[0xSacul]

Add FiveMesh CDN as an upload provider

Summary

Adds FiveMesh CDN as a third media provider alongside Fivemanage and Qbox. FiveMesh uploads go through the game server by default. With AllowDirectUpload = true, supported phone features can send media directly from the NUI to FiveMesh, reducing the upload traffic the game server has to relay.

Each direct upload uses a short-lived token limited to one file, a dedicated path, a size limit, and allowed MIME types. The game server keeps the API key server-side and verifies the returned CDN URL and file signature before saving the media. Supported upload flows can fall back to the server route if direct upload fails.

Setup

1. Set Provider = 'fivemesh' in configs/photos.lua. FiveMeshPath defaults to phone.
2. Add a FiveMesh key with cdn:write access to FiveMeshCdn in configs/server/apikeys.lua, or use the server-only sd_fivemesh_cdn_key convar with set. If the key restricts paths, allow FiveMeshPath.
3. Set AllowDirectUpload = true to opt in to direct uploads.

Type of Change

• New Feature

Related Issues

None.

Testing

• Tested locally

• Tested with latest sd-phone

• Tested with latest ox_lib

• Tested with latest ox_inventory

• Multiplayer tested

• Uploaded a photo and a video on a dev server in each FiveMesh upload mode.

• Ran the NUI build, lint, tests, Knip, and i18n checks.

• Ran local regression checks for FiveMesh token expiry, ownership, media validation, and fallback. Compared 25 Fivemanage presigned upload scenarios against the original implementation and checked Qbox provider routing and error handling with mocks.

Upload mode	Photo	Video
Through the server	JPEG	WebM
Direct to FiveMesh	JPEG	WebM

Breaking Changes

None expected. Existing Fivemanage and Qbox configurations require no migration. FiveMesh requires explicit selection, and Fivemanage is the default.

---

Checklist

• My code follows the existing style of the project.
• I have tested my changes.
• I have updated any necessary documentation.
• I have removed any debug code.
• This PR does not include unrelated changes.
• I have verified this works on the latest version of sd-phone.