sellify-cli 0.0.0-stage → 0.1.1

package/LICENSE

@@ -0,0 +1,21 @@
+MIT License
+
+Copyright (c) 2026 Debayan Ghosh
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+SOFTWARE.

package/README.md

@@ -1,3 +1,61 @@
-# Temporary Holding Version
+# sellify-cli
 
-This version is a temporary placeholder for this package. An operational version to replace this has been submitted for review and is awaiting a staged release.
+Command line for Sellify stores: build themes in your own editor with live sync, and call the GraphQL Admin API.
+
+```bash
+npm install -g sellify-cli     # or run any command with: npx sellify-cli <command>
+```
+
+Needs Node 20 or newer. No other dependencies.
+
+## Log in
+
+```bash
+sellify login                      # opens your browser; pick the store and click Allow
+sellify login --store mystore      # straight to that store
+sellify login --url https://admin.your-sellify-domain.com
+```
+
+Sign in to Sellify in the browser (password or Google), check the computer name and click **Allow**. The CLI receives its token directly from the browser (a one-off listener on `127.0.0.1` with PKCE), so you never see or copy it. It is saved in `~/.config/sellify/config.json`, readable only by you.
+
+A browser login acts as you, can only read and change themes, and needs **Online store** edit access. The store owner sees it under **Apps → Develop apps → Sellify CLI logins** and can sign it out there. Logging in again on the same computer replaces the old token. No browser (SSH)? Add `--no-browser` and open the printed link anywhere.
+
+**CI:** create a custom app with `read_themes` + `write_themes` and set `SELLIFY_STORE`, `SELLIFY_TOKEN` and `SELLIFY_URL` (or `sellify login --store <store> --token <sfat_…>`). Custom app tokens can also have other scopes for `sellify graphql`.
+
+## Themes
+
+```bash
+mkdir my-theme && cd my-theme
+sellify theme pull                  # download the live theme
+sellify theme dev                   # sync every save to a development theme, prints a preview link
+sellify theme push --unpublished    # upload as a new unpublished theme
+sellify theme push --theme <id>     # update an existing theme
+sellify theme publish --theme <id>  # make it live
+```
+
+| Command | What it does |
+| --- | --- |
+| `theme list` | Themes in the store, live theme first |
+| `theme pull [--theme <id>\|live] [--only <prefix>] [--nodelete]` | Download files; only changed files are written. Local theme files that no longer exist remotely are removed unless `--nodelete` |
+| `theme push [--theme <id>\|live] [--unpublished [--name]] [--publish] [--only <prefix>] [--nodelete]` | Upload changed files (compared by checksum) and delete remote files you removed, unless `--nodelete` |
+| `theme dev [--theme <id>]` | Push once, then watch the folder and upload each save. Uses a theme named `Development (<your computer>)` unless `--theme` is given |
+| `theme open [--theme <id>]` | Preview link and code editor link |
+| `theme publish --theme <id>` | Make a theme live |
+| `theme delete --theme <id> [--force]` | Delete an unpublished theme |
+
+Anything that changes the **live** theme asks first. Pass `--allow-live` to skip the question (for scripts).
+
+Every file is checked on upload like in the admin code editor (Liquid syntax, section schemas, JSON templates). Files with errors are reported and skipped; the rest are saved. Themes hold text files only: `.liquid`, `.json`, `.css`, `.js` and `.svg` in `layout/`, `templates/`, `sections/`, `snippets/`, `assets/`, `config/` and `locales/`.
+
+## Admin API
+
+```bash
+sellify graphql '{ shop { name } products(first: 5) { nodes { title } } }'
+sellify graphql --file query.graphql --variables '{"id":"gid://sellify/Product/…"}'
+```
+
+Rate limits are handled for you: throttled requests are retried after the `Retry-After` delay.
+
+## License
+
+MIT

package/bin/sellify.mjs

@@ -0,0 +1,567 @@
+#!/usr/bin/env node
+// Sellify CLI: develop themes locally (pull, push, live-sync with `theme dev`) and call the GraphQL Admin API.
+// No dependencies; needs Node 20+. Authenticates with a custom app access token (read_themes / write_themes).
