@shopify/create-app 4.9.5 → 5.0.0

package/dist/{chunk-A33KVF5C.js → chunk-E4XG6SVI.js}

@@ -13859,4 +13859,4 @@ export {
   debugApis,
   init_prettier
 };
-//# sourceMappingURL=chunk-A33KVF5C.js.map
+//# sourceMappingURL=chunk-E4XG6SVI.js.map

package/dist/{chunk-MCVF3JKC.js → chunk-F5VM2BG4.js}

@@ -4,10 +4,10 @@ import {
 import {
   getPackageManager,
   packageManagerFromUserAgent
-} from "./chunk-KREC6ICN.js";
+} from "./chunk-3S4LYDKB.js";
 import {
   CLI_KIT_VERSION
-} from "./chunk-HSSZIAZA.js";
+} from "./chunk-ZNGF52JY.js";
 import {
   FormData,
   fetch_blob_default,
@@ -27,7 +27,7 @@ import {
   setCurrentSessionId,
   setSessions,
   timeIntervalToMilliseconds
-} from "./chunk-4ZMLBA4T.js";
+} from "./chunk-S3XZMGTD.js";
 import {
   isCI,
   isWsl,
@@ -35,25 +35,29 @@ import {
   require_baseForOwn,
   require_stacktracey,
   sleep
-} from "./chunk-XIWLFYMS.js";
+} from "./chunk-DKAJC4S3.js";
 import {
   platformAndArch
-} from "./chunk-CTYX7C3B.js";
+} from "./chunk-DIOGWWS3.js";
 import {
   addPublicMetadata,
   addSensitiveMetadata,
   getAllPublicMetadata,
   getAllSensitiveMetadata,
   runWithTimer
-} from "./chunk-ATC7DBGE.js";
+} from "./chunk-J53FSF5Q.js";
 import {
+  automationTokenAuthMethod,
+  automationTokenVariable,
+  automationTokenVariablesProblem,
   getAppAutomationToken,
   getIdentityTokenInformation,
   hashString,
   maxRequestTimeForNetworkCallsMs,
   nonRandomUUID,
+  sha256,
   skipNetworkLevelRetry
-} from "./chunk-DXHBESFY.js";
+} from "./chunk-VHVI7YNQ.js";
 import {
   AbortError,
   AbortSilentError,
@@ -64,15 +68,13 @@ import {
   errorMapper,
   graphQLErrorCodes,
   handler,
-  hasRateLimitCode,
   isGatewayErrorStatus,
   isPermissionCode,
   isRateLimitCode,
   shouldReportErrorAsUnexpected
-} from "./chunk-M3RDXLNX.js";
+} from "./chunk-L6U3W2XC.js";
 import {
   currentProcessIsGlobal,
-  external_exports,
   getArrayContainsDuplicates,
   getArrayRejectingUndefined,
   inferPackageManagerForGlobalCLI,
@@ -115,7 +117,7 @@ import {
   slugify,
   stringifyMessage,
   uniq
-} from "./chunk-37C3NPH2.js";
+} from "./chunk-VKOB4EDC.js";
 import {
   alwaysLogAnalytics,
   alwaysLogMetrics,
@@ -129,22 +131,26 @@ import {
   macAddress,
   opentelemetryDomain,
   themeToken
-} from "./chunk-P3CA5HR4.js";
+} from "./chunk-CXCQOKSC.js";
 import {
   bugsnagApiKey,
+  environmentVariables,
   reportingRateLimit,
   sessionConstants
-} from "./chunk-C3P3BBJI.js";
+} from "./chunk-C7SNAAK3.js";
+import {
+  external_exports
+} from "./chunk-GLO2DI4E.js";
 import {
   require_lib
-} from "./chunk-EJEHENXO.js";
+} from "./chunk-YYP4UTTA.js";
 import {
   cwd,
   isAbsolutePath,
   joinPath,
   normalizePath,
   relativePath
-} from "./chunk-57VCTLOQ.js";
+} from "./chunk-JZFZ3JYG.js";
 import {
   __commonJS,
   __esm,
@@ -10157,7 +10163,7 @@ var require_GraphQLError = __commonJS({
         extensions: args[5]
       } : firstArg;
     }
-    var GraphQLError = class _GraphQLError extends Error {
+    var GraphQLError2 = class _GraphQLError extends Error {
       /**
        * An array of `{ line, column }` locations within the source GraphQL document
        * which correspond to this error.
