@onexapis/cli 1.1.44 → 1.1.45

package/dist/cli.js

@@ -20,7 +20,6 @@ var inquirer = require('inquirer');
 var archiver = require('archiver');
 var FormData = require('form-data');
 var fetch2 = require('node-fetch');
-var clientS3 = require('@aws-sdk/client-s3');
 var AdmZip = require('adm-zip');
 var chokidar = require('chokidar');
 var http = require('http');
@@ -3486,343 +3485,94 @@ async function deployCommand(options) {
 
 // src/commands/upload.ts
 init_logger();
-function getS3Client() {
-  const adapterMode = (process.env.ADAPTER_MODE || "aws").trim().toLowerCase();
-  if (adapterMode === "vps") {
-    const endpoint = process.env.MINIO_ENDPOINT || "localhost:9000";
-    const secure = process.env.MINIO_SECURE === "true";
-    const endpointUrl = endpoint.startsWith("http") ? endpoint : `${secure ? "https" : "http"}://${endpoint}`;
-    return new clientS3.S3Client({
-      endpoint: endpointUrl,
-      region: "us-east-1",
-      credentials: {
-        accessKeyId: process.env.MINIO_ACCESS_KEY || "minioadmin",
-        secretAccessKey: process.env.MINIO_SECRET_KEY || "minioadmin"
-      },
-      forcePathStyle: true
-    });
-  }
-  if (adapterMode === "local") {
-    return new clientS3.S3Client({
-      endpoint: "http://localhost:4569",
-      region: "ap-southeast-1",
-      credentials: {
-        accessKeyId: "S3RVER",
-        secretAccessKey: "S3RVER"
-      },
-      forcePathStyle: true
-    });
-  }
-  return new clientS3.S3Client({
-    region: process.env.AWS_REGION || "ap-southeast-1"
-  });
-}
-function getBucketName(env) {
-  if (process.env.BUCKET_NAME) {
-    return process.env.BUCKET_NAME;
-  }
-  const environment = env || process.env.ENVIRONMENT || "staging";
-  return environment === "production" ? "theme-s3-bucket" : "theme-s3-bucket";
-}
-async function findCompiledThemeDir(themeId, version2) {
-  const searchPaths = [path9__default.default.resolve(process.cwd(), "dist")];
-  for (const dir of searchPaths) {
-    if (await fs__default.default.pathExists(dir)) {
-      const hasManifest = await fs__default.default.pathExists(path9__default.default.join(dir, "manifest.json"));
-      const hasThemeEntry = await fs__default.default.pathExists(path9__default.default.join(dir, "bundle-entry.js")) || await fs__default.default.pathExists(path9__default.default.join(dir, "theme.config.js")) || await fs__default.default.pathExists(path9__default.default.join(dir, "index.js"));
-      if (hasManifest || hasThemeEntry) {
-        return dir;
-      }
-    }
-  }
-  return null;
-}
-async function readManifest() {
-  const manifestTsPath = path9__default.default.resolve(process.cwd(), "manifest.ts");
-  if (await fs__default.default.pathExists(manifestTsPath)) {
-    try {
-      const module = await import(manifestTsPath);
-      return module.default || module;
-    } catch (error) {
-      logger.warning("Failed to import manifest.ts, trying package.json");
-    }
-  }
-  const packageJsonPath = path9__default.default.resolve(process.cwd(), "package.json");
-  if (await fs__default.default.pathExists(packageJsonPath)) {
-    const pkg = await fs__default.default.readJson(packageJsonPath);
-    return {
-      themeId: pkg.name?.replace("@onex-themes/", "") || "unknown",
-      version: pkg.version || "1.0.0"
-    };
-  }
-  throw new Error(
-    "No manifest.ts or package.json found. Are you in a theme directory?"
+async function uploadCommand(_options) {
+  logger.header("Upload Theme to S3 \u2014 DEPRECATED");
+  console.log();
+  console.log(
+    chalk4__default.default.yellow.bold(
+      "`onexthm upload` is deprecated and no longer functional."
