@tomorrowos/sdk 0.9.51 → 0.9.53

package/LOVABLE_SETUP.md

@@ -347,7 +347,7 @@ Copy the same keys to the **Node host** env.
     "start": "tsx server.ts"
   },
   "dependencies": {
-    "@tomorrowos/sdk": "^0.9.51",
+    "@tomorrowos/sdk": "^0.9.53",
     "dotenv": "^17.2.3",
     "tsx": "^4.19.0"
   }

package/VERCEL_QUESTIONS.md

@@ -1,6 +1,6 @@
 # Vercel / v0 閳?Verbatim question bank
 
-> **Protocol:** `vercel-questions/1.0` (pairs with `VERCEL_SETUP.md` 1.9+ / `@tomorrowos/sdk` 0.9.51+)  
+> **Protocol:** `vercel-questions/1.0` (pairs with `VERCEL_SETUP.md` 1.9+ / `@tomorrowos/sdk` 0.9.53+)  
 > **For Agents:** When asking the user a setup question, **copy-paste the block below for that step EXACTLY**.  
 > Do **not** paraphrase, reorder, rename options, or invent alternatives (no S3, no Supabase Storage, no 閳ユ窂lob recommended閳? no 閳ユ竸isable media閳?.  
 > After each answer, configure per `VERCEL_SETUP.md`, then paste the **next** block.

package/VERCEL_SETUP.md

@@ -5,7 +5,7 @@
 >
 > **On Vercel, this file is the setup questionnaire** (not `REPLIT_SETUP.md`, not `LLM_PROMPT.md`).
 >
-> Protocol id: `vercel-setup/1.9` — pairs with `@tomorrowos/sdk` **0.9.51+** (`templates/cms-starter-v0`, Fluid Functions WebSockets).
+> Protocol id: `vercel-setup/1.9` — pairs with `@tomorrowos/sdk` **0.9.53+** (`templates/cms-starter-v0`, Fluid Functions WebSockets).
 >
 > **Questions source of truth:** `VERCEL_QUESTIONS.md` ? Agents must **open that file and paste each Q block verbatim**. Do not paraphrase.  
 > **Copy questions verbatim from `VERCEL_QUESTIONS.md`.** Do not invent alternate Q2 options (no ?Supabase Storage?? no S3, no ?disable media?? no making Blob the recommended option).  

package/dist/cloudinary-storage.d.ts

@@ -11,6 +11,23 @@ export interface CloudinaryUploadResult {
     bytes?: number;
 }
 export declare function resolveCloudinaryConfig(env?: NodeJS.ProcessEnv): CloudinaryStorageConfig | null;
+/** Browser direct-upload params (signed). Secret never leaves the server. */
+export declare function createSignedUploadParams(config: CloudinaryStorageConfig, options: {
+    publicId: string;
+    filename: string;
+}): {
+    cloudName: string;
+    apiKey: string;
+    timestamp: number;
+    signature: string;
+    publicId: string;
+    filenameOverride: string;
+    uploadUrl: string;
+};
+export declare function fetchCloudinaryResource(config: CloudinaryStorageConfig, publicId: string, resourceType?: string): Promise<CloudinaryUploadResult & {
+    etag?: string;
+    durationSec?: number;
+}>;
 export declare function uploadBufferToCloudinary(body: Buffer, options: {
     config: CloudinaryStorageConfig;
     publicId: string;

package/dist/cloudinary-storage.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"cloudinary-storage.d.ts","sourceRoot":"","sources":["../src/cloudinary-storage.ts"],"names":[],"mappings":"AAEA,MAAM,WAAW,uBAAuB;IACtC,SAAS,EAAE,MAAM,CAAC;IAClB,MAAM,EAAE,MAAM,CAAC;IACf,SAAS,EAAE,MAAM,CAAC;IAClB,MAAM,CAAC,EAAE,MAAM,CAAC;CACjB;AAED,MAAM,WAAW,sBAAsB;IACrC,QAAQ,EAAE,MAAM,CAAC;IACjB,SAAS,EAAE,MAAM,CAAC;IAClB,YAAY,EAAE,MAAM,CAAC;IACrB,KAAK,CAAC,EAAE,MAAM,CAAC;CAChB;AAOD,wBAAgB,uBAAuB,CACrC,GAAG,GAAE,MAAM,CAAC,UAAwB,GACnC,uBAAuB,GAAG,IAAI,CAoBhC;AAWD,wBAAsB,wBAAwB,CAC5C,IAAI,EAAE,MAAM,EACZ,OAAO,EAAE;IACP,MAAM,EAAE,uBAAuB,CAAC;IAChC,QAAQ,EAAE,MAAM,CAAC;IACjB,QAAQ,EAAE,MAAM,CAAC;CAClB,GACA,OAAO,CAAC,sBAAsB,CAAC,CAsCjC;AAED,wBAAsB,qBAAqB,CACzC,MAAM,EAAE,uBAAuB,EAC/B,QAAQ,EAAE,MAAM,EAChB,YAAY,SAAU,GACrB,OAAO,CAAC,IAAI,CAAC,CAKf;AAED,qEAAqE;AACrE,wBAAsB,cAAc,CAClC,MAAM,EAAE,uBAAuB,GAC9B,OAAO,CAAC,IAAI,CAAC,CAGf"}
+{"version":3,"file":"cloudinary-storage.d.ts","sourceRoot":"","sources":["../src/cloudinary-storage.ts"],"names":[],"mappings":"AAEA,MAAM,WAAW,uBAAuB;IACtC,SAAS,EAAE,MAAM,CAAC;IAClB,MAAM,EAAE,MAAM,CAAC;IACf,SAAS,EAAE,MAAM,CAAC;IAClB,MAAM,CAAC,EAAE,MAAM,CAAC;CACjB;AAED,MAAM,WAAW,sBAAsB;IACrC,QAAQ,EAAE,MAAM,CAAC;IACjB,SAAS,EAAE,MAAM,CAAC;IAClB,YAAY,EAAE,MAAM,CAAC;IACrB,KAAK,CAAC,EAAE,MAAM,CAAC;CAChB;AAOD,wBAAgB,uBAAuB,CACrC,GAAG,GAAE,MAAM,CAAC,UAAwB,GACnC,uBAAuB,GAAG,IAAI,CAoBhC;AAsBD,6EAA6E;AAC7E,wBAAgB,wBAAwB,CACtC,MAAM,EAAE,uBAAuB,EAC/B,OAAO,EAAE;IAAE,QAAQ,EAAE,MAAM,CAAC;IAAC,QAAQ,EAAE,MAAM,CAAA;CAAE,GAC9C;IACD,SAAS,EAAE,MAAM,CAAC;IAClB,MAAM,EAAE,MAAM,CAAC;IACf,SAAS,EAAE,MAAM,CAAC;IAClB,SAAS,EAAE,MAAM,CAAC;IAClB,QAAQ,EAAE,MAAM,CAAC;IACjB,gBAAgB,EAAE,MAAM,CAAC;IACzB,SAAS,EAAE,MAAM,CAAC;CACnB,CAyBA;AAED,wBAAsB,uBAAuB,CAC3C,MAAM,EAAE,uBAAuB,EAC/B,QAAQ,EAAE,MAAM,EAChB,YAAY,SAAU,GACrB,OAAO,CAAC,sBAAsB,GAAG;IAAE,IAAI,CAAC,EAAE,MAAM,CAAC;IAAC,WAAW,CAAC,EAAE,MAAM,CAAA;CAAE,CAAC,CA+B3E;AAED,wBAAsB,wBAAwB,CAC5C,IAAI,EAAE,MAAM,EACZ,OAAO,EAAE;IACP,MAAM,EAAE,uBAAuB,CAAC;IAChC,QAAQ,EAAE,MAAM,CAAC;IACjB,QAAQ,EAAE,MAAM,CAAC;CAClB,GACA,OAAO,CAAC,sBAAsB,CAAC,CAoCjC;AAED,wBAAsB,qBAAqB,CACzC,MAAM,EAAE,uBAAuB,EAC/B,QAAQ,EAAE,MAAM,EAChB,YAAY,SAAU,GACrB,OAAO,CAAC,IAAI,CAAC,CAKf;AAED,qEAAqE;AACrE,wBAAsB,cAAc,CAClC,MAAM,EAAE,uBAAuB,GAC9B,OAAO,CAAC,IAAI,CAAC,CAGf"}

