!refreshedAccessToken) return {
+				status: "transient",
+				accessToken: void 0
+			};
+			await writeTokens(sessionManager, refreshResult.tokens);
+			return {
+				status: "authenticated",
+				accessToken: refreshedAccessToken
+			};
+		}
+		if (refreshResult.type === "invalid") {
+			await clearTokens(sessionManager);
+			return {
+				status: "unauthenticated",
+				accessToken: void 0
+			};
+		}
+		return {
+			status: "transient",
+			accessToken: void 0
+		};
+	}
+	async function prepareLoginUrl(sessionManager, requestContext, options) {
+		requestContext.markResponseAsPersonalized(CUSTOMER_SESSION_MUTATION_PERSONALIZATION_REASON);
+		const origin = await getResolvedOrigin(sessionManager, options.origin);
+		const state = generateRandomBase64Url();
+		const nonce = generateRandomBase64Url();
+		const codeVerifier = generateRandomBase64Url();
+		const codeChallenge = await createCodeChallenge(codeVerifier);
+		const returnTo = sanitizeReturnTo(options.returnTo, origin);
+		const createdAt = Date.now();
+		await writeSessionData(sessionManager, {
+			...await readSessionData(sessionManager),
+			pendingLogin: {
+				state,
+				nonce,
+				codeVerifier,
+				returnTo,
+				origin,
+				createdAt
+			}
+		});
+		const loginUrl = new URL(endpoints.authorizeUrl);
+		loginUrl.searchParams.set("client_id", customerAccountApiClientId);
+		loginUrl.searchParams.set("scope", CUSTOMER_ACCOUNT_SCOPE);
+		loginUrl.searchParams.set("response_type", "code");
+		loginUrl.searchParams.set("redirect_uri", `${origin}${CUSTOMER_ACCOUNT_AUTHORIZE_PATH}`);
+		loginUrl.searchParams.set("state", state);
+		loginUrl.searchParams.set("nonce", nonce);
+		loginUrl.searchParams.set("code_challenge", codeChallenge);
+		loginUrl.searchParams.set("code_challenge_method", CODE_CHALLENGE_METHOD);
+		setOptionalLoginParams(loginUrl, options);
+		return loginUrl.toString();
+	}
+	async function handleOAuthCallback(sessionManager, requestContext, request) {
+		return (await handleOAuthCallbackResult(sessionManager, requestContext, request)).location;
+	}
+	async function handleOAuthCallbackResult(sessionManager, requestContext, request) {
+		requestContext.markResponseAsPersonalized(CUSTOMER_SESSION_MUTATION_PERSONALIZATION_REASON);
+		try {
+			return await completeOAuthCallback({
+				sessionManager,
+				request,
+				endpoints,
+				customerAccountApiClientId,
+				fetch,
+				timeoutInMs: defaultTimeoutInMs
+			});
+		} catch (error) {
+			await clearPendingLogin(sessionManager);
+			throw error;
+		}
+	}
+	async function logout(sessionManager, requestContext, options = {}) {
+		requestContext.markResponseAsPersonalized(CUSTOMER_SESSION_MUTATION_PERSONALIZATION_REASON);
+		const origin = await getResolvedOrigin(sessionManager, options.origin);
+		const idToken = (await readSessionData(sessionManager)).tokens?.idToken;
+		const postLogoutRedirectUri = absoluteSameOriginUrl(options.postLogoutRedirectUri ?? origin, origin);
+		await sessionManager.removeSessionItem(CUSTOMER_ACCOUNT_SESSION_KEY);
+		if (!idToken) return postLogoutRedirectUri;
+		const logoutUrl = new URL(endpoints.logoutUrl);
+		logoutUrl.searchParams.set("id_token_hint", idToken);
+		logoutUrl.searchParams.set("post_logout_redirect_uri", postLogoutRedirectUri);
+		return logoutUrl.toString();
+	}
+	const customerSession = {
+		[CUSTOMER_SESSION_INTERNAL_BRAND]: true,
+		isLoggedIn: async (sessionManager, requestContext) => {
+			requestContext.markResponseAsPersonalized(CUSTOMER_SESSION_ACCESS_TOKEN_PERSONALIZATION_REASON);
+			return hasCustomerSession(await readSessionData(sessionManager));
+		},
+		getAccessToken,
+		getOrRefreshAccessToken,
