#!/usr/bin/env python3
"""shopify-cli-scan — free Shopify CLI / App migration & risk scanner by PatchVault (patchvault-81y.pages.dev).
Single file, Python 3.8+ standard library only. Reads files locally; sends nothing anywhere.
Usage:  python3 <(curl -sL https://patchvault-81y.pages.dev/starters/shopify-cli-scan.py) [dir] [--demo] [--json] [--no-color]
If the directory has no matching project files (or --demo is given) it runs a clearly labelled showcase on a
built-in SAMPLE repository so you can see the report format.  Exit code is always 0 (it is a report, not a gate)."""
import json,os,re,sys
CFG=json.loads(r'''{"name": "shopify-cli-scan", "framework": "Shopify CLI / App", "detect": ["shopify.app.toml", "shopify.extension.toml", "shopify.web.toml", "package.json", ".js", ".ts", ".tsx", ".jsx", ".sh", ".yml", ".yaml", ".toml"], "rules": [{"id": "sh-poll", "sev": "HIGH", "title": "`theme dev --poll` flag was removed", "rx": "(theme\\s+dev\\b[^\\n;&|]*?)\\s--poll\\b", "advice": "Drop --poll; theme dev now uses file events.", "fix": "\\1", "flags": "", "unless": null, "ext": null, "fix_unless": null}, {"id": "sh-logs", "sev": "HIGH", "title": "`shopify app logs sources` was removed", "rx": "\\bshopify\\s+app\\s+logs\\s+sources\\b", "advice": "Use `shopify app logs` with --source filters.", "fix": null, "flags": "", "unless": null, "ext": null, "fix_unless": null}, {"id": "sh-token", "sev": "MEDIUM", "title": "Deprecated CLI automation token variable", "rx": "\\b(?:SHOPIFY_APP_AUTOMATION_TOKEN|SHOPIFY_CLI_PARTNERS_TOKEN)\\b", "advice": "Re-check CI auth against the current Shopify CLI docs before the next deploy.", "fix": null, "flags": "", "unless": null, "ext": null, "fix_unless": null}, {"id": "sh-themelist-json", "sev": "HIGH", "title": "`theme list --json` now returns {\"themes\":[...]} with string IDs", "rx": "\\btheme\\s+list\\b[^\\n]*--json", "advice": "Read `.themes[]` and treat ids as strings.", "fix": null, "flags": "", "unless": null, "ext": null, "fix_unless": null}, {"id": "sh-push-json", "sev": "HIGH", "title": "`theme push --json` result shape changed", "rx": "\\btheme\\s+push\\b[^\\n]*--json", "advice": "Re-map the parser to the new result object.", "fix": null, "flags": "", "unless": null, "ext": null, "fix_unless": null}, {"id": "sh-combined", "sev": "MEDIUM", "title": "JSON parsed from combined stdout+stderr", "rx": "\\bshopify\\b[^\\n]*--json[^\\n]*2>&1", "advice": "Parse stdout only; send stderr elsewhere.", "fix": null, "flags": "", "unless": null, "ext": null, "fix_unless": null}, {"id": "sh-toml-legacy", "sev": "HIGH", "title": "Legacy app config key `api_key` (current schema uses client_id)", "rx": "^\\s*api_key\\s*=", "advice": "Run `shopify app config link` to regenerate shopify.app.toml with client_id and [access_scopes].", "fix": null, "flags": "", "unless": null, "ext": [".toml"], "fix_unless": null}, {"id": "sh-toml-scopes", "sev": "HIGH", "title": "Top-level `scopes` outside an [access_scopes] table (legacy schema)", "rx": "^\\s*scopes\\s*=", "advice": "Run `shopify app config link` to