includio-cms 0.13.1 → 0.13.2

package/CHANGELOG.md

@@ -3,6 +3,24 @@
 All notable changes to includio-cms are documented here.
 Generated from `src/lib/updates/` — do not edit manually.
 
+## 0.13.2 — 2026-03-20
+
+Upload limits, stable reordering, relation filters, image style optimization
+
+### Added
+- Configurable upload size limit via BODY_SIZE_LIMIT env var (supports K/M/G suffixes, default 50M)
+- File upload pre-validation — rejects oversized files before upload with localized error messages
+- Stable slot reordering — preserves positions of filtered-out entries during DnD reorder
+- Collection relation field filtering — filter entries by relation field values
+- Expose _sortOrder on entries for orderable collections
+- Codegen: _sortOrder field in generated TypeScript interfaces for orderable collections
+- getImageStyleIfExists — non-blocking image style lookup (returns null if missing)
+
+### Fixed
+- Concurrent image style generation with buffer reuse — download original once, generate styles in parallel (limit 3)
+- Image style resolution gracefully skips missing styles instead of blocking
+- Upload endpoints use configurable size limit instead of hardcoded 50MB
+
 ## 0.13.1 — 2026-03-20
 
 Admin UI i18n, codegen cleanup, docs rewrite

package/ROADMAP.md

@@ -219,6 +219,16 @@
 - [x] `[fix]` `[P2]` Layout type: remove unused label property <!-- files: src/lib/types/layout.ts -->
 - [x] `[chore]` `[P1]` Documentation rewrite — new pages for blocks, content, media-field, layout; expanded API, auth, entries, forms, plugins docs
 
+## 0.13.2 — Upload limits, stable reordering, image style optimization
+
+- [x] `[feature]` `[P1]` Configurable upload size limit — `BODY_SIZE_LIMIT` env var, pre-validation in UI <!-- files: src/lib/core/server/media/uploadLimit.ts, src/lib/admin/api/upload-limit.ts, src/lib/admin/components/media/file-upload.svelte -->
+- [x] `[feature]` `[P1]` Stable slot reordering — preserve filtered-out entry positions during DnD <!-- files: src/lib/admin/remote/reorder.ts, src/lib/admin/remote/entry.remote.ts -->
+- [x] `[feature]` `[P1]` Collection relation field filtering — filter entries by relation values <!-- files: src/lib/admin/client/collection/collection-entries.svelte -->
+- [x] `[feature]` `[P2]` Expose `_sortOrder` on entries + codegen for orderable collections <!-- files: src/lib/core/server/entries/operations/get.ts, src/lib/core/server/generator/generator.ts, src/lib/types/entries.ts -->
+- [x] `[feature]` `[P2]` `getImageStyleIfExists` — non-blocking image style lookup <!-- files: src/lib/core/server/media/styles/operations/getImageStyle.ts -->
+- [x] `[fix]` `[P1]` Concurrent image style generation with buffer reuse (download once, parallel limit 3) <!-- files: src/lib/core/server/media/styles/operations/generateDefaultStyles.ts, src/lib/core/server/media/styles/sharp/generateImageStyle.ts -->
+- [x] `[fix]` `[P1]` Image style resolution gracefully skips missing styles <!-- files: src/lib/core/server/fields/utils/imageStyles.ts -->
+
 ## 0.14.0 — SEO module
 
 - [ ] `[feature]` `[P1]` SERP preview + character limits for title/description <!-- files: src/lib/admin/components/fields/seo-field.svelte -->

package/dist/admin/api/handler.js

@@ -6,6 +6,7 @@ import * as inviteHandlers from './invite.js';
 import * as acceptInviteHandlers from './accept-invite.js';
 import * as mediaGcHandlers from './media-gc.js';
 import * as generateStylesHandlers from './generate-styles.js';
+import * as uploadLimitHandlers from './upload-limit.js';
 import { requireAuth } from '../remote/middleware/auth.js';
 import { getCMS } from '../../core/cms.js';
 import { lookup } from 'mrmime';
@@ -18,6 +19,7 @@ export function createAdminApiHandler(options) {
         'accept-invite': acceptInviteHandlers,
         'media-gc': mediaGcHandlers,
         'generate-styles': generateStylesHandlers,
+        'upload-limit': uploadLimitHandlers,
         ...options?.extraRoutes
     };
     const privateMediaGet = async (event) => {

