@shopify/create-app 4.9.1 → 4.9.3

package/dist/index.js

@@ -4,7 +4,7 @@ import {
   decodeToml,
   loadEnvironment,
   require_toml_patch
-} from "./chunk-XTW7GZNX.js";
+} from "./chunk-N5WBV6WX.js";
 import {
   require_normalize_path
 } from "./chunk-RIQNGBMO.js";
@@ -15,7 +15,7 @@ import {
 import {
   setCurrentCommandId,
   showNotificationsIfNeeded
-} from "./chunk-XE2VSA7J.js";
+} from "./chunk-YGIFL56H.js";
 import {
   ClientError,
   DevServerCore,
@@ -81,7 +81,7 @@ import {
   setPathValue,
   shopifyFetch,
   storeAdminUrl
-} from "./chunk-XIVTHG4G.js";
+} from "./chunk-5H43E2UF.js";
 import {
   setNextDeprecationDate
 } from "./chunk-MSED5ZFM.js";
@@ -103,26 +103,26 @@ import {
   usesWorkspaces,
   versionSatisfies,
   writePackageJSON
-} from "./chunk-AIZTGQJR.js";
+} from "./chunk-HAZKL7NQ.js";
 import {
   import_websocket_server
 } from "./chunk-LDYT4FTV.js";
 import "./chunk-FKZ3NFHZ.js";
 import {
   CLI_KIT_VERSION
-} from "./chunk-6OYK2NCF.js";
+} from "./chunk-MA5EMKMH.js";
 import "./chunk-G53O4PDO.js";
 import {
   LocalStorage,
   require_ajv,
   runAtMinimumInterval,
   serviceEnvironment
-} from "./chunk-IGYLFVSH.js";
+} from "./chunk-CJUEOAXA.js";
 import {
   globalCLIVersion,
   isPreReleaseVersion,
   localCLIVersion
-} from "./chunk-GXCPTCSE.js";
+} from "./chunk-QIGNQLSJ.js";
 import {
   AbortController as AbortController2,
   Alert,
@@ -170,10 +170,10 @@ import {
   use_input_default,
   use_stdin_default,
   use_stdout_default
-} from "./chunk-63WOEPSQ.js";
+} from "./chunk-U53ZNKER.js";
 import {
   runWithCommandEventsForCommand
-} from "./chunk-7NOX742S.js";
+} from "./chunk-T2OHLRUY.js";
 import {
   execa,
   isStream,
@@ -186,14 +186,14 @@ import {
   require_signal_exit,
   stripFinalNewline,
   username
-} from "./chunk-27YRBZHB.js";
+} from "./chunk-GXR6N3MP.js";
 import "./chunk-JGGOQOPO.js";
 import {
   addPublicMetadata,
   addSensitiveMetadata,
   createRuntimeMetadataContainer,
   runWithTimer
-} from "./chunk-DC6ZFOVX.js";
+} from "./chunk-HT6VPO56.js";
 import {
   fileHash,
   getAppAutomationToken,
@@ -206,20 +206,20 @@ import {
 } from "./chunk-SHCNJ47P.js";
 import {
   defineJsonOutputSchema
-} from "./chunk-WXRXVG7I.js";
+} from "./chunk-N46TBZG5.js";
 import "./chunk-CM6ALOD7.js";
 import {
   AbortError,
   AbortSilentError,
   BugError,
   CancelExecution
-} from "./chunk-EJPPP2UR.js";
+} from "./chunk-GI3EXDGY.js";
 import {
   waitForPostRunHookAndExit
-} from "./chunk-U5GH53OY.js";
+} from "./chunk-7U2D7OQY.js";
 import {
   treeKill
-} from "./chunk-37A2FHUG.js";
+} from "./chunk-KFK6UTCG.js";
 import {
   appendFile,
   asHumanFriendlyArray,
@@ -316,7 +316,7 @@ import {
   unstyled,
   writeFile,
   writeFileSync
-} from "./chunk-7RUPPYI4.js";
+} from "./chunk-ZWNY6NQH.js";
 import {
   codespacePortForwardingDomain,
   codespaceURL,
@@ -330,7 +330,7 @@ import {
   isUnitTest,
   isVerbose,
   noInputFlag
-} from "./chunk-QWRYHKCI.js";
+} from "./chunk-R6VAFEZ5.js";
 import {
   environmentVariables,
   themeKitAccessDomain
@@ -203943,7 +203943,7 @@ var import_core2 = __toESM(require_lib()), BaseCommand = class extends import_co
   }
   async catch(error) {
     error.skipOclifErrorHandling = !0;
-    let { errorHandler } = await import("./error-handler-LQ3ZDIBZ.js");
+    let { errorHandler } = await import("./error-handler-DRCELNRR.js");
     return await errorHandler(error, this.config), import_core2.Errors.handle(error);
   }
   async _run() {
@@ -203951,11 +203951,11 @@ var import_core2 = __toESM(require_lib()), BaseCommand = class extends import_co
   }
   async init() {
     if (this.exitWithTimestampWhenEnvVariablePresent(), setCurrentCommandId(this.id ?? ""), !isDevelopment()) {
-      let { registerCleanBugsnagErrorsFromWithinPlugins } = await import("./error-handler-LQ3ZDIBZ.js");
+      let { registerCleanBugsnagErrorsFromWithinPlugins } = await import("./error-handler-DRCELNRR.js");
       await registerCleanBugsnagErrorsFromWithinPlugins(this.config);
     }
     await removeDuplicatedPlugins(this.config), this.showNpmFlagWarning();
-    let { showNotificationsIfNeeded: showNotificationsIfNeeded2 } = await import("./notifications-system-45UW7RPJ.js");
+    let { showNotificationsIfNeeded: showNotificationsIfNeeded2 } = await import("./notifications-system-244NM3IW.js");
     return await showNotificationsIfNeeded2(), super.init();
   }
   // NPM creates an environment variable for every flag passed to a script.
@@ -203963,7 +203963,7 @@ var import_core2 = __toESM(require_lib()), BaseCommand = class extends import_co
   // and warns the user to use the `--` separator.
   showNpmFlagWarning() {
     let commandVariables = this.constructor;
-    Object.keys(commandVariables.flags || {}).map((key) => `npm_config_${underscore(key).replace(/^no_/, "")}`).some((flag) => process.env[flag] !== void 0) && import("./ui-KEWWVBIJ.js").then(({ renderWarning: renderWarning2 }) => {
+    Object.keys(commandVariables.flags || {}).map((key) => `npm_config_${underscore(key).replace(/^no_/, "")}`).some((flag) => process.env[flag] !== void 0) && import("./ui-DVZCQR62.js").then(({ renderWarning: renderWarning2 }) => {
       renderWarning2({
         body: [
           "NPM scripts require an extra",
@@ -204012,7 +204012,7 @@ ${explanation} in non-interactive terminal environments, such as a CI environmen
     let flags = originalResult.flags, environmentsFileName = this.environmentsFilename();
     if (!environmentsFileName)
       return originalResult;
-    let { environmentFilePath } = await import("./environments-4D4TK7F7.js"), environmentFileExists = await environmentFilePath(environmentsFileName, { from: flags.path }), environments = [];
+    let { environmentFilePath } = await import("./environments-L53AHQLZ.js"), environmentFileExists = await environmentFilePath(environmentsFileName, { from: flags.path }), environments = [];
     flags.environment && (environments = Array.isArray(flags.environment) ? flags.environment : [flags.environment]);
     let environmentSpecified = environments.length > 0;
     if (!environmentFileExists && !environmentSpecified || environmentSpecified && environments.length > 1)
@@ -204033,7 +204033,7 @@ ${explanation} in non-interactive terminal environments, such as a CI environmen
    * is specified it will try to load a default environment.
    */
   async loadEnvironmentForCommand(path4, environmentsFileName, specifiedEnvironment) {
-    let { loadEnvironment: loadEnvironment2 } = await import("./environments-4D4TK7F7.js");
+    let { loadEnvironment: loadEnvironment2 } = await import("./environments-L53AHQLZ.js");
     return specifiedEnvironment ? { environment: await loadEnvironment2(specifiedEnvironment, environmentsFileName, { from: path4 }), isDefaultEnvironment: !1 } : { environment: await loadEnvironment2("default", environmentsFileName, { from: path4, silent: !0 }), isDefaultEnvironment: !0 };
   }
 };
@@ -204056,7 +204056,7 @@ function reportEnvironmentApplication(noDefaultsFlags, flagsWithEnvironments, en
   if (Object.keys(changes).length === 0)
     return;
   let items = Object.entries(changes).map(([name, value]) => `${name}: ${value}`);
-  import("./ui-KEWWVBIJ.js").then(({ renderInfo: renderInfo2 }) => {
+  import("./ui-DVZCQR62.js").then(({ renderInfo: renderInfo2 }) => {
     renderInfo2({
       headline: ["Using applicable flags from", { userInput: environmentName }, "environment:"],
       body: [{ list: { items } }]
@@ -204107,7 +204107,7 @@ async function removeDuplicatedPlugins(config2) {
   let plugins = Array.from(config2.plugins.values()), bundlePlugins = ["@shopify/app", "@shopify/plugin-cloudflare"], pluginsToRemove = plugins.filter((plugin) => bundlePlugins.includes(plugin.name));
   if (pluginsToRemove.length > 0) {
     let commandsToRun = pluginsToRemove.map((plugin) => `  - shopify plugins remove ${plugin.name}`).join(`
-`), { renderWarning: renderWarning2 } = await import("./ui-KEWWVBIJ.js");
+`), { renderWarning: renderWarning2 } = await import("./ui-DVZCQR62.js");
     renderWarning2({
       headline: `Unsupported plugins detected: ${pluginsToRemove.map((plugin) => plugin.name).join(", ")}`,
       body: [
@@ -204129,20 +204129,20 @@ init_cjs_shims();
 init_cjs_shims();
 import { fileURLToPath as fileURLToPath2 } from "node:url";
 async function launchCLI(options) {
-  let { isDevelopment: isDevelopment2 } = await import("./local-EVID5OFN.js"), { ShopifyConfig } = await import("./custom-oclif-loader-GXZPW6CV.js"), oclifModule = await import("./lib-NYDMHWZM.js"), { run, flush, Errors: Errors2, settings } = oclifModule.default ?? oclifModule;
+  let { isDevelopment: isDevelopment2 } = await import("./local-YQI64EPC.js"), { ShopifyConfig } = await import("./custom-oclif-loader-Q7GRLCIZ.js"), oclifModule = await import("./lib-NYDMHWZM.js"), { run, flush, Errors: Errors2, settings } = oclifModule.default ?? oclifModule;
   isDevelopment2() && (settings.debug = !0);
   try {
     let config2 = new ShopifyConfig({ root: fileURLToPath2(options.moduleURL) });
     await config2.load(), options.lazyCommandLoader && config2.setLazyCommandLoader(options.lazyCommandLoader);
     let argv = options.argv ?? process.argv.slice(2), passthroughIndex = argv.indexOf("--");
     if ((passthroughIndex === -1 ? argv : argv.slice(0, passthroughIndex)).includes("--json-schema") || isTruthy(process.env.SHOPIFY_FLAG_JSON_SCHEMA)) {
-      let { printCommandJsonSchema } = await import("./command-json-schema-NKZVCRA4.js");
+      let { printCommandJsonSchema } = await import("./command-json-schema-RCC6ZVRF.js");
       await printCommandJsonSchema(config2, argv, options.lazyCommandLoader);
       return;
     }
     await run(argv, config2), await flush();
   } catch (error) {
-    let { errorHandler } = await import("./error-handler-LQ3ZDIBZ.js");
+    let { errorHandler } = await import("./error-handler-DRCELNRR.js");
     await errorHandler(error);
     let handledError = error;
     return Errors2.handle({
@@ -204160,7 +204160,7 @@ var import_core3 = __toESM(require_lib());
 async function exitIfOldNodeVersion(versions2 = process.versions) {
   let nodeVersion = versions2.node, nodeMajorVersion = Number(nodeVersion.split(".")[0]);
   if (nodeMajorVersion < 22) {
-    let { renderError: renderError2 } = await import("./ui-KEWWVBIJ.js");
+    let { renderError: renderError2 } = await import("./ui-DVZCQR62.js");
     renderError2({
       headline: "Upgrade to a supported Node version now.",
       body: [
@@ -204187,7 +204187,7 @@ async function runCLI(options, launchCLI2 = launchCLI, argv = process.argv, env2
   return setupEnvironmentVariables(options, argv, env2), options.runInCreateMode && await addInitToArgvWhenRunningCreateCLI(options, argv), forceNoColor(argv, env2), await exitIfOldNodeVersion(versions2), launchCLI2({ moduleURL: options.moduleURL, lazyCommandLoader: options.lazyCommandLoader });
 }
 async function addInitToArgvWhenRunningCreateCLI(options, argv = process.argv) {
-  let { findUpAndReadPackageJson: findUpAndReadPackageJson2 } = await import("./node-package-manager-BLIC3IFC.js"), { moduleDirectory: moduleDirectory2 } = await import("./path-2KZ7FSGN.js"), name = (await findUpAndReadPackageJson2(moduleDirectory2(options.moduleURL))).content.name.replace("@shopify/create-", "");
+  let { findUpAndReadPackageJson: findUpAndReadPackageJson2 } = await import("./node-package-manager-GY7LMT5D.js"), { moduleDirectory: moduleDirectory2 } = await import("./path-2KZ7FSGN.js"), name = (await findUpAndReadPackageJson2(moduleDirectory2(options.moduleURL))).content.name.replace("@shopify/create-", "");
   if (argv.findIndex((arg) => arg.includes("init")) === -1) {
     let initIndex2 = argv.findIndex((arg) => arg.match(new RegExp(`bin(\\/|\\\\)+(create-${name}|dev|run)`))) + 1;
     argv.splice(initIndex2, 0, "init");
@@ -217373,7 +217373,7 @@ init_cjs_shims();
 
