@withandeo/cli 0.13.0 → 0.14.0

package/templates/shopify-customer-account/apps/gateway/.tender/artifacts/current/worker.mjs

@@ -0,0 +1,1785 @@
+// src/platform/customer-auth/hostname-policy.ts
+import { createHash as createHash2 } from "node:crypto";
+
+// src/platform/runtime-hostname.ts
+import { createHash } from "node:crypto";
+function canonicalApplicationHostname(input) {
+  return `a-${shortDigest(input.projectId, 14)}--t-${shortDigest(input.tenantId, 14)}.${normalizedDomain(input.baseDomain)}`;
+}
+function immutablePreviewHostname(input) {
+  return [
+    `r-${shortDigest(input.releaseId, 12)}`,
+    `p-${shortDigest(input.projectId, 10)}`,
+    `t-${shortDigest(input.tenantId, 10)}`
+  ].join("--") + `.${normalizedDomain(input.baseDomain)}`;
+}
+function previewAliasHostname(input) {
+  const readable = input.alias.toLowerCase().replace(/[^a-z0-9-]+/gu, "-").replace(/^-+|-+$/gu, "").slice(0, 12);
+  if (readable.length < 2) throw new Error("The preview alias is invalid.");
+  return [
+    `b-${readable}-${rawDigest(input.alias, 8)}`,
+    `p-${shortDigest(input.projectId, 10)}`,
+    `t-${shortDigest(input.tenantId, 10)}`
+  ].join("--") + `.${normalizedDomain(input.baseDomain)}`;
+}
+function shortDigest(value, length) {
+  if (!/^[A-Za-z0-9][A-Za-z0-9_-]{1,127}$/u.test(value)) throw new Error("The runtime identity is invalid.");
+  return rawDigest(value, length);
+}
+function rawDigest(value, length) {
+  return createHash("sha256").update(value, "utf8").digest("hex").slice(0, length);
+}
+function normalizedDomain(value) {
+  const domain = value.toLowerCase().replace(/\.$/u, "");
+  if (!/^(?:[a-z0-9](?:[a-z0-9-]{0,61}[a-z0-9])?\.)+[a-z]{2,63}$/u.test(domain)) {
+    throw new Error("The runtime base domain is invalid.");
+  }
+  return domain;
+}
+
+// src/platform/customer-auth/hostname-policy.ts
+function createTenderRuntimeHostnamePolicy(input) {
+  const canonicalHostname = canonicalApplicationHostname(input);
+  const domain = canonicalHostname.slice(canonicalHostname.indexOf(".") + 1);
+  const projectDigest = shortDigest2(input.projectId, 10);
+  const tenantDigest = shortDigest2(input.tenantId, 10);
+  const immutablePattern = new RegExp(
+    `^r-[a-f0-9]{12}--p-${projectDigest}--t-${tenantDigest}\\.${escaped(domain)}$`
+  );
+  const aliasPattern = new RegExp(
+    `^b-[a-z0-9][a-z0-9-]{1,11}-[a-f0-9]{8}--p-${projectDigest}--t-${tenantDigest}\\.${escaped(domain)}$`
+  );
+  const additionalHostnames = new Set((input.additionalHostnames ?? []).map(normalizedHostname));
+  return ({ projectId, hostname }) => projectId === input.projectId && (hostname === canonicalHostname || additionalHostnames.has(hostname) || immutablePattern.test(hostname) || aliasPattern.test(hostname));
+}
+function normalizedHostname(value) {
+  const hostname = value.trim().toLowerCase().replace(/\.$/u, "");
+  if (!/^(?=.{4,253}$)(?:[a-z0-9](?:[a-z0-9-]{0,61}[a-z0-9])?\.)+[a-z]{2,63}$/u.test(hostname)) {
+    throw new Error("The additional runtime hostname is invalid.");
+  }
+  return hostname;
+}
+var PUBLIC_CUSTOMER_AUTH_RUNTIME_HOST_CONSTRUCTORS = Object.freeze({
+  canonicalApplicationHostname,
+  immutablePreviewHostname,
+  previewAliasHostname
+});
+function shortDigest2(value, length) {
+  return createHash2("sha256").update(value).digest("hex").slice(0, length);
+}
+function escaped(value) {
+  return value.replace(/[.*+?^${}()|[\]\\]/g, "\\$&");
+}
+
+// src/platform/customer-auth/session-store.ts
+var FLOW_MAX_TTL_SECONDS = 10 * 60;
+var HANDOFF_MAX_TTL_SECONDS = 5 * 60;
+var SESSION_MAX_TTL_SECONDS = 31 * 24 * 60 * 60;
+var EXPIRED_STATE_DELETE_LIMIT = 256;
+var DEFAULT_MAX_RECENT_AUTHORIZATION_ATTEMPTS_PER_PROJECT = 512;
+var DEFAULT_MAX_RECENT_AUTHORIZATION_ATTEMPTS_PER_CLIENT = 20;
+var MAX_CONFIGURED_AUTHORIZATION_ATTEMPTS = 1e5;
+var OPAQUE_VALUE_BYTES = 32;
+var SESSION_DATA_MAX_LENGTH = 65536;
+var SESSION_SEAL_MAX_LENGTH = 1e5;
+var CustomerAuthFlowCapacityError = class extends Error {
+  constructor() {
+    super("The customer authentication flow capacity has been reached.");
+  }
+};
+var PublicCustomerAuthSessionStore = class {
+  database;
+  hostnamePolicy;
+  maxRecentAuthorizationAttemptsPerProject;
+  maxRecentAuthorizationAttemptsPerClient;
+  constructor(database, hostnamePolicy, options = {}) {
+    if (typeof hostnamePolicy !== "function") {
+      throw new Error("A customer authentication hostname policy is required.");
+    }
+    this.database = database;
+    this.hostnamePolicy = hostnamePolicy;
+    const maxRecentAuthorizationAttemptsPerProject = options.maxRecentAuthorizationAttemptsPerProject ?? DEFAULT_MAX_RECENT_AUTHORIZATION_ATTEMPTS_PER_PROJECT;
+    const maxRecentAuthorizationAttemptsPerClient = options.maxRecentAuthorizationAttemptsPerClient ?? DEFAULT_MAX_RECENT_AUTHORIZATION_ATTEMPTS_PER_CLIENT;
+    if (!validAuthorizationAttemptLimit(maxRecentAuthorizationAttemptsPerProject) || !validAuthorizationAttemptLimit(maxRecentAuthorizationAttemptsPerClient) || maxRecentAuthorizationAttemptsPerClient > maxRecentAuthorizationAttemptsPerProject) {
+      throw new Error("The customer authentication flow capacity is invalid.");
+    }
+    this.maxRecentAuthorizationAttemptsPerProject = maxRecentAuthorizationAttemptsPerProject;
+    this.maxRecentAuthorizationAttemptsPerClient = maxRecentAuthorizationAttemptsPerClient;
+  }
+  async createAuthorizationFlow(input) {
+    const projectId = requiredProjectId(input.projectId);
+    const pkceVerifier = requiredPkceVerifier(input.pkceVerifier);
+    const returnHostname = normalizedHostname2(input.returnHostname);
+    const clientKey = requiredClientKey(input.clientKey);
+    const interactionMode = requiredInteractionMode(input.interactionMode ?? "interactive");
+    const timing = expiration(input.nowSeconds, input.ttlSeconds, FLOW_MAX_TTL_SECONDS, "authorization flow");
+    await this.requireAllowedHostname(projectId, returnHostname);
+    await this.deleteExpiredState({ projectId, nowSeconds: timing.createdAt });
+    const state = randomOpaqueValue();
+    const browserBinding = randomOpaqueValue();
+    const stateDigest = await opaqueDigest(state);
+    const browserBindingDigest = await opaqueDigest(browserBinding);
+    const clientKeyDigest = await opaqueDigest(clientKey);
+    const result = await this.database.prepare(
+      `INSERT INTO public_customer_auth_flows (
+        project_id, state_digest, browser_binding_digest, client_key_digest, interaction_mode,
+        pkce_verifier, return_hostname, created_at, expires_at
+      )
+      SELECT ?, ?, ?, ?, ?, ?, ?, ?, ?
+      WHERE (
+        SELECT COUNT(*) FROM public_customer_auth_flows
+        WHERE project_id = ? AND expires_at > ?
+      ) < ?
+        AND (
+          SELECT COUNT(*) FROM public_customer_auth_flows
+          WHERE project_id = ? AND client_key_digest = ? AND expires_at > ?
+        ) < ?`
+    ).bind(
+      projectId,
+      stateDigest,
+      browserBindingDigest,
+      clientKeyDigest,
+      interactionMode,
+      pkceVerifier,
+      returnHostname,
+      timing.createdAt,
+      timing.expiresAt,
+      projectId,
+      timing.createdAt,
+      this.maxRecentAuthorizationAttemptsPerProject,
+      projectId,
+      clientKeyDigest,
+      timing.createdAt,
+      this.maxRecentAuthorizationAttemptsPerClient
+    ).run();
+    if (result.success === false) {
+      throw new Error("The customer authentication state was not stored.");
+    }
+    if (result.meta?.changes === 0) throw new CustomerAuthFlowCapacityError();
+    if (result.meta?.changes !== 1) {
+      throw new Error("The customer authentication state was not stored.");
+    }
+    return { state, browserBinding, returnHostname, expiresAt: timing.expiresAt };
+  }
+  async consumeAuthorizationFlow(input) {
+    const projectId = requiredProjectId(input.projectId);
+    const stateDigest = await opaqueDigest(requiredOpaqueValue(input.state, "authorization state"));
+    const browserBindingDigest = await opaqueDigest(
+      requiredOpaqueValue(input.browserBinding, "authorization browser binding")
+    );
+    const now = requiredNow(input.nowSeconds);
+    const row = await this.database.prepare(
+      `UPDATE public_customer_auth_flows
+       SET consumed_at = ?
+       WHERE project_id = ? AND state_digest = ? AND browser_binding_digest = ?
+         AND consumed_at IS NULL AND expires_at > ?