@@ -10374,7 +10380,7 @@ var require_GraphQLError = __commonJS({
         return this.locations != null && (formattedError.locations = this.locations), this.path != null && (formattedError.path = this.path), this.extensions != null && Object.keys(this.extensions).length > 0 && (formattedError.extensions = this.extensions), formattedError;
       }
     };
-    exports2.GraphQLError = GraphQLError;
+    exports2.GraphQLError = GraphQLError2;
     function undefinedIfEmpty(array) {
       return array === void 0 || array.length === 0 ? void 0 : array;
     }
@@ -11693,13 +11699,13 @@ var require_parser = __commonJS({
       value: !0
     });
     exports2.Parser = void 0;
-    exports2.parse = parse2;
+    exports2.parse = parse3;
     exports2.parseConstValue = parseConstValue;
     exports2.parseSchemaCoordinate = parseSchemaCoordinate;
     exports2.parseType = parseType;
     exports2.parseValue = parseValue;
     var _syntaxError = require_syntaxError(), _ast = require_ast(), _directiveLocation = require_directiveLocation(), _kinds = require_kinds(), _lexer = require_lexer(), _schemaCoordinateLexer = require_schemaCoordinateLexer(), _source = require_source(), _tokenKind = require_tokenKind();
-    function parse2(source, options2) {
+    function parse3(source, options2) {
       let parser2 = new Parser(source, options2), document = parser2.parseDocument();
       return Object.defineProperty(document, "tokenCount", {
         enumerable: !1,
@@ -24585,9 +24591,9 @@ var require_getOperationAST = __commonJS({
     Object.defineProperty(exports2, "__esModule", {
       value: !0
     });
-    exports2.getOperationAST = getOperationAST;
+    exports2.getOperationAST = getOperationAST2;
     var _kinds = require_kinds();
-    function getOperationAST(documentAST, operationName) {
+    function getOperationAST2(documentAST, operationName) {
       let operation = null;
       for (let definition of documentAST.definitions)
         if (definition.kind === _kinds.Kind.OPERATION_DEFINITION) {
@@ -32507,10 +32513,10 @@ metadata was removed`
         var payload = _$safeJsonStringify_1(session, null, null);
         return payload;
       };
-      var http4 = __require("http"), https4 = __require("https"), ___require_37 = __require("url"), parse2 = ___require_37.parse, _$request_37 = function(_ref, cb) {
+      var http4 = __require("http"), https4 = __require("https"), ___require_37 = __require("url"), parse3 = ___require_37.parse, _$request_37 = function(_ref, cb) {
         var url5 = _ref.url, headers = _ref.headers, body = _ref.body, agent = _ref.agent, didError = !1, onError = function(err2) {
           didError || (didError = !0, cb(err2));
-        }, parsedUrl = parse2(url5), secure = parsedUrl.protocol === "https:", transport = secure ? https4 : http4, req = transport.request({
+        }, parsedUrl = parse3(url5), secure = parsedUrl.protocol === "https:", transport = secure ? https4 : http4, req = transport.request({
           method: "POST",
           hostname: parsedUrl.hostname,
           port: parsedUrl.port,
@@ -61548,7 +61554,7 @@ async function sendAnalyticsEvent(payload, skipMonorailAnalytics, skipMetricAnal
 }
 async function sendAnalyticsEventFromStdin() {
   try {
-    let { readStdinString } = await import("./system-J3NNUCJW.js"), payloadStr = await readStdinString();
+    let { readStdinString } = await import("./system-SDCJN2UD.js"), payloadStr = await readStdinString();
     if (payloadStr === void 0)
       throw new Error("No analytics payload received from stdin");
     let { payload, skipMonorailAnalytics, skipMetricAnalytics } = JSON.parse(payloadStr);