regenerate shopify.app.toml with client_id and [access_scopes].", "fix": null, "flags": "", "unless": "\\[access_scopes\\]", "ext": [".toml"], "fix_unless": null}, {"id": "sh-toml-subs", "sev": "MEDIUM", "title": "Webhook subscriptions declared without the [webhooks] api_version block", "rx": "^\\s*\\[\\[webhooks\\.subscriptions\\]\\]", "advice": "Ensure [webhooks] has api_version set and each subscription has `uri` + `topics`.", "fix": null, "flags": "", "unless": "api_version\\s*=", "ext": [".toml"], "fix_unless": null}, {"id": "sh-rest", "sev": "HIGH", "title": "Deprecated REST Admin endpoint: migrate to the GraphQL Admin API", "rx": "/admin/api/[0-9]{4}-[0-9]{2}/(?:products|variants|orders|customers|inventory_levels|custom_collections)[^'\"`\\s]*\\.json", "advice": "Rewrite with the GraphQL Admin API (REST product/variant APIs are legacy since 2024-04).", "fix": null, "flags": "", "unless": null, "ext": null, "fix_unless": null}, {"id": "sh-rest-client", "sev": "MEDIUM", "title": "shopify.clients.Rest usage (REST Admin client)", "rx": "\\bclients\\.Rest\\b|\\bnew\\s+shopify\\.clients\\.Rest\\b", "advice": "Switch to shopify.clients.Graphql.", "fix": null, "flags": "", "unless": null, "ext": null, "fix_unless": null}, {"id": "sh-delivery", "sev": "MEDIUM", "title": "Webhook DeliveryMethod registration in code: move webhooks to shopify.app.toml", "rx": "\\bDeliveryMethod\\.(?:Http|EventBridge|PubSub)\\b", "advice": "Declare app-specific webhooks in TOML; remove runtime registration.", "fix": null, "flags": "", "unless": null, "ext": null, "fix_unless": null}, {"id": "sh-appbridge-v3", "sev": "HIGH", "title": "App Bridge v3 `createApp` pattern (v4 uses the global `shopify` object)", "rx": "\\bcreateApp\\s*\\(|from\\s+['\"]@shopify/app-bridge/actions['\"]", "advice": "Load app-bridge.js via <script> and use window.shopify (toast, modal, idToken).", "fix": null, "flags": "", "unless": null, "ext": null, "fix_unless": null}, {"id": "sh-appbridge-react", "sev": "MEDIUM", "title": "@shopify/app-bridge-react v3 Provider", "rx": "<Provider\\s+config=|\\buseAppBridge\\(\\)\\.dispatch", "advice": "v4: remove <Provider>, call shopify.* APIs directly.", "fix": null, "flags": "", "unless": null, "ext": null, "fix_unless": null}, {"id": "sh-cli-old", "sev": "MEDIUM", "title": "@shopify/cli pinned to 3.x", "rx": "\"@shopify/cli\"\\s*:\\s*\"[\\^~]?3\\.", "advice": "Upgrade @shopify/cli and re-check flags.", "fix": null, "flags": "", "unless": null, "ext": ["package.json"], "fix_unless": null}], "samples": {"shopify.app.toml": "# legacy schema\nname = \"acme-upsell\"\napi_key = \"a1b2c3d4e5f6\"\nscopes = \"read_products,write_orders\"\n\n[[webhooks.subscriptions]]\ntopics = [\"orders/create\"]\nuri = \"/webhooks/orders\"\n", "web/index.js": "import createApp from '@shopify/app-bridge';\nimport { Toast } from '@shopify/app-bridge/actions';\nimport { DeliveryMethod } from '@shopify/shopify-api';\n\nconst app = createApp({ apiKey: process.env.SHOPIFY_API_KEY, host });\nshopify.webhooks.addHandlers({ ORDERS_CREATE: { deliveryMethod: DeliveryMethod.Http, callbackUrl: '/webhooks' } });\nconst res = await fetch(`https://${shop}/admin/api/2023-10/products.json?limit=50`);\n", "scripts/deploy.sh": "#!