Events schema blocks app deploys that use legacy OAuth scopes

Inizia riproducendo il problema con Shopify CLI 4.7.0 utilizzando una configurazione dell’app in cui access_scopes, read_products e use_legacy_install_flow sono impostati su true. Confronta shopify app config validate con shopify app deploy --no-release, quindi verifica che Events rimanga facoltativo per legacy OAuth o che il relativo Product topic accetti lo scope dichiarato.

Summary

Shopify app deploy is blocked for an established app that uses the legacy OAuth installation flow with per-shop dynamic scope overrides.

The current remote app-config schema requires an Events section with at least one subscription. Adding a Product subscription and declaring read_products passes shopify app config validate, but app-version creation fails with:

Missing scope for event topic: Product (read_products)

This happens with both the documented scopes string and the newer required_scopes array when use_legacy_install_flow = true. Removing the Events section instead fails config validation with [events]: Required.

Reproduction

1. Use Shopify CLI 4.7.0 with an app config containing access_scopes, read_products, and use_legacy_install_flow = true.
2. Add an Events subscription for the Product topic.
3. Run shopify app config validate: the config is valid.
4. Run shopify app deploy --no-release: version creation fails because read_products is allegedly missing.
5. Remove the Events section and validate again: validation fails because Events is required.

The same mandatory-Events schema is received by the repository-pinned CLI 3.94.3.

Expected behavior

Events is a developer-preview feature and should remain optional. Apps using legacy OAuth should be able to deploy without an Events section. Alternatively, if Events is intended to support legacy installation, its topic-scope validator should recognize scopes declared in the app config.

Impact

The app cannot create staging or production app versions without either adopting preview Events and abandoning its existing legacy dynamic-scope flow, or failing app-config validation. This blocks unrelated extension deployments.