[github-actions]

WHY are these changes introduced?

packages/theme/src/cli/services/json-output/schema.ts defines the shared JSON output contract for the theme commands — themeId, storeDomain, projectTheme and defineThemeJsonOutputSchema are imported by 11 theme commands and 18 service types — and has no co-located test. The projection helpers in particular are the layer that decides what leaves the CLI as public JSON, so their guards are a contract rather than incidental validation.

Nothing in the repository asserts them directly. themeId is never exercised with a GID, a negative number or a non-integer, so its TypeError branch is dead in tests; storeDomain is never given a non-myshopify.com host, so the null fallback that hides a custom domain is unverified; projectTheme is never checked for dropping the extra fields that come back on an upstream theme (shop, editor_url, preview_url). A refactor could widen any of these and the whole suite would still pass. The downstream tests that touch this code — push/result.test.ts, info/types.test.ts — assert their own command's shape, not the shared helpers.

This is not a flaky-test fix. Reviewing Main tests runs created between 2026-10-15T00:24Z and 2026-10-22T00:24Z UTC (28 runs, all first attempts — I confirmed via the attempts API that none had a rerun hiding an earlier failure) found four failures, all on windows-latest, all timeouts, reducing to two signatures: the PowerShell record test in app-security-commands.test.ts (runs 39241753364, 38773610537, 38766274961, 38709303616) and the 32-hex secret test in secret-safety.test.ts (run 38766274961). Both already have open fixes, #8832 and #8928, so no actionable flake remains in the window.

WHAT is this pull request doing?

Adds packages/theme/src/cli/services/json-output/schema.test.ts covering the four exported helpers with table-driven cases.

The rejection cases pin themeId to both of its failure modes, which are not the same check: a GID or a negative string fails Zod's ^\d+$ pattern, while -1, 1.5 and MAX_SAFE_INTEGER + 1 fail the numeric guard that runs before the string is ever parsed. The storeDomain cases make the regex boundary explicit — a.b.myshopify.com and My-Shop.myshopify.com both end in myshopify.com but are still reported as unavailable, so a looser rewrite using a suffix match would not slip through. For defineThemeJsonOutputSchema the tests cover the branch that matters most: a cancelled result must reach the output unprojected in both the single and batched forms, since the command projections assume a real result and would throw on it.

The helpers are pure and synchronous, so the test needs no temporary directory and no filesystem access. No production code is changed.

Validation: the new file passes locally on Linux Node 22.20.1 (22 passed), five times under --sequence.shuffle, and alongside all 30 test files under packages/theme/src/cli/services (287 passed). nx type-check theme and ESLint on the new file both pass. I confirmed the tests earn their keep by temporarily neutralizing each guard in turn and restoring it: removing the numeric guard and the domain validation and the cancellation passthrough fails 8 cases, and making projectTheme spread the upstream theme instead of selecting fields fails its case.

Remaining uncertainty: the cases named for Windows-shaped input do not exist here — these helpers are plain string and schema matching with no platform branch, so the Linux run covers the same code paths CI will run on macOS and Windows. This PR does not address the two Windows timeouts cited above; those are separate flakes with their own open fixes.

How to manually test your changes?

shopify theme info --json
shopify theme list --json

Checklist

• I've considered possible cross-platform impacts (Mac, Linux, Windows)
• I've considered possible documentation changes
• I've considered analytics changes to measure impact
• The change is user-facing — I've identified the correct bump type (patch for bug fixes · minor for new features · major for breaking changes) and added a changeset with pnpm changeset add