@shopify/cli 4.9.4 → 5.0.0

package/dist/chunk-HCZG7YJ6.js

@@ -0,0 +1,16 @@
+import{K as y,M as c,N as S,h as C,t as w}from"./chunk-LMQGNECW.js";import{A as u}from"./chunk-CZ22VZDA.js";import{h as f}from"./chunk-2VSNFOKD.js";import{ta as m,wb as g}from"./chunk-LWCTKI4Z.js";import{p}from"./chunk-IWTNUJGY.js";import{g as l}from"./chunk-VKWPEFWQ.js";l();import N from"clipboardy";var _="{{SCAN_CONTEXT}}",I="<the findings document from step 4>",P={posix:"bash",powershell:"powershell",cmd:"bat"};function r(e){return`\`${e.replace(/`/g,"'")}\``}function E(e,t){return`\`\`\`${P[t]}
+${e}
+\`\`\``}function s(e){return{...e,args:[...e.args,"--json","--no-input"]}}function T(e,t){let n=E(c(e,t),t),i=`replacing \`${e.stdinPlaceholder}\` with the file's path`,o=S(e,I,t);if(o===void 0)return`cmd.exe can't pipe multi-line text inline, so write the document to a file and redirect it to \`record\`, ${i}:
+
+${n}`;let a=t==="powershell"?"The closing `'@` must start its line. The single-quoted here-string keeps PowerShell from expanding `$` in the document.":"The quoted `'EOF'` keeps the shell from expanding `$` and backticks in the document.",d=t==="powershell"?"\n\nWindows PowerShell 5.1 pipes text to `record` as ASCII by default. If the document contains non-ASCII characters, run `$OutputEncoding = [System.Text.UTF8Encoding]::new()` before either command.":"";return`${E(o,t)}
+
+Replace \`${I}\` with the document itself; you don't need to write a file. ${a}
+
+If you'd rather write the document to a file, pipe the file instead, ${i}:
+
+${n}${d}`}function O(e,t,n,i){let{resultsDirectory:o,deterministicFindingsPath:a,agentChecksPath:d,agentFindingsPath:A}=w(e,t);return{commands:i,scanCommand:c(s(i.scan),n),deterministicScanCommand:c(i.scan,n),recordInstructions:T(s(i.record),n),reviewCommand:c(s(i.review),n),cleanCommand:c(s(i.clean),n),deterministicFindingsPath:a,agentChecksPath:d,agentFindingsPath:A,resultsDirectory:o}}function k(e){return`### 1. Run the scan
+
+Decide what to scan before running the check. By default, \`check\` scans the app directory. If the app's code also lives elsewhere (a backend, a shared library, another repository), add each of those directories with \`--include-dir\`. Skip paths with \`--exclude\`. Use \`--no-git-ignore\` only if Git-ignored files must be scanned. Include only directories relevant to the app. Check the scope with ${r(`${e.scanCommand} --list-files`)} and adjust the flags until its \`files\` list is right. Then run \`check\` with the same flags, and use the same flags every time you run \`check\` again.`}function $(e){return`### 1. Use the existing scan results
+
+\`shopify app security check\` has already run. It wrote ${r(e.deterministicFindingsPath)} and ${r(e.agentChecksPath)}. Continue by reading the agent checks. Running \`check\` again is always safe; do so once source files change (step 7).`}var D=JSON.stringify({include_dirs:[],excludes:[],no_git_ignore:!1});function x(e){return e?{json:JSON.stringify(e),guidance:"`scope` is the scope of the `check` run these results come from. Copy it into the document unchanged."}:{json:D,guidance:"Fill in `scope` with the flags you settled on with `--list-files`: `include_dirs` and `excludes` hold the `--include-dir` and `--exclude` values exactly as you typed them, in order, and `no_git_ignore` is `true` only if you passed `--no-git-ignore`."}}function R(e,t){return Object.entries(t).reduce((n,[i,o])=>n.replaceAll(i,()=>o),e)}var h=class extends f{constructor(t){let n=t instanceof Error?t.message:String(t);super(`Couldn't copy the app security check instructions to the clipboard: ${n}`,null,[["Run the command without",{command:"--copy"},"to print the instructions, or with",{command:"--write <file>"},"to write them to a file."]]),this.code="clipboard-unavailable"}},b={copyToClipboard:e=>N.write(e),writeToFile:m};function q(e){let t=e.shell??y(),n=O(e.appDirectory,e.resultsKey,t,e.commands),i=e.scanScope?$(n):k(n),o=x(e.scanScope);return R(C(),{[_]:i,"{{WORKING_DIRECTORY_LINE}}":`Run these commands from ${r(p())}.`,"{{SCOPE_JSON}}":o.json,"{{SCOPE_GUIDANCE}}":o.guidance,"{{SCAN_COMMAND}}":n.scanCommand,"{{DETERMINISTIC_SCAN_COMMAND}}":n.deterministicScanCommand,"{{RECORD_COMMAND}}":n.recordInstructions,"{{REVIEW_COMMAND}}":n.reviewCommand,"{{CLEAN_COMMAND}}":n.cleanCommand,"{{DETERMINISTIC_FINDINGS_PATH}}":r(n.deterministicFindingsPath),"{{AGENT_CHECKS_PATH}}":r(n.agentChecksPath),"{{AGENT_FINDINGS_PATH}}":r(n.agentFindingsPath)}).trimEnd()}async function B(e,t,n=b){if(t.copy)try{await n.copyToClipboard(e)}catch(i){throw new h(i)}else t.writePath&&await n.writeToFile(t.writePath,`${e}
+`)}function K(e,t){t.copy?u({headline:"Copied app security check instructions to the clipboard"}):t.writePath?u({headline:`Wrote app security check instructions to ${t.writePath}`}):g(e)}export{h as a,q as b,B as c,K as d};

