@shopify/create-app 4.9.2 → 4.9.4

package/dist/index.js

@@ -4,7 +4,7 @@ import {
   decodeToml,
   loadEnvironment,
   require_toml_patch
-} from "./chunk-UU2BFFYI.js";
+} from "./chunk-VDSENONW.js";
 import {
   require_normalize_path
 } from "./chunk-RIQNGBMO.js";
@@ -15,7 +15,7 @@ import {
 import {
   setCurrentCommandId,
   showNotificationsIfNeeded
-} from "./chunk-CVBQ5S5E.js";
+} from "./chunk-IYZRNCTE.js";
 import {
   ClientError,
   DevServerCore,
@@ -81,7 +81,7 @@ import {
   setPathValue,
   shopifyFetch,
   storeAdminUrl
-} from "./chunk-R2AIQR2X.js";
+} from "./chunk-TLGD6UXP.js";
 import {
   setNextDeprecationDate
 } from "./chunk-MSED5ZFM.js";
@@ -103,26 +103,26 @@ import {
   usesWorkspaces,
   versionSatisfies,
   writePackageJSON
-} from "./chunk-U5KA5YG3.js";
+} from "./chunk-75IKCZVA.js";
 import {
   import_websocket_server
 } from "./chunk-LDYT4FTV.js";
 import "./chunk-FKZ3NFHZ.js";
 import {
   CLI_KIT_VERSION
-} from "./chunk-PYUSHB4W.js";
+} from "./chunk-MNUDC2IF.js";
 import "./chunk-G53O4PDO.js";
 import {
   LocalStorage,
   require_ajv,
   runAtMinimumInterval,
   serviceEnvironment
-} from "./chunk-UHTO6LKY.js";
+} from "./chunk-TJDRI2KO.js";
 import {
   globalCLIVersion,
   isPreReleaseVersion,
   localCLIVersion
-} from "./chunk-MB6QQB5L.js";
+} from "./chunk-IIDLK3B2.js";
 import {
   AbortController as AbortController2,
   Alert,
@@ -170,10 +170,10 @@ import {
   use_input_default,
   use_stdin_default,
   use_stdout_default
-} from "./chunk-DBII5OBE.js";
+} from "./chunk-PUN2NAT5.js";
 import {
   runWithCommandEventsForCommand
-} from "./chunk-BJRUKXTH.js";
+} from "./chunk-52LPDF46.js";
 import {
   execa,
   isStream,
@@ -186,14 +186,14 @@ import {
   require_signal_exit,
   stripFinalNewline,
   username
-} from "./chunk-YMDHYX2O.js";
+} from "./chunk-RRQPXOTA.js";
 import "./chunk-JGGOQOPO.js";
 import {
   addPublicMetadata,
   addSensitiveMetadata,
   createRuntimeMetadataContainer,
   runWithTimer
-} from "./chunk-4L6UUTTJ.js";
+} from "./chunk-ATS65VTD.js";
 import {
   fileHash,
   getAppAutomationToken,
@@ -203,23 +203,23 @@ import {
   nonRandomUUID,
   randomUUID,
   sha256
-} from "./chunk-SHCNJ47P.js";
+} from "./chunk-DXHBESFY.js";
 import {
   defineJsonOutputSchema
-} from "./chunk-AKE2R5YA.js";
+} from "./chunk-L6MEGCFP.js";
 import "./chunk-CM6ALOD7.js";
 import {
   AbortError,
   AbortSilentError,
   BugError,
   CancelExecution
-} from "./chunk-KCVRVXZY.js";
+} from "./chunk-6BEAY6DV.js";
 import {
   waitForPostRunHookAndExit
-} from "./chunk-IY53IJS3.js";
+} from "./chunk-53A2QBFH.js";
 import {
   treeKill
-} from "./chunk-GR2RHEDU.js";
+} from "./chunk-7EY7VZVX.js";
 import {
   appendFile,
   asHumanFriendlyArray,
@@ -316,7 +316,7 @@ import {
   unstyled,
   writeFile,
   writeFileSync
-} from "./chunk-JLQYDEOX.js";
+} from "./chunk-QLLL4VIM.js";
 import {
   codespacePortForwardingDomain,
   codespaceURL,
@@ -330,11 +330,11 @@ import {
   isUnitTest,
   isVerbose,
   noInputFlag
-} from "./chunk-PI6OTTFS.js";
+} from "./chunk-NN45GPHA.js";
 import {
   environmentVariables,
   themeKitAccessDomain
-} from "./chunk-CK3T27VW.js";
+} from "./chunk-C3P3BBJI.js";
 import {
   isTruthy
 } from "./chunk-HNIAZN6U.js";
@@ -344,7 +344,9 @@ import {
 } from "./chunk-EJEHENXO.js";
 import "./chunk-23UTCSPZ.js";
 import "./chunk-LBXDGVFS.js";
-import "./chunk-OQ3KXXGH.js";
+import {
+  require_semver
+} from "./chunk-OQ3KXXGH.js";
 import "./chunk-D6NYWNY2.js";
 import {
   basename,
@@ -362,7 +364,7 @@ import {
   resolvePath,
   sanitizeRelativePath,
   sniffForJson
-} from "./chunk-VDUAROBQ.js";
+} from "./chunk-57VCTLOQ.js";
 import "./chunk-UFLX7QDP.js";
 import "./chunk-SI4LHZYW.js";
 import {
@@ -30653,7 +30655,7 @@ var require_lodash = __commonJS({
         function isWeakSet(value) {
           return isObjectLike(value) && baseGetTag(value) == weakSetTag;
         }
-        var lt = createRelationalOperation(baseLt), lte = createRelationalOperation(function(value, other) {
+        var lt2 = createRelationalOperation(baseLt), lte = createRelationalOperation(function(value, other) {
           return value <= other;
         });
         function toArray(value) {
@@ -31226,7 +31228,7 @@ function print() { __p += __j.call(arguments, '') }
         function sumBy(array, iteratee2) {
           return array && array.length ? baseSum(array, getIteratee(iteratee2, 2)) : 0;
         }
-        return lodash.after = after, lodash.ary = ary, lodash.assign = assign, lodash.assignIn = assignIn, lodash.assignInWith = assignInWith, lodash.assignWith = assignWith, lodash.at = at, lodash.before = before, lodash.bind = bind, lodash.bindAll = bindAll, lodash.bindKey = bindKey, lodash.castArray = castArray, lodash.chain = chain, lodash.chunk = chunk, lodash.compact = compact2, lodash.concat = concat, lodash.cond = cond, lodash.conforms = conforms, lodash.constant = constant, lodash.countBy = countBy, lodash.create = create, lodash.curry = curry, lodash.curryRight = curryRight, lodash.debounce = debounce2, lodash.defaults = defaults, lodash.defaultsDeep = defaultsDeep, lodash.defer = defer2, lodash.delay = delay2, lodash.difference = difference2, lodash.differenceBy = differenceBy, lodash.differenceWith = differenceWith, lodash.drop = drop, lodash.dropRight = dropRight, lodash.dropRightWhile = dropRightWhile, lodash.dropWhile = dropWhile, lodash.fill = fill, lodash.filter = filter, lodash.flatMap = flatMap, lodash.flatMapDeep = flatMapDeep, lodash.flatMapDepth = flatMapDepth, lodash.flatten = flatten, lodash.flattenDeep = flattenDeep, lodash.flattenDepth = flattenDepth, lodash.flip = flip, lodash.flow = flow, lodash.flowRight = flowRight, lodash.fromPairs = fromPairs, lodash.functions = functions, lodash.functionsIn = functionsIn, lodash.groupBy = groupBy2, lodash.initial = initial, lodash.intersection = intersection, lodash.intersectionBy = intersectionBy, lodash.intersectionWith = intersectionWith, lodash.invert = invert, lodash.invertBy = invertBy, lodash.invokeMap = invokeMap, lodash.iteratee = iteratee, lodash.keyBy = keyBy, lodash.keys = keys, lodash.keysIn = keysIn, lodash.map = map, lodash.mapKeys = mapKeys, lodash.mapValues = mapValues, lodash.matches = matches2, lodash.matchesProperty = matchesProperty, lodash.memoize = memoize, lodash.merge = merge, lodash.mergeWith = mergeWith, lodash.method = method, lodash.methodOf = methodOf, lodash.mixin = mixin, lodash.negate = negate, lodash.nthArg = nthArg, lodash.omit = omit, lodash.omitBy = omitBy, lodash.once = once, lodash.orderBy = orderBy, lodash.over = over, lodash.overArgs = overArgs, lodash.overEvery = overEvery, lodash.overSome = overSome, lodash.partial = partial, lodash.partialRight = partialRight, lodash.partition = partition2, lodash.pick = pick, lodash.pickBy = pickBy2, lodash.property = property, lodash.propertyOf = propertyOf, lodash.pull = pull3, lodash.pullAll = pullAll, lodash.pullAllBy = pullAllBy, lodash.pullAllWith = pullAllWith, lodash.pullAt = pullAt, lodash.range = range, lodash.rangeRight = rangeRight, lodash.rearg = rearg, lodash.reject = reject, lodash.remove = remove2, lodash.rest = rest, lodash.reverse = reverse, lodash.sampleSize = sampleSize, lodash.set = set, lodash.setWith = setWith, lodash.shuffle = shuffle, lodash.slice = slice, lodash.sortBy = sortBy, lodash.sortedUniq = sortedUniq, lodash.sortedUniqBy = sortedUniqBy, lodash.split = split, lodash.spread = spread, lodash.tail = tail, lodash.take = take, lodash.takeRight = takeRight, lodash.takeRightWhile = takeRightWhile, lodash.takeWhile = takeWhile, lodash.tap = tap, lodash.throttle = throttle, lodash.thru = thru, lodash.toArray = toArray, lodash.toPairs = toPairs, lodash.toPairsIn = toPairsIn, lodash.toPath = toPath, lodash.toPlainObject = toPlainObject, lodash.transform = transform2, lodash.unary = unary, lodash.union = union2, lodash.unionBy = unionBy, lodash.unionWith = unionWith, lodash.uniq = uniq2, lodash.uniqBy = uniqBy2, lodash.uniqWith = uniqWith, lodash.unset = unset, lodash.unzip = unzip, lodash.unzipWith = unzipWith, lodash.update = update, lodash.updateWith = updateWith, lodash.values = values2, lodash.valuesIn = valuesIn, lodash.without = without, lodash.words = words, lodash.wrap = wrap, lodash.xor = xor, lodash.xorBy = xorBy, lodash.xorWith = xorWith, lodash.zip = zip2, lodash.zipObject = zipObject, lodash.zipObjectDeep = zipObjectDeep, lodash.zipWith = zipWith, lodash.entries = toPairs, lodash.entriesIn = toPairsIn, lodash.extend = assignIn, lodash.extendWith = assignInWith, mixin(lodash, lodash), lodash.add = add, lodash.attempt = attempt, lodash.camelCase = camelCase, lodash.capitalize = capitalize2, lodash.ceil = ceil, lodash.clamp = clamp, lodash.clone = clone, lodash.cloneDeep = cloneDeep2, lodash.cloneDeepWith = cloneDeepWith, lodash.cloneWith = cloneWith, lodash.conformsTo = conformsTo, lodash.deburr = deburr, lodash.defaultTo = defaultTo, lodash.divide = divide, lodash.endsWith = endsWith3, lodash.eq = eq, lodash.escape = escape, lodash.escapeRegExp = escapeRegExp4, lodash.every = every, lodash.find = find, lodash.findIndex = findIndex, lodash.findKey = findKey, lodash.findLast = findLast, lodash.findLastIndex = findLastIndex, lodash.findLastKey = findLastKey, lodash.floor = floor, lodash.forEach = forEach, lodash.forEachRight = forEachRight, lodash.forIn = forIn, lodash.forInRight = forInRight, lodash.forOwn = forOwn, lodash.forOwnRight = forOwnRight, lodash.get = get, lodash.gt = gt, lodash.gte = gte, lodash.has = has, lodash.hasIn = hasIn, lodash.head = head, lodash.identity = identity2, lodash.includes = includes2, lodash.indexOf = indexOf, lodash.inRange = inRange, lodash.invoke = invoke, lodash.isArguments = isArguments, lodash.isArray = isArray, lodash.isArrayBuffer = isArrayBuffer, lodash.isArrayLike = isArrayLike, lodash.isArrayLikeObject = isArrayLikeObject, lodash.isBoolean = isBoolean2, lodash.isBuffer = isBuffer, lodash.isDate = isDate, lodash.isElement = isElement, lodash.isEmpty = isEmpty2, lodash.isEqual = isEqual, lodash.isEqualWith = isEqualWith, lodash.isError = isError2, lodash.isFinite = isFinite2, lodash.isFunction = isFunction, lodash.isInteger = isInteger, lodash.isLength = isLength, lodash.isMap = isMap, lodash.isMatch = isMatch, lodash.isMatchWith = isMatchWith, lodash.isNaN = isNaN2, lodash.isNative = isNative, lodash.isNil = isNil, lodash.isNull = isNull, lodash.isNumber = isNumber2, lodash.isObject = isObject2, lodash.isObjectLike = isObjectLike, lodash.isPlainObject = isPlainObject3, lodash.isRegExp = isRegExp, lodash.isSafeInteger = isSafeInteger, lodash.isSet = isSet, lodash.isString = isString3, lodash.isSymbol = isSymbol, lodash.isTypedArray = isTypedArray, lodash.isUndefined = isUndefined, lodash.isWeakMap = isWeakMap, lodash.isWeakSet = isWeakSet, lodash.join = join2, lodash.kebabCase = kebabCase, lodash.last = last, lodash.lastIndexOf = lastIndexOf, lodash.lowerCase = lowerCase, lodash.lowerFirst = lowerFirst, lodash.lt = lt, lodash.lte = lte, lodash.max = max, lodash.maxBy = maxBy, lodash.mean = mean, lodash.meanBy = meanBy, lodash.min = min, lodash.minBy = minBy, lodash.stubArray = stubArray, lodash.stubFalse = stubFalse, lodash.stubObject = stubObject, lodash.stubString = stubString, lodash.stubTrue = stubTrue, lodash.multiply = multiply, lodash.nth = nth, lodash.noConflict = noConflict, lodash.noop = noop2, lodash.now = now, lodash.pad = pad, lodash.padEnd = padEnd, lodash.padStart = padStart, lodash.parseInt = parseInt2, lodash.random = random, lodash.reduce = reduce, lodash.reduceRight = reduceRight, lodash.repeat = repeat3, lodash.replace = replace, lodash.result = result, lodash.round = round, lodash.runInContext = runInContext2, lodash.sample = sample, lodash.size = size, lodash.snakeCase = snakeCase, lodash.some = some, lodash.sortedIndex = sortedIndex, lodash.sortedIndexBy = sortedIndexBy, lodash.sortedIndexOf = sortedIndexOf, lodash.sortedLastIndex = sortedLastIndex, lodash.sortedLastIndexBy = sortedLastIndexBy, lodash.sortedLastIndexOf = sortedLastIndexOf, lodash.startCase = startCase, lodash.startsWith = startsWith3, lodash.subtract = subtract, lodash.sum = sum, lodash.sumBy = sumBy, lodash.template = template, lodash.times = times, lodash.toFinite = toFinite, lodash.toInteger = toInteger, lodash.toLength = toLength, lodash.toLower = toLower, lodash.toNumber = toNumber, lodash.toSafeInteger = toSafeInteger, lodash.toString = toString2, lodash.toUpper = toUpper, lodash.trim = trim2, lodash.trimEnd = trimEnd, lodash.trimStart = trimStart, lodash.truncate = truncate, lodash.unescape = unescape4, lodash.uniqueId = uniqueId, lodash.upperCase = upperCase, lodash.upperFirst = upperFirst, lodash.each = forEach, lodash.eachRight = forEachRight, lodash.first = head, mixin(lodash, (function() {