 // ../cli-kit/dist/public/node/liquid.js
 init_cjs_shims();
-var import_liquidjs = __toESM(require_liquid_node(), 1);
+var import_liquidjs = __toESM(require_liquid_node());
 function renderLiquidTemplate(templateContent, data) {
   let engine = new import_liquidjs.Liquid();
   return engine.render(engine.parse(templateContent), data);
@@ -220472,7 +220472,7 @@ init_cjs_shims();
 init_cjs_shims();
 var import_core29 = __toESM(require_lib(), 1), blockingLevels = ["high", "medium", "low", "none"], appSecurityBlockingFlag = {
   blocking: import_core29.Flags.custom({
-    description: "The minimum finding severity that causes a non-zero exit code.",
+    description: "The minimum finding severity that causes a non-zero exit code: high, medium, or low. Defaults to none, which never fails on findings.",
     options: blockingLevels,
     default: "none",
     env: "SHOPIFY_FLAG_APP_SECURITY_BLOCKING"
@@ -220595,7 +220595,7 @@ Do not report:
 `,
   `---
 id: APP_PROXY_LIQUID_INJECTION
-version: 2
+version: 3
 severity: high
 precedence: prefer-agent
 ---
@@ -220700,10 +220700,10 @@ Do not report:
 - Protocol-only canonicalization concerns with no demonstrated app-local exploit path
 - Test handlers
 `,
-  "---\nid: COMMITTED_SECRET\nversion: 3\nseverity: high\nprecedence: union\n---\n\n# Committed Secret\n\nInspect files skipped by deterministic secret scanning for committed credentials. Never quote or reproduce a secret; cite only the file and redacted credential kind, and recommend rotation.\n\nDo not report placeholders, public client identifiers (`SHOPIFY_API_KEY`, Stripe `pk_`), or files git confirms are untracked and ignored. Template env files (`.env.example`, `.sample`, `.template`, `.dist`) are findings only when they contain a known credential format.\n",
+  "---\nid: COMMITTED_SECRET\nversion: 4\nseverity: high\nprecedence: union\n---\n\n# Committed Secret\n\nInspect files skipped by deterministic secret scanning for committed credentials. Never quote or reproduce a secret; cite only the file and redacted credential kind, and recommend rotation.\n\nDo not report placeholders, public client identifiers (`SHOPIFY_API_KEY`, Stripe `pk_`), or files git confirms are untracked and ignored. Template env files (`.env.example`, `.sample`, `.template`, `.dist`) are findings only when they contain a known credential format.\n",
   `---
 id: CREDENTIAL_BROWSER_LEAKAGE
-version: 1
+version: 2
 severity: high
 precedence: prefer-agent
 ---
@@ -220714,7 +220714,7 @@ Trace credentials, access tokens, session tokens, and client secrets into loader
 `,
   `---
 id: CREDENTIAL_LOG_LEAKAGE
-version: 1
+version: 2
 severity: high
 precedence: prefer-agent
 ---
@@ -221025,7 +221025,7 @@ Do not report:
 `,
   `---
 id: DEPRECATED_SCRIPT_TAG_SCOPE
-version: 1
+version: 2
 severity: medium
 precedence: prefer-agent
 ---
@@ -221036,7 +221036,7 @@ Inspect parsed app scopes and JavaScript/TypeScript Admin API operations for dep
 `,
   `---
 id: EOL_API_VERSION
-version: 1
+version: 2
 severity: low
 precedence: prefer-agent
 ---
@@ -221045,7 +221045,7 @@ precedence: prefer-agent
 
