@essential-apps/shopify-test-runner 1.0.0

package/dist/scripts/verifyRestContracts.js

@@ -0,0 +1,237 @@
+#!/usr/bin/env node
+/**
+ * verifyRestContracts — replay each vendored REST contract,
+ * diff vs the contract.
+ *
+ * Sister to `verifyContracts.ts`, but for REST. See
+ * `captureRestContracts.ts` for the manifest format and capture
+ * flow; this script consumes the captured contracts and asserts the
+ * target still returns the same shape.
+ *
+ *   - `--target offline` (default): hit the in-process mock-admin
+ *     Hono app. Detects regression in the mock's REST stubs.
+ *   - `--target live`: hit a real Shopify admin endpoint with
+ *     CONTRACTS_LIVE_SHOP + CONTRACTS_LIVE_ACCESS_TOKEN. Detects
+ *     drift between vendored contracts and what Shopify actually
+ *     returns today.
+ *
+ * Responses are normalised (volatile IDs / timestamps / CDN URLs /
+ * cursors → stable tokens) before diffing — same normaliser the
+ * GraphQL verifier uses. Offline-offline matches byte-for-byte
+ * anyway; the normaliser only matters for live-vs-contract.
+ */
+import { readdirSync, readFileSync, statSync } from 'node:fs';
+import { resolve, relative } from 'node:path';
+import { createAdminApi, } from '@essential-apps/shopify-test-shopify-api';
+import { ShopState } from '@essential-apps/shopify-test-storefront';
+import { normaliseResponse } from '../contracts/normalize.js';
+const ADMIN_API_VERSION = '2025-07';
+function parseArgs() {
+    const argv = process.argv.slice(2);
+    const out = {
+        contractsDir: '',
+        cwd: process.cwd(),
+    };
+    for (let i = 0; i < argv.length; i++) {
+        const a = argv[i] ?? '';
+        if (a === '--dir' && i + 1 < argv.length) {
+            out.contractsDir = argv[++i] ?? '';
+        }
+    }
+    if (!out.contractsDir) {
+        out.contractsDir = resolve(out.cwd, 'tests/test-offline/contracts/admin-rest');
+    }
+    else {
+        out.contractsDir = resolve(out.cwd, out.contractsDir);
+    }
+    return out;
+}
+function fillPath(template, params) {
+    return template.replace(/\{([^}]+)\}/g, (_, key) => {
+        if (!(key in params)) {
+            throw new Error(`path template references {${key}} but no value provided`);
+        }
+        return encodeURIComponent(params[key] ?? '');
+    });
+}
+function appendQuery(path, query) {
+    if (!query || Object.keys(query).length === 0)
+        return path;
+    const params = new URLSearchParams();
+    for (const [k, v] of Object.entries(query))
+        params.set(k, v);
+    const joiner = path.includes('?') ? '&' : '?';
+    return `${path}${joiner}${params.toString()}`;
+}
+// eslint-disable-next-line @typescript-eslint/no-explicit-any -- Hono is loosely typed
+function buildOfflineExecutor(state) {
+    const app = createAdminApi({ state });
+    return async (contract) => {
+        const filled = fillPath(contract.path, {
+            version: ADMIN_API_VERSION,
+            ...(contract.pathParams ?? {}),
+        });
+        const finalPath = appendQuery(filled, contract.query);
+        const init = {
+            method: contract.method,
+            headers: {
+                'Content-Type': 'application/json',
+                'X-Shopify-Access-Token': 'mock-access-token',
+            },
+        };
+        if (contract.body !== undefined) {
+            init.body = JSON.stringify(contract.body);
+        }
+        const resp = await app.request(finalPath, init);
+        let body = null;
+        try {
+            body = await resp.json();
+        }
+        catch {
+            // empty / non-JSON
+        }
+        return { status: resp.status, body };
+    };
+}
+// Live executor intentionally removed — platform parity (does the
+// mock match real Shopify) is owned by
+// `@essential-apps/shopify-test-conformance`. Consuming-app
+// contract verification only runs against the offline mock.
+/**
+ * Deep-diff with normalised first-mismatch reporting. Same shape
+ * as the GraphQL verifier — kept independent rather than imported
+ * so the REST script can be invoked standalone.
+ */
+function diff(expected, actual, path = '$') {
+    if (expected === actual)
+        return null;
+    if (typeof expected !== typeof actual ||
+        expected === null ||
+        actual === null) {
+        return `${path}: expected ${JSON.stringify(expected)}, got ${JSON.stringify(actual)}`;
+    }
+    if (Array.isArray(expected)) {
+        if (!Array.isArray(actual))
+            return `${path}: expected array, got object`;
+        if (expected.length !== actual.length) {
+            return `${path}: expected length ${expected.length}, got ${actual.length}`;
+        }
+        for (let i = 0; i < expected.length; i++) {
+            const d = diff(expected[i], actual[i], `${path}[${i}]`);
+            if (d)
+                return d;
+        }
+        return null;
+    }
+    if (typeof expected === 'object') {
+        const e = expected;
+        const a = actual;
+        const allKeys = new Set([...Object.keys(e), ...Object.keys(a)]);
+        for (const k of allKeys) {
+            if (!(k in e))
+                return `${path}.${k}: unexpected key`;
+            if (!(k in a))
+                return `${path}.${k}: missing key`;
+            const d = diff(e[k], a[k], `${path}.${k}`);
+            if (d)
+                return d;
+        }
+        return null;
+    }
+    return `${path}: expected ${JSON.stringify(expected)}, got ${JSON.stringify(actual)}`;
+}
+async function main() {
+    const args = parseArgs();
+    let entries;
+    try {
+        entries = readdirSync(args.contractsDir);
+    }
+    catch {
+        console.error(`[verify-rest] no contracts directory at ${args.contractsDir}. ` +
+            `Run \`npm run test:online:capture-rest-contracts\` first.`);
+        process.exit(2);
+    }
+    const contractFiles = entries.filter((f) => f.endsWith('.json'));
+    if (contractFiles.length === 0) {
+        console.error(`[verify-rest] no contracts found in ${args.contractsDir}`);
+        process.exit(2);
+    }
+    const state = buildSeededState();
+    const executor = buildOfflineExecutor(state);
+    let pass = 0;
+    let drift = 0;
+    let skipped = 0;
+    const failures = [];
+    for (const f of contractFiles) {
+        const path = resolve(args.contractsDir, f);
+        let st;
+        try {
+            st = statSync(path);
+        }
+        catch {
+            continue;
+        }
+        if (!st.isFile())
+            continue;
+        const contract = JSON.parse(readFileSync(path, 'utf8'));
+        if (contract.warning) {
+            skipped++;
+            continue;
+        }
+        let actual;
+        try {
+            actual = await executor(contract);
+        }
+        catch (err) {
+            drift++;
+            failures.push({ contract: f, diff: `executor threw: ${err.message}` });
+            continue;
+        }
+        // Status-code mismatch is a hard diff — surface it directly.
+        if (actual.status !== contract.response.status) {
+            drift++;
+            failures.push({
+                contract: f,
+                diff: `$.status: expected ${contract.response.status}, got ${actual.status}`,
+            });
+            continue;
+        }
+        // Body diff — normalise both sides first (same rationale as
+        // GraphQL verify; see contracts/normalize.ts).
+        const expectedNorm = normaliseResponse(contract.response.body);
+        const actualNorm = normaliseResponse(actual.body);
+        const d = diff(expectedNorm, actualNorm, '$.body');
+        if (d === null) {
+            pass++;
+        }
+        else {
+            drift++;
+            failures.push({ contract: f, diff: d });
+        }
+    }
+    console.log(`[verify-rest]: ${pass} pass, ${drift} drift, ${skipped} skipped`);
+    if (failures.length > 0) {
+        console.log('');
+        console.log('[verify-rest] drift:');
+        for (const f of failures) {
+            console.log(`  ${relative(args.cwd, resolve(args.contractsDir, f.contract))}`);
+            console.log(`    ${f.diff}`);
+        }
+        console.log('');
+        console.log('If the mock is correct and the contract is stale, regenerate with `npm run test:online:capture-rest-contracts`.');
+    }
+    process.exit(drift === 0 ? 0 : 1);
+}
+function buildSeededState() {
+    return new ShopState({
+        shop: {
+            domain: 'test-shop.myshopify.com',
+            permanent_domain: 'test-shop.myshopify.com',
+        },
+    });
+}
+main().catch((err) => {
+    console.error(err);
+    process.exit(2);
+});
+//# sourceMappingURL=verifyRestContracts.js.map