+        return lodash.after = after, lodash.ary = ary, lodash.assign = assign, lodash.assignIn = assignIn, lodash.assignInWith = assignInWith, lodash.assignWith = assignWith, lodash.at = at, lodash.before = before, lodash.bind = bind, lodash.bindAll = bindAll, lodash.bindKey = bindKey, lodash.castArray = castArray, lodash.chain = chain, lodash.chunk = chunk, lodash.compact = compact2, lodash.concat = concat, lodash.cond = cond, lodash.conforms = conforms, lodash.constant = constant, lodash.countBy = countBy, lodash.create = create, lodash.curry = curry, lodash.curryRight = curryRight, lodash.debounce = debounce2, lodash.defaults = defaults, lodash.defaultsDeep = defaultsDeep, lodash.defer = defer2, lodash.delay = delay2, lodash.difference = difference2, lodash.differenceBy = differenceBy, lodash.differenceWith = differenceWith, lodash.drop = drop, lodash.dropRight = dropRight, lodash.dropRightWhile = dropRightWhile, lodash.dropWhile = dropWhile, lodash.fill = fill, lodash.filter = filter, lodash.flatMap = flatMap, lodash.flatMapDeep = flatMapDeep, lodash.flatMapDepth = flatMapDepth, lodash.flatten = flatten, lodash.flattenDeep = flattenDeep, lodash.flattenDepth = flattenDepth, lodash.flip = flip, lodash.flow = flow, lodash.flowRight = flowRight, lodash.fromPairs = fromPairs, lodash.functions = functions, lodash.functionsIn = functionsIn, lodash.groupBy = groupBy2, lodash.initial = initial, lodash.intersection = intersection, lodash.intersectionBy = intersectionBy, lodash.intersectionWith = intersectionWith, lodash.invert = invert, lodash.invertBy = invertBy, lodash.invokeMap = invokeMap, lodash.iteratee = iteratee, lodash.keyBy = keyBy, lodash.keys = keys, lodash.keysIn = keysIn, lodash.map = map, lodash.mapKeys = mapKeys, lodash.mapValues = mapValues, lodash.matches = matches2, lodash.matchesProperty = matchesProperty, lodash.memoize = memoize, lodash.merge = merge, lodash.mergeWith = mergeWith, lodash.method = method, lodash.methodOf = methodOf, lodash.mixin = mixin, lodash.negate = negate, lodash.nthArg = nthArg, lodash.omit = omit, lodash.omitBy = omitBy, lodash.once = once, lodash.orderBy = orderBy, lodash.over = over, lodash.overArgs = overArgs, lodash.overEvery = overEvery, lodash.overSome = overSome, lodash.partial = partial, lodash.partialRight = partialRight, lodash.partition = partition2, lodash.pick = pick, lodash.pickBy = pickBy2, lodash.property = property, lodash.propertyOf = propertyOf, lodash.pull = pull3, lodash.pullAll = pullAll, lodash.pullAllBy = pullAllBy, lodash.pullAllWith = pullAllWith, lodash.pullAt = pullAt, lodash.range = range, lodash.rangeRight = rangeRight, lodash.rearg = rearg, lodash.reject = reject, lodash.remove = remove2, lodash.rest = rest, lodash.reverse = reverse, lodash.sampleSize = sampleSize, lodash.set = set, lodash.setWith = setWith, lodash.shuffle = shuffle, lodash.slice = slice, lodash.sortBy = sortBy, lodash.sortedUniq = sortedUniq, lodash.sortedUniqBy = sortedUniqBy, lodash.split = split, lodash.spread = spread, lodash.tail = tail, lodash.take = take, lodash.takeRight = takeRight, lodash.takeRightWhile = takeRightWhile, lodash.takeWhile = takeWhile, lodash.tap = tap, lodash.throttle = throttle, lodash.thru = thru, lodash.toArray = toArray, lodash.toPairs = toPairs, lodash.toPairsIn = toPairsIn, lodash.toPath = toPath, lodash.toPlainObject = toPlainObject, lodash.transform = transform2, lodash.unary = unary, lodash.union = union2, lodash.unionBy = unionBy, lodash.unionWith = unionWith, lodash.uniq = uniq2, lodash.uniqBy = uniqBy2, lodash.uniqWith = uniqWith, lodash.unset = unset, lodash.unzip = unzip, lodash.unzipWith = unzipWith, lodash.update = update, lodash.updateWith = updateWith, lodash.values = values2, lodash.valuesIn = valuesIn, lodash.without = without, lodash.words = words, lodash.wrap = wrap, lodash.xor = xor, lodash.xorBy = xorBy, lodash.xorWith = xorWith, lodash.zip = zip2, lodash.zipObject = zipObject, lodash.zipObjectDeep = zipObjectDeep, lodash.zipWith = zipWith, lodash.entries = toPairs, lodash.entriesIn = toPairsIn, lodash.extend = assignIn, lodash.extendWith = assignInWith, mixin(lodash, lodash), lodash.add = add, lodash.attempt = attempt, lodash.camelCase = camelCase, lodash.capitalize = capitalize2, lodash.ceil = ceil, lodash.clamp = clamp, lodash.clone = clone, lodash.cloneDeep = cloneDeep2, lodash.cloneDeepWith = cloneDeepWith, lodash.cloneWith = cloneWith, lodash.conformsTo = conformsTo, lodash.deburr = deburr, lodash.defaultTo = defaultTo, lodash.divide = divide, lodash.endsWith = endsWith3, lodash.eq = eq, lodash.escape = escape, lodash.escapeRegExp = escapeRegExp4, lodash.every = every, lodash.find = find, lodash.findIndex = findIndex, lodash.findKey = findKey, lodash.findLast = findLast, lodash.findLastIndex = findLastIndex, lodash.findLastKey = findLastKey, lodash.floor = floor, lodash.forEach = forEach, lodash.forEachRight = forEachRight, lodash.forIn = forIn, lodash.forInRight = forInRight, lodash.forOwn = forOwn, lodash.forOwnRight = forOwnRight, lodash.get = get, lodash.gt = gt, lodash.gte = gte, lodash.has = has, lodash.hasIn = hasIn, lodash.head = head, lodash.identity = identity2, lodash.includes = includes2, lodash.indexOf = indexOf, lodash.inRange = inRange, lodash.invoke = invoke, lodash.isArguments = isArguments, lodash.isArray = isArray, lodash.isArrayBuffer = isArrayBuffer, lodash.isArrayLike = isArrayLike, lodash.isArrayLikeObject = isArrayLikeObject, lodash.isBoolean = isBoolean2, lodash.isBuffer = isBuffer, lodash.isDate = isDate, lodash.isElement = isElement, lodash.isEmpty = isEmpty2, lodash.isEqual = isEqual, lodash.isEqualWith = isEqualWith, lodash.isError = isError2, lodash.isFinite = isFinite2, lodash.isFunction = isFunction, lodash.isInteger = isInteger, lodash.isLength = isLength, lodash.isMap = isMap, lodash.isMatch = isMatch, lodash.isMatchWith = isMatchWith, lodash.isNaN = isNaN2, lodash.isNative = isNative, lodash.isNil = isNil, lodash.isNull = isNull, lodash.isNumber = isNumber2, lodash.isObject = isObject2, lodash.isObjectLike = isObjectLike, lodash.isPlainObject = isPlainObject3, lodash.isRegExp = isRegExp, lodash.isSafeInteger = isSafeInteger, lodash.isSet = isSet, lodash.isString = isString3, lodash.isSymbol = isSymbol, lodash.isTypedArray = isTypedArray, lodash.isUndefined = isUndefined, lodash.isWeakMap = isWeakMap, lodash.isWeakSet = isWeakSet, lodash.join = join2, lodash.kebabCase = kebabCase, lodash.last = last, lodash.lastIndexOf = lastIndexOf, lodash.lowerCase = lowerCase, lodash.lowerFirst = lowerFirst, lodash.lt = lt2, lodash.lte = lte, lodash.max = max, lodash.maxBy = maxBy, lodash.mean = mean, lodash.meanBy = meanBy, lodash.min = min, lodash.minBy = minBy, lodash.stubArray = stubArray, lodash.stubFalse = stubFalse, lodash.stubObject = stubObject, lodash.stubString = stubString, lodash.stubTrue = stubTrue, lodash.multiply = multiply, lodash.nth = nth, lodash.noConflict = noConflict, lodash.noop = noop2, lodash.now = now, lodash.pad = pad, lodash.padEnd = padEnd, lodash.padStart = padStart, lodash.parseInt = parseInt2, lodash.random = random, lodash.reduce = reduce, lodash.reduceRight = reduceRight, lodash.repeat = repeat3, lodash.replace = replace, lodash.result = result, lodash.round = round, lodash.runInContext = runInContext2, lodash.sample = sample, lodash.size = size, lodash.snakeCase = snakeCase, lodash.some = some, lodash.sortedIndex = sortedIndex, lodash.sortedIndexBy = sortedIndexBy, lodash.sortedIndexOf = sortedIndexOf, lodash.sortedLastIndex = sortedLastIndex, lodash.sortedLastIndexBy = sortedLastIndexBy, lodash.sortedLastIndexOf = sortedLastIndexOf, lodash.startCase = startCase, lodash.startsWith = startsWith3, lodash.subtract = subtract, lodash.sum = sum, lodash.sumBy = sumBy, lodash.template = template, lodash.times = times, lodash.toFinite = toFinite, lodash.toInteger = toInteger, lodash.toLength = toLength, lodash.toLower = toLower, lodash.toNumber = toNumber, lodash.toSafeInteger = toSafeInteger, lodash.toString = toString2, lodash.toUpper = toUpper, lodash.trim = trim2, lodash.trimEnd = trimEnd, lodash.trimStart = trimStart, lodash.truncate = truncate, lodash.unescape = unescape4, lodash.uniqueId = uniqueId, lodash.upperCase = upperCase, lodash.upperFirst = upperFirst, lodash.each = forEach, lodash.eachRight = forEachRight, lodash.first = head, mixin(lodash, (function() {
           var source = {};
           return baseForOwn(lodash, function(func, methodName) {
             hasOwnProperty.call(lodash.prototype, methodName) || (source[methodName] = func);
@@ -51028,7 +51030,7 @@ var require_lodash2 = __commonJS({
         function isWeakSet(value) {
           return isObjectLike(value) && baseGetTag(value) == weakSetTag;
         }
-        var lt = createRelationalOperation(baseLt), lte = createRelationalOperation(function(value, other) {
+        var lt2 = createRelationalOperation(baseLt), lte = createRelationalOperation(function(value, other) {
           return value <= other;
         });
         function toArray(value) {
@@ -51596,7 +51598,7 @@ function print() { __p += __j.call(arguments, '') }
         function sumBy(array, iteratee2) {
           return array && array.length ? baseSum(array, getIteratee(iteratee2, 2)) : 0;
         }
-        return lodash.after = after, lodash.ary = ary, lodash.assign = assign, lodash.assignIn = assignIn, lodash.assignInWith = assignInWith, lodash.assignWith = assignWith, lodash.at = at, lodash.before = before, lodash.bind = bind, lodash.bindAll = bindAll, lodash.bindKey = bindKey, lodash.castArray = castArray, lodash.chain = chain, lodash.chunk = chunk, lodash.compact = compact2, lodash.concat = concat, lodash.cond = cond, lodash.conforms = conforms, lodash.constant = constant, lodash.countBy = countBy, lodash.create = create, lodash.curry = curry, lodash.curryRight = curryRight, lodash.debounce = debounce2, lodash.defaults = defaults, lodash.defaultsDeep = defaultsDeep, lodash.defer = defer2, lodash.delay = delay2, lodash.difference = difference2, lodash.differenceBy = differenceBy, lodash.differenceWith = differenceWith, lodash.drop = drop, lodash.dropRight = dropRight, lodash.dropRightWhile = dropRightWhile, lodash.dropWhile = dropWhile, lodash.fill = fill, lodash.filter = filter, lodash.flatMap = flatMap, lodash.flatMapDeep = flatMapDeep, lodash.flatMapDepth = flatMapDepth, lodash.flatten = flatten, lodash.flattenDeep = flattenDeep, lodash.flattenDepth = flattenDepth, lodash.flip = flip, lodash.flow = flow, lodash.flowRight = flowRight, lodash.fromPairs = fromPairs, lodash.functions = functions, lodash.functionsIn = functionsIn, lodash.groupBy = groupBy2, lodash.initial = initial, lodash.intersection = intersection, lodash.intersectionBy = intersectionBy, lodash.intersectionWith = intersectionWith, lodash.invert = invert, lodash.invertBy = invertBy, lodash.invokeMap = invokeMap, lodash.iteratee = iteratee, lodash.keyBy = keyBy, lodash.keys = keys, lodash.keysIn = keysIn, lodash.map = map, lodash.mapKeys = mapKeys, lodash.mapValues = mapValues, lodash.matches = matches2, lodash.matchesProperty = matchesProperty, lodash.memoize = memoize, lodash.merge = merge, lodash.mergeWith = mergeWith, lodash.method = method, lodash.methodOf = methodOf, lodash.mixin = mixin, lodash.negate = negate, lodash.nthArg = nthArg, lodash.omit = omit, lodash.omitBy = omitBy, lodash.once = once, lodash.orderBy = orderBy, lodash.over = over, lodash.overArgs = overArgs, lodash.overEvery = overEvery, lodash.overSome = overSome, lodash.partial = partial, lodash.partialRight = partialRight, lodash.partition = partition2, lodash.pick = pick, lodash.pickBy = pickBy2, lodash.property = property, lodash.propertyOf = propertyOf, lodash.pull = pull3, lodash.pullAll = pullAll, lodash.pullAllBy = pullAllBy, lodash.pullAllWith = pullAllWith, lodash.pullAt = pullAt, lodash.range = range, lodash.rangeRight = rangeRight, lodash.rearg = rearg, lodash.reject = reject, lodash.remove = remove2, lodash.rest = rest, lodash.reverse = reverse, lodash.sampleSize = sampleSize, lodash.set = set, lodash.setWith = setWith, lodash.shuffle = shuffle, lodash.slice = slice, lodash.sortBy = sortBy, lodash.sortedUniq = sortedUniq, lodash.sortedUniqBy = sortedUniqBy, lodash.split = split, lodash.spread = spread, lodash.tail = tail, lodash.take = take, lodash.takeRight = takeRight, lodash.takeRightWhile = takeRightWhile, lodash.takeWhile = takeWhile, lodash.tap = tap, lodash.throttle = throttle, lodash.thru = thru, lodash.toArray = toArray, lodash.toPairs = toPairs, lodash.toPairsIn = toPairsIn, lodash.toPath = toPath, lodash.toPlainObject = toPlainObject, lodash.transform = transform2, lodash.unary = unary, lodash.union = union2, lodash.unionBy = unionBy, lodash.unionWith = unionWith, lodash.uniq = uniq2, lodash.uniqBy = uniqBy2, lodash.uniqWith = uniqWith, lodash.unset = unset, lodash.unzip = unzip, lodash.unzipWith = unzipWith, lodash.update = update, lodash.updateWith = updateWith, lodash.values = values2, lodash.valuesIn = valuesIn, lodash.without = without, lodash.words = words, lodash.wrap = wrap, lodash.xor = xor, lodash.xorBy = xorBy, lodash.xorWith = xorWith, lodash.zip = zip2, lodash.zipObject = zipObject, lodash.zipObjectDeep = zipObjectDeep, lodash.zipWith = zipWith, lodash.entries = toPairs, lodash.entriesIn = toPairsIn, lodash.extend = assignIn, lodash.extendWith = assignInWith, mixin(lodash, lodash), lodash.add = add, lodash.attempt = attempt, lodash.camelCase = camelCase, lodash.capitalize = capitalize2, lodash.ceil = ceil, lodash.clamp = clamp, lodash.clone = clone, lodash.cloneDeep = cloneDeep2, lodash.cloneDeepWith = cloneDeepWith, lodash.cloneWith = cloneWith, lodash.conformsTo = conformsTo, lodash.deburr = deburr, lodash.defaultTo = defaultTo, lodash.divide = divide, lodash.endsWith = endsWith3, lodash.eq = eq, lodash.escape = escape, lodash.escapeRegExp = escapeRegExp4, lodash.every = every, lodash.find = find, lodash.findIndex = findIndex, lodash.findKey = findKey, lodash.findLast = findLast, lodash.findLastIndex = findLastIndex, lodash.findLastKey = findLastKey, lodash.floor = floor, lodash.forEach = forEach, lodash.forEachRight = forEachRight, lodash.forIn = forIn, lodash.forInRight = forInRight, lodash.forOwn = forOwn, lodash.forOwnRight = forOwnRight, lodash.get = get, lodash.gt = gt, lodash.gte = gte, lodash.has = has, lodash.hasIn = hasIn, lodash.head = head, lodash.identity = identity2, lodash.includes = includes2, lodash.indexOf = indexOf, lodash.inRange = inRange, lodash.invoke = invoke, lodash.isArguments = isArguments, lodash.isArray = isArray, lodash.isArrayBuffer = isArrayBuffer, lodash.isArrayLike = isArrayLike, lodash.isArrayLikeObject = isArrayLikeObject, lodash.isBoolean = isBoolean2, lodash.isBuffer = isBuffer, lodash.isDate = isDate, lodash.isElement = isElement, lodash.isEmpty = isEmpty2, lodash.isEqual = isEqual, lodash.isEqualWith = isEqualWith, lodash.isError = isError2, lodash.isFinite = isFinite2, lodash.isFunction = isFunction, lodash.isInteger = isInteger, lodash.isLength = isLength, lodash.isMap = isMap, lodash.isMatch = isMatch, lodash.isMatchWith = isMatchWith, lodash.isNaN = isNaN2, lodash.isNative = isNative, lodash.isNil = isNil, lodash.isNull = isNull, lodash.isNumber = isNumber2, lodash.isObject = isObject2, lodash.isObjectLike = isObjectLike, lodash.isPlainObject = isPlainObject3, lodash.isRegExp = isRegExp, lodash.isSafeInteger = isSafeInteger, lodash.isSet = isSet, lodash.isString = isString3, lodash.isSymbol = isSymbol, lodash.isTypedArray = isTypedArray, lodash.isUndefined = isUndefined, lodash.isWeakMap = isWeakMap, lodash.isWeakSet = isWeakSet, lodash.join = join2, lodash.kebabCase = kebabCase, lodash.last = last, lodash.lastIndexOf = lastIndexOf, lodash.lowerCase = lowerCase, lodash.lowerFirst = lowerFirst, lodash.lt = lt, lodash.lte = lte, lodash.max = max, lodash.maxBy = maxBy, lodash.mean = mean, lodash.meanBy = meanBy, lodash.min = min, lodash.minBy = minBy, lodash.stubArray = stubArray, lodash.stubFalse = stubFalse, lodash.stubObject = stubObject, lodash.stubString = stubString, lodash.stubTrue = stubTrue, lodash.multiply = multiply, lodash.nth = nth, lodash.noConflict = noConflict, lodash.noop = noop2, lodash.now = now, lodash.pad = pad, lodash.padEnd = padEnd, lodash.padStart = padStart, lodash.parseInt = parseInt2, lodash.random = random, lodash.reduce = reduce, lodash.reduceRight = reduceRight, lodash.repeat = repeat3, lodash.replace = replace, lodash.result = result, lodash.round = round, lodash.runInContext = runInContext2, lodash.sample = sample, lodash.size = size, lodash.snakeCase = snakeCase, lodash.some = some, lodash.sortedIndex = sortedIndex, lodash.sortedIndexBy = sortedIndexBy, lodash.sortedIndexOf = sortedIndexOf, lodash.sortedLastIndex = sortedLastIndex, lodash.sortedLastIndexBy = sortedLastIndexBy, lodash.sortedLastIndexOf = sortedLastIndexOf, lodash.startCase = startCase, lodash.startsWith = startsWith3, lodash.subtract = subtract, lodash.sum = sum, lodash.sumBy = sumBy, lodash.template = template, lodash.times = times, lodash.toFinite = toFinite, lodash.toInteger = toInteger, lodash.toLength = toLength, lodash.toLower = toLower, lodash.toNumber = toNumber, lodash.toSafeInteger = toSafeInteger, lodash.toString = toString2, lodash.toUpper = toUpper, lodash.trim = trim2, lodash.trimEnd = trimEnd, lodash.trimStart = trimStart, lodash.truncate = truncate, lodash.unescape = unescape4, lodash.uniqueId = uniqueId, lodash.upperCase = upperCase, lodash.upperFirst = upperFirst, lodash.each = forEach, lodash.eachRight = forEachRight, lodash.first = head, mixin(lodash, (function() {
+        return lodash.after = after, lodash.ary = ary, lodash.assign = assign, lodash.assignIn = assignIn, lodash.assignInWith = assignInWith, lodash.assignWith = assignWith, lodash.at = at, lodash.before = before, lodash.bind = bind, lodash.bindAll = bindAll, lodash.bindKey = bindKey, lodash.castArray = castArray, lodash.chain = chain, lodash.chunk = chunk, lodash.compact = compact2, lodash.concat = concat, lodash.cond = cond, lodash.conforms = conforms, lodash.constant = constant, lodash.countBy = countBy, lodash.create = create, lodash.curry = curry, lodash.curryRight = curryRight, lodash.debounce = debounce2, lodash.defaults = defaults, lodash.defaultsDeep = defaultsDeep, lodash.defer = defer2, lodash.delay = delay2, lodash.difference = difference2, lodash.differenceBy = differenceBy, lodash.differenceWith = differenceWith, lodash.drop = drop, lodash.dropRight = dropRight, lodash.dropRightWhile = dropRightWhile, lodash.dropWhile = dropWhile, lodash.fill = fill, lodash.filter = filter, lodash.flatMap = flatMap, lodash.flatMapDeep = flatMapDeep, lodash.flatMapDepth = flatMapDepth, lodash.flatten = flatten, lodash.flattenDeep = flattenDeep, lodash.flattenDepth = flattenDepth, lodash.flip = flip, lodash.flow = flow, lodash.flowRight = flowRight, lodash.fromPairs = fromPairs, lodash.functions = functions, lodash.functionsIn = functionsIn, lodash.groupBy = groupBy2, lodash.initial = initial, lodash.intersection = intersection, lodash.intersectionBy = intersectionBy, lodash.intersectionWith = intersectionWith, lodash.invert = invert, lodash.invertBy = invertBy, lodash.invokeMap = invokeMap, lodash.iteratee = iteratee, lodash.keyBy = keyBy, lodash.keys = keys, lodash.keysIn = keysIn, lodash.map = map, lodash.mapKeys = mapKeys, lodash.mapValues = mapValues, lodash.matches = matches2, lodash.matchesProperty = matchesProperty, lodash.memoize = memoize, lodash.merge = merge, lodash.mergeWith = mergeWith, lodash.method = method, lodash.methodOf = methodOf, lodash.mixin = mixin, lodash.negate = negate, lodash.nthArg = nthArg, lodash.omit = omit, lodash.omitBy = omitBy, lodash.once = once, lodash.orderBy = orderBy, lodash.over = over, lodash.overArgs = overArgs, lodash.overEvery = overEvery, lodash.overSome = overSome, lodash.partial = partial, lodash.partialRight = partialRight, lodash.partition = partition2, lodash.pick = pick, lodash.pickBy = pickBy2, lodash.property = property, lodash.propertyOf = propertyOf, lodash.pull = pull3, lodash.pullAll = pullAll, lodash.pullAllBy = pullAllBy, lodash.pullAllWith = pullAllWith, lodash.pullAt = pullAt, lodash.range = range, lodash.rangeRight = rangeRight, lodash.rearg = rearg, lodash.reject = reject, lodash.remove = remove2, lodash.rest = rest, lodash.reverse = reverse, lodash.sampleSize = sampleSize, lodash.set = set, lodash.setWith = setWith, lodash.shuffle = shuffle, lodash.slice = slice, lodash.sortBy = sortBy, lodash.sortedUniq = sortedUniq, lodash.sortedUniqBy = sortedUniqBy, lodash.split = split, lodash.spread = spread, lodash.tail = tail, lodash.take = take, lodash.takeRight = takeRight, lodash.takeRightWhile = takeRightWhile, lodash.takeWhile = takeWhile, lodash.tap = tap, lodash.throttle = throttle, lodash.thru = thru, lodash.toArray = toArray, lodash.toPairs = toPairs, lodash.toPairsIn = toPairsIn, lodash.toPath = toPath, lodash.toPlainObject = toPlainObject, lodash.transform = transform2, lodash.unary = unary, lodash.union = union2, lodash.unionBy = unionBy, lodash.unionWith = unionWith, lodash.uniq = uniq2, lodash.uniqBy = uniqBy2, lodash.uniqWith = uniqWith, lodash.unset = unset, lodash.unzip = unzip, lodash.unzipWith = unzipWith, lodash.update = update, lodash.updateWith = updateWith, lodash.values = values2, lodash.valuesIn = valuesIn, lodash.without = without, lodash.words = words, lodash.wrap = wrap, lodash.xor = xor, lodash.xorBy = xorBy, lodash.xorWith = xorWith, lodash.zip = zip2, lodash.zipObject = zipObject, lodash.zipObjectDeep = zipObjectDeep, lodash.zipWith = zipWith, lodash.entries = toPairs, lodash.entriesIn = toPairsIn, lodash.extend = assignIn, lodash.extendWith = assignInWith, mixin(lodash, lodash), lodash.add = add, lodash.attempt = attempt, lodash.camelCase = camelCase, lodash.capitalize = capitalize2, lodash.ceil = ceil, lodash.clamp = clamp, lodash.clone = clone, lodash.cloneDeep = cloneDeep2, lodash.cloneDeepWith = cloneDeepWith, lodash.cloneWith = cloneWith, lodash.conformsTo = conformsTo, lodash.deburr = deburr, lodash.defaultTo = defaultTo, lodash.divide = divide, lodash.endsWith = endsWith3, lodash.eq = eq, lodash.escape = escape, lodash.escapeRegExp = escapeRegExp4, lodash.every = every, lodash.find = find, lodash.findIndex = findIndex, lodash.findKey = findKey, lodash.findLast = findLast, lodash.findLastIndex = findLastIndex, lodash.findLastKey = findLastKey, lodash.floor = floor, lodash.forEach = forEach, lodash.forEachRight = forEachRight, lodash.forIn = forIn, lodash.forInRight = forInRight, lodash.forOwn = forOwn, lodash.forOwnRight = forOwnRight, lodash.get = get, lodash.gt = gt, lodash.gte = gte, lodash.has = has, lodash.hasIn = hasIn, lodash.head = head, lodash.identity = identity2, lodash.includes = includes2, lodash.indexOf = indexOf, lodash.inRange = inRange, lodash.invoke = invoke, lodash.isArguments = isArguments, lodash.isArray = isArray, lodash.isArrayBuffer = isArrayBuffer, lodash.isArrayLike = isArrayLike, lodash.isArrayLikeObject = isArrayLikeObject, lodash.isBoolean = isBoolean2, lodash.isBuffer = isBuffer, lodash.isDate = isDate, lodash.isElement = isElement, lodash.isEmpty = isEmpty2, lodash.isEqual = isEqual, lodash.isEqualWith = isEqualWith, lodash.isError = isError2, lodash.isFinite = isFinite2, lodash.isFunction = isFunction, lodash.isInteger = isInteger, lodash.isLength = isLength, lodash.isMap = isMap, lodash.isMatch = isMatch, lodash.isMatchWith = isMatchWith, lodash.isNaN = isNaN2, lodash.isNative = isNative, lodash.isNil = isNil, lodash.isNull = isNull, lodash.isNumber = isNumber2, lodash.isObject = isObject2, lodash.isObjectLike = isObjectLike, lodash.isPlainObject = isPlainObject3, lodash.isRegExp = isRegExp, lodash.isSafeInteger = isSafeInteger, lodash.isSet = isSet, lodash.isString = isString3, lodash.isSymbol = isSymbol, lodash.isTypedArray = isTypedArray, lodash.isUndefined = isUndefined, lodash.isWeakMap = isWeakMap, lodash.isWeakSet = isWeakSet, lodash.join = join2, lodash.kebabCase = kebabCase, lodash.last = last, lodash.lastIndexOf = lastIndexOf, lodash.lowerCase = lowerCase, lodash.lowerFirst = lowerFirst, lodash.lt = lt2, lodash.lte = lte, lodash.max = max, lodash.maxBy = maxBy, lodash.mean = mean, lodash.meanBy = meanBy, lodash.min = min, lodash.minBy = minBy, lodash.stubArray = stubArray, lodash.stubFalse = stubFalse, lodash.stubObject = stubObject, lodash.stubString = stubString, lodash.stubTrue = stubTrue, lodash.multiply = multiply, lodash.nth = nth, lodash.noConflict = noConflict, lodash.noop = noop2, lodash.now = now, lodash.pad = pad, lodash.padEnd = padEnd, lodash.padStart = padStart, lodash.parseInt = parseInt2, lodash.random = random, lodash.reduce = reduce, lodash.reduceRight = reduceRight, lodash.repeat = repeat3, lodash.replace = replace, lodash.result = result, lodash.round = round, lodash.runInContext = runInContext2, lodash.sample = sample, lodash.size = size, lodash.snakeCase = snakeCase, lodash.some = some, lodash.sortedIndex = sortedIndex, lodash.sortedIndexBy = sortedIndexBy, lodash.sortedIndexOf = sortedIndexOf, lodash.sortedLastIndex = sortedLastIndex, lodash.sortedLastIndexBy = sortedLastIndexBy, lodash.sortedLastIndexOf = sortedLastIndexOf, lodash.startCase = startCase, lodash.startsWith = startsWith3, lodash.subtract = subtract, lodash.sum = sum, lodash.sumBy = sumBy, lodash.template = template, lodash.times = times, lodash.toFinite = toFinite, lodash.toInteger = toInteger, lodash.toLength = toLength, lodash.toLower = toLower, lodash.toNumber = toNumber, lodash.toSafeInteger = toSafeInteger, lodash.toString = toString2, lodash.toUpper = toUpper, lodash.trim = trim2, lodash.trimEnd = trimEnd, lodash.trimStart = trimStart, lodash.truncate = truncate, lodash.unescape = unescape4, lodash.uniqueId = uniqueId, lodash.upperCase = upperCase, lodash.upperFirst = upperFirst, lodash.each = forEach, lodash.eachRight = forEachRight, lodash.first = head, mixin(lodash, (function() {
