@shopify/hydrogen 2026.4.5 → 2026.10.0-preview.2

package/dist/vite/certificate-prompt.mjs

@@ -0,0 +1,24 @@
+import { createInterface } from "node:readline/promises";
+
+//#region src/vite/certificate-prompt.ts
+async function confirmCertificateInstallation(host) {
+	if (!process.stdin.isTTY || !process.stdout.isTTY) return false;
+	const readline = createInterface({
+		input: process.stdin,
+		output: process.stdout
+	});
+	try {
+		return acceptsCertificateInstallation(await readline.question(`To run HTTPS in development, Hydrogen needs to download mkcert, add a local certificate authority to your system trust store, and create a certificate for "${host}". Continue? [Y/n] `));
+	} finally {
+		readline.close();
+	}
+}
+/** @internal Exported for tests. */
+function acceptsCertificateInstallation(answer) {
+	const response = answer.trim().toLowerCase();
+	return response === "" || response === "y" || response === "yes";
+}
+
+//#endregion
+export { confirmCertificateInstallation };
+//# sourceMappingURL=certificate-prompt.mjs.map

package/dist/vite/certificate-prompt.mjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"certificate-prompt.mjs","names":[],"sources":["../../src/vite/certificate-prompt.ts"],"sourcesContent":["import { createInterface } from \"node:readline/promises\";\n\nexport async function confirmCertificateInstallation(host: string): Promise<boolean> {\n  if (!process.stdin.isTTY || !process.stdout.isTTY) return false;\n\n  const readline = createInterface({ input: process.stdin, output: process.stdout });\n  try {\n    const answer = await readline.question(\n      `To run HTTPS in development, Hydrogen needs to download mkcert, add a local certificate authority to your system trust store, and create a certificate for \"${host}\". Continue? [Y/n] `,\n    );\n\n    return acceptsCertificateInstallation(answer);\n  } finally {\n    readline.close();\n  }\n}\n\n/** @internal Exported for tests. */\nexport function acceptsCertificateInstallation(answer: string): boolean {\n  const response = answer.trim().toLowerCase();\n  return response === \"\" || response === \"y\" || response === \"yes\";\n}\n"],"mappings":";;;AAEA,eAAsB,+BAA+B,MAAgC;AACnF,KAAI,CAAC,QAAQ,MAAM,SAAS,CAAC,QAAQ,OAAO,MAAO,QAAO;CAE1D,MAAM,WAAW,gBAAgB;EAAE,OAAO,QAAQ;EAAO,QAAQ,QAAQ;EAAQ,CAAC;AAClF,KAAI;AAKF,SAAO,+BAA+B,MAJjB,SAAS,SAC5B,+JAA+J,KAAK,qBACrK,CAE4C;WACrC;AACR,WAAS,OAAO;;;;AAKpB,SAAgB,+BAA+B,QAAyB;CACtE,MAAM,WAAW,OAAO,MAAM,CAAC,aAAa;AAC5C,QAAO,aAAa,MAAM,aAAa,OAAO,aAAa"}

package/dist/vite/index.d.mts

@@ -0,0 +1,2 @@
+import { LOCAL_HTTPS_DEFAULTS, LocalHttpsDevServerConfig, LocalHttpsOptions, LocalHttpsPlugin, ProvisionLocalHttpsOptions, localHttps, provisionLocalHttps } from "./local-https.mjs";
+export { LOCAL_HTTPS_DEFAULTS, LocalHttpsDevServerConfig, LocalHttpsOptions, LocalHttpsPlugin, ProvisionLocalHttpsOptions, localHttps, provisionLocalHttps };

package/dist/vite/index.mjs

@@ -0,0 +1,3 @@
+import { LOCAL_HTTPS_DEFAULTS, localHttps, provisionLocalHttps } from "./local-https.mjs";
+
+export { LOCAL_HTTPS_DEFAULTS, localHttps, provisionLocalHttps };

package/dist/vite/local-https.d.mts

@@ -0,0 +1,47 @@
+import { Plugin } from "vite";
+
+//#region src/vite/local-https.d.ts
+declare const LOCAL_HTTPS_DEFAULTS: {
+  readonly host: "local.tryhydrogen.dev";
+  readonly port: 5173;
+};
+/** Options for Hydrogen's local HTTPS Vite plugin. */
+type LocalHttpsOptions = {
+  /** Enable trusted local HTTPS for the dev server. */enabled: boolean; /** Local hostname registered in Shopify admin. Defaults to `local.tryhydrogen.dev`. */
+  host?: string; /** Local port registered in Shopify admin. Defaults to `5173`. */
+  port?: number; /** Certificate file path. Defaults to Hydrogen's mkcert path under `~/.shopify/hydrogen/certs`. */
+  certPath?: string | URL; /** Private key file path. Defaults to Hydrogen's mkcert path under `~/.shopify/hydrogen/certs`. */
+  keyPath?: string | URL;
+};
+type LocalHttpsPlugin = Plugin & {
+  api: {
+    /** Returns host, port, and TLS file paths for frameworks that terminate HTTPS outside Vite. */getDevServerConfig(): LocalHttpsDevServerConfig | undefined;
+  };
+};
+type LocalHttpsDevServerConfig = {
+  host: string;
+  port: number;
+  https: {
+    cert: string;
+    key: string;
+  };
+};
+/**
+ * Configures Vite for trusted local HTTPS on Hydrogen's default development host.
+ */
+declare function localHttps(options: LocalHttpsOptions): LocalHttpsPlugin;
+type ProvisionLocalHttpsOptions = Omit<LocalHttpsOptions, "enabled" | "port">;
+/**
+ * Downloads a pinned, checksum-verified mkcert release and generates the
+ * trusted local certificate files when they do not exist yet. The Vite plugin
+ * runs this automatically on `vite dev`; call it directly for frameworks that
+ * read certificate paths before Vite starts or from setup scripts.
+ */
+declare function provisionLocalHttps(options?: ProvisionLocalHttpsOptions): Promise<{
+  host: string;
+  certPath: string;
+  keyPath: string;
+}>;
+//#endregion
+export { LOCAL_HTTPS_DEFAULTS, LocalHttpsDevServerConfig, LocalHttpsOptions, LocalHttpsPlugin, ProvisionLocalHttpsOptions, localHttps, provisionLocalHttps };
+//# sourceMappingURL=local-https.d.mts.map

