@se-studio/contentful-cms 3.14.2 → 3.15.1

package/dist/staged-upload/intake-policy.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"intake-policy.js","sourceRoot":"","sources":["../../src/staged-upload/intake-policy.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,aAAa,EAAE,sBAAsB,EAAE,MAAM,uCAAuC,CAAC;AAC9F,OAAO,EAAE,uBAAuB,EAAE,MAAM,gCAAgC,CAAC;AACzE,OAAO,EAAE,uBAAuB,EAAE,MAAM,aAAa,CAAC;AACtD,OAAO,EAAE,iBAAiB,EAAyB,MAAM,WAAW,CAAC;AAKrE,MAAM,UAAU,WAAW,CAAC,MAK3B;IACC,IAAI,MAAM,CAAC,IAAI,KAAK,OAAO,EAAE,CAAC;QAC5B,OAAO,UAAU,CAAC;IACpB,CAAC;IACD,MAAM,IAAI,GAAG,iBAAiB,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC;IAChD,IAAI,aAAa,CAAC,IAAI,EAAE,MAAM,CAAC,QAAQ,CAAC,EAAE,CAAC;QACzC,OAAO,QAAQ,CAAC;IAClB,CAAC;IACD,IAAI,CAAC,sBAAsB,CAAC,IAAI,EAAE,MAAM,CAAC,QAAQ,CAAC,EAAE,CAAC;QACnD,OAAO,UAAU,CAAC;IACpB,CAAC;IACD,IAAI,MAAM,CAAC,UAAU,KAAK,SAAS,IAAI,MAAM,CAAC,UAAU,GAAG,uBAAuB,EAAE,CAAC;QACnF,OAAO,QAAQ,CAAC;IAClB,CAAC;IACD,OAAO,UAAU,CAAC;AACpB,CAAC;AAED,MAAM,UAAU,cAAc,CAAC,KAAkB;IAC/C,OAAO,KAAK,KAAK,QAAQ,CAAC,CAAC,CAAC,uBAAuB,CAAC,CAAC,CAAC,uBAAuB,CAAC;AAChF,CAAC;AAED,qGAAqG;AACrG,MAAM,UAAU,sBAAsB,CAAC,KAAkB,EAAE,UAA8B;IACvF,IAAI,UAAU,KAAK,SAAS,EAAE,CAAC;QAC7B,OAAO;IACT,CAAC;IACD,MAAM,GAAG,GAAG,cAAc,CAAC,KAAK,CAAC,CAAC;IAClC,IAAI,UAAU,GAAG,GAAG,EAAE,CAAC;QACrB,MAAM,KAAK,GACT,KAAK,KAAK,QAAQ;YAChB,CAAC,CAAC,GAAG,MAAM,CAAC,uBAAuB,GAAG,CAAC,IAAI,GAAG,IAAI,CAAC,CAAC,kBAAkB;YACtE,CAAC,CAAC,GAAG,MAAM,CAAC,uBAAuB,GAAG,CAAC,IAAI,GAAG,IAAI,CAAC,CAAC,yBAAyB,CAAC;QAClF,MAAM,IAAI,KAAK,CACb,uBAAuB,MAAM,CAAC,UAAU,CAAC,gBAAgB,KAAK,WAAW,MAAM,CAAC,GAAG,CAAC,UAAU,CAC/F,CAAC;IACJ,CAAC;AACH,CAAC"}

package/dist/staged-upload/request.d.ts

@@ -1,3 +1,4 @@
+import { type DirectIntakeParams, type DirectIntakeResult } from './direct-intake.js';
 import { type StagedUploadKind } from './mime.js';
 import type { StagedUploadStore } from './store.js';
 import type { StagedUploadRequestResult } from './types.js';
@@ -9,5 +10,8 @@ export interface CreateStagedUploadRequestParams {
     title?: string;
     kind?: StagedUploadKind | string;
 }
-export declare function createStagedUploadRequest(store: StagedUploadStore, params: CreateStagedUploadRequestParams): Promise<StagedUploadRequestResult>;
+export interface StagedUploadDeps {
+    createDirectIntake?: (params: DirectIntakeParams) => Promise<DirectIntakeResult>;
+}
+export declare function createStagedUploadRequest(store: StagedUploadStore, params: CreateStagedUploadRequestParams, deps?: StagedUploadDeps): Promise<StagedUploadRequestResult>;
 //# sourceMappingURL=request.d.ts.map

