feat(cli): migrate cloud-render upload to /v3/assets/direct-uploads (200MB) (#1844)

* chore(cli): regenerate cloud client for createAssetUpload + completeAssetUpload

Regenerated from experiment-framework `master` at commit `e74815f7af` (the
merge of EF#41085, which added `/v3/assets/direct-uploads` +
`/v3/assets/{asset_id}/complete` to the `TARGET_ENDPOINTS` allowlist in
`scripts/generate_hyperframes_cli_client.py`).

The `sync-hyperframes-codegen.yml` workflow that normally auto-opens this
PR failed with a `gh: Not Found (HTTP 404)` on the PR-creation step (run
28556975483); regenerated manually with:

  cd experiment-framework
  PYTHONPATH=. python3 scripts/generate_hyperframes_cli_client.py \\
    --out /path/to/hyperframes-oss

This commit is codegen-only — no hand edits. The direct-upload wire-up
that consumes the new `createAssetUpload` + `completeAssetUpload` methods
lands in the follow-up commit.

— Jerrai

Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>

* feat(cli): migrate cloud-render upload to /v3/assets/direct-uploads (200MB)

Replaces the legacy `client.uploadAsset(...)` multipart POST to
`/v3/assets` (32 MB in-memory proxy path) with the three-step direct-to-
S3 flow that lifts the practical per-project ceiling to 200 MB:

  1. `POST /v3/assets/direct-uploads` — declares filename, content-type,
     size, and SHA256 checksum; returns `asset_id`, presigned
     `upload_url`, and required `upload_headers`.
  2. Raw `PUT` to `upload_url` with the zip bytes + `upload_headers`
     verbatim. No CLI auth attached — the presigned URL signature carries
     authorization, and any extra headers would break the signature.
  3. `POST /v3/assets/{asset_id}/complete` — finalizes into a reusable
     asset. Retried up to 5x on 409 ("Uploaded object not found yet"), a
     documented race between S3 write consistency and the finalize check.

The returned `asset_id` is the same namespace the legacy path produced
(both write into `movio_asset`), so the downstream render submission at
`createRender({project: {type: "asset_id", asset_id}})` is unchanged.

Server-side context (EF#41085): the direct-upload endpoint now accepts
`application/zip` via a scoped `_ZIP_MIME_TO_EXT` map — the shared media/
PDF allowlist stays zip-free. The exact-MIME cross-check at the sniff
step guards against zip<->PDF confusion under the shared 'document'
category. Canonical S3 key layout matches the legacy proxy path
(`document/{asset_id}/original.zip`), so the render-side head_object
gate is transparent to which upload path produced the asset.

The prior codegen commit added the generated createAssetUpload +
completeAssetUpload methods this commit consumes.

— Jerrai

Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>

---------

Co-authored-by: Claude Opus 4.7 <noreply@anthropic.com>

packages/cli/src/cloud/_gen/client.ts

@@ -5,6 +5,10 @@
  * experiment-framework to regenerate.
  */
 import type {
+  CompleteAssetUploadRequest,
+  CompleteAssetUploadResponse,
+  CreateAssetUploadRequest,
+  CreateAssetUploadResponse,
   CreateHyperframesRenderRequest,
   CreateHyperframesRenderResponse,
   DeleteHyperframesRenderResponse,
@@ -225,6 +229,43 @@ export class HyperframesCloudClient {
     });
   }
 
+  /**
+   * Create Asset Upload
+   *
+   * Begin a direct-to-S3 upload. Returns an asset_id and a presigned upload_url; PUT the file bytes to upload_url, then call POST /v3/assets/{asset_id}/complete. Unlike POST /v3/assets (which proxies the bytes), this never sends the file through the API.
+   */
+  async createAssetUpload(args: {
+    body: CreateAssetUploadRequest;
+    idempotencyKey?: string;
+    signal?: AbortSignal;
+  }): Promise<CreateAssetUploadResponse> {
+    return await this.request<CreateAssetUploadResponse>({
+      method: "POST",
+      path: "/v3/assets/direct-uploads",
+      body: args.body,
+      idempotencyKey: args.idempotencyKey,
+      signal: args.signal,
+    });
+  }
+
+  /**
+   * Complete Asset Upload
+   *
+   * Finalize a direct-to-S3 upload into a reusable asset. Call after the upload PUT returns 200. Idempotent: repeated calls return the same finalized asset.
+   */
+  async completeAssetUpload(args: {
+    asset_id: string;
+    body: CompleteAssetUploadRequest;
+    signal?: AbortSignal;
+  }): Promise<CompleteAssetUploadResponse> {
+    return await this.request<CompleteAssetUploadResponse>({
+      method: "POST",
+      path: `/v3/assets/${encodeURIComponent(args.asset_id)}/complete`,
+      body: args.body,
+      signal: args.signal,
+    });
+  }
+
   /**
    * Create HyperFrames Render
    *

packages/cli/src/cloud/_gen/types.ts

@@ -55,6 +55,100 @@ export interface AssetUrl {
   url: string;
 }
 
+/**
+ * Finalize a presigned upload (POST /v3/assets/{asset_id}/complete).
+ */
+export interface CompleteAssetUploadRequest {
+  /**
+   * Optional SHA256 (hex) cross-check.
+   */
+  checksum_sha256?: string | null;
+}
+
+/**
+ * Result of finalizing an upload.
+ */
+export interface CompleteAssetUploadResponse {
+  /**
+   * The reusable asset identifier.
+   */
+  asset_id: string;
+  /**
+   * Public URL of the finalized asset.
+   */
+  url: string;
+  /**
+   * MIME type detected from the stored bytes.
+   */
+  mime_type: string;
+  /**
+   * Size of the stored object in bytes.
+   */
+  size_bytes: number;
+  /**
+   * Asset status, e.g. 'processing'.
+   */
+  status: "processing";
+}
+
+/**
+ * Request to begin a presigned direct-to-S3 upload (POST
+ * /v3/assets/direct-uploads).
+ */
+export interface CreateAssetUploadRequest {
+  /**
+   * Original filename for reference/metadata. The stored object's extension is
+   * derived from content_type.
+   */
+  filename: string;
+  /**
+   * Declared MIME type (e.g. 'video/mp4', 'image/png', 'audio/mpeg',
+   * 'application/pdf', 'application/zip'). Verified against the stored bytes at
+   * completion.
+   */
+  content_type: string;
+  /**
+   * Exact byte size of the file. Signed into the upload URL so it cannot be
+   * exceeded.
+   */
+  size_bytes: number;
+  /**
+   * Optional SHA256 of the file as hex. When provided, S3 enforces it on upload.
+   */
+  checksum_sha256?: string | null;
+}
+
+/**
+ * Presigned upload instructions.
+ */
+export interface CreateAssetUploadResponse {
+  /**
+   * Reusable asset identifier. Becomes usable after POST
+   * /v3/assets/{asset_id}/complete.
+   */
+  asset_id: string;
+  /**
+   * Presigned S3 URL. PUT the raw file bytes here.
+   */
+  upload_url: string;
+  /**
+   * Headers that must be sent verbatim on the PUT request.
+   */
+  upload_headers: Record<string, unknown>;
+  /**
+   * Seconds until the upload URL expires.
+   */
+  expires_in_seconds: number;
+  /**
+   * Maximum allowed upload size in bytes.
+   */
+  max_bytes: number;
+  /**
+   * Upload lifecycle status. Always 'pending_upload' here.
+   */
+  status: "pending_upload";
+}
+
 /**
  * Request body for POST /v3/hyperframes/renders.
  */