package/dist/vite/local-https.mjs

@@ -0,0 +1,276 @@
+import { CUSTOMER_ACCOUNT_PATHS } from "../core/url.mjs";
+import { confirmCertificateInstallation } from "./certificate-prompt.mjs";
+import { provisionCertificates } from "./mkcert.mjs";
+import { existsSync, readFileSync } from "node:fs";
+import { homedir } from "node:os";
+import { dirname, isAbsolute, join, resolve } from "node:path";
+import { fileURLToPath } from "node:url";
+
+//#region src/vite/local-https.ts
+const LOCAL_HTTPS_DEFAULTS = {
+	host: "local.tryhydrogen.dev",
+	port: 5173
+};
+const HEADER_PAIR_SIZE = 2;
+const HTTP1_ONLY_RESPONSE_HEADERS = new Set([
+	"connection",
+	"keep-alive",
+	"proxy-authenticate",
+	"proxy-authorization",
+	"te",
+	"trailer",
+	"transfer-encoding",
+	"upgrade"
+]);
+const emittedMissingCertificateWarnings = /* @__PURE__ */ new Set();
+const loggedCustomerAccountSettings = /* @__PURE__ */ new Set();
+/**
+* Configures Vite for trusted local HTTPS on Hydrogen's default development host.
+*/
+function localHttps(options) {
+	const settings = options.enabled ? resolveLocalHttpsSettings(options) : void 0;
+	let certificateFiles;
+	const getCertificateFiles = () => {
+		if (!settings) return;
+		certificateFiles ??= readCertificateFiles(settings);
+		return certificateFiles;
+	};
+	const getDevServerConfig = () => {
+		if (!settings || !checkCertificateFiles(settings)) return;
+		getCertificateFiles();
+		return {
+			host: settings.host,
+			port: settings.port,
+			https: {
+				cert: settings.certPath,
+				key: settings.keyPath
+			}
+		};
+	};
+	return {
+		name: "hydrogen-local-https",
+		api: { getDevServerConfig },
+		async config(_config, env) {
+			if (settings && env.command === "serve" && !env.isPreview) {
+				if (!await ensureCertificateFiles(settings)) return;
+			} else if (settings && !checkCertificateFiles(settings)) return;
+			const certificates = getCertificateFiles();
+			if (!settings || !certificates) return;
+			return { server: {
+				allowedHosts: [settings.host],
+				host: settings.host,
+				port: settings.port,
+				strictPort: true,
+				https: {
+					ALPNProtocols: ["http/1.1"],
+					cert: certificates.cert,
+					key: certificates.key
+				},
+				hmr: {
+					host: settings.host,
+					protocol: "wss"
+				}
+			} };
+		},
+		configureServer(server) {
+			if (!settings || !checkCertificateFiles(settings)) return;
+			getCertificateFiles();
+			configureLocalHttpsServer(server, settings);
+		}
+	};
+}
+/**
+* Downloads a pinned, checksum-verified mkcert release and generates the
+* trusted local certificate files when they do not exist yet. The Vite plugin
+* runs this automatically on `vite dev`; call it directly for frameworks that
+* read certificate paths before Vite starts or from setup scripts.
+*/
+async function provisionLocalHttps(options = {}) {
+	const settings = resolveLocalHttpsSettings({
+		enabled: true,
+		...options
+	});
+	if (!certificateFilesExist(settings)) await provisionCertificates(settings);
+	return {
+		host: settings.host,
+		certPath: settings.certPath,
+		keyPath: settings.keyPath
+	};
+}
+function resolveLocalHttpsSettings(options) {
+	const host = options.host ?? LOCAL_HTTPS_DEFAULTS.host;
+	const certificateDirectory = join(homedir(), ".shopify", "hydrogen", "certs");
+	return {
+		host,
+		port: options.port ?? LOCAL_HTTPS_DEFAULTS.port,
+		certPath: resolveCertificatePath(options.certPath ?? join(certificateDirectory, `${host}.pem`)),
+		keyPath: resolveCertificatePath(options.keyPath ?? join(certificateDirectory, `${host}-key.pem`))
+	};
+}
+function resolveCertificatePath(path) {
+	if (path instanceof URL) return fileURLToPath(path);
+	if (path === "~") return homedir();
+	if (path.startsWith("~/")) return resolve(homedir(), path.slice(2));
+	return isAbsolute(path) ? path : resolve(path);
+}
+function certificateFilesExist(settings) {
+	return existsSync(settings.certPath) && existsSync(settings.keyPath);
+}
+async function ensureCertificateFiles(settings) {
+	if (certificateFilesExist(settings)) return true;
+	if (isContinuousIntegration()) return checkCertificateFiles(settings, "Automatic certificate provisioning is skipped in CI environments (the CI environment variable is set).");
+	if (!await confirmCertificateInstallation(settings.host)) return checkCertificateFiles(settings, "Automatic certificate provisioning requires confirmation in an interactive terminal.");
+	try {
+		await provisionCertificates(settings);
+		return true;
+	} catch (error) {
+		return checkCertificateFiles(settings, `Automatic certificate provisioning failed:\n  ${error instanceof Error ? error.message : String(error)}`);
+	}
+}
+function isContinuousIntegration() {
+	const ci = process.env.CI;
+	return ci !== void 0 && ci !== "" && ci !== "false" && ci !== "0";
+}
+function checkCertificateFiles(settings, provisioningNote) {
+	const missingPaths = [settings.certPath, settings.keyPath].filter((path) => !existsSync(path));
+	if (missingPaths.length === 0) return true;
+	const warning = formatMissingCertificateWarning(settings, missingPaths, provisioningNote);
+	if (!emittedMissingCertificateWarnings.has(warning)) {
+		emittedMissingCertificateWarnings.add(warning);
+		process.emitWarning(warning, { type: "HydrogenLocalHttpsWarning" });
+	}
+	return false;
+}
+function formatMissingCertificateWarning({ certPath, host, keyPath }, missingPaths, provisioningNote) {
+	const certificateDirectories = [...new Set([dirname(certPath), dirname(keyPath)])];
+	const provisioningFailure = provisioningNote === void 0 ? [] : ["", provisioningNote];
+	return [
+		"Local HTTPS is disabled because certificate files are missing:",
+		...missingPaths.map((path) => `  ${path}`),
+		...provisioningFailure,
+		"",
+		"Expected certificate files:",
+		`  Certificate: ${certPath}`,
+		`  Private key: ${keyPath}`,
+		"",
+		"Run the automatic setup:",
+		"  npx hydrogen certs install",
+		"",
+		"Or install and configure mkcert, then generate the certificate:",
+		"  macOS: brew install mkcert",
+		"  mkcert -install",
+		`  mkdir -p ${certificateDirectories.map(shellQuote).join(" ")}`,
+		`  mkcert -cert-file ${shellQuote(certPath)} -key-file ${shellQuote(keyPath)} ${shellQuote(host)}`
+	].join("\n");
+}
+function readCertificateFiles(settings) {
+	return {
+		cert: readCertificateFile(settings, "certificate", settings.certPath),
+		key: readCertificateFile(settings, "private key", settings.keyPath)
+	};
+}
+function readCertificateFile(settings, label, path) {
+	try {
+		return readFileSync(path);
+	} catch (error) {
+		throw new Error(formatCertificateReadError(settings, label, path, error), { cause: error });
+	}
+}
+function formatCertificateReadError({ certPath, host, keyPath }, label, path, error) {
+	const certificateDirectories = [...new Set([dirname(certPath), dirname(keyPath)])];
+	const reason = error instanceof Error ? error.message : String(error);
+	return [
+		`Local HTTPS requires a readable ${label} file:`,
+		`  ${path}`,
+		`Reason: ${reason}`,
+		"",
+		"Expected certificate files:",
+		`  Certificate: ${certPath}`,
+		`  Private key: ${keyPath}`,
+		"",
+		"Install and configure mkcert, then generate the certificate:",
+		"  macOS: brew install mkcert",
+		"  mkcert -install",
+		`  mkdir -p ${certificateDirectories.map(shellQuote).join(" ")}`,
+		`  mkcert -cert-file ${shellQuote(certPath)} -key-file ${shellQuote(keyPath)} ${shellQuote(host)}`
+	].join("\n");
+}
+function shellQuote(value) {
+	return `'${value.replaceAll("'", `'\\''`)}'`;
+}
+function configureLocalHttpsServer(server, settings) {
+	const resolveBoundPort = () => {
+		const address = server.httpServer?.address();
+		return address && typeof address === "object" ? address.port : settings.port;
+	};
+	server.middlewares.use((request, response, next) => {
+		request.headers["x-forwarded-host"] ??= request.headers.host ?? `${settings.host}:${resolveBoundPort()}`;
+		request.headers["x-forwarded-proto"] ??= "https";
+		stripHttp1OnlyResponseHeaders(response);
+		next();
+	});
+	const logSettings = () => {
+		const port = resolveBoundPort();
+		const settingsKey = `${settings.host}:${port}`;
+		if (loggedCustomerAccountSettings.has(settingsKey)) return;
+		loggedCustomerAccountSettings.add(settingsKey);
+		server.config.logger.info(formatCustomerAccountSettings({
+			host: settings.host,
+			port
+		}));
+	};
+	if (server.httpServer) server.httpServer.once("listening", logSettings);
+	else logSettings();
+}
+function formatCustomerAccountSettings({ host, port }) {
+	const origin = `https://${host}`;
+	const portfulOrigin = `${origin}:${port}`;
+	return [
+		"",
+		"Customer Account API — make sure these values are configured for your storefront:",
+		"",
+		`  Callback URI(s) (required):  ${portfulOrigin}${CUSTOMER_ACCOUNT_PATHS.authorize}`,
+		`  JavaScript origin(s):        ${origin}`,
+		`  Logout URI:                  ${portfulOrigin}`,
+		""
+	].join("\n");
+}
+function stripHttp1OnlyResponseHeaders(response) {
+	const originalWriteHead = response.writeHead.bind(response);
+	response.writeHead = (statusCode, statusMessageOrHeaders, headers) => {
+		removeStoredHttp1OnlyHeaders(response);
+		if (typeof statusMessageOrHeaders === "string") return originalWriteHead(statusCode, statusMessageOrHeaders, sanitizeWriteHeadHeaders(headers));
+		return originalWriteHead(statusCode, sanitizeWriteHeadHeaders(statusMessageOrHeaders));
+	};
+}
+function removeStoredHttp1OnlyHeaders(response) {
+	for (const header of HTTP1_ONLY_RESPONSE_HEADERS) response.removeHeader(header);
+}
+function sanitizeWriteHeadHeaders(headers) {
+	if (Array.isArray(headers)) return sanitizeHeaderArray(headers);
+	if (headers) return sanitizeHeaderObject(headers);
+	return headers;
+}
+function sanitizeHeaderObject(headers) {
+	const sanitizedHeaders = {};
+	for (const [name, value] of Object.entries(headers)) if (!isHttp1OnlyHeader(name)) sanitizedHeaders[name] = value;
+	return sanitizedHeaders;
+}
+function sanitizeHeaderArray(headers) {
+	const sanitizedHeaders = [];
+	for (let index = 0; index < headers.length; index += HEADER_PAIR_SIZE) {
+		const name = headers[index];
+		const value = headers[index + 1];
+		if (typeof name === "string" && isHttp1OnlyHeader(name)) continue;
+		sanitizedHeaders.push(name);
+		if (value !== void 0) sanitizedHeaders.push(value);
+	}
+	return sanitizedHeaders;
+}
+function isHttp1OnlyHeader(name) {
+	return HTTP1_ONLY_RESPONSE_HEADERS.has(name.toLowerCase());
+}
+
+//#endregion
+export { LOCAL_HTTPS_DEFAULTS, localHttps, provisionLocalHttps };
+//# sourceMappingURL=local-https.mjs.map

