@decocms/apps-shopify 8.1.0-next.1 → 8.1.0-next.2

package/dist/client.d.ts

@@ -0,0 +1,36 @@
+export interface ShopifyClientConfig {
+    /** The store's subdomain: "acme" for acme.myshopify.com. */
+    storeName: string;
+    /** Storefront API access token. */
+    storefrontAccessToken: string;
+    /** Admin API access token; `admin` is only available when it's set. */
+    adminAccessToken?: string;
+    /** The Shopify API version, e.g. "2026-07". The site owns it, so there is no default to go stale. */
+    apiVersion: string;
+}
+interface ShopifyRequestOptions {
+    /** Extra request headers, e.g. `Shopify-Storefront-Buyer-IP`. */
+    headers?: Record<string, string>;
+    signal?: AbortSignal;
+}
+/** One GraphQL endpoint: send a document, get its `data` back. */
+interface ShopifyGraphQL {
+    query<T, V extends Record<string, unknown> = Record<string, unknown>>(document: string, variables?: V, options?: ShopifyRequestOptions): Promise<T>;
+}
+export interface ShopifyClient {
+    storefront: ShopifyGraphQL;
+    /** Throws when called without `adminAccessToken` in the config. */
+    admin: ShopifyGraphQL;
+}
+/** A failed request. Carries the operation, the HTTP status and Shopify's error codes; never bodies or tokens. */
+export declare class ShopifyError extends Error {
+    readonly operation: string;
+    readonly status: number;
+    readonly codes: string[];
+    constructor(operation: string, status: number, codes?: string[]);
+}
+export declare function createShopifyClient(config: ShopifyClientConfig, options?: {
+    fetch?: typeof globalThis.fetch;
+}): ShopifyClient;
+export {};
+//# sourceMappingURL=client.d.ts.map

package/dist/client.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"client.d.ts","sourceRoot":"","sources":["../src/client.ts"],"names":[],"mappings":"AAeA,MAAM,WAAW,mBAAmB;IAClC,4DAA4D;IAC5D,SAAS,EAAE,MAAM,CAAC;IAClB,mCAAmC;IACnC,qBAAqB,EAAE,MAAM,CAAC;IAC9B,uEAAuE;IACvE,gBAAgB,CAAC,EAAE,MAAM,CAAC;IAC1B,qGAAqG;IACrG,UAAU,EAAE,MAAM,CAAC;CACpB;AAED,UAAU,qBAAqB;IAC7B,iEAAiE;IACjE,OAAO,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IACjC,MAAM,CAAC,EAAE,WAAW,CAAC;CACtB;AAED,kEAAkE;AAClE,UAAU,cAAc;IACtB,KAAK,CAAC,CAAC,EAAE,CAAC,SAAS,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,EAClE,QAAQ,EAAE,MAAM,EAChB,SAAS,CAAC,EAAE,CAAC,EACb,OAAO,CAAC,EAAE,qBAAqB,GAC9B,OAAO,CAAC,CAAC,CAAC,CAAC;CACf;AAED,MAAM,WAAW,aAAa;IAC5B,UAAU,EAAE,cAAc,CAAC;IAC3B,mEAAmE;IACnE,KAAK,EAAE,cAAc,CAAC;CACvB;AAED,kHAAkH;AAClH,qBAAa,YAAa,SAAQ,KAAK;IAEnC,QAAQ,CAAC,SAAS,EAAE,MAAM;IAC1B,QAAQ,CAAC,MAAM,EAAE,MAAM;IACvB,QAAQ,CAAC,KAAK,EAAE,MAAM,EAAE;IAH1B,YACW,SAAS,EAAE,MAAM,EACjB,MAAM,EAAE,MAAM,EACd,KAAK,GAAE,MAAM,EAAO,EAQ9B;CACF;AAED,wBAAgB,mBAAmB,CACjC,MAAM,EAAE,mBAAmB,EAC3B,OAAO,GAAE;IAAE,KAAK,CAAC,EAAE,OAAO,UAAU,CAAC,KAAK,CAAA;CAAO,GAChD,aAAa,CA0Df"}

