Replace JS implementation with TypeScript shop-cli (@shopify/shop-cli)

[joerj123]

What

Replaces the current JS implementation (bin/shop.mjs + lib/*.mjs, package shop v1.0.1) with the catalog-cli TypeScript version of the Shop CLI skill.

Contents

• package/ — TypeScript source (src/) + tests (tests/), tsup build, vitest, keytar (OS-keychain token storage)
• SKILL.md — skill instructions
• references/ — catalog-mcp.md, direct-api.md, safety.md, legal.md
• Package renamed to @shopify/shop-cli

Excluded intentionally

• node_modules/, dist/ (build artifacts; pnpm build regenerates dist)
• ucp-bug-repro/ debug response dumps (contained real catalog response data)

Validation

• pnpm typecheck — clean
• pnpm test — 56/56 passing

Not published to npm / any registry.

[shopify-bumperbot]

🔍 Denylist Analysis Results

Analyzed 41 packages.

package/pnpm-lock.yaml

---

✅ Known Packages - Approved for Use (41)

Package	Version	Details
@types/node	22.19.19	Package policy allows this version
base64-js	1.5.1	Package policy allows this version
bl	4.1.0	Package policy allows this version
buffer	5.7.1	Package policy allows this version
chownr	1.1.4	Package policy allows this version
commander	12.1.0	Package policy allows this version
decompress-response	6.0.0	Package policy allows this version
deep-extend	0.6.0	Package policy allows this version
detect-libc	2.1.2	Package policy allows this version
end-of-stream	1.4.5	Package policy allows this version
expand-template	2.0.3	Package policy allows this version
fs-constants	1.0.0	Package policy allows this version
github-from-package	0.0.0	Package policy allows this version
ieee754	1.2.1	Package policy allows this version
inherits	2.0.4	Package policy allows this version
ini	1.3.8	Package policy allows this version
keytar	7.9.0	Package policy allows this version
mimic-response	3.1.0	Package policy allows this version
minimist	1.2.8	Package policy allows this version
mkdirp-classic	0.5.3	Package policy allows this version
napi-build-utils	2.0.0	Package policy allows this version
node-abi	3.92.0	Package policy allows this version
node-addon-api	4.3.0	Package policy allows this version
once	1.4.0	Package policy allows this version
prebuild-install	7.1.3	Package policy allows this version
pump	3.0.4	Package policy allows this version
rc	1.2.8	Package policy allows this version
readable-stream	3.6.2	Package policy allows this version
safe-buffer	5.2.1	Package policy allows this version
semver	7.8.1	Package policy allows this version
simple-concat	1.0.1	Package policy allows this version
simple-get	4.0.1	Package policy allows this version
string_decoder	1.3.0	Package policy allows this version
strip-json-comments	2.0.1	Package policy allows this version
tar-fs	2.1.4	Package policy allows this version
tar-stream	2.2.0	Package policy allows this version
tunnel-agent	0.6.0	Package policy allows this version
typescript	5.9.3	Package policy allows this version
undici-types	6.21.0	Package policy allows this version
util-deprecate	1.0.2	Package policy allows this version
wrappy	1.0.2	Package policy allows this version

⏳ Package Age Warnings

❓ Packages With Unknown Age (1) — unable to determine publish date

Package	Version	Ecosystem
@types/node	22.19.19	npm

---

For any questions or to provide feedback, please reach out to #help-bumperbot.

Generated by Bumperbot.