@@ -61582,12 +61588,12 @@ async function reportAnalyticsEvent(options2) {
       outputDebug(outputContent`Skipping command analytics, payload: ${outputToken.json(payload)}`);
       return;
     }
-    let [{ platformAndArch: platformAndArch2 }, { isInsideContainer }] = await Promise.all([import("./os-ZBSIDHYK.js"), import("./system-J3NNUCJW.js")]), sendInBackground = !commandStartOptions?.requiresSyncAnalytics && platformAndArch2().platform !== "windows" && !ciPlatform().isCI && !isInsideContainer();
+    let [{ platformAndArch: platformAndArch2 }, { isInsideContainer }] = await Promise.all([import("./os-VAWLBHBF.js"), import("./system-SDCJN2UD.js")]), sendInBackground = !commandStartOptions?.requiresSyncAnalytics && platformAndArch2().platform !== "windows" && !ciPlatform().isCI && !isInsideContainer();
     if (outputDebug(outputContent`Sending command analytics${sendInBackground ? " in background" : ""}, payload: ${outputToken.json(payload)}`), !sendInBackground) {
       await sendAnalyticsEvent(payload, skipMonorailAnalytics, skipMetricAnalytics);
       return;
     }
-    let { exec } = await import("./system-J3NNUCJW.js"), argv = process.argv;
+    let { exec } = await import("./system-SDCJN2UD.js"), argv = process.argv;
     if (!argv[1])
       return;
     let nodeBinary = process.execPath, args = [argv[1], "send-analytics"], analyticsProcess = exec(nodeBinary, args, {
@@ -61672,8 +61678,9 @@ function compileData2() {
 }
 
 // ../cli-kit/dist/private/node/api.js
+var import_graphql2 = __toESM(require_graphql2(), 1);
 import { performance as performance2 } from "perf_hooks";
-var allAPIs = ["admin", "storefront-renderer", "partners", "business-platform", "app-management"], DEFAULT_RETRY_DELAY_MS2 = 1e3, DEFAULT_RETRY_LIMIT = 10, interestingResponseHeaders = /* @__PURE__ */ new Set([
+var allAPIs = ["admin", "storefront-renderer", "partners", "business-platform", "app-management"], DEFAULT_RETRY_DELAY_MS2 = 1e3, DEFAULT_RETRY_LIMIT = 10, MAX_THROTTLE_RETRY_DELAY_MS = 8e3, MAX_THROTTLE_RETRY_TIME_MS = 3e4, interestingResponseHeaders = /* @__PURE__ */ new Set([
   "cache-control",
   "content-type",
   "etag",
@@ -61751,32 +61758,23 @@ async function makeVerboseRequest(requestOptions) {
         for (let [key, value] of err2.response.headers)
           responseHeaderIsInteresting(key) && (responseHeaders[key] = value);
       let sanitizedHeaders = sanitizedHeadersOutput(responseHeaders);
-      if (isThrottled(err2)) {
-        let delayMs;
-        try {
-          delayMs = responseHeaders["retry-after"] ? Number.parseInt(responseHeaders["retry-after"], 10) : void 0;
-        } catch {
-        }
-        return {
-          status: "can-retry",
-          clientError: err2,
-          duration,
-          sanitizedHeaders,
-          sanitizedUrl,
-          requestId: responseHeaders["x-request-id"],
-          delayMs
-        };
-      } else if (err2.response.status === 401)
-        return {
-          status: "unauthorized",
-          clientError: err2,
-          duration,
-          sanitizedHeaders,
-          sanitizedUrl,
-          requestId: responseHeaders["x-request-id"],
-          delayMs: 500
-        };
-      return {
+      return isThrottled(err2) ? {
+        status: "can-retry",
+        clientError: err2,
+        duration,
+        sanitizedHeaders,
+        sanitizedUrl,
+        requestId: responseHeaders["x-request-id"],
+        delayMs: retryAfterDelayMs(responseHeaders["retry-after"])
+      } : err2.response.status === 401 ? {
+        status: "unauthorized",
+        clientError: err2,
+        duration,
