Extract App Security checks behind a replaceable package contract

.gitignore

@@ -203,3 +203,6 @@ packages/store/src/cli/api/graphql/*/*_schema.graphql
 
 # Local dev alias scripts
 bin/p
+
+# Local standalone check package for the App Security extraction POC
+.poc/

docs/cli/app-security-check-set-poc.md

@@ -0,0 +1,39 @@
+# App Security check-set extraction POC
+
+The command and security workflow stay in Shopify CLI. Only the default deterministic implementations, check metadata, and agent prompts move to `@shopify/app-security-checks` in the private POC repository `shopify-playground/shopify-app-security-checks`.
+
+This draft is not a release-ready dependency change. It deliberately uses a local package link rather than publishing an experimental package or requiring public CLI CI to access a private Git URL.
+
+## Local setup
+
+From the CLI repository root, clone the check package into the ignored `.poc` directory, check out its extraction PR, then install and build it:
+
+```sh
+mkdir -p .poc
+git clone https://github.com/shopify-playground/shopify-app-security-checks.git .poc/app-security-checks
+git -C .poc/app-security-checks checkout poc/extract-check-set
+pnpm --dir .poc/app-security-checks install --ignore-workspace --frozen-lockfile
+pnpm --dir .poc/app-security-checks build
+pnpm install --no-frozen-lockfile
+```
+
+The CLI app package links to `.poc/app-security-checks`. To exercise the packaged artifact rather than the checkout, run `pnpm --dir .poc/app-security-checks pack --pack-destination ..`, extract the tarball in another local directory, and point `.poc/app-security-checks` at that directory before reinstalling. Neither this POC package nor tarballs should be published or committed to the CLI repository.
+
+## Boundary
+
+The check package supplies a versioned `AppSecurityCheckSet` containing catalog metadata, deterministic runner definitions, and exact raw agent prompt sources. `app-security-engine/check-set.ts` is the production package import point.
+
+CLI still discovers and reads bounded inputs, detects capabilities/frameworks, schedules runners, computes prompt hashes, produces review packs, validates/merges findings, applies redaction and suppressions, compiles traces, persists artifacts, and renders the unchanged command output. Authenticated submissions remain in CLI. Host workflow instructions are embedded independently from the check prompts.
+
+A compatible replacement can be installed under the same dependency name, changing only the package integration point. Library-level callers can also bind a set explicitly through `createAppSecurityEngine(checkSet)`. That factory passes the set through the existing scan, review, validation and compilation functions; it does not replace them or mutate global package selection. `getRegistry(checkSet)` exposes the selected implementations.
+
+Alternative packages are executable code and require the same review/trust as other installed dependencies. This POC does not add runtime package-loading flags and does not load packages from reviewed app configuration or source files. The host rejects contract mismatches, duplicate IDs and orphan implementations. Preserve or deliberately bump check versions and prompt content when changing checks.
+
+## Validation
+
+- Existing host workflow tests continue to exercise default finding/trace schemas, redaction, coverage and provenance.
+- Detector/prompt tests move with the implementations or import the installed package.
+- An alternative fixture set exercises scan, review pack, registry, findings merge and trace compilation end to end, with no command change.
+- The package tests exercise additions and explicit overrides; the host rejects ambiguous identities.
+
+Before this can be merged for release, decide the package name, contract ownership, distribution/visibility and publishing/versioning policy; replace the local link with a resolvable pinned dependency; and run standard public CI. No changeset is included for this internal draft POC.

packages/app/package.json

@@ -55,6 +55,7 @@
     ]
   },
   "dependencies": {
+    "@shopify/app-security-checks": "link:../../.poc/app-security-checks",
     "@graphql-typed-document-node/core": "3.2.0",
     "@luckycatfactory/esbuild-graphql-loader": "3.8.1",
     "@oclif/core": "4.8.3",

packages/app/src/cli/services/app-security-engine/check-set.ts

@@ -0,0 +1,29 @@
+import {defaultCheckSet} from '@shopify/app-security-checks'
+import type {AppSecurityCheckSet, DeterministicCheckDefinition} from '@shopify/app-security-checks'
+
+/** Change this dependency or pass another set to createAppSecurityEngine to replace the checks, not the workflow. */
+export {defaultCheckSet}
+export type {AppSecurityCheckSet, DeterministicCheckDefinition} from '@shopify/app-security-checks'
+
+/** The host rejects unsupported contracts and ambiguous runner identities before executing package code. */
+export function deterministicChecks(checkSet: AppSecurityCheckSet): ReadonlyMap<string, DeterministicCheckDefinition> {
+  if (checkSet.contractVersion !== 1) throw new Error('Unsupported App Security check-set contract version.')
+  const catalogIds = new Set<string>()
+  for (const entry of checkSet.catalog) {
+    if (catalogIds.has(entry.id)) throw new Error(`Duplicate stable product ID: ${entry.id}`)
+    catalogIds.add(entry.id)
+  }
+  const checks = new Map<string, DeterministicCheckDefinition>()
+  for (const definition of checkSet.deterministic) {
+    if (checks.has(definition.id)) throw new Error(`Duplicate deterministic stable ID: ${definition.id}`)
+    if (!catalogIds.has(definition.id)) throw new Error(`Orphan deterministic runner: ${definition.id}`)
+    if (!Number.isInteger(definition.version) || definition.version < 1)
+      throw new Error(`Invalid deterministic check version: ${definition.id}`)
+    if (definition.lifecycle === 'active' && typeof definition.runner !== 'function')
+      throw new Error(`Active deterministic check has no runner: ${definition.id}`)
+    if (definition.lifecycle !== 'active' && definition.runner)
+      throw new Error(`A non-active deterministic check can't have a runner: ${definition.id}`)
+    checks.set(definition.id, definition)
+  }
+  return checks
+}