package/dist/client.js

@@ -0,0 +1,82 @@
+/**
+ * The Shopify upstream client (/next/upstream-clients): the Storefront and
+ * Admin GraphQL APIs over the framework's instrumented fetch, and nothing
+ * else. Converters to commerce types, cart and customer flows, hooks and
+ * loaders live in the Shopify platform template and site code.
+ *
+ * Every request is measured as provider "shopify", labeled with the GraphQL
+ * operation's own name (`query ProductByHandle { … }` → "ProductByHandle"),
+ * or "storefront.graphql" / "admin.graphql" for an unnamed document. Retries
+ * and the circuit breaker stay off, as for every client but VTEX's; caching
+ * is the site's job.
+ */
+import { createInstrumentedFetch } from "@decocms/blocks/fetch";
+import { extractGraphqlOperationName } from "./graphqlOperationName.js";
+/** A failed request. Carries the operation, the HTTP status and Shopify's error codes; never bodies or tokens. */
+export class ShopifyError extends Error {
+    operation;
+    status;
+    codes;
+    constructor(operation, status, codes = []) {
+        super(codes.length > 0
+            ? `shopify ${operation} returned GraphQL errors (${codes.join(", ")})`
+            : `shopify ${operation} failed with HTTP ${status}`);
+        this.operation = operation;
+        this.status = status;
+        this.codes = codes;
+        this.name = "ShopifyError";
+    }
+}
+export function createShopifyClient(config, options = {}) {
+    const request = createInstrumentedFetch({ provider: "shopify", fetch: options.fetch });
+    const origin = `https://${config.storeName}.myshopify.com`;
+    const version = config.apiVersion;
+    const endpoint = (surface, url, auth) => ({
+        async query(document, variables, { headers, signal } = {}) {
+            const operation = extractGraphqlOperationName(document) ?? `${surface}.graphql`;
+            const response = await request(url, {
+                operation,
+                method: "POST",
+                headers: { "content-type": "application/json", ...headers, ...auth },
+                body: JSON.stringify({ query: document, variables }),
+                signal,
+            });
+            if (!response.ok) {
+                void response.body?.cancel().catch(() => { });
+                throw new ShopifyError(operation, response.status);
+            }
+            // A non-JSON body (an HTML error page) must not reach the error: the
+            // SyntaxError's message quotes the start of the body.
+            let body;
+            try {
+                body = await response.json();
+            }
+            catch {
+                throw new ShopifyError(operation, response.status, ["INVALID_JSON"]);
+            }
+            // Partial data alongside errors is rejected as a whole, deliberately:
+            // a thin client doesn't guess which fields are still trustworthy.
+            if (body.errors?.length || body.data == null) {
+                const codes = body.errors?.length
+                    ? body.errors.map((e) => typeof e.extensions?.code === "string" ? e.extensions.code : "UNKNOWN")
+                    : ["MISSING_DATA"];
+                throw new ShopifyError(operation, response.status, [...new Set(codes)]);
+            }
+            return body.data;
+        },
+    });
+    const adminToken = config.adminAccessToken;
+    return {
+        storefront: endpoint("storefront", `${origin}/api/${version}/graphql.json`, {
+            "x-shopify-storefront-access-token": config.storefrontAccessToken,
+        }),
+        admin: adminToken
+            ? endpoint("admin", `${origin}/admin/api/${version}/graphql.json`, {
+                "x-shopify-access-token": adminToken,
+            })
+            : {
+                query: () => Promise.reject(new Error("shopify admin: pass adminAccessToken to createShopifyClient")),
+            },
+    };
+}
+//# sourceMappingURL=client.js.map