+import { spawn } from "node:child_process";
+import { createHash, randomBytes } from "node:crypto";
+import { existsSync, mkdirSync, readdirSync, readFileSync, rmSync, statSync, watch, writeFileSync } from "node:fs";
+import { createServer } from "node:http";
+import { homedir, hostname } from "node:os";
+import { dirname, join, relative, resolve, sep } from "node:path";
+import { createInterface } from "node:readline/promises";
+import { parseArgs } from "node:util";
+
+const VERSION = JSON.parse(readFileSync(new URL("../package.json", import.meta.url), "utf8")).version;
+const API_VERSION = "2026-10";
+// The Sellify admin host. Point at your own deployment with --url or SELLIFY_URL.
+const DEFAULT_URL = "http://admin.localhost:3000";
+// Same rule as the server (lib/theme-code FILE_PATH_RE): which files a theme can hold. All are text.
+const THEME_PATH_RE =
+  /^(layout|templates|sections|snippets)\/[a-z0-9][a-z0-9_.-]{0,60}\.liquid$|^(templates|sections)\/[a-z0-9][a-z0-9_.-]{0,60}\.json$|^assets\/[a-z0-9][a-z0-9_.-]{0,60}\.(css|js|svg|json)$|^config\/settings_(schema|data)\.json$|^locales\/[a-z]{2}(-[a-z]{2})?(\.default)?(\.schema)?\.json$/;
+const THEME_DIRS = ["layout", "templates", "sections", "snippets", "assets", "config", "locales"];
+const BATCH_FILES = 25;
+const BATCH_BYTES = 2 * 1024 * 1024;
+
+// ---------- Output ----------
+
+const tty = process.stdout.isTTY && !process.env.NO_COLOR;
+const paint = (code) => (s) => (tty ? `\x1b[${code}m${s}\x1b[0m` : String(s));
+const c = { bold: paint(1), dim: paint(2), red: paint(31), green: paint(32), yellow: paint(33), cyan: paint(36) };
+const log = (...a) => console.log(...a);
+
+class CliError extends Error {}
+const fail = (msg) => {
+  throw new CliError(msg);
+};
+
+// ---------- Config (~/.config/sellify/config.json, readable only by you) ----------
+
+function configPath() {
+  if (process.env.SELLIFY_CONFIG_DIR) return join(process.env.SELLIFY_CONFIG_DIR, "config.json");
+  const base = process.platform === "win32" ? process.env.APPDATA || join(homedir(), "AppData", "Roaming") : process.env.XDG_CONFIG_HOME || join(homedir(), ".config");
+  return join(base, "sellify", "config.json");
+}
+
+function readConfig() {
+  try {
+    return JSON.parse(readFileSync(configPath(), "utf8"));
+  } catch {
+    return { current: null, stores: {} };
+  }
+}
+
+function writeConfig(cfg) {
+  const p = configPath();
+  mkdirSync(dirname(p), { recursive: true, mode: 0o700 });
+  writeFileSync(p, JSON.stringify(cfg, null, 2) + "\n", { mode: 0o600 });
+}
+
+/** The store, admin URL and token to use: flags, then SELLIFY_* env vars, then the saved login. */
+function session(flags) {
+  const cfg = readConfig();
+  const store = flags.store || process.env.SELLIFY_STORE || cfg.current;
+  const saved = (store && cfg.stores[store]) || {};
+  const token = process.env.SELLIFY_TOKEN || saved.token;
+  const url = (flags.url || process.env.SELLIFY_URL || saved.url || DEFAULT_URL).replace(/\/+$/, "");
+  if (!store || !token) fail(`Not logged in. Run ${c.bold("sellify login")} (or set SELLIFY_STORE and SELLIFY_TOKEN).`);
+  return { store, token, url };
+}
+
+// ---------- API ----------
+
+async function gql(s, query, variables = {}) {
+  for (let attempt = 0; ; attempt++) {
+    let res;
+    try {
+      res = await fetch(`${s.url}/api/admin/${API_VERSION}/graphql`, {
+        method: "POST",
+        headers: { "Content-Type": "application/json", "X-Sellify-Access-Token": s.token, "User-Agent": `sellify-cli/${VERSION}` },
+        body: JSON.stringify({ query, variables }),
+      });
+    } catch (e) {
+      fail(`Can't reach ${s.url} (${e.cause?.code ?? e.message}). Check --url.`);
+    }
+    if (res.status === 429 && attempt < 5) {
