Review fixes for the store signup JWT handoff

[craigmichaelmartin]

WHY are these changes introduced?

Review fixes for #8428 (and one carried defect from #8427), stacked on top of signup-stdin-loopback so neither of @dengjeffrey's branches has to be force-pushed and #8427 keeps its approval. Take these as commits to cherry-pick or squash into the stack, whichever you prefer — I have deliberately not touched either branch.

Context: I picked up Vault 69736 as this week's Gardener and went over both PRs. The design in both is right; these are defects in the details. Each commit is self-contained and independently tested.

WHAT is this pull request doing?

Five commits, each with tests that fail without its source change (verified by reverting each source file in isolation — 2 failing tests per fix).

1. Harden the store auth handoff endpoint — callback.ts

• Every rejection now answers 404. Previously a wrong nonce got 403 and a spent handoff got 410, which tells a local prober that a store auth flow is live on this port and that it has already been used.
• Restricted to GET.
• A browser's speculative fetch no longer spends the single-use handoff. This is the one I'd most like you to look at: the handoff is consumed on first serve, and the manual path prints http://127.0.0.1:13387/auth/handoff?nonce=… for a human to paste. If the browser prefetches or prerenders that URL from the omnibox, the nonce is spent and the real navigation gets a dead handoff — an intermittent, confusing auth failure in exactly the headless environment the handoff exists to keep working. Requests carrying Sec-Purpose, Purpose, or X-moz with prefetch/prerender are declined without consuming it. Covered by a test that prefetches, then navigates, and asserts the navigation still gets its 302.

2. Keep the signup credential out of buildStoreAuthUrl — pkce.ts

This is the finding's literal first step, and the stack currently skips it: buildStoreAuthUrl still takes signup?: string and still runs params.set('signup', …). Now it neither accepts nor serializes the credential — the URL that carries it is derived only for the loopback redirect.

Also removes signup?: string from StoreAuthorizationContext. It had no readers, but it meant createPkceBootstrap(...).authorization handed the raw credential back to every caller.

3. Withhold manual auth URLs that carry a signup credential — result.ts, index.ts

#8427 keys the refusal on a caller-supplied boolean. Once the handoff lands, no caller passes true any more — #8428 hardcodes {sensitive: false} — so the guard #8427 added is dormant and a future caller that forgets the flag leaks the URL again. The presenter now also refuses any URL that actually carries a signup parameter, and fails closed on a URL it cannot parse. options.sensitive is kept as the extension point for credentials the presenter can't recognise.

This is the one real design change here, so it's the one to push back on if you disagree — I'd rather you decide than have me quietly reshape an approved PR.

4. Don't wait on an interactive stdin for the signup JWT — stripe-auth.ts

• readSignupJwtFromStdin reads process.stdin unconditionally. Since --signup became optional, shopify store stripe-auth --store … --scopes … on an interactive terminal hangs forever instead of reporting the missing credential. Now guarded with cli-kit's existing isStdinPiped() (system.ts:413).
• Reads are capped at 8 KiB.
• flags.signup ?? … meant --signup '' ran a signup-less authorization. A blank flag is now treated as not supplied. (Implemented by normalising the flag rather than ||, because @typescript-eslint/prefer-nullish-coalescing is an error here.)

Two things NOT fixed here, because a layer on #8428 structurally can't

• Avoid printing sensitive store auth URLs #8427's futile five-minute wait. Its sensitive branch prints guidance and bare-returns, but control is still inside waitForStoreAuthCode's onListening, and callback.ts:222 discards the fulfilled value — so nothing settles and the CLI blocks the full timeoutMs = 5 * 60 * 1000 before failing. That is deterministic in Codespaces/Gitpod/Cloud Shell, where openURL returns false at system.ts:57 without trying. It needs an AbortError (the pattern at private/node/session/device-authorization.ts:74-79) on Avoid printing sensitive store auth URLs #8427 itself — it only bites if Avoid printing sensitive store auth URLs #8427 lands alone, and once the handoff lands the printed URL is usable, so an abort here would be wrong.
• packages/cli/oclif.manifest.json is stale — fixed in 48d196e3. I originally left this, reasoning that regenerating on a base 547 commits behind main would bake in a stale command set. That was wrong: the first CI run here printed the generator's actual output, and it is only the store:stripe-auth entry — description, the new printf example, and "required": true → false. The ~900-line divergence is between this base and main, which the rebase resolves on its own and has nothing to do with regenerating. Applied the generator's output verbatim. The command is hidden, appears nowhere in packages/cli/README.md, and has no docs-shopify.dev interface, so the readme and docs steps of that job are unaffected.

