App Bridge Changelog

August 7, 2026 — 166e1f5d

Fri, 07 Aug 2026 08:21:59 GMT

Bootstrap now captures an admin_theme parameter, persists it to sessionStorage, and exposes it globally. - Bootstrap reads a new admin_theme URL parameter and stores it in sessionStorage under the key app-bridge-admin-theme. - When the admin_theme parameter is absent from the URL, App Bridge now falls back to a previously cached sessionStorage value. - The captured value is exposed as globalThis.__shopifyAdminTheme so other code in the page can read the active admin theme. - The admin_theme parameter was added to the list of query parameters App Bridge preserves when rewriting URLs. - Remaining changes across modules like fetch, pos, toast, and tools are internal identifier renames with no behavior changes.

August 5, 2026 — f90ae585

Wed, 05 Aug 2026 08:53:06 GMT

App nav (v0.38.7) now validates anchor hrefs and warns on unsupported links instead of silently breaking. - App nav parsing (used by s-app-nav and ui-nav-menu) now validates each anchor href and only accepts relative app paths, app: URLs, or same-origin http(s) URLs. - Anchors with unsupported hrefs are dropped from the nav and logged once via console.warn with a link to the app-nav docs, instead of silently producing a broken URL. - app: protocol URLs are now converted to a proper same-origin URL string before being sent in the Menu update payload. - The internal-only modal show() method and the intents module's configure/invoke helpers were renamed internally with no behavioral change. - Bumped the internal app-bridge utilities version from 0.38.6 to 0.38.7.

July 30, 2026 — 740e2544

Thu, 30 Jul 2026 08:52:07 GMT

This build only renames internal minified variables and registry comments, with no functional or API changes. - No modules were added or removed in this build. - The intents, internal-only, pos, and title-bar modules changed only in internal variable names, with identical logic and behavior preserved. - The s-app-nav, s-app-window, ui-modal, and ui-nav-menu modules only had their internal registry-reference comments updated. - The _utilities.js and _web-vitals.js infrastructure files were reshuffled with new minified variable names but no new logic. - No new API methods, bug fixes, or user-facing behavior changes were introduced in this release.

July 16, 2026 — d5bb40f6

Thu, 16 Jul 2026 08:43:50 GMT

Reworks save-bar dirty-state tracking, wires it into tools.register, and adds a version field to protocol messages. - The save-bar dirty-state utility in _utilities.js was rewritten with a new valuemodified event and a shared capture/settle registry for more reliable change detection. - tools.register() now captures save-bar state before invoking a registered handler and settles it afterward via double requestAnimationFrame, keeping the save bar accurate when a tool action modifies form state. - Bootstrap now attaches a version field to the client config, and web-vitals includes the same version field in its WebVitals protocol messages. - resource-picker.js simplified how it builds the error thrown for an invalid type option, without changing the message text.

July 10, 2026 — 6d27951e

Fri, 10 Jul 2026 09:02:03 GMT

Fixes case-sensitive link target handling and URL path normalization, and makes the shopifyQL API always available with lazy resolution. - The shopifyQL module now always exposes api.shopifyQL as a lazy proxy with an available() check, instead of only setting it after confirming backend support. - Link and window.open target attributes like _blank or _self are now normalized case-insensitively, fixing save-bar interception for links with mixed-case target values. - Fixed URL path normalization in parseUrl to collapse multiple leading slashes instead of just prepending one.

July 8, 2026 — 6d9a048d

Wed, 08 Jul 2026 08:49:32 GMT

Minor bootstrap update adds safe-area padding to Polaris modal dialogs on devices with bottom insets. - The injected safe-area stylesheet in _bootstrap.js now adds a rule targeting .Polaris-Modal-Dialog__Modal. - Modal dialogs get bottom padding equal to the shopify-safe-area-inset-bottom variable so content is not obscured by device insets like home indicators. - No modules were added or removed, and no public API methods changed in this build.

July 3, 2026 — ccda5568

Fri, 03 Jul 2026 09:00:15 GMT

Telemetry now reports element attributes and Polaris version; cleanup listener switched from beforeunload to pagehide. - The telemetry module now includes the custom element's attribute names in its ui-component telemetry payload. - Telemetry increment calls now attach the Polaris design system version when globalThis.polaris.version is available. - The internal utilities module now cleans up navigation listeners on the pagehide event instead of beforeunload.

