@withandeo/cli 0.14.0 → 0.15.0

package/templates/shopify-customer-account/apps/gateway/.tender/artifacts/current/worker.mjs

@@ -1,1785 +0,0 @@
-// src/platform/customer-auth/hostname-policy.ts
-import { createHash as createHash2 } from "node:crypto";
-
-// src/platform/runtime-hostname.ts
-import { createHash } from "node:crypto";
-function canonicalApplicationHostname(input) {
-  return `a-${shortDigest(input.projectId, 14)}--t-${shortDigest(input.tenantId, 14)}.${normalizedDomain(input.baseDomain)}`;
-}
-function immutablePreviewHostname(input) {
-  return [
-    `r-${shortDigest(input.releaseId, 12)}`,
-    `p-${shortDigest(input.projectId, 10)}`,
-    `t-${shortDigest(input.tenantId, 10)}`
-  ].join("--") + `.${normalizedDomain(input.baseDomain)}`;
-}
-function previewAliasHostname(input) {
-  const readable = input.alias.toLowerCase().replace(/[^a-z0-9-]+/gu, "-").replace(/^-+|-+$/gu, "").slice(0, 12);
-  if (readable.length < 2) throw new Error("The preview alias is invalid.");
-  return [
-    `b-${readable}-${rawDigest(input.alias, 8)}`,
-    `p-${shortDigest(input.projectId, 10)}`,
-    `t-${shortDigest(input.tenantId, 10)}`
-  ].join("--") + `.${normalizedDomain(input.baseDomain)}`;
-}
-function shortDigest(value, length) {
-  if (!/^[A-Za-z0-9][A-Za-z0-9_-]{1,127}$/u.test(value)) throw new Error("The runtime identity is invalid.");
-  return rawDigest(value, length);
-}
-function rawDigest(value, length) {
-  return createHash("sha256").update(value, "utf8").digest("hex").slice(0, length);
-}
-function normalizedDomain(value) {
-  const domain = value.toLowerCase().replace(/\.$/u, "");
-  if (!/^(?:[a-z0-9](?:[a-z0-9-]{0,61}[a-z0-9])?\.)+[a-z]{2,63}$/u.test(domain)) {
-    throw new Error("The runtime base domain is invalid.");
-  }
-  return domain;
-}
-
-// src/platform/customer-auth/hostname-policy.ts
-function createTenderRuntimeHostnamePolicy(input) {
-  const canonicalHostname = canonicalApplicationHostname(input);
-  const domain = canonicalHostname.slice(canonicalHostname.indexOf(".") + 1);
-  const projectDigest = shortDigest2(input.projectId, 10);
-  const tenantDigest = shortDigest2(input.tenantId, 10);
-  const immutablePattern = new RegExp(
-    `^r-[a-f0-9]{12}--p-${projectDigest}--t-${tenantDigest}\\.${escaped(domain)}$`
-  );
-  const aliasPattern = new RegExp(
-    `^b-[a-z0-9][a-z0-9-]{1,11}-[a-f0-9]{8}--p-${projectDigest}--t-${tenantDigest}\\.${escaped(domain)}$`
-  );
-  const additionalHostnames = new Set((input.additionalHostnames ?? []).map(normalizedHostname));
-  return ({ projectId, hostname }) => projectId === input.projectId && (hostname === canonicalHostname || additionalHostnames.has(hostname) || immutablePattern.test(hostname) || aliasPattern.test(hostname));
-}
-function normalizedHostname(value) {
-  const hostname = value.trim().toLowerCase().replace(/\.$/u, "");
-  if (!/^(?=.{4,253}$)(?:[a-z0-9](?:[a-z0-9-]{0,61}[a-z0-9])?\.)+[a-z]{2,63}$/u.test(hostname)) {
-    throw new Error("The additional runtime hostname is invalid.");
-  }
-  return hostname;
-}
-var PUBLIC_CUSTOMER_AUTH_RUNTIME_HOST_CONSTRUCTORS = Object.freeze({
-  canonicalApplicationHostname,
-  immutablePreviewHostname,
-  previewAliasHostname
-});
-function shortDigest2(value, length) {
-  return createHash2("sha256").update(value).digest("hex").slice(0, length);
-}
-function escaped(value) {
-  return value.replace(/[.*+?^${}()|[\]\\]/g, "\\$&");
-}
-
-// src/platform/customer-auth/session-store.ts
-var FLOW_MAX_TTL_SECONDS = 10 * 60;
-var HANDOFF_MAX_TTL_SECONDS = 5 * 60;
-var SESSION_MAX_TTL_SECONDS = 31 * 24 * 60 * 60;
-var EXPIRED_STATE_DELETE_LIMIT = 256;
-var DEFAULT_MAX_RECENT_AUTHORIZATION_ATTEMPTS_PER_PROJECT = 512;
-var DEFAULT_MAX_RECENT_AUTHORIZATION_ATTEMPTS_PER_CLIENT = 20;
-var MAX_CONFIGURED_AUTHORIZATION_ATTEMPTS = 1e5;
-var OPAQUE_VALUE_BYTES = 32;
-var SESSION_DATA_MAX_LENGTH = 65536;
-var SESSION_SEAL_MAX_LENGTH = 1e5;
-var CustomerAuthFlowCapacityError = class extends Error {
-  constructor() {
-    super("The customer authentication flow capacity has been reached.");
-  }
-};
-var PublicCustomerAuthSessionStore = class {
-  database;
-  hostnamePolicy;
-  maxRecentAuthorizationAttemptsPerProject;
-  maxRecentAuthorizationAttemptsPerClient;
-  constructor(database, hostnamePolicy, options = {}) {
-    if (typeof hostnamePolicy !== "function") {
-      throw new Error("A customer authentication hostname policy is required.");
-    }
-    this.database = database;
-    this.hostnamePolicy = hostnamePolicy;
-    const maxRecentAuthorizationAttemptsPerProject = options.maxRecentAuthorizationAttemptsPerProject ?? DEFAULT_MAX_RECENT_AUTHORIZATION_ATTEMPTS_PER_PROJECT;
-    const maxRecentAuthorizationAttemptsPerClient = options.maxRecentAuthorizationAttemptsPerClient ?? DEFAULT_MAX_RECENT_AUTHORIZATION_ATTEMPTS_PER_CLIENT;
-    if (!validAuthorizationAttemptLimit(maxRecentAuthorizationAttemptsPerProject) || !validAuthorizationAttemptLimit(maxRecentAuthorizationAttemptsPerClient) || maxRecentAuthorizationAttemptsPerClient > maxRecentAuthorizationAttemptsPerProject) {
-      throw new Error("The customer authentication flow capacity is invalid.");
-    }
-    this.maxRecentAuthorizationAttemptsPerProject = maxRecentAuthorizationAttemptsPerProject;
-    this.maxRecentAuthorizationAttemptsPerClient = maxRecentAuthorizationAttemptsPerClient;
-  }
-  async createAuthorizationFlow(input) {
-    const projectId = requiredProjectId(input.projectId);
-    const pkceVerifier = requiredPkceVerifier(input.pkceVerifier);
-    const returnHostname = normalizedHostname2(input.returnHostname);
-    const clientKey = requiredClientKey(input.clientKey);
-    const interactionMode = requiredInteractionMode(input.interactionMode ?? "interactive");
-    const timing = expiration(input.nowSeconds, input.ttlSeconds, FLOW_MAX_TTL_SECONDS, "authorization flow");
-    await this.requireAllowedHostname(projectId, returnHostname);
-    await this.deleteExpiredState({ projectId, nowSeconds: timing.createdAt });
-    const state = randomOpaqueValue();
-    const browserBinding = randomOpaqueValue();
-    const stateDigest = await opaqueDigest(state);
-    const browserBindingDigest = await opaqueDigest(browserBinding);
-    const clientKeyDigest = await opaqueDigest(clientKey);
-    const result = await this.database.prepare(
-      `INSERT INTO public_customer_auth_flows (
-        project_id, state_digest, browser_binding_digest, client_key_digest, interaction_mode,
-        pkce_verifier, return_hostname, created_at, expires_at
-      )
-      SELECT ?, ?, ?, ?, ?, ?, ?, ?, ?
-      WHERE (
-        SELECT COUNT(*) FROM public_customer_auth_flows
-        WHERE project_id = ? AND expires_at > ?
-      ) < ?
-        AND (
-          SELECT COUNT(*) FROM public_customer_auth_flows
-          WHERE project_id = ? AND client_key_digest = ? AND expires_at > ?
-        ) < ?`
-    ).bind(
-      projectId,
-      stateDigest,
-      browserBindingDigest,
-      clientKeyDigest,
-      interactionMode,
-      pkceVerifier,
-      returnHostname,
-      timing.createdAt,
-      timing.expiresAt,
-      projectId,
-      timing.createdAt,
-      this.maxRecentAuthorizationAttemptsPerProject,
-      projectId,
-      clientKeyDigest,
-      timing.createdAt,
-      this.maxRecentAuthorizationAttemptsPerClient
-    ).run();
-    if (result.success === false) {
-      throw new Error("The customer authentication state was not stored.");
-    }
-    if (result.meta?.changes === 0) throw new CustomerAuthFlowCapacityError();
-    if (result.meta?.changes !== 1) {
-      throw new Error("The customer authentication state was not stored.");
-    }
-    return { state, browserBinding, returnHostname, expiresAt: timing.expiresAt };
-  }
-  async consumeAuthorizationFlow(input) {
-    const projectId = requiredProjectId(input.projectId);
-    const stateDigest = await opaqueDigest(requiredOpaqueValue(input.state, "authorization state"));
-    const browserBindingDigest = await opaqueDigest(
-      requiredOpaqueValue(input.browserBinding, "authorization browser binding")
-    );
-    const now = requiredNow(input.nowSeconds);
-    const row = await this.database.prepare(
-      `UPDATE public_customer_auth_flows
-       SET consumed_at = ?
-       WHERE project_id = ? AND state_digest = ? AND browser_binding_digest = ?
-         AND consumed_at IS NULL AND expires_at > ?