How to test your changes?

pnpm vitest run packages/store/src/cli/services/store/auth packages/store/src/cli/commands/store/stripe-auth.test.ts

Full packages/store suite: 386 passed / 55 files. eslint and prettier --check clean on all ten changed files. nx run store:type-check reports 0 errors — for what it's worth, it's also 0 on this base unpatched, so the type-check failure noted in #8428's description looks environmental rather than real.

CI: 23 pass, 4 fail — all four inherited from the base. Verified rather than predicted:

Check	#8445	#8427 (none of my commits)	#8444 (cut from current main)
Check OCLIF manifests & readme & docs	pass	fail	pass
Check graphql-codegen has been run	fail	fail	pass
E2E tests (shard 1/2 and 2/2)	fail	fail	pass
Cleanup current-run E2E resources	fail	—	pass
Lint · Type check · Type-diff · Knip · Bundle · Breaking change detection	pass	pass	pass
Unit tests, Node 22/24/26 × macOS/Linux/Windows	pass	pass	pass

The remaining four fail on #8427 too, with none of these commits, and all of them pass on a branch cut from current main — they clear on rebase. graphql-codegen diffs regenerated types (I touched no GraphQL); the E2E jobs report Project(s) not found against the stale base.

One correction to what I first wrote here, since it matters for reading the two PRs' CI: on #8427 (base main) the OCLIF job dies early with Cannot find module bin/check-commands-snapshot.js, because the workflow comes from main while the checked-out code predates that script. On this PR the base is signup-stdin-loopback, so the older workflow runs and gets far enough to actually check the manifest — which is how the real stale-manifest problem surfaced and got fixed in 48d196e3.

Also note pnpm build fails on this base in ui-extensions-dev-console (Rollup failed to resolve import "react/jsx-runtime" — react is not installed for this base's lockfile). Reproduced with my commits stashed, so pre-existing. That is why the manifest was applied from the generator's CI output rather than regenerated locally; the follow-up CI run confirmed it green.

Post-release steps

None.

Checklist

• I've considered possible cross-platform impacts (Mac, Linux, Windows) — isStdinPiped() is existing cli-kit code used elsewhere; the handoff endpoint is loopback HTTP with no platform-specific behaviour
• I've considered possible documentation changes — oclif.manifest.json regenerated for Read store signup JWT from stdin #8428's flag change; the command is hidden so README and shopify.dev docs are unaffected
• I've considered analytics changes to measure impact — none here. Separately, Redact store signup JWTs from analytics payloads #8444 stops the same credential reaching Monorail; that one is independent of this stack.
• The change is user-facing — no changeset, consistent with Avoid printing sensitive store auth URLs #8427 and Read store signup JWT from stdin #8428, which add none for this hidden command

[github-actions]

Differences in type declarations

We detected differences in the type declarations generated by Typescript for this branch compared to the baseline ('main' branch). Please, review them to ensure they are backward-compatible. Here are some important things to keep in mind:

• Some seemingly private modules might be re-exported through public modules.
• If the branch is behind main you might see odd diffs, rebase main into this branch.

New type declarations

We found no new type declarations in this PR

Existing type declarations

packages/cli-kit/dist/public/common/object.d.ts

@@ -38,14 +38,6 @@ export declare function mapValues<T extends object, TResult>(source: T | null |
  * @returns True if the objects are equal, false otherwise.
  */
 export declare function deepCompare(one: object, two: object): boolean;
-/**
- * Deeply compares two values and treats arrays as order-insensitive.
- *
- * @param one - The first value to be compared.
- * @param two - The second value to be compared.
- * @returns True if the normalized values are equal, false otherwise.
- */
-export declare function deepCompareWithOrderInsensitiveArrays(one: unknown, two: unknown): boolean;
 /**
  * Return the difference between two nested objects.
  *

packages/cli-kit/dist/public/common/string.d.ts

@@ -1,4 +1,4 @@
-import type { Token, TokenItem } from '../../private/node/ui/components/token-item.js';
+import { Token, TokenItem } from '../../private/node/ui/components/TokenizedText.js';
 export type RandomNameFamily = 'business' | 'creative';
 /**
  * Generates a random name by combining an adjective and noun.

