@aglyn/plugins-video-delivery 1.0.0-beta.143

package/src/lib/sigv4.js

@@ -0,0 +1,104 @@
+/**
+ * @license
+ * Copyright 2026 Aglyn LLC
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *   http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */ /**
+ * AWS Signature Version 4, header-signed, on Web Crypto.
+ *
+ * R2 speaks the S3 API, and the copy flow needs four of its calls: put,
+ * delete, head and list. An S3 SDK would bring a large dependency tree for
+ * those four, so this signs them directly, following the published algorithm
+ * (the canonical request, the string to sign, the derived signing key). The
+ * spec checks it against the worked examples in the S3 documentation.
+ *
+ * The caller builds the URL with its path already encoded; S3 signs the path
+ * as sent and does not encode it a second time. Query parameters are encoded
+ * here, strictly, in the order the algorithm requires.
+ */ /** The SHA-256 of an empty body, which every bodiless request signs. */ export const EMPTY_PAYLOAD_SHA256 = 'e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855';
+/** Signs a streamed body without hashing it first; the transport is TLS. */ export const UNSIGNED_PAYLOAD = 'UNSIGNED-PAYLOAD';
+const encoder = new TextEncoder();
+function hex(bytes) {
+    return Array.from(bytes instanceof Uint8Array ? bytes : new Uint8Array(bytes), (byte)=>byte.toString(16).padStart(2, '0')).join('');
+}
+async function sha256Hex(text) {
+    return hex(await crypto.subtle.digest('SHA-256', encoder.encode(text)));
+}
+async function hmac(key, text) {
+    const imported = await crypto.subtle.importKey('raw', typeof key === 'string' ? encoder.encode(key) : key, {
+        name: 'HMAC',
+        hash: 'SHA-256'
+    }, false, [
+        'sign'
+    ]);
+    return new Uint8Array(await crypto.subtle.sign('HMAC', imported, encoder.encode(text)));
+}
+/** RFC 3986 encoding: `encodeURIComponent` plus the four it leaves alone. */ export function encodeRfc3986(value) {
+    return encodeURIComponent(value).replace(/[!'()*]/g, (character)=>`%${character.charCodeAt(0).toString(16).toUpperCase()}`);
+}
+/** `20130524T000000Z`. */ function amzDate(now) {
+    return now.toISOString().replace(/[-:]/g, '').replace(/\.\d{3}/, '');
+}
+/**
+ * The headers that authorize `request`: `authorization`, `x-amz-date` and
+ * `x-amz-content-sha256`. Send them with the headers named in
+ * `request.headers`, exactly as signed. `host` is signed from the URL, which
+ * is what `fetch` sends.
+ */ export async function signSigV4(request, credentials) {
+    var _request_headers;
+    const date = amzDate(request.now);
+    const day = date.slice(0, 8);
+    const signed = {};
+    for (const [name, value] of Object.entries((_request_headers = request.headers) != null ? _request_headers : {})){
+        signed[name.toLowerCase()] = String(value).trim().replace(/\s+/g, ' ');
+    }
+    signed['host'] = request.url.host;
+    signed['x-amz-date'] = date;
+    signed['x-amz-content-sha256'] = request.payloadHash;
+    const names = Object.keys(signed).sort();
+    const canonicalHeaders = names.map((name)=>`${name}:${signed[name]}\n`).join('');
+    const signedHeaders = names.join(';');
+    const query = [
+        ...request.url.searchParams.entries()
+    ].map(([name, value])=>[
+            encodeRfc3986(name),
+            encodeRfc3986(value)
+        ]).sort(([a, x], [b, y])=>a < b ? -1 : a > b ? 1 : x < y ? -1 : x > y ? 1 : 0).map(([name, value])=>`${name}=${value}`).join('&');
+    const canonicalRequest = [
+        request.method.toUpperCase(),
+        request.url.pathname || '/',
+        query,
+        canonicalHeaders,
+        signedHeaders,
+        request.payloadHash
+    ].join('\n');
+    const scope = `${day}/${request.region}/${request.service}/aws4_request`;
+    const stringToSign = [
+        'AWS4-HMAC-SHA256',
+        date,
+        scope,
+        await sha256Hex(canonicalRequest)
+    ].join('\n');
+    let key = await hmac(`AWS4${credentials.secretAccessKey}`, day);
+    key = await hmac(key, request.region);
+    key = await hmac(key, request.service);
+    key = await hmac(key, 'aws4_request');
+    const signature = hex(await hmac(key, stringToSign));
+    return {
+        authorization: `AWS4-HMAC-SHA256 Credential=${credentials.accessKeyId}/${scope}, ` + `SignedHeaders=${signedHeaders}, Signature=${signature}`,
+        'x-amz-date': date,
+        'x-amz-content-sha256': request.payloadHash
+    };
+}
+
+//# sourceMappingURL=sigv4.js.map