-       RETURNING pkce_verifier, return_hostname, interaction_mode, expires_at`
-    ).bind(now, projectId, stateDigest, browserBindingDigest, now).first();
-    if (!row) return null;
-    return {
-      pkceVerifier: requiredPkceVerifier(row.pkce_verifier),
-      returnHostname: normalizedHostname2(row.return_hostname),
-      interactionMode: requiredInteractionMode(row.interaction_mode),
-      expiresAt: requiredExpiry(row.expires_at, now)
-    };
-  }
-  async createShopperSessionHandoff(input) {
-    const projectId = requiredProjectId(input.projectId);
-    const returnHostname = normalizedHostname2(input.returnHostname);
-    const sessionData = requiredSessionData(input.sessionData);
-    const now = requiredNow(input.nowSeconds);
-    const timing = expiration(now, input.handoffTtlSeconds, HANDOFF_MAX_TTL_SECONDS, "handoff");
-    const sessionTiming = expiration(now, input.sessionTtlSeconds, SESSION_MAX_TTL_SECONDS, "shopper session");
-    if (input.handoffTtlSeconds > input.sessionTtlSeconds) {
-      throw new Error("The handoff cannot outlive its shopper session.");
-    }
-    await this.requireAllowedHostname(projectId, returnHostname);
-    await this.deleteExpiredState({ projectId, nowSeconds: now });
-    const sessionId = randomOpaqueValue();
-    const sessionDigest = await opaqueDigest(sessionId);
-    const handoff = randomOpaqueValue();
-    const handoffDigest = await opaqueDigest(handoff);
-    const sessionSeal = await sealPendingSessionPayload({
-      sessionId,
-      sessionExpiresAt: sessionTiming.expiresAt,
-      sessionData,
-      handoff,
-      projectId,
-      returnHostname,
-      handoffDigest
-    });
-    await requireInsert(this.database.prepare(
-      `INSERT INTO public_customer_auth_handoffs (
-        project_id, handoff_digest, return_hostname, session_digest, session_seal, created_at, expires_at
-      ) VALUES (?, ?, ?, ?, ?, ?, ?)`
-    ).bind(
-      projectId,
-      handoffDigest,
-      returnHostname,
-      sessionDigest,
-      sessionSeal,
-      timing.createdAt,
-      timing.expiresAt
-    ));
-    return { handoff, returnHostname, expiresAt: timing.expiresAt };
-  }
-  async consumeHandoff(input) {
-    const projectId = requiredProjectId(input.projectId);
-    const handoff = requiredOpaqueValue(input.handoff, "handoff");
-    const handoffDigest = await opaqueDigest(handoff);
-    const requestHostname = normalizedHostname2(input.requestHostname);
-    const now = requiredNow(input.nowSeconds);
-    const readHandoff = () => this.database.prepare(
-      `SELECT session_seal, session_digest, return_hostname, expires_at, claimed_at
-       FROM public_customer_auth_handoffs
-       WHERE project_id = ? AND handoff_digest = ? AND return_hostname = ? AND expires_at > ?`
-    ).bind(projectId, handoffDigest, requestHostname, now).first();
-    const row = await readHandoff();
-    if (!row) return null;
-    const returnHostname = normalizedHostname2(row.return_hostname);
-    const handoffExpiresAt = requiredExpiry(row.expires_at, now);
-    const sessionDigest = requiredDigest(row.session_digest, "shopper session");
-    const sessionSeal = requiredSessionSeal(row.session_seal);
-    const claimedAt = optionalClaimedAt(row.claimed_at, now);
-    if (claimedAt !== null) {
-      return this.readClaimedHandoff({
-        projectId,
-        handoff,
-        handoffDigest,
-        requestHostname,
-        handoffExpiresAt,
-        sessionDigest,
-        sessionSeal,
-        now
-      });
-    }
-    const payload = await unsealPendingSessionPayload({
-      sessionSeal,
-      handoff,
-      projectId,
-      returnHostname,
-      handoffDigest
-    });
-    if (await opaqueDigest(payload.sessionId) !== sessionDigest) {
-      throw new Error("The customer authentication handoff is invalid.");
-    }
-    const sessionExpiresAt = requiredExpiry(payload.sessionExpiresAt, now);
-    const claimedSeal = await sealClaimedSessionId({
-      sessionId: payload.sessionId,
-      handoff,
-      projectId,
-      returnHostname,
-      handoffDigest
-    });
-    const [claimResult, insertResult] = await this.database.batch([
-      this.database.prepare(
-        `UPDATE public_customer_auth_handoffs
-         SET claimed_at = ?, session_seal = ?
-         WHERE project_id = ? AND handoff_digest = ? AND return_hostname = ?
-           AND expires_at > ? AND claimed_at IS NULL AND session_digest = ? AND session_seal = ?`
-      ).bind(
-        now,
-        claimedSeal,
-        projectId,
-        handoffDigest,
-        returnHostname,
-        now,
-        sessionDigest,
-        sessionSeal
-      ),
-      this.database.prepare(
-        `INSERT INTO public_customer_auth_sessions (
-          project_id, session_digest, audience_hostname, session_data, created_at, expires_at
-        )
-        SELECT ?, ?, ?, ?, ?, ?
-        WHERE EXISTS (
-          SELECT 1 FROM public_customer_auth_handoffs
-          WHERE project_id = ? AND handoff_digest = ? AND return_hostname = ?
-            AND expires_at > ? AND claimed_at = ? AND session_digest = ? AND session_seal = ?
-        )`
-      ).bind(
-        projectId,
-        sessionDigest,
-        returnHostname,
-        payload.sessionData,
-        now,
-        sessionExpiresAt,
-        projectId,
-        handoffDigest,
-        returnHostname,
-        now,
-        now,
-        sessionDigest,
-        claimedSeal
-      )
-    ]);
-    if (!claimResult || !insertResult || claimResult.success === false || insertResult.success === false) {
-      throw new Error("The customer authentication handoff could not be consumed.");
-    }
-    const claimed = claimResult.meta?.changes ?? 0;
-    const inserted = insertResult.meta?.changes ?? 0;
-    if (claimed === 0 && inserted === 0) {
-      const racedRow = await readHandoff();
-      if (!racedRow || optionalClaimedAt(racedRow.claimed_at, now) === null) {
-        throw new Error("The customer authentication handoff could not be consumed.");
-      }
-      return this.readClaimedHandoff({
-        projectId,
-        handoff,
-        handoffDigest,
-        requestHostname,
-        handoffExpiresAt: requiredExpiry(racedRow.expires_at, now),
-        sessionDigest: requiredDigest(racedRow.session_digest, "shopper session"),
-        sessionSeal: requiredSessionSeal(racedRow.session_seal),
-        now
-      });
-    }
-    if (claimed !== 1 || inserted !== 1) {
-      throw new Error("The customer authentication handoff could not be consumed.");
-    }
-    return {
-      sessionId: payload.sessionId,
-      returnHostname,
-      expiresAt: handoffExpiresAt
-    };
-  }
-  async readClaimedHandoff(input) {
-    const sessionId = await unsealClaimedSessionId({
-      sessionSeal: input.sessionSeal,
-      handoff: input.handoff,
-      projectId: input.projectId,
-      returnHostname: input.requestHostname,
-      handoffDigest: input.handoffDigest
-    });
-    if (await opaqueDigest(sessionId) !== input.sessionDigest) {
-      throw new Error("The customer authentication handoff is invalid.");
-    }
-    const session = await this.database.prepare(
-      `SELECT expires_at FROM public_customer_auth_sessions
-       WHERE project_id = ? AND session_digest = ? AND audience_hostname = ? AND expires_at > ?`
-    ).bind(
-      input.projectId,
-      input.sessionDigest,
-      input.requestHostname,
-      input.now
-    ).first();
-    if (!session) throw new Error("The customer authentication handoff is invalid.");
-    requiredExpiry(session.expires_at, input.now);
-    return {
-      sessionId,
-      returnHostname: input.requestHostname,
-      expiresAt: input.handoffExpiresAt
-    };
-  }
-  async createShopperSession(input) {
-    const projectId = requiredProjectId(input.projectId);
-    const audienceHostname = normalizedHostname2(input.audienceHostname);
-    const sessionData = requiredSessionData(input.sessionData);
-    const timing = expiration(input.nowSeconds, input.ttlSeconds, SESSION_MAX_TTL_SECONDS, "shopper session");
-    await this.requireAllowedHostname(projectId, audienceHostname);
-    await this.deleteExpiredState({ projectId, nowSeconds: timing.createdAt });
-    return this.insertShopperSession({
-      projectId,
-      audienceHostname,
-      sessionData,
-      timing
-    });
-  }
-  async deleteExpiredState(input) {
-    const projectId = requiredProjectId(input.projectId);
-    const now = requiredNow(input.nowSeconds);
-    const deleted = {
-      flows: 0,
-      handoffs: 0,
-      sessions: 0
-    };
-    for (const [key, table] of [
-      ["flows", "public_customer_auth_flows"],
-      ["handoffs", "public_customer_auth_handoffs"],
-      ["sessions", "public_customer_auth_sessions"]
-    ]) {
-      const statement = this.database.prepare(
-        `DELETE FROM ${table}
-         WHERE rowid IN (
-           SELECT rowid FROM ${table}
-           WHERE project_id = ? AND expires_at <= ?
-           ORDER BY expires_at
-           LIMIT ?
-         )`
-      ).bind(projectId, now, EXPIRED_STATE_DELETE_LIMIT);
-      const result = await statement.run();
-      if (result.success === false) {
-        throw new Error("Expired customer authentication state could not be deleted.");
-      }
-      deleted[key] = result.meta?.changes ?? 0;
-    }
-    return deleted;
-  }
-  /**
-   * Bounded maintenance entry point. Opportunistic request cleanup is enough
-   * for the first proof; a future trusted first-party scheduler can invoke a
-   * protected merchant route to drain inactive projects. A User Worker
-   * `scheduled` export is not itself a trigger in a dispatch namespace.