 Inspect the selected \`shopify.app*.toml\` plus React Router \`app/shopify.server.*\` declarations. Shopify publishes quarterly versions in January, April, July, and October and supports each stable version for 12 months; the app security check allows a documented 30-day extension grace period before reporting it as end-of-life. Cite the exact declaration. For malformed config, computed \`ApiVersion\` values, or a Shopify-announced exceptional extension, inspect the source and current lifecycle policy rather than inferring from unrelated constants.
 `,
-  "---\nid: EXPIRING_OFFLINE_TOKEN\nversion: 1\nseverity: medium\nprecedence: prefer-agent\n---\n\n# Expiring Offline Token\n\nFor supported React Router apps, verify `expiringOfflineAccessTokens` is enabled and the selected session storage persists `expires`, `refreshToken`, and `refreshTokenExpires` metadata needed for refresh and rotation. `isOnline: false` selects an offline session; it does not disable token expiry and is not a finding. Report an explicit `expiringOfflineAccessTokens: false`. Treat absent or computed flags, custom storage, and ambiguous Prisma schemas as unresolved investigation: inspect storage adapters, migrations, and serialization before returning a clean result. Config-only and unsupported frameworks are handled by the runtime applicability boundary.\n",
+  "---\nid: EXPIRING_OFFLINE_TOKEN\nversion: 2\nseverity: medium\nprecedence: prefer-agent\n---\n\n# Expiring Offline Token\n\nFor supported React Router apps, verify `expiringOfflineAccessTokens` is enabled and the selected session storage persists `expires`, `refreshToken`, and `refreshTokenExpires` metadata needed for refresh and rotation. `isOnline: false` selects an offline session; it does not disable token expiry and is not a finding. Report an explicit `expiringOfflineAccessTokens: false`. Treat absent or computed flags, custom storage, and ambiguous Prisma schemas as unresolved investigation: inspect storage adapters, migrations, and serialization before returning a clean result. Config-only and unsupported frameworks are handled by the runtime applicability boundary.\n",
   `---
 id: INSECURE_WEBHOOK_URL
 version: 2
@@ -221060,17 +221060,24 @@ Inspect webhook destinations and OAuth redirect URLs in the selected Shopify app
   "---\nid: LIQUID_UNSAFE_RENDER\nversion: 1\nseverity: medium\nprecedence: union\n---\n\n# Liquid Unsafe Render\n\nInspect only theme-extension Liquid/HTML files the parser could not analyze. Liquid output is not automatically HTML-escaped. Check the destination: use `escape`/`escape_once` for HTML text and ordinary attributes, `json` when embedding a value as JavaScript data, and `metafield_tag` only for supported rich metafield rendering in HTML content. HTML escaping is not sufficient for event handlers, `srcdoc`, or a `<script src>` URL; avoid merchant-controlled output there and validate any dynamic URL. An ordinary non-script `src` attribute is not itself an executable sink. `{% raw %}` suppresses Liquid parsing, so apparent output inside it is literal text. Follow rendered snippets and inspect ambiguous filters or parser failures before reporting.\n",
   `---
 id: METAFIELD_OFFLINE_TOKEN
-version: 1
+version: 2
 severity: high
 ---
 
 # Metafield Offline Token
 
-Trace metafield writes and determine whether they use an offline Admin API context where an authenticated online context is required. Confirm token provenance and compensating authorization before reporting.
+Trace metafield and metaobject writes and determine their token provenance. Report a write that runs in an offline Admin API context that no verified request for the same shop authorizes: for example \`unauthenticated.admin(shop)\` or a stored offline session reached from an unauthenticated route, an unverified webhook or app proxy request, or a job whose shop or values come from request-controlled input.
+
+An offline session returned by \`authenticate.admin(request)\` (the React Router SDK default when \`useOnlineTokens\` isn't set) is a verified, shop-bound context: Shopify verified the session token and the staff member's access to the app. Don't report a write only because its token is offline or because an online token would add user attribution or expiry. Report it when:
+
+- the app defines its own per-user permission, for example an app-level role or allowlist check, and this write bypasses it. Name that permission.
+- request-controlled values reach an app-reserved (\`$app\`) metafield or metaobject that the app treats as trusted state and merchants can't edit themselves, for example a definition with \`access.admin = "merchant_read"\` or no merchant access, or billing, entitlement or feature-flag data. Writing to the \`$app\` namespace isn't safe by itself.
+
+Confirm token provenance and compensating authorization before reporting.
 `,
   `---
 id: MISSING_AUTHORIZATION_CHECK
-version: 2
+version: 3
 severity: high
 ---
 
@@ -221127,6 +221134,16 @@ actions.
    changes, direct URLs that survive permission downgrades, and backend actions
    that remain callable after a feature is hidden or disabled in the UI.
 
