@tomorrowos/sdk 0.9.56 → 0.9.58

package/README.md

@@ -99,8 +99,8 @@ Supported hosts: **Replit** and **Vercel / v0**.
 2. On Vercel: paste Q1–Q3 **verbatim** from `VERCEL_QUESTIONS.md`; after database choice set `TOMORROWOS_STORE` and `DATABASE_SSL` yourself; after media choice set `TOMORROWOS_MEDIA` yourself.
 3. Read `brand.schema.json` for the validated shape of `brand.json`.
 4. Scaffold with the correct template:
-   - Replit / self-host style: `npx @tomorrowos/sdk@0.9.56 init` (default `cms-starter`)
-   - Vercel / v0: `npx @tomorrowos/sdk@0.9.56 init . --hosting v0 --force` (`cms-starter-v0`)
+   - Replit / self-host style: `npx @tomorrowos/sdk init` (default `cms-starter`)
+   - Vercel / v0: `npx @tomorrowos/sdk init . --hosting v0 --force` (`cms-starter-v0`)
 5. Apply the user’s answers — brand and use case. Validate `brand.json`. On Vercel, apply the **NON-NEGOTIABLE VERCEL RUNTIME CONTRACT** from `VERCEL_SETUP.md`.
 6. Point the user at `PLAYER_INSTALL.md` and the Control Panel **Download Players** UI once the CMS is running.
 
@@ -317,8 +317,8 @@ Works in either direction across `sqlite`, `postgres`, and `supabase`. It moves
 
 ### Media
 
-- **Local / Object Storage:** `POST /media/upload` when `staticRoot` is set (files under `public/uploads`).
-- **Cloudinary:** set `CLOUDINARY_CLOUD_NAME`, `CLOUDINARY_API_KEY`, `CLOUDINARY_API_SECRET` (optional `CLOUDINARY_FOLDER`). The Control Panel uses **browser → Cloudinary** direct upload (`/media/upload-sign` + `/media/register`) when Cloudinary is configured, which avoids host request-body limits on platforms like Replit.
+- **Local / Object Storage:** small files may use `POST /media/upload`. Larger files use **chunked upload** (`/media/upload-init` → `/media/upload-chunk` → `/media/upload-complete`) so hosts like Replit do not return HTTP 413 on ~50MB+ bodies.
+- **Cloudinary:** set `CLOUDINARY_CLOUD_NAME`, `CLOUDINARY_API_KEY`, `CLOUDINARY_API_SECRET` (optional `CLOUDINARY_FOLDER`). The Control Panel uses **browser → Cloudinary** direct upload (`/media/upload-sign` + `/media/register`) when Cloudinary is configured.
 
 Cloudinary account plans still enforce their own max file sizes (for example Free plan video caps).
 
@@ -377,7 +377,7 @@ Fetch `GET /brand.json` from the panel’s network. A live WebSocket with a blac
 Policy URLs must be absolute and reachable from the screen. Relative paths or hosts only visible on your laptop will fail on the panel.
 
 **Upload fails with HTTP 413 on Replit (or similar hosts).**  
-The file was posted through the CMS host body limit. With Cloudinary configured, use an SDK/Control Panel version that supports direct browser upload. Otherwise upload smaller files or raise the host limit.
+Use `@tomorrowos/sdk` Control Panel / templates: non-Cloudinary uploads over ~2MB go through **chunked** `/media/upload-chunk` (works with Replit Object Storage). With Cloudinary configured, the panel uses browser direct upload instead.
 
 **BrightSign zip has empty `cmsEndpoint`.**  
 You downloaded the mother zip from a static CDN instead of **this** CMS’s `/players/brightsign.zip`. Use Control Panel → Download Players → BrightSign on the deployed CMS.

package/VERCEL_QUESTIONS.md

@@ -1,6 +1,6 @@
 # Vercel / v0 ? Verbatim question bank
 
-> **Protocol:** `vercel-questions/1.1` (pairs with `VERCEL_SETUP.md` 1.10+ / `@tomorrowos/sdk` 0.9.56+)  
+> **Protocol:** `vercel-questions/1.1` (pairs with `VERCEL_SETUP.md` 1.10+ / `@tomorrowos/sdk` 0.9.58+)  
 > **For Agents:** When asking the user a setup question, **copy-paste the block below for that step EXACTLY**.  
 > Do **not** paraphrase, reorder, rename options, or invent alternatives (no S3, no Supabase Storage, no "Blob recommended", no "disable media").  
 > After each answer, configure per `VERCEL_SETUP.md`, then paste the **next** block.

package/VERCEL_SETUP.md

@@ -5,7 +5,7 @@
 >
 > **On Vercel, this file is the setup questionnaire** (not `REPLIT_SETUP.md`).
 >
-> Protocol id: `vercel-setup/1.9` ? pairs with `@tomorrowos/sdk` **0.9.56+** (`templates/cms-starter-v0`, Fluid Functions WebSockets).
+> Protocol id: `vercel-setup/1.9` ? pairs with `@tomorrowos/sdk` **0.9.58+** (`templates/cms-starter-v0`, Fluid Functions WebSockets).
 >
 > **Questions source of truth:** `VERCEL_QUESTIONS.md` ? Agents must **open that file and paste each Q block verbatim**. Do not paraphrase.  
 > **Copy questions verbatim from `VERCEL_QUESTIONS.md`.** Do not invent alternate Q2 options (no ?Supabase Storage?? no S3, no ?disable media?? no making Blob the recommended option).  
@@ -39,7 +39,7 @@ Open VERCEL_QUESTIONS.md first.
 For Q1, Q2, Q3: paste each question block VERBATIM. Do not rephrase options.
 After Q1 database choice, YOU set TOMORROWOS_STORE and DATABASE_SSL. Do not ask me to fill those.
 After Q2 media storage choice, YOU set TOMORROWOS_MEDIA. Do not ask me to fill those.
-Run: npx @tomorrowos/sdk@0.9.56 init . --hosting v0 --force
+Run: npx @tomorrowos/sdk@0.9.58 init . --hosting v0 --force
 Keep cms-starter-v0 layout.
 Apply the NON-NEGOTIABLE VERCEL RUNTIME CONTRACT exactly:
 one TomorrowOS instance only

package/dist/chunked-upload.d.ts

@@ -0,0 +1,32 @@
+/** Keep each proxy request well under typical host/body limits (Replit 413). */
+export declare const MEDIA_UPLOAD_CHUNK_BYTES: number;
+export interface ChunkedUploadMeta {
+    uploadId: string;
+    filename: string;
+    mimeType?: string;
+    size: number;
+    chunkSize: number;
+    totalChunks: number;
+    createdAt: string;
+    received: number[];
+}
+export declare function isValidUploadId(uploadId: string): boolean;
+export declare function chunkedUploadRoot(staticRoot: string): string;
+export declare function chunkedUploadDir(staticRoot: string, uploadId: string): string;
+export declare function initChunkedUpload(staticRoot: string, options: {
+    filename: string;
+    size: number;
+    mimeType?: string;
+}): Promise<ChunkedUploadMeta>;
+export declare function readChunkedUploadMeta(staticRoot: string, uploadId: string): Promise<ChunkedUploadMeta>;
+export declare function storeChunkedUploadPart(staticRoot: string, uploadId: string, index: number, body: Buffer): Promise<ChunkedUploadMeta>;
+export declare function assembleChunkedUpload(staticRoot: string, uploadId: string): Promise<{
+    filePath: string;
+    sha256: string;
+    bytes: number;
+    meta: ChunkedUploadMeta;
+}>;
+export declare function cleanupChunkedUpload(staticRoot: string, uploadId: string): Promise<void>;
+/** Best-effort: drop unfinished uploads older than maxAgeMs. */
+export declare function cleanupStaleChunkedUploads(staticRoot: string, maxAgeMs?: number): Promise<void>;
+//# sourceMappingURL=chunked-upload.d.ts.map