-   */
-  async runScheduledCleanup(input) {
-    const maxBatches = input.maxBatches ?? 4;
-    if (!Number.isSafeInteger(maxBatches) || maxBatches < 1 || maxBatches > 16) {
-      throw new Error("The scheduled customer authentication cleanup bound is invalid.");
-    }
-    const total = { flows: 0, handoffs: 0, sessions: 0 };
-    let batches = 0;
-    let mayHaveMore = false;
-    while (batches < maxBatches) {
-      const deleted = await this.deleteExpiredState({
-        projectId: input.projectId,
-        nowSeconds: input.nowSeconds
-      });
-      batches += 1;
-      total.flows += deleted.flows;
-      total.handoffs += deleted.handoffs;
-      total.sessions += deleted.sessions;
-      mayHaveMore = Object.values(deleted).some((count) => count === EXPIRED_STATE_DELETE_LIMIT);
-      if (!mayHaveMore) break;
-    }
-    return { ...total, batches, mayHaveMore };
-  }
-  async insertShopperSession(input) {
-    const sessionId = input.sessionId === void 0 ? randomOpaqueValue() : requiredOpaqueValue(input.sessionId, "shopper session");
-    const sessionDigest = await opaqueDigest(sessionId);
-    await requireInsert(this.database.prepare(
-      `INSERT INTO public_customer_auth_sessions (
-        project_id, session_digest, audience_hostname, session_data, created_at, expires_at
-      ) VALUES (?, ?, ?, ?, ?, ?)`
-    ).bind(
-      input.projectId,
-      sessionDigest,
-      input.audienceHostname,
-      input.sessionData,
-      input.timing.createdAt,
-      input.timing.expiresAt
-    ));
-    return {
-      sessionId,
-      audienceHostname: input.audienceHostname,
-      expiresAt: input.timing.expiresAt
-    };
-  }
-  async readShopperSession(input) {
-    const projectId = requiredProjectId(input.projectId);
-    const sessionDigest = await opaqueDigest(requiredOpaqueValue(input.sessionId, "shopper session"));
-    const requestHostname = normalizedHostname2(input.requestHostname);
-    const now = requiredNow(input.nowSeconds);
-    const row = await this.database.prepare(
-      `SELECT session_data, audience_hostname, expires_at
-       FROM public_customer_auth_sessions
-       WHERE project_id = ? AND session_digest = ? AND audience_hostname = ?
-         AND expires_at > ?`
-    ).bind(projectId, sessionDigest, requestHostname, now).first();
-    if (!row) return null;
-    return {
-      sessionData: requiredSessionData(row.session_data),
-      audienceHostname: normalizedHostname2(row.audience_hostname),
-      expiresAt: requiredExpiry(row.expires_at, now)
-    };
-  }
-  async deleteShopperSession(input) {
-    const projectId = requiredProjectId(input.projectId);
-    const sessionDigest = await opaqueDigest(requiredOpaqueValue(input.sessionId, "shopper session"));
-    const requestHostname = normalizedHostname2(input.requestHostname);
-    const result = await this.database.prepare(
-      `DELETE FROM public_customer_auth_sessions
-       WHERE project_id = ? AND session_digest = ? AND audience_hostname = ?`
-    ).bind(projectId, sessionDigest, requestHostname).run();
-    if (result.success === false) throw new Error("The shopper session deletion failed.");
-    return result.meta?.changes === 1;
-  }
-  async requireAllowedHostname(projectId, hostname) {
-    let allowed = false;
-    try {
-      allowed = await this.hostnamePolicy({ projectId, hostname });
-    } catch {
-      throw new Error("The customer authentication hostname is not allowed for this project.");
-    }
-    if (allowed !== true) {
-      throw new Error("The customer authentication hostname is not allowed for this project.");
-    }
-  }
-};
-async function requireInsert(statement) {
-  const result = await statement.run();
-  if (result.success === false || result.meta?.changes !== void 0 && result.meta.changes !== 1) {
-    throw new Error("The customer authentication state was not stored.");
-  }
-}
-function expiration(nowSeconds, ttlSeconds, maximumTtlSeconds, label) {
-  const createdAt = requiredNow(nowSeconds);
-  if (!Number.isSafeInteger(ttlSeconds) || ttlSeconds < 1 || ttlSeconds > maximumTtlSeconds) {
-    throw new Error(`The ${label} lifetime is invalid.`);
-  }
-  return { createdAt, expiresAt: createdAt + ttlSeconds };
-}
-function requiredNow(value) {
-  const now = value ?? Math.floor(Date.now() / 1e3);
-  if (!Number.isSafeInteger(now) || now < 0) throw new Error("The current time is invalid.");
-  return now;
-}
-function requiredExpiry(value, now) {
-  if (typeof value !== "number" || !Number.isSafeInteger(value) || value <= now) {
-    throw new Error("The stored expiration is invalid.");
-  }
-  return value;
-}
-function optionalClaimedAt(value, now) {
-  if (value === null) return null;
-  if (typeof value !== "number" || !Number.isSafeInteger(value) || value < 0 || value > now) {
-    throw new Error("The customer authentication handoff claim is invalid.");
-  }
-  return value;
-}
-function requiredProjectId(value) {
-  if (!/^[A-Za-z0-9][A-Za-z0-9_-]{1,127}$/.test(value)) {
-    throw new Error("The customer authentication project is invalid.");
-  }
-  return value;
-}
-function requiredPkceVerifier(value) {
-  if (typeof value !== "string" || !/^[A-Za-z0-9._~-]{43,128}$/.test(value)) {
-    throw new Error("The PKCE verifier is invalid.");
-  }
-  return value;
-}
-function requiredSessionData(value) {
-  if (typeof value !== "string" || value.length < 1 || new TextEncoder().encode(value).byteLength > SESSION_DATA_MAX_LENGTH) {
-    throw new Error("The customer session data is invalid.");
-  }
-  return value;
-}
-function requiredClientKey(value) {
-  if (typeof value !== "string" || value.length < 1 || value.length > 512 || /[\u0000-\u001f\u007f]/.test(value)) {
-    throw new Error("The customer authentication client key is invalid.");
-  }
-  return value;
-}
-function requiredInteractionMode(value) {
-  if (value !== "interactive" && value !== "silent") {
-    throw new Error("The customer authentication interaction mode is invalid.");
-  }
-  return value;
-}
-function validAuthorizationAttemptLimit(value) {
-  return Number.isSafeInteger(value) && value >= 1 && value <= MAX_CONFIGURED_AUTHORIZATION_ATTEMPTS;
-}
-function requiredDigest(value, label) {
-  if (typeof value !== "string" || !/^[a-f0-9]{64}$/.test(value)) {
-    throw new Error(`The ${label} digest is invalid.`);
-  }
-  return value;
-}
-function requiredSessionSeal(value) {
-  if (typeof value !== "string" || value.length > SESSION_SEAL_MAX_LENGTH || !/^[A-Za-z0-9_-]{16}\.[A-Za-z0-9_-]{40,99980}$/.test(value)) {
-    throw new Error("The customer authentication session seal is invalid.");
-  }
-  return value;
-}
-function requiredOpaqueValue(value, label) {
-  if (typeof value !== "string" || !/^[A-Za-z0-9_-]{43}$/.test(value)) {
-    throw new Error(`The ${label} is invalid.`);
-  }
-  return value;
-}
-function normalizedHostname2(value) {
-  if (typeof value !== "string") throw new Error("The customer authentication hostname is invalid.");
-  const hostname = value.toLowerCase().replace(/\.$/, "");
-  if (!/^(?:[a-z0-9](?:[a-z0-9-]{0,61}[a-z0-9])?\.)+[a-z]{2,63}$/.test(hostname) || hostname.length > 253) {
-    throw new Error("The customer authentication hostname is invalid.");
-  }
-  return hostname;
-}
-function randomOpaqueValue() {
-  const bytes = crypto.getRandomValues(new Uint8Array(OPAQUE_VALUE_BYTES));
-  return base64UrlEncode(bytes);
-}
-async function opaqueDigest(value) {
-  const digest = await crypto.subtle.digest("SHA-256", new TextEncoder().encode(value));
-  return Array.from(new Uint8Array(digest), (byte) => byte.toString(16).padStart(2, "0")).join("");
-}
-async function sealPendingSessionPayload(input) {
-  const key = await handoffKey(input.handoff, ["encrypt"]);
-  const nonce = crypto.getRandomValues(new Uint8Array(12));
-  const plaintext = new TextEncoder().encode(
-    `${requiredOpaqueValue(input.sessionId, "shopper session")}
-${requiredStoredExpiry(input.sessionExpiresAt)}
-${requiredSessionData(input.sessionData)}`
-  );
-  const ciphertext = await crypto.subtle.encrypt({
-    name: "AES-GCM",
-    iv: nonce,
-    additionalData: handoffContext(input, "pending")
-  }, key, plaintext);
-  return requiredSessionSeal(`${base64UrlEncode(nonce)}.${base64UrlEncode(new Uint8Array(ciphertext))}`);
-}
-async function unsealPendingSessionPayload(input) {
-  const [encodedNonce, encodedCiphertext] = input.sessionSeal.split(".");
-  if (!encodedNonce || !encodedCiphertext) throw new Error("The customer authentication session seal is invalid.");
-  try {
-    const key = await handoffKey(input.handoff, ["decrypt"]);
-    const plaintext = await crypto.subtle.decrypt({
-      name: "AES-GCM",
-      iv: base64UrlDecode(encodedNonce),
-      additionalData: handoffContext(input, "pending")
-    }, key, base64UrlDecode(encodedCiphertext));
-    const decoded = new TextDecoder("utf-8", { fatal: true }).decode(plaintext);
-    const firstSeparator = decoded.indexOf("\n");
-    const secondSeparator = decoded.indexOf("\n", firstSeparator + 1);
-    if (firstSeparator < 0 || secondSeparator < 0) {
-      throw new Error("The customer authentication session seal is invalid.");
-    }
-    return {
-      sessionId: requiredOpaqueValue(decoded.slice(0, firstSeparator), "shopper session"),
-      sessionExpiresAt: requiredStoredExpiry(decoded.slice(firstSeparator + 1, secondSeparator)),
-      sessionData: requiredSessionData(decoded.slice(secondSeparator + 1))
-    };
-  } catch {