package/dist/client.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"client.js","sourceRoot":"","sources":["../src/client.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;GAWG;AACH,OAAO,EAAE,uBAAuB,EAAE,MAAM,uBAAuB,CAAC;AAChE,OAAO,EAAE,2BAA2B,EAAE,MAAM,2BAA2B,CAAC;AAkCxE,kHAAkH;AAClH,MAAM,OAAO,YAAa,SAAQ,KAAK;IAE1B,SAAS;IACT,MAAM;IACN,KAAK;IAHhB,YACW,SAAiB,EACjB,MAAc,EACd,KAAK,GAAa,EAAE;QAE7B,KAAK,CACH,KAAK,CAAC,MAAM,GAAG,CAAC;YACd,CAAC,CAAC,WAAW,SAAS,6BAA6B,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG;YACtE,CAAC,CAAC,WAAW,SAAS,qBAAqB,MAAM,EAAE,CACtD,CAAC;yBARO,SAAS;sBACT,MAAM;qBACN,KAAK;QAOd,IAAI,CAAC,IAAI,GAAG,cAAc,CAAC;IAC7B,CAAC;CACF;AAED,MAAM,UAAU,mBAAmB,CACjC,MAA2B,EAC3B,OAAO,GAAwC,EAAE;IAEjD,MAAM,OAAO,GAAG,uBAAuB,CAAC,EAAE,QAAQ,EAAE,SAAS,EAAE,KAAK,EAAE,OAAO,CAAC,KAAK,EAAE,CAAC,CAAC;IACvF,MAAM,MAAM,GAAG,WAAW,MAAM,CAAC,SAAS,gBAAgB,CAAC;IAC3D,MAAM,OAAO,GAAG,MAAM,CAAC,UAAU,CAAC;IAElC,MAAM,QAAQ,GAAG,CAAC,OAA+B,EAAE,GAAW,EAAE,IAA4B,EAAE,EAAE,CAC9F,CAAC;QACC,KAAK,CAAC,KAAK,CAAC,QAAQ,EAAE,SAAS,EAAE,EAAE,OAAO,EAAE,MAAM,EAAE,GAAG,EAAE;YACvD,MAAM,SAAS,GAAG,2BAA2B,CAAC,QAAQ,CAAC,IAAI,GAAG,OAAO,UAAU,CAAC;YAChF,MAAM,QAAQ,GAAG,MAAM,OAAO,CAAC,GAAG,EAAE;gBAClC,SAAS;gBACT,MAAM,EAAE,MAAM;gBACd,OAAO,EAAE,EAAE,cAAc,EAAE,kBAAkB,EAAE,GAAG,OAAO,EAAE,GAAG,IAAI,EAAE;gBACpE,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,EAAE,KAAK,EAAE,QAAQ,EAAE,SAAS,EAAE,CAAC;gBACpD,MAAM;aACP,CAAC,CAAC;YACH,IAAI,CAAC,QAAQ,CAAC,EAAE,EAAE,CAAC;gBACjB,KAAK,QAAQ,CAAC,IAAI,EAAE,MAAM,EAAE,CAAC,KAAK,CAAC,GAAG,EAAE,GAAE,CAAC,CAAC,CAAC;gBAC7C,MAAM,IAAI,YAAY,CAAC,SAAS,EAAE,QAAQ,CAAC,MAAM,CAAC,CAAC;YACrD,CAAC;YACD,qEAAqE;YACrE,sDAAsD;YACtD,IAAI,IAAwE,CAAC;YAC7E,IAAI,CAAC;gBACH,IAAI,GAAG,MAAM,QAAQ,CAAC,IAAI,EAAE,CAAC;YAC/B,CAAC;YAAC,MAAM,CAAC;gBACP,MAAM,IAAI,YAAY,CAAC,SAAS,EAAE,QAAQ,CAAC,MAAM,EAAE,CAAC,cAAc,CAAC,CAAC,CAAC;YACvE,CAAC;YACD,sEAAsE;YACtE,kEAAkE;YAClE,IAAI,IAAI,CAAC,MAAM,EAAE,MAAM,IAAI,IAAI,CAAC,IAAI,IAAI,IAAI,EAAE,CAAC;gBAC7C,MAAM,KAAK,GAAG,IAAI,CAAC,MAAM,EAAE,MAAM;oBAC/B,CAAC,CAAC,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CACpB,OAAO,CAAC,CAAC,UAAU,EAAE,IAAI,KAAK,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC,UAAU,CAAC,IAAI,CAAC,CAAC,CAAC,SAAS,CACvE;oBACH,CAAC,CAAC,CAAC,cAAc,CAAC,CAAC;gBACrB,MAAM,IAAI,YAAY,CAAC,SAAS,EAAE,QAAQ,CAAC,MAAM,EAAE,CAAC,GAAG,IAAI,GAAG,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC;YAC1E,CAAC;YACD,OAAO,IAAI,CAAC,IAAa,CAAC;QAC5B,CAAC;KACF,CAA0B,CAAC;IAE9B,MAAM,UAAU,GAAG,MAAM,CAAC,gBAAgB,CAAC;IAC3C,OAAO;QACL,UAAU,EAAE,QAAQ,CAAC,YAAY,EAAE,GAAG,MAAM,QAAQ,OAAO,eAAe,EAAE;YAC1E,mCAAmC,EAAE,MAAM,CAAC,qBAAqB;SAClE,CAAC;QACF,KAAK,EAAE,UAAU;YACf,CAAC,CAAC,QAAQ,CAAC,OAAO,EAAE,GAAG,MAAM,cAAc,OAAO,eAAe,EAAE;gBAC/D,wBAAwB,EAAE,UAAU;aACrC,CAAC;YACJ,CAAC,CAAC;gBACE,KAAK,EAAE,GAAG,EAAE,CACV,OAAO,CAAC,MAAM,CACZ,IAAI,KAAK,CAAC,6DAA6D,CAAC,CACzE;aACJ;KACN,CAAC;AACJ,CAAC"}