package/dist/admin/api/replace.js

@@ -1,7 +1,8 @@
 import { requireAuth } from '../remote/middleware/auth.js';
 import { replaceFile } from '../../core/server/media/operations/replaceFile.js';
 import { json } from '@sveltejs/kit';
-const MAX_UPLOAD_SIZE = 50 * 1024 * 1024; // 50MB
+import { getMaxUploadSize } from '../../core/server/media/uploadLimit.js';
+const MAX_UPLOAD_SIZE = getMaxUploadSize();
 export const POST = async ({ request }) => {
     requireAuth();
     const form = await request.formData();

package/dist/admin/api/rest/routes/upload.js

@@ -1,7 +1,8 @@
 import { json } from '@sveltejs/kit';
 import { uploadFile } from '../../../../core/server/media/operations/uploadFile.js';
 import { getCMS } from '../../../../core/cms.js';
-const MAX_UPLOAD_SIZE = 50 * 1024 * 1024; // 50MB
+import { getMaxUploadSize } from '../../../../core/server/media/uploadLimit.js';
+const MAX_UPLOAD_SIZE = getMaxUploadSize();
 export async function POST(event) {
     const form = await event.request.formData();
     const file = form.get('file');

package/dist/admin/api/upload-limit.d.ts

@@ -0,0 +1,2 @@
+import { type RequestHandler } from '@sveltejs/kit';
+export declare const GET: RequestHandler;

package/dist/admin/api/upload-limit.js

@@ -0,0 +1,7 @@
+import { requireAuth } from '../remote/middleware/auth.js';
+import { getMaxUploadSize } from '../../core/server/media/uploadLimit.js';
+import { json } from '@sveltejs/kit';
+export const GET = async () => {
+    requireAuth();
+    return json({ maxUploadSize: getMaxUploadSize() });
+};

package/dist/admin/api/upload.js

@@ -2,7 +2,8 @@ import { requireAuth } from '../remote/middleware/auth.js';
 import { uploadFile } from '../../core/server/media/operations/uploadFile.js';
 import { getCMS } from '../../core/cms.js';
 import { json } from '@sveltejs/kit';
-const MAX_UPLOAD_SIZE = 50 * 1024 * 1024; // 50MB
+import { getMaxUploadSize } from '../../core/server/media/uploadLimit.js';
+const MAX_UPLOAD_SIZE = getMaxUploadSize();
 export const POST = async ({ request }) => {
     requireAuth();
     const form = await request.formData();

package/dist/admin/client/collection/collection-entries.svelte

@@ -144,6 +144,21 @@
 	);
 
 
+	// Relation filter options fetched from related collections
+	let relationFilterOptions = $state<Record<string, { label: string; value: string }[]>>({});
+
+	$effect(() => {
+		if (relationListFields.length === 0) return;
+		for (const field of relationListFields) {
+			remotes.getEntryLabels({ slug: field.collection }).then((labels) => {
+				relationFilterOptions = {
+					...relationFilterOptions,
+					[field.slug]: labels.map((l) => ({ value: l.id, label: l.label }))
+				};
+			});
+		}
+	});
+
 	// Data filter configs from select/radio fields in listColumns
 	const dataFilterConfigs = $derived(
 		(collection.listColumns ?? [])
@@ -163,6 +178,15 @@
 				return null;
 			})
 			.filter((f): f is NonNullable<typeof f> => f !== null)
+			.concat(
+				relationListFields
+					.filter((f) => relationFilterOptions[f.slug]?.length)
+					.map((f) => ({
+						slug: f.slug,
+						label: getLocalizedLabel(f.label, interfaceLanguage.current),
+						options: relationFilterOptions[f.slug]
+					}))
+			)
 	);
 
