[jplhomer]

WHY are these changes introduced?

Backports merged changes from main to stable/5.0 so they can ship in the next 5.0 patch (5.0.1). It started with these two:

• #9012 Keep the storefront exit page working in the theme dev server
• #9014 Remove network_access allowed_sources from theme app extensions

It now also includes ten additional 5.0.x fixes; see "Additional 5.0.x fixes" below.

Following the grouping convention used for earlier stable backports (#8855, #8895): one commit per original PR, in merge order, each with a backref to the original.

Please merge without squashing (keep one commit per original PR).

WHAT is this pull request doing?

One commit per original PR, each cherry-picked from its merge commit on main with git cherry-pick -x -m 1, so each carries a (cherry picked from commit …) trailer and a Backport of … link.

Original PR	Merge commit on main	Backport commit
#9012	7c300eac85669f380577a1ef4cf6f468bc5ab559	d1a21ba9285fffce8934372d1b85a07cbdd25dd2
#9014	1fc6b148f852c9ce91d023223eee57aa65fbb476	e854ced24f853ea3520a41b786d8d87d67856817

Both were cherry-picked from the merge commits on main. Conflicts: none. Each backport commit has the same patch ID as its original PR's merge diff, and the files each PR touches have no other changes on stable/5.0.

Note for #9014: the [extensions.capabilities.network_access] allowed_sources setting it removes was added in #9003 and is listed in the 5.0.0 changelog, so this removes behavior that already shipped in 5.0.0 as a patch change. The replacement is the app-level [network_access] allowed_sources setting in shopify.app.toml.

Changesets: both original changesets are kept unchanged, both patch:

• .changeset/theme-dev-external-links.md: @shopify/app patch, @shopify/theme patch
• .changeset/remove-theme-extension-network-access-allowed-sources.md: @shopify/app patch

CHANGELOG.md and package.json versions are not touched; the Version Packages PR handles those.

Validation (clean checkout of this branch, Node 26.12.1, pnpm 10.11.1, pnpm install --frozen-lockfile):

• Tests for the files the two PRs touch: theme storefront-renderer, proxy and html tests, 92/92; app loader and utilities/extensions/theme tests, 142/142.
• Wider affected suites: theme theme-environment, theme-ext-environment and services/dev, 25 files, 326/326; app loader, models/extensions, theme bundle and deploy steps, utilities/extensions/theme and dev extension payload, 39 files, 622/622.
• pnpm type-check and pnpm lint pass for @shopify/theme and @shopify/app. prettier --check on the changed files and git diff --check are clean.

Additional 5.0.x fixes

This PR now also carries ten more fixes from main for 5.0.1, one commit each after the two above, in merge order, each cherry-picked with git cherry-pick -x -m 1 from its merge commit (so each has the (cherry picked from commit …) trailer and a Backport of … link):

Original PR	Merge commit on main	Backport commit
#9002 Widen piped tables and word store-not-found advice for tokens	c2948e0f22397cd9cbe8fba07163c501dbcb2ee5	d613da079643ba6dfaef77a068a2b39f353cdd46
#9001 Find a store in the account's only organization when destinations miss it	9403cabd5c92b9b263c49d21424ba72a8a884878	0ef4c791a1c1f4de52cef1b54c62ac44ab82bdbd
#9000 Name the missing access when a token exchange is refused	8be099c393d18dbfd8d63d3c4b98a139644750a0	fafefe3e199eb1ce50e5c3d7a13911e648513c8f
#9013 Fix Preact flavor validation when generating extensions	77063feaf1699cd1cafe5d08a70dda4ab3780a2c	563e7c30f61f18747418a876a4a48b9eb0d1afd6
#9024 Keep polling dev store creation when the status read comes back empty	d92c0a0d62f149c2d458a98dbaf89f7cc2e7669d	cbd26c3dad70bc9d7e9428138bfacee94021ca77
#9029 Keep extension flavor flag options in sync with supported values	f22f94ddb5a4ec61cefd29bbd460aabaa89796a4	b9ef7ad00f0a1d6c5ec31cc89300325a45032e84
#8833 Fix intermittent deploy failures with shared UI extension folders	67c6cb5e0fe136a5abe985dd0196f4b4d4051205	58ada0f7015bae15de3dba5a1b039e3fffb08c99
#9044 Normalize store domains for app-admin authentication	bd10dd0304d440ccc72b5fa140d6752c77a117af	38957695ac4b829f29c27a8879375ac677942545
#9041 Fix theme check JSON output for offenses without a position	a25396eedec0afe16183eb4027c8e7f8ada4147c	b474cb207b89029d26e066808f93acb9d2d50952
#9060 Update function-runner to 9.2.3	fa827ab5cded292dcba181ae386a9f00e95d67e4	afe53c6834ffb031cf70a8d118f1bdd25db00566

Conflicts: none. All ten applied cleanly, and each backport commit has the same patch ID as its original PR's merge diff. #9013 and #9029 touch generated files (packages/cli/oclif.manifest.json, packages/cli/README.md, and for #9029 docs-shopify.dev/generated/generated_docs_data_v2.json) and picked cleanly. After all picks, pnpm refresh-manifests, pnpm refresh-readme and pnpm refresh-code-documentation leave git diff clean.