package/dist/graphqlOperationName.d.ts

@@ -0,0 +1,36 @@
+/**
+ * Extract a semantic operation name from a GraphQL document.
+ *
+ * Used at the Shopify GraphQL client layer to stamp `init.operation`
+ * on the outbound fetch. The framework then suffixes the integration
+ * name (`shopify.<operation>`) onto the span and uses the same string
+ * as the `fetch.operation` attribute + histogram label.
+ *
+ * Resolution order:
+ *
+ *   1. An explicit `operationName` argument (e.g. when the client
+ *      received one alongside a multi-operation document) wins.
+ *   2. If the document has exactly one named operation, that name
+ *      is used.
+ *   3. If the document has zero or many anonymous operations, we
+ *      return `undefined` so the caller can fall back (typically to
+ *      the URL-derived `storefront.graphql` / `admin.graphql`).
+ *
+ * The parser is deliberately a small regex pass, not a full GraphQL
+ * tokenizer:
+ *
+ *   - GraphQL operation definitions live at the top level of the
+ *     document, never nested inside other operations, fragments, or
+ *     selection sets, so positional context isn't required to find
+ *     them — only to not match the literal words `query` /
+ *     `mutation` / `subscription` inside string values.
+ *   - We strip block strings (`""" … """`), string literals
+ *     (`"…"`), and `# …` comments before matching, which is enough
+ *     to make false-positive matches inside comments / docs vanish.
+ *
+ * If a Shopify operation is ever sufficiently mis-named to break
+ * this (unlikely, since the storefront SDK names them deliberately),
+ * the caller can always set `init.operation` explicitly.
+ */
+export declare function extractGraphqlOperationName(document: string, explicit?: string): string | undefined;
+//# sourceMappingURL=graphqlOperationName.d.ts.map

package/dist/graphqlOperationName.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"graphqlOperationName.d.ts","sourceRoot":"","sources":["../src/graphqlOperationName.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAiCG;AAUH,wBAAgB,2BAA2B,CACzC,QAAQ,EAAE,MAAM,EAChB,QAAQ,CAAC,EAAE,MAAM,GAChB,MAAM,GAAG,SAAS,CAoBpB"}