+    )
   );
-}
-async function createZipFromDir(sourceDir, outputPath, excludePatterns = []) {
-  return new Promise((resolve, reject) => {
-    const output = fs__default.default.createWriteStream(outputPath);
-    const archive = archiver__default.default("zip", { zlib: { level: 6 } });
-    output.on("close", () => resolve());
-    archive.on("error", (err) => reject(err));
-    archive.pipe(output);
-    archive.glob("**/*", {
-      cwd: sourceDir,
-      dot: true,
-      ignore: excludePatterns
-    });
-    archive.finalize();
-  });
-}
-async function findSourceDir(themeId, explicitDir) {
-  if (explicitDir) {
-    if (await fs__default.default.pathExists(explicitDir)) return explicitDir;
-    return null;
-  }
-  const searchPaths = [
-    process.cwd(),
-    path9__default.default.resolve(process.cwd(), `../../themes/${themeId}`),
-    path9__default.default.resolve(process.cwd(), `../themes/${themeId}`)
-  ];
-  const markers = ["theme.config.ts", "bundle-entry.ts"];
-  for (const dir of searchPaths) {
-    for (const marker of markers) {
-      if (await fs__default.default.pathExists(path9__default.default.join(dir, marker))) {
-        return dir;
-      }
-    }
-  }
-  return null;
-}
-async function updateLatestPointer(s3Client, bucket, themeId, version2) {
-  const latestData = {
-    version: version2,
-    uploadedAt: (/* @__PURE__ */ new Date()).toISOString()
-  };
-  await s3Client.send(
-    new clientS3.PutObjectCommand({
-      Bucket: bucket,
-      Key: `themes/${themeId}/latest.json`,
-      Body: JSON.stringify(latestData, null, 2),
-      ContentType: "application/json"
-    })
+  console.log();
+  console.log(
+    "The platform no longer exposes themes via direct S3 access, so this"
   );
-}
-async function uploadCommand(options) {
-  logger.header("Upload Theme to S3");
-  const spinner = ora__default.default("Preparing theme upload...").start();
-  try {
-    let themeId;
-    let version2;
-    if (options.theme) {
-      themeId = options.theme;
-      version2 = options.version || "1.0.0";
-    } else {
-      const manifest = await readManifest();
-      themeId = manifest.themeId;
-      version2 = options.version || manifest.version || "1.0.0";
-    }
-    spinner.text = `Found theme: ${themeId}@${version2}`;
-    const bucket = options.bucket || getBucketName(options.environment);
-    const s3Client = getS3Client();
-    const compiledDir = await findCompiledThemeDir(themeId, version2);
-    if (!compiledDir) {
-      spinner.fail(
-        chalk4__default.default.red(
-          `Compiled theme not found for ${themeId}@${version2}. Run 'onexthm build' first.`
-        )
-      );
-      logger.info(chalk4__default.default.gray(`Expected location:
-  - ./dist/`));
-      process.exit(1);
-    }
-    spinner.succeed(`Found compiled theme at: ${compiledDir}`);
-    spinner.start("Creating bundle.zip...");
-    const tmpDir = os__default.default.tmpdir();
-    const bundleZipPath = path9__default.default.join(tmpDir, `${themeId}-${version2}-bundle.zip`);
-    await createZipFromDir(compiledDir, bundleZipPath);
-    const bundleZipBuffer = await fs__default.default.readFile(bundleZipPath);
-    const bundleSizeMB = (bundleZipBuffer.length / 1024 / 1024).toFixed(2);
-    spinner.succeed(`Created bundle.zip (${bundleSizeMB} MB)`);
-    if (options.dryRun) {
-      spinner.info(chalk4__default.default.yellow("Dry run mode \u2014 no files will be uploaded"));
-      console.log();
-      console.log(chalk4__default.default.gray(`  bundle.zip: ${bundleSizeMB} MB`));
-      console.log(
-        chalk4__default.default.cyan(
-          `  S3 path: s3://${bucket}/themes/${themeId}/${version2}/bundle.zip`
-        )
-      );
-      if (!options.skipSource) {
-        const sourceDir = await findSourceDir(themeId, options.sourceDir);
-        if (sourceDir) {
-          console.log(chalk4__default.default.gray(`  source dir: ${sourceDir}`));
-          console.log(
-            chalk4__default.default.cyan(
-              `  S3 path: s3://${bucket}/themes/${themeId}/${version2}/source.zip`
-            )
-          );
-        } else {
-          console.log(
-            chalk4__default.default.yellow("  source dir: not found (source.zip will be skipped)")
-          );
-        }
-      }
-      console.log();
-      await fs__default.default.remove(bundleZipPath);
-      return;
-    }
-    spinner.start("Uploading bundle.zip to S3...");