+		prepareLoginUrl,
+		handleOAuthCallback,
+		logout
+	};
+	customerSessionInternals.set(customerSession, {
+		getOrRefreshAccessToken: getOrRefreshAccessTokenResult,
+		handleOAuthCallback: handleOAuthCallbackResult
+	});
+	return customerSession;
+}
+async function getCustomerSessionRefreshResult(customerSession, sessionManager, requestContext, options = {}) {
+	return customerSessionInternals.get(customerSession)?.getOrRefreshAccessToken(sessionManager, requestContext, options);
+}
+function createCustomerAccountServerHandlers(options) {
+	const { customerSession, defaultPostLoginRedirectPathname = DEFAULT_POST_LOGIN_REDIRECT_PATHNAME, loginFailedRedirectPath = FAILED_LOGIN_PATH, postLogoutRedirectUri = DEFAULT_POST_LOGOUT_REDIRECT_URI } = options;
+	const { origin: originOption } = options;
+	const cartSync = resolveCartBuyerIdentitySync(options);
+	return {
+		authorize: createCallableRouteHandler(CUSTOMER_ACCOUNT_AUTHORIZE_PATH, "GET", async (context) => {
+			return handleAuthorizeRoute(customerSession, context, loginFailedRedirectPath, originOption, cartSync);
+		}),
+		login: createCallableRouteHandler(CUSTOMER_ACCOUNT_LOGIN_PATH, "GET", async (context) => {
+			const { request, sessionManager, requestContext } = context;
+			return handleLoginRoute(customerSession, sessionManager, requestContext, request, defaultPostLoginRedirectPathname, originOption);
+		}),
+		logout: createCallableRouteHandler(CUSTOMER_ACCOUNT_LOGOUT_PATH, "POST", async (context) => {
+			return handleLogoutRoute(customerSession, context, postLogoutRedirectUri, originOption, cartSync);
+		}),
+		refresh: createCallableRouteHandler(CUSTOMER_ACCOUNT_REFRESH_PATH, "GET", async (context) => {
+			return handleRefreshRoute(customerSession, context, originOption, cartSync);
+		})
+	};
+}
+function resolveCartBuyerIdentitySync(options) {
+	if (!options.cartServerHandlers) return void 0;
+	const cartSync = getCartBuyerIdentitySync(options.cartServerHandlers);
+	if (!cartSync) throw new Error("cartServerHandlers must be created by createCartServerHandlers with the customerSession option.");
+	if (!customerSessionInternals.has(options.customerSession)) throw new Error("Cart buyer identity sync requires the customerSession returned by createCustomerSession.");
+	return cartSync;
+}
+async function handleLoginRoute(customerSession, sessionManager, requestContext, request, defaultPostLoginRedirectPathname, originOption) {
+	const origin = await resolveRouteOrigin(sessionManager, request, originOption);
+	const requestUrl = new URL(request.url);
+	const defaultReturnTo = sanitizeReturnTo(defaultPostLoginRedirectPathname, origin, DEFAULT_POST_LOGIN_REDIRECT_PATHNAME);
+	const returnTo = sanitizeReturnTo(requestUrl.searchParams.get("return_to") ?? requestUrl.searchParams.get("returnTo"), origin, defaultReturnTo);
+	return redirectResult(await customerSession.prepareLoginUrl(sessionManager, requestContext, {
+		origin,
+		returnTo,
+		countryCode: requestContext.i18n.country,
+		locale: getOptionalSearchParam(requestUrl, "locale"),
+		acrValues: getOptionalSearchParam(requestUrl, "acr_values"),
+		loginHint: getOptionalSearchParam(requestUrl, "login_hint"),
+		loginHintMode: getOptionalSearchParam(requestUrl, "login_hint_mode")
+	}), await commitSession(sessionManager));
+}
+async function handleLogoutRoute(customerSession, context, postLogoutRedirectUri, originOption, cartSync) {
+	const { request, sessionManager, requestContext } = context;
+	const origin = await resolveRouteOrigin(sessionManager, request, originOption);
+	if (!isSameOriginPost(request, origin)) return forbiddenResult();