 	let activeDataFilters = $state<Record<string, string | null>>({});
@@ -485,6 +509,8 @@
 				const fieldData = (columnData as Record<string, unknown>)[fieldSlug];
 				const isRelation = relationListFields.some((f) => f.slug === fieldSlug);
 				if (isRelation) {
+					// Store raw UUID(s) for filtering
+					customData[`__raw_${fieldSlug}`] = fieldData;
 					// Resolve relation UUID(s) to labels
 					if (typeof fieldData === 'string') {
 						customData[fieldSlug] = lookup[fieldData] ?? '';
@@ -599,7 +625,7 @@
 			...old,
 			entries: orderedIds.map((id) => old.entries.find((e: RawEntry) => e.id === id)).filter(Boolean)
 		}));
-		await remotes.reorderEntriesCommand({ orderedIds });
+		await remotes.reorderEntriesCommand({ orderedIds, collectionSlug: collection.slug });
 		await entriesQuery.refresh();
 		override.release();
 	}
@@ -640,8 +666,20 @@
 			rows = rows.filter((row) => {
 				for (const [slug, value] of Object.entries(activeDataFilters)) {
 					if (value === null) continue;
-					const rowValue = row.customData[slug];
-					if (String(rowValue ?? '') !== value) return false;
+					// For relation fields, compare against raw UUID(s)
+					const rawValue = row.customData[`__raw_${slug}`];
+					if (rawValue !== undefined) {
+						if (typeof rawValue === 'string') {
+							if (rawValue !== value) return false;
+						} else if (Array.isArray(rawValue)) {
+							if (!rawValue.includes(value)) return false;
+						} else {
+							return false;
+						}
+					} else {
+						const rowValue = row.customData[slug];
+						if (String(rowValue ?? '') !== value) return false;
+					}
 				}
 				return true;
 			});

package/dist/admin/components/media/file-upload.svelte

@@ -2,6 +2,7 @@
 	import { getRemotes } from '../../context/remotes.js';
 	import { useInterfaceLanguage } from '../../state/interface-language.svelte.js';
 	import type { InterfaceLanguage } from '../../../types/languages.js';
+	import { toast } from 'svelte-sonner';
 	import Upload from '@tabler/icons-svelte/icons/upload';
 	import X from '@tabler/icons-svelte/icons/x';
 
@@ -9,21 +10,36 @@
 	const interfaceLanguage = useInterfaceLanguage();
 	const lang: Record<
 		InterfaceLanguage,
-		{ addFiles: string; dropFiles: string; dropHint: string; uploading: string; uploadComplete: string }
+		{
+			addFiles: string;
+			dropFiles: string;
+			dropHint: string;
+			uploading: string;
+			uploadComplete: string;
+			fileTooLarge: (maxMB: number) => string;
+			uploadError: string;
+			skippedFiles: (count: number) => string;
+		}
 	> = {
 		pl: {
 			addFiles: 'Prześlij pliki',
 			dropFiles: 'Upuść pliki tutaj',
 			dropHint: 'Przeciągnij pliki tutaj',
 			uploading: 'Wysyłanie...',
-			uploadComplete: 'Ukończono'
+			uploadComplete: 'Ukończono',
+			fileTooLarge: (maxMB) => `Plik za duży (max ${maxMB} MB)`,
+			uploadError: 'Błąd przesyłania',
+			skippedFiles: (count) => `Pominięto ${count} plik(ów) przekraczających limit`
 		},
 		en: {
 			addFiles: 'Upload files',
 			dropFiles: 'Drop files here',
 			dropHint: 'Drag files here',
 			uploading: 'Uploading...',
-			uploadComplete: 'Complete'
+			uploadComplete: 'Complete',
+			fileTooLarge: (maxMB) => `File too large (max ${maxMB} MB)`,
+			uploadError: 'Upload error',
+			skippedFiles: (count) => `Skipped ${count} file(s) exceeding the limit`
 		}
 	};
 
@@ -39,7 +55,17 @@
 
 	let inputElement: HTMLInputElement;
 	let isDragging = $state(false);
-	let uploadProgress = $state<{ name: string; progress: number; complete: boolean }[]>([]);
+	let uploadProgress = $state<{ name: string; progress: number; complete: boolean; error?: string }[]>([]);
+	let maxUploadSize = $state<number>(50 * 1024 * 1024);
+
+	$effect(() => {
+		fetch('/admin/api/upload-limit')
+			.then((r) => r.json())
+			.then((data) => {
+				if (data.maxUploadSize) maxUploadSize = data.maxUploadSize;
+			})
+			.catch(() => {});
+	});
 
 	async function uploadFile(file: File, index: number) {
 		const form = new FormData();
@@ -58,13 +84,26 @@
 			};
 
 			xhr.onload = () => {
-				uploadProgress[index].complete = true;
-				uploadProgress[index].progress = 100;
+				if (xhr.status >= 200 && xhr.status < 300) {
+					uploadProgress[index].complete = true;
+					uploadProgress[index].progress = 100;
+				} else {
+					const t = lang[interfaceLanguage.current];
+					const error =
+						xhr.status === 413
+							? t.fileTooLarge(Math.round(maxUploadSize / 1024 / 1024))
+							: t.uploadError;
+					uploadProgress[index].progress = -1;
+					uploadProgress[index].error = error;
+					toast.error(error, { description: file.name });
+				}
 				resolve();
 			};
 
 			xhr.onerror = () => {
 				uploadProgress[index].progress = -1;
+				uploadProgress[index].error = lang[interfaceLanguage.current].uploadError;
+				toast.error(lang[interfaceLanguage.current].uploadError, { description: file.name });
 				resolve();
 			};
 