package/dist/cloudinary-storage.js

@@ -29,11 +29,73 @@ function configureCloudinary(config) {
         secure: true
     });
 }
+function resolvePublicId(config, publicId) {
+    if (!config.folder)
+        return publicId;
+    const folder = config.folder.replace(/^\/+|\/+$/g, "");
+    if (!folder)
+        return publicId;
+    if (publicId === folder || publicId.startsWith(`${folder}/`))
+        return publicId;
+    return `${folder}/${publicId}`;
+}
+/** Browser direct-upload params (signed). Secret never leaves the server. */
+export function createSignedUploadParams(config, options) {
+    configureCloudinary(config);
+    const publicId = resolvePublicId(config, options.publicId);
+    const timestamp = Math.round(Date.now() / 1000);
+    const paramsToSign = {
+        timestamp,
+        public_id: publicId,
+        overwrite: true,
+        unique_filename: false,
+        use_filename: false,
+        filename_override: options.filename
+    };
+    const signature = cloudinary.utils.api_sign_request(paramsToSign, config.apiSecret);
+    return {
+        cloudName: config.cloudName,
+        apiKey: config.apiKey,
+        timestamp,
+        signature,
+        publicId,
+        filenameOverride: options.filename,
+        uploadUrl: `https://api.cloudinary.com/v1_1/${config.cloudName}/auto/upload`
+    };
+}
+export async function fetchCloudinaryResource(config, publicId, resourceType = "image") {
+    configureCloudinary(config);
+    const types = resourceType === "auto"
+        ? ["video", "image", "raw"]
+        : [resourceType, "video", "image", "raw"];
+    let lastErr;
+    for (const type of types) {
+        try {
+            const result = (await cloudinary.api.resource(publicId, {
+                resource_type: type
+            }));
+            return {
+                publicId: result.public_id,
+                secureUrl: result.secure_url,
+                resourceType: result.resource_type || type,
+                bytes: result.bytes,
+                etag: result.etag,
+                durationSec: typeof result.duration === "number" && Number.isFinite(result.duration)
+                    ? result.duration
+                    : undefined
+            };
+        }
+        catch (err) {
+            lastErr = err;
+        }
+    }
+    throw lastErr instanceof Error
+        ? lastErr
+        : new Error("Cloudinary asset not found");
+}
 export async function uploadBufferToCloudinary(body, options) {
     configureCloudinary(options.config);
-    const publicId = options.config.folder
-        ? `${options.config.folder.replace(/^\/+|\/+$/g, "")}/${options.publicId}`
-        : options.publicId;
+    const publicId = resolvePublicId(options.config, options.publicId);
     const result = await new Promise((resolve, reject) => {
         const stream = cloudinary.uploader.upload_stream({
             resource_type: "auto",

package/dist/tomorrowos.d.ts

@@ -207,6 +207,8 @@ export declare class TomorrowOS extends EventEmitter {
     private getSuggestedCmsUrl;
     listen(options: ListenOptions): http.Server;
     private handleMediaUpload;
+    private handleMediaUploadSign;
+    private handleMediaRegister;
     private storeUploadedMediaAsset;
     private getAssetIdsFromItems;
     private isUploadedAssetReferenced;

