@devultur/self-host 0.0.0-stage → 1.0.0

package/dist/index.js

@@ -0,0 +1,4008 @@
+import {
+  JOB_TICKET_HEADER,
+  KV_JOB_TTL_SECONDS,
+  KvPrefix,
+  MaxResolution,
+  RESOURCE_SECURITY_HEADER,
+  RUN_SCRIPT_COMMAND,
+  SERVICE_SUBJECT_PREFIX,
+  SERVICE_TOKEN_TYPE,
+  TranscodeLaunchErrorCode,
+  TranscodeRunnerName,
+  UPLOAD_TOKEN_TTL_SECONDS,
+  areLocalesAllowed,
+  base64UrlDecode,
+  contentDispositionAttachment,
+  contentDispositionInline,
+  createCloudflareContainerRunner,
+  createObjectEncryption,
+  deletePrefix,
+  encryptForStorage,
+  envWithScript,
+  getRequestState,
+  hashKey,
+  isAuthenticated,
+  isBearerAuthorized,
+  isContentTypeAllowed,
+  isServiceToken,
+  isTranscodeWebhookAuthorized,
+  launchErrorCode,
+  loadStorageKey,
+  notConfigured,
+  parseRunnerName,
+  parseSecurityHeader,
+  sanitizeFilename,
+  shouldEncryptAtRest,
+  signJobTicket,
+  signViewerToken,
+  storageKey,
+  storagePrefix,
+  updateRequestState,
+  verifyJobTicket,
+  verifyViewerToken
+} from "./chunk-VF4KBW3I.js";
+import {
+  ImageTransformsMode,
+  WORKER_DECODABLE_TYPES,
+  fitsWorkerBudget,
+  isUpscale,
+  isVariantKey,
+  megapixels,
+  mimeOfFormat,
+  outputQuality,
+  parseMaxMegapixels,
+  planResize,
+  resolveOutputFormat,
+  resolveRequestedFormat,
+  resolveTransformsMode,
+  variantPrefix,
+  variantStorageKey
+} from "./chunk-D3KOHAVH.js";
+
+// src/index.ts
+import {
+  EXPIRES_AT_HEADER as EXPIRES_AT_HEADER2,
+  REPR_DIGEST_HEADER as REPR_DIGEST_HEADER2,
+  SESSION_HEADER as SESSION_HEADER2,
+  SHA256_HEADER as SHA256_HEADER3,
+  SHA256_VERIFIED_HEADER as SHA256_VERIFIED_HEADER2
+} from "@devultur/core";
+import { Hono as Hono10 } from "hono";
+import { cors } from "hono/cors";
+import { logger } from "hono/logger";
+
+// src/plugin.ts
+var PHASES = ["beforeAuth", "auth", "afterAuth"];
+function assertComposable(plugins) {
+  const names = /* @__PURE__ */ new Set();
+  for (const plugin of plugins) {
+    if (names.has(plugin.name)) throw new Error(`createWorker: two plugins are named "${plugin.name}"`);
+    names.add(plugin.name);
+  }
+  if (!plugins.some((plugin) => (plugin.middleware?.auth?.length ?? 0) > 0)) {
+    throw new Error("createWorker: no plugin authenticates requests. Add workerSecretAuth() or your own auth plugin.");
+  }
+}
+function composePlugins(plugins) {
+  assertComposable(plugins);
+  return {
+    middleware: PHASES.flatMap((phase) => plugins.flatMap((plugin) => plugin.middleware?.[phase] ?? [])),
+    routes: plugins.flatMap((plugin) => plugin.routes ?? []),
+    hooks: {
+      issueCredential: plugins.flatMap((plugin) => plugin.issueCredential ? [plugin.issueCredential] : []),
+      beforeLinkRedeem: plugins.flatMap((plugin) => plugin.beforeLinkRedeem ? [plugin.beforeLinkRedeem] : [])
+    }
+  };
+}
+
+// src/plugin-hooks.ts
+var PLUGIN_HOOKS_VARIABLE = "pluginHooks";
+var NO_HOOKS = { issueCredential: [], beforeLinkRedeem: [] };
+function getPluginHooks(context) {
+  return context.get(PLUGIN_HOOKS_VARIABLE) ?? NO_HOOKS;
+}
+var earliest = (current, next) => current === void 0 ? next : next === void 0 ? current : Math.min(current, next);
+async function decideCredential(context, request) {
+  let expiresAt;
+  let claims;
+  for (const hook of getPluginHooks(context).issueCredential) {
+    const decision = await hook(context, request);
+    if (!decision.allow) return decision;
+    expiresAt = earliest(expiresAt, decision.expiresAt);
+    if (decision.claims) claims = { ...claims, ...decision.claims };
+  }
+  return { allow: true, ...expiresAt !== void 0 ? { expiresAt } : {}, ...claims ? { claims } : {} };
+}
+async function gateLinkRedemption(context, link) {
+  for (const hook of getPluginHooks(context).beforeLinkRedeem) {
+    const refusal = await hook(context, link);
+    if (refusal) return refusal;
+  }
+  return null;
+}
+function cappedExpiry(requested, cap, toUnit) {
+  return cap === void 0 ? requested : Math.min(requested, toUnit(cap));
+}
+function withPluginClaims(claims, decision) {
+  return { ...decision.claims, ...claims };
+}
+
+// src/plugins/credential-policy.ts
+function credentialPolicy(options = {}) {
+  return {
+    name: "credential-policy",
+    issueCredential: (_context, request) => {
+      const maxTtlSeconds = options.maxTtlSeconds?.[request.kind];
+      if (maxTtlSeconds === void 0) return { allow: true };
+      return { allow: true, expiresAt: Date.now() + maxTtlSeconds * 1e3 };
+    }
+  };
+}
+
+// src/plugins/download-links.ts
+import { Hono as Hono2 } from "hono";
+
+// src/routes/download.ts
+import { contentDispositionAttachment as contentDispositionAttachment2, relativeMediaPath, TokenScope } from "@devultur/core";
+import { Hono } from "hono";
+
+// src/download-link.ts
+var isRecord = (value) => typeof value === "object" && value !== null && !Array.isArray(value);
+function recordContext(record) {
+  if (record.context) return record.context;
+  const legacy = record.callerContext;
+  return isRecord(legacy) ? legacy : void 0;
+}
+var DownloadLinkPath = {
+  CREATE: "/create",
+  REDEEM: "/redeem",
+  /** Reads the link without consuming a use (same 404/410 as redemption): the `beforeLinkRedeem` hook decides first. */
+  PEEK: "/peek"
+};
+var RECORD_KEY = "link";
+var linkGone = (code, error) => Response.json({ error, code }, { status: 410 });
+var DownloadLink = class {
+  state;
+  storage;
+  constructor(state) {
+    this.state = state;
+    this.storage = state.storage;
+  }
+  async fetch(request) {
+    const { pathname } = new URL(request.url);
+    if (request.method !== "POST") return new Response(null, { status: 405 });
+    if (pathname === DownloadLinkPath.CREATE) return this.state.blockConcurrencyWhile(() => this.create(request));
+    if (pathname === DownloadLinkPath.REDEEM) return this.state.blockConcurrencyWhile(() => this.redeem());
+    if (pathname === DownloadLinkPath.PEEK) return this.state.blockConcurrencyWhile(() => this.peek());
+    return new Response(null, { status: 404 });
+  }
+  async create(request) {
+    if (await this.storage.get(RECORD_KEY)) {
+      return Response.json({ error: "Link id already in use", code: "link_exists" }, { status: 409 });
+    }
+    const record = await request.json();
+    await this.storage.put(RECORD_KEY, { ...record, uses: 0 });
+    await this.storage.setAlarm(record.expiresAt);
+    return Response.json({ ok: true }, { status: 201 });
+  }
+  /** The record if it still has a use left, or the response explaining why not: 404 if it never existed (or the alarm already
+   *  cleared it), 410 if it expired or was already used. */
+  async usableRecord() {
+    const record = await this.storage.get(RECORD_KEY);
+    if (!record) return Response.json({ error: "Download link not found", code: "link_not_found" }, { status: 404 });
+    if (record.expiresAt <= Date.now()) return linkGone("link_expired", "This download link has expired");
+    if (record.uses >= record.maxUses) return linkGone("link_used", "This download link was already used");
+    return record;
+  }
+  async peek() {
+    const record = await this.usableRecord();
+    return record instanceof Response ? record : Response.json(record);
+  }
+  /** Consumes ONE use. */
+  async redeem() {
+    const record = await this.usableRecord();
+    if (record instanceof Response) return record;
+    const consumed = { ...record, uses: record.uses + 1 };
+    await this.storage.put(RECORD_KEY, consumed);
+    return Response.json(consumed);
+  }
+  async alarm() {
+    await this.storage.deleteAll();
+  }
+};
+
+// src/route-result.ts
+var ROUTE_RESULT_VARIABLE = "routeResult";
+function getRouteResult(context) {
+  return context.get(ROUTE_RESULT_VARIABLE) ?? {};
+}
+function addRouteResult(context, result) {
+  context.set(ROUTE_RESULT_VARIABLE, { ...getRouteResult(context), ...result });
+}
+
+// src/routes/object-response.ts
+import {
+  AES_BLOCK_BYTES,
+  createDecryptStream,
+  decodeEncryptionMeta,
+  decryptChunk,
+  EXPIRES_AT_HEADER,
+  REPR_DIGEST_HEADER,
+  reprDigest,
+  SHA256_HEADER as SHA256_HEADER2,
+  SHA256_VERIFIED_HEADER
+} from "@devultur/core";
+
+// src/routes/upload-integrity.ts
+import { normalizeSha256, SHA256_HEADER, sha256Hex } from "@devultur/core";
+var ObjectMeta = {
+  SHA256: "sha256",
+  /** `"true"` = the worker hashed the bytes; `"false"` = sha256 declared by the client (multipart). */
+  SHA256_VERIFIED: "sha256Verified",
+  /** Epoch ms. From then on the gate responds 410 (and an external sweeper may delete it). */
+  EXPIRES_AT: "expiresAt"
+};
+var WORKER_METADATA_KEYS = /* @__PURE__ */ new Set(["security", "enc", ObjectMeta.EXPIRES_AT.toLowerCase(), "derivedfrom"]);
+function isWorkerMetadataKey(key) {
+  const lowerKey = key.toLowerCase();
+  return lowerKey.startsWith(ObjectMeta.SHA256) || WORKER_METADATA_KEYS.has(lowerKey);
+}
+function allowedUploadMetadata(metadata) {
+  if (!metadata) return {};
+  return Object.fromEntries(Object.entries(metadata).filter(([key]) => !isWorkerMetadataKey(key)));
+}
+function targetFailure(context, failure3) {
+  return context.json({ error: failure3.error, code: failure3.code }, failure3.status);
+}
+function alreadyExists(context, key) {
+  return context.json(
+    { error: `${key} already exists; pass overwrite: true to replace it`, code: "already_exists", key },
+    409
+  );
+}
+function sha256Mismatch(context, expected, actual) {
+  return context.json(
+    { error: "The uploaded bytes do not match the declared sha256", code: "sha256_mismatch", expected, actual },
+    400
+  );
+}
+function headerSha256(context) {
+  const raw = context.req.header(SHA256_HEADER);
+  if (raw === void 0) return void 0;
+  return normalizeSha256(raw);
+}
+async function digestBody(body, declared, header) {
+  if (header === null) return { invalid: true };
+  const actual = await sha256Hex(body);
+  const expected = declared ?? header;
+  if (expected && expected !== actual) return { mismatch: { expected, actual } };
+  return { sha256: actual };
+}
+function integrityMetadata(sha256, isVerified, expiresAt) {
+  return {
+    ...sha256 ? { [ObjectMeta.SHA256]: sha256, [ObjectMeta.SHA256_VERIFIED]: String(isVerified) } : {},
+    ...expiresAt ? { [ObjectMeta.EXPIRES_AT]: String(expiresAt) } : {}
+  };
+}
+function createOnlyCondition() {
+  return new Headers({ "If-None-Match": "*" });
+}
+async function discardStaleVariants(bucket, pending) {
+  if (!pending?.overwrite) return;
+  await deletePrefix(bucket, variantPrefix(pending.storageKey));
+}
+
+// src/routes/object-response.ts
+function isObjectExpired(customMetadata, now = Date.now()) {
+  const expiresAt = Number(customMetadata?.[ObjectMeta.EXPIRES_AT]);
+  return Number.isFinite(expiresAt) && expiresAt > 0 && expiresAt <= now;
+}
+function expiredResponse() {
+  return Response.json({ error: "This file has expired", code: "expired" }, { status: 410 });
+}
+function applyIntegrityHeaders(headers, customMetadata) {
+  const sha256 = customMetadata?.[ObjectMeta.SHA256];
+  if (sha256) {
+    headers.set(SHA256_HEADER2, sha256);
+    headers.set(REPR_DIGEST_HEADER, reprDigest(sha256));
+    headers.set(SHA256_VERIFIED_HEADER, customMetadata?.[ObjectMeta.SHA256_VERIFIED] === "true" ? "true" : "false");
+  }
+  const expiresAt = customMetadata?.[ObjectMeta.EXPIRES_AT];
+  if (expiresAt) headers.set(EXPIRES_AT_HEADER, expiresAt);
+}
+function parseRange(range, totalSize) {
+  const match = range.match(/bytes=(\d*)-(\d*)/);
+  if (!match || !match[1] && !match[2]) return [0, totalSize - 1];
+  if (!match[1]) {
+    const suffixLength = Number.parseInt(match[2], 10);
+    if (suffixLength === 0) return null;
+    return [Math.max(0, totalSize - suffixLength), totalSize - 1];
+  }
+  const start = Number.parseInt(match[1], 10);
+  if (start >= totalSize) return null;
+  const end = match[2] ? Math.min(Number.parseInt(match[2], 10), totalSize - 1) : totalSize - 1;
+  return end < start ? null : [start, end];
+}
+var notFound = () => Response.json({ error: "Not found" }, { status: 404 });
+async function rangeResponse(input, cryptoKey, iv) {
+  const { bucket, fullKey, object, headers } = input;
+  const byteRange = parseRange(input.range ?? "", object.size);
+  if (!byteRange) {
+    return new Response(null, { status: 416, headers: { "Content-Range": `bytes */${object.size}` } });
+  }
+  const [start, end] = byteRange;
+  headers.set("Content-Range", `bytes ${start}-${end}/${object.size}`);
+  headers.set("Content-Length", String(end - start + 1));
+  if (cryptoKey && iv) {
+    const firstBlock = Math.floor(start / AES_BLOCK_BYTES);
+    const alignedOffset = firstBlock * AES_BLOCK_BYTES;
+    const cipherPart = await bucket.get(fullKey, { range: { offset: alignedOffset, length: end - alignedOffset + 1 } });
+    if (!cipherPart) return notFound();
+    const decrypted = await decryptChunk(await cipherPart.arrayBuffer(), cryptoKey, iv, firstBlock);
+    const leading = start - alignedOffset;
+    return new Response(decrypted.subarray(leading, leading + (end - start + 1)), { status: 206, headers });
+  }
+  const partial = await bucket.get(fullKey, { range: { offset: start, length: end - start + 1 } });
+  if (!partial) return notFound();
+  return new Response(partial.body, { status: 206, headers });
+}
+async function streamObject(input) {
+  const { object, headers } = input;
+  headers.set("Content-Length", String(object.size));
+  headers.set("ETag", object.httpEtag);
+  headers.set("Accept-Ranges", "bytes");
+  applyIntegrityHeaders(headers, object.customMetadata);
+  const enc = decodeEncryptionMeta(object.customMetadata?.enc);
+  const loaded = enc ? await loadStorageKey(input.keysBucket, input.fullKey, enc.keyId) : null;
+  if (enc && !loaded) {
+    return { response: Response.json({ error: "Decryption key unavailable" }, { status: 500 }), kind: "other" };
+  }
+  const cryptoKey = loaded?.key ?? null;
+  const iv = enc?.iv ?? null;
+  if (input.range && object.size > 0) {
+    const response = await rangeResponse(input, cryptoKey, iv);
+    return { response, kind: !enc && response.status === 206 ? "plain-range" : "other" };
+  }
+  if (cryptoKey && iv && object.body) {
+    return {
+      response: new Response(object.body.pipeThrough(createDecryptStream(cryptoKey, iv)), { status: 200, headers }),
+      kind: "other"
+    };
+  }
+  return { response: new Response(object.body, { status: 200, headers }), kind: "plain-full" };
+}
+
+// src/routes/download.ts
+var DEFAULT_LINK_TTL_SECONDS = 15 * 60;
+var MAX_LINK_TTL_SECONDS = 7 * 24 * 60 * 60;
+var MAX_LINK_USES = 100;
+var LINK_ID_PATTERN = /^[A-Za-z0-9_-]{22}$/;
+function newLinkId() {
+  const bytes = crypto.getRandomValues(new Uint8Array(16));
+  return btoa(String.fromCharCode(...bytes)).replace(/\+/g, "-").replace(/\//g, "_").replace(/=+$/, "");
+}
+function linkStub(namespace, linkId) {
+  return namespace.get(namespace.idFromName(linkId));
+}
+var isIntegerIn = (value, max) => typeof value === "number" && Number.isSafeInteger(value) && value > 0 && value <= max;
+function parseLinkRequest(body) {
+  const key = typeof body.key === "string" ? body.key : "";
+  if (relativeMediaPath(key) === null) {
+    return { error: "key must be a visibility-prefixed media key", code: "invalid_key" };
+  }
+  const expiresIn = body.expiresIn ?? DEFAULT_LINK_TTL_SECONDS;
+  if (!isIntegerIn(expiresIn, MAX_LINK_TTL_SECONDS)) {
+    return { error: `expiresIn must be 1..${MAX_LINK_TTL_SECONDS} seconds`, code: "invalid_expires_in" };
+  }
+  const maxUses = body.maxUses ?? 1;
+  if (!isIntegerIn(maxUses, MAX_LINK_USES)) {
+    return { error: `maxUses must be 1..${MAX_LINK_USES}`, code: "invalid_max_uses" };
+  }
+  const filename = typeof body.filename === "string" && body.filename ? body.filename : void 0;
+  return { key, expiresIn, maxUses, filename };
+}
+async function handleDownloadLink(context) {
+  const namespace = context.env.DOWNLOAD_LINKS;
+  if (!namespace) return context.json({ error: "Download links are not configured", code: "not_configured" }, 501);
+  const parsed = parseLinkRequest(await context.req.json().catch(() => null) ?? {});
+  if ("error" in parsed) return context.json(parsed, 400);
+  const fullKey = storageKey(context, parsed.key);
+  const object = await context.env.MEDIA_BUCKET.head(fullKey);
+  if (!object) return context.json({ error: "Not found" }, 404);
+  if (isObjectExpired(object.customMetadata)) return expiredResponse();
+  const objectExpiresAt = Number(object.customMetadata?.expiresAt) || Infinity;
+  const requestedExpiresAt = Math.min(Date.now() + parsed.expiresIn * 1e3, objectExpiresAt);
+  const decision = await decideCredential(context, {
+    kind: "download-link",
+    scopes: [TokenScope.MEDIA_READ],
+    path: parsed.key,
+    expiresAt: requestedExpiresAt
+  });
+  if (!decision.allow) return decision.response;
+  const expiresAt = cappedExpiry(requestedExpiresAt, decision.expiresAt, (epochMs) => epochMs);
+  const linkId = newLinkId();
+  const scope = getRequestState(context);
+  const record = {
+    storageKey: fullKey,
+    key: parsed.key,
+    expiresAt,
+    maxUses: parsed.maxUses,
+    ...parsed.filename ? { filename: parsed.filename } : {},
+    storagePrefix: scope.storagePrefix,
+    ...scope.context ? { context: scope.context } : {}
+  };
+  const created = await linkStub(namespace, linkId).fetch(`https://download-link${DownloadLinkPath.CREATE}`, {
+    method: "POST",
+    body: JSON.stringify(record)
+  });
+  if (!created.ok) return context.json({ error: "Could not create the download link" }, 500);
+  const origin = new URL(context.req.url).origin;
+  return context.json({ url: `${origin}/v1/download/${linkId}`, expiresAt, maxUses: parsed.maxUses });
+}
+function attachmentDisposition(record, storedDisposition) {
+  if (record.filename) return contentDispositionAttachment2(record.filename);
+  const fallback2 = storedDisposition ?? contentDispositionInline(record.key.split("/").pop() || "download");
+  return fallback2.startsWith("inline") ? `attachment${fallback2.slice("inline".length)}` : fallback2;
+}
+var callLink = (stub, path) => stub.fetch(`https://download-link${path}`, { method: "POST" });
+var relayLinkFailure = (response) => new Response(response.body, { status: response.status, headers: response.headers });
+function linkInfoOf(record) {
+  const context = recordContext(record);
+  return { storagePrefix: record.storagePrefix, key: record.key, ...context ? { context } : {} };
+}
+async function gateRedemption(context, stub) {
+  if (getPluginHooks(context).beforeLinkRedeem.length === 0) return null;
+  const peeked = await callLink(stub, DownloadLinkPath.PEEK);
+  if (!peeked.ok) return relayLinkFailure(peeked);
+  return gateLinkRedemption(context, linkInfoOf(await peeked.json()));
+}
+var download = new Hono();
+download.get("/:linkId", async (context) => {
+  if (context.req.method === "HEAD") return new Response(null, { status: 405, headers: { Allow: "GET" } });
+  const linkId = context.req.param("linkId");
+  const namespace = context.env.DOWNLOAD_LINKS;
+  if (!namespace || !LINK_ID_PATTERN.test(linkId)) return context.json({ error: "Not found" }, 404);
+  const stub = linkStub(namespace, linkId);
+  const blocked = await gateRedemption(context, stub);
+  if (blocked) return blocked;
+  const redeemed = await callLink(stub, DownloadLinkPath.REDEEM);
+  if (!redeemed.ok) return relayLinkFailure(redeemed);
+  const record = await redeemed.json();
+  const object = await context.env.MEDIA_BUCKET.get(record.storageKey);
+  if (!object) return context.json({ error: "Not found" }, 404);
+  if (isObjectExpired(object.customMetadata)) return expiredResponse();
+  addRouteResult(context, { redeemedLink: linkInfoOf(record) });
+  const headers = new Headers({
+    "Content-Type": object.httpMetadata?.contentType ?? "application/octet-stream",
+    "Cache-Control": "private, no-store",
+    "Content-Disposition": attachmentDisposition(record, object.httpMetadata?.contentDisposition)
+  });
+  const { response } = await streamObject({
+    bucket: context.env.MEDIA_BUCKET,
+    keysBucket: context.env.KEYS_BUCKET,
+    fullKey: record.storageKey,
+    object,
+    headers,
+    range: context.req.header("Range")
+  });
+  return response;
+});
+
+// src/plugins/download-links.ts
+function downloadLinks() {
+  const issue = new Hono2().post("/", handleDownloadLink);
+  return {
+    name: "download-links",
+    routes: [
+      { path: "/v1/token/download", app: issue },
+      { path: "/v1/download", app: download }