package/dist/vite/local-https.mjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"local-https.mjs","names":[],"sources":["../../src/vite/local-https.ts"],"sourcesContent":["import { existsSync, readFileSync } from \"node:fs\";\nimport type { OutgoingHttpHeader, OutgoingHttpHeaders, ServerResponse } from \"node:http\";\nimport { homedir } from \"node:os\";\nimport { dirname, isAbsolute, join, resolve } from \"node:path\";\nimport { fileURLToPath } from \"node:url\";\n\nimport type { ConfigEnv, Plugin, ViteDevServer } from \"vite\";\n\nimport { CUSTOMER_ACCOUNT_PATHS } from \"../core/url\";\nimport { confirmCertificateInstallation } from \"./certificate-prompt\";\nimport { provisionCertificates } from \"./mkcert\";\n\nexport const LOCAL_HTTPS_DEFAULTS = {\n  host: \"local.tryhydrogen.dev\",\n  port: 5_173,\n} as const;\n\nconst HEADER_PAIR_SIZE = 2;\nconst HTTP1_ONLY_RESPONSE_HEADERS = new Set([\n  \"connection\",\n  \"keep-alive\",\n  \"proxy-authenticate\",\n  \"proxy-authorization\",\n  \"te\",\n  \"trailer\",\n  \"transfer-encoding\",\n  \"upgrade\",\n]);\nconst emittedMissingCertificateWarnings = new Set<string>();\nconst loggedCustomerAccountSettings = new Set<string>();\n\n/** Options for Hydrogen's local HTTPS Vite plugin. */\nexport type LocalHttpsOptions = {\n  /** Enable trusted local HTTPS for the dev server. */\n  enabled: boolean;\n  /** Local hostname registered in Shopify admin. Defaults to `local.tryhydrogen.dev`. */\n  host?: string;\n  /** Local port registered in Shopify admin. Defaults to `5173`. */\n  port?: number;\n  /** Certificate file path. Defaults to Hydrogen's mkcert path under `~/.shopify/hydrogen/certs`. */\n  certPath?: string | URL;\n  /** Private key file path. Defaults to Hydrogen's mkcert path under `~/.shopify/hydrogen/certs`. */\n  keyPath?: string | URL;\n};\n\nexport type LocalHttpsPlugin = Plugin & {\n  api: {\n    /** Returns host, port, and TLS file paths for frameworks that terminate HTTPS outside Vite. */\n    getDevServerConfig(): LocalHttpsDevServerConfig | undefined;\n  };\n};\n\nexport type LocalHttpsDevServerConfig = {\n  host: string;\n  port: number;\n  https: {\n    cert: string;\n    key: string;\n  };\n};\n\n/**\n * Configures Vite for trusted local HTTPS on Hydrogen's default development host.\n */\nexport function localHttps(options: LocalHttpsOptions): LocalHttpsPlugin {\n  const settings = options.enabled ? resolveLocalHttpsSettings(options) : undefined;\n  let certificateFiles: LocalHttpsCertificateFiles | undefined;\n\n  const getCertificateFiles = () => {\n    if (!settings) return;\n\n    certificateFiles ??= readCertificateFiles(settings);\n    return certificateFiles;\n  };\n\n  const getDevServerConfig = () => {\n    if (!settings || !checkCertificateFiles(settings)) return;\n\n    getCertificateFiles();\n\n    return {\n      host: settings.host,\n      port: settings.port,\n      https: {\n        cert: settings.certPath,\n        key: settings.keyPath,\n      },\n    };\n  };\n\n  return {\n    name: \"hydrogen-local-https\",\n    api: { getDevServerConfig },\n    async config(_config: unknown, env: ConfigEnv) {\n      if (settings && env.command === \"serve\" && !env.isPreview) {\n        const certificatesAvailable = await ensureCertificateFiles(settings);\n        if (!certificatesAvailable) return;\n      } else if (settings && !checkCertificateFiles(settings)) {\n        return;\n      }\n\n      const certificates = getCertificateFiles();\n      if (!settings || !certificates) return;\n\n      return {\n        server: {\n          allowedHosts: [settings.host],\n          host: settings.host,\n          port: settings.port,\n          strictPort: true,\n          https: {\n            // Several framework dev servers fail when Vite negotiates HTTP/2.\n            ALPNProtocols: [\"http/1.1\"],\n            cert: certificates.cert,\n            key: certificates.key,\n          },\n          hmr: {\n            host: settings.host,\n            protocol: \"wss\",\n          },\n        },\n      };\n    },\n    configureServer(server) {\n      if (!settings || !checkCertificateFiles(settings)) return;\n\n      getCertificateFiles();\n      configureLocalHttpsServer(server, settings);\n    },\n  };\n}\n\nexport type ProvisionLocalHttpsOptions = Omit<LocalHttpsOptions, \"enabled\" | \"port\">;\n\n/**\n * Downloads a pinned, checksum-verified mkcert release and generates the\n * trusted local certificate files when they do not exist yet. The Vite plugin\n * runs this automatically on `vite dev`; call it directly for frameworks that\n * read certificate paths before Vite starts or from setup scripts.\n */\nexport async function provisionLocalHttps(options: ProvisionLocalHttpsOptions = {}) {\n  const settings = resolveLocalHttpsSettings({ enabled: true, ...options });\n\n  if (!certificateFilesExist(settings)) {\n    await provisionCertificates(settings);\n  }\n\n  return {\n    host: settings.host,\n    certPath: settings.certPath,\n    keyPath: settings.keyPath,\n  };\n}\n\ntype LocalHttpsSettings = {\n  host: string;\n  port: number;\n  certPath: string;\n  keyPath: string;\n};\n\ntype LocalHttpsCertificateFiles = {\n  cert: Buffer;\n  key: Buffer;\n};\n\nfunction resolveLocalHttpsSettings(options: LocalHttpsOptions): LocalHttpsSettings {\n  const host = options.host ?? LOCAL_HTTPS_DEFAULTS.host;\n  const certificateDirectory = join(homedir(), \".shopify\", \"hydrogen\", \"certs\");\n\n  return {\n    host,\n    port: options.port ?? LOCAL_HTTPS_DEFAULTS.port,\n    certPath: resolveCertificatePath(options.certPath ?? join(certificateDirectory, `${host}.pem`)),\n    keyPath: resolveCertificatePath(\n      options.keyPath ?? join(certificateDirectory, `${host}-key.pem`),\n    ),\n  };\n}\n\nfunction resolveCertificatePath(path: string | URL) {\n  if (path instanceof URL) return fileURLToPath(path);\n  if (path === \"~\") return homedir();\n  if (path.startsWith(\"~/\")) return resolve(homedir(), path.slice(2));\n  return isAbsolute(path) ? path : resolve(path);\n}\n\nfunction certificateFilesExist(settings: LocalHttpsSettings) {\n  return existsSync(settings.certPath) && existsSync(settings.keyPath);\n}\n\nasync function ensureCertificateFiles(settings: LocalHttpsSettings): Promise<boolean> {\n  if (certificateFilesExist(settings)) return true;\n\n  // Installing the mkcert certificate authority needs an interactive trust\n  // prompt on first run, which hangs or fails on CI runners.