+      await new Promise((r) => setTimeout(r, Number(res.headers.get("retry-after") || 2) * 1000));
+      continue;
+    }
+    const body = await res.json().catch(() => null);
+    if (!body) fail(`Unexpected response from ${s.url} (HTTP ${res.status}).`);
+    if (res.status === 401) {
+      const reason = body.errors?.[0]?.message ?? "";
+      fail(reason.includes("sellify login") ? reason : "The access token was rejected. Run `sellify login` again.");
+    }
+    if (body.errors?.length) {
+      const e = body.errors[0];
+      fail(e.extensions?.code === "ACCESS_DENIED" ? `${e.message} Browser logins can use themes only; for other data log in with a custom app token (sellify login --store <store> --token <sfat_…>).` : e.message);
+    }
+    return body.data;
+  }
+}
+
+const userErrors = (payload) => {
+  if (payload.userErrors.length) fail(payload.userErrors.map((e) => e.message).join("\n"));
+};
+
+const THEME_FIELDS = "id name role previewUrl editorUrl updatedAt";
+
+const toGid = (id) => (id.startsWith("gid://") ? id : `gid://sellify/Theme/${id}`);
+const shortId = (gid) => gid.split("/").pop();
+
+/** The theme named by --theme (id, or "live"), or the live theme. */
+async function pickTheme(s, flags) {
+  if (flags.theme && flags.theme !== "live") {
+    const { theme } = await gql(s, `query($id: ID!) { theme(id: $id) { ${THEME_FIELDS} } }`, { id: toGid(flags.theme) });
+    if (!theme) fail(`Theme ${flags.theme} not found. Run \`sellify theme list\`.`);
+    return theme;
+  }
+  const { themes } = await gql(s, `{ themes { ${THEME_FIELDS} } }`);
+  const live = themes.find((t) => t.role === "MAIN");
+  if (!live) fail("This store has no live theme.");
+  return live;
+}
+
+async function remoteFiles(s, theme, withContent) {
+  const { theme: t } = await gql(s, `query($id: ID!) { theme(id: $id) { files { path checksum ${withContent ? "content" : ""} } } }`, { id: theme.id });
+  return t.files;
+}
+
+// ---------- Local files ----------
+
+const md5 = (text) => createHash("md5").update(text).digest("hex");
+const toPosix = (p) => p.split(sep).join("/");
+
+/** Theme files in a folder, keyed by theme path. Files a theme can't hold are reported, not uploaded. */
+function localFiles(root) {
+  const files = new Map();
+  const skipped = [];
+  for (const dir of THEME_DIRS) {
+    const full = join(root, dir);
+    if (!existsSync(full)) continue;
+    (function walk(d) {
+      for (const name of readdirSync(d)) {
+        if (name.startsWith(".")) continue;
+        const p = join(d, name);
+        if (statSync(p).isDirectory()) walk(p);
+        else {
+          const path = toPosix(relative(root, p));
+          if (THEME_PATH_RE.test(path)) files.set(path, readFileSync(p, "utf8"));
+          else skipped.push(path);
+        }
+      }
+    })(full);
+  }
+  return { files, skipped };
+}
+
+const themeRoot = (flags) => resolve(flags.path || ".");
+const looksLikeTheme = (root) => existsSync(join(root, "layout", "theme.liquid"));
+const twinOf = (p) => (p.endsWith(".json") ? p.replace(/\.json$/, ".liquid") : p.replace(/\.liquid$/, ".json"));
+
+// ---------- Upload ----------
+
+async function upload(s, theme, entries) {
+  let batch = [];
+  let bytes = 0;
+  let done = 0;
+  const errors = [];
+  const flush = async () => {
+    if (!batch.length) return;
+    const { themeFilesUpsert: r } = await gql(
+      s,
+      `mutation($themeId: ID!, $files: [ThemeFileInput!]!) { themeFilesUpsert(themeId: $themeId, files: $files) { upsertedPaths userErrors { message } } }`,
+      { themeId: theme.id, files: batch },
+    );
+    done += r.upsertedPaths.length;
+    errors.push(...r.userErrors.map((e) => e.message));
+    batch = [];
+    bytes = 0;
+  };
+  // Settings schema and section files first, so templates that use new sections validate.