package/dist/scripts/verifyRestContracts.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"verifyRestContracts.js","sourceRoot":"","sources":["../../src/scripts/verifyRestContracts.ts"],"names":[],"mappings":";AACA;;;;;;;;;;;;;;;;;;;;GAoBG;AACH,OAAO,EAAE,WAAW,EAAE,YAAY,EAAE,QAAQ,EAAE,MAAM,SAAS,CAAC;AAC9D,OAAO,EAAE,OAAO,EAAE,QAAQ,EAAE,MAAM,WAAW,CAAC;AAC9C,OAAO,EACL,cAAc,GACf,MAAM,0CAA0C,CAAC;AAClD,OAAO,EAAE,SAAS,EAAE,MAAM,yCAAyC,CAAC;AACpE,OAAO,EAAE,iBAAiB,EAAE,MAAM,2BAA2B,CAAC;AAuB9D,MAAM,iBAAiB,GAAG,SAAS,CAAC;AAEpC,SAAS,SAAS;IAChB,MAAM,IAAI,GAAG,OAAO,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC;IACnC,MAAM,GAAG,GAAS;QAChB,YAAY,EAAE,EAAE;QAChB,GAAG,EAAE,OAAO,CAAC,GAAG,EAAE;KACnB,CAAC;IACF,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,IAAI,CAAC,MAAM,EAAE,CAAC,EAAE,EAAE,CAAC;QACrC,MAAM,CAAC,GAAG,IAAI,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;QACxB,IAAI,CAAC,KAAK,OAAO,IAAI,CAAC,GAAG,CAAC,GAAG,IAAI,CAAC,MAAM,EAAE,CAAC;YACzC,GAAG,CAAC,YAAY,GAAG,IAAI,CAAC,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC;QACrC,CAAC;IACH,CAAC;IACD,IAAI,CAAC,GAAG,CAAC,YAAY,EAAE,CAAC;QACtB,GAAG,CAAC,YAAY,GAAG,OAAO,CAAC,GAAG,CAAC,GAAG,EAAE,yCAAyC,CAAC,CAAC;IACjF,CAAC;SAAM,CAAC;QACN,GAAG,CAAC,YAAY,GAAG,OAAO,CAAC,GAAG,CAAC,GAAG,EAAE,GAAG,CAAC,YAAY,CAAC,CAAC;IACxD,CAAC;IACD,OAAO,GAAG,CAAC;AACb,CAAC;AAED,SAAS,QAAQ,CAAC,QAAgB,EAAE,MAA8B;IAChE,OAAO,QAAQ,CAAC,OAAO,CAAC,cAAc,EAAE,CAAC,CAAC,EAAE,GAAG,EAAE,EAAE;QACjD,IAAI,CAAC,CAAC,GAAG,IAAI,MAAM,CAAC,EAAE,CAAC;YACrB,MAAM,IAAI,KAAK,CAAC,6BAA6B,GAAG,yBAAyB,CAAC,CAAC;QAC7E,CAAC;QACD,OAAO,kBAAkB,CAAC,MAAM,CAAC,GAAG,CAAC,IAAI,EAAE,CAAC,CAAC;IAC/C,CAAC,CAAC,CAAC;AACL,CAAC;AAED,SAAS,WAAW,CAAC,IAAY,EAAE,KAA8B;IAC/D,IAAI,CAAC,KAAK,IAAI,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,IAAI,CAAC;IAC3D,MAAM,MAAM,GAAG,IAAI,eAAe,EAAE,CAAC;IACrC,KAAK,MAAM,CAAC,CAAC,EAAE,CAAC,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,KAAK,CAAC;QAAE,MAAM,CAAC,GAAG,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC;IAC7D,MAAM,MAAM,GAAG,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,GAAG,CAAC;IAC9C,OAAO,GAAG,IAAI,GAAG,MAAM,GAAG,MAAM,CAAC,QAAQ,EAAE,EAAE,CAAC;AAChD,CAAC;AAMD,uFAAuF;AACvF,SAAS,oBAAoB,CAAC,KAAgB;IAC5C,MAAM,GAAG,GAAG,cAAc,CAAC,EAAE,KAAK,EAAE,CAAC,CAAC;IACtC,OAAO,KAAK,EAAE,QAAQ,EAAE,EAAE;QACxB,MAAM,MAAM,GAAG,QAAQ,CAAC,QAAQ,CAAC,IAAI,EAAE;YACrC,OAAO,EAAE,iBAAiB;YAC1B,GAAG,CAAC,QAAQ,CAAC,UAAU,IAAI,EAAE,CAAC;SAC/B,CAAC,CAAC;QACH,MAAM,SAAS,GAAG,WAAW,CAAC,MAAM,EAAE,QAAQ,CAAC,KAAK,CAAC,CAAC;QACtD,MAAM,IAAI,GAAgB;YACxB,MAAM,EAAE,QAAQ,CAAC,MAAM;YACvB,OAAO,EAAE;gBACP,cAAc,EAAE,kBAAkB;gBAClC,wBAAwB,EAAE,mBAAmB;aAC9C;SACF,CAAC;QACF,IAAI,QAAQ,CAAC,IAAI,KAAK,SAAS,EAAE,CAAC;YAChC,IAAI,CAAC,IAAI,GAAG,IAAI,CAAC,SAAS,