package/dist/tomorrowos.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"tomorrowos.d.ts","sourceRoot":"","sources":["../src/tomorrowos.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,YAAY,EAAE,MAAM,QAAQ,CAAC;AAEtC,OAAO,IAAI,MAAM,MAAM,CAAC;AAYxB,OAAO,EAAE,eAAe,EAAE,KAAK,iBAAiB,EAAE,MAAM,uBAAuB,CAAC;AAChF,OAAO,KAAK,EACV,gBAAgB,EAKhB,eAAe,EAEhB,MAAM,kBAAkB,CAAC;AAoB1B,YAAY,EACV,cAAc,EACd,eAAe,EACf,kBAAkB,EAClB,aAAa,EACd,MAAM,oBAAoB,CAAC;AAE5B,MAAM,WAAW,eAAe;IAC9B,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC;CACxB;AAED,MAAM,WAAW,iBAAiB;IAChC,KAAK,EAAE,eAAe,CAAC;IACvB,6EAA6E;IAC7E,KAAK,CAAC,EAAE,eAAe,CAAC;CACzB;AAED,MAAM,WAAW,aAAa;IAC5B,IAAI,EAAE,MAAM,CAAC;IACb,IAAI,CAAC,EAAE,MAAM,CAAC;IACd;;;;;OAKG;IACH,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB;;;OAGG;IACH,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB;;;;;OAKG;IACH,UAAU,CAAC,EAAE,OAAO,CAAC;IACrB;;;OAGG;IACH,cAAc,CAAC,EAAE,MAAM,EAAE,CAAC;CAC3B;AAoED,MAAM,WAAW,cAAc;IAC7B,QAAQ,EAAE,MAAM,CAAC;IACjB,2EAA2E;IAC3E,WAAW,EAAE,MAAM,GAAG,IAAI,CAAC;IAC3B,SAAS,EAAE,OAAO,CAAC;IACnB,UAAU,EAAE,MAAM,GAAG,IAAI,CAAC;IAC1B,QAAQ,EAAE,MAAM,GAAG,IAAI,CAAC;IACxB,MAAM,EAAE,MAAM,GAAG,IAAI,CAAC;IACtB,aAAa,EAAE,MAAM,GAAG,IAAI,CAAC;IAC7B,aAAa,EAAE,MAAM,GAAG,IAAI,CAAC;IAC7B,YAAY,EAAE,MAAM,GAAG,IAAI,CAAC;IAC5B,QAAQ,EAAE,MAAM,CAAC;IACjB,UAAU,EAAE,MAAM,GAAG,IAAI,CAAC;IAC1B,YAAY,EAAE,MAAM,GAAG,IAAI,CAAC;IAC5B,aAAa,EAAE,MAAM,GAAG,IAAI,CAAC;IAC7B,gBAAgB,EAAE,MAAM,GAAG,IAAI,CAAC;IAChC,kBAAkB,EAAE,OAAO,CAAC;IAC5B,iBAAiB,EAAE,MAAM,CAAC;IAC1B,mEAAmE;IACnE,iBAAiB,EAAE,MAAM,GAAG,IAAI,CAAC;IACjC,kBAAkB,EAAE,KAAK,CAAC;QACxB,UAAU,EAAE,MAAM,CAAC;QACnB,IAAI,EAAE,MAAM,CAAC;QACb,WAAW,EAAE,MAAM,CAAC;QACpB,QAAQ,CAAC,EAAE;YACT,SAAS,CAAC,EAAE,MAAM,CAAC;YACnB,OAAO,CAAC,EAAE,MAAM,CAAC;YACjB,KAAK,CAAC,EAAE,MAAM,CAAC;YACf,GAAG,CAAC,EAAE,MAAM,CAAC;SACd,CAAC;KACH,CAAC,CAAC;IACH,aAAa,EAAE,MAAM,GAAG,IAAI,CAAC;IAC7B,kBAAkB,EAAE,MAAM,GAAG,IAAI,CAAC;IAClC,gBAAgB,EAAE;QAChB,GAAG,EAAE,MAAM,CAAC;QACZ,UAAU,EAAE,MAAM,CAAC;KACpB,GAAG,IAAI,CAAC;IACT,2DAA2D;IAC3D,UAAU,EAAE,gBAAgB,GAAG,IAAI,CAAC;CACrC;AAoBD,MAAM,WAAW,cAAc;IAC7B,SAAS,EAAE,MAAM,CAAC;IAClB,KAAK,EAAE,MAAM,GAAG,MAAM,GAAG,OAAO,CAAC;IACjC,OAAO,EAAE,MAAM,CAAC;IAChB,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,OAAO,CAAC,EAAE,OAAO,CAAC;CACnB;AAED,MAAM,WAAW,oBAAoB;IACnC,QAAQ,EAAE,MAAM,CAAC;IACjB,GAAG,EAAE,MAAM,CAAC;IACZ,UAAU,EAAE,MAAM,CAAC;IACnB,QAAQ,EAAE,MAAM,CAAC;IACjB,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,MAAM,CAAC,EAAE,MAAM,CAAC;CACjB;AAiMD,qBAAa,UAAW,SAAQ,YAAY;IAC1C,QAAQ,CAAC,KAAK,EAAE,eAAe,CAAC;IAChC,OAAO,CAAC,QAAQ,CAAC,KAAK,CAAkB;IACxC,QAAQ,CAAC,SAAS,EAAE,eAAe,CAAC;IACpC,OAAO,CAAC,QAAQ,CAAC,OAAO,CAAmC;IAC3D,OAAO,CAAC,QAAQ,CAAC,iBAAiB,CAAsC;IACxE,OAAO,CAAC,QAAQ,CAAC,UAAU,CAAuC;IAClE,yFAAyF;IACzF,OAAO,CAAC,QAAQ,CAAC,qBAAqB,CAA6B;IACnE,OAAO,CAAC,mBAAmB,CAA+C;IAC1E,OAAO,CAAC,UAAU,CAA4B;IAC9C,OAAO,CAAC,GAAG,CAAgC;IAC3C,OAAO,CAAC,UAAU,CAAuB;IACzC,OAAO,CAAC,eAAe,CAAgB;IACvC,wFAAwF;IACxF,OAAO,CAAC,eAAe,CAAuB;IAC9C,+DAA+D;IAC/D,OAAO,CAAC,UAAU,CAAuB;gBAE7B,OAAO,EAAE,iBAAiB;IAOtC,yFAAyF;IACnF,wBAAwB,CAAC,QAAQ,EAAE,MAAM,GAAG,OAAO,CAAC;QACxD,MAAM,EAAE,OAAO,CAAC;QAChB,MAAM,CAAC,EAAE,iBAAiB,CAAC,QAAQ,CAAC,CAAC;KACtC,CAAC;YAkBY,iBAAiB;IAY/B,6EAA6E;IACvE,aAAa,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC;QAAE,QAAQ,EAAE,MAAM,CAAA;KAAE,CAAC;IAmFhE,6EAA6E;IACvE,aAAa,CAAC,QAAQ,EAAE,MAAM,GAAG,OAAO,CAAC;QAAE,QAAQ,EAAE,MAAM,CAAC;QAAC,QAAQ,EAAE,OAAO,CAAA;KAAE,CAAC;