Configure and prepare Universal Checkout sample sessions

[tiagocandido]

What changes are you making?

Create independent Storefront carts from the selected products, check for a shared currency and prepare a Universal Checkout session whose continuation URL can be opened by the next sample layer. Invalidate prepared state when shops, quantities, country or environment change, and ignore stale asynchronous responses.

Configure initial domains through the repository-root .env/.env.local: CHECKOUT_KIT_UC_SHOP_DOMAINS falls back to STOREFRONT_DOMAIN, and an explicit empty value starts with no shops. Domains remain editable. .env.local overrides .env, with shell values as fallback. A guarded local runtime route exposes only initial domains and the optional development continuation host; environment values are never compiled into browser assets.

Keep session creation endpoints on the local server. Production destinations are restricted to HTTPS on shop.app; local development requires an explicit endpoint and continuation-host trust pair. The adapter validates loopback/same-origin requests, catalog/cart destinations, response sizes, currency and keyed continuation URLs. Tokens and keyed URLs are not logged or persisted.

How to test

From the repository root, with dependencies installed:

pnpm --dir platforms/web lint
pnpm --dir platforms/web test
pnpm --dir platforms/web build
pnpm --dir platforms/web verify
pnpm --dir platforms/web sample:build

The full stack passes 440 Web tests plus lint/typechecks, package verification and sample build. Focused tests cover file precedence, empty configuration, runtime field allowlisting, origin checks, destination validation, partial failures, aborts and stale results. A synthetic build scan verifies that configured domains, continuation hosts and unrelated Vite secrets do not appear in generated browser assets.

Set synthetic or approved shop domains in an ignored root .env.local, restart Vite and verify automatic shop selection; edit shops through the UI, select products, prepare a session and confirm editing a cart disables the prepared URL.

tophat results

On the public-base revision, the browser loaded two shops from ignored environment configuration, loaded both catalogs, created separate carts and prepared a continuation URL. The overlay opened and its close event appeared in the DOM. Removing a shop invalidated the prepared URL; reload restored configured shops with empty carts. This configuration retest did not receive live start/update events in the in-app browser; the earlier live event evidence remains separate.

An earlier integrated browser run loaded two catalogs, selected products independently, created Storefront carts and prepared a continuation URL that opened an authenticated checkout. No payment was submitted. Environment-loading regressions added here are covered by the focused configuration and middleware tests.

[github-actions]

Web — Coverage Report

Lines	Statements	Branches	Functions
	87.96% (753/856)	82.72% (479/579)	92.18% (177/192)

[github-actions]

Package Size

Platform	Artifact	Base	Head	Delta
Web	npm tarball	126.3 KiB	126.3 KiB	-1 B

Web file breakdown

File	Base	Head	Delta
dist/telemetry-BhYuVVw_.js.map	215.7 KiB	215.7 KiB	0 B
dist/custom-elements.json	90.8 KiB	90.8 KiB	0 B
dist/universal.js.map	63.9 KiB	63.9 KiB	0 B
dist/index.d.ts	47.7 KiB	47.7 KiB	0 B
dist/universal.d.ts	44.7 KiB	44.7 KiB	0 B
dist/index.js.map	34.8 KiB	34.8 KiB	0 B
dist/telemetry-BhYuVVw_.js	34.4 KiB	34.4 KiB	0 B
README.md	20.1 KiB	20.1 KiB	0 B
dist/universal.js	18.9 KiB	18.9 KiB	0 B
dist/index.js	8.3 KiB	8.3 KiB	0 B
package.json	3.1 KiB	3.1 KiB	0 B
LICENSE	1.1 KiB	1.1 KiB	0 B

Measured from the PR base SHA and PR head SHA. The file breakdown shows uncompressed sizes within each package artifact, so individual files do not sum to the compressed artifact total. This comment reports package artifact sizes only; it is not a final app binary-size report.