@onexapis/cli 1.1.44 → 1.1.46

package/dist/cli.mjs

@@ -18,7 +18,6 @@ import inquirer from 'inquirer';
 import archiver from 'archiver';
 import FormData from 'form-data';
 import fetch2 from 'node-fetch';
-import { PutObjectCommand, GetObjectCommand, S3Client } from '@aws-sdk/client-s3';
 import AdmZip from 'adm-zip';
 import chokidar from 'chokidar';
 import http from 'http';
@@ -2674,12 +2673,12 @@ async function validateCommand(options) {
     }
     themeToValidate = options.theme;
   } else {
-    const isThemeDir = [
+    const isThemeDir2 = [
       "theme.config.ts",
       "bundle-entry.ts",
       "manifest.ts"
     ].some((f) => fs.existsSync(path9.join(process.cwd(), f)));
-    if (isThemeDir) {
+    if (isThemeDir2) {
       themeToValidate = path9.basename(process.cwd());
       logger.info(`Validating current theme: ${themeToValidate}`);
     } else {
@@ -3071,12 +3070,12 @@ async function buildCommand(options) {
       process.exit(1);
     }
   } else {
-    const isThemeDir = [
+    const isThemeDir2 = [
       "theme.config.ts",
       "bundle-entry.ts",
       "manifest.ts"
     ].some((f) => fs.existsSync(path9.join(process.cwd(), f)));
-    if (isThemeDir) {
+    if (isThemeDir2) {
       themePath = process.cwd();
       themeName = path9.basename(themePath);
       logger.info(`Building current theme: ${themeName}`);
@@ -3207,12 +3206,12 @@ async function packageCommand(options) {
       process.exit(1);
     }
   } else {
-    const isThemeDir = [
+    const isThemeDir2 = [
       "theme.config.ts",
       "bundle-entry.ts",
       "manifest.ts"
     ].some((f) => fs.existsSync(path9.join(process.cwd(), f)));
-    if (isThemeDir) {
+    if (isThemeDir2) {
       themePath = process.cwd();
       themeName = path9.basename(themePath);
       logger.info(`Packaging current theme: ${themeName}`);
@@ -3443,343 +3442,94 @@ async function deployCommand(options) {
 
 // src/commands/upload.ts
 init_logger();
-function getS3Client() {
-  const adapterMode = (process.env.ADAPTER_MODE || "aws").trim().toLowerCase();
-  if (adapterMode === "vps") {
-    const endpoint = process.env.MINIO_ENDPOINT || "localhost:9000";
-    const secure = process.env.MINIO_SECURE === "true";
-    const endpointUrl = endpoint.startsWith("http") ? endpoint : `${secure ? "https" : "http"}://${endpoint}`;
-    return new S3Client({
-      endpoint: endpointUrl,
-      region: "us-east-1",
-      credentials: {
-        accessKeyId: process.env.MINIO_ACCESS_KEY || "minioadmin",
-        secretAccessKey: process.env.MINIO_SECRET_KEY || "minioadmin"
-      },
-      forcePathStyle: true
-    });
-  }
-  if (adapterMode === "local") {
-    return new S3Client({
-      endpoint: "http://localhost:4569",
-      region: "ap-southeast-1",
-      credentials: {
-        accessKeyId: "S3RVER",
-        secretAccessKey: "S3RVER"
-      },
-      forcePathStyle: true
-    });
-  }
-  return new S3Client({
-    region: process.env.AWS_REGION || "ap-southeast-1"
-  });
-}
-function getBucketName(env) {
-  if (process.env.BUCKET_NAME) {
-    return process.env.BUCKET_NAME;
-  }
-  const environment = env || process.env.ENVIRONMENT || "staging";
-  return environment === "production" ? "theme-s3-bucket" : "theme-s3-bucket";
-}
-async function findCompiledThemeDir(themeId, version2) {
-  const searchPaths = [path9.resolve(process.cwd(), "dist")];
-  for (const dir of searchPaths) {
-    if (await fs.pathExists(dir)) {
-      const hasManifest = await fs.pathExists(path9.join(dir, "manifest.json"));
-      const hasThemeEntry = await fs.pathExists(path9.join(dir, "bundle-entry.js")) || await fs.pathExists(path9.join(dir, "theme.config.js")) || await fs.pathExists(path9.join(dir, "index.js"));
-      if (hasManifest || hasThemeEntry) {
-        return dir;
-      }
-    }
-  }
-  return null;
-}
-async function readManifest() {
-  const manifestTsPath = path9.resolve(process.cwd(), "manifest.ts");
-  if (await fs.pathExists(manifestTsPath)) {
-    try {
-      const module = await import(manifestTsPath);
-      return module.default || module;
-    } catch (error) {
-      logger.warning("Failed to import manifest.ts, trying package.json");
-    }
-  }
-  const packageJsonPath = path9.resolve(process.cwd(), "package.json");
-  if (await fs.pathExists(packageJsonPath)) {
-    const pkg = await fs.readJson(packageJsonPath);
-    return {
-      themeId: pkg.name?.replace("@onex-themes/", "") || "unknown",
-      version: pkg.version || "1.0.0"
-    };
-  }
-  throw new Error(
-    "No manifest.ts or package.json found. Are you in a theme directory?"
+async function uploadCommand(_options) {
+  logger.header("Upload Theme to S3 \u2014 DEPRECATED");
+  console.log();
+  console.log(
+    chalk4.yellow.bold(
+      "`onexthm upload` is deprecated and no longer functional."