IAuCvF,OAAO;uBACU,MAAM;sBA5HgC,MAAM;;2BA6HxC,MAAM;sBAzCgC,MAAM;sBAAY,OAAO;;MA0ClF;IAEF,kFAAkF;IAC5E,WAAW,IAAI,OAAO,CAAC,cAAc,EAAE,CAAC;IAgF9C;;;OAGG;IACG,mBAAmB,CACvB,QAAQ,EAAE,MAAM,EAChB,UAAU,EAAE,OAAO,GAClB,OAAO,CAAC;QACT,QAAQ,EAAE,MAAM,CAAC;QACjB,UAAU,EAAE,gBAAgB,CAAC;QAC7B,MAAM,EAAE,OAAO,CAAC;KACjB,CAAC;IAqBF;;;OAGG;IACG,qBAAqB,CAAC,QAAQ,EAAE,MAAM,GAAG,OAAO,CAAC;QACrD,QAAQ,EAAE,MAAM,CAAC;QACjB,UAAU,EAAE,IAAI,CAAC;QACjB,MAAM,EAAE,OAAO,CAAC;KACjB,CAAC;YAkBY,sBAAsB;IAsB9B,aAAa,CAAC,QAAQ,EAAE,MAAM,EAAE,UAAU,EAAE,MAAM,GAAG,OAAO,CAAC;QACjE,QAAQ,EAAE,MAAM,CAAC;QACjB,UAAU,EAAE,MAAM,CAAC;KACpB,CAAC;IAyBF,0FAA0F;YAC5E,2BAA2B;YAW3B,0BAA0B;IAYxC,qFAAqF;YACvE,8BAA8B;IAY5C,OAAO,CAAC,aAAa;IASrB,OAAO,CAAC,aAAa;IAMrB,OAAO,CAAC,iBAAiB;IAKzB;;;OAGG;IACH,OAAO,CAAC,gBAAgB;IAQxB,OAAO,CAAC,oBAAoB;IAM5B,OAAO,CAAC,yBAAyB;IAUjC,OAAO,CAAC,0BAA0B;IAkBlC,gFAAgF;YAClE,uBAAuB;IAarC,OAAO,CAAC,mBAAmB;IAgB3B,OAAO,CAAC,uBAAuB;IAU/B,OAAO,CAAC,gBAAgB;YAoBV,+BAA+B;YAsC/B,iBAAiB;YASjB,iBAAiB;YAqCjB,kBAAkB;IAUhC,uFAAuF;IACvF,OAAO,CAAC,kBAAkB;YAoBZ,gBAAgB;YAMhB,uBAAuB;IA0CrC,MAAM,CAAC,QAAQ,EAAE,MAAM;oBAGD,CAAC,oBACT,MAAM,WACN,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAC9B,OAAO,CAAC;YAAE,MAAM,EAAE,MAAM,CAAC;YAAC,IAAI,CAAC,EAAE,CAAC,CAAC;YAAC,KAAK,CAAC,EAAE,MAAM,CAAC;YAAC,KAAK,CAAC,EAAE,MAAM,CAAA;SAAE,CAAC;;IAU5E,OAAO,CAAC,mBAAmB;IA6D3B,6EAA6E;IAC7E,OAAO,CAAC,kBAAkB;IAO1B,MAAM,CAAC,OAAO,EAAE,aAAa,GAAG,IAAI,CAAC,MAAM;YAoE7B,iBAAiB;YAgDjB,uBAAuB;IA6ErC,OAAO,CAAC,oBAAoB;YASd,yBAAyB;YAQzB,4BAA4B;YAa5B,2CAA2C;YAO3C,iCAAiC;YA6BjC,wBAAwB;YAiBxB,cAAc;IAiD5B,OAAO,CAAC,uBAAuB;IAO/B,OAAO,CAAC,mBAAmB;YAOb,yBAAyB;YAwBzB,oBAAoB;YAkDpB,yBAAyB;YAsBzB,uBAAuB;YAcvB,UAAU;YA2XV,gBAAgB;IAqG9B,OAAO,CAAC,iBAAiB;IAWzB,OAAO,CAAC,gBAAgB;CA2KzB"}
+{"version":3,"file":"tomorrowos.d.ts","sourceRoot":"","sources":["../src/tomorrowos.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,YAAY,EAAE,MAAM,QAAQ,CAAC;AAEtC,OAAO,IAAI,MAAM,MAAM,CAAC;AAYxB,OAAO,EAAE,eAAe,EAAE,KAAK,iBAAiB,EAAE,MAAM,uBAAuB,CAAC;AAChF,OAAO,KAAK,EACV,gBAAgB,EAKhB,eAAe,EAEhB,MAAM,kBAAkB,CAAC;AAsB1B,YAAY,EACV,cAAc,EACd,eAAe,EACf,kBAAkB,EAClB,aAAa,EACd,MAAM,oBAAoB,CAAC;AAE5B,MAAM,WAAW,eAAe;IAC9B,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC;CACxB;AAED,MAAM,WAAW,iBAAiB;IAChC,KAAK,EAAE,eAAe,CAAC;IACvB,6EAA6E;IAC7E,KAAK,CAAC,EAAE,eAAe,CAAC;CACzB;AAED,MAAM,WAAW,aAAa;IAC5B,IAAI,EAAE,MAAM,CAAC;IACb,IAAI,CAAC,EAAE,MAAM,CAAC;IACd;;;;;OAKG;IACH,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB;;;OAGG;IACH,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB;;;;;OAKG;IACH,UAAU,CAAC,EAAE,OAAO,CAAC;IACrB;;;OAGG;IACH,cAAc,CAAC,EAAE,MAAM,EAAE,CAAC;CAC3B;AAoED,MAAM,WAAW,cAAc;IAC7B,QAAQ,EAAE,MAAM,CAAC;IACjB,2EAA2E;IAC3E,WAAW,EAAE,MAAM,GAAG,IAAI,CAAC;IAC3B,SAAS,EAAE,OAAO,CAAC;IACnB,UAAU,EAAE,MAAM,GAAG,IAAI,CAAC;IAC1B,QAAQ,EAAE,MAAM,GAAG,IAAI,CAAC;IACxB,MAAM,EAAE,MAAM,GAAG,IAAI,CAAC;IACtB,aAAa,EAAE,MAAM,GAAG,IAAI,CAAC;IAC7B,aAAa,EAAE,MAAM,GAAG,IAAI,CAAC;IAC7B,YAAY,EAAE,MAAM,GAAG,IAAI,CAAC;IAC5B,QAAQ,EAAE,MAAM,CAAC;IACjB,UAAU,EAAE,MAAM,GAAG,IAAI,CAAC;IAC1B,YAAY,EAAE,MAAM,GAAG,IAAI,CAAC;IAC5B,aAAa,EAAE,MAAM,GAAG,IAAI,CAAC;IAC7B,gBAAgB,EAAE,MAAM,GAAG,IAAI,CAAC;IAChC,kBAAkB,EAAE,OAAO,CAAC;IAC5B,iBAAiB,EAAE,MAAM,CAAC;IAC1B,mEAAmE;IACnE,iBAAiB,EAAE,MAAM,GAAG,IAAI,CAAC;IACjC,kBAAkB,EAAE,KAAK,CAAC;QACxB,UAAU,EAAE,MAAM,CAAC;QACnB,IAAI,EAAE,MAAM,CAAC;QACb,WAAW,EAAE,MAAM,CAAC;QACpB,QAAQ,CAAC,EAAE;YACT,SAAS,CAAC,EAAE,MAAM,CAAC;YACnB,OAAO,CAAC,EAAE,MAAM,CAAC;YACjB,KAAK,CAAC,EAAE,MAAM,CAAC;YACf,GAAG,CAAC,EAAE,MAAM,CAAC;SACd,CAAC;KACH,CAAC,CAAC;IACH,aAAa,EAAE,MAAM,GAAG,IAAI,CAAC;IAC7B,kBAAkB,EAAE,MAAM,GAAG,IAAI,CAAC;IAClC,gBAAgB,EAAE;QAChB,GAAG,EAAE,MAAM,CAAC;QACZ,UAAU,EAAE,MAAM,CAAC;KACpB,GAAG,IAAI,CAAC;IACT,2DAA2D;IAC3D,UAAU,EAAE,gBAAgB,GAAG,IAAI,CAAC;CACrC;AAoBD,MAAM,WAAW,cAAc;IAC7B,SAAS,EAAE,MAAM,CAAC;IAClB,KAAK,EAAE,MAAM,GAAG,MAAM,GAAG,OAAO,CAAC;IACjC,OAAO,EAAE,MAAM,CAAC;IAChB,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,OAAO,CAAC,EAAE,OAAO,CAAC;CACnB;AAED,MAAM,WAAW,oBAAoB;IACnC,QAAQ,EAAE,MAAM,CAAC;IACjB,GAAG,EAAE,MAAM,CAAC;IACZ,UAAU,EAAE,MAAM,CAAC;IACnB,QAAQ,EAAE,MAAM,CAAC;IACjB,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,MAAM,CAAC,EAAE,MAAM,CAAC;CACjB;AAoMD,qBAAa,UAAW,SAAQ,YAAY;IAC1C,QAAQ,CAAC,KAAK,EAAE,eAAe,CAAC;IAChC,OAAO,CAAC,QAAQ,CAAC,KAAK,CAAkB;IACxC,QAAQ,CAAC,SAAS,EAAE,eAAe,CAAC;IACpC,OAAO,CAAC,QAAQ,CAAC,OAAO,CAAmC;IAC3D,OAAO,CAAC,QAAQ,CAAC,iBAAiB,CAAsC;IACxE,OAAO,CAAC,QAAQ,CAAC,UAAU,CAAuC;IAClE,yFAAyF;IACzF,OAAO,CAAC,QAAQ,CAAC,qBAAqB,CAA6B;IACnE,OAAO,CAAC,mBAAmB,CAA+C;IAC1E,OAAO,CAAC,UAAU,CAA4B;IAC9C,OAAO,CAAC,GAAG,CAAgC;IAC3C,OAAO,CAAC,UAAU,CAAuB;IACzC,OAAO,CAAC,eAAe,CAAgB;IACvC,wFAAwF;IACxF,OAAO,CAAC,eAAe,CAAuB;IAC9C,+DAA+D;IAC/D,OAAO,CAAC,UAAU,CAAuB;gBAE7B,OAAO,EAAE,iBAAiB;IAOtC,yFAAyF;IACnF,wBAAwB,CAAC,QAAQ,EAAE,MAAM,GAAG,OAAO,CAAC;QACxD,MAAM,EAAE,OAAO,CAAC;QAChB,MAAM,CAAC,EAAE,iBAAiB,CAAC,QAAQ,CAAC,CAAC;KACtC,CAAC;YAkBY,iBAAiB;IAY/B,6EAA6E;IACvE,aAAa,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC;QAAE,QAAQ,EAAE,MAAM,CAAA;KAAE,CAAC;IAmFhE,6EAA6E;IACvE,aAAa,CAAC,QAAQ,EAAE,MAAM,GAAG,OAAO,CAAC;QAAE,QAAQ,EAAE,MAAM,CAAC;QAAC,QAAQ,EAAE,OAAO,CAAA;KAAE,CAAC;IAuCvF,OAAO;uBACU,MAAM;sBA5HgC,MAAM;;2BA6HxC,MAAM;sBAzCgC,MAAM;sBAAY,OAAO;;MA0ClF;IAEF,kFAAkF;IAC5E,WAAW,IAAI,OAAO,CAAC,cAAc,EAAE,CAAC;IAgF9C;;;OAGG;IACG,mBAAmB,CACvB,QAAQ,EAAE,MAAM,EAChB,UAAU,EAAE,OAAO,GAClB,OAAO,CAAC;QACT,QAAQ,EAAE,MAAM,CAAC;QACjB,UAAU,EAAE,gBAAgB,CAAC;QAC7B,MAAM,EAAE,OAAO,CAAC;KACjB,CAAC;IAqBF;;;OAGG;IACG,qBAAqB,CAAC,QAAQ,EAAE,MAAM,GAAG,OAAO,CAAC;QACrD,QAAQ,EAAE,MAAM,CAAC;QACjB,UAAU,EAAE,IAAI,CAAC;QACjB,MAAM,EAAE,OAAO,CAAC;KACjB,CAAC;YAkBY,sBAAsB;IAsB9B,aAAa,CAAC,QAAQ,EAAE,MAAM,EAAE,UAAU,EAAE,MAAM,GAAG,OAAO,CAAC;QACjE,QAAQ,EAAE,MAAM,CAAC;QACjB,UAAU,EAAE,MAAM,CAAC;KACpB,CAAC;IAyBF,0FAA0F;YAC5E,2BAA2B;YAW3B,0BAA0B;IAYxC,qFAAqF;YACvE,8BAA8B;IAY5C,OAAO,CAAC,aAAa;IASrB,OAAO,CAAC,aAAa;IAMrB,OAAO,CAAC,iBAAiB;IAKzB;;;OAGG;IACH,OAAO,CAAC,gBAAgB;IAQxB,OAAO,CAAC,oBAAoB;IAM5B,OAAO,CAAC,yBAAyB;IAUjC,OAAO,CAAC,0BAA0B;IAkBlC,gFAAgF;YAClE,uBAAuB;IAarC,OAAO,CAAC,mBAAmB;IAgB3B,OAAO,CAAC,uBAAuB;IAU/B,OAAO,CAAC,gBAAgB;YAoBV,+BAA+B;YAsC/B,iBAAiB;YASjB,iBAAiB;YAqCjB,kBAAkB;IAUhC,uFAAuF;IACvF,OAAO,CAAC,kBAAkB;YAoBZ,gBAAgB;YAMhB,uBAAuB;IA0CrC,MAAM,CAAC,QAAQ,EAAE,MAAM;oBAGD,CAAC,oBACT,MAAM,WACN,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAC9B,OAAO,CAAC;YAAE,MAAM,EAAE,MAAM,CAAC;YAAC,IAAI,CAAC,EAAE,CAAC,CAAC;YAAC,KAAK,CAAC,EAAE,MAAM,CAAC;YAAC,KAAK,CAAC,EAAE,MAAM,CAAA;SAAE,CAAC;;IAU5E,OAAO,CAAC,mBAAmB;IA6D3B,6EAA6E;IAC7E,OAAO,CAAC,kBAAkB;IAO1B,MAAM,CAAC,OAAO,EAAE,aAAa,GAAG,IAAI,CAAC,MAAM;YAoE7B,iBAAiB;YAgDjB,qBAAqB;YA6BrB,mBAAmB;YA8FnB,uBAAuB;IA6ErC,OAAO,CAAC,oBAAoB;YASd,yBAAyB;YAQzB,4BAA4B;YAa5B,2CAA2C;YAO3C,iCAAiC;YA6BjC,wBAAwB;YAiBxB,cAAc;IAiD5B,OAAO,CAAC,uBAAuB;IAO/B,OAAO,CAAC,mBAAmB;YAOb,yBAAyB;YAwBzB,oBAAoB;YAkDpB,yBAAyB;YAsBzB,uBAAuB;YAcvB,UAAU;YAqYV,gBAAgB;IAqG9B,OAAO,CAAC,iBAAiB;IAWzB,OAAO,CAAC,gBAAgB;CA2KzB"}