+	const requestUrl = new URL(request.url);
+	const requestedReturnTo = requestUrl.searchParams.get("return_to") ?? requestUrl.searchParams.get("returnTo");
+	const logoutUrl = await customerSession.logout(sessionManager, requestContext, {
+		origin,
+		postLogoutRedirectUri: sanitizeReturnTo(requestedReturnTo, origin, postLogoutRedirectUri)
+	});
+	let detachFailed = false;
+	if (cartSync) detachFailed = !await syncCartBuyerIdentity(cartSync, context, null, "logout");
+	const headers = new Headers(await commitSession(sessionManager));
+	if (cartSync && detachFailed) headers.append("set-cookie", cartSync.expiredCartCookie);
+	return redirectResult(logoutUrl, headers);
+}
+async function handleAuthorizeRoute(customerSession, context, loginFailedRedirectPath, originOption, cartSync) {
+	const { request, sessionManager, requestContext } = context;
+	try {
+		if (!cartSync) return redirectResult(await customerSession.handleOAuthCallback(sessionManager, requestContext, request), await commitSession(sessionManager));
+		const { location, accessToken } = await handleOAuthCallbackWithAccessToken(customerSession, sessionManager, requestContext, request);
+		await syncCartBuyerIdentity(cartSync, context, accessToken, "authorize");
+		return redirectResult(location, await commitSession(sessionManager));
+	} catch (error) {
+		if (!(error instanceof CustomerAccountOAuthError)) throw error;
+		return redirectResult(sanitizeReturnTo(loginFailedRedirectPath, await resolveRouteOrigin(sessionManager, request, originOption)), await commitSession(sessionManager));
+	}
+}
+async function handleRefreshRoute(customerSession, context, originOption, cartSync) {
+	const { request, sessionManager, requestContext } = context;
+	const origin = await resolveRouteOrigin(sessionManager, request, originOption);
+	if (!cartSync) {
+		await customerSession.getOrRefreshAccessToken(sessionManager, requestContext, { origin });
+		return refreshRedirectResult(request, origin, await commitSession(sessionManager));
+	}
+	const refreshResult = await getOrRefreshAccessTokenWithStatus(customerSession, sessionManager, requestContext, { origin });
+	let detachFailed = false;
+	if (refreshResult.status !== "transient") {
+		const customerAccessToken = refreshResult.accessToken ?? null;
+		const syncSucceeded = await syncCartBuyerIdentity(cartSync, context, customerAccessToken, "refresh");
+		detachFailed = customerAccessToken === null && !syncSucceeded;
+	}
+	const headers = new Headers(await commitSession(sessionManager));
+	if (detachFailed) headers.append("set-cookie", cartSync.expiredCartCookie);
+	return refreshRedirectResult(request, origin, headers);
+}
+function refreshRedirectResult(request, origin, headers) {
+	const requestUrl = new URL(request.url);
+	return redirectResult(sanitizeReturnTo(requestUrl.searchParams.get("return_to") ?? requestUrl.searchParams.get("returnTo"), origin), headers);
+}
+async function handleOAuthCallbackWithAccessToken(customerSession, sessionManager, requestContext, request) {
+	const internal = customerSessionInternals.get(customerSession);
+	if (!internal) throw new Error("Customer session was not created by createCustomerSession");
+	return internal.handleOAuthCallback(sessionManager, requestContext, request);
+}
+async function getOrRefreshAccessTokenWithStatus(customerSession, sessionManager, requestContext, options) {
+	const internal = customerSessionInternals.get(customerSession);
+	if (!internal) throw new Error("Customer session was not created by createCustomerSession");
+	return internal.getOrRefreshAccessToken(sessionManager, requestContext, options);
+}