+       RETURNING pkce_verifier, return_hostname, interaction_mode, expires_at`
+    ).bind(now, projectId, stateDigest, browserBindingDigest, now).first();
+    if (!row) return null;
+    return {
+      pkceVerifier: requiredPkceVerifier(row.pkce_verifier),
+      returnHostname: normalizedHostname2(row.return_hostname),
+      interactionMode: requiredInteractionMode(row.interaction_mode),
+      expiresAt: requiredExpiry(row.expires_at, now)
+    };
+  }
+  async createShopperSessionHandoff(input) {
+    const projectId = requiredProjectId(input.projectId);
+    const returnHostname = normalizedHostname2(input.returnHostname);
+    const sessionData = requiredSessionData(input.sessionData);
+    const now = requiredNow(input.nowSeconds);
+    const timing = expiration(now, input.handoffTtlSeconds, HANDOFF_MAX_TTL_SECONDS, "handoff");
+    const sessionTiming = expiration(now, input.sessionTtlSeconds, SESSION_MAX_TTL_SECONDS, "shopper session");
+    if (input.handoffTtlSeconds > input.sessionTtlSeconds) {
+      throw new Error("The handoff cannot outlive its shopper session.");
+    }
+    await this.requireAllowedHostname(projectId, returnHostname);
+    await this.deleteExpiredState({ projectId, nowSeconds: now });
+    const sessionId = randomOpaqueValue();
+    const sessionDigest = await opaqueDigest(sessionId);
+    const handoff = randomOpaqueValue();
+    const handoffDigest = await opaqueDigest(handoff);
+    const sessionSeal = await sealPendingSessionPayload({
+      sessionId,
+      sessionExpiresAt: sessionTiming.expiresAt,
+      sessionData,
+      handoff,
+      projectId,
+      returnHostname,
+      handoffDigest
+    });
+    await requireInsert(this.database.prepare(
+      `INSERT INTO public_customer_auth_handoffs (
+        project_id, handoff_digest, return_hostname, session_digest, session_seal, created_at, expires_at
+      ) VALUES (?, ?, ?, ?, ?, ?, ?)`
+    ).bind(
+      projectId,
+      handoffDigest,
+      returnHostname,
+      sessionDigest,
+      sessionSeal,
+      timing.createdAt,
+      timing.expiresAt
+    ));
+    return { handoff, returnHostname, expiresAt: timing.expiresAt };
+  }
+  async consumeHandoff(input) {
+    const projectId = requiredProjectId(input.projectId);
+    const handoff = requiredOpaqueValue(input.handoff, "handoff");
+    const handoffDigest = await opaqueDigest(handoff);
+    const requestHostname = normalizedHostname2(input.requestHostname);
+    const now = requiredNow(input.nowSeconds);
+    const readHandoff = () => this.database.prepare(
+      `SELECT session_seal, session_digest, return_hostname, expires_at, claimed_at
+       FROM public_customer_auth_handoffs
+       WHERE project_id = ? AND handoff_digest = ? AND return_hostname = ? AND expires_at > ?`
+    ).bind(projectId, handoffDigest, requestHostname, now).first();
+    const row = await readHandoff();
+    if (!row) return null;
+    const returnHostname = normalizedHostname2(row.return_hostname);
+    const handoffExpiresAt = requiredExpiry(row.expires_at, now);
+    const sessionDigest = requiredDigest(row.session_digest, "shopper session");
+    const sessionSeal = requiredSessionSeal(row.session_seal);
+    const claimedAt = optionalClaimedAt(row.claimed_at, now);
+    if (claimedAt !== null) {
+      return this.readClaimedHandoff({
+        projectId,
+        handoff,
+        handoffDigest,
+        requestHostname,
+        handoffExpiresAt,
+        sessionDigest,
+        sessionSeal,
+        now
+      });
+    }
+    const payload = await unsealPendingSessionPayload({
+      sessionSeal,
+      handoff,
+      projectId,
+      returnHostname,
+      handoffDigest
+    });
+    if (await opaqueDigest(payload.sessionId) !== sessionDigest) {
+      throw new Error("The customer authentication handoff is invalid.");
+    }
+    const sessionExpiresAt = requiredExpiry(payload.sessionExpiresAt, now);
+    const claimedSeal = await sealClaimedSessionId({
+      sessionId: payload.sessionId,
+      handoff,
+      projectId,
+      returnHostname,
+      handoffDigest
+    });
+    const [claimResult, insertResult] = await this.database.batch([
+      this.database.prepare(
+        `UPDATE public_customer_auth_handoffs
+         SET claimed_at = ?, session_seal = ?
+         WHERE project_id = ? AND handoff_digest = ? AND return_hostname = ?
+           AND expires_at > ? AND claimed_at IS NULL AND session_digest = ? AND session_seal = ?`
+      ).bind(
+        now,
+        claimedSeal,
+        projectId,
+        handoffDigest,
+        returnHostname,
+        now,
+        sessionDigest,
+        sessionSeal
+      ),
+      this.database.prepare(
+        `INSERT INTO public_customer_auth_sessions (
+          project_id, session_digest, audience_hostname, session_data, created_at, expires_at
+        )
+        SELECT ?, ?, ?, ?, ?, ?
+        WHERE EXISTS (
+          SELECT 1 FROM public_customer_auth_handoffs
+          WHERE project_id = ? AND handoff_digest = ? AND return_hostname = ?
+            AND expires_at > ? AND claimed_at = ? AND session_digest = ? AND session_seal = ?
+        )`
+      ).bind(
+        projectId,
+        sessionDigest,
+        returnHostname,
+        payload.sessionData,
+        now,
+        sessionExpiresAt,
+        projectId,
+        handoffDigest,
+        returnHostname,
+        now,
+        now,
+        sessionDigest,
+        claimedSeal
+      )
+    ]);
+    if (!claimResult || !insertResult || claimResult.success === false || insertResult.success === false) {
+      throw new Error("The customer authentication handoff could not be consumed.");
+    }
+    const claimed = claimResult.meta?.changes ?? 0;
+    const inserted = insertResult.meta?.changes ?? 0;
+    if (claimed === 0 && inserted === 0) {
+      const racedRow = await readHandoff();
+      if (!racedRow || optionalClaimedAt(racedRow.claimed_at, now) === null) {
+        throw new Error("The customer authentication handoff could not be consumed.");
+      }
+      return this.readClaimedHandoff({
+        projectId,
+        handoff,
+        handoffDigest,
+        requestHostname,
+        handoffExpiresAt: requiredExpiry(racedRow.expires_at, now),
+        sessionDigest: requiredDigest(racedRow.session_digest, "shopper session"),
+        sessionSeal: requiredSessionSeal(racedRow.session_seal),
+        now
+      });
+    }
+    if (claimed !== 1 || inserted !== 1) {
+      throw new Error("The customer authentication handoff could not be consumed.");
+    }
+    return {
+      sessionId: payload.sessionId,
+      returnHostname,
+      expiresAt: handoffExpiresAt
+    };
+  }
+  async readClaimedHandoff(input) {
+    const sessionId = await unsealClaimedSessionId({
+      sessionSeal: input.sessionSeal,
+      handoff: input.handoff,
+      projectId: input.projectId,
+      returnHostname: input.requestHostname,
+      handoffDigest: input.handoffDigest
+    });
+    if (await opaqueDigest(sessionId) !== input.sessionDigest) {
+      throw new Error("The customer authentication handoff is invalid.");
+    }
+    const session = await this.database.prepare(
+      `SELECT expires_at FROM public_customer_auth_sessions
+       WHERE project_id = ? AND session_digest = ? AND audience_hostname = ? AND expires_at > ?`
+    ).bind(
+      input.projectId,
+      input.sessionDigest,
+      input.requestHostname,
+      input.now
+    ).first();
+    if (!session) throw new Error("The customer authentication handoff is invalid.");
+    requiredExpiry(session.expires_at, input.now);
+    return {
+      sessionId,
+      returnHostname: input.requestHostname,
+      expiresAt: input.handoffExpiresAt
+    };
+  }
+  async createShopperSession(input) {
+    const projectId = requiredProjectId(input.projectId);
+    const audienceHostname = normalizedHostname2(input.audienceHostname);
+    const sessionData = requiredSessionData(input.sessionData);
+    const timing = expiration(input.nowSeconds, input.ttlSeconds, SESSION_MAX_TTL_SECONDS, "shopper session");
+    await this.requireAllowedHostname(projectId, audienceHostname);
+    await this.deleteExpiredState({ projectId, nowSeconds: timing.createdAt });
+    return this.insertShopperSession({
+      projectId,
+      audienceHostname,
+      sessionData,
+      timing
+    });
+  }
+  async deleteExpiredState(input) {
+    const projectId = requiredProjectId(input.projectId);
+    const now = requiredNow(input.nowSeconds);
+    const deleted = {
+      flows: 0,
+      handoffs: 0,
+      sessions: 0
+    };
+    for (const [key, table] of [
+      ["flows", "public_customer_auth_flows"],
+      ["handoffs", "public_customer_auth_handoffs"],
+      ["sessions", "public_customer_auth_sessions"]
+    ]) {
+      const statement = this.database.prepare(
+        `DELETE FROM ${table}
+         WHERE rowid IN (
+           SELECT rowid FROM ${table}
+           WHERE project_id = ? AND expires_at <= ?
+           ORDER BY expires_at
+           LIMIT ?
+         )`
+      ).bind(projectId, now, EXPIRED_STATE_DELETE_LIMIT);
+      const result = await statement.run();
+      if (result.success === false) {
+        throw new Error("Expired customer authentication state could not be deleted.");
+      }
+      deleted[key] = result.meta?.changes ?? 0;
+    }
+    return deleted;
+  }
+  /**
+   * Bounded maintenance entry point. Opportunistic request cleanup is enough
+   * for the first proof; a future trusted first-party scheduler can invoke a
+   * protected merchant route to drain inactive projects. A User Worker
+   * `scheduled` export is not itself a trigger in a dispatch namespace.
