@onexapis/cli 1.1.43 → 1.1.45

package/dist/cli.mjs

@@ -18,7 +18,6 @@ import inquirer from 'inquirer';
 import archiver from 'archiver';
 import FormData from 'form-data';
 import fetch2 from 'node-fetch';
-import { PutObjectCommand, GetObjectCommand, S3Client } from '@aws-sdk/client-s3';
 import AdmZip from 'adm-zip';
 import chokidar from 'chokidar';
 import http from 'http';
@@ -3443,343 +3442,94 @@ async function deployCommand(options) {
 
 // src/commands/upload.ts
 init_logger();
-function getS3Client() {
-  const adapterMode = (process.env.ADAPTER_MODE || "aws").trim().toLowerCase();
-  if (adapterMode === "vps") {
-    const endpoint = process.env.MINIO_ENDPOINT || "localhost:9000";
-    const secure = process.env.MINIO_SECURE === "true";
-    const endpointUrl = endpoint.startsWith("http") ? endpoint : `${secure ? "https" : "http"}://${endpoint}`;
-    return new S3Client({
-      endpoint: endpointUrl,
-      region: "us-east-1",
-      credentials: {
-        accessKeyId: process.env.MINIO_ACCESS_KEY || "minioadmin",
-        secretAccessKey: process.env.MINIO_SECRET_KEY || "minioadmin"
-      },
-      forcePathStyle: true
-    });
-  }
-  if (adapterMode === "local") {
-    return new S3Client({
-      endpoint: "http://localhost:4569",
-      region: "ap-southeast-1",
-      credentials: {
-        accessKeyId: "S3RVER",
-        secretAccessKey: "S3RVER"
-      },
-      forcePathStyle: true
-    });
-  }
-  return new S3Client({
-    region: process.env.AWS_REGION || "ap-southeast-1"
-  });
-}
-function getBucketName(env) {
-  if (process.env.BUCKET_NAME) {
-    return process.env.BUCKET_NAME;
-  }
-  const environment = env || process.env.ENVIRONMENT || "staging";
-  return environment === "production" ? "theme-s3-bucket" : "theme-s3-bucket";
-}
-async function findCompiledThemeDir(themeId, version2) {
-  const searchPaths = [path9.resolve(process.cwd(), "dist")];
-  for (const dir of searchPaths) {
-    if (await fs.pathExists(dir)) {
-      const hasManifest = await fs.pathExists(path9.join(dir, "manifest.json"));
-      const hasThemeEntry = await fs.pathExists(path9.join(dir, "bundle-entry.js")) || await fs.pathExists(path9.join(dir, "theme.config.js")) || await fs.pathExists(path9.join(dir, "index.js"));
-      if (hasManifest || hasThemeEntry) {
-        return dir;
-      }
-    }
-  }
-  return null;
-}
-async function readManifest() {
-  const manifestTsPath = path9.resolve(process.cwd(), "manifest.ts");
-  if (await fs.pathExists(manifestTsPath)) {
-    try {
-      const module = await import(manifestTsPath);
-      return module.default || module;
-    } catch (error) {
-      logger.warning("Failed to import manifest.ts, trying package.json");
-    }
-  }
-  const packageJsonPath = path9.resolve(process.cwd(), "package.json");
-  if (await fs.pathExists(packageJsonPath)) {
-    const pkg = await fs.readJson(packageJsonPath);
-    return {
-      themeId: pkg.name?.replace("@onex-themes/", "") || "unknown",
-      version: pkg.version || "1.0.0"
-    };
-  }
-  throw new Error(
-    "No manifest.ts or package.json found. Are you in a theme directory?"
+async function uploadCommand(_options) {
+  logger.header("Upload Theme to S3 \u2014 DEPRECATED");
+  console.log();
+  console.log(
+    chalk4.yellow.bold(
+      "`onexthm upload` is deprecated and no longer functional."
+    )
   );
-}
-async function createZipFromDir(sourceDir, outputPath, excludePatterns = []) {
-  return new Promise((resolve, reject) => {
-    const output = fs.createWriteStream(outputPath);
-    const archive = archiver("zip", { zlib: { level: 6 } });
-    output.on("close", () => resolve());
-    archive.on("error", (err) => reject(err));
-    archive.pipe(output);
-    archive.glob("**/*", {
-      cwd: sourceDir,
-      dot: true,
-      ignore: excludePatterns
-    });
-    archive.finalize();
-  });
-}
-async function findSourceDir(themeId, explicitDir) {
-  if (explicitDir) {
-    if (await fs.pathExists(explicitDir)) return explicitDir;
-    return null;
-  }
-  const searchPaths = [
-    process.cwd(),
-    path9.resolve(process.cwd(), `../../themes/${themeId}`),
-    path9.resolve(process.cwd(), `../themes/${themeId}`)
-  ];
-  const markers = ["theme.config.ts", "bundle-entry.ts"];
-  for (const dir of searchPaths) {
-    for (const marker of markers) {
-      if (await fs.pathExists(path9.join(dir, marker))) {
-        return dir;
-      }
-    }
-  }
-  return null;
-}
-async function updateLatestPointer(s3Client, bucket, themeId, version2) {
-  const latestData = {
-    version: version2,
-    uploadedAt: (/* @__PURE__ */ new Date()).toISOString()
-  };
-  await s3Client.send(
-    new PutObjectCommand({
-      Bucket: bucket,
-      Key: `themes/${themeId}/latest.json`,
-      Body: JSON.stringify(latestData, null, 2),
-      ContentType: "application/json"
-    })
+  console.log();
+  console.log(
+    "The platform no longer exposes themes via direct S3 access, so this"