+    ]
+  };
+}
+
+// src/plugins/static-config.ts
+function staticConfig(config) {
+  const applyConfig = async (context, next) => {
+    updateRequestState(context, { config });
+    await next();
+  };
+  return { name: "static-config", middleware: { beforeAuth: [applyConfig] } };
+}
+
+// src/routes/token-upload.ts
+import { assetRelativePath as assetRelativePath2, normalizeAssetPrefix } from "@devultur/core";
+
+// src/token-claims.ts
+function audienceClaim(storagePrefix2) {
+  const prefix = storagePrefix2.replace(/\/$/, "");
+  return prefix ? { aud: prefix } : {};
+}
+function scopeClaim(scopes) {
+  return { scope: scopes.join(" ") };
+}
+function hasInvalidScope(scopes) {
+  return scopes.some((scope) => typeof scope !== "string" || scope === "" || /\s/.test(scope));
+}
+function readTokenScopes(payload) {
+  if (payload.scope === void 0) return void 0;
+  if (typeof payload.scope !== "string") return [];
+  return payload.scope.split(" ").filter(Boolean);
+}
+
+// src/routes/upload-target.ts
+import {
+  assetRelativePath,
+  DEFAULT_ASSET_CACHE_CONTROL,
+  filePath,
+  generateId,
+  imagePath,
+  isWithinPathPrefix as isWithinPathPrefix2,
+  MediaType,
+  matchCacheRule,
+  normalizeAssetPath,
+  normalizeSha256 as normalizeSha2562,
+  resolveCacheControl,
+  videoRawPath
+} from "@devultur/core";
+
+// src/routes/viewer-token-claims.ts
+import { coversScope, isWithinPathPrefix, relativeMediaPath as relativeMediaPath2, TokenScope as TokenScope2 } from "@devultur/core";
+var TOKEN_REJECTED_CODE = "token_rejected";
+function isOtherAudience(payload, storagePrefix2) {
+  if (payload.aud === void 0) return false;
+  return payload.aud !== (storagePrefix2 ?? "").replace(/\/$/, "");
+}
+function isOutsideResource(payload, key) {
+  if (payload.res === void 0) return false;
+  if (typeof payload.res !== "string") return true;
+  const relativePath = relativeMediaPath2(key);
+  return relativePath === null || !isWithinPathPrefix(relativePath, payload.res);
+}
+function lacksReadScope(payload) {
+  const scopes = readTokenScopes(payload);
+  return scopes !== void 0 && !coversScope(scopes, TokenScope2.MEDIA_READ);
+}
+function rejectionReason(payload, target) {
+  if (isOtherAudience(payload, target.storagePrefix)) return "audience";
+  if (isOutsideResource(payload, target.key)) return "resource";
+  if (lacksReadScope(payload)) return "scope";
+  return null;
+}
+function viewerTokenClaimRejection(payload, target) {
+  const reason = rejectionReason(payload, target);
+  if (!reason) return null;
+  return { status: 403, error: "Token rejected", code: TOKEN_REJECTED_CODE, reason };
+}
+
+// src/routes/upload-target.ts
+var MAX_FILE_TTL_SECONDS = 365 * 24 * 60 * 60;
+var MAX_FILES_COUNTER_TTL_SECONDS = 24 * 60 * 60;
+var MAX_FILES_PREFIX = "upload-token-files";
+var failure = (status, code, error) => ({
+  status,
+  code,
+  error
+});
+function isUploadTargetError(value) {
+  return typeof value === "object" && value !== null && "code" in value && "status" in value;
+}
+function generatedKindPath(mediaType, id, filename) {
+  const safeFilename = sanitizeFilename(filename);
+  if (mediaType === MediaType.VIDEO) return videoRawPath(id, safeFilename);
+  if (mediaType === MediaType.IMAGE) return imagePath(id, safeFilename);
+  return filePath(id, safeFilename);
+}
+function tokenRejected(reason, path) {
+  console.warn(`[upload] token rejected (${reason}) for path ${String(path)}`);
+  return failure(403, TOKEN_REJECTED_CODE, "Token rejected");
+}
+function assetTarget(rawPath, visibility, grant) {
+  const assetPath = normalizeAssetPath(rawPath);
+  if (!assetPath) {
+    return failure(400, "invalid_path", "path must be a relative path of [A-Za-z0-9._-] segments, without `..`");
+  }
+  const relativePath = assetRelativePath(assetPath);
+  if (grant && !isWithinPathPrefix2(relativePath, grant.pathPrefix)) return tokenRejected("resource", relativePath);
+  const key = `${visibility}/${relativePath}`;
+  return { key, id: key, visibility, isAsset: true, assetPath };
+}
+function resolveUploadTarget(body, mediaType, visibility, grant) {
+  if (grant && body.path === void 0) {
+    return failure(400, "path_required", "an upload token can only create files at an explicit `path`");
+  }
+  if (grant && body.visibility && body.visibility !== grant.visibility) return tokenRejected("visibility", body.path);
+  if (body.path !== void 0) return assetTarget(body.path, grant?.visibility ?? visibility, grant);
+  const id = generateId();
+  return { key: `${visibility}/${generatedKindPath(mediaType, id, body.filename)}`, id, visibility, isAsset: false };
+}
+function resolveExpiresAt(requested, grant, now, maxTtlSeconds) {
+  const hasRequest = requested !== void 0 && requested !== null;
+  const isValid = typeof requested === "number" && Number.isInteger(requested) && requested > 0;
+  if (hasRequest && (!isValid || requested > MAX_FILE_TTL_SECONDS)) {
+    return failure(400, "invalid_expires_in", "expiresIn must be a positive integer number of seconds (max 1 year)");
+  }
+  const candidates = [hasRequest ? requested : void 0, grant?.fileExpiresIn, maxTtlSeconds];
+  const ttls = candidates.filter((ttl) => typeof ttl === "number" && ttl > 0);
+  return ttls.length > 0 ? now + Math.min(...ttls) * 1e3 : void 0;
+}
+function resolveDeclaredSha256(raw) {
+  if (raw === void 0 || raw === null) return void 0;
+  return normalizeSha2562(raw) ?? failure(400, "invalid_sha256", "sha256 must be a 64-character hex string");
+}
+function effectiveMaxBytes(ruleMax, grant) {
+  const limits = [ruleMax, grant?.maxBytes].filter((limit) => typeof limit === "number");
+  return limits.length > 0 ? Math.min(...limits) : void 0;
+}
+async function claimTokenFileSlot(kv, grant) {
+  if (!grant.maxFiles) return null;
+  const counterKey = `${MAX_FILES_PREFIX}:${grant.tokenId}`;
+  const used = Number(await kv.get(counterKey) ?? "0");
+  if (used >= grant.maxFiles) {
+    return failure(403, "max_files_reached", `the upload token already created ${grant.maxFiles} files`);
+  }
+  await kv.put(counterKey, String(used + 1), { expirationTtl: MAX_FILES_COUNTER_TTL_SECONDS });
+  return null;
+}
+function resolveObjectCacheControl(requested, target, rules) {
+  if (!target.isAsset || !target.assetPath) return void 0;
+  if (requested !== void 0 && requested !== null) {
+    return resolveCacheControl(requested) ?? failure(400, "invalid_cache_control", "cacheControl must be immutable, revalidate, no-cache or a valid header");
+  }
+  return matchCacheRule(rules, target.assetPath)?.cacheControl ?? DEFAULT_ASSET_CACHE_CONTROL;
+}
+function inferMediaType(contentType) {
+  if (contentType.startsWith("video/")) return MediaType.VIDEO;
+  if (contentType.startsWith("image/")) return MediaType.IMAGE;
+  if (contentType.startsWith("application/")) return MediaType.FILE;
+  return null;
+}
+
+// src/routes/token-upload.ts
+var UPLOAD_TOKEN_TYPE = "upload";
+var MEDIA_WRITE_SCOPE = "media:write";
+var DEFAULT_UPLOAD_TOKEN_TTL_SECONDS = 60 * 60;
+var MAX_UPLOAD_TOKEN_TTL_SECONDS = 24 * 60 * 60;
+var isPositiveInteger = (value) => typeof value === "number" && Number.isSafeInteger(value) && value > 0;
+function optionalPositive(value, max = Number.MAX_SAFE_INTEGER) {
+  if (value === void 0 || value === null) return void 0;
+  return isPositiveInteger(value) && value <= max ? value : null;
+}
+function parseVisibility(value) {
+  if (value === void 0 || value === null) return "private";
+  return value === "public" || value === "private" ? value : null;
+}
+function uploadGrantFromClaims(payload) {
+  if (payload.typ !== UPLOAD_TOKEN_TYPE || typeof payload.res !== "string" || typeof payload.jti !== "string") {
+    return null;
+  }
+  if (payload.visibility !== "public" && payload.visibility !== "private") return null;
+  return {
+    tokenId: payload.jti,
+    pathPrefix: payload.res,
+    visibility: payload.visibility,
+    ...isPositiveInteger(payload.max_bytes) ? { maxBytes: payload.max_bytes } : {},
+    ...isPositiveInteger(payload.max_files) ? { maxFiles: payload.max_files } : {},
+    ...isPositiveInteger(payload.file_ttl) ? { fileExpiresIn: payload.file_ttl } : {}
+  };
+}
+var badRequest = (context, code, error) => context.json({ error, code }, 400);
+async function handleUploadToken(context) {
+  const body = await context.req.json().catch(() => null) ?? {};
+  const prefix = normalizeAssetPrefix(body.prefix);
+  if (!prefix) return badRequest(context, "invalid_prefix", "prefix must be a relative path like `exports/inst-1/`");
+  const visibility = parseVisibility(body.visibility);
+  if (!visibility) return badRequest(context, "invalid_visibility", "visibility must be `public` or `private`");
+  const expiresIn = optionalPositive(body.expiresIn, MAX_UPLOAD_TOKEN_TTL_SECONDS);
+  const maxBytes = optionalPositive(body.maxBytes);
+  const maxFiles = optionalPositive(body.maxFiles);
+  const fileExpiresIn = optionalPositive(body.fileExpiresIn, MAX_FILE_TTL_SECONDS);
+  if (expiresIn === null) return badRequest(context, "invalid_expires_in", "expiresIn must be 1..86400 seconds");
+  if (maxBytes === null || maxFiles === null) {
+    return badRequest(context, "invalid_limits", "maxBytes and maxFiles must be positive integers");
+  }
+  if (fileExpiresIn === null) {
+    return badRequest(context, "invalid_file_expires_in", "fileExpiresIn must be a positive number of seconds");
+  }
+  const pathPrefix = assetRelativePath2(prefix);
+  const now = Math.floor(Date.now() / 1e3);
+  const requestedExp = now + (expiresIn ?? DEFAULT_UPLOAD_TOKEN_TTL_SECONDS);
+  const decision = await decideCredential(context, {
+    kind: "upload",
+    scopes: [MEDIA_WRITE_SCOPE],
+    path: pathPrefix,
+    expiresAt: requestedExp * 1e3
+  });
+  if (!decision.allow) return decision.response;
+  const expiresAt = cappedExpiry(requestedExp, decision.expiresAt, (epochMs) => Math.floor(epochMs / 1e3));
+  const payload = withPluginClaims(
+    {
+      typ: UPLOAD_TOKEN_TYPE,
+      jti: crypto.randomUUID(),
+      res: pathPrefix,
+      visibility,
+      ...scopeClaim([MEDIA_WRITE_SCOPE]),
+      ...audienceClaim(getRequestState(context).storagePrefix),
+      iat: now,
+      exp: expiresAt,
+      ...maxBytes ? { max_bytes: maxBytes } : {},
+      ...maxFiles ? { max_files: maxFiles } : {},
+      ...fileExpiresIn ? { file_ttl: fileExpiresIn } : {}
+    },
+    decision
+  );
+  const token2 = await signViewerToken(payload, context.env.DELIVERY_SIGN_SECRET);
+  return context.json({
+    token: token2,
+    prefix,
+    visibility,
+    expiresAt,
+    ...maxBytes ? { maxBytes } : {},
+    ...maxFiles ? { maxFiles } : {},
+    ...fileExpiresIn ? { fileExpiresIn } : {}
+  });
+}
+
+// src/plugins/worker-secret-auth.ts
+var WorkerAuthErrorCode = {
+  SECRET_MISSING: "worker_auth_secret_missing",
+  UNAUTHORIZED: "unauthorized"
+};
+var MEDIA_PREFIX = "/v1/media/";
+var DOWNLOAD_PREFIX = "/v1/download/";
+var WEBHOOKS_PREFIX = "/v1/webhooks/";
+var UPLOAD_CREATE_PATH = "/v1/upload";
+var UPLOAD_URL_PREFIX = "/v1/upload/";
+var isReadMethod = (method) => method === "GET" || method === "HEAD";
+function isOpenRoute(method, path) {
+  if (method === "OPTIONS") return true;
+  if (path === "/health") return isReadMethod(method);
+  if (path === "/v1/metrics/playback") return method === "POST";
+  if (path.startsWith(MEDIA_PREFIX) || path.startsWith(DOWNLOAD_PREFIX)) return isReadMethod(method);
+  return path.startsWith(WEBHOOKS_PREFIX) && method === "POST";
+}
+function isUploadUrl(path) {
+  return path.startsWith(UPLOAD_URL_PREFIX);
+}
+async function uploadGrantFromBearer(context, authHeader) {
+  const token2 = authHeader?.match(/^Bearer\s+(\S+)$/i)?.[1];
+  const signSecret = context.env.DELIVERY_SIGN_SECRET;
+  if (!token2 || !signSecret) return null;
+  try {
+    const payload = await verifyViewerToken(token2, signSecret);
+    return payload ? uploadGrantFromClaims(payload) : null;
+  } catch {
+    return null;
+  }
+}
+function rejectUnauthenticated(context, isSecretMissing) {
+  if (isSecretMissing) {
+    return context.json(
+      { error: "WORKER_AUTH_SECRET is not configured on the Worker", code: WorkerAuthErrorCode.SECRET_MISSING },
+      503
+    );
+  }
+  return context.json({ error: "Unauthorized", code: WorkerAuthErrorCode.UNAUTHORIZED }, 401);
+}
+function workerSecretMiddleware() {
+  return async (context, next) => {
+    const { method, path } = context.req;
+    const authHeader = context.req.header("Authorization");
+    const secret = context.env.WORKER_AUTH_SECRET;
+    const hasWorkerSecret = isBearerAuthorized(secret, authHeader);
+    updateRequestState(context, {
+      runnerCredential: secret ?? "",
+      ...hasWorkerSecret ? { access: { authenticated: true } } : {}
+    });
+    if (isOpenRoute(method, path)) {
+      if (hasWorkerSecret && path.startsWith(MEDIA_PREFIX))
+        updateRequestState(context, { access: { trustedRead: true } });
+      await next();
+      return;
+    }
+    if (isUploadUrl(path) || hasWorkerSecret) {
+      await next();
+      return;
+    }
+    if (!secret) return rejectUnauthenticated(context, true);
+    const grant = method === "POST" && path === UPLOAD_CREATE_PATH ? await uploadGrantFromBearer(context, authHeader) : null;
+    if (!grant) return rejectUnauthenticated(context, false);
+    updateRequestState(context, { access: { authenticated: true, uploadGrant: grant } });
+    await next();
+  };
+}
+function workerSecretAuth() {
+  return { name: "worker-secret-auth", middleware: { auth: [workerSecretMiddleware()] } };
+}
+
+// src/plugins/index.ts
+function defaultPlugins(config = {}) {
+  return [staticConfig(config), workerSecretAuth(), credentialPolicy(), downloadLinks()];
+}
+
+// src/routes/assets.ts
+import { ASSET_NAMESPACE, normalizeAssetPrefix as normalizeAssetPrefix2 } from "@devultur/core";
+import { Hono as Hono3 } from "hono";
+var MAX_ASSET_LIST_LIMIT = 1e3;
+var VISIBILITY_ORDER = ["private", "public"];
+function parseListPrefix(raw) {
+  if (!raw?.trim()) return "";
+  return normalizeAssetPrefix2(raw);
+}
+function parseListCursor(raw, visibilities) {
+  if (!raw) return { visibility: visibilities[0] };
+  const separator = raw.indexOf(":");
+  const visibility = raw.slice(0, separator);
+  if (separator < 0 || !visibilities.includes(visibility)) return null;
+  const cursor = raw.slice(separator + 1);
+  return { visibility, ...cursor ? { cursor } : {} };
+}
+function parseLimit(raw) {
+  const limit = Number(raw);
+  if (!Number.isInteger(limit) || limit <= 0) return MAX_ASSET_LIST_LIMIT;
+  return Math.min(limit, MAX_ASSET_LIST_LIMIT);
+}
+function toEntry(object, storageRoot, visibility) {
+  const key = object.key.slice(storageRoot.length);
+  const sha256 = object.customMetadata?.[ObjectMeta.SHA256] ?? null;
+  return {
+    key,
+    path: key.slice(`${visibility}/${ASSET_NAMESPACE}/`.length),
+    size: object.size,
+    etag: object.httpEtag,
+    sha256,
+    sha256Verified: Boolean(sha256) && object.customMetadata?.[ObjectMeta.SHA256_VERIFIED] === "true",
+    uploaded: object.uploaded.toISOString(),
+    cacheControl: object.httpMetadata?.cacheControl ?? null,
+    visibility
+  };
+}
+function nextCursor(listing, position, visibilities) {
+  if (listing.truncated) return `${position.visibility}:${listing.cursor}`;
+  const next = visibilities[visibilities.indexOf(position.visibility) + 1];
+  return next ? `${next}:` : null;
+}
+var assets = new Hono3();
+assets.get("/", async (context) => {
+  const prefix = parseListPrefix(context.req.query("prefix"));
+  if (prefix === null) {
+    return context.json(
+      { error: "prefix must be a relative path of [A-Za-z0-9._-] segments", code: "invalid_prefix" },
+      400
+    );
+  }
+  const requested = context.req.query("visibility");
+  const visibilities = VISIBILITY_ORDER.filter((visibility) => !requested || visibility === requested);
+  const position = visibilities.length > 0 ? parseListCursor(context.req.query("cursor"), visibilities) : null;
+  if (!position) return context.json({ error: "Invalid cursor or visibility", code: "invalid_cursor" }, 400);
+  const storageRoot = storagePrefix(context, "");
+  const listOptions = {
+    prefix: `${storageRoot}${position.visibility}/${ASSET_NAMESPACE}/${prefix}`,
+    limit: parseLimit(context.req.query("limit")),
+    ...position.cursor ? { cursor: position.cursor } : {},
+    include: ["httpMetadata", "customMetadata"]
+  };
+  const listing = await context.env.MEDIA_BUCKET.list(listOptions);
+  const objects = listing.objects.filter((object) => !isObjectExpired(object.customMetadata)).map((object) => toEntry(object, storageRoot, position.visibility));
+  return context.json({ objects, cursor: nextCursor(listing, position, visibilities) });
+});
+
+// src/routes/captions.ts
+import {
+  captionPath,
+  createDecryptStream as createDecryptStream2,
+  decodeEncryptionMeta as decodeEncryptionMeta2,
+  extractId,
+  resolveSecurity,
+  visibilityFromKey
+} from "@devultur/core";
+import { Hono as Hono5 } from "hono";
+
+// src/routes/captions-errors.ts
+var CaptionsErrorCode = {
+  /** The provider responded 429: retriable later. */
+  PROVIDER_RATE_LIMITED: "captions_provider_rate_limited",
+  /** The provider responded with some other non-2xx. */
+  PROVIDER_ERROR: "captions_provider_error",
+  /** Something on our end failed (VTT storage, parsing, …). */
+  FAILED: "captions_failed"
+};
+var CaptionsProviderError = class extends Error {
+  constructor(provider, status, body) {
+    super(`${provider} responded ${status}`);
+    this.provider = provider;
+    this.status = status;
+    this.body = body;
+    this.name = "CaptionsProviderError";
+  }
+  provider;
+  status;
+  body;
+};
+function toCaptionsFailure(error) {
+  if (!(error instanceof CaptionsProviderError)) {
+    return {
+      status: 500,
+      code: CaptionsErrorCode.FAILED,
+      error: "Captions generation failed",
+      reason: "internal",
+      retriable: true
+    };
+  }
+  if (error.status === 429) {
+    return {
+      status: 503,
+      code: CaptionsErrorCode.PROVIDER_RATE_LIMITED,
+      error: "Captions provider is rate limited, try again later",
+      reason: "capacity",
+      retriable: true
+    };
+  }
+  return {
+    status: 500,
+    code: CaptionsErrorCode.PROVIDER_ERROR,
+    error: "Captions provider failed",
+    reason: "internal",
+    retriable: error.status >= 500
+  };
+}
+function logCaptionsError(context, error) {
+  if (error instanceof CaptionsProviderError) {
+    console.error(`[captions] ${context}: ${error.provider} ${error.status}:`, error.body);
+    return;
+  }
+  console.error(`[captions] ${context}:`, error);
+}
+
+// src/routes/webhooks.ts
+import { Hono as Hono4 } from "hono";
+
+// src/transcode/metrics.ts
+var OPERATOR_EVENT_FIELDS = ["encode", "posterKey", "posterFormats"];
+var isNonNegativeNumber = (value) => typeof value === "number" && Number.isFinite(value) && value >= 0;
+var optionalString = (value) => typeof value === "string" && value.length > 0 ? value : void 0;
+function readEncodeParams(value) {
+  if (!Array.isArray(value)) return void 0;
+  const params = value.filter((entry) => {
+    if (typeof entry !== "object" || entry === null) return false;
+    const { rung, crf, maxrateKbps } = entry;
+    return typeof rung === "string" && isNonNegativeNumber(crf) && isNonNegativeNumber(maxrateKbps);
+  });
+  return params.length > 0 ? params.map(({ rung, crf, maxrateKbps }) => ({ rung, crf, maxrateKbps })) : void 0;
+}
+function perTitleMetrics(encode) {
+  const isScore = isNonNegativeNumber(encode.complexity) && encode.complexity <= 1;
+  const encodeParams = readEncodeParams(encode.params);
+  return {
+    ...isScore ? { complexity: encode.complexity } : {},
+    ...isNonNegativeNumber(encode.probeSeconds) ? { probeSeconds: encode.probeSeconds } : {},
+    ...encodeParams ? { encodeParams } : {}
+  };
+}
+var isRecord2 = (value) => typeof value === "object" && value !== null && !Array.isArray(value);
+function parseEncodeMetrics(event) {
+  if (!isRecord2(event) || event.event !== "transcode.complete" || !isRecord2(event.encode)) return null;
+  const { encode } = event;
+  if (!isNonNegativeNumber(encode.seconds) || !isNonNegativeNumber(event.duration)) return null;
+  return {
+    encodeSeconds: encode.seconds,
+    cpus: isNonNegativeNumber(encode.cpus) ? encode.cpus : 0,
+    durationSeconds: event.duration,
+    topRung: optionalString(encode.topRung),