packages/cli-kit/dist/public/common/version.d.ts

@@ -1 +1 @@
-export declare const CLI_KIT_VERSION = "4.7.0";
\ No newline at end of file
+export declare const CLI_KIT_VERSION = "4.4.0";
\ No newline at end of file

packages/cli-kit/dist/private/node/constants.d.ts

@@ -6,6 +6,7 @@ export declare const environmentVariables: {
     doctor: string;
     enableCliRedirect: string;
     env: string;
+    firstPartyDev: string;
     noAnalytics: string;
     optOutInstrumentation: string;
     appAutomationToken: string;
@@ -30,6 +31,7 @@ export declare const environmentVariables: {
     otelURL: string;
     themeKitAccessDomain: string;
     json: string;
+    neverUsePartnersApi: string;
     skipNetworkLevelRetry: string;
     maxRequestTimeForNetworkCalls: string;
     disableImportScanning: string;

packages/cli-kit/dist/private/node/otel-metrics.d.ts

@@ -2,7 +2,7 @@ import { OtelService } from '../../public/node/vendor/otel-js/service/types.js';
 import { DefaultOtelServiceOptions } from '../../public/node/vendor/otel-js/service/DefaultOtelService/DefaultOtelService.js';
 type MetricRecorder = 'console' | {
     type: 'otel';
-    otel: Pick<OtelService, 'getMeterProvider' | 'record'>;
+    otel: Pick<OtelService, 'record'>;
 };
 interface Timing {
     active: number;

packages/cli-kit/dist/private/node/session.d.ts

@@ -90,7 +90,6 @@ export declare function setLastSeenUserIdAfterAuth(id: string): void;
  */
 export declare function getLastSeenAuthMethod(): Promise<AuthMethod>;
 export declare function setLastSeenAuthMethod(method: AuthMethod): void;
-export declare function setCommandSessionId(sessionId: string | undefined): void;
 export interface EnsureAuthenticatedAdditionalOptions {
     noPrompt?: boolean;
     forceRefresh?: boolean;

packages/cli-kit/dist/public/node/abort.d.ts

+import { AbortController as NodeAbortController, AbortSignal as NodeAbortControllerSignal } from 'node-abort-controller';
 /**
  * The AbortController interface represents a controller object that allows you to abort one or more Web requests as and when desired.
  *
  * - MDN Documentation: https://developer.mozilla.org/en-US/docs/Web/API/AbortController
  *
- * This class exists to keep the historical `@shopify/cli-kit/node/abort` import path working
- * now that Node provides AbortController natively.
+ * This class is necessary because AbortController support was added to Node 15 and the minimum
+ * version that we support is Node 14.
  */
-export declare class AbortController extends globalThis.AbortController {
+export declare class AbortController extends NodeAbortController {
 }
 /**
  * The AbortSignal interface represents a signal object that allows you to communicate with a DOM request (such as a fetch request) and abort it if required via an AbortController object.
- *
- * Note that AbortSignal cannot be constructed directly. Get one from an AbortController's
- * `signal` property or from the static helpers such as `AbortSignal.timeout()`.
  */
-export declare const AbortSignal: {
-    new (): globalThis.AbortSignal;
-    prototype: globalThis.AbortSignal;
-    abort(reason?: any): globalThis.AbortSignal;
-    any(signals: globalThis.AbortSignal[]): globalThis.AbortSignal;
-    timeout(milliseconds: number): globalThis.AbortSignal;
-};
-export type AbortSignal = globalThis.AbortSignal;
+export declare class AbortSignal extends NodeAbortControllerSignal {
+}

packages/cli-kit/dist/public/node/analytics.d.ts

 import { RuntimeData } from '../../private/node/analytics/storage.js';
 import { Interfaces } from '@oclif/core';
 export type CommandExitMode = 'ok' | 'unexpected_error' | 'expected_error';
 interface ReportAnalyticsEventOptions {
     config: Interfaces.Config;
     errorMessage?: string;
     exitMode: CommandExitMode;
 }
-export declare function sendAnalyticsEventFromStdin(): Promise<void>;
 /**
  * Report an analytics event, sending it off to Monorail -- Shopify's internal analytics service.
  *
  * The payload for an event includes both generic data, and data gathered from installed plug-ins.
  *
  */
 export declare function reportAnalyticsEvent(options: ReportAnalyticsEventOptions): Promise<void>;
 /**
  * Records timing data for performance monitoring. Call twice with the same
  * event name to start and stop timing. First call starts the timer, second
  * call stops it and records the duration.
  *
  * @example
  * ```ts
  *   recordTiming('theme-upload') // Start timing
  *   // ... do work ...
  *   recordTiming('theme-upload') // Stop timing and record duration
  * ```
  *
  * @param eventName - Unique identifier for the timing event
  */
 export declare function recordTiming(eventName: string): void;
 /**
  * Records error information for debugging and monitoring. Use this to track
  * any exceptions or error conditions that occur during theme operations.
  * Errors are automatically categorized for easier analysis.
  *
  * @example
  * ```ts
  *   try {
  *     // ... risky operation ...
  *   } catch (error) {
  *     recordError(error)
  *   }
  * ```
  *
  * @param error - Error object or message to record
  */
 export declare function recordError<T>(error: T): T;
 /**
  * Records retry attempts for network operations. Use this to track when
  * operations are retried due to transient failures. Helps identify
  * problematic endpoints or operations that frequently fail.
  *
  * @example
  * ```ts
  *   recordRetry('https://api.shopify.com/themes', 'upload')
  * ```
  *
  * @param url - The URL or endpoint being retried
  * @param operation - Description of the operation being retried
  */
 export declare function recordRetry(url: string, operation: string): void;
 /**
  * Records custom events for tracking specific user actions or system events.
  * Use this for important milestones, user interactions, or significant
  * state changes in the application.
  *
  * @example
  * ```ts
  *   recordEvent('theme-dev-started')
  *   recordEvent('file-watcher-connected')
  * ```
  *
  * @param eventName - Descriptive name for the event
  */
 export declare function recordEvent(eventName: string): void;
 /**
  * Compiles and returns all runtime analytics data collected during the session.
  * This includes timing measurements, error records, retry attempts, and custom
  * events. Use this to retrieve a complete snapshot of analytics data for
  * reporting or debugging purposes.
  *
  * @example
  * ```ts
  *   const analyticsData = compileData()
  *   console.log(`Recorded ${analyticsData.timings.length} timing events`)
  *   console.log(`Recorded ${analyticsData.errors.length} errors`)
  * ```
  *
  * @returns Object containing all collected analytics data including timings, errors, retries, and events
  */
 export declare function compileData(): RuntimeData;
 export {};

