@shopify/cli-kit 4.9.5 → 5.0.1

package/dist/public/node/error/schema.d.ts

@@ -30,24 +30,24 @@ export declare const JsonAbortErrorSchema: zod.ZodObject<{
     type: "abort";
     message: string;
     code?: string | undefined;
+    tryMessage?: string | undefined;
     nextSteps?: string[] | undefined;
     customSections?: {
         body: string | string[][];
         title?: string | undefined;
     }[] | undefined;
     details?: unknown;
-    tryMessage?: string | undefined;
 }, {
     type: "abort";
     message: string;
     code?: string | undefined;
+    tryMessage?: string | undefined;
     nextSteps?: string[] | undefined;
     customSections?: {
         body: string | string[][];
         title?: string | undefined;
     }[] | undefined;
     details?: unknown;
-    tryMessage?: string | undefined;
 }>;
 export declare const JsonBugErrorSchema: zod.ZodObject<{
     stack: zod.ZodOptional<zod.ZodString>;
@@ -71,6 +71,7 @@ export declare const JsonBugErrorSchema: zod.ZodObject<{
     type: "bug";
     message: string;
     code?: string | undefined;
+    tryMessage?: string | undefined;
     stack?: string | undefined;
     nextSteps?: string[] | undefined;
     customSections?: {
@@ -78,11 +79,11 @@ export declare const JsonBugErrorSchema: zod.ZodObject<{
         title?: string | undefined;
     }[] | undefined;
     details?: unknown;
-    tryMessage?: string | undefined;
 }, {
     type: "bug";
     message: string;
     code?: string | undefined;
+    tryMessage?: string | undefined;
     stack?: string | undefined;
     nextSteps?: string[] | undefined;
     customSections?: {
@@ -90,7 +91,6 @@ export declare const JsonBugErrorSchema: zod.ZodObject<{
         title?: string | undefined;
     }[] | undefined;
     details?: unknown;
-    tryMessage?: string | undefined;
 }>;
 export declare const JsonExternalErrorSchema: zod.ZodObject<{
     command: zod.ZodString;
@@ -117,26 +117,26 @@ export declare const JsonExternalErrorSchema: zod.ZodObject<{
     command: string;
     args: string[];
     code?: string | undefined;
+    tryMessage?: string | undefined;
     nextSteps?: string[] | undefined;
     customSections?: {
         body: string | string[][];
         title?: string | undefined;
     }[] | undefined;
     details?: unknown;
-    tryMessage?: string | undefined;
 }, {
     type: "external";
     message: string;
     command: string;
     args: string[];
     code?: string | undefined;
+    tryMessage?: string | undefined;
     nextSteps?: string[] | undefined;
     customSections?: {
         body: string | string[][];
         title?: string | undefined;
     }[] | undefined;
     details?: unknown;
-    tryMessage?: string | undefined;
 }>;
 export declare const JsonErrorSchema: zod.ZodUnion<[zod.ZodObject<{
     message: zod.ZodString;
@@ -159,24 +159,24 @@ export declare const JsonErrorSchema: zod.ZodUnion<[zod.ZodObject<{
     type: "abort";
     message: string;
     code?: string | undefined;
+    tryMessage?: string | undefined;
     nextSteps?: string[] | undefined;
     customSections?: {
         body: string | string[][];
         title?: string | undefined;
     }[] | undefined;
     details?: unknown;
-    tryMessage?: string | undefined;
 }, {
     type: "abort";
     message: string;
     code?: string | undefined;
+    tryMessage?: string | undefined;
     nextSteps?: string[] | undefined;
     customSections?: {
         body: string | string[][];
         title?: string | undefined;
     }[] | undefined;
     details?: unknown;
-    tryMessage?: string | undefined;
 }>, zod.ZodObject<{
     stack: zod.ZodOptional<zod.ZodString>;
     message: zod.ZodString;
@@ -199,6 +199,7 @@ export declare const JsonErrorSchema: zod.ZodUnion<[zod.ZodObject<{
     type: "bug";
     message: string;
     code?: string | undefined;
+    tryMessage?: string | undefined;
     stack?: string | undefined;
     nextSteps?: string[] | undefined;
     customSections?: {
@@ -206,11 +207,11 @@ export declare const JsonErrorSchema: zod.ZodUnion<[zod.ZodObject<{
         title?: string | undefined;
     }[] | undefined;
     details?: unknown;
-    tryMessage?: string | undefined;
 }, {
     type: "bug";
     message: string;
     code?: string | undefined;
+    tryMessage?: string | undefined;
     stack?: string | undefined;
     nextSteps?: string[] | undefined;
     customSections?: {
@@ -218,7 +219,6 @@ export declare const JsonErrorSchema: zod.ZodUnion<[zod.ZodObject<{
         title?: string | undefined;
     }[] | undefined;
     details?: unknown;
-    tryMessage?: string | undefined;
 }>, zod.ZodObject<{
     command: zod.ZodString;
     args: zod.ZodArray<zod.ZodString, "many">;
@@ -244,26 +244,26 @@ export declare const JsonErrorSchema: zod.ZodUnion<[zod.ZodObject<{
     command: string;
     args: string[];
     code?: string | undefined;
+    tryMessage?: string | undefined;
     nextSteps?: string[] | undefined;
     customSections?: {
         body: string | string[][];
         title?: string | undefined;
     }[] | undefined;
     details?: unknown;
-    tryMessage?: string | undefined;
 }, {
     type: "external";
     message: string;
     command: string;
     args: string[];
     code?: string | undefined;
+    tryMessage?: string | undefined;
     nextSteps?: string[] | undefined;
     customSections?: {
         body: string | string[][];
         title?: string | undefined;
     }[] | undefined;
     details?: unknown;
-    tryMessage?: string | undefined;
 }>]>;
 export declare const jsonErrorOutputSchema: import("../json-output-schema.js").JsonOutputSchema<zod.ZodObject<{
     error: zod.ZodUnion<[zod.ZodObject<{
@@ -287,24 +287,24 @@ export declare const jsonErrorOutputSchema: import("../json-output-schema.js").J
         type: "abort";
         message: string;
         code?: string | undefined;
+        tryMessage?: string | undefined;
         nextSteps?: string[] | undefined;
         customSections?: {
             body: string | string[][];
             title?: string | undefined;
         }[] | undefined;
         details?: unknown;
-        tryMessage?: string | undefined;
     }, {
         type: "abort";
         message: string;
         code?: string | undefined;
+        tryMessage?: string | undefined;
         nextSteps?: string[] | undefined;
         customSections?: {
             body: string | string[][];
             title?: string | undefined;
         }[] | undefined;
         details?: unknown;
-        tryMessage?: string | undefined;
     }>, zod.ZodObject<{
         stack: zod.ZodOptional<zod.ZodString>;
         message: zod.ZodString;
@@ -327,6 +327,7 @@ export declare const jsonErrorOutputSchema: import("../json-output-schema.js").J
         type: "bug";
         message: string;
         code?: string | undefined;
+        tryMessage?: string | undefined;
         stack?: string | undefined;
         nextSteps?: string[] | undefined;
         customSections?: {
@@ -334,11 +335,11 @@ export declare const jsonErrorOutputSchema: import("../json-output-schema.js").J
             title?: string | undefined;
         }[] | undefined;
         details?: unknown;
-        tryMessage?: string | undefined;
     }, {
         type: "bug";
         message: string;
         code?: string | undefined;
+        tryMessage?: string | undefined;
         stack?: string | undefined;
         nextSteps?: string[] | undefined;
         customSections?: {
@@ -346,7 +347,6 @@ export declare const jsonErrorOutputSchema: import("../json-output-schema.js").J
             title?: string | undefined;
         }[] | undefined;
         details?: unknown;
-        tryMessage?: string | undefined;
     }>, zod.ZodObject<{
         command: zod.ZodString;
         args: zod.ZodArray<zod.ZodString, "many">;
@@ -372,43 +372,44 @@ export declare const jsonErrorOutputSchema: import("../json-output-schema.js").J
         command: string;
         args: string[];
         code?: string | undefined;
+        tryMessage?: string | undefined;
         nextSteps?: string[] | undefined;
         customSections?: {
             body: string | string[][];
             title?: string | undefined;
         }[] | undefined;
         details?: unknown;
-        tryMessage?: string | undefined;
     }, {
         type: "external";
         message: string;
         command: string;
         args: string[];
         code?: string | undefined;
+        tryMessage?: string | undefined;
         nextSteps?: string[] | undefined;
         customSections?: {
             body: string | string[][];
             title?: string | undefined;
         }[] | undefined;
         details?: unknown;
-        tryMessage?: string | undefined;
     }>]>;
 }, "strict", zod.ZodTypeAny, {
     error: {
         type: "abort";
         message: string;
         code?: string | undefined;
+        tryMessage?: string | undefined;
         nextSteps?: string[] | undefined;
         customSections?: {
             body: string | string[][];
             title?: string | undefined;
         }[] | undefined;
         details?: unknown;
-        tryMessage?: string | undefined;
     } | {
         type: "bug";
         message: string;
         code?: string | undefined;
+        tryMessage?: string | undefined;
         stack?: string | undefined;
         nextSteps?: string[] | undefined;
         customSections?: {
@@ -416,37 +417,37 @@ export declare const jsonErrorOutputSchema: import("../json-output-schema.js").J
             title?: string | undefined;
         }[] | undefined;
         details?: unknown;
-        tryMessage?: string | undefined;
     } | {
         type: "external";
         message: string;
         command: string;
         args: string[];
         code?: string | undefined;
+        tryMessage?: string | undefined;
         nextSteps?: string[] | undefined;
         customSections?: {
             body: string | string[][];
             title?: string | undefined;
         }[] | undefined;
         details?: unknown;
-        tryMessage?: string | undefined;
     };
 }, {
     error: {
         type: "abort";
         message: string;
         code?: string | undefined;
+        tryMessage?: string | undefined;
         nextSteps?: string[] | undefined;
         customSections?: {
             body: string | string[][];
             title?: string | undefined;
         }[] | undefined;
         details?: unknown;
-        tryMessage?: string | undefined;
     } | {
         type: "bug";
         message: string;
         code?: string | undefined;
+        tryMessage?: string | undefined;
         stack?: string | undefined;
         nextSteps?: string[] | undefined;
         customSections?: {
@@ -454,19 +455,18 @@ export declare const jsonErrorOutputSchema: import("../json-output-schema.js").J
             title?: string | undefined;
         }[] | undefined;
         details?: unknown;
-        tryMessage?: string | undefined;
     } | {
         type: "external";
         message: string;
         command: string;
         args: string[];
         code?: string | undefined;
+        tryMessage?: string | undefined;
         nextSteps?: string[] | undefined;
         customSections?: {
             body: string | string[][];
             title?: string | undefined;
         }[] | undefined;
         details?: unknown;
-        tryMessage?: string | undefined;
     };
 }>>;

package/dist/public/node/error/serialization.d.ts

@@ -0,0 +1,8 @@
+import type { JsonError } from './types.js';
+/**
+ * Projects an error into the shared JSON error contract, retaining only allowlisted fields.
+ *
+ * @param source - Error to project.
+ * @returns The error classification, message, and available recovery information.