package/dist/graphqlOperationName.js

@@ -0,0 +1,59 @@
+/**
+ * Extract a semantic operation name from a GraphQL document.
+ *
+ * Used at the Shopify GraphQL client layer to stamp `init.operation`
+ * on the outbound fetch. The framework then suffixes the integration
+ * name (`shopify.<operation>`) onto the span and uses the same string
+ * as the `fetch.operation` attribute + histogram label.
+ *
+ * Resolution order:
+ *
+ *   1. An explicit `operationName` argument (e.g. when the client
+ *      received one alongside a multi-operation document) wins.
+ *   2. If the document has exactly one named operation, that name
+ *      is used.
+ *   3. If the document has zero or many anonymous operations, we
+ *      return `undefined` so the caller can fall back (typically to
+ *      the URL-derived `storefront.graphql` / `admin.graphql`).
+ *
+ * The parser is deliberately a small regex pass, not a full GraphQL
+ * tokenizer:
+ *
+ *   - GraphQL operation definitions live at the top level of the
+ *     document, never nested inside other operations, fragments, or
+ *     selection sets, so positional context isn't required to find
+ *     them — only to not match the literal words `query` /
+ *     `mutation` / `subscription` inside string values.
+ *   - We strip block strings (`""" … """`), string literals
+ *     (`"…"`), and `# …` comments before matching, which is enough
+ *     to make false-positive matches inside comments / docs vanish.
+ *
+ * If a Shopify operation is ever sufficiently mis-named to break
+ * this (unlikely, since the storefront SDK names them deliberately),
+ * the caller can always set `init.operation` explicitly.
+ */
+const OPERATION_RE = /\b(?:query|mutation|subscription)\s+([A-Za-z_][A-Za-z0-9_]*)/g;
+const stripCommentsAndStrings = (doc) => doc
+    .replace(/"""[\s\S]*?"""/g, '""')
+    .replace(/"(?:\\.|[^"\\])*"/g, '""')
+    .replace(/#[^\n]*/g, "");
+export function extractGraphqlOperationName(document, explicit) {
+    if (explicit)
+        return explicit;
+    if (!document)
+        return undefined;
+    const stripped = stripCommentsAndStrings(document);
+    const names = [];
+    OPERATION_RE.lastIndex = 0;
+    for (let match = OPERATION_RE.exec(stripped); match !== null; match = OPERATION_RE.exec(stripped)) {
+        const [, name] = match;
+        if (name)
+            names.push(name);
+        if (names.length > 1)
+            break;
+    }
+    if (names.length === 1)
+        return names[0];
+    return undefined;
+}
+//# sourceMappingURL=graphqlOperationName.js.map

package/dist/graphqlOperationName.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"graphqlOperationName.js","sourceRoot":"","sources":["../src/graphqlOperationName.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAiCG;AAEH,MAAM,YAAY,GAAG,+DAA+D,CAAC;AAErF,MAAM,uBAAuB,GAAG,CAAC,GAAW,EAAU,EAAE,CACtD,GAAG;KACA,OAAO,CAAC,iBAAiB,EAAE,IAAI,CAAC;KAChC,OAAO,CAAC,oBAAoB,EAAE,IAAI,CAAC;KACnC,OAAO,CAAC,UAAU,EAAE,EAAE,CAAC,CAAC;AAE7B,MAAM,UAAU,2BAA2B,CACzC,QAAgB,EAChB,QAAiB;IAEjB,IAAI,QAAQ;QAAE,OAAO,QAAQ,CAAC;IAC9B,IAAI,CAAC,QAAQ;QAAE,OAAO,SAAS,CAAC;IAEhC,MAAM,QAAQ,GAAG,uBAAuB,CAAC,QAAQ,CAAC,CAAC;IACnD,MAAM,KAAK,GAAa,EAAE,CAAC;IAE3B,YAAY,CAAC,SAAS,GAAG,CAAC,CAAC;IAC3B,KACE,IAAI,KAAK,GAAG,YAAY,CAAC,IAAI,CAAC,QAAQ,CAAC,EACvC,KAAK,KAAK,IAAI,EACd,KAAK,GAAG,YAAY,CAAC,IAAI,CAAC,QAAQ,CAAC,EACnC,CAAC;QACD,MAAM,CAAC,EAAE,IAAI,CAAC,GAAG,KAAK,CAAC;QACvB,IAAI,IAAI;YAAE,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QAC3B,IAAI,KAAK,CAAC,MAAM,GAAG,CAAC;YAAE,MAAM;IAC9B,CAAC;IAED,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,KAAK,CAAC,CAAC,CAAC,CAAC;IACxC,OAAO,SAAS,CAAC;AACnB,CAAC"}