@@ -76,9 +115,27 @@
 	async function handleFiles(files: File[]) {
 		if (!files.length) return;
 
-		uploadProgress = files.map((f) => ({ name: f.name, progress: 0, complete: false }));
+		const maxMB = Math.round(maxUploadSize / 1024 / 1024);
+		uploadProgress = files.map((f) => ({
+			name: f.name,
+			progress: f.size > maxUploadSize ? -1 : 0,
+			complete: false,
+			error: f.size > maxUploadSize ? lang[interfaceLanguage.current].fileTooLarge(maxMB) : undefined
+		}));
+
+		const validFiles = files
+			.map((file, i) => ({ file, i }))
+			.filter(({ file }) => file.size <= maxUploadSize);
+
+		const rejectedCount = files.length - validFiles.length;
+		if (rejectedCount > 0) {
+			const t = lang[interfaceLanguage.current];
+			toast.error(t.fileTooLarge(maxMB), {
+				description: t.skippedFiles(rejectedCount)
+			});
+		}
 
-		await Promise.all(files.map((file, i) => uploadFile(file, i)));
+		await Promise.all(validFiles.map(({ file, i }) => uploadFile(file, i)));
 
 		remotes.getMedia().refresh();
 
@@ -210,7 +267,7 @@
 							{#if item.complete}
 								{lang[interfaceLanguage.current].uploadComplete}
 							{:else if item.progress === -1}
-								Error
+								{item.error || lang[interfaceLanguage.current].uploadError}
 							{:else}
 								{item.progress}%
 							{/if}

package/dist/admin/remote/entry.remote.d.ts

@@ -73,6 +73,7 @@ export declare const unarchiveEntryCommand: import("@sveltejs/kit").RemoteComman
 export declare const deleteEntryCommand: import("@sveltejs/kit").RemoteCommand<string, Promise<void>>;
 export declare const reorderEntriesCommand: import("@sveltejs/kit").RemoteCommand<{
     orderedIds: string[];
+    collectionSlug: string;
 }, Promise<void>>;
 export declare const getEntryVersion: import("@sveltejs/kit").RemoteQueryFunction<{
     id: string;

package/dist/admin/remote/entry.remote.js

@@ -5,6 +5,7 @@ import { getCMS } from '../../core/cms.js';
 import { pruneOldDraftVersions, unpublishEntryLang, upsertDraftVersion, updateEntry, updateEntrySchema, updateEntryVersionCommandTypes } from '../../core/server/entries/operations/update.js';
 import z from 'zod';
 import { requireAuth } from './middleware/auth.js';
+import { stableSlotReorder } from './reorder.js';
 import { entryStatuses } from '../../types/entries.js';
 export const getRawEntries = query(z.object({
     ids: z.array(z.string().uuid()).optional(),
@@ -179,10 +180,11 @@ export const deleteEntryCommand = command(z.string().uuid(), async (id) => {
     return getCMS().databaseAdapter.deleteEntry({ id });
 });
 export const reorderEntriesCommand = command(z.object({
-    orderedIds: z.array(z.string().uuid())
-}), async ({ orderedIds }) => {
+    orderedIds: z.array(z.string().uuid()),
+    collectionSlug: z.string()
+}), async ({ orderedIds, collectionSlug }) => {
     requireAuth();
-    await Promise.all(orderedIds.map((id, index) => updateEntry(id, { sortOrder: index })));
+    await stableSlotReorder(orderedIds, collectionSlug);
 });
 export const getEntryVersion = query(z.object({
     id: z.string().uuid(),

package/dist/admin/remote/reorder.d.ts

@@ -0,0 +1 @@
+export declare function stableSlotReorder(orderedIds: string[], collectionSlug: string): Promise<void>;