package/dist/chunked-upload.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"chunked-upload.d.ts","sourceRoot":"","sources":["../src/chunked-upload.ts"],"names":[],"mappings":"AAIA,gFAAgF;AAChF,eAAO,MAAM,wBAAwB,QAAkB,CAAC;AAIxD,MAAM,WAAW,iBAAiB;IAChC,QAAQ,EAAE,MAAM,CAAC;IACjB,QAAQ,EAAE,MAAM,CAAC;IACjB,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,IAAI,EAAE,MAAM,CAAC;IACb,SAAS,EAAE,MAAM,CAAC;IAClB,WAAW,EAAE,MAAM,CAAC;IACpB,SAAS,EAAE,MAAM,CAAC;IAClB,QAAQ,EAAE,MAAM,EAAE,CAAC;CACpB;AAED,wBAAgB,eAAe,CAAC,QAAQ,EAAE,MAAM,GAAG,OAAO,CAEzD;AAED,wBAAgB,iBAAiB,CAAC,UAAU,EAAE,MAAM,GAAG,MAAM,CAE5D;AAED,wBAAgB,gBAAgB,CAAC,UAAU,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,GAAG,MAAM,CAK7E;AAED,wBAAsB,iBAAiB,CACrC,UAAU,EAAE,MAAM,EAClB,OAAO,EAAE;IAAE,QAAQ,EAAE,MAAM,CAAC;IAAC,IAAI,EAAE,MAAM,CAAC;IAAC,QAAQ,CAAC,EAAE,MAAM,CAAA;CAAE,GAC7D,OAAO,CAAC,iBAAiB,CAAC,CA2B5B;AAED,wBAAsB,qBAAqB,CACzC,UAAU,EAAE,MAAM,EAClB,QAAQ,EAAE,MAAM,GACf,OAAO,CAAC,iBAAiB,CAAC,CAI5B;AAUD,wBAAsB,sBAAsB,CAC1C,UAAU,EAAE,MAAM,EAClB,QAAQ,EAAE,MAAM,EAChB,KAAK,EAAE,MAAM,EACb,IAAI,EAAE,MAAM,GACX,OAAO,CAAC,iBAAiB,CAAC,CA0B5B;AAED,wBAAsB,qBAAqB,CACzC,UAAU,EAAE,MAAM,EAClB,QAAQ,EAAE,MAAM,GACf,OAAO,CAAC;IAAE,QAAQ,EAAE,MAAM,CAAC;IAAC,MAAM,EAAE,MAAM,CAAC;IAAC,KAAK,EAAE,MAAM,CAAC;IAAC,IAAI,EAAE,iBAAiB,CAAA;CAAE,CAAC,CAiCvF;AAED,wBAAsB,oBAAoB,CACxC,UAAU,EAAE,MAAM,EAClB,QAAQ,EAAE,MAAM,GACf,OAAO,CAAC,IAAI,CAAC,CAIf;AAED,gEAAgE;AAChE,wBAAsB,0BAA0B,CAC9C,UAAU,EAAE,MAAM,EAClB,QAAQ,SAAqB,GAC5B,OAAO,CAAC,IAAI,CAAC,CAuBf"}

package/dist/chunked-upload.js

@@ -0,0 +1,134 @@
+import { createHash, randomUUID } from "crypto";
+import fs from "fs/promises";
+import path from "path";
+/** Keep each proxy request well under typical host/body limits (Replit 413). */
+export const MEDIA_UPLOAD_CHUNK_BYTES = 1 * 1024 * 1024;
+const UPLOAD_ID_RE = /^[0-9a-f]{8}-[0-9a-f]{4}-[1-5][0-9a-f]{3}-[89ab][0-9a-f]{3}-[0-9a-f]{12}$/i;
+export function isValidUploadId(uploadId) {
+    return UPLOAD_ID_RE.test(String(uploadId || "").trim());
+}
+export function chunkedUploadRoot(staticRoot) {
+    return path.join(path.resolve(staticRoot), ".upload-tmp");
+}
+export function chunkedUploadDir(staticRoot, uploadId) {
+    if (!isValidUploadId(uploadId)) {
+        throw new Error("Invalid uploadId");
+    }
+    return path.join(chunkedUploadRoot(staticRoot), uploadId);
+}
+export async function initChunkedUpload(staticRoot, options) {
+    const size = Number(options.size);
+    if (!Number.isFinite(size) || size <= 0) {
+        throw new Error("size must be a positive number");
+    }
+    if (size > 20 * 1024 * 1024 * 1024) {
+        throw new Error("File too large (max 20GB)");
+    }
+    const uploadId = randomUUID();
+    const chunkSize = MEDIA_UPLOAD_CHUNK_BYTES;
+    const totalChunks = Math.ceil(size / chunkSize);
+    const meta = {
+        uploadId,
+        filename: options.filename,
+        mimeType: options.mimeType,
+        size,
+        chunkSize,
+        totalChunks,
+        createdAt: new Date().toISOString(),
+        received: []
+    };
+    const dir = chunkedUploadDir(staticRoot, uploadId);
+    await fs.mkdir(dir, { recursive: true });
+    await fs.writeFile(path.join(dir, "meta.json"), JSON.stringify(meta), "utf8");
+    return meta;
+}
+export async function readChunkedUploadMeta(staticRoot, uploadId) {
+    const dir = chunkedUploadDir(staticRoot, uploadId);
+    const raw = await fs.readFile(path.join(dir, "meta.json"), "utf8");
+    return JSON.parse(raw);
+}
+async function writeChunkedUploadMeta(staticRoot, meta) {
+    const dir = chunkedUploadDir(staticRoot, meta.uploadId);
+    await fs.writeFile(path.join(dir, "meta.json"), JSON.stringify(meta), "utf8");
+}
+export async function storeChunkedUploadPart(staticRoot, uploadId, index, body) {
+    const meta = await readChunkedUploadMeta(staticRoot, uploadId);
+    if (!Number.isInteger(index) || index < 0 || index >= meta.totalChunks) {
+        throw new Error(`Invalid chunk index ${index}`);
+    }
+    const expected = index === meta.totalChunks - 1
+        ? meta.size - meta.chunkSize * (meta.totalChunks - 1)
+        : meta.chunkSize;
+    if (body.length !== expected) {
+        throw new Error(`Chunk ${index} size mismatch (got ${body.length}, expected ${expected})`);
+    }
+    const dir = chunkedUploadDir(staticRoot, uploadId);
+    const partPath = path.join(dir, `part-${String(index).padStart(6, "0")}`);
+    await fs.writeFile(partPath, body);
+    if (!meta.received.includes(index)) {
+        meta.received.push(index);
+        meta.received.sort((a, b) => a - b);
+        await writeChunkedUploadMeta(staticRoot, meta);
+    }
+    return meta;
+}
+export async function assembleChunkedUpload(staticRoot, uploadId) {
+    const meta = await readChunkedUploadMeta(staticRoot, uploadId);
+    if (meta.received.length !== meta.totalChunks) {
+        throw new Error(`Upload incomplete (${meta.received.length}/${meta.totalChunks} chunks)`);
+    }
+    const dir = chunkedUploadDir(staticRoot, uploadId);
+    const assembledPath = path.join(dir, "assembled.bin");
+    const hash = createHash("sha256");
+    await fs.writeFile(assembledPath, Buffer.alloc(0));
+    for (let i = 0; i < meta.totalChunks; i += 1) {
+        const partPath = path.join(dir, `part-${String(i).padStart(6, "0")}`);
+        const data = await fs.readFile(partPath);
+        hash.update(data);
+        await fs.appendFile(assembledPath, data);
+    }
+    const stat = await fs.stat(assembledPath);
+    if (stat.size !== meta.size) {
+        throw new Error(`Assembled size mismatch (got ${stat.size}, expected ${meta.size})`);
+    }
+    return {
+        filePath: assembledPath,
+        sha256: hash.digest("hex"),
+        bytes: stat.size,
+        meta
+    };
+}
+export async function cleanupChunkedUpload(staticRoot, uploadId) {
+    if (!isValidUploadId(uploadId))
+        return;
+    const dir = chunkedUploadDir(staticRoot, uploadId);
+    await fs.rm(dir, { recursive: true, force: true });
+}
+/** Best-effort: drop unfinished uploads older than maxAgeMs. */
+export async function cleanupStaleChunkedUploads(staticRoot, maxAgeMs = 6 * 60 * 60 * 1000) {
+    const root = chunkedUploadRoot(staticRoot);
+    let entries = [];
+    try {
+        entries = await fs.readdir(root);
+    }
+    catch {
+        return;
+    }
+    const now = Date.now();
+    for (const name of entries) {
+        if (!isValidUploadId(name))
+            continue;
+        const metaPath = path.join(root, name, "meta.json");
+        try {
+            const raw = await fs.readFile(metaPath, "utf8");
+            const meta = JSON.parse(raw);
+            const created = Date.parse(meta.createdAt);
+            if (!Number.isFinite(created) || now - created > maxAgeMs) {
+                await fs.rm(path.join(root, name), { recursive: true, force: true });
+            }
+        }
+        catch {
+            await fs.rm(path.join(root, name), { recursive: true, force: true });
+        }
+    }
+}

package/dist/tomorrowos.d.ts

@@ -209,6 +209,10 @@ export declare class TomorrowOS extends EventEmitter {
     private handleMediaUpload;
     private handleMediaUploadSign;
     private handleMediaRegister;
+    private handleMediaUploadInit;
+    private handleMediaUploadChunk;
+    private handleMediaUploadComplete;
+    private storeLocalAssembledUpload;
     private storeUploadedMediaAsset;
     private getAssetIdsFromItems;
     private isUploadedAssetReferenced;