June 17, 2026 — cd7d0f3d

Wed, 17 Jun 2026 09:31:45 GMT

MobileBridgeNext safe area insets now inject styles via Constructable Stylesheets instead of a style element. - MobileBridgeNext now injects safe area inset styles using the Constructable Stylesheets API and document.adoptedStyleSheets instead of appending a style element to document.head. - Safe area inset style injection now includes feature detection and exits gracefully if CSSStyleSheet or adoptedStyleSheets APIs are unavailable. - The function for intercepting native browser APIs was renamed from restoreProperty to interceptProperty, affecting the fetch, print, share, window.open, and history modules.

June 5, 2026 — c3591477

Fri, 05 Jun 2026 09:03:20 GMT

Navigation handler sets navigationVersion 2 on the shopify global and adds a history.pushState fallback for unresolved link navigations. - The navigation system now sets Symbol.for('navigationVersion') to 2 on the global shopify object at initialization, advertising the active navigation protocol version. - When home-link click simulation cannot process a URL, a new fallback uses history.pushState and dispatches a popstate event to complete the navigation instead of calling the App Bridge navigate API. - When navigating via a home link, the target URL is now derived from the home link element's href attribute rather than the original destination URL.

May 30, 2026 — ef8b61d3

Sat, 30 May 2026 08:46:14 GMT

The title-bar module adds groupType support to secondary action button groups. - The title-bar module now accepts a groupType property on secondary action button groups. - groupType is destructured from button group objects alongside label, icon, disabled, and buttons fields. - When groupType is provided on a button group, it is forwarded to the title bar protocol.

May 29, 2026 — 6bb9c034

Fri, 29 May 2026 09:04:07 GMT

Navigation utilities updated to support s-app-nav elements and fix home link detection via getAttribute fallback. - The qt selector function now includes s-app-nav as a navigation container, matching ui-nav-menu support for click interception. - App Bridge will now intercept and handle client-side navigation for clickable elements inside s-app-nav components. - Home link detection in the navigation handler now uses getAttribute('rel') as a fallback when the rel property is nullish, fixing routing for custom elements.

May 27, 2026 — fd311eae

Wed, 27 May 2026 09:03:22 GMT

Added idToken timeout and error hardening, sidekick conversation stream events, and title bar button pressed state. - The id-token module now enforces a 60-second timeout when requesting session tokens from the host, rejecting with a clear error if the host does not respond in time. - The id-token module now validates that retrieved tokens are non-empty strings, throwing an idToken unavailable error for missing or invalid tokens. - The fetch module now handles idToken failures gracefully, logging an error and skipping the Authorization header instead of propagating the exception. - The sidekick module now forwards shopify:sidekick:active-conversation-stream-event events to the global window, enabling apps to listen for active conversation stream updates. - Title bar buttons now support a pressed property, allowing buttons to reflect a toggled or active visual state.

May 14, 2026 — af2eb2f3

Thu, 14 May 2026 08:53:17 GMT

The fetch interceptor removes extensionOriginFetch support, simplifying all intercepted requests to use native fetch. - The fetch module removes the extensionOriginFetch code path, which previously allowed extension-origin requests to be routed through a custom fetch implementation from internalApiPromise. - Helper utilities for serializing Request objects to plain objects and reconstructing Responses from ArrayBuffers were removed from the utilities module alongside extensionOriginFetch. - The session token retry logic in the fetch interceptor is simplified, with both the initial request and the auth-header retry now always using native self.fetch directly.

May 7, 2026 — 5fe14787

Thu, 07 May 2026 08:51:17 GMT

Intents module gains a reactive request signal and response now only exists when an intent is active. - The intents module now exposes api.intents.request as a reactive signal that tracks the current active intent value. - The api.intents.response property is now a getter returning undefined when no intent is active, instead of always being defined. - Intent request state is kept synchronized with the internal API via subscription and unsubscribed automatically on page unload. - The intents module now accepts a signalFactory parameter, enabling reactive SignalLike signals for intent state management. - The intents register method now uses a properly scoped AbortController local to each registration call.

