@shopify/hydrogen 2026.4.5 → 2026.10.0-preview.2

package/dist/core/standard-routes/path.mjs

@@ -0,0 +1,58 @@
+//#region src/core/standard-routes/path.ts
+function prependPathPrefix(pathname, pathPrefix) {
+	const normalizedPathPrefix = normalizePathPrefix(pathPrefix);
+	if (!normalizedPathPrefix) return pathname;
+	return `${normalizedPathPrefix}/${pathname.replace(/^\/+/, "")}`;
+}
+function normalizePathPrefix(pathPrefix) {
+	if (!pathPrefix) return "";
+	const trimmedPathPrefix = pathPrefix.trim().replace(/^\/+|\/+$/g, "");
+	return trimmedPathPrefix ? `/${trimmedPathPrefix}` : "";
+}
+function parseUrl(url, baseUrl) {
+	try {
+		return new URL(url, baseUrl ?? "https://shopify.local");
+	} catch {
+		return null;
+	}
+}
+/**
+* Parses a URL and rejects absolute URLs that do not share `baseUrl`'s origin.
+*
+* Relative URLs are resolved against `baseUrl` when provided, or against a throwaway local origin
+* when no base is available.
+*/
+function parseSameOriginUrl(url, baseUrl) {
+	const parsedUrl = parseUrl(url, baseUrl);
+	if (!parsedUrl) return null;
+	const parsedBaseUrl = baseUrl ? parseUrl(baseUrl, void 0) : null;
+	if (parsedBaseUrl && parsedUrl.origin !== parsedBaseUrl.origin) return null;
+	return parsedUrl;
+}
+function isAbsoluteUrl(url) {
+	return /^[A-Za-z][A-Za-z0-9+.-]*:/.test(url);
+}
+function stripTrailingSlash(pathname) {
+	if (pathname === "/") return pathname;
+	return pathname.replace(/\/+$/, "");
+}
+/**
+* Removes the locale prefix before matching route templates.
+*
+* `ShopifyScripts` stores `routes.root` with a trailing slash, while server i18n uses
+* `pathPrefix`; both are normalized here so `/fr-ca/products/snowboard` can match the same
+* template as `/products/snowboard`.
+*/
+function stripI18nPathPrefix(pathname, pathPrefix) {
+	const normalizedPathPrefix = normalizePathPrefix(pathPrefix);
+	if (!normalizedPathPrefix) return pathname;
+	const lowerPathname = pathname.toLowerCase();
+	const lowerPathPrefix = normalizedPathPrefix.toLowerCase();
+	if (lowerPathname === lowerPathPrefix) return "/";
+	if (!lowerPathname.startsWith(`${lowerPathPrefix}/`)) return pathname;
+	return pathname.slice(normalizedPathPrefix.length) || "/";
+}
+
+//#endregion
+export { isAbsoluteUrl, normalizePathPrefix, parseSameOriginUrl, prependPathPrefix, stripI18nPathPrefix, stripTrailingSlash };
+//# sourceMappingURL=path.mjs.map

package/dist/core/standard-routes/path.mjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"path.mjs","names":[],"sources":["../../../src/core/standard-routes/path.ts"],"sourcesContent":["export function prependPathPrefix(pathname: string, pathPrefix: string | undefined): string {\n  const normalizedPathPrefix = normalizePathPrefix(pathPrefix);\n  if (!normalizedPathPrefix) return pathname;\n\n  return `${normalizedPathPrefix}/${pathname.replace(/^\\/+/, \"\")}`;\n}\n\nexport function normalizePathPrefix(pathPrefix: string | undefined): string {\n  if (!pathPrefix) return \"\";\n\n  const trimmedPathPrefix = pathPrefix.trim().replace(/^\\/+|\\/+$/g, \"\");\n  return trimmedPathPrefix ? `/${trimmedPathPrefix}` : \"\";\n}\n\nfunction parseUrl(url: string, baseUrl: string | undefined): URL | null {\n  try {\n    return new URL(url, baseUrl ?? \"https://shopify.local\");\n  } catch {\n    return null;\n  }\n}\n\n/**\n * Parses a URL and rejects absolute URLs that do not share `baseUrl`'s origin.\n *\n * Relative URLs are resolved against `baseUrl` when provided, or against a throwaway local origin\n * when no base is available.\n */\nexport function parseSameOriginUrl(url: string, baseUrl: string | undefined): URL | null {\n  const parsedUrl = parseUrl(url, baseUrl);\n  if (!parsedUrl) return null;\n\n  const parsedBaseUrl = baseUrl ? parseUrl(baseUrl, undefined) : null;\n  if (parsedBaseUrl && parsedUrl.origin !== parsedBaseUrl.origin) return null;\n\n  return parsedUrl;\n}\n\nexport function isAbsoluteUrl(url: string): boolean {\n  return /^[A-Za-z][A-Za-z0-9+.-]*:/.test(url);\n}\n\nexport function stripTrailingSlash(pathname: string): string {\n  if (pathname === \"/\") return pathname;\n  return pathname.replace(/\\/+$/, \"\");\n}\n\n/**\n * Removes the locale prefix before matching route templates.\n *\n * `ShopifyScripts` stores `routes.root` with a trailing slash, while server i18n uses\n * `pathPrefix`; both are normalized here so `/fr-ca/products/snowboard` can match the same\n * template as `/products/snowboard`.\n */\nexport function stripI18nPathPrefix(pathname: string, pathPrefix: string | undefined): string {\n  const normalizedPathPrefix = normalizePathPrefix(pathPrefix);\n  if (!normalizedPathPrefix) return pathname;\n\n  const lowerPathname = pathname.toLowerCase();\n  const lowerPathPrefix = normalizedPathPrefix.toLowerCase();\n\n  if (lowerPathname === lowerPathPrefix) return \"/\";\n  if (!lowerPathname.startsWith(`${lowerPathPrefix}/`)) return pathname;\n\n  return pathname.slice(normalizedPathPrefix.length) || \"/\";\n}\n"],"mappings":";AAAA,SAAgB,kBAAkB,UAAkB,YAAwC;CAC1F,MAAM,uBAAuB,oBAAoB,WAAW;AAC5D,KAAI,CAAC,qBAAsB,QAAO;AAElC,QAAO,GAAG,qBAAqB,GAAG,SAAS,QAAQ,QAAQ,GAAG;;AAGhE,SAAgB,oBAAoB,YAAwC;AAC1E,KAAI,CAAC,WAAY,QAAO;CAExB,MAAM,oBAAoB,WAAW,MAAM,CAAC,QAAQ,cAAc,GAAG;AACrE,QAAO,oBAAoB,IAAI,sBAAsB;;AAGvD,SAAS,SAAS,KAAa,SAAyC;AACtE,KAAI;AACF,SAAO,IAAI,IAAI,KAAK,WAAW,wBAAwB;SACjD;AACN,SAAO;;;;;;;;;AAUX,SAAgB,mBAAmB,KAAa,SAAyC;CACvF,MAAM,YAAY,SAAS,KAAK,QAAQ;AACxC,KAAI,CAAC,UAAW,QAAO;CAEvB,MAAM,gBAAgB,UAAU,SAAS,SAAS,OAAU,GAAG;AAC/D,KAAI,iBAAiB,UAAU,WAAW,cAAc,OAAQ,QAAO;AAEvE,QAAO;;AAGT,SAAgB,cAAc,KAAsB;AAClD,QAAO,4BAA4B,KAAK,IAAI;;AAG9C,SAAgB,mBAAmB,UAA0B;AAC3D,KAAI,aAAa,IAAK,QAAO;AAC7B,QAAO,SAAS,QAAQ,QAAQ,GAAG;;;;;;;;;AAUrC,SAAgB,oBAAoB,UAAkB,YAAwC;CAC5F,MAAM,uBAAuB,oBAAoB,WAAW;AAC5D,KAAI,CAAC,qBAAsB,QAAO;CAElC,MAAM,gBAAgB,SAAS,aAAa;CAC5C,MAAM,kBAAkB,qBAAqB,aAAa;AAE1D,KAAI,kBAAkB,gBAAiB,QAAO;AAC9C,KAAI,CAAC,cAAc,WAAW,GAAG,gBAAgB,GAAG,CAAE,QAAO;AAE7D,QAAO,SAAS,MAAM,qBAAqB,OAAO,IAAI"}