package/dist/admin/remote/reorder.js

@@ -0,0 +1,33 @@
+import { getDbEntries } from '../../core/server/entries/operations/get.js';
+import { updateEntry } from '../../core/server/entries/operations/update.js';
+export async function stableSlotReorder(orderedIds, collectionSlug) {
+    if (orderedIds.length === 0)
+        return;
+    const allEntries = await getDbEntries({
+        slug: collectionSlug,
+        orderBy: { column: 'sortOrder', direction: 'asc' }
+    });
+    const allIds = allEntries.map((e) => e.id);
+    const orderedSet = new Set(orderedIds);
+    // Find slot positions occupied by orderedIds in the full list
+    const slotIndices = [];
+    for (let i = 0; i < allIds.length; i++) {
+        if (orderedSet.has(allIds[i])) {
+            slotIndices.push(i);
+        }
+    }
+    // Fill slots with new order
+    const result = [...allIds];
+    for (let i = 0; i < orderedIds.length; i++) {
+        result[slotIndices[i]] = orderedIds[i];
+    }
+    // Update only entries whose sortOrder changed
+    const updates = [];
+    for (let i = 0; i < result.length; i++) {
+        const entry = allEntries.find((e) => e.id === result[i]);
+        if (!entry || entry.sortOrder !== i) {
+            updates.push(updateEntry(result[i], { sortOrder: i }));
+        }
+    }
+    await Promise.all(updates);
+}

package/dist/core/server/entries/operations/get.js

@@ -119,7 +119,7 @@ export const getEntries = async (options = {}) => {
                 const slugPath = getEntrySlugPath(entry.slug);
                 const slug = getSlugFromEntryData(version.data, slugPath, language);
                 const _url = slug ? getEntryPath(entry.slug, slug) : undefined;
-                return {
+                const result = {
                     _id: entry.id,
                     _slug: entry.slug,
                     _type: entry.type,
@@ -127,6 +127,10 @@ export const getEntries = async (options = {}) => {
                     _url,
                     ...populatedData
                 };
+                if (config.type === 'collection' && config.orderable) {
+                    result._sortOrder = entry.sortOrder;
+                }
+                return result;
             }
             catch (error) {
                 console.error(`[CMS] Failed to populate entry ${entry.id} (${entry.slug}):`, error);
@@ -206,7 +210,7 @@ export const getEntries = async (options = {}) => {
             const slugPath = getEntrySlugPath(dbEntry.slug);
             const slug = getSlugFromEntryData(version.data, slugPath, language);
             const _url = slug ? getEntryPath(dbEntry.slug, slug) : undefined;
-            return {
+            const result = {
                 _id: dbEntry.id,
                 _slug: dbEntry.slug,
                 _type: dbEntry.type,
@@ -214,6 +218,10 @@ export const getEntries = async (options = {}) => {
                 _url,
                 ...populatedData
             };
+            if (config.type === 'collection' && config.orderable) {
+                result._sortOrder = dbEntry.sortOrder;
+            }
+            return result;
         }
         catch (error) {
             console.error(`[CMS] Failed to populate entry ${dbEntry.id} (${dbEntry.slug}):`, error);
@@ -349,7 +357,7 @@ export const getEntryVersion = async (options) => {
         const slugPath = getEntrySlugPath(dbEntry.slug);
         const entrySlug = getSlugFromEntryData(dbEntryVersion.data, slugPath, language);
         const _url = entrySlug ? getEntryPath(dbEntry.slug, entrySlug) : undefined;
-        return {
+        const result = {
             _id: dbEntry.id,
             _slug: dbEntry.slug,
             _type: dbEntry.type,
@@ -357,6 +365,10 @@ export const getEntryVersion = async (options) => {
             _url,
             ...populatedData
         };
+        if (config.type === 'collection' && config.orderable) {
+            result._sortOrder = dbEntry.sortOrder;
+        }
+        return result;
     }
     catch (error) {
         console.error(`[CMS] Failed to populate entry ${dbEntry.id} (${dbEntry.slug}):`, error);