-    const bundleS3Key = `themes/${themeId}/${version2}/bundle.zip`;
-    await s3Client.send(
-      new clientS3.PutObjectCommand({
-        Bucket: bucket,
-        Key: bundleS3Key,
-        Body: bundleZipBuffer,
-        ContentType: "application/zip"
-      })
-    );
-    spinner.succeed(
-      `Uploaded bundle.zip ${chalk4__default.default.gray(`\u2192 s3://${bucket}/${bundleS3Key}`)}`
-    );
-    await fs__default.default.remove(bundleZipPath);
-    let sourceUploaded = false;
-    if (!options.skipSource) {
-      spinner.start("Looking for source directory...");
-      const sourceDir = await findSourceDir(themeId, options.sourceDir);
-      if (sourceDir) {
-        spinner.succeed(`Found source at: ${sourceDir}`);
-        spinner.start("Creating source.zip...");
-        const sourceZipPath = path9__default.default.join(
-          tmpDir,
-          `${themeId}-${version2}-source.zip`
-        );
-        await createZipFromDir(sourceDir, sourceZipPath, [
-          "node_modules/**",
-          "dist/**",
-          ".git/**",
-          "*.zip",
-          ".next/**",
-          ".turbo/**"
-        ]);
-        const sourceZipBuffer = await fs__default.default.readFile(sourceZipPath);
-        const sourceSizeMB = (sourceZipBuffer.length / 1024 / 1024).toFixed(2);
-        spinner.succeed(`Created source.zip (${sourceSizeMB} MB)`);
-        spinner.start("Uploading source.zip to S3...");
-        const sourceS3Key = `themes/${themeId}/${version2}/source.zip`;
-        await s3Client.send(
-          new clientS3.PutObjectCommand({
-            Bucket: bucket,
-            Key: sourceS3Key,
-            Body: sourceZipBuffer,
-            ContentType: "application/zip"
-          })
-        );
-        spinner.succeed(
-          `Uploaded source.zip ${chalk4__default.default.gray(`\u2192 s3://${bucket}/${sourceS3Key}`)}`
-        );
-        await fs__default.default.remove(sourceZipPath);
-        sourceUploaded = true;
-      } else {
-        spinner.warn(
-          chalk4__default.default.yellow("Source directory not found \u2014 skipping source.zip")
-        );
-      }
-    }
-    spinner.start("Updating latest.json pointer...");
-    await updateLatestPointer(s3Client, bucket, themeId, version2);
-    spinner.succeed("Updated latest.json pointer");
-    console.log();
-    logger.success(chalk4__default.default.green.bold("Theme uploaded successfully!"));
-    console.log();
-    console.log(
-      chalk4__default.default.cyan("   Theme:   ") + chalk4__default.default.white(`${themeId}@${version2}`)
-    );
-    console.log(chalk4__default.default.cyan("   Bucket:  ") + chalk4__default.default.white(bucket));
-    console.log(
-      chalk4__default.default.cyan("   Files:   ") + chalk4__default.default.white(`bundle.zip${sourceUploaded ? " + source.zip" : ""}`)
-    );
-    console.log(
-      chalk4__default.default.cyan("   Path:    ") + chalk4__default.default.gray(`s3://${bucket}/themes/${themeId}/${version2}/`)
-    );
-    console.log();
-  } catch (error) {
-    spinner.fail(chalk4__default.default.red(`Upload failed: ${error.message}`));
-    logger.error(error.stack || error.message);
-    process.exit(1);
-  }
+  console.log(
+    "command can no longer reach the bucket. Use `onexthm publish` instead:"
+  );
+  console.log();
+  console.log(chalk4__default.default.cyan("  cd themes/your-theme"));
+  console.log(chalk4__default.default.cyan("  onexthm login          # one-time, refreshes JWT"));
+  console.log(
+    chalk4__default.default.cyan("  onexthm publish        # builds + uploads + confirms")
+  );
+  console.log();
+  console.log(
+    "`publish` does everything this command did (build, version bump,"
+  );
+  console.log(
+    "bundle + source upload) plus content-hashed asset upload, security"
+  );
+  console.log("scanning, and atomic version registration in one step.");
+  console.log();
+  process.exit(1);
 }
 
 // src/commands/download.ts
 init_logger();
-function getS3Client2() {
-  const adapterMode = (process.env.ADAPTER_MODE || "aws").trim().toLowerCase();
-  if (adapterMode === "vps") {
-    const endpoint = process.env.MINIO_ENDPOINT || "localhost:9000";
-    const secure = process.env.MINIO_SECURE === "true";
-    const endpointUrl = endpoint.startsWith("http") ? endpoint : `${secure ? "https" : "http"}://${endpoint}`;
-    return new clientS3.S3Client({
-      endpoint: endpointUrl,