package/dist/index.d.ts

@@ -0,0 +1,6 @@
+/**
+ * `@decocms/apps-shopify`: a thin client for the Shopify Storefront API.
+ * See /next/upstream-clients.
+ */
+export { createShopifyClient, type ShopifyClient, type ShopifyClientConfig, ShopifyError, } from "./client.ts";
+//# sourceMappingURL=index.d.ts.map

package/dist/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA;;;GAGG;AACH,OAAO,EACL,mBAAmB,EACnB,KAAK,aAAa,EAClB,KAAK,mBAAmB,EACxB,YAAY,GACb,MAAM,aAAa,CAAC"}

package/dist/index.js

@@ -0,0 +1,6 @@
+/**
+ * `@decocms/apps-shopify`: a thin client for the Shopify Storefront API.
+ * See /next/upstream-clients.
+ */
+export { createShopifyClient, ShopifyError, } from "./client.js";
+//# sourceMappingURL=index.js.map

package/dist/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA;;;GAGG;AACH,OAAO,EACL,mBAAmB,EAGnB,YAAY,GACb,MAAM,aAAa,CAAC"}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@decocms/apps-shopify",
-  "version": "8.1.0-next.1",
+  "version": "8.1.0-next.2",
   "type": "module",
   "description": "Thin Shopify Storefront API client for Deco sites",
   "repository": {
@@ -9,24 +9,28 @@
     "directory": "packages/apps-shopify"
   },
   "files": [
+    "dist",
     "src",
     "!src/**/*.test.ts",
     "!src/**/__tests__"
   ],
-  "main": "./src/index.ts",
+  "main": "./dist/index.js",
+  "types": "./dist/index.d.ts",
   "exports": {
-    ".": "./src/index.ts"
+    ".": {
+      "types": "./dist/index.d.ts",
+      "source": "./src/index.ts",
+      "default": "./dist/index.js"
+    }
   },
   "scripts": {
-    "build": "tsc",
+    "build": "node ../../scripts/tsc.mjs --clean dist -p tsconfig.build.json",
+    "prepack": "npm run build",
     "test": "vitest run --root ../.. packages/apps-shopify/",
-    "typecheck": "tsc --noEmit"
+    "typecheck": "node ../../scripts/tsc.mjs -p tsconfig.json"
   },
   "dependencies": {
-    "@decocms/blocks": "8.1.0-next.1"
-  },
-  "devDependencies": {
-    "typescript": "^5.9.0"
+    "@decocms/blocks": "8.1.0-next.2"
   },
   "publishConfig": {
     "registry": "https://registry.npmjs.org",

package/src/client.ts

@@ -11,7 +11,7 @@
  * is the site's job.
  */
 import { createInstrumentedFetch } from "@decocms/blocks/fetch";
-import { extractGraphqlOperationName } from "./graphqlOperationName";
+import { extractGraphqlOperationName } from "./graphqlOperationName.ts";
 
 export interface ShopifyClientConfig {
   /** The store's subdomain: "acme" for acme.myshopify.com. */

package/src/index.ts

@@ -7,4 +7,4 @@ export {
   type ShopifyClient,
   type ShopifyClientConfig,
   ShopifyError,
-} from "./client";
+} from "./client.ts";