+async function syncCartBuyerIdentity(cartSync, context, customerAccessToken, route) {
+	try {
+		if (!context.storefrontClient) throw new Error("Customer Account handlers configured with cartServerHandlers require storefrontClient.");
+		await cartSync.updateBuyerIdentity({
+			request: context.request,
+			storefrontClient: context.storefrontClient
+		}, customerAccessToken);
+		return true;
+	} catch (error) {
+		log.error("cart buyer identity sync failed", {
+			route,
+			error
+		});
+		return false;
+	}
+}
+async function resolveRouteOrigin(sessionManager, request, originOption) {
+	if (typeof originOption === "function") return normalizeOrigin(originOption(request));
+	return getResolvedOrigin(sessionManager, originOption);
+}
+async function getResolvedOrigin(sessionManager, originOverride) {
+	return normalizeOrigin(originOverride ?? await sessionManager.getSessionOrigin());
+}
+function getOptionalSearchParam(url, name) {
+	return url.searchParams.get(name) ?? void 0;
+}
+function redirectResult(location, headers) {
+	const redirectHeaders = new Headers(headers);
+	redirectHeaders.set("cache-control", NO_STORE_CACHE_CONTROL);
+	return {
+		type: "redirect",
+		location,
+		headers: redirectHeaders
+	};
+}
+function forbiddenResult() {
+	return {
+		type: "error",
+		status: FORBIDDEN_STATUS,
+		error: {
+			code: FORBIDDEN_ERROR_CODE,
+			message: FORBIDDEN_ERROR_MESSAGE
+		},
+		headers: { "cache-control": NO_STORE_CACHE_CONTROL }
+	};
+}
+async function commitSession(sessionManager) {
+	return await sessionManager.commit?.() ?? void 0;
+}
+async function completeOAuthCallback({ sessionManager, request, endpoints, customerAccountApiClientId, fetch, timeoutInMs }) {
+	const requestUrl = new URL(request.url);
+	const code = requestUrl.searchParams.get("code");
+	const state = requestUrl.searchParams.get("state");
+	const pendingLogin = getPendingLogin(await readSessionData(sessionManager));
+	assertOAuthCallbackParams(code, state, pendingLogin);
+	const tokenResponse = await exchangeAuthorizationCode({
+		endpoints,
+		customerAccountApiClientId,
+		origin: pendingLogin.origin ?? getOriginFromRequest(request),
+		code,
+		codeVerifier: pendingLogin.codeVerifier,
+		fetch,
+		timeoutInMs
+	});
+	validateIdTokenClaims(tokenResponse.id_token, {
+		audience: customerAccountApiClientId,
+		issuer: endpoints.issuer,
+		nonce: pendingLogin.nonce
+	});
+	await writeSessionData(sessionManager, { tokens: createTokensFromResponse(tokenResponse) });
+	return {
+		location: pendingLogin.returnTo ?? DEFAULT_LOGIN_RETURN_TO_PATH,
+		accessToken: tokenResponse.access_token
+	};
+}
+function isSameOriginPost(request, trustedOrigin) {
+	const origin = request.headers.get("origin");
+	if (origin) try {
+		return normalizeOrigin(origin) === trustedOrigin;
+	} catch {
+		return false;
+	}
+	const referer = request.headers.get("referer");
+	if (!referer) return false;
+	try {
+		return normalizeOrigin(new URL(referer).origin) === trustedOrigin;
+	} catch {
+		return false;
+	}
+}
+function assertOAuthCallbackParams(code, state, pendingLogin) {
+	if (!code || !state) throw new CustomerAccountOAuthError("missing_callback_params", "OAuth callback is missing code or state");
+	if (pendingLogin.state !== state) throw new CustomerAccountOAuthError("state_mismatch", "OAuth callback state does not match session state");
+}
+async function exchangeAuthorizationCode({ endpoints, customerAccountApiClientId, origin, code, codeVerifier, fetch, timeoutInMs }) {
+	const body = new URLSearchParams({
+		grant_type: AUTHORIZATION_CODE_GRANT_TYPE,
+		client_id: customerAccountApiClientId,
+		redirect_uri: `${origin}${CUSTOMER_ACCOUNT_AUTHORIZE_PATH}`,