package/dist/core/standard-routes/redirects.mjs

@@ -0,0 +1,51 @@
+import { DEFAULT_STANDARD_ROUTES } from "./defaults.mjs";
+import { isAbsoluteUrl, parseSameOriginUrl, stripTrailingSlash } from "./path.mjs";
+import { buildStandardRouteTarget } from "./build.mjs";
+import { matchStandardRouteTemplates } from "./match.mjs";
+
+//#region src/core/standard-routes/redirects.ts
+/**
+* Returns the custom route target for a Shopify standard route pathname.
+*
+* This is used by server redirects: it only matches Shopify's default route shape when the app
+* configured a custom template for that same resource, so standard `/products/...` requests do not
+* redirect unless the app opted into a non-standard product route.
+*/
+function getStandardRouteTarget({ pathname, pathPrefix, routeTemplates }) {
+	const match = matchStandardRouteTemplates(pathname, pathPrefix, (route) => routeTemplates[route] ? DEFAULT_STANDARD_ROUTES[route] : []);
+	if (!match) return null;
+	const target = routeTemplates[match.route];
+	if (!target) return null;
+	return buildStandardRouteTarget(target, match.params, pathPrefix);
+}
+/**
+* Resolves a Shopify standard resource URL to the app's configured route template.
+*
+* Query strings and hashes are preserved. Absolute URLs are only resolved when they share the same
+* origin as `baseUrl`; external URLs are returned unchanged.
+*/
+function resolveStandardRouteUrl({ baseUrl, pathPrefix, routeTemplates, url }) {
+	const parsedUrl = parseSameOriginUrl(url, baseUrl);
+	if (!parsedUrl) return url;
+	const target = getStandardRouteTarget({
+		pathname: parsedUrl.pathname,
+		pathPrefix,
+		routeTemplates
+	});
+	if (!target) return url;
+	const resolvedUrl = `${target}${parsedUrl.search}${parsedUrl.hash}`;
+	return isAbsoluteUrl(url) ? `${parsedUrl.origin}${resolvedUrl}` : resolvedUrl;
+}
+function isStandardRouteSelfRedirect(requestUrl, location) {
+	try {
+		const sourceUrl = new URL(requestUrl);
+		const targetUrl = new URL(location, sourceUrl.origin);
+		return sourceUrl.origin === targetUrl.origin && stripTrailingSlash(sourceUrl.pathname) === stripTrailingSlash(targetUrl.pathname) && sourceUrl.search === targetUrl.search;
+	} catch {
+		return false;
+	}
+}
+
+//#endregion
+export { getStandardRouteTarget, isStandardRouteSelfRedirect, resolveStandardRouteUrl };
+//# sourceMappingURL=redirects.mjs.map

