[Feature] Relative url patching on contract app extensions

[EliasJRH]

WHY are these changes introduced?

Part of https://github.com/shop/issues-automate/issues/3352
Merge only after https://meteorite.shopify.io/repos/shop/world/pulls/2009553/files has merged

WHAT is this pull request doing?

We recently extended deployConfig with the capabilities of using application config info (primarily the application url) when deploying app extensions with local contracts (see #7715). This PR primarily extends this to extensions with remote contracts (in this PR, the Flow trigger lifecycle callback extension time).

How to test your changes?

Tested on flow-with-local-apps rig from flow zone.

• Create Shopify app with "Flow trigger lifecycle callback" extension and "Flow trigger"
• In the extensions toml file, make the url a relative path (e.g /realtive-path) with corresponding route file in /app/routes
• With shopify app dev create and activate a Flow workflow using custom Flow trigger, observe that relative route file is hit in application logs
• Deploy application with shopify app deploy, create and activate a Flow workflow using custom Flow trigger, observe that application url receives callback request at relative path

CI
dev test packages/app/src/cli/models/extensions/specifications/validation/app_relative_urls.test.ts packages/app/src/cli/models/extensions/specification.integration.test.ts packages/app/src/cli/services/flow/utils.test.ts -> 34 tests pass

Post-release steps

Will update "Flow trigger lifecycle callback" extension docs to include info about relative url support. Will also publish developer changelog entry.

Checklist

• I've considered possible cross-platform impacts (Mac, Linux, Windows)
• I've considered possible documentation changes
• I've considered analytics changes to measure impact
• The change is user-facing — I've identified the correct [bump type](minor bump type, backwards-compatible new feature)

[Copilot]

Pull request overview

This PR extends relative-URL support beyond locally-specified extensions by introducing shared URL resolution logic and applying it to contract-based modules (notably flow_trigger_lifecycle_callback), so relative URL fields can be resolved against the dev tunnel in app dev and against application_url during deploy.

Changes:

• Introduces resolveAppRelativeUrl / patchAppRelativeUrls to centralize “app-relative URL” resolution and validation (HTTPS-only, blocks protocol-relative URLs and control characters).
• Applies the shared resolver to Flow action URL fields and to contract-based module config patching (dev + deploy).
• Adds/updates tests and a changeset documenting the new user-facing behavior.

Reviewed changes

Copilot reviewed 11 out of 11 changed files in this pull request and generated 2 comments.

Show a summary per file

File	Description
packages/app/src/cli/services/flow/validation.ts	Reuses shared control-character regex for Flow action URL validation.
packages/app/src/cli/services/flow/utils.ts	Removes Flow-action-specific URL resolution helper (now centralized elsewhere).
packages/app/src/cli/services/flow/utils.test.ts	Removes tests for deleted resolveFlowActionUrl.
packages/app/src/cli/services/flow/types.ts	Removes now-unused FlowActionUrlField type.
packages/app/src/cli/models/extensions/specifications/validation/app_relative_urls.ts	Adds shared resolver/patcher for app-relative URLs and contract-module field mapping.
packages/app/src/cli/models/extensions/specifications/validation/app_relative_urls.test.ts	Adds unit coverage for the shared resolver/patcher behavior and error cases.
packages/app/src/cli/models/extensions/specifications/flow_action.ts	Switches Flow action URL resolution to shared resolveAppRelativeUrl.
packages/app/src/cli/models/extensions/specification.ts	Hooks contract-based modules into app-relative URL patching in dev + deploy paths.
packages/app/src/cli/models/extensions/specification.integration.test.ts	Adds integration coverage for contract-based module relative URL behavior.
packages/app/src/cli/models/app/validation/common.ts	Adds shared URL_CONTROL_CHARACTERS and isHttpsUrl helpers.
.changeset/flow-trigger-lifecycle-callback-relative-url.md	Declares the user-facing feature as a minor bump.

---

💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.

[dmerand]

Having a secondary registry for a subset of extension types hidden inside of patchWithAppDevURLs is surprising.

Have we considered making app-relative URL support an explicit capability of a specification instead of adding patchWithAppDevURLs to all contract-based modules and then filtering by identifier?

For example, createContractBasedModuleSpecification could accept appRelativeUrlFields, and a schema-less local flow_trigger_lifecycle_callback specification could enable it for url. The remote contract schema would still validate the configuration and we wouldn't need to supersede any config schema locally.