+    runner: optionalString(encode.runner),
+    ...perTitleMetrics(encode)
+  };
+}
+function vcpuSecondsPerVideoMinute(metrics) {
+  if (metrics.cpus <= 0 || metrics.durationSeconds <= 0) return null;
+  return metrics.encodeSeconds * metrics.cpus / (metrics.durationSeconds / 60);
+}
+function withoutOperatorFields(event) {
+  const clientEvent = { ...event };
+  for (const field of OPERATOR_EVENT_FIELDS) delete clientEvent[field];
+  return clientEvent;
+}
+function logEncodeMetrics(videoId, metrics) {
+  const perMinute = vcpuSecondsPerVideoMinute(metrics);
+  console.log(
+    "[transcode-metrics]",
+    JSON.stringify({
+      videoId,
+      ...metrics,
+      vcpuSecondsPerVideoMinute: perMinute === null ? null : Math.round(perMinute * 10) / 10
+    })
+  );
+}
+
+// src/transcode/outputs-report.ts
+import {
+  buildTranscodeOutputUrls
+} from "@devultur/core";
+var isOutputKey = (value) => typeof value === "string" && /^(public|private)\/video\/[^/]+\/(hls|mp4|thumbnails)\/[^/]+$/.test(value);
+var isPosterFormat = (value) => value === "jpg" || value === "avif";
+var isPixelSize = (value) => Number.isSafeInteger(value) && value > 0;
+function readRendition(raw) {
+  if (typeof raw !== "object" || raw === null) return null;
+  const { variant, kind, rung, key, width, height } = raw;
+  if (typeof variant !== "string" || typeof rung !== "string" || !isOutputKey(key)) return null;
+  if (kind !== "hls" && kind !== "mp4") return null;
+  const size = isPixelSize(width) && isPixelSize(height) ? { width, height } : {};
+  return { variant, kind, rung, key, ...size };
+}
+var STORYBOARD_KEY = /^(public|private)\/video\/[^/]+\/storyboard\/storyboard\.vtt$/;
+function readStoryboardKey(event) {
+  if (typeof event !== "object" || event === null) return null;
+  const { storyboardKey } = event;
+  return typeof storyboardKey === "string" && STORYBOARD_KEY.test(storyboardKey) ? storyboardKey : null;
+}
+function withClientStoryboard(event) {
+  if (!("storyboardKey" in event)) return event;
+  const { storyboardKey: _dropped, ...rest } = event;
+  const storyboardKey = readStoryboardKey(event);
+  if (!storyboardKey || !Array.isArray(event.renditions)) return rest;
+  return { ...rest, storyboardKey };
+}
+function readTranscodeOutputKeys(event) {
+  if (typeof event !== "object" || event === null) return null;
+  const raw = event;
+  if (raw.event !== "transcode.complete" || !Array.isArray(raw.renditions)) return null;
+  const renditions = raw.renditions.map(readRendition).filter((rendition) => rendition !== null);
+  const posterFormats = Array.isArray(raw.posterFormats) ? raw.posterFormats.filter(isPosterFormat) : void 0;
+  return {
+    renditions,
+    ...isOutputKey(raw.posterKey) ? { posterKey: raw.posterKey } : {},
+    ...posterFormats?.length ? { posterFormats } : {},
+    ...typeof raw.hasAudio === "boolean" ? { hasAudio: raw.hasAudio } : {}
+  };
+}
+function readTranscodeOutputs(event, baseUrl) {
+  const keys = readTranscodeOutputKeys(event);
+  return keys ? buildTranscodeOutputUrls(baseUrl, keys) : null;
+}
+function withOutputUrls(event, baseUrl) {
+  const outputs = readTranscodeOutputs(event, baseUrl);
+  if (!outputs) return event;
+  return { ...event, ...outputs };
+}
+var outputBaseKey = (videoId) => `${KvPrefix.TRANSCODE_META}:output-base:${videoId}`;
+function saveOutputBaseUrl(kv, videoId, baseUrl) {
+  return kv.put(outputBaseKey(videoId), baseUrl, { expirationTtl: KV_JOB_TTL_SECONDS });
+}
+async function loadOutputBaseUrl(kv, videoId, fallbackUrl) {
+  if (typeof videoId !== "string" || !videoId) return fallbackUrl;
+  return await kv.get(outputBaseKey(videoId)) ?? fallbackUrl;
+}
+
+// src/transcode/raw-retention.ts
+import { isVideoRawKey } from "@devultur/core";
+var disposalKey = (videoId) => `${KvPrefix.TRANSCODE_RAW}:${videoId}`;
+async function rememberRawDisposal(kv, videoId, disposal) {
+  await kv.put(disposalKey(videoId), JSON.stringify(disposal), { expirationTtl: KV_JOB_TTL_SECONDS });
+}
+async function disposeRawAfterTranscode(env, videoId) {
+  const disposal = await env.MEDIA_KV.get(disposalKey(videoId), "json");
+  if (!disposal?.deleteOnComplete || !disposal.storageKey) return false;
+  await env.MEDIA_BUCKET.delete(disposal.storageKey);
+  if (env.KEYS_BUCKET) await deletePrefix(env.KEYS_BUCKET, `${disposal.storageKey}/`);
+  return true;
+}
+var ORIGINAL_NOT_RETAINED = {
+  error: "The original of this video is no longer retained, so it can't be re-encoded. Upload it again, or set `config.transcode.deleteOriginalOnSuccess` to false for future videos.",
+  code: "original_not_retained"
+};
+var PRIOR_OUTPUTS_LIST_LIMIT = 100;
+async function hasPriorTranscodeOutputs(bucket, videoFolder) {
+  const listing = await bucket.list({ prefix: videoFolder, limit: PRIOR_OUTPUTS_LIST_LIMIT });
+  return listing.objects.some((object) => !isVideoRawKey(object.key));
+}
+
+// src/transcode/status.ts
+import { TranscodeStatus } from "@devultur/core";
+var statusKey = (videoId) => `${KvPrefix.TRANSCODE_STATUS}:${videoId}`;
+function statusChangeFor(event) {
+  switch (event.event) {
+    case "transcode.started":
+      return { status: TranscodeStatus.RUNNING };
+    case "transcode.progress":
+      return event.phase === "downloading" ? { status: TranscodeStatus.RUNNING } : null;
+    case "transcode.complete":
+      return { status: TranscodeStatus.COMPLETED };
+    case "transcode.failed":
+      return {
+        status: TranscodeStatus.FAILED,
+        ...typeof event.error === "string" ? { error: event.error } : {},
+        ...typeof event.reason === "string" ? { reason: event.reason } : {},
+        ...typeof event.retriable === "boolean" ? { retriable: event.retriable } : {}
+      };
+    default:
+      return null;
+  }
+}
+async function readStatus(kv, videoId) {
+  return kv.get(statusKey(videoId), "json");
+}
+async function writeQueuedStatus(kv, videoId, job) {
+  const record = { status: TranscodeStatus.QUEUED, ...job, updatedAt: Date.now() };
+  await kv.put(statusKey(videoId), JSON.stringify(record), { expirationTtl: KV_JOB_TTL_SECONDS });
+}
+async function applyStatusEvent(kv, event) {
+  const change = statusChangeFor(event);
+  const videoId = typeof event.videoId === "string" ? event.videoId : "";
+  if (!change || !videoId) return;
+  const current = await readStatus(kv, videoId);
+  if (!current) return;
+  if (current.status === TranscodeStatus.COMPLETED) return;
+  const record = {
+    jobRef: current.jobRef,
+    ...current.runner ? { runner: current.runner } : {},
+    ...change,
+    updatedAt: Date.now()
+  };
+  await kv.put(statusKey(videoId), JSON.stringify(record), { expirationTtl: KV_JOB_TTL_SECONDS });
+}
+
+// src/routes/webhooks.ts
+var webhooks = new Hono4();
+webhooks.post("/transcode", async (context) => {
+  const webhookSecret = context.env.TRANSCODE_WEBHOOK_SECRET;
+  if (!webhookSecret) {
+    return context.json(
+      { error: "TRANSCODE_WEBHOOK_SECRET is not configured on the Worker", code: "webhook_secret_missing" },
+      503
+    );
+  }
+  if (!isTranscodeWebhookAuthorized(webhookSecret, context.req.header("Authorization"))) {
+    return context.json({ error: "Unauthorized" }, 401);
+  }
+  const body = await context.req.json();
+  await publishTranscodeJob(context, body);
+  if (body.event === "transcode.complete" && body.videoId) {
+    if (await disposeRawAfterTranscode(context.env, body.videoId)) addRouteResult(context, { originalDeleted: true });
+    await context.env.MEDIA_KV.put(
+      `${KvPrefix.TRANSCODE_META}:${body.videoId}`,
+      JSON.stringify({ duration: body.duration }),
+      { expirationTtl: KV_JOB_TTL_SECONDS }
+    );
+    const metrics = parseEncodeMetrics(body);
+    if (metrics) logEncodeMetrics(body.videoId, metrics);
+  }
+  await applyStatusEvent(context.env.MEDIA_KV, body);
+  const webhookData = await getWebhookData(context.env.MEDIA_KV, body.videoId);
+  const outputBaseUrl = await loadOutputBaseUrl(context.env.MEDIA_KV, body.videoId, new URL(context.req.url).origin);
+  const clientEvent = withClientStoryboard(withoutOperatorFields(withOutputUrls(body, outputBaseUrl)));
+  await forwardToClientWebhook(clientEvent, webhookData);
+  return context.json({ received: true });
+});
+async function publishTranscodeJob(context, body) {
+  const ticket = context.req.header(JOB_TICKET_HEADER);
+  if (!ticket || body.event !== "transcode.complete" || typeof body.videoId !== "string") return;
+  const job = await verifyJobTicket(context.env.DELIVERY_SIGN_SECRET, ticket, body.videoId);
+  if (job) {
+    addRouteResult(context, { transcodeJob: job });
+    return;
+  }
+  console.warn(`[transcode] callback for ${body.videoId} carries a job ticket that does not verify`);
+}
+function clientWebhookKvKey(videoId) {
+  return `${KvPrefix.CAPTION_JOB}:webhook:${videoId}`;
+}
+function clientWebhookFor(scope, url) {
+  return { url, credential: scope.webhookCredential ?? scope.runnerCredential ?? "" };
+}
+async function getWebhookData(kv, videoId) {
+  const raw = await kv.get(clientWebhookKvKey(videoId));
+  if (!raw) return null;
+  try {
+    const stored = JSON.parse(raw);
+    if (typeof stored.url !== "string") return null;
+    return { url: stored.url, credential: typeof stored.credential === "string" ? stored.credential : "" };
+  } catch {
+    return { url: raw, credential: "" };
+  }
+}
+async function forwardToClientWebhook(event, webhookData) {
+  if (!webhookData?.url) return;
+  try {
+    const response = await fetch(webhookData.url, {
+      method: "POST",
+      headers: {
+        "Content-Type": "application/json",
+        ...webhookData.credential ? { Authorization: `Bearer ${webhookData.credential}` } : {}
+      },
+      body: JSON.stringify(event)
+    });
+    if (!response.ok) {
+      const responseBody = await response.text();
+      console.error("[webhook] forward failed:", response.status, webhookData.url, responseBody);
+    }
+  } catch (err) {
+    console.error("[webhook] forward error:", webhookData.url, err);
+  }
+}
+
+// src/routes/captions.ts
+var GROQ_API = "https://api.groq.com/openai/v1";
+var MISTRAL_API = "https://api.mistral.ai/v1";
+var LANGUAGE_NAMES = {
+  en: "English",
+  es: "Spanish",
+  fr: "French",
+  pt: "Portuguese",
+  de: "German",
+  it: "Italian",
+  ja: "Japanese",
+  ko: "Korean",
+  zh: "Chinese",
+  ar: "Arabic",
+  hi: "Hindi",
+  ru: "Russian",
+  nl: "Dutch",
+  sv: "Swedish",
+  pl: "Polish",
+  tr: "Turkish",
+  vi: "Vietnamese",
+  th: "Thai",
+  uk: "Ukrainian",
+  id: "Indonesian"
+};
+function getLanguageName(code) {
+  return LANGUAGE_NAMES[code] ?? code;
+}
+function formatTimestamp(seconds) {
+  const h = Math.floor(seconds / 3600);
+  const m = Math.floor(seconds % 3600 / 60);
+  const s = Math.floor(seconds % 60);
+  const ms = Math.floor(seconds % 1 * 1e3);
+  return `${h.toString().padStart(2, "0")}:${m.toString().padStart(2, "0")}:${s.toString().padStart(2, "0")}.${ms.toString().padStart(3, "0")}`;
+}
+function wordsToSentenceVtt(words) {
+  const cues = [];
+  let sentenceWords = [];
+  for (const word of words) {
+    sentenceWords.push(word);
+    if (/[.!?]$/.test(word.word)) {
+      cues.push({
+        start: sentenceWords[0].start,
+        end: word.end,
+        text: sentenceWords.map((w) => w.word).join(" ")
+      });
+      sentenceWords = [];
+    }
+  }
+  if (sentenceWords.length > 0) {
+    cues.push({
+      start: sentenceWords[0].start,
+      end: sentenceWords[sentenceWords.length - 1].end,
+      text: sentenceWords.map((w) => w.word).join(" ")
+    });
+  }
+  const lines = ["WEBVTT", ""];
+  for (const cue of cues) {
+    lines.push(`${formatTimestamp(cue.start)} --> ${formatTimestamp(cue.end)}`);
+    lines.push(cue.text.trim());
+    lines.push("");
+  }
+  return lines.join("\n");
+}
+function findSourceLocale(detectedLang, locales) {
+  return locales.find((l) => l.split("-")[0] === detectedLang) ?? locales[0];
+}
+function cleanVttResponse(response) {
+  let vtt = response.trim();
+  if (vtt.startsWith("```")) {
+    vtt = vtt.replace(/^```(?:vtt|webvtt)?\n?/, "").replace(/\n?```$/, "");
+  }
+  if (!vtt.startsWith("WEBVTT")) {
+    vtt = `WEBVTT
+
+${vtt}`;
+  }
+  return vtt;
+}
+async function transcribeWithGroq(providerKey, audioBody, filename) {
+  const blob = new Blob([await new Response(audioBody).arrayBuffer()]);
+  const formData = new FormData();
+  formData.append("file", blob, filename);
+  formData.append("model", "whisper-large-v3-turbo");
+  formData.append("response_format", "verbose_json");
+  formData.append("timestamp_granularities[]", "word");
+  const response = await fetch(`${GROQ_API}/audio/transcriptions`, {
+    method: "POST",
+    headers: { Authorization: `Bearer ${providerKey}` },
+    body: formData
+  });
+  if (!response.ok) {
+    throw new CaptionsProviderError("groq", response.status, await response.text());
+  }
+  return await response.json();
+}
+async function translateVtt(providerKey, sourceVtt, targetLocale) {
+  const targetLang = targetLocale.split("-")[0];
+  const targetName = getLanguageName(targetLang);
+  const response = await fetch(`${MISTRAL_API}/chat/completions`, {
+    method: "POST",
+    headers: {
+      Authorization: `Bearer ${providerKey}`,
+      "Content-Type": "application/json"
+    },
+    body: JSON.stringify({
+      model: "mistral-small-latest",
+      messages: [
+        {
+          role: "user",
+          content: [
+            `Translate the following WebVTT subtitle file to ${targetName} (${targetLocale}).`,
+            "Rules:",
+            "- Keep the WEBVTT header and ALL timestamps exactly as-is",
+            "- Only translate the spoken text between timestamp lines",
+            "- Do not add or remove any cues",
+            "- Return ONLY the complete translated VTT file, no commentary",
+            "",
+            sourceVtt
+          ].join("\n")
+        }
+      ]
+    })
+  });
+  if (!response.ok) {
+    throw new CaptionsProviderError("mistral", response.status, await response.text());
+  }
+  const result = await response.json();
+  return cleanVttResponse(result.choices[0].message.content);
+}
+async function resolveCaptionsWebhook(context, videoId, callbackUrl) {
+  if (callbackUrl) return clientWebhookFor(getRequestState(context), callbackUrl);
+  const stored = await getWebhookData(context.env.MEDIA_KV, videoId);
+  return stored;
+}
+async function transcodedDuration(kv, videoId) {
+  const meta = await kv.get(`${KvPrefix.TRANSCODE_META}:${videoId}`, "json");
+  return meta?.duration ?? void 0;
+}
+var captions = new Hono5();
+captions.post("/", async (context) => {
+  const body = await context.req.json();
+  if (!body.key || !body.locales?.length) {
+    return context.json({ error: "key and locales are required" }, 400);
+  }
+  const scope = getRequestState(context);
+  if (!areLocalesAllowed(body.locales, scope.config?.captionsLocales)) {
+    return context.json(
+      { error: "One or more requested locales are not allowed by this Worker's config", code: "locale_not_allowed" },
+      400
+    );
+  }
+  const fullKey = storageKey(context, body.key);
+  const file = await context.env.MEDIA_BUCKET.get(fullKey);
+  if (!file) {
+    return context.json({ error: "Media not found in storage" }, 404);
+  }
+  const videoId = extractId(body.key);
+  if (!videoId || videoId === body.key) {
+    return context.json({ error: "Invalid key format \u2014 expected {type}/{id}/..." }, 400);
+  }
+  const filename = body.key.split("/").pop() ?? "audio.mp4";
+  const webhookData = await resolveCaptionsWebhook(context, videoId, body.callbackUrl);
+  const rawEnc = decodeEncryptionMeta2(file.customMetadata?.enc);
+  let audioBody = file.body;
+  if (rawEnc) {
+    const loaded = await loadStorageKey(context.env.KEYS_BUCKET, fullKey, rawEnc.keyId);
+    if (!loaded) {
+      return context.json({ error: "Decryption key unavailable" }, 500);
+    }
+    audioBody = file.body.pipeThrough(createDecryptStream2(loaded.key, rawEnc.iv));
+  }
+  const visibility = visibilityFromKey(body.key) ?? "private";
+  const captionKey = (locale) => storageKey(context, `${visibility}/${captionPath(videoId, locale)}`);
+  const resourceOverride = parseSecurityHeader(file.customMetadata?.security);
+  const captionPolicy = resolveSecurity(resourceOverride, scope.config?.security);
+  const encryptCaptions = captionPolicy.encrypt && visibility === "private" && Boolean(context.env.KEYS_BUCKET);
+  const putCaption = async (locale, vtt) => {
+    const objectKey = captionKey(locale);
+    const metadata = {};
+    if (resourceOverride) metadata.security = JSON.stringify(resourceOverride);
+    let bodyToStore = vtt;
+    if (encryptCaptions && context.env.KEYS_BUCKET) {
+      const result = await encryptForStorage(
+        context.env.KEYS_BUCKET,
+        objectKey,
+        new TextEncoder().encode(vtt),
+        metadata
+      );
+      bodyToStore = result.body;
+      metadata.enc = result.enc;
+    }
+    await context.env.MEDIA_BUCKET.put(objectKey, bodyToStore, {
+      httpMetadata: { contentType: "text/vtt" },
+      ...Object.keys(metadata).length > 0 ? { customMetadata: metadata } : {}
+    });
+  };
+  try {
+    const transcript = await transcribeWithGroq(context.env.GROQ_API_KEY, audioBody, filename);
+    const sourceVtt = wordsToSentenceVtt(transcript.words);
+    const detectedLang = transcript.language.slice(0, 2);
+    const sourceLocale = findSourceLocale(detectedLang, body.locales);
+    const jobId = crypto.randomUUID();
+    const completedLocales = [];
+    await putCaption(sourceLocale, sourceVtt);
+    completedLocales.push(sourceLocale);
+    const duplicateLocales = body.locales.filter((l) => l !== sourceLocale && l.split("-")[0] === detectedLang);
+    for (const locale of duplicateLocales) {
+      await putCaption(locale, sourceVtt);
+      completedLocales.push(locale);
+    }
+    const translationLocales = body.locales.filter((l) => l !== sourceLocale && l.split("-")[0] !== detectedLang);
+    const translationResults = await Promise.allSettled(
+      translationLocales.map(async (locale) => {
+        const translatedVtt = await translateVtt(context.env.MISTRAL_API_KEY, sourceVtt, locale);
+        await putCaption(locale, translatedVtt);
+        return locale;
+      })
+    );
+    const translatedLocales = [];
+    for (const [index, result] of translationResults.entries()) {
+      if (result.status === "rejected") {
+        logCaptionsError(`translation to ${translationLocales[index]} failed for ${videoId}`, result.reason);
+        continue;
+      }
+      completedLocales.push(result.value);
+      translatedLocales.push(result.value);
+    }
+    const jobMeta = { videoId, locales: body.locales, completedLocales, status: "completed" };
+    await context.env.MEDIA_KV.put(`${KvPrefix.CAPTION_GROUP}:${jobId}`, JSON.stringify(jobMeta), {
+      expirationTtl: KV_JOB_TTL_SECONDS
+    });
+    await forwardToClientWebhook({ event: "captions.complete", videoId, locales: completedLocales }, webhookData);
+    return context.json({
+      transcriptId: jobId,
+      inputKey: body.key,
+      locales: body.locales,
+      completedLocales,
+      // Job detail for the caller: source language, effective translations and the audio's duration (the
+      // transcription's; without it, the one the last transcode reported, kept in KV for 24 h).
+      sourceLocale,
+      translatedLocales,
+      durationSeconds: transcript.duration ?? await transcodedDuration(context.env.MEDIA_KV, videoId),
+      status: "completed"
+    });
+  } catch (err) {
+    logCaptionsError(`job failed for ${videoId}`, err);
+    const failure3 = toCaptionsFailure(err);
+    await forwardToClientWebhook(
+      {
+        event: "captions.failed",
+        videoId,
+        error: failure3.error,
+        reason: failure3.reason,
+        retriable: failure3.retriable
+      },
+      webhookData
+    );
+    return context.json({ error: failure3.error, code: failure3.code }, failure3.status);
+  }
+});
+captions.get("/:transcriptId", async (context) => {
+  const transcriptId = context.req.param("transcriptId");
+  const job = await context.env.MEDIA_KV.get(`${KvPrefix.CAPTION_GROUP}:${transcriptId}`, "json");
+  if (!job) {
+    return context.json({ error: "Caption job not found" }, 404);
+  }
+  return context.json({
+    transcriptId,
+    status: job.status,
+    // The ones actually generated; falls back to `locales` (requested) only for old jobs missing the field.
