@onexapis/cli 1.1.17 → 1.1.19

package/dist/cli.mjs

@@ -4,10 +4,10 @@ import ora from 'ora';
 import * as esbuild from 'esbuild';
 import path8 from 'path';
 import fs7 from 'fs/promises';
-import crypto from 'crypto';
+import crypto2 from 'crypto';
 import { glob } from 'glob';
 import { createRequire } from 'module';
-import os from 'os';
+import os3 from 'os';
 import dotenv from 'dotenv';
 import fs from 'fs-extra';
 import ejs from 'ejs';
@@ -17,7 +17,7 @@ import fs2 from 'fs';
 import inquirer from 'inquirer';
 import archiver from 'archiver';
 import FormData from 'form-data';
-import fetch from 'node-fetch';
+import fetch2 from 'node-fetch';
 import { PutObjectCommand, GetObjectCommand, S3Client } from '@aws-sdk/client-s3';
 import AdmZip from 'adm-zip';
 import chokidar from 'chokidar';
@@ -96,7 +96,7 @@ __export(compile_theme_exports, {
   compilePreviewRuntime: () => compilePreviewRuntime,
   compileStandaloneTheme: () => compileStandaloneTheme,
   compileStandaloneThemeDev: () => compileStandaloneThemeDev,
-  generateManifest: () => generateManifest2
+  generateManifest: () => generateManifest
 });
 async function resolveNodeModulesFile(startDir, relativePath) {
   let dir = startDir;
@@ -484,7 +484,7 @@ async function contentHashEntry(outputDir) {
       logger.warning("No entry file found in output, skipping content hash");
       return;
     }
-    const hash2 = crypto.createHash("sha256").update(entryContent).digest("hex").slice(0, 8);
+    const hash2 = crypto2.createHash("sha256").update(entryContent).digest("hex").slice(0, 8);
     const hashedName2 = `bundle-entry-${hash2}.js`;
     const indexMapPath = path8.join(outputDir, "index.js.map");
     const hashedMapName2 = `bundle-entry-${hash2}.js.map`;
@@ -502,7 +502,7 @@ async function contentHashEntry(outputDir) {
     logger.info(`Entry hashed: ${hashedName2}`);
     return;
   }
-  const hash = crypto.createHash("sha256").update(entryContent).digest("hex").slice(0, 8);
+  const hash = crypto2.createHash("sha256").update(entryContent).digest("hex").slice(0, 8);
   const hashedName = `bundle-entry-${hash}.js`;
   const hashedMapName = `bundle-entry-${hash}.js.map`;
   entryContent = entryContent.replace(
@@ -540,7 +540,7 @@ async function extractDataRequirements(themePath) {
   }
   return requirements;
 }
-async function generateManifest2(themeName, themePath, outputDir) {
+async function generateManifest(themeName, themePath, outputDir) {
   let version2 = "1.0.0";
   let themeId = themeName;
   try {
@@ -675,7 +675,7 @@ async function compileStandaloneTheme(themePath, themeName) {
     } catch {
     }
     await contentHashEntry(outputDir);
-    await generateManifest2(themeName, themePath, outputDir);
+    await generateManifest(themeName, themePath, outputDir);
     await generateThemeData(themePath, outputDir, themeName);
     if (result.metafile) {
       const outputs = result.metafile.outputs;
@@ -756,7 +756,7 @@ async function compileStandaloneThemeDev(themePath, themeName) {
   };
   const context2 = await esbuild.context(buildOptions);
   await context2.rebuild();
-  await generateManifest2(themeName, themePath, outputDir);
+  await generateManifest(themeName, themePath, outputDir);
   await generateThemeData(themePath, outputDir, themeName);
   return { context: context2, outputDir };
 }
@@ -1492,38 +1492,13 @@ async function initCommand(projectName, options = {}) {
   try {
     fs2.mkdirSync(projectPath, { recursive: true });
     await copyTemplate(template, projectPath, data);
-    const srcPath = path8.join(projectPath, "src");
-    fs2.mkdirSync(srcPath, { recursive: true });
-    const manifestContent = generateManifest(data);
-    await writeFile(path8.join(srcPath, "manifest.ts"), manifestContent);
-    const configContent = generateThemeConfig(data);
-    await writeFile(path8.join(srcPath, "config.ts"), configContent);
-    const layoutContent = generateThemeLayout(data);
-    await writeFile(path8.join(srcPath, "layout.ts"), layoutContent);
-    const indexContent = generateThemeIndex(data);
-    await writeFile(path8.join(srcPath, "index.ts"), indexContent);
-    const sectionsPath = path8.join(srcPath, "sections");
-    fs2.mkdirSync(sectionsPath, { recursive: true });
-    await writeFile(
-      path8.join(sectionsPath, "README.md"),
-      `# ${displayName} Sections
-
-Add your theme-specific sections here.
-`
-    );
-    const blocksPath = path8.join(srcPath, "blocks");
-    fs2.mkdirSync(blocksPath, { recursive: true });
-    await writeFile(
-      path8.join(blocksPath, "README.md"),
-      `# ${displayName} Blocks
-
-Add your theme-specific blocks here.