Changesets: every added changeset is patch and unchanged. pnpm changeset status --verbose shows only patch bumps: @shopify/cli-kit, @shopify/cli, @shopify/app and @shopify/theme go to 5.0.1, and the other fixed-group packages follow to 5.0.1. It reports no minor or major releases.

Additional validation (same setup as above; head afe53c6834ffb031cf70a8d118f1bdd25db00566):

• Tests for every test file the twelve PRs touch: app 7 files, 237 passed (2 skipped); cli-kit 3 files, 166/166; organizations 1 file, 8/8; store 3 files, 63/63; theme 4 files, 172/172.
• Wider suites: theme 26 files, 406/406; app 67 files, 983/983; cli-kit 10 files, 321/321; organizations 5 files, 45/45; store 64 files, 579 passed and 2 failed. The 2 failures are in commands/store/auth-output.test.ts, a file none of these PRs touch: a 5 second timeout in the full-suite run only. The file passes on its own on this branch, and the same two tests fail the same way in a full-suite run on the 5.0.0 tag (573 passed, 2 failed).
• type-check and lint pass with --skip-nx-cache for @shopify/app, @shopify/theme, @shopify/cli-kit, @shopify/cli, @shopify/organizations and @shopify/store.
• prettier --check on the 59 changed non-generated files and git diff --check are clean.

How to manually test your changes?

1. Check out this branch and build the CLI.
2. For #9012: run shopify theme dev against a dev store, click a link to another site, and confirm the browser goes to that site instead of stopping on the storefront's "leaving this store" page. Other redirects, such as /cart/clear, should still stay on the local server.
3. For #9014: in a theme app extension, set [extensions.capabilities.network_access] to an allowed_sources table and confirm config validation rejects it; a theme extension without that setting should load and build as before.

Checklist

• I've considered possible cross-platform impacts (Mac, Linux, Windows)
• I've considered possible documentation changes
• I've considered analytics changes to measure impact
• The change is user-facing — I've identified the correct bump type (patch for bug fixes · minor for new features · major for breaking changes) and added a changeset with pnpm changeset add

Includes 85706e4 (regenerated GraphQL types) so the codegen check passes on stable/5.0.

[github-actions]

Differences in type declarations

We detected differences in the type declarations generated by Typescript for this branch compared to the baseline ('main' branch). Please, review them to ensure they are backward-compatible. Here are some important things to keep in mind:

• Some seemingly private modules might be re-exported through public modules.
• If the branch is behind main you might see odd diffs, rebase main into this branch.

New type declarations

We found no new type declarations in this PR

Existing type declarations

packages/cli-kit/dist/public/common/json-output-schema.d.ts

@@ -1,5 +1,4 @@
 import { z } from 'zod';
-export declare const jsonOutputStoreDomainSchema: z.ZodString;
 /** UTC instants in CLI-owned JSON use whole seconds and the Z timezone marker. */
 export declare const jsonOutputTimestampSchema: z.ZodString;
 /**

packages/cli-kit/dist/private/node/conf-store.d.ts

@@ -73,7 +73,7 @@ export declare function cacheStore(key: ExportedKey, value: string, config?: Loc
 /**
  * Fetch from cache if already populated, otherwise return undefined.
  * @param key - The key to use for the cache.
- * @returns The cache element.
+ * @returns The chache element.
  */
 export declare function cacheRetrieve(key: ExportedKey, config?: LocalStorage<ConfSchema>): CacheValue<string> | undefined;
 export declare function cacheClear(config?: LocalStorage<ConfSchema>): void;

packages/cli-kit/dist/private/node/constants.d.ts

@@ -8,7 +8,6 @@ export declare const environmentVariables: {
     env: string;
     noAnalytics: string;
     optOutInstrumentation: string;
-    doNotTrack: string;
     serviceAccountToken: string;
     appAutomationToken: string;
     partnersToken: string;