+## Shopify embedded apps (React Router)
+
+\`authenticate.admin(request)\` verifies the Shopify session token, so the caller is a staff member of that shop whom Shopify has granted access to this app. With offline tokens (the SDK default), Admin API calls use the app's granted scopes rather than the staff member's own permissions. That is Shopify's standard embedded app model, not a finding by itself. Report a handler only when it skips a concrete authorization boundary inside the app:
+
+- The app defines its own roles, owners, or allowlists (for example a check on \`sessionToken.sub\`, \`onlineAccessInfo.associated_user\`, \`account_owner\`, or an app database role), and a handler that performs the same or a more privileged operation doesn't apply it. Compare each route's loader and action, and sibling routes.
+- A request-supplied identifier selects an app-owned record that belongs to another user of the app.
+- The app uses online tokens to respect staff permissions on some paths, but a privileged path falls back to an offline session.
+
+If none of these applies, record the check as executed with no finding.
+
 ## What to report
 
 For each action that exposes a concrete unauthorized operation beyond authentication:
@@ -221530,7 +221547,7 @@ Do not report:
 `,
   `---
 id: REQUEST_CONTROLLED_ADMIN_CONTEXT
-version: 3
+version: 4
 severity: high
 precedence: prefer-agent
 ---
@@ -222129,17 +222146,7 @@ Do not report:
 - \`exec()\` with literal strings (no user input)
 - Shell calls with properly escaped arguments
 `,
-  `---
-id: STATIC_FRAME_ANCESTORS
-version: 1
-severity: high
-precedence: prefer-agent
----
-
-# Static Frame Ancestors
-
-Inspect embedded-app Content-Security-Policy construction. Report wildcard or static cross-shop frame-ancestors policies; accept a policy derived safely for the authenticated shop plus Shopify Admin.
-`,
+  "---\nid: STATIC_FRAME_ANCESTORS\nversion: 2\nseverity: high\nprecedence: prefer-agent\n---\n\n# Static Frame Ancestors\n\nInspect embedded-app Content-Security-Policy construction, including headers that app code sets after or instead of the SDK's. Report wildcard or static cross-shop frame-ancestors policies, such as `*`, `https:`, `*.myshopify.com`, or a fixed list of shop domains, whether the value is written literally or built from variables. Accept a policy derived safely for the shop plus Shopify Admin.\n\nThe React Router SDK's `addDocumentResponseHeaders` (from `shopifyApp()`, usually called in `entry.server`) is the accepted pattern: it sets `frame-ancestors` to the sanitized request shop plus Shopify Admin origins, including Shopify-operated development admin origins. Don't report it unless app code overrides or extends its header.\n",
   `---
 id: TEXT_SETTING_HTML_SMUGGLING
 version: 2
@@ -222334,7 +222341,7 @@ Do not report:
 `,
   `---
 id: UNAUTHENTICATED_ENDPOINT
-version: 2
+version: 3
 severity: high
 precedence: union
 ---
@@ -222471,7 +222478,7 @@ pack instructions.
 `,
   `---
 id: UNSAFE_INNERHTML
-version: 2
+version: 3
 severity: high
 precedence: union
 ---
@@ -222745,7 +222752,10 @@ For each check:
 5. Keep the check \`id\` and \`version\` exactly as they appear in {{AGENT_CHECKS_PATH}}.
 6. Include concise evidence citations. Never include a detected secret value or unnecessary personal data.
 
-A check with no verified issue must not produce a fabricated finding. If you cannot establish exploitability or affected authority, record the check as \`unresolved\` with a reason instead.
+A check with no verified issue must not produce a fabricated finding. Choose the status from what you were able to investigate, not from whether you can prove a negative:
+
+- \`executed\`: you traced the paths the check directs you to and found no concrete issue. This includes code that follows the safe pattern the check or its \`docs_url\` describes. A candidate is ruled out when the code establishes the boundary the check asks about, even if you can't rule out hypothetical policies or requirements that the repository doesn't define.
+- \`unresolved\`: you couldn't complete the investigation, for example because required code was unreadable, out of scope, or outside the repository and you couldn't inspect it, or you found a specific candidate whose boundary you could neither establish nor show to be missing. Name the candidate's file and line, or the missing input, in the reason.
 
 ### 4. Write one findings document
 
@@ -222789,7 +222799,7 @@ Write a single JSON document that covers every check you ran:
 - \`status\` is one of:
   - \`executed\`: you investigated the check, whether or not it produced findings.
   - \`not_applicable\`: the capability the check covers is absent. It can't have findings.
-  - \`unresolved\`: you couldn't finish the check or prove the issue. An unresolved check didn't pass; never describe it as passing.
+  - \`unresolved\`: you couldn't complete the investigation, or you named a specific candidate whose boundary is still unclear. An unresolved check didn't pass; never describe it as passing.
 - \`not_applicable\` and \`unresolved\` require a \`reason\` with a short \`code\` and a \`message\`.
 - Each finding needs \`file\`, \`line\` (1 or greater), \`message\`, and at least one \`evidence\` item with \`file\`, \`line\`, and \`quote\`.
 - Optional finding fields: \`snippet\`, \`confidence\` (\`high\`, \`medium\`, or \`low\`), \`reasoning\`, and \`suppression\` (\`{"justification": "..."}\`).
@@ -222860,6 +222870,36 @@ init_cjs_shims();
 