+    completedLocales: job.completedLocales ?? job.locales,
+    error: job.error
+  });
+});
+
+// src/routes/media.ts
+import {
+  computeFingerprint,
+  decodeEncryptionMeta as decodeEncryptionMeta4,
+  GENERATED_PRIVATE_CACHE_CONTROL,
+  GENERATED_PUBLIC_CACHE_CONTROL,
+  resolveSecurity as resolveSecurity2,
+  SESSION_HEADER,
+  toPrivateCacheControl,
+  videoBasePath,
+  visibilityFromKey as visibilityFromKey2
+} from "@devultur/core";
+import { Hono as Hono6 } from "hono";
+
+// src/image/cloudflare.ts
+var IMAGE_RESIZING_VIA = "image-resizing";
+var ORIGIN_MESSAGE_PREFIX = "image-origin:";
+var ORIGIN_CREDENTIAL_PREFIX = "Bearer dvo.";
+var CLOUDFLARE_FIT = {
+  fill: "squeeze",
+  cover: "cover",
+  contain: "contain",
+  "scale-down": "scale-down",
+  pad: "pad"
+};
+function imageOriginUrl(requestUrl) {
+  return new URL(`${requestUrl.origin}${requestUrl.pathname}`);
+}
+async function originSigningKey(secret, usage) {
+  const keyBytes = new TextEncoder().encode(secret);
+  return crypto.subtle.importKey("raw", keyBytes, { name: "HMAC", hash: "SHA-256" }, false, [usage]);
+}
+var originMessage = (scope, url) => new TextEncoder().encode(`${ORIGIN_MESSAGE_PREFIX}${scope}
+${url.host}${url.pathname}`);
+var base64Url = (bytes) => btoa(String.fromCharCode(...bytes)).replace(/\+/g, "-").replace(/\//g, "_").replace(/=+$/, "");
+async function imageOriginAuthorization(secret, origin) {
+  const key = await originSigningKey(secret, "sign");
+  const signature = await crypto.subtle.sign("HMAC", key, originMessage(origin.scope, origin.url));
+  const encodedScope = base64Url(new TextEncoder().encode(origin.scope));
+  return `${ORIGIN_CREDENTIAL_PREFIX}${encodedScope}.${base64Url(new Uint8Array(signature))}`;
+}
+async function readImageOriginScope(request, secret) {
+  if (request.method !== "GET" || !request.headers.get("via")?.includes(IMAGE_RESIZING_VIA)) return null;
+  const authorization = request.headers.get("Authorization");
+  if (!secret || !authorization?.startsWith(ORIGIN_CREDENTIAL_PREFIX)) return null;
+  const [encodedScope, encodedSignature] = authorization.slice(ORIGIN_CREDENTIAL_PREFIX.length).split(".");
+  if (encodedScope === void 0 || !encodedSignature) return null;
+  try {
+    const scope = new TextDecoder().decode(base64UrlDecode(encodedScope));
+    const key = await originSigningKey(secret, "verify");
+    const message = originMessage(scope, new URL(request.url));
+    const isValid = await crypto.subtle.verify("HMAC", key, base64UrlDecode(encodedSignature), message);
+    return isValid ? scope : null;
+  } catch {
+    return null;
+  }
+}
+async function isImageOriginRequest(request, secret) {
+  return await readImageOriginScope(request, secret) !== null;
+}
+function cloudflareImageOptions(params, format) {
+  const options = { "origin-auth": "share-publicly" };
+  if (params.width) options.width = params.width;
+  if (params.height) options.height = params.height;
+  if (params.fit) options.fit = CLOUDFLARE_FIT[params.fit];
+  if (params.quality) options.quality = params.quality;
+  if (format) options.format = format;
+  return options;
+}
+async function fetchCloudflareImage(origin, secret, image) {
+  return fetch(origin.url.toString(), {
+    headers: { Authorization: await imageOriginAuthorization(secret, origin) },
+    cf: { image }
+  });
+}
+function cloudflareOutputFormat(params, accept, sourceType) {
+  const requested = resolveRequestedFormat(params, accept);
+  if (requested === "source") return null;
+  if (params.format !== "auto") return resolveOutputFormat(requested, sourceType);
+  if (requested === "avif" && sourceType === "image/jpeg") return "avif";
+  if (accept?.includes("image/webp")) return "webp";
+  if (sourceType === "image/gif") return null;
+  return resolveOutputFormat("baseline", sourceType);
+}
+async function serveCloudflareTransform(transform) {
+  const { params, accept, sourceType } = transform;
+  const format = cloudflareOutputFormat(params, accept, sourceType);
+  const image = cloudflareImageOptions(params, format);
+  const transformed = await fetchCloudflareImage(transform.origin, transform.secret, image);
+  const headers = new Headers(transformed.headers);
+  headers.set("Cache-Control", transform.cacheControl);
+  if (params.format === "auto") headers.set("Vary", "Accept");
+  if (transform.disposition) headers.set("Content-Disposition", transform.disposition);
+  return new Response(transformed.body, { status: transformed.status, headers });
+}
+
+// src/image/params.ts
+var IMAGE_CONTENT_TYPES = /* @__PURE__ */ new Set(["image/jpeg", "image/png", "image/webp", "image/avif", "image/gif"]);
+var ImageFit = {
+  COVER: "cover",
+  CONTAIN: "contain",
+  FILL: "fill",
+  SCALE_DOWN: "scale-down",
+  PAD: "pad"
+};
+var VALID_FITS = new Set(Object.values(ImageFit));
+var VALID_FORMATS = /* @__PURE__ */ new Set(["webp", "avif", "jpeg", "png", "auto"]);
+var MAX_DIMENSION = 4096;
+var MIN_QUALITY = 1;
+var MAX_QUALITY = 100;
+var TRANSFORM_QUERY_PARAMS = ["w", "width", "h", "height", "fit", "format", "q", "quality"];
+function parseTransformParams(url) {
+  const width = url.searchParams.get("w") ?? url.searchParams.get("width");
+  const height = url.searchParams.get("h") ?? url.searchParams.get("height");
+  const fit = url.searchParams.get("fit");
+  const format = url.searchParams.get("format");
+  const quality = url.searchParams.get("q") ?? url.searchParams.get("quality");
+  if (!width && !height && !fit && !format && !quality) return null;
+  const params = {};
+  if (width) {
+    const parsed = Number.parseInt(width, 10);
+    if (parsed > 0 && parsed <= MAX_DIMENSION) params.width = parsed;
+  }
+  if (height) {
+    const parsed = Number.parseInt(height, 10);
+    if (parsed > 0 && parsed <= MAX_DIMENSION) params.height = parsed;
+  }
+  if (fit && VALID_FITS.has(fit)) params.fit = fit;
+  if (format && VALID_FORMATS.has(format)) params.format = format;
+  if (quality) {
+    const parsed = Number.parseInt(quality, 10);
+    if (parsed >= MIN_QUALITY && parsed <= MAX_QUALITY) params.quality = parsed;
+  }
+  return Object.keys(params).length > 0 ? params : null;
+}
+function hasTransformQuery(url) {
+  return TRANSFORM_QUERY_PARAMS.some((param) => url.searchParams.has(param));
+}
+
+// src/image/dimensions.ts
+function readImageDimensions(bytes, contentType) {
+  if (contentType === "image/jpeg") return readJpeg(bytes);
+  if (contentType === "image/png") return readPng(bytes);
+  if (contentType === "image/webp") return readWebp(bytes);
+  if (contentType === "image/avif") return readAvif(bytes);
+  return null;
+}
+var uint16BE = (bytes, offset) => bytes[offset] << 8 | bytes[offset + 1];
+var uint32BE = (bytes, offset) => (bytes[offset] << 24 | bytes[offset + 1] << 16 | bytes[offset + 2] << 8 | bytes[offset + 3]) >>> 0;
+var uint16LE = (bytes, offset) => bytes[offset] | bytes[offset + 1] << 8;
+var uint24LE = (bytes, offset) => bytes[offset] | bytes[offset + 1] << 8 | bytes[offset + 2] << 16;
+var isStartOfFrame = (marker) => marker >= 192 && marker <= 207 && marker !== 196 && marker !== 200 && marker !== 204;
+function readJpeg(bytes) {
+  if (bytes[0] !== 255 || bytes[1] !== 216) return null;
+  let offset = 2;
+  while (offset + 9 < bytes.length) {
+    if (bytes[offset] !== 255) return null;
+    const marker = bytes[offset + 1];
+    if (isStartOfFrame(marker)) {
+      return { height: uint16BE(bytes, offset + 5), width: uint16BE(bytes, offset + 7) };
+    }
+    offset += 2 + uint16BE(bytes, offset + 2);
+  }
+  return null;
+}
+function readPng(bytes) {
+  const isPng = bytes[0] === 137 && bytes[1] === 80 && bytes[2] === 78 && bytes[3] === 71;
+  if (!isPng || bytes.length < 24) return null;
+  return { width: uint32BE(bytes, 16), height: uint32BE(bytes, 20) };
+}
+function readWebp(bytes) {
+  if (bytes.length < 30) return null;
+  const chunk = String.fromCharCode(bytes[12], bytes[13], bytes[14], bytes[15]);
+  if (chunk === "VP8X") return { width: uint24LE(bytes, 24) + 1, height: uint24LE(bytes, 27) + 1 };
+  if (chunk === "VP8 ") return { width: uint16LE(bytes, 26) & 16383, height: uint16LE(bytes, 28) & 16383 };
+  if (chunk === "VP8L") {
+    const bits = bytes[21] | bytes[22] << 8 | bytes[23] << 16 | bytes[24] << 24;
+    return { width: (bits & 16383) + 1, height: (bits >> 14 & 16383) + 1 };
+  }
+  return null;
+}
+function readAvif(bytes) {
+  const limit = Math.min(bytes.length - 20, 64 * 1024);
+  for (let offset = 4; offset < limit; offset += 1) {
+    const isIspe = bytes[offset] === 105 && bytes[offset + 1] === 115 && bytes[offset + 2] === 112 && bytes[offset + 3] === 101;
+    if (isIspe) return { width: uint32BE(bytes, offset + 8), height: uint32BE(bytes, offset + 12) };
+  }
+  return null;
+}
+var fourCC = (bytes, offset) => String.fromCharCode(bytes[offset], bytes[offset + 1], bytes[offset + 2], bytes[offset + 3]);
+function isAnimatedImage(bytes, contentType) {
+  if (contentType === "image/gif") return true;
+  if (contentType === "image/webp")
+    return bytes.length > 20 && fourCC(bytes, 12) === "VP8X" && (bytes[20] & 2) !== 0;
+  if (contentType === "image/png") return hasPngAnimationControl(bytes);
+  if (contentType === "image/avif") return hasAvifSequenceBrand(bytes);
+  return false;
+}
+function hasPngAnimationControl(bytes) {
+  let offset = 8;
+  while (offset + 8 <= bytes.length) {
+    const chunk = fourCC(bytes, offset + 4);
+    if (chunk === "acTL") return true;
+    if (chunk === "IDAT") return false;
+    offset += 12 + uint32BE(bytes, offset);
+  }
+  return false;
+}
+function hasAvifSequenceBrand(bytes) {
+  if (bytes.length < 16 || fourCC(bytes, 4) !== "ftyp") return false;
+  const boxEnd = Math.min(uint32BE(bytes, 0), bytes.length);
+  for (let offset = 8; offset + 4 <= boxEnd; offset += 4) {
+    if (offset === 12) continue;
+    if (fourCC(bytes, offset) === "avis") return true;
+  }
+  return false;
+}
+
+// src/image/storage.ts
+import { decodeEncryptionMeta as decodeEncryptionMeta3, decryptChunk as decryptChunk2 } from "@devultur/core";
+var HEADER_PROBE_BYTES = 256 * 1024;
+var passThrough = async (bytes) => bytes;
+var DerivedKind = {
+  VARIANT: "variant",
+  MEZZANINE: "mezzanine"
+};
+async function loadDecryptor(env, objectKey, customMetadata) {
+  const enc = decodeEncryptionMeta3(customMetadata?.enc);
+  if (!enc) return passThrough;
+  const loaded = await loadStorageKey(env.KEYS_BUCKET, objectKey, enc.keyId);
+  if (!loaded) return null;
+  return (bytes) => decryptChunk2(bytes, loaded.key, enc.iv, 0);
+}
+async function readHeaderBytes(env, objectKey, object, decrypt) {
+  const length = Math.min(object.size, HEADER_PROBE_BYTES);
+  if (length === 0) return null;
+  const part = await env.MEDIA_BUCKET.get(objectKey, { range: { offset: 0, length } });
+  if (!part) return null;
+  return decrypt(new Uint8Array(await part.arrayBuffer()));
+}
+async function readWholeObject(object, decrypt) {
+  return decrypt(new Uint8Array(await object.arrayBuffer()));
+}
+async function storeDerived(env, storageKey2, body, contentType, original, kind) {
+  const security = original.customMetadata?.security;
+  const customMetadata = { derivedFrom: kind };
+  if (security) customMetadata.security = security;
+  let storedBody = body;
+  if (decodeEncryptionMeta3(original.customMetadata?.enc)) {
+    if (!env.KEYS_BUCKET) throw new Error("Encrypted original without KEYS_BUCKET");
+    const encrypted = await encryptForStorage(env.KEYS_BUCKET, storageKey2, body, security ? { security } : void 0);
+    storedBody = encrypted.body;
+    customMetadata.enc = encrypted.enc;
+  }
+  await env.MEDIA_BUCKET.put(storageKey2, storedBody, {
+    storageClass: "Standard",
+    httpMetadata: { contentType },
+    customMetadata
+  });
+}
+
+// src/image/mezzanine.ts
+var MEZZANINE_QUALITY = 90;
+var MEZZANINE_PIXEL_HEADROOM = 0.98;
+function mezzanineFormat(sourceType) {
+  return sourceType === "image/jpeg" ? "jpeg" : "webp";
+}
+function mezzanineKey(fullKey, sourceType) {
+  return `${variantPrefix(fullKey)}mezzanine.${mezzanineFormat(sourceType)}`;
+}
+function mezzanineLongSide(original, maxMegapixels) {
+  const budgetPixels = maxMegapixels * 1e6 * MEZZANINE_PIXEL_HEADROOM;
+  const scale = Math.min(1, Math.sqrt(budgetPixels / (original.width * original.height)));
+  return Math.max(1, Math.floor(Math.max(original.width, original.height) * scale));
+}
+var isLandscape = (size) => size.width >= size.height;
+function canServeFromMezzanine(original, mezzanine, params) {
+  const oriented = isLandscape(original) === isLandscape(mezzanine) ? original : { width: original.height, height: original.width };
+  const fromOriginal = planResize(oriented, params);
+  const fromMezzanine = planResize(mezzanine, params);
+  if (isUpscale(mezzanine, fromMezzanine)) return false;
+  const isSameWidth = Math.abs(fromOriginal.width - fromMezzanine.width) <= 1;
+  return isSameWidth && Math.abs(fromOriginal.height - fromMezzanine.height) <= 1;
+}
+var inFlight = /* @__PURE__ */ new Map();
+function resolveMezzanine(request) {
+  const key = mezzanineKey(request.fullKey, request.original.httpMetadata?.contentType ?? "");
+  const pending = inFlight.get(key);
+  if (pending) return pending;
+  const run = loadOrCreate(request, key).finally(() => inFlight.delete(key));
+  inFlight.set(key, run);
+  return run;
+}
+async function loadOrCreate(request, key) {
+  const stored = await readStoredMezzanine(request.env, key, request.maxMegapixels);
+  if (stored) return { kind: "mezzanine", source: stored, created: false };
+  return createMezzanine(request, key);
+}
+async function readStoredMezzanine(env, key, maxMegapixels) {
+  const object = await env.MEDIA_BUCKET.get(key);
+  if (!object) return null;
+  const decrypt = await loadDecryptor(env, key, object.customMetadata);
+  if (!decrypt) return null;
+  const bytes = await decrypt(new Uint8Array(await object.arrayBuffer()));
+  return validMezzanine(bytes, object.httpMetadata?.contentType ?? "", maxMegapixels);
+}
+async function createMezzanine(request, key) {
+  const { env, original, originalDimensions, maxMegapixels } = request;
+  const format = mezzanineFormat(original.httpMetadata?.contentType ?? "");
+  const longSide = mezzanineLongSide(originalDimensions, maxMegapixels);
+  const response = await fetchCloudflareImage(request.origin, env.DELIVERY_SIGN_SECRET, {
+    width: longSide,
+    height: longSide,
+    fit: "scale-down",
+    format,
+    quality: MEZZANINE_QUALITY,
+    "origin-auth": "share-publicly"
+  });
+  if (!response.ok) return { kind: "fallback", reason: `mezzanine_status:${response.status}` };
+  const bytes = new Uint8Array(await response.arrayBuffer());
+  const declaredLength = response.headers.get("content-length");
+  if (declaredLength && Number(declaredLength) !== bytes.byteLength) {
+    return { kind: "fallback", reason: "mezzanine_truncated" };
+  }
+  const contentType = mimeOfFormat(format);
+  if (!response.headers.get("content-type")?.startsWith(contentType)) {
+    return { kind: "fallback", reason: "mezzanine_type" };
+  }
+  const source = validMezzanine(bytes, contentType, maxMegapixels);
+  if (!source) return { kind: "fallback", reason: "mezzanine_invalid" };
+  await storeDerived(env, key, bytes.buffer, contentType, original, DerivedKind.MEZZANINE);
+  console.log(`[image-transforms] mezzanine created ${source.dimensions.width}x${source.dimensions.height}`);
+  return { kind: "mezzanine", source, created: true };
+}
+function validMezzanine(bytes, contentType, maxMegapixels) {
+  const dimensions = readImageDimensions(bytes, contentType);
+  if (!dimensions || megapixels(dimensions) > maxMegapixels) return null;
+  if (isAnimatedImage(bytes, contentType)) return null;
+  return { bytes, contentType, dimensions };
+}
+
+// src/image/worker-transform.ts
+var MAX_SOURCE_BYTES = 25 * 1024 * 1024;
+var fallback = (reason) => ({ kind: "fallback", reason });
+function workerVariantKey(fullKey, params, accept) {
+  return variantStorageKey(fullKey, params, resolveRequestedFormat(params, accept));
+}
+async function resolveWorkerVariant(request) {
+  const storageKey2 = workerVariantKey(request.fullKey, request.params, request.accept);
+  const existing = await request.env.MEDIA_BUCKET.get(storageKey2);
+  if (existing) return { kind: "variant", storageKey: storageKey2, object: existing, generated: false };
+  try {
+    return await generateVariant(request, storageKey2);
+  } catch (error) {
+    console.error("[image-transforms] worker path failed:", error);
+    return fallback(`error:${error instanceof Error ? error.name : "unknown"}`);
+  }
+}
+async function generateVariant(request, storageKey2) {
+  const { env, fullKey, original, params } = request;
+  const sourceType = original.httpMetadata?.contentType ?? "";
+  if (!WORKER_DECODABLE_TYPES.has(sourceType)) return fallback(`type:${sourceType}`);
+  const decrypt = await loadDecryptor(env, fullKey, original.customMetadata);
+  if (!decrypt) return fallback("decryption_key_unavailable");
+  const header = await readHeaderBytes(env, fullKey, original, decrypt);
+  const dimensions = header ? readImageDimensions(header, sourceType) : null;
+  if (!header || !dimensions) return fallback("unreadable_header");
+  if (isAnimatedImage(header, sourceType)) return fallback("animated");
+  const maxMegapixels = parseMaxMegapixels(env.IMAGE_TRANSFORMS_MAX_MEGAPIXELS);
+  const isWithinBudget = megapixels(dimensions) <= maxMegapixels && original.size <= MAX_SOURCE_BYTES;
+  const source = isWithinBudget ? { bytes: await readWholeObject(original, decrypt), contentType: sourceType, dimensions } : await mezzanineSource(request, dimensions, maxMegapixels);
+  if ("reason" in source) return source;
+  const plan = planResize(source.dimensions, params);
+  if (!fitsWorkerBudget(source.dimensions, maxMegapixels, plan)) return fallback("megapixels");
+  const format = resolveOutputFormat(resolveRequestedFormat(params, request.accept), sourceType);
+  const output = await oneAtATime(() => runCodecs(source, params, format));
+  await storeDerived(env, storageKey2, output.body, output.contentType, original, DerivedKind.VARIANT);
+  const stored = await env.MEDIA_BUCKET.get(storageKey2);
+  if (!stored) return fallback("variant_write_lost");
+  return { kind: "variant", storageKey: storageKey2, object: stored, generated: true };
+}
+async function mezzanineSource(request, originalDimensions, maxMegapixels) {
+  const { env, fullKey, original, origin, params } = request;
+  const mezzanine = await resolveMezzanine({ env, fullKey, original, originalDimensions, origin, maxMegapixels });
+  if (mezzanine.kind === "fallback") return mezzanine;
+  if (!canServeFromMezzanine(originalDimensions, mezzanine.source.dimensions, params)) {
+    return fallback("beyond_mezzanine");
+  }
+  return mezzanine.source;
+}
+var transformQueue = Promise.resolve();
+function oneAtATime(task) {
+  const run = transformQueue.then(task, task);
+  transformQueue = run.catch(() => void 0);
+  return run;
+}
+async function runCodecs(source, params, format) {
+  const [{ prepareCodecs, transformImage }, { codecWasmModules }] = await Promise.all([
+    import("./codecs-RKUOPKWR.js"),
+    import("./wasm-modules-55Q2QP7Q.js")
+  ]);
+  await prepareCodecs(codecWasmModules, source.contentType, format);
+  const headerPixels = source.dimensions.width * source.dimensions.height;
+  return transformImage(
+    source.bytes.buffer,
+    source.contentType,
+    (decoded) => planResize(decoded, params),
+    { format, quality: outputQuality(params, format) },
+    headerPixels
+  );
+}
+
+// src/routes/edge-cache.ts
+import { edgeTtlSeconds, isAssetKey, sha256Hex as sha256Hex2 } from "@devultur/core";
+var MAX_EDGE_TTL_SECONDS = 7 * 24 * 60 * 60;
+var MAX_EDGE_CACHE_FILL_BYTES = 100 * 1024 * 1024;
+var ORIGINAL_CACHE_CONTROL_HEADER = "x-devultur-cache-control";
+var CACHE_TAG_HEADER = "Cache-Tag";
+var TAG_HASH_LENGTH = 40;
+function publicEdgeCache() {
+  if (typeof caches === "undefined") return null;
+  return caches.default;
+}
+function purgeUnitOfKey(virtualKey) {
+  if (isAssetKey(virtualKey)) return virtualKey;
+  return virtualKey.split("/").slice(0, 3).join("/");
+}
+async function edgeCacheTag(storagePrefix2, virtualKey) {
