Shoplifter CLI

Requires Node 24. This source prepares CLI 0.1.9 with SDK and contract 0.2.0. After publication, install with npm install --global @shoplifter/[email protected]. Existing projects upgrade runtime inputs only through explicit dependency synchronization.

Agent skills

After the public docs catalog and CLI 0.1.9 are released:

shoplifter skills install --agent codex
shoplifter skills install --agent claude
shoplifter skills install --agent all --version 0.1.0
shoplifter skills install --agent codex --global

Installs both official Shoplifter skills in the current directory by default: .agents/skills for Codex, .claude/skills for Claude Code. --global uses the corresponding directories under your home. No login is needed. Bundles are selected against this CLI version and its pinned SDK runtime, then checksum/path validated before installation. Identical installs stay unchanged. Use --force only to replace differing Shoplifter skill folders; unrelated skills/settings are preserved. Manual ZIPs and installation guidance are at https://docs.shoplifter.co.il/en/skills/.

Authoring

shoplifter init ./site site downloads the matching public SDK and contract with integrity verification, without a dashboard session. For existing local archives:

shoplifter init ./site site /absolute/sdk.tgz /absolute/contract.tgz
cd site
npm install
shoplifter fixtures generate
shoplifter types
shoplifter validate
npm run dev
npm run build

Commands include fields, editor, assets, data, design, migrations, fixtures, types, validate, scaffold, files, dependencies, login, logout and publication. Authoring commands and manual edits share validation. Use explicit scaffold or fixtures reset to create components or reset fixtures; ordinary generation preserves valid edits and authored markup/styles.

Upload safety and publishing

shoplifter files prints only included file paths, byte sizes and the total size. Uploads use that same file selection. Root and nested .gitignore and .shoplifterignore rules are supported; missing required files are errors. Mandatory credential/key/environment exclusions always win, including over negation. Do not store private records or hardcoded credentials in project source.

shoplifter publication upload combo-media prepares a deterministic binary archive and streams it directly to private S3. The platform authorizes the transfer and validates the source asynchronously. Older CLIs must upgrade for uploads; their other publication commands remain supported. No SDK upgrade is needed.

Rerun the same command after an interruption or after renewing an expired login. The CLI resumes matching uploads and transfers only missing multipart parts. If source contents changed, it cancels the previous incomplete session and starts a new one. Checkpoints contain metadata only, without tokens or signed URLs. They live outside the project under the private Shoplifter configuration directory (SHOPLIFTER_CONFIG_DIRECTORY, or ~/.config/shoplifter). Archive and checkpoint files are removed after successful validation. A failed validation can be retried by correcting the reported project/session issue and rerunning upload.

Limits: 2,000 files, 12 MiB per file, 96 MiB expanded and 112 MiB compressed. Archives below 32 MiB use one PUT; larger archives use 8 MiB parts with at most three concurrent transfers. Sessions expire after 24 hours, transfer grants after at most 15 minutes. Two unfinished upload sessions may exist per channel.

Set SHOPLIFTER_API_URL=https://<platform-api-host> before production operations. shoplifter dependencies sync anonymously downloads the platform-approved public runtime, verifies hashes and explicitly updates local archives and the lockfile. It preserves authored files. Run npm ci --ignore-scripts after synchronization. For an unpublished local runtime pair, use shoplifter dependencies sync /absolute/path/sdk.tgz /absolute/path/contract.tgz; both archives are required.

shoplifter login combo-media opens dashboard approval for that channel code. With shoplifter login alone, explicitly choose a channel on the approval page. Only channels accessible to your dashboard account can be selected; publishing must be enabled for the channel. Switching channels clears the reviewed request. One-hour credentials are stored with private permissions outside the project. Use shoplifter logout to revoke. CLI 0.1.2 tolerates up to five minutes of server clock lead when validating a new one-hour credential; server-side token expiry remains one hour. This fixes approved logins rejected by 0.1.1 when server and developer clocks differ slightly. shoplifter publication upload <channel-code> uploads source; stage, preview, build, activate, publish, status, logs, retry, retry-deployment and rollback operate on channel-scoped revisions. preview-link requests protected preview access. Source changes require exact-input preview and explicit activation. Downloading the SDK never grants publication permission. The loopback bypass is development-only and cannot be used remotely or in production. Older credentials resolve their channel code through the authenticated session API. Set SHOPLIFTER_NO_BROWSER=1 to copy the approval link without opening a browser. Deploy the matching backend/dashboard changes before releasing CLI 0.1.1; this patch requires the authenticated session endpoint and code-based operations.

Shoplifter-owned code is Apache-2.0; separately installed dependencies retain their licenses. See LICENSE, NOTICE and THIRD_PARTY_NOTICES. This does not license the private backend, repository or customer content.