package/dist/tomorrowos.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"tomorrowos.d.ts","sourceRoot":"","sources":["../src/tomorrowos.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,YAAY,EAAE,MAAM,QAAQ,CAAC;AAEtC,OAAO,IAAI,MAAM,MAAM,CAAC;AAYxB,OAAO,EAAE,eAAe,EAAE,KAAK,iBAAiB,EAAE,MAAM,uBAAuB,CAAC;AAChF,OAAO,KAAK,EACV,gBAAgB,EAKhB,eAAe,EAEhB,MAAM,kBAAkB,CAAC;AA0B1B,YAAY,EACV,cAAc,EACd,eAAe,EACf,kBAAkB,EAClB,aAAa,EACd,MAAM,oBAAoB,CAAC;AAE5B,MAAM,WAAW,eAAe;IAC9B,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC;CACxB;AAED,MAAM,WAAW,iBAAiB;IAChC,KAAK,EAAE,eAAe,CAAC;IACvB,6EAA6E;IAC7E,KAAK,CAAC,EAAE,eAAe,CAAC;CACzB;AAED,MAAM,WAAW,aAAa;IAC5B,IAAI,EAAE,MAAM,CAAC;IACb,IAAI,CAAC,EAAE,MAAM,CAAC;IACd;;;;;OAKG;IACH,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB;;;OAGG;IACH,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB;;;;;OAKG;IACH,UAAU,CAAC,EAAE,OAAO,CAAC;IACrB;;;OAGG;IACH,cAAc,CAAC,EAAE,MAAM,EAAE,CAAC;CAC3B;AAoED,MAAM,WAAW,cAAc;IAC7B,QAAQ,EAAE,MAAM,CAAC;IACjB,2EAA2E;IAC3E,WAAW,EAAE,MAAM,GAAG,IAAI,CAAC;IAC3B,SAAS,EAAE,OAAO,CAAC;IACnB,UAAU,EAAE,MAAM,GAAG,IAAI,CAAC;IAC1B,QAAQ,EAAE,MAAM,GAAG,IAAI,CAAC;IACxB,MAAM,EAAE,MAAM,GAAG,IAAI,CAAC;IACtB,aAAa,EAAE,MAAM,GAAG,IAAI,CAAC;IAC7B,aAAa,EAAE,MAAM,GAAG,IAAI,CAAC;IAC7B,YAAY,EAAE,MAAM,GAAG,IAAI,CAAC;IAC5B,QAAQ,EAAE,MAAM,CAAC;IACjB,UAAU,EAAE,MAAM,GAAG,IAAI,CAAC;IAC1B,YAAY,EAAE,MAAM,GAAG,IAAI,CAAC;IAC5B,aAAa,EAAE,MAAM,GAAG,IAAI,CAAC;IAC7B,gBAAgB,EAAE,MAAM,GAAG,IAAI,CAAC;IAChC,kBAAkB,EAAE,OAAO,CAAC;IAC5B,iBAAiB,EAAE,MAAM,CAAC;IAC1B,mEAAmE;IACnE,iBAAiB,EAAE,MAAM,GAAG,IAAI,CAAC;IACjC,kBAAkB,EAAE,KAAK,CAAC;QACxB,UAAU,EAAE,MAAM,CAAC;QACnB,IAAI,EAAE,MAAM,CAAC;QACb,WAAW,EAAE,MAAM,CAAC;QACpB,QAAQ,CAAC,EAAE;YACT,SAAS,CAAC,EAAE,MAAM,CAAC;YACnB,OAAO,CAAC,EAAE,MAAM,CAAC;YACjB,KAAK,CAAC,EAAE,MAAM,CAAC;YACf,GAAG,CAAC,EAAE,MAAM,CAAC;SACd,CAAC;KACH,CAAC,CAAC;IACH,aAAa,EAAE,MAAM,GAAG,IAAI,CAAC;IAC7B,kBAAkB,EAAE,MAAM,GAAG,IAAI,CAAC;IAClC,gBAAgB,EAAE;QAChB,GAAG,EAAE,MAAM,CAAC;QACZ,UAAU,EAAE,MAAM,CAAC;KACpB,GAAG,IAAI,CAAC;IACT,2DAA2D;IAC3D,UAAU,EAAE,gBAAgB,GAAG,IAAI,CAAC;CACrC;AAoBD,MAAM,WAAW,cAAc;IAC7B,SAAS,EAAE,MAAM,CAAC;IAClB,KAAK,EAAE,MAAM,GAAG,MAAM,GAAG,OAAO,CAAC;IACjC,OAAO,EAAE,MAAM,CAAC;IAChB,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,OAAO,CAAC,EAAE,OAAO,CAAC;CACnB;AAED,MAAM,WAAW,oBAAoB;IACnC,QAAQ,EAAE,MAAM,CAAC;IACjB,GAAG,EAAE,MAAM,CAAC;IACZ,UAAU,EAAE,MAAM,CAAC;IACnB,QAAQ,EAAE,MAAM,CAAC;IACjB,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,MAAM,CAAC,EAAE,MAAM,CAAC;CACjB;AAoMD,qBAAa,UAAW,SAAQ,YAAY;IAC1C,QAAQ,CAAC,KAAK,EAAE,eAAe,CAAC;IAChC,OAAO,CAAC,QAAQ,CAAC,KAAK,CAAkB;IACxC,QAAQ,CAAC,SAAS,EAAE,eAAe,CAAC;IACpC,OAAO,CAAC,QAAQ,CAAC,OAAO,CAAmC;IAC3D,OAAO,CAAC,QAAQ,CAAC,iBAAiB,CAAsC;IACxE,OAAO,CAAC,QAAQ,CAAC,UAAU,CAAuC;IAClE,yFAAyF;IACzF,OAAO,CAAC,QAAQ,CAAC,qBAAqB,CAA6B;IACnE,OAAO,CAAC,mBAAmB,CAA+C;IAC1E,OAAO,CAAC,UAAU,CAA4B;IAC9C,OAAO,CAAC,GAAG,CAAgC;IAC3C,OAAO,CAAC,UAAU,CAAuB;IACzC,OAAO,CAAC,eAAe,CAAgB;IACvC,wFAAwF;IACxF,OAAO,CAAC,eAAe,CAAuB;IAC9C,+DAA+D;IAC/D,OAAO,CAAC,UAAU,CAAuB;gBAE7B,OAAO,EAAE,iBAAiB;IAOtC,yFAAyF;IACnF,wBAAwB,CAAC,QAAQ,EAAE,MAAM,GAAG,OAAO,CAAC;QACxD,MAAM,EAAE,OAAO,CAAC;QAChB,MAAM,CAAC,EAAE,iBAAiB,CAAC,QAAQ,CAAC,CAAC;KACtC,CAAC;YAkBY,iBAAiB;IAY/B,6EAA6E;IACvE,aAAa,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC;QAAE,QAAQ,EAAE,MAAM,CAAA;KAAE,CAAC;IAmFhE,6EAA6E;IACvE,aAAa,CAAC,QAAQ,EAAE,MAAM,GAAG,OAAO,CAAC;QAAE,QAAQ,EAAE,MAAM,CAAC;QAAC,QAAQ,EAAE,OAAO,CAAA;KAAE,CAAC;IAuCvF,OAAO;uBACU,MAAM;sBA5HgC,MAAM;;2BA6HxC,MAAM;sBAzCgC,MAAM;sBAAY,OAAO;;MA0ClF;IAEF,kFAAkF;IAC5E,WAAW,IAAI,OAAO,CAAC,cAAc,EAAE,CAAC;IAgF9C;;;OAGG;IACG,mBAAmB,CACvB,QAAQ,EAAE,MAAM,EAChB,UAAU,EAAE,OAAO,GAClB,OAAO,CAAC;QACT,QAAQ,EAAE,MAAM,CAAC;QACjB,UAAU,EAAE,gBAAgB,CAAC;QAC7B,MAAM,EAAE,OAAO,CAAC;KACjB,CAAC;IAqBF;;;OAGG;IACG,qBAAqB,CAAC,QAAQ,EAAE,MAAM,GAAG,OAAO,CAAC;QACrD,QAAQ,EAAE,MAAM,CAAC;QACjB,UAAU,EAAE,IAAI,CAAC;QACjB,MAAM,EAAE,OAAO,CAAC;KACjB,CAAC;YAkBY,sBAAsB;IAsB9B,aAAa,CAAC,QAAQ,EAAE,MAAM,EAAE,UAAU,EAAE,MAAM,GAAG,OAAO,CAAC;QACjE,QAAQ,EAAE,MAAM,CAAC;QACjB,UAAU,EAAE,MAAM,CAAC;KACpB,CAAC;IAyBF,0FAA0F;YAC5E,2BAA2B;YAW3B,0BAA0B;IAYxC,qFAAqF;YACvE,8BAA8B;IAY5C,OAAO,CAAC,aAAa;IASrB,OAAO,CAAC,aAAa;IAMrB,OAAO,CAAC,iBAAiB;IAKzB;;;OAGG;IACH,OAAO,CAAC,gBAAgB;IAQxB,OAAO,CAAC,oBAAoB;IAM5B,OAAO,CAAC,yBAAyB;IAUjC,OAAO,CAAC,0BAA0B;IAkBlC,gFAAgF;YAClE,uBAAuB;IAarC,OAAO,CAAC,mBAAmB;IAgB3B,OAAO,CAAC,uBAAuB;IAU/B,OAAO,CAAC,gBAAgB;YAoBV,+BAA+B;YAsC/B,iBAAiB;YASjB,iBAAiB;YAqCjB,kBAAkB;IAUhC,uFAAuF;IACvF,OAAO,CAAC,kBAAkB;YAoBZ,gBAAgB;YAMhB,uBAAuB;IA0CrC,MAAM,CAAC,QAAQ,EAAE,MAAM;oBAGD,CAAC,oBACT,MAAM,WACN,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAC9B,OAAO,CAAC;YAAE,MAAM,EAAE,MAAM,CAAC;YAAC,IAAI,CAAC,EAAE,CAAC,CAAC;YAAC,KAAK,CAAC,EAAE,MAAM,CAAC;YAAC,KAAK,CAAC,EAAE,MAAM,CAAA;SAAE,CAAC;;IAU5E,OAAO,CAAC,mBAAmB;IA6D3B,6EAA6E;IAC7E,OAAO,CAAC,kBAAkB;IAO1B,MAAM,CAAC,OAAO,EAAE,aAAa,GAAG,IAAI,CAAC,MAAM;YAoE7B,iBAAiB;YAgDjB,qBAAqB;YA6BrB,mBAAmB;YA8FnB,uBAAuB;IA6ErC,OAAO,CAAC,oBAAoB;YASd,yBAAyB;YAQzB,4BAA4B;YAa5B,2CAA2C;YAO3C,iCAAiC;YA6BjC,wBAAwB;YAiBxB,cAAc;IAiD5B,OAAO,CAAC,uBAAuB;IAO/B,OAAO,CAAC,mBAAmB;YAOb,yBAAyB;YAwBzB,oBAAoB;YAkDpB,yBAAyB;YAsBzB,uBAAuB;YAcvB,UAAU;YAyZV,gBAAgB;IAqG9B,OAAO,CAAC,iBAAiB;IAWzB,OAAO,CAAC,gBAAgB;CA2KzB"}
+{"version":3,"file":"tomorrowos.d.ts","sourceRoot":"","sources":["../src/tomorrowos.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,YAAY,EAAE,MAAM,QAAQ,CAAC;AAEtC,OAAO,IAAI,MAAM,MAAM,CAAC;AAaxB,OAAO,EAAE,eAAe,EAAE,KAAK,iBAAiB,EAAE,MAAM,uBAAuB,CAAC;AAChF,OAAO,KAAK,EACV,gBAAgB,EAKhB,eAAe,EAEhB,MAAM,kBAAkB,CAAC;AAkD1B,YAAY,EACV,cAAc,EACd,eAAe,EACf,kBAAkB,EAClB,aAAa,EACd,MAAM,oBAAoB,CAAC;AAE5B,MAAM,WAAW,eAAe;IAC9B,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC;CACxB;AAED,MAAM,WAAW,iBAAiB;IAChC,KAAK,EAAE,eAAe,CAAC;IACvB,6EAA6E;IAC7E,KAAK,CAAC,EAAE,eAAe,CAAC;CACzB;AAED,MAAM,WAAW,aAAa;IAC5B,IAAI,EAAE,MAAM,CAAC;IACb,IAAI,CAAC,EAAE,MAAM,CAAC;IACd;;;;;OAKG;IACH,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB;;;OAGG;IACH,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB;;;;;OAKG;IACH,UAAU,CAAC,EAAE,OAAO,CAAC;IACrB;;;OAGG;IACH,cAAc,CAAC,EAAE,MAAM,EAAE,CAAC;CAC3B;AAoED,MAAM,WAAW,cAAc;IAC7B,QAAQ,EAAE,MAAM,CAAC;IACjB,2EAA2E;IAC3E,WAAW,EAAE,MAAM,GAAG,IAAI,CAAC;IAC3B,SAAS,EAAE,OAAO,CAAC;IACnB,UAAU,EAAE,MAAM,GAAG,IAAI,CAAC;IAC1B,QAAQ,EAAE,MAAM,GAAG,IAAI,CAAC;IACxB,MAAM,EAAE,MAAM,GAAG,IAAI,CAAC;IACtB,aAAa,EAAE,MAAM,GAAG,IAAI,CAAC;IAC7B,aAAa,EAAE,MAAM,GAAG,IAAI,CAAC;IAC7B,YAAY,EAAE,MAAM,GAAG,IAAI,CAAC;IAC5B,QAAQ,EAAE,MAAM,CAAC;IACjB,UAAU,EAAE,MAAM,GAAG,IAAI,CAAC;IAC1B,YAAY,EAAE,MAAM,GAAG,IAAI,CAAC;IAC5B,aAAa,EAAE,MAAM,GAAG,IAAI,CAAC;IAC7B,gBAAgB,EAAE,MAAM,GAAG,IAAI,CAAC;IAChC,kBAAkB,EAAE,OAAO,CAAC;IAC5B,iBAAiB,EAAE,MAAM,CAAC;IAC1B,mEAAmE;IACnE,iBAAiB,EAAE,MAAM,GAAG,IAAI,CAAC;IACjC,kBAAkB,EAAE,KAAK,CAAC;QACxB,UAAU,EAAE,MAAM,CAAC;QACnB,IAAI,EAAE,MAAM,CAAC;QACb,WAAW,EAAE,MAAM,CAAC;QACpB,QAAQ,CAAC,EAAE;YACT,SAAS,CAAC,EAAE,MAAM,CAAC;YACnB,OAAO,CAAC,EAAE,MAAM,CAAC;YACjB,KAAK,CAAC,EAAE,MAAM,CAAC;YACf,GAAG,CAAC,EAAE,MAAM,CAAC;SACd,CAAC;KACH,CAAC,CAAC;IACH,aAAa,EAAE,MAAM,GAAG,IAAI,CAAC;IAC7B,kBAAkB,EAAE,MAAM,GAAG,IAAI,CAAC;IAClC,gBAAgB,EAAE;QAChB,GAAG,EAAE,MAAM,CAAC;QACZ,UAAU,EAAE,MAAM,CAAC;KACpB,GAAG,IAAI,CAAC;IACT,2DAA2D;IAC3D,UAAU,EAAE,gBAAgB,GAAG,IAAI,CAAC;CACrC;AAoBD,MAAM,WAAW,cAAc;IAC7B,SAAS,EAAE,MAAM,CAAC;IAClB,KAAK,EAAE,MAAM,GAAG,MAAM,GAAG,OAAO,CAAC;IACjC,OAAO,EAAE,MAAM,CAAC;IAChB,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,OAAO,CAAC,EAAE,OAAO,CAAC;CACnB;AAED,MAAM,WAAW,oBAAoB;IACnC,QAAQ,EAAE,MAAM,CAAC;IACjB,GAAG,EAAE,MAAM,CAAC;IACZ,UAAU,EAAE,MAAM,CAAC;IACnB,QAAQ,EAAE,MAAM,CAAC;IACjB,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,MAAM,CAAC,EAAE,MAAM,CAAC;CACjB;AAoMD,qBAAa,UAAW,SAAQ,YAAY;IAC1C,QAAQ,CAAC,KAAK,EAAE,eAAe,CAAC;IAChC,OAAO,CAAC,QAAQ,CAAC,KAAK,CAAkB;IACxC,QAAQ,CAAC,SAAS,EAAE,eAAe,CAAC;IACpC,OAAO,CAAC,QAAQ,CAAC,OAAO,CAAmC;IAC3D,OAAO,CAAC,QAAQ,CAAC,iBAAiB,CAAsC;IACxE,OAAO,CAAC,QAAQ,CAAC,UAAU,CAAuC;IAClE,yFAAyF;IACzF,OAAO,CAAC,QAAQ,CAAC,qBAAqB,CAA6B;IACnE,OAAO,CAAC,mBAAmB,CAA+C;IAC1E,OAAO,CAAC,UAAU,CAA4B;IAC9C,OAAO,CAAC,GAAG,CAAgC;IAC3C,OAAO,CAAC,UAAU,CAAuB;IACzC,OAAO,CAAC,eAAe,CAAgB;IACvC,wFAAwF;IACxF,OAAO,CAAC,eAAe,CAAuB;IAC9C,+DAA+D;IAC/D,OAAO,CAAC,UAAU,CAAuB;gBAE7B,OAAO,EAAE,iBAAiB;IAOtC,yFAAyF;IACnF,wBAAwB,CAAC,QAAQ,EAAE,MAAM,GAAG,OAAO,CAAC;QACxD,MAAM,EAAE,OAAO,CAAC;QAChB,MAAM,CAAC,EAAE,iBAAiB,CAAC,QAAQ,CAAC,CAAC;KACtC,CAAC;YAkBY,iBAAiB;IAY/B,6EAA6E;IACvE,aAAa,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC;QAAE,QAAQ,EAAE,MAAM,CAAA;KAAE,CAAC;IAmFhE,6EAA6E;IACvE,aAAa,CAAC,QAAQ,EAAE,MAAM,GAAG,OAAO,CAAC;QAAE,QAAQ,EAAE,MAAM,CAAC;QAAC,QAAQ,EAAE,OAAO,CAAA;KAAE,CAAC;IAuCvF,OAAO;uBACU,MAAM;sBA5HgC,MAAM;;2BA6HxC,MAAM;sBAzCgC,MAAM;sBAAY,OAAO;;MA0ClF;IAEF,kFAAkF;IAC5E,WAAW,IAAI,OAAO,CAAC,cAAc,EAAE,CAAC;IAgF9C;;;OAGG;IACG,mBAAmB,CACvB,QAAQ,EAAE,MAAM,EAChB,UAAU,EAAE,OAAO,GAClB,OAAO,CAAC;QACT,QAAQ,EAAE,MAAM,CAAC;QACjB,UAAU,EAAE,gBAAgB,CAAC;QAC7B,MAAM,EAAE,OAAO,CAAC;KACjB,CAAC;IAqBF;;;OAGG;IACG,qBAAqB,CAAC,QAAQ,EAAE,MAAM,GAAG,OAAO,CAAC;QACrD,QAAQ,EAAE,MAAM,CAAC;QACjB,UAAU,EAAE,IAAI,CAAC;QACjB,MAAM,EAAE,OAAO,CAAC;KACjB,CAAC;YAkBY,sBAAsB;IAsB9B,aAAa,CAAC,QAAQ,EAAE,MAAM,EAAE,UAAU,EAAE,MAAM,GAAG,OAAO,CAAC;QACjE,QAAQ,EAAE,MAAM,CAAC;QACjB,UAAU,EAAE,MAAM,CAAC;KACpB,CAAC;IAyBF,0FAA0F;YAC5E,2BAA2B;YAW3B,0BAA0B;IAYxC,qFAAqF;YACvE,8BAA8B;IAY5C,OAAO,CAAC,aAAa;IASrB,OAAO,CAAC,aAAa;IAMrB,OAAO,CAAC,iBAAiB;IAKzB;;;OAGG;IACH,OAAO,CAAC,gBAAgB;IAQxB,OAAO,CAAC,oBAAoB;IAM5B,OAAO,CAAC,yBAAyB;IAUjC,OAAO,CAAC,0BAA0B;IAkBlC,gFAAgF;YAClE,uBAAuB;IAarC,OAAO,CAAC,mBAAmB;IAgB3B,OAAO,CAAC,uBAAuB;IAU/B,OAAO,CAAC,gBAAgB;YAoBV,+BAA+B;YAsC/B,iBAAiB;YASjB,iBAAiB;YAqCjB,kBAAkB;IAUhC,uFAAuF;IACvF,OAAO,CAAC,kBAAkB;YAoBZ,gBAAgB;YAMhB,uBAAuB;IA0CrC,MAAM,CAAC,QAAQ,EAAE,MAAM;oBAGD,CAAC,oBACT,MAAM,WACN,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAC9B,OAAO,CAAC;YAAE,MAAM,EAAE,MAAM,CAAC;YAAC,IAAI,CAAC,EAAE,CAAC,CAAC;YAAC,KAAK,CAAC,EAAE,MAAM,CAAC;YAAC,KAAK,CAAC,EAAE,MAAM,CAAA;SAAE,CAAC;;IAU5E,OAAO,CAAC,mBAAmB;IA6D3B,6EAA6E;IAC7E,OAAO,CAAC,kBAAkB;IAO1B,MAAM,CAAC,OAAO,EAAE,aAAa,GAAG,IAAI,CAAC,MAAM;YAqE7B,iBAAiB;YAgEjB,qBAAqB;YA6BrB,mBAAmB;YA8FnB,qBAAqB;YAmCrB,sBAAsB;YAoCtB,yBAAyB;YAwDzB,yBAAyB;YA+CzB,uBAAuB;IA6ErC,OAAO,CAAC,oBAAoB;YASd,yBAAyB;YAQzB,4BAA4B;YAa5B,2CAA2C;YAO3C,iCAAiC;YA6BjC,wBAAwB;YAiBxB,cAAc;IA8E5B,OAAO,CAAC,uBAAuB;IAO/B,OAAO,CAAC,mBAAmB;YAOb,yBAAyB;YAwBzB,oBAAoB;YAkDpB,yBAAyB;YAsBzB,uBAAuB;YAcvB,UAAU;YAwaV,gBAAgB;IAqG9B,OAAO,CAAC,iBAAiB;IAWzB,OAAO,CAAC,gBAAgB;CA2KzB"}