\n  if (isContinuousIntegration()) {\n    return checkCertificateFiles(\n      settings,\n      \"Automatic certificate provisioning is skipped in CI environments (the CI environment variable is set).\",\n    );\n  }\n\n  if (!(await confirmCertificateInstallation(settings.host))) {\n    return checkCertificateFiles(\n      settings,\n      \"Automatic certificate provisioning requires confirmation in an interactive terminal.\",\n    );\n  }\n\n  try {\n    await provisionCertificates(settings);\n    return true;\n  } catch (error) {\n    return checkCertificateFiles(\n      settings,\n      `Automatic certificate provisioning failed:\\n  ${error instanceof Error ? error.message : String(error)}`,\n    );\n  }\n}\n\nfunction isContinuousIntegration() {\n  const ci = process.env.CI;\n  return ci !== undefined && ci !== \"\" && ci !== \"false\" && ci !== \"0\";\n}\n\nfunction checkCertificateFiles(settings: LocalHttpsSettings, provisioningNote?: string) {\n  const missingPaths = [settings.certPath, settings.keyPath].filter((path) => !existsSync(path));\n  if (missingPaths.length === 0) return true;\n\n  const warning = formatMissingCertificateWarning(settings, missingPaths, provisioningNote);\n  if (!emittedMissingCertificateWarnings.has(warning)) {\n    emittedMissingCertificateWarnings.add(warning);\n    process.emitWarning(warning, { type: \"HydrogenLocalHttpsWarning\" });\n  }\n  return false;\n}\n\nfunction formatMissingCertificateWarning(\n  { certPath, host, keyPath }: LocalHttpsSettings,\n  missingPaths: string[],\n  provisioningNote?: string,\n) {\n  const certificateDirectories = [...new Set([dirname(certPath), dirname(keyPath)])];\n  const provisioningFailure = provisioningNote === undefined ? [] : [\"\", provisioningNote];\n\n  return [\n    \"Local HTTPS is disabled because certificate files are missing:\",\n    ...missingPaths.map((path) => `  ${path}`),\n    ...provisioningFailure,\n    \"\",\n    \"Expected certificate files:\",\n    `  Certificate: ${certPath}`,\n    `  Private key: ${keyPath}`,\n    \"\",\n    \"Run the automatic setup:\",\n    \"  npx hydrogen certs install\",\n    \"\",\n    \"Or install and configure mkcert, then generate the certificate:\",\n    \"  macOS: brew install mkcert\",\n    \"  mkcert -install\",\n    `  mkdir -p ${certificateDirectories.map(shellQuote).join(\" \")}`,\n    `  mkcert -cert-file ${shellQuote(certPath)} -key-file ${shellQuote(keyPath)} ${shellQuote(host)}`,\n  ].join(\"\\n\");\n}\n\nfunction readCertificateFiles(settings: LocalHttpsSettings): LocalHttpsCertificateFiles {\n  return {\n    cert: readCertificateFile(settings, \"certificate\", settings.certPath),\n    key: readCertificateFile(settings, \"private key\", settings.keyPath),\n  };\n}\n\nfunction readCertificateFile(settings: LocalHttpsSettings, label: string, path: string) {\n  try {\n    return readFileSync(path);\n  } catch (error) {\n    throw new Error(formatCertificateReadError(settings, label, path, error), { cause: error });\n  }\n}\n\nfunction formatCertificateReadError(\n  { certPath, host, keyPath }: LocalHttpsSettings,\n  label: string,\n  path: string,\n  error: unknown,\n) {\n  const certificateDirectories = [...new Set([dirname(certPath), dirname(keyPath)])];\n  const reason = error instanceof Error ? error.message : String(error);\n\n  return [\n    `Local HTTPS requires a readable ${label} file:`,\n    `  ${path}`,\n    `Reason: ${reason}`,\n    \"\",\n    \"Expected certificate files:\",\n    `  Certificate: ${certPath}`,\n    `  Private key: ${keyPath}`,\n    \"\",\n    \"Install and configure mkcert, then generate the certificate:\",\n    \"  macOS: brew install mkcert\",\n    \"  mkcert -install\",\n    `  mkdir -p ${certificateDirectories.map(shellQuote).join(\" \")}`,\n    `  mkcert -cert-file ${shellQuote(certPath)} -key-file ${shellQuote(keyPath)} ${shellQuote(host)}`,\n  ].join(\"\\n\");\n}\n\nfunction shellQuote(value: string) {\n  return `'${value.replaceAll(\"'\", `'\\\\''`)}'`;\n}\n\nfunction configureLocalHttpsServer(server: ViteDevServer, settings: LocalHttpsSettings) {\n  // The configured port is only a fallback: frameworks that own the listener\n  // (or auto-incremented ports) can bind somewhere else, and the Customer\n  // Account URLs registered in admin must match the port actually served.\n  const resolveBoundPort = () => {\n    const address = server.httpServer?.address();\n    return address && typeof address === \"object\" ? address.port : settings.port;\n  };\n\n  server.middlewares.use((request, response, next) => {\n    request.headers[\"x-forwarded-host\"] ??=\n      request.headers.host ?? `${settings.host}:${resolveBoundPort()}`;\n    request.headers[\"x-forwarded-proto\"] ??= \"https\";\n    stripHttp1OnlyResponseHeaders(response);\n    next();\n  });\n\n  const logSettings = () => {\n    const port = resolveBoundPort();\n    const settingsKey = `${settings.host}:${port}`;\n    if (loggedCustomerAccountSettings.has(settingsKey)) return;\n    loggedCustomerAccountSettings.add(settingsKey);\n    server.config.logger.info(formatCustomerAccountSettings({ host: settings.host, port }));\n  };\n\n  if (server.httpServer) {\n    server.httpServer.once(\"listening\", logSettings);\n  } else {\n    logSettings();\n  }\n}\n\nfunction formatCustomerAccountSettings({ host, port }: Pick<LocalHttpsSettings, \"host\" | \"port\">) {\n  const origin = `https://${host}`;\n  const portfulOrigin = `${origin}:${port}`;\n\n  return [\n    \"\",\n    \"Customer Account API — make sure these values are configured for your storefront:\",\n    \"\",\n    `  Callback URI(s) (required):  ${portfulOrigin}${CUSTOMER_ACCOUNT_PATHS.authorize}`,\n    // Shopify's server-side validation rejects JavaScript origins containing a port.