package/dist/staged-upload/request.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"request.d.ts","sourceRoot":"","sources":["../../src/staged-upload/request.ts"],"names":[],"mappings":"AAIA,OAAO,EAAyB,KAAK,gBAAgB,EAAE,MAAM,WAAW,CAAC;AACzE,OAAO,KAAK,EAAE,iBAAiB,EAAE,MAAM,YAAY,CAAC;AACpD,OAAO,KAAK,EAAE,yBAAyB,EAAE,MAAM,YAAY,CAAC;AAE5D,MAAM,WAAW,+BAA+B;IAC9C,MAAM,EAAE,MAAM,CAAC;IACf,QAAQ,EAAE,MAAM,CAAC;IACjB,QAAQ,EAAE,MAAM,CAAC;IACjB,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,IAAI,CAAC,EAAE,gBAAgB,GAAG,MAAM,CAAC;CAClC;AAgCD,wBAAsB,yBAAyB,CAC7C,KAAK,EAAE,iBAAiB,EACxB,MAAM,EAAE,+BAA+B,GACtC,OAAO,CAAC,yBAAyB,CAAC,CA6BpC"}
+{"version":3,"file":"request.d.ts","sourceRoot":"","sources":["../../src/staged-upload/request.ts"],"names":[],"mappings":"AAEA,OAAO,EAEL,KAAK,kBAAkB,EACvB,KAAK,kBAAkB,EAExB,MAAM,oBAAoB,CAAC;AAI5B,OAAO,EAAkD,KAAK,gBAAgB,EAAE,MAAM,WAAW,CAAC;AAClG,OAAO,KAAK,EAAE,iBAAiB,EAAE,MAAM,YAAY,CAAC;AACpD,OAAO,KAAK,EAAE,yBAAyB,EAAE,MAAM,YAAY,CAAC;AAE5D,MAAM,WAAW,+BAA+B;IAC9C,MAAM,EAAE,MAAM,CAAC;IACf,QAAQ,EAAE,MAAM,CAAC;IACjB,QAAQ,EAAE,MAAM,CAAC;IACjB,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,IAAI,CAAC,EAAE,gBAAgB,GAAG,MAAM,CAAC;CAClC;AAMD,MAAM,WAAW,gBAAgB;IAC/B,kBAAkB,CAAC,EAAE,CAAC,MAAM,EAAE,kBAAkB,KAAK,OAAO,CAAC,kBAAkB,CAAC,CAAC;CAClF;AA4BD,wBAAsB,yBAAyB,CAC7C,KAAK,EAAE,iBAAiB,EACxB,MAAM,EAAE,+BAA+B,EACvC,IAAI,GAAE,gBAAqB,GAC1B,OAAO,CAAC,yBAAyB,CAAC,CA0DpC"}

package/dist/staged-upload/request.js

@@ -1,8 +1,10 @@
 import { requiresPipelineEncode } from '../contentful/pipeline-encode-gate.js';
 import { getPublicOrigin } from '../hosted/oauth/config.js';
+import { createDirectIntakeUpload, directIntakeCurl, } from './direct-intake.js';
 import { buildStagedUploadUrl, getUploadHmacSecret } from './hmac.js';
+import { assertIntakeByteLength, intakeRoute } from './intake-policy.js';
 import { hostedStagedMaxBytes, STAGED_UPLOAD_TTL_SECONDS } from './limits.js';
-import { parseStagedUploadKind } from './mime.js';
+import { isAllowedStagedMimeType, parseStagedUploadKind } from './mime.js';
 function shellQuote(value) {
     return `'${value.replace(/'/g, `'\\''`)}'`;
 }
@@ -27,8 +29,34 @@ function buildConsumeArgs(kind, uploadId, params) {
             ...(params.title ? ['--title', params.title] : []),
         ];
 }
-export async function createStagedUploadRequest(store, params) {
+export async function createStagedUploadRequest(store, params, deps = {}) {
     const kind = parseStagedUploadKind(typeof params.kind === 'string' ? params.kind : undefined);
+    if (!isAllowedStagedMimeType(params.mimeType, kind)) {
+        throw new Error(`MIME type not allowed for staged upload (${kind}): ${params.mimeType}`);
+    }
+    const route = intakeRoute({
+        kind,
+        mimeType: params.mimeType,
+        fileName: params.fileName,
+        byteLength: params.byteLength,
+    });
+    assertIntakeByteLength(route, params.byteLength);
+    if (route === 'direct') {
+        await store.assertRateLimit(params.userId);
+        const createDirect = deps.createDirectIntake ?? createDirectIntakeUpload;
+        const direct = await createDirect(params);
+        return {
+            uploadId: direct.uploadId,
+            uploadUrl: direct.presignedUrl,
+            expiresIn: STAGED_UPLOAD_TTL_SECONDS,
+            expiresAt: direct.expiresAt,
+            maxBytes: direct.maxBytes,
+            curlCommand: directIntakeCurl(direct.presignedUrl, params.mimeType, params.fileName),
+            consumeArgs: ['media', 'prepare', '--https-urls', direct.publicUrl],
+            intake: 'direct',
+            publicUrl: direct.publicUrl,
+        };
+    }
     const uploadId = await store.createPending({
         userId: params.userId,
         fileName: params.fileName,
@@ -50,6 +78,7 @@ export async function createStagedUploadRequest(store, params) {
         maxBytes: hostedStagedMaxBytes(),
         curlCommand,
         consumeArgs,
+        intake: 'function',
     };
 }
 //# sourceMappingURL=request.js.map