+ */
+export declare function errorToJson(source: unknown): JsonError;

package/dist/public/node/error/serialization.js

@@ -0,0 +1,103 @@
+import { FatalErrorType } from './index.js';
+import { tokenItemToJsonString } from '../../../private/node/ui/components/token-item.js';
+import { unstyled } from '../output.js';
+function externalCommand(error) {
+    if (typeof error.command !== 'string' || !Array.isArray(error.args))
+        return;
+    if (!error.args.every((arg) => typeof arg === 'string'))
+        return;
+    return { command: error.command, args: error.args };
+}
+function jsonErrorType(error, external) {
+    if (error.type === FatalErrorType.Abort) {
+        return external ? 'external' : 'abort';
+    }
+    return 'bug';
+}
+function jsonTokenItem(token) {
+    if (token === null || token === undefined)
+        return;
+    try {
+        const message = tokenItemToJsonString(token);
+        return typeof message === 'string' ? unstyled(message) : undefined;
+    }
+    catch (error) {
+        if (error instanceof TypeError)
+            return undefined;
+        throw error;
+    }
+}
+function jsonTokenItems(items) {
+    if (!Array.isArray(items))
+        return;
+    const renderedItems = items.map(jsonTokenItem).filter((item) => item !== undefined);
+    return renderedItems.length > 0 ? renderedItems : undefined;
+}
+function jsonTable(data) {
+    if (!Array.isArray(data))
+        return;
+    return data
+        .filter((row) => Array.isArray(row))
+        .map((row) => row.map((cell) => jsonTokenItem(cell) ?? ''));
+}
+function jsonCustomSection(section) {
+    if (typeof section !== 'object' || section === null || !('body' in section))
+        return;
+    const title = 'title' in section && typeof section.title === 'string' ? unstyled(section.title) : undefined;
+    const sectionBody = section.body;
+    const body = typeof sectionBody === 'object' && sectionBody !== null && 'tabularData' in sectionBody
+        ? jsonTable(sectionBody.tabularData)
+        : jsonTokenItem(sectionBody);
+    if (body === undefined)
+        return;
+    return { ...(title ? { title } : {}), body };
+}
+function jsonCustomSections(sections) {
+    if (!Array.isArray(sections))
+        return;
+    const renderedSections = sections
+        .map(jsonCustomSection)
+        .filter((section) => section !== undefined);
+    return renderedSections.length > 0 ? renderedSections : undefined;
+}
+/**
+ * Projects an error into the shared JSON error contract, retaining only allowlisted fields.
+ *
+ * @param source - Error to project.
+ * @returns The error classification, message, and available recovery information.
+ */
+export function errorToJson(source) {
+    const error = typeof source === 'object' && source !== null ? source : { message: source };
+    const external = externalCommand(error);
+    const type = jsonErrorType(error, external);
+    const formattedMessage = jsonTokenItem(error.formattedMessage);
+    const message = formattedMessage ?? (typeof error.message === 'string' ? unstyled(error.message) : 'Unknown error');
+    const tryMessage = jsonTokenItem(error.tryMessage);
+    const nextSteps = jsonTokenItems(error.nextSteps);
+    const customSections = jsonCustomSections(error.customSections);
+    const details = error.details;
+    const commonFields = {
+        message,
+        ...(typeof error.code === 'string' && error.code.length > 0 ? { code: error.code } : {}),
+        ...(tryMessage === undefined ? {} : { tryMessage }),
+        ...(nextSteps === undefined ? {} : { nextSteps }),
+        ...(customSections === undefined ? {} : { customSections }),
+        ...(details === undefined ? {} : { details }),
+    };
+    let jsonError;
+    if (type === 'bug') {
+        jsonError = {
+            type,
+            ...commonFields,
+            ...(typeof error.stack === 'string' ? { stack: unstyled(error.stack) } : {}),
+        };
+    }
+    else if (type === 'external' && external) {
+        jsonError = { type, ...commonFields, ...external };
+    }
+    else {
+        jsonError = { type: 'abort', ...commonFields };
+    }
+    return jsonError;
+}
+//# sourceMappingURL=serialization.js.map

package/dist/public/node/error/serialization.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"serialization.js","sourceRoot":"","sources":["../../../../src/public/node/error/serialization.ts"],"names":[],"mappings":"AAAA,OAAO,EAAC,cAAc,EAAC,MAAM,YAAY,CAAA;AACzC,OAAO,EAAC,qBAAqB,EAAiB,MAAM,mDAAmD,CAAA;AACvG,OAAO,EAAC,QAAQ,EAAC,MAAM,cAAc,CAAA;AAsBrC,SAAS,eAAe,CAAC,KAAqB;IAC5C,IAAI,OAAO,KAAK,CAAC,OAAO,KAAK,QAAQ,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,IAAI,CAAC;QAAE,OAAM;IAC3E,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,OAAO,GAAG,KAAK,QAAQ,CAAC;QAAE,OAAM;IAE/D,OAAO,EAAC,OAAO,EAAE,KAAK,CAAC,OAAO,EAAE,IAAI,EAAE,KAAK,CAAC,IAAI,EAAC,CAAA;AACnD,CAAC;AAED,SAAS,aAAa,CAAC,KAAqB,EAAE,QAAqC;IACjF,IAAI,KAAK,CAAC,IAAI,KAAK,cAAc,CAAC,KAAK,EAAE,CAAC;QACxC,OAAO,QAAQ,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC,OAAO,CAAA;IACxC,CAAC;IACD,OAAO,KAAK,CAAA;AACd,CAAC;AAED,SAAS,aAAa,CAAC,KAAc;IACnC,IAAI,KAAK,KAAK,IAAI,IAAI,KAAK,KAAK,SAAS;QAAE,OAAM;IAEjD,IAAI,CAAC;QACH,MAAM,OAAO,GAAG,qBAAqB,CAAC,KAAkB,CAAC,CAAA;QACzD,OAAO,OAAO,OAAO,KAAK,QAAQ,CAAC,CAAC,CAAC,QAAQ,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,SAAS,CAAA;IACpE,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,IAAI,KAAK,YAAY,SAAS;YAAE,OAAO,SAAS,CAAA;QAChD,MAAM,KAAK,CAAA;IACb,CAAC;AACH,CAAC;AAED,SAAS,cAAc,CAAC,KAAc;IACpC,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC;QAAE,OAAM;IAEjC,MAAM,aAAa,GAAG,KAAK,CAAC,GAAG,CAAC,aAAa,CAAC,CAAC,MAAM,CAAC,CAAC,IAAI,EAAkB,EAAE,CAAC,IAAI,KAAK,SAAS,CAAC,CAAA;IACnG,OAAO,aAAa,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,aAAa,CAAC,CAAC,CAAC,SAAS,CAAA;AAC7D,CAAC;AAED,SAAS,SAAS,CAAC,IAAa;IAC9B,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC;QAAE,OAAM;IAEhC,OAAO,IAAI;SACR,MAAM,CAAC,CAAC,GAAG,EAAoB,EAAE,CAAC,KAAK,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;SACrD,GAAG,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,aAAa,CAAC,IAAI,CAAC,IAAI,EAAE,CAAC,CAAC,CAAA;AAC/D,CAAC;AAED,SAAS,iBAAiB,CAAC,OAAgB;IACzC,IAAI,OAAO,OAAO,KAAK,QAAQ,IAAI,OAAO,KAAK,IAAI,IAAI,CAAC,CAAC,MAAM,IAAI,OAAO,CAAC;QAAE,OAAM;IAEnF,MAAM,KAAK,GAAG,OAAO,IAAI,OAAO,IAAI,OAAO,OAAO,CAAC,KAAK,KAAK,QAAQ,CAAC,CAAC,CAAC,QAAQ,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,SAAS,CAAA;IAC3G,MAAM,WAAW,GAAG,OAAO,CAAC,IAAI,CAAA;IAChC,MAAM,IAAI,GACR,OAAO,WAAW,KAAK,QAAQ,IAAI,WAAW,KAAK,IAAI,IAAI,aAAa,IAAI,WAAW;QACrF,CAAC,CAAC,SAAS,CAAC,WAAW,CAAC,WAAW,CAAC;QACpC,CAAC,CAAC,aAAa,CAAC,WAAW,CAAC,CAAA;IAEhC,IAAI,IAAI,KAAK,SAAS;QAAE,OAAM;IAC9B,OAAO,EAAC,GAAG,CAAC,KAAK,CAAC,CAAC,CAAC,EAAC,KAAK,EAAC,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,IAAI,EAAC,CAAA;AAC1C,CAAC;AAED,SAAS,kBAAkB,CAAC,QAAiB;IAC3C,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,QAAQ,CAAC;QAAE,OAAM;IAEpC,MAAM,gBAAgB,GAAG,QAAQ;SAC9B,GAAG,CAAC,iBAAiB,CAAC;SACtB,MAAM,CAAC,CAAC,OAAO,EAAqC,EAAE,CAAC,OAAO,KAAK,SAAS,CAAC,CAAA;IAChF,OAAO,gBAAgB,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,gBAAgB,CAAC,CAAC,CAAC,SAAS,CAAA;AACnE,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,WAAW,CAAC,MAAe;IACzC,MAAM,KAAK,GAAmB,OAAO,MAAM,KAAK,QAAQ,IAAI,MAAM,KAAK,IAAI,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAC,OAAO,EAAE,MAAM,EAAC,CAAA;IAExG,MAAM,QAAQ,GAAG,eAAe,CAAC,KAAK,CAAC,CAAA;IACvC,MAAM,IAAI,GAAG,aAAa,CAAC,KAAK,EAAE,QAAQ,CAAC,CAAA;IAC3C,MAAM,gBAAgB,GAAG,aAAa,CAAC,KAAK,CAAC,gBAAgB,CAAC,CAAA;IAC9D,MAAM,OAAO,GAAG,gBAAgB,IAAI,CAAC,OAAO,KAAK,CAAC,OAAO,KAAK,QAAQ,CAAC,CAAC,CAAC,QAAQ,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,eAAe,CAAC,CAAA;IACnH,MAAM,UAAU,GAAG,aAAa,CAAC,KAAK,CAAC,UAAU,CAAC,CAAA;IAClD,MAAM,SAAS,GAAG,cAAc,CAAC,KAAK,CAAC,SAAS,CAAC,CAAA;IACjD,MAAM,cAAc,GAAG,kBAAkB,CAAC,KAAK,CAAC,cAAc,CAAC,CAAA;IAC/D,MAAM,OAAO,GAAG,KAAK,CAAC,OAAO,CAAA;IAE7B,MAAM,YAAY,GAAG;QACnB,OAAO;QACP,GAAG,CAAC,OAAO,KAAK,CAAC,IAAI,KAAK,QAAQ,IAAI,KAAK,CAAC,IAAI,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,EAAC,IAAI,EAAE,KAAK,CAAC,IAAI,EAAC,CAAC,CAAC,CAAC,EAAE,CAAC;QACtF,GAAG,CAAC,UAAU,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAC,UAAU,EAAC,CAAC;QACjD,GAAG,CAAC,SAAS,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAC,SAAS,EAAC,CAAC;QAC/C,GAAG,CAAC,cAAc,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAC,cAAc,EAAC,CAAC;QACzD,GAAG,CAAC,OAAO,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAC,OAAO,EAAC,CAAC;KAC5C,CAAA;IAED,IAAI,SAAoB,CAAA;IACxB,IAAI,IAAI,KAAK,KAAK,EAAE,CAAC;QACnB,SAAS,GAAG;YACV,IAAI;YACJ,GAAG,YAAY;YACf,GAAG,CAAC,OAAO,KAAK,CAAC,KAAK,KAAK,QAAQ,CAAC,CAAC,CAAC,EAAC,KAAK,EAAE,QAAQ,CAAC,KAAK,CAAC,KAAK,CAAC,EAAC,CAAC,CAAC,CAAC,EAAE,CAAC;SAC3E,CAAA;IACH,CAAC;SAAM,IAAI,IAAI,KAAK,UAAU,IAAI,QAAQ,EAAE,CAAC;QAC3C,SAAS,GAAG,EAAC,IAAI,EAAE,GAAG,YAAY,EAAE,GAAG,QAAQ,EAAC,CAAA;IAClD,CAAC;SAAM,CAAC;QACN,SAAS,GAAG,EAAC,IAAI,EAAE,OAAO,EAAE,GAAG,YAAY,EAAC,CAAA;IAC9C,CAAC;IAED,OAAO,SAAS,CAAA;AAClB,CAAC","sourcesContent":["import {FatalErrorType} from './index.js'\nimport {tokenItemToJsonString, type TokenItem} from '../../../private/node/ui/components/token-item.js'\nimport {unstyled} from '../output.js'\nimport type {JsonError, JsonErrorCustomSection, JsonErrorType} from './types.js'\n\ninterface FatalErrorLike {\n  type?: number\n  message?: unknown\n  formattedMessage?: unknown\n  tryMessage?: unknown\n  nextSteps?: unknown\n  customSections?: unknown\n  stack?: unknown\n  command?: unknown\n  args?: unknown\n  details?: unknown\n  code?: unknown\n}\n\ninterface ExternalCommand {\n  command: string\n  args: string[]\n}\n\nfunction externalCommand(error: FatalErrorLike): ExternalCommand | undefined {\n  if (typeof error.command !