+		code,
+		code_verifier: codeVerifier
+	});
+	return withTokenRequestTimeout(timeoutInMs, async (signal) => {
+		const response = await postTokenRequest({
+			url: endpoints.tokenUrl,
+			origin,
+			body,
+			fetch,
+			signal
+		});
+		if (!response.ok) {
+			cancelResponseBody(response);
+			throw new CustomerAccountOAuthError(response.status === 400 || response.status === 401 ? "token_exchange_rejected" : "token_exchange_failed", `Customer Account OAuth token exchange failed with ${response.status}`);
+		}
+		return parseRequiredTokenResponse(await readTokenResponseJson(response, signal));
+	});
+}
+async function getRefreshResult({ refreshFlights, refreshToken, idToken, origin, endpoints, customerAccountApiClientId, fetch, timeoutInMs }) {
+	const flightKey = `${origin}\n${refreshToken}`;
+	const existingFlight = refreshFlights.get(flightKey);
+	if (existingFlight) return existingFlight;
+	const flight = refreshAccessToken({
+		endpoints,
+		customerAccountApiClientId,
+		refreshToken,
+		idToken,
+		origin,
+		fetch,
+		timeoutInMs
+	});
+	refreshFlights.set(flightKey, flight);
+	try {
+		return await flight;
+	} finally {
+		refreshFlights.delete(flightKey);
+	}
+}
+async function refreshAccessToken({ endpoints, customerAccountApiClientId, refreshToken, idToken, origin, fetch, timeoutInMs }) {
+	const body = new URLSearchParams({
+		grant_type: REFRESH_TOKEN_GRANT_TYPE,
+		client_id: customerAccountApiClientId,
+		refresh_token: refreshToken
+	});
+	try {
+		return await withTokenRequestTimeout(timeoutInMs, async (signal) => {
+			return readRefreshResult(await postTokenRequest({
+				url: endpoints.tokenUrl,
+				origin,
+				body,
+				fetch,
+				signal
+			}), refreshToken, idToken, signal);
+		});
+	} catch {
+		return { type: "transient" };
+	}
+}
+async function readRefreshResult(response, currentRefreshToken, currentIdToken, signal) {
+	if (response.status === 400 || response.status === 401) {
+		cancelResponseBody(response);
+		return { type: "invalid" };
+	}
+	if (!response.ok) {
+		cancelResponseBody(response);
+		return { type: "transient" };
+	}
+	try {
+		const parsedTokenResponse = parseRefreshTokenResponse(await readTokenResponseJson(response, signal));
+		return {
+			type: "success",
+			tokens: createTokensFromResponse({
+				...parsedTokenResponse,
+				refresh_token: parsedTokenResponse.refresh_token ?? currentRefreshToken,
+				id_token: parsedTokenResponse.id_token ?? currentIdToken
+			})
+		};
+	} catch {
+		return { type: "transient" };
+	}
+}
+async function postTokenRequest({ url, origin, body, fetch, signal }) {
+	return await withAbort(fetch(url, {
+		method: "POST",
+		headers: new Headers({
+			"Content-Type": "application/x-www-form-urlencoded",
+			"User-Agent": USER_AGENT,
+			Origin: origin
+		}),
+		body,
+		cache: "no-store",
+		redirect: "manual",
+		signal
+	}), signal);
+}
+async function withTokenRequestTimeout(timeoutInMs, operation) {
+	const controller = new AbortController();
+	const timeoutId = setTimeout(() => {
+		controller.abort(new CustomerAccountApiError(`Customer Account OAuth request timed out after ${timeoutInMs}ms`));
+	}, timeoutInMs);
+	try {
+		return await operation(controller.signal);
+	} finally {
+		clearTimeout(timeoutId);
+	}
+}
+function withAbort(promise, signal) {
+	if (signal.aborted) return Promise.reject(getAbortReason(signal));
+	return new Promise((resolve, reject) => {
+		const abort = () => {
+			signal.removeEventListener("abort", abort);
+			reject(getAbortReason(signal));
+		};
+		signal.addEventListener("abort", abort, { once: true });
+		Promise.resolve(promise).then((value) => {