packages/cli-kit/dist/public/node/base-command.d.ts

@@ -13,7 +13,7 @@ export interface NonTTYFlagRequirement {
 declare abstract class BaseCommand extends Command {
     static baseFlags: FlagInput<{}>;
     static descriptionWithMarkdown?: string;
-    static jsonOutputSchema?: JsonOutputSchema;
+    static get jsonOutputSchema(): JsonOutputSchema | undefined;
     static get requiresSyncAnalytics(): boolean;
     static nonTTYFlagRequirements(_flags: FlagOutput): NonTTYFlagRequirement[];
     static descriptionForHelp(): string | undefined;

packages/cli-kit/dist/public/node/json-output-schema.d.ts

@@ -1,6 +1,6 @@
 import { zodToJsonSchema } from 'zod-to-json-schema';
 import type { ZodTypeAny, z } from 'zod';
-export { formatJsonOutputTimestamp, jsonOutputTimestampSchema, jsonOutputStoreDomainSchema, } from '../common/json-output-schema.js';
+export { formatJsonOutputTimestamp, jsonOutputTimestampSchema } from '../common/json-output-schema.js';
 interface JsonOutputSchemaDefinition<TSchema extends ZodTypeAny = ZodTypeAny> {
     readonly name: string;
     readonly schema: TSchema;

packages/cli-kit/dist/public/node/notifications-system.d.ts

@@ -172,7 +172,7 @@ export declare function showNotificationsIfNeeded(currentSurfaces?: string[], en
  */
 export declare function getNotifications(): Promise<Notifications>;
 /**
- * Fetch notifications from the CDN and cache them.
+ * Fetch notifications from the CDN and chache them.
  *
  * @returns A string with the notifications.
  */

packages/cli-kit/dist/public/node/context/local.d.ts

@@ -52,7 +52,7 @@ export declare function isUnitTest(env?: NodeJS.ProcessEnv): boolean;
  * Returns true if reporting analytics is enabled.
  *
  * @param env - The environment variables from the environment of the current process.
- * @returns True unless SHOPIFY_CLI_NO_ANALYTICS, OPT_OUT_INSTRUMENTATION or DO_NOT_TRACK is truthy, or debug mode is enabled.
+ * @returns True unless SHOPIFY_CLI_NO_ANALYTICS or OPT_OUT_INSTRUMENTATION is truthy, or debug mode is enabled.
  */
 export declare function analyticsDisabled(env?: NodeJS.ProcessEnv): boolean;
 /**

packages/cli-kit/dist/public/node/graphiql/server.d.ts

@@ -27,14 +27,13 @@ export declare function resolveGraphiQLKey(providedKey: string | undefined, apiS
  * - `getToken` may return a cached token; the proxy calls it for every request.
  * - `refreshToken` (optional) is invoked when the upstream Admin API returns 401.
  * When omitted, the proxy falls back to calling `getToken` again on 401.
- * - Both operations receive a cancellation signal to pass to token requests.
  *
  * Implementations must throw `TokenRefreshError` (or any thrown error) when the
  * token cannot be obtained; the proxy renders the unauthorized template in that case.
  */
 export interface TokenProvider {
-    getToken: (signal?: AbortSignal) => Promise<string>;
-    refreshToken?: (signal?: AbortSignal) => Promise<string>;
+    getToken: () => Promise<string>;
+    refreshToken?: () => Promise<string>;
 }
 /**
  * Optional app-specific context, used to render the app pill and scopes note in the
@@ -66,10 +65,6 @@ export interface SetupGraphiQLServerOptions {
      * interactive UI.
      */
     protectMutations?: boolean;
-    /** Called for request failures that leave the server available for subsequent requests. */
-    onRequestError?: (message: string) => void;
-    /** Routes diagnostics through command events and leaves readiness output to the session. */
-    json?: boolean;
 }
 export declare const MUTATIONS_BLOCKED_MESSAGE = "Mutations are disabled. Re-run with --allow-mutations to enable mutations.";
 /**

packages/cli-kit/dist/public/node/graphiql/session.d.ts

@@ -22,7 +22,6 @@ export interface RunGraphiQLSessionOptions {
     additionalReadyMessages?: OutputMessage[];
     abortSignal?: AbortSignal;
     stdout?: Writable;
-    outputFormat?: 'text' | 'json';
 }
 /**
  * Generates a random key suitable for authenticating a single local GraphiQL session.

[github-actions]

⚠️ Potential Breaking Changes Detected

This PR contains changes that may break the existing contract.

@shopify/dev_experience — this PR contains breaking changes that require coordination for the next major release.

📝 Removed Schema Fields

The following Zod schema fields were removed or their files deleted:

File	Removed Fields	Reason
packages/app/src/cli/models/extensions/specifications/theme.ts	allowed_sources, network_access, capabilities	Fields removed