+  const digest = await sha256Hex2(new TextEncoder().encode(`${storagePrefix2}${purgeUnitOfKey(virtualKey)}`));
+  return `dv-o-${digest.slice(0, TAG_HASH_LENGTH)}`;
+}
+function prefixEdgeCacheTag(storagePrefix2) {
+  const prefix = storagePrefix2.replace(/\/$/, "");
+  return prefix ? `dv-p-${prefix}` : null;
+}
+async function edgeCacheTags(storagePrefix2, virtualKey) {
+  const prefixTag = prefixEdgeCacheTag(storagePrefix2);
+  const objectTag = await edgeCacheTag(storagePrefix2, virtualKey);
+  return prefixTag ? `${objectTag},${prefixTag}` : objectTag;
+}
+function responseFromEdgeHit(hit, options) {
+  const headers = new Headers(hit.headers);
+  if (options.isFormatNegotiated) headers.set("Vary", "Accept");
+  const original = headers.get(ORIGINAL_CACHE_CONTROL_HEADER);
+  if (original) headers.set("Cache-Control", original);
+  headers.delete(ORIGINAL_CACHE_CONTROL_HEADER);
+  headers.delete(CACHE_TAG_HEADER);
+  return new Response(hit.body, { status: hit.status, headers });
+}
+function edgeTtlFor(cacheControl) {
+  return edgeTtlSeconds(cacheControl, MAX_EDGE_TTL_SECONDS);
+}
+async function putEdgeCopy(target, body, headers) {
+  const ttl = edgeTtlFor(target.cacheControl);
+  const copyHeaders = new Headers(headers);
+  copyHeaders.delete("Content-Range");
+  copyHeaders.delete("Vary");
+  copyHeaders.set(ORIGINAL_CACHE_CONTROL_HEADER, target.cacheControl);
+  copyHeaders.set("Cache-Control", `public, max-age=${ttl}`);
+  copyHeaders.set(CACHE_TAG_HEADER, await edgeCacheTags(target.storagePrefix, target.virtualKey));
+  await target.cache.put(target.cacheKey, new Response(body, { status: 200, headers: copyHeaders }));
+}
+async function fillEdgeCache(target, bucket, fullKey, headers) {
+  const full = await bucket.get(fullKey);
+  if (!full) return;
+  const fullHeaders = new Headers(headers);
+  fullHeaders.set("Content-Length", String(full.size));
+  await putEdgeCopy(target, full.body, fullHeaders);
+}
+
+// src/routes/storyboard-vtt.ts
+import { createDecryptStream as createDecryptStream3 } from "@devultur/core";
+var STORYBOARD_VTT = /(?:^|\/)video\/[^/]+\/storyboard\/[^/]+\.vtt$/;
+var SPRITE_LINE = /^(sprite-\d+\.jpg)(#xywh=\d+,\d+,\d+,\d+)?$/gm;
+function isStoryboardVttKey(key) {
+  return STORYBOARD_VTT.test(key);
+}
+function rewriteStoryboardVtt(vttText, token2) {
+  return vttText.replace(SPRITE_LINE, (_line, file, fragment = "") => `${file}?token=${token2}${fragment}`);
+}
+async function storyboardVttResponse(body, token2, decryption) {
+  const plain = decryption ? body.pipeThrough(createDecryptStream3(decryption.key, decryption.iv)) : body;
+  const vttText = await new Response(plain).text();
+  return new Response(rewriteStoryboardVtt(vttText, token2), {
+    headers: { "Content-Type": "text/vtt; charset=utf-8", "Cache-Control": "no-cache" }
+  });
+}
+
+// src/routes/media.ts
+async function verifyDeliveryToken(token2, secret) {
+  const payload = await verifyViewerToken(token2, secret);
+  return payload && payload.typ !== "upload" ? payload : null;
+}
+function downloadDisposition(storedDisposition, key, filename) {
+  if (filename) return contentDispositionAttachment(filename);
+  if (storedDisposition?.startsWith("inline")) return `attachment${storedDisposition.slice("inline".length)}`;
+  return contentDispositionAttachment(key.split("/").pop() || "download");
+}
+var media = new Hono6();
+media.get("/:key{.+}", async (context) => {
+  const key = context.req.param("key");
+  const fullKey = storageKey(context, key);
+  const requestUrl = new URL(context.req.url);
+  if (isVariantKey(key)) {
+    return context.json({ error: "Not found" }, 404);
+  }
+  const callerScope = storagePrefix(context, "");
+  const originScope = await readImageOriginScope(context.req.raw, context.env.DELIVERY_SIGN_SECRET);
+  const isOriginRequest = originScope !== null && originScope === callerScope;
+  const origin = { url: imageOriginUrl(requestUrl), scope: callerScope };
+  const visibility = visibilityFromKey2(key) ?? "private";
+  const isPrivate = visibility === "private";
+  const isOwnerAccess = getRequestState(context).access?.trustedRead === true;
+  const token2 = isOwnerAccess ? void 0 : context.req.query("token") ?? context.req.header("Authorization")?.replace(/^Bearer\s+/i, "");
+  let tokenPayload = null;
+  if (isPrivate && !isOriginRequest && !isOwnerAccess) {
+    tokenPayload = await verifyDeliveryToken(token2, context.env.DELIVERY_SIGN_SECRET);
+    if (!tokenPayload) {
+      return context.json({ error: "Unauthorized" }, 401);
+    }
+    const claimRejection = viewerTokenClaimRejection(tokenPayload, {
+      storagePrefix: getRequestState(context).storagePrefix,
+      key
+    });
+    if (claimRejection) {
+      console.warn(`[delivery] token rejected (${claimRejection.reason}) for ${key}`);
+      return context.json({ error: claimRejection.error, code: claimRejection.code }, claimRejection.status);
+    }
+  }
+  if (key.includes("/hls/") && key.endsWith(".key") && !isOwnerAccess) {
+    return serveEncryptionKey(context, key, tokenPayload);
+  }
+  const transformParams = isOriginRequest ? null : parseTransformParams(requestUrl);
+  const isFormatNegotiated = transformParams?.format === "auto";
+  const workerParams = resolveTransformsMode(context.env.IMAGE_TRANSFORMS) === ImageTransformsMode.WORKER ? transformParams : null;
+  const accept = context.req.header("Accept");
+  const edgeCacheKey = workerParams ? `${requestUrl.origin}/__variant/${workerVariantKey(fullKey, workerParams, accept)}` : requestUrl.toString();
+  const isUncachedTransform = hasTransformQuery(requestUrl) && !workerParams;
+  const edgeCache = isPrivate || isOriginRequest || isUncachedTransform ? null : publicEdgeCache();
+  if (edgeCache) {
+    const cacheRequest = workerParams ? new Request(edgeCacheKey, context.req.raw) : context.req.raw;
+    const hit = await edgeCache.match(cacheRequest);
+    if (hit) return responseFromEdgeHit(hit, { isFormatNegotiated });
+  }
+  let object = await context.env.MEDIA_BUCKET.get(fullKey);
+  let servedKey = fullKey;
+  if (!object) {
+    return context.json({ error: "Not found" }, 404);
+  }
+  if (isObjectExpired(object.customMetadata)) return expiredResponse();
+  if (tokenPayload && await bindingMismatch(context, tokenPayload, object.customMetadata)) {
+    return context.json({ error: "Session mismatch", code: "session_mismatch" }, 401);
+  }
+  let contentType = object.httpMetadata?.contentType ?? "application/octet-stream";
+  const isPlaylist = key.endsWith(".m3u8");
+  const cacheControl = servedCacheControl(object.httpMetadata?.cacheControl, isPrivate);
+  const downloadParam = requestUrl.searchParams.get("download");
+  const isDownload = downloadParam !== null;
+  if (isPlaylist && token2) {
+    const playlistText = await object.text();
+    const rewritten = playlistText.replace(/^([^#\s].+\.(?:ts|m3u8))$/gm, `$1?token=${token2}`).replace(/(#EXT-X-KEY:[^\n]*URI=")([^"]+)(")/g, `$1$2?token=${token2}$3`);
+    return new Response(rewritten, {
+      headers: {
+        "Content-Type": "application/vnd.apple.mpegurl",
+        "Cache-Control": "no-cache"
+      }
+    });
+  }
+  const imageParams = IMAGE_CONTENT_TYPES.has(contentType) ? transformParams : null;
+  const disposition = isDownload ? downloadDisposition(object.httpMetadata?.contentDisposition, key, downloadParam ?? "") : void 0;
+  let isServingVariant = false;
+  if (imageParams && workerParams) {
+    const variant = await resolveWorkerVariant({
+      env: context.env,
+      fullKey,
+      original: object,
+      params: workerParams,
+      accept,
+      origin
+    });
+    if (variant.kind === "variant") {
+      object = variant.object;
+      servedKey = variant.storageKey;
+      contentType = object.httpMetadata?.contentType ?? contentType;
+      isServingVariant = true;
+    } else {
+      console.log(`[image-transforms] fallback to cloudflare: ${variant.reason}`);
+    }
+  }
+  if (imageParams && !isServingVariant) {
+    return serveCloudflareTransform({
+      origin,
+      secret: context.env.DELIVERY_SIGN_SECRET,
+      params: imageParams,
+      accept,
+      sourceType: contentType,
+      cacheControl,
+      disposition
+    });
+  }
+  if (token2 && isStoryboardVttKey(key) && object.body) {
+    const enc = decodeEncryptionMeta4(object.customMetadata?.enc);
+    const loaded = enc ? await loadStorageKey(context.env.KEYS_BUCKET, fullKey, enc.keyId) : null;
+    if (enc && !loaded) return context.json({ error: "Decryption key unavailable" }, 500);
+    const decryption = enc && loaded ? { key: loaded.key, iv: enc.iv } : null;
+    return storyboardVttResponse(object.body, token2, decryption);
+  }
+  const headers = new Headers();
+  headers.set("Content-Type", contentType);
+  headers.set("Cache-Control", cacheControl);
+  if (isServingVariant && isFormatNegotiated) headers.set("Vary", "Accept");
+  if (disposition) {
+    headers.set("Content-Disposition", disposition);
+  } else if (object.httpMetadata?.contentDisposition) {
+    headers.set("Content-Disposition", object.httpMetadata.contentDisposition);
+  }
+  const { response, kind } = await streamObject({
+    bucket: context.env.MEDIA_BUCKET,
+    keysBucket: context.env.KEYS_BUCKET,
+    fullKey: servedKey,
+    object,
+    headers,
+    range: context.req.header("Range")
+  });
+  if (!edgeCache || edgeTtlFor(cacheControl) <= 0) return response;
+  const target = {
+    cache: edgeCache,
+    cacheKey: edgeCacheKey,
+    storagePrefix: getRequestState(context).storagePrefix,
+    virtualKey: key,
+    cacheControl
+  };
+  if (kind === "plain-range" && object.size <= MAX_EDGE_CACHE_FILL_BYTES) {
+    context.executionCtx.waitUntil(fillEdgeCache(target, context.env.MEDIA_BUCKET, servedKey, response.headers));
+  }
+  if (kind === "plain-full") {
+    context.executionCtx.waitUntil(putEdgeCopy(target, response.clone().body, headers));
+  }
+  return response;
+});
+function servedCacheControl(stored, isPrivate) {
+  if (!stored) return isPrivate ? GENERATED_PRIVATE_CACHE_CONTROL : GENERATED_PUBLIC_CACHE_CONTROL;
+  return isPrivate ? toPrivateCacheControl(stored) : stored;
+}
+media.delete("/videos/:videoId", async (context) => {
+  const videoId = context.req.param("videoId");
+  const visibilityParam = context.req.query("visibility");
+  const visibilities = visibilityParam === "public" || visibilityParam === "private" ? [visibilityParam] : ["public", "private"];
+  let deletedCount = 0;
+  let deletedKeyCount = 0;
+  for (const visibility of visibilities) {
+    const prefix = storagePrefix(context, `${visibility}/${videoBasePath(videoId)}/`);
+    deletedCount += await deletePrefix(context.env.MEDIA_BUCKET, prefix);
+    if (visibility === "private" && context.env.KEYS_BUCKET) {
+      deletedKeyCount += await deletePrefix(context.env.KEYS_BUCKET, prefix);
+    }
+  }
+  return context.json({ videoId, deletedCount, deletedKeyCount });
+});
+media.delete("/:key{.+}", async (context) => {
+  const key = context.req.param("key");
+  const fullKey = storageKey(context, key);
+  if (isVariantKey(key)) {
+    return context.json({ error: "Not found" }, 404);
+  }
+  const exists = await context.env.MEDIA_BUCKET.head(fullKey);
+  if (!exists) {
+    return context.json({ error: "Not found" }, 404);
+  }
+  await context.env.MEDIA_BUCKET.delete(fullKey);
+  await deletePrefix(context.env.MEDIA_BUCKET, variantPrefix(fullKey));
+  if (context.env.KEYS_BUCKET) await deletePrefix(context.env.KEYS_BUCKET, `${fullKey}/`);
+  return new Response(null, { status: 204 });
+});
+function parseSecurityMeta(raw) {
+  if (!raw) return void 0;
+  try {
+    return JSON.parse(raw);
+  } catch {
+    return void 0;
+  }
+}
+async function bindingMismatch(context, payload, customMetadata) {
+  const policy = resolveSecurity2(
+    parseSecurityMeta(customMetadata?.security),
+    payload.bind
+  );
+  if (!policy.sessionBinding) return false;
+  const userId = payload.sub;
+  const nonce = payload.nonce;
+  if (!userId || !nonce) return false;
+  const sessionSecret = context.req.header(SESSION_HEADER) ?? "";
+  if (policy.ipBinding) {
+    const ip = context.req.header("CF-Connecting-IP") ?? context.req.header("X-Forwarded-For") ?? "unknown";
+    return await computeFingerprint(userId, sessionSecret, nonce, ip) !== payload.fpip;
+  }
+  return await computeFingerprint(userId, sessionSecret, nonce) !== payload.fp;
+}
+async function serveEncryptionKey(context, key, tokenPayload) {
+  if (!tokenPayload) {
+    return context.json({ error: "Unauthorized" }, 401);
+  }
+  const keyObjectPath = storageKey(context, key.replace(/\.key$/, ""));
+  const stored = context.env.KEYS_BUCKET ? await context.env.KEYS_BUCKET.get(keyObjectPath) : null;
+  if (!stored) {
+    return context.json({ error: "Not found" }, 404);
+  }
+  if (await bindingMismatch(context, tokenPayload, stored.customMetadata)) {
+    return context.json({ error: "Session mismatch", code: "session_mismatch" }, 401);
+  }
+  return new Response(stored.body, {
+    headers: {
+      "Content-Type": "application/octet-stream",
+      "Content-Length": String(stored.size),
+      // The key must never be cached by a CDN/proxy: it's the secret that protects the stream.
+      "Cache-Control": "private, no-store"
+    }
+  });
+}
+
+// src/routes/token.ts
+import { computeFingerprint as computeFingerprint2, DEFAULT_SECURITY, TokenScope as TokenScope3 } from "@devultur/core";
+import { Hono as Hono7 } from "hono";
+var DEFAULT_VIEWER_TOKEN_TTL_SECONDS = 7200;
+var token = new Hono7();
+token.post("/", async (context) => {
+  const body = await context.req.json();
+  if (!body.userId) {
+    return context.json({ error: "userId is required" }, 400);
+  }
+  if (typeof body.userId === "string" && body.userId.startsWith(SERVICE_SUBJECT_PREFIX)) {
+    return context.json(
+      { error: `userId must not start with "${SERVICE_SUBJECT_PREFIX}"`, code: "reserved_user_id" },
+      400
+    );
+  }
+  const clientIp = context.req.header("CF-Connecting-IP") ?? context.req.header("X-Forwarded-For") ?? "unknown";
+  const requestedScopes = body.scopes ?? [TokenScope3.MEDIA_READ];
+  if (!Array.isArray(requestedScopes) || hasInvalidScope(requestedScopes)) {
+    return context.json({ error: "scopes must be non-empty strings without spaces", code: "invalid_scopes" }, 400);
+  }
+  const now = Math.floor(Date.now() / 1e3);
+  const requestedExp = now + (body.expiresIn ?? DEFAULT_VIEWER_TOKEN_TTL_SECONDS);
+  const decision = await decideCredential(context, {
+    kind: "viewer",
+    scopes: requestedScopes,
+    expiresAt: requestedExp * 1e3
+  });
+  if (!decision.allow) return decision.response;
+  const exp = cappedExpiry(requestedExp, decision.expiresAt, (epochMs) => Math.floor(epochMs / 1e3));
+  const expiresIn = exp - now;
+  const sessionSecret = body.sessionSecret ?? "";
+  const nonce = crypto.randomUUID();
+  const fp = await computeFingerprint2(body.userId, sessionSecret, nonce);
+  const fpip = await computeFingerprint2(body.userId, sessionSecret, nonce, clientIp);
+  const scope = getRequestState(context);
+  const security = scope.config?.security ?? DEFAULT_SECURITY;
+  const payload = withPluginClaims(
+    {
+      sub: body.userId,
+      ip: clientIp,
+      nonce,
+      fp,
+      fpip,
+      // Current binding policy → the gate knows what it can require without re-reading config.
+      bind: { sessionBinding: security.sessionBinding ?? true, ipBinding: security.ipBinding ?? false },
+      ...scopeClaim(requestedScopes),
+      // The storage prefix it was issued under: the delivery gate rejects the token under any other.
+      ...audienceClaim(scope.storagePrefix),
+      iat: now,
+      exp
+    },
+    decision
+  );
+  const jwt = await signViewerToken(payload, context.env.DELIVERY_SIGN_SECRET);
+  return context.json({ token: jwt, expiresIn, expiresAt: exp });
+});
+token.post("/upload", handleUploadToken);
+
+// src/routes/transcode.ts
+import {
+  extractId as extractId2,
+  generateId as generateId2,
+  resolveSecurity as resolveSecurity3,
+  resolveTranscodePreset,
+  TokenScope as TokenScope4,
+  TranscodeStatus as TranscodeStatus2,
+  videoBasePath as videoBasePath2,
+  videoHlsPath,
+  videoMp4Dir,
+  videoPosterPath,
+  videoStoryboardDir,
+  videoThumbnailPath,
+  visibilityFromKey as visibilityFromKey3
+} from "@devultur/core";
+import { Hono as Hono8 } from "hono";
+
+// src/transcode/plan.ts
+import { MAIN_VARIANT } from "@devultur/core";
+
+// src/transcode-ladder.ts
+var RENDITION_LADDER = [
+  { name: "360p", shortSide: 360, crf: 28, audioBitrate: "96k", maxrateKbps: 800, h264Level: "3.1" },
+  { name: "720p", shortSide: 720, crf: 23, audioBitrate: "128k", maxrateKbps: 3e3, h264Level: "3.2" },
+  { name: "1080p", shortSide: 1080, crf: 20, audioBitrate: "192k", maxrateKbps: 6e3, h264Level: "4.2" },
+  { name: "4k", shortSide: 2160, crf: 18, audioBitrate: "256k", maxrateKbps: 16e3, h264Level: "5.2" }
+];
+function videoCodecOf(rendition) {
+  const levelHex = Math.round(Number(rendition.h264Level) * 10).toString(16).padStart(2, "0");
+  return `avc1.6400${levelHex}`;
+}
+var AUDIO_CODEC = "mp4a.40.2";
+var h264Args = (rendition) => `-profile:v high -level:v ${rendition.h264Level}`;
+var SEGMENT_SECONDS = 2;
+var MAX_RESOLUTION_SHORT_SIDE = {
+  [MaxResolution.P720]: 720,
+  [MaxResolution.P1080]: 1080,
+  [MaxResolution.P4K]: 2160
+};
+function renditionsFor(maxResolution) {
+  const cap = MAX_RESOLUTION_SHORT_SIDE[maxResolution];
+  return RENDITION_LADDER.filter((rendition) => rendition.shortSide <= cap);
+}
+function clampRungsToCap(names, maxResolution) {
+  const allowed = renditionsFor(maxResolution);
+  const withinCap = allowed.filter((rendition) => names.includes(rendition.name));
+  if (withinCap.length > 0) return withinCap;
+  const highestAllowed = allowed[allowed.length - 1];
+  return highestAllowed ? [highestAllowed] : [];
+}
+function presetToMaxResolution(preset) {
+  return preset === "hls-adaptive" ? MaxResolution.P1080 : MaxResolution.P720;
+}
+function scaleFilter(rendition) {
+  const side = rendition.shortSide;
+  return `scale=${side}:${side}:force_original_aspect_ratio=increase:force_divisible_by=2`;
+}
+var CROP_FILTERS = {
+  "9:16-center": "crop=w=min(iw\\,ih*9/16):h=min(ih\\,iw*16/9)",
+  "1:1-center": "crop=w=min(iw\\,ih):h=min(iw\\,ih)"
+};
+function cropFilter(crop) {
+  return CROP_FILTERS[crop];
+}
+var SOURCE_SIZE_FILTER = "scale=trunc(iw/2)*2:trunc(ih/2)*2";
+function videoFilter(rendition, crop, atSourceSize) {
+  const scale = atSourceSize ? SOURCE_SIZE_FILTER : scaleFilter(rendition);
+  return crop ? `${cropFilter(crop)},${scale}` : scale;
+}
+function crfRateArgs(rendition, perTitle) {
+  if (!perTitle) {
+    return `-crf ${rendition.crf} -maxrate ${rendition.maxrateKbps}k -bufsize ${rendition.maxrateKbps * 2}k`;
+  }
+  const tag = rendition.name.toUpperCase();
+  return `-crf $PT_CRF_${tag} -maxrate \${PT_MAXRATE_${tag}}k -bufsize \${PT_BUFSIZE_${tag}}k`;
+}
+function audioArgs(rendition, stripAudio) {
+  return stripAudio ? "-an" : `-c:a aac -b:a ${rendition.audioBitrate}`;
+}
+function streamMaps(stripAudio) {
+  return stripAudio ? "-map 0:v" : "-map 0:v -map 0:a?";
+}
+function renditionArgs(rendition, hlsKeyOption, options = {}) {
+  const segmentPattern = `/tmp/output/${rendition.name}_%03d.ts`;
+  const filter = videoFilter(rendition, options.crop, options.atSourceSize);
+  return [
+    streamMaps(options.stripAudio),
+    `-vf ${filter}`,
+    `-c:v libx264 -preset fast ${h264Args(rendition)} ${crfRateArgs(rendition, options.perTitle)}`,
+    // Always 8-bit 4:2:0: a 10-bit/4:2:2 source (iPhone HDR, cameras) would produce High10/High 4:2:2, which
+    // almost no browser decodes.
+    "-pix_fmt yuv420p",
+    `-force_key_frames expr:gte(t,n_forced*${SEGMENT_SECONDS}) -sc_threshold 0`,
+    audioArgs(rendition, options.stripAudio),
+    `-f hls ${hlsKeyOption}-hls_time ${SEGMENT_SECONDS} -hls_playlist_type vod`,
+    `-hls_segment_filename ${segmentPattern} /tmp/output/${rendition.name}.m3u8`,
+    // A scaled frame outside /tmp/output (not uploaded): gives the master's real RESOLUTION even when the
+    // segments are encrypted (ffprobe can't read an AES-128 .ts).