April 30, 2026 — b3f8e93d

Thu, 30 Apr 2026 08:43:10 GMT

Internal refactoring of private field utilities with a minor defensive hasOwnProperty improvement. - The private field access guard in _utilities.js was updated to use {}.hasOwnProperty.call instead of Object.prototype.hasOwnProperty.call, making it more resilient to prototype pollution. - Internal private field helpers were renamed and reorganized in _utilities.js: the counter variable and key-creation and field-check functions swapped names. - _bootstrap.js was updated to call the renamed private field helpers privateKeyCounter and checkPrivateField consistently.

April 22, 2026 — e35faefd

Wed, 22 Apr 2026 08:31:20 GMT

Several modules broadened protocol support from Shopify-only to all protocols, with minor error tracking improvements. - toast.show and toast.hide switched from SHOPIFY_PROTOCOLS to ALL_PROTOCOLS, enabling them to work across all protocol environments. - sidekick.registerToolHandler and sidekick.registerContextCallback switched from SHOPIFY_PROTOCOLS to ALL_PROTOCOLS. - tools.register, tools.unregister, and tools.clear switched from SHOPIFY_PROTOCOLS to ALL_PROTOCOLS. - The print module's window.print interceptor switched from SHOPIFY_PROTOCOLS to ALL_PROTOCOLS. - RemoteUI MissingResolverError now includes a groupingHash property set to RemoteUI::MissingResolverError for improved error grouping.

April 11, 2026 — 07f68577

Sat, 11 Apr 2026 08:10:06 GMT

Added mobile safe area inset support via a CSS custom property when the MobileBridgeNext flag is enabled. - Bootstrap now injects a --shopify-safe-area-inset-bottom CSS custom property initialized to 0px when the MobileBridgeNext feature flag is active. - The safe area inset bottom value is automatically subscribed to from the host and kept in sync as a CSS variable on the root element. - A body::after pseudo-element is added to reserve physical space at the bottom of the page equal to the safe area inset height.

March 26, 2026 — d934d47f

Thu, 26 Mar 2026 08:14:27 GMT

The fetch module gained extensionOriginFetch support, and several modules narrowed their protocol scope to Shopify-only contexts. - The fetch module now supports an extensionOriginFetch handler that routes requests through a custom fetch implementation when available, affecting both initial and retry-on-session requests. - The toast module's show and hide methods now only activate in Shopify protocol contexts, replacing the previous all-protocols behavior. - The tools module's register, unregister, and clear methods now scope exclusively to Shopify protocols. - The print and sidekick modules also switched from all-protocols to Shopify-only protocol scope. - The internal-only module's internalModal show and hide calls were simplified to use optional chaining, removing intermediate variable bindings.

March 24, 2026 — cdc43ba6

Tue, 24 Mar 2026 11:21:11 GMT

This build introduces first-class support for app intents — apps can now read structured intent data from the URL, respond to intents with ok/error/closed outcomes, and detect intent context via `environment.intent`. Two new modules (`analytics` and `tools`) were added, and the title bar gains support for `` elements. - Two new modules registered: `analytics.js` and `tools.js` - `intents` module: new `api.data.intent` property that parses and exposes structured intent payload (`type`, `action`, `data`) from the URL's `intent` query parameter - `intents` module: new `api.intents.response` object with `ok()`, `error()`, and `closed()` methods for sending a response back to the intent caller (only exposed when an intent is present) - `environment` module: added `intent` boolean property indicating whether the app was launched with an intent - `title-bar` module: button-group serialization now recognises `` elements (in addition to ``) and emits `groupType: 'inline'` vs `'menu'` accordingly - Internal bootstrap config object gains a `data: {}` field used to share intent state across modules - New internal `at()` utility lazily detects presence of the `intent` URL parameter (result is cached after first call)

March 7, 2026 — 55c89da0

Sat, 07 Mar 2026 22:21:45 GMT

Initial baseline capture of Shopify's App Bridge CDN bundle. This is the first tracked build — all 38 modules and 4 infrastructure files have been deminified and catalogued. - Captured 34 feature modules including navigation, fetch, save-bar, toast, resource-picker, and POS - Identified 4 infrastructure files: bootstrap, utilities, remote-ui (RPC), and web-vitals - Bundle size: 88.5 KB minified, expanding to ~167 KB deminified across 38 files - Detected embedded libraries: web-vitals v3 and @remote-ui/rpc