package/dist/tomorrowos.js

@@ -8,7 +8,7 @@ import { generateDeterministicPairingCode, generateRandomPairingCode, isValidPai
 import { PlaylistCatalog } from "./playlist-catalog.js";
 import { MemoryStore } from "./store/memory-store.js";
 import { resolveBrandLogoPath, syncProjectAssetsToStaticRoot } from "./brand-assets.js";
-import { deleteCloudinaryAsset, resolveCloudinaryConfig, uploadBufferToCloudinary } from "./cloudinary-storage.js";
+import { createSignedUploadParams, deleteCloudinaryAsset, fetchCloudinaryResource, resolveCloudinaryConfig, uploadBufferToCloudinary } from "./cloudinary-storage.js";
 import { probeVideoDurationMs } from "./media-probe.js";
 import { contentHashHex, storeUploadIfNeeded } from "./upload-storage.js";
 import { detectPrimaryLanIpv4 } from "./lan-address.js";
@@ -168,9 +168,12 @@ function isAllowedWebSocketPath(pathname, allowed) {
     const trimmed = p.replace(/\/+$/, "") || "/";
     return allowed.has(trimmed) || allowed.has(`${trimmed}/`);
 }
-const MAX_MEDIA_UPLOAD_BYTES = 100 * 1024 * 1024;
+/** JSON API bodies stay capped; media uploads have no SDK size cap. */
+const MAX_JSON_BODY_BYTES = 2 * 1024 * 1024;
+/** `null` = no limit (host/Cloudinary may still enforce their own caps). */
+const MAX_MEDIA_UPLOAD_BYTES = null;
 async function readJsonBody(req) {
-    const buf = await readRawBody(req, MAX_MEDIA_UPLOAD_BYTES);
+    const buf = await readRawBody(req, MAX_JSON_BODY_BYTES);
     const raw = buf.toString("utf8");
     if (!raw.trim())
         return {};
@@ -187,7 +190,7 @@ async function readRawBody(req, maxBytes) {
     for await (const chunk of req) {
         const buf = typeof chunk === "string" ? Buffer.from(chunk) : chunk;
         total += buf.length;
-        if (total > maxBytes) {
+        if (maxBytes != null && maxBytes > 0 && total > maxBytes) {
             throw new Error(`Body too large (max ${maxBytes} bytes)`);
         }
         chunks.push(buf);
@@ -966,6 +969,101 @@ export class TomorrowOS extends EventEmitter {
             sendJson(res, 400, { status: "failed", error: msg });
         }
     }
+    async handleMediaUploadSign(req, res, url) {
+        const cloudinaryConfig = resolveCloudinaryConfig();
+        if (!cloudinaryConfig) {
+            sendJson(res, 404, {
+                status: "failed",
+                error: "Cloudinary is not configured"
+            });
+            return;
+        }
+        const rawName = url.searchParams.get("filename") || "upload";
+        const safeName = sanitizeUploadFilename(rawName);
+        const publicId = randomUUID().replace(/-/g, "");
+        const signed = createSignedUploadParams(cloudinaryConfig, {
+            publicId,
+            filename: safeName
+        });
+        sendJson(res, 200, {
+            status: "success",
+            mode: "cloudinary-direct",
+            ...signed
+        });
+    }
+    async handleMediaRegister(req, res) {
+        const cloudinaryConfig = resolveCloudinaryConfig();
+        if (!cloudinaryConfig) {
+            sendJson(res, 400, {
+                status: "failed",
+                error: "Cloudinary is not configured"
+            });
+            return;
+        }
+        try {
+            const body = (await readJsonBody(req));
+            const publicId = String(body.publicId || "").trim();
+            if (!publicId) {
+                sendJson(res, 400, { status: "failed", error: "publicId is required" });
+                return;
+            }
+            const safeName = sanitizeUploadFilename(body.originalFilename || path.basename(publicId) || "upload");
+            const hintedType = String(body.resourceType || "auto").trim() || "auto";
+            const remote = await fetchCloudinaryResource(cloudinaryConfig, publicId, hintedType);
+            const sha256 = remote.etag
+                ? `cloudinary-etag:${remote.etag}`
+                : `cloudinary:${remote.publicId}`;
+            const existing = await this.store.getUploadedAssetBySha256(sha256);
+            if (existing && isRemoteUploadedAssetUrl(existing.url)) {
+                const payload = {
+                    status: "success",
+                    url: existing.url,
+                    assetId: existing.id,
+                    filename: safeName,
+                    size: existing.bytes,
+                    contentHash: existing.sha256,
+                    deduplicated: true
+                };
+                if (remote.durationSec != null) {
+                    payload.durationMs = Math.round(remote.durationSec * 1000);
+                }
+                sendJson(res, 200, payload);
+                return;
+            }
+            const now = new Date().toISOString();
+            const mimeType = typeof body.mimeType === "string" ? body.mimeType : undefined;
+            const asset = {
+                id: randomUUID(),
+                sha256,
+                storageKey: remote.publicId,
+                url: remote.secureUrl,
+                originalFilename: safeName,
+                mimeType,
+                resourceType: remote.resourceType || inferResourceType(mimeType, safeName),
+                bytes: remote.bytes,
+                createdAt: now,
+                updatedAt: now
+            };
+            await this.store.setUploadedAsset(asset);
+            const payload = {
+                status: "success",
+                url: asset.url,
+                assetId: asset.id,
+                filename: safeName,
+                size: asset.bytes,
+                contentHash: asset.sha256,
+                deduplicated: false
+            };
+            if (remote.durationSec != null) {
+                payload.durationMs = Math.round(remote.durationSec * 1000);
+            }
+            sendJson(res, 200, payload);
+        }
+        catch (e) {
+            const msg = e instanceof Error ? e.message : "Register failed";
+            sendJson(res, 400, { status: "failed", error: msg });
+        }
+    }
     async storeUploadedMediaAsset(body, safeName, mimeType) {
         const sha256 = contentHashHex(body);
         const cloudinaryConfig = resolveCloudinaryConfig();
@@ -1266,6 +1364,14 @@ export class TomorrowOS extends EventEmitter {
                 await this.handleMediaUpload(req, res, url);
                 return;
             }
+            if (req.method === "GET" && pathname === "/media/upload-sign") {
+                await this.handleMediaUploadSign(req, res, url);
+                return;
+            }
+            if (req.method === "POST" && pathname === "/media/register") {
+                await this.handleMediaRegister(req, res);
+                return;
+            }
             if (req.method === "GET" && this.staticRoot) {
                 const served = await this.tryServeStatic(pathname, res);
                 if (served)

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@tomorrowos/sdk",
-  "version": "0.9.51",
+  "version": "0.9.53",
   "description": "TomorrowOS CMS server SDK - WebSocket transport, pairing, device commands, optional static CMS UI. Includes CLI (tomorrowos init / build) and starter templates.",
   "type": "module",
   "main": "./dist/index.js",

package/templates/cms-starter/package.json

@@ -1,6 +1,6 @@
 {
   "name": "my-cms",
-  "version": "0.9.51",
+  "version": "0.9.53",
   "description": "CMS server on @tomorrowos/sdk. Add your UI (React, static files, etc.) alongside this server.",
   "private": true,
   "type": "module",
@@ -13,7 +13,7 @@
     "build-player": "tomorrowos build --platform tizen"
   },
   "dependencies": {
-    "@tomorrowos/sdk": "^0.9.51",
+    "@tomorrowos/sdk": "^0.9.53",
     "dotenv": "^17.2.3",
     "tsx": "^4.19.0"
   },

package/templates/cms-starter/public/methods.js

@@ -43,6 +43,10 @@ let uploadInProgress = false;
 const UPLOAD_MAX_RETRIES = 3;
 const DEVICE_RECONNECT_GRACE_MS = 60000;
 const UPLOAD_TIMEOUT_MS = 120000;
+/** Direct-to-Cloudinary: no XHR timeout (large videos can exceed 2 minutes). */
+const CLOUDINARY_DIRECT_TIMEOUT_MS = 0;
+/** Cloudinary chunked upload minimum is 5MB; use 8MB chunks. */
+const CLOUDINARY_CHUNK_BYTES = 8 * 1024 * 1024;
 
 /**
  * Apply brand.json to the Control Panel (name + colours). No logo on the panel.
@@ -1661,7 +1665,164 @@ function uploadFileWithProgress(file, { onProgress, attempt }) {
   });
 }
 