   );
-}
-async function uploadCommand(options) {
-  logger.header("Upload Theme to S3");
-  const spinner = ora("Preparing theme upload...").start();
-  try {
-    let themeId;
-    let version2;
-    if (options.theme) {
-      themeId = options.theme;
-      version2 = options.version || "1.0.0";
-    } else {
-      const manifest = await readManifest();
-      themeId = manifest.themeId;
-      version2 = options.version || manifest.version || "1.0.0";
-    }
-    spinner.text = `Found theme: ${themeId}@${version2}`;
-    const bucket = options.bucket || getBucketName(options.environment);
-    const s3Client = getS3Client();
-    const compiledDir = await findCompiledThemeDir(themeId, version2);
-    if (!compiledDir) {
-      spinner.fail(
-        chalk4.red(
-          `Compiled theme not found for ${themeId}@${version2}. Run 'onexthm build' first.`
-        )
-      );
-      logger.info(chalk4.gray(`Expected location:
-  - ./dist/`));
-      process.exit(1);
-    }
-    spinner.succeed(`Found compiled theme at: ${compiledDir}`);
-    spinner.start("Creating bundle.zip...");
-    const tmpDir = os.tmpdir();
-    const bundleZipPath = path9.join(tmpDir, `${themeId}-${version2}-bundle.zip`);
-    await createZipFromDir(compiledDir, bundleZipPath);
-    const bundleZipBuffer = await fs.readFile(bundleZipPath);
-    const bundleSizeMB = (bundleZipBuffer.length / 1024 / 1024).toFixed(2);
-    spinner.succeed(`Created bundle.zip (${bundleSizeMB} MB)`);
-    if (options.dryRun) {
-      spinner.info(chalk4.yellow("Dry run mode \u2014 no files will be uploaded"));
-      console.log();
-      console.log(chalk4.gray(`  bundle.zip: ${bundleSizeMB} MB`));
-      console.log(
-        chalk4.cyan(
-          `  S3 path: s3://${bucket}/themes/${themeId}/${version2}/bundle.zip`
-        )
-      );
-      if (!options.skipSource) {
-        const sourceDir = await findSourceDir(themeId, options.sourceDir);
-        if (sourceDir) {
-          console.log(chalk4.gray(`  source dir: ${sourceDir}`));
-          console.log(
-            chalk4.cyan(
-              `  S3 path: s3://${bucket}/themes/${themeId}/${version2}/source.zip`
-            )
-          );
-        } else {
-          console.log(
-            chalk4.yellow("  source dir: not found (source.zip will be skipped)")
-          );
-        }
-      }
-      console.log();
-      await fs.remove(bundleZipPath);
-      return;
-    }
-    spinner.start("Uploading bundle.zip to S3...");
-    const bundleS3Key = `themes/${themeId}/${version2}/bundle.zip`;
-    await s3Client.send(
-      new PutObjectCommand({
-        Bucket: bucket,
-        Key: bundleS3Key,
-        Body: bundleZipBuffer,
-        ContentType: "application/zip"
-      })
-    );
-    spinner.succeed(
-      `Uploaded bundle.zip ${chalk4.gray(`\u2192 s3://${bucket}/${bundleS3Key}`)}`
-    );
-    await fs.remove(bundleZipPath);
-    let sourceUploaded = false;
-    if (!options.skipSource) {
-      spinner.start("Looking for source directory...");
-      const sourceDir = await findSourceDir(themeId, options.sourceDir);
-      if (sourceDir) {
-        spinner.succeed(`Found source at: ${sourceDir}`);
-        spinner.start("Creating source.zip...");
-        const sourceZipPath = path9.join(
-          tmpDir,
-          `${themeId}-${version2}-source.zip`
-        );
-        await createZipFromDir(sourceDir, sourceZipPath, [
-          "node_modules/**",
-          "dist/**",
-          ".git/**",
-          "*.zip",
-          ".next/**",
-          ".turbo/**"
-        ]);
-        const sourceZipBuffer = await fs.readFile(sourceZipPath);
-        const sourceSizeMB = (sourceZipBuffer.length / 1024 / 1024).toFixed(2);
-        spinner.succeed(`Created source.zip (${sourceSizeMB} MB)`);
-        spinner.start("Uploading source.zip to S3...");
-        const sourceS3Key = `themes/${themeId}/${version2}/source.zip`;
-        await s3Client.send(
-          new PutObjectCommand({
-            Bucket: bucket,
-            Key: sourceS3Key,
-            Body: sourceZipBuffer,
-            ContentType: "application/zip"
-          })
-        );
-        spinner.succeed(
-          `Uploaded source.zip ${chalk4.gray(`\u2192 s3://${bucket}/${sourceS3Key}`)}`
-        );
-        await fs.remove(sourceZipPath);
-        sourceUploaded = true;
-      } else {
-        spinner.warn(
-          chalk4.yellow("Source directory not found \u2014 skipping source.zip")
-        );
-      }
-    }
-    spinner.start("Updating latest.json pointer...");
-    await updateLatestPointer(s3Client, bucket, themeId, version2);
-    spinner.succeed("Updated latest.json pointer");
-    console.log();
-    logger.success(chalk4.green.bold("Theme uploaded successfully!"));
-    console.log();
-    console.log(
-      chalk4.cyan("   Theme:   ") + chalk4.white(`${themeId}@${version2}`)
-    );