+  const order = (p) => (p.startsWith("config/") ? 0 : p.startsWith("sections/") && p.endsWith(".liquid") ? 1 : p.startsWith("snippets/") ? 2 : 3);
+  for (const [path, content] of [...entries].sort((a, b) => order(a[0]) - order(b[0]) || a[0].localeCompare(b[0]))) {
+    const size = Buffer.byteLength(content);
+    if (batch.length >= BATCH_FILES || (batch.length && bytes + size > BATCH_BYTES)) await flush();
+    batch.push({ path, content });
+    bytes += size;
+  }
+  await flush();
+  return { done, errors };
+}
+
+async function removeRemote(s, theme, paths) {
+  if (!paths.length) return [];
+  const { themeFilesDelete: r } = await gql(s, `mutation($themeId: ID!, $paths: [String!]!) { themeFilesDelete(themeId: $themeId, paths: $paths) { deletedPaths userErrors { message } } }`, {
+    themeId: theme.id,
+    paths,
+  });
+  userErrors(r);
+  return r.deletedPaths;
+}
+
+async function confirm(question) {
+  if (!process.stdin.isTTY) return false;
+  const rl = createInterface({ input: process.stdin, output: process.stdout });
+  const answer = await rl.question(`${question} ${c.dim("(y/N)")} `);
+  rl.close();
+  return /^y(es)?$/i.test(answer.trim());
+}
+
+async function guardLive(theme, flags, action) {
+  if (theme.role !== "MAIN" || flags["allow-live"]) return;
+  if (await confirm(`${c.yellow("!")} ${c.bold(theme.name)} is your live theme — shoppers will see this ${action} immediately. Continue?`)) return;
+  fail("Stopped. Pass --allow-live to change the live theme without asking.");
+}
+
+// ---------- Commands ----------
+
+/** Opens the browser to approve this computer; the token comes back to a one-off listener on 127.0.0.1 (never shown). */
+async function browserLogin(url, store, open) {
+  const verifier = randomBytes(32).toString("base64url");
+  const state = randomBytes(24).toString("base64url");
+  let finish;
+  const done = new Promise((resolve, reject) => (finish = { resolve, reject }));
+  const server = createServer((req, res) => {
+    const q = new URL(req.url, "http://127.0.0.1").searchParams;
+    if (!req.url.startsWith("/callback") || q.get("state") !== state) {
+      res.writeHead(404).end();
+      return;
+    }
+    const ok = !!q.get("code");
+    // "connection: close" so the browser doesn't hold the listener open after this page.
+    res.writeHead(200, { "content-type": "text/html; charset=utf-8", connection: "close" }).end(
+      `<!doctype html><meta charset="utf-8"><title>Sellify CLI</title><body style="font:16px system-ui;display:grid;place-items:center;height:90vh;margin:0;background:#f5f5f5"><div style="background:#fff;padding:32px 40px;border-radius:12px;box-shadow:0 0 0 1px #0001;text-align:center"><h1 style="font-size:20px;margin:0 0 8px">${ok ? "You're logged in to Sellify CLI" : "Login cancelled"}</h1><p style="margin:0;color:#555">You can close this tab and return to your terminal.</p></div>`,
+    );
+    if (ok) finish.resolve({ code: q.get("code"), store: q.get("store") });
+    else finish.reject(new CliError("Login was cancelled in the browser."));
+  });
+  await new Promise((r) => server.listen(0, "127.0.0.1", r));
+  const params = new URLSearchParams({
+    port: String(server.address().port),
+    state,
+    code_challenge: createHash("sha256").update(verifier).digest("base64url"),
+    device: hostname().split(".")[0].slice(0, 40),
+    ...(store ? { store } : {}),
+  });
+  const link = `${url}/cli/authorize?${params}`;
+  log(`Opening your browser to log in…\n${c.dim("If it doesn't open, visit:")} ${link}`);
+  if (open) openBrowser(link);
+  const timer = setTimeout(() => finish.reject(new CliError("Timed out waiting for the browser (5 minutes). Run `sellify login` again.")), 5 * 60 * 1000);
+  try {
+    const { code, store: chosen } = await done;
+    let res;
+    try {
+      res = await fetch(`${url}/api/cli/token`, { method: "POST", headers: { "content-type": "application/json" }, body: JSON.stringify({ code, code_verifier: verifier }) });
+    } catch (e) {
+      fail(`Can't reach ${url} (${e.cause?.code ?? e.message}). Check --url.`);
+    }
+    const body = await res.json().catch(() => ({}));
+    if (!res.ok || !body.access_token) fail(body.error === "access_denied" ? "Your account needs Online store edit access on this store." : "The login couldn't be completed. Run `sellify login` again.");
+    return { store: chosen, token: body.access_token };
+  } finally {
+    clearTimeout(timer);
+    // Browsers keep idle connections (and preconnects) open; drop them so the CLI can exit.
