[jek]

Related to https://github.com/shop/issues-develop/issues/23885

WHY are these changes introduced?

Review of stack #8969 asked for two refactors that don't change behaviour, on #8963 and #8966. They're in this follow-up, on top of the stack, so the approved PRs below don't change.

WHAT is this pull request doing?

1. Assign unchanged enum values directly. review --json passed every stored enum through a map, including severities, precedences, dispositions, confidences and language support, which are spelled the same in both formats. Those are now assigned directly; type-check still rejects a stored value that the public schema doesn't allow. The maps stay where the spelling differs, such as not_applicable → not-applicable.
2. Split the shared module. app-security-json-output.ts becomes app-security/types.ts (the schemas and types that several commands share) and app-security/result.ts (the projections to them), as dev-clean/ and each security-<command>/ folder already separate them. Elsewhere only import paths change.

No changeset: the JSON output, the JSON Schema and the text output are unchanged.

How to manually test your changes?

Each command's JSON Schema should be byte-identical to #8968's:

pnpm nx build cli
for c in check clean instructions record review; do node packages/cli/bin/dev.js app security $c --json-schema > /tmp/$c.after.json; done
git checkout app-security/support-json-schema-agent-review && pnpm nx build cli
for c in check clean instructions record review; do node packages/cli/bin/dev.js app security $c --json-schema | cmp - /tmp/$c.after.json && echo "$c unchanged"; done

Checklist

• I've considered possible cross-platform impacts (Mac, Linux, Windows)
• I've considered possible documentation changes
• I've considered analytics changes to measure impact
• The change is user-facing — I've identified the correct bump type (patch for bug fixes · minor for new features · major for breaking changes) and added a changeset with pnpm changeset add

[github-actions]

Differences in type declarations

We detected differences in the type declarations generated by Typescript for this branch compared to the baseline ('main' branch). Please, review them to ensure they are backward-compatible. Here are some important things to keep in mind:

• Some seemingly private modules might be re-exported through public modules.
• If the branch is behind main you might see odd diffs, rebase main into this branch.

New type declarations

packages/cli-kit/dist/private/node/ui/components/TextAnimation.d.ts

import React from 'react';
interface TextAnimationProps {
    text: string;
    maxWidth?: number;
}
/**
 * `TextAnimation` applies a rainbow animation to text.
 */
declare const TextAnimation: React.MemoExoticComponent<({ text, maxWidth }: TextAnimationProps) => JSX.Element>;
export { TextAnimation };

Existing type declarations

packages/cli-kit/dist/private/node/api.d.ts

@@ -60,8 +60,6 @@ export declare function simpleRequestWithDebugLog<T extends {
  * Makes a HTTP request to some API, retrying if response headers indicate a retryable error.
  *
  * If a request fails with a 429, the retry-after header determines a delay before an automatic retry is performed.
- * Without a valid header, rate-limit retries use exponential backoff with jitter, capped at 8 seconds per delay.
- * No new rate-limit retry starts after 30 seconds. A server-requested delay beyond that budget is not shortened.
  *
  * If unauthorizedHandler is provided, then it will be called in the case of a 401 and a retry performed. This allows
  * for a token refresh for instance.

packages/cli-kit/dist/public/node/ui.d.ts

@@ -325,9 +325,9 @@ export interface RenderSingleTaskOptions<T> {
     renderOptions?: RenderOptions;
 }
 /**
- * Awaits a single task and displays a loading indicator while it's in progress. The task's result is returned.
+ * Awaits a single task and displays a loading bar while it's in progress. The task's result is returned.
  * @param options - Configuration object
- * @param options.title - The initial title to display with the loading indicator
+ * @param options.title - The initial title to display with the loading bar
  * @param options.task - The async task to execute. Receives an updateStatus callback to change the displayed title.
  * @param options.retry - The number of additional attempts after a failure. Defaults to zero.
  * @param options.renderOptions - Optional render configuration

packages/cli-kit/dist/public/node/ui/components.d.ts

@@ -1,5 +1,4 @@
 export { ConcurrentOutput, ConcurrentOutputContext, useConcurrentOutputContext, } from '../../../private/node/ui/components/ConcurrentOutput.js';
 export { Alert } from '../../../private/node/ui/components/Alert.js';
 export { Link } from '../../../private/node/ui/components/Link.js';
-export { LoadingIndicator } from '../../../private/node/ui/components/LoadingIndicator.js';
 export { TabularData } from '../../../private/node/ui/components/TabularData.js';
\ No newline at end of file

packages/cli-kit/dist/private/node/ui/components/ConcurrentOutput.d.ts

@@ -1,4 +1,3 @@
-import { ConcurrentOutputContext, getConcurrentOutputContext, useConcurrentOutputContext } from '../../output-context.js';
 import { type OutputProcess } from '../../../../public/node/output.js';
 import { AbortSignal } from '../../../../public/node/abort.js';
 import { FunctionComponent } from 'react';
@@ -14,6 +13,12 @@ export interface ConcurrentOutputProps {
     keepRunningAfterProcessesResolve?: boolean;
     useAlternativeColorPalette?: boolean;
 }
+interface ConcurrentOutputContext {
+    outputPrefix?: string;
+    /** Controls ANSI stripping for terminal output. JSON diagnostics are always unstyled. */
+    stripAnsi?: boolean;
+}
+declare function useConcurrentOutputContext<T>(context: ConcurrentOutputContext, callback: () => T): T;
 /** Runs finite processes concurrently and routes their output through the shared diagnostic context. */
 export declare function runConcurrentProcessesForJson({ processes, abortSignal, }: Pick<ConcurrentOutputProps, 'processes' | 'abortSignal'>): Promise<void>;
 /**
@@ -50,4 +55,4 @@ export declare function runConcurrentProcessesForJson({ processes, abortSignal,
  * ```
  */
 declare const ConcurrentOutput: FunctionComponent<ConcurrentOutputProps>;
-export { ConcurrentOutput, ConcurrentOutputContext, getConcurrentOutputContext, useConcurrentOutputContext };
\ No newline at end of file
+export { ConcurrentOutput, ConcurrentOutputContext, useConcurrentOutputContext };
\ No newline at end of file

[jek]

/snapit

[github-actions]

🫰✨ Thanks @jek! Your snapshot has been published to npm.

Built from 47b7b69c2460787415f9dd561fd1e9563541d291. Workflow run.

Test the snapshot by installing your package globally:

pnpm i -g --@shopify:registry=https://registry.npmjs.org @shopify/cli@0.0.0-snapshot-20261022181815

Caution

After installing, validate the version by running shopify version in your terminal.
If the versions don't match, you might have multiple global instances installed.
Use which shopify to find out which one you are running and uninstall it.