           var source = {};
           return baseForOwn(lodash, function(func, methodName) {
             hasOwnProperty.call(lodash.prototype, methodName) || (source[methodName] = func);
@@ -126903,22 +126905,22 @@ From ` + this.originalError.stack);
       this.context.memoryLimit.use(str.length);
       let blocks2 = /* @__PURE__ */ new Map([["<script", "</script>"], ["<style", "</style>"], ["<!--", "-->"], ["<", ">"]]), out = "", i = 0;
       for (; i < str.length; ) {
-        let lt = str.indexOf("<", i);
-        if (lt < 0)
+        let lt2 = str.indexOf("<", i);
+        if (lt2 < 0)
           return out + str.slice(i);
-        out += str.slice(i, lt);
+        out += str.slice(i, lt2);
         for (let [opener, closer] of blocks2) {
-          if (!str.startsWith(opener, lt))
+          if (!str.startsWith(opener, lt2))
             continue;
-          let e = str.indexOf(closer, lt + opener.length);
+          let e = str.indexOf(closer, lt2 + opener.length);
           if (e >= 0) {
             i = e + closer.length;
             break;
           }
           blocks2.delete(opener);
         }
-        if (i === lt)
-          return out + str.slice(lt);
+        if (i === lt2)
+          return out + str.slice(lt2);
       }
       return out;
     }
@@ -203943,7 +203945,7 @@ var import_core2 = __toESM(require_lib()), BaseCommand = class extends import_co
   }
   async catch(error) {
     error.skipOclifErrorHandling = !0;
-    let { errorHandler } = await import("./error-handler-T5DK23DW.js");
+    let { errorHandler } = await import("./error-handler-MENPWWOI.js");
     return await errorHandler(error, this.config), import_core2.Errors.handle(error);
   }
   async _run() {
@@ -203951,11 +203953,11 @@ var import_core2 = __toESM(require_lib()), BaseCommand = class extends import_co
   }
   async init() {
     if (this.exitWithTimestampWhenEnvVariablePresent(), setCurrentCommandId(this.id ?? ""), !isDevelopment()) {
-      let { registerCleanBugsnagErrorsFromWithinPlugins } = await import("./error-handler-T5DK23DW.js");
+      let { registerCleanBugsnagErrorsFromWithinPlugins } = await import("./error-handler-MENPWWOI.js");
       await registerCleanBugsnagErrorsFromWithinPlugins(this.config);
     }
     await removeDuplicatedPlugins(this.config), this.showNpmFlagWarning();
-    let { showNotificationsIfNeeded: showNotificationsIfNeeded2 } = await import("./notifications-system-LJSYFBE6.js");
+    let { showNotificationsIfNeeded: showNotificationsIfNeeded2 } = await import("./notifications-system-TAHUXXGQ.js");
     return await showNotificationsIfNeeded2(), super.init();
   }
   // NPM creates an environment variable for every flag passed to a script.
@@ -203963,7 +203965,7 @@ var import_core2 = __toESM(require_lib()), BaseCommand = class extends import_co
   // and warns the user to use the `--` separator.
   showNpmFlagWarning() {
     let commandVariables = this.constructor;
-    Object.keys(commandVariables.flags || {}).map((key) => `npm_config_${underscore(key).replace(/^no_/, "")}`).some((flag) => process.env[flag] !== void 0) && import("./ui-XXDBKKJS.js").then(({ renderWarning: renderWarning2 }) => {
+    Object.keys(commandVariables.flags || {}).map((key) => `npm_config_${underscore(key).replace(/^no_/, "")}`).some((flag) => process.env[flag] !== void 0) && import("./ui-ZXHKYLCS.js").then(({ renderWarning: renderWarning2 }) => {
       renderWarning2({
         body: [
           "NPM scripts require an extra",
@@ -204012,7 +204014,7 @@ ${explanation} in non-interactive terminal environments, such as a CI environmen
     let flags = originalResult.flags, environmentsFileName = this.environmentsFilename();
     if (!environmentsFileName)
       return originalResult;
-    let { environmentFilePath } = await import("./environments-P6W4YQBT.js"), environmentFileExists = await environmentFilePath(environmentsFileName, { from: flags.path }), environments = [];
+    let { environmentFilePath } = await import("./environments-II3QYMU3.js"), environmentFileExists = await environmentFilePath(environmentsFileName, { from: flags.path }), environments = [];
     flags.environment && (environments = Array.isArray(flags.environment) ? flags.environment : [flags.environment]);
     let environmentSpecified = environments.length > 0;
     if (!environmentFileExists && !environmentSpecified || environmentSpecified && environments.length > 1)
@@ -204033,7 +204035,7 @@ ${explanation} in non-interactive terminal environments, such as a CI environmen
    * is specified it will try to load a default environment.
    */
   async loadEnvironmentForCommand(path4, environmentsFileName, specifiedEnvironment) {
-    let { loadEnvironment: loadEnvironment2 } = await import("./environments-P6W4YQBT.js");
+    let { loadEnvironment: loadEnvironment2 } = await import("./environments-II3QYMU3.js");
     return specifiedEnvironment ? { environment: await loadEnvironment2(specifiedEnvironment, environmentsFileName, { from: path4 }), isDefaultEnvironment: !1 } : { environment: await loadEnvironment2("default", environmentsFileName, { from: path4, silent: !0 }), isDefaultEnvironment: !0 };
   }
 };
@@ -204056,7 +204058,7 @@ function reportEnvironmentApplication(noDefaultsFlags, flagsWithEnvironments, en
   if (Object.keys(changes).length === 0)
     return;
   let items = Object.entries(changes).map(([name, value]) => `${name}: ${value}`);
-  import("./ui-XXDBKKJS.js").then(({ renderInfo: renderInfo2 }) => {
+  import("./ui-ZXHKYLCS.js").then(({ renderInfo: renderInfo2 }) => {
     renderInfo2({
       headline: ["Using applicable flags from", { userInput: environmentName }, "environment:"],
       body: [{ list: { items } }]
@@ -204107,7 +204109,7 @@ async function removeDuplicatedPlugins(config2) {
   let plugins = Array.from(config2.plugins.values()), bundlePlugins = ["@shopify/app", "@shopify/plugin-cloudflare"], pluginsToRemove = plugins.filter((plugin) => bundlePlugins.includes(plugin.name));
   if (pluginsToRemove.length > 0) {
     let commandsToRun = pluginsToRemove.map((plugin) => `  - shopify plugins remove ${plugin.name}`).join(`
-`), { renderWarning: renderWarning2 } = await import("./ui-XXDBKKJS.js");
+`), { renderWarning: renderWarning2 } = await import("./ui-ZXHKYLCS.js");
     renderWarning2({
       headline: `Unsupported plugins detected: ${pluginsToRemove.map((plugin) => plugin.name).join(", ")}`,
       body: [
@@ -204129,20 +204131,20 @@ init_cjs_shims();
 init_cjs_shims();
 import { fileURLToPath as fileURLToPath2 } from "node:url";
 async function launchCLI(options) {
-  let { isDevelopment: isDevelopment2 } = await import("./local-XHZE5NPW.js"), { ShopifyConfig } = await import("./custom-oclif-loader-M5AZS4TE.js"), oclifModule = await import("./lib-NYDMHWZM.js"), { run, flush, Errors: Errors2, settings } = oclifModule.default ?? oclifModule;
+  let { isDevelopment: isDevelopment2 } = await import("./local-G2BSQFFH.js"), { ShopifyConfig } = await import("./custom-oclif-loader-WGQ253VO.js"), oclifModule = await import("./lib-NYDMHWZM.js"), { run, flush, Errors: Errors2, settings } = oclifModule.default ?? oclifModule;
   isDevelopment2() && (settings.debug = !0);
   try {
     let config2 = new ShopifyConfig({ root: fileURLToPath2(options.moduleURL) });
     await config2.load(), options.lazyCommandLoader && config2.setLazyCommandLoader(options.lazyCommandLoader);
     let argv = options.argv ?? process.argv.slice(2), passthroughIndex = argv.indexOf("--");
     if ((passthroughIndex === -1 ? argv : argv.slice(0, passthroughIndex)).includes("--json-schema") || isTruthy(process.env.SHOPIFY_FLAG_JSON_SCHEMA)) {
-      let { printCommandJsonSchema } = await import("./command-json-schema-JURPJVZ3.js");
+      let { printCommandJsonSchema } = await import("./command-json-schema-LA7ZVL4O.js");
       await printCommandJsonSchema(config2, argv, options.lazyCommandLoader);
       return;
     }
     await run(argv, config2), await flush();
   } catch (error) {
-    let { errorHandler } = await import("./error-handler-T5DK23DW.js");
+    let { errorHandler } = await import("./error-handler-MENPWWOI.js");
     await errorHandler(error);
     let handledError = error;
     return Errors2.handle({
@@ -204160,7 +204162,7 @@ var import_core3 = __toESM(require_lib());
 async function exitIfOldNodeVersion(versions2 = process.versions) {
   let nodeVersion = versions2.node, nodeMajorVersion = Number(nodeVersion.split(".")[0]);
   if (nodeMajorVersion < 22) {
-    let { renderError: renderError2 } = await import("./ui-XXDBKKJS.js");
+    let { renderError: renderError2 } = await import("./ui-ZXHKYLCS.js");
     renderError2({
       headline: "Upgrade to a supported Node version now.",
       body: [
@@ -204187,7 +204189,7 @@ async function runCLI(options, launchCLI2 = launchCLI, argv = process.argv, env2
   return setupEnvironmentVariables(options, argv, env2), options.runInCreateMode && await addInitToArgvWhenRunningCreateCLI(options, argv), forceNoColor(argv, env2), await exitIfOldNodeVersion(versions2), launchCLI2({ moduleURL: options.moduleURL, lazyCommandLoader: options.lazyCommandLoader });
 }
 async function addInitToArgvWhenRunningCreateCLI(options, argv = process.argv) {
-  let { findUpAndReadPackageJson: findUpAndReadPackageJson2 } = await import("./node-package-manager-IRHXUBQ2.js"), { moduleDirectory: moduleDirectory2 } = await import("./path-2KZ7FSGN.js"), name = (await findUpAndReadPackageJson2(moduleDirectory2(options.moduleURL))).content.name.replace("@shopify/create-", "");
+  let { findUpAndReadPackageJson: findUpAndReadPackageJson2 } = await import("./node-package-manager-QET5FYFY.js"), { moduleDirectory: moduleDirectory2 } = await import("./path-RDYZ7Q5T.js"), name = (await findUpAndReadPackageJson2(moduleDirectory2(options.moduleURL))).content.name.replace("@shopify/create-", "");
   if (argv.findIndex((arg) => arg.includes("init")) === -1) {
     let initIndex2 = argv.findIndex((arg) => arg.match(new RegExp(`bin(\\/|\\\\)+(create-${name}|dev|run)`))) + 1;
     argv.splice(initIndex2, 0, "init");
@@ -215322,7 +215324,7 @@ init_cjs_shims();
 
 // ../cli-kit/dist/public/node/git.js
 init_cjs_shims();
-var import_ignore3 = __toESM(require_ignore2());
+var import_semver = __toESM(require_semver()), import_ignore3 = __toESM(require_ignore2());
 async function gitCommand(args, directory) {
   try {
     return (await execa("git", args, { cwd: directory })).stdout;
@@ -215385,6 +215387,35 @@ async function ensureGitIsPresentOrAbort() {
   if (!await hasGit())
     throw new AbortError("Git is necessary in the environment to continue", outputContent`Install ${outputToken.link("git", "https://git-scm.com/book/en/v2/Getting-Started-Installing-Git")}`);
 }
+function parseGitVersion(versionOutput) {
+  let match2 = /^git version (?<version>\d+\.\d+\.\d+)(?<suffix>[.\s-].*)?$/.exec(versionOutput.trim()), version = match2?.groups?.version;
+  if (!version)
+    return;
+  let releaseCandidateNumber = /^(?:\.rc|-rc\.?)(?<number>\d+)(?:[.\s-].*)?$/.exec(match2.groups?.suffix ?? "")?.groups?.number;
+  return releaseCandidateNumber ? `${version}-rc.${releaseCandidateNumber}` : version;
+}
+async function ensureGitVersionIsAtLeast(minimumVersion, options = {}) {
+  let versionOutput = await inTemporaryDirectory((emptyGitDirectory) => captureGitVersionOutput(minimumVersion, { cwd: options.cwd, env: { GIT_DIR: emptyGitDirectory } })), installedVersion = parseGitVersion(versionOutput);
+  if (!installedVersion)
+    throw outputDebug(outputContent`Unrecognized git --version output: ${outputToken.raw(JSON.stringify(versionOutput.slice(0, 200)))}`), new AbortError("Couldn't determine the installed Git version.", `Install Git ${minimumVersion} or later, then try again.`);
+  if ((0, import_semver.lt)(installedVersion, minimumVersion))
+    throw new AbortError(`Git ${minimumVersion} or later is required, but version ${installedVersion} is installed.`, `Upgrade Git to version ${minimumVersion} or later, then try again.`);
+}
+async function captureGitVersionOutput(minimumVersion, execOptions) {
+  let { captureOutput } = await import("./system-EHWOZQCE.js");
+  try {
+    return await captureOutput("git", ["--version"], execOptions);
+  } catch (error) {
+    if (error instanceof AbortError)
+      throw error;
+    if (error instanceof Error && "code" in error && error.code === "ENOENT")
+      throw new AbortError(`Git ${minimumVersion} or later is required, but Git isn't installed.`, `Install Git ${minimumVersion} or later, then try again.`);
+    let reason = error instanceof Error ? error.message : String(error);
+    outputDebug(outputContent`Couldn't run git --version: ${outputToken.raw(reason)}`);