package/dist/core/server/fields/utils/imageStyles.js

@@ -1,4 +1,4 @@
-import { getImageStyle } from '../../media/styles/operations/getImageStyle.js';
+import { getImageStyleIfExists } from '../../media/styles/operations/getImageStyle.js';
 import { getCMS } from '../../../cms.js';
 import { generateBlurDataUrl } from '../../media/utils/generateBlurDataUrl.js';
 export const defaultStyles = [
@@ -67,7 +67,9 @@ export async function getImageStyles(field, val) {
     const [styles, blurDataUrl] = await Promise.all([
         Promise.all(stylesArr.map(async (style) => {
             try {
-                const styleDbData = await getImageStyle(val.id, style);
+                const styleDbData = await getImageStyleIfExists(val.id, style);
+                if (!styleDbData)
+                    return null;
                 const result = {
                     url: styleDbData.url,
                     media: styleDbData.media,
@@ -86,7 +88,9 @@ export async function getImageStyles(field, val) {
                                     srcset: undefined,
                                     sizes: undefined
                                 };
-                                const variantData = await getImageStyle(val.id, variantStyle);
+                                const variantData = await getImageStyleIfExists(val.id, variantStyle);
+                                if (!variantData)
+                                    return null;
                                 return `${variantData.url} ${w}w`;
                             }
                             catch (e) {

package/dist/core/server/generator/generator.js

@@ -19,6 +19,8 @@ function generateTypesStringForRecords(type, records) {
         const fieldsType = generateFlatTsTypeFromFields(getFieldsFromConfig(single));
         // Strip outer braces to inline fields into the interface
         const innerFields = fieldsType.replace(/^\s*\{/, '').replace(/\}\s*$/, '');
+        const sortOrderField = type === 'collection' && 'orderable' in single && single.orderable
+            ? '_sortOrder: number;\n\t\t\t\t' : '';
         return `
 			export interface ${toPascalCase(single.slug)} {
 				_id: string;
@@ -26,7 +28,7 @@ function generateTypesStringForRecords(type, records) {
 				_type: string;
 				_publishedAt: Date | null;
 				_url?: string;
-				${innerFields}
+				${sortOrderField}${innerFields}
 			}
 		`;
     })

package/dist/core/server/media/styles/operations/createMediaStyle.d.ts

@@ -1,3 +1,3 @@
 import type { ImageFieldStyle } from '../../../../../types/fields.js';
-import type { ImageStyle } from '../../../../../types/media.js';
-export declare function createImageStyle(mediaFileId: string, style: ImageFieldStyle): Promise<ImageStyle>;
+import type { ImageStyle, MediaFile } from '../../../../../types/media.js';
+export declare function createImageStyle(mediaFileId: string, style: ImageFieldStyle, buffer?: Buffer, mediaFile?: MediaFile): Promise<ImageStyle>;

package/dist/core/server/media/styles/operations/createMediaStyle.js

@@ -1,11 +1,13 @@
 import { getCMS } from '../../../../cms.js';
-import { generateImageStyle } from '../sharp/generateImageStyle.js';
-export async function createImageStyle(mediaFileId, style) {
+import { generateImageStyle, generateImageStyleFromBuffer } from '../sharp/generateImageStyle.js';
+export async function createImageStyle(mediaFileId, style, buffer, mediaFile) {
     const cms = getCMS();
     // Check for existing style to clean up old file after upsert
     const existing = await cms.databaseAdapter.getImageStyle(mediaFileId, style);
     const oldUrl = existing?.url;
-    const imageStyleFile = await generateImageStyle(mediaFileId, style);
+    const imageStyleFile = buffer && mediaFile
+        ? await generateImageStyleFromBuffer(buffer, mediaFile, style)
+        : await generateImageStyle(mediaFileId, style);
     const imageStyle = await cms.databaseAdapter.createImageStyle(mediaFileId, imageStyleFile, style);
     // Delete old file from disk if URL changed
     if (oldUrl && oldUrl !== imageStyle.url) {