+    )
   );
-}
-async function createZipFromDir(sourceDir, outputPath, excludePatterns = []) {
-  return new Promise((resolve, reject) => {
-    const output = fs.createWriteStream(outputPath);
-    const archive = archiver("zip", { zlib: { level: 6 } });
-    output.on("close", () => resolve());
-    archive.on("error", (err) => reject(err));
-    archive.pipe(output);
-    archive.glob("**/*", {
-      cwd: sourceDir,
-      dot: true,
-      ignore: excludePatterns
-    });
-    archive.finalize();
-  });
-}
-async function findSourceDir(themeId, explicitDir) {
-  if (explicitDir) {
-    if (await fs.pathExists(explicitDir)) return explicitDir;
-    return null;
-  }
-  const searchPaths = [
-    process.cwd(),
-    path9.resolve(process.cwd(), `../../themes/${themeId}`),
-    path9.resolve(process.cwd(), `../themes/${themeId}`)
-  ];
-  const markers = ["theme.config.ts", "bundle-entry.ts"];
-  for (const dir of searchPaths) {
-    for (const marker of markers) {
-      if (await fs.pathExists(path9.join(dir, marker))) {
-        return dir;
-      }
-    }
-  }
-  return null;
-}
-async function updateLatestPointer(s3Client, bucket, themeId, version2) {
-  const latestData = {
-    version: version2,
-    uploadedAt: (/* @__PURE__ */ new Date()).toISOString()
-  };
-  await s3Client.send(
-    new PutObjectCommand({
-      Bucket: bucket,
-      Key: `themes/${themeId}/latest.json`,
-      Body: JSON.stringify(latestData, null, 2),
-      ContentType: "application/json"
-    })
+  console.log();
+  console.log(
+    "The platform no longer exposes themes via direct S3 access, so this"
   );
-}
-async function uploadCommand(options) {
-  logger.header("Upload Theme to S3");
-  const spinner = ora("Preparing theme upload...").start();
-  try {
-    let themeId;
-    let version2;
-    if (options.theme) {
-      themeId = options.theme;
-      version2 = options.version || "1.0.0";
-    } else {
-      const manifest = await readManifest();
-      themeId = manifest.themeId;
-      version2 = options.version || manifest.version || "1.0.0";
-    }
-    spinner.text = `Found theme: ${themeId}@${version2}`;
-    const bucket = options.bucket || getBucketName(options.environment);
-    const s3Client = getS3Client();
-    const compiledDir = await findCompiledThemeDir(themeId, version2);
-    if (!compiledDir) {
-      spinner.fail(
-        chalk4.red(
-          `Compiled theme not found for ${themeId}@${version2}. Run 'onexthm build' first.`
-        )
-      );
-      logger.info(chalk4.gray(`Expected location:
-  - ./dist/`));
-      process.exit(1);
-    }
-    spinner.succeed(`Found compiled theme at: ${compiledDir}`);
-    spinner.start("Creating bundle.zip...");
-    const tmpDir = os.tmpdir();
-    const bundleZipPath = path9.join(tmpDir, `${themeId}-${version2}-bundle.zip`);
-    await createZipFromDir(compiledDir, bundleZipPath);
-    const bundleZipBuffer = await fs.readFile(bundleZipPath);
-    const bundleSizeMB = (bundleZipBuffer.length / 1024 / 1024).toFixed(2);
-    spinner.succeed(`Created bundle.zip (${bundleSizeMB} MB)`);
-    if (options.dryRun) {
-      spinner.info(chalk4.yellow("Dry run mode \u2014 no files will be uploaded"));
-      console.log();
-      console.log(chalk4.gray(`  bundle.zip: ${bundleSizeMB} MB`));
-      console.log(
-        chalk4.cyan(
-          `  S3 path: s3://${bucket}/themes/${themeId}/${version2}/bundle.zip`
-        )
-      );
-      if (!options.skipSource) {
-        const sourceDir = await findSourceDir(themeId, options.sourceDir);
-        if (sourceDir) {
-          console.log(chalk4.gray(`  source dir: ${sourceDir}`));
-          console.log(
-            chalk4.cyan(
-              `  S3 path: s3://${bucket}/themes/${themeId}/${version2}/source.zip`
-            )
-          );
-        } else {
-          console.log(
-            chalk4.yellow("  source dir: not found (source.zip will be skipped)")
-          );
-        }
-      }
-      console.log();
-      await fs.remove(bundleZipPath);
-      return;
-    }
-    spinner.start("Uploading bundle.zip to S3...");
-    const bundleS3Key = `themes/${themeId}/${version2}/bundle.zip`;
-    await s3Client.send(
-      new PutObjectCommand({
-        Bucket: bucket,
-        Key: bundleS3Key,
-        Body: bundleZipBuffer,
-        ContentType: "application/zip"
-      })
-    );
-    spinner.succeed(
-      `Uploaded bundle.zip ${chalk4.gray(`\u2192 s3://${bucket}/${bundleS3Key}`)}`
-    );
-    await fs.remove(bundleZipPath);
-    let sourceUploaded = false;
-    if (!options.skipSource) {
-      spinner.start("Looking for source directory...");
-      const sourceDir = await findSourceDir(themeId, options.sourceDir);
-      if (sourceDir) {
-        spinner.succeed(`Found source at: ${sourceDir}`);
-        spinner.start("Creating source.zip...");
-        const sourceZipPath = path9.join(
-          tmpDir,
-          `${themeId}-${version2}-source.zip`
-        );
-        await createZipFromDir(sourceDir, sourceZipPath, [
-          "node_modules/**",
-          "dist/**",
-          ".git/**",
-          "*.zip",
-          ".next/**",
-          ".turbo/**"
-        ]);
-        const sourceZipBuffer = await fs.readFile(sourceZipPath);
-        const sourceSizeMB = (sourceZipBuffer.length / 1024 / 1024).toFixed(2);
-        spinner.succeed(`Created source.zip (${sourceSizeMB} MB)`);
-        spinner.start("Uploading source.zip to S3...");