-    console.log(chalk4.cyan("   Bucket:  ") + chalk4.white(bucket));
-    console.log(
-      chalk4.cyan("   Files:   ") + chalk4.white(`bundle.zip${sourceUploaded ? " + source.zip" : ""}`)
-    );
-    console.log(
-      chalk4.cyan("   Path:    ") + chalk4.gray(`s3://${bucket}/themes/${themeId}/${version2}/`)
-    );
-    console.log();
-  } catch (error) {
-    spinner.fail(chalk4.red(`Upload failed: ${error.message}`));
-    logger.error(error.stack || error.message);
-    process.exit(1);
-  }
+  console.log(
+    "command can no longer reach the bucket. Use `onexthm publish` instead:"
+  );
+  console.log();
+  console.log(chalk4.cyan("  cd themes/your-theme"));
+  console.log(chalk4.cyan("  onexthm login          # one-time, refreshes JWT"));
+  console.log(
+    chalk4.cyan("  onexthm publish        # builds + uploads + confirms")
+  );
+  console.log();
+  console.log(
+    "`publish` does everything this command did (build, version bump,"
+  );
+  console.log(
+    "bundle + source upload) plus content-hashed asset upload, security"
+  );
+  console.log("scanning, and atomic version registration in one step.");
+  console.log();
+  process.exit(1);
 }
 
 // src/commands/download.ts
 init_logger();
-function getS3Client2() {
-  const adapterMode = (process.env.ADAPTER_MODE || "aws").trim().toLowerCase();
-  if (adapterMode === "vps") {
-    const endpoint = process.env.MINIO_ENDPOINT || "localhost:9000";
-    const secure = process.env.MINIO_SECURE === "true";
-    const endpointUrl = endpoint.startsWith("http") ? endpoint : `${secure ? "https" : "http"}://${endpoint}`;
-    return new S3Client({
-      endpoint: endpointUrl,
-      region: "us-east-1",
-      credentials: {
-        accessKeyId: process.env.MINIO_ACCESS_KEY || "minioadmin",
-        secretAccessKey: process.env.MINIO_SECRET_KEY || "minioadmin"
-      },
-      forcePathStyle: true
-    });
+function unwrapEnvelope(raw) {
+  if (raw && typeof raw === "object" && "statusCode" in raw && "body" in raw) {
+    return raw.body;
   }
-  if (adapterMode === "local") {
-    return new S3Client({
-      endpoint: "http://localhost:4569",
-      region: "ap-southeast-1",
-      credentials: {
-        accessKeyId: "S3RVER",
-        secretAccessKey: "S3RVER"
-      },
-      forcePathStyle: true
-    });
-  }
-  return new S3Client({
-    region: process.env.AWS_REGION || "ap-southeast-1"
-  });
+  return raw;
 }
-function getBucketName2(env) {
-  if (process.env.BUCKET_NAME) {
-    return process.env.BUCKET_NAME;
+async function resolveLatestVersion(apiUrl, themeId) {
+  const url = `${apiUrl}/website-api/themes/${encodeURIComponent(themeId)}/versions`;
+  let response;
+  try {
+    response = await fetch(url, { cache: "no-store" });
+  } catch (err) {
+    throw new Error(
+      `Network error contacting ${url}: ${err instanceof Error ? err.message : "unknown"}`
+    );
   }
-  const environment = env || process.env.ENVIRONMENT || "staging";
-  return environment === "production" ? "theme-s3-bucket" : "theme-s3-bucket";
-}
-async function streamToString(stream) {
-  const chunks = [];
-  for await (const chunk of stream) {
-    chunks.push(Buffer.from(chunk));
+  if (!response.ok) {
+    throw new Error(
+      `Version lookup failed for "${themeId}" (HTTP ${response.status})`
+    );
   }
-  return Buffer.concat(chunks).toString("utf-8");
-}
-async function streamToBuffer(stream) {
-  const chunks = [];
-  for await (const chunk of stream) {
-    chunks.push(Buffer.from(chunk));
+  const raw = await response.json();
+  const data = unwrapEnvelope(raw);
+  const latest = data?.latest_version;
+  if (typeof latest !== "string" || latest.length === 0) {
+    throw new Error(
+      `Theme "${themeId}" has no published versions yet (no latest_version in response)`
+    );
   }
-  return Buffer.concat(chunks);
+  return latest;
 }
-async function resolveLatestVersion(s3Client, bucket, themeId) {
-  try {
-    const response = await s3Client.send(
-      new GetObjectCommand({
-        Bucket: bucket,
-        Key: `themes/${themeId}/latest.json`
-      })
-    );
-    const body = await streamToString(response.Body);
-    const data = JSON.parse(body);
-    return data.version;
-  } catch (error) {
+async function downloadBundleZip(apiUrl, themeId, version2) {
+  const url = `${apiUrl}/website-api/themes/${encodeURIComponent(themeId)}/${encodeURIComponent(version2)}/download`;
+  const response = await fetch(url);
+  if (!response.ok) {
     throw new Error(
-      `Failed to resolve latest version for theme "${themeId}": ${error.message}`
+      `Bundle download failed for "${themeId}@${version2}" (HTTP ${response.status})`
     );
   }
+  const contentType = response.headers.get("content-type") || "";
+  if (contentType.includes("application/json")) {
+    const raw = await response.json();
+    const envelope = raw && typeof raw === "object" && "statusCode" in raw ? raw : { body: raw };
+    const body = envelope.body;