== 'string' || !Array.isArray(error.args)) return\n  if (!error.args.every((arg) => typeof arg === 'string')) return\n\n  return {command: error.command, args: error.args}\n}\n\nfunction jsonErrorType(error: FatalErrorLike, external: ExternalCommand | undefined): JsonErrorType {\n  if (error.type === FatalErrorType.Abort) {\n    return external ? 'external' : 'abort'\n  }\n  return 'bug'\n}\n\nfunction jsonTokenItem(token: unknown): string | undefined {\n  if (token === null || token === undefined) return\n\n  try {\n    const message = tokenItemToJsonString(token as TokenItem)\n    return typeof message === 'string' ? unstyled(message) : undefined\n  } catch (error) {\n    if (error instanceof TypeError) return undefined\n    throw error\n  }\n}\n\nfunction jsonTokenItems(items: unknown): string[] | undefined {\n  if (!Array.isArray(items)) return\n\n  const renderedItems = items.map(jsonTokenItem).filter((item): item is string => item !== undefined)\n  return renderedItems.length > 0 ? renderedItems : undefined\n}\n\nfunction jsonTable(data: unknown): string[][] | undefined {\n  if (!Array.isArray(data)) return\n\n  return data\n    .filter((row): row is unknown[] => Array.isArray(row))\n    .map((row) => row.map((cell) => jsonTokenItem(cell) ?? ''))\n}\n\nfunction jsonCustomSection(section: unknown): JsonErrorCustomSection | undefined {\n  if (typeof section !== 'object' || section === null || !('body' in section)) return\n\n  const title = 'title' in section && typeof section.title === 'string' ? unstyled(section.title) : undefined\n  const sectionBody = section.body\n  const body =\n    typeof sectionBody === 'object' && sectionBody !== null && 'tabularData' in sectionBody\n      ? jsonTable(sectionBody.tabularData)\n      : jsonTokenItem(sectionBody)\n\n  if (body === undefined) return\n  return {...(title ? {title} : {}), body}\n}\n\nfunction jsonCustomSections(sections: unknown): JsonErrorCustomSection[] | undefined {\n  if (!Array.isArray(sections)) return\n\n  const renderedSections = sections\n    .map(jsonCustomSection)\n    .filter((section): section is JsonErrorCustomSection => section !== undefined)\n  return renderedSections.length > 0 ? renderedSections : undefined\n}\n\n/**\n * Projects an error into the shared JSON error contract, retaining only allowlisted fields.\n *\n * @param source - Error to project.\n * @returns The error classification, message, and available recovery information.\n */\nexport function errorToJson(source: unknown): JsonError {\n  const error: FatalErrorLike = typeof source === 'object' && source !== null ? source : {message: source}\n\n  const external = externalCommand(error)\n  const type = jsonErrorType(error, external)\n  const formattedMessage = jsonTokenItem(error.formattedMessage)\n  const message = formattedMessage ?? (typeof error.message === 'string' ? unstyled(error.message) : 'Unknown error')\n  const tryMessage = jsonTokenItem(error.tryMessage)\n  const nextSteps = jsonTokenItems(error.nextSteps)\n  const customSections = jsonCustomSections(error.customSections)\n  const details = error.details\n\n  const commonFields = {\n    message,\n    ...(typeof error.code === 'string' && error.code.length > 0 ? {code: error.code} : {}),\n    ...(tryMessage === undefined ? {} : {tryMessage}),\n    ...(nextSteps === undefined ? {} : {nextSteps}),\n    ...(customSections === undefined ? {} : {customSections}),\n    ...(details === undefined ? {} : {details}),\n  }\n\n  let jsonError: JsonError\n  if (type === 'bug') {\n    jsonError = {\n      type,\n      ...commonFields,\n      ...(typeof error.stack === 'string' ? {stack: unstyled(error.stack)} : {}),\n    }\n  } else if (type === 'external' && external) {\n    jsonError = {type, ...commonFields, ...external}\n  } else {\n    jsonError = {type: 'abort', ...commonFields}\n  }\n\n  return jsonError\n}\n"]}

package/dist/public/node/graphiql/server.js

@@ -40,6 +40,22 @@ export function resolveGraphiQLKey(providedKey, apiSecret, storeFqdn) {
     return providedKey?.trim() || deriveGraphiQLKey(apiSecret, storeFqdn);
 }
 const require = createRequire(import.meta.url);
+/**
+ * Serializes a value as JSON that is safe to place inside an inline `<script>` element.
+ * `JSON.stringify` alone leaves `<`, `>` and `&` as-is, so a value could close the script element early. Escaping
+ * them (and the U+2028/U+2029 line separators) as `\uXXXX` sequences keeps the JavaScript value identical.
+ *
+ * @param value - The value to serialize.
+ * @returns A JSON string that can be interpolated into an inline script.
+ */
+function serializeForInlineScript(value) {
+    return JSON.stringify(value)
+        .replace(/</g, '\\u003c')
+        .replace(/>/g, '\\u003e')
+        .replace(/&/g, '\\u0026')
+        .replace(/\u2028/g, '\\u2028')
+        .replace(/\u2029/g, '\\u2029');
+}
 class TokenRefreshError extends AbortError {
     constructor() {
         super('Failed to refresh credentials. Check that your app is installed, and try again.');
@@ -152,8 +168,8 @@ export function setupGraphiQLServer(options) {
         }), {
             url,
             defaultQueries: [{ query: defaultQuery }],
-            query: queryParam ? JSON.stringify(queryParam) : undefined,
-            variables: variables ? JSON.stringify(variables) : undefined,
+            query: queryParam ? serializeForInlineScript(queryParam) : undefined,
+            variables: variables ? serializeForInlineScript(variables) : undefined,
         });
     }));
     router.post('/graphiql/graphql.json', defineEventHandler(async (event) => {

package/dist/public/node/graphiql/server.js.map

@@ -1 +1 @@
-{"version":3,"file":"server.js","sourceRoot":"","sources":["../../../../src/public/node/graphiql/server.ts"],"names":[],"mappings":"AAAA,OAAO,EAAC,YAAY,EAAE,gBAAgB,EAAC,MAAM,yBAAyB,CAAA;AACtE,OAAO,EAAC,oBAAoB,EAAC,MAAM,6BAA6B,CAAA;AAChE,OAAO,EAAC,mBAAmB,EAAC,MAAM,gBAAgB,CAAA;AAClD,OAAO,EAAC,mCAAmC,EAAC,MAAM,uBAAuB,CAAA;AACzE,OAAO,EAAC,eAAe,EAAC,MAAM,yBAAyB,CAAA;AACvD,OAAO,EAAC,UAAU,EAAC,MAAM,aAAa,CAAA;AACtC,OAAO,EAAC,QAAQ,EAAE,oBAAoB,EAAC,MAAM,iBAAiB,CAAA;AAC9D,OAAO,EAAC,KAAK,EAAC,MAAM,YAAY,CAAA;AAChC,OAAO,EAAC,oBAAoB,EAAC,MAAM,cAAc,CAAA;AACjD,OAAO,EAAC,WAAW,EAAC,MAAM,cAAc,CAAA;AACxC,OAAO,EAAC,gBAAgB,EAAC,MAAM,eAAe,CAAA;AAC9C,OAAO,EACL,SAAS,EACT,YAAY,EACZ,kBAAkB,EAClB,QAAQ,EACR,gBAAgB,EAChB,iBAAiB,EACjB,QAAQ,EACR,iBAAiB,EACjB,iBAAiB,EACjB,cAAc,GACf,MAAM,IAAI,CAAA;AACX,OAAO,EAAC,UAAU,EAAE,WAAW,EAAC,MAAM,QAAQ,CAAA;AAC9C,OAAO,EAAC,YAAY,EAAS,MAAM,MAAM,CAAA;AACzC,OAAO,EAAC,YAAY,EAAC,MAAM,IAAI,CAAA;AAE/B,OAAO,EAAC,aAAa,EAAC,MAAM,QAAQ,CAAA;AAEpC;;;;;;;;GAQG;AACH,MAAM,UAAU,iBAAiB,CAAC,SAAiB,EAAE,SAAiB;IACpE,OAAO,UAAU,CAAC,QAAQ,EAAE,SAAS,CAAC,CAAC,MAAM,CAAC,YAAY,SAAS,EAAE,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAA;AACtF,CAAC;AAED;;;;;;;;GAQG;AACH,MAAM,UAAU,kBAAkB,CAAC,WAA+B,EAAE,SAAiB,EAAE,SAAiB;IACtG,yJAAyJ;IACzJ,OAAO,WAAW,EAAE,IAAI,EAAE,IAAI,iBAAiB,CAAC,SAAS,EAAE,SAAS,CAAC,CAAA;AACvE,CAAC;AAED,MAAM,OAAO,GAAG,aAAa,CAAC,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,CAAA;AAE9C,MAAM,iBAAkB,SAAQ,UAAU;IACxC;QACE,KAAK,CAAC,iFAAiF,CAAC,CAAA;IAC1F,CAAC;CACF;AAmDD,MAAM,CAAC,MAAM,yBAAyB,GAAG,4EAA4E,CAAA;AAErH;;;;;;;;;GASG;AACH,MAAM,UAAU,mBAAmB,CAAC,OAAmC;IACrE,MAAM,EAAC,MAAM,EAAE,IAAI,EAAE,SAAS,EAAE,aAAa,EAAE,GAAG,EAAE,WAAW,EAAE,UAAU,EAAE,gBAAgB,GAAG,KAAK,EAAC,GAAG,OAAO,CAAA;IAChH,MAAM,GAAG,GAAG,wBAAwB,CAAC,WAAW,EAAE,UAAU,EAAE,SAAS,CAAC,CAAA;IACxE,WAAW,CAAC,2CAA2C,IAAI,KAAK,EAAE,MAAM,CAAC,CAAA;IAEzE,MAAM,GAAG,GAAG,SAAS,EAAE,CAAA;IACvB,MAAM,MAAM,GAAG,YAAY,EAAE,CAAA;IAE7B,MAAM,oBAAoB,GAAG,KAAK,IAAqB,EAAE;QACvD,IAAI,CAAC;YACH,WAAW,CAAC,kBAAkB,EAAE,MAAM,CAAC,CAAA;YACvC,OAAO,MAAM,CAAC,aAAa,CAAC,YAAY,IAAI,aAAa,CAAC,QAAQ,CAAC,EAAE,CAAA;QACvE,CAAC;QAAC,OAAO,MAAM,EAAE,CAAC;YAChB,MAAM,IAAI,iBAAiB,EAAE,CAAA;QAC/B,CAAC;IACH,CAAC,CAAA;IAED,MAAM,YAAY,GAAG,KAAK,IAAqB,EAAE;QAC/C,IAAI,CAAC;YACH,OAAO,MAAM,aAAa,CAAC,QAAQ,EAAE,CAAA;QACvC,CAAC;QAAC,OAAO,MAAM,EAAE,CAAC;YAChB,MAAM,IAAI,iBAAiB,EAAE,CAAA;QAC/B,CAAC;IACH,CAAC,CAAA;IAED,KAAK,UAAU,gCAAgC;QAC7C,OAAO,mCAAmC,CACxC,KAAK,IAAI,EAAE,CAAC,oBAAoB,CAAC,EAAC,SAAS,EAAE,KAAK,EAAE,MAAM,YAAY,EAAE,EAAC,CAAC,EAC1E,oBAAoB,CACrB,CAAA;IACH,CAAC;IAED,MAAM,WAAW,GAAG,OAAO,CAAC,OAAO,CAAC,yCAAyC,CAAC,CAAA;IAC9E,MAAM,cAAc,GAAG,YAAY,CAAC,WAAW,CAAC,CAAA;IAChD,MAAM,SAAS,GAAG,OAAO,CAAC,OAAO,CAAC,uCAAuC,CAAC,CAAA;IAC1E,MAAM,YAAY,GAAG,YAAY,CAAC,SAAS,EAAE,MAAM,CAAC,CAAA;IAEpD,GAAG,CAAC,GAAG,CACL,kBAAkB,CAAC,CAAC,KAAK,EAAE,EAAE;QAC3B,iBAAiB,CAAC,KAAK,EAAE,6BAA6B,EAAE,GAAG,CAAC,CAAA;QAC5D,iBAAiB,CAAC,KAAK,EAAE,8BAA8B,EAAE,cAAc,CAAC,CAAA;QACxE,iBAAiB,CACf,KAAK,EACL,8BAA8B,EAC9B,gHAAgH,CACjH,CAAA;IACH,CAAC,CAAC,CACH,CAAA;IAED,MAAM,CAAC,GAAG,CACR,gBAAgB,EAChB,kBAAkB,CAAC,GAAG,EAAE,CAAC,MAAM,CAAC,CACjC,CAAA;IAED,MAAM,CAAC,GAAG,CACR,uBAAuB,EACvB,kBAAkB,CAAC,CAAC,KAAK,EAAE,EAAE;QAC3B,iBAAiB,CAAC,KAAK,EAAE,cAAc,EAAE,cAAc,CAAC,CAAA;QACxD,OAAO,cAAc,CAAA;IACvB,CAAC,CAAC,CACH,CAAA;IAED,MAAM,CAAC,GAAG,CACR,sBAAsB,EACtB,kBAAkB,CAAC,CAAC,KAAK,EAAE,EAAE;QAC3B,iBAAiB,CAAC,KAAK,EAAE,cAAc,EAAE,UAAU,CAAC,CAAA;QACpD,OAAO,YAAY,CAAA;IACrB,CAAC,CAAC,CACH,CAAA;IAED,MAAM,CAAC,GAAG,CACR,kBAAkB,EAClB,kBAAkB,CAAC,KAAK,IAAI,EAAE;QAC5B,IAAI,CAAC;YACH,MAAM,gCAAgC,EAAE,CAAA;YACxC,OAAO,EAAC,MAAM,EAAE,IAAI,EAAE,SAAS,EAAE,OAAO,EAAE,UAAU,EAAE,OAAO,EAAE,MAAM,EAAE,UAAU,EAAE,MAAM,EAAC,CAAA;YAC1F,qDAAqD;QACvD,CAAC;QAAC,MAAM,CAAC;YACP,OAAO,EAAC,MAAM,EAAE,iBAAiB,EAAC,CAAA;QACpC,CAAC;IACH,CAAC,CAAC,CACH,CAAA;IAED,MAAM,CAAC,GAAG,CACR,WAAW,EACX,kBAAkB,CAAC,KAAK,EAAE,KAAK,EAAE,EAAE;QACjC,WAAW,CAAC,4BAA4B,EAAE,MAAM,CAAC,CAAA;QAEjD,MAAM,KAAK,GAAG,QAAQ,CAAC,KAAK,CAAC,CAAA;QAE7B,IAAI,GAAG,IAAI,KAAK,CAAC,GAAG,KAAK,GAAG,EAAE,CAAC;YAC7B,iBAAiB,CAAC,KAAK,EAAE,GAAG,CAAC,CAAA;YAC7B,OAAO,gBAAgB,KAAK,CAAC,IAAI,EAAE,CAAA;QACrC,CAAC;QAED,MAAM,cAAc,GAAG,gBAAgB,CAAC,KAAK,EAAE,mBAAmB,CAAC,CAAA;QACnE,MAAM,SAAS,GAAG,cAAc,KAAK,OAAO,CAAA;QAC5C,MAAM,IAAI,GAAG,gBAAgB,CAAC,KAAK,EAAE,MAAM,CAAC,CAAA;QAC5C,MAAM,GAAG,GAAG,OAAO,SAAS,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,MAAM,IAAI,EAAE,CAAA;QAEnD,IAAI,WAAqB,CAAA;QACzB,IAAI,CAAC;YACH,WAAW,GAAG,MAAM,gCAAgC,EAAE,CAAA;QACxD,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,IAAI,GAAG,YAAY,iBAAiB,EAAE,CAAC;gBACrC,OAAO,oBAAoB,CAAC,oBAAoB,CAAC,EAAC,aAAa,EAAE,OAAO,CAAC,UAAU,CAAC,EAAC,CAAC,EAAE;oBACtF,UAAU,EAAE,UAAU,EAAE,MAAM,IAAI,EAAE;oBACpC,SAAS;oBACT,GAAG;iBACJ,CAAC,CAAA;YACJ,CAAC;YACD,MAAM,GAAG,CAAA;QACX,CAAC;QAED,MAAM,UAAU,GAAG,WAAW,CAAC,IAAI,EAAE,CAAC,OAAO,EAAE,CAAC,CAAC,CAAE,CAAA;QAEnD,SAAS,iBAAiB,CAAC,KAAyB;YAClD,OAAO,KAAK,CAAC,CAAC,CAAC,kBAAkB,CAAC,KAAK,CAAC,CAAC,OAAO,CAAC,KAAK,EAAE,KAAK,CAAC,CAAC,CAAC,CAAC,SAAS,CAAA;QAC5E,CAAC;QAED,MAAM,UAAU,GAAG,iBAAiB,CAAC,KAAK,CAAC,KAA2B,CAAC,CAAA;QACvE,MAAM,SAAS,GAAG,iBAAiB,CAAC,KAAK,CAAC,SAA+B,CAAC,CAAA;QAE1E,OAAO,oBAAoB,CACzB,gBAAgB,CAAC;YACf,UAAU;YACV,WAAW,EAAE,CAAC,GAAG,WAAW,EAAE,UAAU,CAAC;YACzC,OAAO,EAAE,UAAU,EAAE,OAAO;YAC5B,MAAM,EAAE,UAAU,EAAE,MAAM;YAC1B,GAAG;YACH,SAAS;YACT,gBAAgB;SACjB,CAAC,EACF;YACE,GAAG;YACH,cAAc,EAAE,CAAC,EAAC,KAAK,EAAE,YAAY,EAAC,CAAC;YACvC,KAAK,EAAE,UAAU,CAAC,CAAC,CAAC,IAAI,CAAC,SAAS,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC,SAAS;YAC1D,SAAS,EAAE,SAAS,CAAC,CAAC,CAAC,IAAI,CAAC,SAAS,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,SAAS;SAC7D,CACF,CAAA;IACH,CAAC,CAAC,CACH,CAAA;IAED,MAAM,CAAC,IAAI,CACT,wBAAwB,EACxB,kBAAkB,CAAC,KAAK,EAAE,KAAK,EAAE,EAAE;QACjC,WAAW,CAAC,yCAAyC,EAAE,MAAM,CAAC,CAAA;QAE9D,MAAM,KAAK,GAAG,QAAQ,CAAC,KAAK,CAAC,CAAA;QAE7B,IAAI,GAAG,IAAI,KAAK,CAAC,GAAG,KAAK,GAAG,EAAE,CAAC;YAC7B,iBAAiB,CAAC,KAAK,EAAE,GAAG,CAAC,CAAA;YAC7B,OAAO,gBAAgB,KAAK,CAAC,IAAI,EAAE,CAAA;QACrC,CAAC;QAED,MAAM,UAAU,GAAG,QAAQ,CAAC,SAAS,EAAE,KAAK,CAAC,WAAqB,CAAC,CAAA;QACnE,IAAI,CAAC;YACH,MAAM,IAAI,GAAG,MAAM,QAAQ,CAAC,KAAK,CAAC,CAAA;YAElC,IAAI,gBAAgB,IAAI,qBAAqB,CAAC,IAAI,CAAC,EAAE,CAAC;gBACpD,iBAAiB,CAAC,KAAK,EAAE,GAAG,CAAC,CAAA;gBAC7B,OAAO,EAAC,MAAM,EAAE,CAAC,EAAC,OAAO,EAAE,yBAAyB,EAAC,CAAC,EAAC,CAAA;YACzD,CAAC;YAED,MAAM,OAAO,GAAG,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,CAAA;YAEpC,MAAM,UAAU,GAAG,iBAAiB,CAAC,KAAK,CAAC,CAAA;YAC3C,MAAM,aAAa,GAAG,mBAAmB,CAAC,UAAU,CAAC,CAAA;YAErD,MAAM,UAAU,GAAG,KAAK,EAAE,KAAa,EAAE,EAAE;gBACzC,MAAM,OAAO,GAAG;oBACd,GAAG,aAAa;oBAChB,MAAM,EAAE,kBAAkB;oBAC1B,cAAc,EAAE,kBAAkB;oBAClC,wBAAwB,EAAE,KAAK;oBAC/B,YAAY,EAAE,sBAAsB,eAAe,EAAE;iBACtD,CAAA;gBAED,OAAO,KAAK,CAAC,UAAU,EAAE;oBACvB,MAAM,EAAE,MAAM;oBACd,OAAO;oBACP,IAAI,EAAE,OAAO;iBACd,CAAC,CAAA;YACJ,CAAC,CAAA;YAED,IAAI,MAAM,GAAG,MAAM,UAAU,CAAC,MAAM,YAAY,EAAE,CAAC,CAAA;YACnD,IAAI,MAAM,CAAC,MAAM,KAAK,GAAG,EAAE,CAAC;gBAC1B,WAAW,CAAC,mCAAmC,EAAE,MAAM,CAAC,CAAA;gBACxD,MAAM,GAAG,MAAM,UAAU,CAAC,MAAM,oBAAoB,EAAE,CAAC,CAAA;YACzD,CAAC;YAED,iBAAiB,CAAC,KAAK,EAAE,cAAc,EAAE,kBAAkB,CAAC,CAAA;YAC5D,iBAAiB,CAAC,KAAK,EAAE,MAAM,CAAC,MAAM,CAAC,CAAA;YACvC,OAAO,MAAM,CAAC,IAAI,EAAE,CAAA;YACpB,qDAAqD;QACvD,CAAC;QAAC,OAAO,KAAc,EAAE,CAAC;YACxB,iBAAiB,CAAC,KAAK,EAAE,GAAG,CAAC,CAAA;YAC7B,IAAI,KAAK,YAAY,KAAK,EAAE,CAAC;gBAC3B,OAAO,EAAC,MAAM,EAAE,CAAC,KAAK,CAAC,OAAO,CAAC,EAAC,CAAA;YAClC,CAAC;YACD,OAAO,EAAC,MAAM,EAAE,CAAC,eAAe,CAAC,EAAC,CAAA;QACpC,CAAC;IACH,CAAC,CAAC,CACH,CAAA;IAED,GAAG,CAAC,GAAG,CAAC,MAAM,CAAC,CAAA;IAEf,MAAM,MAAM,GAAG,YAAY,CAAC,cAAc,CAAC,GAAG,CAAC,CAAC,CAAA;IAChD,MAAM,CAAC,MAAM,CAAC,IAAI,EAAE,WAAW,EAAE,GAAG,EAAE,CAAC,MAAM,CAAC,KAAK,CAAC,mCAAmC,IAAI,EAAE,CAAC,CAAC,CAAA;IAC/F,OAAO,MAAM,CAAA;AACf,CAAC;AAED,yDAAyD;AACzD,oCAAoC;AACpC,mFAAmF;AACnF,sFAAsF;AACtF,sEAAsE;AACtE,SAAS,wBAAwB,CAC/B,WAA+B,EAC/B,UAA0C,EAC1C,SAAiB;IAEjB,MAAM,OAAO,GAAG,WAAW,EAAE,IAAI,EAAE,CAAA;IACnC,IAAI,OAAO;QAAE,OAAO,OAAO,CAAA;IAC3B,IAAI,UAAU;QAAE,OAAO,iBAAiB,CAAC,UAAU,CAAC,SAAS,EAAE,SAAS,CAAC,CAAA;IACzE,OAAO,WAAW,CAAC,EAAE,CAAC,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAA;AACxC,CAAC;AAED,SAAS,qBAAqB,CAAC,IAAa;IAC1C,IAAI,OAAO,IAAI,KAAK,QAAQ,IAAI,IAAI,KAAK,IAAI;QAAE,OAAO,KAAK,CAAA;IAC3D,MAAM,EAAC,KAAK,EAAE,aAAa,EAAC,GAAG,IAAkD,CAAA;IACjF,IAAI,OAAO,KAAK,KAAK,QAAQ;QAAE,OAAO,KAAK,CAAA;IAC3C,OAAO,gBAAgB,CAAC,KAAK,EAAE,OAAO,aAAa,KAAK,QAAQ,CAAC,CAAC,CAAC,aAAa,CAAC,CAAC,CAAC,SAAS,CAAC,CAAA;AAC/F,CAAC","sourcesContent":["import {defaultQuery, graphiqlTemplate} from './templates/graphiql.js'\nimport {unauthorizedTemplate} from './templates/unauthorized.js'\nimport {filterCustomHeaders} from './utilities.js'\nimport {performActionWithRetryAfterRecovery} from '../../common/retry.js'\nimport {CLI_KIT_VERSION} from '../../common/version.js'\nimport {AbortError} from '../error.js'\nimport {adminUrl, supportedApiVersions} from '../api/admin.js'\nimport {fetch} from '../http.js'\nimport {renderLiquidTemplate} from '../liquid.js'\nimport {outputDebug} from '../output.js'\nimport {containsMutation} from '../graphql.js'\nimport {\n  createApp,\n  createRouter,\n  defineEventHandler,\n  getQuery,\n  getRequestHeader,\n  getRequestHeaders,\n  readBody,\n  setResponseHeader,\n  setResponseStatus,\n  toNodeListener,\n} from 'h3'\nimport {createHmac, randomBytes} from 'crypto'\nimport {createServer, Server} from 'http'\nimport {readFileSync} from 'fs'\nimport {Writable} from 'stream'\nimport {createRequire} from 'module'\n\n/**\n * Derives a deterministic GraphiQL authentication key from the app's API secret and store FQDN.\n * The key is stable across dev server restarts (so browser tabs survive restarts)\n * but is not guessable without the app secret.\n *\n * @param apiSecret - The Partners app's client secret used as the HMAC key.\n * @param storeFqdn - The myshopify.com domain the GraphiQL session targets.\n * @returns A 64-character hex string suitable for use as the `?key=` query param.\n */\nexport function deriveGraphiQLKey(apiSecret: string, storeFqdn: string): string {\n  return createHmac('sha256', apiSecret).update(`graphiql:${storeFqdn}`).digest('hex')\n}\n\n/**\n * Resolves the GraphiQL authentication key. Uses the explicitly provided key\n * if non-empty, otherwise derives one deterministically from the app secret.\n *\n * @param providedKey - An explicit key supplied by the caller; takes precedence when non-empty.