-`
+    await renameThemeInFiles(
+      projectPath,
+      name,
+      displayName,
+      description,
+      author
     );
-    const pagesPath = path8.join(srcPath, "pages");
-    fs2.mkdirSync(pagesPath, { recursive: true });
-    const homePageContent = generateHomePage(data);
-    await writeFile(path8.join(pagesPath, "home.ts"), homePageContent);
     logger.stopSpinner(true, "Project structure created!");
     if (options.git) {
       logger.startSpinner("Initializing git repository...");
@@ -1567,14 +1542,14 @@ Add your theme-specific blocks here.
     logger.log(`  npm run dev        # Start development mode`);
     logger.newLine();
     logger.section("Theme structure:");
-    logger.log("  src/manifest.ts    - Theme manifest and exports");
+    logger.log("  bundle-entry.ts    - Theme manifest and exports");
     logger.log(
-      "  src/config.ts      - Design tokens (colors, typography, etc.)"
+      "  theme.config.ts    - Design tokens (colors, typography, etc.)"
     );
-    logger.log("  src/layout.ts      - Header and footer configuration");
-    logger.log("  src/sections/      - Custom sections for your theme");
-    logger.log("  src/blocks/        - Reusable blocks");
-    logger.log("  src/pages/         - Page configurations");
+    logger.log("  theme.layout.ts    - Header and footer configuration");
+    logger.log("  sections/          - Custom sections for your theme");
+    logger.log("  pages/             - Page configurations");
+    logger.log("  CLAUDE.md          - AI assistant context");
     logger.newLine();
     logger.success(`Happy theming! \u{1F3A8}`);
   } catch (error) {
@@ -1588,231 +1563,33 @@ Add your theme-specific blocks here.
     process.exit(1);
   }
 }
-function generateManifest(data) {
-  return `import type { ThemeExport } from "@onexapis/core";
-
-/**
- * ${data.displayName} Theme Manifest
- * ${data.description}
- */
-export const manifest: ThemeExport = {
-  id: "${data.themeName}",
-  name: "${data.displayName}",
-  description: "${data.description}",
-  version: "1.0.0",
-  author: "${data.author}",
-
-  // Theme configuration
-  config: () => import("./config").then((m) => m.themeConfig),
-
-  // Theme layout (header/footer sections)
-  layout: () => import("./layout").then((m) => m.themeLayout),
-
-  // Available sections in this theme
-  sections: {
-    // Example: hero: () => import("./sections/hero").then((m) => m.heroSchema),
-  },
-
-  // Available blocks in this theme
-  blocks: {
-    // Example: productCard: () => import("./blocks/product-card").then((m) => m.productCardDefinition),
-  },
-
-  // Default pages
-  pages: {
-    home: () => import("./pages/home").then((m) => m.homePageConfig),
-  },
-
-  // Supported page types
-  supportedPageTypes: ["home", "about", "contact", "custom"],
-
-  // Preview image (optional)
-  preview: undefined,
-
-  // Tags for categorization (optional)
-  tags: ["custom"],
-};
-
-export default manifest;
-`;
-}
-function generateThemeConfig(data) {
-  return `import type { ThemeConfig } from "@onexapis/core";
-
-/**
- * ${data.displayName} Theme Configuration
- * Design tokens: colors, typography, spacing, etc.
- */
-export const themeConfig: ThemeConfig = {
-  // Color palette
-  colors: {
-    primary: {
-      50: "#eff6ff",
-      100: "#dbeafe",
-      200: "#bfdbfe",
-      300: "#93c5fd",
-      400: "#60a5fa",
-      500: "#3b82f6",
-      600: "#2563eb",
-      700: "#1d4ed8",
-      800: "#1e40af",
-      900: "#1e3a8a",
-    },
-    secondary: {
-      50: "#f8fafc",
-      100: "#f1f5f9",
-      200: "#e2e8f0",
-      300: "#cbd5e1",
-      400: "#94a3b8",
-      500: "#64748b",
-      600: "#475569",
-      700: "#334155",
-      800: "#1e293b",
-      900: "#0f172a",
-    },
-    accent: {
-      50: "#fdf4ff",
-      100: "#fae8ff",
-      200: "#f5d0fe",
-      300: "#f0abfc",
-      400: "#e879f9",
-      500: "#d946ef",
-      600: "#c026d3",
-      700: "#a21caf",
-      800: "#86198f",
-      900: "#701a75",
-    },
-  },
-
-  // Typography
-  typography: {
-    fontFamily: {
-      sans: ["Inter", "system-ui", "sans-serif"],
-      serif: ["Georgia", "serif"],
-      mono: ["Monaco", "monospace"],
-    },
-    fontSize: {
-      xs: "0.75rem",
-      sm: "0.875rem",
-      base: "1rem",
-      lg: "1.125rem",
-      xl: "1.25rem",
-      "2xl": "1.5rem",
-      "3xl": "1.875rem",
-      "4xl": "2.25rem",
-      "5xl": "3rem",
-    },
-  },
-
-  // Spacing
-  spacing: {
-    xs: "0.5rem",
-    sm: "1rem",
-    md: "1.5rem",
-    lg: "2rem",
-    xl: "3rem",
-    "2xl": "4rem",
-    "3xl": "6rem",
-    "4xl": "8rem",
-  },
-
-  // Border radius
-  borderRadius: {
-    none: "0",
-    sm: "0.125rem",
-    md: "0.375rem",
-    lg: "0.5rem",
-    xl: "0.75rem",
-    full: "9999px",
-  },
-
-  // Breakpoints
-  breakpoints: {
-    sm: "640px",
-    md: "768px",
-    lg: "1024px",
-    xl: "1280px",
-    "2xl": "1536px",
-  },
-};
-`;
-}
-function generateThemeLayout(data) {
-  return `import type { ThemeLayoutConfig } from "@onexapis/core";