+    let gitError = error instanceof Error && "stderr" in error && typeof error.stderr == "string" ? error.stderr.trim() : "";
+    throw new AbortError(gitError ? `Couldn't run Git to check its version: ${gitError}` : "Couldn't run Git to check its version.", `Check that Git ${minimumVersion} or later is installed and can run, then try again.`);
+  }
+}
 async function insideGitDirectory(directory) {
   return await hasGit() ? checkIfInsideGitDirectory(directory) : !1;
 }
@@ -217373,7 +217404,7 @@ init_cjs_shims();
 
 // ../cli-kit/dist/public/node/liquid.js
 init_cjs_shims();
-var import_liquidjs = __toESM(require_liquid_node(), 1);
+var import_liquidjs = __toESM(require_liquid_node());
 function renderLiquidTemplate(templateContent, data) {
   let engine = new import_liquidjs.Liquid();
   return engine.render(engine.parse(templateContent), data);
@@ -220472,7 +220503,7 @@ init_cjs_shims();
 init_cjs_shims();
 var import_core29 = __toESM(require_lib(), 1), blockingLevels = ["high", "medium", "low", "none"], appSecurityBlockingFlag = {
   blocking: import_core29.Flags.custom({
-    description: "The minimum finding severity that causes a non-zero exit code.",
+    description: "The minimum finding severity that causes a non-zero exit code: high, medium, or low. Defaults to none, which never fails on findings.",
     options: blockingLevels,
     default: "none",
     env: "SHOPIFY_FLAG_APP_SECURITY_BLOCKING"
@@ -220595,7 +220626,7 @@ Do not report:
 `,
   `---
 id: APP_PROXY_LIQUID_INJECTION
-version: 2
+version: 3
 severity: high
 precedence: prefer-agent
 ---
@@ -220700,10 +220731,10 @@ Do not report:
 - Protocol-only canonicalization concerns with no demonstrated app-local exploit path
 - Test handlers
 `,
-  "---\nid: COMMITTED_SECRET\nversion: 3\nseverity: high\nprecedence: union\n---\n\n# Committed Secret\n\nInspect files skipped by deterministic secret scanning for committed credentials. Never quote or reproduce a secret; cite only the file and redacted credential kind, and recommend rotation.\n\nDo not report placeholders, public client identifiers (`SHOPIFY_API_KEY`, Stripe `pk_`), or files git confirms are untracked and ignored. Template env files (`.env.example`, `.sample`, `.template`, `.dist`) are findings only when they contain a known credential format.\n",
+  "---\nid: COMMITTED_SECRET\nversion: 4\nseverity: high\nprecedence: union\n---\n\n# Committed Secret\n\nInspect files skipped by deterministic secret scanning for committed credentials. Never quote or reproduce a secret; cite only the file and redacted credential kind, and recommend rotation.\n\nDo not report placeholders, public client identifiers (`SHOPIFY_API_KEY`, Stripe `pk_`), or files git confirms are untracked and ignored. Template env files (`.env.example`, `.sample`, `.template`, `.dist`) are findings only when they contain a known credential format.\n",
   `---
 id: CREDENTIAL_BROWSER_LEAKAGE
-version: 1
+version: 2
 severity: high
 precedence: prefer-agent
 ---
@@ -220714,7 +220745,7 @@ Trace credentials, access tokens, session tokens, and client secrets into loader
 `,
   `---
 id: CREDENTIAL_LOG_LEAKAGE
-version: 1
+version: 2
 severity: high
 precedence: prefer-agent
 ---
@@ -221025,7 +221056,7 @@ Do not report:
 `,
   `---
 id: DEPRECATED_SCRIPT_TAG_SCOPE
-version: 1
+version: 2
 severity: medium
 precedence: prefer-agent
 ---
@@ -221036,7 +221067,7 @@ Inspect parsed app scopes and JavaScript/TypeScript Admin API operations for dep
 `,
   `---
 id: EOL_API_VERSION
-version: 1
+version: 2
 severity: low
 precedence: prefer-agent
 ---
@@ -221045,7 +221076,7 @@ precedence: prefer-agent
 
 Inspect the selected \`shopify.app*.toml\` plus React Router \`app/shopify.server.*\` declarations. Shopify publishes quarterly versions in January, April, July, and October and supports each stable version for 12 months; the app security check allows a documented 30-day extension grace period before reporting it as end-of-life. Cite the exact declaration. For malformed config, computed \`ApiVersion\` values, or a Shopify-announced exceptional extension, inspect the source and current lifecycle policy rather than inferring from unrelated constants.
 `,
-  "---\nid: EXPIRING_OFFLINE_TOKEN\nversion: 1\nseverity: medium\nprecedence: prefer-agent\n---\n\n# Expiring Offline Token\n\nFor supported React Router apps, verify `expiringOfflineAccessTokens` is enabled and the selected session storage persists `expires`, `refreshToken`, and `refreshTokenExpires` metadata needed for refresh and rotation. `isOnline: false` selects an offline session; it does not disable token expiry and is not a finding. Report an explicit `expiringOfflineAccessTokens: false`. Treat absent or computed flags, custom storage, and ambiguous Prisma schemas as unresolved investigation: inspect storage adapters, migrations, and serialization before returning a clean result. Config-only and unsupported frameworks are handled by the runtime applicability boundary.\n",
+  "---\nid: EXPIRING_OFFLINE_TOKEN\nversion: 2\nseverity: medium\nprecedence: prefer-agent\n---\n\n# Expiring Offline Token\n\nFor supported React Router apps, verify `expiringOfflineAccessTokens` is enabled and the selected session storage persists `expires`, `refreshToken`, and `refreshTokenExpires` metadata needed for refresh and rotation. `isOnline: false` selects an offline session; it does not disable token expiry and is not a finding. Report an explicit `expiringOfflineAccessTokens: false`. Treat absent or computed flags, custom storage, and ambiguous Prisma schemas as unresolved investigation: inspect storage adapters, migrations, and serialization before returning a clean result. Config-only and unsupported frameworks are handled by the runtime applicability boundary.\n",
   `---
 id: INSECURE_WEBHOOK_URL
 version: 2
@@ -221060,17 +221091,24 @@ Inspect webhook destinations and OAuth redirect URLs in the selected Shopify app
   "---\nid: LIQUID_UNSAFE_RENDER\nversion: 1\nseverity: medium\nprecedence: union\n---\n\n# Liquid Unsafe Render\n\nInspect only theme-extension Liquid/HTML files the parser could not analyze. Liquid output is not automatically HTML-escaped. Check the destination: use `escape`/`escape_once` for HTML text and ordinary attributes, `json` when embedding a value as JavaScript data, and `metafield_tag` only for supported rich metafield rendering in HTML content. HTML escaping is not sufficient for event handlers, `srcdoc`, or a `<script src>` URL; avoid merchant-controlled output there and validate any dynamic URL. An ordinary non-script `src` attribute is not itself an executable sink. `{% raw %}` suppresses Liquid parsing, so apparent output inside it is literal text. Follow rendered snippets and inspect ambiguous filters or parser failures before reporting.\n",
   `---
 id: METAFIELD_OFFLINE_TOKEN
-version: 1
+version: 2
 severity: high
 ---
 
 # Metafield Offline Token
 
-Trace metafield writes and determine whether they use an offline Admin API context where an authenticated online context is required. Confirm token provenance and compensating authorization before reporting.
+Trace metafield and metaobject writes and determine their token provenance. Report a write that runs in an offline Admin API context that no verified request for the same shop authorizes: for example \`unauthenticated.admin(shop)\` or a stored offline session reached from an unauthenticated route, an unverified webhook or app proxy request, or a job whose shop or values come from request-controlled input.
+
+An offline session returned by \`authenticate.admin(request)\` (the React Router SDK default when \`useOnlineTokens\` isn't set) is a verified, shop-bound context: Shopify verified the session token and the staff member's access to the app. Don't report a write only because its token is offline or because an online token would add user attribution or expiry. Report it when:
+
+- the app defines its own per-user permission, for example an app-level role or allowlist check, and this write bypasses it. Name that permission.
+- request-controlled values reach an app-reserved (\`$app\`) metafield or metaobject that the app treats as trusted state and merchants can't edit themselves, for example a definition with \`access.admin = "merchant_read"\` or no merchant access, or billing, entitlement or feature-flag data. Writing to the \`$app\` namespace isn't safe by itself.
+
+Confirm token provenance and compensating authorization before reporting.
 `,
   `---
 id: MISSING_AUTHORIZATION_CHECK
-version: 2
+version: 3
 severity: high
 ---
 
@@ -221127,6 +221165,16 @@ actions.
    changes, direct URLs that survive permission downgrades, and backend actions
    that remain callable after a feature is hidden or disabled in the UI.
 
+## Shopify embedded apps (React Router)
+
+\`authenticate.admin(request)\` verifies the Shopify session token, so the caller is a staff member of that shop whom Shopify has granted access to this app. With offline tokens (the SDK default), Admin API calls use the app's granted scopes rather than the staff member's own permissions. That is Shopify's standard embedded app model, not a finding by itself. Report a handler only when it skips a concrete authorization boundary inside the app:
+
+- The app defines its own roles, owners, or allowlists (for example a check on \`sessionToken.sub\`, \`onlineAccessInfo.associated_user\`, \`account_owner\`, or an app database role), and a handler that performs the same or a more privileged operation doesn't apply it. Compare each route's loader and action, and sibling routes.
+- A request-supplied identifier selects an app-owned record that belongs to another user of the app.
+- The app uses online tokens to respect staff permissions on some paths, but a privileged path falls back to an offline session.
+
+If none of these applies, record the check as executed with no finding.
+
 ## What to report
 
 For each action that exposes a concrete unauthorized operation beyond authentication:
@@ -221530,7 +221578,7 @@ Do not report:
 `,
   `---
 id: REQUEST_CONTROLLED_ADMIN_CONTEXT
-version: 3
+version: 4
 severity: high
 precedence: prefer-agent
 ---
@@ -222129,17 +222177,7 @@ Do not report:
 - \`exec()\` with literal strings (no user input)
 - Shell calls with properly escaped arguments
 `,
-  `---
-id: STATIC_FRAME_ANCESTORS
-version: 1
-severity: high
-precedence: prefer-agent
----
-
-# Static Frame Ancestors
-
-Inspect embedded-app Content-Security-Policy construction. Report wildcard or static cross-shop frame-ancestors policies; accept a policy derived safely for the authenticated shop plus Shopify Admin.
-`,
+  "---\nid: STATIC_FRAME_ANCESTORS\nversion: 2\nseverity: high\nprecedence: prefer-agent\n---\n\n# Static Frame Ancestors\n\nInspect embedded-app Content-Security-Policy construction, including headers that app code sets after or instead of the SDK's. Report wildcard or static cross-shop frame-ancestors policies, such as `*`, `https:`, `*.myshopify.com`, or a fixed list of shop domains, whether the value is written literally or built from variables. Accept a policy derived safely for the shop plus Shopify Admin.\n\nThe React Router SDK's `addDocumentResponseHeaders` (from `shopifyApp()`, usually called in `entry.server`) is the accepted pattern: it sets `frame-ancestors` to the sanitized request shop plus Shopify Admin origins, including Shopify-operated development admin origins. Don't report it unless app code overrides or extends its header.\n",
   `---
 id: TEXT_SETTING_HTML_SMUGGLING
 version: 2
@@ -222334,7 +222372,7 @@ Do not report:
 `,
   `---
 id: UNAUTHENTICATED_ENDPOINT
-version: 2
+version: 3
 severity: high
 precedence: union
 ---
@@ -222471,7 +222509,7 @@ pack instructions.
 `,
   `---
 id: UNSAFE_INNERHTML
-version: 2
+version: 3
 severity: high
 precedence: union
 ---
@@ -222745,7 +222783,10 @@ For each check:
 5. Keep the check \`id\` and \`version\` exactly as they appear in {{AGENT_CHECKS_PATH}}.
 6. Include concise evidence citations. Never include a detected secret value or unnecessary personal data.
 
-A check with no verified issue must not produce a fabricated finding. If you cannot establish exploitability or affected authority, record the check as \`unresolved\` with a reason instead.
+A check with no verified issue must not produce a fabricated finding. Choose the status from what you were able to investigate, not from whether you can prove a negative:
+
+- \`executed\`: you traced the paths the check directs you to and found no concrete issue. This includes code that follows the safe pattern the check or its \`docs_url\` describes. A candidate is ruled out when the code establishes the boundary the check asks about, even if you can't rule out hypothetical policies or requirements that the repository doesn't define.