+   */
+  async runScheduledCleanup(input) {
+    const maxBatches = input.maxBatches ?? 4;
+    if (!Number.isSafeInteger(maxBatches) || maxBatches < 1 || maxBatches > 16) {
+      throw new Error("The scheduled customer authentication cleanup bound is invalid.");
+    }
+    const total = { flows: 0, handoffs: 0, sessions: 0 };
+    let batches = 0;
+    let mayHaveMore = false;
+    while (batches < maxBatches) {
+      const deleted = await this.deleteExpiredState({
+        projectId: input.projectId,
+        nowSeconds: input.nowSeconds
+      });
+      batches += 1;
+      total.flows += deleted.flows;
+      total.handoffs += deleted.handoffs;
+      total.sessions += deleted.sessions;
+      mayHaveMore = Object.values(deleted).some((count) => count === EXPIRED_STATE_DELETE_LIMIT);
+      if (!mayHaveMore) break;
+    }
+    return { ...total, batches, mayHaveMore };
+  }
+  async insertShopperSession(input) {
+    const sessionId = input.sessionId === void 0 ? randomOpaqueValue() : requiredOpaqueValue(input.sessionId, "shopper session");
+    const sessionDigest = await opaqueDigest(sessionId);
+    await requireInsert(this.database.prepare(
+      `INSERT INTO public_customer_auth_sessions (
+        project_id, session_digest, audience_hostname, session_data, created_at, expires_at
+      ) VALUES (?, ?, ?, ?, ?, ?)`
+    ).bind(
+      input.projectId,
+      sessionDigest,
+      input.audienceHostname,
+      input.sessionData,
+      input.timing.createdAt,
+      input.timing.expiresAt
+    ));
+    return {
+      sessionId,
+      audienceHostname: input.audienceHostname,
+      expiresAt: input.timing.expiresAt
+    };
+  }
+  async readShopperSession(input) {
+    const projectId = requiredProjectId(input.projectId);
+    const sessionDigest = await opaqueDigest(requiredOpaqueValue(input.sessionId, "shopper session"));
+    const requestHostname = normalizedHostname2(input.requestHostname);
+    const now = requiredNow(input.nowSeconds);
+    const row = await this.database.prepare(
+      `SELECT session_data, audience_hostname, expires_at
+       FROM public_customer_auth_sessions
+       WHERE project_id = ? AND session_digest = ? AND audience_hostname = ?
+         AND expires_at > ?`
+    ).bind(projectId, sessionDigest, requestHostname, now).first();
+    if (!row) return null;
+    return {
+      sessionData: requiredSessionData(row.session_data),
+      audienceHostname: normalizedHostname2(row.audience_hostname),
+      expiresAt: requiredExpiry(row.expires_at, now)
+    };
+  }
+  async deleteShopperSession(input) {
+    const projectId = requiredProjectId(input.projectId);
+    const sessionDigest = await opaqueDigest(requiredOpaqueValue(input.sessionId, "shopper session"));
+    const requestHostname = normalizedHostname2(input.requestHostname);
+    const result = await this.database.prepare(
+      `DELETE FROM public_customer_auth_sessions
+       WHERE project_id = ? AND session_digest = ? AND audience_hostname = ?`
+    ).bind(projectId, sessionDigest, requestHostname).run();
+    if (result.success === false) throw new Error("The shopper session deletion failed.");
+    return result.meta?.changes === 1;
+  }
+  async requireAllowedHostname(projectId, hostname) {
+    let allowed = false;
+    try {
+      allowed = await this.hostnamePolicy({ projectId, hostname });
+    } catch {
+      throw new Error("The customer authentication hostname is not allowed for this project.");
+    }
+    if (allowed !== true) {
+      throw new Error("The customer authentication hostname is not allowed for this project.");
+    }
+  }
+};
+async function requireInsert(statement) {
+  const result = await statement.run();
+  if (result.success === false || result.meta?.changes !== void 0 && result.meta.changes !== 1) {
+    throw new Error("The customer authentication state was not stored.");
+  }
+}
+function expiration(nowSeconds, ttlSeconds, maximumTtlSeconds, label) {
+  const createdAt = requiredNow(nowSeconds);
+  if (!Number.isSafeInteger(ttlSeconds) || ttlSeconds < 1 || ttlSeconds > maximumTtlSeconds) {
+    throw new Error(`The ${label} lifetime is invalid.`);
+  }
+  return { createdAt, expiresAt: createdAt + ttlSeconds };
+}
+function requiredNow(value) {
+  const now = value ?? Math.floor(Date.now() / 1e3);
+  if (!Number.isSafeInteger(now) || now < 0) throw new Error("The current time is invalid.");
+  return now;
+}
+function requiredExpiry(value, now) {
+  if (typeof value !== "number" || !Number.isSafeInteger(value) || value <= now) {
+    throw new Error("The stored expiration is invalid.");
+  }
+  return value;
+}
+function optionalClaimedAt(value, now) {
+  if (value === null) return null;
+  if (typeof value !== "number" || !Number.isSafeInteger(value) || value < 0 || value > now) {
+    throw new Error("The customer authentication handoff claim is invalid.");
+  }
+  return value;
+}
+function requiredProjectId(value) {
+  if (!/^[A-Za-z0-9][A-Za-z0-9_-]{1,127}$/.test(value)) {
+    throw new Error("The customer authentication project is invalid.");
+  }
+  return value;
+}
+function requiredPkceVerifier(value) {
+  if (typeof value !== "string" || !/^[A-Za-z0-9._~-]{43,128}$/.test(value)) {
+    throw new Error("The PKCE verifier is invalid.");
+  }
+  return value;
+}
+function requiredSessionData(value) {
+  if (typeof value !== "string" || value.length < 1 || new TextEncoder().encode(value).byteLength > SESSION_DATA_MAX_LENGTH) {
+    throw new Error("The customer session data is invalid.");
+  }
+  return value;
+}
+function requiredClientKey(value) {
+  if (typeof value !== "string" || value.length < 1 || value.length > 512 || /[\u0000-\u001f\u007f]/.test(value)) {
+    throw new Error("The customer authentication client key is invalid.");
+  }
+  return value;
+}
+function requiredInteractionMode(value) {
+  if (value !== "interactive" && value !== "silent") {
+    throw new Error("The customer authentication interaction mode is invalid.");
+  }
+  return value;
+}
+function validAuthorizationAttemptLimit(value) {
+  return Number.isSafeInteger(value) && value >= 1 && value <= MAX_CONFIGURED_AUTHORIZATION_ATTEMPTS;
+}
+function requiredDigest(value, label) {
+  if (typeof value !== "string" || !/^[a-f0-9]{64}$/.test(value)) {
+    throw new Error(`The ${label} digest is invalid.`);
+  }
+  return value;
+}
+function requiredSessionSeal(value) {
+  if (typeof value !== "string" || value.length > SESSION_SEAL_MAX_LENGTH || !/^[A-Za-z0-9_-]{16}\.[A-Za-z0-9_-]{40,99980}$/.test(value)) {
+    throw new Error("The customer authentication session seal is invalid.");
+  }
+  return value;
+}
+function requiredOpaqueValue(value, label) {
+  if (typeof value !== "string" || !/^[A-Za-z0-9_-]{43}$/.test(value)) {
+    throw new Error(`The ${label} is invalid.`);
+  }
+  return value;
+}
+function normalizedHostname2(value) {
+  if (typeof value !== "string") throw new Error("The customer authentication hostname is invalid.");
+  const hostname = value.toLowerCase().replace(/\.$/, "");
+  if (!/^(?:[a-z0-9](?:[a-z0-9-]{0,61}[a-z0-9])?\.)+[a-z]{2,63}$/.test(hostname) || hostname.length > 253) {
+    throw new Error("The customer authentication hostname is invalid.");
+  }
+  return hostname;
+}
+function randomOpaqueValue() {
+  const bytes = crypto.getRandomValues(new Uint8Array(OPAQUE_VALUE_BYTES));
+  return base64UrlEncode(bytes);
+}
+async function opaqueDigest(value) {
+  const digest = await crypto.subtle.digest("SHA-256", new TextEncoder().encode(value));
+  return Array.from(new Uint8Array(digest), (byte) => byte.toString(16).padStart(2, "0")).join("");
+}
+async function sealPendingSessionPayload(input) {
+  const key = await handoffKey(input.handoff, ["encrypt"]);
+  const nonce = crypto.getRandomValues(new Uint8Array(12));
+  const plaintext = new TextEncoder().encode(
+    `${requiredOpaqueValue(input.sessionId, "shopper session")}
+${requiredStoredExpiry(input.sessionExpiresAt)}
+${requiredSessionData(input.sessionData)}`
+  );
+  const ciphertext = await crypto.subtle.encrypt({
+    name: "AES-GCM",
+    iv: nonce,
+    additionalData: handoffContext(input, "pending")
+  }, key, plaintext);
+  return requiredSessionSeal(`${base64UrlEncode(nonce)}.${base64UrlEncode(new Uint8Array(ciphertext))}`);
+}
+async function unsealPendingSessionPayload(input) {
+  const [encodedNonce, encodedCiphertext] = input.sessionSeal.split(".");
+  if (!encodedNonce || !encodedCiphertext) throw new Error("The customer authentication session seal is invalid.");
+  try {
+    const key = await handoffKey(input.handoff, ["decrypt"]);
+    const plaintext = await crypto.subtle.decrypt({
+      name: "AES-GCM",
+      iv: base64UrlDecode(encodedNonce),
+      additionalData: handoffContext(input, "pending")
+    }, key, base64UrlDecode(encodedCiphertext));
+    const decoded = new TextDecoder("utf-8", { fatal: true }).decode(plaintext);
+    const firstSeparator = decoded.indexOf("\n");
+    const secondSeparator = decoded.indexOf("\n", firstSeparator + 1);
+    if (firstSeparator < 0 || secondSeparator < 0) {
+      throw new Error("The customer authentication session seal is invalid.");
+    }
+    return {
+      sessionId: requiredOpaqueValue(decoded.slice(0, firstSeparator), "shopper session"),
+      sessionExpiresAt: requiredStoredExpiry(decoded.slice(firstSeparator + 1, secondSeparator)),
+      sessionData: requiredSessionData(decoded.slice(secondSeparator + 1))
+    };
+  } catch {
