Skip to content

Upgrade cloudflared to 2026.10.3 on stable/4.9 - #9019

Merged
isaacroldan merged 2 commits into
stable/4.9from
codex/upgrade-cloudflared-stable-4-9
Oct 27, 2026
Merged

isaacroldan merged 2 commits into
stable/4.9from
codex/upgrade-cloudflared-stable-4-9

Conversation

@isaacroldan

Copy link
Copy Markdown
Contributor

WHY are these changes introduced?

Backport #9017 to stable/4.9, the stable branch for the latest published release, 4.9.4. The CLI pins cloudflared 2024.8.2; Cloudflare's eMudhra advisory asks users to upgrade after eight intermediate CA private keys were compromised.

WHAT is this pull request doing?

Upgrade the cloudflared pin to 2026.10.3, update the download URL assertions, and add a patch changeset. The existing installer upgrades older binaries on the next tunnel start.

Local macOS arm64 validation passed: all 18 stable-branch plugin tests, Nx lint, TypeScript checks, and the plugin build. A smoke test with real binaries confirmed fresh installation, reuse of 2026.10.3, and upgrade from 2024.8.2. Live tunnel traffic and Linux/Windows runtime tests were not repeated for this backport.

How to manually test your changes?

  1. From the PR checkout, build the CLI and replace any older bundled output with a forced source build:

    pnpm nx build cli
    pnpm exec tsc -b packages/cli/tsconfig.build.json packages/plugin-cloudflare/tsconfig.build.json --force
    tunnel_dir=$(mktemp -d)
    SHOPIFY_CLI_CLOUDFLARED_PATH="$tunnel_dir/cloudflared" pnpm shopify:run app dev --path /path/to/app --verbose

    Use shopify:run to run this build directly without restoring Nx build cache output.

  2. Open the app preview and confirm it loads through the Cloudflare tunnel. Stop the development server, then run "$tunnel_dir/cloudflared" --version and confirm it reports 2026.10.3.

  3. Start the command again and confirm the existing binary is reused. Repeat with a 2024.8.2 binary at the same path and confirm it is upgraded to 2026.10.3.

  4. Remove the temporary directory when finished: rm -r "$tunnel_dir".

Checklist

  • I've considered possible cross-platform impacts (Mac, Linux, Windows)
  • I've considered possible documentation changes
  • I've considered analytics changes to measure impact
  • The change is user-facing — I've identified the correct bump type (patch for bug fixes · minor for new features · major for breaking changes) and added a changeset

Cloudflare asks cloudflared users to upgrade after the private keys of
eight eMudhra intermediate CA certificates were compromised. Upgrade the
CLI pin and the download URL assertions.

The existing installer replaces older binaries on the next tunnel start.

Advisory: https://blog.cloudflare.com/emudhra-certificate-compromise
(cherry picked from commit 1971278)
@isaacroldan
isaacroldan requested a review from a team as a code owner October 27, 2026 09:13
@github-actions github-actions Bot added the Area: @shopify/cli @shopify/cli package issues label Oct 27, 2026
@github-actions

Copy link
Copy Markdown
Contributor

Differences in type declarations

We detected differences in the type declarations generated by Typescript for this branch compared to the baseline ('main' branch). Please, review them to ensure they are backward-compatible. Here are some important things to keep in mind:

  • Some seemingly private modules might be re-exported through public modules.
  • If the branch is behind main you might see odd diffs, rebase main into this branch.

New type declarations

packages/cli-kit/dist/private/node/ui/components/TextAnimation.d.ts
import React from 'react';
interface TextAnimationProps {
    text: string;
    maxWidth?: number;
}
/**
 * `TextAnimation` applies a rainbow animation to text.
 */
declare const TextAnimation: React.MemoExoticComponent<({ text, maxWidth }: TextAnimationProps) => JSX.Element>;
export { TextAnimation };