package/dist/staged-upload/request.js.map

@@ -1 +1 @@
-{"version":3,"file":"request.js","sourceRoot":"","sources":["../../src/staged-upload/request.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,sBAAsB,EAAE,MAAM,uCAAuC,CAAC;AAC/E,OAAO,EAAE,eAAe,EAAE,MAAM,2BAA2B,CAAC;AAC5D,OAAO,EAAE,oBAAoB,EAAE,mBAAmB,EAAE,MAAM,WAAW,CAAC;AACtE,OAAO,EAAE,oBAAoB,EAAE,yBAAyB,EAAE,MAAM,aAAa,CAAC;AAC9E,OAAO,EAAE,qBAAqB,EAAyB,MAAM,WAAW,CAAC;AAazE,SAAS,UAAU,CAAC,KAAa;IAC/B,OAAO,IAAI,KAAK,CAAC,OAAO,CAAC,IAAI,EAAE,OAAO,CAAC,GAAG,CAAC;AAC7C,CAAC;AAED,SAAS,gBAAgB,CACvB,IAAsB,EACtB,QAAgB,EAChB,MAAuC;IAEvC,IAAI,IAAI,KAAK,MAAM,EAAE,CAAC;QACpB,OAAO,CAAC,KAAK,EAAE,UAAU,EAAE,QAAQ,CAAC,CAAC;IACvC,CAAC;IACD,IAAI,IAAI,KAAK,MAAM,EAAE,CAAC;QACpB,OAAO,CAAC,QAAQ,EAAE,WAAW,EAAE,UAAU,EAAE,QAAQ,CAAC,CAAC;IACvD,CAAC;IACD,OAAO,sBAAsB,CAAC,MAAM,CAAC,QAAQ,EAAE,MAAM,CAAC,QAAQ,CAAC;QAC7D,CAAC,CAAC,CAAC,OAAO,EAAE,SAAS,EAAE,cAAc,EAAE,QAAQ,CAAC;QAChD,CAAC,CAAC;YACE,OAAO;YACP,QAAQ;YACR,UAAU;YACV,QAAQ;YACR,QAAQ;YACR,MAAM,CAAC,QAAQ;YACf,aAAa;YACb,MAAM,CAAC,QAAQ;YACf,GAAG,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,SAAS,EAAE,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;SACnD,CAAC;AACR,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,yBAAyB,CAC7C,KAAwB,EACxB,MAAuC;IAEvC,MAAM,IAAI,GAAG,qBAAqB,CAAC,OAAO,MAAM,CAAC,IAAI,KAAK,QAAQ,CAAC,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC;IAE9F,MAAM,QAAQ,GAAG,MAAM,KAAK,CAAC,aAAa,CAAC;QACzC,MAAM,EAAE,MAAM,CAAC,MAAM;QACrB,QAAQ,EAAE,MAAM,CAAC,QAAQ;QACzB,QAAQ,EAAE,MAAM,CAAC,QAAQ;QACzB,IAAI;QACJ,UAAU,EAAE,MAAM,CAAC,UAAU;KAC9B,CAAC,CAAC;IAEH,MAAM,MAAM,GAAG,mBAAmB,EAAE,CAAC;IACrC,MAAM,MAAM,GAAG,eAAe,EAAE,CAAC;IACjC,MAAM,GAAG,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC,GAAG,yBAAyB,CAAC;IACtE,MAAM,SAAS,GAAG,oBAAoB,CAAC,MAAM,EAAE,QAAQ,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,EAAE,MAAM,CAAC,CAAC;IAErF,MAAM,WAAW,GAAG,gBAAgB,CAAC,IAAI,EAAE,QAAQ,EAAE,MAAM,CAAC,CAAC;IAE7D,MAAM,WAAW,GAAG,sBAAsB,UAAU,CAAC,kBAAkB,MAAM,CAAC,QAAQ,EAAE,CAAC,IAAI,UAAU,CAAC,SAAS,CAAC,EAAE,CAAC;IAErH,OAAO;QACL,QAAQ;QACR,SAAS;QACT,SAAS,EAAE,yBAAyB;QACpC,SAAS,EAAE,GAAG;QACd,QAAQ,EAAE,oBAAoB,EAAE;QAChC,WAAW;QACX,WAAW;KACZ,CAAC;AACJ,CAAC"}
+{"version":3,"file":"request.js","sourceRoot":"","sources":["../../src/staged-upload/request.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,sBAAsB,EAAE,MAAM,uCAAuC,CAAC;AAC/E,OAAO,EAAE,eAAe,EAAE,MAAM,2BAA2B,CAAC;AAC5D,OAAO,EACL,wBAAwB,EAGxB,gBAAgB,GACjB,MAAM,oBAAoB,CAAC;AAC5B,OAAO,EAAE,oBAAoB,EAAE,mBAAmB,EAAE,MAAM,WAAW,CAAC;AACtE,OAAO,EAAE,sBAAsB,EAAE,WAAW,EAAE,MAAM,oBAAoB,CAAC;AACzE,OAAO,EAAE,oBAAoB,EAAE,yBAAyB,EAAE,MAAM,aAAa,CAAC;AAC9E,OAAO,EAAE,uBAAuB,EAAE,qBAAqB,EAAyB,MAAM,WAAW,CAAC;AAalG,SAAS,UAAU,CAAC,KAAa;IAC/B,OAAO,IAAI,KAAK,CAAC,OAAO,CAAC,IAAI,EAAE,OAAO,CAAC,GAAG,CAAC;AAC7C,CAAC;AAMD,SAAS,gBAAgB,CACvB,IAAsB,EACtB,QAAgB,EAChB,MAAuC;IAEvC,IAAI,IAAI,KAAK,MAAM,EAAE,CAAC;QACpB,OAAO,CAAC,KAAK,EAAE,UAAU,EAAE,QAAQ,CAAC,CAAC;IACvC,CAAC;IACD,IAAI,IAAI,KAAK,MAAM,EAAE,CAAC;QACpB,OAAO,CAAC,QAAQ,EAAE,WAAW,EAAE,UAAU,EAAE,QAAQ,CAAC,CAAC;IACvD,CAAC;IACD,OAAO,sBAAsB,CAAC,MAAM,CAAC,QAAQ,EAAE,MAAM,CAAC,QAAQ,CAAC;QAC7D,CAAC,CAAC,CAAC,OAAO,EAAE,SAAS,EAAE,cAAc,EAAE,QAAQ,CAAC;QAChD,CAAC,CAAC;YACE,OAAO;YACP,QAAQ;YACR,UAAU;YACV,QAAQ;YACR,QAAQ;YACR,MAAM,CAAC,QAAQ;YACf,aAAa;YACb,MAAM,CAAC,QAAQ;YACf,GAAG,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,SAAS,EAAE,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;SACnD,CAAC;AACR,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,yBAAyB,CAC7C,KAAwB,EACxB,MAAuC,EACvC,IAAI,GAAqB,EAAE;IAE3B,MAAM,IAAI,GAAG,qBAAqB,CAAC,OAAO,MAAM,CAAC,IAAI,KAAK,QAAQ,CAAC,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC;IAC9F,IAAI,CAAC,uBAAuB,CAAC,MAAM,CAAC,QAAQ,EAAE,IAAI,CAAC,EAAE,CAAC;QACpD,MAAM,IAAI,KAAK,CAAC,4CAA4C,IAAI,MAAM,MAAM,CAAC,QAAQ,EAAE,CAAC,CAAC;IAC3F,CAAC;IAED,MAAM,KAAK,GAAG,WAAW,CAAC;QACxB,IAAI;QACJ,QAAQ,EAAE,MAAM,CAAC,QAAQ;QACzB,QAAQ,EAAE,MAAM,CAAC,QAAQ;QACzB,UAAU,EAAE,MAAM,CAAC,UAAU;KAC9B,CAAC,CAAC;IACH,sBAAsB,CAAC,KAAK,EAAE,MAAM,CAAC,UAAU,CAAC,CAAC;IAEjD,IAAI,KAAK,KAAK,QAAQ,EAAE,CAAC;QACvB,MAAM,KAAK,CAAC,eAAe,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC;QAC3C,MAAM,YAAY,GAAG,IAAI,CAAC,kBAAkB,IAAI,wBAAwB,CAAC;QACzE,MAAM,MAAM,GAAG,MAAM,YAAY,CAAC,MAAM,CAAC,CAAC;QAC1C,OAAO;YACL,QAAQ,EAAE,MAAM,CAAC,QAAQ;YACzB,SAAS,EAAE,MAAM,CAAC,YAAY;YAC9B,SAAS,EAAE,yBAAyB;YACpC,SAAS,EAAE,MAAM,CAAC,SAAS;YAC3B,QAAQ,EAAE,MAAM,CAAC,QAAQ;YACzB,WAAW,EAAE,gBAAgB,CAAC,MAAM,CAAC,YAAY,EAAE,MAAM,CAAC,QAAQ,EAAE,MAAM,CAAC,QAAQ,CAAC;YACpF,WAAW,EAAE,CAAC,OAAO,EAAE,SAAS,EAAE,cAAc,EAAE,MAAM,CAAC,SAAS,CAAC;YACnE,MAAM,EAAE,QAAQ;YAChB,SAAS,EAAE,MAAM,CAAC,SAAS;SAC5B,CAAC;IACJ,CAAC;IAED,MAAM,QAAQ,GAAG,MAAM,KAAK,CAAC,aAAa,CAAC;QACzC,MAAM,EAAE,MAAM,CAAC,MAAM;QACrB,QAAQ,EAAE,MAAM,CAAC,QAAQ;QACzB,QAAQ,EAAE,MAAM,CAAC,QAAQ;QACzB,IAAI;QACJ,UAAU,EAAE,MAAM,CAAC,UAAU;KAC9B,CAAC,CAAC;IAEH,MAAM,MAAM,GAAG,mBAAmB,EAAE,CAAC;IACrC,MAAM,MAAM,GAAG,eAAe,EAAE,CAAC;IACjC,MAAM,GAAG,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC,GAAG,yBAAyB,CAAC;IACtE,MAAM,SAAS,GAAG,oBAAoB,CAAC,MAAM,EAAE,QAAQ,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,EAAE,MAAM,CAAC,CAAC;IAErF,MAAM,WAAW,GAAG,gBAAgB,CAAC,IAAI,EAAE,QAAQ,EAAE,MAAM,CAAC,CAAC;IAE7D,MAAM,WAAW,GAAG,sBAAsB,UAAU,CAAC,kBAAkB,MAAM,CAAC,QAAQ,EAAE,CAAC,IAAI,UAAU,CAAC,SAAS,CAAC,EAAE,CAAC;IAErH,OAAO;QACL,QAAQ;QACR,SAAS;QACT,SAAS,EAAE,yBAAyB;QACpC,SAAS,EAAE,GAAG;QACd,QAAQ,EAAE,oBAAoB,EAAE;QAChC,WAAW;QACX,WAAW;QACX,MAAM,EAAE,UAAU;KACnB,CAAC;AACJ,CAAC"}