-      region: "us-east-1",
-      credentials: {
-        accessKeyId: process.env.MINIO_ACCESS_KEY || "minioadmin",
-        secretAccessKey: process.env.MINIO_SECRET_KEY || "minioadmin"
-      },
-      forcePathStyle: true
-    });
-  }
-  if (adapterMode === "local") {
-    return new clientS3.S3Client({
-      endpoint: "http://localhost:4569",
-      region: "ap-southeast-1",
-      credentials: {
-        accessKeyId: "S3RVER",
-        secretAccessKey: "S3RVER"
-      },
-      forcePathStyle: true
-    });
+function unwrapEnvelope(raw) {
+  if (raw && typeof raw === "object" && "statusCode" in raw && "body" in raw) {
+    return raw.body;
   }
-  return new clientS3.S3Client({
-    region: process.env.AWS_REGION || "ap-southeast-1"
-  });
+  return raw;
 }
-function getBucketName2(env) {
-  if (process.env.BUCKET_NAME) {
-    return process.env.BUCKET_NAME;
+async function resolveLatestVersion(apiUrl, themeId) {
+  const url = `${apiUrl}/website-api/themes/${encodeURIComponent(themeId)}/versions`;
+  let response;
+  try {
+    response = await fetch(url, { cache: "no-store" });
+  } catch (err) {
+    throw new Error(
+      `Network error contacting ${url}: ${err instanceof Error ? err.message : "unknown"}`
+    );
   }
-  const environment = env || process.env.ENVIRONMENT || "staging";
-  return environment === "production" ? "theme-s3-bucket" : "theme-s3-bucket";
-}
-async function streamToString(stream) {
-  const chunks = [];
-  for await (const chunk of stream) {
-    chunks.push(Buffer.from(chunk));
+  if (!response.ok) {
+    throw new Error(
+      `Version lookup failed for "${themeId}" (HTTP ${response.status})`
+    );
   }
-  return Buffer.concat(chunks).toString("utf-8");
-}
-async function streamToBuffer(stream) {
-  const chunks = [];
-  for await (const chunk of stream) {
-    chunks.push(Buffer.from(chunk));
+  const raw = await response.json();
+  const data = unwrapEnvelope(raw);
+  const latest = data?.latest_version;
+  if (typeof latest !== "string" || latest.length === 0) {
+    throw new Error(
+      `Theme "${themeId}" has no published versions yet (no latest_version in response)`
+    );
   }
-  return Buffer.concat(chunks);
+  return latest;
 }
-async function resolveLatestVersion(s3Client, bucket, themeId) {
-  try {
-    const response = await s3Client.send(
-      new clientS3.GetObjectCommand({
-        Bucket: bucket,
-        Key: `themes/${themeId}/latest.json`
-      })
-    );
-    const body = await streamToString(response.Body);
-    const data = JSON.parse(body);
-    return data.version;
-  } catch (error) {
+async function downloadBundleZip(apiUrl, themeId, version2) {
+  const url = `${apiUrl}/website-api/themes/${encodeURIComponent(themeId)}/${encodeURIComponent(version2)}/download`;
+  const response = await fetch(url);
+  if (!response.ok) {
     throw new Error(
-      `Failed to resolve latest version for theme "${themeId}": ${error.message}`
+      `Bundle download failed for "${themeId}@${version2}" (HTTP ${response.status})`
     );
   }
+  const contentType = response.headers.get("content-type") || "";
+  if (contentType.includes("application/json")) {
+    const raw = await response.json();
+    const envelope = raw && typeof raw === "object" && "statusCode" in raw ? raw : { body: raw };
+    const body = envelope.body;
+    if (typeof body !== "string") {
+      throw new Error(
+        "Unexpected /download response shape: expected base64 string in body"
+      );
+    }
+    return Buffer.from(body, "base64");
+  }
+  const arrayBuffer = await response.arrayBuffer();
+  return Buffer.from(arrayBuffer);
 }
 async function createCompatibilityFiles(outputDir, manifest) {
   const entryFile = manifest.output?.entry || "bundle-entry.js";
@@ -3846,47 +3596,58 @@ export * from './bundle-entry.js';
   const pkgJsonPath = path9__default.default.join(outputDir, "package.json");
   await fs__default.default.writeFile(pkgJsonPath, '{\n  "type": "module"\n}\n', "utf-8");
 }
-function showDownloadFailureHelp(themeId, bucket) {
+function showDownloadFailureHelp(themeId, apiUrl) {
   console.log();
   logger.error(chalk4__default.default.red.bold("Theme download failed"));
   console.log();
   console.log(chalk4__default.default.yellow("Possible reasons:"));
-  console.log(chalk4__default.default.gray("  1. Theme not uploaded to S3 yet"));
-  console.log(chalk4__default.default.gray("  2. AWS credentials not configured correctly"));