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC;QAC5C,CAAC;QACD,MAAM,IAAI,GAAa,MAAO,GAAG,CAAC,OAAe,CAAC,SAAS,EAAE,IAAI,CAAC,CAAC;QACnE,IAAI,IAAI,GAAY,IAAI,CAAC;QACzB,IAAI,CAAC;YACH,IAAI,GAAG,MAAM,IAAI,CAAC,IAAI,EAAE,CAAC;QAC3B,CAAC;QAAC,MAAM,CAAC;YACP,mBAAmB;QACrB,CAAC;QACD,OAAO,EAAE,MAAM,EAAE,IAAI,CAAC,MAAM,EAAE,IAAI,EAAE,CAAC;IACvC,CAAC,CAAC;AACJ,CAAC;AAED,kEAAkE;AAClE,uCAAuC;AACvC,4DAA4D;AAC5D,4DAA4D;AAE5D;;;;GAIG;AACH,SAAS,IAAI,CACX,QAAiB,EACjB,MAAe,EACf,IAAI,GAAG,GAAG;IAEV,IAAI,QAAQ,KAAK,MAAM;QAAE,OAAO,IAAI,CAAC;IACrC,IACE,OAAO,QAAQ,KAAK,OAAO,MAAM;QACjC,QAAQ,KAAK,IAAI;QACjB,MAAM,KAAK,IAAI,EACf,CAAC;QACD,OAAO,GAAG,IAAI,cAAc,IAAI,CAAC,SAAS,CAAC,QAAQ,CAAC,SAAS,IAAI,CAAC,SAAS,CAAC,MAAM,CAAC,EAAE,CAAC;IACxF,CAAC;IACD,IAAI,KAAK,CAAC,OAAO,CAAC,QAAQ,CAAC,EAAE,CAAC;QAC5B,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC;YAAE,OAAO,GAAG,IAAI,8BAA8B,CAAC;QACzE,IAAI,QAAQ,CAAC,MAAM,KAAK,MAAM,CAAC,MAAM,EAAE,CAAC;YACtC,OAAO,GAAG,IAAI,qBAAqB,QAAQ,CAAC,MAAM,SAAS,MAAM,CAAC,MAAM,EAAE,CAAC;QAC7E,CAAC;QACD,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,QAAQ,CAAC,MAAM,EAAE,CAAC,EAAE,EAAE,CAAC;YACzC,MAAM,CAAC,GAAG,IAAI,CAAC,QAAQ,CAAC,CAAC,CAAC,EAAE,MAAM,CAAC,CAAC,CAAC,EAAE,GAAG,IAAI,IAAI,CAAC,GAAG,CAAC,CAAC;YACxD,IAAI,CAAC;gBAAE,OAAO,CAAC,CAAC;QAClB,CAAC;QACD,OAAO,IAAI,CAAC;IACd,CAAC;IACD,IAAI,OAAO,QAAQ,KAAK,QAAQ,EAAE,CAAC;QACjC,MAAM,CAAC,GAAG,QAAmC,CAAC;QAC9C,MAAM,CAAC,GAAG,MAAiC,CAAC;QAC5C,MAAM,OAAO,GAAG,IAAI,GAAG,CAAC,CAAC,GAAG,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,GAAG,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;QAChE,KAAK,MAAM,CAAC,IAAI,OAAO,EAAE,CAAC;YACxB,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC;gBAAE,OAAO,GAAG,IAAI,IAAI,CAAC,kBAAkB,CAAC;YACrD,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC;gBAAE,OAAO,GAAG,IAAI,IAAI,CAAC,eAAe,CAAC;YAClD,MAAM,CAAC,GAAG,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,EAAE,GAAG,IAAI,IAAI,CAAC,EAAE,CAAC,CAAC;YAC3C,IAAI,CAAC;gBAAE,OAAO,CAAC,CAAC;QAClB,CAAC;QACD,OAAO,IAAI,CAAC;IACd,CAAC;IACD,OAAO,GAAG,IAAI,cAAc,IAAI,CAAC,SAAS,CAAC,QAAQ,CAAC,SAAS,IAAI,CAAC,SAAS,CAAC,MAAM,CAAC,EAAE,CAAC;AACxF,CAAC;AAED,KAAK,UAAU,IAAI;IACjB,MAAM,IAAI,GAAG,SAAS,EAAE,CAAC;IACzB,IAAI,OAAiB,CAAC;IACtB,IAAI,CAAC;QACH,OAAO,GAAG,WAAW,CAAC,IAAI,CAAC,YAAY,CAAC,CAAC;IAC3C,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,CAAC,KAAK,CACX,2CAA2C,IAAI,CAAC,YAAY,IAAI;YAC9D,2DAA2D,CAC9D,CAAC;QACF,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IAClB,CAAC;IACD,MAAM,aAAa,GAAG,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,QAAQ,CAAC,OAAO,CAAC,CAAC,CAAC;IACjE,IAAI,aAAa,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QAC/B,OAAO,CAAC,KAAK,CAAC,uCAAuC,IAAI,CAAC,YAAY,EAAE,CAAC,CAAC;QAC1E,