packages/cli-kit/dist/public/node/base-command.d.ts

@@ -2,16 +2,8 @@ import { Command } from '@oclif/core';
 import { OutputFlags, Input, ParserOutput, FlagInput, OutputArgs } from '@oclif/core/parser';
 export type ArgOutput = OutputArgs<any>;
 export type FlagOutput = OutputFlags<any>;
-export interface NonTTYFlagRequirement {
-    /** At least one of these flags must be present when the requirement applies. */
-    flags: string[];
-    /** Determines whether the requirement applies to the parsed flags. */
-    when?: (flags: FlagOutput) => boolean;
-}
 declare abstract class BaseCommand extends Command {
     static baseFlags: FlagInput<{}>;
-    static get requiresSyncAnalytics(): boolean;
-    static nonTTYFlagRequirements(_flags: FlagOutput): NonTTYFlagRequirement[];
     static descriptionWithoutMarkdown(): string | undefined;
     static analyticsNameOverride(): string | undefined;
     static analyticsStopCommand(): string | undefined;
@@ -24,14 +16,11 @@ declare abstract class BaseCommand extends Command {
     protected parse<TFlags extends FlagOutput & {
         path?: string;
         verbose?: boolean;
-        'auth-alias'?: string;
     }, TGlobalFlags extends FlagOutput, TArgs extends ArgOutput>(options?: Input<TFlags, TGlobalFlags, TArgs>, argv?: string[]): Promise<ParserOutput<TFlags, TGlobalFlags, TArgs> & {
         argv: string[];
     }>;
     protected environmentsFilename(): string | undefined;
     protected failMissingNonTTYFlags(flags: FlagOutput, requiredFlags: string[]): void;
-    private failMissingNonTTYFlagRequirements;
-    private applicableNonTTYFlagRequirements;
     private resultWithEnvironment;
     /**
      * Tries to load an environment to forward to the command. If no environment

packages/cli-kit/dist/public/node/cli.d.ts

@@ -39,9 +39,6 @@ export declare const globalFlags: {
 export declare const jsonFlag: {
     json: import("@oclif/core/interfaces").BooleanFlag<boolean>;
 };
-export declare const authAliasFlag: {
-    'auth-alias': import("@oclif/core/interfaces").OptionFlag<string | undefined, import("@oclif/core/interfaces").CustomOptions>;
-};
 /**
  * Builds a  flag that only accepts a valid port number. The flag parses its
  * value as an integer and rejects anything that isn't a whole number between 1 and
@@ -55,19 +52,6 @@ export declare const portFlag: (options?: {
     env?: string;
     hidden?: boolean;
 }) => import("@oclif/core/interfaces").OptionFlag<number | undefined, import("@oclif/core/interfaces").CustomOptions>;
-/**
- * Marks a flag as required when the CLI cannot prompt for a value.
- *
- * The flag remains optional in interactive terminals. In non-interactive environments,
- *  validates the flag automatically and the requirement is shown in .
- * Use  for conditional or alternative requirements.
- *
- * @param flag - An oclif flag definition.
- * @returns A new flag definition annotated for non-interactive validation and help output.
- */
-export declare function requiredIfNonInteractive<TFlag extends {
-    description?: string;
-}>(flag: TFlag): TFlag;
 /**
  * Clear the CLI cache, used to store some API responses and handle notifications status
  */