-        const sourceS3Key = `themes/${themeId}/${version2}/source.zip`;
-        await s3Client.send(
-          new PutObjectCommand({
-            Bucket: bucket,
-            Key: sourceS3Key,
-            Body: sourceZipBuffer,
-            ContentType: "application/zip"
-          })
-        );
-        spinner.succeed(
-          `Uploaded source.zip ${chalk4.gray(`\u2192 s3://${bucket}/${sourceS3Key}`)}`
-        );
-        await fs.remove(sourceZipPath);
-        sourceUploaded = true;
-      } else {
-        spinner.warn(
-          chalk4.yellow("Source directory not found \u2014 skipping source.zip")
-        );
-      }
-    }
-    spinner.start("Updating latest.json pointer...");
-    await updateLatestPointer(s3Client, bucket, themeId, version2);
-    spinner.succeed("Updated latest.json pointer");
-    console.log();
-    logger.success(chalk4.green.bold("Theme uploaded successfully!"));
-    console.log();
-    console.log(
-      chalk4.cyan("   Theme:   ") + chalk4.white(`${themeId}@${version2}`)
-    );
-    console.log(chalk4.cyan("   Bucket:  ") + chalk4.white(bucket));
-    console.log(
-      chalk4.cyan("   Files:   ") + chalk4.white(`bundle.zip${sourceUploaded ? " + source.zip" : ""}`)
-    );
-    console.log(
-      chalk4.cyan("   Path:    ") + chalk4.gray(`s3://${bucket}/themes/${themeId}/${version2}/`)
-    );
-    console.log();
-  } catch (error) {
-    spinner.fail(chalk4.red(`Upload failed: ${error.message}`));
-    logger.error(error.stack || error.message);
-    process.exit(1);
-  }
+  console.log(
+    "command can no longer reach the bucket. Use `onexthm publish` instead:"
+  );
+  console.log();
+  console.log(chalk4.cyan("  cd themes/your-theme"));
+  console.log(chalk4.cyan("  onexthm login          # one-time, refreshes JWT"));
+  console.log(
+    chalk4.cyan("  onexthm publish        # builds + uploads + confirms")
+  );
+  console.log();
+  console.log(
+    "`publish` does everything this command did (build, version bump,"
+  );
+  console.log(
+    "bundle + source upload) plus content-hashed asset upload, security"
+  );
+  console.log("scanning, and atomic version registration in one step.");
+  console.log();
+  process.exit(1);
 }
 
 // src/commands/download.ts
 init_logger();
-function getS3Client2() {
-  const adapterMode = (process.env.ADAPTER_MODE || "aws").trim().toLowerCase();
-  if (adapterMode === "vps") {
-    const endpoint = process.env.MINIO_ENDPOINT || "localhost:9000";
-    const secure = process.env.MINIO_SECURE === "true";
-    const endpointUrl = endpoint.startsWith("http") ? endpoint : `${secure ? "https" : "http"}://${endpoint}`;
-    return new S3Client({
-      endpoint: endpointUrl,
-      region: "us-east-1",
-      credentials: {
-        accessKeyId: process.env.MINIO_ACCESS_KEY || "minioadmin",
-        secretAccessKey: process.env.MINIO_SECRET_KEY || "minioadmin"
-      },
-      forcePathStyle: true
-    });
+function unwrapEnvelope(raw) {
+  if (raw && typeof raw === "object" && "statusCode" in raw && "body" in raw) {
+    return raw.body;
   }
-  if (adapterMode === "local") {
-    return new S3Client({
-      endpoint: "http://localhost:4569",
-      region: "ap-southeast-1",
-      credentials: {
-        accessKeyId: "S3RVER",
-        secretAccessKey: "S3RVER"
-      },
-      forcePathStyle: true
-    });
-  }
-  return new S3Client({
-    region: process.env.AWS_REGION || "ap-southeast-1"
-  });
+  return raw;
 }
-function getBucketName2(env) {
-  if (process.env.BUCKET_NAME) {
-    return process.env.BUCKET_NAME;
+async function resolveLatestVersion(apiUrl, themeId) {
+  const url = `${apiUrl}/website-api/themes/${encodeURIComponent(themeId)}/versions`;
+  let response;
+  try {
+    response = await fetch(url, { cache: "no-store" });
+  } catch (err) {
+    throw new Error(
+      `Network error contacting ${url}: ${err instanceof Error ? err.message : "unknown"}`
+    );
   }
-  const environment = env || process.env.ENVIRONMENT || "staging";
-  return environment === "production" ? "theme-s3-bucket" : "theme-s3-bucket";
-}
-async function streamToString(stream) {
-  const chunks = [];
-  for await (const chunk of stream) {
-    chunks.push(Buffer.from(chunk));
+  if (!response.ok) {
+    throw new Error(
+      `Version lookup failed for "${themeId}" (HTTP ${response.status})`
+    );
   }
-  return Buffer.concat(chunks).toString("utf-8");
-}
-async function streamToBuffer(stream) {
-  const chunks = [];
-  for await (const chunk of stream) {
-    chunks.push(Buffer.from(chunk));
+  const raw = await response.json();
+  const data = unwrapEnvelope(raw);
+  const latest = data?.latest_version;
+  if (typeof latest !== "string" || latest.length === 0) {
+    throw new Error(
+      `Theme "${themeId}" has no published versions yet (no latest_version in response)`
+    );
   }
-  return Buffer.concat(chunks);
+  return latest;
 }
-async function resolveLatestVersion(s3Client, bucket, themeId) {
-  try {
-    const response = await s3Client.send(
-      new GetObjectCommand({
-        Bucket: bucket,
-        Key: `themes/${themeId}/latest.json`
-      })
-    );
-    const body = await streamToString(response.Body);
-    const data = JSON.parse(body);
-    return data.version;
-  } catch (error) {
+async function downloadBundleZip(apiUrl, themeId, version2) {
+  const url = `${apiUrl}/website-api/themes/${encodeURIComponent(themeId)}/${encodeURIComponent(version2)}/download`;
+  const response = await fetch(url);
