feat: incoming mesage origin validation for web

[michaeljsXu]

What changes are you making?

Validate incoming checkout messages against the checkout URL origin, shop.app, and optional exact or wildcard origins configured through allowed-origins / allowedOrigins.

Rejected messages are surfaced through onMessageRejected. Origin parsing normalizes default ports and works in browsers without URL.canParse.

How to test

From platforms/web:

pnpm lint
pnpm test

[michaeljsXu]

• docs: incoming message origin validation across platforms #478
• feat: incoming message origin validation for react native #477
• feat: incoming message origin validation for ios #476
• feat: incoming message origin validation for android #475
• feat: incoming mesage origin validation for web #474 👈 (View in Graphite)
• main

This stack of pull requests is managed by Graphite. Learn more about stacking.

[github-actions]

Web — Coverage Report

Lines	Statements	Branches	Functions
	94.62% (299/316)	81.72% (152/186)	98.71% (77/78)

[github-actions]

Package Size

Platform	Artifact	Base	Head	Delta
Web	npm tarball	65.5 KiB	70.1 KiB	+4.6 KiB

Web file breakdown

File	Base	Head	Delta
dist/index.js.map	184.1 KiB	192.0 KiB	+7.8 KiB
dist/index.d.ts	41.9 KiB	44.7 KiB	+2.8 KiB
dist/custom-elements.json	40.1 KiB	43.7 KiB	+3.6 KiB
dist/index.js	29.6 KiB	31.5 KiB	+1.9 KiB
README.md	17.8 KiB	17.8 KiB	0 B
package.json	2.8 KiB	2.8 KiB	0 B
LICENSE	1.1 KiB	1.1 KiB	0 B

Measured from the PR base SHA and PR head SHA. The file breakdown shows uncompressed sizes within each package artifact, so individual files do not sum to the compressed artifact total. This comment reports package artifact sizes only; it is not a final app binary-size report.