package/dist/chunk-HF4NDEX3.js

@@ -0,0 +1 @@
+import{b as n,c as t,g as s,h as i}from"./chunk-QFWWCZOI.js";import{b as e}from"./chunk-FZCGRIOM.js";import{g as r}from"./chunk-VKWPEFWQ.js";r();var l=e.object({id:e.number(),name:e.string(),role:e.string(),processing:e.boolean(),createdAtRuntime:e.boolean(),src:e.string().optional(),shop:e.string()}),m=t.extend({storeDomain:n,processing:e.boolean(),sourceUrl:e.string().url().nullable()}).strict().describe("The selected theme projection; sourceUrl is null when the upstream source URL is unavailable.");function u(o){return{...i(o),storeDomain:s(o.shop),processing:o.processing,sourceUrl:o.src===""?null:o.src??null}}export{l as a,m as b,u as c};

package/dist/chunk-HIRTL45Q.js

@@ -0,0 +1 @@
+import{k as S,m as O,p as R}from"./chunk-DNMXVMJM.js";import{a as x}from"./chunk-P33TONYG.js";import{e as J}from"./chunk-QFWWCZOI.js";import{p as E,v as j}from"./chunk-DJAZBPYA.js";import{k as l,ua as u}from"./chunk-H4V55Y3Z.js";import{b as g,c as f}from"./chunk-Q2SZCZE7.js";import{A as b,B as I,O as _}from"./chunk-CZ22VZDA.js";import{h as s}from"./chunk-2VSNFOKD.js";import{Ta as y,la as P,wb as w}from"./chunk-LWCTKI4Z.js";import{b as p}from"./chunk-FZCGRIOM.js";import{b as N}from"./chunk-YTUUU33R.js";import{e as H,g as n}from"./chunk-VKWPEFWQ.js";n();n();n();async function $({session:r,overridesContent:e,themeId:t}){u("theme-preview:create");let d=`${O(r)}/theme_preview.json?preview_theme_id=${t}`,i=await S(r,{headers:{"Content-Type":"application/json"}}),o=await l(d,{method:"POST",body:e,headers:i});if(!o.ok)throw new s(`Theme preview request failed with status ${o.status}: ${o.statusText}`);let m=await U(o);return u("theme-preview:create"),m}async function A({session:r,overridesContent:e,themeId:t,previewIdentifier:a}){u("theme-preview:update");let i=`${O(r)}/theme_preview.json?preview_theme_id=${t}&preview_identifier=${encodeURIComponent(a)}`,o=await S(r,{headers:{"Content-Type":"application/json"}}),m=await l(i,{method:"POST",body:e,headers:o});if(!m.ok)throw new s(`Theme preview request failed with status ${m.status}: ${m.statusText}`);let v=await U(m);return u("theme-preview:update"),v}async function U(r){let e=await r.json();if(e.error)throw new s(`Theme preview failed: ${e.error}`);if(!e.url||!e.preview_identifier)throw new s("Theme preview returned an unexpected response");return{url:e.url,preview_identifier:e.preview_identifier}}async function L(r){if(!y(r.overrideJson))throw new s(`Override file not found: ${r.overrideJson}`);let e=await P(r.overrideJson),t;try{t=JSON.parse(e)}catch(i){let o=i instanceof Error?i.message:String(i);throw new s(`Failed to parse override file: ${r.overrideJson}`,o)}let a=await R(r.themeId,r.adminSession,r.password),d=JSON.stringify(t);return r.previewIdentifier?A({session:a,overridesContent:d,themeId:r.themeId,previewIdentifier:r.previewIdentifier}):$({session:a,overridesContent:d,themeId:r.themeId})}n();n();var C=p.object({id:p.string().min(1).describe("The opaque Storefront preview identifier, not a theme ID or Shopify GID."),url:p.string().url()}).strict(),h=J({name:"ThemePreviewResult",schema:p.object({status:p.literal("success"),preview:C}).strict(),definitions:{ThemePreview:C},project:r=>{let e=r;return{status:"success",preview:{id:e.preview_identifier,url:e.url}}}});function D(r,e,t){if(e==="json"){w(h.encode(r));return}b({body:[{list:{title:t?"Preview updated":"Preview is ready",items:[{link:{url:r.url}},`Preview ID: ${r.preview_identifier}`]}}]})}function T(r){let e="Failed to open theme preview.",t=r.stack??r.message;I({headline:e,body:t})}var c=H(N(),1);var F=class extends j{static get jsonOutputSchema(){return h}static summary="Applies JSON overrides to a theme and returns a preview URL.";static descriptionWithMarkdown="Applies a JSON overrides file to a theme and creates or updates a preview. This lets you quickly preview changes.\n\n  The command returns a preview URL and a preview identifier. You can reuse the preview identifier with `--preview-id` to update an existing preview instead of creating a new one.";static description=this.descriptionForHelp();static flags={...g,...f,...E,theme:c.Flags.string({char:"t",description:"Theme ID or name of the remote theme.",env:"SHOPIFY_FLAG_THEME_ID"}),overrides:c.Flags.string({description:"Path to a JSON overrides file.",env:"SHOPIFY_FLAG_OVERRIDES"}),"preview-id":c.Flags.string({description:"An existing preview identifier to update instead of creating a new preview.",env:"SHOPIFY_FLAG_PREVIEW_ID"}),open:c.Flags.boolean({description:"Automatically launch the theme preview in your default web browser.",env:"SHOPIFY_FLAG_OPEN",default:!1}),json:c.Flags.boolean({...f.json,description:"Output the preview URL and identifier as JSON.",env:"SHOPIFY_FLAG_JSON",default:!1})};static multiEnvironmentsFlags=["store","password","theme","overrides"];async command(e,t,a=!1){let d=await x(t,{filter:{theme:e.theme}}),i=await L({adminSession:t,overrideJson:e.overrides,themeId:d.id.toString(),previewIdentifier:e["preview-id"],password:e.password}),o=e.json?"json":"text";return e.open&&await _(i.url).catch(v=>T(v))===!1&&T(new Error(`Could not open the browser. Open this URL manually: ${i.url}`)),(!a||!e.json)&&D(i,o,!!e["preview-id"]),i}renderEnvironmentResults(e){w(h.encode({environments:e}))}validateCommandFlags(e){if(!e.theme||!e.overrides)throw new s("Specify both --theme and --overrides, either as flags or in an environment.")