package/dist/core/standard-routes/redirects.mjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"redirects.mjs","names":[],"sources":["../../../src/core/standard-routes/redirects.ts"],"sourcesContent":["import { buildStandardRouteTarget } from \"./build\";\nimport { DEFAULT_STANDARD_ROUTES } from \"./defaults\";\nimport { matchStandardRouteTemplates } from \"./match\";\nimport { isAbsoluteUrl, parseSameOriginUrl, stripTrailingSlash } from \"./path\";\nimport type { ShopifyRouteTemplates } from \"./types\";\n\n/**\n * Returns the custom route target for a Shopify standard route pathname.\n *\n * This is used by server redirects: it only matches Shopify's default route shape when the app\n * configured a custom template for that same resource, so standard `/products/...` requests do not\n * redirect unless the app opted into a non-standard product route.\n */\nexport function getStandardRouteTarget({\n  pathname,\n  pathPrefix,\n  routeTemplates,\n}: {\n  pathname: string;\n  pathPrefix?: string;\n  routeTemplates: ShopifyRouteTemplates;\n}): string | null {\n  const match = matchStandardRouteTemplates(pathname, pathPrefix, (route) =>\n    routeTemplates[route] ? DEFAULT_STANDARD_ROUTES[route] : [],\n  );\n\n  if (!match) return null;\n\n  const target = routeTemplates[match.route];\n  if (!target) return null;\n\n  return buildStandardRouteTarget(target, match.params, pathPrefix);\n}\n\n/**\n * Resolves a Shopify standard resource URL to the app's configured route template.\n *\n * Query strings and hashes are preserved. Absolute URLs are only resolved when they share the same\n * origin as `baseUrl`; external URLs are returned unchanged.\n */\nexport function resolveStandardRouteUrl({\n  baseUrl,\n  pathPrefix,\n  routeTemplates,\n  url,\n}: {\n  baseUrl?: string;\n  pathPrefix?: string;\n  routeTemplates: ShopifyRouteTemplates;\n  url: string;\n}): string {\n  const parsedUrl = parseSameOriginUrl(url, baseUrl);\n  if (!parsedUrl) return url;\n\n  const target = getStandardRouteTarget({\n    pathname: parsedUrl.pathname,\n    pathPrefix,\n    routeTemplates,\n  });\n\n  if (!target) return url;\n\n  const resolvedUrl = `${target}${parsedUrl.search}${parsedUrl.hash}`;\n\n  return isAbsoluteUrl(url) ? `${parsedUrl.origin}${resolvedUrl}` : resolvedUrl;\n}\n\nexport function isStandardRouteSelfRedirect(requestUrl: string, location: string): boolean {\n  try {\n    const sourceUrl = new URL(requestUrl);\n    const targetUrl = new URL(location, sourceUrl.origin);\n\n    return (\n      sourceUrl.origin === targetUrl.origin &&\n      stripTrailingSlash(sourceUrl.pathname) === stripTrailingSlash(targetUrl.pathname) &&\n      sourceUrl.search === targetUrl.search\n    );\n  } catch {\n    return false;\n  }\n}\n"],"mappings":";;;;;;;;;;;;;AAaA,SAAgB,uBAAuB,EACrC,UACA,YACA,kBAKgB;CAChB,MAAM,QAAQ,4BAA4B,UAAU,aAAa,UAC/D,eAAe,SAAS,wBAAwB,SAAS,EAAE,CAC5D;AAED,KAAI,CAAC,MAAO,QAAO;CAEnB,MAAM,SAAS,eAAe,MAAM;AACpC,KAAI,CAAC,OAAQ,QAAO;AAEpB,QAAO,yBAAyB,QAAQ,MAAM,QAAQ,WAAW;;;;;;;;AASnE,SAAgB,wBAAwB,EACtC,SACA,YACA,gBACA,OAMS;CACT,MAAM,YAAY,mBAAmB,KAAK,QAAQ;AAClD,KAAI,CAAC,UAAW,QAAO;CAEvB,MAAM,SAAS,uBAAuB;EACpC,UAAU,UAAU;EACpB;EACA;EACD,CAAC;AAEF,KAAI,CAAC,OAAQ,QAAO;CAEpB,MAAM,cAAc,GAAG,SAAS,UAAU,SAAS,UAAU;AAE7D,QAAO,cAAc,IAAI,GAAG,GAAG,UAAU,SAAS,gBAAgB;;AAGpE,SAAgB,4BAA4B,YAAoB,UAA2B;AACzF,KAAI;EACF,MAAM,YAAY,IAAI,IAAI,WAAW;EACrC,MAAM,YAAY,IAAI,IAAI,UAAU,UAAU,OAAO;AAErD,SACE,UAAU,WAAW,UAAU,UAC/B,mBAAmB,UAAU,SAAS,KAAK,mBAAmB,UAAU,SAAS,IACjF,UAAU,WAAW,UAAU;SAE3B;AACN,SAAO"}

package/dist/core/standard-routes/types.d.mts

@@ -0,0 +1,95 @@
+//#region src/core/standard-routes/types.d.ts
+type StandardRouteTemplateWithParam<Param extends string> = `/${string}:${Param}` | `/${string}:${Param}/${string}`;
+type StandardRouteTemplate = `/${string}`;
+type ShopifyRouteTemplates = {
+  /**
+   * Redirects Shopify article routes, for example
+   * `/blogs/news/snowboard-guide`, to the app's custom article route.
+   *
+   * @example "/journal/:blogHandle/:articleHandle"
+   */
+  article?: StandardRouteTemplateWithParam<"blogHandle"> & StandardRouteTemplateWithParam<"articleHandle">;
+  /**
+   * Redirects Shopify blog routes, for example `/blogs/news`, to the app's
+   * custom blog route.
+   *
+   * @example "/journal/:blogHandle"
+   */
+  blog?: StandardRouteTemplateWithParam<"blogHandle">;
+  /**
+   * Redirects Shopify's `/cart` route to the app's custom cart route.
+   *
+   * @example "/basket"
+   */
+  cart?: StandardRouteTemplate;
+  /**
+   * Redirects Shopify collection routes, for example `/collections/winter`,
+   * to the app's custom collection route.
+   *
+   * @example "/c/:collectionHandle"
+   */
+  collection?: StandardRouteTemplateWithParam<"collectionHandle">;
+  /**
+   * Redirects Shopify's collection-listing routes, `/collections` and the
+   * legacy `/products`, to the app's custom collection-listing route.
+   *
+   * @example "/catalog"
+   */
+  collectionList?: StandardRouteTemplate;
+  /**
+   * Redirects Shopify page routes, for example `/pages/about-us`, to the app's
+   * custom page route.
+   *
+   * @example "/content/:pageHandle"
+   */
+  page?: StandardRouteTemplateWithParam<"pageHandle">;
+  /**
+   * Redirects Shopify policy routes, for example `/policies/privacy-policy`,
+   * to the app's custom policy route.
+   *
+   * @example "/legal/:policyHandle"
+   */
+  policy?: StandardRouteTemplateWithParam<"policyHandle">;
+  /**
+   * Redirects Shopify product routes, for example `/products/snowboard`,
+   * to the app's custom product route.
+   *
+   * @example "/p/:productHandle"
+   */
+  product?: StandardRouteTemplateWithParam<"productHandle">;
+  /**
+   * Redirects Shopify collection-scoped product routes, for example
+   * `/collections/winter/products/snowboard`, to the app's custom product route.
+   *
+   * Must include `:productHandle`. May include `:collectionHandle` when the
+   * app's custom product route is also collection-scoped.
+   *
+   * @example "/p/:productHandle"
+   * @example "/c/:collectionHandle/p/:productHandle"
+   */
+  productInCollection?: StandardRouteTemplateWithParam<"productHandle">;
+  /**
+   * Redirects Shopify's `/search` route to the app's custom search route.
+   *
+   * @example "/find"
+   */
+  search?: StandardRouteTemplate;
+};
+type StandardRouteName = keyof ShopifyRouteTemplates;
+type ShopifyStandardRouteName = StandardRouteName | "index";
+type ShopifyPageTemplateName<TRoute extends ShopifyStandardRouteName = ShopifyStandardRouteName> = TRoute extends "productInCollection" ? "product" : TRoute extends "collectionList" ? "list-collections" : TRoute;
+type StandardRouteParamName = "articleHandle" | "blogHandle" | "collectionHandle" | "pageHandle" | "policyHandle" | "productHandle";
+type StandardRouteParams = Partial<Record<StandardRouteParamName, string>>;
+type ShopifyStandardRouteMatch<TRoute extends ShopifyStandardRouteName = ShopifyStandardRouteName> = {
+  standardPathname: string;
+  params: StandardRouteParams;
+  route: TRoute;
+  pageTemplateName: ShopifyPageTemplateName<TRoute>;
+  templates: {
+    standard: string;
+    custom: string;
+  };
+};
+//#endregion
+export { ShopifyRouteTemplates, ShopifyStandardRouteMatch };
+//# sourceMappingURL=types.d.mts.map