+    throw new Error("The customer authentication session seal is invalid.");
+  }
+}
+async function sealClaimedSessionId(input) {
+  const key = await handoffKey(input.handoff, ["encrypt"]);
+  const nonce = crypto.getRandomValues(new Uint8Array(12));
+  const ciphertext = await crypto.subtle.encrypt({
+    name: "AES-GCM",
+    iv: nonce,
+    additionalData: handoffContext(input, "claimed")
+  }, key, new TextEncoder().encode(requiredOpaqueValue(input.sessionId, "shopper session")));
+  return requiredSessionSeal(`${base64UrlEncode(nonce)}.${base64UrlEncode(new Uint8Array(ciphertext))}`);
+}
+async function unsealClaimedSessionId(input) {
+  const [encodedNonce, encodedCiphertext] = input.sessionSeal.split(".");
+  if (!encodedNonce || !encodedCiphertext) throw new Error("The customer authentication session seal is invalid.");
+  try {
+    const key = await handoffKey(input.handoff, ["decrypt"]);
+    const plaintext = await crypto.subtle.decrypt({
+      name: "AES-GCM",
+      iv: base64UrlDecode(encodedNonce),
+      additionalData: handoffContext(input, "claimed")
+    }, key, base64UrlDecode(encodedCiphertext));
+    return requiredOpaqueValue(
+      new TextDecoder("utf-8", { fatal: true }).decode(plaintext),
+      "shopper session"
+    );
+  } catch {
+    throw new Error("The customer authentication session seal is invalid.");
+  }
+}
+function requiredStoredExpiry(value) {
+  const parsed = typeof value === "number" ? value : typeof value === "string" && /^(?:0|[1-9][0-9]{0,15})$/.test(value) ? Number(value) : Number.NaN;
+  if (!Number.isSafeInteger(parsed) || parsed < 1) {
+    throw new Error("The stored expiration is invalid.");
+  }
+  return parsed;
+}
+async function handoffKey(handoff, usages) {
+  const keyMaterial = await crypto.subtle.digest(
+    "SHA-256",
+    new TextEncoder().encode(`public-customer-auth-handoff:${handoff}`)
+  );
+  return crypto.subtle.importKey("raw", keyMaterial, "AES-GCM", false, usages);
+}
+function handoffContext(input, state) {
+  return new TextEncoder().encode(
+    `${input.projectId}\0${input.returnHostname}\0${input.handoffDigest}\0${state}`
+  );
+}
+function base64UrlEncode(value) {
+  const binary = Array.from(value, (byte) => String.fromCharCode(byte)).join("");
+  return btoa(binary).replaceAll("+", "-").replaceAll("/", "_").replaceAll("=", "");
+}
+function base64UrlDecode(value) {
+  if (!/^[A-Za-z0-9_-]+$/.test(value)) throw new Error("The encoded customer authentication value is invalid.");
+  const padding = "=".repeat((4 - value.length % 4) % 4);
+  const binary = atob(value.replaceAll("-", "+").replaceAll("_", "/") + padding);
+  return Uint8Array.from(binary, (character) => character.charCodeAt(0));
+}
+
+// src/platform/customer-auth/shopify-route-adapter.ts
+var DEFAULT_LOGIN_PATH = "/auth/login";
+var DEFAULT_CALLBACK_PATH = "/auth/callback";
+var DEFAULT_HANDOFF_PATH = "/auth/handoff";
+var DEFAULT_SESSION_PATH = "/api/session";
+var DEFAULT_LOGOUT_PATH = "/auth/logout";
+var DEFAULT_POST_LOGOUT_PATH = "/auth/logout/callback";
+var DEFAULT_SIGNED_IN_PATH = "/account";
+var DEFAULT_SIGNED_OUT_PATH = "/";
+var FLOW_TTL_SECONDS = 5 * 60;
+var HANDOFF_TTL_SECONDS = 60;
+var MAX_REQUEST_URL_LENGTH = 8192;
+var MAX_FORM_BODY_BYTES = 1024;
+var MAX_COOKIE_HEADER_LENGTH = 8192;
+var MAX_DISCOVERY_BYTES = 16384;
+var MAX_TOKEN_BYTES = 65536;
+var MAX_GRAPHQL_BYTES = 65536;
+var MAX_ENDPOINT_LENGTH = 2048;
+var MAX_ACCESS_TOKEN_LENGTH = 32768;
+var MAX_ID_TOKEN_LENGTH = 16384;
+var MAX_SESSION_TTL_SECONDS = 31 * 24 * 60 * 60;
+var SHOPPER_SESSION_RECORD_TTL_SECONDS = MAX_SESSION_TTL_SECONDS;
+var PROVIDER_FETCH_TIMEOUT_MS = 1e4;
+var DEFAULT_PROVIDER_USER_AGENT = "TenderAccountsCustomerAuth/0.1";
+var PROVIDER_REDIRECT_MODE = "manual";
+var PUBLIC_CUSTOMER_AUTH_SESSION_COOKIE = "__Host-tender_accounts_session";
+var PUBLIC_CUSTOMER_AUTH_FLOW_COOKIE = "__Host-tender_accounts_auth_flow";
+var SHOPIFY_CUSTOMER_IDENTITY_QUERY = `query CustomerIdentity {
+  customer {
+    id
+    displayName
+    emailAddress {
+      emailAddress
+    }
+  }
+}`;
+function createShopifyCustomerAccountRouteAdapter(input) {
+  if (!(input.sessionStore instanceof PublicCustomerAuthSessionStore)) {
+    throw new Error("A public customer authentication session store is required.");
+  }
+  if (typeof input.hostnamePolicy !== "function") {
+    throw new Error("A public customer authentication hostname policy is required.");
+  }
+  const config = validateConfig(input.config);
+  const providerFetch = input.providerFetch ?? fetch;
+  if (typeof providerFetch !== "function") {
+    throw new Error("A Shopify provider fetch implementation is required.");
+  }
+  const authorizationClientKey = input.authorizationClientKey ?? cloudflareAuthorizationClientKey;
+  if (typeof authorizationClientKey !== "function") {
+    throw new Error("A customer authentication client-key implementation is required.");
+  }
+  const routeInput = {
+    sessionStore: input.sessionStore,
+    hostnamePolicy: input.hostnamePolicy,
+    authorizationClientKey
+  };
+  return {
+    async handle(request) {
+      try {
+        const routeUrl = parsedRequestUrl(request);
+        const route = routeFor(config, routeUrl.pathname);
+        if (!route) return null;
+        const requestUrl = validatedRequestUrl(routeUrl);
+        if (request.method !== route.method) return methodNotAllowed(route.method);
+        switch (route.name) {
+          case "login":
+            return await handleLogin({ request, requestUrl, config, input: routeInput, providerFetch });
+          case "callback":
+            return await handleCallback({ request, requestUrl, config, input: routeInput, providerFetch });
+          case "handoff":
+            return await handleHandoff({ request, requestUrl, config, input: routeInput });
+          case "session":
+            return await handleSession({ request, requestUrl, config, input: routeInput, providerFetch });
+          case "logout":
+            return await handleLogout({ request, requestUrl, config, input: routeInput });
+          case "postLogout":
+            return handlePostLogout({ requestUrl, config });
+        }
+      } catch (error) {
+        if (error instanceof SafeHttpError) return safeError(error.status, error.code);
+        if (error instanceof CustomerAuthFlowCapacityError) {
+          return safeError(429, "customer_authentication_busy");
+        }
+        if (error instanceof ProviderFailure) return safeError(502, "customer_authentication_unavailable");
+        return safeError(500, "customer_authentication_failed");
+      }
+    }
+  };
+}
+async function handleLogin(context) {
+  const callbackHostname2 = requireCallbackHostname(context.requestUrl, context.config);
+  const returnHostname = requiredSingleQueryValue(context.requestUrl, "return_host", 253);
+  const prompt = optionalSingleQueryValue(context.requestUrl, "prompt", 4, /^(?:none)$/);
+  if (!await isAllowedHostname(context.input, context.config.projectId, returnHostname)) {
+    throw new SafeHttpError(400, "invalid_return_host");
+  }
+  const verifier = randomBase64Url(32);
+  const challenge = await sha256Base64Url(verifier);
+  const flow = await context.input.sessionStore.createAuthorizationFlow({
+    projectId: context.config.projectId,
+    pkceVerifier: verifier,
+    returnHostname,
+    clientKey: await requiredAuthorizationClientKey(context.input.authorizationClientKey, context.request),
+    interactionMode: prompt === "none" ? "silent" : "interactive",
+    ttlSeconds: FLOW_TTL_SECONDS
+  });
+  let discovery;
+  try {
+    discovery = await discoverOpenId(context.config, context.providerFetch);
+  } catch (error) {
+    await context.input.sessionStore.consumeAuthorizationFlow({
+      projectId: context.config.projectId,
+      state: flow.state,
+      browserBinding: flow.browserBinding
+    });
+    throw error;
+  }
+  const authorizationUrl = new URL(discovery.authorizationEndpoint);
+  authorizationUrl.searchParams.set("scope", "openid email customer-account-api:full");
+  authorizationUrl.searchParams.set("client_id", context.config.clientId);
+  authorizationUrl.searchParams.set("response_type", "code");
+  authorizationUrl.searchParams.set("redirect_uri", callbackUrl(context.config, callbackHostname2));
+  authorizationUrl.searchParams.set("state", flow.state);
+  authorizationUrl.searchParams.set("code_challenge", challenge);
+  authorizationUrl.searchParams.set("code_challenge_method", "S256");
+  if (prompt) authorizationUrl.searchParams.set("prompt", prompt);
+  return redirectResponse(authorizationUrl.toString(), 302, {
+    "Set-Cookie": authorizationFlowCookie(flow.state, flow.browserBinding)
+  });
+}
+async function handleCallback(context) {
+  const callbackHostname2 = requireCallbackHostname(context.requestUrl, context.config);
+  const state = requiredSingleQueryValue(context.requestUrl, "state", 43, /^[A-Za-z0-9_-]{43}$/);
+  const browserBinding = readOpaqueCookie(
+    context.request.headers.get("Cookie"),
+    authorizationFlowCookieName(state)
+  );
+  if (!browserBinding) throw new SafeHttpError(400, "invalid_authorization_state");
+  if (context.requestUrl.searchParams.has("error")) {
+    const providerError = requiredSingleQueryValue(
+      context.requestUrl,
+      "error",
+      256,
+      /^[A-Za-z0-9._-]+$/
+    );
+    const deniedFlow = await context.input.sessionStore.consumeAuthorizationFlow({
+      projectId: context.config.projectId,
+      state,
+      browserBinding