+    if (typeof body !== "string") {
+      throw new Error(
+        "Unexpected /download response shape: expected base64 string in body"
+      );
+    }
+    return Buffer.from(body, "base64");
+  }
+  const arrayBuffer = await response.arrayBuffer();
+  return Buffer.from(arrayBuffer);
 }
 async function createCompatibilityFiles(outputDir, manifest) {
   const entryFile = manifest.output?.entry || "bundle-entry.js";
@@ -3803,47 +3553,58 @@ export * from './bundle-entry.js';
   const pkgJsonPath = path9.join(outputDir, "package.json");
   await fs.writeFile(pkgJsonPath, '{\n  "type": "module"\n}\n', "utf-8");
 }
-function showDownloadFailureHelp(themeId, bucket) {
+function showDownloadFailureHelp(themeId, apiUrl) {
   console.log();
   logger.error(chalk4.red.bold("Theme download failed"));
   console.log();
   console.log(chalk4.yellow("Possible reasons:"));
-  console.log(chalk4.gray("  1. Theme not uploaded to S3 yet"));
-  console.log(chalk4.gray("  2. AWS credentials not configured correctly"));
-  console.log(chalk4.gray("  3. Bucket name or region is incorrect"));
-  console.log(chalk4.gray("  4. bundle.zip is missing or corrupted"));
+  console.log(
+    chalk4.gray("  1. Theme has not been published yet (run `onexthm publish`)")
+  );
+  console.log(
+    chalk4.gray(
+      "  2. Theme ID is wrong (typo in --theme-id or THEME_ID env var)"
+    )
+  );
+  console.log(
+    chalk4.gray("  3. API base URL is wrong or the website-api is unreachable")
+  );
   console.log();
   console.log(chalk4.cyan.bold("To fix this:"));
   console.log();
-  console.log(chalk4.white("1. Compile and upload the theme:"));
-  console.log(chalk4.gray(`   cd themes/${themeId}`));
-  console.log(chalk4.gray("   pnpm build"));
-  console.log(chalk4.gray("   onexthm upload"));
-  console.log();
-  console.log(chalk4.white("2. Verify AWS credentials are set:"));
+  console.log(chalk4.white("1. Verify the theme is published:"));
   console.log(
-    chalk4.gray("   - Set AWS_ACCESS_KEY_ID and AWS_SECRET_ACCESS_KEY")
+    chalk4.gray(
+      `   curl -s ${apiUrl}/website-api/themes/${themeId}/versions | jq .latest_version`
+    )
   );
-  console.log(chalk4.gray("   - Or use AWS_PROFILE=your-profile"));
-  console.log(chalk4.gray("   - Set AWS_REGION (e.g., ap-southeast-1)"));
   console.log();
-  console.log(chalk4.white("3. Check bucket configuration:"));
-  console.log(chalk4.gray(`   Current bucket: ${bucket}`));
+  console.log(chalk4.white("2. Check API URL configuration:"));
+  console.log(chalk4.gray(`   Current API URL: ${apiUrl}`));
   console.log(
-    chalk4.gray("   Set BUCKET_NAME environment variable if different")
+    chalk4.gray("   Override with NEXT_PUBLIC_API_URL or ONEXTHM_API_URL")
   );
   console.log();
-  console.log(chalk4.white("4. Verify theme exists in S3:"));
-  console.log(chalk4.gray(`   aws s3 ls s3://${bucket}/themes/${themeId}/`));
+  console.log(chalk4.white("3. Pin a specific version (CI/production):"));
+  console.log(
+    chalk4.gray(`   THEME_VERSION=1.2.3 onexthm download --theme-id ${themeId}`)
+  );
   console.log();
 }
 async function downloadCommand(options) {
-  logger.header("Download Theme from S3");
+  logger.header("Download Theme");
   const spinner = ora("Initializing download...").start();
+  if (options.bucket || options.environment) {
+    spinner.stop();
+    logger.warning(
+      "--bucket and --environment are deprecated and ignored. Themes are now served via HTTP from the website-api Lambda."
+    );
+    spinner.start();
+  }
+  const apiUrl = getApiUrl();
   try {
     const themeId = options.themeId || process.env.NEXT_PUBLIC_THEME_ID || process.env.THEME_ID;
-    const version2 = options.version || process.env.THEME_VERSION || "latest";
-    const bucket = options.bucket || getBucketName2(options.environment);
+    const requestedVersion = options.version || process.env.THEME_VERSION || "latest";
     const outputDir = options.output || "./active-theme";
     if (!themeId) {
       spinner.fail(
@@ -3853,12 +3614,10 @@ async function downloadCommand(options) {
       );
       process.exit(1);
     }
-    spinner.text = `Downloading ${themeId}@${version2} from ${bucket}...`;
-    const s3Client = getS3Client2();
-    let resolvedVersion = version2;
-    if (version2 === "latest") {
-      spinner.text = "Resolving latest version...";
-      resolvedVersion = await resolveLatestVersion(s3Client, bucket, themeId);
+    spinner.text = `Resolving ${themeId}@${requestedVersion}...`;
+    let resolvedVersion = requestedVersion;
+    if (requestedVersion === "latest") {
+      resolvedVersion = await resolveLatestVersion(apiUrl, themeId);
       spinner.succeed(
         `Resolved latest version: ${chalk4.cyan(resolvedVersion)}`
       );
@@ -3868,24 +3627,19 @@ async function downloadCommand(options) {
           chalk4.yellow(
             `
   Warning: Resolved "latest" to ${resolvedVersion} in CI environment.