+    server.closeAllConnections();
+    server.close();
+  }
+}
+
+function openBrowser(link) {
+  const [cmd, args] = process.platform === "darwin" ? ["open", [link]] : process.platform === "win32" ? ["cmd", ["/c", "start", "", link]] : ["xdg-open", [link]];
+  try {
+    spawn(cmd, args, { stdio: "ignore", detached: true }).on("error", () => {}).unref();
+  } catch {
+    // The link is printed as well.
+  }
+}
+
+async function login(flags) {
+  const url = (flags.url || process.env.SELLIFY_URL || DEFAULT_URL).replace(/\/+$/, "");
+  let store = flags.store || process.env.SELLIFY_STORE;
+  let token = flags.token || process.env.SELLIFY_TOKEN;
+  if (token) {
+    if (!store) fail("Usage: sellify login --store <store> --token <sfat_…>   (or just `sellify login` to log in with your browser)");
+    if (!token.startsWith("sfat_")) fail("That doesn't look like a Sellify access token (it starts with sfat_).");
+  } else {
+    ({ store, token } = await browserLogin(url, store, !flags["no-browser"]));
+  }
+  const { shop } = await gql({ store, token, url }, "{ shop { name myshopifyDomain } }");
+  const cfg = readConfig();
+  cfg.stores[store] = { url, token };
+  cfg.current = store;
+  writeConfig(cfg);
+  log(`${c.green("✓")} Logged in to ${c.bold(shop.name)} (${shop.myshopifyDomain}). Saved to ${c.dim(configPath())}`);
+}
+
+function logout(flags) {
+  const cfg = readConfig();
+  const store = flags.store || cfg.current;
+  if (!store || !cfg.stores[store]) return log("Not logged in.");
+  delete cfg.stores[store];
+  cfg.current = Object.keys(cfg.stores)[0] ?? null;
+  writeConfig(cfg);
+  log(`${c.green("✓")} Logged out of ${store}.`);
+}
+
+async function whoami(flags) {
+  const s = session(flags);
+  const { shop } = await gql(s, "{ shop { name myshopifyDomain url } }");
+  log(`${c.bold(shop.name)} ${c.dim(`(${s.store})`)}\n  Storefront  ${shop.url}\n  Admin API   ${s.url}`);
+}
+
+async function themeList(flags) {
+  const s = session(flags);
+  const { themes } = await gql(s, `{ themes { ${THEME_FIELDS} } }`);
+  const width = Math.max(...themes.map((t) => t.name.length), 4);
+  for (const t of themes) log(`${t.name.padEnd(width)}  ${t.role === "MAIN" ? c.green("[live]".padEnd(13)) : c.dim("[unpublished]")}  ${c.dim(shortId(t.id))}`);
+}
+
+async function themePull(flags) {
+  const s = session(flags);
+  const theme = await pickTheme(s, flags);
+  const root = themeRoot(flags);
+  const remote = await remoteFiles(s, theme, true);
+  const local = localFiles(root).files;
+  let written = 0;
+  for (const f of remote) {
+    if (flags.only && !f.path.startsWith(flags.only)) continue;
+    if (local.get(f.path) !== undefined && md5(local.get(f.path)) === f.checksum) continue;
+    const p = join(root, ...f.path.split("/"));
+    mkdirSync(dirname(p), { recursive: true });
+    writeFileSync(p, f.content);
+    written++;
+  }
+  const remotePaths = new Set(remote.map((f) => f.path));
+  const stale = [...local.keys()].filter((p) => !remotePaths.has(p) && (!flags.only || p.startsWith(flags.only)));
+  if (!flags.nodelete) for (const p of stale) rmSync(join(root, ...p.split("/")));