-    throw new Error("The customer authentication session seal is invalid.");
-  }
-}
-async function sealClaimedSessionId(input) {
-  const key = await handoffKey(input.handoff, ["encrypt"]);
-  const nonce = crypto.getRandomValues(new Uint8Array(12));
-  const ciphertext = await crypto.subtle.encrypt({
-    name: "AES-GCM",
-    iv: nonce,
-    additionalData: handoffContext(input, "claimed")
-  }, key, new TextEncoder().encode(requiredOpaqueValue(input.sessionId, "shopper session")));
-  return requiredSessionSeal(`${base64UrlEncode(nonce)}.${base64UrlEncode(new Uint8Array(ciphertext))}`);
-}
-async function unsealClaimedSessionId(input) {
-  const [encodedNonce, encodedCiphertext] = input.sessionSeal.split(".");
-  if (!encodedNonce || !encodedCiphertext) throw new Error("The customer authentication session seal is invalid.");
-  try {
-    const key = await handoffKey(input.handoff, ["decrypt"]);
-    const plaintext = await crypto.subtle.decrypt({
-      name: "AES-GCM",
-      iv: base64UrlDecode(encodedNonce),
-      additionalData: handoffContext(input, "claimed")
-    }, key, base64UrlDecode(encodedCiphertext));
-    return requiredOpaqueValue(
-      new TextDecoder("utf-8", { fatal: true }).decode(plaintext),
-      "shopper session"
-    );
-  } catch {
-    throw new Error("The customer authentication session seal is invalid.");
-  }
-}
-function requiredStoredExpiry(value) {
-  const parsed = typeof value === "number" ? value : typeof value === "string" && /^(?:0|[1-9][0-9]{0,15})$/.test(value) ? Number(value) : Number.NaN;
-  if (!Number.isSafeInteger(parsed) || parsed < 1) {
-    throw new Error("The stored expiration is invalid.");
-  }
-  return parsed;
-}
-async function handoffKey(handoff, usages) {
-  const keyMaterial = await crypto.subtle.digest(
-    "SHA-256",
-    new TextEncoder().encode(`public-customer-auth-handoff:${handoff}`)
-  );
-  return crypto.subtle.importKey("raw", keyMaterial, "AES-GCM", false, usages);
-}
-function handoffContext(input, state) {
-  return new TextEncoder().encode(
-    `${input.projectId}\0${input.returnHostname}\0${input.handoffDigest}\0${state}`
-  );
-}
-function base64UrlEncode(value) {
-  const binary = Array.from(value, (byte) => String.fromCharCode(byte)).join("");
-  return btoa(binary).replaceAll("+", "-").replaceAll("/", "_").replaceAll("=", "");
-}
-function base64UrlDecode(value) {
-  if (!/^[A-Za-z0-9_-]+$/.test(value)) throw new Error("The encoded customer authentication value is invalid.");
-  const padding = "=".repeat((4 - value.length % 4) % 4);
-  const binary = atob(value.replaceAll("-", "+").replaceAll("_", "/") + padding);
-  return Uint8Array.from(binary, (character) => character.charCodeAt(0));
-}
-
-// src/platform/customer-auth/shopify-route-adapter.ts
-var DEFAULT_LOGIN_PATH = "/auth/login";
-var DEFAULT_CALLBACK_PATH = "/auth/callback";
-var DEFAULT_HANDOFF_PATH = "/auth/handoff";
-var DEFAULT_SESSION_PATH = "/api/session";
-var DEFAULT_LOGOUT_PATH = "/auth/logout";
-var DEFAULT_POST_LOGOUT_PATH = "/auth/logout/callback";
-var DEFAULT_SIGNED_IN_PATH = "/account";
-var DEFAULT_SIGNED_OUT_PATH = "/";
-var FLOW_TTL_SECONDS = 5 * 60;
-var HANDOFF_TTL_SECONDS = 60;
-var MAX_REQUEST_URL_LENGTH = 8192;
-var MAX_FORM_BODY_BYTES = 1024;
-var MAX_COOKIE_HEADER_LENGTH = 8192;
-var MAX_DISCOVERY_BYTES = 16384;
-var MAX_TOKEN_BYTES = 65536;
-var MAX_GRAPHQL_BYTES = 65536;
-var MAX_ENDPOINT_LENGTH = 2048;
-var MAX_ACCESS_TOKEN_LENGTH = 32768;
-var MAX_ID_TOKEN_LENGTH = 16384;
-var MAX_SESSION_TTL_SECONDS = 31 * 24 * 60 * 60;
-var SHOPPER_SESSION_RECORD_TTL_SECONDS = MAX_SESSION_TTL_SECONDS;
-var PROVIDER_FETCH_TIMEOUT_MS = 1e4;
-var DEFAULT_PROVIDER_USER_AGENT = "TenderAccountsCustomerAuth/0.1";
-var PROVIDER_REDIRECT_MODE = "manual";
-var PUBLIC_CUSTOMER_AUTH_SESSION_COOKIE = "__Host-tender_accounts_session";
-var PUBLIC_CUSTOMER_AUTH_FLOW_COOKIE = "__Host-tender_accounts_auth_flow";
-var SHOPIFY_CUSTOMER_IDENTITY_QUERY = `query CustomerIdentity {
-  customer {
-    id
-    displayName
-    emailAddress {
-      emailAddress
-    }
-  }
-}`;
-function createShopifyCustomerAccountRouteAdapter(input) {
-  if (!(input.sessionStore instanceof PublicCustomerAuthSessionStore)) {
-    throw new Error("A public customer authentication session store is required.");
-  }
-  if (typeof input.hostnamePolicy !== "function") {
-    throw new Error("A public customer authentication hostname policy is required.");
-  }
-  const config = validateConfig(input.config);
-  const providerFetch = input.providerFetch ?? fetch;
-  if (typeof providerFetch !== "function") {
-    throw new Error("A Shopify provider fetch implementation is required.");
-  }
-  const authorizationClientKey = input.authorizationClientKey ?? cloudflareAuthorizationClientKey;
-  if (typeof authorizationClientKey !== "function") {
-    throw new Error("A customer authentication client-key implementation is required.");
-  }
-  const routeInput = {
-    sessionStore: input.sessionStore,
-    hostnamePolicy: input.hostnamePolicy,
-    authorizationClientKey
-  };
-  return {
-    async handle(request) {
-      try {
-        const routeUrl = parsedRequestUrl(request);
-        const route = routeFor(config, routeUrl.pathname);
-        if (!route) return null;
-        const requestUrl = validatedRequestUrl(routeUrl);
-        if (request.method !== route.method) return methodNotAllowed(route.method);
-        switch (route.name) {
-          case "login":
-            return await handleLogin({ request, requestUrl, config, input: routeInput, providerFetch });
-          case "callback":
-            return await handleCallback({ request, requestUrl, config, input: routeInput, providerFetch });
-          case "handoff":
-            return await handleHandoff({ request, requestUrl, config, input: routeInput });
-          case "session":
-            return await handleSession({ request, requestUrl, config, input: routeInput, providerFetch });
-          case "logout":
-            return await handleLogout({ request, requestUrl, config, input: routeInput });
-          case "postLogout":
-            return handlePostLogout({ requestUrl, config });
-        }
-      } catch (error) {
-        if (error instanceof SafeHttpError) return safeError(error.status, error.code);
-        if (error instanceof CustomerAuthFlowCapacityError) {
-          return safeError(429, "customer_authentication_busy");
-        }
-        if (error instanceof ProviderFailure) return safeError(502, "customer_authentication_unavailable");
-        return safeError(500, "customer_authentication_failed");
-      }
-    }
-  };
-}
-async function handleLogin(context) {
-  const callbackHostname2 = requireCallbackHostname(context.requestUrl, context.config);
-  const returnHostname = requiredSingleQueryValue(context.requestUrl, "return_host", 253);
-  const prompt = optionalSingleQueryValue(context.requestUrl, "prompt", 4, /^(?:none)$/);
-  if (!await isAllowedHostname(context.input, context.config.projectId, returnHostname)) {
-    throw new SafeHttpError(400, "invalid_return_host");
-  }
-  const verifier = randomBase64Url(32);
-  const challenge = await sha256Base64Url(verifier);
-  const flow = await context.input.sessionStore.createAuthorizationFlow({
-    projectId: context.config.projectId,
-    pkceVerifier: verifier,
-    returnHostname,
-    clientKey: await requiredAuthorizationClientKey(context.input.authorizationClientKey, context.request),
-    interactionMode: prompt === "none" ? "silent" : "interactive",
-    ttlSeconds: FLOW_TTL_SECONDS
-  });
-  let discovery;
-  try {
-    discovery = await discoverOpenId(context.config, context.providerFetch);
-  } catch (error) {
-    await context.input.sessionStore.consumeAuthorizationFlow({
-      projectId: context.config.projectId,
-      state: flow.state,
-      browserBinding: flow.browserBinding
-    });
-    throw error;
-  }
-  const authorizationUrl = new URL(discovery.authorizationEndpoint);
-  authorizationUrl.searchParams.set("scope", "openid email customer-account-api:full");
-  authorizationUrl.searchParams.set("client_id", context.config.clientId);
-  authorizationUrl.searchParams.set("response_type", "code");
-  authorizationUrl.searchParams.set("redirect_uri", callbackUrl(context.config, callbackHostname2));
-  authorizationUrl.searchParams.set("state", flow.state);
-  authorizationUrl.searchParams.set("code_challenge", challenge);
-  authorizationUrl.searchParams.set("code_challenge_method", "S256");
-  if (prompt) authorizationUrl.searchParams.set("prompt", prompt);
-  return redirectResponse(authorizationUrl.toString(), 302, {
-    "Set-Cookie": authorizationFlowCookie(flow.state, flow.browserBinding)
-  });
-}
-async function handleCallback(context) {
-  const callbackHostname2 = requireCallbackHostname(context.requestUrl, context.config);
-  const state = requiredSingleQueryValue(context.requestUrl, "state", 43, /^[A-Za-z0-9_-]{43}$/);
-  const browserBinding = readOpaqueCookie(
-    context.request.headers.get("Cookie"),
-    authorizationFlowCookieName(state)
-  );
-  if (!browserBinding) throw new SafeHttpError(400, "invalid_authorization_state");
-  if (context.requestUrl.searchParams.has("error")) {
-    const providerError = requiredSingleQueryValue(
-      context.requestUrl,
-      "error",
-      256,
-      /^[A-Za-z0-9._-]+$/
-    );
-    const deniedFlow = await context.input.sessionStore.consumeAuthorizationFlow({
-      projectId: context.config.projectId,
-      state,
-      browserBinding