package/src/lib/sigv4.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../../../../../../libs/plugins/video-delivery/src/lib/sigv4.ts"],"sourcesContent":["/**\n * @license\n * Copyright 2026 Aglyn LLC\n *\n * Licensed under the Apache License, Version 2.0 (the \"License\");\n * you may not use this file except in compliance with the License.\n * You may obtain a copy of the License at\n *\n *   http://www.apache.org/licenses/LICENSE-2.0\n *\n * Unless required by applicable law or agreed to in writing, software\n * distributed under the License is distributed on an \"AS IS\" BASIS,\n * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.\n * See the License for the specific language governing permissions and\n * limitations under the License.\n */\n\n/**\n * AWS Signature Version 4, header-signed, on Web Crypto.\n *\n * R2 speaks the S3 API, and the copy flow needs four of its calls: put,\n * delete, head and list. An S3 SDK would bring a large dependency tree for\n * those four, so this signs them directly, following the published algorithm\n * (the canonical request, the string to sign, the derived signing key). The\n * spec checks it against the worked examples in the S3 documentation.\n *\n * The caller builds the URL with its path already encoded; S3 signs the path\n * as sent and does not encode it a second time. Query parameters are encoded\n * here, strictly, in the order the algorithm requires.\n */\n\n/** The SHA-256 of an empty body, which every bodiless request signs. */\nexport const EMPTY_PAYLOAD_SHA256 =\n  'e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855'\n\n/** Signs a streamed body without hashing it first; the transport is TLS. */\nexport const UNSIGNED_PAYLOAD = 'UNSIGNED-PAYLOAD'\n\nexport interface SigV4Credentials {\n  accessKeyId: string\n  secretAccessKey: string\n}\n\nexport interface SigV4Request {\n  method: string\n  url: URL\n  /** Headers to sign besides `host`, `x-amz-date` and `x-amz-content-sha256`. */\n  headers?: Record<string, string>\n  /** Hex SHA-256 of the body, or {@link UNSIGNED_PAYLOAD}. */\n  payloadHash: string\n  region: string\n  service: string\n  now: Date\n}\n\nconst encoder = new TextEncoder()\n\nfunction hex(bytes: ArrayBuffer | Uint8Array): string {\n  return Array.from(bytes instanceof Uint8Array ? bytes : new Uint8Array(bytes), (byte) =>\n    byte.toString(16).padStart(2, '0'),\n  ).join('')\n}\n\nasync function sha256Hex(text: string): Promise<string> {\n  return hex(await crypto.subtle.digest('SHA-256', encoder.encode(text)))\n}\n\nasync function hmac(\n  key: Uint8Array<ArrayBuffer> | string,\n  text: string,\n): Promise<Uint8Array<ArrayBuffer>> {\n  const imported = await crypto.subtle.importKey(\n    'raw',\n    typeof key === 'string' ? encoder.encode(key) : key,\n    { name: 'HMAC', hash: 'SHA-256' },\n    false,\n    ['sign'],\n  )\n  return new Uint8Array(await crypto.subtle.sign('HMAC', imported, encoder.encode(text)))\n}\n\n/** RFC 3986 encoding: `encodeURIComponent` plus the four it leaves alone. */\nexport function encodeRfc3986(value: string): string {\n  return encodeURIComponent(value).replace(\n    /[!'()*]/g,\n    (character) => `%${character.charCodeAt(0).toString(16).toUpperCase()}`,\n  )\n}\n\n/** `20130524T000000Z`. */\nfunction amzDate(now: Date): string {\n  return now.toISOString().replace(/[-:]/g, '').replace(/\\.\\d{3}/, '')\n}\n\n/**\n * The headers that authorize `request`: `authorization`, `x-amz-date` and\n * `x-amz-content-sha256`. Send them with the headers named in\n * `request.headers`, exactly as signed. `host` is signed from the URL, which\n * is what `fetch` sends.\n */\nexport async function signSigV4(\n  request: SigV4Request,\n  credentials: SigV4Credentials,\n): Promise<Record<string, string>> {\n  const date = amzDate(request.now)\n  const day = date.slice(0, 8)\n  const signed: Record<string, string> = {}\n  for (const [name, value] of Object.entries(request.headers ?? {})) {\n    signed[name.toLowerCase()] = String(value).trim().replace(/\\s+/g, ' ')\n  }\n  signed['host'] = request.url.host\n  signed['x-amz-date'] = date\n  signed['x-amz-content-sha256'] = request.payloadHash\n  const names = Object.keys(signed).sort()\n  const canonicalHeaders = names.map((name) => `${name}:${signed[name]}\\n`).join('')\n  const signedHeaders = names.join(';')\n  const query = [...request.url.searchParams.entries()]\n    .map(([name, value]) => [encodeRfc3986(name), encodeRfc3986(value)] as const)\n    .sort(([a, x], [b, y]) => (a < b ? -1 : a > b ? 1 : x < y ? -1 : x > y ? 1 : 0))\n    .map(([name, value]) => `${name}=${value}`)\n    .join('&')\n  const canonicalRequest = [\n    request.method.toUpperCase(),\n    request.url.pathname || '/',\n    query,\n    canonicalHeaders,\n    signedHeaders,\n    request.payloadHash,\n  ].join('\\n')\n  const scope = `${day}/${request.region}/${request.service}/aws4_request`\n  const stringToSign = [\n    'AWS4-HMAC-SHA256',\n    date,\n    scope,\n    await sha256Hex(canonicalRequest),\n  ].join('\\n')\n  let key = await hmac(`AWS4${credentials.secretAccessKey}`, day)\n  key = await hmac(key, request.region)\n  key = await hmac(key, request.service)\n  key = await hmac(key, 'aws4_request')\n  const signature = hex(await hmac(key, stringToSign))\n  return {\n    authorization:\n      `AWS4-HMAC-SHA256 Credential=${credentials.accessKeyId}/${scope}, ` +\n      `SignedHeaders=${signedHeaders}, Signature=${signature}`,\n    'x-amz-date': date,\n    'x-amz-content-sha256': request.payloadHash,\n  }\n}\n"],"names":["EMPTY_PAYLOAD_SHA256","UNSIGNED_PAYLOAD","encoder","TextEncoder","hex","bytes","Array","from","Uint8Array","byte","toString","padStart","join","sha256Hex","text","crypto","subtle","digest","encode","hmac","key","imported","importKey","name","hash","sign","encodeRfc3986","value","encodeURIComponent","replace","character","charCodeAt","toUpperCase","amzDate","now","toISOString","signSigV4","request","credentials","date","day","slice","signed","Object","entries","headers","toLowerCase","String","trim","url","host","payloadHash","names","keys","sort","canonicalHeaders","map","signedHeaders","query","searchParams","a","x","b","y","canonicalRequest","method","pathname","scope","region","service","stringToSign","secretAccessKey","signature","authorization","accessKeyId"],"mappings":"AAAA;;;;;;;;;;;;;;;CAeC,GAED;;;;;;;;;;;;CAYC,GAED,sEAAsE,GACtE,OAAO,MAAMA,uBACX,mEAAkE;AAEpE,0EAA0E,GAC1E,OAAO,MAAMC,mBAAmB,mBAAkB;AAmBlD,MAAMC,UAAU,IAAIC;AAEpB,SAASC,IAAIC,KAA+B;IAC1C,OAAOC,MAAMC,IAAI,CAACF,iBAAiBG,aAAaH,QAAQ,IAAIG,WAAWH,QAAQ,CAACI,OAC9EA,KAAKC,QAAQ,CAAC,IAAIC,QAAQ,CAAC,GAAG,MAC9BC,IAAI,CAAC;AACT;AAEA,eAAeC,UAAUC,IAAY;IACnC,OAAOV,IAAI,MAAMW,OAAOC,MAAM,CAACC,MAAM,CAAC,WAAWf,QAAQgB,MAAM,CAACJ;AAClE;AAEA,eAAeK,KACbC,GAAqC,EACrCN,IAAY;IAEZ,MAAMO,WAAW,MAAMN,OAAOC,MAAM,CAACM,SAAS,CAC5C,OACA,OAAOF,QAAQ,WAAWlB,QAAQgB,MAAM,CAACE,OAAOA,KAChD;QAAEG,MAAM;QAAQC,MAAM;IAAU,GAChC,OACA;QAAC;KAAO;IAEV,OAAO,IAAIhB,WAAW,MAAMO,OAAOC,MAAM,CAACS,IAAI,CAAC,QAAQJ,UAAUnB,QAAQgB,MAAM,CAACJ;AAClF;AAEA,2EAA2E,GAC3E,OAAO,SAASY,cAAcC,KAAa;IACzC,OAAOC,mBAAmBD,OAAOE,OAAO,CACtC,YACA,CAACC,YAAc,CAAC,CAAC,EAAEA,UAAUC,UAAU,CAAC,GAAGrB,QAAQ,CAAC,IAAIsB,WAAW,IAAI;AAE3E;AAEA,wBAAwB,GACxB,SAASC,QAAQC,GAAS;IACxB,OAAOA,IAAIC,WAAW,GAAGN,OAAO,CAAC,SAAS,IAAIA,OAAO,CAAC,WAAW;AACnE;AAEA;;;;;CAKC,GACD,OAAO,eAAeO,UACpBC,OAAqB,EACrBC,WAA6B;QAKcD;IAH3C,MAAME,OAAON,QAAQI,QAAQH,GAAG;IAChC,MAAMM,MAAMD,KAAKE,KAAK,CAAC,GAAG;IAC1B,MAAMC,SAAiC,CAAC;IACxC,KAAK,MAAM,CAACnB,MAAMI,MAAM,IAAIgB,OAAOC,OAAO,EAACP,mBAAAA,QAAQQ,OAAO,YAAfR,mBAAmB,CAAC,GAAI;QACjEK,MAAM,CAACnB,KAAKuB,WAAW,GAAG,GAAGC,OAAOpB,OAAOqB,IAAI,GAAGnB,OAAO,CAAC,QAAQ;IACpE;IACAa,MAAM,CAAC,OAAO,GAAGL,QAAQY,GAAG,CAACC,IAAI;IACjCR,MAAM,CAAC,aAAa,GAAGH;IACvBG,MAAM,CAAC,uBAAuB,GAAGL,QAAQc,WAAW;IACpD,MAAMC,QAAQT,OAAOU,IAAI,CAACX,QAAQY,IAAI;IACtC,MAAMC,mBAAmBH,MAAMI,GAAG,CAAC,CAACjC,OAAS,GAAGA,KAAK,CAAC,EAAEmB,MAAM,CAACnB,KAAK,CAAC,EAAE,CAAC,EAAEX,IAAI,CAAC;IAC/E,MAAM6C,gBAAgBL,MAAMxC,IAAI,CAAC;IACjC,MAAM8C,QAAQ;WAAIrB,QAAQY,GAAG,CAACU,YAAY,CAACf,OAAO;KAAG,CAClDY,GAAG,CAAC,CAAC,CAACjC,MAAMI,MAAM,GAAK;YAACD,cAAcH;YAAOG,cAAcC;SAAO,EAClE2B,IAAI,CAAC,CAAC,CAACM,GAAGC,EAAE,EAAE,CAACC,GAAGC,EAAE,GAAMH,IAAIE,IAAI,CAAC,IAAIF,IAAIE,IAAI,IAAID,IAAIE,IAAI,CAAC,IAAIF,IAAIE,IAAI,IAAI,GAC5EP,GAAG,CAAC,CAAC,CAACjC,MAAMI,MAAM,GAAK,GAAGJ,KAAK,CAAC,EAAEI,OAAO,EACzCf,IAAI,CAAC;IACR,MAAMoD,mBAAmB;QACvB3B,QAAQ4B,MAAM,CAACjC,WAAW;QAC1BK,QAAQY,GAAG,CAACiB,QAAQ,IAAI;QACxBR;QACAH;QACAE;QACApB,QAAQc,WAAW;KACpB,CAACvC,IAAI,CAAC;IACP,MAAMuD,QAAQ,GAAG3B,IAAI,CAAC,EAAEH,QAAQ+B,MAAM,CAAC,CAAC,EAAE/B,QAAQgC,OAAO,CAAC,aAAa,CAAC;IACxE,MAAMC,eAAe;QACnB;QACA/B;QACA4B;QACA,MAAMtD,UAAUmD;KACjB,CAACpD,IAAI,CAAC;IACP,IAAIQ,MAAM,MAAMD,KAAK,CAAC,IAAI,EAAEmB,YAAYiC,eAAe,EAAE,EAAE/B;IAC3DpB,MAAM,MAAMD,KAAKC,KAAKiB,QAAQ+B,MAAM;IACpChD,MAAM,MAAMD,KAAKC,KAAKiB,QAAQgC,OAAO;IACrCjD,MAAM,MAAMD,KAAKC,KAAK;IACtB,MAAMoD,YAAYpE,IAAI,MAAMe,KAAKC,KAAKkD;IACtC,OAAO;QACLG,eACE,CAAC,4BAA4B,EAAEnC,YAAYoC,WAAW,CAAC,CAAC,EAAEP,MAAM,EAAE,CAAC,GACnE,CAAC,cAAc,EAAEV,cAAc,YAAY,EAAEe,WAAW;QAC1D,cAAcjC;QACd,wBAAwBF,QAAQc,WAAW;IAC7C;AACF"}