package/dist/core/url.mjs

@@ -0,0 +1,42 @@
+//#region src/core/url.ts
+const SFAPI_RE = /^\/api\/(unstable|2\d{3}-\d{2})\/graphql\.json$/;
+const SHOPIFY_API_PROXY_PREFIX = "/__shopify";
+const SHOPIFY_API_PROXY_RE = /^\/__shopify(?:\/|$)/;
+const MCP_RE = /^\/api\/mcp$/;
+const CHECKOUT_RE = /^\/checkout$/;
+const CART_PERMALINK_RE = /^\/cart\/\d+:\d+(?:,\d+:\d+)*$/;
+const CUSTOMER_ACCOUNT_PATHS = {
+	authorize: "/account/authorize",
+	login: "/account/login",
+	logout: "/account/logout",
+	refresh: "/account/refresh"
+};
+const CUSTOMER_ACCOUNT_HANDOFF_PATHS = new Set(Object.values(CUSTOMER_ACCOUNT_PATHS));
+/**
+* Returns whether the pathname conventionally represents a Hydrogen document-level server handoff.
+*
+* Keep this aligned with the routes intercepted before framework routing. API and protocol
+* interceptors are intentionally excluded because they are not browser navigation destinations.
+*/
+function isHydrogenServerHandoffPath(pathname) {
+	return CHECKOUT_RE.test(pathname) || CART_PERMALINK_RE.test(pathname) || CUSTOMER_ACCOUNT_HANDOFF_PATHS.has(pathname);
+}
+/**
+* Allowlisted `.well-known` resources proxied to the Online Store origin:
+* - `apple-developer-merchantid-domain-association` — Apple Pay domain verification.
+* - `shopify/fec/produce` — Frontend Event Collector ingress. On the Online
+*   Store the myshopify.com edge forwards this first-party path to the
+*   collector; headless storefronts have no such edge, so Hydrogen proxies it
+*   to the same origin (used by WebMCP's Event Refinery client).
+*/
+const WELL_KNOWN_RE = /^\/\.well-known\/(?:apple-developer-merchantid-domain-association|shopify\/fec\/produce)$/;
+const AJAX_CART_RE = /^(?:\/[a-z]{2}(?:-[a-z]{2})?)?\/cart(?:\.(?:js|json)|\/(?:add|update|change|clear)(?:\.(?:js|json))?)$/i;
+function normalizeStoreDomain(domain) {
+	if (!domain) throw new Error("Storefront `storeDomain` is required.");
+	if (domain.startsWith("http://") || domain.startsWith("https://")) return domain.replace(/\/+$/, "");
+	return `https://${domain}`.replace(/\/+$/, "");
+}
+
+//#endregion
+export { AJAX_CART_RE, CHECKOUT_RE, CUSTOMER_ACCOUNT_PATHS, MCP_RE, SFAPI_RE, SHOPIFY_API_PROXY_PREFIX, SHOPIFY_API_PROXY_RE, WELL_KNOWN_RE, isHydrogenServerHandoffPath, normalizeStoreDomain };
+//# sourceMappingURL=url.mjs.map

