Skip expired store auth sessions in theme commands

[alfonso-noriega]

WHY are these changes introduced?

Third layer of the theme dev store-auth regression fix (Slack thread); stacked on #8184.

Theme commands read stored store-auth sessions with the raw cache accessor and never checked expiry. An expired token was handed to the Admin API, and the resulting 401 was terminal: the theme session carries no refresh handler (adminRequestDoc only installs one when 'refresh' in session), and the failure path never falls back to normal authentication. This is the exact shape of the July 8 Enterprise case (401 on publicApiVersions that auth logout + re-auth couldn't fix).

WHAT is this pull request doing?

• Skips stored sessions that fail cli-kit's isSessionExpired (including its 4-minute refresh margin) and falls back to normal theme authentication.
• Flips the test that pinned the old behavior (does not check stored store auth cache session expiry) and adds a positive test for future expiries.
• Switches the test file to a partial module mock so the real isSessionExpired implementation runs.

Actual token refresh (the refresh client lives in @shopify/store, which @shopify/theme deliberately no longer depends on) is left as follow-up work.

How to test your changes?

Covered by unit tests (theme-command.test.ts): a stored session with a past expiresAt is skipped and the command authenticates normally; a future expiresAt is still reused.

Measuring impact

• Existing analytics will cater for this addition

[alfonso-noriega]

• Log store auth session decisions in theme commands under --verbose #8186
• Skip expired store auth sessions in theme commands #8185 👈 (View in Graphite)
• Require recorded scopes to reuse a store auth session in theme commands #8184
• Make store auth session reuse opt-in per theme command #8183
• main

This stack of pull requests is managed by Graphite. Learn more about stacking.

[github-actions]

Differences in type declarations

We detected differences in the type declarations generated by Typescript for this branch compared to the baseline ('main' branch). Please, review them to ensure they are backward-compatible. Here are some important things to keep in mind:

• Some seemingly private modules might be re-exported through public modules.
• If the branch is behind main you might see odd diffs, rebase main into this branch.

New type declarations

We found no new type declarations in this PR

Existing type declarations

packages/cli-kit/dist/public/node/api/partners.d.ts

@@ -1,5 +1,7 @@
 import { GraphQLVariables, GraphQLResponse, CacheOptions, UnauthorizedHandler } from './graphql.js';
 import { RequestModeInput } from '../http.js';
+import { Variables } from 'graphql-request';
+import { TypedDocumentNode } from '@graphql-typed-document-node/core';
 /**
  * Executes a GraphQL query against the Partners API.
  *
@@ -12,6 +14,17 @@ import { RequestModeInput } from '../http.js';
  * @returns The response of the query of generic type <T>.
  */
 export declare function partnersRequest<T>(query: string, token: string, variables?: GraphQLVariables, cacheOptions?: CacheOptions, preferredBehaviour?: RequestModeInput, unauthorizedHandler?: UnauthorizedHandler): Promise<T>;
+/**
+ * Executes a GraphQL query against the Partners API. Uses typed documents.
+ *
+ * @param query - GraphQL query to execute.
+ * @param token - Partners token.
+ * @param variables - GraphQL variables to pass to the query.
+ * @param preferredBehaviour - Preferred behaviour for the request.
+ * @param unauthorizedHandler - Optional handler for unauthorized requests.
+ * @returns The response of the query of generic type <TResult>.
+ */
+export declare function partnersRequestDoc<TResult, TVariables extends Variables>(query: TypedDocumentNode<TResult, TVariables>, token: string, variables?: TVariables, preferredBehaviour?: RequestModeInput, unauthorizedHandler?: UnauthorizedHandler): Promise<TResult>;
 /**
  * Sets the next deprecation date from [GraphQL response extensions](https://www.apollographql.com/docs/resources/graphql-glossary/#extensions)
  * if `response.extensions.deprecations` objects contain a `supportedUntilDate` (ISO 8601-formatted string).