package/src/lib/video-delivery-provider.d.ts

@@ -0,0 +1,59 @@
+/**
+ * @license
+ * Copyright 2026 Aglyn LLC
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *   http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+import type { MediaDeliveryCapability, MediaDeliveryProvider } from '@aglyn/aglyn/plugin-manager/media-delivery-provider';
+/**
+ * Core's media delivery provider, on Cloudflare R2 and a Worker (AGL-2824).
+ *
+ * `store` is R2's S3 API with a bucket-scoped key pair; `deliver` is a token
+ * the Worker on the delivery host verifies before it serves the object from
+ * its bucket binding. The two capabilities read different settings, so a
+ * deployment can hold the R2 key pair only where copies are written — the
+ * console — and the delivery secret wherever a URL is minted.
+ *
+ * Settings are read from the environment on every call rather than once, so
+ * a deployment that gains or loses them behaves accordingly without a
+ * restart, and each read is a handful of property lookups.
+ */
+export interface VideoDeliverySettings {
+    accountId: string;
+    accessKeyId: string;
+    secretAccessKey: string;
+    bucket: string;
+    /** A bare hostname, or an origin; see {@link videoDeliveryOrigin}. */
+    deliveryHost: string;
+    deliverySecret: string;
+}
+/** The provider's settings, from this process's environment. */
+export declare function videoDeliverySettingsFromEnv(): VideoDeliverySettings;
+/**
+ * The origin delivery URLs are minted on, or null for a setting that is not
+ * one.
+ *
+ * A bare hostname (`video.example.workers.dev`) means HTTPS. A full origin is
+ * accepted too, which is what a local `wrangler dev` needs: HTTPS anywhere,
+ * or HTTP on the loopback host only. Anything with a path, a query or
+ * credentials is refused rather than trimmed, because a URL minted on a
+ * guess is a URL that points somewhere nobody chose.
+ */
+export declare function videoDeliveryOrigin(host: string): string | null;
+/** Whether `settings` hold everything `capability` needs. */
+export declare function videoDeliveryConfigured(settings: VideoDeliverySettings, capability: MediaDeliveryCapability): boolean;
+export declare function createVideoDeliveryProvider(options?: {
+    settings?: () => VideoDeliverySettings;
+    fetch?: typeof fetch;
+    now?: () => number;
+}): MediaDeliveryProvider;

