[Ji-One1]

Selected Shopify Standard Events can explain an add attempt or rejection without treating an event's cart data as the current cart. This PR defines the read-only event script and its evidence format.

What this changes

• Listen in the capture phase on document for an explicit selection from the supported-event list. Record document and element events once, including non-bubbling element events; ignore events dispatched directly on window. An empty selection records nothing.
• Re-arm document listeners without duplicates, including after document.open() and same-origin popup document replacement in a reused JavaScript realm. Observe event.promise without dispatching events or changing storefront state.
• Use focused Zod schemas and safeParse for event headers and retained phase fields. Parse input, settled, failed, and unsettled records; reject malformed messages and messages longer than 65,536 JavaScript string code units.
• Save payload fields only for shopify:cart:lines-update input action, context, and line IDs, merchandise IDs, and quantities; its settled cart userErrors; and shopify:cart:error input code and error. Other supported events keep headers and phase metadata only. Failed promises retain error name/message; unsettled records retain their reason. Standard Event evidence saves no cart IDs or other cart fields.
• Truncate retained strings and arrays rather than rejecting them only for length. Provide an unsettled record for an awaited event whose outcome was not received.
• Add Chrome regression tests for document/element capture, direct-window exclusion, duplicate prevention, document.open(), and same-realm popup replacement.

Developer impact

Internal tooling only; no published Hydrogen exports change and no changeset is needed. Browser installation over CDP is separate from this script and parser.

Out of scope

No Hydrogen analytics capture, automatic capture of every event, cart reader, or verdict logic.

Risk

Truncated fields and omitted payloads can remove diagnostic detail. Saved line IDs, error messages, and other retained values remain private owner data; bounds and field selection are not secret redaction. Events on a reused document can be missed before its listeners are re-armed.

Stack: 04/15. Previous: #4310. Next: #4313.

[github-actions]

We detected some changes in packages/*/package.json or packages/*/src, and there are no updates in the .changeset.
If the changes are user-facing and should cause a version bump, run pnpm run changeset add to track your changes and include them in the next release CHANGELOG.
If you are making simple updates to examples or documentation, you do not need to add a changeset.