Add store auth list for local store auth sessions

[dmerand]

Summary

Add shopify store auth list for stores authenticated directly with shopify store auth.

Closes https://github.com/shop/issues-develop/issues/22919

Scope

• add shopify store auth list
• list only local store-auth sessions; no organization auth probe and no organization prompt
• render text output as stores authenticated directly with shopify store auth
• emit deterministic JSON as {sessions: [...]} with kind: "store" rows so agents can resume without reading cache internals
• keep access tokens and refresh tokens out of the command output
• add cross-command hints:
  • store auth list points users to shopify store list for organization stores
  • store list points users to shopify store auth list for direct store-auth sessions
• keep shopify store list organization-backed only; no --from, no auto, no fallback behavior

Command split

This stack intentionally keeps the two jobs separate:

• shopify store list lists organization stores using the active CLI account, prompting for organization selection unless --organization-id is provided.
• shopify store auth list lists stores already present in local store-auth storage.

Not changed / deferred

• Did not keep store list --from store-auth or --from auto. Those were the source of the confusing mixed-command contract this PR replaces.
• Did not attempt organization auth or show organization stores from store auth list. That stays in shopify store list.
• Did not expose access tokens or refresh tokens in store auth list --json. Agents get enough metadata to choose a stored session without reading cache internals; token return would require a separate product/security decision.
• Did not add the LocalStorage enumeration API suggested in follow-through review. That belongs in a focused cli-kit/storage follow-up, not in the command behavior PR.
• Did not add E2E evals for “returning to my preview store.” That is tracked separately in https://github.com/shop/issues-develop/issues/22970.

Smoke checks

• shopify store auth list --json returns local store-auth sessions and does not prompt for organization auth
• shopify store list --help has no --from flag
• shopify auth list --help is not registered

[dmerand]

• Escape store auth session keys #7864
• Add store auth list for local store auth sessions #7714 👈 (View in Graphite)
• Add local store auth summary API #7709
• Add store list for organization stores #7708
• main

This stack of pull requests is managed by Graphite. Learn more about stacking.

[nickwesselman]

/snapit

[github-actions]

🫰✨ Thanks @nickwesselman! Your snapshot has been published to npm.

Test the snapshot by installing your package globally:

pnpm i -g --@shopify:registry=https://registry.npmjs.org @shopify/cli@0.0.0-snapshot-20260605172558

Caution

After installing, validate the version by running shopify version in your terminal.
If the versions don't match, you might have multiple global instances installed.
Use which shopify to find out which one you are running and uninstall it.

[github-actions]

Differences in type declarations

We detected differences in the type declarations generated by Typescript for this branch compared to the baseline ('main' branch). Please, review them to ensure they are backward-compatible. Here are some important things to keep in mind:

• Some seemingly private modules might be re-exported through public modules.
• If the branch is behind main you might see odd diffs, rebase main into this branch.

New type declarations

We found no new type declarations in this PR

Existing type declarations

packages/cli-kit/dist/public/common/string.d.ts

@@ -102,6 +102,16 @@ export declare function formatDate(date: Date): string;
  * @returns The transformed string in local system time.
  */
 export declare function formatLocalDate(dateString: string): string;
+/**
+ * Formats a date as a short calendar date like "May 22, 2026" () in UTC.
+ *
+ * UTC keeps the output deterministic regardless of the machine timezone. Returns an empty string
+ * when the value cannot be parsed into a valid date.
+ *
+ * @param value - A Date, epoch milliseconds, or a date string such as an ISO 8601 timestamp.
+ * @returns The formatted date, or an empty string when the value is invalid.
+ */
+export declare function formatShortDate(value: Date | number | string): string;
 /**
  * Given a list of items, it returns a string with the items joined by commas and the last item joined by "and".
  * All items are wrapped in double quotes.

packages/cli-kit/dist/public/common/url.d.ts

@@ -28,4 +28,13 @@ export declare function extractHost(value: string | null | undefined): string |
  * @param value - A URL or host string, possibly null/undefined.
  * @returns The myshopify subdomain handle, or undefined when the input isn't a  URL.
  */
-export declare function extractMyshopifyHandle(value: string | null | undefined): string | undefined;
\ No newline at end of file
+export declare function extractMyshopifyHandle(value: string | null | undefined): string | undefined;
+/**
+ * Extracts the leading subdomain label from a URL or host, across environments — e.g.
+ * , , or local development hosts — rather than assuming a
+ *  domain.
+ *
+ * @param value - A URL or host string, possibly null/undefined.
+ * @returns The first DNS label, or undefined when no host can be extracted.
+ */
+export declare function extractSubdomain(value: string | null | undefined): string | undefined;
\ No newline at end of file