package/src/lib/video-delivery-provider.js

@@ -0,0 +1,107 @@
+/**
+ * @license
+ * Copyright 2026 Aglyn LLC
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *   http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */ import { _ as _extends } from "@swc/helpers/_/_extends";
+import { DELIVERY_SECRET_MIN_LENGTH, DELIVERY_TOKEN_PARAM, mintDeliveryToken } from "./delivery-token.js";
+import { createR2ObjectStore, deleteR2Prefix, r2CredentialsUsable } from "./r2-object-store.js";
+import { encodeRfc3986 } from "./sigv4.js";
+/** The provider's settings, from this process's environment. */ export function videoDeliverySettingsFromEnv() {
+    var _process_env_R2_ACCOUNT_ID, _process_env_R2_ACCESS_KEY_ID, _process_env_R2_SECRET_ACCESS_KEY, _process_env_R2_VIDEO_BUCKET, _process_env_MEDIA_VIDEO_DELIVERY_HOST, _process_env_MEDIA_VIDEO_DELIVERY_SECRET;
+    return {
+        accountId: ((_process_env_R2_ACCOUNT_ID = process.env['R2_ACCOUNT_ID']) != null ? _process_env_R2_ACCOUNT_ID : '').trim(),
+        accessKeyId: ((_process_env_R2_ACCESS_KEY_ID = process.env['R2_ACCESS_KEY_ID']) != null ? _process_env_R2_ACCESS_KEY_ID : '').trim(),
+        secretAccessKey: ((_process_env_R2_SECRET_ACCESS_KEY = process.env['R2_SECRET_ACCESS_KEY']) != null ? _process_env_R2_SECRET_ACCESS_KEY : '').trim(),
+        bucket: ((_process_env_R2_VIDEO_BUCKET = process.env['R2_VIDEO_BUCKET']) != null ? _process_env_R2_VIDEO_BUCKET : '').trim(),
+        deliveryHost: ((_process_env_MEDIA_VIDEO_DELIVERY_HOST = process.env['MEDIA_VIDEO_DELIVERY_HOST']) != null ? _process_env_MEDIA_VIDEO_DELIVERY_HOST : '').trim(),
+        deliverySecret: ((_process_env_MEDIA_VIDEO_DELIVERY_SECRET = process.env['MEDIA_VIDEO_DELIVERY_SECRET']) != null ? _process_env_MEDIA_VIDEO_DELIVERY_SECRET : '').trim()
+    };
+}
+/**
+ * The origin delivery URLs are minted on, or null for a setting that is not
+ * one.
+ *
+ * A bare hostname (`video.example.workers.dev`) means HTTPS. A full origin is
+ * accepted too, which is what a local `wrangler dev` needs: HTTPS anywhere,
+ * or HTTP on the loopback host only. Anything with a path, a query or
+ * credentials is refused rather than trimmed, because a URL minted on a
+ * guess is a URL that points somewhere nobody chose.
+ */ export function videoDeliveryOrigin(host) {
+    const value = host.trim();
+    if (!value) return null;
+    if (value.includes('://')) {
+        let url;
+        try {
+            url = new URL(value);
+        } catch (unused) {
+            return null;
+        }
+        if (url.username || url.password || url.search || url.hash) return null;
+        if (url.pathname !== '/' && url.pathname !== '') return null;
+        const loopback = url.hostname === 'localhost' || url.hostname === '127.0.0.1';
+        if (url.protocol === 'https:' || url.protocol === 'http:' && loopback) {
+            return url.origin;
+        }
+        return null;
+    }
+    if (!/^[a-z0-9](?:[a-z0-9.-]{0,251}[a-z0-9])?(?::\d{1,5})?$/i.test(value)) return null;
+    return `https://${value.toLowerCase()}`;
+}
+/** Whether `settings` hold everything `capability` needs. */ export function videoDeliveryConfigured(settings, capability) {
+    if (capability === 'deliver') {
+        return videoDeliveryOrigin(settings.deliveryHost) !== null && settings.deliverySecret.length >= DELIVERY_SECRET_MIN_LENGTH;
+    }
+    return r2CredentialsUsable(settings);
+}
+export function createVideoDeliveryProvider(options = {}) {
+    var _options_settings, _options_now;
+    const settings = (_options_settings = options.settings) != null ? _options_settings : videoDeliverySettingsFromEnv;
+    const now = (_options_now = options.now) != null ? _options_now : Date.now;
+    /** The object store for the current settings; throws when unconfigured. */ const store = ()=>{
+        const current = settings();
+        if (!videoDeliveryConfigured(current, 'store')) {
+            throw new Error('Video delivery storage is not configured');
+        }
+        return createR2ObjectStore(current, _extends({}, options.fetch ? {
+            fetch: options.fetch
+        } : {}, {
+            now: ()=>new Date(now())
+        }));
+    };
+    return {
+        isConfigured: (capability)=>videoDeliveryConfigured(settings(), capability),
+        putObject: (request)=>store().putObject(request),
+        deleteObject: (key)=>store().deleteObject(key),
+        deleteObjectsWithPrefix: (prefix)=>deleteR2Prefix(store(), prefix),
+        async deliveryUrl ({ key, expiresAtMs, claims }) {
+            const current = settings();
+            const origin = videoDeliveryOrigin(current.deliveryHost);
+            if (!origin || !videoDeliveryConfigured(current, 'deliver')) {
+                throw new Error('Video delivery is not configured');
+            }
+            const token = await mintDeliveryToken({
+                key,
+                expiresAtMs,
+                orgId: claims.orgId,
+                hostId: claims.hostId,
+                mediaId: claims.mediaId,
+                scope: claims.scope
+            }, current.deliverySecret, now());
+            const path = key.split('/').map(encodeRfc3986).join('/');
+            return `${origin}/${path}?${DELIVERY_TOKEN_PARAM}=${token}`;
+        }
+    };
+}
+
+//# sourceMappingURL=video-delivery-provider.js.map