\n * @param apiSecret - The Partners app's client secret, used to derive a stable key as a fallback.\n * @param storeFqdn - The myshopify.com domain the GraphiQL session targets.\n * @returns The resolved key.\n */\nexport function resolveGraphiQLKey(providedKey: string | undefined, apiSecret: string, storeFqdn: string): string {\n  // eslint-disable-next-line @typescript-eslint/prefer-nullish-coalescing -- intentional: empty string after trim should fall through to deriveGraphiQLKey\n  return providedKey?.trim() || deriveGraphiQLKey(apiSecret, storeFqdn)\n}\n\nconst require = createRequire(import.meta.url)\n\nclass TokenRefreshError extends AbortError {\n  constructor() {\n    super('Failed to refresh credentials. Check that your app is installed, and try again.')\n  }\n}\n\n/**\n * Pluggable strategy for obtaining and refreshing the Admin API access token\n * that the GraphiQL proxy injects into every request.\n *\n * - `getToken` may return a cached token; the proxy calls it for every request.\n * - `refreshToken` (optional) is invoked when the upstream Admin API returns 401.\n * When omitted, the proxy falls back to calling `getToken` again on 401.\n *\n * Implementations must throw `TokenRefreshError` (or any thrown error) when the\n * token cannot be obtained; the proxy renders the unauthorized template in that case.\n */\nexport interface TokenProvider {\n  getToken: () => Promise<string>\n  refreshToken?: () => Promise<string>\n}\n\n/**\n * Optional app-specific context, used to render the app pill and scopes note in the\n * GraphiQL header and to drive the deterministic key derivation. Pass when the GraphiQL\n * server is hosted as part of `shopify app dev`; omit for app-less use cases such as\n * `shopify store execute`.\n */\nexport interface GraphiQLAppContext {\n  appName: string\n  appUrl: string\n  apiSecret: string\n}\n\nexport interface SetupGraphiQLServerOptions {\n  stdout: Writable\n  port: number\n  storeFqdn: string\n  tokenProvider: TokenProvider\n  /**\n   * Authentication key required as a `?key=` query string on every request. When omitted:\n   * - if `appContext` is provided, derived deterministically from `apiSecret` + `storeFqdn`\n   * so browser tabs survive dev server restarts.\n   * - otherwise, generated randomly per process.\n   */\n  key?: string\n  appContext?: GraphiQLAppContext\n  /**\n   * When true, the proxy rejects mutation operations with HTTP 400 before forwarding\n   * them to the Admin API. Use this to mirror non-interactive safety guarantees in the\n   * interactive UI.\n   */\n  protectMutations?: boolean\n}\n\nexport const MUTATIONS_BLOCKED_MESSAGE = 'Mutations are disabled. Re-run with --allow-mutations to enable mutations.'\n\n/**\n * Starts a local HTTP server that hosts the GraphiQL UI and proxies requests to the\n * Admin API for the configured store. Authentication is delegated to the supplied\n * `tokenProvider`, so the same server can serve both `shopify app dev` and stored-session\n * use cases.\n *\n * @param options - Configuration for the server, including the target store, the\n * pluggable token provider, and the local port to bind to.\n * @returns The underlying Node `http.Server` instance, already listening on `options.port`.\n */\nexport function setupGraphiQLServer(options: SetupGraphiQLServerOptions): Server {\n  const {stdout, port, storeFqdn, tokenProvider, key: providedKey, appContext, protectMutations = false} = options\n  const key = resolveGraphiQLServerKey(providedKey, appContext, storeFqdn)\n  outputDebug(`Setting up GraphiQL HTTP server on port ${port}...`, stdout)\n\n  const app = createApp()\n  const router = createRouter()\n\n  const refreshUpstreamToken = async (): Promise<string> => {\n    try {\n      outputDebug('refreshing token', stdout)\n      return await (tokenProvider.refreshToken ?? tokenProvider.getToken)()\n    } catch (_error) {\n      throw new TokenRefreshError()\n    }\n  }\n\n  const currentToken = async (): Promise<string> => {\n    try {\n      return await tokenProvider.getToken()\n    } catch (_error) {\n      throw new TokenRefreshError()\n    }\n  }\n\n  async function fetchApiVersionsWithTokenRefresh(): Promise<string[]> {\n    return performActionWithRetryAfterRecovery(\n      async () => supportedApiVersions({storeFqdn, token: await currentToken()}),\n      refreshUpstreamToken,\n    )\n  }\n\n  const faviconPath = require.resolve('../../../../assets/graphiql/favicon.ico')\n  const faviconContent = readFileSync(faviconPath)\n  const stylePath = require.resolve('../../../../assets/graphiql/style.css')\n  const styleContent = readFileSync(stylePath, 'utf8')\n\n  app.use(\n    defineEventHandler((event) => {\n      setResponseHeader(event, 'Access-Control-Allow-Origin', '*')\n      setResponseHeader(event, 'Access-Control-Allow-Methods', 'GET, OPTIONS')\n      setResponseHeader(\n        event,\n        'Access-Control-Allow-Headers',\n        'Accept, Content-Type, Content-Length, Accept-Encoding, X-CSRF-Token, Authorization, ngrok-skip-browser-warning',\n      )\n    }),\n  )\n\n  router.get(\n    '/graphiql/ping',\n    defineEventHandler(() => 'pong'),\n  )\n\n  router.get(\n    '/graphiql/favicon.ico',\n    defineEventHandler((event) => {\n      setResponseHeader(event, 'Content-Type', 'image/x-icon')\n      return faviconContent\n    }),\n  )\n\n  router.get(\n    '/graphiql/simple.css',\n    defineEventHandler((event) => {\n      setResponseHeader(event, 'Content-Type', 'text/css')\n      return styleContent\n    }),\n  )\n\n  router.get(\n    '/graphiql/status',\n    defineEventHandler(async () => {\n      try {\n        await fetchApiVersionsWithTokenRefresh()\n        return {status: 'OK', storeFqdn, appName: appContext?.appName, appUrl: appContext?.appUrl}\n        // eslint-disable-next-line no-catch-all/no-catch-all\n      } catch {\n        return {status: 'UNAUTHENTICATED'}\n      }\n    }),\n  )\n\n  router.get(\n    '/graphiql',\n    defineEventHandler(async (event) => {\n      outputDebug('Handling /graphiql request', stdout)\n\n      const query = getQuery(event)\n\n      if (key && query.key !== key) {\n        setResponseStatus(event, 404)\n        return `Invalid path ${event.path}`\n      }\n\n      const forwardedProto = getRequestHeader(event, 'x-forwarded-proto')\n      const usesHttps = forwardedProto === 'https'\n      const host = getRequestHeader(event, 'host')\n      const url = `http${usesHttps ? 's' : ''}://${host}`\n\n      let apiVersions: string[]\n      try {\n        apiVersions = await fetchApiVersionsWithTokenRefresh()\n      } catch (err) {\n        if (err instanceof TokenRefreshError) {\n          return renderLiquidTemplate(unauthorizedTemplate({hasAppContext: Boolean(appContext)}), {\n            previewUrl: appContext?.appUrl ?? '',\n            storeFqdn,\n            url,\n          })\n        }\n        throw err\n      }\n\n      const apiVersion = apiVersions.sort().reverse()[0]!\n\n      function decodeQueryString(input: string | undefined) {\n        return input ? decodeURIComponent(input).replace(/\\n/g, '\\\\n') : undefined\n      }\n\n      const queryParam = decodeQueryString(query.query as string | undefined)\n      const variables = decodeQueryString(query.variables as string | undefined)\n\n      return renderLiquidTemplate(\n        graphiqlTemplate({\n          apiVersion,\n          apiVersions: [...apiVersions, 'unstable'],\n          appName: appContext?.appName,\n          appUrl: appContext?.appUrl,\n          key,\n          storeFqdn,\n          protectMutations,\n        }),\n        {\n          url,\n          defaultQueries: [{query: defaultQuery}],\n          query: queryParam ? JSON.stringify(queryParam) : undefined,\n          variables: variables ? JSON.stringify(variables) : undefined,\n        },\n      )\n    }),\n  )\n\n  router.post(\n    '/graphiql/graphql.json',\n    defineEventHandler(async (event) => {\n      outputDebug('Handling /graphiql/graphql.json request', stdout)\n\n      const query = getQuery(event)\n\n      if (key && query.key !