\n    `  JavaScript origin(s):        ${origin}`,\n    `  Logout URI:                  ${portfulOrigin}`,\n    \"\",\n  ].join(\"\\n\");\n}\n\nfunction stripHttp1OnlyResponseHeaders(response: ServerResponse) {\n  const originalWriteHead = response.writeHead.bind(response);\n\n  response.writeHead = (\n    statusCode: number,\n    statusMessageOrHeaders?: string | OutgoingHttpHeaders | OutgoingHttpHeader[],\n    headers?: OutgoingHttpHeaders | OutgoingHttpHeader[],\n  ) => {\n    removeStoredHttp1OnlyHeaders(response);\n\n    if (typeof statusMessageOrHeaders === \"string\") {\n      return originalWriteHead(\n        statusCode,\n        statusMessageOrHeaders,\n        sanitizeWriteHeadHeaders(headers),\n      );\n    }\n\n    return originalWriteHead(statusCode, sanitizeWriteHeadHeaders(statusMessageOrHeaders));\n  };\n}\n\nfunction removeStoredHttp1OnlyHeaders(response: ServerResponse) {\n  for (const header of HTTP1_ONLY_RESPONSE_HEADERS) {\n    response.removeHeader(header);\n  }\n}\n\nfunction sanitizeWriteHeadHeaders(headers: OutgoingHttpHeaders | OutgoingHttpHeader[] | undefined) {\n  if (Array.isArray(headers)) return sanitizeHeaderArray(headers);\n  if (headers) return sanitizeHeaderObject(headers);\n  return headers;\n}\n\nfunction sanitizeHeaderObject(headers: OutgoingHttpHeaders) {\n  const sanitizedHeaders: OutgoingHttpHeaders = {};\n\n  for (const [name, value] of Object.entries(headers)) {\n    if (!isHttp1OnlyHeader(name)) sanitizedHeaders[name] = value;\n  }\n\n  return sanitizedHeaders;\n}\n\nfunction sanitizeHeaderArray(headers: OutgoingHttpHeader[]) {\n  const sanitizedHeaders: OutgoingHttpHeader[] = [];\n\n  for (let index = 0; index < headers.length; index += HEADER_PAIR_SIZE) {\n    const name = headers[index];\n    const value = headers[index + 1];\n    if (typeof name === \"string\" && isHttp1OnlyHeader(name)) continue;\n\n    sanitizedHeaders.push(name);\n    if (value !== undefined) sanitizedHeaders.push(value);\n  }\n\n  return sanitizedHeaders;\n}\n\nfunction isHttp1OnlyHeader(name: string) {\n  return HTTP1_ONLY_RESPONSE_HEADERS.has(name.toLowerCase());\n}\n"],"mappings":";;;;;;;;;AAYA,MAAa,uBAAuB;CAClC,MAAM;CACN,MAAM;CACP;AAED,MAAM,mBAAmB;AACzB,MAAM,8BAA8B,IAAI,IAAI;CAC1C;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACD,CAAC;AACF,MAAM,oDAAoC,IAAI,KAAa;AAC3D,MAAM,gDAAgC,IAAI,KAAa;;;;AAmCvD,SAAgB,WAAW,SAA8C;CACvE,MAAM,WAAW,QAAQ,UAAU,0BAA0B,QAAQ,GAAG;CACxE,IAAI;CAEJ,MAAM,4BAA4B;AAChC,MAAI,CAAC,SAAU;AAEf,uBAAqB,qBAAqB,SAAS;AACnD,SAAO;;CAGT,MAAM,2BAA2B;AAC/B,MAAI,CAAC,YAAY,CAAC,sBAAsB,SAAS,CAAE;AAEnD,uBAAqB;AAErB,SAAO;GACL,MAAM,SAAS;GACf,MAAM,SAAS;GACf,OAAO;IACL,MAAM,SAAS;IACf,KAAK,SAAS;IACf;GACF;;AAGH,QAAO;EACL,MAAM;EACN,KAAK,EAAE,oBAAoB;EAC3B,MAAM,OAAO,SAAkB,KAAgB;AAC7C,OAAI,YAAY,IAAI,YAAY,WAAW,CAAC,IAAI,WAE9C;QAAI,CAAC,MAD+B,uBAAuB,SAAS,CACxC;cACnB,YAAY,CAAC,sBAAsB,SAAS,CACrD;GAGF,MAAM,eAAe,qBAAqB;AAC1C,OAAI,CAAC,YAAY,CAAC,aAAc;AAEhC,UAAO,EACL,QAAQ;IACN,cAAc,CAAC,SAAS,KAAK;IAC7B,MAAM,SAAS;IACf,MAAM,SAAS;IACf,YAAY;IACZ,OAAO;KAEL,eAAe,CAAC,WAAW;KAC3B,MAAM,aAAa;KACnB,KAAK,aAAa;KACnB;IACD,KAAK;KACH,MAAM,SAAS;KACf,UAAU;KACX;IACF,EACF;;EAEH,gBAAgB,QAAQ;AACtB,OAAI,CAAC,YAAY,CAAC,sBAAsB,SAAS,CAAE;AAEnD,wBAAqB;AACrB,6BAA0B,QAAQ,SAAS;;EAE9C;;;;;;;;AAWH,eAAsB,oBAAoB,UAAsC,EAAE,EAAE;CAClF,MAAM,WAAW,0BAA0B;EAAE,SAAS;EAAM,GAAG;EAAS,CAAC;AAEzE,KAAI,CAAC,sBAAsB,SAAS,CAClC,OAAM,sBAAsB,SAAS;AAGvC,QAAO;EACL,MAAM,SAAS;EACf,UAAU,SAAS;EACnB,SAAS,SAAS;EACnB;;AAeH,SAAS,0BAA0B,SAAgD;CACjF,MAAM,OAAO,QAAQ,QAAQ,qBAAqB;CAClD,MAAM,uBAAuB,KAAK,SAAS,EAAE,YAAY,YAAY,QAAQ;AAE7E,QAAO;EACL;EACA,MAAM,QAAQ,QAAQ,qBAAqB;EAC3C,UAAU,uBAAuB,QAAQ,YAAY,KAAK,sBAAsB,GAAG,KAAK,MAAM,CAAC;EAC/F,SAAS,uBACP,QAAQ,WAAW,KAAK,sBAAsB,GAAG,KAAK,UAAU,CACjE;EACF;;AAGH,SAAS,uBAAuB,MAAoB;AAClD,KAAI,gBAAgB,IAAK,QAAO,cAAc,KAAK;AACnD,KAAI,SAAS,IAAK,QAAO,SAAS;AAClC,KAAI,KAAK,WAAW,KAAK,CAAE,QAAO,QAAQ,SAAS,EAAE,KAAK,MAAM,EAAE,CAAC;AACnE,QAAO,WAAW,KAAK,GAAG,OAAO,QAAQ,KAAK;;AAGhD,SAAS,sBAAsB,UAA8B;AAC3D,QAAO,WAAW,SAAS,SAAS,IAAI,WAAW,SAAS,QAAQ;;AAGtE,eAAe,uBAAuB,UAAgD;AACpF,KAAI,sBAAsB,SAAS,CAAE,QAAO;AAI5C,KAAI,yBAAyB,CAC3B,QAAO,sBACL,UACA,yGACD;AAGH,KAAI,CAAE,MAAM,+BAA+B,SAAS,KAAK,CACvD,QAAO,sBACL,UACA,uFACD;AAGH,KAAI;AACF,QAAM,sBAAsB,SAAS;AACrC,SAAO;UACA,OAAO;AACd,SAAO,sBACL,UACA,iDAAiD,iBAAiB,QAAQ,MAAM,UAAU,OAAO,MAAM,GACxG;;;AAIL,SAAS,0BAA0B;CACjC,MAAM,KAAK,QAAQ,IAAI;AACvB,QAAO,OAAO,UAAa,OAAO,MAAM,OAAO,WAAW,OAAO;;AAGnE,SAAS,sBAAsB,UAA8B,kBAA2B;CACtF,MAAM,eAAe,CAAC,SAAS,UAAU,SAAS,QAAQ,CAAC,QAAQ,SAAS,CAAC,WAAW,KAAK,CAAC;AAC9F,KAAI,aAAa,WAAW,EAAG,QAAO;CAEtC,MAAM,UAAU,gCAAgC,UAAU,cAAc,iBAAiB;AACzF,KAAI,CAAC,kCAAkC,IAAI,QAAQ,EAAE;AACnD,oCAAkC,IAAI,QAAQ;AAC9C,UAAQ,YAAY,SAAS,EAAE,MAAM,6BAA6B,CAAC;;AAErE,QAAO;;AAGT,SAAS,gCACP,EAAE,UAAU,MAAM,WAClB,cACA,kBACA;CACA,MAAM,yBAAyB,CAAC,GAAG,IAAI,IAAI,CAAC,QAAQ,SAAS,EAAE,QAAQ,QAAQ,CAAC,CAAC,CAAC;CAClF,MAAM,sBAAsB,qBAAqB,SAAY,EAAE,GAAG,CAAC,IAAI,iBAAiB;AAExF,QAAO;EACL;EACA,GAAG,aAAa,KAAK,SAAS,KAAK,OAAO;EAC1C,GAAG;EACH;EACA;EACA,kBAAkB;EAClB,kBAAkB;EAClB;EACA;EACA;EACA;EACA;EACA;EACA;EACA,cAAc,uBAAuB,IAAI,WAAW,CAAC,KAAK,IAAI;EAC9D,uBAAuB,WAAW,SAAS,CAAC,aAAa,WAAW,QAAQ,CAAC,GAAG,WAAW,KAAK;EACjG,CAAC,KAAK,KAAK;;AAGd,SAAS,qBAAqB,UAA0D;AACtF,QAAO;EACL,MAAM,oBAAoB,UAAU,eAAe,SAAS,SAAS;EACrE,KAAK,oBAAoB,UAAU,eAAe,SAAS,QAAQ;EACpE;;AAGH,SAAS,oBAAoB,UAA8B,OAAe,MAAc;AACtF,KAAI;AACF,SAAO,aAAa,KAAK;UAClB,OAAO;AACd,QAAM,IAAI,MAAM,2BAA2B,UAAU,OAAO,MAAM,MAAM,EAAE,EAAE,OAAO,OAAO,CAAC;;;AAI/F,SAAS,2BACP,EAAE,UAAU,MAAM,WAClB,OACA,MACA,OACA;CACA,MAAM,yBAAyB,CAAC,GAAG,IAAI,IAAI,CAAC,QAAQ,SAAS,EAAE,QAAQ,QAAQ,CAAC,CAAC,CAAC;CAClF,MAAM,SAAS,iBAAiB,QAAQ,MAAM,UAAU,OAAO,MAAM;AAErE,QAAO;EACL,mCAAmC,MAAM;EACzC,KAAK;EACL,WAAW;EACX;EACA;EACA,kBAAkB;EAClB,kBAAkB;EAClB;EACA;EACA;EACA;EACA,cAAc,uBAAuB,IAAI,WAAW,CAAC,KAAK,IAAI;EAC9D,uBAAuB,WAAW,SAAS,CAAC,aAAa,WAAW,QAAQ,CAAC,GAAG,WAAW,KAAK;EACjG,CAAC,KAAK,KAAK;;AAGd,SAAS,WAAW,OAAe;AACjC,QAAO,IAAI,MAAM,WAAW,KAAK,QAAQ,CAAC;;AAG5C,SAAS,0BAA0B,QAAuB,UAA8B;CAItF,MAAM,yBAAyB;EAC7B,MAAM,UAAU,OAAO,YAAY,SAAS;AAC5C,SAAO,WAAW,OAAO,YAAY,WAAW,QAAQ,OAAO,SAAS;;AAG1E,QAAO,YAAY,KAAK,SAAS,UAAU,SAAS;AAClD,UAAQ,QAAQ,wBACd,QAAQ,QAAQ,QAAQ,GAAG,SAAS,KAAK,GAAG,kBAAkB;AAChE,UAAQ,QAAQ,yBAAyB;AACzC,gCAA8B,SAAS;AACvC,QAAM;GACN;CAEF,MAAM,oBAAoB;EACxB,MAAM,OAAO,kBAAkB;EAC/B,MAAM,cAAc,GAAG,SAAS,KAAK,GAAG;AACxC,MAAI,8BAA8B,IAAI,YAAY,CAAE;AACpD,gCAA8B,IAAI,YAAY;AAC9C,SAAO,OAAO,OAAO,KAAK,8BAA8B;GAAE,MAAM,SAAS;GAAM;GAAM,CAAC,CAAC;;AAGzF,KAAI,OAAO,WACT,QAAO,WAAW,KAAK,aAAa,YAAY;KAEhD,cAAa;;AAIjB,SAAS,8BAA8B,EAAE,MAAM,QAAmD;CAChG,MAAM,SAAS,WAAW;CAC1B,MAAM,gBAAgB,GAAG,OAAO,GAAG;AAEnC,QAAO;EACL;EACA;EACA;EACA,kCAAkC,gBAAgB,uBAAuB;EAEzE,kCAAkC;EAClC,kCAAkC;EAClC;EACD,CAAC,KAAK,KAAK;;AAGd,SAAS,8BAA8B,UAA0B;CAC/D,MAAM,oBAAoB,SAAS,UAAU,KAAK,SAAS;AAE3D,UAAS,aACP,YACA,wBACA,YACG;AACH,+BAA6B,SAAS;AAEtC,MAAI,OAAO,2BAA2B,SACpC,QAAO,kBACL,YACA,wBACA,yBAAyB,QAAQ,CAClC;AAGH,SAAO,kBAAkB,YAAY,yBAAyB,uBAAuB,CAAC;;;AAI1F,SAAS,6BAA6B,UAA0B;AAC9D,MAAK,MAAM,UAAU,4BACnB,UAAS,aAAa,OAAO;;AAIjC,SAAS,yBAAyB,SAAiE;AACjG,KAAI,MAAM,QAAQ,QAAQ,CAAE,QAAO,oBAAoB,QAAQ;AAC/D,KAAI,QAAS,QAAO,qBAAqB,QAAQ;AACjD,QAAO;;AAGT,SAAS,qBAAqB,SAA8B;CAC1D,MAAM,mBAAwC,EAAE;AAEhD,MAAK,MAAM,CAAC,MAAM,UAAU,OAAO,QAAQ,QAAQ,CACjD,KAAI,CAAC,kBAAkB,KAAK,CAAE,kBAAiB,QAAQ;AAGzD,QAAO;;AAGT,SAAS,oBAAoB,SAA+B;CAC1D,MAAM,mBAAyC,EAAE;AAEjD,MAAK,IAAI,QAAQ,GAAG,QAAQ,QAAQ,QAAQ,SAAS,kBAAkB;EACrE,MAAM,OAAO,QAAQ;EACrB,MAAM,QAAQ,QAAQ,QAAQ;AAC9B,MAAI,OAAO,SAAS,YAAY,kBAAkB,KAAK,CAAE;AAEzD,mBAAiB,KAAK,KAAK;AAC3B,MAAI,UAAU,OAAW,kBAAiB,KAAK,MAAM;;AAGvD,QAAO;;AAGT,SAAS,kBAAkB,MAAc;AACvC,QAAO,4BAA4B,IAAI,KAAK,aAAa,CAAC"}