+			signal.removeEventListener("abort", abort);
+			resolve(value);
+		}, (error) => {
+			signal.removeEventListener("abort", abort);
+			reject(error);
+		});
+	});
+}
+function getAbortReason(signal) {
+	return signal.reason ?? new DOMException("signal is aborted without reason", "AbortError");
+}
+async function readTokenResponseJson(response, signal) {
+	const json = await withAbort(response.json(), signal);
+	if (!isObjectRecord(json)) throw new CustomerAccountOAuthError("invalid_token_response", "Customer Account OAuth response must be an object");
+	return {
+		access_token: json.access_token,
+		refresh_token: json.refresh_token,
+		id_token: json.id_token,
+		expires_in: json.expires_in
+	};
+}
+function parseRequiredTokenResponse(response) {
+	const parsed = parseRefreshTokenResponse(response);
+	if (typeof response.refresh_token !== "string" || response.refresh_token === "") throw new CustomerAccountOAuthError("invalid_token_response", "Customer Account OAuth response is missing refresh_token");
+	if (typeof response.id_token !== "string" || response.id_token === "") throw new CustomerAccountOAuthError("invalid_token_response", "Customer Account OAuth response is missing id_token");
+	return {
+		...parsed,
+		refresh_token: response.refresh_token,
+		id_token: response.id_token
+	};
+}
+function parseRefreshTokenResponse(response) {
+	if (typeof response.access_token !== "string" || response.access_token === "") throw new CustomerAccountOAuthError("invalid_token_response", "Customer Account OAuth response is missing access_token");
+	if (typeof response.expires_in !== "number" || !Number.isFinite(response.expires_in) || response.expires_in <= 0) throw new CustomerAccountOAuthError("invalid_token_response", "Customer Account OAuth response is missing expires_in");
+	return {
+		access_token: response.access_token,
+		refresh_token: typeof response.refresh_token === "string" && response.refresh_token !== "" ? response.refresh_token : void 0,
+		id_token: typeof response.id_token === "string" && response.id_token !== "" ? response.id_token : void 0,
+		expires_in: response.expires_in
+	};
+}
+function createTokensFromResponse(response) {
+	return {
+		accessToken: response.access_token,
+		refreshToken: response.refresh_token,
+		idToken: response.id_token,
+		expiresAt: Date.now() + (response.expires_in - EXPIRY_BUFFER_IN_SECONDS) * MILLISECONDS_PER_SECOND
+	};
+}
+function validateIdTokenClaims(idToken, expected) {
+	const claims = parseJwtPayload(idToken);
+	if (claims.nonce !== expected.nonce) throw new CustomerAccountOAuthError("nonce_mismatch", "OAuth id_token nonce does not match session nonce");
+	if (claims.iss !== expected.issuer) throw new CustomerAccountOAuthError("issuer_mismatch", "OAuth id_token issuer does not match Customer Account issuer");
+	if (!hasAudienceClaim(claims.aud, expected.audience)) throw new CustomerAccountOAuthError("audience_mismatch", "OAuth id_token audience does not match Customer Account client ID");
+	if (typeof claims.exp !== "number" || claims.exp <= Math.floor(Date.now() / MILLISECONDS_PER_SECOND)) throw new CustomerAccountOAuthError("expired_id_token", "OAuth id_token is expired");
+}
+function parseJwtPayload(idToken) {
+	try {
+		const [, payload] = idToken.split(".");
+		if (!payload) throw new Error("Missing JWT payload");
+		const decodedPayload = JSON.parse(base64UrlDecode(payload));
+		if (!isObjectRecord(decodedPayload)) throw new Error("JWT payload must be an object");
+		return decodedPayload;
+	} catch (cause) {
+		throw new CustomerAccountOAuthError("invalid_id_token", "Customer Account OAuth id_token is invalid", { cause });