Existing type declarations

packages/cli-kit/dist/private/node/api.d.ts
@@ -60,8 +60,6 @@ export declare function simpleRequestWithDebugLog<T extends {
  * Makes a HTTP request to some API, retrying if response headers indicate a retryable error.
  *
  * If a request fails with a 429, the retry-after header determines a delay before an automatic retry is performed.
- * Without a valid header, rate-limit retries use exponential backoff with jitter, capped at 8 seconds per delay.
- * No new rate-limit retry starts after 30 seconds. A server-requested delay beyond that budget is not shortened.
  *
  * If unauthorizedHandler is provided, then it will be called in the case of a 401 and a retry performed. This allows
  * for a token refresh for instance.
packages/cli-kit/dist/private/node/constants.d.ts
@@ -8,7 +8,6 @@ export declare const environmentVariables: {
     env: string;
     noAnalytics: string;
     optOutInstrumentation: string;
-    serviceAccountToken: string;
     appAutomationToken: string;
     partnersToken: string;
     runAsUser: string;
packages/cli-kit/dist/private/node/json-error.d.ts
@@ -1,3 +1,16 @@
+interface FatalErrorLike {
+    type?: number;
+    message?: unknown;
+    formattedMessage?: unknown;
+    tryMessage?: unknown;
+    nextSteps?: unknown;
+    customSections?: unknown;
+    stack?: unknown;
+    command?: unknown;
+    args?: unknown;
+    details?: unknown;
+    code?: unknown;
+}
 /**
  * Writes the public JSON representation of a fatal error to stdout.
  *
@@ -6,4 +19,5 @@
  *
  * @param error - Fatal error to serialize.
  */
-export declare function renderFatalErrorAsJson(error: unknown): void;
\ No newline at end of file
+export declare function renderFatalErrorAsJson(error: FatalErrorLike): void;
+export {};
\ No newline at end of file
packages/cli-kit/dist/private/node/session.d.ts
@@ -61,7 +61,7 @@ export interface OAuthSession {
     appManagement?: string;
     userId: string;
 }
-type AuthMethod = 'partners_token' | 'service_account_token' | 'device_auth' | 'theme_access_token' | 'custom_app_token' | 'none';
+type AuthMethod = 'partners_token' | 'device_auth' | 'theme_access_token' | 'custom_app_token' | 'none';
 /**
  * Retrieves a stable user identifier for analytics, or `'unknown'` if none applies.
  *
@@ -82,8 +82,7 @@ export declare function setLastSeenUserIdAfterAuth(id: string): void;
  * This function checks for the authentication method in the following order:
  * 1. Returns the cached auth method if it's not 'none'.
  * 2. Checks for a cached session, which implies 'device_auth' was used.
- * 3. Checks for an automation token in the environment: `service_account_token` for SHOPIFY_SERVICE_ACCOUNT_TOKEN,
- *    `partners_token` for the app and Partner variables.
+ * 3. Checks for a partners token in the environment.
  * 4. Checks for a theme password in the environment.
  * 5. If none of the above are true, returns 'none'.
  *
packages/cli-kit/dist/public/common/version.d.ts
@@ -1 +1 @@
-export declare const CLI_KIT_VERSION = "4.9.0";
\ No newline at end of file
+export declare const CLI_KIT_VERSION = "4.9.4";
\ No newline at end of file
packages/cli-kit/dist/public/node/base-command.d.ts
@@ -1,5 +1,4 @@
 import { type JsonOutputSchema } from './json-output-schema.js';
-import { JsonMap } from '../../private/common/json.js';
 import { Command } from '@oclif/core';
 import { OutputFlags, Input, ParserOutput, FlagInput, OutputArgs } from '@oclif/core/parser';
 export type ArgOutput = OutputArgs<any>;
@@ -21,14 +20,12 @@ declare abstract class BaseCommand extends Command {
     static descriptionWithoutMarkdown(): string | undefined;
     static analyticsNameOverride(): string | undefined;
     static analyticsStopCommand(): string | undefined;
-    private jsonOutputFromFlags;
     catch(error: Error & {
         skipOclifErrorHandling: boolean;
     }): Promise<void>;
     protected _run<T>(): Promise<T>;
     protected init(): Promise<unknown>;
     protected showNpmFlagWarning(): void;
-    protected showDeprecatedAutomationTokenVariableWarning(): Promise<void>;
     protected exitWithTimestampWhenEnvVariablePresent(): void;
     protected parse<TFlags extends FlagOutput & {
         path?: string;
@@ -37,10 +34,7 @@ declare abstract class BaseCommand extends Command {
     }, TGlobalFlags extends FlagOutput, TArgs extends ArgOutput>(options?: Input<TFlags, TGlobalFlags, TArgs>, argv?: string[]): Promise<ParserOutput<TFlags, TGlobalFlags, TArgs> & {
         argv: string[];
     }>;
-    protected runWithParsedOutput<T>(flags: FlagOutput, execute: () => T): T;
     protected environmentsFilename(): string | undefined;
-    protected parseEnvironmentFlags<TFlags extends FlagOutput, TGlobalFlags extends FlagOutput, TArgs extends ArgOutput>(environment: JsonMap, options: Input<TFlags, TGlobalFlags, TArgs>, explicitFlags: FlagOutput): Promise<FlagOutput>;
-    protected validateNonTTYFlags(flags: FlagOutput): void;
     protected failMissingNonTTYFlags(flags: FlagOutput, requiredFlags: string[]): void;
     private failMissingNonTTYFlagRequirements;
     private applicableNonTTYFlagRequirements;
packages/cli-kit/dist/public/node/environment.d.ts
@@ -10,13 +10,10 @@
  */
 export declare function getEnvironmentVariables(): NodeJS.ProcessEnv;