package/dist/core/server/media/styles/operations/generateDefaultStyles.js

@@ -1,16 +1,35 @@
+import { getCMS } from '../../../../cms.js';
 import { defaultStyles, isProcessableImage, expandStyleFormats, getOriginalFormat } from '../../../fields/utils/imageStyles.js';
-import { getImageStyle } from './getImageStyle.js';
-export async function generateDefaultStyles(mediaFile) {
-    if (!isProcessableImage(mediaFile))
-        return;
+import { createImageStyle } from './createMediaStyle.js';
+const CONCURRENCY = 3;
+async function runWithConcurrency(tasks, limit) {
+    const results = new Array(tasks.length);
+    let i = 0;
+    async function next() {
+        while (i < tasks.length) {
+            const idx = i++;
+            results[idx] = await tasks[idx]();
+        }
+    }
+    await Promise.all(Array.from({ length: Math.min(limit, tasks.length) }, () => next()));
+    return results;
+}
+async function downloadOriginalBuffer(mediaFile) {
+    const file = await getCMS().filesAdapter.downloadFile(mediaFile.url.split('/').pop() || '');
+    if (!file)
+        throw new Error('Media file not found');
+    return Buffer.from(await file.arrayBuffer());
+}
+function collectStyleTasks(mediaFile) {
     const origFormat = getOriginalFormat(mediaFile);
     const expanded = expandStyleFormats(defaultStyles, origFormat);
+    const tasks = [];
     for (const style of expanded) {
-        await getImageStyle(mediaFile.id, style);
+        tasks.push(style);
         if (style.srcset && mediaFile.width) {
             const widths = style.srcset.filter((w) => w <= mediaFile.width);
             for (const w of widths) {
-                await getImageStyle(mediaFile.id, {
+                tasks.push({
                     ...style,
                     name: `${style.name}_${w}w`,
                     width: w,
@@ -20,6 +39,14 @@ export async function generateDefaultStyles(mediaFile) {
             }
         }
     }
+    return tasks;
+}
+export async function generateDefaultStyles(mediaFile) {
+    if (!isProcessableImage(mediaFile))
+        return;
+    const buffer = await downloadOriginalBuffer(mediaFile);
+    const styles = collectStyleTasks(mediaFile);
+    await runWithConcurrency(styles.map((style) => () => createImageStyle(mediaFile.id, style, buffer, mediaFile)), CONCURRENCY);
 }
 export function generateDefaultStylesInBackground(mediaFile) {
     generateDefaultStyles(mediaFile).catch((e) => console.warn('Background style generation failed:', e));

package/dist/core/server/media/styles/operations/getImageStyle.d.ts

@@ -1,3 +1,4 @@
 import type { ImageFieldStyle } from '../../../../../types/fields.js';
 import type { ImageStyle } from '../../../../../types/media.js';
 export declare function getImageStyle(mediaFileId: string, style: ImageFieldStyle): Promise<ImageStyle>;
+export declare function getImageStyleIfExists(mediaFileId: string, style: ImageFieldStyle): Promise<ImageStyle | null>;

package/dist/core/server/media/styles/operations/getImageStyle.js

@@ -6,3 +6,6 @@ export async function getImageStyle(mediaFileId, style) {
         return imageStyle;
     return createImageStyle(mediaFileId, style);
 }
+export async function getImageStyleIfExists(mediaFileId, style) {
+    return getCMS().databaseAdapter.getImageStyle(mediaFileId, style);
+}

package/dist/core/server/media/styles/sharp/generateImageStyle.d.ts

@@ -1,3 +1,4 @@
 import type { ImageFieldStyle } from '../../../../../types/fields.js';
-import type { UploadedMediaFile } from '../../../../../types/media.js';
+import type { MediaFile, UploadedMediaFile } from '../../../../../types/media.js';
 export declare function generateImageStyle(mediaFileId: string, style: ImageFieldStyle): Promise<UploadedMediaFile>;
+export declare function generateImageStyleFromBuffer(buf: Buffer, mediaFile: MediaFile, style: ImageFieldStyle): Promise<UploadedMediaFile>;

package/dist/core/server/media/styles/sharp/generateImageStyle.js

@@ -14,8 +14,10 @@ export async function generateImageStyle(mediaFileId, style) {
     if (!file) {
         throw new Error('Media file not found');
     }
-    const imageBuffer = await file.arrayBuffer();
-    const buf = Buffer.from(imageBuffer);
+    const buf = Buffer.from(await file.arrayBuffer());
+    return generateImageStyleFromBuffer(buf, mediaFile, style);
+}
+export async function generateImageStyleFromBuffer(buf, mediaFile, style) {
     // Read EXIF orientation before processing
     const metadata = await sharp(buf).metadata();
     // .rotate() applies EXIF orientation to pixels AND strips the tag from output.
@@ -51,7 +53,7 @@ export async function generateImageStyle(mediaFileId, style) {
     const format = style.format ?? originalExt ?? 'jpeg';
     sharpInstance = sharpInstance.toFormat(format, style.quality != null ? { quality: Math.max(1, Math.min(100, style.quality)) } : undefined);
     const outputBuffer = await sharpInstance.toBuffer();
-    return getCMS().filesAdapter.uploadFile(new File([new Uint8Array(outputBuffer)], `${mediaFileId}_${style.name}_${Date.now().toString(36)}.${format}`, {
+    return getCMS().filesAdapter.uploadFile(new File([new Uint8Array(outputBuffer)], `${mediaFile.id}_${style.name}_${Date.now().toString(36)}.${format}`, {
         type: `image/${format}`
     }));
 }