+        sanitizedHeaders,
+        sanitizedUrl,
+        requestId: responseHeaders["x-request-id"],
+        delayMs: 500
+      } : {
         status: "client-error",
         clientError: err2,
         duration,
@@ -61805,7 +61803,34 @@ async function makeVerboseRequest(requestOptions) {
   };
 }
 function isThrottled(error) {
-  return error.response.status === 429 ? !0 : hasRateLimitCode(error.response.errors);
+  if (error.response.data != null && !isReadOnlyQuery(error.request.query))
+    return !1;
+  let httpRateLimited = error.response.status === 429, errors = error.response.errors;
+  return !Array.isArray(errors) || errors.length === 0 ? httpRateLimited : errors.every((entry) => {
+    let codes = graphQLErrorCodes([entry]);
+    return (codes.length > 0 || httpRateLimited) && codes.every(isRateLimitCode);
+  });
+}
+function isReadOnlyQuery(query) {
+  if (typeof query != "string")
+    return !1;
+  try {
+    return (0, import_graphql2.getOperationAST)((0, import_graphql2.parse)(query))?.operation === "query";
+  } catch (error) {
+    if (error instanceof import_graphql2.GraphQLError)
+      return !1;
+    throw error;
+  }
+}
+function retryAfterDelayMs(retryAfter) {
+  let value = retryAfter?.trim();
+  if (!value)
+    return;
+  let seconds = Number(value);
+  if (!Number.isNaN(seconds))
+    return Number.isFinite(seconds) && seconds >= 0 ? seconds * 1e3 : void 0;
+  let isAsctimeDate = /^[A-Za-z]{3} [A-Za-z]{3} (?: \d|\d{2}) \d{2}:\d{2}:\d{2} \d{4}$/.test(value), retryAt = Date.parse(isAsctimeDate ? `${value} GMT` : value);
+  return Number.isNaN(retryAt) ? void 0 : Math.max(0, retryAt - Date.now());
 }
 async function simpleRequestWithDebugLog(requestOptions, errorHandler3) {
   let result = await makeVerboseRequest(requestOptions);
@@ -61828,7 +61853,7 @@ ${result.sanitizedHeaders}
 async function retryAwareRequest(requestOptions, errorHandler3, retryOptions = {
   scheduleDelay: setTimeout
 }) {
-  let retriesUsed = 0, limitRetriesTo = retryOptions.limitRetriesTo ?? DEFAULT_RETRY_LIMIT, result = await makeVerboseRequest(requestOptions);
+  let retriesUsed = 0, limitRetriesTo = retryOptions.limitRetriesTo ?? DEFAULT_RETRY_LIMIT, result = await makeVerboseRequest(requestOptions), retryDeadline = performance2.now() + MAX_THROTTLE_RETRY_TIME_MS;
   for (outputDebug(`Request to ${result.sanitizedUrl} completed in ${result.duration} ms
 With response headers:
 ${result.sanitizedHeaders}
@@ -61841,13 +61866,14 @@ ${result.sanitizedHeaders}
       throw errorHandler3 ? errorHandler3(result.error, result.requestId) : result.error;
     if (result.status === "unauthorized")
       throw result.clientError;
-    if (limitRetriesTo <= retriesUsed)
-      throw outputDebug(`${limitRetriesTo} retries exhausted for request to ${result.sanitizedUrl}`), errorHandler3 ? errorHandler3(result.clientError, result.requestId) : result.clientError;
-    retriesUsed += 1, requestOptions.recordCommandRetries && recordRetry2(requestOptions.url, `http-retry-${retriesUsed}:${result.status}:`);
-    let retryDelayMs = result.delayMs ?? retryOptions.defaultDelayMs ?? DEFAULT_RETRY_DELAY_MS2;
-    outputDebug(`Scheduling retry request #${retriesUsed} to ${result.sanitizedUrl} in ${retryDelayMs} ms`), result = await new Promise((resolve) => {
+    let maximumDelayMs = Math.min((retryOptions.defaultDelayMs ?? DEFAULT_RETRY_DELAY_MS2) * 2 ** retriesUsed, MAX_THROTTLE_RETRY_DELAY_MS), retryDelayMs = result.delayMs ?? Math.floor(maximumDelayMs * (0.5 + Math.random() / 2));
+    if (limitRetriesTo <= retriesUsed || retryDelayMs >= retryDeadline - performance2.now())