}requiredFlagsForSingleEnvironment(e){return super.requiredFlagsForSingleEnvironment(e).filter(t=>t!=="store")}};export{F as a};

package/dist/chunk-I4OVLRQR.js

@@ -0,0 +1 @@
+import{a as $,c as M}from"./chunk-RVQV6G5M.js";import{d as N,f as Q,u as P}from"./chunk-OGWPS55W.js";import{a as C}from"./chunk-ZGV3HNEV.js";import{a as G,c as q}from"./chunk-FWB3GLMW.js";import{b as L}from"./chunk-AJMDF3QC.js";import{b as X,c as j}from"./chunk-H4V55Y3Z.js";import{b as J,c as R}from"./chunk-Q2SZCZE7.js";import{A as w,C as k,J as x}from"./chunk-CZ22VZDA.js";import{a as S}from"./chunk-BN7ZXAZJ.js";import{h as p}from"./chunk-2VSNFOKD.js";import{Sa as A,la as b,qb as m,sb as c,ta as E,wb as f}from"./chunk-LWCTKI4Z.js";import{b as a}from"./chunk-FZCGRIOM.js";import{e as y,g as O}from"./chunk-IWTNUJGY.js";import{e as K,g as i}from"./chunk-VKWPEFWQ.js";i();i();var V=K(X(),1);async function Y(o,e){if(o)try{return JSON.parse(o)}catch(r){let t=r instanceof Error?r.message:"Unknown error";throw new p(c`Invalid JSON in ${m.yellow("--variables")} flag: ${t}`,"Please provide valid JSON format.")}else if(e){if(!await A(e))throw new p(c`Variable file not found at ${m.path(e)}. Please check the path and try again.`);let r=await b(e,{encoding:"utf8"});try{return JSON.parse(r)}catch(t){let s=t instanceof Error?t.message:"Unknown error";throw new p(c`Invalid JSON in variable file ${m.path(e)}: ${s}`,"Please provide valid JSON format.")}}}async function F(o){let{remoteApp:e,store:r,query:t,variables:s,variableFile:h,version:U}=o,{adminSession:H,version:W}=await x({title:c`Authenticating`,task:async()=>{let n=await $(e,r.shopDomain),d=await Q({adminSession:n,userSpecifiedVersion:U});return{adminSession:n,version:d}},renderOptions:{stdout:process.stderr}}),B=await Y(s,h);N(t),M(t,r);try{let n;return{status:"success",result:{data:await x({title:c`Executing GraphQL operation`,task:async()=>L({query:(0,V.parse)(t),session:H,variables:B,version:W,responseOptions:{handleErrors:!1,onResponse:u=>{n=u.extensions}}}),renderOptions:{stdout:process.stderr}}),...n===void 0?{}:{extensions:n}}}}catch(n){if(n instanceof j){let{errors:d,extensions:u,data:v}=n.response;return{status:"failed",details:{...d===void 0?{}:{errors:d},...u===void 0?{}:{extensions:u},...v===void 0?{}:{data:v}}}}throw n}}i();var z=a.unknown().and(a.record(a.unknown())),I=a.object({data:z.nullable().describe("Native GraphQL query data, preserving fields and aliases."),extensions:z.optional().describe("Native GraphQL response extensions, when supplied.")}).strict(),D=a.object({path:a.string().refine(O,"Expected an absolute filesystem path."),format:a.literal("json")}).strict().describe("Receipt for a written JSON file containing the GraphQL result, including data and optional extensions."),l=S({name:"AppExecuteResult",schema:a.union([I,D]),definitions:{AppExecuteGraphQLResult:I,AppExecuteFileReceipt:D}});i();async function T(o,e,r){if(o.status==="failed"){if(e==="json"){let s=new p("GraphQL operation failed.");throw s.details=o.details,s}k({headline:"GraphQL operation failed.",body:JSON.stringify({errors:o.details.errors},null,2)});return}let t=e==="json"?l.encode(o.result):JSON.stringify(o.result.data,null,2);r?(await E(r,t),e==="json"?f(l.encode({path:y(r),format:"json"})):w({headline:"Operation succeeded.",body:`Results written to ${r}`})):e==="json"?f(t):(w({headline:"Operation succeeded."}),f(t))}var g=class o extends C{static summary="Execute GraphQL queries and mutations.";static descriptionWithMarkdown="Executes an Admin API GraphQL query or mutation on the specified store. Mutations are only allowed on dev stores.\n\n  For operations that process large amounts of data, use [`bulk execute`](https://shopify.dev/docs/api/shopify-cli/app/app-bulk-execute) instead.";static get jsonOutputSchema(){return l}static description=this.descriptionForHelp();static flags={...J,...G,...q,...R};async run(){let{flags:e}=await this.parse(o),{query:r,appContextResult:t,store:s}=await P(e),h=await F({organization:t.organization,remoteApp:t.remoteApp,store:s,query:r,variables:e.variables,variableFile:e["variable-file"],...e.version&&{version:e.version}});return await T(h,e.json?"json":"text",e["output-file"]),{app:t.app}}};export{g as a};