-    });
-    if (!deniedFlow) throw new SafeHttpError(400, "invalid_authorization_state");
-    if (providerError === "login_required" && deniedFlow.interactionMode === "silent") {
-      const interactiveUrl = new URL(`https://${callbackHostname2}${context.config.loginPath}`);
-      interactiveUrl.searchParams.set("return_host", deniedFlow.returnHostname);
-      return handleLogin({
-        request: new Request(interactiveUrl, { headers: context.request.headers }),
-        requestUrl: interactiveUrl,
-        config: context.config,
-        input: context.input,
-        providerFetch: context.providerFetch
-      });
-    }
-    return safeError(400, "customer_authentication_denied");
-  }
-  const code = requiredSingleQueryValue(context.requestUrl, "code", 4096, /^[A-Za-z0-9._~-]+$/);
-  const flow = await context.input.sessionStore.consumeAuthorizationFlow({
-    projectId: context.config.projectId,
-    state,
-    browserBinding
-  });
-  if (!flow) throw new SafeHttpError(400, "invalid_authorization_state");
-  if (!await isAllowedHostname(context.input, context.config.projectId, flow.returnHostname)) {
-    return safeError(400, "invalid_return_host");
-  }
-  try {
-    const openId = await discoverOpenId(context.config, context.providerFetch);
-    const token = await exchangeAuthorizationCode({
-      config: context.config,
-      providerFetch: context.providerFetch,
-      tokenEndpoint: openId.tokenEndpoint,
-      code,
-      verifier: flow.pkceVerifier,
-      callbackHostname: callbackHostname2
-    });
-    const customerApi = await discoverCustomerApi(context.config, context.providerFetch);
-    const tokenIssuedAt = currentSeconds();
-    const handoff = await context.input.sessionStore.createShopperSessionHandoff({
-      projectId: context.config.projectId,
-      returnHostname: flow.returnHostname,
-      sessionData: JSON.stringify({
-        version: 1,
-        accessToken: token.accessToken,
-        idToken: token.idToken,
-        graphqlEndpoint: customerApi.graphqlEndpoint,
-        endSessionEndpoint: openId.endSessionEndpoint,
-        accessTokenExpiresAt: tokenIssuedAt + token.expiresIn
-      }),
-      sessionTtlSeconds: SHOPPER_SESSION_RECORD_TTL_SECONDS,
-      handoffTtlSeconds: Math.min(HANDOFF_TTL_SECONDS, token.expiresIn)
-    });
-    if (handoff.returnHostname === callbackHostname2) {
-      return finalizeHandoff(context, handoff.handoff, handoff.returnHostname);
-    }
-    return handoffPostResponse(context.config, handoff.returnHostname, handoff.handoff);
-  } catch (error) {
-    if (error instanceof ProviderFailure) {
-      return safeError(502, "customer_authentication_unavailable");
-    }
-    throw error;
-  }
-}
-async function handleHandoff(context) {
-  const requestHostname = normalizedHostname3(context.requestUrl.hostname);
-  if (!await isAllowedHostname(context.input, context.config.projectId, requestHostname)) {
-    throw new SafeHttpError(400, "invalid_handoff");
-  }
-  requireOrigin(context.request, [
-    `https://${context.config.canonicalHostname}`,
-    ...Array.from(context.config.additionalCallbackHostnames, (hostname) => `https://${hostname}`),
-    `https://${requestHostname}`
-  ]);
-  const form = await boundedForm(context.request);
-  const handoffValue = requiredSingleFormValue(form, "handoff", 43, /^[A-Za-z0-9_-]{43}$/);
-  if (Array.from(form.keys()).some((key) => key !== "handoff")) {
-    throw new SafeHttpError(400, "invalid_handoff");
-  }
-  return finalizeHandoff(context, handoffValue, requestHostname);
-}
-async function finalizeHandoff(context, handoffValue, requestHostname) {
-  const handoff = await context.input.sessionStore.consumeHandoff({
-    projectId: context.config.projectId,
-    handoff: handoffValue,
-    requestHostname
-  });
-  if (!handoff) throw new SafeHttpError(400, "invalid_handoff");
-  const previousSessionId = readSessionCookie(context.request.headers.get("Cookie"));
-  if (previousSessionId && previousSessionId !== handoff.sessionId) {
-    try {
-      await context.input.sessionStore.deleteShopperSession({
-        projectId: context.config.projectId,
-        sessionId: previousSessionId,
-        requestHostname
-      });
-    } catch {
-    }
-  }
-  return new Response(null, {
-    status: 303,
-    headers: secureHeaders({
-      Location: context.config.signedInPath,
-      "Set-Cookie": sessionCookie(handoff.sessionId)
-    })
-  });
-}
-async function handleSession(context) {
-  const requestHostname = normalizedHostname3(context.requestUrl.hostname);
-  if (!await isAllowedHostname(context.input, context.config.projectId, requestHostname)) {
-    throw new SafeHttpError(404, "not_found");
-  }
-  const sessionId = readSessionCookie(context.request.headers.get("Cookie"));
-  if (!sessionId) return unauthenticatedResponse(true);
-  const stored = await context.input.sessionStore.readShopperSession({
-    projectId: context.config.projectId,
-    sessionId,
-    requestHostname
-  });
-  if (!stored) return unauthenticatedResponse(true);
-  const session = parseStoredShopifySession(stored.sessionData, context.config);
-  const renewalUrl = customerRenewalUrl(context.config, requestHostname);
-  if (session.accessTokenExpiresAt <= currentSeconds()) {
-    return jsonResponse(200, {
-      authenticated: false,
-      renewalRequired: true,
-      renewalUrl
-    });
-  }
-  const response = await fetchProvider(context.providerFetch, session.graphqlEndpoint, {
-    method: "POST",
-    headers: providerRequestHeaders(context.config, {
-      Accept: "application/json",
-      Authorization: session.accessToken,
-      "Content-Type": "application/json"
-    }, providerOrigin(context.config, requestHostname)),
-    body: JSON.stringify({
-      operationName: "CustomerIdentity",
-      query: SHOPIFY_CUSTOMER_IDENTITY_QUERY,
-      variables: {}
-    }),
-    redirect: PROVIDER_REDIRECT_MODE
-  });
-  if (response.status === 401 || response.status === 403) {
-    return jsonResponse(200, {
-      authenticated: false,
-      renewalRequired: true,
-      renewalUrl
-    });
-  }
-  if (!response.ok) throw new ProviderFailure();
-  const payload = await readBoundedJson(response, MAX_GRAPHQL_BYTES);
-  const customer = parseCustomerIdentity(payload);
-  return jsonResponse(200, {
-    authenticated: true,
-    customer,
-    expiresAt: session.accessTokenExpiresAt,
-    renewalUrl
-  });
-}
-async function handleLogout(context) {
-  const requestHostname = normalizedHostname3(context.requestUrl.hostname);
-  if (!await isAllowedHostname(context.input, context.config.projectId, requestHostname)) {
-    throw new SafeHttpError(404, "not_found");
-  }
-  requireOrigin(context.request, `https://${requestHostname}`);
-  const sessionId = readSessionCookie(context.request.headers.get("Cookie"));
-  if (!sessionId) return localLogoutResponse();
-  const stored = await context.input.sessionStore.readShopperSession({
-    projectId: context.config.projectId,
-    sessionId,
-    requestHostname
-  });
-  await context.input.sessionStore.deleteShopperSession({
-    projectId: context.config.projectId,
-    sessionId,
-    requestHostname
-  });
-  if (!stored) return localLogoutResponse();
-  let session;
-  try {
-    session = parseStoredShopifySession(stored.sessionData, context.config);
-  } catch {
-    return localLogoutResponse();
-  }
-  const providerLogout = new URL(session.endSessionEndpoint);
-  providerLogout.searchParams.set("id_token_hint", session.idToken);
-  providerLogout.searchParams.set(
-    "post_logout_redirect_uri",
-    `https://${callbackHostname(context.config, requestHostname)}${context.config.postLogoutPath}`
-  );
-  return redirectResponse(providerLogout.toString(), 303, {
-    "Set-Cookie": expiredSessionCookie()
-  });
-}
-function handlePostLogout(context) {
-  requireCallbackHostname(context.requestUrl, context.config);
-  return redirectResponse(context.config.signedOutPath, 303);
-}
-function routeFor(config, pathname) {
-  if (pathname === config.loginPath) return { name: "login", method: "GET" };
-  if (pathname === config.callbackPath) return { name: "callback", method: "GET" };
-  if (pathname === config.handoffPath) return { name: "handoff", method: "POST" };
-  if (pathname === config.sessionPath) return { name: "session", method: "GET" };
-  if (pathname === config.logoutPath) return { name: "logout", method: "POST" };
-  if (pathname === config.postLogoutPath) return { name: "postLogout", method: "GET" };
-  return null;
-}
-function validateConfig(config) {
-  if (!config || typeof config !== "object") throw new Error("Customer authentication config is required.");
-  const allowedConfigKeys = /* @__PURE__ */ new Set([
-    "projectId",
-    "canonicalHostname",
-    "additionalCallbackHostnames",
-    "storefrontDomain",
-    "clientId",
-    "providerUserAgent",
-    "additionalProviderHostnames",
-    "loginPath",
-    "callbackPath",
-    "handoffPath",
-    "sessionPath",
-    "logoutPath",
-    "postLogoutPath",
-    "signedInPath",
-    "signedOutPath"
-  ]);
-  if (Object.keys(config).some((key) => !allowedConfigKeys.has(key))) {
-    throw new Error("The customer authentication config contains an unsupported field.");
-  }
-  if (!/^[A-Za-z0-9][A-Za-z0-9_-]{1,127}$/.test(config.projectId)) {
-    throw new Error("The customer authentication project is invalid.");
-  }
-  if (typeof config.clientId !== "string" || !/^[A-Za-z0-9_-]{8,256}$/.test(config.clientId)) {