package/src/lib/video-delivery-provider.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../../../../../../libs/plugins/video-delivery/src/lib/video-delivery-provider.ts"],"sourcesContent":["/**\n * @license\n * Copyright 2026 Aglyn LLC\n *\n * Licensed under the Apache License, Version 2.0 (the \"License\");\n * you may not use this file except in compliance with the License.\n * You may obtain a copy of the License at\n *\n *   http://www.apache.org/licenses/LICENSE-2.0\n *\n * Unless required by applicable law or agreed to in writing, software\n * distributed under the License is distributed on an \"AS IS\" BASIS,\n * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.\n * See the License for the specific language governing permissions and\n * limitations under the License.\n */\n\nimport type {\n  MediaDeliveryCapability,\n  MediaDeliveryProvider,\n} from '@aglyn/aglyn/plugin-manager/media-delivery-provider'\nimport {\n  DELIVERY_SECRET_MIN_LENGTH,\n  DELIVERY_TOKEN_PARAM,\n  mintDeliveryToken,\n} from './delivery-token'\nimport {\n  createR2ObjectStore,\n  deleteR2Prefix,\n  r2CredentialsUsable,\n  type R2ObjectStore,\n} from './r2-object-store'\nimport { encodeRfc3986 } from './sigv4'\n\n/**\n * Core's media delivery provider, on Cloudflare R2 and a Worker (AGL-2824).\n *\n * `store` is R2's S3 API with a bucket-scoped key pair; `deliver` is a token\n * the Worker on the delivery host verifies before it serves the object from\n * its bucket binding. The two capabilities read different settings, so a\n * deployment can hold the R2 key pair only where copies are written — the\n * console — and the delivery secret wherever a URL is minted.\n *\n * Settings are read from the environment on every call rather than once, so\n * a deployment that gains or loses them behaves accordingly without a\n * restart, and each read is a handful of property lookups.\n */\n\nexport interface VideoDeliverySettings {\n  accountId: string\n  accessKeyId: string\n  secretAccessKey: string\n  bucket: string\n  /** A bare hostname, or an origin; see {@link videoDeliveryOrigin}. */\n  deliveryHost: string\n  deliverySecret: string\n}\n\n/** The provider's settings, from this process's environment. */\nexport function videoDeliverySettingsFromEnv(): VideoDeliverySettings {\n  return {\n    accountId: (process.env['R2_ACCOUNT_ID'] ?? '').trim(),\n    accessKeyId: (process.env['R2_ACCESS_KEY_ID'] ?? '').trim(),\n    secretAccessKey: (process.env['R2_SECRET_ACCESS_KEY'] ?? '').trim(),\n    bucket: (process.env['R2_VIDEO_BUCKET'] ?? '').trim(),\n    deliveryHost: (process.env['MEDIA_VIDEO_DELIVERY_HOST'] ?? '').trim(),\n    deliverySecret: (process.env['MEDIA_VIDEO_DELIVERY_SECRET'] ?? '').trim(),\n  }\n}\n\n/**\n * The origin delivery URLs are minted on, or null for a setting that is not\n * one.\n *\n * A bare hostname (`video.example.workers.dev`) means HTTPS. A full origin is\n * accepted too, which is what a local `wrangler dev` needs: HTTPS anywhere,\n * or HTTP on the loopback host only. Anything with a path, a query or\n * credentials is refused rather than trimmed, because a URL minted on a\n * guess is a URL that points somewhere nobody chose.\n */\nexport function videoDeliveryOrigin(host: string): string | null {\n  const value = host.trim()\n  if (!value) return null\n  if (value.includes('://')) {\n    let url: URL\n    try {\n      url = new URL(value)\n    } catch {\n      return null\n    }\n    if (url.username || url.password || url.search || url.hash) return null\n    if (url.pathname !== '/' && url.pathname !== '') return null\n    const loopback = url.hostname === 'localhost' || url.hostname === '127.0.0.1'\n    if (url.protocol === 'https:' || (url.protocol === 'http:' && loopback)) {\n      return url.origin\n    }\n    return null\n  }\n  if (!/^[a-z0-9](?:[a-z0-9.-]{0,251}[a-z0-9])?(?::\\d{1,5})?$/i.test(value)) return null\n  return `https://${value.toLowerCase()}`\n}\n\n/** Whether `settings` hold everything `capability` needs. */\nexport function videoDeliveryConfigured(\n  settings: VideoDeliverySettings,\n  capability: MediaDeliveryCapability,\n): boolean {\n  if (capability === 'deliver') {\n    return (\n      videoDeliveryOrigin(settings.deliveryHost) !== null &&\n      settings.deliverySecret.length >= DELIVERY_SECRET_MIN_LENGTH\n    )\n  }\n  return r2CredentialsUsable(settings)\n}\n\nexport function createVideoDeliveryProvider(\n  options: {\n    settings?: () => VideoDeliverySettings\n    fetch?: typeof fetch\n    now?: () => number\n  } = {},\n): MediaDeliveryProvider {\n  const settings = options.settings ?? videoDeliverySettingsFromEnv\n  const now = options.now ?? Date.now\n\n  /** The object store for the current settings; throws when unconfigured. */\n  const store = (): R2ObjectStore => {\n    const current = settings()\n    if (!videoDeliveryConfigured(current, 'store')) {\n      throw new Error('Video delivery storage is not configured')\n    }\n    return createR2ObjectStore(current, {\n      ...