-  console.log(chalk4__default.default.gray("  3. Bucket name or region is incorrect"));
-  console.log(chalk4__default.default.gray("  4. bundle.zip is missing or corrupted"));
+  console.log(
+    chalk4__default.default.gray("  1. Theme has not been published yet (run `onexthm publish`)")
+  );
+  console.log(
+    chalk4__default.default.gray(
+      "  2. Theme ID is wrong (typo in --theme-id or THEME_ID env var)"
+    )
+  );
+  console.log(
+    chalk4__default.default.gray("  3. API base URL is wrong or the website-api is unreachable")
+  );
   console.log();
   console.log(chalk4__default.default.cyan.bold("To fix this:"));
   console.log();
-  console.log(chalk4__default.default.white("1. Compile and upload the theme:"));
-  console.log(chalk4__default.default.gray(`   cd themes/${themeId}`));
-  console.log(chalk4__default.default.gray("   pnpm build"));
-  console.log(chalk4__default.default.gray("   onexthm upload"));
-  console.log();
-  console.log(chalk4__default.default.white("2. Verify AWS credentials are set:"));
+  console.log(chalk4__default.default.white("1. Verify the theme is published:"));
   console.log(
-    chalk4__default.default.gray("   - Set AWS_ACCESS_KEY_ID and AWS_SECRET_ACCESS_KEY")
+    chalk4__default.default.gray(
+      `   curl -s ${apiUrl}/website-api/themes/${themeId}/versions | jq .latest_version`
+    )
   );
-  console.log(chalk4__default.default.gray("   - Or use AWS_PROFILE=your-profile"));
-  console.log(chalk4__default.default.gray("   - Set AWS_REGION (e.g., ap-southeast-1)"));
   console.log();
-  console.log(chalk4__default.default.white("3. Check bucket configuration:"));
-  console.log(chalk4__default.default.gray(`   Current bucket: ${bucket}`));
+  console.log(chalk4__default.default.white("2. Check API URL configuration:"));
+  console.log(chalk4__default.default.gray(`   Current API URL: ${apiUrl}`));
   console.log(
-    chalk4__default.default.gray("   Set BUCKET_NAME environment variable if different")
+    chalk4__default.default.gray("   Override with NEXT_PUBLIC_API_URL or ONEXTHM_API_URL")
   );
   console.log();
-  console.log(chalk4__default.default.white("4. Verify theme exists in S3:"));
-  console.log(chalk4__default.default.gray(`   aws s3 ls s3://${bucket}/themes/${themeId}/`));
+  console.log(chalk4__default.default.white("3. Pin a specific version (CI/production):"));
+  console.log(
+    chalk4__default.default.gray(`   THEME_VERSION=1.2.3 onexthm download --theme-id ${themeId}`)
+  );
   console.log();
 }
 async function downloadCommand(options) {
-  logger.header("Download Theme from S3");
+  logger.header("Download Theme");
   const spinner = ora__default.default("Initializing download...").start();
+  if (options.bucket || options.environment) {
+    spinner.stop();
+    logger.warning(
+      "--bucket and --environment are deprecated and ignored. Themes are now served via HTTP from the website-api Lambda."
+    );
+    spinner.start();
+  }
+  const apiUrl = getApiUrl();
   try {
     const themeId = options.themeId || process.env.NEXT_PUBLIC_THEME_ID || process.env.THEME_ID;
-    const version2 = options.version || process.env.THEME_VERSION || "latest";
-    const bucket = options.bucket || getBucketName2(options.environment);
+    const requestedVersion = options.version || process.env.THEME_VERSION || "latest";
     const outputDir = options.output || "./active-theme";
     if (!themeId) {
       spinner.fail(
@@ -3896,12 +3657,10 @@ async function downloadCommand(options) {
       );
       process.exit(1);
     }
-    spinner.text = `Downloading ${themeId}@${version2} from ${bucket}...`;
-    const s3Client = getS3Client2();
-    let resolvedVersion = version2;
-    if (version2 === "latest") {
-      spinner.text = "Resolving latest version...";
-      resolvedVersion = await resolveLatestVersion(s3Client, bucket, themeId);
+    spinner.text = `Resolving ${themeId}@${requestedVersion}...`;
+    let resolvedVersion = requestedVersion;
+    if (requestedVersion === "latest") {
+      resolvedVersion = await resolveLatestVersion(apiUrl, themeId);
       spinner.succeed(
         `Resolved latest version: ${chalk4__default.default.cyan(resolvedVersion)}`
       );
@@ -3911,24 +3670,19 @@ async function downloadCommand(options) {
           chalk4__default.default.yellow(
             `
   Warning: Resolved "latest" to ${resolvedVersion} in CI environment.