+    `-map 0:v:0 -frames:v 1 -vf ${filter} -update 1 /tmp/probe/${rendition.name}.jpg`
+  ].join(" ");
+}
+function mp4RateArgs(rendition, options) {
+  const { bitrateKbps } = options;
+  if (!bitrateKbps) return crfRateArgs(rendition, options.perTitle);
+  return `-b:v ${bitrateKbps}k -maxrate ${Math.round(bitrateKbps * 1.5)}k -bufsize ${bitrateKbps * 2}k`;
+}
+function mp4FileName(variant, rendition) {
+  return `${variant}-${rendition.name}.mp4`;
+}
+function mp4Args(variant, rendition, options = {}) {
+  return [
+    options.stripAudio ? "-map 0:v:0" : "-map 0:v:0 -map 0:a:0?",
+    `-vf ${videoFilter(rendition, options.crop, options.atSourceSize)}`,
+    `-c:v libx264 -preset fast ${h264Args(rendition)} ${mp4RateArgs(rendition, options)}`,
+    "-pix_fmt yuv420p",
+    audioArgs(rendition, options.stripAudio),
+    `-movflags +faststart /tmp/mp4/${mp4FileName(variant, rendition)}`
+  ].join(" ");
+}
+var SEGMENT_RATES_AWK = [
+  '/^#EXTINF:/ { sub(/^#EXTINF:/, ""); sub(/,.*/, ""); duration = $0 + 0; next }',
+  '/^[^#]/ && duration > 0 { cmd = "wc -c < " dir "/" $0; cmd | getline bytes; close(cmd);',
+  "bits = bytes * 8; total += bits; elapsed += duration; rate = bits / duration;",
+  "if (rate > peak) peak = rate; duration = 0 }",
+  'END { if (elapsed <= 0) exit 1; printf "BANDWIDTH=%d,AVERAGE-BANDWIDTH=%d\\n", peak + 1, total / elapsed + 1 }'
+].join(" ");
+function videoCodecCase() {
+  const branches = RENDITION_LADDER.map((rendition) => `${rendition.name}) VIDEO_CODEC=${videoCodecOf(rendition)} ;;`);
+  return `  case "$NAME" in ${branches.join(" ")} esac`;
+}
+function masterPlaylistScript() {
+  return [
+    'MASTER="#EXTM3U\\n#EXT-X-INDEPENDENT-SEGMENTS\\n"',
+    "for NAME in $RENDITIONS; do",
+    videoCodecCase(),
+    `  CODECS="$VIDEO_CODEC"; if [ "$HAS_AUDIO" = true ]; then CODECS="$CODECS,${AUDIO_CODEC}"; fi`,
+    `  RATES=$(awk -v dir=/tmp/output '${SEGMENT_RATES_AWK}' "/tmp/output/$NAME.m3u8")`,
+    '  RESOLUTION=$(ffprobe -v error -select_streams v:0 -show_entries stream=width,height -of csv=s=x:p=0 "/tmp/probe/$NAME.jpg")',
+    '  echo "[transcode] $NAME $RESOLUTION $RATES"',
+    '  MASTER="$MASTER#EXT-X-STREAM-INF:$RATES,RESOLUTION=$RESOLUTION,CODECS=\\"$CODECS\\"\\n$NAME.m3u8\\n"',
+    "done",
+    'printf "%b" "$MASTER" > /tmp/output/playlist.m3u8'
+  ].join("\n");
+}
+
+// src/transcode/plan.ts
+var DEFAULT_POSTER_FORMATS = ["jpg", "avif"];
+function planMp4(output, maxResolution) {
+  if (!output) return [];
+  return clampRungsToCap(output.rungs, maxResolution).map((rendition) => {
+    const bitrateKbps = output.bitrate?.[rendition.name];
+    return bitrateKbps ? { rendition, bitrateKbps } : { rendition };
+  });
+}
+function planHls(output, maxResolution) {
+  if (!output) return [];
+  if (!output.rungs) return renditionsFor(maxResolution);
+  return clampRungsToCap(output.rungs, maxResolution);
+}
+function planMainVariant(spec, maxResolution) {
+  if (!spec.hls && !spec.mp4) return null;
+  return {
+    name: MAIN_VARIANT,
+    ...spec.crop ? { crop: spec.crop } : {},
+    hls: planHls(spec.hls, maxResolution),
+    mp4: planMp4(spec.mp4, maxResolution)
+  };
+}
+function planTranscode(spec, maxResolution, options) {
+  const main = planMainVariant(spec, maxResolution);
+  const extraVariants = (spec.variants ?? []).map((variant) => ({
+    name: variant.name,
+    ...variant.crop ? { crop: variant.crop } : {},
+    hls: [],
+    mp4: planMp4(variant.mp4, maxResolution)
+  }));
+  return {
+    variants: main ? [main, ...extraVariants] : extraVariants,
+    stripAudio: spec.audio === "strip",
+    posterAt: spec.poster?.at ?? "auto",
+    posterFormats: spec.poster?.formats ?? DEFAULT_POSTER_FORMATS,
+    reportsOutputs: options.reportsOutputs,
+    perTitle: spec.perTitle ?? true,
+    storyboard: spec.storyboard ?? true
+  };
+}
+function legacyPlan(maxResolution) {
+  return planTranscode({ hls: {} }, maxResolution, { reportsOutputs: false });
+}
+
+// src/transcode/retry.ts
+var DEFAULT_MAX_ATTEMPTS = 5;
+var DEFAULT_BASE_DELAY_MS = 500;
+var DEFAULT_MAX_DELAY_MS = 8e3;
+var MAX_RETRY_AFTER_MS = 3e4;
+var defaultSleep = (delayMs) => new Promise((resolve) => setTimeout(resolve, delayMs));
+function isRetryableStatus(status) {
+  return status === 429 || status >= 500;
+}
+function parseRetryAfterMs(header, now = Date.now()) {
+  if (!header) return null;
+  const trimmed = header.trim();
+  if (/^\d+$/.test(trimmed)) return Number(trimmed) * 1e3;
+  const date = Date.parse(trimmed);
+  if (Number.isNaN(date)) return null;
+  return Math.max(0, date - now);
+}
+function backoffDelayMs(attempt, options = {}) {
+  const baseDelayMs = options.baseDelayMs ?? DEFAULT_BASE_DELAY_MS;
+  const maxDelayMs = options.maxDelayMs ?? DEFAULT_MAX_DELAY_MS;
+  const ceiling = Math.min(maxDelayMs, baseDelayMs * 2 ** attempt);
+  return Math.floor((options.random ?? Math.random)() * ceiling);
+}
+function delayFor(attempt, response, options) {
+  const retryAfterMs = parseRetryAfterMs(response?.headers.get("Retry-After") ?? null, (options.now ?? Date.now)());
+  if (retryAfterMs !== null) return Math.min(retryAfterMs, MAX_RETRY_AFTER_MS);
+  return backoffDelayMs(attempt, options);
+}
+async function fetchWithRetry(send, options = {}) {
+  const maxAttempts = Math.max(1, options.maxAttempts ?? DEFAULT_MAX_ATTEMPTS);
+  const sleep = options.sleep ?? defaultSleep;
+  for (let attempt = 0; ; attempt++) {
+    const isLastAttempt = attempt === maxAttempts - 1;
+    let response;
+    try {
+      response = await send();
+    } catch (error) {
+      if (isLastAttempt) throw error;
+      await sleep(delayFor(attempt, null, options));
+      continue;
+    }
+    if (!isRetryableStatus(response.status) || isLastAttempt) return response;
+    await response.body?.cancel();
+    await sleep(delayFor(attempt, response, options));
+  }
+}
+
+// src/transcode/fly.ts
+var FLY_API_BASE = "https://api.machines.dev/v1";
+var DEFAULT_FLY_GUEST = { cpu_kind: "performance", cpus: 4, memory_mb: 8192 };
+function positiveInt(raw, fallback2) {
+  const parsed = Number(raw);
+  return Number.isInteger(parsed) && parsed > 0 ? parsed : fallback2;
+}
+function flyGuestFromEnv(env) {
+  return {
+    cpu_kind: env.FLY_TRANSCODE_CPU_KIND?.trim() || DEFAULT_FLY_GUEST.cpu_kind,
+    cpus: positiveInt(env.FLY_TRANSCODE_CPUS, DEFAULT_FLY_GUEST.cpus),
+    memory_mb: positiveInt(env.FLY_TRANSCODE_MEMORY_MB, DEFAULT_FLY_GUEST.memory_mb)
+  };
+}
+function flyMachinePayload(request) {
+  return JSON.stringify({
+    config: {
+      image: request.image,
+      guest: request.guest,
+      auto_destroy: true,
+      restart: { policy: "no" },
+      env: request.env,
+      init: { cmd: [`echo '${btoa(request.script)}' | base64 -d | sh`] }
+    },
+    ...request.region ? { region: request.region } : {}
+  });
+}
+async function resumeFlyApp(appName, apiToken) {
+  const headers = { Authorization: `Bearer ${apiToken}` };
+  const response = await fetch(`${FLY_API_BASE}/apps/${appName}`, { method: "GET", headers });
+  if (!response.ok) return false;
+  const app = await response.json();
+  if (app.status !== "suspended") return true;
+  const resumeResponse = await fetch(`${FLY_API_BASE}/apps/${appName}`, {
+    method: "PUT",
+    headers: { ...headers, "Content-Type": "application/json" },
+    body: JSON.stringify({ status: "deployed" })
+  });
+  if (!resumeResponse.ok) return false;
+  await new Promise((resolve) => setTimeout(resolve, 2e3));
+  return true;
+}
+function postMachine(request, retry) {
+  const body = flyMachinePayload(request);
+  return fetchWithRetry(
+    () => fetch(`${FLY_API_BASE}/apps/${request.appName}/machines`, {
+      method: "POST",
+      headers: { Authorization: `Bearer ${request.apiToken}`, "Content-Type": "application/json" },
+      body
+    }),
+    retry
+  );
+}
+async function failure2(response, error) {
+  const detail = await response.text();
+  const status = response.status === 429 || response.status >= 500 ? 503 : 500;
+  console.error(`[transcode] fly: ${error} (status ${response.status}):`, detail);
+  return { ok: false, status, error, code: launchErrorCode(status), detail };
+}
+async function createFlyMachine(request, retry) {
+  const response = await postMachine(request, retry);
+  if (response.ok) return { ok: true, machine: await response.json() };
+  const errorBody = await response.text();
+  const isSuspended = response.status === 412 || errorBody.includes("suspended");
+  if (!isSuspended) {
+    return failure2(new Response(errorBody, { status: response.status }), "Failed to create transcode job");
+  }
+  if (!await resumeFlyApp(request.appName, request.apiToken)) {
+    console.error("[transcode] fly: failed to resume suspended app:", errorBody);
+    return {
+      ok: false,
+      status: 503,
+      error: "Failed to resume transcode app",
+      code: TranscodeLaunchErrorCode.UNAVAILABLE,
+      detail: errorBody
+    };
+  }
+  const retried = await postMachine(request, retry);
+  if (retried.ok) return { ok: true, machine: await retried.json() };
+  return failure2(retried, "Failed to create transcode job after resume");
+}
+function createFlyRunner(env, retry) {
+  const guest = flyGuestFromEnv(env);
+  const appName = env.FLY_APP_NAME ?? "";
+  const apiToken = env.FLY_API_TOKEN ?? "";
+  const region = env.FLY_REGION?.trim() || void 0;
+  async function launch(job) {
+    if (!appName || !apiToken || !env.FLY_TRANSCODE_IMAGE) {
+      const detail = "FLY_APP_NAME, FLY_API_TOKEN and FLY_TRANSCODE_IMAGE are required for TRANSCODE_RUNNER=fly";
+      return notConfigured(detail);
+    }
+    const result = await createFlyMachine(
+      { appName, apiToken, image: env.FLY_TRANSCODE_IMAGE, guest, env: job.env, script: job.script, region },
+      retry
+    );
+    if (!result.ok) return result;
+    return { ok: true, jobRef: result.machine.id };
+  }
+  async function cancel(jobRef) {
+    await fetch(`${FLY_API_BASE}/apps/${appName}/machines/${jobRef}?force=true`, {
+      method: "DELETE",
+      headers: { Authorization: `Bearer ${apiToken}` }
+    });
+  }
+  return { name: TranscodeRunnerName.FLY, cpus: guest.cpus, launch, cancel };
+}
+
+// src/transcode/http.ts
+var HTTP_RUNNER_PROTOCOL_VERSION = 1;
+var JOB_REF_PREFIX = "http-";
+function cpusFrom(raw) {
+  const parsed = Number(raw);
+  return Number.isFinite(parsed) && parsed > 0 ? parsed : 0;
+}
+async function jobRefFrom(response, videoId) {
+  const body = await response.json().catch(() => null);
+  return typeof body?.jobId === "string" && body.jobId ? body.jobId : `${JOB_REF_PREFIX}${videoId}`;
+}
+function createHttpRunner(env, retry) {
+  const url = env.TRANSCODE_RUNNER_URL?.trim().replace(/\/$/, "") ?? "";
+  const secret = env.TRANSCODE_RUNNER_SECRET ?? "";
+  const headers = { Authorization: `Bearer ${secret}`, "Content-Type": "application/json" };
+  async function launch(job) {
+    if (!url || !secret) {
+      const detail2 = "TRANSCODE_RUNNER_URL and TRANSCODE_RUNNER_SECRET are required for TRANSCODE_RUNNER=http";
+      return notConfigured(detail2);
+    }
+    const request = {
+      version: HTTP_RUNNER_PROTOCOL_VERSION,
+      videoId: job.videoId,
+      command: ["sh", "-c", RUN_SCRIPT_COMMAND],
+      env: envWithScript(job)
+    };
+    const body = JSON.stringify(request);
+    let response;
+    try {
+      response = await fetchWithRetry(() => fetch(url, { method: "POST", headers, body }), retry);
+    } catch (error) {
+      console.error("[transcode] http runner unreachable:", error);
+      return {
+        ok: false,
+        status: 503,
+        error: "Transcode runner unreachable",
+        code: TranscodeLaunchErrorCode.UNAVAILABLE,
+        detail: String(error)
+      };
+    }
+    if (response.ok) return { ok: true, jobRef: await jobRefFrom(response, job.videoId) };
+    const detail = await response.text();
+    console.error(`[transcode] http runner rejected the job (status ${response.status}):`, detail);
+    const status = isRetryableStatus(response.status) ? 503 : 500;
+    return { ok: false, status, error: "Transcode runner rejected the job", code: launchErrorCode(status), detail };
+  }
+  async function cancel(jobRef) {
+    await fetch(`${url}/${encodeURIComponent(jobRef)}`, { method: "DELETE", headers });
+  }
+  return { name: "http", cpus: cpusFrom(env.TRANSCODE_RUNNER_CPUS), launch, cancel };
+}
+
+// src/transcode/runners.ts
+function createRunner(env) {
+  switch (parseRunnerName(env.TRANSCODE_RUNNER)) {
+    case TranscodeRunnerName.FLY:
+      return createFlyRunner(env);
+    case TranscodeRunnerName.CLOUDFLARE:
+      return createCloudflareContainerRunner(env);
+    case TranscodeRunnerName.HTTP:
+      return createHttpRunner(env);
+    default:
+      return null;
+  }
+}
+
+// src/transcode/per-title.ts
+var PER_TITLE = {
+  /** Shorter clips aren't probed: the savings are minimal and the probe would cost more than the encode. */
+  minDurationSeconds: 10,
+  sampleSeconds: 2,
+  maxSamples: 4,
+  /** One sample every this many seconds of video (up to `maxSamples`). */
+  secondsPerSample: 15,
+  probeShortSide: 360,
+  probeCrf: 23,
+  probePreset: "veryfast",
+  /** Probe kbps (360p, CRF 23) at the simple end (score 0) and the complex end (score 1); logarithmic scale. */
+  simpleKbps: 100,
+  complexKbps: 800,
+  minMaxrateFactor: 0.5,
+  maxCrfBoost: 2
+};
+var rateTag = (rendition) => rendition.name.toUpperCase();
+function crfRungs(plan) {
+  const names = /* @__PURE__ */ new Set();
+  for (const variant of plan.variants) {
+    for (const rendition of variant.hls) names.add(rendition.name);
+    for (const output of variant.mp4) {
+      if (!output.bitrateKbps) names.add(output.rendition.name);
+    }
+  }
+  return RENDITION_LADDER.filter((rendition) => names.has(rendition.name));
+}
+var PROBE_FILE = "/tmp/probe/per-title.h264";
+function probeEncode() {
+  const side = PER_TITLE.probeShortSide;
+  return [
+    `ffmpeg -nostdin -v error -y -ss "$PROBE_AT" -t ${PER_TITLE.sampleSeconds} -i /tmp/input -map 0:v:0 -an`,
+    `-vf scale=${side}:${side}:force_original_aspect_ratio=increase:force_divisible_by=2`,
+    `-c:v libx264 -preset ${PER_TITLE.probePreset} -crf ${PER_TITLE.probeCrf} -pix_fmt yuv420p -f h264 ${PROBE_FILE}`
+  ].join(" ");
+}
+function probeScript() {
+  const { minDurationSeconds, secondsPerSample, maxSamples, sampleSeconds } = PER_TITLE;
+  const span = Math.log(PER_TITLE.complexKbps / PER_TITLE.simpleKbps);
+  return [
+    `PROBE_SAMPLES=$(awk -v d="$DURATION" 'BEGIN { if (!(d >= ${minDurationSeconds})) { print 0; exit } n = int(d / ${secondsPerSample}); if (n < 1) n = 1; if (n > ${maxSamples}) n = ${maxSamples}; print n }')`,
+    "PROBE_BYTES=0",
+    "PROBE_DONE=0",
+    'while [ "$PROBE_DONE" -lt "$PROBE_SAMPLES" ]; do',
+    // Center of each equal-length segment, minus half a sample: always within the video.
+    `  PROBE_AT=$(awk -v d="$DURATION" -v n="$PROBE_SAMPLES" -v i="$PROBE_DONE" 'BEGIN { t = (i + 0.5) * d / n - ${sampleSeconds / 2}; if (t < 0) t = 0; printf "%.3f", t }')`,
+    `  if ! ${probeEncode()}; then PROBE_BYTES=0; break; fi`,
+    `  PROBE_BYTES=$((PROBE_BYTES + $(wc -c < ${PROBE_FILE})))`,
+    "  PROBE_DONE=$((PROBE_DONE + 1))",
+    "done",
+    'if [ "$PROBE_BYTES" -gt 0 ]; then',
+    `  PROBE_KBPS=$(awk -v b="$PROBE_BYTES" -v n="$PROBE_SAMPLES" 'BEGIN { printf "%.1f", b * 8 / 1000 / (n * ${sampleSeconds}) }')`,
+    `  PT_SCORE=$(awk -v k="$PROBE_KBPS" 'BEGIN { if (k < 1) k = 1; s = log(k / ${PER_TITLE.simpleKbps}) / ${span}; if (s < 0) s = 0; if (s > 1) s = 1; printf "%.2f", s }')`,
+    "fi"
+  ];
+}
+function rateVarsScript() {
+  const { minMaxrateFactor, maxCrfBoost } = PER_TITLE;
+  return [
+    "PT_BOOST=0",
+    `if [ "$PT_SCORE" != null ]; then PT_BOOST=$(awk -v s="$PT_SCORE" 'BEGIN { printf "%d", int(${maxCrfBoost} * (1 - s) + 0.5) }'); fi`,
+    ...RENDITION_LADDER.flatMap((rendition) => {
+      const tag = rateTag(rendition);
+      return [
+        `PT_CRF_${tag}=$((${rendition.crf} + PT_BOOST))`,
+        `PT_MAXRATE_${tag}=${rendition.maxrateKbps}`,
+        `if [ "$PT_SCORE" != null ]; then PT_MAXRATE_${tag}=$(awk -v s="$PT_SCORE" 'BEGIN { printf "%d", int(${rendition.maxrateKbps} * (${minMaxrateFactor} + ${1 - minMaxrateFactor} * s) + 0.5) }'); fi`,
+        `PT_BUFSIZE_${tag}=$((PT_MAXRATE_${tag} * 2))`
+      ];
+    })
+  ];
+}
+function perTitleScript(plan) {
+  return [
+    "PT_SCORE=null",
+    "PROBE_START=$(date +%s)",
+    ...plan.perTitle ? probeScript() : [],
+    "PROBE_SECONDS=$(( $(date +%s) - PROBE_START ))",
+    ...rateVarsScript(),
+    'echo "[transcode] per-title score $PT_SCORE (probe $PROBE_SECONDS s)"'
+  ].join("\n");
+}
+function encodeParamsJson(plan) {
+  const entries = crfRungs(plan).map((rendition) => {
+    const tag = rateTag(rendition);
+    return `{\\"rung\\":\\"${rendition.name}\\",\\"crf\\":$PT_CRF_${tag},\\"maxrateKbps\\":$PT_MAXRATE_${tag}}`;
+  });
+  return `[${entries.join(",")}]`;
+}
+
+// src/transcode/storyboard-script.ts
+var STORYBOARD = {
+  thumbWidth: 160,
+  columns: 10,
+  rows: 10,
+  minIntervalSeconds: 2,
+  maxThumbnails: 300,
+  jpegQuality: 5,
+  vttFile: "storyboard.vtt"
+};
+var PER_SHEET = STORYBOARD.columns * STORYBOARD.rows;
+var DIR = "/tmp/storyboard";
+function storyboardFilter(plan) {
+  const sample = `fps=1/$SB_INTERVAL,scale=${STORYBOARD.thumbWidth}:-2,tile=${STORYBOARD.columns}x${STORYBOARD.rows}`;
+  const crop = plan.variants[0]?.crop;
+  return crop ? `${cropFilter(crop)},${sample}` : sample;
+}
+function storyboardOutputScript(plan) {
+  if (!plan.storyboard) return [];
+  const { maxThumbnails, minIntervalSeconds } = STORYBOARD;
+  const args = `-map 0:v:0 -vf ${storyboardFilter(plan)} -q:v ${STORYBOARD.jpegQuality} -start_number 0 ${DIR}/sprite-%d.jpg`;
+  return [
+    `SB_INTERVAL=$(awk -v d="$DURATION" 'BEGIN { d += 0; i = int(d / ${maxThumbnails}); if (i * ${maxThumbnails} < d) i++; if (i < ${minIntervalSeconds}) i = ${minIntervalSeconds}; print i }')`,
+    `FF_OUTPUTS="$FF_OUTPUTS ${args}"`
+  ];
+}
+var VTT_AWK = [
+  'function ts(t,  h, m) { h = int(t / 3600); m = int((t - h * 3600) / 60); return sprintf("%02d:%02d:%06.3f", h, m, t - h * 3600 - m * 60) }',
+  "BEGIN {",
+  '  print "WEBVTT"',
+  "  n = int(d / i); if (n * i < d) n++; if (n > sheets * per) n = sheets * per",
+  "  for (k = 0; k < n; k++) {",
+  "    start = k * i; end = (k + 1) * i; if (end > d) end = d",
+  "    pos = k % per",
+  '    print ""; print ts(start) " --> " ts(end)',
+  '    printf "sprite-%d.jpg#xywh=%d,%d,%d,%d\\n", int(k / per), (pos % cols) * w, int(pos / cols) * h, w, h',
+  "  }",
+  "}"
+].join("\n");
+function storyboardVttScript(plan, storyboardKey) {
+  if (!plan.storyboard) return 'STORYBOARD_KEY=""';
+  return [
+    'STORYBOARD_KEY=""',
+    `if [ -s ${DIR}/sprite-0.jpg ]; then`,
+    `  SB_DIMS=$(ffprobe -v error -select_streams v:0 -show_entries stream=width,height -of csv=p=0 ${DIR}/sprite-0.jpg | head -1)`,
+    `  SB_TILE_W=$(( $(echo "$SB_DIMS" | cut -d, -f1) / ${STORYBOARD.columns} ))`,
+    `  SB_TILE_H=$(( $(echo "$SB_DIMS" | cut -d, -f2) / ${STORYBOARD.rows} ))`,
+    `  SB_SHEETS=$(ls ${DIR}/sprite-*.jpg | wc -l)`,
+    `  awk -v d="$DURATION" -v i="$SB_INTERVAL" -v w="$SB_TILE_W" -v h="$SB_TILE_H" -v sheets="$SB_SHEETS" -v per=${PER_SHEET} -v cols=${STORYBOARD.columns} '${VTT_AWK}' > ${DIR}/${STORYBOARD.vttFile}`,
+    `  STORYBOARD_KEY="${storyboardKey}"`,
+    `  echo "[transcode] storyboard: $SB_SHEETS sheet(s), every $SB_INTERVAL s, tile \${SB_TILE_W}x$SB_TILE_H"`,
+    "fi"
+  ].join("\n");
+}
+function storyboardUploadScript(plan, storyboardPrefix, put) {
+  if (!plan.storyboard) return "";
+  return [
+    'if [ -n "$STORYBOARD_KEY" ]; then',
+    `  for f in ${DIR}/*; do`,
+    '    FILENAME=$(basename "$f")',
+    '    CT="image/jpeg"',
+    '    case "$FILENAME" in *.vtt) CT="text/vtt" ;; esac',
+    `    ${put} "$WORKER_URL/v1/upload/${storyboardPrefix}$FILENAME" -H "Content-Type: $CT" --data-binary "@$f"`,
+    "  done",
+    "fi"
+  ].join("\n");
+}
+
+// src/transcode/plan-script.ts
+var NO_KEYS = { playlistKey: "", mp4Prefix: "" };
+function shortSideScript(prefix, dimsCommand) {
+  return [
+    `${prefix}_DIMS=$(${dimsCommand} | head -1)`,
+    `${prefix}_W=$(echo "$${prefix}_DIMS" | cut -s -d, -f1)`,
+    `${prefix}_H=$(echo "$${prefix}_DIMS" | cut -s -d, -f2)`,
+    `case "$${prefix}_W" in ""|*[!0-9]*) ${prefix}_W=0 ;; esac`,
+    `case "$${prefix}_H" in ""|*[!0-9]*) ${prefix}_H=0 ;; esac`,
+    `${prefix}_SHORT=$${prefix}_W`,
+    `if [ "$${prefix}_H" -lt "$${prefix}_SHORT" ]; then ${prefix}_SHORT=$${prefix}_H; fi`
+  ];
+}
+var FRAME_DIMS = (file) => `ffprobe -v error -select_streams v:0 -show_entries stream=width,height -of csv=p=0 ${file}`;
+function variantShortSide(variant) {
+  if (!variant.crop) return ["V_SHORT=$SRC_SHORT"];
+  const probe = `/tmp/probe/crop-${variant.name}.jpg`;
+  return [
+    `ffmpeg -nostdin -v error -y -i /tmp/input -frames:v 1 -vf "${cropFilter(variant.crop)}" -update 1 ${probe}`,
+    ...shortSideScript("CROP", FRAME_DIMS(probe)),
+    "V_SHORT=$CROP_SHORT"
+  ];
+}
+function markRung(rendition, atSourceSize) {
+  const side = atSourceSize ? "$V_EVEN" : String(rendition.shortSide);
+  return [
+    `  if [ ${side} -gt "$TOP_SHORT" ]; then TOP_SHORT=${side}; TOP_RES="${rendition.name}"; fi`,
+    `  if [ ${side} -gt "$V_TOP" ]; then V_TOP=${side}; fi`
+  ];
+}
+var RECORD_RENDITION_FUNCTION = 'record_rendition() { echo "$1 $2" >> /tmp/outputs.list; }';
+function recordRendition(probeFile, variant, kind, rung, key) {
+  const json = `{\\"variant\\":\\"${variant}\\",\\"kind\\":\\"${kind}\\",\\"rung\\":\\"${rung}\\",\\"key\\":\\"${key}\\"`;
+  return `record_rendition "${probeFile}" "${json}"`;
+}
+function rungBlocks(rungs, doneFlag, block) {
+  const lowest = rungs[0];
+  if (!lowest) return [];
+  return [
+    `${doneFlag}=""`,
+    ...rungs.flatMap((rendition) => [
+      `if [ "$V_SHORT" -ge ${rendition.shortSide} ]; then`,
+      ...block(rendition, false),
+      `  ${doneFlag}=1`,
+      "fi"
+    ]),
+    `if [ -z "$${doneFlag}" ]; then`,
+    ...block(lowest, true),
+    "fi"
+  ];
+}
+function hlsScript(variant, plan, hlsKeyOption, keys) {
+  if (variant.hls.length === 0) return [];
+  return [
+    'HLS_TOP=""',
+    ...rungBlocks(variant.hls, "HLS_DONE", (rendition, atSourceSize) => [
+      `  FF_OUTPUTS="$FF_OUTPUTS ${renditionArgs(rendition, hlsKeyOption, { crop: variant.crop, stripAudio: plan.stripAudio, atSourceSize, perTitle: plan.perTitle })}"`,
+      `  RENDITIONS="$RENDITIONS ${rendition.name}"`,
+      `  HLS_TOP="${rendition.name}"`,
+      ...markRung(rendition, atSourceSize)
+    ]),
+    // The ladder is ONE output, measured by its highest rung (its probe frame has the real size).
+    recordRendition("/tmp/probe/$HLS_TOP.jpg", variant.name, "hls", "$HLS_TOP", keys.playlistKey)
+  ];
+}
+function mp4Script(variant, plan, keys) {
+  const bitrates = new Map(variant.mp4.map((output) => [output.rendition.name, output.bitrateKbps]));
+  const rungs = variant.mp4.map((output) => output.rendition);
+  return rungBlocks(rungs, "MP4_DONE", (rendition, atSourceSize) => {
+    const options = {
+      crop: variant.crop,
+      stripAudio: plan.stripAudio,
+      atSourceSize,
+      perTitle: plan.perTitle,
+      // At source size the requested rung's bitrate is overkill: constant quality with the rung's cap instead.
+      bitrateKbps: atSourceSize ? void 0 : bitrates.get(rendition.name)
+    };
+    const key = `${keys.mp4Prefix}${mp4FileName(variant.name, rendition)}`;
+    return [
+      `  FF_OUTPUTS="$FF_OUTPUTS ${mp4Args(variant.name, rendition, options)}"`,
+      `  ${recordRendition(`/tmp/mp4/${mp4FileName(variant.name, rendition)}`, variant.name, "mp4", rendition.name, key)}`,
+      ...markRung(rendition, atSourceSize)
+    ];
+  });
+}
+function variantScript(variant, index, plan, hlsKeyOption, keys) {
+  return [
+    `# frame ${variant.name}`,
+    ...variantShortSide(variant),
+    // Even short side: the one that will have an output at source size.
+    "V_EVEN=$((V_SHORT / 2 * 2))",
+    "V_TOP=0",
+    ...hlsScript(variant, plan, hlsKeyOption, keys),
+    ...mp4Script(variant, plan, keys),
+    ...index === 0 ? ["POSTER_SHORT=$V_TOP"] : [],
+    `echo "[transcode] ${variant.name}: short $V_SHORT top $V_TOP"`
+  ];
+}
+function planSetupScript(plan, hlsKeyOption, keys = NO_KEYS) {
+  if (plan.variants.length === 0) throw new Error("planSetupScript: plan has no outputs");
+  return [
+    // `width,height` of the video stream. The short side doesn't change with rotation (phone metadata).