/bin/sh\nexport SHOPIFY_APP_AUTOMATION_TOKEN=$TOKEN\nshopify theme dev --store acme --poll\nshopify theme list --json 2>&1 | jq '.[0].id'\n", "package.json": "{ \"devDependencies\": { \"@shopify/cli\": \"^3.58.0\" } }\n"}, "hours": {"CRITICAL": 1.5, "HIGH": 1.0, "MEDIUM": 0.5}, "hours_note": "Estimate: 1.5 h per CRITICAL, 1.0 h per HIGH, 0.5 h per MEDIUM issue (find, rewrite, re-test by hand).", "buy": "https://buy.stripe.com/eVq4gB650aIC6Mc7z1gYU0m", "guide": "https://patchvault-81y.pages.dev/shopify-cli-5-migration/?src=cli_terminal", "price": 9}''')
SKIP={'node_modules','.git','dist','build','.next','coverage','.vercel','.venv','venv','__pycache__','.turbo','.cache'}
SEVS=('CRITICAL','HIGH','MEDIUM')
def _rules():
    out=[]
    for r in CFG['rules']:
        out.append(dict(r,_rx=re.compile(r['rx'],re.I if 'i' in r['flags'] else 0),_un=re.compile(r['unless'],re.I) if r['unless'] else None,_fu=re.compile(r['fix_unless']) if r.get('fix_unless') else None))
    return out
def matches_detect(rel):
    b=os.path.basename(rel)
    return any(b==d or (d.startswith('.') and (b.endswith(d) or b.startswith(d+'.') or b==d)) for d in CFG['detect'])
def rule_applies(r,rel):
    if not r['ext']: return True
    b=os.path.basename(rel); return any(b==e or b.endswith(e) or (e.startswith('.') and b.startswith(e)) for e in r['ext'])
def fix_line(rel,line,R):
    for r in R:
        if r['fix'] is None or not rule_applies(r,rel) or (r['_fu'] and r['_fu'].search(line)): continue
        line=r['_rx'].sub(r['fix'],line)
    return line
def scan_text(rel,text,R):
    F=[]; lines=text.splitlines()
    for r in R:
        if not rule_applies(r,rel) or (r['_un'] and r['_un'].search(text)): continue
        for n,l in enumerate(lines,1):
            if r['_rx'].search(l):
                F.append(dict(sev=r['sev'],id=r['id'],file=rel,line=n,title=r['title'],advice=r['advice'],code=l.rstrip(),
                              fixed=fix_line(rel,l.rstrip(),R) if r['fix'] is not None and not (r['_fu'] and r['_fu'].search(l)) else None,ctx=lines))
    return F
def collect(root):
    files=[]
    for dp,dn,fn in os.walk(root):
        dn[:]=sorted(x for x in dn if x not in SKIP)
        for f in sorted(fn):
            p=os.path.join(dp,f); rel=os.path.relpath(p,root)
            if f in ('package-lock.json','yarn.lock','pnpm-lock.yaml') or not matches_detect(rel): continue
            try:
                if os.path.getsize(p)>2_000_000: continue
                files.append((rel,open(p,encoding='utf-8',errors='ignore').read()))
            except OSError: pass
    return files
class C:
    def __init__(s,on): s.on=on
    def __call__(s,code,t): return f'\033[{code}m{t}\033[0m' if s.on else t
def vis(t): return len(re.sub(r'\033\[[0-9;]*m','',t))
def main(a):
    try: sys.stdout.reconfigure(errors='replace')
    except Exception: pass
    root=next((x for x in a if not x.startswith('-')),'.')