 // ../app/dist/cli/services/app-security-engine/rules/secret-rules.js
 init_cjs_shims();
+
+// ../app/dist/cli/services/app-security-engine/scanners/git.js
+init_cjs_shims();
+var UNTRUSTED_REPOSITORY_PROTECTIONS = {
+  // Reading the index runs the file-system monitor program. The empty value turns it off on every Git version;
+  // older versions take `false` as the program's name.
+  fileSystemMonitor: { args: ["-c", "core.fsmonitor="] },
+  // Refuses a bare repository Git would otherwise find in the working directory, such as one committed as files.
+  bareRepository: { args: ["-c", "safe.bareRepository=explicit"] },
+  // A partial clone fetches a missing object on demand, running the repository's transport commands.
+  lazyFetch: { env: { GIT_NO_LAZY_FETCH: "1" } },
+  // An empty allow-list refuses every transport, for Git versions that predate GIT_NO_LAZY_FETCH.
+  transports: { env: { GIT_ALLOW_PROTOCOL: "" } }
+}, protections = Object.values(UNTRUSTED_REPOSITORY_PROTECTIONS), protectionArguments = protections.flatMap((protection) => protection.args ?? []);
+function protectionEnvironment() {
+  return Object.fromEntries(protections.flatMap((protection) => Object.entries(protection.env ?? {})));
+}
+async function runGit(directory, args) {
+  try {
+    let result = await captureOutputWithExitCode("git", [...protectionArguments, ...args], {
+      cwd: directory,
+      env: protectionEnvironment()
+    });
+    return { exitCode: result.exitCode, stdout: result.stdout };
+  } catch {
+    return;
+  }
+}
+
+// ../app/dist/cli/services/app-security-engine/rules/secret-rules.js
 var SHOPIFY_TOKEN_PATTERN = {
   regex: /shp(?:(?:at|ca|pa|ss)_[a-fA-F0-9]{16,}|(?:rt|sb|tka|ua)_[a-zA-Z0-9]{16,})/,
   name: "Shopify token",
@@ -222950,7 +222990,7 @@ function isEnvFile(path4) {
   return envFileBasename(path4) !== void 0;
 }
 async function gitTopLevel(cwd2) {
-  let result = await runGit(cwd2, ["rev-parse", "--show-toplevel"]);
+  let result = await gitProbe(cwd2, ["rev-parse", "--show-toplevel"]);
   return result.exitCode === 0 && result.out !== "" ? result.out : void 0;
 }
 async function ignoredFileScanReason(file, gitIgnoreListing, appTopLevel) {
@@ -223031,16 +223071,12 @@ async function scanCommittedSecrets(secretEvidenceFiles, appRoot, gitIgnoreListi
   }
   return issues;
 }
-async function runGit(cwd2, args) {
-  try {
-    let result = await captureOutputWithExitCode("git", args, { cwd: cwd2 });
-    return { exitCode: result.exitCode, out: result.stdout.trim() };
-  } catch {
-    return { exitCode: void 0, out: "" };
-  }
+async function gitProbe(cwd2, args) {
+  let result = await runGit(cwd2, args);
+  return { exitCode: result?.exitCode, out: result?.stdout.trim() ?? "" };
 }
 async function gitStatusFor(file) {
-  let run = async (args) => runGit(dirname(file.absolutePath), args), name = basename(file.absolutePath), inRepo = await run(["rev-parse", "--is-inside-work-tree"]);
+  let run = async (args) => gitProbe(dirname(file.absolutePath), args), name = basename(file.absolutePath), inRepo = await run(["rev-parse", "--is-inside-work-tree"]);
   if (inRepo.exitCode !== 0 || inRepo.out !== "true")
     return {
       tracked: void 0,
@@ -223156,11 +223192,11 @@ var CHECK_DOCS_BASE_URL = "https://shopify.dev/docs/apps/build/security/app-secu
   },
   {
     id: "METAFIELD_OFFLINE_TOKEN",
-    title: "Metafield write using offline token context",
+    title: "Metafield write in an unverified offline token context",
     severity: "high",
     points: -15,
-    description: "Detects metafield writes (metafieldsSet) in offline-token contexts. Online tokens provide user attribution and expiry.",
-    fix: "Use authenticate.admin(request) instead of unauthenticated.admin() for metafield writes.",
+    description: "Investigates metafield and metaobject writes made with an offline Admin API context that no verified request for the same shop authorizes.",
+    fix: "Make the write from a request verified with authenticate.admin(request), or derive the shop and values from a verified source.",
     guide: "https://shopify.dev/docs/apps/build/authentication-authorization/access-token-types/online-access-tokens",
     docsUrl: `${CHECK_DOCS_BASE_URL}/metafield-offline-token`
   },
@@ -223300,7 +223336,7 @@ var CHECK_DOCS_BASE_URL = "https://shopify.dev/docs/apps/build/security/app-secu
     title: "Embedded app frame-ancestors uses a wildcard",
     severity: "high",
     points: -12,
-    description: "Detects literal wildcard or clearly permissive frame-ancestors policies in embedded app code.",
+    description: "Detects wildcard or static cross-shop frame-ancestors policies in embedded app code, whether written literally or built from variables.",
     fix: "Restrict frame-ancestors to Shopify Admin and the authenticated shop origin.",
     guide: "https://shopify.dev/docs/apps/build/security/set-up-iframe-protection",
     requires: "embedded_app",
@@ -223499,7 +223535,8 @@ Rules:
 - Record unresolved and not_applicable checks with a reason: { "code": "...", "message": "..." }.
 - A not_applicable check can't have findings.
 - An unsupported or unresolved check didn't pass. Never describe it as passing or complete.
-- If you can't prove exploitability or affected authority, record the check as unresolved instead of reporting a finding.
+- If you can't prove exploitability or affected authority for a specific candidate, don't report a finding: record the check as unresolved and name the candidate in the reason.
+- If you investigated and the code establishes the boundary the check asks about, record the check as executed. An unprovable hypothetical is not a reason to leave a check unresolved.
 - Don't report things you couldn't confirm \u2014 uncertainty is not a finding.`, catalogEntry = (checkId) => {
   let entry = RULE_CATALOG.find((candidate) => candidate.id === checkId);
   if (!entry)
@@ -223815,7 +223852,7 @@ async function listGitIgnoredPaths(directory) {
   return listing.status !== "listed" && outputDebug(`app security check: git ignore listing skipped (${listing.status})`), listing;
 }
 async function runGitIgnoreListing(directory) {
-  let location2 = await runGit2(directory, ["rev-parse", "--is-inside-work-tree"]);
+  let location2 = await runGit(directory, ["rev-parse", "--is-inside-work-tree"]);
   if (location2 === void 0)
     return { status: "failed" };
   if (location2.exitCode !== 0)
@@ -223824,7 +223861,7 @@ async function runGitIgnoreListing(directory) {
     return { status: "not-a-repository" };
   if (location2.stdout.trim() !== "true")
     return { status: "failed" };
-  let listed = await runGit2(directory, [
+  let listed = await runGit(directory, [
     "ls-files",
     "-z",
     "--others",
@@ -223838,10 +223875,10 @@ async function runGitIgnoreListing(directory) {
 }
 async function isIgnoredByParentRepository(directory) {
   let parent = dirname(directory);
-  return parent === directory ? !1 : (await runGit2(parent, ["check-ignore", "--no-index", "-q", "--", basename(directory)]))?.exitCode === 0;
+  return parent === directory ? !1 : (await runGit(parent, ["check-ignore", "--no-index", "-q", "--", basename(directory)]))?.exitCode === 0;
 }
 async function listTrackedFiles(directory) {
-  let listed = await runGit2(directory, ["ls-files", "-z", "--cached", "--", "."]);
+  let listed = await runGit(directory, ["ls-files", "-z", "--cached", "--", "."]);
   if (!(listed === void 0 || listed.exitCode !== 0))
     return splitNullSeparated(listed.stdout);
 }
@@ -223856,14 +223893,6 @@ async function listNestedRepository(directory) {
 function splitNullSeparated(output) {
   return output.split("\0").filter((path4) => path4 !== "");
 }
-async function runGit2(directory, args) {
-  try {
-    let result = await captureOutputWithExitCode("git", args, { cwd: directory });
-    return { exitCode: result.exitCode, stdout: result.stdout };
-  } catch {
-    return;
-  }
-}
 