package/dist/staged-upload/types.d.ts

@@ -20,6 +20,10 @@ export interface StagedUploadRequestResult {
     maxBytes: number;
     curlCommand: string;
     consumeArgs: string[];
+    /** `function` POSTs to the cms-edit route. `direct` PUTs to blob storage. */
+    intake: 'function' | 'direct';
+    /** Set when intake is `direct`. Pass this URL to media prepare after the PUT. */
+    publicUrl?: string;
 }
 export interface StagedUploadConsumeResult {
     buffer: Buffer;

package/dist/staged-upload/types.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"types.d.ts","sourceRoot":"","sources":["../../src/staged-upload/types.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,WAAW,CAAC;AAElD,MAAM,MAAM,kBAAkB,GAAG,SAAS,GAAG,OAAO,CAAC;AAErD,MAAM,WAAW,kBAAkB;IACjC,QAAQ,EAAE,MAAM,CAAC;IACjB,MAAM,EAAE,MAAM,CAAC;IACf,QAAQ,EAAE,MAAM,CAAC;IACjB,QAAQ,EAAE,MAAM,CAAC;IACjB,6DAA6D;IAC7D,IAAI,CAAC,EAAE,gBAAgB,CAAC;IACxB,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,MAAM,EAAE,kBAAkB,CAAC;IAC3B,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,SAAS,EAAE,MAAM,CAAC;CACnB;AAED,MAAM,WAAW,yBAAyB;IACxC,QAAQ,EAAE,MAAM,CAAC;IACjB,SAAS,EAAE,MAAM,CAAC;IAClB,SAAS,EAAE,MAAM,CAAC;IAClB,SAAS,EAAE,MAAM,CAAC;IAClB,QAAQ,EAAE,MAAM,CAAC;IACjB,WAAW,EAAE,MAAM,CAAC;IACpB,WAAW,EAAE,MAAM,EAAE,CAAC;CACvB;AAED,MAAM,WAAW,yBAAyB;IACxC,MAAM,EAAE,MAAM,CAAC;IACf,QAAQ,EAAE,MAAM,CAAC;IACjB,QAAQ,EAAE,MAAM,CAAC;IACjB,UAAU,EAAE,MAAM,CAAC;IACnB,IAAI,EAAE,gBAAgB,CAAC;CACxB"}
+{"version":3,"file":"types.d.ts","sourceRoot":"","sources":["../../src/staged-upload/types.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,WAAW,CAAC;AAElD,MAAM,MAAM,kBAAkB,GAAG,SAAS,GAAG,OAAO,CAAC;AAErD,MAAM,WAAW,kBAAkB;IACjC,QAAQ,EAAE,MAAM,CAAC;IACjB,MAAM,EAAE,MAAM,CAAC;IACf,QAAQ,EAAE,MAAM,CAAC;IACjB,QAAQ,EAAE,MAAM,CAAC;IACjB,6DAA6D;IAC7D,IAAI,CAAC,EAAE,gBAAgB,CAAC;IACxB,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,MAAM,EAAE,kBAAkB,CAAC;IAC3B,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,SAAS,EAAE,MAAM,CAAC;CACnB;AAED,MAAM,WAAW,yBAAyB;IACxC,QAAQ,EAAE,MAAM,CAAC;IACjB,SAAS,EAAE,MAAM,CAAC;IAClB,SAAS,EAAE,MAAM,CAAC;IAClB,SAAS,EAAE,MAAM,CAAC;IAClB,QAAQ,EAAE,MAAM,CAAC;IACjB,WAAW,EAAE,MAAM,CAAC;IACpB,WAAW,EAAE,MAAM,EAAE,CAAC;IACtB,6EAA6E;IAC7E,MAAM,EAAE,UAAU,GAAG,QAAQ,CAAC;IAC9B,iFAAiF;IACjF,SAAS,CAAC,EAAE,MAAM,CAAC;CACpB;AAED,MAAM,WAAW,yBAAyB;IACxC,MAAM,EAAE,MAAM,CAAC;IACf,QAAQ,EAAE,MAAM,CAAC;IACjB,QAAQ,EAAE,MAAM,CAAC;IACjB,UAAU,EAAE,MAAM,CAAC;IACnB,IAAI,EAAE,gBAAgB,CAAC;CACxB"}

package/docs/editor-tasks/media-pipeline-prepare.md

@@ -34,7 +34,7 @@ Normalize a **folder of designer masters** into short-lived **public HTTPS URLs*
 | Situation | Action |
 |-----------|--------|
 | Drive folder of masters | This task with `driveFolderUrl` |
-| Staged files (curl after `cms_edit_request_staged_upload`) | This task with `stagedUploadIds` — one prepare for the batch |
+| Staged files (curl after `cms_edit_request_staged_upload`) | This task with `stagedUploadIds` when `intake` is `function`, or `httpsUrls` / `--https-urls` when `intake` is `direct` |
 | Public HTTPS on allowed hosts | This task with `httpsUrls` |
 | Single SVG/PDF/Lottie | `task-media-reuse-and-upload` asset upload --staged |
 | Prior prepare already reached `succeeded` + catalog | **Reuse that jobId** — do not re-prepare |
@@ -61,7 +61,7 @@ Drive:
 }
 ```
 
-Staged (after curl POST to each `uploadUrl`):
+Function POST (image at or under 4MB, after curl POST to `uploadUrl`):
 
 ```json
 {
@@ -70,6 +70,15 @@ Staged (after curl POST to each `uploadUrl`):
 }
 ```
 
+Direct (video, or an image over 4MB, after the presigned PUT). Do not POST that file through the function:
+
+```json
+{
+  "action": "prepare",
+  "httpsUrls": ["https://….public.blob.vercel-storage.com/intake/…/file.mp4"]
+}
+```
+
 CLI:
 
 ```bash
@@ -77,6 +86,7 @@ cms-edit media prepare --drive-folder "https://drive.google.com/drive/folders/
   --source-names "BusinessCards copy.jpg,ADB_Macbook_HomeLoop.mp4"
 