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IAClB,CAAC;IAED,MAAM,KAAK,GAAG,gBAAgB,EAAE,CAAC;IACjC,MAAM,QAAQ,GACZ,oBAAoB,CAAC,KAAK,CAAC,CAAC;IAE9B,IAAI,IAAI,GAAG,CAAC,CAAC;IACb,IAAI,KAAK,GAAG,CAAC,CAAC;IACd,IAAI,OAAO,GAAG,CAAC,CAAC;IAChB,MAAM,QAAQ,GAAyC,EAAE,CAAC;IAE1D,KAAK,MAAM,CAAC,IAAI,aAAa,EAAE,CAAC;QAC9B,MAAM,IAAI,GAAG,OAAO,CAAC,IAAI,CAAC,YAAY,EAAE,CAAC,CAAC,CAAC;QAC3C,IAAI,EAAE,CAAC;QACP,IAAI,CAAC;YACH,EAAE,GAAG,QAAQ,CAAC,IAAI,CAAC,CAAC;QACtB,CAAC;QAAC,MAAM,CAAC;YACP,SAAS;QACX,CAAC;QACD,IAAI,CAAC,EAAE,CAAC,MAAM,EAAE;YAAE,SAAS;QAC3B,MAAM,QAAQ,GAAG,IAAI,CAAC,KAAK,CAAC,YAAY,CAAC,IAAI,EAAE,MAAM,CAAC,CAAa,CAAC;QACpE,IAAI,QAAQ,CAAC,OAAO,EAAE,CAAC;YACrB,OAAO,EAAE,CAAC;YACV,SAAS;QACX,CAAC;QACD,IAAI,MAAyC,CAAC;QAC9C,IAAI,CAAC;YACH,MAAM,GAAG,MAAM,QAAQ,CAAC,QAAQ,CAAC,CAAC;QACpC,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,KAAK,EAAE,CAAC;YACR,QAAQ,CAAC,IAAI,CAAC,EAAE,QAAQ,EAAE,CAAC,EAAE,IAAI,EAAE,mBAAoB,GAAa,CAAC,OAAO,EAAE,EAAE,CAAC,CAAC;YAClF,SAAS;QACX,CAAC;QACD,6DAA6D;QAC7D,IAAI,MAAM,CAAC,MAAM,KAAK,QAAQ,CAAC,QAAQ,CAAC,MAAM,EAAE,CAAC;YAC/C,KAAK,EAAE,CAAC;YACR,QAAQ,CAAC,IAAI,CAAC;gBACZ,QAAQ,EAAE,CAAC;gBACX,IAAI,EAAE,sBAAsB,QAAQ,CAAC,QAAQ,CAAC,MAAM,SAAS,MAAM,CAAC,MAAM,EAAE;aAC7E,CAAC,CAAC;YACH,SAAS;QACX,CAAC;QACD,4DAA4D;QAC5D,+CAA+C;QAC/C,MAAM,YAAY,GAAG,iBAAiB,CAAC,QAAQ,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC;QAC/D,MAAM,UAAU,GAAG,iBAAiB,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC;QAClD,MAAM,CAAC,GAAG,IAAI,CAAC,YAAY,EAAE,UAAU,EAAE,QAAQ,CAAC,CAAC;QACnD,IAAI,CAAC,KAAK,IAAI,EAAE,CAAC;YACf,IAAI,EAAE,CAAC;QACT,CAAC;aAAM,CAAC;YACN,KAAK,EAAE,CAAC;YACR,QAAQ,CAAC,IAAI,CAAC,EAAE,QAAQ,EAAE,CAAC,EAAE,IAAI,EAAE,CAAC,EAAE,CAAC,CAAC;QAC1C,CAAC;IACH,CAAC;IAED,OAAO,CAAC,GAAG,CACT,kBAAkB,IAAI,UAAU,KAAK,WAAW,OAAO,UAAU,CAClE,CAAC;IACF,IAAI,QAAQ,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QACxB,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;QAChB,OAAO,CAAC,GAAG,CAAC,sBAAsB,CAAC,CAAC;QACpC,KAAK,MAAM,CAAC,IAAI,QAAQ,EAAE,CAAC;YACzB,OAAO,CAAC,GAAG,CAAC,KAAK,QAAQ,CAAC,IAAI,CAAC,GAAG,EAAE,OAAO,CAAC,IAAI,CAAC,YAAY,EAAE,CAAC,CAAC,QAAQ,CAAC,CAAC,EAAE,CAAC,CAAC;YAC/E,OAAO,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC;QAC/B,CAAC;QACD,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;QAChB,OAAO,CAAC,GAAG,CACT,iHAAiH,CAClH,CAAC;IACJ,CAAC;IACD,OAAO,CAAC,IAAI,CAAC,KAAK,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;AACpC,CAAC;AAED,SAAS,gBAAgB;IACvB,OAAO,IAAI,SAAS,CAAC;QACnB,IAAI,EAAE;YACJ,MAAM,EAAE,yBAAyB;YACjC,gBAAgB,EAAE,yBAAyB;SAC5C;KACF,CAAC,CAAC;AACL,CAAC;AAED,IAAI,EAAE,CAAC,KAAK,CAAC,CAAC,GAAG,EAAE,EAAE;IACnB,OAAO,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;IACnB,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;AAClB,CAAC,CAAC,CAAC"}