+      throw outputDebug(`Rate-limit retry budget exhausted after ${retriesUsed} retries for request to ${result.sanitizedUrl}`), errorHandler3 ? errorHandler3(result.clientError, result.requestId) : result.clientError;
+    retriesUsed += 1, requestOptions.recordCommandRetries && recordRetry2(requestOptions.url, `http-retry-${retriesUsed}:${result.status}:`), outputDebug(`Scheduling retry request #${retriesUsed} to ${result.sanitizedUrl} in ${retryDelayMs} ms`);
+    let previousResult = result;
+    result = await new Promise((resolve) => {
       retryOptions.scheduleDelay(() => {
-        resolve(makeVerboseRequest(requestOptions));
+        resolve(performance2.now() < retryDeadline ? makeVerboseRequest(requestOptions) : previousResult);
       }, retryDelayMs);
     });
   }
@@ -62426,7 +62452,7 @@ async function exchangeAppAutomationTokenForAccessToken(apiName, token, scopes)
   let appId = applicationId(apiName);
   try {
     let accessToken = (await requestAppToken(apiName, token, scopes))[appId].accessToken, userId2 = nonRandomUUID(token);
-    return setLastSeenUserIdAfterAuth(userId2), setLastSeenAuthMethod("partners_token"), { accessToken, userId: userId2 };
+    return setLastSeenUserIdAfterAuth(userId2), setLastSeenAuthMethod(automationTokenAuthMethod()), { accessToken, userId: userId2 };
   } catch (error) {
     let prettyName = apiName.replace(/-/g, " ").replace(/\b\w/g, (char) => char.toUpperCase()), reason = error instanceof Error ? error.message.slice(0, 200) : "unknown error";
     throw outputDebug(`Token exchange for the ${prettyName} API failed: ${reason}`), new AbortError(`The custom token provided can't be used for the ${prettyName} API.`, "Ensure the token is correct and not expired.");
@@ -62438,8 +62464,8 @@ async function exchangeCustomPartnerToken(token) {
 async function exchangeAppAutomationTokenForAppManagementAccessToken(token) {
   return exchangeAppAutomationTokenForAccessToken("app-management", token, tokenExchangeScopes("app-management"));
 }
-async function exchangeAppAutomationTokenForBusinessPlatformAccessToken(token) {
-  return exchangeAppAutomationTokenForAccessToken("business-platform", token, tokenExchangeScopes("business-platform"));
+async function exchangeAppAutomationTokenForBusinessPlatformAccessToken(token, scopes = tokenExchangeScopes("business-platform")) {
+  return exchangeAppAutomationTokenForAccessToken("business-platform", token, scopes);
 }
 var identityDeviceErrors = [
   "authorization_pending",
@@ -62673,6 +62699,66 @@ var UserEmailQueryString = `
 
 // ../cli-kit/dist/public/node/session.js
 init_cjs_shims();
+
+// ../cli-kit/dist/private/node/session/permanent-store-domain.js
+init_cjs_shims();
+
+// ../cli-kit/dist/public/common/url.js
+init_cjs_shims();
+function safeParseURL(url4) {
+  try {
+    return new URL(url4);
+  } catch {
+    return;
+  }
+}
+function extractHost(value) {
+  if (!value)
+    return;
+  let lowered = value.toLowerCase();
+  for (let candidate of [lowered, `https://${lowered}`]) {
+    let hostname = safeParseURL(candidate)?.hostname;
+    if (hostname)
+      return hostname;
+  }
+  let fallback = lowered.replace(/^https?:\/\//, "").split("/")[0];
+  if (fallback)
+    return fallback;
+}
+function extractMyshopifyHandle(value) {
+  let host3 = extractHost(value);
+  if (!host3)
+    return;
+  let match = host3.match(/^([^.]+)\.myshopify\.com$/);
+  return match ? match[1] : void 0;
+}
+
+// ../cli-kit/dist/private/node/session/permanent-store-domain.js
+var PERMANENT_DOMAIN_LOOKUP_TIMEOUT_MS = 5e3, resolvedStoreFqdns = /* @__PURE__ */ new Map();