 cms-edit media prepare --staged-ids "id1,id2"
+cms-edit media prepare --https-urls "https://….public.blob.vercel-storage.com/intake/…/file.mp4"
 ```
 
 Expect `{ ok: true, jobId, status: "queued", pollHint }`.

package/docs/editor-tasks/media-reuse-and-upload.md

@@ -37,10 +37,42 @@
 Encode via **`task-media-pipeline-prepare`**. Intake can be:
 
 1. A **Drive folder**, or
-2. **Staged upload** (4 MB): `cms_edit_request_staged_upload` → curl → `cms_edit_media` prepare with `stagedUploadIds` (see returned `consumeArgs`), or
+2. **Staged upload**: `cms_edit_request_staged_upload` → curl → follow `consumeArgs`, or
 3. **httpsUrls** on pipeline-allowed hosts
 
-Then wait → catalog → **import** with `overrides[].alt`. Do **not** `asset upload --staged/--base64` for jpeg/png/webp/gif/mp4. Do **not** `asset upload --url` for **video** (import only). Raster `--url` only for pipeline ready image hosts.
+Then wait → catalog → **import** with `overrides[].alt` for a **new** asset. Do **not** `asset upload --staged/--base64` for jpeg/png/webp/gif/mp4. Do **not** `asset upload --url` for **video** (import only). Raster `--url` only for pipeline ready image hosts.
+
+**Search before upload still applies.** `asset search` (title or file name) first. **Search by concept** is how an editor finds a subject and a tone, including files no page uses yet:
+
+```
+cms_edit ["asset", "search", "--concept", "<subject-concept-id>", "--concept-all", "<tone-concept-id>"]
+```
+
+`--concept` matches any listed id. Repeat `--concept-all` when several concepts are required. The result is id, title, file name, description, concepts. Concept search reads Contentful. It does not use the local index.
+
+**Size.** Video source intake is **100MB** via direct-to-storage. An image master over **4MB** uses the same path. JSON, text, SVG, PDF, and Lottie stay on the **4MB** function POST. Pass `byteLength` for an image that might be over 4MB so the tool returns a presigned PUT (`intake: "direct"`) instead of the function URL. Run the curl, then `consumeArgs` (`media prepare --https-urls` of the public intake URL). The asset stored in Contentful is the **processed** file from the pack (`…/packs/…/ready/…`), not the 100MB source. Do not re-encode every asset. Size targets come from the site sizing standard. `asset review` still flags a stored video over **8MB**.
+
+**Replace the file on an existing id** when pages already point at it. A second upload leaves those links on the old id.
+
+```
+cms_edit ["asset", "replace", "<asset-id>", "--url", "<processed-ready-url>", "--dry-run"]
+cms_edit ["asset", "replace", "<asset-id>", "--url", "<processed-ready-url>"]
+```
+
+Replace keeps the id and the current file name. Dry-run returns id, file name, old dimensions, new dimensions, and writes nothing. The write is a draft. There is no publish flag. It refuses a replace that would turn an image into a non-image, or the reverse. SVG, PDF, and Lottie may use `--staged` or `--url`. Raster and video must use the processed pack URL.
+
+**Title.** `asset set-title <asset-id> "<title>"` sets the asset title. Draft. It does not change the file name. Description stays `asset set-description`, written from the picture.
+
+**Concepts are not blog tags.** `taxonomy-from-json` stays the blog importer (`tag` / `tagType`). Do not turn `taxonomyImport` on. Asset concepts are Contentful `metadata.concepts`, assigned by concept id after a person creates the scheme in the Taxonomy manager. The same organisation concepts show in every space. Files do not cross spaces. cms-edit does not create the scheme.
+
+```
+cms_edit ["asset", "concept", "assign", "<asset-id>", "<concept-id>"]
+cms_edit ["asset", "concept", "unassign", "<asset-id>", "<concept-id>"]
+```
+
+A missing concept fails with the id. Do not invent one.
+
+**Do not emotion-score headshots, logos, icons, or illustrations.** Tone concepts are for lifestyle photos only. Alt text is still the asset description, one sentence from looking at the picture, not a keyword list and not the file name.
 
 Animated GIFs become **MP4** (`gif-converted`) — attach as mute-loop Media / video visual, not `featuredImage`. **Do not** convert the GIF (or PNG) with local ffmpeg first; prepare the original file. If prepare gaps say `staged GET failed 405`, stop and report a cms-edit host bump — do not retry and do not use the Contentful web UI. If they say `staged GET failed 404`, re-stage (POST) and prepare once — the GET route exists.
 
@@ -48,19 +80,19 @@ Animated GIFs become **MP4** (`gif-converted`) — attach as mute-loop Media / v
 
 These may skip the pipeline. On hosted MCP use staged upload then `asset upload --staged`.
 
-### Hosted MCP (SVG/PDF/Lottie only)
+### Hosted MCP
 
 **Always use staged upload** for ad-hoc binaries. Do not pass base64 in `cms_edit` args — hosted MCP rejects `asset upload --base64`.
 
-1. `cms_edit_request_staged_upload` with `fileName`, `mimeType`, optional `byteLength`, optional `title`
-2. Run the returned `curlCommand` in a shell (POST file to `uploadUrl`)
-3. Follow `consumeArgs`: **media prepare** for photos/video; **asset upload --staged** for SVG/PDF/Lottie
+1. `cms_edit_request_staged_upload` with `fileName`, `mimeType`, `byteLength` when the file may be over 4MB, optional `title`