-    throw new Error("The Shopify Customer Account client ID is invalid.");
-  }
-  const canonicalHostname = normalizedHostname3(config.canonicalHostname);
-  const additionalCallbackHostnames = validatedHostnameSet(
-    config.additionalCallbackHostnames,
-    "Shopify callback hostname allowlist"
-  );
-  additionalCallbackHostnames.delete(canonicalHostname);
-  const storefrontDomain = normalizedHostname3(config.storefrontDomain);
-  const providerUserAgent = config.providerUserAgent ?? DEFAULT_PROVIDER_USER_AGENT;
-  if (typeof providerUserAgent !== "string" || providerUserAgent.length < 3 || providerUserAgent.length > 128 || /[^\u0020-\u007e]/.test(providerUserAgent)) {
-    throw new Error("The Shopify provider User-Agent is invalid.");
-  }
-  const additionalProviderHostnames = /* @__PURE__ */ new Set();
-  if (config.additionalProviderHostnames !== void 0) {
-    if (!Array.isArray(config.additionalProviderHostnames) || config.additionalProviderHostnames.length > 8) {
-      throw new Error("The Shopify provider hostname allowlist is invalid.");
-    }
-    for (const hostname of config.additionalProviderHostnames) {
-      additionalProviderHostnames.add(normalizedHostname3(hostname));
-    }
-  }
-  const routePaths = {
-    loginPath: validatedPath(config.loginPath ?? DEFAULT_LOGIN_PATH, "login"),
-    callbackPath: validatedPath(config.callbackPath ?? DEFAULT_CALLBACK_PATH, "callback"),
-    handoffPath: validatedPath(config.handoffPath ?? DEFAULT_HANDOFF_PATH, "handoff"),
-    sessionPath: validatedPath(config.sessionPath ?? DEFAULT_SESSION_PATH, "session"),
-    logoutPath: validatedPath(config.logoutPath ?? DEFAULT_LOGOUT_PATH, "logout"),
-    postLogoutPath: validatedPath(config.postLogoutPath ?? DEFAULT_POST_LOGOUT_PATH, "post-logout")
-  };
-  if (new Set(Object.values(routePaths)).size !== Object.keys(routePaths).length) {
-    throw new Error("Customer authentication route paths must be distinct.");
-  }
-  const signedInPath = validatedPath(config.signedInPath ?? DEFAULT_SIGNED_IN_PATH, "signed-in");
-  const signedOutPath = validatedPath(config.signedOutPath ?? DEFAULT_SIGNED_OUT_PATH, "signed-out");
-  if (signedOutPath === routePaths.postLogoutPath) {
-    throw new Error("The signed-out path cannot be the post-logout callback path.");
-  }
-  return {
-    projectId: config.projectId,
-    canonicalHostname,
-    additionalCallbackHostnames,
-    storefrontDomain,
-    clientId: config.clientId,
-    providerUserAgent,
-    additionalProviderHostnames,
-    ...routePaths,
-    signedInPath,
-    signedOutPath
-  };
-}
-function parsedRequestUrl(request) {
-  if (!(request instanceof Request) || request.url.length > MAX_REQUEST_URL_LENGTH) {
-    throw new SafeHttpError(400, "invalid_request");
-  }
-  try {
-    return new URL(request.url);
-  } catch {
-    throw new SafeHttpError(400, "invalid_request");
-  }
-}
-function validatedRequestUrl(url) {
-  if (url.protocol !== "https:" || url.username || url.password || url.port) {
-    throw new SafeHttpError(400, "invalid_request");
-  }
-  normalizedHostname3(url.hostname);
-  return url;
-}
-function validatedPath(value, label) {
-  if (typeof value !== "string" || !/^\/[A-Za-z0-9/_-]{0,127}$/.test(value) || value.includes("//")) {
-    throw new Error(`The customer authentication ${label} path is invalid.`);
-  }
-  return value;
-}
-function callbackUrl(config, hostname = config.canonicalHostname) {
-  return `https://${hostname}${config.callbackPath}`;
-}
-function customerRenewalUrl(config, returnHostname) {
-  return `https://${callbackHostname(config, returnHostname)}${config.loginPath}?return_host=${encodeURIComponent(returnHostname)}&prompt=none`;
-}
-function currentSeconds() {
-  return Math.floor(Date.now() / 1e3);
-}
-function requireCallbackHostname(url, config) {
-  const hostname = normalizedHostname3(url.hostname);
-  if (callbackHostname(config, hostname) !== hostname) {
-    throw new SafeHttpError(404, "not_found");
-  }
-  return hostname;
-}
-function callbackHostname(config, hostname) {
-  return hostname === config.canonicalHostname || config.additionalCallbackHostnames.has(hostname) ? hostname : config.canonicalHostname;
-}
-async function isAllowedHostname(input, projectId, hostnameValue) {
-  let hostname;
-  try {
-    hostname = normalizedHostname3(hostnameValue);
-  } catch {
-    return false;
-  }
-  try {
-    return await input.hostnamePolicy({ projectId, hostname }) === true;
-  } catch {
-    return false;
-  }
-}
-async function discoverOpenId(config, providerFetch) {
-  const response = await fetchProvider(
-    providerFetch,
-    `https://${config.storefrontDomain}/.well-known/openid-configuration`,
-    {
-      method: "GET",
-      headers: providerRequestHeaders(config, { Accept: "application/json" }),
-      redirect: PROVIDER_REDIRECT_MODE
-    }
-  );
-  if (!response.ok) throw new ProviderFailure();
-  const value = objectValue(await readBoundedJson(response, MAX_DISCOVERY_BYTES));
-  return {
-    authorizationEndpoint: providerEndpoint(value.authorization_endpoint, config),
-    tokenEndpoint: providerEndpoint(value.token_endpoint, config),
-    endSessionEndpoint: providerEndpoint(value.end_session_endpoint, config)
-  };
-}
-async function discoverCustomerApi(config, providerFetch) {
-  const response = await fetchProvider(
-    providerFetch,
-    `https://${config.storefrontDomain}/.well-known/customer-account-api`,
-    {
-      method: "GET",
-      headers: providerRequestHeaders(config, { Accept: "application/json" }),
-      redirect: PROVIDER_REDIRECT_MODE
-    }
-  );
-  if (!response.ok) throw new ProviderFailure();
-  const value = objectValue(await readBoundedJson(response, MAX_DISCOVERY_BYTES));
-  return { graphqlEndpoint: providerEndpoint(value.graphql_api, config) };
-}
-async function exchangeAuthorizationCode(input) {
-  const response = await fetchProvider(input.providerFetch, input.tokenEndpoint, {
-    method: "POST",
-    headers: providerRequestHeaders(input.config, {
-      Accept: "application/json",
-      "Content-Type": "application/x-www-form-urlencoded"
-    }, `https://${input.callbackHostname}`),
-    body: new URLSearchParams({
-      grant_type: "authorization_code",
-      client_id: input.config.clientId,
-      redirect_uri: callbackUrl(input.config, input.callbackHostname),
-      code: input.code,
-      code_verifier: input.verifier
-    }),
-    redirect: PROVIDER_REDIRECT_MODE
-  });
-  if (!response.ok) throw new ProviderFailure();
-  const value = objectValue(await readBoundedJson(response, MAX_TOKEN_BYTES));
-  if (typeof value.access_token !== "string" || value.access_token.length < 1 || value.access_token.length > MAX_ACCESS_TOKEN_LENGTH || /[\u0000-\u001f\u007f]/.test(value.access_token)) {
-    throw new ProviderFailure();
-  }
-  if (!Number.isSafeInteger(value.expires_in) || value.expires_in < 1 || value.expires_in > MAX_SESSION_TTL_SECONDS) {
-    throw new ProviderFailure();
-  }
-  return {
-    accessToken: value.access_token,
-    idToken: requiredIdToken(value.id_token),
-    expiresIn: value.expires_in
-  };
-}
-function providerRequestHeaders(config, values, origin = `https://${config.canonicalHostname}`) {
-  const headers = new Headers(values);
-  headers.set("Origin", origin);
-  headers.set("User-Agent", config.providerUserAgent);
-  return headers;
-}
-function providerEndpoint(value, config) {
-  if (typeof value !== "string" || value.length < 1 || value.length > MAX_ENDPOINT_LENGTH) {
-    throw new ProviderFailure();
-  }
-  let url;
-  try {
-    url = new URL(value);
-  } catch {
-    throw new ProviderFailure();
-  }
-  if (url.protocol !== "https:" || url.username || url.password || url.hash || url.port && url.port !== "443") {
-    throw new ProviderFailure();
-  }
-  let hostname;
-  try {
-    hostname = normalizedHostname3(url.hostname);
-  } catch {
-    throw new ProviderFailure();
-  }
-  if (!isSameOrSubdomain(hostname, config.storefrontDomain) && !isSameOrSubdomain(hostname, "shopify.com") && !isSameOrSubdomain(hostname, "myshopify.com") && !config.additionalProviderHostnames.has(hostname)) {
-    throw new ProviderFailure();
-  }
-  return url.toString();
-}
-function parseStoredShopifySession(value, config) {
-  if (typeof value !== "string" || value.length > 65536) throw new ProviderFailure();
-  let parsed;
-  try {
-    parsed = JSON.parse(value);
-  } catch {
-    throw new ProviderFailure();
-  }
-  const object = objectValue(parsed);
-  if (object.version !== 1 || typeof object.accessToken !== "string" || object.accessToken.length < 1 || object.accessToken.length > MAX_ACCESS_TOKEN_LENGTH || /[\u0000-\u001f\u007f]/.test(object.accessToken)) {
-    throw new ProviderFailure();
-  }
-  return {
-    version: 1,
-    accessToken: object.accessToken,
-    idToken: requiredIdToken(object.idToken),
-    graphqlEndpoint: providerEndpoint(object.graphqlEndpoint, config),
-    endSessionEndpoint: providerEndpoint(object.endSessionEndpoint, config),
-    accessTokenExpiresAt: requiredStoredExpiry2(object.accessTokenExpiresAt)
-  };
-}
-function requiredIdToken(value) {
-  if (typeof value !== "string" || value.length < 3 || value.length > MAX_ID_TOKEN_LENGTH || !/^[A-Za-z0-9_-]+\.[A-Za-z0-9_-]+\.[A-Za-z0-9_-]+$/.test(value)) {
-    throw new ProviderFailure();
-  }
-  return value;
-}
-function requiredStoredExpiry2(value) {
-  if (typeof value !== "number" || !Number.isSafeInteger(value) || value < 1) {
-    throw new ProviderFailure();
-  }
-  return value;
-}