package/dist/core/url.mjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"url.mjs","names":[],"sources":["../../src/core/url.ts"],"sourcesContent":["export const SFAPI_RE = /^\\/api\\/(unstable|2\\d{3}-\\d{2})\\/graphql\\.json$/;\nexport const SHOPIFY_API_PROXY_PREFIX = \"/__shopify\";\nexport const SHOPIFY_API_PROXY_RE = /^\\/__shopify(?:\\/|$)/;\nexport const MCP_RE = /^\\/api\\/mcp$/;\nexport const CHECKOUT_RE = /^\\/checkout$/;\nexport const CART_PERMALINK_RE = /^\\/cart\\/\\d+:\\d+(?:,\\d+:\\d+)*$/;\nexport const CUSTOMER_ACCOUNT_PATHS = {\n  authorize: \"/account/authorize\",\n  login: \"/account/login\",\n  logout: \"/account/logout\",\n  refresh: \"/account/refresh\",\n} as const;\n\nconst CUSTOMER_ACCOUNT_HANDOFF_PATHS: ReadonlySet<string> = new Set(\n  Object.values(CUSTOMER_ACCOUNT_PATHS),\n);\n\n/**\n * Returns whether the pathname conventionally represents a Hydrogen document-level server handoff.\n *\n * Keep this aligned with the routes intercepted before framework routing. API and protocol\n * interceptors are intentionally excluded because they are not browser navigation destinations.\n */\nexport function isHydrogenServerHandoffPath(pathname: string): boolean {\n  return (\n    CHECKOUT_RE.test(pathname) ||\n    CART_PERMALINK_RE.test(pathname) ||\n    CUSTOMER_ACCOUNT_HANDOFF_PATHS.has(pathname)\n  );\n}\n\n/**\n * Allowlisted `.well-known` resources proxied to the Online Store origin:\n * - `apple-developer-merchantid-domain-association` — Apple Pay domain verification.\n * - `shopify/fec/produce` — Frontend Event Collector ingress. On the Online\n *   Store the myshopify.com edge forwards this first-party path to the\n *   collector; headless storefronts have no such edge, so Hydrogen proxies it\n *   to the same origin (used by WebMCP's Event Refinery client).\n */\nexport const WELL_KNOWN_RE =\n  /^\\/\\.well-known\\/(?:apple-developer-merchantid-domain-association|shopify\\/fec\\/produce)$/;\nexport const AJAX_CART_RE =\n  /^(?:\\/[a-z]{2}(?:-[a-z]{2})?)?\\/cart(?:\\.(?:js|json)|\\/(?:add|update|change|clear)(?:\\.(?:js|json))?)$/i;\n\nexport function normalizeStoreDomain(domain: string): string {\n  if (!domain) {\n    throw new Error(\"Storefront `storeDomain` is required.\");\n  }\n\n  if (domain.startsWith(\"http://\") || domain.startsWith(\"https://\")) {\n    return domain.replace(/\\/+$/, \"\");\n  }\n  return `https://${domain}`.replace(/\\/+$/, \"\");\n}\n"],"mappings":";AAAA,MAAa,WAAW;AACxB,MAAa,2BAA2B;AACxC,MAAa,uBAAuB;AACpC,MAAa,SAAS;AACtB,MAAa,cAAc;AAC3B,MAAa,oBAAoB;AACjC,MAAa,yBAAyB;CACpC,WAAW;CACX,OAAO;CACP,QAAQ;CACR,SAAS;CACV;AAED,MAAM,iCAAsD,IAAI,IAC9D,OAAO,OAAO,uBAAuB,CACtC;;;;;;;AAQD,SAAgB,4BAA4B,UAA2B;AACrE,QACE,YAAY,KAAK,SAAS,IAC1B,kBAAkB,KAAK,SAAS,IAChC,+BAA+B,IAAI,SAAS;;;;;;;;;;AAYhD,MAAa,gBACX;AACF,MAAa,eACX;AAEF,SAAgB,qBAAqB,QAAwB;AAC3D,KAAI,CAAC,OACH,OAAM,IAAI,MAAM,wCAAwC;AAG1D,KAAI,OAAO,WAAW,UAAU,IAAI,OAAO,WAAW,WAAW,CAC/D,QAAO,OAAO,QAAQ,QAAQ,GAAG;AAEnC,QAAO,WAAW,SAAS,QAAQ,QAAQ,GAAG"}

package/dist/core/utils/load-script.mjs

@@ -0,0 +1,34 @@
+//#region src/core/utils/load-script.ts
+/**
+* Inlined from @shopify/hydrogen-react/load-script.
+* Pure DOM script loader with no framework dependency.
+*/
+const SCRIPTS_LOADED = {};
+function loadScript(src, options) {
+	const isScriptLoaded = SCRIPTS_LOADED[src];
+	if (isScriptLoaded) return isScriptLoaded;
+	const promise = new Promise((resolve, reject) => {
+		const script = document.createElement("script");
+		script.type = options?.module ? "module" : "text/javascript";
+		script.src = src;
+		script.addEventListener("load", () => resolve(true));
+		script.addEventListener("error", () => {
+			delete SCRIPTS_LOADED[src];
+			reject(false);
+		});
+		if (options?.in === "head") document.head.appendChild(script);
+		else document.body.appendChild(script);
+		if (options?.attributes) {
+			const { attributes } = options;
+			Object.keys(attributes).forEach((key) => {
+				script.setAttribute(key, attributes[key]);
+			});
+		}
+	});
+	SCRIPTS_LOADED[src] = promise;
+	return promise;
+}
+
+//#endregion
+export { loadScript };
+//# sourceMappingURL=load-script.mjs.map

package/dist/core/utils/load-script.mjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"load-script.mjs","names":[],"sources":["../../../src/core/utils/load-script.ts"],"sourcesContent":["/**\n * Inlined from @shopify/hydrogen-react/load-script.\n * Pure DOM script loader with no framework dependency.\n */\n\nconst SCRIPTS_LOADED: Record<string, Promise<boolean>> = {};\n\ntype LoadScriptOptions = {\n  module?: boolean;\n  in?: \"head\" | \"body\";\n  attributes?: Record<string, string>;\n};\n\nexport function loadScript(src: string, options?: LoadScriptOptions): Promise<boolean> {\n  const isScriptLoaded = SCRIPTS_LOADED[src];\n  if (isScriptLoaded) return isScriptLoaded;\n\n  const promise = new Promise<boolean>((resolve, reject) => {\n    const script = document.createElement(\"script\");\n    script.type = options?.module ? \"module\" : \"text/javascript\";\n    script.src = src;\n    script.addEventListener(\"load\", () => resolve(true));\n    script.addEventListener(\"error\", () => {\n      delete SCRIPTS_LOADED[src];\n      reject(false);\n    });\n\n    if (options?.in === \"head\") {\n      document.head.appendChild(script);\n    } else {\n      document.body.appendChild(script);\n    }\n\n    if (options?.attributes) {\n      const { attributes } = options;\n      Object.keys(attributes).forEach((key) => {\n        script.setAttribute(key, attributes[key]);\n      });\n    }\n  });\n\n  SCRIPTS_LOADED[src] = promise;\n  return promise;\n}\n"],"mappings":";;;;;AAKA,MAAM,iBAAmD,EAAE;AAQ3D,SAAgB,WAAW,KAAa,SAA+C;CACrF,MAAM,iBAAiB,eAAe;AACtC,KAAI,eAAgB,QAAO;CAE3B,MAAM,UAAU,IAAI,SAAkB,SAAS,WAAW;EACxD,MAAM,SAAS,SAAS,cAAc,SAAS;AAC/C,SAAO,OAAO,SAAS,SAAS,WAAW;AAC3C,SAAO,MAAM;AACb,SAAO,iBAAiB,cAAc,QAAQ,KAAK,CAAC;AACpD,SAAO,iBAAiB,eAAe;AACrC,UAAO,eAAe;AACtB,UAAO,MAAM;IACb;AAEF,MAAI,SAAS,OAAO,OAClB,UAAS,KAAK,YAAY,OAAO;MAEjC,UAAS,KAAK,YAAY,OAAO;AAGnC,MAAI,SAAS,YAAY;GACvB,MAAM,EAAE,eAAe;AACvB,UAAO,KAAK,WAAW,CAAC,SAAS,QAAQ;AACvC,WAAO,aAAa,KAAK,WAAW,KAAK;KACzC;;GAEJ;AAEF,gBAAe,OAAO;AACtB,QAAO"}