+	}
+}
+function hasAudienceClaim(audience, expectedAudience) {
+	if (audience === expectedAudience) return true;
+	if (!Array.isArray(audience)) return false;
+	return audience.includes(expectedAudience);
+}
+async function readSessionData(sessionManager) {
+	const value = await sessionManager.getSessionItem(CUSTOMER_ACCOUNT_SESSION_KEY);
+	return isCustomerAccountSessionData(value) ? value : {};
+}
+async function writeSessionData(sessionManager, sessionData) {
+	await sessionManager.setSessionItem(CUSTOMER_ACCOUNT_SESSION_KEY, sessionData);
+}
+async function writeTokens(sessionManager, tokens) {
+	await writeSessionData(sessionManager, {
+		...await readSessionData(sessionManager),
+		tokens
+	});
+}
+async function clearTokens(sessionManager) {
+	const { pendingLogin } = await readSessionData(sessionManager);
+	if (pendingLogin) {
+		await writeSessionData(sessionManager, { pendingLogin });
+		return;
+	}
+	await sessionManager.removeSessionItem(CUSTOMER_ACCOUNT_SESSION_KEY);
+}
+async function clearPendingLogin(sessionManager) {
+	const { tokens } = await readSessionData(sessionManager);
+	if (tokens) {
+		await writeSessionData(sessionManager, { tokens });
+		return;
+	}
+	await sessionManager.removeSessionItem(CUSTOMER_ACCOUNT_SESSION_KEY);
+}
+function getUsableAccessToken(sessionData) {
+	const tokens = sessionData.tokens;
+	if (!isTokenUsable(tokens)) return void 0;
+	return tokens.accessToken;
+}
+function hasCustomerSession(sessionData) {
+	return getUsableAccessToken(sessionData) !== void 0 || getRefreshToken(sessionData) !== void 0;
+}
+function getRefreshToken(sessionData) {
+	const refreshToken = sessionData.tokens?.refreshToken;
+	return typeof refreshToken === "string" && refreshToken !== "" ? refreshToken : void 0;
+}
+function getPendingLogin(sessionData) {
+	const pendingLogin = sessionData.pendingLogin;
+	if (isPendingLoginReady(pendingLogin)) return pendingLogin;
+	throw new CustomerAccountOAuthError("missing_pending_login", "OAuth callback has no pending login state");
+}
+function isTokenUsable(tokens) {
+	if (!tokens || typeof tokens.accessToken !== "string" || tokens.accessToken === "") return false;
+	if (typeof tokens.expiresAt !== "number") return false;
+	return tokens.expiresAt > Date.now();
+}
+function isPendingLoginReady(pendingLogin) {
+	if (!pendingLogin) return false;
+	if (!isNonEmptyString(pendingLogin.state)) return false;
+	if (!isNonEmptyString(pendingLogin.nonce)) return false;
+	if (!isNonEmptyString(pendingLogin.codeVerifier)) return false;
+	if (!isNonEmptyString(pendingLogin.returnTo)) return false;
+	if (!isNonEmptyString(pendingLogin.origin)) return false;
+	if (typeof pendingLogin.createdAt !== "number") return false;
+	return Date.now() - pendingLogin.createdAt <= PENDING_LOGIN_TTL_IN_MS;
+}
+function isNonEmptyString(value) {
+	return typeof value === "string" && value !== "";
+}
+function isCustomerAccountSessionData(value) {
+	if (!isObjectRecord(value) || Array.isArray(value)) return false;
+	const tokens = value.tokens;
+	const pendingLogin = value.pendingLogin;
+	if (tokens !== void 0 && (!isObjectRecord(tokens) || Array.isArray(tokens))) return false;
+	return pendingLogin === void 0 || isObjectRecord(pendingLogin) && !Array.isArray(pendingLogin);
+}
+function setOptionalLoginParams(loginUrl, options) {
+	if (options.locale) loginUrl.searchParams.set("locale", options.locale);
+	if (options.countryCode) loginUrl.searchParams.set("region_country", options.countryCode);
+	if (options.acrValues) loginUrl.searchParams.set("acr_values", options.acrValues);
+	if (!options.loginHint) return;