packages/cli-kit/dist/public/node/environment.d.ts

@@ -45,6 +45,12 @@ export declare function getIdentityTokenInformation(): {
  * @returns True if the JSON output is enabled, false otherwise.
  */
 export declare function jsonOutputEnabled(environment?: NodeJS.ProcessEnv): boolean;
+/**
+ * If true, the CLI should not use the Partners API.
+ *
+ * @returns True when the CLI should not use the Partners API.
+ */
+export declare function blockPartnersAccess(): boolean;
 /**
  * If true, the CLI should not use the network level retry.
  *

packages/cli-kit/dist/public/node/error.d.ts

@@ -1,6 +1,7 @@
 import { OutputMessage } from './output.js';
-import { type InlineToken, type TokenItem } from '../../private/node/ui/components/token-item.js';
+import { InlineToken, TokenItem } from '../../private/node/ui/components/TokenizedText.js';
 import type { AlertCustomSection } from './ui.js';
+export { ExtendableError } from 'ts-error';
 export declare enum FatalErrorType {
     Abort = 0,
     AbortSilent = 1,
@@ -37,6 +38,8 @@ export declare abstract class FatalError extends Error {
  * Those usually represent unexpected scenarios that we can't handle and that usually require some action from the developer.
  */
 export declare class AbortError extends FatalError {
+    nextSteps?: TokenItem<InlineToken>[];
+    customSections?: AlertCustomSection[];
     constructor(message: TokenItem | OutputMessage, tryMessage?: TokenItem | OutputMessage | null, nextSteps?: TokenItem<InlineToken>[], customSections?: AlertCustomSection[]);
 }
 /**

packages/cli-kit/dist/public/node/metadata.d.ts

@@ -42,7 +42,6 @@ declare const coreData: RuntimeMetadataManager<CmdFieldsFromMonorail, {
         startCommand: string;
         startTopic?: string;
         startArgs: string[];
-        requiresSyncAnalytics?: boolean;
     };
 } & {
     environmentFlags: string;
@@ -64,7 +63,6 @@ export declare const getAllPublicMetadata: () => Partial<CmdFieldsFromMonorail>,
         startCommand: string;
         startTopic?: string;
         startArgs: string[];
-        requiresSyncAnalytics?: boolean;
     };
 } & {
     environmentFlags: string;
@@ -85,7 +83,6 @@ export declare const getAllPublicMetadata: () => Partial<CmdFieldsFromMonorail>,
         startCommand: string;
         startTopic?: string;
         startArgs: string[];
-        requiresSyncAnalytics?: boolean;
     };
 } & {
     environmentFlags: string;

packages/cli-kit/dist/public/node/session.d.ts

@@ -22,19 +22,6 @@ export type AccountInfo = UserAccountInfo | ServiceAccountInfo | UnknownAccountI
  * @param userId - User identifier to report on the command analytics event.
  */
 export declare function setLastSeenUserId(userId: string): void;
-/**
- * Finds a stored Shopify account session by alias without changing the current session.
- *
- * @param alias - The account alias to find.
- * @returns The matching session ID, or undefined if no session matches.
- */
-export declare function findSessionIdByAlias(alias: string): Promise<string | undefined>;
-/**
- * Selects a stored Shopify account session by alias for the current command process.
- *
- * @param alias - The account alias to select. Passing undefined clears the command selection.
- */
-export declare function setCurrentSessionAlias(alias?: string): Promise<void>;
 interface UserAccountInfo {
     type: 'UserAccount';
     email: string;

packages/cli-kit/dist/public/node/system.d.ts

@@ -105,25 +105,12 @@ export declare function terminalSupportsPrompting(): boolean;
  * @returns True if the current environment is a CI environment.
  */
 export declare function isCI(): boolean;
-interface WslDetectionOverrides {
-    platform?: NodeJS.Platform;
-    kernelRelease?: string;
-    procVersion?: string;
-    insideContainer?: boolean;
-}
 /**
  * Check if the current environment is a WSL environment.
  *
- * @param overrides - Detection inputs, read from the system when not provided. Intended for tests.
  * @returns True if the current environment is a WSL environment.
  */
-export declare function isWsl(overrides?: WslDetectionOverrides): Promise<boolean>;
-/**
- * Check if the current process is running inside a container.
- *
- * @returns True if the current process is running inside a container.
- */
-export declare function isInsideContainer(): boolean;
+export declare function isWsl(): Promise<boolean>;
 /**
  * Check if stdin has piped data available.
  * This distinguishes between actual piped input (e.g., )
@@ -142,5 +129,4 @@ export declare function isStdinPiped(): boolean;
  *
  * @returns A promise that resolves with the stdin content, or undefined if stdin is a TTY.
  */
-export declare function readStdinString(): Promise<string | undefined>;
-export {};
\ No newline at end of file
+export declare function readStdinString(): Promise<string | undefined>;
\ No newline at end of file

