Retry gateway failures during device authorization

[gonzaloriestra]

WHY are these changes introduced?

Related to https://shopify.slack.com/archives/C0ARV62K59C/p1789515820672379

Temporary gateway failures during sign-in immediately fail device authorization, and non-JSON error responses are reported as CLI bugs.

WHAT is this pull request doing?

Retry device authorization requests that return HTTP 502, 503, or 504 twice. Respect valid Retry-After headers (seconds or HTTP dates), falling back to delays of 200 ms and 400 ms when the header is missing or invalid. If a non-JSON gateway response persists, report an AbortError with the existing service-error context. JSON error responses retain their existing handling.

Share the gateway-status helper with the existing GraphQL error classification and record retry analytics. Include regression coverage and a patch changeset.

How to manually test your changes?

pnpm shopify auth login

Checklist

• I've considered possible cross-platform impacts (Mac, Linux, Windows)
• I've considered possible documentation changes
• I've considered analytics changes to measure impact
• The change is user-facing — I've identified the correct bump type (patch for bug fixes · minor for new features · major for breaking changes) and added a changeset with pnpm changeset add

[amcaplan]

The code looks good. One small change I'd like to see, and then I think this PR is ready to go

[github-actions]

Differences in type declarations

We detected differences in the type declarations generated by Typescript for this branch compared to the baseline ('main' branch). Please, review them to ensure they are backward-compatible. Here are some important things to keep in mind:

• Some seemingly private modules might be re-exported through public modules.
• If the branch is behind main you might see odd diffs, rebase main into this branch.

New type declarations

packages/cli-kit/dist/private/node/api/gateway-status.d.ts

/**
 * Checks whether an HTTP status indicates a gateway-level failure.
 *
 * @param status - The HTTP status to check.
 * @returns Whether the status is 502, 503, or 504.
 */
export declare function isGatewayErrorStatus(status: number | undefined): boolean;

Existing type declarations

We found no diffs with existing type declarations