== key) {\n        setResponseStatus(event, 404)\n        return `Invalid path ${event.path}`\n      }\n\n      const graphqlUrl = adminUrl(storeFqdn, query.api_version as string)\n      try {\n        const body = await readBody(event)\n\n        if (protectMutations && isMutationRequestBody(body)) {\n          setResponseStatus(event, 400)\n          return {errors: [{message: MUTATIONS_BLOCKED_MESSAGE}]}\n        }\n\n        const reqBody = JSON.stringify(body)\n\n        const reqHeaders = getRequestHeaders(event)\n        const customHeaders = filterCustomHeaders(reqHeaders)\n\n        const runRequest = async (token: string) => {\n          const headers = {\n            ...customHeaders,\n            Accept: 'application/json',\n            'Content-Type': 'application/json',\n            'X-Shopify-Access-Token': token,\n            'User-Agent': `ShopifyCLIGraphiQL/${CLI_KIT_VERSION}`,\n          }\n\n          return fetch(graphqlUrl, {\n            method: 'POST',\n            headers,\n            body: reqBody,\n          })\n        }\n\n        let result = await runRequest(await currentToken())\n        if (result.status === 401) {\n          outputDebug('Token expired, fetching new token', stdout)\n          result = await runRequest(await refreshUpstreamToken())\n        }\n\n        setResponseHeader(event, 'Content-Type', 'application/json')\n        setResponseStatus(event, result.status)\n        return result.json()\n        // eslint-disable-next-line no-catch-all/no-catch-all\n      } catch (error: unknown) {\n        setResponseStatus(event, 500)\n        if (error instanceof Error) {\n          return {errors: [error.message]}\n        }\n        return {errors: ['Unknown error']}\n      }\n    }),\n  )\n\n  app.use(router)\n\n  const server = createServer(toNodeListener(app))\n  server.listen(port, 'localhost', () => stdout.write(`GraphiQL server started on port ${port}`))\n  return server\n}\n\n// Picks the right key based on what the caller supplied:\n// - explicit non-empty key → use it\n// - app context with apiSecret → derive deterministically (stable across restarts)\n// - otherwise → random per-process key (browser tabs won't survive restarts, which is\n//   the right tradeoff when there's no stable secret to derive from).\nfunction resolveGraphiQLServerKey(\n  providedKey: string | undefined,\n  appContext: GraphiQLAppContext | undefined,\n  storeFqdn: string,\n): string {\n  const trimmed = providedKey?.trim()\n  if (trimmed) return trimmed\n  if (appContext) return deriveGraphiQLKey(appContext.apiSecret, storeFqdn)\n  return randomBytes(32).toString('hex')\n}\n\nfunction isMutationRequestBody(body: unknown): boolean {\n  if (typeof body !== 'object' || body === null) return false\n  const {query, operationName} = body as {query?: unknown; operationName?: unknown}\n  if (typeof query !== 'string') return false\n  return containsMutation(query, typeof operationName === 'string' ? operationName : undefined)\n}\n"]}
+{"version":3,"file":"server.js","sourceRoot":"","sources":["../../../../src/public/node/graphiql/server.ts"],"names":[],"mappings":"AAAA,OAAO,EAAC,YAAY,EAAE,gBAAgB,EAAC,MAAM,yBAAyB,CAAA;AACtE,OAAO,EAAC,oBAAoB,EAAC,MAAM,6BAA6B,CAAA;AAChE,OAAO,EAAC,mBAAmB,EAAC,MAAM,gBAAgB,CAAA;AAClD,OAAO,EAAC,mCAAmC,EAAC,MAAM,uBAAuB,CAAA;AACzE,OAAO,EAAC,eAAe,EAAC,MAAM,yBAAyB,CAAA;AACvD,OAAO,EAAC,UAAU,EAAC,MAAM,aAAa,CAAA;AACtC,OAAO,EAAC,QAAQ,EAAE,oBAAoB,EAAC,MAAM,iBAAiB,CAAA;AAC9D,OAAO,EAAC,KAAK,EAAC,MAAM,YAAY,CAAA;AAChC,OAAO,EAAC,oBAAoB,EAAC,MAAM,cAAc,CAAA;AACjD,OAAO,EAAC,WAAW,EAAC,MAAM,cAAc,CAAA;AACxC,OAAO,EAAC,gBAAgB,EAAC,MAAM,eAAe,CAAA;AAC9C,OAAO,EACL,SAAS,EACT,YAAY,EACZ,kBAAkB,EAClB,QAAQ,EACR,gBAAgB,EAChB,iBAAiB,EACjB,QAAQ,EACR,iBAAiB,EACjB,iBAAiB,EACjB,cAAc,GACf,MAAM,IAAI,CAAA;AACX,OAAO,EAAC,UAAU,EAAE,WAAW,EAAC,MAAM,QAAQ,CAAA;AAC9C,OAAO,EAAC,YAAY,EAAS,MAAM,MAAM,CAAA;AACzC,OAAO,EAAC,YAAY,EAAC,MAAM,IAAI,CAAA;AAE/B,OAAO,EAAC,aAAa,EAAC,MAAM,QAAQ,CAAA;AAEpC;;;;;;;;GAQG;AACH,MAAM,UAAU,iBAAiB,CAAC,SAAiB,EAAE,SAAiB;IACpE,OAAO,UAAU,CAAC,QAAQ,EAAE,SAAS,CAAC,CAAC,MAAM,CAAC,YAAY,SAAS,EAAE,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAA;AACtF,CAAC;AAED;;;;;;;;GAQG;AACH,MAAM,UAAU,kBAAkB,CAAC,WAA+B,EAAE,SAAiB,EAAE,SAAiB;IACtG,yJAAyJ;IACzJ,OAAO,WAAW,EAAE,IAAI,EAAE,IAAI,iBAAiB,CAAC,SAAS,EAAE,SAAS,CAAC,CAAA;AACvE,CAAC;AAED,MAAM,OAAO,GAAG,aAAa,CAAC,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,CAAA;AAE9C;;;;;;;GAOG;AACH,SAAS,wBAAwB,CAAC,KAAc;IAC9C,OAAO,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC;SACzB,OAAO,CAAC,IAAI,EAAE,SAAS,CAAC;SACxB,OAAO,CAAC,IAAI,EAAE,SAAS,CAAC;SACxB,OAAO,CAAC,IAAI,EAAE,SAAS,CAAC;SACxB,OAAO,CAAC,SAAS,EAAE,SAAS,CAAC;SAC7B,OAAO,CAAC,SAAS,EAAE,SAAS,CAAC,CAAA;AAClC,CAAC;AAED,MAAM,iBAAkB,SAAQ,UAAU;IACxC;QACE,KAAK,CAAC,iFAAiF,CAAC,CAAA;IAC1F,CAAC;CACF;AAmDD,MAAM,CAAC,MAAM,yBAAyB,GAAG,4EAA4E,CAAA;AAErH;;;;;;;;;GASG;AACH,MAAM,UAAU,mBAAmB,CAAC,OAAmC;IACrE,MAAM,EAAC,MAAM,EAAE,IAAI,EAAE,SAAS,EAAE,aAAa,EAAE,GAAG,EAAE,WAAW,EAAE,UAAU,EAAE,gBAAgB,GAAG,KAAK,EAAC,GAAG,OAAO,CAAA;IAChH,MAAM,GAAG,GAAG,wBAAwB,CAAC,WAAW,EAAE,UAAU,EAAE,SAAS,CAAC,CAAA;IACxE,WAAW,CAAC,2CAA2C,IAAI,KAAK,EAAE,MAAM,CAAC,CAAA;IAEzE,MAAM,GAAG,GAAG,SAAS,EAAE,CAAA;IACvB,MAAM,MAAM,GAAG,YAAY,EAAE,CAAA;IAE7B,MAAM,oBAAoB,GAAG,KAAK,IAAqB,EAAE;QACvD,IAAI,CAAC;YACH,WAAW,CAAC,kBAAkB,EAAE,MAAM,CAAC,CAAA;YACvC,OAAO,MAAM,CAAC,aAAa,CAAC,YAAY,IAAI,aAAa,CAAC,QAAQ,CAAC,EAAE,CAAA;QACvE,CAAC;QAAC,OAAO,MAAM,EAAE,CAAC;YAChB,MAAM,IAAI,iBAAiB,EAAE,CAAA;QAC/B,CAAC;IACH,CAAC,CAAA;IAED,MAAM,YAAY,GAAG,KAAK,IAAqB,EAAE;QAC/C,IAAI,CAAC;YACH,OAAO,MAAM,aAAa,CAAC,QAAQ,EAAE,CAAA;QACvC,CAAC;QAAC,OAAO,MAAM,EAAE,CAAC;YAChB,MAAM,IAAI,iBAAiB,EAAE,CAAA;QAC/B,CAAC;IACH,CAAC,CAAA;IAED,KAAK,UAAU,gCAAgC;QAC7C,OAAO,mCAAmC,CACxC,KAAK,IAAI,EAAE,CAAC,oBAAoB,CAAC,EAAC,SAAS,EAAE,KAAK,EAAE,MAAM,YAAY,EAAE,EAAC,CAAC,EAC1E,oBAAoB,CACrB,CAAA;IACH,CAAC;IAED,MAAM,WAAW,GAAG,OAAO,CAAC,OAAO,CAAC,yCAAyC,CAAC,CAAA;IAC9E,MAAM,cAAc,GAAG,YAAY,CAAC,WAAW,CAAC,CAAA;IAChD,MAAM,SAAS,GAAG,OAAO,CAAC,OAAO,CAAC,uCAAuC,CAAC,CAAA;IAC1E,MAAM,YAAY,GAAG,YAAY,CAAC,SAAS,EAAE,MAAM,CAAC,CAAA;IAEpD,GAAG,CAAC,GAAG,CACL,kBAAkB,CAAC,CAAC,KAAK,EAAE,EAAE;QAC3B,iBAAiB,CAAC,KAAK,EAAE,6BAA6B,EAAE,GAAG,CAAC,CAAA;QAC5D,iBAAiB,CAAC,KAAK,EAAE,8BAA8B,EAAE,cAAc,CAAC,CAAA;QACxE,iBAAiB,CACf,KAAK,EACL,8BAA8B,EAC9B,gHAAgH,CACjH,CAAA;IACH,CAAC,CAAC,CACH,CAAA;IAED,MAAM,CAAC,GAAG,CACR,gBAAgB,EAChB,kBAAkB,CAAC,GAAG,EAAE,CAAC,MAAM,CAAC,CACjC,CAAA;IAED,MAAM,CAAC,GAAG,CACR,uBAAuB,EACvB,kBAAkB,CAAC,CAAC,KAAK,EAAE,EAAE;QAC3B,iBAAiB,CAAC,KAAK,EAAE,cAAc,EAAE,cAAc,CAAC,CAAA;QACxD,OAAO,cAAc,CAAA;IACvB,CAAC,CAAC,CACH,CAAA;IAED,MAAM,CAAC,GAAG,CACR,sBAAsB,EACtB,kBAAkB,CAAC,CAAC,KAAK,EAAE,EAAE;QAC3B,iBAAiB,CAAC,KAAK,EAAE,cAAc,EAAE,UAAU,CAAC,CAAA;QACpD,OAAO,YAAY,CAAA;IACrB,CAAC,CAAC,CACH,CAAA;IAED,MAAM,CAAC,GAAG,CACR,kBAAkB,EAClB,kBAAkB,CAAC,KAAK,IAAI,EAAE;QAC5B,IAAI,CAAC;YACH,MAAM,gCAAgC,EAAE,CAAA;YACxC,OAAO,EAAC,MAAM,EAAE,IAAI,EAAE,SAAS,EAAE,OAAO,EAAE,UAAU,EAAE,OAAO,EAAE,MAAM,EAAE,UAAU,EAAE,MAAM,EAAC,CAAA;YAC1F,qDAAqD;QACvD,CAAC;QAAC,MAAM,CAAC;YACP,OAAO,EAAC,MAAM,EAAE,iBAAiB,EAAC,CAAA;QACpC,CAAC;IACH,CAAC,CAAC,CACH,CAAA;IAED,MAAM,CAAC,GAAG,CACR,WAAW,EACX,kBAAkB,CAAC,KAAK,EAAE,KAAK,EAAE,EAAE;QACjC,WAAW,CAAC,4BAA4B,EAAE,MAAM,CAAC,CAAA;QAEjD,MAAM,KAAK,GAAG,QAAQ,CAAC,KAAK,CAAC,CAAA;QAE7B,IAAI,GAAG,IAAI,KAAK,CAAC,GAAG,KAAK,GAAG,EAAE,CAAC;YAC7B,iBAAiB,CAAC,KAAK,EAAE,GAAG,CAAC,CAAA;YAC7B,OAAO,gBAAgB,KAAK,CAAC,IAAI,EAAE,CAAA;QACrC,CAAC;QAED,MAAM,cAAc,GAAG,gBAAgB,CAAC,KAAK,EAAE,mBAAmB,CAAC,CAAA;QACnE,MAAM,SAAS,GAAG,cAAc,KAAK,OAAO,CAAA;QAC5C,MAAM,IAAI,GAAG,gBAAgB,CAAC,KAAK,EAAE,MAAM,CAAC,CAAA;QAC5C,MAAM,GAAG,GAAG,OAAO,SAAS,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,MAAM,IAAI,EAAE,CAAA;QAEnD,IAAI,WAAqB,CAAA;QACzB,IAAI,CAAC;YACH,WAAW,GAAG,MAAM,gCAAgC,EAAE,CAAA;QACxD,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,IAAI,GAAG,YAAY,iBAAiB,EAAE,CAAC;gBACrC,OAAO,oBAAoB,CAAC,oBAAoB,CAAC,EAAC,aAAa,EAAE,OAAO,CAAC,UAAU,CAAC,EAAC,CAAC,EAAE;oBACtF,UAAU,EAAE,UAAU,EAAE,MAAM,IAAI,EAAE;oBACpC,SAAS;oBACT,GAAG;iBACJ,CAAC,CAAA;YACJ,CAAC;YACD,MAAM,GAAG,CAAA;QACX,CAAC;QAED,MAAM,UAAU,GAAG,WAAW,CAAC,IAAI,EAAE,CAAC,OAAO,EAAE,CAAC,CAAC,CAAE,CAAA;QAEnD,SAAS,iBAAiB,CAAC,KAAyB;YAClD,OAAO,KAAK,CAAC,CAAC,CAAC,kBAAkB,CAAC,KAAK,CAAC,CAAC,OAAO,CAAC,KAAK,EAAE,KAAK,CAAC,CAAC,CAAC,CAAC,SAAS,CAAA;QAC5E,CAAC;QAED,MAAM,UAAU,GAAG,iBAAiB,CAAC,KAAK,CAAC,KAA2B,CAAC,CAAA;QACvE,MAAM,SAAS,GAAG,iBAAiB,CAAC,KAAK,CAAC,SAA+B,CAAC,CAAA;QAE1E,OAAO,oBAAoB,CACzB,gBAAgB,CAAC;YACf,UAAU;YACV,WAAW,EAAE,CAAC,GAAG,WAAW,EAAE,UAAU,CAAC;YACzC,OAAO,EAAE,UAAU,EAAE,OAAO;YAC5B,MAAM,EAAE,UAAU,EAAE,MAAM;YAC1B,GAAG;YACH,SAAS;YACT,gBAAgB;SACjB,CAAC,EACF;YACE,GAAG;YACH,cAAc,EAAE,CAAC,EAAC,KAAK,EAAE,YAAY,EAAC,CAAC;YACvC,KAAK,EAAE,UAAU,CAAC,CAAC,CAAC,wBAAwB,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC,SAAS;YACpE,SAAS,EAAE,SAAS,CAAC,CAAC,CAAC,wBAAwB,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,SAAS;SACvE,CACF,CAAA;IACH,CAAC,CAAC,CACH,CAAA;IAED,MAAM,CAAC,IAAI,CACT,wBAAwB,EACxB,kBAAkB,CAAC,KAAK,EAAE,KAAK,EAAE,EAAE;QACjC,WAAW,CAAC,yCAAyC,EAAE,MAAM,CAAC,CAAA;QAE9D,MAAM,KAAK,GAAG,QAAQ,CAAC,KAAK,CAAC,CAAA