+  log(`${c.green("✓")} Pulled ${c.bold(theme.name)} into ${root}: ${written} file${written === 1 ? "" : "s"} updated, ${remote.length - written} unchanged${stale.length ? `, ${stale.length} ${flags.nodelete ? "local-only kept" : "removed"}` : ""}.`);
+}
+
+async function themePush(flags) {
+  const s = session(flags);
+  const root = themeRoot(flags);
+  if (!looksLikeTheme(root)) fail(`${root} isn't a theme folder (no layout/theme.liquid). Run \`sellify theme pull\` first or pass --path.`);
+  let theme;
+  if (flags.unpublished) {
+    const name = flags.name || `${root.split(sep).pop()} (pushed ${new Date().toISOString().slice(0, 10)})`;
+    const { themeCreate: r } = await gql(s, `mutation($name: String!) { themeCreate(name: $name) { theme { ${THEME_FIELDS} } userErrors { message } } }`, { name });
+    userErrors(r);
+    theme = r.theme;
+    log(`${c.green("✓")} Created unpublished theme ${c.bold(theme.name)}`);
+  } else {
+    theme = await pickTheme(s, flags);
+    await guardLive(theme, flags, "push");
+  }
+  const { files, skipped } = localFiles(root);
+  for (const p of skipped) log(`${c.yellow("skip")} ${p} ${c.dim("(themes can hold .liquid, .json, .css, .js and .svg files in the theme folders)")}`);
+  const remote = await remoteFiles(s, theme, false);
+  const sums = new Map(remote.map((f) => [f.path, f.checksum]));
+  const changed = [...files].filter(([path, content]) => (!flags.only || path.startsWith(flags.only)) && sums.get(path) !== md5(content));
+  const gone = flags.nodelete ? [] : remote.map((f) => f.path).filter((p) => !files.has(p) && (!flags.only || p.startsWith(flags.only)));
+  // A template is Liquid or JSON, never both: remove the old twin before uploading its replacement.
+  const twins = gone.filter((p) => p.startsWith("templates/") && changed.some(([path]) => path === twinOf(p)));
+  const deleted = await removeRemote(s, theme, twins);
+  const { done, errors } = await upload(s, theme, changed);
+  deleted.push(...(await removeRemote(s, theme, gone.filter((p) => !twins.includes(p)))));
+  for (const e of errors) log(`${c.red("✗")} ${e}`);
+  log(`${errors.length ? c.yellow("!") : c.green("✓")} Pushed to ${c.bold(theme.name)}: ${done} uploaded, ${files.size - changed.length} unchanged${deleted.length ? `, ${deleted.length} deleted` : ""}${errors.length ? `, ${errors.length} failed` : ""}.`);
+  if (flags.publish) await publish(s, theme, flags);
+  log(`  Preview  ${c.cyan(theme.previewUrl)}\n  Code     ${c.dim(theme.editorUrl)}`);
+  if (errors.length) process.exitCode = 1;
+}
+
+async function publish(s, theme, flags) {
+  if (theme.role === "MAIN") return log(`${theme.name} is already live.`);
+  if (!flags["allow-live"] && !(await confirm(`Publish ${c.bold(theme.name)}? It replaces your live theme.`))) fail("Stopped. Pass --allow-live to publish without asking.");
+  const { themePublish: r } = await gql(s, `mutation($id: ID!) { themePublish(id: $id) { theme { ${THEME_FIELDS} } userErrors { message } } }`, { id: theme.id });
+  userErrors(r);
+  log(`${c.green("✓")} ${c.bold(theme.name)} is now live.`);
+}
+
+async function themePublish(flags) {
+  const s = session(flags);
+  if (!flags.theme) fail("Usage: sellify theme publish --theme <id>");
+  await publish(s, await pickTheme(s, flags), flags);
+}
+
+async function themeDelete(flags) {
+  const s = session(flags);