package/dist/vite/offlineConfig.d.ts

@@ -0,0 +1,34 @@
+import { type ConfigEnv, type UserConfig } from 'vite';
+/**
+ * Vite config used to serve a consuming app's backend for the
+ * OFFLINE-FULL suite via `vite dev` (instead of a prod build +
+ * remix-serve). `runOfflineFullTests` boots `vite --config <this>`.
+ *
+ * This is what makes offline onboarding zero-app-touch on the build
+ * side. A prod build runs the app's own vite.config, which for Vercel-
+ * hosted apps applies `vercelPreset()` and shards the server build so
+ * `remix-serve` can't boot it (the "vanilla build" problem). Build-only
+ * presets are INERT in dev, so serving via `vite dev` sidesteps it
+ * with no change to the app's vite.config.
+ *
+ * It loads the app's OWN config and overlays the offline necessities:
+ *   - `server.hmr = false`: Vite dev injects HMR <script>/<link> tags
+ *     that aren't in the SSR HTML → breaks React-18 hydration. Disabling
+ *     HMR is what historically forced offline onto a prod build; turning
+ *     it off here lets us serve via dev safely.
+ *   - strip `basic-ssl`: the offline edge proxy + mocks expect a plain
+ *     HTTP backend. Apps that add basicSsl in test mode would otherwise
+ *     serve HTTPS. basic-ssl is a top-level plugin, so it's filterable
+ *     (the Vercel preset isn't — it lives inside the remix() plugin —
+ *     but it's build-only, so dev doesn't care). Dropping the plugin
+ *     means no `server.https` is set, so the dev server is plain HTTP.
+ *   - `optimizeDeps.entries`: pre-bundle every route's deps at startup
+ *     so the first in-test navigation doesn't trigger Vite's on-demand
+ *     re-optimize + iframe reload (same fix as the online suite).
+ *
+ * Generic + additive: never rewrites the app's plugins beyond dropping
+ * basic-ssl. Override the optimize glob with
+ * TEST_OFFLINE_VITE_OPTIMIZE_ENTRIES for apps with an unusual layout.
+ */
+export default function viteOfflineConfig(configEnv: ConfigEnv): Promise<UserConfig>;
+//# sourceMappingURL=offlineConfig.d.ts.map

package/dist/vite/offlineConfig.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"offlineConfig.d.ts","sourceRoot":"","sources":["../../src/vite/offlineConfig.ts"],"names":[],"mappings":"AAAA,OAAO,EAAmC,KAAK,SAAS,EAAE,KAAK,UAAU,EAAE,MAAM,MAAM,CAAC;AAExF;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA8BG;AACH,wBAA8B,iBAAiB,CAAC,SAAS,EAAE,SAAS,GAAG,OAAO,CAAC,UAAU,CAAC,CAgCzF"}