-
-/**
- * ${data.themeName} Theme Layout
- * Define header and footer sections
- */
-export const themeLayout: ThemeLayoutConfig = {
-  // Header section configuration
-  header: undefined,
-  // Example:
-  // header: {
-  //   type: "header",
-  //   template: "default",
-  //   enabled: true,
-  //   settings: {},
-  // },
-
-  // Footer section configuration
-  footer: undefined,
-  // Example:
-  // footer: {
-  //   type: "footer",
-  //   template: "default",
-  //   enabled: true,
-  //   settings: {},
-  // },
-};
-`;
-}
-function generateThemeIndex(data) {
-  return `/**
- * ${data.themeNamePascal} Theme
- */
-
-export { manifest as ${data.themeNamePascal}Manifest } from "./manifest";
-export { themeConfig as ${data.themeNamePascal}Config } from "./config";
-export { themeLayout as ${data.themeNamePascal}Layout } from "./layout";
-`;
-}
-function generateHomePage(data) {
-  return `import type { PageConfig } from "@onexapis/core";
-
-/**
- * Home Page Configuration
- */
-export const homePageConfig: PageConfig = {
-  type: "home",
-  title: "${data.displayName}",
-  description: "Welcome to ${data.displayName}",
-
-  // SEO metadata
-  seo: {
-    title: "${data.displayName} - Home",
-    description: "Welcome to ${data.displayName}",
-    keywords: [],
-    ogImage: undefined,
-  },
-
-  // Page sections
-  sections: [
-    // Add your sections here
-    // Example:
-    // {
-    //   id: "hero-1",
-    //   type: "hero",
-    //   template: "default",
-    //   order: 0,
-    //   enabled: true,
-    //   settings: {},
-    //   components: [],
-    //   blocks: [],
-    // },
-  ],
-};
-`;
+async function renameThemeInFiles(projectPath, themeName, displayName, description, author) {
+  const configPath = path8.join(projectPath, "theme.config.ts");
+  if (fs2.existsSync(configPath)) {
+    let content = fs2.readFileSync(configPath, "utf-8");
+    content = content.replace(
+      /name: "My Simple Theme"/,
+      `name: "${displayName}"`
+    );
+    content = content.replace(
+      /description: ".*?"/,
+      `description: "${description}"`
+    );
+    fs2.writeFileSync(configPath, content, "utf-8");
+  }
+  const pkgPath = path8.join(projectPath, "package.json");
+  if (fs2.existsSync(pkgPath)) {
+    let content = fs2.readFileSync(pkgPath, "utf-8");
+    content = content.replace(
+      /@onex-themes\/my-simple/g,
+      `@onex-themes/${themeName}`
+    );
+    content = content.replace(
+      /"description": ".*?"/,
+      `"description": "${description}"`
+    );
+    fs2.writeFileSync(pkgPath, content, "utf-8");
+  }
 }
 
 // src/commands/create-section.ts
@@ -2768,6 +2545,79 @@ async function validateCommand(options) {
       }
     }
   }
+  if (fs.existsSync(sectionsDir)) {
+    const sections = fs.readdirSync(sectionsDir).filter(
+      (name) => fs.statSync(path8.join(sectionsDir, name)).isDirectory()
+    );
+    for (const sectionName of sections) {
+      const sectionPath = path8.join(sectionsDir, sectionName);
+      const tsxFiles = fs.readdirSync(sectionPath).filter((f) => f.endsWith(".tsx") && !f.endsWith(".schema.ts"));
+      for (const tsxFile of tsxFiles) {
+        const filePath = path8.join(sectionPath, tsxFile);
+        const content = fs.readFileSync(filePath, "utf-8");
+        const relPath = `sections/${sectionName}/${tsxFile}`;
+        if (!content.includes('"use client"') && !content.includes("'use client'")) {
+          issues.push({
+            type: "error",
+            file: relPath,
+            message: 'Missing "use client" directive at top of file'
+          });
+        }
+        if (!content.includes("ComponentRenderer") && !content.includes("BlockRenderer")) {
+          issues.push({
+            type: "warning",
+            file: relPath,
+            message: "No ComponentRenderer or BlockRenderer found \u2014 sections should use core renderers for content"
+          });
+        }
+        if (!content.includes("data-section-id")) {
+          issues.push({
+            type: "error",
+            file: relPath,
+            message: "Missing data-section-id attribute \u2014 editor cannot select this section"
+          });
+        }
+        if (/\beval\s*\(/.test(content)) {
+          issues.push({
+            type: "error",
+            file: relPath,
+            message: "eval() detected \u2014 arbitrary code execution risk"
+          });
+        }
+        if (content.includes("document.cookie")) {
+          issues.push({
+            type: "error",
+            file: relPath,
+            message: "document.cookie access \u2014 session hijacking risk"
+          });
+        }
+        if (/\brequire\s*\(/.test(content)) {
+          issues.push({
+            type: "warning",
+            file: relPath,
+            message: "require() detected \u2014 themes should use ES module imports"
+          });
+        }
+      }
+    }
+  }
+  const registryPath = path8.join(themePath, "sections-registry.ts");
+  const bundleEntryPath = path8.join(themePath, "bundle-entry.ts");