packages/cli-kit/dist/public/node/ui.d.ts

@@ -6,7 +6,7 @@ import { AlertOptions } from '../../private/node/ui/alert.js';
 import { CustomSection } from '../../private/node/ui/components/Alert.js';
 import ScalarDict from '../../private/node/ui/components/Table/ScalarDict.js';
 import { TableColumn, TableProps } from '../../private/node/ui/components/Table/Table.js';
-import { type InlineToken, type LinkToken, type ListToken, type Token, type TokenItem } from '../../private/node/ui/components/token-item.js';
+import { Token, InlineToken, LinkToken, ListToken, TokenItem } from '../../private/node/ui/components/TokenizedText.js';
 import { DangerousConfirmationPromptProps } from '../../private/node/ui/components/DangerousConfirmationPrompt.js';
 import { SelectPromptProps } from '../../private/node/ui/components/SelectPrompt.js';
 import { Task } from '../../private/node/ui/components/Tasks.js';

packages/cli-kit/dist/private/node/analytics/graphql-error-codes.d.ts

@@ -21,8 +21,8 @@ export declare function graphQLErrorCodes(errors: unknown): string[];
 /**
  * Whether a single code is a rate-limit signal ( or ).
  *
- * Shared with the retry path ( in ), where these codes signal
- * rate limiting even at HTTP 200.
+ * Mirrors the established shape detected by  in ,
+ * where  signals rate limiting even at HTTP 200.
  */
 export declare function isRateLimitCode(code: string | undefined): boolean;
 /**

packages/cli-kit/dist/private/node/session/exchange.d.ts

@@ -1,9 +1,10 @@
 import { ApplicationToken, IdentityToken } from './schema.js';
 import { API } from '../api.js';
 import { Result } from '../../../public/node/result.js';
-export declare class InvalidGrantError extends Error {
+import { ExtendableError } from '../../../public/node/error.js';
+export declare class InvalidGrantError extends ExtendableError {
 }
-export declare class InvalidRequestError extends Error {
+export declare class InvalidRequestError extends ExtendableError {
 }
 export interface ExchangeScopes {
     admin: string[];
@@ -51,8 +52,7 @@ export declare function exchangeAppAutomationTokenForBusinessPlatformAccessToken
     accessToken: string;
     userId: string;
 }>;
-declare const identityDeviceErrors: readonly ["authorization_pending", "access_denied", "expired_token", "slow_down", "unknown_failure"];
-type IdentityDeviceError = (typeof identityDeviceErrors)[number];
+type IdentityDeviceError = 'authorization_pending' | 'access_denied' | 'expired_token' | 'slow_down' | 'unknown_failure';
 /**
  * Given a deviceCode obtained after starting a device identity flow, request an identity token.
  * @param deviceCode - The device code obtained after starting a device identity flow

packages/cli-kit/dist/private/node/ui/utilities.d.ts

@@ -1,16 +1,16 @@
-import { type TokenItem } from './components/token-item.js';
-export declare function messageWithPunctuation(message: TokenItem): string | import("./components/token-item.js").LinkToken | import("./components/token-item.js").UserInputToken | import("./components/token-item.js").ListToken | {
+import { TokenItem } from './components/TokenizedText.js';
+export declare function messageWithPunctuation(message: TokenItem): string | {
     command: string;
-} | {
+} | import("./components/TokenizedText.js").LinkToken | {
     char: string;
-} | {
+} | import("./components/TokenizedText.js").UserInputToken | {
     subdued: string;
 } | {
     filePath: string;
-} | import("./components/token-item.js").BoldToken | {
+} | import("./components/TokenizedText.js").ListToken | import("./components/TokenizedText.js").BoldToken | {
     info: string;
 } | {
     warn: string;
 } | {
     error: string;
-} | import("./components/token-item.js").Token[];
\ No newline at end of file
+} | import("./components/TokenizedText.js").Token[];
\ No newline at end of file

