Escape store auth session keys

[alfonso-noriega]

WHY are these changes introduced?

Follow-up to discussion on #7709 about avoiding recursive crawling of conf storage for store-auth sessions.

WHAT is this pull request doing?

Escapes dots in store-auth session keys before passing them to conf, so a store domain is persisted as one top-level key instead of a nested dotted path. The listing code now scans only top-level store-auth buckets and ignores legacy nested entries.

This intentionally means stores authenticated with the old nested key format may need to be re-authenticated.

How to test your changes?

pnpm --filter @shopify/store vitest src/cli/services/store/auth/session-store.test.ts src/cli/services/store/auth/stored-auth.test.ts
pnpm --filter @shopify/store lint
pnpm --filter @shopify/store type-check

Post-release steps

None.

Checklist

• I've considered possible cross-platform impacts (Mac, Linux, Windows)
• I've considered possible documentation changes
• I've considered analytics changes to measure impact
• The change is user-facing — I've identified the correct bump type (patch for bug fixes · minor for new features · major for breaking changes) and added a changeset with pnpm changeset add

[alfonso-noriega]

Warning

This pull request is not mergeable via GitHub because a downstack PR is open. Once all requirements are satisfied, merge this PR as a stack on Graphite.
Learn more

• Escape store auth session keys #7864 👈 (View in Graphite)
• Add store auth list for local store auth sessions #7714
• Add local store auth summary API #7709
• Add store list for organization stores #7708
• main

This stack of pull requests is managed by Graphite. Learn more about stacking.

[isaacroldan]

is it better to escape or to replace them? maybe is safer to use -?

[alfonso-noriega]

I think escaping is safer here than replacing with -: - is valid in store domains, so replacement can create collisions between distinct domains. dot-prop explicitly supports escaped dots for this exact case, and the persisted JSON key remains the original domain string rather than an encoded/replaced value. If we want to avoid relying on dot-prop escaping semantics entirely, I think encodeURIComponent(store) would be the safer alternative over - replacement.