 // ../app/dist/cli/services/app-security-engine/rules/dependency-automation-rules.js
 init_cjs_shims();
@@ -224252,6 +224281,13 @@ function readRepositoryFile(absolutePath) {
   let located = configuredReader().explicitInputs.has(path4) ? explicitInputPath(path4) : containedRepositoryPath(path4), result = located.path ? readBoundedFile(located.path) : located.failure;
   return repositoryFileCache.set(path4, result), result.ok || recordSkippedFile(path4, result), result;
 }
+function readFileContainedBy(directory, path4) {
+  let inspected = inspectRepositoryPath(directory, path4);
+  if (inspected.status === "missing")
+    return;
+  let result = inspected.status === "file" ? readBoundedFile(inspected.path) : repositoryPathFailure(inspected.reason);
+  return result.ok || recordSkippedFile(joinPath(directory, path4), result), result;
+}
 function readRepositoryText(absolutePath) {
   let result = readRepositoryFile(absolutePath);
   return result.ok ? result.content.toString() : void 0;
@@ -224354,15 +224390,14 @@ function isProbablyBinary(content) {
   return sample.length > 0 && suspiciousControlBytes / sample.length > 0.1;
 }
 function findSensitiveFiles(appRoot, repositoryFiles, selectedAppConfigPath) {
-  return repositoryFiles.filter(isSensitiveFile).filter((path4) => !LOCKFILE_MANAGERS.has(path4)).filter((path4) => !isValidFormatAppConfigurationFileName(basename(path4)) || path4 === selectedAppConfigPath).flatMap((path4) => {
+  return repositoryFiles.filter(isSensitiveFile).filter((path4) => !LOCKFILE_MANAGERS.has(basename(path4))).filter((path4) => !isValidFormatAppConfigurationFileName(basename(path4)) || path4 === selectedAppConfigPath).flatMap((path4) => {
     let absolutePath = joinPath(appRoot, path4), result = readRepositoryFile(absolutePath);
     return result.ok ? isProbablyBinary(result.content) ? [] : [{ path: path4, absolutePath, ext: extname(path4), content: result.content.toString() }] : [{ path: path4, absolutePath, ext: extname(path4), content: void 0 }];
   });
 }
-function nestedRepositoryReason(appRoot) {
+function dependencyAutomationRoot(appRoot) {
   let marker = findRepositoryMarker(appRoot);
-  if (marker.status !== "none")
-    return marker.status === "ambiguous" ? marker.reason : marker.directory === appRoot ? void 0 : "App root is nested below a parent Git repository";
+  return marker.status === "ambiguous" ? { unresolvedReason: marker.reason } : { directory: marker.status === "found" ? marker.directory : appRoot };
 }
 function findDependencyAutomationInputs(appRoot, gatheredPaths) {
   let canonicalRoot;
@@ -224372,25 +224407,28 @@ function findDependencyAutomationInputs(appRoot, gatheredPaths) {
   } catch (error) {
     return { files: [], unresolvedReason: inspectErrorReason("app root", error) };
   }
-  let repositoryReason = nestedRepositoryReason(canonicalRoot);
-  if (repositoryReason)
-    return { files: [], unresolvedReason: repositoryReason };
-  let gathered = new Set(gatheredPaths), files = [], unresolvedReason;
-  for (let relative of DEPENDENCY_AUTOMATION_CONFIG_PATHS) {
-    if (!gathered.has(relative))
-      continue;
-    let absolutePath = joinPath(canonicalRoot, relative), result = readRepositoryFile(absolutePath);
-    if (!result.ok) {
-      unresolvedReason ??= result.reason === "too_large" ? `${relative} is too large to inspect` : result.detail ?? `Could not read ${relative}`;
+  let configurationRoot = dependencyAutomationRoot(canonicalRoot);
+  if ("unresolvedReason" in configurationRoot)
+    return { files: [], unresolvedReason: configurationRoot.unresolvedReason };
+  let repositoryRoot = configurationRoot.directory, { scanDirectories } = configuredReader(), isScanned = (absolutePath) => repositoryRoot === canonicalRoot || scanDirectories.some((directory) => isSubpath(directory, absolutePath)), gathered = new Set(gatheredPaths), files = [], unresolvedReason;
+  for (let configurationPath of DEPENDENCY_AUTOMATION_CONFIG_PATHS) {
+    let absolutePath = joinPath(repositoryRoot, configurationPath), relative = normalizePath(relativePath(canonicalRoot, absolutePath)), scanned = isScanned(absolutePath);
+    if (scanned && !gathered.has(relative))
       continue;
+    let result = scanned ? readRepositoryFile(absolutePath) : readFileContainedBy(repositoryRoot, configurationPath);
+    if (result !== void 0) {
+      if (!result.ok) {
+        unresolvedReason ??= result.reason === "too_large" ? `${relative} is too large to inspect` : result.detail ?? `Could not read ${relative}`;
+        continue;
+      }
+      files.push({
+        path: relative,
+        absolutePath,
+        ext: extname(relative),
+        content: result.content.toString()
+      });
+      break;
     }
-    files.push({
-      path: relative,
-      absolutePath,
-      ext: extname(relative),
-      content: result.content.toString()
-    });
-    break;
   }
   return files.length > 0 ? { files } : { files, ...unresolvedReason ? { unresolvedReason } : {} };
 }
@@ -224436,6 +224474,7 @@ function findManifests(appRoot, discoveredPaths) {
 