+  if (!flags.theme || flags.theme === "live") fail("Usage: sellify theme delete --theme <id> (the live theme can't be deleted)");
+  const theme = await pickTheme(s, flags);
+  if (!flags.force && !(await confirm(`Delete ${c.bold(theme.name)}? This can't be undone.`))) fail("Stopped. Pass --force to delete without asking.");
+  const { themeDelete: r } = await gql(s, `mutation($id: ID!) { themeDelete(id: $id) { deletedId userErrors { message } } }`, { id: theme.id });
+  userErrors(r);
+  log(`${c.green("✓")} Deleted ${theme.name}.`);
+}
+
+async function themeOpen(flags) {
+  const s = session(flags);
+  const theme = await pickTheme(s, flags);
+  log(`${c.bold(theme.name)}\n  Preview  ${c.cyan(theme.previewUrl)}\n  Code     ${theme.editorUrl}`);
+}
+
+/** Uploads every save to a development theme (never the live one unless asked) and prints its preview link. */
+async function themeDev(flags) {
+  const s = session(flags);
+  const root = themeRoot(flags);
+  if (!looksLikeTheme(root)) fail(`${root} isn't a theme folder (no layout/theme.liquid). Run \`sellify theme pull\` first or pass --path.`);
+  let theme;
+  if (flags.theme) {
+    theme = await pickTheme(s, flags);
+    await guardLive(theme, flags, "sync");
+  } else {
+    const name = `Development (${hostname().split(".")[0]})`.slice(0, 60);
+    const { themes } = await gql(s, `{ themes { ${THEME_FIELDS} } }`);
+    theme = themes.find((t) => t.name === name && t.role !== "MAIN");
+    if (!theme) {
+      const { themeCreate: r } = await gql(s, `mutation($name: String!) { themeCreate(name: $name) { theme { ${THEME_FIELDS} } userErrors { message } } }`, { name });
+      userErrors(r);
+      theme = r.theme;
+    }
+  }
+  log(`${c.dim("Syncing")} ${root} ${c.dim("→")} ${c.bold(theme.name)}`);
+  await themePush({ ...flags, theme: shortId(theme.id), unpublished: false, publish: false, "allow-live": true });
+  log(`\n${c.green("●")} Watching for changes. Refresh the preview after saving. ${c.dim("Ctrl+C to stop.")}`);
+
+  const pending = new Set();
+  let timer = null;
+  let running = Promise.resolve();
+  const sync = async () => {
+    const paths = [...pending];
+    pending.clear();
+    const writes = [];
+    const deletes = [];
+    for (const path of paths) {
+      const p = join(root, ...path.split("/"));
+      if (existsSync(p) && statSync(p).isFile()) writes.push([path, readFileSync(p, "utf8")]);
+      else deletes.push(path);
+    }
+    const time = c.dim(new Date().toLocaleTimeString());
+    if (writes.length) {
+      const { done, errors } = await upload(s, theme, writes);
+      if (done) log(`${time} ${c.green("↑")} ${writes.map(([p]) => p).filter((p) => !errors.some((e) => e.startsWith(`${p}:`))).join(", ")}`);
+      for (const e of errors) log(`${time} ${c.red("✗")} ${e}`);
+    }
+    if (deletes.length) {
+      const deleted = await removeRemote(s, theme, deletes);
+      if (deleted.length) log(`${time} ${c.yellow("−")} ${deleted.join(", ")}`);
+    }
+  };
+  watch(root, { recursive: true }, (_event, file) => {
+    if (!file) return;
+    const path = toPosix(file);
+    if (!THEME_PATH_RE.test(path)) return;
+    pending.add(path);
+    clearTimeout(timer);
+    // Editors often write a file in several steps; wait for them to finish.