+    });
+    if (!deniedFlow) throw new SafeHttpError(400, "invalid_authorization_state");
+    if (providerError === "login_required" && deniedFlow.interactionMode === "silent") {
+      const interactiveUrl = new URL(`https://${callbackHostname2}${context.config.loginPath}`);
+      interactiveUrl.searchParams.set("return_host", deniedFlow.returnHostname);
+      return handleLogin({
+        request: new Request(interactiveUrl, { headers: context.request.headers }),
+        requestUrl: interactiveUrl,
+        config: context.config,
+        input: context.input,
+        providerFetch: context.providerFetch
+      });
+    }
+    return safeError(400, "customer_authentication_denied");
+  }
+  const code = requiredSingleQueryValue(context.requestUrl, "code", 4096, /^[A-Za-z0-9._~-]+$/);
+  const flow = await context.input.sessionStore.consumeAuthorizationFlow({
+    projectId: context.config.projectId,
+    state,
+    browserBinding
+  });
+  if (!flow) throw new SafeHttpError(400, "invalid_authorization_state");
+  if (!await isAllowedHostname(context.input, context.config.projectId, flow.returnHostname)) {
+    return safeError(400, "invalid_return_host");
+  }
+  try {
+    const openId = await discoverOpenId(context.config, context.providerFetch);
+    const token = await exchangeAuthorizationCode({
+      config: context.config,
+      providerFetch: context.providerFetch,
+      tokenEndpoint: openId.tokenEndpoint,
+      code,
+      verifier: flow.pkceVerifier,
+      callbackHostname: callbackHostname2
+    });
+    const customerApi = await discoverCustomerApi(context.config, context.providerFetch);
+    const tokenIssuedAt = currentSeconds();
+    const handoff = await context.input.sessionStore.createShopperSessionHandoff({
+      projectId: context.config.projectId,
+      returnHostname: flow.returnHostname,
+      sessionData: JSON.stringify({
+        version: 1,
+        accessToken: token.accessToken,
+        idToken: token.idToken,
+        graphqlEndpoint: customerApi.graphqlEndpoint,
+        endSessionEndpoint: openId.endSessionEndpoint,
+        accessTokenExpiresAt: tokenIssuedAt + token.expiresIn
+      }),
+      sessionTtlSeconds: SHOPPER_SESSION_RECORD_TTL_SECONDS,
+      handoffTtlSeconds: Math.min(HANDOFF_TTL_SECONDS, token.expiresIn)
+    });
+    if (handoff.returnHostname === callbackHostname2) {
+      return finalizeHandoff(context, handoff.handoff, handoff.returnHostname);
+    }
+    return handoffPostResponse(context.config, handoff.returnHostname, handoff.handoff);
+  } catch (error) {
+    if (error instanceof ProviderFailure) {
+      return safeError(502, "customer_authentication_unavailable");
+    }
+    throw error;
+  }
+}
+async function handleHandoff(context) {
+  const requestHostname = normalizedHostname3(context.requestUrl.hostname);
+  if (!await isAllowedHostname(context.input, context.config.projectId, requestHostname)) {
+    throw new SafeHttpError(400, "invalid_handoff");
+  }
+  requireOrigin(context.request, [
+    `https://${context.config.canonicalHostname}`,
+    ...Array.from(context.config.additionalCallbackHostnames, (hostname) => `https://${hostname}`),
+    `https://${requestHostname}`
+  ]);
+  const form = await boundedForm(context.request);
+  const handoffValue = requiredSingleFormValue(form, "handoff", 43, /^[A-Za-z0-9_-]{43}$/);
+  if (Array.from(form.keys()).some((key) => key !== "handoff")) {
+    throw new SafeHttpError(400, "invalid_handoff");
+  }
+  return finalizeHandoff(context, handoffValue, requestHostname);
+}
+async function finalizeHandoff(context, handoffValue, requestHostname) {
+  const handoff = await context.input.sessionStore.consumeHandoff({
+    projectId: context.config.projectId,
+    handoff: handoffValue,
+    requestHostname
+  });
+  if (!handoff) throw new SafeHttpError(400, "invalid_handoff");
+  const previousSessionId = readSessionCookie(context.request.headers.get("Cookie"));
+  if (previousSessionId && previousSessionId !== handoff.sessionId) {
+    try {
+      await context.input.sessionStore.deleteShopperSession({
+        projectId: context.config.projectId,
+        sessionId: previousSessionId,
+        requestHostname
+      });
+    } catch {
+    }
+  }
+  return new Response(null, {
+    status: 303,
+    headers: secureHeaders({
+      Location: context.config.signedInPath,
+      "Set-Cookie": sessionCookie(handoff.sessionId)
+    })
+  });
+}
+async function handleSession(context) {
+  const requestHostname = normalizedHostname3(context.requestUrl.hostname);
+  if (!await isAllowedHostname(context.input, context.config.projectId, requestHostname)) {
+    throw new SafeHttpError(404, "not_found");
+  }
+  const sessionId = readSessionCookie(context.request.headers.get("Cookie"));
+  if (!sessionId) return unauthenticatedResponse(true);
+  const stored = await context.input.sessionStore.readShopperSession({
+    projectId: context.config.projectId,
+    sessionId,
+    requestHostname
+  });
+  if (!stored) return unauthenticatedResponse(true);
+  const session = parseStoredShopifySession(stored.sessionData, context.config);
+  const renewalUrl = customerRenewalUrl(context.config, requestHostname);
+  if (session.accessTokenExpiresAt <= currentSeconds()) {
+    return jsonResponse(200, {
+      authenticated: false,
+      renewalRequired: true,
+      renewalUrl
+    });
+  }
+  const response = await fetchProvider(context.providerFetch, session.graphqlEndpoint, {
+    method: "POST",
+    headers: providerRequestHeaders(context.config, {
+      Accept: "application/json",
+      Authorization: session.accessToken,
+      "Content-Type": "application/json"
+    }, providerOrigin(context.config, requestHostname)),
+    body: JSON.stringify({
+      operationName: "CustomerIdentity",
+      query: SHOPIFY_CUSTOMER_IDENTITY_QUERY,
+      variables: {}
+    }),
+    redirect: PROVIDER_REDIRECT_MODE
+  });
+  if (response.status === 401 || response.status === 403) {
+    return jsonResponse(200, {
+      authenticated: false,
+      renewalRequired: true,
+      renewalUrl
+    });
+  }
+  if (!response.ok) throw new ProviderFailure();
+  const payload = await readBoundedJson(response, MAX_GRAPHQL_BYTES);
+  const customer = parseCustomerIdentity(payload);
+  return jsonResponse(200, {
+    authenticated: true,
+    customer,
+    expiresAt: session.accessTokenExpiresAt,
+    renewalUrl
+  });
+}
+async function handleLogout(context) {
+  const requestHostname = normalizedHostname3(context.requestUrl.hostname);
+  if (!await isAllowedHostname(context.input, context.config.projectId, requestHostname)) {
+    throw new SafeHttpError(404, "not_found");
+  }
+  requireOrigin(context.request, `https://${requestHostname}`);
+  const sessionId = readSessionCookie(context.request.headers.get("Cookie"));
+  if (!sessionId) return localLogoutResponse();
+  const stored = await context.input.sessionStore.readShopperSession({
+    projectId: context.config.projectId,
+    sessionId,
+    requestHostname
+  });
+  await context.input.sessionStore.deleteShopperSession({
+    projectId: context.config.projectId,
+    sessionId,
+    requestHostname
+  });
+  if (!stored) return localLogoutResponse();
+  let session;
+  try {
+    session = parseStoredShopifySession(stored.sessionData, context.config);
+  } catch {
+    return localLogoutResponse();
+  }
+  const providerLogout = new URL(session.endSessionEndpoint);
+  providerLogout.searchParams.set("id_token_hint", session.idToken);
+  providerLogout.searchParams.set(
+    "post_logout_redirect_uri",
+    `https://${callbackHostname(context.config, requestHostname)}${context.config.postLogoutPath}`
+  );
+  return redirectResponse(providerLogout.toString(), 303, {
+    "Set-Cookie": expiredSessionCookie()
+  });
+}
+function handlePostLogout(context) {
+  requireCallbackHostname(context.requestUrl, context.config);
+  return redirectResponse(context.config.signedOutPath, 303);
+}
+function routeFor(config, pathname) {
+  if (pathname === config.loginPath) return { name: "login", method: "GET" };
+  if (pathname === config.callbackPath) return { name: "callback", method: "GET" };
+  if (pathname === config.handoffPath) return { name: "handoff", method: "POST" };
+  if (pathname === config.sessionPath) return { name: "session", method: "GET" };
+  if (pathname === config.logoutPath) return { name: "logout", method: "POST" };
+  if (pathname === config.postLogoutPath) return { name: "postLogout", method: "GET" };
+  return null;
+}
+function validateConfig(config) {
+  if (!config || typeof config !== "object") throw new Error("Customer authentication config is required.");
+  const allowedConfigKeys = /* @__PURE__ */ new Set([
+    "projectId",
+    "canonicalHostname",
+    "additionalCallbackHostnames",
+    "storefrontDomain",
+    "clientId",
+    "providerUserAgent",
+    "additionalProviderHostnames",
+    "loginPath",
+    "callbackPath",
+    "handoffPath",
+    "sessionPath",
+    "logoutPath",
+    "postLogoutPath",
+    "signedInPath",
+    "signedOutPath"
+  ]);
+  if (Object.keys(config).some((key) => !allowedConfigKeys.has(key))) {
+    throw new Error("The customer authentication config contains an unsupported field.");
+  }
+  if (!/^[A-Za-z0-9][A-Za-z0-9_-]{1,127}$/.test(config.projectId)) {
+    throw new Error("The customer authentication project is invalid.");
+  }
+  if (typeof config.clientId !== "string" || !/^[A-Za-z0-9_-]{8,256}$/.test(config.clientId)) {
+    throw new Error("The Shopify Customer Account client ID is invalid.");
+  }
+  const canonicalHostname = normalizedHostname3(config.canonicalHostname);
+  const additionalCallbackHostnames = validatedHostnameSet(
+    config.additionalCallbackHostnames,
+    "Shopify callback hostname allowlist"
+  );
+  additionalCallbackHostnames.delete(canonicalHostname);
+  const storefrontDomain = normalizedHostname3(config.storefrontDomain);
+  const providerUserAgent = config.providerUserAgent ?? DEFAULT_PROVIDER_USER_AGENT;
+  if (typeof providerUserAgent !== "string" || providerUserAgent.length < 3 || providerUserAgent.length > 128 || /[^\u0020-\u007e]/.test(providerUserAgent)) {
+    throw new Error("The Shopify provider User-Agent is invalid.");
+  }
+  const additionalProviderHostnames = /* @__PURE__ */ new Set();
+  if (config.additionalProviderHostnames !== void 0) {
+    if (!Array.isArray(config.additionalProviderHostnames) || config.additionalProviderHostnames.length > 8) {
+      throw new Error("The Shopify provider hostname allowlist is invalid.");
+    }
+    for (const hostname of config.additionalProviderHostnames) {
+      additionalProviderHostnames.add(normalizedHostname3(hostname));
+    }
+  }
+  const routePaths = {
+    loginPath: validatedPath(config.loginPath ?? DEFAULT_LOGIN_PATH, "login"),
+    callbackPath: validatedPath(config.callbackPath ?? DEFAULT_CALLBACK_PATH, "callback"),
+    handoffPath: validatedPath(config.handoffPath ?? DEFAULT_HANDOFF_PATH, "handoff"),
+    sessionPath: validatedPath(config.sessionPath ?? DEFAULT_SESSION_PATH, "session"),
+    logoutPath: validatedPath(config.logoutPath ?? DEFAULT_LOGOUT_PATH, "logout"),
+    postLogoutPath: validatedPath(config.postLogoutPath ?? DEFAULT_POST_LOGOUT_PATH, "post-logout")
+  };
+  if (new Set(Object.values(routePaths)).size !== Object.keys(routePaths).length) {
+    throw new Error("Customer authentication route paths must be distinct.");
+  }
+  const signedInPath = validatedPath(config.signedInPath ?? DEFAULT_SIGNED_IN_PATH, "signed-in");
+  const signedOutPath = validatedPath(config.signedOutPath ?? DEFAULT_SIGNED_OUT_PATH, "signed-out");
+  if (signedOutPath === routePaths.postLogoutPath) {
+    throw new Error("The signed-out path cannot be the post-logout callback path.");
+  }
+  return {
+    projectId: config.projectId,
+    canonicalHostname,
+    additionalCallbackHostnames,
+    storefrontDomain,
+    clientId: config.clientId,
+    providerUserAgent,
+    additionalProviderHostnames,
+    ...routePaths,
+    signedInPath,
+    signedOutPath
+  };
+}
+function parsedRequestUrl(request) {
+  if (!(request instanceof Request) || request.url.length > MAX_REQUEST_URL_LENGTH) {
+    throw new SafeHttpError(400, "invalid_request");
+  }
+  try {
+    return new URL(request.url);
+  } catch {
+    throw new SafeHttpError(400, "invalid_request");
+  }
+}
+function validatedRequestUrl(url) {
+  if (url.protocol !== "https:" || url.username || url.password || url.port) {
+    throw new SafeHttpError(400, "invalid_request");
+  }
+  normalizedHostname3(url.hostname);
+  return url;
+}
+function validatedPath(value, label) {
+  if (typeof value !== "string" || !/^\/[A-Za-z0-9/_-]{0,127}$/.test(value) || value.includes("//")) {
+    throw new Error(`The customer authentication ${label} path is invalid.`);
+  }
+  return value;
+}
+function callbackUrl(config, hostname = config.canonicalHostname) {
+  return `https://${hostname}${config.callbackPath}`;
+}
+function customerRenewalUrl(config, returnHostname) {
+  return `https://${callbackHostname(config, returnHostname)}${config.loginPath}?return_host=${encodeURIComponent(returnHostname)}&prompt=none`;
+}
+function currentSeconds() {
+  return Math.floor(Date.now() / 1e3);
+}
+function requireCallbackHostname(url, config) {
+  const hostname = normalizedHostname3(url.hostname);
+  if (callbackHostname(config, hostname) !== hostname) {
+    throw new SafeHttpError(404, "not_found");
+  }
+  return hostname;
+}
+function callbackHostname(config, hostname) {
+  return hostname === config.canonicalHostname || config.additionalCallbackHostnames.has(hostname) ? hostname : config.canonicalHostname;
+}
+async function isAllowedHostname(input, projectId, hostnameValue) {
+  let hostname;
+  try {
+    hostname = normalizedHostname3(hostnameValue);
+  } catch {
+    return false;
+  }
+  try {
+    return await input.hostnamePolicy({ projectId, hostname }) === true;
+  } catch {
+    return false;
+  }
+}
+async function discoverOpenId(config, providerFetch) {
+  const response = await fetchProvider(
+    providerFetch,
+    `https://${config.storefrontDomain}/.well-known/openid-configuration`,
+    {
+      method: "GET",
+      headers: providerRequestHeaders(config, { Accept: "application/json" }),
+      redirect: PROVIDER_REDIRECT_MODE
+    }
+  );
+  if (!response.ok) throw new ProviderFailure();
+  const value = objectValue(await readBoundedJson(response, MAX_DISCOVERY_BYTES));
+  return {
+    authorizationEndpoint: providerEndpoint(value.authorization_endpoint, config),
+    tokenEndpoint: providerEndpoint(value.token_endpoint, config),
+    endSessionEndpoint: providerEndpoint(value.end_session_endpoint, config)
+  };
+}
+async function discoverCustomerApi(config, providerFetch) {
+  const response = await fetchProvider(
+    providerFetch,
+    `https://${config.storefrontDomain}/.well-known/customer-account-api`,
+    {
+      method: "GET",
+      headers: providerRequestHeaders(config, { Accept: "application/json" }),
+      redirect: PROVIDER_REDIRECT_MODE
+    }
+  );
+  if (!response.ok) throw new ProviderFailure();
+  const value = objectValue(await readBoundedJson(response, MAX_DISCOVERY_BYTES));
+  return { graphqlEndpoint: providerEndpoint(value.graphql_api, config) };
+}
+async function exchangeAuthorizationCode(input) {
+  const response = await fetchProvider(input.providerFetch, input.tokenEndpoint, {
+    method: "POST",
+    headers: providerRequestHeaders(input.config, {
+      Accept: "application/json",
+      "Content-Type": "application/x-www-form-urlencoded"
+    }, `https://${input.callbackHostname}`),
+    body: new URLSearchParams({
+      grant_type: "authorization_code",
+      client_id: input.config.clientId,
+      redirect_uri: callbackUrl(input.config, input.callbackHostname),
+      code: input.code,
+      code_verifier: input.verifier
+    }),
+    redirect: PROVIDER_REDIRECT_MODE
+  });
+  if (!response.ok) throw new ProviderFailure();
+  const value = objectValue(await readBoundedJson(response, MAX_TOKEN_BYTES));
+  if (typeof value.access_token !== "string" || value.access_token.length < 1 || value.access_token.length > MAX_ACCESS_TOKEN_LENGTH || /[\u0000-\u001f\u007f]/.test(value.access_token)) {
+    throw new ProviderFailure();
+  }
+  if (!Number.isSafeInteger(value.expires_in) || value.expires_in < 1 || value.expires_in > MAX_SESSION_TTL_SECONDS) {
+    throw new ProviderFailure();
+  }
+  return {
+    accessToken: value.access_token,
+    idToken: requiredIdToken(value.id_token),
+    expiresIn: value.expires_in
+  };
+}
+function providerRequestHeaders(config, values, origin = `https://${config.canonicalHostname}`) {
+  const headers = new Headers(values);
+  headers.set("Origin", origin);
+  headers.set("User-Agent", config.providerUserAgent);
+  return headers;
+}
+function providerEndpoint(value, config) {
+  if (typeof value !== "string" || value.length < 1 || value.length > MAX_ENDPOINT_LENGTH) {
+    throw new ProviderFailure();
+  }
+  let url;
+  try {
+    url = new URL(value);
+  } catch {
+    throw new ProviderFailure();
+  }
+  if (url.protocol !== "https:" || url.username || url.password || url.hash || url.port && url.port !== "443") {
+    throw new ProviderFailure();
+  }
+  let hostname;
+  try {
+    hostname = normalizedHostname3(url.hostname);
+  } catch {
+    throw new ProviderFailure();
+  }
+  if (!isSameOrSubdomain(hostname, config.storefrontDomain) && !isSameOrSubdomain(hostname, "shopify.com") && !isSameOrSubdomain(hostname, "myshopify.com") && !config.additionalProviderHostnames.has(hostname)) {
+    throw new ProviderFailure();
+  }
+  return url.toString();
+}
+function parseStoredShopifySession(value, config) {
+  if (typeof value !== "string" || value.length > 65536) throw new ProviderFailure();
+  let parsed;
+  try {
+    parsed = JSON.parse(value);
+  } catch {
+    throw new ProviderFailure();
+  }
+  const object = objectValue(parsed);
+  if (object.version !== 1 || typeof object.accessToken !== "string" || object.accessToken.length < 1 || object.accessToken.length > MAX_ACCESS_TOKEN_LENGTH || /[\u0000-\u001f\u007f]/.test(object.accessToken)) {
+    throw new ProviderFailure();
+  }
+  return {
+    version: 1,
+    accessToken: object.accessToken,
+    idToken: requiredIdToken(object.idToken),
+    graphqlEndpoint: providerEndpoint(object.graphqlEndpoint, config),
+    endSessionEndpoint: providerEndpoint(object.endSessionEndpoint, config),
+    accessTokenExpiresAt: requiredStoredExpiry2(object.accessTokenExpiresAt)
+  };
+}
+function requiredIdToken(value) {
+  if (typeof value !== "string" || value.length < 3 || value.length > MAX_ID_TOKEN_LENGTH || !/^[A-Za-z0-9_-]+\.[A-Za-z0-9_-]+\.[A-Za-z0-9_-]+$/.test(value)) {
+    throw new ProviderFailure();
+  }
+  return value;
+}
+function requiredStoredExpiry2(value) {
+  if (typeof value !== "number" || !Number.isSafeInteger(value) || value < 1) {
+    throw new ProviderFailure();
+  }
+  return value;
+}