+2. Run the returned `curlCommand`. `intake: "direct"` (video, or an image over 4MB) is a PUT of the file. `intake: "function"` is a POST to `uploadUrl`. Do not POST a video through the function.
+3. Follow `consumeArgs`. Direct intake: **media prepare** with `--https-urls` / `httpsUrls`. Function intake of an image at or under 4MB: **media prepare** with `stagedUploadIds`. SVG/PDF/Lottie: **asset upload --staged**.
 
 Rules:
 
 - Staged upload keeps binary **out of MCP args**
-- Hosted limit: **4 MB** per file; **1000 upload URLs per user per hour**; TTL **60 minutes**
-- Raster/video staged files stay in Redis until pipeline fetches them (GET); they are not written to CMA
+- Function POST (JSON, text, SVG, PDF, Lottie, and an image at or under 4MB): **4 MB**. Video, and an image master over 4MB: **100MB** presigned PUT to storage, then the media pipeline. **1000 upload URLs per user per hour**; TTL **60 minutes**
+- Direct intake bytes are not stored in Redis. An image at or under 4MB stays in Redis until the pipeline fetches it (GET). Neither path writes the source to CMA
 - Upload/import alone does **not** attach the asset — follow with **link + save** (below)
 - Use `--if-exists-by-filename` (with `--file-name`) to avoid duplicate assets when re-running
 

package/docs/editor-tasks/taxonomy.md

@@ -1,5 +1,7 @@
 # Capability: Taxonomy setup
 
+Blog `tag` / `tagType` / `articleType` entries. This is not Contentful asset concepts (`metadata.concepts`). Do not use `taxonomy-from-json` to label assets. Asset concepts are assigned with `asset concept assign` after a person creates the scheme in the Taxonomy manager.
+
 ## Intent phrases
 
 - create tags

package/docs/help/create-from-json.md

@@ -110,6 +110,7 @@ Use **named keys** only — the CLI does not infer whether a string is an asset
 | `templateId` | `template` | Entry ID |
 | `articleTypeId` | `articleType` | Entry ID (articles) |
 | `topContentIds`, `visualsIds`, … | See `cms-edit help fields-taxonomy` | Entry ID arrays |
+| `tagSlugs` | `tags` | Tag slug strings (articles). `tagsIds` is rejected. |
 
 ### Component `fields`
 

package/docs/mcp/hosted-guide.md

@@ -13,7 +13,7 @@ cms-edit **cannot and will not**:
 
 All `save` operations create **drafts only**. A human must review and publish in Contentful.
 
-**Assets:** Always **search and reuse** first (`index sync`, then `asset search`). Raster/video go through **`cms_edit_media`** (staged upload or Drive → prepare → import). Never `asset upload` jpeg/png/webp/gif/mp4, and never convert those files with local ffmpeg. SVG/PDF/Lottie: staged upload then `asset upload --staged`. **`--base64` is not supported on hosted MCP.**
+**Assets:** Always **search and reuse** first (`index sync`, then `asset search`). Raster/video go through **`cms_edit_media`** (Drive, or intake then prepare → import). Video, and an image master over 4MB, is a presigned PUT (`intake: direct`) then prepare with `httpsUrls`. An image at or under 4MB uses a function POST then `stagedUploadIds`. Never `asset upload` jpeg/png/webp/gif/mp4, and never convert those files with local ffmpeg. SVG/PDF/Lottie: staged upload then `asset upload --staged`. **`--base64` is not supported on hosted MCP.**
 
 ## MCP tools
 
@@ -138,11 +138,12 @@ cms-edit saves **drafts only**. A colleague must **publish in Contentful** for c
 
 ## Asset upload (hosted MCP)
 
-Hosted connectors have **no server filesystem** and **reject `asset upload --base64`**. Raster/video: staged intake then **media pipeline**. SVG/PDF/Lottie: staged then `asset upload --staged`.
+Hosted connectors have **no server filesystem** and **reject `asset upload --base64`**. Raster/video: intake then the **media pipeline**. SVG/PDF/Lottie: staged then `asset upload --staged`.
 
 | Source | When | Example |
 |--------|------|---------|
-| **Staged + pipeline** | jpeg/png/webp/gif/mp4 | `cms_edit_media` prepare `stagedUploadIds` → import (required for video) |
+| **Direct + pipeline** | video, or an image over 4MB | Presigned PUT, then `cms_edit_media` prepare `httpsUrls` → import (required for video) |
+| **Staged + pipeline** | image at or under 4MB | Function POST, then prepare `stagedUploadIds` → import |
 | **`--url`** | Pipeline-ready **images** only, or SVG/PDF | `["asset", "upload", "--url", "https://….blob.vercel-storage.com/ready.jpg"]` |
 | **Staged consume** | SVG/PDF/Lottie | `asset upload --staged` |
 
@@ -168,14 +169,15 @@ Full workflow: `cms-edit://customer/task-media-reuse-and-upload`.
 Keeps binary **and large text/JSON** out of MCP tool args. The agent uploads via `curl`, then passes only a short `uploadId`.
 
 1. `cms_edit_request_staged_upload` with `fileName`, `mimeType`, optional `kind` (`asset` \| `text` \| `json`), optional `byteLength`, optional `title`. If the wrapper schema has no `kind`, use `cms_edit` `["staged-upload", "request", "--kind", "json", "--file-name", "...", "--mime", "application/json"]` (or `--kind text` for HtmlComponent fields).
-2. Run the returned `curlCommand` in a shell (POST multipart to `uploadUrl`)
+2. Run the returned `curlCommand` in a shell (function route: POST multipart to `uploadUrl`; direct intake: PUT `--data-binary`)
 3. Follow `consumeArgs`:
-   - **asset:** media prepare for jpeg/png/webp/gif/mp4; **asset upload --staged** for SVG/PDF/Lottie
+   - **asset, intake direct** (video, or an image over 4MB): media prepare with the public intake URL