package/dist/tomorrowos.js

@@ -3,6 +3,7 @@ import { EventEmitter } from "events";
 import fs from "fs/promises";
 import http from "http";
 import path from "path";
+import { fileURLToPath } from "url";
 import { WebSocket, WebSocketServer } from "ws";
 import { generateDeterministicPairingCode, generateRandomPairingCode, isValidPairingCodeFormat, normalizePairingCode, resolvePairingCodeSecret } from "./pairing-code.js";
 import { PlaylistCatalog } from "./playlist-catalog.js";
@@ -10,13 +11,22 @@ import { MemoryStore } from "./store/memory-store.js";
 import { resolveBrandLogoPath, syncProjectAssetsToStaticRoot } from "./brand-assets.js";
 import { createSignedUploadParams, deleteCloudinaryAsset, fetchCloudinaryResource, resolveCloudinaryConfig, uploadBufferToCloudinary } from "./cloudinary-storage.js";
 import { probeVideoDurationMs } from "./media-probe.js";
+import { assembleChunkedUpload, cleanupChunkedUpload, cleanupStaleChunkedUploads, initChunkedUpload, MEDIA_UPLOAD_CHUNK_BYTES, storeChunkedUploadPart } from "./chunked-upload.js";
 import { buildBrightSignZipWithCmsEndpoint, resolveRequestCmsOrigin } from "./player-zip.js";
-import { contentHashHex, storeUploadIfNeeded } from "./upload-storage.js";
+import { buildContentAddressedNameFromHash, contentHashHex, storeUploadIfNeeded } from "./upload-storage.js";
 import { detectPrimaryLanIpv4 } from "./lan-address.js";
 import { buildServerStatus } from "./server-status.js";
 /** Mark offline if no device.ping within this window (power-loss / half-open TCP). */
 const DEVICE_HEARTBEAT_TIMEOUT_MS = 30_000;
 const DEVICE_HEARTBEAT_SWEEP_MS = 10_000;
+function sdkPackageRoot() {
+    return path.resolve(path.dirname(fileURLToPath(import.meta.url)), "..");
+}
+/** Project methods.js without chunked upload still hits host 413 on large files. */
+function methodsJsSupportsChunkedUpload(source) {
+    return (source.includes("uploadViaChunkedProxy") &&
+        source.includes("/media/upload-init"));
+}
 function normalizeDevicePlatform(platform, system) {
     const explicit = typeof platform === "string" ? platform.trim().toLowerCase() : "";
     if (explicit)
@@ -886,6 +896,7 @@ export class TomorrowOS extends EventEmitter {
             this.staticIndexFile = idx;
             const uploadsDir = path.join(path.resolve(this.staticRoot), "uploads");
             void fs.mkdir(uploadsDir, { recursive: true });
+            void cleanupStaleChunkedUploads(this.staticRoot).catch(() => undefined);
             void this.refreshResolvedBrandLogo();
         }
         else {
@@ -940,6 +951,18 @@ export class TomorrowOS extends EventEmitter {
             return;
         }
         try {
+            const declaredLength = Number(req.headers["content-length"]);
+            if (Number.isFinite(declaredLength) &&
+                declaredLength > MEDIA_UPLOAD_CHUNK_BYTES) {
+                // Avoid buffering a huge body that many hosts (e.g. Replit) reject with 413.
+                req.resume();
+                sendJson(res, 413, {
+                    status: "failed",
+                    code: "USE_CHUNKED",
+                    error: "File too large for single-request upload. Soft-refresh the Control Panel (SDK serves chunked methods.js) or copy templates/.../methods.js, then retry."
+                });
+                return;
+            }
             const body = await readRawBody(req, MAX_MEDIA_UPLOAD_BYTES);
             if (body.length === 0) {
                 sendJson(res, 400, { status: "failed", error: "Empty upload body" });
@@ -1065,6 +1088,141 @@ export class TomorrowOS extends EventEmitter {
             sendJson(res, 400, { status: "failed", error: msg });
         }
     }
+    async handleMediaUploadInit(req, res) {
+        if (!this.staticRoot) {
+            sendJson(res, 400, { status: "failed", error: "staticRoot is not configured" });
+            return;
+        }
+        try {
+            const body = (await readJsonBody(req));
+            const safeName = sanitizeUploadFilename(body.filename || "upload");
+            const mimeType = typeof body.mimeType === "string" ? body.mimeType : undefined;
+            const meta = await initChunkedUpload(this.staticRoot, {
+                filename: safeName,
+                size: Number(body.size),
+                mimeType
+            });
+            sendJson(res, 200, {
+                status: "success",
+                mode: "chunked",
+                uploadId: meta.uploadId,
+                chunkSize: meta.chunkSize,
+                totalChunks: meta.totalChunks
+            });
+        }
+        catch (e) {
+            const msg = e instanceof Error ? e.message : "Upload init failed";
+            sendJson(res, 400, { status: "failed", error: msg });
+        }
+    }
+    async handleMediaUploadChunk(req, res, url) {
+        if (!this.staticRoot) {
+            sendJson(res, 400, { status: "failed", error: "staticRoot is not configured" });
+            return;
+        }
+        try {
+            const uploadId = String(url.searchParams.get("uploadId") || "").trim();
+            const index = Number(url.searchParams.get("index"));
+            const body = await readRawBody(req, MEDIA_UPLOAD_CHUNK_BYTES + 64 * 1024);
+            if (body.length === 0) {
+                sendJson(res, 400, { status: "failed", error: "Empty chunk body" });
+                return;
+            }
+            const meta = await storeChunkedUploadPart(this.staticRoot, uploadId, index, body);
+            sendJson(res, 200, {
+                status: "success",
+                uploadId: meta.uploadId,
+                index,
+                received: meta.received.length,
+                totalChunks: meta.totalChunks
+            });
+        }
+        catch (e) {
+            const msg = e instanceof Error ? e.message : "Chunk upload failed";
+            sendJson(res, 400, { status: "failed", error: msg });
+        }
+    }
+    async handleMediaUploadComplete(req, res) {
+        if (!this.staticRoot) {
+            sendJson(res, 400, { status: "failed", error: "staticRoot is not configured" });
+            return;
+        }
+        let uploadId = "";
+        try {
+            const body = (await readJsonBody(req));
+            uploadId = String(body.uploadId || "").trim();
+            const assembled = await assembleChunkedUpload(this.staticRoot, uploadId);
+            const safeName = sanitizeUploadFilename(assembled.meta.filename);
+            const mimeType = assembled.meta.mimeType;
+            const { asset, deduplicated } = await this.storeLocalAssembledUpload(assembled.filePath, assembled.sha256, assembled.bytes, safeName, mimeType);
+            let durationMs = null;
+            if (assembled.bytes <= 64 * 1024 * 1024) {
+                try {
+                    const probeBuf = await fs.readFile(assembled.filePath);
+                    durationMs = probeVideoDurationMs(probeBuf, safeName);
+                }
+                catch {
+                    durationMs = null;
+                }
+            }
+            const payload = {
+                status: "success",
+                url: asset.url,
+                assetId: asset.id,
+                filename: isRemoteUploadedAssetUrl(asset.url) ? safeName : asset.storageKey,
+                size: asset.bytes ?? assembled.bytes,
+                contentHash: asset.sha256,
+                deduplicated
+            };
+            if (durationMs != null)
+                payload.durationMs = durationMs;
+            sendJson(res, 200, payload);
+        }
+        catch (e) {
+            const msg = e instanceof Error ? e.message : "Upload complete failed";
+            sendJson(res, 400, { status: "failed", error: msg });
+        }
+        finally {
+            if (uploadId && this.staticRoot) {
+                void cleanupChunkedUpload(this.staticRoot, uploadId).catch(() => undefined);
+            }
+        }
+    }
+    async storeLocalAssembledUpload(assembledPath, sha256, bytes, safeName, mimeType) {
+        const existing = await this.store.getUploadedAssetBySha256(sha256);
+        if (existing && !isRemoteUploadedAssetUrl(existing.url)) {
+            const existingLocalPath = path.join(path.resolve(this.staticRoot || "."), "uploads", existing.storageKey);
+            try {
+                const stat = await fs.stat(existingLocalPath);
+                if (stat.size === bytes) {
+                    return { asset: existing, deduplicated: true };
+                }
+            }
+            catch {
+                // rewrite below
+            }
+        }
+        const uploadsDir = path.join(path.resolve(this.staticRoot || "."), "uploads");
+        await fs.mkdir(uploadsDir, { recursive: true });
+        const storedName = buildContentAddressedNameFromHash(sha256, safeName);
+        const destPath = path.join(uploadsDir, storedName);
+        await fs.copyFile(assembledPath, destPath);
+        const now = new Date().toISOString();
+        const asset = {
+            id: existing?.id ?? randomUUID(),
+            sha256,
+            storageKey: storedName,
+            url: `/uploads/${storedName}`,
+            originalFilename: safeName,
+            mimeType,
+            resourceType: inferResourceType(mimeType, safeName),
+            bytes,
+            createdAt: existing?.createdAt ?? now,
+            updatedAt: now
+        };
+        await this.store.setUploadedAsset(asset);
+        return { asset, deduplicated: false };
+    }
     async storeUploadedMediaAsset(body, safeName, mimeType) {
         const sha256 = contentHashHex(body);
         const cloudinaryConfig = resolveCloudinaryConfig();
@@ -1213,8 +1371,26 @@ export class TomorrowOS extends EventEmitter {
         if (relativeToRoot.startsWith("..") || path.isAbsolute(relativeToRoot)) {
             return false;
         }
+        const relPosix = relativeToRoot.split(path.sep).join("/");
+        if (relPosix === ".upload-tmp" || relPosix.startsWith(".upload-tmp/")) {
+            return false;
+        }
         try {
-            const buf = await fs.readFile(filePath);
+            let buf = await fs.readFile(filePath);
+            const baseName = path.basename(rel).toLowerCase();
+            if (baseName === "methods.js") {
+                const text = buf.toString("utf8");
+                if (!methodsJsSupportsChunkedUpload(text)) {
+                    const fallback = path.join(sdkPackageRoot(), "templates", "cms-starter", "public", "methods.js");
+                    try {
+                        buf = await fs.readFile(fallback);
+                        console.warn("[TomorrowOS] serving SDK methods.js with chunked uploads (project methods.js is outdated)");
+                    }
+                    catch {
+                        // keep project file
+                    }
+                }
+            }
             const ext = path.extname(rel).toLowerCase();
             const types = {
                 ".html": "text/html; charset=utf-8",
@@ -1229,7 +1405,11 @@ export class TomorrowOS extends EventEmitter {
                 ".gif": "image/gif"
             };
             const ctype = types[ext] ?? "application/octet-stream";
-            res.writeHead(200, { "Content-Type": ctype });
+            const headers = { "Content-Type": ctype };
+            if (baseName === "methods.js") {
+                headers["Cache-Control"] = "no-store";
+            }
+            res.writeHead(200, headers);
             res.end(buf);
             return true;
         }
@@ -1373,6 +1553,18 @@ export class TomorrowOS extends EventEmitter {
                 await this.handleMediaRegister(req, res);
                 return;
             }
+            if (req.method === "POST" && pathname === "/media/upload-init") {
+                await this.handleMediaUploadInit(req, res);
+                return;
+            }
+            if (req.method === "POST" && pathname === "/media/upload-chunk") {
+                await this.handleMediaUploadChunk(req, res, url);
+                return;
+            }
+            if (req.method === "POST" && pathname === "/media/upload-complete") {
+                await this.handleMediaUploadComplete(req, res);
+                return;
+            }
             if (req.method === "GET" && pathname === "/players/brightsign.zip") {
                 try {
                     const cmsOrigin = resolveRequestCmsOrigin(req);

package/dist/upload-storage.d.ts

@@ -1,5 +1,6 @@
 /** Stable on-disk name: first 16 chars of SHA-256 + original safe filename. */
 export declare function buildContentAddressedName(body: Buffer, safeName: string): string;
+export declare function buildContentAddressedNameFromHash(sha256Hex: string, safeName: string): string;
 export declare function contentHashHex(body: Buffer): string;
 /**
  * Write upload once per unique file bytes; reuse existing file when present.