+  const registryContent = fs.existsSync(registryPath) ? fs.readFileSync(registryPath, "utf-8") : fs.existsSync(bundleEntryPath) ? fs.readFileSync(bundleEntryPath, "utf-8") : "";
+  if (fs.existsSync(sectionsDir) && registryContent) {
+    const sections = fs.readdirSync(sectionsDir).filter(
+      (name) => fs.statSync(path8.join(sectionsDir, name)).isDirectory()
+    );
+    for (const sectionName of sections) {
+      if (!registryContent.includes(`sections/${sectionName}`) && !registryContent.includes(`"${sectionName}"`)) {
+        issues.push({
+          type: "warning",
+          file: `sections/${sectionName}/`,
+          message: "Section not found in sections-registry.ts or bundle-entry.ts \u2014 may not be included in build"
+        });
+      }
+    }
+  }
   logger.stopSpinner(true, "Validation complete");
   const errors = issues.filter((i) => i.type === "error");
   const warnings = issues.filter((i) => i.type === "warning");
@@ -2880,7 +2730,7 @@ async function buildCommand(options) {
   logger.stopSpinner(true, "Lint passed");
   const pkgJson = fs.readJsonSync(packageJsonPath);
   const buildScript = pkgJson.scripts?.build || "";
-  const isRecursive = buildScript.includes("onexthm build") || buildScript.includes("onex-cli build");
+  const isRecursive = buildScript.includes("onexthm build") || buildScript.includes("onex build") || buildScript.includes("onex-cli build");
   logger.startSpinner(
     options.watch ? "Building (watch mode)..." : "Building..."
   );
@@ -2914,18 +2764,36 @@ function runCommand(command, args, cwd) {
   return new Promise((resolve) => {
     const proc = spawn(command, args, {
       cwd,
-      stdio: "pipe",
+      stdio: ["pipe", "pipe", "pipe"],
       shell: true
     });
-    let hasError = false;
+    let stdout = "";
+    let stderr = "";
+    proc.stdout.on("data", (data) => {
+      stdout += data.toString();
+    });
     proc.stderr.on("data", (data) => {
-      const message = data.toString();
-      if (message.includes("error") || message.includes("Error") || message.includes("ERROR")) {
-        hasError = true;
-      }
+      stderr += data.toString();
     });
     proc.on("close", (code) => {
-      resolve(code === 0 && !hasError);
+      if (code !== 0) {
+        const output = (stderr + stdout).trim();
+        if (output) {
+          logger.newLine();
+          for (const line of output.split("\n")) {
+            const t = line.trim();
+            if (!t) continue;
+            if (t.includes("error") || t.includes("Error") || t.includes("TS")) {
+              logger.log(`  \u274C ${t}`);
+            } else if (t.includes("warning") || t.includes("Warning")) {
+              logger.log(`  \u26A0\uFE0F  ${t}`);
+            } else {
+              logger.log(`     ${t}`);
+            }
+          }
+        }
+      }
+      resolve(code === 0);
     });
     proc.on("error", () => {
       resolve(false);
@@ -3139,7 +3007,7 @@ async function deployCommand(options) {
     if (options.environment) {
       formData.append("environment", options.environment);
     }
-    const response = await fetch(uploadEndpoint, {
+    const response = await fetch2(uploadEndpoint, {
       method: "POST",
       body: formData,
       headers: formData.getHeaders()
@@ -3220,7 +3088,7 @@ function getBucketName(env) {
     return process.env.BUCKET_NAME;
   }
   const environment = env || process.env.ENVIRONMENT || "staging";
-  return environment === "production" ? "onex-themes-prod" : "onex-themes-staging";
+  return environment === "production" ? "theme-s3-bucket" : "theme-s3-bucket";
 }
 async function findCompiledThemeDir(themeId, version2) {
   const searchPaths = [path8.resolve(process.cwd(), "dist")];
@@ -3336,7 +3204,7 @@ async function uploadCommand(options) {
     }
     spinner.succeed(`Found compiled theme at: ${compiledDir}`);
     spinner.start("Creating bundle.zip...");
-    const tmpDir = os.tmpdir();
+    const tmpDir = os3.tmpdir();
     const bundleZipPath = path8.join(tmpDir, `${themeId}-${version2}-bundle.zip`);
     await createZipFromDir(compiledDir, bundleZipPath);
     const bundleZipBuffer = await fs.readFile(bundleZipPath);
@@ -3489,7 +3357,7 @@ function getBucketName2(env) {
     return process.env.BUCKET_NAME;
   }
   const environment = env || process.env.ENVIRONMENT || "staging";
-  return environment === "production" ? "onex-themes-prod" : "onex-themes-staging";
+  return environment === "production" ? "theme-s3-bucket" : "theme-s3-bucket";
 }
 async function streamToString(stream) {
   const chunks = [];
@@ -3690,7 +3558,7 @@ function getBucketName3(env) {
     return process.env.BUCKET_NAME;
   }
   const environment = env || process.env.ENVIRONMENT || "staging";
-  return environment === "production" ? "onex-themes-prod" : "onex-themes-staging";
+  return environment === "production" ? "theme-s3-bucket" : "theme-s3-bucket";
 }
 async function streamToString2(stream) {
   const chunks = [];
@@ -3734,8 +3602,8 @@ function runInstall(cwd) {
