feat(cli): migrate cloud-render upload to /v3/assets/direct-uploads (200MB) (#1844)

* chore(cli): regenerate cloud client for createAssetUpload + completeAssetUpload

Regenerated from experiment-framework `master` at commit `e74815f7af` (the
merge of EF#41085, which added `/v3/assets/direct-uploads` +
`/v3/assets/{asset_id}/complete` to the `TARGET_ENDPOINTS` allowlist in
`scripts/generate_hyperframes_cli_client.py`).

The `sync-hyperframes-codegen.yml` workflow that normally auto-opens this
PR failed with a `gh: Not Found (HTTP 404)` on the PR-creation step (run
28556975483); regenerated manually with:

  cd experiment-framework
  PYTHONPATH=. python3 scripts/generate_hyperframes_cli_client.py \\
    --out /path/to/hyperframes-oss

This commit is codegen-only — no hand edits. The direct-upload wire-up
that consumes the new `createAssetUpload` + `completeAssetUpload` methods
lands in the follow-up commit.

— Jerrai

Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>

* feat(cli): migrate cloud-render upload to /v3/assets/direct-uploads (200MB)

Replaces the legacy `client.uploadAsset(...)` multipart POST to
`/v3/assets` (32 MB in-memory proxy path) with the three-step direct-to-
S3 flow that lifts the practical per-project ceiling to 200 MB:

  1. `POST /v3/assets/direct-uploads` — declares filename, content-type,
     size, and SHA256 checksum; returns `asset_id`, presigned
     `upload_url`, and required `upload_headers`.
  2. Raw `PUT` to `upload_url` with the zip bytes + `upload_headers`
     verbatim. No CLI auth attached — the presigned URL signature carries
     authorization, and any extra headers would break the signature.
  3. `POST /v3/assets/{asset_id}/complete` — finalizes into a reusable
     asset. Retried up to 5x on 409 ("Uploaded object not found yet"), a
     documented race between S3 write consistency and the finalize check.

The returned `asset_id` is the same namespace the legacy path produced
(both write into `movio_asset`), so the downstream render submission at
`createRender({project: {type: "asset_id", asset_id}})` is unchanged.

Server-side context (EF#41085): the direct-upload endpoint now accepts
`application/zip` via a scoped `_ZIP_MIME_TO_EXT` map — the shared media/
PDF allowlist stays zip-free. The exact-MIME cross-check at the sniff
step guards against zip<->PDF confusion under the shared 'document'
category. Canonical S3 key layout matches the legacy proxy path
(`document/{asset_id}/original.zip`), so the render-side head_object
gate is transparent to which upload path produced the asset.

The prior codegen commit added the generated createAssetUpload +
completeAssetUpload methods this commit consumes.

— Jerrai

Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>

---------

Co-authored-by: Claude Opus 4.7 <noreply@anthropic.com>

packages/cli/src/commands/cloud/render.ts

@@ -6,8 +6,11 @@
  *      `--url`).
  *   2. Zip the project (reuses `createPublishArchive` so the
  *      file-ignore set matches the existing `publish` command exactly).
- *   3. Upload the zip via `POST /v3/assets` (multipart) — the server
- *      branches on the detected `application/zip` MIME.
+ *   3. Upload the zip via the direct-to-S3 flow: `POST /v3/assets/
+ *      direct-uploads` returns a presigned URL, we PUT the zip bytes
+ *      to it, then `POST /v3/assets/{asset_id}/complete` finalizes.
+ *      Cap: 200 MB. See `../../cloud/upload.ts` for the three-step
+ *      contract. (The legacy `POST /v3/assets` proxy path was 32 MB.)
  *   4. Submit the render via `POST /v3/hyperframes/renders` with a
  *      `project: {type:"asset_id", asset_id}` shape.
  *   5. If `--no-wait`: print the `render_id` and exit immediately.
@@ -53,6 +56,7 @@ import {
 } from "../../cloud/index.js";
 import { reportApiError } from "../../cloud/errors.js";
 import { parseEnumFlag, parseIntFlag, parseNumericFlag } from "../../cloud/parsing.js";
+import { uploadZipViaDirectUpload } from "../../cloud/upload.js";
 import { colorStatus } from "../../cloud/statusColor.js";
 import type {
   CreateHyperframesRenderRequest,
@@ -552,22 +556,27 @@ async function maybeUploadProject(
 
   if (!asJson) {
     console.log("");
-    console.log(`${c.accent("◆")}  Uploading to /v3/assets`);
+    console.log(`${c.accent("◆")}  Uploading (direct-to-S3)`);
   }
   const uploadStart = Date.now();
   let uploaded;
   try {
-    uploaded = await client.uploadAsset({
-      file: archive.buffer,
+    uploaded = await uploadZipViaDirectUpload({
+      client,
+      bytes: archive.buffer,
       filename: `${project.name}.zip`,
-      // Tag the multipart part with application/zip so downstream
-      // proxies / WAFs / any server-side path that keys off the
-      // part Content-Type see the intended type. The asset
-      // controller currently sniffs magic bytes from the file
-      // bytes, so this is belt-and-suspenders today; without it,
-      // FormData defaults to application/octet-stream.
-      mimeType: "application/zip",
       idempotencyKey,
+      onProgress: !asJson
+        ? (ev) => {
+            if (ev.phase === "initialize") {
+              console.log(c.dim(`   initializing…`));
+            } else if (ev.phase === "upload" && ev.percent === 0) {
+              console.log(c.dim(`   uploading to S3…`));
+            } else if (ev.phase === "complete") {
+              console.log(c.dim(`   finalizing…`));
+            }
+          }
+        : undefined,
     });
   } catch (err) {
     reportApiError("Upload failed", err);