-  For production builds, pin to a specific version:
+  For reproducible builds, pin to a specific version:
     THEME_VERSION=${resolvedVersion}
 `
           )
         );
       }
+    } else {
+      spinner.succeed(`Using version: ${chalk4__default.default.cyan(resolvedVersion)}`);
     }
     spinner.start(
       `Downloading bundle.zip for ${themeId}@${resolvedVersion}...`
     );
-    const s3Key = `themes/${themeId}/${resolvedVersion}/bundle.zip`;
-    const response = await s3Client.send(
-      new clientS3.GetObjectCommand({
-        Bucket: bucket,
-        Key: s3Key
-      })
-    );
-    const zipBuffer = await streamToBuffer(response.Body);
+    const zipBuffer = await downloadBundleZip(apiUrl, themeId, resolvedVersion);
     const sizeMB = (zipBuffer.length / 1024 / 1024).toFixed(2);
     spinner.succeed(`Downloaded bundle.zip (${sizeMB} MB)`);
     spinner.start("Extracting bundle...");
@@ -3947,7 +3701,7 @@ async function downloadCommand(options) {
     console.log(
       chalk4__default.default.cyan("   Theme:   ") + chalk4__default.default.white(`${themeId}@${resolvedVersion}`)
     );
-    console.log(chalk4__default.default.cyan("   Bucket:  ") + chalk4__default.default.white(bucket));
+    console.log(chalk4__default.default.cyan("   Source:  ") + chalk4__default.default.white(apiUrl));
     console.log(chalk4__default.default.cyan("   Output:  ") + chalk4__default.default.white(outputDir));
     console.log(chalk4__default.default.cyan("   Files:   ") + chalk4__default.default.white(entries.length));
     if (manifest.counts) {
@@ -3959,82 +3713,70 @@ async function downloadCommand(options) {
   } catch (error) {
     spinner.fail(chalk4__default.default.red("Download failed"));
     logger.error(error.message);
-    const themeId = options.themeId || process.env.NEXT_PUBLIC_THEME_ID || "unknown";
-    const bucket = options.bucket || getBucketName2(options.environment);
-    showDownloadFailureHelp(themeId, bucket);
+    const themeId = options.themeId || process.env.NEXT_PUBLIC_THEME_ID || process.env.THEME_ID || "unknown";
+    showDownloadFailureHelp(themeId, apiUrl);
     process.exit(1);
   }
 }
 
 // src/commands/clone.ts
 init_logger();
-function getS3Client3() {
-  const adapterMode = (process.env.ADAPTER_MODE || "aws").trim().toLowerCase();
-  if (adapterMode === "vps") {
-    const endpoint = process.env.MINIO_ENDPOINT || "localhost:9000";
-    const secure = process.env.MINIO_SECURE === "true";
-    const endpointUrl = endpoint.startsWith("http") ? endpoint : `${secure ? "https" : "http"}://${endpoint}`;
-    return new clientS3.S3Client({
-      endpoint: endpointUrl,
-      region: "us-east-1",
-      credentials: {
-        accessKeyId: process.env.MINIO_ACCESS_KEY || "minioadmin",
-        secretAccessKey: process.env.MINIO_SECRET_KEY || "minioadmin"
-      },
-      forcePathStyle: true
-    });
-  }
-  if (adapterMode === "local") {
-    return new clientS3.S3Client({
-      endpoint: "http://localhost:4569",
-      region: "ap-southeast-1",
-      credentials: {
-        accessKeyId: "S3RVER",
-        secretAccessKey: "S3RVER"
-      },
-      forcePathStyle: true
-    });
+function unwrapEnvelope2(raw) {
+  if (raw && typeof raw === "object" && "statusCode" in raw && "body" in raw) {
+    return raw.body;
   }
-  return new clientS3.S3Client({
-    region: process.env.AWS_REGION || "ap-southeast-1"
-  });
+  return raw;
 }
-function getBucketName3(env) {
-  if (process.env.BUCKET_NAME) {
-    return process.env.BUCKET_NAME;
-  }
-  const environment = env || process.env.ENVIRONMENT || "staging";
-  return environment === "production" ? "theme-s3-bucket" : "theme-s3-bucket";
-}
-async function streamToString2(stream) {
-  const chunks = [];
-  for await (const chunk of stream) {
-    chunks.push(Buffer.from(chunk));
+async function resolveLatestVersion2(apiUrl, themeId) {
+  const url = `${apiUrl}/website-api/themes/${encodeURIComponent(themeId)}/versions`;
+  const response = await fetch(url, { cache: "no-store" });
+  if (!response.ok) {
+    throw new Error(
+      `Version lookup failed for "${themeId}" (HTTP ${response.status})`
+    );
   }
-  return Buffer.concat(chunks).toString("utf-8");
-}
-async function streamToBuffer2(stream) {
-  const chunks = [];
-  for await (const chunk of stream) {
-    chunks.push(Buffer.from(chunk));
+  const raw = await response.json();
+  const data = unwrapEnvelope2(raw);