package/dist/core/utils/parse-gid.mjs

@@ -0,0 +1,33 @@
+//#region src/core/utils/parse-gid.ts
+function parseGid(gid) {
+	const defaultReturn = {
+		id: "",
+		resource: null,
+		resourceId: null,
+		search: "",
+		searchParams: new URLSearchParams(),
+		hash: ""
+	};
+	if (typeof gid !== "string") return defaultReturn;
+	try {
+		const { search, searchParams, pathname, hash } = new URL(gid);
+		const pathnameParts = pathname.split("/");
+		const lastPathnamePart = pathnameParts[pathnameParts.length - 1];
+		const resourcePart = pathnameParts[pathnameParts.length - 2];
+		if (!lastPathnamePart || !resourcePart) return defaultReturn;
+		return {
+			id: `${lastPathnamePart}${search}${hash}` || "",
+			resource: resourcePart ?? null,
+			resourceId: lastPathnamePart || null,
+			search,
+			searchParams,
+			hash
+		};
+	} catch {
+		return defaultReturn;
+	}
+}
+
+//#endregion
+export { parseGid };
+//# sourceMappingURL=parse-gid.mjs.map

package/dist/core/utils/parse-gid.mjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"parse-gid.mjs","names":[],"sources":["../../../src/core/utils/parse-gid.ts"],"sourcesContent":["/**\n * Inlined from @shopify/hydrogen-react/analytics-utils.\n * Parses Shopify Global IDs (GIDs) into their component parts.\n */\n\ntype ShopifyGid = Pick<URL, \"search\" | \"searchParams\" | \"hash\"> & {\n  id: string;\n  resource: string | null;\n  resourceId: string | null;\n};\n\nexport function parseGid(gid: string | undefined): ShopifyGid {\n  const defaultReturn: ShopifyGid = {\n    id: \"\",\n    resource: null,\n    resourceId: null,\n    search: \"\",\n    searchParams: new URLSearchParams(),\n    hash: \"\",\n  };\n\n  if (typeof gid !== \"string\") return defaultReturn;\n\n  try {\n    const { search, searchParams, pathname, hash } = new URL(gid);\n    const pathnameParts = pathname.split(\"/\");\n    const lastPathnamePart = pathnameParts[pathnameParts.length - 1];\n    const resourcePart = pathnameParts[pathnameParts.length - 2];\n\n    if (!lastPathnamePart || !resourcePart) return defaultReturn;\n\n    const id = `${lastPathnamePart}${search}${hash}` || \"\";\n    const resourceId = lastPathnamePart || null;\n    const resource = resourcePart ?? null;\n\n    return { id, resource, resourceId, search, searchParams, hash };\n  } catch {\n    return defaultReturn;\n  }\n}\n"],"mappings":";AAWA,SAAgB,SAAS,KAAqC;CAC5D,MAAM,gBAA4B;EAChC,IAAI;EACJ,UAAU;EACV,YAAY;EACZ,QAAQ;EACR,cAAc,IAAI,iBAAiB;EACnC,MAAM;EACP;AAED,KAAI,OAAO,QAAQ,SAAU,QAAO;AAEpC,KAAI;EACF,MAAM,EAAE,QAAQ,cAAc,UAAU,SAAS,IAAI,IAAI,IAAI;EAC7D,MAAM,gBAAgB,SAAS,MAAM,IAAI;EACzC,MAAM,mBAAmB,cAAc,cAAc,SAAS;EAC9D,MAAM,eAAe,cAAc,cAAc,SAAS;AAE1D,MAAI,CAAC,oBAAoB,CAAC,aAAc,QAAO;AAM/C,SAAO;GAAE,IAJE,GAAG,mBAAmB,SAAS,UAAU;GAIvC,UAFI,gBAAgB;GAEV,YAHJ,oBAAoB;GAGJ;GAAQ;GAAc;GAAM;SACzD;AACN,SAAO"}

package/dist/core/utils/record.mjs

@@ -0,0 +1,8 @@
+//#region src/core/utils/record.ts
+function isObjectRecord(value) {
+	return typeof value === "object" && value !== null && !Array.isArray(value);
+}
+
+//#endregion
+export { isObjectRecord };
+//# sourceMappingURL=record.mjs.map

package/dist/core/utils/record.mjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"record.mjs","names":[],"sources":["../../../src/core/utils/record.ts"],"sourcesContent":["export function isObjectRecord(value: unknown): value is Record<PropertyKey, unknown> {\n  return typeof value === \"object\" && value !== null && !Array.isArray(value);\n}\n"],"mappings":";AAAA,SAAgB,eAAe,OAAuD;AACpF,QAAO,OAAO,UAAU,YAAY,UAAU,QAAQ,CAAC,MAAM,QAAQ,MAAM"}