+- \`unresolved\`: you couldn't complete the investigation, for example because required code was unreadable, out of scope, or outside the repository and you couldn't inspect it, or you found a specific candidate whose boundary you could neither establish nor show to be missing. Name the candidate's file and line, or the missing input, in the reason.
 
 ### 4. Write one findings document
 
@@ -222789,7 +222830,7 @@ Write a single JSON document that covers every check you ran:
 - \`status\` is one of:
   - \`executed\`: you investigated the check, whether or not it produced findings.
   - \`not_applicable\`: the capability the check covers is absent. It can't have findings.
-  - \`unresolved\`: you couldn't finish the check or prove the issue. An unresolved check didn't pass; never describe it as passing.
+  - \`unresolved\`: you couldn't complete the investigation, or you named a specific candidate whose boundary is still unclear. An unresolved check didn't pass; never describe it as passing.
 - \`not_applicable\` and \`unresolved\` require a \`reason\` with a short \`code\` and a \`message\`.
 - Each finding needs \`file\`, \`line\` (1 or greater), \`message\`, and at least one \`evidence\` item with \`file\`, \`line\`, and \`quote\`.
 - Optional finding fields: \`snippet\`, \`confidence\` (\`high\`, \`medium\`, or \`low\`), \`reasoning\`, and \`suppression\` (\`{"justification": "..."}\`).
@@ -222871,13 +222912,18 @@ var UNTRUSTED_REPOSITORY_PROTECTIONS = {
   bareRepository: { args: ["-c", "safe.bareRepository=explicit"] },
   // A partial clone fetches a missing object on demand, running the repository's transport commands.
   lazyFetch: { env: { GIT_NO_LAZY_FETCH: "1" } },
-  // An empty allow-list refuses every transport, for Git versions that predate GIT_NO_LAZY_FETCH.
-  transports: { env: { GIT_ALLOW_PROTOCOL: "" } }
-}, protections = Object.values(UNTRUSTED_REPOSITORY_PROTECTIONS), protectionArguments = protections.flatMap((protection) => protection.args ?? []);
+  // An empty allow-list refuses every named transport, for Git versions that predate GIT_NO_LAZY_FETCH.
+  transports: { env: { GIT_ALLOW_PROTOCOL: "" } },
+  // The allow-list still holds an empty name, which a remote's helper gets from an empty `vcs` or a URL that starts
+  // with `::`. Git runs that helper as `git remote-`, which falls back to the repository's `remote-` alias. The empty
+  // value replaces the alias, for Git versions that predate GIT_NO_LAZY_FETCH.
+  emptyRemoteHelper: { args: ["-c", "alias.remote-="] }
+}, minimumAppSecurityGitVersion = "2.38.0", protections = Object.values(UNTRUSTED_REPOSITORY_PROTECTIONS), protectionArguments = protections.flatMap((protection) => protection.args ?? []);
 function protectionEnvironment() {
   return Object.fromEntries(protections.flatMap((protection) => Object.entries(protection.env ?? {})));
 }
 async function runGit(directory, args) {
+  await ensureGitVersionIsAtLeast(minimumAppSecurityGitVersion, { cwd: directory });
   try {
     let result = await captureOutputWithExitCode("git", [...protectionArguments, ...args], {
       cwd: directory,
@@ -223182,11 +223228,11 @@ var CHECK_DOCS_BASE_URL = "https://shopify.dev/docs/apps/build/security/app-secu
   },
   {
     id: "METAFIELD_OFFLINE_TOKEN",
-    title: "Metafield write using offline token context",
+    title: "Metafield write in an unverified offline token context",
     severity: "high",
     points: -15,
-    description: "Detects metafield writes (metafieldsSet) in offline-token contexts. Online tokens provide user attribution and expiry.",
-    fix: "Use authenticate.admin(request) instead of unauthenticated.admin() for metafield writes.",
+    description: "Investigates metafield and metaobject writes made with an offline Admin API context that no verified request for the same shop authorizes.",
+    fix: "Make the write from a request verified with authenticate.admin(request), or derive the shop and values from a verified source.",
     guide: "https://shopify.dev/docs/apps/build/authentication-authorization/access-token-types/online-access-tokens",
     docsUrl: `${CHECK_DOCS_BASE_URL}/metafield-offline-token`
   },
@@ -223326,7 +223372,7 @@ var CHECK_DOCS_BASE_URL = "https://shopify.dev/docs/apps/build/security/app-secu
     title: "Embedded app frame-ancestors uses a wildcard",
     severity: "high",
     points: -12,
-    description: "Detects literal wildcard or clearly permissive frame-ancestors policies in embedded app code.",
+    description: "Detects wildcard or static cross-shop frame-ancestors policies in embedded app code, whether written literally or built from variables.",
     fix: "Restrict frame-ancestors to Shopify Admin and the authenticated shop origin.",
     guide: "https://shopify.dev/docs/apps/build/security/set-up-iframe-protection",
     requires: "embedded_app",
@@ -223525,7 +223571,8 @@ Rules:
 - Record unresolved and not_applicable checks with a reason: { "code": "...", "message": "..." }.
 - A not_applicable check can't have findings.
 - An unsupported or unresolved check didn't pass. Never describe it as passing or complete.
-- If you can't prove exploitability or affected authority, record the check as unresolved instead of reporting a finding.
+- If you can't prove exploitability or affected authority for a specific candidate, don't report a finding: record the check as unresolved and name the candidate in the reason.
+- If you investigated and the code establishes the boundary the check asks about, record the check as executed. An unprovable hypothetical is not a reason to leave a check unresolved.
 - Don't report things you couldn't confirm \u2014 uncertainty is not a finding.`, catalogEntry = (checkId) => {
   let entry = RULE_CATALOG.find((candidate) => candidate.id === checkId);
   if (!entry)
@@ -223872,12 +223919,13 @@ async function listTrackedFiles(directory) {
     return splitNullSeparated(listed.stdout);
 }
 async function listNestedRepository(directory) {
+  let stats;
   try {
-    let stats = lstatSync2(joinPath(directory, ".git"));
-    return stats.isDirectory() || stats.isFile() ? await listGitIgnoredPaths(directory) : { status: "failed" };
+    stats = lstatSync2(joinPath(directory, ".git"));
   } catch (error) {
     return isMissingFilesystemEntry(error) ? void 0 : { status: "failed" };
   }
+  return stats.isDirectory() || stats.isFile() ? listGitIgnoredPaths(directory) : { status: "failed" };
 }
 function splitNullSeparated(output) {
   return output.split("\0").filter((path4) => path4 !== "");
@@ -224270,6 +224318,13 @@ function readRepositoryFile(absolutePath) {
   let located = configuredReader().explicitInputs.has(path4) ? explicitInputPath(path4) : containedRepositoryPath(path4), result = located.path ? readBoundedFile(located.path) : located.failure;
   return repositoryFileCache.set(path4, result), result.ok || recordSkippedFile(path4, result), result;
 }
+function readFileContainedBy(directory, path4) {
+  let inspected = inspectRepositoryPath(directory, path4);
+  if (inspected.status === "missing")
+    return;
+  let result = inspected.status === "file" ? readBoundedFile(inspected.path) : repositoryPathFailure(inspected.reason);
+  return result.ok || recordSkippedFile(joinPath(directory, path4), result), result;
+}
 function readRepositoryText(absolutePath) {
   let result = readRepositoryFile(absolutePath);
   return result.ok ? result.content.toString() : void 0;
@@ -224372,15 +224427,14 @@ function isProbablyBinary(content) {
   return sample.length > 0 && suspiciousControlBytes / sample.length > 0.1;
 }
 function findSensitiveFiles(appRoot, repositoryFiles, selectedAppConfigPath) {
-  return repositoryFiles.filter(isSensitiveFile).filter((path4) => !LOCKFILE_MANAGERS.has(path4)).filter((path4) => !isValidFormatAppConfigurationFileName(basename(path4)) || path4 === selectedAppConfigPath).flatMap((path4) => {
+  return repositoryFiles.filter(isSensitiveFile).filter((path4) => !LOCKFILE_MANAGERS.has(basename(path4))).filter((path4) => !isValidFormatAppConfigurationFileName(basename(path4)) || path4 === selectedAppConfigPath).flatMap((path4) => {
     let absolutePath = joinPath(appRoot, path4), result = readRepositoryFile(absolutePath);
     return result.ok ? isProbablyBinary(result.content) ? [] : [{ path: path4, absolutePath, ext: extname(path4), content: result.content.toString() }] : [{ path: path4, absolutePath, ext: extname(path4), content: void 0 }];
   });
 }
-function nestedRepositoryReason(appRoot) {
+function dependencyAutomationRoot(appRoot) {
   let marker = findRepositoryMarker(appRoot);
-  if (marker.status !== "none")
-    return marker.status === "ambiguous" ? marker.reason : marker.directory === appRoot ? void 0 : "App root is nested below a parent Git repository";
+  return marker.status === "ambiguous" ? { unresolvedReason: marker.reason } : { directory: marker.status === "found" ? marker.directory : appRoot };
 }
 function findDependencyAutomationInputs(appRoot, gatheredPaths) {
   let canonicalRoot;
@@ -224390,25 +224444,28 @@ function findDependencyAutomationInputs(appRoot, gatheredPaths) {
   } catch (error) {
     return { files: [], unresolvedReason: inspectErrorReason("app root", error) };
   }
-  let repositoryReason = nestedRepositoryReason(canonicalRoot);
-  if (repositoryReason)
-    return { files: [], unresolvedReason: repositoryReason };
-  let gathered = new Set(gatheredPaths), files = [], unresolvedReason;
-  for (let relative of DEPENDENCY_AUTOMATION_CONFIG_PATHS) {
-    if (!gathered.has(relative))
-      continue;
-    let absolutePath = joinPath(canonicalRoot, relative), result = readRepositoryFile(absolutePath);
-    if (!result.ok) {
-      unresolvedReason ??= result.reason === "too_large" ? `${relative} is too large to inspect` : result.detail ?? `Could not read ${relative}`;
+  let configurationRoot = dependencyAutomationRoot(canonicalRoot);
+  if ("unresolvedReason" in configurationRoot)
+    return { files: [], unresolvedReason: configurationRoot.unresolvedReason };
+  let repositoryRoot = configurationRoot.directory, { scanDirectories } = configuredReader(), isScanned = (absolutePath) => repositoryRoot === canonicalRoot || scanDirectories.some((directory) => isSubpath(directory, absolutePath)), gathered = new Set(gatheredPaths), files = [], unresolvedReason;
+  for (let configurationPath of DEPENDENCY_AUTOMATION_CONFIG_PATHS) {
+    let absolutePath = joinPath(repositoryRoot, configurationPath), relative = normalizePath(relativePath(canonicalRoot, absolutePath)), scanned = isScanned(absolutePath);
+    if (scanned && !gathered.has(relative))
       continue;
+    let result = scanned ? readRepositoryFile(absolutePath) : readFileContainedBy(repositoryRoot, configurationPath);
+    if (result !== void 0) {
+      if (!result.ok) {
+        unresolvedReason ??= result.reason === "too_large" ? `${relative} is too large to inspect` : result.detail ?? `Could not read ${relative}`;
+        continue;
+      }
+      files.push({
+        path: relative,
+        absolutePath,
+        ext: extname(relative),
+        content: result.content.toString()
+      });
+      break;
     }
-    files.push({
-      path: relative,
-      absolutePath,
-      ext: extname(relative),
-      content: result.content.toString()
-    });
-    break;
   }
   return files.length > 0 ? { files } : { files, ...unresolvedReason ? { unresolvedReason } : {} };
 }
@@ -224454,6 +224511,7 @@ function findManifests(appRoot, discoveredPaths) {
 
 // ../app/dist/cli/services/app-security-engine/capabilities/detect.js
 init_cjs_shims();
+var REACT_ROUTER_PACKAGE = "@shopify/shopify-app-react-router";
 function detectCapabilities(appToml, extensions, sourceFiles, appTomls = appToml ? [appToml] : []) {
   let themeExtension = extensions.some((extension) => extension.type === "theme"), appEmbed = extensions.some((extension) => extension.type === "theme" && hasAppEmbedBlock(extension)), embeddedApp = appTomls.some((configuration) => configuration.raw.embedded === !0), scriptTags = sourceFiles.some((file) => file.content ? /script[_-]?tags?|ScriptTag/i.test(file.content) : !1), storefrontMetafieldWrites = sourceFiles.some((file) => file.content ? /metafields?Set|metafields?\/.*(?:POST|PUT|create|update)|write.*metafield|metafield.*write/i.test(file.content) : !1), hasBackend = sourceFiles.some(detectRouteDefinitions);
   return {
@@ -224469,11 +224527,49 @@ function detectCapabilities(appToml, extensions, sourceFiles, appTomls = appToml
     checkout_extension: extensions.some((extension) => extension.type === "checkout_ui" || extension.type === "checkout_ui_extension")
   };
 }
-function detectProject(manifests, extensions, candidates) {
-  let dependencyNames = new Set(manifests.flatMap((manifest) => [
-    ...Object.keys(manifest.dependencies),
-    ...Object.keys(manifest.devDependencies ?? {})
-  ])), candidatePaths = new Set(candidates.map((candidate) => candidate.path)), hasReactRouterPackage = dependencyNames.has("@shopify/shopify-app-react-router"), hasReactRouterStructure = [...candidatePaths].some((path4) => path4.startsWith("app/routes/")) && [...candidatePaths].some((path4) => /^app\/shopify\.server\.[cm]?[jt]sx?$/.test(path4)), reactRouter = hasReactRouterPackage && hasReactRouterStructure, themeExtensions = extensions.filter((extension) => extension.type === "theme"), themeExtension = themeExtensions.length > 0, themePaths = new Set(themeExtensions.flatMap((extension) => extension.files.map((file) => file.path))), hasSources = candidates.length > 0, surface;
+function detectReactRouterRoots(manifests, candidates, otherAppDirectories = []) {
+  let declaringManifests = manifests.filter((manifest) => manifest.dependencies[REACT_ROUTER_PACKAGE] !== void 0 || manifest.devDependencies?.[REACT_ROUTER_PACKAGE] !== void 0);
+  if (declaringManifests.length === 0)
+    return [];
+  let candidatePaths = candidates.map((candidate) => candidate.path);
+  return [.../* @__PURE__ */ new Set([".", ...declaringManifests.map((manifest) => dirname(manifest.path))])].filter((root) => hasReactRouterStructure(root, candidatePaths)).filter((root) => !belongsToOtherApp(root, otherAppDirectories)).sort();
+}
+function isReactRouterServerPath(root, path4) {
+  let pathInRoot = pathWithinRoot(root, path4);
+  return pathInRoot !== void 0 && /^app\/shopify\.server\.[cm]?[jt]sx?$/.test(pathInRoot);
+}
+function isReactRouterSourcePath(path4, reactRouterRoots, otherAppDirectories) {
+  let otherAppCode = otherAppCodeDirectories(otherAppDirectories).filter((directory) => !isInsideReactRouterRoot(directory, reactRouterRoots));
+  return (!climbsOutOfDirectory(path4) || reactRouterRoots.some((root) => pathWithinRoot(root, path4) !== void 0)) && !otherAppCode.some((directory) => pathWithinRoot(directory, path4) !== void 0);
+}
+function isInsideReactRouterRoot(directory, reactRouterRoots) {
+  return reactRouterRoots.some((root) => root === "." ? !climbsOutOfDirectory(directory) : directory === root || pathWithinRoot(root, directory) !== void 0);
+}
+function climbsOutOfDirectory(path4) {
+  return path4 === ".." || path4.startsWith("../");
+}
+function pathWithinRoot(root, path4) {
+  if (root === ".")