    uni=(sys.stdout.encoding or '').lower().startswith('utf')
    c=C(sys.stdout.isatty() and not os.environ.get('NO_COLOR') and '--no-color' not in a and os.environ.get('TERM')!='dumb')
    R=_rules(); files=[] if '--demo' in a else collect(root); demo=not files
    if demo: files=list(CFG['samples'].items())
    F=[f for rel,t in files for f in scan_text(rel,t,R)]
    F.sort(key=lambda f:(SEVS.index(f['sev']),f['file'],f['line']))
    cnt={s:sum(f['sev']==s for f in F) for s in SEVS}
    hrs=sum(CFG['hours'][f['sev']] for f in F)
    buy=CFG['buy']+('&' if '?' in CFG['buy'] else '?')+'src=cli_terminal'
    if '--json' in a:
        print(json.dumps(dict(tool=CFG['name'],sample_mode=demo,files_scanned=len(files),counts=cnt,est_manual_hours=hrs,hours_note=CFG['hours_note'],
            findings=[{k:f[k] for k in ('sev','id','file','line','title','advice','code','fixed')} for f in F],guide=CFG['guide'],fix_bundle=buy),indent=1)); return 0
    H,V,TL,TR,BL,BR,LT,RT='─│┌┐└┘├┤' if uni else '-|++++++'
    badge={'CRITICAL':c('1;97;41',' CRITICAL '),'HIGH':c('1;30;43','   HIGH   '),'MEDIUM':c('1;30;46',' MEDIUM   ')}
    print()
    print(c('1;33',f"⚡ PatchVault {CFG['name']}" if uni else f"PatchVault {CFG['name']}")+c('2',f"  ·  {CFG['framework']}"))
    if demo:
        print(c('1;35',f"⚡ No local {CFG['framework']} files detected in current directory — running Live Interactive Showcase on sample repository..." if uni else
              f"No local {CFG['framework']} files detected in current directory - running Live Interactive Showcase on sample repository..."))
        print(c('2','   (SAMPLE DATA: the files below are a built-in demo repo, not your code. Run inside your project to scan it.)'))
    W=64
    rows=[('Files scanned',str(len(files))+(' (sample repo)' if demo else '')),
          ('[CRITICAL] issues',c('1;91',str(cnt['CRITICAL']))),('[HIGH] issues',c('1;93',str(cnt['HIGH']))),('[MEDIUM] issues',c('1;96',str(cnt['MEDIUM']))),
          ('Est. manual fix time',f'~{hrs:g} h (estimate)'),('PatchVault auto-fix',c('1;92','~12 seconds')+f" ({sum(f['fixed'] is not None for f in F)} auto-fixable)")]
    print(TL+H*W+TR)
    t=' SCAN SUMMARY'; print(V+c('1',t)+' '*(W-len(t))+V); print(LT+H*W+RT)
    for k,v in rows:
        line=f' {k:<24}{v}'; print(V+line+' '*max(0,W-vis(line))+V)
    print(BL+H*W+BR)
    print(c('2','  '+CFG['hours_note']))
    if not F: print('\n  '+c('1;92','Nothing found. You look ready.'))
    else:
        print()
        for f in F[:60]: print(f"  {badge[f['sev']]} {c('1',f['file'])}:{f['line']}  {f['title']}")
        if len(F)>60: print(f'  ... and {len(F)-60} more (use --json)')
        f=F[0]; L=f['ctx']; i=f['line']-1
        new=f['fixed'] if f['fixed'] is not None and f['fixed']!=f['code'] else re.match(r'\s*',f['code']).group(0)+('# ' if f['file'].endswith(('.toml','.sh','.yml','.yaml','.py','.env','.example')) else '-- ' if f['file'].endswith('.sql') else '// ')+'PatchVault: '+f['advice']
        print('\n'+c('1',f"  Before/after preview — first issue ({f['id']})"+(' [sample]' if demo else '')))
        print(c('1',f"  --- a/{f['file']}")); print(c('1',f"  +++ b/{f['file']}"))
        print('  '+c('2',f"@@ line {f['line']} @@ "+(L[i-1].strip()[:70] if i>0 else '')))
        print('  '+c('91','- '+f['code'][:110])); print('  '+c('92','+ '+new[:110]))
        print('  '+c('2','  '+(L[i+1][:110] if i+1<len(L) else '')))
    print()
    print(f"  Free fix guide:  {CFG['guide']}")
    nfix=sum(f['fixed'] is not None for f in F)
    if F: print('  '+c('1;92',f"${CFG['price']} fix bundle: auto-fixes {nfix} of {len(F)} here (dry-run / apply / .bak / rollback), exact templates + AI prompts for the rest:"))
    else: print('  '+c('1;92',f"${CFG['price']} fix bundle (dry-run / apply / .bak / rollback):"))
    print('  '+c('1;4',buy))
    print()
    return 0
if __name__=='__main__': sys.exit(main(sys.argv[1:]))