package/dist/core/server/media/uploadLimit.d.ts

@@ -0,0 +1,2 @@
+export declare function parseAsBytes(value: string): number;
+export declare function getMaxUploadSize(): number;

package/dist/core/server/media/uploadLimit.js

@@ -0,0 +1,26 @@
+const SUFFIX_MULTIPLIERS = {
+    K: 1024,
+    M: 1024 * 1024,
+    G: 1024 * 1024 * 1024
+};
+const DEFAULT_LIMIT = '50M';
+export function parseAsBytes(value) {
+    const trimmed = value.trim();
+    if (!trimmed)
+        return 0;
+    const suffix = trimmed.at(-1).toUpperCase();
+    const multiplier = SUFFIX_MULTIPLIERS[suffix];
+    if (multiplier) {
+        const num = Number(trimmed.slice(0, -1));
+        if (isNaN(num) || num < 0)
+            return 0;
+        return Math.floor(num * multiplier);
+    }
+    const num = Number(trimmed);
+    if (isNaN(num) || num < 0)
+        return 0;
+    return Math.floor(num);
+}
+export function getMaxUploadSize() {
+    return parseAsBytes(process.env.BODY_SIZE_LIMIT || DEFAULT_LIMIT);
+}

package/dist/types/entries.d.ts

@@ -41,6 +41,7 @@ export type Entry = {
     _type: EntryType;
     _publishedAt?: Date | null;
     _url?: string;
+    _sortOrder?: number | null;
 } & Record<string, unknown>;
 export interface DbEntryVersion {
     id: string;

package/dist/updates/0.13.2/index.d.ts

@@ -0,0 +1,2 @@
+import type { CmsUpdate } from '../index.js';
+export declare const update: CmsUpdate;

package/dist/updates/0.13.2/index.js

@@ -0,0 +1,20 @@
+export const update = {
+    version: '0.13.2',
+    date: '2026-03-20',
+    description: 'Upload limits, stable reordering, relation filters, image style optimization',
+    features: [
+        'Configurable upload size limit via BODY_SIZE_LIMIT env var (supports K/M/G suffixes, default 50M)',
+        'File upload pre-validation — rejects oversized files before upload with localized error messages',
+        'Stable slot reordering — preserves positions of filtered-out entries during DnD reorder',
+        'Collection relation field filtering — filter entries by relation field values',
+        'Expose _sortOrder on entries for orderable collections',
+        'Codegen: _sortOrder field in generated TypeScript interfaces for orderable collections',
+        'getImageStyleIfExists — non-blocking image style lookup (returns null if missing)'
+    ],
+    fixes: [
+        'Concurrent image style generation with buffer reuse — download original once, generate styles in parallel (limit 3)',
+        'Image style resolution gracefully skips missing styles instead of blocking',
+        'Upload endpoints use configurable size limit instead of hardcoded 50MB'
+    ],
+    breakingChanges: []
+};

package/dist/updates/index.js

@@ -34,7 +34,8 @@ import { update as update0110 } from './0.11.0/index.js';
 import { update as update0120 } from './0.12.0/index.js';
 import { update as update0130 } from './0.13.0/index.js';
 import { update as update0131 } from './0.13.1/index.js';
-export const updates = [update0065, update0066, update0067, update0068, update0069, update010, update011, update012, update013, update014, update015, update020, update022, update050, update051, update052, update053, update054, update055, update056, update057, update058, update060, update061, update062, update070, update071, update072, update073, update080, update090, update0100, update0110, update0120, update0130, update0131];
+import { update as update0132 } from './0.13.2/index.js';
+export const updates = [update0065, update0066, update0067, update0068, update0069, update010, update011, update012, update013, update014, update015, update020, update022, update050, update051, update052, update053, update054, update055, update056, update057, update058, update060, update061, update062, update070, update071, update072, update073, update080, update090, update0100, update0110, update0120, update0130, update0131, update0132];
 export const getUpdatesFrom = (fromVersion) => {
     const fromParts = fromVersion.split('.').map(Number);
     return updates.filter((update) => {

package/package.json

@@ -1,6 +1,6 @@
 {
 	"name": "includio-cms",
-	"version": "0.13.1",
+	"version": "0.13.2",
 	"scripts": {
 		"dev": "vite dev",
 		"build": "vite build && npm run prepack",