-  For production builds, pin to a specific version:
+  For reproducible builds, pin to a specific version:
     THEME_VERSION=${resolvedVersion}
 `
           )
         );
       }
+    } else {
+      spinner.succeed(`Using version: ${chalk4.cyan(resolvedVersion)}`);
     }
     spinner.start(
       `Downloading bundle.zip for ${themeId}@${resolvedVersion}...`
     );
-    const s3Key = `themes/${themeId}/${resolvedVersion}/bundle.zip`;
-    const response = await s3Client.send(
-      new GetObjectCommand({
-        Bucket: bucket,
-        Key: s3Key
-      })
-    );
-    const zipBuffer = await streamToBuffer(response.Body);
+    const zipBuffer = await downloadBundleZip(apiUrl, themeId, resolvedVersion);
     const sizeMB = (zipBuffer.length / 1024 / 1024).toFixed(2);
     spinner.succeed(`Downloaded bundle.zip (${sizeMB} MB)`);
     spinner.start("Extracting bundle...");
@@ -3904,7 +3658,7 @@ async function downloadCommand(options) {
     console.log(
       chalk4.cyan("   Theme:   ") + chalk4.white(`${themeId}@${resolvedVersion}`)
     );
-    console.log(chalk4.cyan("   Bucket:  ") + chalk4.white(bucket));
+    console.log(chalk4.cyan("   Source:  ") + chalk4.white(apiUrl));
     console.log(chalk4.cyan("   Output:  ") + chalk4.white(outputDir));
     console.log(chalk4.cyan("   Files:   ") + chalk4.white(entries.length));
     if (manifest.counts) {
@@ -3916,82 +3670,70 @@ async function downloadCommand(options) {
   } catch (error) {
     spinner.fail(chalk4.red("Download failed"));
     logger.error(error.message);
-    const themeId = options.themeId || process.env.NEXT_PUBLIC_THEME_ID || "unknown";
-    const bucket = options.bucket || getBucketName2(options.environment);
-    showDownloadFailureHelp(themeId, bucket);
+    const themeId = options.themeId || process.env.NEXT_PUBLIC_THEME_ID || process.env.THEME_ID || "unknown";
+    showDownloadFailureHelp(themeId, apiUrl);
     process.exit(1);
   }
 }
 
 // src/commands/clone.ts
 init_logger();
-function getS3Client3() {
-  const adapterMode = (process.env.ADAPTER_MODE || "aws").trim().toLowerCase();
-  if (adapterMode === "vps") {
-    const endpoint = process.env.MINIO_ENDPOINT || "localhost:9000";
-    const secure = process.env.MINIO_SECURE === "true";
-    const endpointUrl = endpoint.startsWith("http") ? endpoint : `${secure ? "https" : "http"}://${endpoint}`;
-    return new S3Client({
-      endpoint: endpointUrl,
-      region: "us-east-1",
-      credentials: {
-        accessKeyId: process.env.MINIO_ACCESS_KEY || "minioadmin",
-        secretAccessKey: process.env.MINIO_SECRET_KEY || "minioadmin"
-      },
-      forcePathStyle: true
-    });
+function unwrapEnvelope2(raw) {
+  if (raw && typeof raw === "object" && "statusCode" in raw && "body" in raw) {
+    return raw.body;
   }
-  if (adapterMode === "local") {
-    return new S3Client({
-      endpoint: "http://localhost:4569",
-      region: "ap-southeast-1",
-      credentials: {
-        accessKeyId: "S3RVER",
-        secretAccessKey: "S3RVER"
-      },
-      forcePathStyle: true
-    });
-  }
-  return new S3Client({
-    region: process.env.AWS_REGION || "ap-southeast-1"
-  });
+  return raw;
 }
-function getBucketName3(env) {
-  if (process.env.BUCKET_NAME) {
-    return process.env.BUCKET_NAME;
+async function resolveLatestVersion2(apiUrl, themeId) {
+  const url = `${apiUrl}/website-api/themes/${encodeURIComponent(themeId)}/versions`;
+  const response = await fetch(url, { cache: "no-store" });
+  if (!response.ok) {
+    throw new Error(
+      `Version lookup failed for "${themeId}" (HTTP ${response.status})`
+    );
   }
-  const environment = env || process.env.ENVIRONMENT || "staging";
-  return environment === "production" ? "theme-s3-bucket" : "theme-s3-bucket";
-}
-async function streamToString2(stream) {
-  const chunks = [];
-  for await (const chunk of stream) {
-    chunks.push(Buffer.from(chunk));
+  const raw = await response.json();
+  const data = unwrapEnvelope2(raw);
+  const latest = data?.latest_version;
+  if (typeof latest !== "string" || latest.length === 0) {
+    throw new Error(`Theme "${themeId}" has no published versions yet`);
   }
-  return Buffer.concat(chunks).toString("utf-8");
+  return latest;
 }
-async function streamToBuffer2(stream) {
-  const chunks = [];
-  for await (const chunk of stream) {
-    chunks.push(Buffer.from(chunk));
-  }
-  return Buffer.concat(chunks);
-}
-async function resolveLatestVersion2(s3Client, bucket, themeId) {
-  try {
-    const response = await s3Client.send(
-      new GetObjectCommand({
-        Bucket: bucket,
-        Key: `themes/${themeId}/latest.json`
-      })
+async function fetchSourceZip(apiUrl, themeId, version2) {
+  const url = `${apiUrl}/website-api/themes/${encodeURIComponent(themeId)}/source?version=${encodeURIComponent(version2)}`;
+  const response = await authenticatedFetch(url, {
+    method: "GET"
+  });
+  if (!response.ok) {
+    if (response.status === 404) {
+      throw new Error(
+        `Source not found for ${themeId}@${version2}. The theme may not have been published with source upload enabled.`
+      );
+    }