packages/cli-kit/dist/public/node/api/partners.d.ts

@@ -1,5 +1,7 @@
 import { GraphQLVariables, GraphQLResponse, CacheOptions, UnauthorizedHandler } from './graphql.js';
 import { RequestModeInput } from '../http.js';
+import { Variables } from 'graphql-request';
+import { TypedDocumentNode } from '@graphql-typed-document-node/core';
 /**
  * Executes a GraphQL query against the Partners API.
  *
@@ -12,6 +14,21 @@ import { RequestModeInput } from '../http.js';
  * @returns The response of the query of generic type <T>.
  */
 export declare function partnersRequest<T>(query: string, token: string, variables?: GraphQLVariables, cacheOptions?: CacheOptions, preferredBehaviour?: RequestModeInput, unauthorizedHandler?: UnauthorizedHandler): Promise<T>;
+export declare const generateFetchAppLogUrl: (cursor?: string, filters?: {
+    status?: string;
+    source?: string;
+}) => Promise<string>;
+/**
+ * Executes a GraphQL query against the Partners API. Uses typed documents.
+ *
+ * @param query - GraphQL query to execute.
+ * @param token - Partners token.
+ * @param variables - GraphQL variables to pass to the query.
+ * @param preferredBehaviour - Preferred behaviour for the request.
+ * @param unauthorizedHandler - Optional handler for unauthorized requests.
+ * @returns The response of the query of generic type <TResult>.
+ */
+export declare function partnersRequestDoc<TResult, TVariables extends Variables>(query: TypedDocumentNode<TResult, TVariables>, token: string, variables?: TVariables, preferredBehaviour?: RequestModeInput, unauthorizedHandler?: UnauthorizedHandler): Promise<TResult>;
 /**
  * Sets the next deprecation date from [GraphQL response extensions](https://www.apollographql.com/docs/resources/graphql-glossary/#extensions)
  * if  objects contain a  (ISO 8601-formatted string).

packages/cli-kit/dist/public/node/context/local.d.ts

@@ -63,6 +63,13 @@ export declare function alwaysLogAnalytics(env?: NodeJS.ProcessEnv): boolean;
  * @returns True if SHOPIFY_CLI_ALWAYS_LOG_METRICS is truthy.
  */
 export declare function alwaysLogMetrics(env?: NodeJS.ProcessEnv): boolean;
+/**
+ * Returns true if the CLI User is 1P.
+ *
+ * @param env - The environment variables from the environment of the current process.
+ * @returns True if SHOPIFY_CLI_1P is truthy.
+ */
+export declare function firstPartyDev(env?: NodeJS.ProcessEnv): boolean;
 /**
  * Returns true if the CLI can run the "doctor-release" command.
  *
@@ -141,9 +148,7 @@ export declare function ciPlatform(env?: NodeJS.ProcessEnv): {
     metadata?: undefined;
 };
 /**
- * Returns the first mac address found, preferring external interfaces. Returns a random
- * value when no interface has a MAC, so callers hashing it as a device id don't group
- * unrelated devices together.
+ * Returns the first mac address found.
  *
  * @returns Mac address.
  */

packages/cli-kit/dist/public/node/plugins/tunnel.d.ts

@@ -1,3 +1,4 @@
+import { ExtendableError } from '../error.js';
 import { OutputMessage } from '../output.js';
 import { FanoutHookFunction, PluginReturnsForHook } from '../plugins.js';
 import { Result } from '../result.js';
@@ -21,7 +22,7 @@ export type TunnelStatusType = {
     message: TokenItem | OutputMessage;
     tryMessage?: TokenItem | OutputMessage | null;
 };
-export declare class TunnelError extends Error {
+export declare class TunnelError extends ExtendableError {
     type: TunnelErrorType;
     constructor(type: TunnelErrorType, message?: string);
 }

packages/cli-kit/dist/private/node/ui/components/Alert.d.ts

@@ -1,7 +1,7 @@
 import { BannerType } from './Banner.js';
+import { BoldToken, InlineToken, LinkToken, TokenItem } from './TokenizedText.js';
 import { TabularDataProps } from './TabularData.js';
 import { FunctionComponent } from 'react';
-import type { BoldToken, InlineToken, LinkToken, TokenItem } from './token-item.js';
 export interface CustomSection {
     title?: string;
     body: TabularDataProps | TokenItem;

packages/cli-kit/dist/private/node/ui/components/DangerousConfirmationPrompt.d.ts

@@ -1,7 +1,7 @@
+import { InlineToken, TokenItem } from './TokenizedText.js';
 import { InfoTableProps } from './Prompts/InfoTable.js';
 import { AbortSignal } from '../../../../public/node/abort.js';
 import { FunctionComponent } from 'react';
-import type { InlineToken, TokenItem } from './token-item.js';
 export interface DangerousConfirmationPromptProps {
     message: string;
     confirmation: string;

packages/cli-kit/dist/private/node/ui/components/List.d.ts

@@ -1,6 +1,6 @@
+import { InlineToken, TokenItem } from './TokenizedText.js';
 import { TextProps } from 'ink';
 import { FunctionComponent } from 'react';
-import type { InlineToken, TokenItem } from './token-item.js';
 export interface CustomListItem {
     type?: string;
     item: TokenItem<InlineToken>;

