@shopify/hydrogen 2026.1.1 → 2026.1.3

package/dist/development/index.js

@@ -434,7 +434,7 @@ function getPrivacyBanner() {
 }
 
 // package.json
-var version = "2026.1.1";
+var version = "2026.1.3";
 
 // src/analytics-manager/ShopifyAnalytics.tsx
 function getCustomerPrivacyRequired() {
@@ -1829,7 +1829,7 @@ function generateUUID() {
 }
 
 // src/version.ts
-var LIB_VERSION = "2026.1.1";
+var LIB_VERSION = "2026.1.3";
 
 // src/utils/graphql.ts
 function minifyQuery(string) {
@@ -3746,9 +3746,30 @@ function createCustomerAccountHelper(customerApiVersion, shopId) {
 }
 
 // src/customer/customer.ts
+var HYDROGEN_TUNNEL_DOMAIN_SUFFIX = ".tryhydrogen.dev";
+function throwIfNotTunnelled(hostname) {
+  {
+    if (!hostname.endsWith(HYDROGEN_TUNNEL_DOMAIN_SUFFIX)) {
+      throw new Response(
+        [
+          "Customer Account API OAuth requires a Hydrogen tunnel in local development.",
+          "Run the development server with the `--customer-account-push` flag,",
+          `then open the tunnel URL shown in your terminal (\`https://*${HYDROGEN_TUNNEL_DOMAIN_SUFFIX}\`) instead of localhost.`
+        ].join("\n\n"),
+        {
+          status: 400,
+          headers: {
+            "Content-Type": "text/plain; charset=utf-8"
+          }
+        }
+      );
+    }
+  }
+}
 function defaultAuthStatusHandler(request, defaultLoginUrl) {
   if (!request.url) return defaultLoginUrl;
-  const { pathname } = new URL(request.url);
+  const { hostname, pathname } = new URL(request.url);
+  throwIfNotTunnelled(hostname);
   const cleanedPathname = pathname.replace(/\.data$/, "").replace(/\/_root$/, "/").replace(/(.+)\/$/, "$1");
   const redirectTo = defaultLoginUrl + `?${new URLSearchParams({ return_to: cleanedPathname }).toString()}`;
   return redirect(redirectTo);
@@ -3912,6 +3933,7 @@ function createCustomerAccountClient({
       return session.get(CUSTOMER_ACCOUNT_SESSION_KEY)?.accessToken;
   }
   async function mutate(mutation, options) {
+    throwIfNotTunnelled(requestUrl.hostname);
     ifInvalidCredentialThrowError();
     mutation = minifyQuery(mutation);
     assertMutation(mutation, "customer.mutate");
@@ -3921,6 +3943,7 @@ function createCustomerAccountClient({
     );
   }
   async function query(query2, options) {
+    throwIfNotTunnelled(requestUrl.hostname);
     ifInvalidCredentialThrowError();
     query2 = minifyQuery(query2);
     assertQuery(query2, "customer.query");
@@ -3944,6 +3967,7 @@ function createCustomerAccountClient({
   return {
     i18n: { language: language ?? "EN" },
     login: async (options) => {
+      throwIfNotTunnelled(requestUrl.hostname);
       ifInvalidCredentialThrowError();
       const loginUrl = new URL(getCustomerAccountUrl("AUTH" /* AUTH */));
       const state = generateState();
@@ -3995,6 +4019,7 @@ function createCustomerAccountClient({
       return redirect(loginUrl.toString());
     },
     logout: async (options) => {
+      throwIfNotTunnelled(requestUrl.hostname);
       ifInvalidCredentialThrowError();
       const idToken = session.get(CUSTOMER_ACCOUNT_SESSION_KEY)?.idToken;
       const postLogoutRedirectUri = ensureLocalRedirectUrl({
@@ -4029,6 +4054,7 @@ function createCustomerAccountClient({
     mutate,
     query,
     authorize: async () => {
+      throwIfNotTunnelled(requestUrl.hostname);
       ifInvalidCredentialThrowError();
       const code = requestUrl.searchParams.get("code");
       const state = requestUrl.searchParams.get("state");
@@ -4158,7 +4184,7 @@ function createIfInvalidCredentialThrowError(getCustomerAccountUrl, customerAcco
           "[h2:error:customerAccount] You do not have the valid credential to use Customer Account API.\nRun `h2 env pull` to link your store credentials."
         )
       );
-      const publicMessage = "You do not have the valid credential to use Customer Account API (/account).";
+      const publicMessage = "You do not have valid credentials to use Customer Account API (/account).";
       throw new Response(publicMessage, { status: 500 });
     }
   };