+  if (!response.ok) {
     throw new Error(
-      `Failed to resolve latest version for theme "${themeId}": ${error.message}`
+      `Bundle download failed for "${themeId}@${version2}" (HTTP ${response.status})`
     );
   }
+  const contentType = response.headers.get("content-type") || "";
+  if (contentType.includes("application/json")) {
+    const raw = await response.json();
+    const envelope = raw && typeof raw === "object" && "statusCode" in raw ? raw : { body: raw };
+    const body = envelope.body;
+    if (typeof body !== "string") {
+      throw new Error(
+        "Unexpected /download response shape: expected base64 string in body"
+      );
+    }
+    return Buffer.from(body, "base64");
+  }
+  const arrayBuffer = await response.arrayBuffer();
+  return Buffer.from(arrayBuffer);
 }
 async function createCompatibilityFiles(outputDir, manifest) {
   const entryFile = manifest.output?.entry || "bundle-entry.js";
@@ -3803,47 +3553,58 @@ export * from './bundle-entry.js';
   const pkgJsonPath = path9.join(outputDir, "package.json");
   await fs.writeFile(pkgJsonPath, '{\n  "type": "module"\n}\n', "utf-8");
 }
-function showDownloadFailureHelp(themeId, bucket) {
+function showDownloadFailureHelp(themeId, apiUrl) {
   console.log();
   logger.error(chalk4.red.bold("Theme download failed"));
   console.log();
   console.log(chalk4.yellow("Possible reasons:"));
-  console.log(chalk4.gray("  1. Theme not uploaded to S3 yet"));
-  console.log(chalk4.gray("  2. AWS credentials not configured correctly"));
-  console.log(chalk4.gray("  3. Bucket name or region is incorrect"));
-  console.log(chalk4.gray("  4. bundle.zip is missing or corrupted"));
+  console.log(
+    chalk4.gray("  1. Theme has not been published yet (run `onexthm publish`)")
+  );
+  console.log(
+    chalk4.gray(
+      "  2. Theme ID is wrong (typo in --theme-id or THEME_ID env var)"
+    )
+  );
+  console.log(
+    chalk4.gray("  3. API base URL is wrong or the website-api is unreachable")
+  );
   console.log();
   console.log(chalk4.cyan.bold("To fix this:"));
   console.log();
-  console.log(chalk4.white("1. Compile and upload the theme:"));
-  console.log(chalk4.gray(`   cd themes/${themeId}`));
-  console.log(chalk4.gray("   pnpm build"));
-  console.log(chalk4.gray("   onexthm upload"));
-  console.log();
-  console.log(chalk4.white("2. Verify AWS credentials are set:"));
+  console.log(chalk4.white("1. Verify the theme is published:"));
   console.log(
-    chalk4.gray("   - Set AWS_ACCESS_KEY_ID and AWS_SECRET_ACCESS_KEY")
+    chalk4.gray(
+      `   curl -s ${apiUrl}/website-api/themes/${themeId}/versions | jq .latest_version`
+    )
   );
-  console.log(chalk4.gray("   - Or use AWS_PROFILE=your-profile"));
-  console.log(chalk4.gray("   - Set AWS_REGION (e.g., ap-southeast-1)"));
   console.log();
-  console.log(chalk4.white("3. Check bucket configuration:"));
-  console.log(chalk4.gray(`   Current bucket: ${bucket}`));
+  console.log(chalk4.white("2. Check API URL configuration:"));
+  console.log(chalk4.gray(`   Current API URL: ${apiUrl}`));
   console.log(
-    chalk4.gray("   Set BUCKET_NAME environment variable if different")
+    chalk4.gray("   Override with NEXT_PUBLIC_API_URL or ONEXTHM_API_URL")
   );
   console.log();
-  console.log(chalk4.white("4. Verify theme exists in S3:"));
-  console.log(chalk4.gray(`   aws s3 ls s3://${bucket}/themes/${themeId}/`));
+  console.log(chalk4.white("3. Pin a specific version (CI/production):"));
+  console.log(
+    chalk4.gray(`   THEME_VERSION=1.2.3 onexthm download --theme-id ${themeId}`)
+  );
   console.log();
 }
 async function downloadCommand(options) {
-  logger.header("Download Theme from S3");
+  logger.header("Download Theme");
   const spinner = ora("Initializing download...").start();
+  if (options.bucket || options.environment) {
+    spinner.stop();
+    logger.warning(
+      "--bucket and --environment are deprecated and ignored. Themes are now served via HTTP from the website-api Lambda."
+    );
+    spinner.start();
+  }
+  const apiUrl = getApiUrl();
   try {
     const themeId = options.themeId || process.env.NEXT_PUBLIC_THEME_ID || process.env.THEME_ID;
-    const version2 = options.version || process.env.THEME_VERSION || "latest";
-    const bucket = options.bucket || getBucketName2(options.environment);
+    const requestedVersion = options.version || process.env.THEME_VERSION || "latest";
     const outputDir = options.output || "./active-theme";
     if (!themeId) {
       spinner.fail(
@@ -3853,12 +3614,10 @@ async function downloadCommand(options) {
       );
       process.exit(1);
     }
-    spinner.text = `Downloading ${themeId}@${version2} from ${bucket}...`;
-    const s3Client = getS3Client2();
-    let resolvedVersion = version2;
-    if (version2 === "latest") {
-      spinner.text = "Resolving latest version...";
-      resolvedVersion = await resolveLatestVersion(s3Client, bucket, themeId);
+    spinner.text = `Resolving ${themeId}@${requestedVersion}...`;
+    let resolvedVersion = requestedVersion;
+    if (requestedVersion === "latest") {
+      resolvedVersion = await resolveLatestVersion(apiUrl, themeId);
       spinner.succeed(
         `Resolved latest version: ${chalk4.cyan(resolvedVersion)}`
       );
@@ -3868,24 +3627,19 @@ async function downloadCommand(options) {
           chalk4.yellow(
             `
   Warning: Resolved "latest" to ${resolvedVersion} in CI environment.
