Remove @shopify/polaris, @shopify/polaris-icons and react-dom from cli-kit

[isaacroldan]

WHY are these changes introduced?

Part of the effort to reduce external dependencies in the CLI. The GraphiQL page templates were the only consumers of @shopify/polaris, @shopify/polaris-icons and react-dom in cli-kit: they rendered a fixed set of Polaris components with renderToStaticMarkup on every request, always producing the same static markup around a handful of dynamic values.

WHAT is this pull request doing?

• Rewrites graphiql.tsx and unauthorized.tsx as plain .ts templates. The static Polaris markup is embedded as string constants, and the dynamic parts (API version select, status badge label, store/app link pills, scopes note) are interpolated with a local escapeHtml that matches React's escaping.
• Removes @shopify/polaris, @shopify/polaris-icons, react-dom and @types/react-dom from cli-kit's dependencies. react stays because Ink depends on it.

The generated HTML is byte-identical to the previous output. Verified with a temporary capture test that rendered all five variants (no app, app, app with protected mutations, unauthorized app, unauthorized store) before and after the change and diffed the results.

The pnpm-lock.yaml diff also includes the known libc: [glibc|musl] metadata lines that pnpm 10.11.1 adds on any install; they are unrelated to this change.

How to test your changes?

Run shopify app dev, open GraphiQL, and check the top bar (status badge, version select, store/app pills, scopes note), the server-stopped banner, and the unauthorized page. They should look and behave exactly as before.

Measuring impact

• n/a: the rendered pages are unchanged.

Checklist

• I've considered possible cross-platform impacts (Mac, Linux, Windows)
• I've considered possible documentation changes

🤖 Generated with Claude Code

[isaacroldan]

/snapit

[github-actions]

🫰✨ Thanks @isaacroldan! Your snapshot has been published to npm.

Test the snapshot by installing your package globally:

pnpm i -g --@shopify:registry=https://registry.npmjs.org @shopify/cli@0.0.0-snapshot-20260810111653

Caution

After installing, validate the version by running shopify version in your terminal.
If the versions don't match, you might have multiple global instances installed.
Use which shopify to find out which one you are running and uninstall it.

[github-actions]

Differences in type declarations

We detected differences in the type declarations generated by Typescript for this branch compared to the baseline ('main' branch). Please, review them to ensure they are backward-compatible. Here are some important things to keep in mind:

• Some seemingly private modules might be re-exported through public modules.
• If the branch is behind main you might see odd diffs, rebase main into this branch.

New type declarations

We found no new type declarations in this PR

Existing type declarations

packages/cli-kit/dist/public/node/graphiql/templates/graphiql.d.ts

@@ -8,5 +8,11 @@ interface GraphiQLTemplateOptions {
     storeFqdn: string;
     protectMutations?: boolean;
 }
-export declare function graphiqlTemplate({ apiVersion, apiVersions, appName, appUrl, key, storeFqdn, protectMutations, }: GraphiQLTemplateOptions): string;
+/**
+ * Returns the HTML for the GraphiQL page, ready to be rendered as a Liquid template.
+ *
+ * @param options - The dynamic values to interpolate into the page.
+ * @returns The HTML for the GraphiQL page.
+ */
+export declare function graphiqlTemplate(options: GraphiQLTemplateOptions): string;
 export {};
\ No newline at end of file

packages/cli-kit/dist/public/node/graphiql/templates/unauthorized.d.ts

@@ -1,5 +1,11 @@
 interface UnauthorizedTemplateOptions {
     hasAppContext: boolean;
 }
-export declare function unauthorizedTemplate({ hasAppContext }: UnauthorizedTemplateOptions): string;
+/**
+ * Returns the HTML for the page shown while the app or store authentication is not ready.
+ *
+ * @param options - Whether the page is for an app (install flow) or a store (auth flow).
+ * @returns The HTML for the unauthorized page.
+ */
+export declare function unauthorizedTemplate(options: UnauthorizedTemplateOptions): string;
 export {};
\ No newline at end of file