(options.fetch ? { fetch: options.fetch } : {}),\n      now: () => new Date(now()),\n    })\n  }\n\n  return {\n    isConfigured: (capability) => videoDeliveryConfigured(settings(), capability),\n\n    putObject: (request) => store().putObject(request),\n\n    deleteObject: (key) => store().deleteObject(key),\n\n    deleteObjectsWithPrefix: (prefix) => deleteR2Prefix(store(), prefix),\n\n    async deliveryUrl({ key, expiresAtMs, claims }) {\n      const current = settings()\n      const origin = videoDeliveryOrigin(current.deliveryHost)\n      if (!origin || !videoDeliveryConfigured(current, 'deliver')) {\n        throw new Error('Video delivery is not configured')\n      }\n      const token = await mintDeliveryToken(\n        {\n          key,\n          expiresAtMs,\n          orgId: claims.orgId,\n          hostId: claims.hostId,\n          mediaId: claims.mediaId,\n          scope: claims.scope,\n        },\n        current.deliverySecret,\n        now(),\n      )\n      const path = key.split('/').map(encodeRfc3986).join('/')\n      return `${origin}/${path}?${DELIVERY_TOKEN_PARAM}=${token}`\n    },\n  }\n}\n"],"names":["DELIVERY_SECRET_MIN_LENGTH","DELIVERY_TOKEN_PARAM","mintDeliveryToken","createR2ObjectStore","deleteR2Prefix","r2CredentialsUsable","encodeRfc3986","videoDeliverySettingsFromEnv","process","accountId","env","trim","accessKeyId","secretAccessKey","bucket","deliveryHost","deliverySecret","videoDeliveryOrigin","host","value","includes","url","URL","username","password","search","hash","pathname","loopback","hostname","protocol","origin","test","toLowerCase","videoDeliveryConfigured","settings","capability","length","createVideoDeliveryProvider","options","now","Date","store","current","Error","fetch","isConfigured","putObject","request","deleteObject","key","deleteObjectsWithPrefix","prefix","deliveryUrl","expiresAtMs","claims","token","orgId","hostId","mediaId","scope","path","split","map","join"],"mappings":"AAAA;;;;;;;;;;;;;;;CAeC;AAMD,SACEA,0BAA0B,EAC1BC,oBAAoB,EACpBC,iBAAiB,QACZ,sBAAkB;AACzB,SACEC,mBAAmB,EACnBC,cAAc,EACdC,mBAAmB,QAEd,uBAAmB;AAC1B,SAASC,aAAa,QAAQ,aAAS;AA0BvC,8DAA8D,GAC9D,OAAO,SAASC;QAEAC,4BACEA,+BACIA,mCACTA,8BACMA,wCACEA;IANnB,OAAO;QACLC,WAAW,EAACD,6BAAAA,QAAQE,GAAG,CAAC,gBAAgB,YAA5BF,6BAAgC,IAAIG,IAAI;QACpDC,aAAa,EAACJ,gCAAAA,QAAQE,GAAG,CAAC,mBAAmB,YAA/BF,gCAAmC,IAAIG,IAAI;QACzDE,iBAAiB,EAACL,oCAAAA,QAAQE,GAAG,CAAC,uBAAuB,YAAnCF,oCAAuC,IAAIG,IAAI;QACjEG,QAAQ,EAACN,+BAAAA,QAAQE,GAAG,CAAC,kBAAkB,YAA9BF,+BAAkC,IAAIG,IAAI;QACnDI,cAAc,EAACP,yCAAAA,QAAQE,GAAG,CAAC,4BAA4B,YAAxCF,yCAA4C,IAAIG,IAAI;QACnEK,gBAAgB,EAACR,2CAAAA,QAAQE,GAAG,CAAC,8BAA8B,YAA1CF,2CAA8C,IAAIG,IAAI;IACzE;AACF;AAEA;;;;;;;;;CASC,GACD,OAAO,SAASM,oBAAoBC,IAAY;IAC9C,MAAMC,QAAQD,KAAKP,IAAI;IACvB,IAAI,CAACQ,OAAO,OAAO;IACnB,IAAIA,MAAMC,QAAQ,CAAC,QAAQ;QACzB,IAAIC;QACJ,IAAI;YACFA,MAAM,IAAIC,IAAIH;QAChB,EAAE,eAAM;YACN,OAAO;QACT;QACA,IAAIE,IAAIE,QAAQ,IAAIF,IAAIG,QAAQ,IAAIH,IAAII,MAAM,IAAIJ,IAAIK,IAAI,EAAE,OAAO;QACnE,IAAIL,IAAIM,QAAQ,KAAK,OAAON,IAAIM,QAAQ,KAAK,IAAI,OAAO;QACxD,MAAMC,WAAWP,IAAIQ,QAAQ,KAAK,eAAeR,IAAIQ,QAAQ,KAAK;QAClE,IAAIR,IAAIS,QAAQ,KAAK,YAAaT,IAAIS,QAAQ,KAAK,WAAWF,UAAW;YACvE,OAAOP,IAAIU,MAAM;QACnB;QACA,OAAO;IACT;IACA,IAAI,CAAC,yDAAyDC,IAAI,CAACb,QAAQ,OAAO;IAClF,OAAO,CAAC,QAAQ,EAAEA,MAAMc,WAAW,IAAI;AACzC;AAEA,2DAA2D,GAC3D,OAAO,SAASC,wBACdC,QAA+B,EAC/BC,UAAmC;IAEnC,IAAIA,eAAe,WAAW;QAC5B,OACEnB,oBAAoBkB,SAASpB,YAAY,MAAM,QAC/CoB,SAASnB,cAAc,CAACqB,MAAM,IAAIrC;IAEtC;IACA,OAAOK,oBAAoB8B;AAC7B;AAEA,OAAO,SAASG,4BACdC,UAII,CAAC,CAAC;QAEWA,mBACLA;IADZ,MAAMJ,YAAWI,oBAAAA,QAAQJ,QAAQ,YAAhBI,oBAAoBhC;IACrC,MAAMiC,OAAMD,eAAAA,QAAQC,GAAG,YAAXD,eAAeE,KAAKD,GAAG;IAEnC,yEAAyE,GACzE,MAAME,QAAQ;QACZ,MAAMC,UAAUR;QAChB,IAAI,CAACD,wBAAwBS,SAAS,UAAU;YAC9C,MAAM,IAAIC,MAAM;QAClB;QACA,OAAOzC,oBAAoBwC,SAAS,aAC9BJ,QAAQM,KAAK,GAAG;YAAEA,OAAON,QAAQM,KAAK;QAAC,IAAI,CAAC;YAChDL,KAAK,IAAM,IAAIC,KAAKD;;IAExB;IAEA,OAAO;QACLM,cAAc,CAACV,aAAeF,wBAAwBC,YAAYC;QAElEW,WAAW,CAACC,UAAYN,QAAQK,SAAS,CAACC;QAE1CC,cAAc,CAACC,MAAQR,QAAQO,YAAY,CAACC;QAE5CC,yBAAyB,CAACC,SAAWhD,eAAesC,SAASU;QAE7D,MAAMC,aAAY,EAAEH,GAAG,EAAEI,WAAW,EAAEC,MAAM,EAAE;YAC5C,MAAMZ,UAAUR;YAChB,MAAMJ,SAASd,oBAAoB0B,QAAQ5B,YAAY;YACvD,IAAI,CAACgB,UAAU,CAACG,wBAAwBS,SAAS,YAAY;gBAC3D,MAAM,IAAIC,MAAM;YAClB;YACA,MAAMY,QAAQ,MAAMtD,kBAClB;gBACEgD;gBACAI;gBACAG,OAAOF,OAAOE,KAAK;gBACnBC,QAAQH,OAAOG,MAAM;gBACrBC,SAASJ,OAAOI,OAAO;gBACvBC,OAAOL,OAAOK,KAAK;YACrB,GACAjB,QAAQ3B,cAAc,EACtBwB;YAEF,MAAMqB,OAAOX,IAAIY,KAAK,CAAC,KAAKC,GAAG,CAACzD,eAAe0D,IAAI,CAAC;YACpD,OAAO,GAAGjC,OAAO,CAAC,EAAE8B,KAAK,CAAC,EAAE5D,qBAAqB,CAAC,EAAEuD,OAAO;QAC7D;IACF;AACF"}