+    return path4;
+  if (!path4.startsWith(`${root}/`))
+    return;
+  let pathInRoot = path4.slice(root.length + 1);
+  return climbsOutOfDirectory(pathInRoot) ? void 0 : pathInRoot;
+}
+function hasReactRouterStructure(root, paths) {
+  return paths.some((path4) => pathWithinRoot(root, path4)?.startsWith("app/routes/")) && paths.some((path4) => isReactRouterServerPath(root, path4));
+}
+function belongsToOtherApp(root, otherAppDirectories) {
+  return root === "." ? !1 : otherAppDirectories.includes(root) || otherAppCodeDirectories(otherAppDirectories).some((directory) => root === directory || pathWithinRoot(directory, root) !== void 0);
+}
+function otherAppCodeDirectories(otherAppDirectories) {
+  return otherAppDirectories.flatMap((directory) => isAncestorOfAppDirectory(directory) ? [`${directory}/app`, `${directory}/web`] : [directory]);
+}
+function isAncestorOfAppDirectory(directory) {
+  return directory.split("/").every((segment) => segment === "..");
+}
+function detectProject(extensions, candidates, reactRouterRoots) {
+  let reactRouter = reactRouterRoots.length > 0, themeExtensions = extensions.filter((extension) => extension.type === "theme"), themeExtension = themeExtensions.length > 0, themePaths = new Set(themeExtensions.flatMap((extension) => extension.files.map((file) => file.path))), hasSources = candidates.length > 0, surface;
   reactRouter && themeExtension ? surface = "mixed" : reactRouter ? surface = "react_router" : themeExtension && candidates.some((candidate) => !themePaths.has(candidate.path)) ? surface = "mixed" : themeExtension ? surface = "theme_app_extension" : hasSources ? surface = "unknown" : surface = "config_only";
   let framework;
   reactRouter ? framework = "react_router" : surface === "config_only" || surface === "theme_app_extension" ? framework = "none" : surface === "mixed" ? framework = "mixed" : framework = "unknown";
@@ -225133,11 +225229,11 @@ function scanEolApiVersions(context, referenceDate = /* @__PURE__ */ new Date())
   ]);
   if (context.detection.framework !== "react_router")
     return configIssues;
-  let sourceIssues = context.sourceFiles.flatMap((file) => scanReactRouterApiVersion(file, referenceDate));
+  let sourceIssues = context.sourceFiles.flatMap((file) => scanReactRouterApiVersion(file, context.reactRouterRoots, referenceDate));
   return [...configIssues, ...sourceIssues];
 }
-function scanReactRouterApiVersion(file, referenceDate) {
-  if (!file.content || !/^app\/shopify\.server\.[cm]?[jt]sx?$/.test(file.path))
+function scanReactRouterApiVersion(file, reactRouterRoots, referenceDate) {
+  if (!file.content || !reactRouterRoots.some((root) => isReactRouterServerPath(root, file.path)))
     return [];
   let content = maskStringsExceptVersions(stripComments4(file.content));
   return [
@@ -226082,7 +226178,7 @@ var JAVASCRIPT_EXTENSIONS6 = [".js", ".jsx", ".mjs", ".cjs", ".ts", ".tsx", ".mt
   configRule(missingComplianceWebhooks),
   {
     id: "MISSING_DEPENDENCY_SECURITY_AUTOMATION",
-    version: 1,
+    version: 2,
     lifecycle: "active",
     analysisMode: "structured_config",
     target: "dependency_automation",
@@ -226090,7 +226186,7 @@ var JAVASCRIPT_EXTENSIONS6 = [".js", ".jsx", ".mjs", ".cjs", ".ts", ".tsx", ".mt
   },
   {
     id: "EOL_API_VERSION",
-    version: 1,
+    version: 2,
     lifecycle: "active",
     analysisMode: "regex",
     target: "config_and_source",
@@ -226098,16 +226194,16 @@ var JAVASCRIPT_EXTENSIONS6 = [".js", ".jsx", ".mjs", ".cjs", ".ts", ".tsx", ".mt
     runner: (context) => scanEolApiVersions(context)
   },
   {
-    ...jsCheck("EXPIRING_OFFLINE_TOKEN", (context) => scanExpiringOfflineTokens(context)),
+    ...jsCheck("EXPIRING_OFFLINE_TOKEN", (context) => scanExpiringOfflineTokens(context), "source", 2),
     extensions: [...JAVASCRIPT_EXTENSIONS6, ".prisma"]
   },
   {
-    ...jsCheck("UNAUTHENTICATED_ENDPOINT", (context) => scanUnauthenticatedEndpoints(context.sourceFiles), "source", 2),
+    ...jsCheck("UNAUTHENTICATED_ENDPOINT", (context) => scanUnauthenticatedEndpoints(context.sourceFiles), "source", 3),
     requires: "has_backend"
   },
-  jsCheck("REQUEST_CONTROLLED_ADMIN_CONTEXT", (context) => scanRequestControlledAdminContext(context.sourceFiles), "source", 3),
+  jsCheck("REQUEST_CONTROLLED_ADMIN_CONTEXT", (context) => scanRequestControlledAdminContext(context.sourceFiles), "source", 4),
   {
-    ...configRule(deprecatedScriptTagScope),
+    ...configRule(deprecatedScriptTagScope, 2),
     target: "config_and_source",
     analysisMode: "regex",
     extensions: JAVASCRIPT_EXTENSIONS6,
@@ -226119,14 +226215,14 @@ var JAVASCRIPT_EXTENSIONS6 = [".js", ".jsx", ".mjs", ".cjs", ".ts", ".tsx", ".mt
   configRule(insecureWebhookUrl, 2),
   {
     id: "COMMITTED_SECRET",
-    version: 3,
+    version: 4,
     lifecycle: "active",
     analysisMode: "regex",
     target: "secrets",
     runner: (context) => scanCommittedSecrets(context.sensitiveFiles, context.appRoot, context.gitIgnoreListing)
   },
-  jsCheck("CREDENTIAL_LOG_LEAKAGE", (context) => scanCredentialLogLeakage(context.sourceFiles)),
-  jsCheck("CREDENTIAL_BROWSER_LEAKAGE", (context) => scanCredentialBrowserLeakage(context.sourceFiles)),
+  jsCheck("CREDENTIAL_LOG_LEAKAGE", (context) => scanCredentialLogLeakage(context.sourceFiles), "source", 2),
+  jsCheck("CREDENTIAL_BROWSER_LEAKAGE", (context) => scanCredentialBrowserLeakage(context.sourceFiles), "source", 2),
   {
     id: "LIQUID_UNSAFE_RENDER",
     version: 1,
@@ -226138,16 +226234,16 @@ var JAVASCRIPT_EXTENSIONS6 = [".js", ".jsx", ".mjs", ".cjs", ".ts", ".tsx", ".mt
     runner: (context) => liquidRunner(context, "LIQUID_UNSAFE_RENDER")
   },
   {
-    ...jsCheck("UNSAFE_INNERHTML", unsafeInnerHtmlRunner, "source_and_theme", 2),
+    ...jsCheck("UNSAFE_INNERHTML", unsafeInnerHtmlRunner, "source_and_theme", 3),
     analysisMode: "regex",
     extensions: [...JAVASCRIPT_EXTENSIONS6, ".liquid", ".html"]
   },
   {
-    ...jsCheck("APP_PROXY_LIQUID_INJECTION", (context) => scanAppProxyLiquidInjection(context.sourceFiles), "source", 2),
+    ...jsCheck("APP_PROXY_LIQUID_INJECTION", (context) => scanAppProxyLiquidInjection(context.sourceFiles), "source", 3),
     requires: "app_proxy"
   },
   {
-    ...jsCheck("STATIC_FRAME_ANCESTORS", (context) => scanStaticFrameAncestors(context.sourceFiles), "app_source"),
+    ...jsCheck("STATIC_FRAME_ANCESTORS", (context) => scanStaticFrameAncestors(context.sourceFiles), "app_source", 2),
     requires: "embedded_app"
   }
 ];
@@ -226255,8 +226351,11 @@ function appSourceFiles(context) {
   let themePaths = new Set(themeFiles(context).map((file) => file.path));
   return context.sourceFiles.filter((file) => !themePaths.has(file.path));
 }
+function isReactRouterFilePath(path4, context) {
+  return context.detection.framework !== "react_router" || isReactRouterSourcePath(path4, context.reactRouterRoots, context.otherAppDirectories);
+}
 function reactRouterFiles(context) {
-  return appSourceFiles(context);
+  return appSourceFiles(context).filter((file) => isReactRouterFilePath(file.path, context));
 }
 function selectedFiles(definition, context) {
   let configurations = context.appTomls.map((toml) => relativePath(context.appRoot, toml.path).replace(/\\/g, "/"));
@@ -226363,8 +226462,8 @@ function manifestHasDependencies(manifest) {
   return Object.keys(manifest.dependencies).length > 0 || Object.keys(manifest.devDependencies ?? {}).length > 0;
 }
 function skippedInputsForCheck(definition, context, skippedFiles2) {
-  let themeDirectories = context.extensions.filter((extension) => extension.type === "theme").map((extension) => extension.path.replace(/shopify\.extension\.toml$/, "")), isThemePath = (path4) => themeDirectories.some((directory) => path4.startsWith(directory)) || path4.endsWith("shopify.extension.toml"), isSourcePath = (path4) => !isThemePath(path4) && !!definition.extensions?.some((extension) => path4.endsWith(extension)), isConfig = (path4) => /^shopify\.app(?:\.[^/]+)?\.toml$/.test(path4), isDependencyAutomationInput = (path4) => /(^|\/)package\.json$/.test(path4) || context.dependencyAutomation.files.some((file) => file.path === path4), isSecretInput = (file) => !file.detail?.includes("could not be parsed") && (context.sourceCandidates.some((candidate) => candidate.path === file.path) || context.sensitiveFiles.some((sensitiveFile) => sensitiveFile.path === file.path) || /(^|\/)(?:\.env(?:\.[^/]+)?|secrets\.json|credentials\.json)$/.test(file.path));
-  return skippedFiles2.filter((file) => definition.target === "config" ? isConfig(file.path) : definition.target === "dependency_automation" ? isDependencyAutomationInput(file.path) : definition.target === "config_and_source" ? isConfig(file.path) || isSourcePath(file.path) : definition.target === "source" || definition.target === "app_source" ? isSourcePath(file.path) : definition.target === "theme" ? isThemePath(file.path) : definition.target === "source_and_theme" ? isSourcePath(file.path) || isThemePath(file.path) : isSecretInput(file));
+  let themeDirectories = context.extensions.filter((extension) => extension.type === "theme").map((extension) => extension.path.replace(/shopify\.extension\.toml$/, "")), isThemePath = (path4) => themeDirectories.some((directory) => path4.startsWith(directory)) || path4.endsWith("shopify.extension.toml"), isSourcePath = (path4) => !isThemePath(path4) && !!definition.extensions?.some((extension) => path4.endsWith(extension)), isReactRouterInput = (path4) => isSourcePath(path4) && isReactRouterFilePath(path4, context), isConfig = (path4) => /^shopify\.app(?:\.[^/]+)?\.toml$/.test(path4), isDependencyAutomationInput = (path4) => /(^|\/)package\.json$/.test(path4) || context.dependencyAutomation.files.some((file) => file.path === path4), isSecretInput = (file) => !file.detail?.includes("could not be parsed") && (context.sourceCandidates.some((candidate) => candidate.path === file.path) || context.sensitiveFiles.some((sensitiveFile) => sensitiveFile.path === file.path) || /(^|\/)(?:\.env(?:\.[^/]+)?|secrets\.json|credentials\.json)$/.test(file.path));
+  return skippedFiles2.filter((file) => definition.target === "config" ? isConfig(file.path) : definition.target === "dependency_automation" ? isDependencyAutomationInput(file.path) : definition.target === "config_and_source" ? isConfig(file.path) || isReactRouterInput(file.path) : definition.target === "source" ? isReactRouterInput(file.path) : definition.target === "app_source" ? isSourcePath(file.path) : definition.target === "theme" ? isThemePath(file.path) : definition.target === "source_and_theme" ? isReactRouterInput(file.path) || isThemePath(file.path) : isSecretInput(file));
 }
 function skippedInputReason(definition, files) {
   return {
@@ -226403,7 +226502,7 @@ async function scan(input, options = {}) {
     scanDirectories,
     explicitInputs: new Set(appConfigFilePath ? [appConfigFilePath] : [])
   });
-  let selectedAppConfigPath = appConfigFilePath ? normalizePath(relativePath(appRoot, appConfigFilePath)) : void 0, appToml = appConfigFilePath ? loadAppToml(appConfigFilePath, appRoot) : null, appTomls = appToml ? [appToml] : [], { paths: repositoryFiles, ignoredScanDirectories, otherAppDirectories, listingStatus } = await gatherScanPaths(input, options), extensions = findExtensions(appRoot, repositoryFiles), sourceCandidates = findSourceCandidates(repositoryFiles), sourceFiles = findAppSourceFiles(appRoot, repositoryFiles), sensitiveFiles = findSensitiveFiles(appRoot, repositoryFiles, selectedAppConfigPath), manifestPaths = findManifestPaths(repositoryFiles), manifests = findManifests(appRoot, manifestPaths), dependencyAutomation = manifests.some(manifestHasDependencies) ? findDependencyAutomationInputs(appRoot, repositoryFiles) : { files: [] }, capabilities = detectCapabilities(appToml, extensions, sourceFiles, appTomls), detection = detectProject(manifests, extensions, sourceCandidates), context = {
+  let selectedAppConfigPath = appConfigFilePath ? normalizePath(relativePath(appRoot, appConfigFilePath)) : void 0, appToml = appConfigFilePath ? loadAppToml(appConfigFilePath, appRoot) : null, appTomls = appToml ? [appToml] : [], { paths: repositoryFiles, ignoredScanDirectories, otherAppDirectories, listingStatus } = await gatherScanPaths(input, options), extensions = findExtensions(appRoot, repositoryFiles), sourceCandidates = findSourceCandidates(repositoryFiles), sourceFiles = findAppSourceFiles(appRoot, repositoryFiles), sensitiveFiles = findSensitiveFiles(appRoot, repositoryFiles, selectedAppConfigPath), manifestPaths = findManifestPaths(repositoryFiles), manifests = findManifests(appRoot, manifestPaths), dependencyAutomation = manifests.some(manifestHasDependencies) ? findDependencyAutomationInputs(appRoot, repositoryFiles) : { files: [] }, capabilities = detectCapabilities(appToml, extensions, sourceFiles, appTomls), relativeOtherAppDirectories = otherAppDirectories.map((directory) => normalizePath(relativePath(appRoot, directory))), reactRouterRoots = detectReactRouterRoots(manifests, sourceCandidates, relativeOtherAppDirectories), detection = detectProject(extensions, sourceCandidates, reactRouterRoots), context = {
     appRoot,
     appToml,
     appTomls,
@@ -226414,6 +226513,8 @@ async function scan(input, options = {}) {
     sensitiveFiles,
     capabilities,
     detection,
+    reactRouterRoots,
+    otherAppDirectories: relativeOtherAppDirectories,
     sourceCandidates,
     gitIgnoreListing: listingStatus
   }, issues = [], checksExecuted = [], requiredCheckIds = /* @__PURE__ */ new Set();
@@ -228801,7 +228902,7 @@ var defaultDependencies3 = {
   recordMetadata: recordAppSecurityMetadata
 };
 async function instructionsDestination(options, dependencies, canPrompt, agentCheckCount) {
-  return options.skipInstructions ? "nothing" : options.yes ? "print" : canPrompt ? dependencies.selectInstructionsDestination(agentCheckCount) : "nothing";
+  return options.skipInstructions ? "nothing" : options.printInstructions ? "print" : canPrompt ? dependencies.selectInstructionsDestination(agentCheckCount) : "nothing";