-  For production builds, pin to a specific version:
+  For reproducible builds, pin to a specific version:
     THEME_VERSION=${resolvedVersion}
 `
           )
         );
       }
+    } else {
+      spinner.succeed(`Using version: ${chalk4.cyan(resolvedVersion)}`);
     }
     spinner.start(
       `Downloading bundle.zip for ${themeId}@${resolvedVersion}...`
     );
-    const s3Key = `themes/${themeId}/${resolvedVersion}/bundle.zip`;
-    const response = await s3Client.send(
-      new GetObjectCommand({
-        Bucket: bucket,
-        Key: s3Key
-      })
-    );
-    const zipBuffer = await streamToBuffer(response.Body);
+    const zipBuffer = await downloadBundleZip(apiUrl, themeId, resolvedVersion);
     const sizeMB = (zipBuffer.length / 1024 / 1024).toFixed(2);
     spinner.succeed(`Downloaded bundle.zip (${sizeMB} MB)`);
     spinner.start("Extracting bundle...");
@@ -3904,7 +3658,7 @@ async function downloadCommand(options) {
     console.log(
       chalk4.cyan("   Theme:   ") + chalk4.white(`${themeId}@${resolvedVersion}`)
     );
-    console.log(chalk4.cyan("   Bucket:  ") + chalk4.white(bucket));
+    console.log(chalk4.cyan("   Source:  ") + chalk4.white(apiUrl));
     console.log(chalk4.cyan("   Output:  ") + chalk4.white(outputDir));
     console.log(chalk4.cyan("   Files:   ") + chalk4.white(entries.length));
     if (manifest.counts) {
@@ -3916,82 +3670,70 @@ async function downloadCommand(options) {
   } catch (error) {
     spinner.fail(chalk4.red("Download failed"));
     logger.error(error.message);
-    const themeId = options.themeId || process.env.NEXT_PUBLIC_THEME_ID || "unknown";
-    const bucket = options.bucket || getBucketName2(options.environment);
-    showDownloadFailureHelp(themeId, bucket);
+    const themeId = options.themeId || process.env.NEXT_PUBLIC_THEME_ID || process.env.THEME_ID || "unknown";
+    showDownloadFailureHelp(themeId, apiUrl);
     process.exit(1);
   }
 }
 
 // src/commands/clone.ts
 init_logger();
-function getS3Client3() {
-  const adapterMode = (process.env.ADAPTER_MODE || "aws").trim().toLowerCase();
-  if (adapterMode === "vps") {
-    const endpoint = process.env.MINIO_ENDPOINT || "localhost:9000";
-    const secure = process.env.MINIO_SECURE === "true";
-    const endpointUrl = endpoint.startsWith("http") ? endpoint : `${secure ? "https" : "http"}://${endpoint}`;
-    return new S3Client({
-      endpoint: endpointUrl,
-      region: "us-east-1",
-      credentials: {
-        accessKeyId: process.env.MINIO_ACCESS_KEY || "minioadmin",
-        secretAccessKey: process.env.MINIO_SECRET_KEY || "minioadmin"
-      },
-      forcePathStyle: true
-    });
-  }
-  if (adapterMode === "local") {
-    return new S3Client({
-      endpoint: "http://localhost:4569",
-      region: "ap-southeast-1",
-      credentials: {
-        accessKeyId: "S3RVER",
-        secretAccessKey: "S3RVER"
-      },
-      forcePathStyle: true
-    });
+function unwrapEnvelope2(raw) {
+  if (raw && typeof raw === "object" && "statusCode" in raw && "body" in raw) {
+    return raw.body;
   }
-  return new S3Client({
-    region: process.env.AWS_REGION || "ap-southeast-1"
-  });
+  return raw;
 }
-function getBucketName3(env) {
-  if (process.env.BUCKET_NAME) {
-    return process.env.BUCKET_NAME;
+async function resolveLatestVersion2(apiUrl, themeId) {
+  const url = `${apiUrl}/website-api/themes/${encodeURIComponent(themeId)}/versions`;
+  const response = await fetch(url, { cache: "no-store" });
+  if (!response.ok) {
+    throw new Error(
+      `Version lookup failed for "${themeId}" (HTTP ${response.status})`
+    );
   }
-  const environment = env || process.env.ENVIRONMENT || "staging";
-  return environment === "production" ? "theme-s3-bucket" : "theme-s3-bucket";
-}
-async function streamToString2(stream) {
-  const chunks = [];
-  for await (const chunk of stream) {
-    chunks.push(Buffer.from(chunk));
+  const raw = await response.json();
+  const data = unwrapEnvelope2(raw);
+  const latest = data?.latest_version;
+  if (typeof latest !== "string" || latest.length === 0) {
+    throw new Error(`Theme "${themeId}" has no published versions yet`);
   }
-  return Buffer.concat(chunks).toString("utf-8");
+  return latest;
 }
-async function streamToBuffer2(stream) {
-  const chunks = [];
-  for await (const chunk of stream) {
-    chunks.push(Buffer.from(chunk));
-  }
-  return Buffer.concat(chunks);
-}
-async function resolveLatestVersion2(s3Client, bucket, themeId) {
-  try {
-    const response = await s3Client.send(
-      new GetObjectCommand({
-        Bucket: bucket,
-        Key: `themes/${themeId}/latest.json`
-      })
+async function fetchSourceZip(apiUrl, themeId, version2) {
+  const url = `${apiUrl}/website-api/themes/${encodeURIComponent(themeId)}/source?version=${encodeURIComponent(version2)}`;
+  const response = await authenticatedFetch(url, {
+    method: "GET"
+  });
+  if (!response.ok) {
+    if (response.status === 404) {
+      throw new Error(
+        `Source not found for ${themeId}@${version2}. The theme may not have been published with source upload enabled.`
+      );
+    }
+    if (response.status === 401 || response.status === 403) {
+      throw new Error(
+        `Not authorized to download source for "${themeId}". Run \`onexthm login\` first.`
+      );
+    }
+    throw new Error(
+      `Source URL request failed for "${themeId}@${version2}" (HTTP ${response.status})`
     );
-    const body = await streamToString2(response.Body);
-    return JSON.parse(body).version;
-  } catch (error) {
+  }
+  const raw = await response.json();
+  const data = unwrapEnvelope2(raw);
+  const presignedUrl = data?.download_url;
+  if (typeof presignedUrl !== "string" || presignedUrl.length === 0) {
+    throw new Error("Unexpected /source response shape: missing download_url");
+  }
+  const zipResponse = await fetch(presignedUrl);
+  if (!zipResponse.ok) {
     throw new Error(
-      `Failed to resolve latest version for theme "${themeId}": ${error.message}`
+      `Presigned source download failed (HTTP ${zipResponse.status})`
     );
   }
+  const arrayBuffer = await zipResponse.arrayBuffer();
+  return Buffer.from(arrayBuffer);
 }
 function runInstall(cwd) {
   return new Promise((resolve) => {
@@ -4005,8 +3747,8 @@ function runInstall(cwd) {
   });
 }
 async function promptThemeName(originalName) {
-  const { default: inquirer7 } = await import('inquirer');
-  const { themeName } = await inquirer7.prompt([
+  const { default: inquirer8 } = await import('inquirer');
+  const { themeName } = await inquirer8.prompt([
     {
       type: "input",
       name: "themeName",
@@ -4090,15 +3832,24 @@ async function renameTheme(themeDir, oldName, newName) {
 }
 async function cloneCommand(themeName, options) {
   logger.header("Clone Theme Source");
+  if (options.bucket || options.environment) {
+    logger.warning(
+      "--bucket and --environment are deprecated and ignored. Source is now fetched via HTTP from the website-api Lambda."