;QAE7B,IAAI,GAAG,IAAI,KAAK,CAAC,GAAG,KAAK,GAAG,EAAE,CAAC;YAC7B,iBAAiB,CAAC,KAAK,EAAE,GAAG,CAAC,CAAA;YAC7B,OAAO,gBAAgB,KAAK,CAAC,IAAI,EAAE,CAAA;QACrC,CAAC;QAED,MAAM,UAAU,GAAG,QAAQ,CAAC,SAAS,EAAE,KAAK,CAAC,WAAqB,CAAC,CAAA;QACnE,IAAI,CAAC;YACH,MAAM,IAAI,GAAG,MAAM,QAAQ,CAAC,KAAK,CAAC,CAAA;YAElC,IAAI,gBAAgB,IAAI,qBAAqB,CAAC,IAAI,CAAC,EAAE,CAAC;gBACpD,iBAAiB,CAAC,KAAK,EAAE,GAAG,CAAC,CAAA;gBAC7B,OAAO,EAAC,MAAM,EAAE,CAAC,EAAC,OAAO,EAAE,yBAAyB,EAAC,CAAC,EAAC,CAAA;YACzD,CAAC;YAED,MAAM,OAAO,GAAG,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,CAAA;YAEpC,MAAM,UAAU,GAAG,iBAAiB,CAAC,KAAK,CAAC,CAAA;YAC3C,MAAM,aAAa,GAAG,mBAAmB,CAAC,UAAU,CAAC,CAAA;YAErD,MAAM,UAAU,GAAG,KAAK,EAAE,KAAa,EAAE,EAAE;gBACzC,MAAM,OAAO,GAAG;oBACd,GAAG,aAAa;oBAChB,MAAM,EAAE,kBAAkB;oBAC1B,cAAc,EAAE,kBAAkB;oBAClC,wBAAwB,EAAE,KAAK;oBAC/B,YAAY,EAAE,sBAAsB,eAAe,EAAE;iBACtD,CAAA;gBAED,OAAO,KAAK,CAAC,UAAU,EAAE;oBACvB,MAAM,EAAE,MAAM;oBACd,OAAO;oBACP,IAAI,EAAE,OAAO;iBACd,CAAC,CAAA;YACJ,CAAC,CAAA;YAED,IAAI,MAAM,GAAG,MAAM,UAAU,CAAC,MAAM,YAAY,EAAE,CAAC,CAAA;YACnD,IAAI,MAAM,CAAC,MAAM,KAAK,GAAG,EAAE,CAAC;gBAC1B,WAAW,CAAC,mCAAmC,EAAE,MAAM,CAAC,CAAA;gBACxD,MAAM,GAAG,MAAM,UAAU,CAAC,MAAM,oBAAoB,EAAE,CAAC,CAAA;YACzD,CAAC;YAED,iBAAiB,CAAC,KAAK,EAAE,cAAc,EAAE,kBAAkB,CAAC,CAAA;YAC5D,iBAAiB,CAAC,KAAK,EAAE,MAAM,CAAC,MAAM,CAAC,CAAA;YACvC,OAAO,MAAM,CAAC,IAAI,EAAE,CAAA;YACpB,qDAAqD;QACvD,CAAC;QAAC,OAAO,KAAc,EAAE,CAAC;YACxB,iBAAiB,CAAC,KAAK,EAAE,GAAG,CAAC,CAAA;YAC7B,IAAI,KAAK,YAAY,KAAK,EAAE,CAAC;gBAC3B,OAAO,EAAC,MAAM,EAAE,CAAC,KAAK,CAAC,OAAO,CAAC,EAAC,CAAA;YAClC,CAAC;YACD,OAAO,EAAC,MAAM,EAAE,CAAC,eAAe,CAAC,EAAC,CAAA;QACpC,CAAC;IACH,CAAC,CAAC,CACH,CAAA;IAED,GAAG,CAAC,GAAG,CAAC,MAAM,CAAC,CAAA;IAEf,MAAM,MAAM,GAAG,YAAY,CAAC,cAAc,CAAC,GAAG,CAAC,CAAC,CAAA;IAChD,MAAM,CAAC,MAAM,CAAC,IAAI,EAAE,WAAW,EAAE,GAAG,EAAE,CAAC,MAAM,CAAC,KAAK,CAAC,mCAAmC,IAAI,EAAE,CAAC,CAAC,CAAA;IAC/F,OAAO,MAAM,CAAA;AACf,CAAC;AAED,yDAAyD;AACzD,oCAAoC;AACpC,mFAAmF;AACnF,sFAAsF;AACtF,sEAAsE;AACtE,SAAS,wBAAwB,CAC/B,WAA+B,EAC/B,UAA0C,EAC1C,SAAiB;IAEjB,MAAM,OAAO,GAAG,WAAW,EAAE,IAAI,EAAE,CAAA;IACnC,IAAI,OAAO;QAAE,OAAO,OAAO,CAAA;IAC3B,IAAI,UAAU;QAAE,OAAO,iBAAiB,CAAC,UAAU,CAAC,SAAS,EAAE,SAAS,CAAC,CAAA;IACzE,OAAO,WAAW,CAAC,EAAE,CAAC,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAA;AACxC,CAAC;AAED,SAAS,qBAAqB,CAAC,IAAa;IAC1C,IAAI,OAAO,IAAI,KAAK,QAAQ,IAAI,IAAI,KAAK,IAAI;QAAE,OAAO,KAAK,CAAA;IAC3D,MAAM,EAAC,KAAK,EAAE,aAAa,EAAC,GAAG,IAAkD,CAAA;IACjF,IAAI,OAAO,KAAK,KAAK,QAAQ;QAAE,OAAO,KAAK,CAAA;IAC3C,OAAO,gBAAgB,CAAC,KAAK,EAAE,OAAO,aAAa,KAAK,QAAQ,CAAC,CAAC,CAAC,aAAa,CAAC,CAAC,CAAC,SAAS,CAAC,CAAA;AAC/F,CAAC","sourcesContent":["import {defaultQuery, graphiqlTemplate} from './templates/graphiql.js'\nimport {unauthorizedTemplate} from './templates/unauthorized.js'\nimport {filterCustomHeaders} from './utilities.js'\nimport {performActionWithRetryAfterRecovery} from '../../common/retry.js'\nimport {CLI_KIT_VERSION} from '../../common/version.js'\nimport {AbortError} from '../error.js'\nimport {adminUrl, supportedApiVersions} from '../api/admin.js'\nimport {fetch} from '../http.js'\nimport {renderLiquidTemplate} from '../liquid.js'\nimport {outputDebug} from '../output.js'\nimport {containsMutation} from '../graphql.js'\nimport {\n  createApp,\n  createRouter,\n  defineEventHandler,\n  getQuery,\n  getRequestHeader,\n  getRequestHeaders,\n  readBody,\n  setResponseHeader,\n  setResponseStatus,\n  toNodeListener,\n} from 'h3'\nimport {createHmac, randomBytes} from 'crypto'\nimport {createServer, Server} from 'http'\nimport {readFileSync} from 'fs'\nimport {Writable} from 'stream'\nimport {createRequire} from 'module'\n\n/**\n * Derives a deterministic GraphiQL authentication key from the app's API secret and store FQDN.\n * The key is stable across dev server restarts (so browser tabs survive restarts)\n * but is not guessable without the app secret.\n *\n * @param apiSecret - The Partners app's client secret used as the HMAC key.\n * @param storeFqdn - The myshopify.com domain the GraphiQL session targets.\n * @returns A 64-character hex string suitable for use as the `?key=` query param.\n */\nexport function deriveGraphiQLKey(apiSecret: string, storeFqdn: string): string {\n  return createHmac('sha256', apiSecret).update(`graphiql:${storeFqdn}`).digest('hex')\n}\n\n/**\n * Resolves the GraphiQL authentication key. Uses the explicitly provided key\n * if non-empty, otherwise derives one deterministically from the app secret.\n *\n * @param providedKey - An explicit key supplied by the caller; takes precedence when non-empty.\n * @param apiSecret - The Partners app's client secret, used to derive a stable key as a fallback.\n * @param storeFqdn - The myshopify.com domain the GraphiQL session targets.\n * @returns The resolved key.\n */\nexport function resolveGraphiQLKey(providedKey: string | undefined, apiSecret: string, storeFqdn: string): string {\n  // eslint-disable-next-line @typescript-eslint/prefer-nullish-coalescing -- intentional: empty string after trim should fall through to deriveGraphiQLKey\n  return providedKey?.trim() || deriveGraphiQLKey(apiSecret, storeFqdn)\n}\n\nconst require = createRequire(import.meta.url)\n\n/**\n * Serializes a value as JSON that is safe to place inside an inline `<script>` element.\n * `JSON.stringify` alone leaves `<`, `>` and `&` as-is, so a value could close the script element early. Escaping\n * them (and the U+2028/U+2029 line separators) as `\\uXXXX` sequences keeps the JavaScript value identical.\n *\n * @param value - The value to serialize.\n * @returns A JSON string that can be interpolated into an inline script.\n */\nfunction serializeForInlineScript(value: unknown): string {\n  return JSON.stringify(value)\n    .replace(/</g, '\\\\u003c')\n    .replace(/>/g, '\\\\u003e')\n    .replace(/&/g, '\\\\u0026')\n    .replace(/\\u2028/g, '\\\\u2028')\n    .replace(/\\u2029/g, '\\\\u2029')\n}\n\nclass TokenRefreshError extends AbortError {\n  constructor() {\n    super('Failed to refresh credentials. Check that your app is installed, and try again.')\n  }\n}\n\n/**\n * Pluggable strategy for obtaining and refreshing the Admin API access token\n * that the GraphiQL proxy injects into every request.\n *\n * - `getToken` may return a cached token; the proxy calls it for every request.\n * - `refreshToken` (optional) is invoked when the upstream Admin API returns 401.\n * When omitted, the proxy falls back to calling `getToken` again on 401.\n *\n * Implementations must throw `TokenRefreshError` (or any thrown error) when the\n * token cannot be obtained; the proxy renders the unauthorized template in that case.\n */\nexport interface TokenProvider {\n  getToken: () => Promise<string>\n  refreshToken?: () => Promise<string>\n}\n\n/**\n * Optional app-specific context, used to render the app pill and scopes note in the\n * GraphiQL header and to drive the deterministic key derivation. Pass when the GraphiQL\n * server is hosted as part of `shopify app dev`; omit for app-less use cases such as\n * `shopify store execute`.\n */\nexport interface GraphiQLAppContext {\n  appName: string\n  appUrl: string\n  apiSecret: string\n}\n\nexport interface SetupGraphiQLServerOptions {\n  stdout: Writable\n  port: number\n  storeFqdn: string\n  tokenProvider: TokenProvider\n  /**\n   * Authentication key required as a `?key=` query string on every request. When omitted:\n   * - if `appContext` is provided, derived deterministically from `apiSecret` + `storeFqdn`\n   * so browser tabs survive dev server restarts.\n   * - otherwise, generated randomly per process.\n   */\n  key?: string\n  appContext?: GraphiQLAppContext\n  /**\n   * When true, the proxy rejects mutation operations with HTTP 400 before forwarding\n   * them to the Admin API. Use this to mirror non-interactive safety guarantees in the\n   * interactive UI.\n   */\n  protectMutations?: boolean\n}\n\nexport const MUTATIONS_BLOCKED_MESSAGE = 'Mutations are disabled. Re-run with --allow-mutations to enable mutations.'\n\n/**\n * Starts a local HTTP server that hosts the GraphiQL UI and proxies requests to the\n * Admin API for the configured store. Authentication is delegated to the supplied\n * `tokenProvider`, so the same server can serve both `shopify app dev` and stored-session\n * use cases.\n *\n * @param options - Configuration for the server, including the target store, the\n * pluggable token provider, and the local port to bind to.\n * @returns The underlying Node `http.Server` instance, already listening on `options.port`.