package/dist/upload-storage.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"upload-storage.d.ts","sourceRoot":"","sources":["../src/upload-storage.ts"],"names":[],"mappings":"AAIA,+EAA+E;AAC/E,wBAAgB,yBAAyB,CAAC,IAAI,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,GAAG,MAAM,CAGhF;AAED,wBAAgB,cAAc,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,CAEnD;AAED;;GAEG;AACH,wBAAsB,mBAAmB,CACvC,UAAU,EAAE,MAAM,EAClB,IAAI,EAAE,MAAM,EACZ,QAAQ,EAAE,MAAM,GACf,OAAO,CAAC;IAAE,UAAU,EAAE,MAAM,CAAC;IAAC,YAAY,EAAE,OAAO,CAAC;IAAC,WAAW,EAAE,MAAM,CAAA;CAAE,CAAC,CAgB7E"}
+{"version":3,"file":"upload-storage.d.ts","sourceRoot":"","sources":["../src/upload-storage.ts"],"names":[],"mappings":"AAIA,+EAA+E;AAC/E,wBAAgB,yBAAyB,CAAC,IAAI,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,GAAG,MAAM,CAGhF;AAED,wBAAgB,iCAAiC,CAC/C,SAAS,EAAE,MAAM,EACjB,QAAQ,EAAE,MAAM,GACf,MAAM,CAER;AAED,wBAAgB,cAAc,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,CAEnD;AAED;;GAEG;AACH,wBAAsB,mBAAmB,CACvC,UAAU,EAAE,MAAM,EAClB,IAAI,EAAE,MAAM,EACZ,QAAQ,EAAE,MAAM,GACf,OAAO,CAAC;IAAE,UAAU,EAAE,MAAM,CAAC;IAAC,YAAY,EAAE,OAAO,CAAC;IAAC,WAAW,EAAE,MAAM,CAAA;CAAE,CAAC,CAgB7E"}

package/dist/upload-storage.js

@@ -4,7 +4,10 @@ import path from "path";
 /** Stable on-disk name: first 16 chars of SHA-256 + original safe filename. */
 export function buildContentAddressedName(body, safeName) {
     const hash = createHash("sha256").update(body).digest("hex");
-    return `${hash.slice(0, 16)}-${safeName}`;
+    return buildContentAddressedNameFromHash(hash, safeName);
+}
+export function buildContentAddressedNameFromHash(sha256Hex, safeName) {
+    return `${String(sha256Hex).slice(0, 16)}-${safeName}`;
 }
 export function contentHashHex(body) {
     return createHash("sha256").update(body).digest("hex");

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@tomorrowos/sdk",
-  "version": "0.9.56",
+  "version": "0.9.58",
   "description": "TomorrowOS CMS server SDK - WebSocket transport, pairing, device commands, optional static CMS UI. Includes CLI (tomorrowos init / build) and starter templates.",
   "type": "module",
   "main": "./dist/index.js",

package/templates/cms-starter/package.json

@@ -1,6 +1,6 @@
 {
   "name": "my-cms",
-  "version": "0.9.56",
+  "version": "0.9.58",
   "description": "CMS server on @tomorrowos/sdk. Add your UI (React, static files, etc.) alongside this server.",
   "private": true,
   "type": "module",
@@ -13,7 +13,7 @@
     "build-player": "tomorrowos build --platform tizen"
   },
   "dependencies": {
-    "@tomorrowos/sdk": "^0.9.56",
+    "@tomorrowos/sdk": "^0.9.58",
     "dotenv": "^17.2.3",
     "tsx": "^4.19.0"
   },

package/templates/cms-starter/public/methods.js

@@ -47,6 +47,9 @@ const UPLOAD_TIMEOUT_MS = 120000;
 const CLOUDINARY_DIRECT_TIMEOUT_MS = 0;
 /** Cloudinary chunked upload minimum is 5MB; use 8MB chunks. */
 const CLOUDINARY_CHUNK_BYTES = 8 * 1024 * 1024;
+/** Single-request proxy uploads stay small; larger files use /media/upload-chunk. */
+const PROXY_SINGLE_MAX_BYTES = 2 * 1024 * 1024;
+const CHUNKED_PROXY_TIMEOUT_MS = 0;
 
 /**
  * Apply brand.json to the Control Panel (name + colours). No logo on the panel.
@@ -1811,6 +1814,108 @@ async function uploadViaCloudinaryDirect(file, onProgress) {
   return registerCloudinaryUpload(file, cloudinaryResult);
 }
 
+function xhrSendBinary(url, body, { timeoutMs, onProgress, contentType }) {
+  return new Promise((resolve, reject) => {
+    const xhr = new XMLHttpRequest();
+    xhr.open("POST", url, true);
+    xhr.timeout = timeoutMs;
+    if (contentType) xhr.setRequestHeader("Content-Type", contentType);
+    xhr.upload.onprogress = (event) => {
+      if (!event.lengthComputable) return;
+      if (typeof onProgress === "function") onProgress(event.loaded, event.total);
+    };
+    xhr.onerror = () => reject(new Error("Network error on chunked upload"));
+    xhr.ontimeout = () => reject(new Error("Chunked upload timed out"));
+    xhr.onload = () => {
+      let payload = {};
+      try {
+        payload = xhr.responseText ? JSON.parse(xhr.responseText) : {};
+      } catch {
+        payload = {};
+      }
+      if (xhr.status >= 200 && xhr.status < 300 && payload.status !== "failed") {
+        resolve(payload);
+        return;
+      }
+      reject(new Error(payload.error || `Upload failed (${xhr.status})`));
+    };
+    xhr.send(body);
+  });
+}
+
+async function uploadViaChunkedProxy(file, onProgress) {
+  const initRes = await fetch("/media/upload-init", {
+    method: "POST",
+    headers: { "Content-Type": "application/json" },
+    body: JSON.stringify({
+      filename: file.name,
+      size: file.size,
+      mimeType: file.type || undefined
+    })
+  });
+  let initPayload = {};
+  try {
+    initPayload = await initRes.json();
+  } catch {
+    initPayload = {};
+  }
+  if (!initRes.ok || initPayload.status === "failed" || !initPayload.uploadId) {
+    throw new Error(initPayload.error || `Upload init failed (${initRes.status})`);
+  }
+
+  const uploadId = String(initPayload.uploadId);
+  const chunkSize = Number(initPayload.chunkSize) || 4 * 1024 * 1024;
+  const totalChunks =
+    Number(initPayload.totalChunks) || Math.ceil(file.size / chunkSize);
+  let uploadedBytes = 0;
+
+  for (let index = 0; index < totalChunks; index += 1) {
+    const start = index * chunkSize;
+    const end = Math.min(start + chunkSize, file.size);
+    const chunk = file.slice(start, end);
+    const q = new URLSearchParams({
+      uploadId,
+      index: String(index)
+    });
+    await xhrSendBinary(`/media/upload-chunk?${q.toString()}`, chunk, {
+      timeoutMs: CHUNKED_PROXY_TIMEOUT_MS,
+      contentType: "application/octet-stream",
+      onProgress: (loaded) => {
+        if (typeof onProgress !== "function") return;
+        const overall = Math.min(file.size, uploadedBytes + loaded);
+        onProgress(Math.round((overall / file.size) * 100));
+      }
+    });
+    uploadedBytes = end;
+    if (typeof onProgress === "function") {
+      onProgress(Math.round((uploadedBytes / file.size) * 100));
+    }
+  }
+
+  const completeRes = await fetch("/media/upload-complete", {
+    method: "POST",
+    headers: { "Content-Type": "application/json" },
+    body: JSON.stringify({ uploadId })
+  });
+  let completePayload = {};
+  try {
+    completePayload = await completeRes.json();
+  } catch {
+    completePayload = {};
+  }
+  if (
+    !completeRes.ok ||
+    completePayload.status === "failed" ||
+    !completePayload.assetId
+  ) {
+    throw new Error(
+      completePayload.error || `Upload complete failed (${completeRes.status})`
+    );
+  }
+  if (typeof onProgress === "function") onProgress(100);
+  return completePayload;
+}
+
 async function uploadFile(file, onProgress) {
   try {
     const direct = await uploadViaCloudinaryDirect(file, onProgress);
@@ -1823,21 +1928,8 @@ async function uploadFile(file, onProgress) {
     }
   }
 