 // ../app/dist/cli/services/app-security-engine/capabilities/detect.js
 init_cjs_shims();
+var REACT_ROUTER_PACKAGE = "@shopify/shopify-app-react-router";
 function detectCapabilities(appToml, extensions, sourceFiles, appTomls = appToml ? [appToml] : []) {
   let themeExtension = extensions.some((extension) => extension.type === "theme"), appEmbed = extensions.some((extension) => extension.type === "theme" && hasAppEmbedBlock(extension)), embeddedApp = appTomls.some((configuration) => configuration.raw.embedded === !0), scriptTags = sourceFiles.some((file) => file.content ? /script[_-]?tags?|ScriptTag/i.test(file.content) : !1), storefrontMetafieldWrites = sourceFiles.some((file) => file.content ? /metafields?Set|metafields?\/.*(?:POST|PUT|create|update)|write.*metafield|metafield.*write/i.test(file.content) : !1), hasBackend = sourceFiles.some(detectRouteDefinitions);
   return {
@@ -224451,11 +224490,49 @@ function detectCapabilities(appToml, extensions, sourceFiles, appTomls = appToml
     checkout_extension: extensions.some((extension) => extension.type === "checkout_ui" || extension.type === "checkout_ui_extension")
   };
 }
-function detectProject(manifests, extensions, candidates) {
-  let dependencyNames = new Set(manifests.flatMap((manifest) => [
-    ...Object.keys(manifest.dependencies),
-    ...Object.keys(manifest.devDependencies ?? {})
-  ])), candidatePaths = new Set(candidates.map((candidate) => candidate.path)), hasReactRouterPackage = dependencyNames.has("@shopify/shopify-app-react-router"), hasReactRouterStructure = [...candidatePaths].some((path4) => path4.startsWith("app/routes/")) && [...candidatePaths].some((path4) => /^app\/shopify\.server\.[cm]?[jt]sx?$/.test(path4)), reactRouter = hasReactRouterPackage && hasReactRouterStructure, themeExtensions = extensions.filter((extension) => extension.type === "theme"), themeExtension = themeExtensions.length > 0, themePaths = new Set(themeExtensions.flatMap((extension) => extension.files.map((file) => file.path))), hasSources = candidates.length > 0, surface;
+function detectReactRouterRoots(manifests, candidates, otherAppDirectories = []) {
+  let declaringManifests = manifests.filter((manifest) => manifest.dependencies[REACT_ROUTER_PACKAGE] !== void 0 || manifest.devDependencies?.[REACT_ROUTER_PACKAGE] !== void 0);
+  if (declaringManifests.length === 0)
+    return [];
+  let candidatePaths = candidates.map((candidate) => candidate.path);
+  return [.../* @__PURE__ */ new Set([".", ...declaringManifests.map((manifest) => dirname(manifest.path))])].filter((root) => hasReactRouterStructure(root, candidatePaths)).filter((root) => !belongsToOtherApp(root, otherAppDirectories)).sort();
+}
+function isReactRouterServerPath(root, path4) {
+  let pathInRoot = pathWithinRoot(root, path4);
+  return pathInRoot !== void 0 && /^app\/shopify\.server\.[cm]?[jt]sx?$/.test(pathInRoot);
+}
+function isReactRouterSourcePath(path4, reactRouterRoots, otherAppDirectories) {
+  let otherAppCode = otherAppCodeDirectories(otherAppDirectories).filter((directory) => !isInsideReactRouterRoot(directory, reactRouterRoots));
+  return (!climbsOutOfDirectory(path4) || reactRouterRoots.some((root) => pathWithinRoot(root, path4) !== void 0)) && !otherAppCode.some((directory) => pathWithinRoot(directory, path4) !== void 0);
+}
+function isInsideReactRouterRoot(directory, reactRouterRoots) {
+  return reactRouterRoots.some((root) => root === "." ? !climbsOutOfDirectory(directory) : directory === root || pathWithinRoot(root, directory) !== void 0);
+}
+function climbsOutOfDirectory(path4) {
+  return path4 === ".." || path4.startsWith("../");
+}
+function pathWithinRoot(root, path4) {
+  if (root === ".")
+    return path4;
+  if (!path4.startsWith(`${root}/`))
+    return;
+  let pathInRoot = path4.slice(root.length + 1);
+  return climbsOutOfDirectory(pathInRoot) ? void 0 : pathInRoot;
+}
+function hasReactRouterStructure(root, paths) {
+  return paths.some((path4) => pathWithinRoot(root, path4)?.startsWith("app/routes/")) && paths.some((path4) => isReactRouterServerPath(root, path4));
+}
+function belongsToOtherApp(root, otherAppDirectories) {
+  return root === "." ? !1 : otherAppDirectories.includes(root) || otherAppCodeDirectories(otherAppDirectories).some((directory) => root === directory || pathWithinRoot(directory, root) !== void 0);
+}
+function otherAppCodeDirectories(otherAppDirectories) {
+  return otherAppDirectories.flatMap((directory) => isAncestorOfAppDirectory(directory) ? [`${directory}/app`, `${directory}/web`] : [directory]);
+}
+function isAncestorOfAppDirectory(directory) {
+  return directory.split("/").every((segment) => segment === "..");
+}
+function detectProject(extensions, candidates, reactRouterRoots) {
+  let reactRouter = reactRouterRoots.length > 0, themeExtensions = extensions.filter((extension) => extension.type === "theme"), themeExtension = themeExtensions.length > 0, themePaths = new Set(themeExtensions.flatMap((extension) => extension.files.map((file) => file.path))), hasSources = candidates.length > 0, surface;
   reactRouter && themeExtension ? surface = "mixed" : reactRouter ? surface = "react_router" : themeExtension && candidates.some((candidate) => !themePaths.has(candidate.path)) ? surface = "mixed" : themeExtension ? surface = "theme_app_extension" : hasSources ? surface = "unknown" : surface = "config_only";
   let framework;
   reactRouter ? framework = "react_router" : surface === "config_only" || surface === "theme_app_extension" ? framework = "none" : surface === "mixed" ? framework = "mixed" : framework = "unknown";
@@ -225115,11 +225192,11 @@ function scanEolApiVersions(context, referenceDate = /* @__PURE__ */ new Date())
   ]);
   if (context.detection.framework !== "react_router")
     return configIssues;
-  let sourceIssues = context.sourceFiles.flatMap((file) => scanReactRouterApiVersion(file, referenceDate));
+  let sourceIssues = context.sourceFiles.flatMap((file) => scanReactRouterApiVersion(file, context.reactRouterRoots, referenceDate));
   return [...configIssues, ...sourceIssues];
 }
-function scanReactRouterApiVersion(file, referenceDate) {
-  if (!file.content || !/^app\/shopify\.server\.[cm]?[jt]sx?$/.test(file.path))
+function scanReactRouterApiVersion(file, reactRouterRoots, referenceDate) {
+  if (!file.content || !reactRouterRoots.some((root) => isReactRouterServerPath(root, file.path)))
     return [];
   let content = maskStringsExceptVersions(stripComments4(file.content));
   return [
@@ -226064,7 +226141,7 @@ var JAVASCRIPT_EXTENSIONS6 = [".js", ".jsx", ".mjs", ".cjs", ".ts", ".tsx", ".mt
   configRule(missingComplianceWebhooks),
   {
     id: "MISSING_DEPENDENCY_SECURITY_AUTOMATION",
-    version: 1,
+    version: 2,
     lifecycle: "active",
     analysisMode: "structured_config",
     target: "dependency_automation",
@@ -226072,7 +226149,7 @@ var JAVASCRIPT_EXTENSIONS6 = [".js", ".jsx", ".mjs", ".cjs", ".ts", ".tsx", ".mt
   },
   {
     id: "EOL_API_VERSION",
-    version: 1,
+    version: 2,
     lifecycle: "active",
     analysisMode: "regex",
     target: "config_and_source",
@@ -226080,16 +226157,16 @@ var JAVASCRIPT_EXTENSIONS6 = [".js", ".jsx", ".mjs", ".cjs", ".ts", ".tsx", ".mt
     runner: (context) => scanEolApiVersions(context)
   },
   {
-    ...jsCheck("EXPIRING_OFFLINE_TOKEN", (context) => scanExpiringOfflineTokens(context)),
+    ...jsCheck("EXPIRING_OFFLINE_TOKEN", (context) => scanExpiringOfflineTokens(context), "source", 2),
     extensions: [...JAVASCRIPT_EXTENSIONS6, ".prisma"]
   },
   {
-    ...jsCheck("UNAUTHENTICATED_ENDPOINT", (context) => scanUnauthenticatedEndpoints(context.sourceFiles), "source", 2),
+    ...jsCheck("UNAUTHENTICATED_ENDPOINT", (context) => scanUnauthenticatedEndpoints(context.sourceFiles), "source", 3),
     requires: "has_backend"
   },
-  jsCheck("REQUEST_CONTROLLED_ADMIN_CONTEXT", (context) => scanRequestControlledAdminContext(context.sourceFiles), "source", 3),
+  jsCheck("REQUEST_CONTROLLED_ADMIN_CONTEXT", (context) => scanRequestControlledAdminContext(context.sourceFiles), "source", 4),
   {
-    ...configRule(deprecatedScriptTagScope),
+    ...configRule(deprecatedScriptTagScope, 2),
     target: "config_and_source",
     analysisMode: "regex",
     extensions: JAVASCRIPT_EXTENSIONS6,
@@ -226101,14 +226178,14 @@ var JAVASCRIPT_EXTENSIONS6 = [".js", ".jsx", ".mjs", ".cjs", ".ts", ".tsx", ".mt
   configRule(insecureWebhookUrl, 2),
   {
     id: "COMMITTED_SECRET",
-    version: 3,
+    version: 4,
     lifecycle: "active",
     analysisMode: "regex",
     target: "secrets",
     runner: (context) => scanCommittedSecrets(context.sensitiveFiles, context.appRoot, context.gitIgnoreListing)
   },
-  jsCheck("CREDENTIAL_LOG_LEAKAGE", (context) => scanCredentialLogLeakage(context.sourceFiles)),
-  jsCheck("CREDENTIAL_BROWSER_LEAKAGE", (context) => scanCredentialBrowserLeakage(context.sourceFiles)),