package/dist/{chunk-ENQXB532.js → chunk-I6FRVYGE.js}

@@ -1,2 +1,2 @@
-import{b as x,c as D,f as M}from"./chunk-F3PZGSOY.js";import{a as o}from"./chunk-XUUIBSLW.js";import{D as s,G as h,J as e,z as y}from"./chunk-47IQIIFX.js";import{d as w}from"./chunk-HILYTMVA.js";import{Kb as _,ya as u}from"./chunk-UWI76E2L.js";import{g as p}from"./chunk-VKWPEFWQ.js";p();async function $(){let a=new Date,n=`${a.getFullYear()}-${(a.getMonth()+1).toString().padStart(2,"0")}-${a.getDate().toString().padStart(2,"0")}`,i=w(),t=await s({message:"Type of message?",choices:[{label:"Info",value:"info"},{label:"Warning",value:"warning"},{label:"Error",value:"error"}]}),b=await e({message:"Title"}),E=await e({message:"Message"}),S=await s({message:"Frequency",choices:[{label:"Only once",value:"once"},{label:"Once a week",value:"once_a_week"},{label:"Once a day",value:"once_a_day"},{label:"Always",value:"always"}]}),r=await e({message:"Minimum CLI version (optional)",initialAnswer:o,allowEmpty:!0}),l=await e({message:"Maximum CLI version (optional)",initialAnswer:o,allowEmpty:!0}),m=await e({message:"Minimum date in YYYY-MM-DD format (optional)",initialAnswer:n,allowEmpty:!0}),c=await e({message:"Maximum date in YYYY-MM-DD format (optional)",initialAnswer:n,allowEmpty:!0}),f=await e({message:"Surface. E.g.: app, theme, hydrogen, theme_app_extension... (optional)",allowEmpty:!0}),g=await e({message:"Comma separated list of commands. E.g.: app:generate:extension (optional)",allowEmpty:!0}),T=await e({message:"Slack channel of the team who will own this notification"}),d=await x(),v={id:i,type:t,title:b,frequency:S,message:E,minVersion:r.length===0?void 0:r,maxVersion:l.length===0?void 0:l,minDate:m.length===0?void 0:m,maxDate:c.length===0?void 0:c,surface:f.length===0?void 0:f,commands:g.length===0?void 0:g.split(",").map(N=>N.trim()),ownerChannel:T};d.notifications.push(v),await u("./notifications.json",JSON.stringify(d)),y({headline:"notifications.json file updated successfully."})}async function j(){let a=await D(),n={type:{header:"Type",color:"dim"},title:{header:"Title",color:"dim"},message:{header:"Message",color:"dim"},filters:{header:"Filters",color:"dim"}},i=a.notifications.map(t=>({type:t.type,title:t.title??"",message:t.message,filters:M(t)}));h({rows:i,columns:n}),_(`
+import{b as x,c as D,f as M}from"./chunk-POKY4RWR.js";import{a as o}from"./chunk-4C2DAX5T.js";import{A as y,E as s,H as h,K as e}from"./chunk-CZ22VZDA.js";import{d as w}from"./chunk-335BUVBP.js";import{ta as u,yb as _}from"./chunk-LWCTKI4Z.js";import{g as p}from"./chunk-VKWPEFWQ.js";p();async function $(){let a=new Date,n=`${a.getFullYear()}-${(a.getMonth()+1).toString().padStart(2,"0")}-${a.getDate().toString().padStart(2,"0")}`,i=w(),t=await s({message:"Type of message?",choices:[{label:"Info",value:"info"},{label:"Warning",value:"warning"},{label:"Error",value:"error"}]}),b=await e({message:"Title"}),E=await e({message:"Message"}),S=await s({message:"Frequency",choices:[{label:"Only once",value:"once"},{label:"Once a week",value:"once_a_week"},{label:"Once a day",value:"once_a_day"},{label:"Always",value:"always"}]}),r=await e({message:"Minimum CLI version (optional)",initialAnswer:o,allowEmpty:!0}),l=await e({message:"Maximum CLI version (optional)",initialAnswer:o,allowEmpty:!0}),m=await e({message:"Minimum date in YYYY-MM-DD format (optional)",initialAnswer:n,allowEmpty:!0}),c=await e({message:"Maximum date in YYYY-MM-DD format (optional)",initialAnswer:n,allowEmpty:!0}),f=await e({message:"Surface. E.g.: app, theme, hydrogen, theme_app_extension... (optional)",allowEmpty:!0}),g=await e({message:"Comma separated list of commands. E.g.: app:generate:extension (optional)",allowEmpty:!0}),T=await e({message:"Slack channel of the team who will own this notification"}),d=await x(),v={id:i,type:t,title:b,frequency:S,message:E,minVersion:r.length===0?void 0:r,maxVersion:l.length===0?void 0:l,minDate:m.length===0?void 0:m,maxDate:c.length===0?void 0:c,surface:f.length===0?void 0:f,commands:g.length===0?void 0:g.split(",").map(N=>N.trim()),ownerChannel:T};d.notifications.push(v),await u("./notifications.json",JSON.stringify(d)),y({headline:"notifications.json file updated successfully."})}async function j(){let a=await D(),n={type:{header:"Type",color:"dim"},title:{header:"Title",color:"dim"},message:{header:"Message",color:"dim"},filters:{header:"Filters",color:"dim"}},i=a.notifications.map(t=>({type:t.type,title:t.title??"",message:t.message,filters:M(t)}));h({rows:i,columns:n}),_(`
 `)}export{$ as a,j as b};

package/dist/chunk-IEQ4UOH3.js

@@ -0,0 +1,4 @@