+   - **asset, intake function:** media prepare for jpeg/png/webp/gif at or under 4MB; **asset upload --staged** for SVG/PDF/Lottie
    - **text:** `set @ref field --staged <id>` (insert ref and field id)
    - **json:** `create from-json --staged <id>` (add `--dry-run --strict` first). Dry-run does not consume the slot.
 4. For pipeline jobs: wait → catalog → **import** (required for video). Then link and save
 
-Hosted **inline** `--json` / `--content` / `--*-base64` is capped at **8192 bytes**. Staged files: **4 MB**. Rate limit: **1000 upload URLs per user per hour**. TTL: **60 minutes**.
+Hosted **inline** `--json` / `--content` / `--*-base64` is capped at **8192 bytes**. Function POST (JSON, text, SVG, PDF, Lottie, image ≤ 4MB): **4 MB**. Video and an image master over 4MB: **100MB** presigned PUT (`BLOB_READ_WRITE_TOKEN` on the host), then the media pipeline. Rate limit: **1000 upload URLs per user per hour**. TTL: **60 minutes**.
 
 ## Featured images (articles)
 

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@se-studio/contentful-cms",
-  "version": "3.14.2",
+  "version": "3.15.1",
   "description": "CLI tool for AI agents to edit Contentful drafts and, when the user's role allows it, publish after an explicit yes",
   "repository": {
     "type": "git",
@@ -62,6 +62,7 @@
   "dependencies": {
     "@contentful/rich-text-types": "^17.2.7",
     "@modelcontextprotocol/sdk": "^1.31.0",
+    "@vercel/blob": "^2.8.0",
     "commander": "^15.0.0",
     "contentful": "^11.12.10",
     "contentful-management": "^12.19.0",

package/skills/core/SKILL.md

@@ -32,9 +32,11 @@ Use this skill when you need to read or edit content in Contentful using **hoste
 
 All `save` operations create **draft** versions. A human must review and publish in Contentful.
 
-**Assets:** Upload **is** supported (`asset upload`). Default workflow: **search and reuse** existing assets first (`index sync` → `asset search`). When uploading:
-- **Raster/video:** `cms_edit_request_staged_upload` → curl → `cms_edit_media` prepare (`stagedUploadIds`) → wait → catalog → import with real alt. Never `asset upload --staged/--url/--base64` for jpeg/png/webp/gif/mp4.
-- **SVG/PDF/Lottie:** `cms_edit_request_staged_upload` → curl → `asset upload --staged` (never `--base64`)
+**Assets:** Upload **is** supported (`asset upload`). Default workflow: **search and reuse** existing assets first (`index sync` → `asset search`). Search by concept (`asset search --concept` / `--concept-all`) finds a subject and a tone, including files no page uses yet. Concepts are not blog tags. When uploading:
+- **Raster/video:** `cms_edit_request_staged_upload` → curl → `cms_edit_media` prepare → wait → catalog → import with real alt. Video, and an image master over 4MB, is a presigned direct PUT (100MB, `intake: direct`) then prepare with that URL. Smaller images still use `stagedUploadIds`. Never `asset upload --staged/--url/--base64` for jpeg/png/webp/gif/mp4. The stored asset is the processed file.
+- **Replace** an existing id with `asset replace --url` of the processed `…/packs/…/ready/…` file (`--dry-run` first). The id and the file name stay. Draft. No publish flag.
+- **SVG/PDF/Lottie:** `cms_edit_request_staged_upload` → curl → `asset upload --staged` (never `--base64`). 4MB function cap.
+- **Title:** `asset set-title`. **Alt:** `asset set-description`, written from the picture. Do not emotion-score headshots, logos, icons, or illustrations.
 - **HtmlComponent / large JSON:** `cms_edit_request_staged_upload` with `kind=text` or `kind=json` → curl → `set --staged`, `rtf --staged`, `create from-json --staged`, or `apply from-json --staged`. Hosted MCP rejects inline `--json`/`--content` over 8192 bytes. If the wrapper schema has no `kind`, use `cms_edit` `["staged-upload", "request", "--kind", "json", "--file-name", "...", "--mime", "application/json"]` (or `--kind text`), then curl, then `--staged`.
 - Use a **sensible fileName** and **descriptive title** (and alt text where the site uses it)
 - Avoid oversized images — width over **2000px** is usually wasteful for web (exact limits vary by project; check `asset audit` / media review guidance)
@@ -376,9 +378,13 @@ cms-edit asset search --filename istockphoto-123.jpg
 cms-edit asset search --filename-match 'istockphoto-.*'
 
 # Raster/video: cms_edit_media prepare → wait → catalog → import (video: import only).
+# Video and image masters over 4MB: direct intake (100MB), then prepare --https-urls.
 # Do not `asset upload` jpeg/png/webp/gif/mp4. Do not convert GIF/MP4 with local ffmpeg.
 # Animated GIF: leave as GIF; pipeline emits gif-converted MP4 for Media mute-loop, not featuredImage.
-# SVG/PDF/Lottie: cms_edit_request_staged_upload → curl → asset upload --staged
+# SVG/PDF/Lottie: cms_edit_request_staged_upload → curl → asset upload --staged (4MB)
+# Replace in place: asset replace <id> --url <processed ready url> --dry-run
+# Title: asset set-title. Alt: asset set-description. Concepts: asset concept assign (not taxonomy-from-json)
+# Concept search: asset search --concept <id> --concept-all <id>
 
 # Create a Media wrapper for an existing asset (name defaults to asset title)
 cms-edit create media --asset-id <asset-id>
@@ -394,7 +400,7 @@ cms-edit asset info 5xKj2abcDef
 cms-edit asset set @c0 visual 5xKj2abcDef
 ```
 