package/dist/customer-account/client.d.mts

@@ -0,0 +1,50 @@
+import { ShopifyRequestContext } from "../core/request-context.mjs";
+import { GraphQLFormattedError } from "../client/types.mjs";
+import { AnyCustomerAccountDocument, CustomerAccountDocument } from "./graphql.mjs";
+
+//#region src/customer-account/client.d.ts
+type CreateCustomerAccountClientOptions = {
+  shopId: string;
+  customerApiVersion?: string;
+  requestContext: ShopifyRequestContext;
+  fetch?: typeof globalThis.fetch;
+  defaultTimeoutInMs?: number;
+};
+type CustomerAccountGraphqlOptions<Variables = Record<string, unknown>> = {
+  accessToken: string;
+  variables?: Variables;
+  signal?: AbortSignal;
+};
+type ResultOfDoc<Doc> = Doc extends CustomerAccountDocument<infer Result, never, string> ? Result : never;
+type VariablesOfDoc<Doc> = Doc extends CustomerAccountDocument<unknown, infer Variables, string> ? Variables : never;
+type OptionalAutoVariables<Variables> = "language" extends keyof Variables ? {
+  language?: Variables["language"];
+} : {};
+type UserVariables<Doc> = Omit<VariablesOfDoc<Doc>, "language"> & OptionalAutoVariables<VariablesOfDoc<Doc>>;
+type HasNoRequiredKeys<T> = Record<string, never> extends T ? true : false;
+type CustomerAccountGraphqlResult<Result = unknown> = {
+  data: Result;
+  errors?: undefined;
+  headers: Headers;
+} | {
+  data: Result | null;
+  errors: GraphQLFormattedError[];
+  headers: Headers;
+};
+type CustomerAccountGqlRestParam<Doc extends AnyCustomerAccountDocument> = HasNoRequiredKeys<UserVariables<Doc>> extends true ? [options: CustomerAccountGraphqlOptions<UserVariables<Doc>>] : [options: CustomerAccountGraphqlOptions<UserVariables<Doc>> & {
+  variables: UserVariables<Doc>;
+}];
+type CustomerAccountClient = {
+  readonly apiUrl: string;
+  graphql: <const Doc extends AnyCustomerAccountDocument>(document: Doc, ...options: CustomerAccountGqlRestParam<Doc>) => Promise<CustomerAccountGraphqlResult<ResultOfDoc<Doc>>>;
+};
+declare function createCustomerAccountClient({
+  shopId,
+  customerApiVersion,
+  requestContext,
+  fetch: customFetch,
+  defaultTimeoutInMs
+}: CreateCustomerAccountClientOptions): CustomerAccountClient;
+//#endregion
+export { CreateCustomerAccountClientOptions, CustomerAccountClient, CustomerAccountGqlRestParam, CustomerAccountGraphqlOptions, CustomerAccountGraphqlResult, createCustomerAccountClient };
+//# sourceMappingURL=client.d.mts.map