 /**
- * Returns the automation token the CLI authenticates with, from the first of these variables that is set:
- * SHOPIFY_SERVICE_ACCOUNT_TOKEN, or the deprecated SHOPIFY_APP_AUTOMATION_TOKEN and SHOPIFY_CLI_PARTNERS_TOKEN.
+ * Returns the value of the SHOPIFY_APP_AUTOMATION_TOKEN environment variable,
+ * falling back to the deprecated SHOPIFY_CLI_PARTNERS_TOKEN.
  *
- * Returns undefined when the variables can't be used (an empty value, or the service account variable set alongside
- * another one). Callers then fall back to the login flow, which reports the problem instead of logging in.
- *
- * @returns The automation token, or undefined if there is no usable one.
+ * @returns The app automation token value, or undefined if neither env var is set.
  */
 export declare function getAppAutomationToken(): string | undefined;
 /**
packages/cli-kit/dist/public/node/notifications-system.d.ts
@@ -26,7 +26,7 @@ declare const NotificationSchema: zod.ZodObject<{
     id: string;
     type: "info" | "error" | "warning";
     message: string;
-    frequency: "once" | "always" | "once_a_day" | "once_a_week";
+    frequency: "always" | "once" | "once_a_day" | "once_a_week";
     ownerChannel: string;
     title?: string | undefined;
     cta?: {
@@ -43,7 +43,7 @@ declare const NotificationSchema: zod.ZodObject<{
     id: string;
     type: "info" | "error" | "warning";
     message: string;
-    frequency: "once" | "always" | "once_a_day" | "once_a_week";
+    frequency: "always" | "once" | "once_a_day" | "once_a_week";
     ownerChannel: string;
     title?: string | undefined;
     cta?: {
@@ -86,7 +86,7 @@ declare const NotificationsSchema: zod.ZodObject<{
         id: string;
         type: "info" | "error" | "warning";
         message: string;
-        frequency: "once" | "always" | "once_a_day" | "once_a_week";
+        frequency: "always" | "once" | "once_a_day" | "once_a_week";
         ownerChannel: string;
         title?: string | undefined;
         cta?: {
@@ -103,7 +103,7 @@ declare const NotificationsSchema: zod.ZodObject<{
         id: string;
         type: "info" | "error" | "warning";
         message: string;
-        frequency: "once" | "always" | "once_a_day" | "once_a_week";
+        frequency: "always" | "once" | "once_a_day" | "once_a_week";
         ownerChannel: string;
         title?: string | undefined;
         cta?: {
@@ -122,7 +122,7 @@ declare const NotificationsSchema: zod.ZodObject<{
         id: string;
         type: "info" | "error" | "warning";
         message: string;
-        frequency: "once" | "always" | "once_a_day" | "once_a_week";
+        frequency: "always" | "once" | "once_a_day" | "once_a_week";
         ownerChannel: string;
         title?: string | undefined;
         cta?: {
@@ -141,7 +141,7 @@ declare const NotificationsSchema: zod.ZodObject<{
         id: string;
         type: "info" | "error" | "warning";
         message: string;
-        frequency: "once" | "always" | "once_a_day" | "once_a_week";
+        frequency: "always" | "once" | "once_a_day" | "once_a_week";
         ownerChannel: string;
         title?: string | undefined;
         cta?: {
packages/cli-kit/dist/public/node/path.d.ts
@@ -1,7 +1,4 @@
 import type { URL } from 'url';
-interface IsSubpathOptions {
-    native?: boolean;
-}
 /**
  * Joins a list of paths together.
  *
@@ -93,25 +90,13 @@ export declare function commonParentDirectory(first: string, second: string): st
  */
 export declare function relativizePath(path: string, dir?: string): string;
 /**
- * Given 2 paths, it returns whether the second path is inside or equal to the first path.
- *
- * By default, paths are compared with pathe, which treats `\` as a separator
- * on every platform. This behaviour is kept for backward compatibility.
- *
- * When `native` is true, paths are compared with the current OS's native path
- * semantics, so literal backslashes on POSIX are preserved as filename
- * characters. Use `native: true` for security or containment checks on
- * resolved filesystem paths.
- *
- * Symbolic links are not resolved; use fileRealPath from the fs module first
- * when checking physical containment.
+ * Given 2 paths, it returns whether the second path is a subpath of the first path.
  *
  * @param mainPath - The main path.
  * @param subpath - The subpath.
- * @param options - Comparison options. Set `native` to true to use the OS's native path semantics. Defaults to false.
- * @returns Whether the subpath is inside or equal to the main path.
+ * @returns Whether the subpath is a subpath of the main path.
  */
-export declare function isSubpath(mainPath: string, subpath: string, options?: IsSubpathOptions): boolean;
+export declare function isSubpath(mainPath: string, subpath: string): boolean;
 /**
  * Given a module's import.meta.url it returns the directory containing the module.
  *
@@ -153,5 +138,4 @@ export declare function sniffForJson(argv?: string[]): boolean;
  * @param warn - Called with a human-readable warning when traversal segments are removed.
  * @returns The sanitized path (may be an empty string if all segments were traversal).
  */
-export declare function sanitizeRelativePath(input: string, warn: (msg: string) => void): string;
-export {};