+async function fetchCloudinaryUploadSign(filename) {
+  const q = new URLSearchParams({ filename: filename || "upload" });
+  const res = await fetch(`/media/upload-sign?${q.toString()}`, {
+    cache: "no-store"
+  });
+  if (res.status === 404) return null;
+  let payload = {};
+  try {
+    payload = await res.json();
+  } catch {
+    payload = {};
+  }
+  if (!res.ok || payload.status === "failed" || !payload.uploadUrl) {
+    if (res.status === 404) return null;
+    throw new Error(payload.error || `Upload sign failed (${res.status})`);
+  }
+  return payload;
+}
+
+function buildCloudinaryFormData(fileOrBlob, sign) {
+  const form = new FormData();
+  const name = String(sign.filenameOverride || fileOrBlob.name || "upload");
+  form.append("file", fileOrBlob, name);
+  form.append("api_key", String(sign.apiKey));
+  form.append("timestamp", String(sign.timestamp));
+  form.append("signature", String(sign.signature));
+  form.append("public_id", String(sign.publicId));
+  form.append("overwrite", "true");
+  form.append("unique_filename", "false");
+  form.append("use_filename", "false");
+  form.append("filename_override", name);
+  return form;
+}
+
+function xhrSendForm(url, form, { timeoutMs, onProgress, headers }) {
+  return new Promise((resolve, reject) => {
+    const xhr = new XMLHttpRequest();
+    xhr.open("POST", url, true);
+    xhr.timeout = timeoutMs;
+    if (headers) {
+      for (const [key, value] of Object.entries(headers)) {
+        xhr.setRequestHeader(key, value);
+      }
+    }
+    xhr.upload.onprogress = (event) => {
+      if (!event.lengthComputable) return;
+      if (typeof onProgress === "function") onProgress(event.loaded, event.total);
+    };
+    xhr.onerror = () => reject(new Error("Network error uploading to Cloudinary"));
+    xhr.ontimeout = () => reject(new Error("Cloudinary upload timed out"));
+    xhr.onload = () => {
+      let payload = {};
+      try {
+        payload = xhr.responseText ? JSON.parse(xhr.responseText) : {};
+      } catch {
+        payload = {};
+      }
+      if (xhr.status >= 200 && xhr.status < 300 && !payload.error) {
+        resolve(payload);
+        return;
+      }
+      const msg =
+        payload.error?.message ||
+        payload.error ||
+        `Cloudinary upload failed (${xhr.status})`;
+      reject(new Error(typeof msg === "string" ? msg : JSON.stringify(msg)));
+    };
+    xhr.send(form);
+  });
+}
+
+async function uploadToCloudinaryDirect(file, sign, onProgress) {
+  const uploadUrl = String(sign.uploadUrl);
+  const uniqueUploadId = `${Date.now()}-${Math.random().toString(16).slice(2)}`;
+
+  if (file.size <= CLOUDINARY_CHUNK_BYTES) {
+    const form = buildCloudinaryFormData(file, sign);
+    const result = await xhrSendForm(uploadUrl, form, {
+      timeoutMs: CLOUDINARY_DIRECT_TIMEOUT_MS,
+      onProgress: (loaded, total) => {
+        if (typeof onProgress !== "function") return;
+        onProgress(Math.round((loaded / total) * 100));
+      }
+    });
+    return result;
+  }
+
+  let offset = 0;
+  let finalResult = null;
+  while (offset < file.size) {
+    const end = Math.min(offset + CLOUDINARY_CHUNK_BYTES, file.size);
+    const chunk = file.slice(offset, end);
+    const form = buildCloudinaryFormData(chunk, sign);
+    const chunkBase = offset;
+    // eslint-disable-next-line no-await-in-loop
+    finalResult = await xhrSendForm(uploadUrl, form, {
+      timeoutMs: CLOUDINARY_DIRECT_TIMEOUT_MS,
+      headers: {
+        "X-Unique-Upload-Id": uniqueUploadId,
+        "Content-Range": `bytes ${offset}-${end - 1}/${file.size}`
+      },
+      onProgress: (loaded) => {
+        if (typeof onProgress !== "function") return;
+        const overall = Math.min(file.size, chunkBase + loaded);
+        onProgress(Math.round((overall / file.size) * 100));
+      }
+    });
+    offset = end;
+  }
+  return finalResult;
+}
+
+async function registerCloudinaryUpload(file, cloudinaryResult) {
+  const res = await fetch("/media/register", {
+    method: "POST",
+    headers: { "Content-Type": "application/json" },
+    body: JSON.stringify({
+      publicId: cloudinaryResult.public_id,
+      resourceType: cloudinaryResult.resource_type || "auto",
+      originalFilename: file.name,
+      mimeType: file.type || undefined
+    })
+  });
+  let payload = {};
+  try {
+    payload = await res.json();
+  } catch {
+    payload = {};
+  }
+  if (!res.ok || payload.status === "failed") {
+    throw new Error(payload.error || `Register failed (${res.status})`);
+  }
+  return payload;
+}
+
+async function uploadViaCloudinaryDirect(file, onProgress) {
+  const sign = await fetchCloudinaryUploadSign(file.name);
+  if (!sign) return null;
+  const cloudinaryResult = await uploadToCloudinaryDirect(file, sign, onProgress);
+  if (!cloudinaryResult?.public_id) {
+    throw new Error("Cloudinary upload returned no public_id");
+  }
+  if (typeof onProgress === "function") onProgress(100);
+  return registerCloudinaryUpload(file, cloudinaryResult);
+}
+
 async function uploadFile(file, onProgress) {
+  try {
+    const direct = await uploadViaCloudinaryDirect(file, onProgress);
+    if (direct) return direct;
+  } catch (err) {
+    const msg = err?.message || String(err);
+    // Fall back to proxy upload only when Cloudinary is unavailable.
+    if (!/not configured|Upload sign failed \(404\)/i.test(msg)) {
+      throw err;
+    }
+  }
+
   let lastErr = null;
   for (let attempt = 1; attempt <= UPLOAD_MAX_RETRIES; attempt += 1) {
     try {
@@ -1669,6 +1830,9 @@ async function uploadFile(file, onProgress) {
       return payload;
     } catch (err) {
       lastErr = err;
+      const msg = err?.message || String(err);
+      // 413 from host proxy will not succeed on retry — fail fast.
+      if (/Upload failed \(413\)/i.test(msg)) break;
       if (attempt >= UPLOAD_MAX_RETRIES) break;
       await new Promise((resolve) => setTimeout(resolve, 500 * attempt));
     }

package/templates/cms-starter-v0/cms-panel/methods.js

@@ -43,6 +43,10 @@ let uploadInProgress = false;
 const UPLOAD_MAX_RETRIES = 3;
 const DEVICE_RECONNECT_GRACE_MS = 60000;
 const UPLOAD_TIMEOUT_MS = 120000;
+/** Direct-to-Cloudinary: no XHR timeout (large videos can exceed 2 minutes). */
+const CLOUDINARY_DIRECT_TIMEOUT_MS = 0;
+/** Cloudinary chunked upload minimum is 5MB; use 8MB chunks. */
+const CLOUDINARY_CHUNK_BYTES = 8 * 1024 * 1024;
 