+    if (response.status === 401 || response.status === 403) {
+      throw new Error(
+        `Not authorized to download source for "${themeId}". Run \`onexthm login\` first.`
+      );
+    }
+    throw new Error(
+      `Source URL request failed for "${themeId}@${version2}" (HTTP ${response.status})`
     );
-    const body = await streamToString2(response.Body);
-    return JSON.parse(body).version;
-  } catch (error) {
+  }
+  const raw = await response.json();
+  const data = unwrapEnvelope2(raw);
+  const presignedUrl = data?.download_url;
+  if (typeof presignedUrl !== "string" || presignedUrl.length === 0) {
+    throw new Error("Unexpected /source response shape: missing download_url");
+  }
+  const zipResponse = await fetch(presignedUrl);
+  if (!zipResponse.ok) {
     throw new Error(
-      `Failed to resolve latest version for theme "${themeId}": ${error.message}`
+      `Presigned source download failed (HTTP ${zipResponse.status})`
     );
   }
+  const arrayBuffer = await zipResponse.arrayBuffer();
+  return Buffer.from(arrayBuffer);
 }
 function runInstall(cwd) {
   return new Promise((resolve) => {
@@ -4090,15 +3832,24 @@ async function renameTheme(themeDir, oldName, newName) {
 }
 async function cloneCommand(themeName, options) {
   logger.header("Clone Theme Source");
+  if (options.bucket || options.environment) {
+    logger.warning(
+      "--bucket and --environment are deprecated and ignored. Source is now fetched via HTTP from the website-api Lambda."
+    );
+  }
+  const tokens = await getValidTokens();
+  if (!tokens) {
+    logger.error("Not logged in. Run: onexthm login");
+    process.exit(1);
+  }
   let newName = options.name;
   if (!newName) {
     newName = await promptThemeName(themeName);
   }
   const spinner = ora("Initializing clone...").start();
   try {
-    const bucket = options.bucket || getBucketName3(options.environment);
+    const apiUrl = getApiUrl();
     const outputDir = options.output || path9.resolve(process.cwd(), newName);
-    const s3Client = getS3Client3();
     if (await fs.pathExists(outputDir)) {
       spinner.fail(chalk4.red(`Directory already exists: ${outputDir}`));
       logger.info(
@@ -4111,28 +3862,20 @@ async function cloneCommand(themeName, options) {
     let version2 = options.version || "latest";
     if (version2 === "latest") {
       spinner.text = "Resolving latest version...";
-      version2 = await resolveLatestVersion2(s3Client, bucket, themeName);
+      version2 = await resolveLatestVersion2(apiUrl, themeName);
       spinner.succeed(`Resolved latest version: ${chalk4.cyan(version2)}`);
     }
     spinner.start(`Downloading source.zip for ${themeName}@${version2}...`);
-    const s3Key = `themes/${themeName}/${version2}/source.zip`;
     let zipBuffer;
     try {
-      const response = await s3Client.send(
-        new GetObjectCommand({
-          Bucket: bucket,
-          Key: s3Key
-        })
-      );
-      zipBuffer = await streamToBuffer2(response.Body);
+      zipBuffer = await fetchSourceZip(apiUrl, themeName, version2);
     } catch (error) {
-      spinner.fail(chalk4.red(`Source not found: s3://${bucket}/${s3Key}`));
+      spinner.fail(chalk4.red(error.message));
       console.log();
       console.log(
-        chalk4.yellow("The theme source may not have been uploaded yet.")
-      );
-      console.log(
-        chalk4.gray(`Upload source with: onexthm upload --theme ${themeName}`)
+        chalk4.gray(
+          `Verify the theme is published: curl -s ${apiUrl}/website-api/themes/${themeName}/versions`
+        )
       );
       console.log();
       process.exit(1);
@@ -4315,10 +4058,7 @@ function createDevServer(options) {
         return;
       }
       if (segments.length > 1) {
-        const fallbackPath = path9.join(
-          assetsBase,
-          segments.slice(1).join("/")
-        );
+        const fallbackPath = path9.join(assetsBase, segments.slice(1).join("/"));
         if (fallbackPath.startsWith(assetsBase) && fs3.existsSync(fallbackPath)) {
           serveFile(res, fallbackPath);
           return;
@@ -4830,6 +4570,82 @@ async function whoamiCommand() {
 
 // src/commands/publish.ts
 init_logger();
+var MIME_MAP = {
+  ".png": "image/png",
+  ".jpg": "image/jpeg",
+  ".jpeg": "image/jpeg",
+  ".gif": "image/gif",
+  ".webp": "image/webp",
+  ".avif": "image/avif",
+  ".svg": "image/svg+xml",
+  ".ico": "image/x-icon",
+  ".bmp": "image/bmp",
+  ".woff": "font/woff",
+  ".woff2": "font/woff2",
+  ".ttf": "font/ttf",
+  ".otf": "font/otf",
+  ".eot": "application/vnd.ms-fontobject",
+  ".mp4": "video/mp4",
+  ".webm": "video/webm",
+  ".mov": "video/quicktime",
+  ".ogg": "video/ogg",
+  ".json": "application/json"
+};
+var HASH_LEN = 8;
+function mimeFor(filename) {
+  const ext = path9.extname(filename).toLowerCase();
+  return MIME_MAP[ext] || "application/octet-stream";
+}
+async function sha256Prefix(absPath, len) {
+  const buf = await fs.readFile(absPath);
+  return crypto.createHash("sha256").update(buf).digest("hex").slice(0, len);
+}
+function insertHashIntoName(relPath, hash) {
+  const dir = path9.posix.dirname(relPath);