+  const latest = data?.latest_version;
+  if (typeof latest !== "string" || latest.length === 0) {
+    throw new Error(`Theme "${themeId}" has no published versions yet`);
   }
-  return Buffer.concat(chunks);
+  return latest;
 }
-async function resolveLatestVersion2(s3Client, bucket, themeId) {
-  try {
-    const response = await s3Client.send(
-      new clientS3.GetObjectCommand({
-        Bucket: bucket,
-        Key: `themes/${themeId}/latest.json`
-      })
+async function fetchSourceZip(apiUrl, themeId, version2) {
+  const url = `${apiUrl}/website-api/themes/${encodeURIComponent(themeId)}/source?version=${encodeURIComponent(version2)}`;
+  const response = await authenticatedFetch(url, {
+    method: "GET"
+  });
+  if (!response.ok) {
+    if (response.status === 404) {
+      throw new Error(
+        `Source not found for ${themeId}@${version2}. The theme may not have been published with source upload enabled.`
+      );
+    }
+    if (response.status === 401 || response.status === 403) {
+      throw new Error(
+        `Not authorized to download source for "${themeId}". Run \`onexthm login\` first.`
+      );
+    }
+    throw new Error(
+      `Source URL request failed for "${themeId}@${version2}" (HTTP ${response.status})`
     );
-    const body = await streamToString2(response.Body);
-    return JSON.parse(body).version;
-  } catch (error) {
+  }
+  const raw = await response.json();
+  const data = unwrapEnvelope2(raw);
+  const presignedUrl = data?.download_url;
+  if (typeof presignedUrl !== "string" || presignedUrl.length === 0) {
+    throw new Error("Unexpected /source response shape: missing download_url");
+  }
+  const zipResponse = await fetch(presignedUrl);
+  if (!zipResponse.ok) {
     throw new Error(
-      `Failed to resolve latest version for theme "${themeId}": ${error.message}`
+      `Presigned source download failed (HTTP ${zipResponse.status})`
     );
   }
+  const arrayBuffer = await zipResponse.arrayBuffer();
+  return Buffer.from(arrayBuffer);
 }
 function runInstall(cwd) {
   return new Promise((resolve) => {
@@ -4133,15 +3875,24 @@ async function renameTheme(themeDir, oldName, newName) {
 }
 async function cloneCommand(themeName, options) {
   logger.header("Clone Theme Source");
+  if (options.bucket || options.environment) {
+    logger.warning(
+      "--bucket and --environment are deprecated and ignored. Source is now fetched via HTTP from the website-api Lambda."
+    );
+  }
+  const tokens = await getValidTokens();
+  if (!tokens) {
+    logger.error("Not logged in. Run: onexthm login");
+    process.exit(1);
+  }
   let newName = options.name;
   if (!newName) {
     newName = await promptThemeName(themeName);
   }
   const spinner = ora__default.default("Initializing clone...").start();
   try {
-    const bucket = options.bucket || getBucketName3(options.environment);
+    const apiUrl = getApiUrl();
     const outputDir = options.output || path9__default.default.resolve(process.cwd(), newName);
-    const s3Client = getS3Client3();
     if (await fs__default.default.pathExists(outputDir)) {
       spinner.fail(chalk4__default.default.red(`Directory already exists: ${outputDir}`));
       logger.info(
@@ -4154,28 +3905,20 @@ async function cloneCommand(themeName, options) {
     let version2 = options.version || "latest";
     if (version2 === "latest") {
       spinner.text = "Resolving latest version...";
-      version2 = await resolveLatestVersion2(s3Client, bucket, themeName);
+      version2 = await resolveLatestVersion2(apiUrl, themeName);
       spinner.succeed(`Resolved latest version: ${chalk4__default.default.cyan(version2)}`);
     }
     spinner.start(`Downloading source.zip for ${themeName}@${version2}...`);
-    const s3Key = `themes/${themeName}/${version2}/source.zip`;
     let zipBuffer;
     try {
-      const response = await s3Client.send(
-        new clientS3.GetObjectCommand({
-          Bucket: bucket,
-          Key: s3Key
-        })
-      );
-      zipBuffer = await streamToBuffer2(response.Body);
+      zipBuffer = await fetchSourceZip(apiUrl, themeName, version2);
     } catch (error) {
-      spinner.fail(chalk4__default.default.red(`Source not found: s3://${bucket}/${s3Key}`));
+      spinner.fail(chalk4__default.default.red(error.message));
       console.log();
       console.log(
-        chalk4__default.default.yellow("The theme source may not have been uploaded yet.")
