Add auth list for store auth sessions

[dmerand]

Summary

Add shopify auth list for stores authenticated directly with shopify store auth.

Closes https://github.com/shop/issues-develop/issues/22919

Scope

• add shopify auth list
• list only local store-auth sessions; no organization auth probe and no organization prompt
• render text output as stores authenticated directly with shopify store auth
• emit deterministic JSON as {sessions: [...]} with kind: "store" rows so agents can resume without reading cache internals
• keep access tokens and refresh tokens out of the command output
• add cross-command hints:
  • auth list points users to shopify store list for organization stores
  • store list points users to shopify auth list for direct store-auth sessions
• keep shopify store list organization-backed only; no --from, no auto, no fallback behavior

Why this replaces the previous PR shape

The earlier top PR mixed two jobs into one shopify store list command via --from auto|organization|store-auth plus fallback behavior. Slack feedback on 2026-06-14/15 called out that the flag and fallback rules were hard to reason through because the jobs are different:

• organization stores = stores available through organization/store-management flows
• store-auth sessions = stores this machine has authenticated directly for store commands like store execute

This PR keeps those jobs separate.

Not changed / deferred

• Did not keep store list --from store-auth or --from auto. Those were the source of the confusing mixed-command contract this PR replaces.
• Did not attempt organization auth or show organization stores from auth list. That stays in shopify store list.
• Did not expose access tokens or refresh tokens in auth list --json. Agents get enough metadata to choose a stored session without reading cache internals; token return would require a separate product/security decision.
• Did not broaden auth list into a full CLI auth inventory. Rows currently have kind: "store" so the JSON can grow later, but this PR only lists store-auth sessions owned by @shopify/store.
• Did not rename the command to shopify store auth list. shopify auth list matches the Slack direction and leaves room for future auth inventory. If reviewers find the name too broad, the fallback naming is still available.
• Did not add the LocalStorage enumeration API suggested in follow-through review. That belongs in a focused cli-kit/storage follow-up, not in the command behavior PR.
• Did not add E2E evals for “returning to my preview store.” That is tracked separately in https://github.com/shop/issues-develop/issues/22970.

Smoke checks

• shopify auth list --json returns local store-auth sessions and does not prompt for organization auth
• shopify store list --help has no --from flag

[dmerand]

Warning

This pull request is not mergeable via GitHub because a downstack PR is open. Once all requirements are satisfied, merge this PR as a stack on Graphite.
Learn more

• Add auth list for store auth sessions #7714 👈 (View in Graphite)
• Add local store auth summary API #7709
• Add store list for organization stores #7708
• main

This stack of pull requests is managed by Graphite. Learn more about stacking.

[nickwesselman]

/snapit

[github-actions]

🫰✨ Thanks @nickwesselman! Your snapshot has been published to npm.

Test the snapshot by installing your package globally:

pnpm i -g --@shopify:registry=https://registry.npmjs.org @shopify/cli@0.0.0-snapshot-20260605172558

Caution

After installing, validate the version by running shopify version in your terminal.
If the versions don't match, you might have multiple global instances installed.
Use which shopify to find out which one you are running and uninstall it.

[github-actions]

Differences in type declarations

We detected differences in the type declarations generated by Typescript for this branch compared to the baseline ('main' branch). Please, review them to ensure they are backward-compatible. Here are some important things to keep in mind:

• Some seemingly private modules might be re-exported through public modules.
• If the branch is behind main you might see odd diffs, rebase main into this branch.

New type declarations

We found no new type declarations in this PR

Existing type declarations

packages/cli-kit/dist/public/common/string.d.ts

@@ -102,6 +102,16 @@ export declare function formatDate(date: Date): string;
  * @returns The transformed string in local system time.
  */
 export declare function formatLocalDate(dateString: string): string;
+/**
+ * Formats a date as a short calendar date like "May 22, 2026" () in UTC.
+ *
+ * UTC keeps the output deterministic regardless of the machine timezone. Returns an empty string
+ * when the value cannot be parsed into a valid date.
+ *
+ * @param value - A Date, epoch milliseconds, or a date string such as an ISO 8601 timestamp.
+ * @returns The formatted date, or an empty string when the value is invalid.
+ */
+export declare function formatShortDate(value: Date | number | string): string;
 /**
  * Given a list of items, it returns a string with the items joined by commas and the last item joined by "and".
  * All items are wrapped in double quotes.

packages/cli-kit/dist/public/common/url.d.ts

@@ -28,4 +28,13 @@ export declare function extractHost(value: string | null | undefined): string |
  * @param value - A URL or host string, possibly null/undefined.
  * @returns The myshopify subdomain handle, or undefined when the input isn't a  URL.
  */
-export declare function extractMyshopifyHandle(value: string | null | undefined): string | undefined;
\ No newline at end of file
+export declare function extractMyshopifyHandle(value: string | null | undefined): string | undefined;
+/**
+ * Extracts the leading subdomain label from a URL or host, across environments — e.g.
+ * , , or local development hosts — rather than assuming a
+ *  domain.
+ *
+ * @param value - A URL or host string, possibly null/undefined.
+ * @returns The first DNS label, or undefined when no host can be extracted.
+ */
+export declare function extractSubdomain(value: string | null | undefined): string | undefined;
\ No newline at end of file