package/dist/vite/offlineConfig.js

@@ -0,0 +1,61 @@
+import { loadConfigFromFile, mergeConfig } from 'vite';
+/**
+ * Vite config used to serve a consuming app's backend for the
+ * OFFLINE-FULL suite via `vite dev` (instead of a prod build +
+ * remix-serve). `runOfflineFullTests` boots `vite --config <this>`.
+ *
+ * This is what makes offline onboarding zero-app-touch on the build
+ * side. A prod build runs the app's own vite.config, which for Vercel-
+ * hosted apps applies `vercelPreset()` and shards the server build so
+ * `remix-serve` can't boot it (the "vanilla build" problem). Build-only
+ * presets are INERT in dev, so serving via `vite dev` sidesteps it
+ * with no change to the app's vite.config.
+ *
+ * It loads the app's OWN config and overlays the offline necessities:
+ *   - `server.hmr = false`: Vite dev injects HMR <script>/<link> tags
+ *     that aren't in the SSR HTML → breaks React-18 hydration. Disabling
+ *     HMR is what historically forced offline onto a prod build; turning
+ *     it off here lets us serve via dev safely.
+ *   - strip `basic-ssl`: the offline edge proxy + mocks expect a plain
+ *     HTTP backend. Apps that add basicSsl in test mode would otherwise
+ *     serve HTTPS. basic-ssl is a top-level plugin, so it's filterable
+ *     (the Vercel preset isn't — it lives inside the remix() plugin —
+ *     but it's build-only, so dev doesn't care). Dropping the plugin
+ *     means no `server.https` is set, so the dev server is plain HTTP.
+ *   - `optimizeDeps.entries`: pre-bundle every route's deps at startup
+ *     so the first in-test navigation doesn't trigger Vite's on-demand
+ *     re-optimize + iframe reload (same fix as the online suite).
+ *
+ * Generic + additive: never rewrites the app's plugins beyond dropping
+ * basic-ssl. Override the optimize glob with
+ * TEST_OFFLINE_VITE_OPTIMIZE_ENTRIES for apps with an unusual layout.
+ */
+export default async function viteOfflineConfig(configEnv) {
+    const root = process.cwd();
+    const loaded = await loadConfigFromFile(configEnv, undefined, root);
+    if (!loaded?.config) {
+        throw new Error(`viteOfflineConfig: could not load the app's Vite config from ${root}. ` +
+            `Expected a vite.config.{ts,js,mjs,mts,…} at the repo root.`);
+    }
+    const appConfig = loaded.config;
+    // Drop basic-ssl (→ plain HTTP). Flatten one level since plugin
+    // entries can be nested arrays; keep everything that isn't basic-ssl
+    // (incl. falsy/Promise entries, which Vite tolerates).
+    const plugins = (appConfig.plugins ?? [])
+        .flat(Infinity)
+        .filter((p) => {
+        const name = p?.name;
+        return !(name && name.includes('basic-ssl'));
+    });
+    const entries = process.env['TEST_OFFLINE_VITE_OPTIMIZE_ENTRIES']
+        ? process.env['TEST_OFFLINE_VITE_OPTIMIZE_ENTRIES']
+            .split(',')
+            .map((s) => s.trim())
+            .filter(Boolean)
+        : ['app/**/*.{ts,tsx,jsx,js}', '!app/**/*.server.*'];
+    return mergeConfig({ ...appConfig, plugins }, {
+        optimizeDeps: { entries },
+        server: { hmr: false },
+    });
+}
+//# sourceMappingURL=offlineConfig.js.map

package/dist/vite/offlineConfig.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"offlineConfig.js","sourceRoot":"","sources":["../../src/vite/offlineConfig.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,kBAAkB,EAAE,WAAW,EAAmC,MAAM,MAAM,CAAC;AAExF;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA8BG;AACH,MAAM,CAAC,OAAO,CAAC,KAAK,UAAU,iBAAiB,CAAC,SAAoB;IAClE,MAAM,IAAI,GAAG,OAAO,CAAC,GAAG,EAAE,CAAC;IAC3B,MAAM,MAAM,GAAG,MAAM,kBAAkB,CAAC,SAAS,EAAE,SAAS,EAAE,IAAI,CAAC,CAAC;IACpE,IAAI,CAAC,MAAM,EAAE,MAAM,EAAE,CAAC;QACpB,MAAM,IAAI,KAAK,CACb,gEAAgE,IAAI,IAAI;YACtE,4DAA4D,CAC/D,CAAC;IACJ,CAAC;IACD,MAAM,SAAS,GAAG,MAAM,CAAC,MAAM,CAAC;IAEhC,gEAAgE;IAChE,qEAAqE;IACrE,uDAAuD;IACvD,MAAM,OAAO,GAAI,CAAC,SAAS,CAAC,OAAO,IAAI,EAAE,CAAe;SACrD,IAAI,CAAC,QAAa,CAAC;SACnB,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE;QACZ,MAAM,IAAI,GAAI,CAA0C,EAAE,IAAI,CAAC;QAC/D,OAAO,CAAC,CAAC,IAAI,IAAI,IAAI,CAAC,QAAQ,CAAC,WAAW,CAAC,CAAC,CAAC;IAC/C,CAAC,CAA0B,CAAC;IAE9B,MAAM,OAAO,GAAG,OAAO,CAAC,GAAG,CAAC,oCAAoC,CAAC;QAC/D,CAAC,CAAC,OAAO,CAAC,GAAG,CAAC,oCAAoC,CAAC;aAC9C,KAAK,CAAC,GAAG,CAAC;aACV,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;aACpB,MAAM,CAAC,OAAO,CAAC;QACpB,CAAC,CAAC,CAAC,0BAA0B,EAAE,oBAAoB,CAAC,CAAC;IAEvD,OAAO,WAAW,CAAC,EAAE,GAAG,SAAS,EAAE,OAAO,EAAE,EAAE;QAC5C,YAAY,EAAE,EAAE,OAAO,EAAE;QACzB,MAAM,EAAE,EAAE,GAAG,EAAE,KAAK,EAAE;KACF,CAAC,CAAC;AAC1B,CAAC"}