+import{a as he,b as fe,c as ge,d as _}from"./chunk-HCZG7YJ6.js";import{a as q}from"./chunk-V75WUEFU.js";import{a as pe}from"./chunk-NB4BRW3H.js";import{B as ne,C as S,D as se,F as oe,G as re,H as ce,I as ae,J as le,K as ue,L as de,M as m,O as y,P as k,Q as j,R as w,S as v,T as F,U as C,V as me,W as $,X as ye,Y as T,Z as R,_ as be,a as z,c as Q,d as D,g as X,i as Z,p as ee,t as te,u as ie}from"./chunk-LMQGNECW.js";import{b as K}from"./chunk-ZQDDRIBA.js";import{b as J,c as V}from"./chunk-Q2SZCZE7.js";import{A as M,B as p,C as Y,E as H,W as b,z as P}from"./chunk-CZ22VZDA.js";import{a as U}from"./chunk-BN7ZXAZJ.js";import{na as B,wb as g}from"./chunk-LWCTKI4Z.js";import{b as r}from"./chunk-FZCGRIOM.js";import{b as Ne}from"./chunk-YTUUU33R.js";import{f as d,p as W}from"./chunk-IWTNUJGY.js";import{e as Ge,g as a}from"./chunk-VKWPEFWQ.js";a();a();a();function Se(e,t){if(t==="none")return 0;let i=e.scan.issues.filter(n=>D[n.severity]>=D[t]);return new Set(i.map(n=>n.id)).size}async function ke({includeDirs:e,excludePatterns:t,noGitIgnore:i,...n}){let s=Date.now();return{...await Z(n,{includeDirs:e,excludePatterns:t,noGitIgnore:i}),elapsedMilliseconds:Date.now()-s}}function we({includeDirs:e,excludePatterns:t,noGitIgnore:i,...n}){return X(n,{includeDirs:e,excludePatterns:t,noGitIgnore:i})}var Oe={resolveSelection:oe,execute:ke,listFiles:we,writeArtifacts:ie,canPrompt:b,recordMetadata:pe};async function G(e,t=Oe){let i=await re(e.includeDirs),n=await t.resolveSelection({path:e.directory,config:e.configName,clientId:e.clientId,withoutAppConfig:e.withoutAppConfig,allowPrompts:!e.listFiles&&t.canPrompt(),validateClientIdFlag:!0});if(n.kind==="declined")return{kind:"cancelled"};let{appDirectory:s}=n,o={include_dirs:[...e.includeDirs],excludes:[...e.excludePatterns],no_git_ignore:e.noGitIgnore},c=le(n,e.directory,o);(n.kind==="no-config"?!e.withoutAppConfig:n.appConfigFilePicked===!0)&&e.onSelectionPrompted?.(c);let I=n.kind==="config"?n.appConfigDirectories??[]:[],{scanDirectories:x,requestedScanDirectories:Te}=ce(s,i,I),A={selection:n,resultsKey:se(n),commands:c,scope:o,scanDirectories:x},L={appDirectory:s,scanDirectories:x.map(({directory:u})=>u),requestedScanDirectories:Te,appConfigDirectories:x.filter(({origin:u})=>u==="app_config_directory").map(({directory:u})=>u),appConfigFilePath:n.kind==="config"?n.appConfigFilePath:void 0,clientId:S(n),includeDirs:e.includeDirs,excludePatterns:e.excludePatterns,noGitIgnore:e.noGitIgnore};if(e.listFiles){let u=await t.listFiles(L);return{kind:"listed",...A,...u}}let f=await t.execute(L);await t.recordMetadata({num_security_findings:f.scan.issues.length});let Re=await t.writeArtifacts(s,A.resultsKey,{deterministicFindings:f.deterministicFindings,agentChecks:f.agentChecks});return{kind:"scanned",...A,execution:f,artifacts:Re,blocking:{level:e.blocking,blockedChecks:Se(f,e.blocking)}}}a();a();var ve=r.object({status:r.literal("success"),app:k,scope:w,scanDirectories:r.array(v).describe("The directories that a scan would walk."),files:r.array(r.object({path:y().describe("The absolute path of the file.")}).strict()).describe("The files that a scan would gather, ordered by their paths relative to the app directory, as listed without --json.")}).strict().describe("With --list-files, the files that a scan would gather. Nothing is scanned or written."),h=U({name:"AppSecurityCheckResult",schema:r.union([r.object({status:r.literal("success"),valid:r.boolean().describe("Whether --blocking passed: no finding of the scan has its own severity at or above the level. blocking.blockedCheckCount counts the checks with such findings, and --blocking none always passes. Run review --json for the findings."),app:k,resultsDirectory:y().describe("The absolute path of the results directory that holds the files the scan wrote."),deterministicFindingsPath:y().describe("The absolute path of deterministic-findings.json, which the scan replaced."),agentChecksPath:y().describe("The absolute path of agent-checks.json, which the scan replaced."),scope:w,scanDirectories:r.array(v).describe("The directories that the scan walked."),agentCheckCount:r.number().int().nonnegative().describe("The number of checks in agent-checks.json for a coding agent to investigate."),blocking:F,instructions:j.optional().describe("The coding-agent instructions for this scan, with --print-instructions or when chosen at the prompt. Left out otherwise.")}).strict(),ve,r.object({status:r.literal("cancelled")}).strict().describe("Asked whether to scan without app configuration, the user declined. Nothing was scanned or written.")]).describe("The scan and the files it wrote. With --list-files, the files that a scan would gather."),definitions:{AppSecurityApp:k,AppSecurityScope:w,AppSecurityScanDirectory:v,AppSecurityBlocking:F,AppSecurityInstructions:j,AppSecurityCheckFileList:ve}});a();var Ee={high:"High",medium:"Medium",low:"Low"},N=3,O=8;function Le(e){let t=Ue(e),i=ee(e.scan.issues);return{type:t,options:{headline:We(e,i),body:Be(e),reference:[{subdued:`Engine: ${e.engine.name} ${e.engine.version}`},{subdued:`Ruleset: ${e.engine.ruleset}`},...i.some(n=>n.issues.length>1)&&!e.verbose?