+function parseCustomerIdentity(value) {
+  const root = objectValue(value);
+  if (root.errors !== void 0 || !root.data) throw new ProviderFailure();
+  const data = objectValue(root.data);
+  const customer = objectValue(data.customer);
+  const id = boundedString(customer.id, 512);
+  const displayName = boundedString(customer.displayName, 1024);
+  let emailAddress = null;
+  if (customer.emailAddress !== null && customer.emailAddress !== void 0) {
+    const email = objectValue(customer.emailAddress);
+    emailAddress = { emailAddress: boundedString(email.emailAddress, 2048) };
+  }
+  return { id, displayName, emailAddress };
+}
+async function fetchProvider(providerFetch, input, init) {
+  try {
+    return await providerFetch(input, {
+      ...init,
+      signal: AbortSignal.timeout(PROVIDER_FETCH_TIMEOUT_MS)
+    });
+  } catch {
+    throw new ProviderFailure();
+  }
+}
+async function readBoundedJson(response, maximumBytes) {
+  const contentType = response.headers.get("Content-Type")?.split(";", 1)[0]?.trim().toLowerCase();
+  if (contentType !== "application/json" && !contentType?.endsWith("+json")) throw new ProviderFailure();
+  const contentLength = response.headers.get("Content-Length");
+  if (contentLength && (!/^\d+$/.test(contentLength) || Number(contentLength) > maximumBytes)) {
+    throw new ProviderFailure();
+  }
+  if (!response.body) throw new ProviderFailure();
+  const reader = response.body.getReader();
+  const decoder = new TextDecoder("utf-8", { fatal: true });
+  let bytesRead = 0;
+  let text = "";
+  try {
+    while (true) {
+      const result = await reader.read();
+      if (result.done) break;
+      bytesRead += result.value.byteLength;
+      if (bytesRead > maximumBytes) throw new ProviderFailure();
+      text += decoder.decode(result.value, { stream: true });
+    }
+    text += decoder.decode();
+  } catch (error) {
+    if (error instanceof ProviderFailure) throw error;
+    throw new ProviderFailure();
+  }
+  try {
+    return JSON.parse(text);
+  } catch {
+    throw new ProviderFailure();
+  }
+}
+async function boundedForm(request) {
+  const contentType = request.headers.get("Content-Type")?.split(";", 1)[0]?.trim().toLowerCase();
+  if (contentType !== "application/x-www-form-urlencoded") {
+    throw new SafeHttpError(400, "invalid_handoff");
+  }
+  const contentLength = request.headers.get("Content-Length");
+  if (contentLength && (!/^\d+$/.test(contentLength) || Number(contentLength) > MAX_FORM_BODY_BYTES)) {
+    throw new SafeHttpError(400, "invalid_handoff");
+  }
+  if (!request.body) throw new SafeHttpError(400, "invalid_handoff");
+  const reader = request.body.getReader();
+  const chunks = [];
+  let byteLength = 0;
+  try {
+    while (true) {
+      const result = await reader.read();
+      if (result.done) break;
+      byteLength += result.value.byteLength;
+      if (byteLength > MAX_FORM_BODY_BYTES) {
+        await reader.cancel();
+        throw new SafeHttpError(400, "invalid_handoff");
+      }
+      chunks.push(result.value);
+    }
+  } catch (error) {
+    if (error instanceof SafeHttpError) throw error;
+    throw new SafeHttpError(400, "invalid_handoff");
+  }
+  const bodyBytes = new Uint8Array(byteLength);
+  let offset = 0;
+  for (const chunk of chunks) {
+    bodyBytes.set(chunk, offset);
+    offset += chunk.byteLength;
+  }
+  let body;
+  try {
+    body = new TextDecoder("utf-8", { fatal: true }).decode(bodyBytes);
+  } catch {
+    throw new SafeHttpError(400, "invalid_handoff");
+  }
+  return new URLSearchParams(body);
+}
+function requiredSingleQueryValue(url, name, maximumLength, pattern) {
+  const values = url.searchParams.getAll(name);
+  if (values.length !== 1 || values[0].length < 1 || values[0].length > maximumLength || pattern && !pattern.test(values[0])) {
+    throw new SafeHttpError(400, "invalid_request");
+  }
+  return values[0];
+}
+function optionalSingleQueryValue(url, name, maximumLength, pattern) {
+  const values = url.searchParams.getAll(name);
+  if (values.length === 0) return null;
+  if (values.length !== 1 || values[0].length < 1 || values[0].length > maximumLength || !pattern.test(values[0])) {
+    throw new SafeHttpError(400, "invalid_request");
+  }
+  return values[0];
+}
+function requiredSingleFormValue(form, name, maximumLength, pattern) {
+  const values = form.getAll(name);
+  if (values.length !== 1 || values[0].length < 1 || values[0].length > maximumLength || !pattern.test(values[0])) {
+    throw new SafeHttpError(400, "invalid_handoff");
+  }
+  return values[0];
+}
+function readSessionCookie(cookieHeader) {
+  return readOpaqueCookie(cookieHeader, PUBLIC_CUSTOMER_AUTH_SESSION_COOKIE);
+}
+function readOpaqueCookie(cookieHeader, expectedName) {
+  if (!cookieHeader || cookieHeader.length > MAX_COOKIE_HEADER_LENGTH) return null;
+  const matches = [];
+  for (const part of cookieHeader.split(";")) {
+    const separator = part.indexOf("=");
+    if (separator < 1) continue;
+    const name = part.slice(0, separator).trim();
+    if (name === expectedName) {
+      matches.push(part.slice(separator + 1).trim());
+    }
+  }
+  if (matches.length !== 1 || !/^[A-Za-z0-9_-]{43}$/.test(matches[0])) return null;
+  return matches[0];
+}
+async function requiredAuthorizationClientKey(resolver, request) {
+  try {
+    const key = await resolver(request);
+    if (typeof key !== "string" || key.length < 1 || key.length > 512 || /[\u0000-\u001f\u007f]/.test(key)) {
+      throw new Error("invalid");
+    }
+    return key;
+  } catch {
+    throw new SafeHttpError(503, "customer_authentication_unavailable");
+  }
+}
+function cloudflareAuthorizationClientKey(request) {
+  const address = request.headers.get("CF-Connecting-IP")?.trim().toLowerCase();
+  if (!address || address.length > 64 || !/^[0-9a-f:.]+$/.test(address)) {
+    throw new Error("The client address is unavailable.");
+  }
+  return `cloudflare-ip:${address}`;
+}
+function requireOrigin(request, expectedOrigin) {
+  const expectedOrigins = typeof expectedOrigin === "string" ? [expectedOrigin] : expectedOrigin;
+  if (!expectedOrigins.includes(request.headers.get("Origin") ?? "")) {
+    throw new SafeHttpError(403, "invalid_origin");
+  }
+}
+function providerOrigin(config, requestHostname) {
+  return `https://${callbackHostname(config, requestHostname)}`;
+}
+function validatedHostnameSet(value, label) {
+  if (value === void 0) return /* @__PURE__ */ new Set();
+  if (!Array.isArray(value) || value.length > 8) throw new Error(`The ${label} is invalid.`);
+  return new Set(value.map(normalizedHostname3));
+}
+function normalizedHostname3(value) {
+  if (typeof value !== "string") throw new Error("The customer authentication hostname is invalid.");
+  const hostname = value.toLowerCase().replace(/\.$/, "");
+  if (!/^(?:[a-z0-9](?:[a-z0-9-]{0,61}[a-z0-9])?\.)+[a-z]{2,63}$/.test(hostname) || hostname.length > 253) {
+    throw new Error("The customer authentication hostname is invalid.");
+  }
+  return hostname;
+}
+function isSameOrSubdomain(hostname, parent) {
+  return hostname === parent || hostname.endsWith(`.${parent}`);
+}
+function objectValue(value) {
+  if (!value || typeof value !== "object" || Array.isArray(value)) throw new ProviderFailure();
+  return value;
+}
+function boundedString(value, maximumLength) {
+  if (typeof value !== "string" || value.length > maximumLength) throw new ProviderFailure();
+  return value;
+}
+function randomBase64Url(bytes) {
+  const value = crypto.getRandomValues(new Uint8Array(bytes));
+  return base64Url(value);
+}
+async function sha256Base64Url(value) {
+  const digest = await crypto.subtle.digest("SHA-256", new TextEncoder().encode(value));
+  return base64Url(new Uint8Array(digest));
+}
+function base64Url(value) {
+  const binary = Array.from(value, (byte) => String.fromCharCode(byte)).join("");
+  return btoa(binary).replaceAll("+", "-").replaceAll("/", "_").replaceAll("=", "");
+}
+function handoffPostResponse(config, returnHostname, handoff) {
+  const action = `https://${returnHostname}${config.handoffPath}`;
+  const nonce = randomBase64Url(18);
+  const html = `<!doctype html>
+<html lang="en">
+<head><meta charset="utf-8"><meta name="referrer" content="no-referrer"><title>Signing in</title></head>
+<body>
+<form id="customer-auth-handoff" method="post" action="${escapeHtml(action)}">
+<input type="hidden" name="handoff" value="${escapeHtml(handoff)}">
+<noscript><button type="submit">Continue</button></noscript>
+</form>
+<script nonce="${nonce}">document.getElementById("customer-auth-handoff").requestSubmit();</script>
+</body>
+</html>`;
+  return new Response(html, {
+    status: 200,
+    headers: secureHeaders({
+      "Content-Type": "text/html; charset=utf-8",
+      "Content-Security-Policy": `default-src 'none'; base-uri 'none'; frame-ancestors 'none'; form-action https://${returnHostname}; script-src 'nonce-${nonce}'`,
+      "Referrer-Policy": "no-referrer"
+    })
+  });
+}
+function escapeHtml(value) {
+  return value.replaceAll("&", "&amp;").replaceAll('"', "&quot;").replaceAll("<", "&lt;").replaceAll(">", "&gt;");
+}
+function sessionCookie(sessionId) {
+  return `${PUBLIC_CUSTOMER_AUTH_SESSION_COOKIE}=${sessionId}; Path=/; Secure; HttpOnly; SameSite=Lax`;
+}
+function authorizationFlowCookie(state, browserBinding) {
+  return `${authorizationFlowCookieName(state)}=${browserBinding}; Max-Age=${FLOW_TTL_SECONDS}; Path=/; Secure; HttpOnly; SameSite=Lax`;
+}
+function authorizationFlowCookieName(state) {