-JSON output for upload (`CMS_EDIT_JSON=1`): `{ ok, id, fileName, url, mediaId?, mediaIds? }`. Max upload size is **10MB** per file.
+JSON output for upload (`CMS_EDIT_JSON=1`): `{ ok, id, fileName, url, mediaId?, mediaIds? }`. Bytes through the process are **10MB**. Hosted function POST is **4MB**. Video and large image masters are **100MB** direct-to-storage, then the pipeline.
 
 **Idempotent upload:** `--if-exists-by-filename` is check-then-create. Do not upload the same `fileName` in parallel — serialize per fileName or re-run to converge.
 

package/skills/editor-tasks/SKILL.md

@@ -64,7 +64,7 @@ Capability playbooks require:
 
 ## Media default
 
-**Search and reuse assets first** (`index sync` → `asset search`). Upload only when no match; use `--if-exists-by-filename` when uploading.
+**Search and reuse assets first** (`index sync` → `asset search`). Search by concept (`--concept`, `--concept-all`) finds a subject and a tone. Concepts are not blog tags. Upload only when no match; use `--if-exists-by-filename` when uploading. Replace an in-use file with `asset replace` so the id and the file name stay. Alt is `asset set-description`, written from the picture. Do not emotion-score headshots, logos, icons, or illustrations.
 
 **Space-wide media audit** (filename, alt, size, dimensions, usage) → read **`task-media-review`**, then skill **`contentful-cms-media-review`** for the spreadsheet.