\ No newline at end of file
+export declare function sanitizeRelativePath(input: string, warn: (msg: string) => void): string;
\ No newline at end of file
packages/cli-kit/dist/public/node/session.d.ts
@@ -121,10 +121,6 @@ export declare function ensureAuthenticatedAdmin(store: string, scopes?: AdminAP
  * If a password is provided, that token will be used against Theme Access API.
  * Otherwise, it will ensure that the user is authenticated with the Admin API.
  *
- * Theme Access passwords only work with the store's permanent `.myshopify.com` domain, so when the password is a
- * Theme Access password the returned session uses the permanent domain of `store`, even if `store` is another of the
- * store's domains.
- *
  * @param store - Store fqdn to request auth for.
  * @param password - Password generated from Theme Access app.
  * @param scopes - Optional array of extra scopes to authenticate with.
@@ -132,44 +128,14 @@ export declare function ensureAuthenticatedAdmin(store: string, scopes?: AdminAP
  * @returns The access token and store.
  */
 export declare function ensureAuthenticatedThemes(store: string, password: string | undefined, scopes?: AdminAPIScope[], options?: EnsureAuthenticatedAdditionalOptions): Promise<AdminSession>;
-/**
- * Options for `ensureAuthenticatedBusinessPlatform`.
- */
-export interface EnsureAuthenticatedBusinessPlatformOptions extends EnsureAuthenticatedAdditionalOptions {
-    /**
-     * Authenticate with the automation token set in the environment, when there is one, instead of the
-     * logged-in user. Only commands that support automation tokens opt in; other callers, such as
-     * Hydrogen's login, keep using the user's session.
-     */
-    allowAutomationToken?: boolean;
-}
 /**
  * Ensure that we have a valid session to access the Business Platform API.
  *
- * @param scopes - Optional array of extra scopes to authenticate with. Ignored when an automation token is used.
+ * @param scopes - Optional array of extra scopes to authenticate with.
  * @param options - Optional extra options to use.
  * @returns The access token for the Business Platform API.
  */
-export declare function ensureAuthenticatedBusinessPlatform(scopes?: BusinessPlatformScope[], options?: EnsureAuthenticatedBusinessPlatformOptions): Promise<string>;
-/**
- * Whether SHOPIFY_SERVICE_ACCOUNT_TOKEN is set, which makes it the automation token the CLI authenticates with.
- *
- * True even when it's empty or set together with another automation token variable. Commands use this to skip logins
- * saved on this machine, and authentication then reports any problem with the variables.
- *
- * @returns True when SHOPIFY_SERVICE_ACCOUNT_TOKEN is set.
- */
-export declare function isServiceAccountTokenSet(): boolean;
-/**
- * Fails when SHOPIFY_SERVICE_ACCOUNT_TOKEN is set, for commands that can't run with that token.
- *
- * Service account tokens can't log in as a user or call a store's Admin API, so commands that need either
- * refuse to run instead of quietly using the person's own login. `ensureAuthenticated` runs this check before any
- * login. Commands that run on a login saved by `shopify store auth` call it before loading that login.
- *
- * @throws AbortError when SHOPIFY_SERVICE_ACCOUNT_TOKEN is set.
- */
-export declare function ensureNoServiceAccountToken(): void;
+export declare function ensureAuthenticatedBusinessPlatform(scopes?: BusinessPlatformScope[], options?: EnsureAuthenticatedAdditionalOptions): Promise<string>;
 /**
  * Logout from Shopify.
  *
packages/cli-kit/dist/public/node/system.d.ts
@@ -8,8 +8,6 @@ export interface ExecOptions {
     stderr?: Writable | 'inherit';
     stdio?: 'inherit';
     input?: string;
-    /** Whether to remove the final newline from captured stdout/stderr (default: true). */
-    stripFinalNewline?: boolean;
     signal?: AbortSignal;
     externalErrorHandler?: (error: unknown) => Promise<void>;
     background?: boolean;
@@ -44,7 +42,6 @@ export interface CaptureOutputResult {
 /**
  * Runs a command asynchronously and returns stdout, stderr, and exit code.
  * Unlike captureOutput, this function does NOT throw on non-zero exit codes.
- * Startup failures and signal termination still throw an ExternalError.
  *
  * @param command - Command to be executed.
  * @param args - Arguments to pass to the command.
@@ -64,7 +61,6 @@ export declare function captureOutputWithExitCode(command: string, args: string[
  * Runs a command string asynchronously and returns stdout, stderr, and exit code.
  * Parses the command string into command and arguments (handles quoted strings).
  * Unlike captureOutput, this function does NOT throw on non-zero exit codes.
- * Startup failures and signal termination still throw an ExternalError.
  *
  * @param command - Full command string to be executed (e.g., 'ls -la "my folder"').
  * @param options - Optional settings for how to run the command.
packages/cli-kit/dist/public/node/ui.d.ts
@@ -325,9 +325,9 @@ export interface RenderSingleTaskOptions<T> {
     renderOptions?: RenderOptions;
 }
 /**
- * Awaits a single task and displays a loading indicator while it's in progress. The task's result is returned.
+ * Awaits a single task and displays a loading bar while it's in progress. The task's result is returned.