+  const base = path9.posix.basename(relPath);
+  const ext = path9.posix.extname(base);
+  const stem = ext ? base.slice(0, -ext.length) : base;
+  const hashed = `${stem}-${hash}${ext}`;
+  return dir === "." ? hashed : `${dir}/${hashed}`;
+}
+async function scanThemeAssets(distDir) {
+  const assetsDir = path9.join(distDir, "theme-assets");
+  if (!await fs.pathExists(assetsDir)) return [];
+  const files = await glob("**/*", {
+    cwd: assetsDir,
+    nodir: true,
+    dot: false
+  });
+  const results = [];
+  for (const rel of files) {
+    const absPath = path9.join(assetsDir, rel);
+    const stat = await fs.stat(absPath);
+    if (!stat.isFile()) continue;
+    const originalPath = rel.split(path9.sep).join("/");
+    const hash = await sha256Prefix(absPath, HASH_LEN);
+    const hashedPath = insertHashIntoName(originalPath, hash);
+    const contentType = mimeFor(rel);
+    results.push({
+      originalPath,
+      hashedPath,
+      hash,
+      size: stat.size,
+      contentType,
+      absPath
+    });
+  }
+  results.sort((a, b) => a.originalPath.localeCompare(b.originalPath));
+  return results;
+}
+function buildAssetMap(entries) {
+  const map = {};
+  for (const e of entries) {
+    map[e.originalPath] = e.hashedPath;
+  }
+  return map;
+}
+
+// src/commands/publish.ts
 async function publishCommand(options) {
   logger.header("OneX Theme Publish");
   const tokens = await getValidTokens();
@@ -4964,37 +4780,123 @@ Or use the --bump flag:
     logger.error(error instanceof Error ? error.message : "Build error");
     process.exit(1);
   }
-  logger.startSpinner("Getting upload URL...");
+  const distDir = path9.join(themePath, "dist");
+  let assetEntries = [];
+  try {
+    assetEntries = await scanThemeAssets(distDir);
+    if (assetEntries.length > 0) {
+      logger.info(`Found ${assetEntries.length} theme asset file(s)`);
+    }
+  } catch (error) {
+    logger.error(
+      `Asset scan failed: ${error instanceof Error ? error.message : "unknown"}`
+    );
+    process.exit(1);
+  }
+  try {
+    const assetMap = buildAssetMap(assetEntries);
+    const assetMapPath = path9.join(distDir, "asset-map.json");
+    await fs.writeFile(assetMapPath, JSON.stringify(assetMap, null, 2));
+  } catch (error) {
+    logger.error(
+      `Failed to write asset-map.json: ${error instanceof Error ? error.message : "unknown"}`
+    );
+    process.exit(1);
+  }
+  logger.startSpinner("Getting upload URLs...");
   let bundleUploadUrl;
   let sourceUploadUrl;
+  let assetUploads = [];
+  let alreadyUploaded = [];
   try {
     const pubResponse = await authenticatedFetch(
       `${apiUrl}/website-api/themes/${encodeURIComponent(themeId)}/versions`,
       {
         method: "POST",
-        body: JSON.stringify({ version: version2 })
+        body: JSON.stringify({
+          version: version2,
+          assets: assetEntries.map((a) => ({
+            path: a.hashedPath,
+            hash: a.hash,
+            size: a.size,
+            content_type: a.contentType
+          }))
+        })
       }
     );
     const pubData = await pubResponse.json();
     const pubBody = pubData.statusCode ? pubData.body : pubData;
     if (!pubResponse.ok || !pubBody.bundleUploadUrl) {
-      logger.stopSpinner(false, "Failed to get upload URL");
+      logger.stopSpinner(false, "Failed to get upload URLs");
       logger.error(pubBody.error || "Server error");
       process.exit(1);
     }
     bundleUploadUrl = pubBody.bundleUploadUrl;
     sourceUploadUrl = pubBody.sourceUploadUrl;
-    logger.stopSpinner(true, "Upload URL obtained");
+    assetUploads = pubBody.assetUploads || [];
+    alreadyUploaded = pubBody.alreadyUploaded || [];
+    logger.stopSpinner(
+      true,
+      `Upload URLs obtained (${assetUploads.length} new, ${alreadyUploaded.length} reused)`
+    );
   } catch (error) {
     logger.stopSpinner(false, "Failed");
     logger.error(error instanceof Error ? error.message : "Connection failed");
     process.exit(1);
   }
+  if (assetUploads.length > 0) {
+    logger.startSpinner(`Uploading ${assetUploads.length} asset(s) to S3...`);
+    const CONCURRENCY = 8;
+    const byHashedPath = new Map(assetEntries.map((a) => [a.hashedPath, a]));
+    const queue = [...assetUploads];
+    let uploaded = 0;
+    let failed = 0;
+    async function worker() {
+      while (queue.length > 0) {
+        const item = queue.shift();
+        if (!item) break;
+        const entry = byHashedPath.get(item.path);
+        if (!entry) {
+          failed++;
+          logger.error(`  \u2717 ${item.path}: no local file found`);
+          continue;
+        }
+        try {
+          const buf = await fs.promises.readFile(entry.absPath);
+          const res = await fetch(item.upload_url, {
+            method: "PUT",
+            headers: {
+              "Content-Type": entry.contentType,
+              "x-amz-acl": "public-read"
+            },
+            body: buf
+          });
+          if (!res.ok) {
+            throw new Error(`HTTP ${res.status}`);
+          }
+          uploaded++;
+        } catch (e) {
+          failed++;
+          logger.error(