package/src/lib/worker/r2-binding.d.ts

@@ -0,0 +1,48 @@
+/**
+ * @license
+ * Copyright 2026 Aglyn LLC
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *   http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+/**
+ * The slice of the Workers R2 binding the delivery Worker calls, typed here
+ * rather than taken from `@cloudflare/workers-types`: the Worker needs two
+ * methods, and a spec satisfies these with an in-memory bucket.
+ *
+ * The shapes follow the binding's documented `R2Bucket.head` and
+ * `R2Bucket.get`: `head` answers the object's metadata or null, and `get`
+ * answers the object with a body, or null when the key does not exist. A
+ * ranged `get` returns only the bytes in `range`.
+ */
+export interface R2ObjectMetadata {
+    key: string;
+    /** The whole object's size, whatever range was read. */
+    size: number;
+    /** The object's ETag, quoted, ready for an `ETag` header. */
+    httpEtag: string;
+    httpMetadata?: {
+        contentType?: string;
+    };
+}
+export interface R2ObjectWithBody extends R2ObjectMetadata {
+    body: ReadableStream<Uint8Array>;
+}
+export interface R2BucketBinding {
+    head(key: string): Promise<R2ObjectMetadata | null>;
+    get(key: string, options?: {
+        range?: {
+            offset: number;
+            length?: number;
+        };
+    }): Promise<R2ObjectWithBody | null>;
+}

package/src/lib/worker/r2-binding.js

@@ -0,0 +1,27 @@
+/**
+ * @license
+ * Copyright 2026 Aglyn LLC
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *   http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */ /**
+ * The slice of the Workers R2 binding the delivery Worker calls, typed here
+ * rather than taken from `@cloudflare/workers-types`: the Worker needs two
+ * methods, and a spec satisfies these with an in-memory bucket.
+ *
+ * The shapes follow the binding's documented `R2Bucket.head` and
+ * `R2Bucket.get`: `head` answers the object's metadata or null, and `get`
+ * answers the object with a body, or null when the key does not exist. A
+ * ranged `get` returns only the bytes in `range`.
+ */ export { };
+
+//# sourceMappingURL=r2-binding.js.map

package/src/lib/worker/r2-binding.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../../../../../../../libs/plugins/video-delivery/src/lib/worker/r2-binding.ts"],"sourcesContent":["/**\n * @license\n * Copyright 2026 Aglyn LLC\n *\n * Licensed under the Apache License, Version 2.0 (the \"License\");\n * you may not use this file except in compliance with the License.\n * You may obtain a copy of the License at\n *\n *   http://www.apache.org/licenses/LICENSE-2.0\n *\n * Unless required by applicable law or agreed to in writing, software\n * distributed under the License is distributed on an \"AS IS\" BASIS,\n * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.\n * See the License for the specific language governing permissions and\n * limitations under the License.\n */\n\n/**\n * The slice of the Workers R2 binding the delivery Worker calls, typed here\n * rather than taken from `@cloudflare/workers-types`: the Worker needs two\n * methods, and a spec satisfies these with an in-memory bucket.\n *\n * The shapes follow the binding's documented `R2Bucket.head` and\n * `R2Bucket.get`: `head` answers the object's metadata or null, and `get`\n * answers the object with a body, or null when the key does not exist. A\n * ranged `get` returns only the bytes in `range`.\n */\n\nexport interface R2ObjectMetadata {\n  key: string\n  /** The whole object's size, whatever range was read. */\n  size: number\n  /** The object's ETag, quoted, ready for an `ETag` header. */\n  httpEtag: string\n  httpMetadata?: { contentType?: string }\n}\n\nexport interface R2ObjectWithBody extends R2ObjectMetadata {\n  body: ReadableStream<Uint8Array>\n}\n\nexport interface R2BucketBinding {\n  head(key: string): Promise<R2ObjectMetadata | null>\n  get(\n    key: string,\n    options?: { range?: { offset: number; length?: number } },\n  ): Promise<R2ObjectWithBody | null>\n}\n"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;CAeC,GAED;;;;;;;;;CASC,GAeD,WAMC"}

package/src/lib/worker/video-worker.d.ts

@@ -0,0 +1,74 @@
+/**
+ * @license
+ * Copyright 2026 Aglyn LLC
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *   http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+import type { R2BucketBinding } from './r2-binding';
+/**
+ * The delivery Worker (AGL-2824): serves one R2 object to the holder of a
+ * token minted for it.
+ *
+ * `wrangler.jsonc` at the plugin's root deploys this file as the Worker named
+ * `video`, with the `aglyn-video` bucket bound as `VIDEO_BUCKET` and the
+ * delivery secret set as the Worker secret `MEDIA_VIDEO_DELIVERY_SECRET` —
+ * the same value the platform mints with.
+ *
+ * ## One request
+ *
+ * `GET|HEAD /{key}?token={token}`. The token is verified before the bucket is
+ * touched, and it must name exactly the key in the path:
+ *
+ * - no secret configured: `503`;
+ * - a token that does not verify — malformed, altered, expired, signed with
+ *   another secret, or claiming a lifetime no minter issues: `403`;
+ * - a genuine token for another object, or an object the bucket does not
+ *   hold: `404`.
+ *
+ * A refusal has no body, so it says nothing about which of those it was
+ * beyond its status.
+ *
+ * ## Ranges
+ *
+ * A single `bytes=` range is answered `206` with `Content-Range`, the same
+ * three forms the platform's CDN route honors (`a-b`, `a-`, `-n`); a range
+ * past the end is `416`; anything else — several ranges, another unit,
+ * malformed syntax, an `If-Range` that does not match — is ignored and the
+ * whole object is sent, which RFC 9110 allows and no client can misread.
+ * Every response says `Accept-Ranges: bytes`.
+ *
+ * ## Caching
+ *
+ * `private`, for at most as long as the token has left: a viewer's browser
+ * may keep the ranges it fetched for the life of the URL that fetched them,
+ * and no shared cache — Cloudflare's included — holds anything. So a
+ * takedown that removes the object leaves nothing to purge.
+ */
+export interface VideoWorkerEnv {
+    VIDEO_BUCKET: R2BucketBinding;
+    MEDIA_VIDEO_DELIVERY_SECRET?: string;
+}
+type ParsedRange = {
+    start: number;
+    end: number;
+} | 'unsatisfiable' | null;
+/**
+ * One `bytes=` range against an object of `size` bytes, both ends inclusive,
+ * with the platform CDN's semantics: `null` means serve the whole object.
+ */
+export declare function parseByteRange(header: string | null, size: number): ParsedRange;
+export declare function handleVideoRequest(request: Request, env: VideoWorkerEnv, nowMs?: number): Promise<Response>;
+declare const _default: {
+    fetch(request: Request, env: VideoWorkerEnv): Promise<Response>;
+};
+export default _default;