\n */\nexport function setupGraphiQLServer(options: SetupGraphiQLServerOptions): Server {\n  const {stdout, port, storeFqdn, tokenProvider, key: providedKey, appContext, protectMutations = false} = options\n  const key = resolveGraphiQLServerKey(providedKey, appContext, storeFqdn)\n  outputDebug(`Setting up GraphiQL HTTP server on port ${port}...`, stdout)\n\n  const app = createApp()\n  const router = createRouter()\n\n  const refreshUpstreamToken = async (): Promise<string> => {\n    try {\n      outputDebug('refreshing token', stdout)\n      return await (tokenProvider.refreshToken ?? tokenProvider.getToken)()\n    } catch (_error) {\n      throw new TokenRefreshError()\n    }\n  }\n\n  const currentToken = async (): Promise<string> => {\n    try {\n      return await tokenProvider.getToken()\n    } catch (_error) {\n      throw new TokenRefreshError()\n    }\n  }\n\n  async function fetchApiVersionsWithTokenRefresh(): Promise<string[]> {\n    return performActionWithRetryAfterRecovery(\n      async () => supportedApiVersions({storeFqdn, token: await currentToken()}),\n      refreshUpstreamToken,\n    )\n  }\n\n  const faviconPath = require.resolve('../../../../assets/graphiql/favicon.ico')\n  const faviconContent = readFileSync(faviconPath)\n  const stylePath = require.resolve('../../../../assets/graphiql/style.css')\n  const styleContent = readFileSync(stylePath, 'utf8')\n\n  app.use(\n    defineEventHandler((event) => {\n      setResponseHeader(event, 'Access-Control-Allow-Origin', '*')\n      setResponseHeader(event, 'Access-Control-Allow-Methods', 'GET, OPTIONS')\n      setResponseHeader(\n        event,\n        'Access-Control-Allow-Headers',\n        'Accept, Content-Type, Content-Length, Accept-Encoding, X-CSRF-Token, Authorization, ngrok-skip-browser-warning',\n      )\n    }),\n  )\n\n  router.get(\n    '/graphiql/ping',\n    defineEventHandler(() => 'pong'),\n  )\n\n  router.get(\n    '/graphiql/favicon.ico',\n    defineEventHandler((event) => {\n      setResponseHeader(event, 'Content-Type', 'image/x-icon')\n      return faviconContent\n    }),\n  )\n\n  router.get(\n    '/graphiql/simple.css',\n    defineEventHandler((event) => {\n      setResponseHeader(event, 'Content-Type', 'text/css')\n      return styleContent\n    }),\n  )\n\n  router.get(\n    '/graphiql/status',\n    defineEventHandler(async () => {\n      try {\n        await fetchApiVersionsWithTokenRefresh()\n        return {status: 'OK', storeFqdn, appName: appContext?.appName, appUrl: appContext?.appUrl}\n        // eslint-disable-next-line no-catch-all/no-catch-all\n      } catch {\n        return {status: 'UNAUTHENTICATED'}\n      }\n    }),\n  )\n\n  router.get(\n    '/graphiql',\n    defineEventHandler(async (event) => {\n      outputDebug('Handling /graphiql request', stdout)\n\n      const query = getQuery(event)\n\n      if (key && query.key !== key) {\n        setResponseStatus(event, 404)\n        return `Invalid path ${event.path}`\n      }\n\n      const forwardedProto = getRequestHeader(event, 'x-forwarded-proto')\n      const usesHttps = forwardedProto === 'https'\n      const host = getRequestHeader(event, 'host')\n      const url = `http${usesHttps ? 's' : ''}://${host}`\n\n      let apiVersions: string[]\n      try {\n        apiVersions = await fetchApiVersionsWithTokenRefresh()\n      } catch (err) {\n        if (err instanceof TokenRefreshError) {\n          return renderLiquidTemplate(unauthorizedTemplate({hasAppContext: Boolean(appContext)}), {\n            previewUrl: appContext?.appUrl ?? '',\n            storeFqdn,\n            url,\n          })\n        }\n        throw err\n      }\n\n      const apiVersion = apiVersions.sort().reverse()[0]!\n\n      function decodeQueryString(input: string | undefined) {\n        return input ? decodeURIComponent(input).replace(/\\n/g, '\\\\n') : undefined\n      }\n\n      const queryParam = decodeQueryString(query.query as string | undefined)\n      const variables = decodeQueryString(query.variables as string | undefined)\n\n      return renderLiquidTemplate(\n        graphiqlTemplate({\n          apiVersion,\n          apiVersions: [...apiVersions, 'unstable'],\n          appName: appContext?.appName,\n          appUrl: appContext?.appUrl,\n          key,\n          storeFqdn,\n          protectMutations,\n        }),\n        {\n          url,\n          defaultQueries: [{query: defaultQuery}],\n          query: queryParam ? serializeForInlineScript(queryParam) : undefined,\n          variables: variables ? serializeForInlineScript(variables) : undefined,\n        },\n      )\n    }),\n  )\n\n  router.post(\n    '/graphiql/graphql.json',\n    defineEventHandler(async (event) => {\n      outputDebug('Handling /graphiql/graphql.json request', stdout)\n\n      const query = getQuery(event)\n\n      if (key && query.key !== key) {\n        setResponseStatus(event, 404)\n        return `Invalid path ${event.path}`\n      }\n\n      const graphqlUrl = adminUrl(storeFqdn, query.api_version as string)\n      try {\n        const body = await readBody(event)\n\n        if (protectMutations && isMutationRequestBody(body)) {\n          setResponseStatus(event, 400)\n          return {errors: [{message: MUTATIONS_BLOCKED_MESSAGE}]}\n        }\n\n        const reqBody = JSON.stringify(body)\n\n        const reqHeaders = getRequestHeaders(event)\n        const customHeaders = filterCustomHeaders(reqHeaders)\n\n        const runRequest = async (token: string) => {\n          const headers = {\n            ...customHeaders,\n            Accept: 'application/json',\n            'Content-Type': 'application/json',\n            'X-Shopify-Access-Token': token,\n            'User-Agent': `ShopifyCLIGraphiQL/${CLI_KIT_VERSION}`,\n          }\n\n          return fetch(graphqlUrl, {\n            method: 'POST',\n            headers,\n            body: reqBody,\n          })\n        }\n\n        let result = await runRequest(await currentToken())\n        if (result.status === 401) {\n          outputDebug('Token expired, fetching new token', stdout)\n          result = await runRequest(await refreshUpstreamToken())\n        }\n\n        setResponseHeader(event, 'Content-Type', 'application/json')\n        setResponseStatus(event, result.status)\n        return result.json()\n        // eslint-disable-next-line no-catch-all/no-catch-all\n      } catch (error: unknown) {\n        setResponseStatus(event, 500)\n        if (error instanceof Error) {\n          return {errors: [error.message]}\n        }\n        return {errors: ['Unknown error']}\n      }\n    }),\n  )\n\n  app.use(router)\n\n  const server = createServer(toNodeListener(app))\n  server.listen(port, 'localhost', () => stdout.write(`GraphiQL server started on port ${port}`))\n  return server\n}\n\n// Picks the right key based on what the caller supplied:\n// - explicit non-empty key → use it\n// - app context with apiSecret → derive deterministically (stable across restarts)\n// - otherwise → random per-process key (browser tabs won't survive restarts, which is\n//   the right tradeoff when there's no stable secret to derive from).\nfunction resolveGraphiQLServerKey(\n  providedKey: string | undefined,\n  appContext: GraphiQLAppContext | undefined,\n  storeFqdn: string,\n): string {\n  const trimmed = providedKey?.trim()\n  if (trimmed) return trimmed\n  if (appContext) return deriveGraphiQLKey(appContext.apiSecret, storeFqdn)\n  return randomBytes(32).toString('hex')\n}\n\nfunction isMutationRequestBody(body: unknown): boolean {\n  if (typeof body !== 'object' || body === null) return false\n  const {query, operationName} = body as {query?: unknown; operationName?: unknown}\n  if (typeof query !== 'string') return false\n  return containsMutation(query, typeof operationName === 'string' ? operationName : undefined)\n}\n"]}

package/dist/public/node/is-global.js

@@ -48,9 +48,10 @@ export function currentProcessIsGlobal(argv = process.argv) {
 export async function installGlobalShopifyCLI(packageManager) {
     const { outputInfo } = await import('./output.js');
     const { exec } = await import('./system.js');
+    const { jsonOutputEnabled } = await import('./environment.js');
     const args = packageManager === 'yarn' ? ['global', 'add', '@shopify/cli@latest'] : ['install', '-g', '@shopify/cli@latest'];
     outputInfo(`Running ${packageManager} ${args.join(' ')}...`);
-    await exec(packageManager, args, { stdio: 'inherit' });
+    await exec(packageManager, args, jsonOutputEnabled() ? {} : { stdio: 'inherit' });
 }
 /**
  * Prompts the user to install the global CLI.