+  jsCheck("CREDENTIAL_LOG_LEAKAGE", (context) => scanCredentialLogLeakage(context.sourceFiles), "source", 2),
+  jsCheck("CREDENTIAL_BROWSER_LEAKAGE", (context) => scanCredentialBrowserLeakage(context.sourceFiles), "source", 2),
   {
     id: "LIQUID_UNSAFE_RENDER",
     version: 1,
@@ -226120,16 +226197,16 @@ var JAVASCRIPT_EXTENSIONS6 = [".js", ".jsx", ".mjs", ".cjs", ".ts", ".tsx", ".mt
     runner: (context) => liquidRunner(context, "LIQUID_UNSAFE_RENDER")
   },
   {
-    ...jsCheck("UNSAFE_INNERHTML", unsafeInnerHtmlRunner, "source_and_theme", 2),
+    ...jsCheck("UNSAFE_INNERHTML", unsafeInnerHtmlRunner, "source_and_theme", 3),
     analysisMode: "regex",
     extensions: [...JAVASCRIPT_EXTENSIONS6, ".liquid", ".html"]
   },
   {
-    ...jsCheck("APP_PROXY_LIQUID_INJECTION", (context) => scanAppProxyLiquidInjection(context.sourceFiles), "source", 2),
+    ...jsCheck("APP_PROXY_LIQUID_INJECTION", (context) => scanAppProxyLiquidInjection(context.sourceFiles), "source", 3),
     requires: "app_proxy"
   },
   {
-    ...jsCheck("STATIC_FRAME_ANCESTORS", (context) => scanStaticFrameAncestors(context.sourceFiles), "app_source"),
+    ...jsCheck("STATIC_FRAME_ANCESTORS", (context) => scanStaticFrameAncestors(context.sourceFiles), "app_source", 2),
     requires: "embedded_app"
   }
 ];
@@ -226237,8 +226314,11 @@ function appSourceFiles(context) {
   let themePaths = new Set(themeFiles(context).map((file) => file.path));
   return context.sourceFiles.filter((file) => !themePaths.has(file.path));
 }
+function isReactRouterFilePath(path4, context) {
+  return context.detection.framework !== "react_router" || isReactRouterSourcePath(path4, context.reactRouterRoots, context.otherAppDirectories);
+}
 function reactRouterFiles(context) {
-  return appSourceFiles(context);
+  return appSourceFiles(context).filter((file) => isReactRouterFilePath(file.path, context));
 }
 function selectedFiles(definition, context) {
   let configurations = context.appTomls.map((toml) => relativePath(context.appRoot, toml.path).replace(/\\/g, "/"));
@@ -226345,8 +226425,8 @@ function manifestHasDependencies(manifest) {
   return Object.keys(manifest.dependencies).length > 0 || Object.keys(manifest.devDependencies ?? {}).length > 0;
 }
 function skippedInputsForCheck(definition, context, skippedFiles2) {
-  let themeDirectories = context.extensions.filter((extension) => extension.type === "theme").map((extension) => extension.path.replace(/shopify\.extension\.toml$/, "")), isThemePath = (path4) => themeDirectories.some((directory) => path4.startsWith(directory)) || path4.endsWith("shopify.extension.toml"), isSourcePath = (path4) => !isThemePath(path4) && !!definition.extensions?.some((extension) => path4.endsWith(extension)), isConfig = (path4) => /^shopify\.app(?:\.[^/]+)?\.toml$/.test(path4), isDependencyAutomationInput = (path4) => /(^|\/)package\.json$/.test(path4) || context.dependencyAutomation.files.some((file) => file.path === path4), isSecretInput = (file) => !file.detail?.includes("could not be parsed") && (context.sourceCandidates.some((candidate) => candidate.path === file.path) || context.sensitiveFiles.some((sensitiveFile) => sensitiveFile.path === file.path) || /(^|\/)(?:\.env(?:\.[^/]+)?|secrets\.json|credentials\.json)$/.test(file.path));
-  return skippedFiles2.filter((file) => definition.target === "config" ? isConfig(file.path) : definition.target === "dependency_automation" ? isDependencyAutomationInput(file.path) : definition.target === "config_and_source" ? isConfig(file.path) || isSourcePath(file.path) : definition.target === "source" || definition.target === "app_source" ? isSourcePath(file.path) : definition.target === "theme" ? isThemePath(file.path) : definition.target === "source_and_theme" ? isSourcePath(file.path) || isThemePath(file.path) : isSecretInput(file));
+  let themeDirectories = context.extensions.filter((extension) => extension.type === "theme").map((extension) => extension.path.replace(/shopify\.extension\.toml$/, "")), isThemePath = (path4) => themeDirectories.some((directory) => path4.startsWith(directory)) || path4.endsWith("shopify.extension.toml"), isSourcePath = (path4) => !isThemePath(path4) && !!definition.extensions?.some((extension) => path4.endsWith(extension)), isReactRouterInput = (path4) => isSourcePath(path4) && isReactRouterFilePath(path4, context), isConfig = (path4) => /^shopify\.app(?:\.[^/]+)?\.toml$/.test(path4), isDependencyAutomationInput = (path4) => /(^|\/)package\.json$/.test(path4) || context.dependencyAutomation.files.some((file) => file.path === path4), isSecretInput = (file) => !file.detail?.includes("could not be parsed") && (context.sourceCandidates.some((candidate) => candidate.path === file.path) || context.sensitiveFiles.some((sensitiveFile) => sensitiveFile.path === file.path) || /(^|\/)(?:\.env(?:\.[^/]+)?|secrets\.json|credentials\.json)$/.test(file.path));
+  return skippedFiles2.filter((file) => definition.target === "config" ? isConfig(file.path) : definition.target === "dependency_automation" ? isDependencyAutomationInput(file.path) : definition.target === "config_and_source" ? isConfig(file.path) || isReactRouterInput(file.path) : definition.target === "source" ? isReactRouterInput(file.path) : definition.target === "app_source" ? isSourcePath(file.path) : definition.target === "theme" ? isThemePath(file.path) : definition.target === "source_and_theme" ? isReactRouterInput(file.path) || isThemePath(file.path) : isSecretInput(file));
 }
 function skippedInputReason(definition, files) {
   return {
@@ -226385,7 +226465,7 @@ async function scan(input, options = {}) {
     scanDirectories,
     explicitInputs: new Set(appConfigFilePath ? [appConfigFilePath] : [])
   });
-  let selectedAppConfigPath = appConfigFilePath ? normalizePath(relativePath(appRoot, appConfigFilePath)) : void 0, appToml = appConfigFilePath ? loadAppToml(appConfigFilePath, appRoot) : null, appTomls = appToml ? [appToml] : [], { paths: repositoryFiles, ignoredScanDirectories, otherAppDirectories, listingStatus } = await gatherScanPaths(input, options), extensions = findExtensions(appRoot, repositoryFiles), sourceCandidates = findSourceCandidates(repositoryFiles), sourceFiles = findAppSourceFiles(appRoot, repositoryFiles), sensitiveFiles = findSensitiveFiles(appRoot, repositoryFiles, selectedAppConfigPath), manifestPaths = findManifestPaths(repositoryFiles), manifests = findManifests(appRoot, manifestPaths), dependencyAutomation = manifests.some(manifestHasDependencies) ? findDependencyAutomationInputs(appRoot, repositoryFiles) : { files: [] }, capabilities = detectCapabilities(appToml, extensions, sourceFiles, appTomls), detection = detectProject(manifests, extensions, sourceCandidates), context = {
+  let selectedAppConfigPath = appConfigFilePath ? normalizePath(relativePath(appRoot, appConfigFilePath)) : void 0, appToml = appConfigFilePath ? loadAppToml(appConfigFilePath, appRoot) : null, appTomls = appToml ? [appToml] : [], { paths: repositoryFiles, ignoredScanDirectories, otherAppDirectories, listingStatus } = await gatherScanPaths(input, options), extensions = findExtensions(appRoot, repositoryFiles), sourceCandidates = findSourceCandidates(repositoryFiles), sourceFiles = findAppSourceFiles(appRoot, repositoryFiles), sensitiveFiles = findSensitiveFiles(appRoot, repositoryFiles, selectedAppConfigPath), manifestPaths = findManifestPaths(repositoryFiles), manifests = findManifests(appRoot, manifestPaths), dependencyAutomation = manifests.some(manifestHasDependencies) ? findDependencyAutomationInputs(appRoot, repositoryFiles) : { files: [] }, capabilities = detectCapabilities(appToml, extensions, sourceFiles, appTomls), relativeOtherAppDirectories = otherAppDirectories.map((directory) => normalizePath(relativePath(appRoot, directory))), reactRouterRoots = detectReactRouterRoots(manifests, sourceCandidates, relativeOtherAppDirectories), detection = detectProject(extensions, sourceCandidates, reactRouterRoots), context = {
     appRoot,
     appToml,
     appTomls,
@@ -226396,6 +226476,8 @@ async function scan(input, options = {}) {
     sensitiveFiles,
     capabilities,
     detection,
+    reactRouterRoots,
+    otherAppDirectories: relativeOtherAppDirectories,
     sourceCandidates,
     gitIgnoreListing: listingStatus
   }, issues = [], checksExecuted = [], requiredCheckIds = /* @__PURE__ */ new Set();
@@ -228914,7 +228996,7 @@ var SecurityCheck = class _SecurityCheck extends base_command_default {
       env: "SHOPIFY_FLAG_YES"
     }),
     "skip-instructions": import_core32.Flags.boolean({
-      description: "Don't offer to show coding-agent instructions.",
+      description: "Don't offer the coding-agent instructions after the scan. Use it when you want only the deterministic scan results.",
       default: !1,
       exclusive: ["yes"],
       env: "SHOPIFY_FLAG_APP_SECURITY_SKIP_INSTRUCTIONS"