Cover every theme write in the missing-scope message and tests

- The `write_themes` next step now names `theme publish`, `theme delete`,
  `theme rename` and `theme duplicate` as well as `theme push` and
  `theme dev`, because those commands now reach this message too.
- Add the missing-scope test for `themeUpdate`, `deleteThemeAssets`,
  `themeDuplicate` and `bulkUploadThemeAssets`, so that all six theme
  mutations that use `requestThemeAdminDoc` are covered.

Author: iaineh

packages/cli-kit/src/public/node/themes/api.test.ts

@@ -445,6 +445,16 @@ describe('themeUpdate', () => {
     expect(theme!.name).toEqual(name)
     expect(theme!.role).toEqual(role)
   })
+
+  test('throws a friendly error when access is denied by a missing theme access scope', async () => {
+    vi.mocked(adminRequestDoc).mockRejectedValue(
+      errorHandler('Admin')(themeAccessDeniedError('`write_themes` access scope.'), 'request-id'),
+    )
+
+    await expect(themeUpdate(123, {name: 'renamed theme'}, session)).rejects.toThrow(
+      'The authenticated account or access token is missing `write_themes` access scope.',
+    )
+  })
 })
 
 describe('themePublish', () => {
@@ -550,6 +560,16 @@ describe('deleteThemeAssets', () => {
     })
     expect(output).toEqual([{key, success: true, operation: 'DELETE'}])
   })
+
+  test('throws a friendly error when access is denied by a missing theme access scope', async () => {
+    vi.mocked(adminRequestDoc).mockRejectedValue(
+      errorHandler('Admin')(themeAccessDeniedError('`write_themes` access scope.'), 'request-id'),
+    )
+
+    await expect(deleteThemeAssets(123, ['snippets/product-variant-picker.liquid'], session)).rejects.toThrow(
+      'The authenticated account or access token is missing `write_themes` access scope.',
+    )
+  })
 })
 
 describe('themeDelete', () => {
@@ -623,6 +643,16 @@ describe('themeDuplicate', () => {
       })
     })
   }
+
+  test('throws a friendly error when access is denied by a missing theme access scope', async () => {
+    vi.mocked(adminRequestDoc).mockRejectedValue(
+      errorHandler('Admin')(themeAccessDeniedError('`write_themes` access scope.'), 'request-id'),
+    )
+
+    await expect(themeDuplicate(123, 'duplicate theme', session)).rejects.toThrow(
+      'The authenticated account or access token is missing `write_themes` access scope.',
+    )
+  })
 })
 
 describe('request errors', () => {
@@ -788,6 +818,16 @@ describe('bulkUploadThemeAssets', async () => {
       'Error uploading theme files: Something went wrong',
     )
   })
+
+  test('throws a friendly error when access is denied by a missing theme access scope', async () => {
+    vi.mocked(adminRequestDoc).mockRejectedValue(
+      errorHandler('Admin')(themeAccessDeniedError('`write_themes` access scope.'), 'request-id'),
+    )
+
+    await expect(
+      bulkUploadThemeAssets(123, [{key: 'snippets/product-variant-picker.liquid', value: 'content'}], session),
+    ).rejects.toThrow('The authenticated account or access token is missing `write_themes` access scope.')
+  })
 })
 
 describe('parseThemeFileContent', () => {

packages/cli-kit/src/public/node/themes/api.ts

@@ -649,9 +649,18 @@ function abortIfMissingThemeAccessScope(error: unknown): void {
     [
       'For',
       {command: 'theme push'},
-      'and',
+      {char: ','},
       {command: 'theme dev'},
       {char: ','},
+      {command: 'theme publish'},
+      {char: ','},
+      {command: 'theme delete'},
+      {char: ','},
+      {command: 'theme rename'},
+      {char: ','},
+      'and',
+      {command: 'theme duplicate'},
+      {char: ','},
       'add both the',
       {command: 'read_themes'},
       'and',