package/dist/vite/onlineConfig.d.ts

@@ -0,0 +1,42 @@
+import { type ConfigEnv, type UserConfig } from 'vite';
+/**
+ * Vite config used ONLY to serve the app backend for the ONLINE test
+ * suite — `runTests.ts` boots the dev server with
+ * `vite --config <this file>`. It is never referenced by an app's own
+ * `vite dev` / `vite build`, so it cannot change any app's production
+ * or local-dev behaviour. (Offline-full serves a production build via
+ * remix-serve; conformance runs VM probes — neither uses Vite dev, so
+ * this is online-only.)
+ *
+ * What it does: load the consuming app's OWN Vite config (auto-
+ * discovered from cwd) and merge `optimizeDeps.entries` on top so Vite
+ * crawls every route at server startup and pre-bundles all their
+ * client deps in the FIRST optimize pass.
+ *
+ * Why: in dev, Vite discovers a route's deps lazily — on the first
+ * navigation to that route — then re-optimizes and FORCE-RELOADS the
+ * page to pick up the freshly pre-bundled deps. Inside the embedded
+ * app iframe that reload tears the page down mid-test. Observed as the
+ * funnels "placement type list shows all 4 placements" flake: the
+ * first hit to /app/funnels/new pulls in react-hook-form / @dnd-kit /
+ * zod, Vite reloads, and the content assertion times out; the retry is
+ * fast because the deps are now warm. Crawling every route up front
+ * leaves nothing to discover on navigation, so there is no reload.
+ *
+ * Generic + safe for every consuming app:
+ *   - additive: only ADDS optimizeDeps.entries (mergeConfig concatenates
+ *     arrays); never removes or rewrites the app's plugins/options.
+ *   - auto-discovers the app config (any extension) — no path assumption.
+ *   - the glob is a Remix-convention default; if it matches nothing it's
+ *     a harmless no-op (no breakage, just no speed-up).
+ *   - `.server.*` files are excluded so server-only modules aren't
+ *     dragged into the client dep scan.
+ *   - override the glob with TEST_ONLINE_VITE_OPTIMIZE_ENTRIES
+ *     (comma-separated) for apps with an unusual route layout.
+ *
+ * `runTests.ts` only passes `--config` to this file when the optimize
+ * is enabled; TEST_ONLINE_VITE_OPTIMIZE_ALL=0 boots bare `vite` with
+ * the app config untouched (kill switch).
+ */
+export default function viteOnlineConfig(configEnv: ConfigEnv): Promise<UserConfig>;
+//# sourceMappingURL=onlineConfig.d.ts.map

package/dist/vite/onlineConfig.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"onlineConfig.d.ts","sourceRoot":"","sources":["../../src/vite/onlineConfig.ts"],"names":[],"mappings":"AAAA,OAAO,EAAmC,KAAK,SAAS,EAAE,KAAK,UAAU,EAAE,MAAM,MAAM,CAAC;AAExF;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAsCG;AACH,wBAA8B,gBAAgB,CAAC,SAAS,EAAE,SAAS,GAAG,OAAO,CAAC,UAAU,CAAC,CAkBxF"}

package/dist/vite/onlineConfig.js

@@ -0,0 +1,56 @@
+import { loadConfigFromFile, mergeConfig } from 'vite';
+/**
+ * Vite config used ONLY to serve the app backend for the ONLINE test
+ * suite — `runTests.ts` boots the dev server with
+ * `vite --config <this file>`. It is never referenced by an app's own
+ * `vite dev` / `vite build`, so it cannot change any app's production
+ * or local-dev behaviour. (Offline-full serves a production build via
+ * remix-serve; conformance runs VM probes — neither uses Vite dev, so
+ * this is online-only.)
+ *
+ * What it does: load the consuming app's OWN Vite config (auto-
+ * discovered from cwd) and merge `optimizeDeps.entries` on top so Vite
+ * crawls every route at server startup and pre-bundles all their
+ * client deps in the FIRST optimize pass.
+ *
+ * Why: in dev, Vite discovers a route's deps lazily — on the first
+ * navigation to that route — then re-optimizes and FORCE-RELOADS the
+ * page to pick up the freshly pre-bundled deps. Inside the embedded
+ * app iframe that reload tears the page down mid-test. Observed as the
+ * funnels "placement type list shows all 4 placements" flake: the
+ * first hit to /app/funnels/new pulls in react-hook-form / @dnd-kit /
+ * zod, Vite reloads, and the content assertion times out; the retry is
+ * fast because the deps are now warm. Crawling every route up front
+ * leaves nothing to discover on navigation, so there is no reload.
+ *
+ * Generic + safe for every consuming app:
+ *   - additive: only ADDS optimizeDeps.entries (mergeConfig concatenates
+ *     arrays); never removes or rewrites the app's plugins/options.
+ *   - auto-discovers the app config (any extension) — no path assumption.
+ *   - the glob is a Remix-convention default; if it matches nothing it's
+ *     a harmless no-op (no breakage, just no speed-up).
+ *   - `.server.*` files are excluded so server-only modules aren't
+ *     dragged into the client dep scan.
+ *   - override the glob with TEST_ONLINE_VITE_OPTIMIZE_ENTRIES
+ *     (comma-separated) for apps with an unusual route layout.
+ *
+ * `runTests.ts` only passes `--config` to this file when the optimize
+ * is enabled; TEST_ONLINE_VITE_OPTIMIZE_ALL=0 boots bare `vite` with
+ * the app config untouched (kill switch).
+ */
+export default async function viteOnlineConfig(configEnv) {
+    const root = process.cwd();
+    const loaded = await loadConfigFromFile(configEnv, undefined, root);
+    if (!loaded?.config) {
+        throw new Error(`viteOnlineConfig: could not load the app's Vite config from ${root}. ` +
+            `Expected a vite.config.{ts,js,mjs,mts,…} at the repo root.`);
+    }
+    const entries = process.env['TEST_ONLINE_VITE_OPTIMIZE_ENTRIES']
+        ? process.env['TEST_ONLINE_VITE_OPTIMIZE_ENTRIES']
+            .split(',')
+            .map((s) => s.trim())
+            .filter(Boolean)
+        : ['app/**/*.{ts,tsx,jsx,js}', '!app/**/*.server.*'];
+    return mergeConfig(loaded.config, { optimizeDeps: { entries } });
+}
+//# sourceMappingURL=onlineConfig.js.map