+async function resolvePermanentStoreFqdn(storeFqdn) {
+  if (serviceEnvironment() === "local")
+    return storeFqdn;
+  let cached = resolvedStoreFqdns.get(storeFqdn);
+  if (cached)
+    return cached;
+  let permanentStoreFqdn = await fetchPermanentStoreFqdn(storeFqdn);
+  return resolvedStoreFqdns.set(storeFqdn, permanentStoreFqdn), permanentStoreFqdn !== storeFqdn && (resolvedStoreFqdns.set(permanentStoreFqdn, permanentStoreFqdn), outputInfo(outputContent`Using the permanent domain ${outputToken.raw(permanentStoreFqdn)} for ${outputToken.raw(storeFqdn)}.`)), permanentStoreFqdn;
+}
+async function fetchPermanentStoreFqdn(storeFqdn) {
+  let url4 = `https://${storeFqdn}/meta.json`;
+  try {
+    let response = await fetch2(url4, { headers: { Accept: "application/json" } }, { useNetworkLevelRetry: !1, useAbortSignal: !0, timeoutMs: PERMANENT_DOMAIN_LOOKUP_TIMEOUT_MS });
+    if (!response.ok)
+      return outputDebug(`Could not look up the permanent domain of ${storeFqdn}: ${url4} returned HTTP ${response.status}`), storeFqdn;
+    let body = await response.json(), permanentStoreFqdn = typeof body?.myshopify_domain == "string" ? body.myshopify_domain.toLowerCase() : "", handle = extractMyshopifyHandle(permanentStoreFqdn);
+    return !handle || `${handle}.myshopify.com` !== permanentStoreFqdn ? (outputDebug(`Could not look up the permanent domain of ${storeFqdn}: ${url4} has no valid myshopify_domain`), storeFqdn) : permanentStoreFqdn;
+  } catch (error) {
+    let message = error instanceof Error ? error.message : String(error);
+    return outputDebug(`Could not look up the permanent domain of ${storeFqdn}: ${message}`), storeFqdn;
+  }
+}
+
+// ../cli-kit/dist/public/node/session.js
 function setLastSeenUserId(userId2) {
   setLastSeenUserIdAfterAuth(userId2);
 }
@@ -62759,8 +62845,8 @@ async function ensureAuthenticatedThemes(store2, password, scopes = [], options2
   if (outputDebug(outputContent`Ensuring that the user is authenticated with the Theme API with the following scopes:
 ${outputToken.json(scopes)}
 `), password) {
-    let session = { token: password, storeFqdn: store2 }, authMethod2 = isThemeAccessSession(session) ? "theme_access_token" : "custom_app_token";
-    return setLastSeenAuthMethod(authMethod2), setLastSeenUserIdAfterAuth(nonRandomUUID(password)), session;
+    let session = { token: password, storeFqdn: store2 }, themeAccess = isThemeAccessSession(session);
+    return setLastSeenAuthMethod(themeAccess ? "theme_access_token" : "custom_app_token"), setLastSeenUserIdAfterAuth(nonRandomUUID(password)), themeAccess && (session.storeFqdn = await resolvePermanentStoreFqdn(store2)), session;
   }
   return ensureAuthenticatedAdmin(store2, scopes, options2);
 }
@@ -62768,11 +62854,23 @@ async function ensureAuthenticatedBusinessPlatform(scopes = [], options2 = {}) {
   outputDebug(outputContent`Ensuring that the user is authenticated with the Business Platform API with the following scopes:
 ${outputToken.json(scopes)}
 `);
-  let tokens = await ensureAuthenticated({ businessPlatformApi: { scopes } }, process.env, options2);
+  let { allowAutomationToken = !1, ...authenticationOptions } = options2, automationToken = allowAutomationToken ? getAppAutomationToken() : void 0;
+  if (automationToken)
+    return (await exchangeAppAutomationTokenForBusinessPlatformAccessToken(automationToken, [])).accessToken;
+  let tokens = await ensureAuthenticated({ businessPlatformApi: { scopes } }, process.env, authenticationOptions);
   if (!tokens.businessPlatform)
     throw new BugError("No business-platform token found after ensuring authenticated");
   return tokens.businessPlatform;