   });
 }
 async function promptThemeName(originalName) {
-  const { default: inquirer6 } = await import('inquirer');
-  const { themeName } = await inquirer6.prompt([
+  const { default: inquirer7 } = await import('inquirer');
+  const { themeName } = await inquirer7.prompt([
     {
       type: "input",
       name: "themeName",
@@ -3888,7 +3756,7 @@ async function cloneCommand(themeName, options) {
         [
           "# API Configuration (enables real data in preview)",
           "# Get your Company ID from the OneX dashboard",
-          "NEXT_PUBLIC_API_URL=https://api-dev.onexeos.com",
+          "NEXT_PUBLIC_API_URL=https://platform-dev.onexeos.com",
           "NEXT_PUBLIC_COMPANY_ID=",
           ""
         ].join("\n")
@@ -4236,7 +4104,7 @@ async function devCommand(options) {
       logger.info(`File changed: ${filePath}`);
       try {
         await context2.rebuild();
-        await generateManifest2(themeName, themePath, outputDir);
+        await generateManifest(themeName, themePath, outputDir);
         server.broadcast({ type: "reload", timestamp: Date.now() });
         logger.success("Rebuilt successfully");
       } catch (error) {
@@ -4271,7 +4139,7 @@ async function devCommand(options) {
 
 // src/commands/config.ts
 init_logger();
-var CONFIG_DIR = path8.join(os.homedir(), ".onexthm");
+var CONFIG_DIR = path8.join(os3.homedir(), ".onexthm");
 var CONFIG_FILE = path8.join(CONFIG_DIR, ".env");
 var CONFIG_ENTRIES = [
   {
@@ -4301,7 +4169,7 @@ var CONFIG_ENTRIES = [
     key: "NEXT_PUBLIC_API_URL",
     label: "API URL",
     required: false,
-    defaultValue: "https://api-dev.onexeos.com"
+    defaultValue: "https://platform-dev.onexeos.com"
   },
   {
     key: "NEXT_PUBLIC_COMPANY_ID",
@@ -4412,6 +4280,461 @@ async function configCommand() {
   );
 }
 
+// src/commands/login.ts
+init_logger();
+var AUTH_DIR = path8.join(os3.homedir(), ".onexthm");
+var AUTH_FILE = path8.join(AUTH_DIR, "auth.json");
+function getApiUrl() {
+  return process.env.NEXT_PUBLIC_API_URL || process.env.ONEXTHM_API_URL || "https://platform-dev.onexeos.com";
+}
+async function saveAuthTokens(tokens) {
+  await fs.ensureDir(AUTH_DIR);
+  const key = getMachineKey();
+  const data = JSON.stringify(tokens);
+  const encrypted = encrypt(data, key);
+  await fs.writeFile(AUTH_FILE, encrypted, "utf-8");
+}
+function loadAuthTokens() {
+  try {
+    if (!fs.existsSync(AUTH_FILE)) return null;
+    const encrypted = fs.readFileSync(AUTH_FILE, "utf-8");
+    const key = getMachineKey();
+    const data = decrypt(encrypted, key);
+    return JSON.parse(data);
+  } catch {
+    return null;
+  }
+}
+async function clearAuthTokens() {
+  try {
+    await fs.remove(AUTH_FILE);
+  } catch {
+  }
+}
+function isTokenExpired(tokens) {
+  return Date.now() / 1e3 > tokens.expiresAt - 60;
+}
+async function getValidTokens() {
+  const tokens = loadAuthTokens();
+  if (!tokens) return null;
+  if (!isTokenExpired(tokens)) return tokens;
+  try {
+    const apiUrl = getApiUrl();
+    const response = await fetch(`${apiUrl}/auth/refresh`, {
+      method: "POST",
+      headers: { "Content-Type": "application/json" },
+      body: JSON.stringify({ refresh_token: tokens.refreshToken })
+    });
+    if (!response.ok) {
+      await clearAuthTokens();
+      return null;
+    }
+    const data = await response.json();
+    const body = data.statusCode ? data.body : data;
+    const refreshed = {
+      ...tokens,
+      accessToken: body.AccessToken || tokens.accessToken,
+      idToken: body.IdToken || tokens.idToken,
+      expiresAt: Math.floor(Date.now() / 1e3) + (body.ExpiresIn || 3600)
+    };
+    await saveAuthTokens(refreshed);
+    return refreshed;
+  } catch {
+    await clearAuthTokens();
+    return null;
+  }
+}
+async function authenticatedFetch(url, init) {
+  const tokens = await getValidTokens();
+  if (!tokens) {
+    throw new Error("Not logged in. Run: onexthm login");
+  }
+  const headers = new Headers(init?.headers);
+  headers.set("Authorization", `Bearer ${tokens.idToken}`);
+  headers.set("Content-Type", "application/json");
+  return fetch(url, { ...init, headers });
+}
+function getMachineKey() {
+  let seed;
+  if (process.platform === "darwin") {
+    seed = `onexthm:${os3.hostname()}:${os3.userInfo().username}`;
+  } else if (process.platform === "linux") {
+    try {
+      seed = `onexthm:${fs.readFileSync("/etc/machine-id", "utf-8").trim()}`;
+    } catch {
+      seed = `onexthm:${os3.hostname()}:${os3.userInfo().username}`;
+    }
+  } else {
+    seed = `onexthm:${os3.hostname()}:${os3.userInfo().username}`;
+  }
+  return crypto2.createHash("sha256").update(seed).digest();
+}
+function encrypt(text, key) {
+  const iv = crypto2.randomBytes(16);
+  const cipher = crypto2.createCipheriv("aes-256-gcm", key, iv);
+  let encrypted = cipher.update(text, "utf-8", "hex");
+  encrypted += cipher.final("hex");
+  const tag = cipher.getAuthTag();
+  return `${iv.toString("hex")}:${tag.toString("hex")}:${encrypted}`;