+    );
+  }
+  const tokens = await getValidTokens();
+  if (!tokens) {
+    logger.error("Not logged in. Run: onexthm login");
+    process.exit(1);
+  }
   let newName = options.name;
   if (!newName) {
     newName = await promptThemeName(themeName);
   }
   const spinner = ora("Initializing clone...").start();
   try {
-    const bucket = options.bucket || getBucketName3(options.environment);
+    const apiUrl = getApiUrl();
     const outputDir = options.output || path9.resolve(process.cwd(), newName);
-    const s3Client = getS3Client3();
     if (await fs.pathExists(outputDir)) {
       spinner.fail(chalk4.red(`Directory already exists: ${outputDir}`));
       logger.info(
@@ -4111,28 +3862,20 @@ async function cloneCommand(themeName, options) {
     let version2 = options.version || "latest";
     if (version2 === "latest") {
       spinner.text = "Resolving latest version...";
-      version2 = await resolveLatestVersion2(s3Client, bucket, themeName);
+      version2 = await resolveLatestVersion2(apiUrl, themeName);
       spinner.succeed(`Resolved latest version: ${chalk4.cyan(version2)}`);
     }
     spinner.start(`Downloading source.zip for ${themeName}@${version2}...`);
-    const s3Key = `themes/${themeName}/${version2}/source.zip`;
     let zipBuffer;
     try {
-      const response = await s3Client.send(
-        new GetObjectCommand({
-          Bucket: bucket,
-          Key: s3Key
-        })
-      );
-      zipBuffer = await streamToBuffer2(response.Body);
+      zipBuffer = await fetchSourceZip(apiUrl, themeName, version2);
     } catch (error) {
-      spinner.fail(chalk4.red(`Source not found: s3://${bucket}/${s3Key}`));
+      spinner.fail(chalk4.red(error.message));
       console.log();
       console.log(
-        chalk4.yellow("The theme source may not have been uploaded yet.")
-      );
-      console.log(
-        chalk4.gray(`Upload source with: onexthm upload --theme ${themeName}`)
+        chalk4.gray(
+          `Verify the theme is published: curl -s ${apiUrl}/website-api/themes/${themeName}/versions`
+        )
       );
       console.log();
       process.exit(1);
@@ -4315,10 +4058,7 @@ function createDevServer(options) {
         return;
       }
       if (segments.length > 1) {
-        const fallbackPath = path9.join(
-          assetsBase,
-          segments.slice(1).join("/")
-        );
+        const fallbackPath = path9.join(assetsBase, segments.slice(1).join("/"));
         if (fallbackPath.startsWith(assetsBase) && fs3.existsSync(fallbackPath)) {
           serveFile(res, fallbackPath);
           return;
@@ -4485,12 +4225,12 @@ async function devCommand(options) {
       process.exit(1);
     }
   } else {
-    const isThemeDir = [
+    const isThemeDir2 = [
       "theme.config.ts",
       "bundle-entry.ts",
       "manifest.ts"
     ].some((f) => fs.existsSync(path9.join(process.cwd(), f)));
-    if (isThemeDir) {
+    if (isThemeDir2) {
       themePath = process.cwd();
       themeName = path9.basename(themePath);
     } else {
@@ -4918,12 +4658,12 @@ async function publishCommand(options) {
   if (options.theme) {
     themePath = path9.resolve(options.theme);
   } else {
-    const isThemeDir = [
+    const isThemeDir2 = [
       "theme.config.ts",
       "bundle-entry.ts",
       "manifest.ts"
     ].some((f) => fs.existsSync(path9.join(process.cwd(), f)));
-    if (isThemeDir) {
+    if (isThemeDir2) {
       themePath = process.cwd();
     } else {
       logger.error(
@@ -5256,11 +4996,11 @@ Or use the --bump flag:
   logger.success(`\u2713 Theme "${themeId}" v${version2} published!`);
 }
 async function createZip(sourceDir, outputPath, exclude) {
-  const archiver3 = (await import('archiver')).default;
+  const archiver2 = (await import('archiver')).default;
   const { createWriteStream } = await import('fs');
   return new Promise((resolve, reject) => {
     const output = createWriteStream(outputPath);
-    const archive = archiver3("zip", { zlib: { level: 9 } });