+	loginUrl.searchParams.set("login_hint", options.loginHint);
+	if (options.loginHintMode) loginUrl.searchParams.set("login_hint_mode", options.loginHintMode);
+}
+function sanitizeReturnTo(returnTo, origin, fallbackReturnTo = DEFAULT_LOGIN_RETURN_TO_PATH) {
+	if (!returnTo) return fallbackReturnTo;
+	try {
+		const url = new URL(returnTo, origin);
+		if (url.origin !== origin) return fallbackReturnTo;
+		const sanitizedReturnTo = `${url.pathname}${url.search}${url.hash}`;
+		if (new TextEncoder().encode(sanitizedReturnTo).byteLength > MAX_RETURN_TO_LENGTH_IN_BYTES) return fallbackReturnTo;
+		return sanitizedReturnTo;
+	} catch {
+		return fallbackReturnTo;
+	}
+}
+function absoluteSameOriginUrl(url, origin) {
+	const parsedUrl = new URL(url, origin);
+	if (parsedUrl.origin !== origin) return origin;
+	return parsedUrl.toString();
+}
+async function createCodeChallenge(codeVerifier) {
+	const digest = await crypto.subtle.digest("SHA-256", new TextEncoder().encode(codeVerifier));
+	return base64UrlEncode(String.fromCharCode(...new Uint8Array(digest)));
+}
+function generateRandomBase64Url() {
+	const bytes = new Uint8Array(RANDOM_BYTES_LENGTH);
+	crypto.getRandomValues(bytes);
+	return base64UrlEncode(String.fromCharCode(...bytes));
+}
+function base64UrlEncode(value) {
+	return btoa(value).replace(/\+/g, "-").replace(/\//g, "_").replace(/=/g, "");
+}
+function base64UrlDecode(value) {
+	const base64 = value.replace(/-/g, "+").replace(/_/g, "/");
+	const paddingLength = (4 - base64.length % 4) % 4;
+	return atob(base64.padEnd(base64.length + paddingLength, "="));
+}
+function createCustomerAccountEndpoints(shopId, customerAccountApiUrl) {
+	const authBaseUrl = normalizeAuthBaseUrl(customerAccountApiUrl ?? `https://shopify.com/authentication/${shopId}`);
+	return {
+		authorizeUrl: `${authBaseUrl}/oauth/authorize`,
+		tokenUrl: `${authBaseUrl}/oauth/token`,
+		logoutUrl: `${authBaseUrl}/logout`,
+		issuer: authBaseUrl
+	};
+}
+function normalizeAuthBaseUrl(customerAccountApiUrl) {
+	const url = new URL(customerAccountApiUrl);
+	if (url.protocol !== "https:") throw new Error("customerAccountApiUrl must use HTTPS");
+	return url.toString().replace(/\/$/, "");
+}
+function getOriginFromRequest(request) {
+	return normalizeOrigin(new URL(request.url).origin);
+}
+function normalizeOrigin(origin) {
+	const url = new URL(origin);
+	if (url.protocol === "https:") return url.origin;
+	throw new Error("Customer Account OAuth origin must use HTTPS. Use a public HTTPS tunnel for local Customer Account login.");
+}
+function cancelResponseBody(response) {
+	try {
+		response.body?.cancel().catch(() => void 0);
+	} catch {}
+}
+function validateShopId(shopId) {
+	if (!SHOP_ID_RE.test(shopId)) throw new Error("shopId must be a numeric Shopify shop ID string");
+}
+function validateCustomerAccountApiClientId(customerAccountApiClientId) {
+	if (typeof customerAccountApiClientId !== "string" || customerAccountApiClientId.trim() === "") throw new Error("customerAccountApiClientId is required");
+}
+function validateTimeout(timeoutInMs) {
+	if (!Number.isSafeInteger(timeoutInMs) || timeoutInMs <= 0 || timeoutInMs > MAX_SET_TIMEOUT_IN_MS) throw new Error(`defaultTimeoutInMs must be a positive safe integer no greater than ${MAX_SET_TIMEOUT_IN_MS}`);
+}
+function isObjectRecord(value) {
+	return typeof value === "object" && value !== null;
+}
+
+//#endregion
+export { CUSTOMER_ACCOUNT_AUTHORIZE_PATH, CUSTOMER_ACCOUNT_LOGIN_PATH, CUSTOMER_ACCOUNT_LOGOUT_PATH, CUSTOMER_ACCOUNT_REFRESH_PATH, createCustomerAccountServerHandlers, createCustomerSession, getCustomerSessionRefreshResult };
+//# sourceMappingURL=session.mjs.map