package/dist/vite/onlineConfig.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"onlineConfig.js","sourceRoot":"","sources":["../../src/vite/onlineConfig.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,kBAAkB,EAAE,WAAW,EAAmC,MAAM,MAAM,CAAC;AAExF;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAsCG;AACH,MAAM,CAAC,OAAO,CAAC,KAAK,UAAU,gBAAgB,CAAC,SAAoB;IACjE,MAAM,IAAI,GAAG,OAAO,CAAC,GAAG,EAAE,CAAC;IAC3B,MAAM,MAAM,GAAG,MAAM,kBAAkB,CAAC,SAAS,EAAE,SAAS,EAAE,IAAI,CAAC,CAAC;IACpE,IAAI,CAAC,MAAM,EAAE,MAAM,EAAE,CAAC;QACpB,MAAM,IAAI,KAAK,CACb,+DAA+D,IAAI,IAAI;YACrE,4DAA4D,CAC/D,CAAC;IACJ,CAAC;IAED,MAAM,OAAO,GAAG,OAAO,CAAC,GAAG,CAAC,mCAAmC,CAAC;QAC9D,CAAC,CAAC,OAAO,CAAC,GAAG,CAAC,mCAAmC,CAAC;aAC7C,KAAK,CAAC,GAAG,CAAC;aACV,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;aACpB,MAAM,CAAC,OAAO,CAAC;QACpB,CAAC,CAAC,CAAC,0BAA0B,EAAE,oBAAoB,CAAC,CAAC;IAEvD,OAAO,WAAW,CAAC,MAAM,CAAC,MAAM,EAAE,EAAE,YAAY,EAAE,EAAE,OAAO,EAAE,EAAuB,CAAC,CAAC;AACxF,CAAC"}

package/docker/Dockerfile

@@ -0,0 +1,67 @@
+# Self-contained test image: Playwright (Node + Chromium) + Postgres.
+# Built via `container build` (Apple's libkrun-based framework).
+# Run via the test runner — see scripts/test/runTests.ts.
+#
+# Architecture: everything runs inside the VM. No host pg dependency.
+# Postgres data lives in a bind-mounted volume so it persists across runs
+# (cuts down per-run setup; per-run isolation is via UUID DB names).
+FROM mcr.microsoft.com/playwright:v1.59.1-jammy
+
+ENV DEBIAN_FRONTEND=noninteractive
+
+RUN apt-get update -qq \
+ && apt-get install -y -qq \
+      postgresql-14 \
+      postgresql-client-14 \
+      sudo \
+      procps \
+      net-tools \
+      wget \
+      gnupg \
+      ca-certificates \
+      libnss3-tools \
+      x11vnc \
+ && rm -rf /var/lib/apt/lists/*
+
+# Install real Google Chrome (stable). Playwright's bundled chromium
+# trips Cloudflare's Turnstile challenge on Linux even with patchright
+# stealth patches; real Chrome renders Turnstile the same way it does
+# on the host, where the challenge auto-clicks cleanly. Note: Google
+# only ships Chrome for Linux amd64 (no ARM64 Linux build), so this
+# image MUST be built with --arch amd64 (Rosetta emulation under Apple
+# Silicon — see packages/runner/src/scripts/buildDockerImage.ts and
+# the `image:build` npm script).
+RUN wget -q -O /tmp/chrome.deb \
+      https://dl.google.com/linux/direct/google-chrome-stable_current_amd64.deb \
+ && apt-get update -qq \
+ && apt-get install -y -qq /tmp/chrome.deb \
+ && rm -f /tmp/chrome.deb \
+ && rm -rf /var/lib/apt/lists/*
+
+# Install cloudflared (quick-tunnel mode, no Cloudflare account
+# needed). Used by the webhook-envelope conformance probes to
+# expose a localhost HTTP receiver on a temporary public URL
+# (https://*.trycloudflare.com) so real Shopify can POST webhooks
+# to it. Lifetime is per-probe-run; the tunnel is torn down as
+# soon as the webhook arrives + payload is captured.
+RUN wget -q -O /tmp/cloudflared.deb \
+      https://github.com/cloudflare/cloudflared/releases/latest/download/cloudflared-linux-amd64.deb \
+ && apt-get update -qq \
+ && apt-get install -y -qq /tmp/cloudflared.deb \
+ && rm -f /tmp/cloudflared.deb \
+ && rm -rf /var/lib/apt/lists/*
+
+ENV PGDATA=/var/lib/postgresql/data
+ENV PG_BIN=/usr/lib/postgresql/14/bin
+
+RUN mkdir -p "$PGDATA" \
+ && chown -R postgres:postgres "$PGDATA" \
+ && chmod 700 "$PGDATA"
+
+COPY entrypoint.sh /usr/local/bin/entrypoint.sh
+RUN chmod +x /usr/local/bin/entrypoint.sh
+
+WORKDIR /workspace
+
+ENTRYPOINT ["/usr/local/bin/entrypoint.sh"]
+CMD ["bash"]