 }
+function isServiceAccountTokenSet() {
+  return automationTokenVariable() === environmentVariables.serviceAccountToken;
+}
+function ensureNoServiceAccountToken() {
+  if (!isServiceAccountTokenSet())
+    return;
+  let variable = environmentVariables.serviceAccountToken;
+  throw new AbortError(`This command can't use ${variable}.`, `Unset ${variable} to run it with your Shopify account.`);
+}
 function logout() {
   return remove();
 }
@@ -62859,7 +62957,7 @@ ${sanitizedHeadersOutput(headers)}\n
 to ${sanitizeURL(url4)}`);
 }
 function sanitizeVariables(variables) {
-  let result = { ...variables }, sanitizedResult = sanitizeDeepVariables(result, ["apiKey", "serialized_script"]);
+  let result = { ...variables }, sanitizedResult = sanitizeDeepVariables(result, ["apiKey", "serialized_script", "sharedSecret", "shared_secret"]);
   return JSON.stringify(sanitizedResult, null, 2);
 }
 function sanitizeDeepVariables(value, sensitiveKeys) {
@@ -62913,7 +63011,7 @@ function errorHandler2(api) {
   return (error, requestId) => {
     if (error instanceof ClientError) {
       let { status } = error.response, extractedMessages = extractGraphQLErrorMessages(error.response.errors), errorMessage2;
-      extractedMessages && status < 500 ? errorMessage2 = extractedMessages : extractedMessages && status >= 500 ? errorMessage2 = `The ${api} GraphQL API responded with HTTP status ${status}: ${extractedMessages}` : errorMessage2 = stringifyMessage(outputContent`
+      extractedMessages && status < 500 ? errorMessage2 = extractedMessages : extractedMessages && status >= 500 ? errorMessage2 = `The ${api} GraphQL API responded with HTTP status ${status}: ${extractedMessages}` : error.response.errors === void 0 ? errorMessage2 = `The ${api} GraphQL API responded unsuccessfully with the HTTP status ${status}.` : errorMessage2 = stringifyMessage(outputContent`
 The ${outputToken.raw(api)} GraphQL API responded unsuccessfully with${status === 200 ? "" : ` the HTTP status ${status} and`} errors:
 
 ${outputToken.json(error.response.errors)}
@@ -62926,6 +63024,9 @@ Request ID: ${requestId}`);
       return error;
   };
 }
+function extractGraphQLErrors(error) {
+  return error instanceof ClientError ? Array.isArray(error.response.errors) ? error.response.errors : [] : error instanceof GraphQLClientError ? Array.isArray(error.errors) ? error.errors : [] : [];
+}
 
 // ../cli-kit/dist/public/node/api/graphql.js
 var MAX_RATE_LIMIT_RESTORE_DELAY_SECONDS = 0.3;
@@ -62980,29 +63081,43 @@ async function performGraphQLRequest(options2) {
       return client = newClient, headers = newHeaders, !0;
     } else
       return !1;
-  } : void 0, request3 = () => retryAwareRequest({ request: rawGraphQLRequest, url: url4, ...behaviour }, responseOptions?.handleErrors === !1 ? void 0 : errorHandler2(api)), executeWithTimer = () => runWithTimer("cmd_all_timing_network_ms")(async () => {
+  } : void 0, handleErrors = responseOptions?.handleErrors !== !1, request3 = () => retryAwareRequest({ request: rawGraphQLRequest, url: url4, ...behaviour }, handleErrors ? errorHandler2(api) : void 0), unauthorizedError = (error) => !handleErrors || !(error instanceof ClientError) || error.response.status !== 401 ? error : errorHandler2(api)(error, requestIdFromClientError(error)), executeWithTimer = () => runWithTimer("cmd_all_timing_network_ms")(async () => {
     let response;
     try {
       response = await request3();
     } catch (error) {
       if (error instanceof ClientError && error.response.status === 401 && tokenRefreshUnauthorizedHandlerFunction)
         if (await tokenRefreshUnauthorizedHandlerFunction())