 }
 function securityReportInput(execution, artifacts, verbose, commands2, selection, scanDirectories) {
   return {
@@ -228898,8 +228999,17 @@ async function securityCheck(options, dependencies = defaultDependencies3) {
 var import_core32 = __toESM(require_lib(), 1);
 var SecurityCheck = class _SecurityCheck extends base_command_default {
   static summary = "Check an app for Shopify-specific security issues and write deterministic-findings.json and agent-checks.json.";
-  static descriptionWithMarkdown = "Runs an app security check locally and writes `deterministic-findings.json` and `agent-checks.json` to the results directory, `.shopify/app-security/<results key>/`. The results key is `--client-id` when you pass it, and otherwise the name of the app configuration file without `.toml`; the other `app security` commands take the same selection flags and find the same directory. Every run replaces both files, so it's always safe to run the check again.\n\n`deterministic-findings.json` holds the deterministic scan results. `agent-checks.json` holds the checks for your coding agent to investigate; the agent's results are recorded with `shopify app security record`. Use `--config` to select a specific app configuration when the project has multiple `shopify.app*.toml` files; the check inspects only that configuration. Use `--client-id` to replace the configuration's client ID for this run. `--client-id` is checked against your Shopify account before anything is scanned, so it needs you to be logged in. When no app configuration exists, use `--without-app-config --client-id <client-id>` to scan `--path` anyway with config checks skipped; in an interactive terminal the command offers to do this.\n\nThe check scans the app directory and each `--include-dir`. Git ignore rules apply by default: a file or directory that Git ignores is skipped, using the rules of the repository that contains it, while files that Git tracks are always scanned. Use `--no-git-ignore` to turn Git ignore rules off for every scanned directory.\n\nUse `--exclude` to skip more paths. Each value is a glob that is matched against the path relative to the working directory, so a path above it starts with `../`, and a name at any depth needs `**/`, for example `--exclude '**/generated'`. Repeat the flag to add globs. An exclusion can't remove the selected app configuration file. Quote each value so your shell doesn't expand `*`. The coding-agent instructions this check offers repeat the globs. Other `app security` commands don't take `--exclude` or `--no-git-ignore`, so pass the same flags each time you run the check.\n\nUse `--list-files` to check the scope before scanning: it prints the files the check would gather, one path per line and relative to the app directory, and then stops. It writes no results and never prompts. `--client-id` is still checked, but doesn't change the list.\n\nIn interactive terminals, the command offers to copy the coding-agent instructions, print them, or choose nothing; copying is the default. In CI and other non-interactive environments, instructions aren't offered unless you pass `--yes`, which prints them. You can also run `shopify app security instructions` to print, copy, or write them later.";
+  static descriptionWithMarkdown = "Runs an app security check locally and writes `deterministic-findings.json` and `agent-checks.json` to the results directory, `.shopify/app-security/<results key>/`. The results key is `--client-id` when you pass it, and otherwise the name of the app configuration file without `.toml`; the other `app security` commands take the same selection flags and find the same directory. Every run replaces both files, so it's always safe to run the check again.\n\n`deterministic-findings.json` holds the deterministic scan results. `agent-checks.json` holds the checks for your coding agent to investigate; the agent's results are recorded with `shopify app security record`. Use `--config` to select a specific app configuration when the project has multiple `shopify.app*.toml` files; the check inspects only that configuration. Use `--client-id` to replace the configuration's client ID for this run. `--client-id` is checked against your Shopify account before anything is scanned, so it needs you to be logged in. When no app configuration exists, use `--without-app-config --client-id <client-id>` to scan `--path` anyway with config checks skipped; in an interactive terminal the command offers to do this.\n\nThe check scans the app directory and each `--include-dir`. Git ignore rules apply by default: a file or directory that Git ignores is skipped, using the rules of the repository that contains it, while files that Git tracks are always scanned. Use `--no-git-ignore` to turn Git ignore rules off for every scanned directory. When the check uses Git, it requires Git 2.38.0 or later.\n\nUse `--exclude` to skip more paths. Each value is a glob that is matched against the path relative to the working directory, so a path above it starts with `../`, and a name at any depth needs `**/`, for example `--exclude '**/generated'`. Repeat the flag to add globs. An exclusion can't remove the selected app configuration file. Quote each value so your shell doesn't expand `*`. The coding-agent instructions this check offers repeat the globs. Other `app security` commands don't take `--exclude` or `--no-git-ignore`, so pass the same flags each time you run the check.\n\nUse `--list-files` to check the scope before scanning: it prints the files the check would gather, one path per line and relative to the app directory, and then stops. It writes no results and never prompts. `--client-id` is still checked, but doesn't change the list.\n\nIn interactive terminals, the command offers to copy the coding-agent instructions, print them, or choose nothing; copying is the default. In CI and other non-interactive environments, instructions aren't offered unless you pass `--print-instructions`, which prints them. You can also run `shopify app security instructions` to print, copy, or write them later.\n\nReports the number of findings to Shopify as usage telemetry, but not finding details. See [usage reporting](https://shopify.dev/docs/api/shopify-cli#usage-reporting) for details.";
   static description = this.descriptionWithoutMarkdown();
+  static examples = [
+    "<%= config.bin %> <%= command.id %>",
+    "<%= config.bin %> <%= command.id %> --include-dir ../backend",
+    "<%= config.bin %> <%= command.id %> --path extensions --config production --include-dir .",
+    "<%= config.bin %> <%= command.id %> --without-app-config --client-id <client-id>",
+    '<%= config.bin %> <%= command.id %> --path app --include-dir . --exclude marketing --exclude "**/generated"',
+    "<%= config.bin %> <%= command.id %> --no-git-ignore --exclude local-data",
+    "<%= config.bin %> <%= command.id %> --include-dir ../backend --list-files"
+  ];
   static flags = {
     ...globalFlags,
     ...appSecuritySelectionFlags,
@@ -228922,19 +229032,26 @@ var SecurityCheck = class _SecurityCheck extends base_command_default {
     "list-files": import_core32.Flags.boolean({
       description: "Print the files the check would gather, one path per line, and stop. Nothing is scanned, no results are written, and nothing is prompted for.",
       env: "SHOPIFY_FLAG_LIST_FILES",
-      exclusive: ["yes", "skip-instructions", "blocking"]
+      exclusive: ["print-instructions", "skip-instructions", "blocking"]
     }),
     ...appSecurityBlockingFlag,
-    yes: import_core32.Flags.boolean({
-      description: "Print coding-agent instructions without prompting.",
+    "print-instructions": import_core32.Flags.boolean({
+      description: "Print coding-agent instructions without prompting for how to deliver them.",
       default: !1,
       exclusive: ["skip-instructions"],
+      env: "SHOPIFY_FLAG_APP_SECURITY_PRINT_INSTRUCTIONS"
+    }),
+    yes: import_core32.Flags.boolean({
+      description: "Print coding-agent instructions without prompting.",
+      hidden: !0,
+      deprecated: { to: "--print-instructions" },
+      exclusive: ["skip-instructions", "list-files"],
       env: "SHOPIFY_FLAG_YES"
     }),
     "skip-instructions": import_core32.Flags.boolean({
-      description: "Don't offer to show coding-agent instructions.",
+      description: "Don't offer the coding-agent instructions after the scan. Use it when you want only the deterministic scan results.",
       default: !1,
-      exclusive: ["yes"],
+      exclusive: ["print-instructions"],
       env: "SHOPIFY_FLAG_APP_SECURITY_SKIP_INSTRUCTIONS"
     })
   };
@@ -228947,7 +229064,7 @@ var SecurityCheck = class _SecurityCheck extends base_command_default {
       withoutAppConfig: !!flags["without-app-config"],
       verbose: !!flags.verbose,
       blocking: flags.blocking,
-      yes: flags.yes,
+      printInstructions: !!(flags["print-instructions"] || flags.yes),
       skipInstructions: flags["skip-instructions"],
       includeDirs: flags["include-dir"] ?? [],
       excludePatterns: flags.exclude ?? [],
@@ -229184,7 +229301,7 @@ function renderSecurityRecordResult(result, selection, path4) {
 // ../app/dist/cli/commands/app/security/record.js
 var SecurityRecord = class _SecurityRecord extends base_command_default {
   static summary = "Record agent findings from an app security check.";
-  static descriptionWithMarkdown = "Reads a coding agent's complete findings document from stdin, validates it, and replaces `agent-findings.json` in the results directory, `.shopify/app-security/<results key>/`. The results key is `--client-id` when you pass it, and otherwise the name of the app configuration file without `.toml`. `--client-id` is checked against your Shopify account before anything is read, so it needs you to be logged in.\n\nThe document must include a `scope` with the `include_dirs`, `excludes` and `no_git_ignore` values of the `check` run it describes, exactly as typed. It's recorded as reported and never compared with the scan's files.\n\nThe document is recorded all or nothing: if anything is invalid, the command fails with every error, writes nothing, and exits with a non-zero code. It needs the results directory that `shopify app security check` creates.";
+  static descriptionWithMarkdown = "Reads a coding agent's complete findings document from stdin, validates it, and replaces `agent-findings.json` in the results directory, `.shopify/app-security/<results key>/`. The results key is `--client-id` when you pass it, and otherwise the name of the app configuration file without `.toml`. `--client-id` is checked against your Shopify account before anything is read, so it needs you to be logged in.\n\nThe document must include a `scope` with the `include_dirs`, `excludes` and `no_git_ignore` values of the `check` run it describes, exactly as typed. It's recorded as reported and never compared with the scan's files.\n\nThe document is recorded all or nothing: if anything is invalid, the command fails with every error, writes nothing, and exits with a non-zero code. It needs the results directory that `shopify app security check` creates.\n\nReports the number of findings to Shopify as usage telemetry, but not finding details. See [usage reporting](https://shopify.dev/docs/api/shopify-cli#usage-reporting) for details.";
   static description = this.descriptionForHelp();
   static flags = {
     ...globalFlags,
@@ -229560,7 +229677,7 @@ async function securityReview(options, dependencies = defaultDependencies6) {
 var import_core35 = __toESM(require_lib(), 1);
 var SecurityReview = class _SecurityReview extends base_command_default {
   static summary = "Show the combined app security check results.";
-  static descriptionWithMarkdown = "Combines the deterministic results (`deterministic-findings.json`, written by `shopify app security check`) with the recorded agent results (`agent-findings.json`, written by `shopify app security record`) and shows one view of every check: its findings, status and source. Both files are in the results directory, `.shopify/app-security/<results key>/`. `--client-id` is checked against your Shopify account before any results are read, so it needs you to be logged in.\n\nThe summary shows the scan directories and the scope of the latest scan, and the scope the agent reported. It notes when the agent findings were recorded for a different scope than the latest scan; that doesn't change the exit code.\n\nThe agent results are optional. Use `--check-id` to narrow the review to specific checks, `--verbose` for full reasoning, evidence and suppressed findings, and `--blocking` to exit with code 1 when a check with findings is at or above a severity.";
+  static descriptionWithMarkdown = "Combines the deterministic results (`deterministic-findings.json`, written by `shopify app security check`) with the recorded agent results (`agent-findings.json`, written by `shopify app security record`) and shows one view of every check: its findings, status and source. Both files are in the results directory, `.shopify/app-security/<results key>/`. `--client-id` is checked against your Shopify account before any results are read, so it needs you to be logged in.\n\nThe summary shows the scan directories and the scope of the latest scan, and the scope the agent reported. It notes when the agent findings were recorded for a different scope than the latest scan; that doesn't change the exit code.\n\nThe agent results are optional. Use `--check-id` to narrow the review to specific checks, `--verbose` for full reasoning, evidence and suppressed findings, and `--blocking` to exit with code 1 when a check with findings is at or above a severity.\n\nReports the number of findings to Shopify as usage telemetry, but not finding details. See [usage reporting](https://shopify.dev/docs/api/shopify-cli#usage-reporting) for details.";
   static description = this.descriptionForHelp();
   static flags = {
     ...globalFlags,