-      );
-      console.log(
-        chalk4__default.default.gray(`Upload source with: onexthm upload --theme ${themeName}`)
+        chalk4__default.default.gray(
+          `Verify the theme is published: curl -s ${apiUrl}/website-api/themes/${themeName}/versions`
+        )
       );
       console.log();
       process.exit(1);
@@ -4358,10 +4101,7 @@ function createDevServer(options) {
         return;
       }
       if (segments.length > 1) {
-        const fallbackPath = path9__default.default.join(
-          assetsBase,
-          segments.slice(1).join("/")
-        );
+        const fallbackPath = path9__default.default.join(assetsBase, segments.slice(1).join("/"));
         if (fallbackPath.startsWith(assetsBase) && fs3__default.default.existsSync(fallbackPath)) {
           serveFile(res, fallbackPath);
           return;
@@ -5299,11 +5039,11 @@ Or use the --bump flag:
   logger.success(`\u2713 Theme "${themeId}" v${version2} published!`);
 }
 async function createZip(sourceDir, outputPath, exclude) {
-  const archiver3 = (await import('archiver')).default;
+  const archiver2 = (await import('archiver')).default;
   const { createWriteStream } = await import('fs');
   return new Promise((resolve, reject) => {
     const output = createWriteStream(outputPath);
-    const archive = archiver3("zip", { zlib: { level: 9 } });
+    const archive = archiver2("zip", { zlib: { level: 9 } });
     output.on("close", resolve);
     archive.on("error", reject);
     archive.pipe(output);
@@ -5366,29 +5106,17 @@ program.command("deploy").description("Upload theme package to API server").opti
   "-e, --environment <env>",
   "Environment (production, staging, development)"
 ).action(deployCommand);
-program.command("upload").description("Upload compiled theme to S3 bucket").option("-t, --theme <theme>", "Theme to upload").option("-b, --bucket <name>", "S3 bucket name").option("-v, --version <version>", "Theme version").option(
-  "-e, --environment <env>",
-  "Environment (staging|production)",
-  "staging"
-).option("--dry-run", "Show what would be uploaded without uploading").option("--skip-source", "Skip uploading source.zip").option("--source-dir <dir>", "Source directory path").action(uploadCommand);
-program.command("download").description("Download theme from S3 bucket").option("-t, --theme-id <id>", "Theme ID to download").option(
+program.command("upload").description("[deprecated] use `onexthm publish` instead").option("-t, --theme <theme>", "[deprecated] ignored").option("-b, --bucket <name>", "[deprecated] ignored").option("-v, --version <version>", "[deprecated] ignored").option("-e, --environment <env>", "[deprecated] ignored").option("--dry-run", "[deprecated] ignored").option("--skip-source", "[deprecated] ignored").option("--source-dir <dir>", "[deprecated] ignored").action(uploadCommand);
+program.command("download").description("Download a published theme via the website-api").option("-t, --theme-id <id>", "Theme ID to download").option(
   "-v, --version <version>",
   "Theme version (default: latest)",
   "latest"
-).option("-b, --bucket <name>", "S3 bucket name").option(
-  "-e, --environment <env>",
-  "Environment (staging|production)",
-  "staging"
-).option("-o, --output <dir>", "Output directory", "./active-theme").action(downloadCommand);
-program.command("clone").description("Clone theme source code from S3").argument("<theme-name>", "Theme to clone").option(
+).option("-b, --bucket <name>", "[deprecated] ignored").option("-e, --environment <env>", "[deprecated] ignored").option("-o, --output <dir>", "Output directory", "./active-theme").action(downloadCommand);
+program.command("clone").description("Clone theme source code via the website-api").argument("<theme-name>", "Theme to clone").option(
   "-v, --version <version>",
   "Theme version (default: latest)",
   "latest"
-).option("-n, --name <name>", "New theme name (skips interactive prompt)").option("-o, --output <dir>", "Output directory").option("-b, --bucket <name>", "S3 bucket name").option(
-  "-e, --environment <env>",
-  "Environment (staging|production)",
-  "staging"
-).option("--no-install", "Skip running pnpm install after clone").action(cloneCommand);
+).option("-n, --name <name>", "New theme name (skips interactive prompt)").option("-o, --output <dir>", "Output directory").option("-b, --bucket <name>", "[deprecated] ignored").option("-e, --environment <env>", "[deprecated] ignored").option("--no-install", "Skip running pnpm install after clone").action(cloneCommand);
 program.command("config").description("Configure OneX CLI credentials (AWS, API keys)").action(configCommand);
 program.command("login").description("Login to OneX platform").action(loginCommand);
 program.command("logout").description("Logout from OneX platform").action(logoutCommand);