-function parseCustomerIdentity(value) {
-  const root = objectValue(value);
-  if (root.errors !== void 0 || !root.data) throw new ProviderFailure();
-  const data = objectValue(root.data);
-  const customer = objectValue(data.customer);
-  const id = boundedString(customer.id, 512);
-  const displayName = boundedString(customer.displayName, 1024);
-  let emailAddress = null;
-  if (customer.emailAddress !== null && customer.emailAddress !== void 0) {
-    const email = objectValue(customer.emailAddress);
-    emailAddress = { emailAddress: boundedString(email.emailAddress, 2048) };
-  }
-  return { id, displayName, emailAddress };
-}
-async function fetchProvider(providerFetch, input, init) {
-  try {
-    return await providerFetch(input, {
-      ...init,
-      signal: AbortSignal.timeout(PROVIDER_FETCH_TIMEOUT_MS)
-    });
-  } catch {
-    throw new ProviderFailure();
-  }
-}
-async function readBoundedJson(response, maximumBytes) {
-  const contentType = response.headers.get("Content-Type")?.split(";", 1)[0]?.trim().toLowerCase();
-  if (contentType !== "application/json" && !contentType?.endsWith("+json")) throw new ProviderFailure();
-  const contentLength = response.headers.get("Content-Length");
-  if (contentLength && (!/^\d+$/.test(contentLength) || Number(contentLength) > maximumBytes)) {
-    throw new ProviderFailure();
-  }
-  if (!response.body) throw new ProviderFailure();
-  const reader = response.body.getReader();
-  const decoder = new TextDecoder("utf-8", { fatal: true });
-  let bytesRead = 0;
-  let text = "";
-  try {
-    while (true) {
-      const result = await reader.read();
-      if (result.done) break;
-      bytesRead += result.value.byteLength;
-      if (bytesRead > maximumBytes) throw new ProviderFailure();
-      text += decoder.decode(result.value, { stream: true });
-    }
-    text += decoder.decode();
-  } catch (error) {
-    if (error instanceof ProviderFailure) throw error;
-    throw new ProviderFailure();
-  }
-  try {
-    return JSON.parse(text);
-  } catch {
-    throw new ProviderFailure();
-  }
-}
-async function boundedForm(request) {
-  const contentType = request.headers.get("Content-Type")?.split(";", 1)[0]?.trim().toLowerCase();
-  if (contentType !== "application/x-www-form-urlencoded") {
-    throw new SafeHttpError(400, "invalid_handoff");
-  }
-  const contentLength = request.headers.get("Content-Length");
-  if (contentLength && (!/^\d+$/.test(contentLength) || Number(contentLength) > MAX_FORM_BODY_BYTES)) {
-    throw new SafeHttpError(400, "invalid_handoff");
-  }
-  if (!request.body) throw new SafeHttpError(400, "invalid_handoff");
-  const reader = request.body.getReader();
-  const chunks = [];
-  let byteLength = 0;
-  try {
-    while (true) {
-      const result = await reader.read();
-      if (result.done) break;
-      byteLength += result.value.byteLength;
-      if (byteLength > MAX_FORM_BODY_BYTES) {
-        await reader.cancel();
-        throw new SafeHttpError(400, "invalid_handoff");
-      }
-      chunks.push(result.value);
-    }
-  } catch (error) {
-    if (error instanceof SafeHttpError) throw error;
-    throw new SafeHttpError(400, "invalid_handoff");
-  }
-  const bodyBytes = new Uint8Array(byteLength);
-  let offset = 0;
-  for (const chunk of chunks) {
-    bodyBytes.set(chunk, offset);
-    offset += chunk.byteLength;
-  }
-  let body;
-  try {
-    body = new TextDecoder("utf-8", { fatal: true }).decode(bodyBytes);
-  } catch {
-    throw new SafeHttpError(400, "invalid_handoff");
-  }
-  return new URLSearchParams(body);
-}
-function requiredSingleQueryValue(url, name, maximumLength, pattern) {
-  const values = url.searchParams.getAll(name);
-  if (values.length !== 1 || values[0].length < 1 || values[0].length > maximumLength || pattern && !pattern.test(values[0])) {
-    throw new SafeHttpError(400, "invalid_request");
-  }
-  return values[0];
-}
-function optionalSingleQueryValue(url, name, maximumLength, pattern) {
-  const values = url.searchParams.getAll(name);
-  if (values.length === 0) return null;
-  if (values.length !== 1 || values[0].length < 1 || values[0].length > maximumLength || !pattern.test(values[0])) {
-    throw new SafeHttpError(400, "invalid_request");
-  }
-  return values[0];
-}
-function requiredSingleFormValue(form, name, maximumLength, pattern) {
-  const values = form.getAll(name);
-  if (values.length !== 1 || values[0].length < 1 || values[0].length > maximumLength || !pattern.test(values[0])) {
-    throw new SafeHttpError(400, "invalid_handoff");
-  }
-  return values[0];
-}
-function readSessionCookie(cookieHeader) {
-  return readOpaqueCookie(cookieHeader, PUBLIC_CUSTOMER_AUTH_SESSION_COOKIE);
-}
-function readOpaqueCookie(cookieHeader, expectedName) {
-  if (!cookieHeader || cookieHeader.length > MAX_COOKIE_HEADER_LENGTH) return null;
-  const matches = [];
-  for (const part of cookieHeader.split(";")) {
-    const separator = part.indexOf("=");
-    if (separator < 1) continue;
-    const name = part.slice(0, separator).trim();
-    if (name === expectedName) {
-      matches.push(part.slice(separator + 1).trim());
-    }
-  }
-  if (matches.length !== 1 || !/^[A-Za-z0-9_-]{43}$/.test(matches[0])) return null;
-  return matches[0];
-}
-async function requiredAuthorizationClientKey(resolver, request) {
-  try {
-    const key = await resolver(request);
-    if (typeof key !== "string" || key.length < 1 || key.length > 512 || /[\u0000-\u001f\u007f]/.test(key)) {
-      throw new Error("invalid");
-    }
-    return key;
-  } catch {
-    throw new SafeHttpError(503, "customer_authentication_unavailable");
-  }
-}
-function cloudflareAuthorizationClientKey(request) {
-  const address = request.headers.get("CF-Connecting-IP")?.trim().toLowerCase();
-  if (!address || address.length > 64 || !/^[0-9a-f:.]+$/.test(address)) {
-    throw new Error("The client address is unavailable.");
-  }
-  return `cloudflare-ip:${address}`;
-}
-function requireOrigin(request, expectedOrigin) {
-  const expectedOrigins = typeof expectedOrigin === "string" ? [expectedOrigin] : expectedOrigin;
-  if (!expectedOrigins.includes(request.headers.get("Origin") ?? "")) {
-    throw new SafeHttpError(403, "invalid_origin");
-  }
-}
-function providerOrigin(config, requestHostname) {
-  return `https://${callbackHostname(config, requestHostname)}`;
-}
-function validatedHostnameSet(value, label) {
-  if (value === void 0) return /* @__PURE__ */ new Set();
-  if (!Array.isArray(value) || value.length > 8) throw new Error(`The ${label} is invalid.`);
-  return new Set(value.map(normalizedHostname3));
-}
-function normalizedHostname3(value) {
-  if (typeof value !== "string") throw new Error("The customer authentication hostname is invalid.");
-  const hostname = value.toLowerCase().replace(/\.$/, "");
-  if (!/^(?:[a-z0-9](?:[a-z0-9-]{0,61}[a-z0-9])?\.)+[a-z]{2,63}$/.test(hostname) || hostname.length > 253) {
-    throw new Error("The customer authentication hostname is invalid.");
-  }
-  return hostname;
-}
-function isSameOrSubdomain(hostname, parent) {
-  return hostname === parent || hostname.endsWith(`.${parent}`);
-}
-function objectValue(value) {
-  if (!value || typeof value !== "object" || Array.isArray(value)) throw new ProviderFailure();
-  return value;
-}
-function boundedString(value, maximumLength) {
-  if (typeof value !== "string" || value.length > maximumLength) throw new ProviderFailure();
-  return value;
-}
-function randomBase64Url(bytes) {
-  const value = crypto.getRandomValues(new Uint8Array(bytes));
-  return base64Url(value);
-}
-async function sha256Base64Url(value) {
-  const digest = await crypto.subtle.digest("SHA-256", new TextEncoder().encode(value));
-  return base64Url(new Uint8Array(digest));
-}
-function base64Url(value) {
-  const binary = Array.from(value, (byte) => String.fromCharCode(byte)).join("");
-  return btoa(binary).replaceAll("+", "-").replaceAll("/", "_").replaceAll("=", "");
-}
-function handoffPostResponse(config, returnHostname, handoff) {
-  const action = `https://${returnHostname}${config.handoffPath}`;
-  const nonce = randomBase64Url(18);
-  const html = `<!doctype html>
-<html lang="en">
-<head><meta charset="utf-8"><meta name="referrer" content="no-referrer"><title>Signing in</title></head>
-<body>
-<form id="customer-auth-handoff" method="post" action="${escapeHtml(action)}">
-<input type="hidden" name="handoff" value="${escapeHtml(handoff)}">
-<noscript><button type="submit">Continue</button></noscript>
-</form>
-<script nonce="${nonce}">document.getElementById("customer-auth-handoff").requestSubmit();</script>
-</body>
-</html>`;
-  return new Response(html, {
-    status: 200,
-    headers: secureHeaders({
-      "Content-Type": "text/html; charset=utf-8",
-      "Content-Security-Policy": `default-src 'none'; base-uri 'none'; frame-ancestors 'none'; form-action https://${returnHostname}; script-src 'nonce-${nonce}'`,
-      "Referrer-Policy": "no-referrer"
-    })
-  });
-}
-function escapeHtml(value) {
-  return value.replaceAll("&", "&amp;").replaceAll('"', "&quot;").replaceAll("<", "&lt;").replaceAll(">", "&gt;");
-}
-function sessionCookie(sessionId) {
-  return `${PUBLIC_CUSTOMER_AUTH_SESSION_COOKIE}=${sessionId}; Path=/; Secure; HttpOnly; SameSite=Lax`;
-}
-function authorizationFlowCookie(state, browserBinding) {
-  return `${authorizationFlowCookieName(state)}=${browserBinding}; Max-Age=${FLOW_TTL_SECONDS}; Path=/; Secure; HttpOnly; SameSite=Lax`;
-}
-function authorizationFlowCookieName(state) {