+    timer = setTimeout(() => {
+      running = running.then(sync).catch((e) => log(`${c.red("✗")} ${e.message}`));
+    }, 150);
+  });
+  await new Promise(() => {});
+}
+
+async function graphql(flags, positionals) {
+  const s = session(flags);
+  const query = flags.file ? readFileSync(flags.file, "utf8") : positionals[0];
+  if (!query) fail("Usage: sellify graphql '<query>' [--variables '<json>'] | sellify graphql --file query.graphql");
+  let variables = {};
+  if (flags.variables) {
+    try {
+      variables = JSON.parse(flags.variables);
+    } catch {
+      fail("--variables must be JSON.");
+    }
+  }
+  log(JSON.stringify(await gql(s, query, variables), null, 2));
+}
+
+// ---------- Entry ----------
+
+const HELP = `${c.bold("sellify")} ${VERSION} — Sellify command line
+
+${c.bold("Account")}
+  sellify login [--store <store>] [--url <admin url>]   Log in with your browser (no token to copy)
+  sellify login --store <store> --token <sfat_…>        Log in with a custom app token (CI)
+  sellify logout [--store <store>]
+  sellify whoami
+
+${c.bold("Themes")} (run inside a theme folder, or pass --path <dir>)
+  sellify theme list
+  sellify theme pull     [--theme <id>|live] [--only <prefix>] [--nodelete]
+  sellify theme push     [--theme <id>|live] [--unpublished [--name <name>]] [--publish] [--only <prefix>] [--nodelete]
+  sellify theme dev      [--theme <id>]      Sync every save to a development theme and print its preview link
+  sellify theme open     [--theme <id>]      Show preview and code editor links
+  sellify theme publish  --theme <id>
+  sellify theme delete   --theme <id> [--force]
+
+${c.bold("Admin API")}
+  sellify graphql '<query>' [--variables '<json>']
+  sellify graphql --file query.graphql
+
+${c.bold("Options")}
+  --store <store>   Which logged-in store to use (default: the last one)
+  --url <url>       Sellify admin URL (default ${DEFAULT_URL}, or SELLIFY_URL)
+  --allow-live      Change the live theme without asking
+  --no-browser      Print the login link instead of opening the browser
+  -v, --version     Print the version
+
+Environment: SELLIFY_STORE, SELLIFY_TOKEN and SELLIFY_URL work instead of \`sellify login\` (useful in CI).
+Changing the live theme always asks first unless --allow-live is passed.`;
+
+const OPTIONS = {
+  store: { type: "string" },
+  token: { type: "string" },
+  url: { type: "string" },
+  theme: { type: "string", short: "t" },
+  path: { type: "string" },
+  only: { type: "string" },
+  name: { type: "string" },
+  file: { type: "string", short: "f" },
+  variables: { type: "string" },
+  unpublished: { type: "boolean", short: "u" },
+  publish: { type: "boolean" },
+  nodelete: { type: "boolean" },
+  force: { type: "boolean" },
+  "allow-live": { type: "boolean" },
+  "no-browser": { type: "boolean" },
+  help: { type: "boolean", short: "h" },
+  version: { type: "boolean", short: "v" },
+};
+
+const COMMANDS = {
+  login: (f) => login(f),
+  logout: (f) => logout(f),
+  whoami: (f) => whoami(f),
+  graphql: (f, p) => graphql(f, p),
+  "theme list": (f) => themeList(f),
+  "theme pull": (f) => themePull(f),
+  "theme push": (f) => themePush(f),
+  "theme dev": (f) => themeDev(f),
+  "theme open": (f) => themeOpen(f),
+  "theme publish": (f) => themePublish(f),
+  "theme delete": (f) => themeDelete(f),
+};
+
+async function main() {
+  let parsed;
+  try {
+    parsed = parseArgs({ args: process.argv.slice(2), options: OPTIONS, allowPositionals: true });
+  } catch (e) {
+    fail(`${e.message}\nRun \`sellify --help\`.`);
+  }
+  const { values: flags, positionals } = parsed;
+  if (flags.version) return log(VERSION);
+  const [a, b, ...rest] = positionals;
+  const key = a === "theme" ? `theme ${b ?? ""}` : a;
+  if (flags.help || !a || !COMMANDS[key]) {
+    log(HELP);
+    if (a && !flags.help && !COMMANDS[key]) process.exitCode = 1;
+    return;
+  }
+  await COMMANDS[key](flags, a === "theme" ? rest : [b, ...rest].filter(Boolean));
+}
+
+main().catch((e) => {
+  console.error(`${c.red("Error:")} ${e instanceof CliError ? e.message : e.stack}`);
+  process.exit(1);
+});

package/package.json

@@ -1,6 +1,25 @@
 {
   "name": "sellify-cli",
-  "version": "0.0.0-stage",
-  "stub": true,
-  "description": "Temporary package placeholder for staged publishing"
-}
+  "version": "0.1.1",
+  "description": "Command line for Sellify: develop themes locally (pull, push, live sync) and call the GraphQL Admin API.",
+  "license": "MIT",
+  "type": "module",
+  "bin": {
+    "sellify": "bin/sellify.mjs"
+  },
+  "files": [
+    "bin",
+    "README.md",
+    "LICENSE"
+  ],
+  "engines": {
+    "node": ">=20"
+  },
+  "keywords": [
+    "sellify",
+    "ecommerce",
+    "liquid",
+    "theme",
+    "cli"
+  ]
+}