Add CDN loading with separate npm and CDN builds

[kiftio]

What changes are you making?

Add on-demand CDN loading to Checkout Kit Web, using the component structure and npm subpath introduced in #940. One package and version produce separate outputs: build:npm writes dist/, and build:cdn writes dist-cdn/. Packing builds only npm output; CDN assets stay out of the npm package.

<script type="module">
  import {loadComponents} from 'https://cdn.shopify.com/checkout-kit/v4/web-components.js';
  await loadComponents(['shopify-checkout']);
</script>

The loader imports only requested components. The URL is evergreen within a Checkout Kit major version, independent of the underlying protocol version; components share that library version. Hashed implementation chunks are deployment details. The loader also exports version and supportedComponents, validates requests before importing, shares concurrent loads, and retries transient import failures.

The npm registration entry remains:

import '@shopify/checkout-kit/shopify-checkout';

Both distributions use the component's register.ts, which registers through ShopifyCheckout.register() and leaves an existing <shopify-checkout> in place, so loading npm and CDN together does not throw. The npm root registers nothing (#940); the distribution tests cover the npm component entry and the npm root alongside the CDN loader, in both orders. No separate cdn-components/ source directory is needed.

Publishing: the release workflow builds and verifies both outputs, checks deploy permissions before npm publication, and uploads hashed CDN chunks before the loader. Stable non-prerelease releases published to npm latest update the major URL; other releases use the maintainer-only v<major>/unstable/ channel. Re-running the original release can redeploy or roll back its CDN assets. Deployment, caching, and rollback details are in platforms/web/CDN-PUBLISHING.md and platforms/web/RELEASING.md.

Known limitation: maintenance releases for older majors are not supported yet; this needs addressing before a new major ships.

Open question: the public filename remains web-components.js. This is a callable loader, unlike the Storefront side-effect bundle; the filename should be settled before first publication.

How to test

shadowenv exec -- dev web check
shadowenv exec -- dev web snapshot compare
shadowenv exec -- actionlint .github/workflows/web-publish.yml

Validation passed in the public checkout: 355 unit tests, 16 Chromium tests, 11 built-package tests, lint/typechecks, publint, the sample build, the packed-file snapshot comparison, and actionlint. Built-package tests cover consumer bundling and TypeScript resolution, isolated stable/unstable CDN layouts, and both npm/CDN loading orders.

After merge, a dry run from main can exercise deploy permissions without publishing. The first real prerelease deployment uses the unstable channel; the stable URL becomes available with 4.0.0.

[github-actions]

Web — Coverage Report

Lines	Statements	Branches	Functions
	95.58% (476/498)	86.59% (252/291)	97.43% (114/117)

[github-actions]

Bundle Size Budgets

Budget	Size	Limits	Result
Web JavaScript (uncompressed)	35.58 KiB (0 B)	35 KiB soft / 50 KiB hard	➖ Above budget; no increase

Bundle and package size

Web bundle sizes cover shipped runtime JavaScript. Package sizes cover the full published archive, including any source maps, declarations, and documentation it contains.

Platform	Measurement	Compression	Base	Head	Delta
Web	JavaScript bundle	Uncompressed	35.6 KiB	35.6 KiB	0 B
Web	JavaScript bundle	gzip	11.1 KiB	11.1 KiB	0 B
Web	npm package (.tgz)	gzip	99.1 KiB	99.4 KiB	+296 B

Web package files (uncompressed)

These are uncompressed file sizes; they do not sum to the compressed package size above.

File	Base	Head	Delta
dist/chunks/shopify-checkout.js.map	264.3 KiB	264.3 KiB	0 B
dist/custom-elements.json	54.7 KiB	54.7 KiB	0 B
dist/index.d.ts	49.5 KiB	49.5 KiB	0 B
dist/chunks/shopify-checkout.js	35.2 KiB	35.2 KiB	0 B
README.md	24.5 KiB	25.1 KiB	+645 B
package.json	3.9 KiB	4.1 KiB	+204 B
LICENSE	1.1 KiB	1.1 KiB	0 B
dist/shopify-checkout.js.map	850 B	850 B	0 B
dist/index.js	255 B	255 B	0 B
dist/shopify-checkout.js	156 B	156 B	0 B
dist/shopify-checkout.d.ts	33 B	33 B	0 B

How sizes are measured

Measured from the PR base SHA and PR head SHA. Web bundle rows sum shipped .js, .mjs, and .cjs files under dist/, excluding source maps and declarations. The gzip bundle size sums files compressed individually with gzip -n -9. npm package sizes are gzip-compressed .tgz archives; Android AAR sizes are ZIP archives. Package sizes are not final app binary sizes.

[kiftio]

/accept-size web Adds a second distribution entrypoint (CDN loader web-components.js, 969 B) and an npm re-export shim (276 B); the shared component chunk grew 104 B for the registration guard and chunk
boundary. No consumer downloads both entrypoints: npm consumers see +380 B, CDN consumers had nothing before.

[bitrise]

Bitrise builds

E2E · iOS CI

Checkout Kit E2E results

No native E2E runs were selected for this change.

[github-actions]

Coverage Report

Status	Platform / target	Lines	Branches	Functions	Report
✅	Web	98%	86.6%	97.44%	Full report
⏭️	React Native	—	—	—	Not run for this change
⏭️	Embedded Checkout Protocol (TS)	—	—	—	Not run for this change