[{subdued:"Use --verbose for every occurrence and fix. deterministic-findings.json retains all file and line details."}]:[]],customSections:Ke(e,i)}}}function Ce(e){let{type:t,options:i}=Le(e);if(t==="success"){M(i);return}if(t==="warning"){p(i);return}Y(i)}function Ie(e){return e.scan.scan.coverage_gaps.length>0}function Ue(e){return e.scan.issues.some(t=>t.severity==="high")?"error":e.scan.issues.length>0||Ie(e)?"warning":"success"}function We(e,t){let i=e.scan.issues.length;return t.length<i?`${t.length} security issue ${t.length===1?"group":"groups"} found (${i} occurrences).`:i>0?`${i} security ${i===1?"issue":"issues"} found.`:Ie(e)?"Scan completed with coverage gaps.":"No security issues found."}function Be(e){let t=e.scan,i=[{userInput:t.app.name},{char:"."},`${t.scan.files_scanned} files scanned in ${ze(e.elapsedMilliseconds)}.`],n=t.scan.checks_executed.filter(s=>s.status==="not_applicable").length;return n>0&&i.push({info:`
+${n} check${n===1?"":"s"} not applicable.`}),i.push({info:`
+${e.agentCheckCount} check${e.agentCheckCount===1?"":"s"} ready for your coding agent.`}),i}function Me(e){return[["Have your coding agent run the agent checks"],["Record the agent results with",{command:m(e.commands.record)}],["Review the results with",{command:m(e.commands.review)}]]}function Ye(e){let t=S(e)??"not linked";return e.kind==="config"&&e.clientIdOverride?`${t} (from --client-id)`:t}function He(e){let{selection:t}=e;return{title:"Selection",body:{tabularData:[["App directory",t.appDirectory],["Config file",ne(t)??"none"],["Client ID",Ye(t)],["Scan directories",e.scanDirectories.map(({directory:i})=>d(t.appDirectory,i)||".").join(", ")]],firstColumnSubdued:!0}}}function Ke(e,t){let i=[He(e)];for(let s of["high","medium","low"]){let o=t.filter(c=>c.severity===s);o.length!==0&&i.push({title:Ee[s],body:{list:{items:o.flatMap(c=>[Ve(c),...e.verbose?c.issues.map(Je):[]])}}})}if(e.scan.scan.coverage_gaps.length>0){let s=e.scan.scan.coverage_gaps,o=s.slice(0,O).map(c=>c.message);s.length>O&&o.push({info:`${s.length-O} more coverage gaps`}),i.push({title:"Coverage gaps",body:{list:{items:o}}})}let{appDirectory:n}=e.selection;return i.push({title:"Artifacts",body:{list:{items:[["Deterministic findings:",{filePath:d(n,e.deterministicFindingsPath)}],["Agent security check instructions:",{filePath:d(n,e.agentChecksPath)}]]}}}),i.push({title:"Next steps",body:{list:{items:Me(e),ordered:!0}}}),e.verbose&&i.push({title:"Scan details",body:{tabularData:[["Framework",e.scan.detection.framework],["Surface",e.scan.detection.surface],["Languages",e.scan.detection.languages.map(s=>`${s.name} (${s.support})`).join(", ")||"none"],["Capabilities",qe(e.scan.capabilities)],["Rules run",String(e.scan.scan.rules_run)],["Not run",String(e.scan.scan.rules_skipped)]],firstColumnSubdued:!0}}),i}function Je(e){let t=e.location.line?`${e.location.file}:${e.location.line}`:e.location.file,i=[{bold:e.title},xe(e.id),{filePath:t}];return i.push({subdued:e.message},{subdued:`Fix: ${e.fix.description}`}),e.fix.guide&&(e.fix.guide.startsWith("https://")||e.fix.guide.startsWith("http://")?i.push({link:{label:"Guide",url:e.fix.guide}}):i.push({subdued:`Guide: ${e.fix.guide}`})),e.snippet&&i.push({subdued:`Code: ${e.snippet}`}),i}function Ve(e){let t=e.issues[0],i=e.issues.length,n=e.files.length,s=e.files.slice(0,N).map(o=>{let c=e.issues.find(I=>I.location.file===o);return{filePath:c.location.line?`${o}:${c.location.line}`:o}});return[{bold:t.title},xe(t.id),`${i} ${i===1?"occurrence":"occurrences"} across ${n} ${n===1?"file":"files"}`,...s,...n>N?[{subdued:`+${n-N} more files`}]:[]]}function xe(e){let t=Q(e);return t?{link:{label:e,url:t}}:{subdued:e}}function qe(e){let t=Object.entries(e).filter(([,i])=>i).map(([i])=>i);return t.length>0?t.join(", "):"none detected"}function ze(e){return e<1e3?`${Math.round(e)}ms`:`${(e/1e3).toFixed(1)}s`}var Qe={canPrompt:b,selectInstructionsDestination:e=>H(e)};function Xe(e,t){return{message:`${e} recommended agent ${e===1?"check":"checks"} available to complete your scan. How do you want to pass that prompt to your agent?`,choices:t==="json"?[{label:"Include instructions in the JSON output and copy them to the clipboard",value:"copy"},{label:"Include instructions in the JSON output",value:"print"},{label:"Nothing",value:"nothing"}]:[{label:"Copy instructions to the clipboard",value:"copy"},{label:"Print instructions to the terminal",value:"print"},{label:"Nothing",value:"nothing"}],defaultValue:"copy"}}function Pe(e){P({headline:"To skip these prompts next time, run:",body:[{command:m(e.scan)}]})}async function De(e,t,i,n=Qe){if(e.kind==="cancelled"){if(i==="json")g(h.encode({status:"cancelled"}));else{let{headline:s,nextStep:o}=ae(t.directory);P({headline:s,body:o})}return}if(e.kind==="listed"){await Ae(e),i==="json"?g(h.encode(it(e))):e.paths.length>0&&g(e.paths.join(`