package/dist/customer-account/client.mjs

@@ -0,0 +1,239 @@
+import { CUSTOMER_ACCOUNT_API_VERSION, DEFAULT_TIMEOUT_IN_MS } from "../core/constants.mjs";
+import { CustomerAccountApiError, CustomerAccountAuthenticationError, CustomerAccountTimeoutError } from "./errors.mjs";
+import { isObjectRecord } from "../core/utils/record.mjs";
+import { assertCustomerAccountDocument } from "./graphql.mjs";
+
+//#region src/customer-account/client.ts
+const SHOP_ID_RE = /^\d+$/;
+const CUSTOMER_API_VERSION_RE = /^\d{4}-\d{2}$/;
+const MAX_ASCII_CONTROL_CODE_POINT = 31;
+const ASCII_DELETE_CODE_POINT = 127;
+const MAX_SET_TIMEOUT_IN_MS = 2147483647;
+const LOCAL_ORIGIN_HOSTS = new Set([
+	"localhost",
+	"127.0.0.1",
+	"::1",
+	"[::1]"
+]);
+const USER_AGENT = `Hydrogen 2026.10.0-preview.2`;
+const CUSTOMER_ACCOUNT_GRAPHQL_PERSONALIZATION_REASON = "customer-account-graphql";
+function createCustomerAccountClient({ shopId, customerApiVersion = CUSTOMER_ACCOUNT_API_VERSION, requestContext, fetch: customFetch, defaultTimeoutInMs = DEFAULT_TIMEOUT_IN_MS }) {
+	if (typeof document !== "undefined") throw new Error("Customer Account API tokens cannot be used in a browser context. Use this client from server or edge routes only.");
+	validateShopId(shopId);
+	validateCustomerApiVersion(customerApiVersion);
+	validateTimeout(defaultTimeoutInMs);
+	const resolvedFetch = customFetch ?? globalThis.fetch;
+	if (typeof resolvedFetch !== "function") throw new Error("No fetch function available. Pass a fetch option or ensure globalThis.fetch exists.");
+	const origin = getOrigin(requestContext.url);
+	const apiUrl = `https://shopify.com/${shopId}/account/customer/api/${customerApiVersion}/graphql`;
+	async function graphql(document, ...rest) {
+		assertCustomerAccountDocument(document);
+		const options = validateGraphqlOptions(rest[0]);
+		requestContext.markResponseAsPersonalized(CUSTOMER_ACCOUNT_GRAPHQL_PERSONALIZATION_REASON);
+		const accessToken = validateAccessToken(options.accessToken);
+		const externalSignals = [requestContext.signal, options.signal].filter((signal) => Boolean(signal));
+		throwIfAlreadyAborted(externalSignals);
+		const { signal: timeoutSignal, cleanup: cleanupTimeout } = createCustomerAccountTimeoutSignal(defaultTimeoutInMs);
+		externalSignals.push(timeoutSignal);
+		const signal = AbortSignal.any(externalSignals);
+		try {
+			const variables = getVariables(document, getOptionalVariables(options.variables), requestContext.i18n.language);
+			return await readCustomerAccountGraphqlResponse(await fetchCustomerAccountGraphql({
+				fetch: resolvedFetch,
+				apiUrl,
+				accessToken,
+				origin,
+				query: document.source,
+				variables,
+				signal,
+				timeoutSignal,
+				timeoutInMs: defaultTimeoutInMs
+			}), signal, timeoutSignal, defaultTimeoutInMs);
+		} finally {
+			cleanupTimeout();
+		}
+	}
+	return {
+		apiUrl,
+		graphql
+	};
+}
+async function fetchCustomerAccountGraphql({ fetch, apiUrl, accessToken, origin, query, variables, signal, timeoutSignal, timeoutInMs }) {
+	try {
+		return await withAbort(fetch(apiUrl, {
+			method: "POST",
+			headers: new Headers({
+				Authorization: accessToken,
+				"Content-Type": "application/json",
+				Origin: origin,
+				"User-Agent": USER_AGENT
+			}),
+			body: JSON.stringify({
+				query,
+				variables
+			}),
+			cache: "no-store",
+			redirect: "manual",
+			signal
+		}), signal);
+	} catch (cause) {
+		throwIfCustomerAccountSignalAborted(signal, timeoutSignal, timeoutInMs);
+		if (isAbortError(cause)) throw cause;
+		throw new CustomerAccountApiError("Customer Account API request failed", { cause });
+	}
+}
+async function readCustomerAccountGraphqlResponse(response, signal, timeoutSignal, timeoutInMs) {
+	const requestId = response.headers.get("x-request-id") ?? void 0;
+	if (!response.ok) {
+		cancelResponseBody(response);
+		throw new CustomerAccountApiError(`Customer Account API responded with ${response.status}`, {
+			status: response.status,
+			requestId,
+			retryAfter: response.headers.get("retry-after") ?? void 0
+		});
+	}
+	let body;
+	try {
+		body = parseGraphqlResponse(await withAbort(response.json(), signal));
+	} catch (cause) {
+		cancelResponseBody(response);
+		throwIfCustomerAccountSignalAborted(signal, timeoutSignal, timeoutInMs);
+		if (isAbortError(cause)) throw cause;
+		throw new CustomerAccountApiError("Failed to parse Customer Account API response as JSON", {
+			status: response.status,
+			requestId,
+			cause
+		});
+	}
+	if (body.errors) return {
+		data: body.data ?? null,
+		errors: body.errors,
+		headers: response.headers
+	};
+	if (body.data == null) throw new CustomerAccountApiError("Customer Account API response did not include data", {
+		status: response.status,
+		requestId
+	});
+	return {
+		data: body.data,
+		headers: response.headers
+	};
+}
+function cancelResponseBody(response) {
+	try {
+		response.body?.cancel().catch(() => void 0);
+	} catch {}
+}
+function validateTimeout(timeoutInMs) {
+	if (!Number.isSafeInteger(timeoutInMs) || timeoutInMs <= 0 || timeoutInMs > MAX_SET_TIMEOUT_IN_MS) throw new Error(`defaultTimeoutInMs must be a positive safe integer no greater than ${MAX_SET_TIMEOUT_IN_MS}`);
+}
+function createCustomerAccountTimeoutSignal(timeoutInMs) {
+	const controller = new AbortController();
+	const timeoutId = setTimeout(() => {
+		controller.abort(new CustomerAccountTimeoutError(timeoutInMs));
+	}, timeoutInMs);
+	return {
+		signal: controller.signal,
+		cleanup: () => clearTimeout(timeoutId)
+	};
+}
+function withAbort(promise, signal) {
+	if (!signal) return Promise.resolve(promise);
+	if (signal.aborted) return Promise.reject(signal.reason ?? new DOMException("signal is aborted without reason", "AbortError"));
+	return new Promise((resolve, reject) => {
+		const abort = () => {
+			signal.removeEventListener("abort", abort);
+			reject(signal.reason ?? new DOMException("signal is aborted without reason", "AbortError"));
+		};
+		signal.addEventListener("abort", abort, { once: true });
+		Promise.resolve(promise).then((value) => {
+			signal.removeEventListener("abort", abort);
+			resolve(value);
+		}, (error) => {
+			signal.removeEventListener("abort", abort);
+			reject(error);
+		});
+	});
+}
+function getVariables(document, variables, language) {
+	if (!document.variableNames.has("language")) return variables;
+	if ("language" in variables) return variables;
+	return {
+		...variables,
+		language
+	};
+}
+function throwIfAlreadyAborted(signals) {
+	const abortedSignal = signals.find((signal) => signal.aborted);
+	if (!abortedSignal) return;
+	throw abortedSignal.reason ?? new DOMException("signal is aborted without reason", "AbortError");
+}
+function throwIfCustomerAccountSignalAborted(signal, timeoutSignal, timeoutInMs) {
+	if (!signal.aborted) return;
+	if (timeoutSignal.aborted && signal.reason === timeoutSignal.reason) {
+		const reason = timeoutSignal.reason;
+		throw reason instanceof CustomerAccountTimeoutError ? reason : new CustomerAccountTimeoutError(timeoutInMs);
+	}
+	throw signal.reason ?? new DOMException("signal is aborted without reason", "AbortError");
+}
+function isAbortError(cause) {
+	return cause instanceof DOMException && cause.name === "AbortError";
+}
+function parseGraphqlResponse(json) {
+	if (!isObjectRecord(json)) throw new Error("Customer Account API returned unexpected JSON type");
+	if (!("data" in json) && !("errors" in json)) throw new Error("Customer Account API response must include data or errors");
+	const errors = json.errors;
+	if (errors !== void 0 && !isGraphqlErrorArray(errors)) throw new Error("Customer Account API returned invalid GraphQL errors");
+	return {
+		data: json.data,
+		errors
+	};
+}
+function isGraphqlErrorArray(value) {
+	if (!Array.isArray(value)) return false;
+	return value.every((error) => {
+		return typeof error === "object" && error !== null && typeof error.message === "string";
+	});
+}
+function validateShopId(shopId) {
+	if (!SHOP_ID_RE.test(shopId)) throw new Error("shopId must be a numeric Shopify shop ID string");
+}
+function validateCustomerApiVersion(customerApiVersion) {
+	if (!CUSTOMER_API_VERSION_RE.test(customerApiVersion)) throw new Error("customerApiVersion must use YYYY-MM format");
+}
+function validateAccessToken(accessToken) {
+	if (typeof accessToken !== "string" || accessToken === "" || accessToken.trim() !== accessToken || hasAsciiControlCharacter(accessToken)) throw new CustomerAccountAuthenticationError();
+	return accessToken;
+}
+function validateGraphqlOptions(options) {
+	if (typeof options !== "object" || options === null) throw new CustomerAccountAuthenticationError();
+	return options;
+}
+function getOptionalVariables(variables) {
+	if (variables === void 0) return {};
+	if (!isObjectRecord(variables)) throw new TypeError("Customer Account API variables must be an object");
+	return variables;
+}
+function hasAsciiControlCharacter(value) {
+	for (let index = 0; index < value.length; index++) {
+		const codePoint = value.charCodeAt(index);
+		if (codePoint <= MAX_ASCII_CONTROL_CODE_POINT || codePoint === ASCII_DELETE_CODE_POINT) return true;
+	}
+	return false;
+}
+/**
+* Customer Account API requires an HTTPS Origin, but local dev frameworks often
+* receive `http://localhost` requests. Keep that local-only exception without
+* weakening origin validation for non-local requests.
+*/
+function getOrigin(requestUrl) {
+	if (!requestUrl) throw new Error("requestContext.url is required for Customer Account API requests");
+	const url = new URL(requestUrl);
+	if (url.protocol === "https:") return url.origin;
+	if (url.protocol === "http:" && LOCAL_ORIGIN_HOSTS.has(url.hostname)) return `https://${url.host}`;
+	throw new Error(`Customer Account API origin must use HTTPS. Received: ${requestUrl}`);
+}
+
+//#endregion
+export { createCustomerAccountClient };
+//# sourceMappingURL=client.mjs.map