-  let lastErr = null;
-  for (let attempt = 1; attempt <= UPLOAD_MAX_RETRIES; attempt += 1) {
-    try {
-      const payload = await uploadFileWithProgress(file, { onProgress, attempt });
-      return payload;
-    } catch (err) {
-      lastErr = err;
-      const msg = err?.message || String(err);
-      // 413 from host proxy will not succeed on retry — fail fast.
-      if (/Upload failed \(413\)/i.test(msg)) break;
-      if (attempt >= UPLOAD_MAX_RETRIES) break;
-      await new Promise((resolve) => setTimeout(resolve, 500 * attempt));
-    }
-  }
-  throw lastErr || new Error("Upload failed");
+  // Always chunk through the CMS for Object Storage / local — avoids Replit 413.
+  return uploadViaChunkedProxy(file, onProgress);
 }
 
 async function addAssetFromFile(file, queueIndex, queueTotal) {

package/templates/cms-starter-v0/cms-panel/methods.js

@@ -47,6 +47,9 @@ const UPLOAD_TIMEOUT_MS = 120000;
 const CLOUDINARY_DIRECT_TIMEOUT_MS = 0;
 /** Cloudinary chunked upload minimum is 5MB; use 8MB chunks. */
 const CLOUDINARY_CHUNK_BYTES = 8 * 1024 * 1024;
+/** Single-request proxy uploads stay small; larger files use /media/upload-chunk. */
+const PROXY_SINGLE_MAX_BYTES = 2 * 1024 * 1024;
+const CHUNKED_PROXY_TIMEOUT_MS = 0;
 
 /**
  * Apply brand.json to the Control Panel (name + colours). No logo on the panel.
@@ -60,10 +63,9 @@ async function applyBrandFromServer() {
     if (!brand || typeof brand !== "object") return;
 
     const name = String(brand.name || "").trim() || "TomorrowOS";
-    const panelTitle = `${name} Control Panel`;
-    document.title = panelTitle;
+    document.title = name;
     const heading = document.querySelector(".app-header h1");
-    if (heading) heading.textContent = panelTitle;
+    if (heading) heading.textContent = name;
 
     const tagline = String(brand.tagline || "").trim();
     const subtitle = document.querySelector(".app-header p");
@@ -1760,6 +1762,7 @@ async function uploadToCloudinaryDirect(file, sign, onProgress) {
     const chunk = file.slice(offset, end);
     const form = buildCloudinaryFormData(chunk, sign);
     const chunkBase = offset;
+    // eslint-disable-next-line no-await-in-loop
     finalResult = await xhrSendForm(uploadUrl, form, {
       timeoutMs: CLOUDINARY_DIRECT_TIMEOUT_MS,
       headers: {
@@ -1811,31 +1814,122 @@ async function uploadViaCloudinaryDirect(file, onProgress) {
   return registerCloudinaryUpload(file, cloudinaryResult);
 }
 
+function xhrSendBinary(url, body, { timeoutMs, onProgress, contentType }) {
+  return new Promise((resolve, reject) => {
+    const xhr = new XMLHttpRequest();
+    xhr.open("POST", url, true);
+    xhr.timeout = timeoutMs;
+    if (contentType) xhr.setRequestHeader("Content-Type", contentType);
+    xhr.upload.onprogress = (event) => {
+      if (!event.lengthComputable) return;
+      if (typeof onProgress === "function") onProgress(event.loaded, event.total);
+    };
+    xhr.onerror = () => reject(new Error("Network error on chunked upload"));
+    xhr.ontimeout = () => reject(new Error("Chunked upload timed out"));
+    xhr.onload = () => {
+      let payload = {};
+      try {
+        payload = xhr.responseText ? JSON.parse(xhr.responseText) : {};
+      } catch {
+        payload = {};
+      }
+      if (xhr.status >= 200 && xhr.status < 300 && payload.status !== "failed") {
+        resolve(payload);
+        return;
+      }
+      reject(new Error(payload.error || `Upload failed (${xhr.status})`));
+    };
+    xhr.send(body);
+  });
+}
+
+async function uploadViaChunkedProxy(file, onProgress) {
+  const initRes = await fetch("/media/upload-init", {
+    method: "POST",
+    headers: { "Content-Type": "application/json" },
+    body: JSON.stringify({
+      filename: file.name,
+      size: file.size,
+      mimeType: file.type || undefined
+    })
+  });
+  let initPayload = {};
+  try {
+    initPayload = await initRes.json();
+  } catch {
+    initPayload = {};
+  }
+  if (!initRes.ok || initPayload.status === "failed" || !initPayload.uploadId) {
+    throw new Error(initPayload.error || `Upload init failed (${initRes.status})`);
+  }
+
+  const uploadId = String(initPayload.uploadId);
+  const chunkSize = Number(initPayload.chunkSize) || 4 * 1024 * 1024;
+  const totalChunks =
+    Number(initPayload.totalChunks) || Math.ceil(file.size / chunkSize);
+  let uploadedBytes = 0;
+
+  for (let index = 0; index < totalChunks; index += 1) {
+    const start = index * chunkSize;
+    const end = Math.min(start + chunkSize, file.size);
+    const chunk = file.slice(start, end);
+    const q = new URLSearchParams({
+      uploadId,
+      index: String(index)
+    });
+    await xhrSendBinary(`/media/upload-chunk?${q.toString()}`, chunk, {
+      timeoutMs: CHUNKED_PROXY_TIMEOUT_MS,
+      contentType: "application/octet-stream",
+      onProgress: (loaded) => {
+        if (typeof onProgress !== "function") return;
+        const overall = Math.min(file.size, uploadedBytes + loaded);
+        onProgress(Math.round((overall / file.size) * 100));
+      }
+    });
+    uploadedBytes = end;
+    if (typeof onProgress === "function") {
+      onProgress(Math.round((uploadedBytes / file.size) * 100));
+    }
+  }
+
+  const completeRes = await fetch("/media/upload-complete", {
+    method: "POST",
+    headers: { "Content-Type": "application/json" },
+    body: JSON.stringify({ uploadId })
+  });
+  let completePayload = {};
+  try {
+    completePayload = await completeRes.json();
+  } catch {
+    completePayload = {};
+  }
+  if (
+    !completeRes.ok ||
+    completePayload.status === "failed" ||
+    !completePayload.assetId
+  ) {
+    throw new Error(
+      completePayload.error || `Upload complete failed (${completeRes.status})`
+    );
+  }
+  if (typeof onProgress === "function") onProgress(100);
+  return completePayload;
+}
+
 async function uploadFile(file, onProgress) {
   try {
     const direct = await uploadViaCloudinaryDirect(file, onProgress);
     if (direct) return direct;
   } catch (err) {
     const msg = err?.message || String(err);
+    // Fall back to proxy upload only when Cloudinary is unavailable.
     if (!/not configured|Upload sign failed \(404\)/i.test(msg)) {
       throw err;
     }
   }
 
-  let lastErr = null;
-  for (let attempt = 1; attempt <= UPLOAD_MAX_RETRIES; attempt += 1) {
-    try {
-      const payload = await uploadFileWithProgress(file, { onProgress, attempt });
-      return payload;
-    } catch (err) {
-      lastErr = err;
-      const msg = err?.message || String(err);
-      if (/Upload failed \(413\)/i.test(msg)) break;
-      if (attempt >= UPLOAD_MAX_RETRIES) break;
-      await new Promise((resolve) => setTimeout(resolve, 500 * attempt));
-    }
-  }
-  throw lastErr || new Error("Upload failed");
+  // Always chunk through the CMS for Object Storage / local — avoids Replit 413.
+  return uploadViaChunkedProxy(file, onProgress);
 }
 
 async function addAssetFromFile(file, queueIndex, queueTotal) {

package/templates/cms-starter-v0/package.json

@@ -1,6 +1,6 @@
 {
   "name": "my-cms",
-  "version": "0.9.56",
+  "version": "0.9.58",
   "description": "TomorrowOS CMS for Vercel / v0 Publish (Fluid Function + WebSockets + optional Next Preview).",
   "private": true,
   "type": "module",
@@ -17,7 +17,7 @@
     "build-player": "tomorrowos build --platform tizen"
   },
   "dependencies": {
-    "@tomorrowos/sdk": "^0.9.56",
+    "@tomorrowos/sdk": "^0.9.58",
     "dotenv": "^17.2.3",
     "tsx": "^4.19.0"
   },