+`));return}await Ae(e.execution),i==="json"?await et(e,t,n):await Ze(e,t,n),e.blocking.blockedChecks>0&&(process.exitCode=1)}async function Ze(e,t,i){Ce(nt(e,t.verbose));let n=await Fe(e,t,"text",i);if(n==="nothing")return;let s=_e(e);n==="print"?_(s,{copy:!1}):await je(s,"text")&&_(s,{copy:!0})}async function et(e,t,i){let n=await Fe(e,t,"json",i),s=n==="nothing"?void 0:_e(e),o=s!==void 0&&n==="copy"&&await je(s,"json");g(h.encode(tt(e,s===void 0?void 0:ye(s,{copy:o}))))}async function je(e,t){try{return await ge(e,{copy:!0}),!0}catch(i){if(!(i instanceof he))throw i;return p({headline:i.message,body:t==="json"?"The result still includes them.":["Run the check again with",{command:"--print-instructions"},"to print them."]}),!1}}async function Fe(e,t,i,n){return t.skipInstructions?"nothing":t.printInstructions?"print":n.canPrompt()?n.selectInstructionsDestination(Xe(e.execution.agentChecks.checks.length,i)):"nothing"}function _e(e){return fe({appDirectory:e.selection.appDirectory,resultsKey:e.resultsKey,commands:e.commands,scanScope:e.scope})}function tt(e,t){let{appDirectory:i}=e.selection,{resultsDirectory:n}=te(i,e.resultsKey);return{status:"success",valid:e.blocking.blockedChecks===0,app:$(e.selection),resultsDirectory:C(n),deterministicFindingsPath:C(e.artifacts.deterministicFindingsPath),agentChecksPath:C(e.artifacts.agentChecksPath),scope:T(e.scope),scanDirectories:e.scanDirectories.map(s=>R(i,s)),agentCheckCount:e.execution.agentChecks.checks.length,blocking:be(e.blocking),...t===void 0?{}:{instructions:t}}}function it(e){let{appDirectory:t}=e.selection;return{status:"success",app:$(e.selection),scope:T(e.scope),scanDirectories:e.scanDirectories.map(i=>R(t,i)),files:e.paths.map(i=>({path:me(t,i)}))}}function nt(e,t){let{execution:i,artifacts:n}=e;return{scan:i.scan,selection:e.selection,scanDirectories:e.scanDirectories,engine:i.engine,verbose:t,elapsedMilliseconds:i.elapsedMilliseconds,commands:e.commands,deterministicFindingsPath:n.deterministicFindingsPath,agentChecksPath:n.agentChecksPath,agentCheckCount:i.agentChecks.checks.length}}function st(e){return e.replace(/[?*()[\]{}!#\\]/g,"\\$&")}async function Ae(e){if(e.ignoredScanDirectories.length===0&&e.otherAppDirectories.length===0)return;let t=await B(W()),i=n=>d(t,n)||".";for(let n of e.ignoredScanDirectories)p({headline:`${i(n)} is ignored by Git, so only the files Git tracks in it are scanned.`,body:["Use",{command:"--no-git-ignore"},"to scan everything in it."]});for(let n of e.otherAppDirectories){let s=i(n);p({headline:`${s} holds another app's configuration, so its files are scanned as part of this app.`,body:["Use",{command:`--exclude ${de(st(s),ue())}`},"to leave it out."]})}}var l=Ge(Ne(),1);var E=class e extends K{static summary="Check an app for Shopify-specific security issues and write deterministic-findings.json and agent-checks.json.";static descriptionWithMarkdown="Runs an app security check locally and writes `deterministic-findings.json` and `agent-checks.json` to the results directory, `.shopify/app-security/<results key>/`. The results key is `--client-id` when you pass it, and otherwise the name of the app configuration file without `.toml`; the other `app security` commands take the same selection flags and find the same directory. Every run replaces both files, so it's always safe to run the check again.\n\n`deterministic-findings.json` holds the deterministic scan results. `agent-checks.json` holds the checks for your coding agent to investigate; the agent's results are recorded with `shopify app security record`. Use `--config` to select a specific app configuration when the project has multiple `shopify.app*.toml` files; the check inspects only that configuration. Use `--client-id` to replace the configuration's client ID for this run. `--client-id` is checked against your Shopify account before anything is scanned, so it needs you to be logged in. When no app configuration exists, use `--without-app-config --client-id <client-id>` to scan `--path` anyway with config checks skipped; in an interactive terminal the command offers to do this.\n\nThe check scans the app directory and each `--include-dir`. Git ignore rules apply by default: a file or directory that Git ignores is skipped, using the rules of the repository that contains it, while files that Git tracks are always scanned. Use `--no-git-ignore` to turn Git ignore rules off for every scanned directory. When the check uses Git, it requires Git 2.38.0 or later.