package/dist/vite/mkcert.mjs

@@ -0,0 +1,141 @@
+import { consoleLogger, getLogger } from "../core/logging/logging.mjs";
+import { existsSync } from "node:fs";
+import { homedir } from "node:os";
+import { dirname, join } from "node:path";
+import { spawn } from "node:child_process";
+import { createHash } from "node:crypto";
+import { chmod, mkdir, readFile, rename, rm, writeFile } from "node:fs/promises";
+
+//#region src/vite/mkcert.ts
+const log = getLogger("local-https");
+function confirm(message) {
+	consoleLogger.info(`☑️ ${message}`);
+}
+const MKCERT_VERSION = "v1.4.4";
+const MKCERT_RELEASE_BASE_URL = `https://github.com/FiloSottile/mkcert/releases/download/${MKCERT_VERSION}`;
+const EXECUTABLE_MODE = 493;
+const SUCCESS_EXIT_CODE = 0;
+const DOWNLOAD_TIMEOUT_MS = 6e4;
+const MKCERT_BINARIES = {
+	"darwin-arm64": {
+		assetName: `mkcert-${MKCERT_VERSION}-darwin-arm64`,
+		sha256: "c8af0df44bce04359794dad8ea28d750437411d632748049d08644ffb66a60c6"
+	},
+	"darwin-x64": {
+		assetName: `mkcert-${MKCERT_VERSION}-darwin-amd64`,
+		sha256: "a32dfab51f1845d51e810db8e47dcf0e6b51ae3422426514bf5a2b8302e97d4e"
+	},
+	"linux-arm64": {
+		assetName: `mkcert-${MKCERT_VERSION}-linux-arm64`,
+		sha256: "b98f2cc69fd9147fe4d405d859c57504571adec0d3611c3eefd04107c7ac00d0"
+	},
+	"linux-x64": {
+		assetName: `mkcert-${MKCERT_VERSION}-linux-amd64`,
+		sha256: "6d31c65b03972c6dc4a14ab429f2928300518b26503f58723e532d1b0a3bbb52"
+	},
+	"win32-arm64": {
+		assetName: `mkcert-${MKCERT_VERSION}-windows-arm64.exe`,
+		sha256: "793747256c562622d40127c8080df26add2fb44c50906ce9db63b42a5280582e"
+	},
+	"win32-x64": {
+		assetName: `mkcert-${MKCERT_VERSION}-windows-amd64.exe`,
+		sha256: "d2660b50a9ed59eada480750561c96abc2ed4c9a38c6a24d93e30e0977631398"
+	}
+};
+/** @internal Exported for tests. */
+function resolveMkcertBinary(platform, arch) {
+	const binary = MKCERT_BINARIES[`${platform}-${arch}`];
+	if (!binary) return void 0;
+	return {
+		...binary,
+		url: `${MKCERT_RELEASE_BASE_URL}/${binary.assetName}`
+	};
+}
+function sha256Hex(bytes) {
+	return createHash("sha256").update(bytes).digest("hex");
+}
+/** @internal Exported for tests. */
+async function downloadVerified(options) {
+	let bytes;
+	try {
+		const response = await fetch(options.url, { signal: AbortSignal.timeout(DOWNLOAD_TIMEOUT_MS) });
+		if (!response.ok) throw new Error(`mkcert download failed with status ${response.status}: ${options.url}`);
+		bytes = new Uint8Array(await response.arrayBuffer());
+	} catch (error) {
+		if (error instanceof Error && error.name === "TimeoutError") throw new Error(`mkcert download timed out after ${DOWNLOAD_TIMEOUT_MS / 1e3}s: ${options.url}`, { cause: error });
+		throw error;
+	}
+	const digest = sha256Hex(bytes);
+	if (digest !== options.sha256) throw new Error(`mkcert download did not match the pinned SHA-256 checksum; refusing to run it.\n  URL:      ${options.url}\n  Expected: ${options.sha256}\n  Received: ${digest}`);
+	await mkdir(dirname(options.destination), { recursive: true });
+	const temporaryPath = `${options.destination}.tmp-${process.pid}`;
+	try {
+		await writeFile(temporaryPath, bytes, { mode: EXECUTABLE_MODE });
+		await chmod(temporaryPath, EXECUTABLE_MODE);
+		await rename(temporaryPath, options.destination);
+	} catch (error) {
+		await rm(temporaryPath, { force: true });
+		throw error;
+	}
+}
+async function ensureMkcertBinary() {
+	const binary = resolveMkcertBinary(process.platform, process.arch);
+	if (!binary) throw new Error(`Automatic mkcert download is not available for ${process.platform}-${process.arch}. Install mkcert manually and generate the certificate.`);
+	const binaryPath = join(homedir(), ".shopify", "hydrogen", "mkcert", binary.assetName);
+	if (existsSync(binaryPath) && sha256Hex(await readFile(binaryPath)) === binary.sha256) return binaryPath;
+	log.info(`downloading mkcert ${MKCERT_VERSION}…`);
+	await downloadVerified({
+		url: binary.url,
+		sha256: binary.sha256,
+		destination: binaryPath
+	});
+	confirm(`mkcert ${MKCERT_VERSION} downloaded`);
+	return binaryPath;
+}
+function runMkcert(binaryPath, args) {
+	return new Promise((resolve, reject) => {
+		const child = spawn(binaryPath, args, { stdio: [
+			"inherit",
+			"pipe",
+			"pipe"
+		] });
+		let output = "";
+		const collect = (chunk) => {
+			output += chunk.toString();
+		};
+		child.stdout?.on("data", collect);
+		child.stderr?.on("data", collect);
+		child.on("error", reject);
+		child.on("close", (code, signal) => {
+			if (code === SUCCESS_EXIT_CODE) {
+				resolve(output);
+				return;
+			}
+			const reason = signal ? `mkcert was killed by ${signal}` : `mkcert exited with code ${code}`;
+			reject(new Error(output.trim() === "" ? reason : `${reason}\n${output.trim()}`));
+		});
+	});
+}
+async function provisionCertificates(settings) {
+	const binaryPath = await ensureMkcertBinary();
+	await mkdir(dirname(settings.certPath), { recursive: true });
+	await mkdir(dirname(settings.keyPath), { recursive: true });
+	log.info("generating a trusted local certificate; mkcert may prompt for your password.");
+	confirm((await runMkcert(binaryPath, [
+		"-install",
+		"-cert-file",
+		settings.certPath,
+		"-key-file",
+		settings.keyPath,
+		settings.host
+	])).includes("The local CA is already installed") ? "The local CA is already installed in the system trust store" : "The local CA is now installed in the system trust store");
+	confirm(`Created a new certificate for "${settings.host}"`);
+	log.info("verifying certificates…");
+	const missingPaths = [settings.certPath, settings.keyPath].filter((path) => !existsSync(path));
+	if (missingPaths.length > 0) throw new Error(`mkcert did not create the expected files: ${missingPaths.join(", ")}`);
+	confirm("local https certificates ready");
+}
+
+//#endregion
+export { provisionCertificates };
+//# sourceMappingURL=mkcert.mjs.map

