mercadodevida/work/artifacts/F-095/implementer.md

F-095 — Implementer evidence

Changes

• Removed the erroneous empty productsApi.update(productId, {}) call from URL image attachment.
• The admin image editor now sends { url } to /api/upload, then attaches the returned local /uploads/... URL to the product.
• /api/upload now supports authenticated JSON URL imports: validates public HTTP(S) hosts, follows limited redirects, accepts only supported image MIME/signatures, enforces the 10MB limit, stores locally, mirrors peers, and generates thumbnails.
• Existing multipart file upload behavior uses the shared local save helper.

Validation

• Admin npx tsc --noEmit → exit 0
• Admin ESLint on upload route and ImagesSection → 0 errors
• Admin production build → exit 0