-          response = await request3();
+          try {
+            response = await request3();
+          } catch (retryError) {
+            throw unauthorizedError(retryError);
+          }
         else
-          throw error;
+          throw unauthorizedError(error);
       else
-        throw error;
+        throw unauthorizedError(error);
     }
     return responseOptions?.onResponse && responseOptions.onResponse(response), response.data;
   });
   if (cacheOptions === void 0)
     return executeWithTimer();
-  let { cacheTTL, cacheExtraKey, cacheStore } = cacheOptions, queryHash = nonRandomUUID(queryAsString), variablesHash = nonRandomUUID(JSON.stringify(variables ?? {})), cacheKey = `q-${queryHash}-${variablesHash}-${CLI_KIT_VERSION}-${cacheExtraKey ?? ""}`, result = await cacheRetrieveOrRepopulate(cacheKey, async () => {
+  let { cacheTTL, cacheExtraKey, cacheStore } = cacheOptions, queryHash = nonRandomUUID(queryAsString), variablesHash = nonRandomUUID(JSON.stringify(variables ?? {})), principalHash = graphQLCachePrincipalHash(url4, token), cacheKey = `q-${queryHash}-${variablesHash}-${CLI_KIT_VERSION}-${principalHash}-${cacheExtraKey ?? ""}`, result = await cacheRetrieveOrRepopulate(cacheKey, async () => {
     let result2 = await executeWithTimer();
     return JSON.stringify(result2);
   }, timeIntervalToMilliseconds(cacheTTL), cacheStore);
   return JSON.parse(result);
 }
+function requestIdFromClientError(error) {
+  try {
+    return error.response.headers?.get?.("x-request-id") ?? void 0;
+  } catch {
+    return;
+  }
+}
+function graphQLCachePrincipalHash(url4, token) {
+  return sha256(JSON.stringify([url4, token ?? ""])).toString("hex");
+}
 async function logLastRequestIdFromResponse(response) {
   try {
     let requestId = response.headers.get("x-request-id");
@@ -63142,7 +63257,7 @@ async function getLastSeenAuthMethod() {
   if (getCurrentSessionId())
     return "device_auth";
   if (getAppAutomationToken())
-    return "partners_token";
+    return automationTokenAuthMethod();
   let themePassword = themeToken();
   return themePassword ? isThemeAccessSession({ token: themePassword, storeFqdn: "" }) ? "theme_access_token" : "custom_app_token" : "none";
 }
@@ -63153,6 +63268,10 @@ function setCommandSessionId(sessionId) {
   commandSessionId = sessionId;
 }
 async function ensureAuthenticated(applications, _env, { forceRefresh = !1, noPrompt = !1, forceNewSession = !1 } = {}) {
+  let variablesProblem = automationTokenVariablesProblem();
+  if (variablesProblem)
+    throw new AbortError(variablesProblem.message, variablesProblem.tryMessage);
+  ensureNoServiceAccountToken();
   let fqdn = await identityFqdn(), previousStoreFqdn = applications.adminApi?.storeFqdn;
   if (previousStoreFqdn) {
     let normalizedStoreName = normalizeStoreFqdn(previousStoreFqdn);
@@ -63398,6 +63517,8 @@ export {
   ok,
   err,
   isThemeAccessSession,
+  safeParseURL,
+  extractMyshopifyHandle,
   setLastSeenUserId,
   setCurrentSessionAlias,
   isUserAccount,
@@ -63408,6 +63529,7 @@ export {
   ensureAuthenticatedAdmin,
   ensureAuthenticatedThemes,
   ensureAuthenticatedBusinessPlatform,
+  isServiceAccountTokenSet,
   ensureAuthenticatedAdminAsApp,
   require_cjs,
   require_baseAssignValue,
@@ -63424,6 +63546,7 @@ export {
   setPathValue,
   isEmpty,
   compact,
+  extractGraphQLErrors,
   graphqlRequest,
   graphqlRequestDoc,
   require_lib4 as require_lib2,
@@ -63468,4 +63591,4 @@ mime-types/index.js:
    * MIT Licensed
    *)
 */
-//# sourceMappingURL=chunk-MCVF3JKC.js.map
+//# sourceMappingURL=chunk-F5VM2BG4.js.map