Add shopify validate command for offline validation

[craigmichaelmartin]

What

Adds a new top-level shopify validate command that ports the four validation scripts from ai-toolkit-source's shopify-dev-tools package into first-class CLI subcommands for offline, deterministic validation:

Subcommand	Validates	Engine
shopify validate theme	Liquid/theme code (full-app + stateless codeblock modes)	@shopify/theme-check-* (already shipped by the CLI)
shopify validate graphql	GraphQL operations against bundled Admin/Storefront/Customer/Partner/Payments schemas; reports required offline access scopes	graphql + bundled introspection JSON
shopify validate functions	Shopify Functions input queries	shared GraphQL engine
shopify validate components	UI-extension component code (TSX/JSX/HTML)	virtual TypeScript environment + bundled @shopify/ui-extensions type defs

How

All four subcommands sit on one shared engine under packages/cli/src/cli/services/validate/engine/:

• A dependency-free result contract (ValidationResult const-union, ValidationResponse) and a barrel-decoupled formatter — so the non-component validators never pull in the TypeScript compiler.
• Pure, injectable version resolution over a bundled version catalog.
• One lazy gunzip walk-up data-loader that resolves bundled assets in dev (tsx/vitest), the split esbuild bundle, and the published /assets alike.
• Pure-core + thin-orchestrator split per subcommand (command parses flags → service holds all logic → renders/records/exits).

Behavior preserved from the source tools (flags, --json shape {success, responses, resolvedVersion?}, exit codes, stdin), while adapting to CLI conventions: cli-kit rendering, outputResult + AbortSilentError for --json, telemetry via addPublicMetadata (new cmd_validate_* fields). Agent-only plumbing (random-UUID artifact IDs, shopify.dev network instrumentation) is dropped for deterministic output. Bad --file/empty stdin now return a structured FAILED payload instead of crashing.

Reference data (~13.7 MB compressed: GraphQL schemas + UI-extension .d.ts.gz) is bundled for fully offline validation and copied into dist/ via a recursive esbuild rule. typescript becomes a lazily-loaded, esbuild-external runtime dependency (used only by validate components).

Test plan

• nx type-check cli ✅ · nx lint cli ✅
• nx vitest cli for the validate suites: 81/81 pass (real temp dirs, no fs mocking)
• nx bundle cli ✅ — bundled binary smoke-tested for all four subcommands:
  • validate graphql --api admin --code 'query { shop { name } }' → success, exit 0
  • validate graphql with an invalid field → failed, exit 1 (Cannot query field "nope" on type "Shop")
  • validate functions --api functions_discount (valid input query) → success
  • validate theme (codeblock) → success
  • validate components --api polaris-app-home --code '<s-text>hello</s-text>' --language html → success, validatedComponents: ["s-text"]
• Regenerated oclif.manifest.json, README.md, and dev-docs; changeset added.

Notes / reviewer callouts

• Package size: adds ~13.7 MB of compressed schema/type data (Admin schema alone ~4.8 MB). This is the faithful-offline tradeoff; the loader decompresses lazily per requested version, so it is on-disk weight only. Happy to trim historical Admin versions if preferred.
• New runtime dep: typescript (lazy, esbuild-external) for validate components.
• A scoped packages/cli/assets/validate/.gitignore re-includes the vendored type packages' dist/ folders (otherwise the repo-wide dist ignore would drop ~320 .d.ts.gz reference files).

🤖 Generated with Claude Code

[binks-code-reviewer]

🤖 Code Review · Skipped — PR has too many files for review (limit: 1000)

[craigmichaelmartin]

/snapit

[github-actions]

🫰✨ Thanks @craigmichaelmartin! Your snapshot has been published to npm.

Test the snapshot by installing your package globally:

pnpm i -g --@shopify:registry=https://registry.npmjs.org @shopify/cli@0.0.0-snapshot-20260721185120

Caution

After installing, validate the version by running shopify version in your terminal.
If the versions don't match, you might have multiple global instances installed.
Use which shopify to find out which one you are running and uninstall it.

[github-actions]

Differences in type declarations

We detected differences in the type declarations generated by Typescript for this branch compared to the baseline ('main' branch). Please, review them to ensure they are backward-compatible. Here are some important things to keep in mind:

• Some seemingly private modules might be re-exported through public modules.
• If the branch is behind main you might see odd diffs, rebase main into this branch.

New type declarations

We found no new type declarations in this PR

Existing type declarations

packages/cli-kit/dist/public/node/metadata.d.ts

@@ -34,7 +34,7 @@ export type SensitiveSchema<T> = T extends RuntimeMetadataManager<infer _TPublic
  * @returns A container for the metadata.
  */
 export declare function createRuntimeMetadataContainer<TPublic extends AnyJson, TSensitive extends AnyJson = Record<string, never>>(defaultPublicMetadata?: Partial<TPublic>): RuntimeMetadataManager<TPublic, TSensitive>;
-type CmdFieldsFromMonorail = PickByPrefix<MonorailEventPublic, 'cmd_all_'> & PickByPrefix<MonorailEventPublic, 'cmd_app_'> & PickByPrefix<MonorailEventPublic, 'cmd_create_app_'> & PickByPrefix<MonorailEventPublic, 'cmd_theme_'> & PickByPrefix<MonorailEventPublic, 'store_'> & PickByPrefix<MonorailEventPublic, 'env_auto_upgrade_'>;
+type CmdFieldsFromMonorail = PickByPrefix<MonorailEventPublic, 'cmd_all_'> & PickByPrefix<MonorailEventPublic, 'cmd_app_'> & PickByPrefix<MonorailEventPublic, 'cmd_create_app_'> & PickByPrefix<MonorailEventPublic, 'cmd_theme_'> & PickByPrefix<MonorailEventPublic, 'cmd_validate_'> & PickByPrefix<MonorailEventPublic, 'store_'> & PickByPrefix<MonorailEventPublic, 'env_auto_upgrade_'>;
 declare const coreData: RuntimeMetadataManager<CmdFieldsFromMonorail, {
     commandStartOptions: {
         startTime: number;

packages/cli-kit/dist/public/node/monorail.d.ts

@@ -77,6 +77,11 @@ export interface Schemas {
             cmd_app_validate_valid?: Optional<boolean>;
             cmd_app_validate_issue_count?: Optional<number>;
             cmd_app_validate_file_count?: Optional<number>;
+            cmd_validate_subcommand?: Optional<string>;
+            cmd_validate_result?: Optional<string>;
+            cmd_validate_api?: Optional<string>;
+            cmd_validate_api_version?: Optional<string>;
+            cmd_validate_json?: Optional<boolean>;
             cmd_dev_tunnel_type?: Optional<string>;
             cmd_dev_tunnel_custom_hash?: Optional<string>;
             cmd_dev_urls_updated?: Optional<boolean>;