+    ...shortSideScript("SRC", FRAME_DIMS("/tmp/input")),
+    'FF_OUTPUTS=""',
+    'RENDITIONS=""',
+    'TOP_RES=""',
+    "TOP_SHORT=0",
+    RECORD_RENDITION_FUNCTION,
+    ": > /tmp/outputs.list",
+    "POSTER_SHORT=0",
+    ...plan.variants.flatMap((variant, index) => variantScript(variant, index, plan, hlsKeyOption, keys)),
+    // Storyboard: one more output from the same ffmpeg (shares the decode); doesn't count as a video output.
+    ...storyboardOutputScript(plan),
+    'echo "[transcode] source $SRC_DIMS (short $SRC_SHORT) top $TOP_RES (short $TOP_SHORT) outputs $(wc -l < /tmp/outputs.list)"'
+  ].join("\n");
+}
+
+// src/transcode/poster-script.ts
+var AUTO_OFFSET_AWK = "t = d * 0.1; if (t > 5) t = 5";
+function posterSeekScript(at) {
+  if (at === "first") return 'POSTER_SEEK=""';
+  const offset = at === "auto" ? `BEGIN { ${AUTO_OFFSET_AWK}; printf "%.3f", t }` : (
+    // A fixed second past the end falls back to `auto` (otherwise ffmpeg wouldn't produce any frame).
+    `BEGIN { if (${at} < d) t = ${at}; else { ${AUTO_OFFSET_AWK} } printf "%.3f", t }`
+  );
+  return [`POSTER_AT=$(awk -v d="$DURATION" '${offset}')`, 'POSTER_SEEK="-ss $POSTER_AT"'].join("\n");
+}
+function posterFilter(plan) {
+  const scale = "scale=$POSTER_SHORT:$POSTER_SHORT:force_original_aspect_ratio=increase:force_divisible_by=2";
+  const crop = plan.variants[0]?.crop;
+  return crop ? `${cropFilter(crop)},${scale}` : scale;
+}
+function posterScript(plan) {
+  const grabPoster = (seek) => `ffmpeg -nostdin -v error -y ${seek}-i /tmp/input -frames:v 1 -vf "${posterFilter(plan)}" -q:v 2 -update 1 /tmp/poster.jpg`;
+  return [
+    posterSeekScript(plan.posterAt),
+    'if [ "$POSTER_SHORT" -le 0 ] 2>/dev/null; then POSTER_SHORT=720; fi',
+    // `-ss` before `-i`: keyframe seek + decode up to the instant (precise and fast).
+    `${grabPoster("$POSTER_SEEK ")} || true`,
+    // No frame at that instant (misreported duration) → the first frame, never an empty poster.
+    `[ -s /tmp/poster.jpg ] || ${grabPoster("")}`,
+    'ffmpeg -nostdin -v error -y -i /tmp/poster.jpg -vf "scale=640:-2" -q:v 2 -update 1 /tmp/thumbnail.jpg'
+  ].join("\n");
+}
+function hasAudioScript(plan) {
+  if (plan.stripAudio) return "HAS_AUDIO=false";
+  return [
+    "AUDIO_STREAM=$(ffprobe -v error -select_streams a -show_entries stream=index -of csv=p=0 /tmp/input | head -1)",
+    'if [ -n "$AUDIO_STREAM" ]; then HAS_AUDIO=true; else HAS_AUDIO=false; fi'
+  ].join("\n");
+}
+
+// src/transcode/upload-script.ts
+var DERIVED_MULTIPART_THRESHOLD_BYTES = 50 * 1024 * 1024;
+var AUTH = '-H "Authorization: Bearer $UPLOAD_CREDENTIAL"';
+var SECURITY = `-H "${RESOURCE_SECURITY_HEADER}: $RESOURCE_SECURITY"`;
+var jsonString = (field) => `sed -n 's/.*"${field}":"\\([^"]*\\)".*/\\1/p'`;
+var jsonNumber = (field) => `sed -n 's/.*"${field}":\\([0-9]*\\).*/\\1/p'`;
+function uploadAssetFunction(thresholdBytes = DERIVED_MULTIPART_THRESHOLD_BYTES) {
+  return [
+    "upload_asset() {",
+    '  ASSET_FILE="$1"; ASSET_KEY="$2"; ASSET_TYPE="$3"',
+    `  ASSET_SIZE=$(wc -c < "$ASSET_FILE" | tr -d ' ')`,
+    `  if [ "$ASSET_SIZE" -le ${thresholdBytes} ]; then`,
+    `    curl -sS -X PUT "$WORKER_URL/v1/upload/$ASSET_KEY" ${AUTH} ${SECURITY} -H "Content-Type: $ASSET_TYPE" --data-binary "@$ASSET_FILE"`,
+    "    return 0",
+    "  fi",
+    '  echo "[transcode] multipart upload of $ASSET_KEY ($ASSET_SIZE bytes)"',
+    `  CREATED=$(curl -sS --fail -X POST "$WORKER_URL/v1/upload/$ASSET_KEY?multipart=create" ${AUTH} ${SECURITY} -H "Content-Type: application/json" -d "{\\"size\\":$ASSET_SIZE,\\"contentType\\":\\"$ASSET_TYPE\\"}")`,
+    `  UPLOAD_ID=$(printf '%s' "$CREATED" | ${jsonString("uploadId")})`,
+    `  PART_SIZE=$(printf '%s' "$CREATED" | ${jsonNumber("partSize")})`,
+    `  PART_COUNT=$(printf '%s' "$CREATED" | ${jsonNumber("partCount")})`,
+    '  if [ -z "$UPLOAD_ID" ] || [ -z "$PART_SIZE" ] || [ -z "$PART_COUNT" ]; then return 1; fi',
+    // R2's uploadId can contain `+`, `/` or `=`: it's URL-encoded in the query.
+    `  UPLOAD_ID_QUERY=$(printf '%s' "$UPLOAD_ID" | sed -e 's/%/%25/g' -e 's/+/%2B/g' -e 's/\\//%2F/g' -e 's/=/%3D/g')`,
+    '  PARTS=""',
+    "  PART=1",
+    '  while [ "$PART" -le "$PART_COUNT" ]; do',
+    // Each part is exactly `partSize` (the last one, the remainder): the worker rejects any other size.
+    `    PART_RESPONSE=$(dd if="$ASSET_FILE" bs="$PART_SIZE" skip=$((PART - 1)) count=1 2>/dev/null | curl -sS --fail -X PUT "$WORKER_URL/v1/upload/$ASSET_KEY?uploadId=$UPLOAD_ID_QUERY&partNumber=$PART" ${AUTH} -H "Content-Type: application/octet-stream" --data-binary @-)`,
+    `    ETAG=$(printf '%s' "$PART_RESPONSE" | sed -n 's/.*"etag":"\\(.*\\)"}.*/\\1/p')`,
+    '    if [ -z "$ETAG" ]; then return 1; fi',
+    '    PARTS="$PARTS,{\\"partNumber\\":$PART,\\"etag\\":\\"$ETAG\\"}"',
+    "    PART=$((PART + 1))",
+    "  done",
+    `  PARTS=$(printf '%s' "$PARTS" | cut -c2-)`,
+    `  curl -sS --fail -X POST "$WORKER_URL/v1/upload/$ASSET_KEY?multipart=complete" ${AUTH} -H "Content-Type: application/json" -d "{\\"uploadId\\":\\"$UPLOAD_ID\\",\\"parts\\":[$PARTS]}" > /dev/null`,
+    "}"
+  ].join("\n");
+}
+
+// src/transcode/script.ts
+function encodeJson(plan) {
+  const fields = [
+    '\\"seconds\\":$ENCODE_SECONDS',
+    '\\"cpus\\":$TRANSCODE_CPUS',
+    '\\"topRung\\":\\"$TOP_RES\\"',
+    '\\"runner\\":\\"$TRANSCODE_RUNNER\\"',
+    '\\"complexity\\":$PT_SCORE',
+    '\\"probeSeconds\\":$PROBE_SECONDS',
+    `\\"params\\":${encodeParamsJson(plan)}`
+  ];
+  return `\\"encode\\":{${fields.join(",")}}`;
+}
+function renditionsScript() {
+  return [
+    'OUTPUTS_JSON=""',
+    "while read -r O_PROBE O_JSON; do",
+    '  O_DIMS=$(ffprobe -v error -select_streams v:0 -show_entries stream=width,height -of csv=p=0 "$O_PROBE" | head -1)',
+    '  O_W=$(echo "$O_DIMS" | cut -s -d, -f1)',
+    '  O_H=$(echo "$O_DIMS" | cut -s -d, -f2)',
+    '  case "$O_W" in ""|*[!0-9]*) O_W=0 ;; esac',
+    '  case "$O_H" in ""|*[!0-9]*) O_H=0 ;; esac',
+    '  OUTPUTS_JSON="$OUTPUTS_JSON,$O_JSON,\\"width\\":$O_W,\\"height\\":$O_H}"',
+    "done < /tmp/outputs.list",
+    `OUTPUTS_JSON=$(printf '%s' "$OUTPUTS_JSON" | cut -c2-)`
+  ];
+}
+function outputsReportJson(plan, posterKey) {
+  if (!plan.reportsOutputs) return "";
+  const formats = plan.posterFormats.map((format) => `\\"${format}\\"`).join(",");
+  return [
+    "",
+    '\\"renditions\\":[$OUTPUTS_JSON]',
+    `\\"posterKey\\":\\"${posterKey}\\"`,
+    `\\"posterFormats\\":[${formats}]`,
+    '\\"hasAudio\\":$HAS_AUDIO'
+  ].join(",");
+}
+function buildScript(options) {
+  const hlsKeyOption = options.encrypt ? "-hls_key_info_file /tmp/enc.keyinfo " : "";
+  const plan = options.plan ?? legacyPlan(options.maxResolution);
+  const playlistKey = `${options.outputPrefix}playlist.m3u8`;
+  const mp4Prefix = options.mp4Prefix ?? options.outputPrefix.replace(/hls\/$/, "mp4/");
+  const posterKey = options.posterKey ?? options.thumbnailKey.replace(/[^/]+$/, "poster.jpg");
+  const storyboardPrefix = options.storyboardPrefix ?? options.outputPrefix.replace(/hls\/$/, "storyboard/");
+  const putAsset = `curl -sS -X PUT -H "Authorization: Bearer $UPLOAD_CREDENTIAL" -H "${RESOURCE_SECURITY_HEADER}: $RESOURCE_SECURITY"`;
+  const ladderSetup = planSetupScript(plan, hlsKeyOption, { playlistKey, mp4Prefix });
+  const callbackHeaders = `-H "Content-Type: application/json" -H "Authorization: Bearer $CALLBACK_SECRET" -H "${JOB_TICKET_HEADER}: $JOB_TICKET"`;
+  const sendEvent = `curl -sS -X POST "$CALLBACK_URL" ${callbackHeaders} -d`;
+  const sendCompletion = `curl -sS --fail --retry 5 --retry-delay 3 --retry-connrefused -X POST "$CALLBACK_URL" ${callbackHeaders} -d`;
+  return [
+    "set -e",
+    uploadAssetFunction(options.multipartThresholdBytes),
+    // With `set -e`, any failing command aborts the script and the machine self-destructs
+    // WITHOUT sending `transcode.complete` → the client would be stuck in "transcoding". This trap
+    // emits `transcode.failed` on abnormal exit so the webhook still arrives. `STAGE`
+    // gives context on where it failed; `COMPLETED` keeps it from firing after a successful finish.
+    "STAGE=starting",
+    // Failure categorized by stage: `reason` + `retriable` (unquoted JSON bool) → the client decides
+    // the message and whether to retry. downloading=invalid/non-retriable input; encoding=unsupported codec;
+    // starting=capacity (the machine didn't start, retriable); everything else=internal, retriable.
+    `notify_failure() { ec=$?; [ "$ec" -eq 0 ] && return 0; [ -n "$COMPLETED" ] && return 0; case "$STAGE" in downloading) R=invalid_input; T=false ;; encoding) R=unsupported_codec; T=false ;; starting) R=capacity; T=true ;; *) R=internal; T=true ;; esac; ${sendEvent} "{\\"event\\":\\"transcode.failed\\",\\"videoId\\":\\"${options.videoId}\\",\\"error\\":\\"transcode failed at $STAGE (exit $ec)\\",\\"reason\\":\\"$R\\",\\"retriable\\":$T}" || true; }`,
+    "trap notify_failure EXIT",
+    "echo '[transcode] starting'",
+    // /tmp/probe holds one frame per rendition (for the master's RESOLUTION); not uploaded.
+    "mkdir -p /tmp/output /tmp/probe /tmp/mp4 /tmp/storyboard",
+    // L4: keyfile (16 bytes from KEY_B64) + keyinfo for ffmpeg. keyinfo line 1 = URI that gets
+    // baked into the playlist (`$KEY_ID.key`, relative → resolves against the hls/ folder on delivery);
+    // line 2 = local path to the keyfile ffmpeg uses to encrypt. Outside /tmp/output → not uploaded.
+    ...options.encrypt ? [
+      'echo "$KEY_B64" | base64 -d > /tmp/enc.keyfile',
+      `printf '%s\\n%s\\n' "$KEY_ID.key" "/tmp/enc.keyfile" > /tmp/enc.keyinfo`
+    ] : [],
+    "STAGE=downloading",
+    // "Machine alive" heartbeat: the first progress event (phase=downloading) moves the video out of
+    // "queued" within seconds, BEFORE downloading the input (which can take a while). Without this the
+    // status takes ~as long as the download.
+    `${sendEvent} "{\\"event\\":\\"transcode.progress\\",\\"videoId\\":\\"${options.videoId}\\",\\"currentSegment\\":0,\\"totalSegments\\":100,\\"phase\\":\\"downloading\\"}"`,
+    'echo "[transcode] downloading input from R2"',
+    // The input (raw, private) is downloaded with the service download token, not the upload credential: the
+    // delivery gate requires a valid viewer token for private media. The worker decrypts the raw if it's encrypted.
+    'curl -sS -o /tmp/input "$WORKER_URL/v1/media/$INPUT_KEY" -H "Authorization: Bearer $DOWNLOAD_TOKEN"',
+    'echo "[transcode] input downloaded: $(du -h /tmp/input | cut -f1)"',
+    "DURATION=$(ffprobe -v error -show_entries format=duration -of csv=p=0 /tmp/input)",
+    `TOTAL_SEGMENTS=$(echo "$DURATION / ${SEGMENT_SECONDS}" | bc)`,
+    "TOTAL_SEGMENTS=$((TOTAL_SEGMENTS + 1))",
+    `${sendEvent} "{\\"event\\":\\"transcode.started\\",\\"videoId\\":\\"${options.videoId}\\",\\"totalSegments\\":$TOTAL_SEGMENTS,\\"duration\\":$DURATION}"`,
+    // Complexity probe (per-title encode) BEFORE setup: the ffmpeg args read its `PT_*` values.
+    "STAGE=probing",
+    perTitleScript(plan),
+    ladderSetup,
+    "STAGE=encoding",
+    'echo "[transcode] running ffmpeg hls encode"',
+    // `set -f`: FF_OUTPUTS is expanded unquoted (intentional word-splitting) and carries a `*` in
+    // -force_key_frames's `expr:` → without noglob the shell could expand it against the filesystem.
+    "set -f",
+    // Measurement: encode wall clock (ffmpeg only, no download/upload). × runner vCPU = vCPU-s.
+    "ENCODE_START=$(date +%s)",
+    "ffmpeg -nostdin -progress /tmp/ffmpeg_progress -i /tmp/input $FF_OUTPUTS &",
+    "set +f",
+    "FFMPEG_PID=$!",
+    "LAST_PCT=0",
+    "while kill -0 $FFMPEG_PID 2>/dev/null; do",
+    "  sleep 5",
+    "  if [ -f /tmp/ffmpeg_progress ]; then",
+    '    CURRENT_US=$(grep "out_time_us" /tmp/ffmpeg_progress | tail -1 | cut -d= -f2)',
+    '    if [ -n "$CURRENT_US" ] && [ "$CURRENT_US" -gt 0 ] 2>/dev/null; then',
+    '      DURATION_US=$(echo "$DURATION * 1000000" | bc | cut -d. -f1)',
+    "      PCT=$(( CURRENT_US * 100 / DURATION_US ))",
+    '      if [ "$PCT" -gt "$LAST_PCT" ] && [ "$PCT" -le 100 ]; then',
+    `        ${sendEvent} "{\\"event\\":\\"transcode.progress\\",\\"videoId\\":\\"${options.videoId}\\",\\"currentSegment\\":$PCT,\\"totalSegments\\":100,\\"phase\\":\\"encoding\\"}"`,
+    "        LAST_PCT=$PCT",
+    "      fi",
+    "    fi",
+    "  fi",
+    "done",
+    "wait $FFMPEG_PID",
+    "ENCODE_SECONDS=$(( $(date +%s) - ENCODE_START ))",
+    // Sanitize: these go raw into the event's JSON (number / slug), a weird env value shouldn't break it.
+    'case "$TRANSCODE_CPUS" in ""|*[!0-9]*) TRANSCODE_CPUS=0 ;; esac',
+    'case "$TRANSCODE_RUNNER" in ""|*[!a-z0-9-]*) TRANSCODE_RUNNER=unknown ;; esac',
+    'echo "[transcode] encode took $ENCODE_SECONDS seconds on $TRANSCODE_CPUS vCPU ($TRANSCODE_RUNNER)"',
+    ...renditionsScript(),
+    // The master's CODECS needs to know if the output has audio.
+    hasAudioScript(plan),
+    // Without an HLS ladder (MP4-only preset) there's no master to write.
+    'if [ -n "$RENDITIONS" ]; then',
+    'echo "[transcode] generating master playlist"',
+    masterPlaylistScript(),
+    "fi",
+    storyboardVttScript(plan, `${storyboardPrefix}${STORYBOARD.vttFile}`),
+    "STAGE=thumbnail",
+    'echo "[transcode] generating poster and thumbnail"',
+    // Poster and thumbnail are generated OUTSIDE /tmp/output so they upload to their own path (`thumbnails/…`,
+    // where delivery serves them from) instead of sitting in the segment loop's hls/ folder.
+    posterScript(plan),
+    "STAGE=uploading",
+    'echo "[transcode] uploading segments"',
+    "CURRENT=0",
+    // Counts the files to upload from hls/ (.ts segments + media playlists + master) and mp4/. Poster and
+    // thumbnail upload separately to their own path. CURRENT and TOTAL line up with any plan.
+    "TOTAL=$(ls /tmp/output/* /tmp/mp4/* 2>/dev/null | wc -l)",
+    "for f in /tmp/output/*; do",
+    // Empty folder (MP4-only preset): the glob stays literal.
+    '  [ -e "$f" ] || continue',
+    '  FILENAME=$(basename "$f")',
+    '  CT="application/octet-stream"',
+    '  case "$FILENAME" in',
+    '    *.m3u8) CT="application/vnd.apple.mpegurl" ;;',
+    '    *.ts) CT="video/mp2t" ;;',
+    "  esac",
+    '  echo "[transcode] uploading $FILENAME ($(du -h "$f" | cut -f1))"',
+    `  curl -sS -X PUT "$WORKER_URL/v1/upload/${options.outputPrefix}$FILENAME" -H "Authorization: Bearer $UPLOAD_CREDENTIAL" -H "${RESOURCE_SECURITY_HEADER}: $RESOURCE_SECURITY" -H "Content-Type: $CT" --data-binary "@$f"`,
+    "  CURRENT=$((CURRENT + 1))",
+    `  ${sendEvent} "{\\"event\\":\\"transcode.progress\\",\\"videoId\\":\\"${options.videoId}\\",\\"currentSegment\\":$CURRENT,\\"totalSegments\\":$TOTAL,\\"phase\\":\\"uploading\\"}"`,
+    "done",
+    // Standalone MP4s → `mp4/`: single PUT up to the threshold, multipart above it (a 200 MB hero doesn't fit in a
+    // buffered PUT). A private one is encrypted at rest on either path and served with Range.
+    "for f in /tmp/mp4/*; do",
+    '  [ -e "$f" ] || continue',
+    '  FILENAME=$(basename "$f")',
+    '  echo "[transcode] uploading $FILENAME ($(du -h "$f" | cut -f1))"',
+    `  upload_asset "$f" "${mp4Prefix}$FILENAME" "video/mp4"`,
+    "  CURRENT=$((CURRENT + 1))",
+    `  ${sendEvent} "{\\"event\\":\\"transcode.progress\\",\\"videoId\\":\\"${options.videoId}\\",\\"currentSegment\\":$CURRENT,\\"totalSegments\\":$TOTAL,\\"phase\\":\\"uploading\\"}"`,
+    "done",
+    storyboardUploadScript(plan, storyboardPrefix, putAsset),
+    'echo "[transcode] uploading poster"',
+    `curl -sS -X PUT "$WORKER_URL/v1/upload/${posterKey}" -H "Authorization: Bearer $UPLOAD_CREDENTIAL" -H "${RESOURCE_SECURITY_HEADER}: $RESOURCE_SECURITY" -H "Content-Type: image/jpeg" --data-binary "@/tmp/poster.jpg"`,
+    // Thumbnail → its own path (`{visibility}/video/{id}/thumbnails/thumbnail.jpg`), with the propagated
+    // binding override. Encrypted at rest if the policy requires it (it's a non-HLS private asset).
+    'echo "[transcode] uploading thumbnail"',
+    `curl -sS -X PUT "$WORKER_URL/v1/upload/${options.thumbnailKey}" -H "Authorization: Bearer $UPLOAD_CREDENTIAL" -H "${RESOURCE_SECURITY_HEADER}: $RESOURCE_SECURITY" -H "Content-Type: image/jpeg" --data-binary "@/tmp/thumbnail.jpg"`,
+    'echo "[transcode] sending completion"',
+    // MP4-only preset: no playlist to announce.