package/dist/vite/mkcert.mjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"mkcert.mjs","names":[],"sources":["../../src/vite/mkcert.ts"],"sourcesContent":["import { spawn } from \"node:child_process\";\nimport { createHash } from \"node:crypto\";\nimport { existsSync } from \"node:fs\";\nimport { chmod, mkdir, readFile, rename, rm, writeFile } from \"node:fs/promises\";\nimport { homedir } from \"node:os\";\nimport { dirname, join } from \"node:path\";\n\nimport { consoleLogger, getLogger } from \"../core/logging\";\n\nconst log = getLogger(\"local-https\");\n\n// Step confirmations print unprefixed on purpose: they are terminal output for\n// an interactive provisioning flow, not subsystem log entries.\nfunction confirm(message: string) {\n  consoleLogger.info(`☑️ ${message}`);\n}\n\n// mkcert is pinned to an exact release and verified against SHA-256 checksums\n// so that a compromised or replaced \"latest\" release can never execute.\n// Checksums are sourced from the Hermit (cashapp/hermit-packages, mkcert.hcl)\n// and Scoop (ScoopInstaller/Extras, bucket/mkcert.json) package registries.\nconst MKCERT_VERSION = \"v1.4.4\";\nconst MKCERT_RELEASE_BASE_URL = `https://github.com/FiloSottile/mkcert/releases/download/${MKCERT_VERSION}`;\nconst EXECUTABLE_MODE = 0o755;\nconst SUCCESS_EXIT_CODE = 0;\nconst DOWNLOAD_TIMEOUT_MS = 60_000;\n\nconst MKCERT_BINARIES: Record<string, { assetName: string; sha256: string }> = {\n  \"darwin-arm64\": {\n    assetName: `mkcert-${MKCERT_VERSION}-darwin-arm64`,\n    sha256: \"c8af0df44bce04359794dad8ea28d750437411d632748049d08644ffb66a60c6\",\n  },\n  \"darwin-x64\": {\n    assetName: `mkcert-${MKCERT_VERSION}-darwin-amd64`,\n    sha256: \"a32dfab51f1845d51e810db8e47dcf0e6b51ae3422426514bf5a2b8302e97d4e\",\n  },\n  \"linux-arm64\": {\n    assetName: `mkcert-${MKCERT_VERSION}-linux-arm64`,\n    sha256: \"b98f2cc69fd9147fe4d405d859c57504571adec0d3611c3eefd04107c7ac00d0\",\n  },\n  \"linux-x64\": {\n    assetName: `mkcert-${MKCERT_VERSION}-linux-amd64`,\n    sha256: \"6d31c65b03972c6dc4a14ab429f2928300518b26503f58723e532d1b0a3bbb52\",\n  },\n  \"win32-arm64\": {\n    assetName: `mkcert-${MKCERT_VERSION}-windows-arm64.exe`,\n    sha256: \"793747256c562622d40127c8080df26add2fb44c50906ce9db63b42a5280582e\",\n  },\n  \"win32-x64\": {\n    assetName: `mkcert-${MKCERT_VERSION}-windows-amd64.exe`,\n    sha256: \"d2660b50a9ed59eada480750561c96abc2ed4c9a38c6a24d93e30e0977631398\",\n  },\n};\n\nexport type MkcertBinary = {\n  assetName: string;\n  sha256: string;\n  url: string;\n};\n\n/** @internal Exported for tests. */\nexport function resolveMkcertBinary(platform: string, arch: string): MkcertBinary | undefined {\n  const binary = MKCERT_BINARIES[`${platform}-${arch}`];\n  if (!binary) return undefined;\n\n  return { ...binary, url: `${MKCERT_RELEASE_BASE_URL}/${binary.assetName}` };\n}\n\nfunction sha256Hex(bytes: Uint8Array): string {\n  return createHash(\"sha256\").update(bytes).digest(\"hex\");\n}\n\n/** @internal Exported for tests. */\nexport async function downloadVerified(options: {\n  url: string;\n  sha256: string;\n  destination: string;\n}): Promise<void> {\n  let bytes: Uint8Array;\n  try {\n    const response = await fetch(options.url, {\n      signal: AbortSignal.timeout(DOWNLOAD_TIMEOUT_MS),\n    });\n    if (!response.ok) {\n      throw new Error(`mkcert download failed with status ${response.status}: ${options.url}`);\n    }\n\n    bytes = new Uint8Array(await response.arrayBuffer());\n  } catch (error) {\n    if (error instanceof Error && error.name === \"TimeoutError\") {\n      throw new Error(\n        `mkcert download timed out after ${DOWNLOAD_TIMEOUT_MS / 1_000}s: ${options.url}`,\n        { cause: error },\n      );\n    }\n    throw error;\n  }\n  const digest = sha256Hex(bytes);\n  if (digest !== options.sha256) {\n    throw new Error(\n      `mkcert download did not match the pinned SHA-256 checksum; refusing to run it.\\n` +\n        `  URL:      ${options.url}\\n` +\n        `  Expected: ${options.sha256}\\n` +\n        `  Received: ${digest}`,\n    );\n  }\n\n  await mkdir(dirname(options.destination), { recursive: true });\n\n  // Write-then-rename keeps concurrent dev servers from ever spawning a\n  // partially written binary: rename is atomic on the same filesystem.\n  const temporaryPath = `${options.destination}.tmp-${process.pid}`;\n  try {\n    await writeFile(temporaryPath, bytes, { mode: EXECUTABLE_MODE });\n    await chmod(temporaryPath, EXECUTABLE_MODE);\n    await rename(temporaryPath, options.destination);\n  } catch (error) {\n    await rm(temporaryPath, { force: true });\n    throw error;\n  }\n}\n\nasync function ensureMkcertBinary(): Promise<string> {\n  const binary = resolveMkcertBinary(process.platform, process.arch);\n  if (!binary) {\n    throw new Error(\n      `Automatic mkcert download is not available for ${process.platform}-${process.arch}. ` +\n        \"Install mkcert manually and generate the certificate.\",\n    );\n  }\n\n  const binaryPath = join(homedir(), \".shopify\", \"hydrogen\", \"mkcert\", binary.assetName);\n  if (existsSync(binaryPath) && sha256Hex(await readFile(binaryPath)) === binary.sha256) {\n    return binaryPath;\n  }\n\n  log.info(`downloading mkcert ${MKCERT_VERSION}…`);\n  await downloadVerified({ url: binary.url, sha256: binary.sha256, destination: binaryPath });\n  confirm(`mkcert ${MKCERT_VERSION} downloaded`);\n\n  return binaryPath;\n}\n\nfunction runMkcert(binaryPath: string, args: string[]): Promise<string> {\n  return new Promise((resolve, reject) => {\n    // stdin stays inherited so sudo can prompt on the terminal (sudo talks to\n    // the tty directly, not to the piped streams). mkcert's verbose output is\n    // captured instead of shown, and surfaced only when the command fails.\n    const child = spawn(binaryPath, args, { stdio: [\"inherit\", \"pipe\", \"pipe\"] });\n\n    let output = \"\";\n    const collect = (chunk: Buffer) => {\n      output += chunk.toString();\n    };\n    child.stdout?.on(\"data\", collect);\n    child.stderr?.on(\"data\", collect);\n\n    child.on(\"error\", reject);\n    child.on(\"close\", (code, signal) => {\n      if (code === SUCCESS_EXIT_CODE) {\n        resolve(output);\n        return;\n      }\n\n      const reason = signal ? `mkcert was killed by ${signal}` : `mkcert exited with code ${code}`;\n      reject(new Error(output.trim() === \"\" ? reason : `${reason}\\n${output.trim()}`));\n    });\n  });\n}\n\nexport type ProvisionSettings = {\n  host: string;\n  certPath: string;\n  keyPath: string;\n};\n\nexport async function provisionCertificates(settings: ProvisionSettings): Promise<void> {\n  const binaryPath = await ensureMkcertBinary();\n\n  await mkdir(dirname(settings.certPath), { recursive: true });\n  await mkdir(dirname(settings.keyPath), { recursive: true });\n\n  log.info(\"generating a trusted local certificate; mkcert may prompt for your password.\");\n  const mkcertOutput = await runMkcert(binaryPath, [\n    \"-install\",\n    \"-cert-file\",\n    settings.certPath,\n    \"-key-file\",\n    settings.keyPath,\n    settings.host,\n  ]);\n  confirm(\n    mkcertOutput.includes(\"The local CA is already installed\")\n      ? \"The local CA is already installed in the system trust store\"\n      : \"The local CA is now installed in the system trust store\",\n  );\n  confirm(`Created a new certificate for \"${settings.host}\"`);\n\n  log.info(\"verifying certificates…\");\n  const missingPaths = [settings.certPath, settings.keyPath].filter((path) => !existsSync(path));\n  if (missingPaths.length > 0) {\n    throw new Error(`mkcert did not create the expected files: ${missingPaths.join(\", \")}`);\n  }\n  confirm(\"local https certificates ready\");\n}\n\nexport async function uninstallCertificateAuthority(): Promise<void> {\n  const binaryPath = await ensureMkcertBinary();\n\n  log.info(\"removing the local certificate authority; mkcert may prompt for your password.\");\n  await runMkcert(binaryPath, [\"-uninstall\"]);\n  confirm(\"The local CA was removed from the system trust stores\");\n}\n"],"mappings":";;;;;;;;;AASA,MAAM,MAAM,UAAU,cAAc;AAIpC,SAAS,QAAQ,SAAiB;AAChC,eAAc,KAAK,MAAM,UAAU;;AAOrC,MAAM,iBAAiB;AACvB,MAAM,0BAA0B,2DAA2D;AAC3F,MAAM,kBAAkB;AACxB,MAAM,oBAAoB;AAC1B,MAAM,sBAAsB;AAE5B,MAAM,kBAAyE;CAC7E,gBAAgB;EACd,WAAW,UAAU,eAAe;EACpC,QAAQ;EACT;CACD,cAAc;EACZ,WAAW,UAAU,eAAe;EACpC,QAAQ;EACT;CACD,eAAe;EACb,WAAW,UAAU,eAAe;EACpC,QAAQ;EACT;CACD,aAAa;EACX,WAAW,UAAU,eAAe;EACpC,QAAQ;EACT;CACD,eAAe;EACb,WAAW,UAAU,eAAe;EACpC,QAAQ;EACT;CACD,aAAa;EACX,WAAW,UAAU,eAAe;EACpC,QAAQ;EACT;CACF;;AASD,SAAgB,oBAAoB,UAAkB,MAAwC;CAC5F,MAAM,SAAS,gBAAgB,GAAG,SAAS,GAAG;AAC9C,KAAI,CAAC,OAAQ,QAAO;AAEpB,QAAO;EAAE,GAAG;EAAQ,KAAK,GAAG,wBAAwB,GAAG,OAAO;EAAa;;AAG7E,SAAS,UAAU,OAA2B;AAC5C,QAAO,WAAW,SAAS,CAAC,OAAO,MAAM,CAAC,OAAO,MAAM;;;AAIzD,eAAsB,iBAAiB,SAIrB;CAChB,IAAI;AACJ,KAAI;EACF,MAAM,WAAW,MAAM,MAAM,QAAQ,KAAK,EACxC,QAAQ,YAAY,QAAQ,oBAAoB,EACjD,CAAC;AACF,MAAI,CAAC,SAAS,GACZ,OAAM,IAAI,MAAM,sCAAsC,SAAS,OAAO,IAAI,QAAQ,MAAM;AAG1F,UAAQ,IAAI,WAAW,MAAM,SAAS,aAAa,CAAC;UAC7C,OAAO;AACd,MAAI,iBAAiB,SAAS,MAAM,SAAS,eAC3C,OAAM,IAAI,MACR,mCAAmC,sBAAsB,IAAM,KAAK,QAAQ,OAC5E,EAAE,OAAO,OAAO,CACjB;AAEH,QAAM;;CAER,MAAM,SAAS,UAAU,MAAM;AAC/B,KAAI,WAAW,QAAQ,OACrB,OAAM,IAAI,MACR,+FACiB,QAAQ,IAAI,gBACZ,QAAQ,OAAO,gBACf,SAClB;AAGH,OAAM,MAAM,QAAQ,QAAQ,YAAY,EAAE,EAAE,WAAW,MAAM,CAAC;CAI9D,MAAM,gBAAgB,GAAG,QAAQ,YAAY,OAAO,QAAQ;AAC5D,KAAI;AACF,QAAM,UAAU,eAAe,OAAO,EAAE,MAAM,iBAAiB,CAAC;AAChE,QAAM,MAAM,eAAe,gBAAgB;AAC3C,QAAM,OAAO,eAAe,QAAQ,YAAY;UACzC,OAAO;AACd,QAAM,GAAG,eAAe,EAAE,OAAO,MAAM,CAAC;AACxC,QAAM;;;AAIV,eAAe,qBAAsC;CACnD,MAAM,SAAS,oBAAoB,QAAQ,UAAU,QAAQ,KAAK;AAClE,KAAI,CAAC,OACH,OAAM,IAAI,MACR,kDAAkD,QAAQ,SAAS,GAAG,QAAQ,KAAK,yDAEpF;CAGH,MAAM,aAAa,KAAK,SAAS,EAAE,YAAY,YAAY,UAAU,OAAO,UAAU;AACtF,KAAI,WAAW,WAAW,IAAI,UAAU,MAAM,SAAS,WAAW,CAAC,KAAK,OAAO,OAC7E,QAAO;AAGT,KAAI,KAAK,sBAAsB,eAAe,GAAG;AACjD,OAAM,iBAAiB;EAAE,KAAK,OAAO;EAAK,QAAQ,OAAO;EAAQ,aAAa;EAAY,CAAC;AAC3F,SAAQ,UAAU,eAAe,aAAa;AAE9C,QAAO;;AAGT,SAAS,UAAU,YAAoB,MAAiC;AACtE,QAAO,IAAI,SAAS,SAAS,WAAW;EAItC,MAAM,QAAQ,MAAM,YAAY,MAAM,EAAE,OAAO;GAAC;GAAW;GAAQ;GAAO,EAAE,CAAC;EAE7E,IAAI,SAAS;EACb,MAAM,WAAW,UAAkB;AACjC,aAAU,MAAM,UAAU;;AAE5B,QAAM,QAAQ,GAAG,QAAQ,QAAQ;AACjC,QAAM,QAAQ,GAAG,QAAQ,QAAQ;AAEjC,QAAM,GAAG,SAAS,OAAO;AACzB,QAAM,GAAG,UAAU,MAAM,WAAW;AAClC,OAAI,SAAS,mBAAmB;AAC9B,YAAQ,OAAO;AACf;;GAGF,MAAM,SAAS,SAAS,wBAAwB,WAAW,2BAA2B;AACtF,UAAO,IAAI,MAAM,OAAO,MAAM,KAAK,KAAK,SAAS,GAAG,OAAO,IAAI,OAAO,MAAM,GAAG,CAAC;IAChF;GACF;;AASJ,eAAsB,sBAAsB,UAA4C;CACtF,MAAM,aAAa,MAAM,oBAAoB;AAE7C,OAAM,MAAM,QAAQ,SAAS,SAAS,EAAE,EAAE,WAAW,MAAM,CAAC;AAC5D,OAAM,MAAM,QAAQ,SAAS,QAAQ,EAAE,EAAE,WAAW,MAAM,CAAC;AAE3D,KAAI,KAAK,+EAA+E;AASxF,UACE,MATyB,UAAU,YAAY;EAC/C;EACA;EACA,SAAS;EACT;EACA,SAAS;EACT,SAAS;EACV,CAAC,EAEa,SAAS,oCAAoC,GACtD,gEACA,0DACL;AACD,SAAQ,kCAAkC,SAAS,KAAK,GAAG;AAE3D,KAAI,KAAK,0BAA0B;CACnC,MAAM,eAAe,CAAC,SAAS,UAAU,SAAS,QAAQ,CAAC,QAAQ,SAAS,CAAC,WAAW,KAAK,CAAC;AAC9F,KAAI,aAAa,SAAS,EACxB,OAAM,IAAI,MAAM,6CAA6C,aAAa,KAAK,KAAK,GAAG;AAEzF,SAAQ,iCAAiC"}