 /**
  * Apply brand.json to the Control Panel (name + colours). No logo on the panel.
@@ -1662,7 +1666,162 @@ function uploadFileWithProgress(file, { onProgress, attempt }) {
   });
 }
 
+async function fetchCloudinaryUploadSign(filename) {
+  const q = new URLSearchParams({ filename: filename || "upload" });
+  const res = await fetch(`/media/upload-sign?${q.toString()}`, {
+    cache: "no-store"
+  });
+  if (res.status === 404) return null;
+  let payload = {};
+  try {
+    payload = await res.json();
+  } catch {
+    payload = {};
+  }
+  if (!res.ok || payload.status === "failed" || !payload.uploadUrl) {
+    if (res.status === 404) return null;
+    throw new Error(payload.error || `Upload sign failed (${res.status})`);
+  }
+  return payload;
+}
+
+function buildCloudinaryFormData(fileOrBlob, sign) {
+  const form = new FormData();
+  const name = String(sign.filenameOverride || fileOrBlob.name || "upload");
+  form.append("file", fileOrBlob, name);
+  form.append("api_key", String(sign.apiKey));
+  form.append("timestamp", String(sign.timestamp));
+  form.append("signature", String(sign.signature));
+  form.append("public_id", String(sign.publicId));
+  form.append("overwrite", "true");
+  form.append("unique_filename", "false");
+  form.append("use_filename", "false");
+  form.append("filename_override", name);
+  return form;
+}
+
+function xhrSendForm(url, form, { timeoutMs, onProgress, headers }) {
+  return new Promise((resolve, reject) => {
+    const xhr = new XMLHttpRequest();
+    xhr.open("POST", url, true);
+    xhr.timeout = timeoutMs;
+    if (headers) {
+      for (const [key, value] of Object.entries(headers)) {
+        xhr.setRequestHeader(key, value);
+      }
+    }
+    xhr.upload.onprogress = (event) => {
+      if (!event.lengthComputable) return;
+      if (typeof onProgress === "function") onProgress(event.loaded, event.total);
+    };
+    xhr.onerror = () => reject(new Error("Network error uploading to Cloudinary"));
+    xhr.ontimeout = () => reject(new Error("Cloudinary upload timed out"));
+    xhr.onload = () => {
+      let payload = {};
+      try {
+        payload = xhr.responseText ? JSON.parse(xhr.responseText) : {};
+      } catch {
+        payload = {};
+      }
+      if (xhr.status >= 200 && xhr.status < 300 && !payload.error) {
+        resolve(payload);
+        return;
+      }
+      const msg =
+        payload.error?.message ||
+        payload.error ||
+        `Cloudinary upload failed (${xhr.status})`;
+      reject(new Error(typeof msg === "string" ? msg : JSON.stringify(msg)));
+    };
+    xhr.send(form);
+  });
+}
+
+async function uploadToCloudinaryDirect(file, sign, onProgress) {
+  const uploadUrl = String(sign.uploadUrl);
+  const uniqueUploadId = `${Date.now()}-${Math.random().toString(16).slice(2)}`;
+
+  if (file.size <= CLOUDINARY_CHUNK_BYTES) {
+    const form = buildCloudinaryFormData(file, sign);
+    const result = await xhrSendForm(uploadUrl, form, {
+      timeoutMs: CLOUDINARY_DIRECT_TIMEOUT_MS,
+      onProgress: (loaded, total) => {
+        if (typeof onProgress !== "function") return;
+        onProgress(Math.round((loaded / total) * 100));
+      }
+    });
+    return result;
+  }
+
+  let offset = 0;
+  let finalResult = null;
+  while (offset < file.size) {
+    const end = Math.min(offset + CLOUDINARY_CHUNK_BYTES, file.size);
+    const chunk = file.slice(offset, end);
+    const form = buildCloudinaryFormData(chunk, sign);
+    const chunkBase = offset;
+    finalResult = await xhrSendForm(uploadUrl, form, {
+      timeoutMs: CLOUDINARY_DIRECT_TIMEOUT_MS,
+      headers: {
+        "X-Unique-Upload-Id": uniqueUploadId,
+        "Content-Range": `bytes ${offset}-${end - 1}/${file.size}`
+      },
+      onProgress: (loaded) => {
+        if (typeof onProgress !== "function") return;
+        const overall = Math.min(file.size, chunkBase + loaded);
+        onProgress(Math.round((overall / file.size) * 100));
+      }
+    });
+    offset = end;
+  }
+  return finalResult;
+}
+
+async function registerCloudinaryUpload(file, cloudinaryResult) {
+  const res = await fetch("/media/register", {
+    method: "POST",
+    headers: { "Content-Type": "application/json" },
+    body: JSON.stringify({
+      publicId: cloudinaryResult.public_id,
+      resourceType: cloudinaryResult.resource_type || "auto",
+      originalFilename: file.name,
+      mimeType: file.type || undefined
+    })
+  });
+  let payload = {};
+  try {
+    payload = await res.json();
+  } catch {
+    payload = {};
+  }
+  if (!res.ok || payload.status === "failed") {
+    throw new Error(payload.error || `Register failed (${res.status})`);
+  }
+  return payload;
+}
+
+async function uploadViaCloudinaryDirect(file, onProgress) {
+  const sign = await fetchCloudinaryUploadSign(file.name);
+  if (!sign) return null;
+  const cloudinaryResult = await uploadToCloudinaryDirect(file, sign, onProgress);
+  if (!cloudinaryResult?.public_id) {
+    throw new Error("Cloudinary upload returned no public_id");
+  }
+  if (typeof onProgress === "function") onProgress(100);
+  return registerCloudinaryUpload(file, cloudinaryResult);
+}
+
 async function uploadFile(file, onProgress) {
+  try {
+    const direct = await uploadViaCloudinaryDirect(file, onProgress);
+    if (direct) return direct;
+  } catch (err) {
+    const msg = err?.message || String(err);
+    if (!/not configured|Upload sign failed \(404\)/i.test(msg)) {
+      throw err;
+    }
+  }
+
   let lastErr = null;
   for (let attempt = 1; attempt <= UPLOAD_MAX_RETRIES; attempt += 1) {
     try {
@@ -1670,6 +1829,8 @@ async function uploadFile(file, onProgress) {
       return payload;
     } catch (err) {
       lastErr = err;
+      const msg = err?.message || String(err);
+      if (/Upload failed \(413\)/i.test(msg)) break;
       if (attempt >= UPLOAD_MAX_RETRIES) break;
       await new Promise((resolve) => setTimeout(resolve, 500 * attempt));
     }

package/templates/cms-starter-v0/package.json

@@ -1,6 +1,6 @@
 {
   "name": "my-cms",
-  "version": "0.9.51",
+  "version": "0.9.53",
   "description": "TomorrowOS CMS for Vercel / v0 Publish (Fluid Function + WebSockets + optional Next Preview).",
   "private": true,
   "type": "module",
@@ -17,7 +17,7 @@
     "build-player": "tomorrowos build --platform tizen"
   },
   "dependencies": {
-    "@tomorrowos/sdk": "^0.9.51",
+    "@tomorrowos/sdk": "^0.9.53",
     "dotenv": "^17.2.3",
     "tsx": "^4.19.0"
   },