+  if (!/^[A-Za-z0-9_-]{43}$/.test(state)) {
+    throw new Error("The customer authentication state is invalid.");
+  }
+  return `${PUBLIC_CUSTOMER_AUTH_FLOW_COOKIE}_${state}`;
+}
+function expiredSessionCookie() {
+  return `${PUBLIC_CUSTOMER_AUTH_SESSION_COOKIE}=; Path=/; Secure; HttpOnly; SameSite=Lax; Max-Age=0`;
+}
+function localLogoutResponse() {
+  return new Response(null, {
+    status: 204,
+    headers: secureHeaders({ "Set-Cookie": expiredSessionCookie() })
+  });
+}
+function unauthenticatedResponse(clearCookie) {
+  return jsonResponse(200, { authenticated: false }, clearCookie ? { "Set-Cookie": expiredSessionCookie() } : void 0);
+}
+function jsonResponse(status, value, headers) {
+  return new Response(JSON.stringify(value), {
+    status,
+    headers: secureHeaders({ "Content-Type": "application/json; charset=utf-8", ...headers })
+  });
+}
+function safeError(status, code, headers) {
+  return jsonResponse(status, { error: code }, headers);
+}
+function redirectResponse(location, status, headers) {
+  const responseHeaders = new Headers(headers);
+  responseHeaders.set("Location", location);
+  return new Response(null, {
+    status,
+    headers: secureHeaders(responseHeaders)
+  });
+}
+function methodNotAllowed(method) {
+  return jsonResponse(405, { error: "method_not_allowed" }, { Allow: method });
+}
+function secureHeaders(extra) {
+  const headers = new Headers(extra);
+  headers.set("Cache-Control", "no-store");
+  headers.set("Referrer-Policy", "no-referrer");
+  headers.set("X-Content-Type-Options", "nosniff");
+  return headers;
+}
+var SafeHttpError = class extends Error {
+  constructor(status, code) {
+    super(code);
+    this.status = status;
+    this.code = code;
+  }
+  status;
+  code;
+};
+var ProviderFailure = class extends Error {
+};
+
+// src/portal-service.ts
+var FORWARDED_HEADERS = [
+  "accept",
+  "accept-language",
+  "cache-control",
+  "if-modified-since",
+  "if-none-match",
+  "if-range",
+  "pragma",
+  "range",
+  "user-agent"
+];
+var PORTAL_CONTENT_SECURITY_POLICY = [
+  "default-src 'self'",
+  "base-uri 'none'",
+  "connect-src 'self'",
+  "frame-ancestors 'none'",
+  "img-src 'self' data:",
+  "object-src 'none'",
+  "script-src 'self'",
+  "style-src 'self'"
+].join("; ");
+async function forwardPortalRequest(request, portal) {
+  if (!portal || typeof portal.fetch !== "function") return gatewayError(503, "portal_ui_unavailable");
+  try {
+    const response = await portal.fetch(portalRequest(request));
+    const headers = new Headers(response.headers);
+    for (const name of [...headers.keys()]) {
+      const normalized = name.toLowerCase();
+      if (normalized === "set-cookie" || normalized === "set-cookie2" || normalized === "clear-site-data" || normalized.startsWith("cf-") || normalized.startsWith("cloudflare-") || normalized.startsWith("x-tender-")) {
+        headers.delete(name);
+      }
+    }
+    headers.set("Content-Security-Policy", PORTAL_CONTENT_SECURITY_POLICY);
+    headers.set("Permissions-Policy", "camera=(), geolocation=(), microphone=(), payment=()");
+    headers.set("Referrer-Policy", "strict-origin-when-cross-origin");
+    headers.set("X-Content-Type-Options", "nosniff");
+    headers.set("X-Frame-Options", "DENY");
+    return new Response(request.method === "HEAD" ? null : response.body, {
+      status: response.status,
+      statusText: response.statusText,
+      headers
+    });
+  } catch {
+    return gatewayError(502, "portal_ui_failed");
+  }
+}
+function portalRequest(request) {
+  const headers = new Headers();
+  for (const name of FORWARDED_HEADERS) {
+    const value = request.headers.get(name);
+    if (value !== null) headers.set(name, value);
+  }
+  return new Request(request.url, { method: request.method, headers, redirect: "manual" });
+}
+function gatewayError(status, code) {
+  return Response.json({ error: { code } }, {
+    status,
+    headers: {
+      "Cache-Control": "no-store",
+      "Content-Security-Policy": "default-src 'none'; frame-ancestors 'none'",
+      "Referrer-Policy": "no-referrer",
+      "X-Content-Type-Options": "nosniff"
+    }
+  });
+}
+
+// src/runtime-config.ts
+var PUBLIC_CLIENT_ID = /^[A-Za-z0-9_-]{8,256}$/u;
+var RUNTIME_ID = /^[A-Za-z0-9][A-Za-z0-9_-]{1,127}$/u;
+var HOSTNAME = /^(?:[a-z0-9](?:[a-z0-9-]{0,61}[a-z0-9])?\.)+[a-z]{2,63}$/u;
+function readRuntimeConfig(env) {
+  const tenantId = requiredMatch(env.ACCOUNT_TENANT_ID, RUNTIME_ID, "tenant identity");
+  const projectId = requiredMatch(env.ACCOUNT_PROJECT_ID, RUNTIME_ID, "project identity");
+  const runtimeBaseDomain = requiredHostname(env.ACCOUNT_RUNTIME_BASE_DOMAIN, "runtime base domain");
+  return {
+    tenantId,
+    projectId,
+    runtimeBaseDomain,
+    canonicalHostname: canonicalApplicationHostname({ tenantId, projectId, baseDomain: runtimeBaseDomain }),
+    storefrontDomain: requiredHostname(env.SHOPIFY_STOREFRONT_DOMAIN, "Shopify storefront domain"),
+    customerAccountClientId: requiredMatch(
+      env.SHOPIFY_CUSTOMER_ACCOUNT_CLIENT_ID,
+      PUBLIC_CLIENT_ID,
+      "Shopify public customer-account client ID"
+    ),
+    customerAccountDomain: requiredHostname(env.SHOPIFY_CUSTOMER_ACCOUNT_DOMAIN, "Shopify customer-account domain"),
+    vanityHostnames: optionalHostnameList(env.ACCOUNT_VANITY_HOSTNAMES)
+  };
+}
+function optionalHostnameList(value) {
+  if (value === void 0) return [];
+  if (value.trim() === "") return [];
+  const hostnames = [...new Set(value.split(",").map((hostname) => requiredHostname(hostname, "vanity hostname")))];
+  if (hostnames.length > 8) throw new Error("Too many vanity hostnames are configured.");
+  return hostnames;
+}
+function requiredHostname(value, label) {
+  const hostname = value.trim().toLowerCase().replace(/\.$/u, "");
+  if (!HOSTNAME.test(hostname)) throw new Error(`The ${label} is invalid.`);
+  return hostname;
+}
+function requiredMatch(value, pattern, label) {
+  const normalized = value.trim();
+  if (!pattern.test(normalized)) throw new Error(`The ${label} is invalid.`);
+  return normalized;
+}
+
+// src/worker.ts
+var LOOPBACK_HOSTNAMES = /* @__PURE__ */ new Set(["localhost", "127.0.0.1", "[::1]"]);
+var worker_default = {
+  async fetch(request, env) {
+    let config;
+    try {
+      config = readRuntimeConfig(env);
+    } catch {
+      return jsonResponse2(503, "application_not_configured");
+    }
+    const url = new URL(request.url);
+    if (request.method === "GET" && url.pathname === "/api/health") {
+      return Response.json({ ok: true, service: "shopify-customer-account-gateway" });
+    }
+    const localDevelopment = (url.protocol === "http:" || url.protocol === "https:") && LOOPBACK_HOSTNAMES.has(url.hostname.toLowerCase());
+    if (localDevelopment && request.method === "GET" && url.pathname === "/api/bootstrap") {
+      return Response.json({ canonicalHostname: config.canonicalHostname, loginUrl: null, localDevelopment: true });
+    }
+    if (localDevelopment && request.method === "GET" && url.pathname === "/api/session") {
+      return Response.json({ authenticated: false, localDevelopment: true });
+    }
+    if (localDevelopment && url.pathname.startsWith("/auth/")) {
+      return jsonResponse2(409, "authentication_requires_https_preview");
+    }
+    const hostnamePolicy = createTenderRuntimeHostnamePolicy({
+      tenantId: config.tenantId,
+      projectId: config.projectId,
+      baseDomain: config.runtimeBaseDomain,
+      additionalHostnames: config.vanityHostnames
+    });
+    const auth = createShopifyCustomerAccountRouteAdapter({
+      config: {
+        projectId: config.projectId,
+        canonicalHostname: config.canonicalHostname,
+        additionalCallbackHostnames: config.vanityHostnames,
+        storefrontDomain: config.storefrontDomain,
+        clientId: config.customerAccountClientId,
+        additionalProviderHostnames: [config.customerAccountDomain]
+      },
+      sessionStore: new PublicCustomerAuthSessionStore(env.APP_DB, hostnamePolicy),
+      hostnamePolicy
+    });
+    const authResponse = await auth.handle(request);
+    if (authResponse) return authResponse;
+    if (request.method === "GET" && url.pathname === "/api/bootstrap") {
+      const hostname = url.hostname.toLowerCase().replace(/\.$/u, "");
+      if (!await hostnamePolicy({ projectId: config.projectId, hostname })) return jsonResponse2(404, "not_found");
+      const loginHostname = config.vanityHostnames.includes(hostname) ? hostname : config.canonicalHostname;
+      const loginUrl = new URL(`https://${loginHostname}/auth/login`);
+      loginUrl.searchParams.set("return_host", hostname);
+      return Response.json({ canonicalHostname: config.canonicalHostname, loginUrl: loginUrl.toString() });
+    }
+    if (url.pathname.startsWith("/api/") || url.pathname.startsWith("/auth/")) return jsonResponse2(404, "not_found");
+    if (request.method !== "GET" && request.method !== "HEAD") {
+      return new Response(null, { status: 405, headers: { Allow: "GET, HEAD" } });
+    }
+    return await forwardPortalRequest(request, env.PORTAL_UI);
+  }
+};
+function jsonResponse2(status, code) {
+  return Response.json({ error: { code } }, {
+    status,
+    headers: {
+      "Cache-Control": "no-store",
+      "Content-Security-Policy": "default-src 'none'; frame-ancestors 'none'",
+      "Referrer-Policy": "no-referrer",
+      "X-Content-Type-Options": "nosniff"
+    }
+  });
+}
+export {
+  worker_default as default
+};