+    const archive = archiver2("zip", { zlib: { level: 9 } });
     output.on("close", resolve);
     archive.on("error", reject);
     archive.pipe(output);
@@ -5273,6 +5013,210 @@ async function createZip(sourceDir, outputPath, exclude) {
   });
 }
 
+// src/commands/mcp.ts
+init_logger();
+var AI_CONTEXT_FILES = [
+  "CLAUDE.md",
+  "AGENTS.md",
+  ".cursorrules",
+  "THEME_REFERENCE.md",
+  ".mcp.json"
+];
+function resolveTargetDir(opts) {
+  return path9.resolve(opts.cwd ?? process.cwd());
+}
+function resolveDefaultTemplateDir() {
+  return path9.join(getTemplatesDir(), "default");
+}
+function isThemeDir(dir) {
+  return fs.existsSync(path9.join(dir, "theme.config.ts")) || fs.existsSync(path9.join(dir, "theme.config.js"));
+}
+function inspectFiles(templateDir, targetDir) {
+  return AI_CONTEXT_FILES.map((name) => {
+    const templatePath = path9.join(templateDir, name);
+    const targetPath = path9.join(targetDir, name);
+    const exists = fs.existsSync(targetPath);
+    let identical = false;
+    if (exists && fs.existsSync(templatePath)) {
+      try {
+        const a = fs.readFileSync(templatePath, "utf-8");
+        const b = fs.readFileSync(targetPath, "utf-8");
+        identical = a.replace(/\r\n/g, "\n") === b.replace(/\r\n/g, "\n");
+      } catch {
+        identical = false;
+      }
+    }
+    return { name, templatePath, targetPath, exists, identical };
+  });
+}
+async function mcpSetupCommand(options = {}) {
+  const targetDir = resolveTargetDir(options);
+  const templateDir = resolveDefaultTemplateDir();
+  logger.header("Install OneX MCP context files");
+  logger.log(`Target: ${targetDir}`);
+  logger.log("");
+  if (!isThemeDir(targetDir)) {
+    logger.error(
+      `${targetDir} does not look like an OneX theme (no theme.config.ts found).`
+    );
+    logger.log("Run this command from the root of your theme project.");
+    process.exitCode = 1;
+    return;
+  }
+  const statuses = inspectFiles(templateDir, targetDir);
+  const missing = statuses.filter((s) => !s.exists);
+  if (missing.length === 0) {
+    logger.success("All AI context files are already present.");
+    logger.log("Run `onexthm mcp upgrade` to refresh them to the latest version.");
+    return;
+  }
+  logger.log(`Will install ${missing.length} file(s):`);
+  for (const s of missing) logger.log(`  + ${s.name}`);
+  logger.log("");
+  if (!options.yes) {
+    const { confirm } = await inquirer.prompt([
+      {
+        type: "confirm",
+        name: "confirm",
+        message: "Proceed?",
+        default: true
+      }
+    ]);
+    if (!confirm) {
+      logger.log("Cancelled.");
+      return;
+    }
+  }
+  for (const s of missing) {
+    if (!fs.existsSync(s.templatePath)) {
+      logger.warning(`  ! ${s.name} not in template \u2014 skipped`);
+      continue;
+    }
+    await fs.copy(s.templatePath, s.targetPath);
+    logger.success(`  \u2713 ${s.name}`);
+  }
+  logger.log("");
+  logger.success("Done. Restart your AI client to pick up the new MCP server.");
+  logger.log("");
+  logger.log("Tip: if your theme uses the Figma MCP, edit .mcp.json and");
+  logger.log("replace __FIGMA_API_KEY__ with your Figma personal access token.");
+}
+async function mcpUpgradeCommand(options = {}) {
+  const targetDir = resolveTargetDir(options);
+  const templateDir = resolveDefaultTemplateDir();
+  logger.header("Upgrade OneX MCP context files");
+  logger.log(`Target: ${targetDir}`);
+  logger.log("");
+  if (!isThemeDir(targetDir)) {
+    logger.error(
+      `${targetDir} does not look like an OneX theme (no theme.config.ts found).`
+    );
+    process.exitCode = 1;
+    return;
+  }
+  const statuses = inspectFiles(templateDir, targetDir);
+  const toUpgrade = statuses.filter(
+    (s) => !s.identical && s.name !== ".mcp.json"
+  );
+  const mcpJsonStatus = statuses.find((s) => s.name === ".mcp.json");
+  if (mcpJsonStatus && !mcpJsonStatus.exists) {
+    logger.warning(
+      ".mcp.json is missing. Run `onexthm mcp setup` to install it."