+            `  \u2717 ${item.path}: ${e instanceof Error ? e.message : "failed"}`
+          );
+        }
+      }
+    }
+    await Promise.all(
+      Array.from(
+        { length: Math.min(CONCURRENCY, assetUploads.length) },
+        () => worker()
+      )
+    );
+    if (failed > 0) {
+      logger.stopSpinner(false, `${failed} asset(s) failed`);
+      process.exit(1);
+    }
+    logger.stopSpinner(true, `Uploaded ${uploaded} asset(s)`);
+  }
   logger.startSpinner("Uploading bundle...");
   try {
-    const archiver3 = await import('archiver');
-    const { createWriteStream } = await import('fs');
-    const distDir = path9.join(themePath, "dist");
     if (!fs.existsSync(distDir)) {
       logger.stopSpinner(false, "No dist/ directory");
       logger.error("Build the theme first: onexthm build");
@@ -5005,7 +4907,9 @@ Or use the --bump flag:
       "bundle.zip",
       "source.zip",
       "preview-runtime.js",
-      "preview-runtime.js.map"
+      "preview-runtime.js.map",
+      "theme-assets",
+      "theme-assets/**"
     ]);
     const bundleBuffer = fs.readFileSync(bundleZipPath);
     const bundleRes = await fetch(bundleUploadUrl, {
@@ -5092,11 +4996,11 @@ Or use the --bump flag:
   logger.success(`\u2713 Theme "${themeId}" v${version2} published!`);
 }
 async function createZip(sourceDir, outputPath, exclude) {
-  const archiver3 = (await import('archiver')).default;
+  const archiver2 = (await import('archiver')).default;
   const { createWriteStream } = await import('fs');
   return new Promise((resolve, reject) => {
     const output = createWriteStream(outputPath);
-    const archive = archiver3("zip", { zlib: { level: 9 } });
+    const archive = archiver2("zip", { zlib: { level: 9 } });
     output.on("close", resolve);
     archive.on("error", reject);
     archive.pipe(output);
@@ -5159,29 +5063,17 @@ program.command("deploy").description("Upload theme package to API server").opti
   "-e, --environment <env>",
   "Environment (production, staging, development)"
 ).action(deployCommand);
-program.command("upload").description("Upload compiled theme to S3 bucket").option("-t, --theme <theme>", "Theme to upload").option("-b, --bucket <name>", "S3 bucket name").option("-v, --version <version>", "Theme version").option(
-  "-e, --environment <env>",
-  "Environment (staging|production)",
-  "staging"
-).option("--dry-run", "Show what would be uploaded without uploading").option("--skip-source", "Skip uploading source.zip").option("--source-dir <dir>", "Source directory path").action(uploadCommand);
-program.command("download").description("Download theme from S3 bucket").option("-t, --theme-id <id>", "Theme ID to download").option(
+program.command("upload").description("[deprecated] use `onexthm publish` instead").option("-t, --theme <theme>", "[deprecated] ignored").option("-b, --bucket <name>", "[deprecated] ignored").option("-v, --version <version>", "[deprecated] ignored").option("-e, --environment <env>", "[deprecated] ignored").option("--dry-run", "[deprecated] ignored").option("--skip-source", "[deprecated] ignored").option("--source-dir <dir>", "[deprecated] ignored").action(uploadCommand);
+program.command("download").description("Download a published theme via the website-api").option("-t, --theme-id <id>", "Theme ID to download").option(
   "-v, --version <version>",
   "Theme version (default: latest)",
   "latest"
-).option("-b, --bucket <name>", "S3 bucket name").option(
-  "-e, --environment <env>",
-  "Environment (staging|production)",
-  "staging"
-).option("-o, --output <dir>", "Output directory", "./active-theme").action(downloadCommand);
-program.command("clone").description("Clone theme source code from S3").argument("<theme-name>", "Theme to clone").option(
+).option("-b, --bucket <name>", "[deprecated] ignored").option("-e, --environment <env>", "[deprecated] ignored").option("-o, --output <dir>", "Output directory", "./active-theme").action(downloadCommand);
+program.command("clone").description("Clone theme source code via the website-api").argument("<theme-name>", "Theme to clone").option(
   "-v, --version <version>",
   "Theme version (default: latest)",
   "latest"
-).option("-n, --name <name>", "New theme name (skips interactive prompt)").option("-o, --output <dir>", "Output directory").option("-b, --bucket <name>", "S3 bucket name").option(
-  "-e, --environment <env>",
-  "Environment (staging|production)",
-  "staging"
-).option("--no-install", "Skip running pnpm install after clone").action(cloneCommand);
+).option("-n, --name <name>", "New theme name (skips interactive prompt)").option("-o, --output <dir>", "Output directory").option("-b, --bucket <name>", "[deprecated] ignored").option("-e, --environment <env>", "[deprecated] ignored").option("--no-install", "Skip running pnpm install after clone").action(cloneCommand);
 program.command("config").description("Configure OneX CLI credentials (AWS, API keys)").action(configCommand);
 program.command("login").description("Login to OneX platform").action(loginCommand);
 program.command("logout").description("Logout from OneX platform").action(logoutCommand);