  * @param options - Configuration object
- * @param options.title - The initial title to display with the loading indicator
+ * @param options.title - The initial title to display with the loading bar
  * @param options.task - The async task to execute. Receives an updateStatus callback to change the displayed title.
  * @param options.retry - The number of additional attempts after a failure. Defaults to zero.
  * @param options.renderOptions - Optional render configuration
@@ -375,30 +375,10 @@ export interface RenderDangerousConfirmationPromptOptions extends Omit<Dangerous
  *
  */
 export declare function renderDangerousConfirmationPrompt({ renderOptions, ...props }: RenderDangerousConfirmationPromptOptions, uiDebugOptions?: UIDebugOptions): Promise<boolean>;
-interface KeypressOptions {
-    /**
-     * The keys that end the wait, for example `['\r']` for Enter. Other keys are ignored.
-     * Without this option, any key ends the wait.
-     */
-    keys?: string[];
-}
-/**
- * Waits for a key to be pressed. Ctrl+C rejects with AbortSilentError, which terminates the process.
- *
- * Raw mode is set back to the state it had before the call. A command that keeps stdin raw for
- * its own single-key shortcuts (for example `theme dev`) keeps them.
- *
- * Chunks are read as text: an active Ink renderer calls `stdin.setEncoding('utf8')`, and then
- * stdin emits strings instead of Buffers.
- *
- * @param stdin - The stream to read from.
- * @param uiDebugOptions - Debug options; `skipTTYCheck` allows a non-TTY stdin.
- * @param options - The keys that end the wait.
- * @returns A promise that resolves when an accepted key is pressed.
- */
+/** Waits for any key to be pressed except Ctrl+C which will terminate the process. */
 export declare const keypress: (stdin?: NodeJS.ReadStream & {
     fd: 0;
-}, uiDebugOptions?: UIDebugOptions, { keys }?: KeypressOptions) => Promise<void>;
+}, uiDebugOptions?: UIDebugOptions) => Promise<unknown>;
 interface IsTTYOptions {
     stdin?: NodeJS.ReadStream;
     uiDebugOptions?: UIDebugOptions;
packages/cli-kit/dist/public/node/upgrade.d.ts
@@ -1,5 +1,4 @@
 import { getAutoUpgradeEnabled, setAutoUpgradeEnabled } from '../../private/node/conf-store.js';
-import type { UpgradeResult } from './upgrade/types.js';
 export { getAutoUpgradeEnabled, setAutoUpgradeEnabled };
 /**
  * Utility function for generating an install command for the user to run
@@ -28,13 +27,6 @@ export interface RunCLIUpgradeOptions {
  * @throws AbortError if the package manager or command cannot be determined.
  */
 export declare function runCLIUpgrade(options?: RunCLIUpgradeOptions): Promise<void>;
-/**
- * Upgrades the CLI and returns the outcome independently of final presentation.
- *
- * @param options - Whether the upgrade was triggered automatically.
- * @returns The verified global version, local dependency update, or skip reason.
- */
-export declare function upgradeCLI(options?: RunCLIUpgradeOptions): Promise<UpgradeResult>;
 /**
  * Returns the version to auto-upgrade to, or undefined if auto-upgrade should be skipped.
  * Auto-upgrade is enabled by default and can be disabled via `setAutoUpgradeEnabled(false)`.
packages/cli-kit/dist/private/node/api/graphql.d.ts
@@ -1,4 +1,4 @@
-import { ClientError, Variables } from 'graphql-request';
+import { Variables } from 'graphql-request';
 export declare function debugLogRequestInfo(api: string, query: string, url: string, variables?: Variables, headers?: Record<string, string>): void;
 export declare function sanitizeVariables(variables: Variables): string;
 /**
@@ -11,5 +11,4 @@ export declare function sanitizeVariables(variables: Variables): string;
  * the full JSON representation if no messages can be extracted.
  */
 export declare function extractGraphQLErrorMessages(errors: any[] | undefined): string | undefined;
-export declare function errorHandler(api: string): (error: unknown, requestId?: string) => unknown;
-export declare function extractGraphQLErrors(error: unknown): NonNullable<ClientError['response']['errors']>;
\ No newline at end of file
+export declare function errorHandler(api: string): (error: unknown, requestId?: string) => unknown;
\ No newline at end of file
packages/cli-kit/dist/private/node/session/exchange.d.ts
@@ -45,10 +45,9 @@ export declare function exchangeAppAutomationTokenForAppManagementAccessToken(to
 /**
  * Given a custom app automation token passed as ENV variable, request a valid Business Platform API token.
  * @param token - The app automation token passed as ENV variable `SHOPIFY_APP_AUTOMATION_TOKEN`
- * @param scopes - The scopes to request. An empty list makes Identity issue every Business Platform scope the token holds.
  * @returns An instance with the application access tokens.
  */
-export declare function exchangeAppAutomationTokenForBusinessPlatformAccessToken(token: string, scopes?: string[]): Promise<{
+export declare function exchangeAppAutomationTokenForBusinessPlatformAccessToken(token: string): Promise<{
     accessToken: string;
     userId: string;
 }>;
packages/cli-kit/dist/public/node/error/schema.d.ts
@@ -30,24 +30,24 @@ export declare const JsonAbortErrorSchema: zod.ZodObject<{
     type: "abort";
     message: string;