package/dist/vue/cart.d.mts

@@ -0,0 +1,46 @@
+import { CartData, CartState } from "../core/cart/state.mjs";
+import { CartStore, CreateCartStoreOptions } from "../core/cart/cart.mjs";
+import { CartFormRegister } from "../core/cart/form.mjs";
+import { CartDataFromHandlers } from "../core/cart/server-handlers.mjs";
+import { ComputedRef, PropType, ShallowRef } from "vue";
+
+//#region src/vue/cart.d.ts
+type TypedUseCart<TData extends CartData> = {
+  (): Readonly<ShallowRef<CartState<TData>>>;
+  <S>(selector: (state: CartState<TData>) => S, isEqual?: (a: S, b: S) => boolean): Readonly<ShallowRef<S>>;
+};
+type TypedUseOptionalCart<TData extends CartData> = <S>(selector: (state: CartState<TData>) => S, isEqual?: (a: S, b: S) => boolean) => Readonly<ShallowRef<S | undefined>>;
+type CartInitialData<TData extends CartData = CartData> = CreateCartStoreOptions<TData>["initialData"];
+type TypedCartProvider<TData extends CartData> = {
+  new (): {
+    $props: {
+      initialData?: CartInitialData<TData>;
+    };
+  };
+};
+/** Actions for reconciling cart state after updates outside Standard Actions. */
+type CartActions = Pick<CartStore, "refresh">;
+type TypedCartComponents<TData extends CartData> = {
+  CartProvider: TypedCartProvider<TData>;
+  useCart: TypedUseCart<TData>;
+  useOptionalCart: TypedUseOptionalCart<TData>;
+  useCartActions: typeof useCartActions;
+  useCartForm: typeof useCartForm;
+};
+declare function useCartActions(): CartActions;
+declare function useCartAnalytics(): void;
+declare function useCartForm(): {
+  formProps: (opts?: {
+    beforeSubmit?: (e: Event) => void;
+    afterSubmit?: (e: Event) => void;
+  }) => Record<string, unknown>;
+  register: CartFormRegister;
+  isPending: {
+    initial: ComputedRef<boolean>;
+    lines: (lineId?: string) => boolean;
+  };
+};
+declare function createCartComponents<THandlers>(): TypedCartComponents<CartDataFromHandlers<THandlers>>;
+//#endregion
+export { CartActions, createCartComponents, useCartActions, useCartAnalytics };
+//# sourceMappingURL=cart.d.mts.map