packages/cli-kit/dist/private/node/ui/components/TabularData.d.ts

@@ -1,4 +1,4 @@
-import { type InlineToken } from './token-item.js';
+import { InlineToken } from './TokenizedText.js';
 import { FunctionComponent } from 'react';
 export interface TabularDataProps {
     tabularData: InlineToken[][];

packages/cli-kit/dist/private/node/ui/components/TextPrompt.d.ts

@@ -1,6 +1,6 @@
+import { InlineToken, TokenItem } from './TokenizedText.js';
 import { AbortSignal } from '../../../../public/node/abort.js';
 import { FunctionComponent } from 'react';
-import type { InlineToken, TokenItem } from './token-item.js';
 export interface TextPromptProps {
     message: TokenItem;
     onSubmit: (value: string) => void;

packages/cli-kit/dist/private/node/ui/components/TokenizedText.d.ts

@@ -1,5 +1,42 @@
 import { FunctionComponent } from 'react';
-import type { TokenItem } from './token-item.js';
+export interface LinkToken {
+    link: {
+        label?: string;
+        url: string;
+    };
+}
+export interface UserInputToken {
+    userInput: string;
+}
+export interface ListToken {
+    list: {
+        title?: TokenItem<InlineToken>;
+        items: TokenItem<InlineToken>[];
+        ordered?: boolean;
+    };
+}
+export interface BoldToken {
+    bold: string;
+}
+export type Token = string | {
+    command: string;
+} | LinkToken | {
+    char: string;
+} | UserInputToken | {
+    subdued: string;
+} | {
+    filePath: string;
+} | ListToken | BoldToken | {
+    info: string;
+} | {
+    warn: string;
+} | {
+    error: string;
+};
+export type InlineToken = Exclude<Token, ListToken>;
+export type TokenItem<T extends Token = Token> = T | T[];
+export declare function tokenItemToString(token: TokenItem): string;
+export declare function appendToTokenItem(token: TokenItem, suffix: string): TokenItem;
 interface TokenizedTextProps {
     item: TokenItem;
 }

packages/cli-kit/dist/private/node/ui/components/Prompts/InfoMessage.d.ts

@@ -1,6 +1,6 @@
+import { InlineToken, LinkToken, TokenItem, UserInputToken } from '../TokenizedText.js';
 import { TextProps } from 'ink';
 import { FunctionComponent } from 'react';
-import type { InlineToken, LinkToken, TokenItem, UserInputToken } from '../token-item.js';
 export interface InfoMessageProps {
     message: {
         title: {

packages/cli-kit/dist/private/node/ui/components/Prompts/InfoTable.d.ts

@@ -1,7 +1,7 @@
 import { CustomListItem } from '../List.js';
+import { InlineToken, TokenItem } from '../TokenizedText.js';
 import { TextProps } from 'ink';
 import { FunctionComponent } from 'react';
-import type { InlineToken, TokenItem } from '../token-item.js';
 type Items = (TokenItem<InlineToken> | CustomListItem)[];
 export interface InfoTableSection {
     color?: TextProps['color'];

packages/cli-kit/dist/private/node/ui/components/Prompts/PromptLayout.d.ts

@@ -1,9 +1,9 @@
 import { InfoTableProps } from './InfoTable.js';
 import { InfoMessageProps } from './InfoMessage.js';
+import { InlineToken, LinkToken, TokenItem } from '../TokenizedText.js';
 import { AbortSignal } from '../../../../../public/node/abort.js';
 import { PromptState } from '../../hooks/use-prompt.js';
 import { ReactElement } from 'react';
-import type { InlineToken, LinkToken, TokenItem } from '../token-item.js';
 export type Message = TokenItem<Exclude<InlineToken, LinkToken>>;
 interface PromptLayoutProps {
     message: Message;

packages/cli-kit/dist/public/node/vendor/otel-js/service/types.d.ts

@@ -1,5 +1,5 @@
-import type { Counter, Histogram, MetricAttributes, MetricOptions, UpDownCounter } from '@opentelemetry/api';
-import type { MeterProvider, ViewOptions } from '@opentelemetry/sdk-metrics';
+import type { Counter, Histogram, MeterProvider, MetricAttributes, MetricOptions, UpDownCounter } from '@opentelemetry/api';
+import type { ViewOptions } from '@opentelemetry/sdk-metrics';
 export type CustomMetricLabels<TLabels extends Record<TKeys, MetricAttributes>, TKeys extends string = keyof TLabels & string> = {
     [P in TKeys]: TLabels[P] extends MetricAttributes ? TLabels[P] : never;
 };