     code?: string | undefined;
-    tryMessage?: string | undefined;
     nextSteps?: string[] | undefined;
     customSections?: {
         body: string | string[][];
         title?: string | undefined;
     }[] | undefined;
     details?: unknown;
+    tryMessage?: string | undefined;
 }, {
     type: "abort";
     message: string;
     code?: string | undefined;
-    tryMessage?: string | undefined;
     nextSteps?: string[] | undefined;
     customSections?: {
         body: string | string[][];
         title?: string | undefined;
     }[] | undefined;
     details?: unknown;
+    tryMessage?: string | undefined;
 }>;
 export declare const JsonBugErrorSchema: zod.ZodObject<{
     stack: zod.ZodOptional<zod.ZodString>;
@@ -71,7 +71,6 @@ export declare const JsonBugErrorSchema: zod.ZodObject<{
     type: "bug";
     message: string;
     code?: string | undefined;
-    tryMessage?: string | undefined;
     stack?: string | undefined;
     nextSteps?: string[] | undefined;
     customSections?: {
@@ -79,11 +78,11 @@ export declare const JsonBugErrorSchema: zod.ZodObject<{
         title?: string | undefined;
     }[] | undefined;
     details?: unknown;
+    tryMessage?: string | undefined;
 }, {
     type: "bug";
     message: string;
     code?: string | undefined;
-    tryMessage?: string | undefined;
     stack?: string | undefined;
     nextSteps?: string[] | undefined;
     customSections?: {
@@ -91,6 +90,7 @@ export declare const JsonBugErrorSchema: zod.ZodObject<{
         title?: string | undefined;
     }[] | undefined;
     details?: unknown;
+    tryMessage?: string | undefined;
 }>;
 export declare const JsonExternalErrorSchema: zod.ZodObject<{
     command: zod.ZodString;
@@ -117,26 +117,26 @@ export declare const JsonExternalErrorSchema: zod.ZodObject<{
     command: string;
     args: string[];
     code?: string | undefined;
-    tryMessage?: string | undefined;
     nextSteps?: string[] | undefined;
     customSections?: {
         body: string | string[][];
         title?: string | undefined;
     }[] | undefined;
     details?: unknown;
+    tryMessage?: string | undefined;
 }, {
     type: "external";
     message: string;
     command: string;
     args: string[];
     code?: string | undefined;
-    tryMessage?: string | undefined;
     nextSteps?: string[] | undefined;
     customSections?: {
         body: string | string[][];
         title?: string | undefined;
     }[] | undefined;
     details?: unknown;
+    tryMessage?: string | undefined;
 }>;
 export declare const JsonErrorSchema: zod.ZodUnion<[zod.ZodObject<{
     message: zod.ZodString;
@@ -159,24 +159,24 @@ export declare const JsonErrorSchema: zod.ZodUnion<[zod.ZodObject<{
     type: "abort";
     message: string;
     code?: string | undefined;
-    tryMessage?: string | undefined;
     nextSteps?: string[] | undefined;
     customSections?: {
         body: string | string[][];
         title?: string | undefined;
     }[] | undefined;
     details?: unknown;
+    tryMessage?: string | undefined;
 }, {
     type: "abort";
     message: string;
     code?: string | undefined;
-    tryMessage?: string | undefined;
     nextSteps?: string[] | undefined;
     customSections?: {
         body: string | string[][];
         title?: string | undefined;
     }[] | undefined;
     details?: unknown;
+    tryMessage?: string | undefined;
 }>, zod.ZodObject<{
     stack: zod.ZodOptional<zod.ZodString>;
     message: zod.ZodString;
@@ -199,7 +199,6 @@ export declare const JsonErrorSchema: zod.ZodUnion<[zod.ZodObject<{
     type: "bug";
     message: string;
     code?: string | undefined;
-    tryMessage?: string | undefined;
     stack?: string | undefined;
     nextSteps?: string[] | undefined;
     customSections?: {
@@ -207,11 +206,11 @@ export declare const JsonErrorSchema: zod.ZodUnion<[zod.ZodObject<{
         title?: string | undefined;
     }[] | undefined;
     details?: unknown;
+    tryMessage?: string | undefined;
 }, {
     type: "bug";
     message: string;
     code?: string | undefined;
-    tryMessage?: string | undefined;
     stack?: string | undefined;
     nextSteps?: string[] | undefined;
     customSections?: {
@@ -219,6 +218,7 @@ export declare const JsonErrorSchema: zod.ZodUnion<[zod.ZodObject<{
         title?: string | undefined;
     }[] | undefined;
     details?: unknown;
+    tryMessage?: string | undefined;
 }>, zod.ZodObject<{
     command: zod.ZodString;
     args: zod.ZodArray<zod.ZodString, "many">;
@@ -244,26 +244,26 @@ export declare const JsonErrorSchema: zod.ZodUnion<[zod.ZodObject<{
     command: string;
     args: string[];
     code?: string | undefined;
-    tryMessage?: string | undefined;
     nextSteps?: string[] | undefined;
     customSections?: {
         body: string | string[][];
         title?: string | undefined;
     }[] | undefined;
     details?: unknown;
+    tryMessage?: string | undefined;
 }, {
     type: "external";
     message: string;
     command: string;
     args: string[];
     code?: string | undefined;
-    tryMessage?: string | undefined;
     nextSteps?: string[] | undefined;
     customSections?: {
         body: string | string[][];
         title?: string | undefined;
     }[] | undefined;
     details?: unknown;