+    );
+  }
+  if (toUpgrade.length === 0) {
+    logger.success("All AI context files are already up to date.");
+    return;
+  }
+  logger.log("Files to update:");
+  for (const s of toUpgrade) {
+    const tag = !s.exists ? "+ new" : "~ changed";
+    logger.log(`  ${tag}  ${s.name}`);
+  }
+  logger.log("");
+  logger.log("(.mcp.json is never auto-upgraded \u2014 edit by hand if needed.)");
+  logger.log("");
+  if (!options.yes) {
+    const { confirm } = await inquirer.prompt([
+      {
+        type: "confirm",
+        name: "confirm",
+        message: "Overwrite the file(s) above?",
+        default: true
+      }
+    ]);
+    if (!confirm) {
+      logger.log("Cancelled.");
+      return;
+    }
+  }
+  for (const s of toUpgrade) {
+    if (!fs.existsSync(s.templatePath)) {
+      logger.warning(`  ! ${s.name} not in template \u2014 skipped`);
+      continue;
+    }
+    await fs.copy(s.templatePath, s.targetPath, { overwrite: true });
+    logger.success(`  \u2713 ${s.name}`);
+  }
+  logger.log("");
+  logger.success("Done. Restart your AI client to pick up the new context.");
+}
+async function mcpDoctorCommand(options = {}) {
+  const targetDir = resolveTargetDir(options);
+  const templateDir = resolveDefaultTemplateDir();
+  logger.header("OneX MCP doctor");
+  logger.log(`Target: ${targetDir}`);
+  logger.log("");
+  if (!isThemeDir(targetDir)) {
+    logger.error("Not an OneX theme directory (no theme.config.ts).");
+    process.exitCode = 1;
+    return;
+  }
+  logger.success("theme.config.ts present");
+  const mcpJsonPath = path9.join(targetDir, ".mcp.json");
+  if (!fs.existsSync(mcpJsonPath)) {
+    logger.error(".mcp.json missing \u2014 run `onexthm mcp setup`");
+  } else {
+    try {
+      const mcpJson = JSON.parse(fs.readFileSync(mcpJsonPath, "utf-8"));
+      const servers = mcpJson?.mcpServers ?? {};
+      if (servers.onexthm) {
+        logger.success(".mcp.json registers `onexthm`");
+      } else {
+        logger.error(".mcp.json does not register `onexthm`");
+      }
+      if (servers.figma) {
+        const arg = (servers.figma.args ?? []).join(" ");
+        if (arg.includes("__FIGMA_API_KEY__")) {
+          logger.warning("figma server uses placeholder API key \u2014 replace __FIGMA_API_KEY__");
+        } else {
+          logger.success(".mcp.json registers `figma`");
+        }
+      }
+    } catch (err) {
+      logger.error(`.mcp.json could not be parsed: ${err.message}`);
+    }
+  }
+  const statuses = inspectFiles(templateDir, targetDir).filter(
+    (s) => s.name !== ".mcp.json"
+  );
+  for (const s of statuses) {
+    if (!s.exists) {
+      logger.warning(`${s.name} missing`);
+    } else if (!s.identical) {
+      logger.warning(`${s.name} is out of date \u2014 run \`onexthm mcp upgrade\``);
+    } else {
+      logger.success(`${s.name} up to date`);
+    }
+  }
+  const registryPath = path9.join(targetDir, "sections-registry.ts");
+  if (fs.existsSync(registryPath)) {
+    logger.success("sections-registry.ts present");
+  } else {
+    logger.warning("sections-registry.ts missing \u2014 section tools won't auto-register");
+  }
+}
+
 // src/cli.ts
 dotenv.config({
   path: path9.join(process.cwd(), ".env.local"),
@@ -5323,33 +5267,25 @@ program.command("deploy").description("Upload theme package to API server").opti
   "-e, --environment <env>",
   "Environment (production, staging, development)"
 ).action(deployCommand);
-program.command("upload").description("Upload compiled theme to S3 bucket").option("-t, --theme <theme>", "Theme to upload").option("-b, --bucket <name>", "S3 bucket name").option("-v, --version <version>", "Theme version").option(
-  "-e, --environment <env>",
-  "Environment (staging|production)",
-  "staging"
-).option("--dry-run", "Show what would be uploaded without uploading").option("--skip-source", "Skip uploading source.zip").option("--source-dir <dir>", "Source directory path").action(uploadCommand);
-program.command("download").description("Download theme from S3 bucket").option("-t, --theme-id <id>", "Theme ID to download").option(
+program.command("upload").description("[deprecated] use `onexthm publish` instead").option("-t, --theme <theme>", "[deprecated] ignored").option("-b, --bucket <name>", "[deprecated] ignored").option("-v, --version <version>", "[deprecated] ignored").option("-e, --environment <env>", "[deprecated] ignored").option("--dry-run", "[deprecated] ignored").option("--skip-source", "[deprecated] ignored").option("--source-dir <dir>", "[deprecated] ignored").action(uploadCommand);
+program.command("download").description("Download a published theme via the website-api").option("-t, --theme-id <id>", "Theme ID to download").option(
   "-v, --version <version>",
   "Theme version (default: latest)",
   "latest"
-).option("-b, --bucket <name>", "S3 bucket name").option(
-  "-e, --environment <env>",
-  "Environment (staging|production)",
-  "staging"
-).option("-o, --output <dir>", "Output directory", "./active-theme").action(downloadCommand);
-program.command("clone").description("Clone theme source code from S3").argument("<theme-name>", "Theme to clone").option(
+).option("-b, --bucket <name>", "[deprecated] ignored").option("-e, --environment <env>", "[deprecated] ignored").option("-o, --output <dir>", "Output directory", "./active-theme").action(downloadCommand);
+program.command("clone").description("Clone theme source code via the website-api").argument("<theme-name>", "Theme to clone").option(
   "-v, --version <version>",
   "Theme version (default: latest)",
   "latest"
-).option("-n, --name <name>", "New theme name (skips interactive prompt)").option("-o, --output <dir>", "Output directory").option("-b, --bucket <name>", "S3 bucket name").option(
-  "-e, --environment <env>",
-  "Environment (staging|production)",
-  "staging"
-).option("--no-install", "Skip running pnpm install after clone").action(cloneCommand);
+).option("-n, --name <name>", "New theme name (skips interactive prompt)").option("-o, --output <dir>", "Output directory").option("-b, --bucket <name>", "[deprecated] ignored").option("-e, --environment <env>", "[deprecated] ignored").option("--no-install", "Skip running pnpm install after clone").action(cloneCommand);
 program.command("config").description("Configure OneX CLI credentials (AWS, API keys)").action(configCommand);
 program.command("login").description("Login to OneX platform").action(loginCommand);
 program.command("logout").description("Logout from OneX platform").action(logoutCommand);
 program.command("whoami").description("Show current logged-in developer").action(whoamiCommand);
+var mcpCmd = program.command("mcp").description("Manage MCP server registration and AI-context files");
+mcpCmd.command("setup").description("Install .mcp.json + CLAUDE.md + AGENTS.md + .cursorrules into the current theme").option("-y, --yes", "Skip confirmation prompts").action(mcpSetupCommand);
+mcpCmd.command("upgrade").description("Refresh AI-context files to the latest version from the bundled template").option("-y, --yes", "Skip confirmation prompts").action(mcpUpgradeCommand);
+mcpCmd.command("doctor").description("Diagnose MCP setup in the current theme directory").action(mcpDoctorCommand);
 program.command("publish").description("Build, scan, and publish theme to marketplace (requires login)").option("-t, --theme <path>", "Theme directory path").option(
   "--bump <type>",
   "Auto-bump version before publish (patch|minor|major)"