+}
+function decrypt(text, key) {
+  const [ivHex, tagHex, encrypted] = text.split(":");
+  const iv = Buffer.from(ivHex, "hex");
+  const tag = Buffer.from(tagHex, "hex");
+  const decipher = crypto2.createDecipheriv("aes-256-gcm", key, iv);
+  decipher.setAuthTag(tag);
+  let decrypted = decipher.update(encrypted, "hex", "utf-8");
+  decrypted += decipher.final("utf-8");
+  return decrypted;
+}
+function parseJwtClaims(idToken) {
+  try {
+    const payload = idToken.split(".")[1];
+    const decoded = Buffer.from(payload, "base64url").toString("utf-8");
+    return JSON.parse(decoded);
+  } catch {
+    return {};
+  }
+}
+
+// src/commands/login.ts
+async function loginCommand() {
+  logger.header("OneX Theme Developer Login");
+  const existing = loadAuthTokens();
+  if (existing) {
+    logger.info(`Already logged in as: ${existing.user.email}`);
+    const { relogin } = await inquirer.prompt([
+      {
+        type: "confirm",
+        name: "relogin",
+        message: "Re-login with different account?",
+        default: false
+      }
+    ]);
+    if (!relogin) return;
+  }
+  const { email, password } = await inquirer.prompt([
+    {
+      type: "input",
+      name: "email",
+      message: "Email:",
+      validate: (input) => input.includes("@") ? true : "Enter a valid email"
+    },
+    {
+      type: "password",
+      name: "password",
+      message: "Password:",
+      validate: (input) => input.length >= 6 ? true : "Password too short"
+    }
+  ]);
+  logger.startSpinner("Logging in...");
+  try {
+    const apiUrl = getApiUrl();
+    const response = await fetch(`${apiUrl}/auth/login`, {
+      method: "POST",
+      headers: { "Content-Type": "application/json" },
+      body: JSON.stringify({ username: email, password })
+    });
+    const raw = await response.json();
+    const data = raw.statusCode ? raw.body : raw;
+    if (!response.ok || data.error) {
+      logger.stopSpinner(false, "Login failed");
+      logger.error(data.message || data.error || "Invalid credentials");
+      process.exit(1);
+    }
+    const idToken = data.IdToken;
+    const accessToken = data.AccessToken;
+    const refreshToken = data.RefreshToken;
+    const expiresIn = data.ExpiresIn || 3600;
+    if (!idToken) {
+      logger.stopSpinner(false, "Login failed");
+      logger.error("No token received from server");
+      process.exit(1);
+    }
+    const claims = parseJwtClaims(idToken);
+    const tokens = {
+      accessToken,
+      idToken,
+      refreshToken,
+      expiresAt: Math.floor(Date.now() / 1e3) + expiresIn,
+      user: {
+        email: claims.email || email,
+        name: claims.name,
+        companyId: claims["custom:company_id"],
+        userId: claims.sub
+      }
+    };
+    await saveAuthTokens(tokens);
+    logger.stopSpinner(true, "Logged in!");
+    logger.newLine();
+    logger.info(`  Email:   ${tokens.user.email}`);
+    if (tokens.user.name) logger.info(`  Name:    ${tokens.user.name}`);
+    if (tokens.user.companyId)
+      logger.info(`  Company: ${tokens.user.companyId}`);
+    logger.newLine();
+    logger.success("Token stored securely in ~/.onexthm/auth.json (encrypted)");
+  } catch (error) {
+    logger.stopSpinner(false, "Login failed");
+    logger.error(error instanceof Error ? error.message : "Connection failed");
+    process.exit(1);
+  }
+}
+
+// src/commands/logout.ts
+init_logger();
+async function logoutCommand() {
+  const tokens = loadAuthTokens();
+  if (!tokens) {
+    logger.info("Not logged in.");
+    return;
+  }
+  await clearAuthTokens();
+  logger.success(`Logged out (was: ${tokens.user.email})`);
+}
+
+// src/commands/whoami.ts
+init_logger();
+async function whoamiCommand() {
+  const tokens = loadAuthTokens();
+  if (!tokens) {
+    logger.error("Not logged in. Run: onexthm login");
+    process.exit(1);
+  }
+  const expired = isTokenExpired(tokens);
+  logger.header("OneX Theme Developer");
+  logger.info(`  Email:    ${tokens.user.email}`);
+  if (tokens.user.name) logger.info(`  Name:     ${tokens.user.name}`);
+  if (tokens.user.companyId)
+    logger.info(`  Company:  ${tokens.user.companyId}`);
+  logger.info(
+    `  Status:   ${expired ? "\u26A0 Token expired (will auto-refresh)" : "\u2713 Active"}`
+  );
+}
+
+// src/commands/publish.ts
+init_logger();
+async function publishCommand(options) {
+  logger.header("OneX Theme Publish");
+  const tokens = await getValidTokens();
+  if (!tokens) {
+    logger.error("Not logged in. Run: onexthm login");
+    process.exit(1);
+  }
+  logger.info(`Logged in as: ${tokens.user.email}`);
+  let themePath;
+  if (options.theme) {
+    themePath = path8.resolve(options.theme);
+  } else {
+    const isThemeDir = [
+      "theme.config.ts",
+      "bundle-entry.ts",
+      "manifest.ts"
+    ].some((f) => fs.existsSync(path8.join(process.cwd(), f)));
+    if (isThemeDir) {
+      themePath = process.cwd();
+    } else {
+      logger.error(
+        "Not in a theme directory. Run from theme root or use --theme flag."