+    tryMessage?: string | undefined;
 }>]>;
 export declare const jsonErrorOutputSchema: import("../json-output-schema.js").JsonOutputSchema<zod.ZodObject<{
     error: zod.ZodUnion<[zod.ZodObject<{
@@ -287,24 +287,24 @@ export declare const jsonErrorOutputSchema: import("../json-output-schema.js").J
         type: "abort";
         message: string;
         code?: string | undefined;
-        tryMessage?: string | undefined;
         nextSteps?: string[] | undefined;
         customSections?: {
             body: string | string[][];
             title?: string | undefined;
         }[] | undefined;
         details?: unknown;
+        tryMessage?: string | undefined;
     }, {
         type: "abort";
         message: string;
         code?: string | undefined;
-        tryMessage?: string | undefined;
         nextSteps?: string[] | undefined;
         customSections?: {
             body: string | string[][];
             title?: string | undefined;
         }[] | undefined;
         details?: unknown;
+        tryMessage?: string | undefined;
     }>, zod.ZodObject<{
         stack: zod.ZodOptional<zod.ZodString>;
         message: zod.ZodString;
@@ -327,7 +327,6 @@ export declare const jsonErrorOutputSchema: import("../json-output-schema.js").J
         type: "bug";
         message: string;
         code?: string | undefined;
-        tryMessage?: string | undefined;
         stack?: string | undefined;
         nextSteps?: string[] | undefined;
         customSections?: {
@@ -335,11 +334,11 @@ export declare const jsonErrorOutputSchema: import("../json-output-schema.js").J
             title?: string | undefined;
         }[] | undefined;
         details?: unknown;
+        tryMessage?: string | undefined;
     }, {
         type: "bug";
         message: string;
         code?: string | undefined;
-        tryMessage?: string | undefined;
         stack?: string | undefined;
         nextSteps?: string[] | undefined;
         customSections?: {
@@ -347,6 +346,7 @@ export declare const jsonErrorOutputSchema: import("../json-output-schema.js").J
             title?: string | undefined;
         }[] | undefined;
         details?: unknown;
+        tryMessage?: string | undefined;
     }>, zod.ZodObject<{
         command: zod.ZodString;
         args: zod.ZodArray<zod.ZodString, "many">;
@@ -372,44 +372,43 @@ export declare const jsonErrorOutputSchema: import("../json-output-schema.js").J
         command: string;
         args: string[];
         code?: string | undefined;
-        tryMessage?: string | undefined;
         nextSteps?: string[] | undefined;
         customSections?: {
             body: string | string[][];
             title?: string | undefined;
         }[] | undefined;
         details?: unknown;
+        tryMessage?: string | undefined;
     }, {
         type: "external";
         message: string;
         command: string;
         args: string[];
         code?: string | undefined;
-        tryMessage?: string | undefined;
         nextSteps?: string[] | undefined;
         customSections?: {
             body: string | string[][];
             title?: string | undefined;
         }[] | undefined;
         details?: unknown;
+        tryMessage?: string | undefined;
     }>]>;
 }, "strict", zod.ZodTypeAny, {
     error: {
         type: "abort";
         message: string;
         code?: string | undefined;
-        tryMessage?: string | undefined;
         nextSteps?: string[] | undefined;
         customSections?: {
             body: string | string[][];
             title?: string | undefined;
         }[] | undefined;
         details?: unknown;
+        tryMessage?: string | undefined;
     } | {
         type: "bug";
         message: string;
         code?: string | undefined;
-        tryMessage?: string | undefined;
         stack?: string | undefined;
         nextSteps?: string[] | undefined;
         customSections?: {
@@ -417,37 +416,37 @@ export declare const jsonErrorOutputSchema: import("../json-output-schema.js").J
             title?: string | undefined;
         }[] | undefined;
         details?: unknown;
+        tryMessage?: string | undefined;
     } | {
         type: "external";
         message: string;
         command: string;
         args: string[];
         code?: string | undefined;
-        tryMessage?: string | undefined;
         nextSteps?: string[] | undefined;
         customSections?: {
             body: string | string[][];
             title?: string | undefined;
         }[] | undefined;
         details?: unknown;
+        tryMessage?: string | undefined;
     };
 }, {
     error: {
         type: "abort";
         message: string;
         code?: string | undefined;
-        tryMessage?: string | undefined;
         nextSteps?: string[] | undefined;
         customSections?: {
             body: string | string[][];
             title?: string | undefined;
         }[] | undefined;
         details?: unknown;
+        tryMessage?: string | undefined;
     } | {
         type: "bug";
         message: string;
         code?: string | undefined;
-        tryMessage?: string | undefined;
         stack?: string | undefined;
         nextSteps?: string[] | undefined;
         customSections?: {