\n\nUse `--exclude` to skip more paths. Each value is a glob that is matched against the path relative to the working directory, so a path above it starts with `../`, and a name at any depth needs `**/`, for example `--exclude '**/generated'`. Repeat the flag to add globs. An exclusion can't remove the selected app configuration file. Quote each value so your shell doesn't expand `*`. The coding-agent instructions this check offers repeat the globs. Other `app security` commands don't take `--exclude` or `--no-git-ignore`, so pass the same flags each time you run the check.\n\nUse `--list-files` to check the scope before scanning: it prints the files the check would gather, one path per line and relative to the app directory, and then stops. It writes no results and never prompts. `--client-id` is still checked, but doesn't change the list. With `--json`, the result lists the files with absolute paths.\n\nIn interactive terminals, the command offers to copy the coding-agent instructions, print them, or choose nothing; copying is the default. In CI and other non-interactive environments, instructions aren't offered unless you pass `--print-instructions`, which prints them. You can also run `shopify app security instructions` to print, copy, or write them later. With `--json`, the command offers to include the instructions in the result, with or without copying them, and `--print-instructions` includes them.\n\nWith `--json`, the result describes the scan and the files it wrote, and whether `--blocking` passed, but not the findings: run `shopify app security review --json` for those.\n\nReports the number of findings to Shopify as usage telemetry, but not finding details. See [usage reporting](https://shopify.dev/docs/api/shopify-cli#usage-reporting) for details.";static get jsonOutputSchema(){return h}static description=this.descriptionForHelp();static examples=["<%= config.bin %> <%= command.id %>","<%= config.bin %> <%= command.id %> --include-dir ../backend","<%= config.bin %> <%= command.id %> --path extensions --config production --include-dir .","<%= config.bin %> <%= command.id %> --without-app-config --client-id <client-id>",'<%= config.bin %> <%= command.id %> --path app --include-dir . --exclude marketing --exclude "**/generated"',"<%= config.bin %> <%= command.id %> --no-git-ignore --exclude local-data","<%= config.bin %> <%= command.id %> --include-dir ../backend --list-files"];static flags={...J,...z,"include-dir":l.Flags.string({description:"Also scan this directory, relative to the working directory. Repeat the flag to add directories. Use it for code that lives outside the app directory, such as a backend or a shared library.",multiple:!0}),exclude:l.Flags.string({description:"Skip paths that match this glob, relative to the working directory. Repeat the flag to add globs. The selected app configuration file can't be excluded.",multiple:!0}),"no-git-ignore":l.Flags.boolean({description:"Turn off Git ignore rules for every scanned directory, so files that Git ignores are scanned too. Files that Git tracks are always scanned.",env:"SHOPIFY_FLAG_NO_GIT_IGNORE"}),"list-files":l.Flags.boolean({description:"Print the files the check would gather, one path per line, and stop. Nothing is scanned, no results are written, and nothing is prompted for. With --json, the result lists them with absolute paths.",env:"SHOPIFY_FLAG_LIST_FILES",exclusive:["print-instructions","skip-instructions","blocking"]}),...q,"print-instructions":l.Flags.boolean({description:"Print coding-agent instructions without prompting for how to deliver them. With --json, the instructions are included in the result.",default:!1,exclusive:["skip-instructions"],env:"SHOPIFY_FLAG_APP_SECURITY_PRINT_INSTRUCTIONS"}),yes:l.Flags.boolean({description:"Print coding-agent instructions without prompting.",hidden:!0,deprecated:{to:"--print-instructions"},exclusive:["skip-instructions","list-files"],env:"SHOPIFY_FLAG_YES"}),"skip-instructions":l.Flags.boolean({description:"Don't offer the coding-agent instructions after the scan. Use it when you want only the deterministic scan results.",default:!1,exclusive:["print-instructions"],env:"SHOPIFY_FLAG_APP_SECURITY_SKIP_INSTRUCTIONS"}),...V};async run(){let{flags:t}=await this.parse(e),i=await G({directory:t.path,configName:t.config,clientId:t["client-id"],withoutAppConfig:!!t["without-app-config"],blocking:t.blocking,includeDirs:t["include-dir"]??[],excludePatterns:t.exclude??[],noGitIgnore:!!t["no-git-ignore"],listFiles:!!t["list-files"],onSelectionPrompted:Pe});await De(i,{directory:t.path,verbose:!!t.verbose,printInstructions:!!(t["print-instructions"]||t.yes),skipInstructions:t["skip-instructions"]},t.json?"json":"text")}};export{E as a};