+      );
+      process.exit(1);
+    }
+  }
+  const pkgPath = path8.join(themePath, "package.json");
+  if (!fs.existsSync(pkgPath)) {
+    logger.error("No package.json found in theme directory");
+    process.exit(1);
+  }
+  const pkg = fs.readJsonSync(pkgPath);
+  const themeId = pkg.name?.replace("@onex-themes/", "") || path8.basename(themePath);
+  const version2 = pkg.version || "1.0.0";
+  logger.newLine();
+  logger.info(`Theme: ${themeId}`);
+  logger.info(`Version: ${version2}`);
+  logger.newLine();
+  const apiUrl = getApiUrl();
+  logger.startSpinner("Registering theme...");
+  try {
+    const regResponse = await authenticatedFetch(
+      `${apiUrl}/website-api/themes/register`,
+      {
+        method: "POST",
+        body: JSON.stringify({
+          themeId,
+          name: pkg.displayName || themeId,
+          description: pkg.description || "",
+          email: tokens.user.email
+        })
+      }
+    );
+    const regData = await regResponse.json();
+    const regBody = regData.statusCode ? regData.body : regData;
+    if (!regResponse.ok && regBody.error && !regBody.error.includes("already registered")) {
+      logger.stopSpinner(false, "Registration failed");
+      logger.error(regBody.error);
+      process.exit(1);
+    }
+    logger.stopSpinner(true, regBody.message || "Theme registered");
+  } catch (error) {
+    logger.stopSpinner(false, "Registration failed");
+    logger.error(error instanceof Error ? error.message : "Connection failed");
+    process.exit(1);
+  }
+  logger.startSpinner("Building theme...");
+  try {
+    const { execSync: execSync3 } = await import('child_process');
+    execSync3(
+      "npx tsup bundle-entry.ts --format esm --target es2020 --outDir dist",
+      {
+        cwd: themePath,
+        stdio: "ignore"
+      }
+    );
+    logger.stopSpinner(true, "Theme compiled");
+  } catch {
+    logger.stopSpinner(false, "Build failed");
+    logger.error("Run 'onexthm build' to see build errors");
+    process.exit(1);
+  }
+  logger.startSpinner("Getting upload URL...");
+  let bundleUploadUrl;
+  let sourceUploadUrl;
+  try {
+    const pubResponse = await authenticatedFetch(
+      `${apiUrl}/website-api/themes/${encodeURIComponent(themeId)}/versions`,
+      {
+        method: "POST",
+        body: JSON.stringify({ version: version2 })
+      }
+    );
+    const pubData = await pubResponse.json();
+    const pubBody = pubData.statusCode ? pubData.body : pubData;
+    if (!pubResponse.ok || !pubBody.bundleUploadUrl) {
+      logger.stopSpinner(false, "Failed to get upload URL");
+      logger.error(pubBody.error || "Server error");
+      process.exit(1);
+    }
+    bundleUploadUrl = pubBody.bundleUploadUrl;
+    sourceUploadUrl = pubBody.sourceUploadUrl;
+    logger.stopSpinner(true, "Upload URL obtained");
+  } catch (error) {
+    logger.stopSpinner(false, "Failed");
+    logger.error(error instanceof Error ? error.message : "Connection failed");
+    process.exit(1);
+  }
+  logger.startSpinner("Uploading bundle...");
+  try {
+    const archiver3 = await import('archiver');
+    const { createWriteStream } = await import('fs');
+    const distDir = path8.join(themePath, "dist");
+    if (!fs.existsSync(distDir)) {
+      logger.stopSpinner(false, "No dist/ directory");
+      logger.error("Build the theme first: onexthm build");
+      process.exit(1);
+    }
+    const bundleZipPath = path8.join(themePath, "dist", "bundle.zip");
+    await createZip(distDir, bundleZipPath, ["bundle.zip"]);
+    const bundleBuffer = fs.readFileSync(bundleZipPath);
+    const bundleRes = await fetch(bundleUploadUrl, {
+      method: "PUT",
+      headers: { "Content-Type": "application/zip" },
+      body: bundleBuffer
+    });
+    if (!bundleRes.ok) {
+      throw new Error(`Upload failed: ${bundleRes.status}`);
+    }
+    const sizeMB = (bundleBuffer.length / 1024 / 1024).toFixed(2);
+    logger.stopSpinner(true, `Bundle uploaded (${sizeMB} MB)`);
+  } catch (error) {
+    logger.stopSpinner(false, "Upload failed");
+    logger.error(error instanceof Error ? error.message : "Upload error");
+    process.exit(1);
+  }
+  logger.startSpinner("Uploading source...");
+  try {
+    const sourceZipPath = path8.join(themePath, "dist", "source.zip");
