[nickwesselman]

Middle of a stack: on PR 9015 (automation token scopes) and under PR 9016 (app dev push).

WHY are these changes introduced?

app dev holds a few pieces of logic that a finite "push a dev preview and exit" command also needs: rewriting app URLs for a dev origin, uploading a compressed bundle to a signed URL, and building the admin preview link. Extracting them first keeps the command PR limited to new files.

WHAT is this pull request doing?

Refactor only; app dev, deploy, and the app loader behave exactly as before.

• generateApplicationURLsForApp() replaces three copies of the same callback-path/app-proxy lookup in dev.ts, dev-push-to-be, and loader.ts.
• uploadDevBundle() and devBundlePath() (new dev/dev-bundle.ts) replace the signed-URL-then-upload sequence in dev-session.ts.
• buildAppURLForAdmin() gains a {devConsole: false} option.
• uploadToGCS() and devSessionCreate() accept an optional AbortSignal; without one, requests are unchanged.
• storeContext() gains ensureUserAccess (default true) so remote-only commands can skip user-access provisioning; blockIfMigrationIncomplete() only requires the fields it reads.

No changeset: nothing user-facing changes.

How to manually test your changes?

1. Run pnpm shopify app dev against a dev store with --url-style tunnelling as usual; the preview and OAuth callback URLs should be identical to before.
2. Edit an extension while app dev is running; the preview should update as before (this exercises the extracted upload helper).
3. Run pnpm shopify app deploy; bundle upload is unchanged.

Checklist

• I've considered possible cross-platform impacts (Mac, Linux, Windows)
• I've considered possible documentation changes
• I've considered analytics changes to measure impact
• The change is user-facing and includes a minor changeset.

---

PR authored by Qlaw