-  if (!/^[A-Za-z0-9_-]{43}$/.test(state)) {
-    throw new Error("The customer authentication state is invalid.");
-  }
-  return `${PUBLIC_CUSTOMER_AUTH_FLOW_COOKIE}_${state}`;
-}
-function expiredSessionCookie() {
-  return `${PUBLIC_CUSTOMER_AUTH_SESSION_COOKIE}=; Path=/; Secure; HttpOnly; SameSite=Lax; Max-Age=0`;
-}
-function localLogoutResponse() {
-  return new Response(null, {
-    status: 204,
-    headers: secureHeaders({ "Set-Cookie": expiredSessionCookie() })
-  });
-}
-function unauthenticatedResponse(clearCookie) {
-  return jsonResponse(200, { authenticated: false }, clearCookie ? { "Set-Cookie": expiredSessionCookie() } : void 0);
-}
-function jsonResponse(status, value, headers) {
-  return new Response(JSON.stringify(value), {
-    status,
-    headers: secureHeaders({ "Content-Type": "application/json; charset=utf-8", ...headers })
-  });
-}
-function safeError(status, code, headers) {
-  return jsonResponse(status, { error: code }, headers);
-}
-function redirectResponse(location, status, headers) {
-  const responseHeaders = new Headers(headers);
-  responseHeaders.set("Location", location);
-  return new Response(null, {
-    status,
-    headers: secureHeaders(responseHeaders)
-  });
-}
-function methodNotAllowed(method) {
-  return jsonResponse(405, { error: "method_not_allowed" }, { Allow: method });
-}
-function secureHeaders(extra) {
-  const headers = new Headers(extra);
-  headers.set("Cache-Control", "no-store");
-  headers.set("Referrer-Policy", "no-referrer");
-  headers.set("X-Content-Type-Options", "nosniff");
-  return headers;
-}
-var SafeHttpError = class extends Error {
-  constructor(status, code) {
-    super(code);
-    this.status = status;
-    this.code = code;
-  }
-  status;
-  code;
-};
-var ProviderFailure = class extends Error {
-};
-
-// src/portal-service.ts
-var FORWARDED_HEADERS = [
-  "accept",
-  "accept-language",
-  "cache-control",
-  "if-modified-since",
-  "if-none-match",
-  "if-range",
-  "pragma",
-  "range",
-  "user-agent"
-];
-var PORTAL_CONTENT_SECURITY_POLICY = [
-  "default-src 'self'",
-  "base-uri 'none'",
-  "connect-src 'self'",
-  "frame-ancestors 'none'",
-  "img-src 'self' data:",
-  "object-src 'none'",
-  "script-src 'self'",
-  "style-src 'self'"
-].join("; ");
-async function forwardPortalRequest(request, portal) {
-  if (!portal || typeof portal.fetch !== "function") return gatewayError(503, "portal_ui_unavailable");
-  try {
-    const response = await portal.fetch(portalRequest(request));
-    const headers = new Headers(response.headers);
-    for (const name of [...headers.keys()]) {
-      const normalized = name.toLowerCase();
-      if (normalized === "set-cookie" || normalized === "set-cookie2" || normalized === "clear-site-data" || normalized.startsWith("cf-") || normalized.startsWith("cloudflare-") || normalized.startsWith("x-tender-")) {
-        headers.delete(name);
-      }
-    }
-    headers.set("Content-Security-Policy", PORTAL_CONTENT_SECURITY_POLICY);
-    headers.set("Permissions-Policy", "camera=(), geolocation=(), microphone=(), payment=()");
-    headers.set("Referrer-Policy", "strict-origin-when-cross-origin");
-    headers.set("X-Content-Type-Options", "nosniff");
-    headers.set("X-Frame-Options", "DENY");
-    return new Response(request.method === "HEAD" ? null : response.body, {
-      status: response.status,
-      statusText: response.statusText,
-      headers
-    });
-  } catch {
-    return gatewayError(502, "portal_ui_failed");
-  }
-}
-function portalRequest(request) {
-  const headers = new Headers();
-  for (const name of FORWARDED_HEADERS) {
-    const value = request.headers.get(name);
-    if (value !== null) headers.set(name, value);
-  }
-  return new Request(request.url, { method: request.method, headers, redirect: "manual" });
-}
-function gatewayError(status, code) {
-  return Response.json({ error: { code } }, {
-    status,
-    headers: {
-      "Cache-Control": "no-store",
-      "Content-Security-Policy": "default-src 'none'; frame-ancestors 'none'",
-      "Referrer-Policy": "no-referrer",
-      "X-Content-Type-Options": "nosniff"
-    }
-  });
-}
-
-// src/runtime-config.ts
-var PUBLIC_CLIENT_ID = /^[A-Za-z0-9_-]{8,256}$/u;
-var RUNTIME_ID = /^[A-Za-z0-9][A-Za-z0-9_-]{1,127}$/u;
-var HOSTNAME = /^(?:[a-z0-9](?:[a-z0-9-]{0,61}[a-z0-9])?\.)+[a-z]{2,63}$/u;
-function readRuntimeConfig(env) {
-  const tenantId = requiredMatch(env.ACCOUNT_TENANT_ID, RUNTIME_ID, "tenant identity");
-  const projectId = requiredMatch(env.ACCOUNT_PROJECT_ID, RUNTIME_ID, "project identity");
-  const runtimeBaseDomain = requiredHostname(env.ACCOUNT_RUNTIME_BASE_DOMAIN, "runtime base domain");
-  return {
-    tenantId,
-    projectId,
-    runtimeBaseDomain,
-    canonicalHostname: canonicalApplicationHostname({ tenantId, projectId, baseDomain: runtimeBaseDomain }),
-    storefrontDomain: requiredHostname(env.SHOPIFY_STOREFRONT_DOMAIN, "Shopify storefront domain"),
-    customerAccountClientId: requiredMatch(
-      env.SHOPIFY_CUSTOMER_ACCOUNT_CLIENT_ID,
-      PUBLIC_CLIENT_ID,
-      "Shopify public customer-account client ID"
-    ),
-    customerAccountDomain: requiredHostname(env.SHOPIFY_CUSTOMER_ACCOUNT_DOMAIN, "Shopify customer-account domain"),
-    vanityHostnames: optionalHostnameList(env.ACCOUNT_VANITY_HOSTNAMES)
-  };
-}
-function optionalHostnameList(value) {
-  if (value === void 0) return [];
-  if (value.trim() === "") return [];
-  const hostnames = [...new Set(value.split(",").map((hostname) => requiredHostname(hostname, "vanity hostname")))];
-  if (hostnames.length > 8) throw new Error("Too many vanity hostnames are configured.");
-  return hostnames;
-}
-function requiredHostname(value, label) {
-  const hostname = value.trim().toLowerCase().replace(/\.$/u, "");
-  if (!HOSTNAME.test(hostname)) throw new Error(`The ${label} is invalid.`);
-  return hostname;
-}
-function requiredMatch(value, pattern, label) {
-  const normalized = value.trim();
-  if (!pattern.test(normalized)) throw new Error(`The ${label} is invalid.`);
-  return normalized;
-}
-
-// src/worker.ts
-var LOOPBACK_HOSTNAMES = /* @__PURE__ */ new Set(["localhost", "127.0.0.1", "[::1]"]);
-var worker_default = {
-  async fetch(request, env) {
-    let config;
-    try {
-      config = readRuntimeConfig(env);
-    } catch {
-      return jsonResponse2(503, "application_not_configured");
-    }
-    const url = new URL(request.url);
-    if (request.method === "GET" && url.pathname === "/api/health") {
-      return Response.json({ ok: true, service: "shopify-customer-account-gateway" });
-    }
-    const localDevelopment = (url.protocol === "http:" || url.protocol === "https:") && LOOPBACK_HOSTNAMES.has(url.hostname.toLowerCase());
-    if (localDevelopment && request.method === "GET" && url.pathname === "/api/bootstrap") {
-      return Response.json({ canonicalHostname: config.canonicalHostname, loginUrl: null, localDevelopment: true });
-    }
-    if (localDevelopment && request.method === "GET" && url.pathname === "/api/session") {
-      return Response.json({ authenticated: false, localDevelopment: true });
-    }
-    if (localDevelopment && url.pathname.startsWith("/auth/")) {
-      return jsonResponse2(409, "authentication_requires_https_preview");
-    }
-    const hostnamePolicy = createTenderRuntimeHostnamePolicy({
-      tenantId: config.tenantId,
-      projectId: config.projectId,
-      baseDomain: config.runtimeBaseDomain,
-      additionalHostnames: config.vanityHostnames
-    });
-    const auth = createShopifyCustomerAccountRouteAdapter({
-      config: {
-        projectId: config.projectId,
-        canonicalHostname: config.canonicalHostname,
-        additionalCallbackHostnames: config.vanityHostnames,
-        storefrontDomain: config.storefrontDomain,
-        clientId: config.customerAccountClientId,
-        additionalProviderHostnames: [config.customerAccountDomain]
-      },
-      sessionStore: new PublicCustomerAuthSessionStore(env.APP_DB, hostnamePolicy),
-      hostnamePolicy
-    });
-    const authResponse = await auth.handle(request);
-    if (authResponse) return authResponse;
-    if (request.method === "GET" && url.pathname === "/api/bootstrap") {
-      const hostname = url.hostname.toLowerCase().replace(/\.$/u, "");
-      if (!await hostnamePolicy({ projectId: config.projectId, hostname })) return jsonResponse2(404, "not_found");
-      const loginHostname = config.vanityHostnames.includes(hostname) ? hostname : config.canonicalHostname;
-      const loginUrl = new URL(`https://${loginHostname}/auth/login`);
-      loginUrl.searchParams.set("return_host", hostname);
-      return Response.json({ canonicalHostname: config.canonicalHostname, loginUrl: loginUrl.toString() });
-    }
-    if (url.pathname.startsWith("/api/") || url.pathname.startsWith("/auth/")) return jsonResponse2(404, "not_found");
-    if (request.method !== "GET" && request.method !== "HEAD") {
-      return new Response(null, { status: 405, headers: { Allow: "GET, HEAD" } });
-    }
-    return await forwardPortalRequest(request, env.PORTAL_UI);
-  }
-};
-function jsonResponse2(status, code) {
-  return Response.json({ error: { code } }, {
-    status,
-    headers: {
-      "Cache-Control": "no-store",
-      "Content-Security-Policy": "default-src 'none'; frame-ancestors 'none'",
-      "Referrer-Policy": "no-referrer",
-      "X-Content-Type-Options": "nosniff"
-    }
-  });
-}
-export {
-  worker_default as default
-};