+    await createZip(themePath, sourceZipPath, [
+      "node_modules",
+      "dist",
+      ".git",
+      ".env",
+      ".env.local"
+    ]);
+    const sourceBuffer = fs.readFileSync(sourceZipPath);
+    const sourceRes = await fetch(sourceUploadUrl, {
+      method: "PUT",
+      headers: { "Content-Type": "application/zip" },
+      body: sourceBuffer
+    });
+    if (!sourceRes.ok) {
+      throw new Error(`Source upload failed: ${sourceRes.status}`);
+    }
+    const sizeMB = (sourceBuffer.length / 1024 / 1024).toFixed(2);
+    logger.stopSpinner(true, `Source uploaded (${sizeMB} MB)`);
+  } catch (error) {
+    logger.stopSpinner(false, "Source upload failed");
+    logger.info("Source upload skipped (bundle was uploaded successfully)");
+  }
+  logger.startSpinner("Scanning and publishing...");
+  try {
+    const confirmResponse = await authenticatedFetch(
+      `${apiUrl}/website-api/themes/${encodeURIComponent(themeId)}/versions/${encodeURIComponent(version2)}/confirm`,
+      { method: "POST" }
+    );
+    const confirmData = await confirmResponse.json();
+    const confirmBody = confirmData.statusCode ? confirmData.body : confirmData;
+    if (!confirmResponse.ok || !confirmBody.success) {
+      logger.stopSpinner(false, "Publishing failed");
+      if (confirmBody.violations) {
+        logger.error("Theme rejected \u2014 security violations found:");
+        for (const v of confirmBody.violations) {
+          logger.log(`  \u274C ${v.file}: ${v.violation}`);
+        }
+      } else {
+        logger.error(confirmBody.error || "Unknown error");
+      }
+      if (confirmBody.warnings?.length) {
+        logger.newLine();
+        logger.info("Warnings:");
+        for (const w of confirmBody.warnings) {
+          logger.log(`  \u26A0\uFE0F  ${w.file}: ${w.warning}`);
+        }
+      }
+      process.exit(1);
+    }
+    logger.stopSpinner(true, confirmBody.message || "Published!");
+    if (confirmBody.warnings?.length) {
+      logger.newLine();
+      logger.info("Warnings (non-blocking):");
+      for (const w of confirmBody.warnings) {
+        logger.log(`  \u26A0\uFE0F  ${w.file}: ${w.warning}`);
+      }
+    }
+  } catch (error) {
+    logger.stopSpinner(false, "Publishing failed");
+    logger.error(error instanceof Error ? error.message : "Connection failed");
+    process.exit(1);
+  }
+  logger.newLine();
+  logger.success(`\u2713 Theme "${themeId}" v${version2} published!`);
+}
+async function createZip(sourceDir, outputPath, exclude) {
+  const archiver3 = (await import('archiver')).default;
+  const { createWriteStream } = await import('fs');
+  return new Promise((resolve, reject) => {
+    const output = createWriteStream(outputPath);
+    const archive = archiver3("zip", { zlib: { level: 9 } });
+    output.on("close", resolve);
+    archive.on("error", reject);
+    archive.pipe(output);
+    archive.glob("**/*", {
+      cwd: sourceDir,
+      ignore: exclude.map((e) => `${e}/**`),
+      dot: false
+    });
+    archive.finalize();
+  });
+}
+
 // src/cli.ts
 try {
   const projectRoot = getProjectRoot();
@@ -4423,7 +4746,7 @@ try {
 } catch {
 }
 dotenv.config({
-  path: path8.join(os.homedir(), ".onexthm", ".env"),
+  path: path8.join(os3.homedir(), ".onexthm", ".env"),
   quiet: true
 });
 var require2 = createRequire(import.meta.url);
@@ -4480,6 +4803,10 @@ program.command("clone").description("Clone theme source code from S3").argument
   "staging"
 ).option("--no-install", "Skip running pnpm install after clone").action(cloneCommand);
 program.command("config").description("Configure OneX CLI credentials (AWS, API keys)").action(configCommand);
+program.command("login").description("Login to OneX platform").action(loginCommand);
+program.command("logout").description("Logout from OneX platform").action(logoutCommand);
+program.command("whoami").description("Show current logged-in developer").action(whoamiCommand);
+program.command("publish").description("Build, scan, and publish theme to marketplace (requires login)").option("-t, --theme <path>", "Theme directory path").action(publishCommand);
 program.configureOutput({
   writeErr: (str) => process.stderr.write(chalk4.red(str))
 });