@@ -455,18 +454,19 @@ export declare const jsonErrorOutputSchema: import("../json-output-schema.js").J
             title?: string | undefined;
         }[] | undefined;
         details?: unknown;
+        tryMessage?: string | undefined;
     } | {
         type: "external";
         message: string;
         command: string;
         args: string[];
         code?: string | undefined;
-        tryMessage?: string | undefined;
         nextSteps?: string[] | undefined;
         customSections?: {
             body: string | string[][];
             title?: string | undefined;
         }[] | undefined;
         details?: unknown;
+        tryMessage?: string | undefined;
     };
 }>>;
\ No newline at end of file
packages/cli-kit/dist/public/node/themes/api.d.ts
@@ -34,15 +34,6 @@ export declare function metafieldDefinitionsByOwnerType(type: MetafieldOwnerType
     };
 }[]>;
 export declare function passwordProtected(session: AdminSession): Promise<boolean>;
-/**
- * Whether the error ends a Trust Battery challenge on a theme request. A caller that
- * retries theme requests must rethrow it, or the user is asked to verify again for
- * each attempt.
- *
- * @param error - The error to check.
- * @returns True when the error ends a Trust Battery challenge.
- */
-export declare function isTrustChallengeError(error: unknown): boolean;
 type OnlineStoreThemeFileBody = {
     __typename: 'OnlineStoreThemeFileBodyBase64';
     contentBase64: string;
packages/cli-kit/dist/public/node/themes/theme-manager.d.ts
@@ -11,12 +11,5 @@ export declare abstract class ThemeManager {
     findOrCreate(name?: string, role?: Role): Promise<Theme>;
     fetch(name?: string, role?: Role): Promise<Theme | undefined>;
     generateThemeName(context: string): string;
-    create(themeRole?: Role, themeName?: string): Promise<{
-        createdAtRuntime: boolean;
-        id: number;
-        name: string;
-        processing: boolean;
-        role: string;
-        src?: string;
-    }>;
+    create(themeRole?: Role, themeName?: string): Promise<Theme>;
 }
\ No newline at end of file
packages/cli-kit/dist/public/node/ui/components.d.ts
@@ -1,5 +1,4 @@
 export { ConcurrentOutput, ConcurrentOutputContext, useConcurrentOutputContext, } from '../../../private/node/ui/components/ConcurrentOutput.js';
 export { Alert } from '../../../private/node/ui/components/Alert.js';
 export { Link } from '../../../private/node/ui/components/Link.js';
-export { LoadingIndicator } from '../../../private/node/ui/components/LoadingIndicator.js';
 export { TabularData } from '../../../private/node/ui/components/TabularData.js';
\ No newline at end of file
packages/cli-kit/dist/private/node/ui/components/ConcurrentOutput.d.ts
@@ -1,4 +1,3 @@
-import { ConcurrentOutputContext, getConcurrentOutputContext, useConcurrentOutputContext } from '../../output-context.js';
 import { type OutputProcess } from '../../../../public/node/output.js';
 import { AbortSignal } from '../../../../public/node/abort.js';
 import { FunctionComponent } from 'react';
@@ -14,6 +13,12 @@ export interface ConcurrentOutputProps {
     keepRunningAfterProcessesResolve?: boolean;
     useAlternativeColorPalette?: boolean;
 }
+interface ConcurrentOutputContext {
+    outputPrefix?: string;
+    /** Controls ANSI stripping for terminal output. JSON diagnostics are always unstyled. */
+    stripAnsi?: boolean;
+}
+declare function useConcurrentOutputContext<T>(context: ConcurrentOutputContext, callback: () => T): T;
 /** Runs finite processes concurrently and routes their output through the shared diagnostic context. */
 export declare function runConcurrentProcessesForJson({ processes, abortSignal, }: Pick<ConcurrentOutputProps, 'processes' | 'abortSignal'>): Promise<void>;
 /**
@@ -50,4 +55,4 @@ export declare function runConcurrentProcessesForJson({ processes, abortSignal,
  * ```
  */
 declare const ConcurrentOutput: FunctionComponent<ConcurrentOutputProps>;
-export { ConcurrentOutput, ConcurrentOutputContext, getConcurrentOutputContext, useConcurrentOutputContext };
\ No newline at end of file
+export { ConcurrentOutput, ConcurrentOutputContext, useConcurrentOutputContext };
\ No newline at end of file
packages/cli-kit/dist/cli/api/graphql/admin/generated/metafield_definitions_by_owner_type.d.ts
@@ -2,14 +2,9 @@ import * as Types from './types.js';
 import { TypedDocumentNode as DocumentNode } from '@graphql-typed-document-node/core';
 export type MetafieldDefinitionsByOwnerTypeQueryVariables = Types.Exact<{
     ownerType: Types.MetafieldOwnerType;
-    after?: Types.InputMaybe<Types.Scalars['String']['input']>;
 }>;
 export type MetafieldDefinitionsByOwnerTypeQuery = {
     metafieldDefinitions: {
-        pageInfo: {
-            hasNextPage: boolean;
-            endCursor?: string | null;
-        };
         nodes: {
             key: string;
             name: string;

@isaacroldan
isaacroldan merged commit d9a18c0 into stable/4.9 Oct 27, 2026
26 of 28 checks passed
@isaacroldan
isaacroldan deleted the codex/upgrade-cloudflared-stable-4-9 branch October 27, 2026 10:07
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

Area: @shopify/cli @shopify/cli package issues

Projects

None yet

Development

Successfully merging this pull request may close these issues.

2 participants