package/src/lib/worker/video-worker.js

@@ -0,0 +1,174 @@
+/**
+ * @license
+ * Copyright 2026 Aglyn LLC
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *   http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */ import { DELIVERY_TOKEN_PARAM, verifyDeliveryToken } from "../delivery-token.js";
+/**
+ * The same base policy the platform's media CDN sets on every response
+ * (`MEDIA_CDN_BASE_CSP`), restated because the Worker bundles nothing from
+ * the platform: a film opened as a top-level document can run nothing.
+ */ const CONTENT_SECURITY_POLICY = "default-src 'none'; script-src 'none'; object-src 'none'; " + "base-uri 'none'; form-action 'none'";
+/** The longest a browser may keep a response, whatever the token has left. */ const MAX_BROWSER_CACHE_SECONDS = 60 * 60;
+/** Headers every answer carries, refusals included. */ function baseHeaders() {
+    return new Headers({
+        'access-control-allow-origin': '*',
+        'x-content-type-options': 'nosniff',
+        'content-security-policy': CONTENT_SECURITY_POLICY
+    });
+}
+function refusal(status, extra = {}) {
+    const headers = baseHeaders();
+    headers.set('cache-control', 'no-store');
+    for (const [name, value] of Object.entries(extra))headers.set(name, value);
+    return new Response(null, {
+        status,
+        headers
+    });
+}
+/**
+ * One `bytes=` range against an object of `size` bytes, both ends inclusive,
+ * with the platform CDN's semantics: `null` means serve the whole object.
+ */ export function parseByteRange(header, size) {
+    var _unit_, _specs_;
+    if (!header) return null;
+    const unit = /^bytes=(.*)$/i.exec(header.trim());
+    if (!unit) return null;
+    const specs = ((_unit_ = unit[1]) != null ? _unit_ : '').split(',');
+    if (specs.length !== 1) return null;
+    const spec = /^(\d*)-(\d*)$/.exec(((_specs_ = specs[0]) != null ? _specs_ : '').trim());
+    if (!spec) return null;
+    const [, startRaw = '', endRaw = ''] = spec;
+    if (!startRaw && !endRaw) return null;
+    if (!startRaw) {
+        const suffix = Number(endRaw);
+        if (!Number.isSafeInteger(suffix)) return null;
+        if (suffix === 0 || size === 0) return 'unsatisfiable';
+        return {
+            start: Math.max(0, size - suffix),
+            end: size - 1
+        };
+    }
+    const start = Number(startRaw);
+    if (!Number.isSafeInteger(start)) return null;
+    const end = endRaw ? Number(endRaw) : size - 1;
+    if (!Number.isSafeInteger(end)) return null;
+    if (endRaw && end < start) return null;
+    if (start >= size) return 'unsatisfiable';
+    return {
+        start,
+        end: Math.min(end, size - 1)
+    };
+}
+/** The object key a path names, or null for one that cannot be decoded. */ function keyFromPath(pathname) {
+    try {
+        const key = pathname.replace(/^\/+/, '').split('/').map(decodeURIComponent).join('/');
+        return key && !key.split('/').includes('..') ? key : null;
+    } catch (unused) {
+        return null;
+    }
+}
+function objectHeaders(object, maxAgeSeconds) {
+    var _object_httpMetadata;
+    const headers = baseHeaders();
+    headers.set('content-type', ((_object_httpMetadata = object.httpMetadata) == null ? void 0 : _object_httpMetadata.contentType) || 'application/octet-stream');
+    headers.set('accept-ranges', 'bytes');
+    headers.set('etag', object.httpEtag);
+    headers.set('cache-control', `private, max-age=${maxAgeSeconds}`);
+    headers.set('access-control-expose-headers', 'accept-ranges, content-length, content-range, etag');
+    return headers;
+}
+export async function handleVideoRequest(request, env, nowMs = Date.now()) {
+    if (request.method === 'OPTIONS') {
+        const headers = baseHeaders();
+        headers.set('access-control-allow-methods', 'GET, HEAD, OPTIONS');
+        headers.set('access-control-allow-headers', 'range, if-range');
+        headers.set('access-control-max-age', '86400');
+        return new Response(null, {
+            status: 204,
+            headers
+        });
+    }
+    if (request.method !== 'GET' && request.method !== 'HEAD') {
+        return refusal(405, {
+            allow: 'GET, HEAD, OPTIONS'
+        });
+    }
+    if (!env.MEDIA_VIDEO_DELIVERY_SECRET) return refusal(503);
+    const url = new URL(request.url);
+    const key = keyFromPath(url.pathname);
+    if (!key) return refusal(404);
+    const verdict = await verifyDeliveryToken(url.searchParams.get(DELIVERY_TOKEN_PARAM), env.MEDIA_VIDEO_DELIVERY_SECRET, {
+        key,
+        nowMs
+    });
+    if (verdict.ok === false) {
+        if (verdict.refusal === 'secret') return refusal(503);
+        return refusal(verdict.refusal === 'key' ? 404 : 403);
+    }
+    const maxAgeSeconds = Math.max(0, Math.min(MAX_BROWSER_CACHE_SECONDS, Math.floor((verdict.claims.expiresAtMs - nowMs) / 1000)));
+    if (request.method === 'HEAD') {
+        const object = await env.VIDEO_BUCKET.head(key);
+        if (!object) return refusal(404);
+        const headers = objectHeaders(object, maxAgeSeconds);
+        headers.set('content-length', String(object.size));
+        return new Response(null, {
+            status: 200,
+            headers
+        });
+    }
+    const rangeHeader = request.headers.get('range');
+    if (rangeHeader) {
+        const object = await env.VIDEO_BUCKET.head(key);
+        if (!object) return refusal(404);
+        const ifRange = request.headers.get('if-range');
+        const parsed = ifRange && ifRange !== object.httpEtag ? null : parseByteRange(rangeHeader, object.size);
+        if (parsed === 'unsatisfiable') {
+            return refusal(416, {
+                'content-range': `bytes */${object.size}`
+            });
+        }
+        if (parsed) {
+            const length = parsed.end - parsed.start + 1;
+            const ranged = await env.VIDEO_BUCKET.get(key, {
+                range: {
+                    offset: parsed.start,
+                    length
+                }
+            });
+            if (!ranged) return refusal(404);
+            const headers = objectHeaders(ranged, maxAgeSeconds);
+            headers.set('content-range', `bytes ${parsed.start}-${parsed.end}/${ranged.size}`);
+            headers.set('content-length', String(length));
+            return new Response(ranged.body, {
+                status: 206,
+                headers
+            });
+        }
+    }
+    const object = await env.VIDEO_BUCKET.get(key);
+    if (!object) return refusal(404);
+    const headers = objectHeaders(object, maxAgeSeconds);
+    headers.set('content-length', String(object.size));
+    return new Response(object.body, {
+        status: 200,
+        headers
+    });
+}
+export default {
+    fetch (request, env) {
+        return handleVideoRequest(request, env);
+    }
+};
+
+//# sourceMappingURL=video-worker.js.map