+    `PLAYLIST_KEY="${playlistKey}"`,
+    '[ -n "$RENDITIONS" ] || PLAYLIST_KEY=""',
+    `${sendCompletion} "{\\"event\\":\\"transcode.complete\\",\\"videoId\\":\\"${options.videoId}\\",\\"duration\\":$DURATION,\\"playlistKey\\":\\"$PLAYLIST_KEY\\",\\"thumbnailKey\\":\\"${options.thumbnailKey}\\",\\"storyboardKey\\":\\"$STORYBOARD_KEY\\",${encodeJson(plan)}${outputsReportJson(plan, posterKey)}}"`,
+    "COMPLETED=1",
+    'echo "[transcode] done"'
+  ].join("\n");
+}
+
+// src/routes/transcode.ts
+function parseSecurityMeta2(raw) {
+  if (!raw) return void 0;
+  try {
+    return JSON.parse(raw);
+  } catch {
+    return void 0;
+  }
+}
+var SERVICE_TOKEN_TTL_SECONDS = 3600;
+var isVideoId = (videoId, key) => Boolean(videoId) && videoId !== key;
+var transcode = new Hono8();
+transcode.post("/", async (context) => {
+  const body = await context.req.json();
+  if (!body.key) {
+    return context.json({ error: "key is required" }, 400);
+  }
+  const videoId = extractId2(body.key);
+  const visibility = visibilityFromKey3(body.key) ?? "private";
+  const outputPrefix = `${visibility}/${videoHlsPath(videoId)}/`;
+  const thumbnailKey = `${visibility}/${videoThumbnailPath(videoId)}`;
+  const fullKey = storageKey(context, body.key);
+  const object = await context.env.MEDIA_BUCKET.head(fullKey);
+  if (!object) {
+    const videoFolder = storageKey(context, `${visibility}/${videoBasePath2(videoId)}/`);
+    const isKnownVideo = isVideoId(videoId, body.key) && await hasPriorTranscodeOutputs(context.env.MEDIA_BUCKET, videoFolder);
+    if (isKnownVideo) return context.json(ORIGINAL_NOT_RETAINED, 410);
+    return context.json({ error: "Media not found in storage" }, 404);
+  }
+  if (!isVideoId(videoId, body.key)) {
+    return context.json({ error: "Invalid key format" }, 400);
+  }
+  const scope = getRequestState(context);
+  const transcodeConfig = scope.config?.transcode;
+  const resolved = resolveTranscodePreset(body.preset, transcodeConfig?.presets);
+  if (!resolved.ok) {
+    return context.json({ error: "Invalid preset", details: resolved.errors }, 400);
+  }
+  const preset = resolved.name;
+  const fallbackMaxResolution = resolved.source === "legacy" ? presetToMaxResolution(preset) : MaxResolution.P4K;
+  const maxResolution = transcodeConfig?.maxResolution ?? fallbackMaxResolution;
+  const plan = planTranscode(resolved.spec, maxResolution, { reportsOutputs: resolved.source !== "legacy" });
+  const posterKey = `${visibility}/${videoPosterPath(videoId)}`;
+  const mp4Prefix = `${visibility}/${videoMp4Dir(videoId)}/`;
+  const storyboardPrefix = `${visibility}/${videoStoryboardDir(videoId)}/`;
+  const workerBaseUrl = new URL(context.req.url).origin;
+  const callbackUrl = `${workerBaseUrl}/v1/webhooks/transcode`;
+  const rawOverride = parseSecurityMeta2(object.customMetadata?.security);
+  const resourceSecurityHeader = rawOverride ? JSON.stringify(rawOverride) : "";
+  const keyMetadata = rawOverride ? { security: resourceSecurityHeader } : void 0;
+  const policy = resolveSecurity3(rawOverride, scope.config?.security);
+  const shouldEncrypt = policy.encrypt && visibility === "private" && Boolean(context.env.KEYS_BUCKET);
+  let encryptKeyB64 = "";
+  let encryptKeyId = "";
+  if (shouldEncrypt && context.env.KEYS_BUCKET) {
+    const rawKey = crypto.getRandomValues(new Uint8Array(16));
+    encryptKeyId = generateId2();
+    const keyPath = storageKey(context, `${outputPrefix}${encryptKeyId}`);
+    await context.env.KEYS_BUCKET.put(keyPath, rawKey, {
+      ...keyMetadata ? { customMetadata: keyMetadata } : {}
+    });
+    encryptKeyB64 = btoa(String.fromCharCode(...rawKey));
+  }
+  const nowSeconds = Math.floor(Date.now() / 1e3);
+  const requestedExp = nowSeconds + SERVICE_TOKEN_TTL_SECONDS;
+  const decision = await decideCredential(context, {
+    kind: "service",
+    scopes: [TokenScope4.MEDIA_READ],
+    path: body.key,
+    expiresAt: requestedExp * 1e3
+  });
+  if (!decision.allow) return decision.response;
+  const downloadToken = await signViewerToken(
+    withPluginClaims(
+      {
+        sub: `${SERVICE_SUBJECT_PREFIX}${videoId}`,
+        typ: SERVICE_TOKEN_TYPE,
+        ...scopeClaim([TokenScope4.MEDIA_READ]),
+        ...audienceClaim(scope.storagePrefix),
+        bind: { sessionBinding: false, ipBinding: false },
+        iat: nowSeconds,
+        exp: cappedExpiry(requestedExp, decision.expiresAt, (epochMs) => Math.floor(epochMs / 1e3))
+      },
+      decision
+    ),
+    context.env.DELIVERY_SIGN_SECRET
+  );
+  if (body.callbackUrl) {
+    await context.env.MEDIA_KV.put(
+      clientWebhookKvKey(videoId),
+      JSON.stringify(clientWebhookFor(scope, body.callbackUrl)),
+      { expirationTtl: KV_JOB_TTL_SECONDS }
+    );
+  }
+  const transcodeScript = buildScript({
+    videoId,
+    maxResolution,
+    plan,
+    outputPrefix,
+    thumbnailKey,
+    posterKey,
+    mp4Prefix,
+    storyboardPrefix,
+    encrypt: shouldEncrypt
+  });
+  const { ticket: jobTicket } = await signJobTicket(context.env.DELIVERY_SIGN_SECRET, {
+    videoId,
+    ...scope.context ? { context: scope.context } : {}
+  });
+  const runner = createRunner(context.env);
+  if (!runner) {
+    console.error(`[transcode] unknown TRANSCODE_RUNNER "${context.env.TRANSCODE_RUNNER}"`);
+    return context.json({ error: "Invalid TRANSCODE_RUNNER", code: TranscodeLaunchErrorCode.NOT_CONFIGURED }, 500);
+  }
+  const launch = await runner.launch({
+    videoId,
+    script: transcodeScript,
+    env: {
+      INPUT_KEY: body.key,
+      VIDEO_ID: videoId,
+      OUTPUT_PREFIX: outputPrefix,
+      THUMBNAIL_KEY: thumbnailKey,
+      WORKER_URL: workerBaseUrl,
+      UPLOAD_CREDENTIAL: scope.runnerCredential ?? "",
+      CALLBACK_URL: callbackUrl,
+      CALLBACK_SECRET: context.env.TRANSCODE_WEBHOOK_SECRET ?? "",
+      JOB_TICKET: jobTicket,
+      PRESET: preset,
+      // Service token to download the raw (private → the gate requires a viewer token; public ignores it).
+      DOWNLOAD_TOKEN: downloadToken,
+      // L4: HLS encryption material (empty if the video isn't encrypted). The script writes the keyfile
+      // from KEY_B64 and bakes `#EXT-X-KEY:URI="$KEY_ID.key"`. The key already lives in the keys bucket.
+      KEY_B64: encryptKeyB64,
+      KEY_ID: encryptKeyId,
+      // Resource binding override (empty if there isn't one) → the script propagates it as a header on
+      // every derived asset upload so the gate ties the video per-resource, same as the raw.
+      RESOURCE_SECURITY: resourceSecurityHeader,
+      // Measurement: the script reports `encodeSeconds` and this vCPU count in `transcode.complete`.
+      TRANSCODE_CPUS: String(runner.cpus),
+      TRANSCODE_RUNNER: runner.name
+    }
+  });
+  if (!launch.ok) {
+    console.error(`[transcode] ${runner.name} launch failed (${launch.code}):`, launch.detail);
+    return context.json({ error: launch.error, code: launch.code }, launch.status);
+  }
+  const jobId = launch.jobRef;
+  await Promise.all([
+    context.env.MEDIA_KV.put(
+      `${KvPrefix.TRANSCODE_JOB}:${jobId}`,
+      JSON.stringify({ videoId, inputKey: body.key, outputPrefix, thumbnailKey, preset, runner: runner.name }),
+      { expirationTtl: KV_JOB_TTL_SECONDS }
+    ),
+    writeQueuedStatus(context.env.MEDIA_KV, videoId, { jobRef: jobId, runner: runner.name }),
+    // Webhook URLs from `outputBaseUrl` (or the request's origin), fixed when the job is queued.
+    saveOutputBaseUrl(context.env.MEDIA_KV, videoId, transcodeConfig?.outputBaseUrl ?? workerBaseUrl),
+    rememberRawDisposal(context.env.MEDIA_KV, videoId, {
+      storageKey: fullKey,
+      deleteOnComplete: transcodeConfig?.deleteOriginalOnSuccess === true
+    })
+  ]);
+  return context.json({
+    jobId,
+    videoId,
+    inputKey: body.key,
+    outputPrefix,
+    thumbnailKey,
+    preset,
+    status: TranscodeStatus2.QUEUED
+  });
+});
+transcode.get("/:jobId", async (context) => {
+  const jobId = context.req.param("jobId");
+  const kv = context.env.MEDIA_KV;
+  const jobMeta = await kv.get(`${KvPrefix.TRANSCODE_JOB}:${jobId}`, "json");
+  if (!jobMeta?.videoId) return context.json({ error: "Job not found" }, 404);
+  const [record, durationMeta] = await Promise.all([
+    readStatus(kv, jobMeta.videoId),
+    kv.get(`${KvPrefix.TRANSCODE_META}:${jobMeta.videoId}`, "json")
+  ]);
+  const ownRecord = record?.jobRef === jobId ? record : null;
+  const status = ownRecord?.status ?? (durationMeta ? TranscodeStatus2.COMPLETED : TranscodeStatus2.QUEUED);
+  if (status === TranscodeStatus2.FAILED) {
+    const { error, reason, retriable } = ownRecord ?? {};
+    return context.json({ jobId, status, error, reason, retriable });
+  }
+  if (status !== TranscodeStatus2.COMPLETED) return context.json({ jobId, status });
+  return context.json({
+    jobId,
+    status,
+    duration: durationMeta?.duration ?? null,
+    playlistUrl: jobMeta.outputPrefix ? `${jobMeta.outputPrefix}playlist.m3u8` : null,
+    thumbnailKey: jobMeta.thumbnailKey ?? null
+  });
+});
+
+// src/routes/upload.ts
+import {
+  decodeEncryptionMeta as decodeEncryptionMeta6,
+  MediaType as MediaType2,
+  resolveSecurity as resolveSecurity5,
+  resolveVisibility,
+  UploadRequestKind as UploadRequestKind2
+} from "@devultur/core";
+import { Hono as Hono9 } from "hono";
+
+// src/routes/upload-multipart.ts
+import {
+  AES_BLOCK_BYTES as AES_BLOCK_BYTES2,
+  classifyUploadRequest,
+  counterForBlock,
+  decodeEncryptionMeta as decodeEncryptionMeta5,
+  encryptBytes,
+  MULTIPART_PART_SIZE_BYTES,
+  MULTIPART_QUERY,
+  multipartPartCount,
+  multipartPartRange,
+  resolveSecurity as resolveSecurity4,
+  UploadRequestKind
+} from "@devultur/core";
+
+// src/routes/derived-upload.ts
+var DERIVED_ASSET_KEY = /^(public|private)\/video\/[A-Za-z0-9-]+\/(hls|mp4|thumbnails|storyboard)\/[^/]+$/;
+var DERIVED_CONTENT_TYPES = /* @__PURE__ */ new Set([
+  "video/mp4",
+  "video/mp2t",
+  "image/jpeg",
+  "application/vnd.apple.mpegurl",
+  "text/vtt"
+]);
+function isDerivedAssetKey(key) {
+  return DERIVED_ASSET_KEY.test(key);
+}
+async function derivedAssetPending(context, key) {
+  if (!isDerivedAssetKey(key) || !isAuthenticated(context)) return null;
+  const body = await context.req.json().catch(() => null);
+  const declared = typeof body?.contentType === "string" ? body.contentType : "";
+  const security = parseSecurityHeader(context.req.header(RESOURCE_SECURITY_HEADER));
+  return {
+    contentType: DERIVED_CONTENT_TYPES.has(declared) ? declared : "application/octet-stream",
+    storageKey: storageKey(context, key),
+    ...security ? { security } : {}
+  };
+}
+
+// src/routes/upload-pending.ts
+var UPLOAD_PENDING_QUERY = "u";
+var PENDING_ID_BYTES = 16;
+var PENDING_ID_PATTERN = /^[A-Za-z0-9_-]{22}$/;
+function newUploadPendingId() {
+  const bytes = crypto.getRandomValues(new Uint8Array(PENDING_ID_BYTES));
+  return btoa(String.fromCharCode(...bytes)).replace(/\+/g, "-").replace(/\//g, "_").replace(/=+$/, "");
+}
+function uploadPendingKvKey(id) {
+  return `${KvPrefix.UPLOAD_PENDING}:${id}`;
+}
+function uploadUrlFor(key, id) {
+  return `/v1/upload/${key}?${UPLOAD_PENDING_QUERY}=${id}`;
+}
+function uploadPendingIdOf(uploadUrl) {
+  const id = new URL(uploadUrl, "http://localhost").searchParams.get(UPLOAD_PENDING_QUERY);
+  if (id === null) return void 0;
+  return PENDING_ID_PATTERN.test(id) ? id : null;
+}
+var isRecord3 = (value) => typeof value === "object" && value !== null && !Array.isArray(value);
+function withLegacyFieldNames(pending) {
+  const { callerContext, objectMetadata, ...current } = pending;
+  return {
+    ...current,
+    ...current.context === void 0 && isRecord3(callerContext) ? { context: callerContext } : {},
+    ...current.uploadMetadata === void 0 && isRecord3(objectMetadata) ? { uploadMetadata: objectMetadata } : {}
+  };
+}
+function parsePending(raw) {
+  if (!raw) return null;
+  try {
+    const pending = JSON.parse(raw);
+    return pending?.storageKey ? withLegacyFieldNames(pending) : null;
+  } catch {
+    return null;
+  }
+}
+async function readUploadPendingRaw(kv, requestUrl, key) {
+  const id = uploadPendingIdOf(requestUrl);
+  if (id === void 0 || id === null) return id;
+  const raw = await kv.get(uploadPendingKvKey(id));
+  const pending = parsePending(raw);
+  if (!raw || !pending || pending.key !== key) return null;
+  return { id, raw };
+}
+function derivedSessionKvKey(context, key) {
+  if (!isAuthenticated(context) || !isDerivedAssetKey(key)) return null;
+  return `${KvPrefix.UPLOAD_PENDING}:${storageKey(context, key)}`;
+}
+function isUnderCallerPrefix(context, pending) {
+  const prefix = getRequestState(context).storagePrefix;
+  if (!isAuthenticated(context) || !prefix) return true;
+  return pending.storageKey.startsWith(prefix);
+}
+async function lookupUploadPending(context, key) {
+  const kv = context.env.MEDIA_KV;
+  const capability = await readUploadPendingRaw(kv, context.req.url, key);
+  if (capability === null) return null;
+  if (capability) {
+    const pending = parsePending(capability.raw);
+    if (!pending || !isUnderCallerPrefix(context, pending)) return null;
+    return { pending, kvKey: uploadPendingKvKey(capability.id) };
+  }
+  const sessionKvKey = derivedSessionKvKey(context, key);
+  const session = sessionKvKey ? parsePending(await kv.get(sessionKvKey)) : null;
+  return session && sessionKvKey ? { pending: session, kvKey: sessionKvKey } : void 0;
+}
+var uploadNotFound = (context) => context.json({ error: "Upload not found or expired", code: "upload_not_found" }, 404);
+function pendingUploadInfo(key, pending) {
+  return {
+    key,
+    storageKey: pending.storageKey,
+    contentType: pending.contentType,
+    ...pending.originalFilename ? { filename: pending.originalFilename } : {},
+    isMultipart: Boolean(pending.multipart),
+    ...typeof pending.expiresAt === "number" ? { expiresAt: pending.expiresAt } : {},
+    isOverwrite: Boolean(pending.isAsset && pending.overwrite),
+    ...pending.context ? { context: pending.context } : {}
+  };
+}
+var UPLOAD_URL_PREFIX2 = "/v1/upload/";
+async function getPendingUpload(context) {
+  const { path } = context.req;
+  if (!path.startsWith(UPLOAD_URL_PREFIX2) || path.length === UPLOAD_URL_PREFIX2.length) return void 0;
+  const key = path.slice(UPLOAD_URL_PREFIX2.length);
+  const found = await readUploadPendingRaw(context.env.MEDIA_KV, context.req.url, key);
+  if (!found) return found;
+  const pending = parsePending(found.raw);
+  return pending ? pendingUploadInfo(key, pending) : null;
+}
+async function cancelPendingUpload(context, uploadUrl) {
+  const id = uploadPendingIdOf(uploadUrl);
+  if (id) await context.env.MEDIA_KV.delete(uploadPendingKvKey(id));
+}
+
+// src/routes/upload-multipart.ts
+var MULTIPART_PENDING_TTL_SECONDS = 24 * 60 * 60;
+var MAX_PART_COUNT = 1e4;
+async function readMultipartAt(context, kvKey) {
+  const raw = await context.env.MEDIA_KV.get(kvKey);
+  try {
+    return raw ? JSON.parse(raw).multipart : void 0;
+  } catch {
+    return void 0;
+  }
+}
+async function readActiveMultipart(context, key, uploadId) {
+  const resolved = await lookupUploadPending(context, key);
+  const multipart = resolved?.pending.multipart;
+  if (!resolved || !multipart || !uploadId || multipart.uploadId !== uploadId) return null;
+  return { ...resolved, multipart };
+}
+function uploadRequestKindOf(context) {
+  return classifyUploadRequest(context.req.method, new URL(context.req.url).searchParams);
+}
+var invalidMultipartRequest = (context) => context.json({ error: "uploadId and partNumber are required for multipart calls", code: "invalid_multipart" }, 400);
+function expectedPartBytes(multipart, partNumber) {
+  const partCount = multipartPartCount(multipart.size, multipart.partSize);
+  if (!Number.isInteger(partNumber) || partNumber < 1 || partNumber > partCount) return null;
+  const { start, end } = multipartPartRange(partNumber, multipart.size, multipart.partSize);
+  return end - start;
+}
+function normalizeCompletedParts(multipart, parts) {
+  if (!Array.isArray(parts)) return null;
+  const partCount = multipartPartCount(multipart.size, multipart.partSize);
+  if (parts.length !== partCount) return null;
+  const sorted = parts.map((part) => part).filter((part) => Number.isInteger(part.partNumber) && typeof part.etag === "string").sort((a, b) => a.partNumber - b.partNumber);
+  const isComplete = sorted.length === partCount && sorted.every((part, index) => part.partNumber === index + 1);
+  return isComplete ? sorted.map((part) => ({ partNumber: part.partNumber, etag: part.etag })) : null;
+}
+async function handleMultipartCreate(context, key, target) {
+  const { pending, kvKey } = target;
+  const body = await context.req.json().catch(() => null);
+  const size = Number(body?.size);
+  if (!Number.isSafeInteger(size) || size <= 0) {
+    return context.json({ error: "size must be a positive integer", code: "invalid_size" }, 400);
+  }
+  const declaredSha256 = resolveDeclaredSha256(body?.sha256 ?? pending.sha256);
+  if (isUploadTargetError(declaredSha256)) return targetFailure(context, declaredSha256);
+  if (pending.maxSizeBytes != null && size > pending.maxSizeBytes) {
+    return context.json(
+      {
+        error: "File exceeds the allowed size for this media type",
+        code: "file_too_large",
+        limit: pending.maxSizeBytes
+      },
+      413
+    );
+  }
+  const partSize = MULTIPART_PART_SIZE_BYTES;
+  const partCount = multipartPartCount(size, partSize);
+  if (partCount > MAX_PART_COUNT) {
+    return context.json({ error: "File is too large for a multipart upload", code: "file_too_large" }, 413);
+  }
+  if (pending.multipart) {
+    return context.json({ uploadId: pending.multipart.uploadId, partSize: pending.multipart.partSize, partCount });
+  }
+  if (await isTakenAsset(context, pending)) return alreadyExists(context, key);
+  const customMetadata = {
+    ...allowedUploadMetadata(pending.uploadMetadata),
+    ...integrityMetadata(declaredSha256, false, pending.expiresAt)
+  };
+  if (pending.security) customMetadata.security = JSON.stringify(pending.security);
+  const policy = resolveSecurity4(pending.security, getRequestState(context).config?.security);
+  let enc;
+  if (context.env.KEYS_BUCKET && shouldEncryptAtRest(policy, key, true)) {
+    ({ enc } = await createObjectEncryption(context.env.KEYS_BUCKET, pending.storageKey, { ...customMetadata }));
+    customMetadata.enc = enc;
+  }
+  const multipartUpload = await context.env.MEDIA_BUCKET.createMultipartUpload(pending.storageKey, {
+    // Video raw: the class the POST resolved from the config's retention setting (see upload.ts).
+    storageClass: pending.storageClass ?? "Standard",
+    httpMetadata: {
+      contentType: pending.contentType,
+      ...pending.originalFilename ? { contentDisposition: contentDispositionInline(pending.originalFilename) } : {},
+      ...pending.cacheControl ? { cacheControl: pending.cacheControl } : {}
+    },
+    ...Object.keys(customMetadata).length > 0 ? { customMetadata } : {}
+  });
+  const multipart = {
+    uploadId: multipartUpload.uploadId,
+    size,
+    partSize,
+    ...enc ? { enc } : {},
+    ...declaredSha256 ? { sha256: declaredSha256 } : {}
+  };
+  await context.env.MEDIA_KV.put(kvKey, JSON.stringify({ ...pending, multipart }), {
+    expirationTtl: MULTIPART_PENDING_TTL_SECONDS
+  });
+  const winner = await readMultipartAt(context, kvKey);
+  if (winner && winner.uploadId !== multipart.uploadId) {
+    await multipartUpload.abort();
+    return context.json({ uploadId: winner.uploadId, partSize: winner.partSize, partCount });
+  }
+  return context.json({ uploadId: multipart.uploadId, partSize, partCount });
+}
+async function encryptPart(context, pending, multipart, partNumber, body) {
+  if (!multipart.enc) return body;
+  const meta = decodeEncryptionMeta5(multipart.enc);
+  const material = meta ? await loadStorageKey(context.env.KEYS_BUCKET, pending.storageKey, meta.keyId) : null;
+  if (!meta || !material) return null;
+  const startBlock = (partNumber - 1) * multipart.partSize / AES_BLOCK_BYTES2;
+  return encryptBytes(body, material.key, counterForBlock(meta.iv, startBlock));
+}
+async function handleMultipartPart(context) {
+  const key = context.req.param("key") ?? "";
+  const active = await readActiveMultipart(context, key, context.req.query(MULTIPART_QUERY.UPLOAD_ID));
+  if (!active) return uploadNotFound(context);
+  const { pending, multipart } = active;
+  const partNumber = Number(context.req.query(MULTIPART_QUERY.PART_NUMBER));
+  const expectedBytes = expectedPartBytes(multipart, partNumber);
+  if (expectedBytes == null) return context.json({ error: "Invalid partNumber", code: "invalid_part" }, 400);
+  const declaredBytes = Number(context.req.header("content-length") ?? "0");
+  if (Number.isFinite(declaredBytes) && declaredBytes > expectedBytes) {
+    return context.json({ error: "Part size does not match the upload plan", code: "part_size_mismatch" }, 400);
+  }
+  const body = await context.req.arrayBuffer();
+  if (body.byteLength !== expectedBytes) {
+    return context.json({ error: "Part size does not match the upload plan", code: "part_size_mismatch" }, 400);
+  }
+  const partChecksumFailure = await checkPartSha256(context, multipart, body);
+  if (partChecksumFailure) return partChecksumFailure;
+  const storedPart = await encryptPart(context, pending, multipart, partNumber, body);
+  if (!storedPart) return context.json({ error: "Encryption key not found for this upload" }, 500);
+  const multipartUpload = context.env.MEDIA_BUCKET.resumeMultipartUpload(pending.storageKey, multipart.uploadId);
+  const uploaded = await multipartUpload.uploadPart(partNumber, storedPart);
+  return context.json({ partNumber: uploaded.partNumber, etag: uploaded.etag });
+}
+async function handleMultipartComplete(context, key) {
+  const body = await context.req.json().catch(() => null);
+  const active = await readActiveMultipart(context, key, body?.uploadId);
+  if (!active) return uploadNotFound(context);
+  const { pending, multipart, kvKey } = active;
+  const parts = normalizeCompletedParts(multipart, body?.parts);
+  if (!parts) return context.json({ error: "parts must list every part exactly once", code: "invalid_parts" }, 400);
+  if (await isTakenAsset(context, pending)) return alreadyExists(context, key);
+  const multipartUpload = context.env.MEDIA_BUCKET.resumeMultipartUpload(pending.storageKey, multipart.uploadId);
+  const object = await multipartUpload.complete(parts);
+  await context.env.MEDIA_KV.delete(kvKey);
+  await discardStaleVariants(context.env.MEDIA_BUCKET, pending);
+  const integrity = multipart.sha256 ? { sha256: multipart.sha256, sha256Verified: false } : {};
+  return context.json({ key, size: object.size, ...integrity });
+}
+async function isTakenAsset(context, pending) {
+  if (!pending.isAsset || pending.overwrite) return false;
+  return Boolean(await context.env.MEDIA_BUCKET.head(pending.storageKey));
+}
+async function checkPartSha256(context, multipart, body) {
+  const partSha256 = headerSha256(context);
+  if (partSha256 === null) {
+    return context.json({ error: "x-devultur-sha256 must be a 64-character hex string", code: "invalid_sha256" }, 400);
+  }
+  if (multipart.sha256 && !partSha256) {
+    return context.json(
+      {
+        error: "Each part must carry its x-devultur-sha256 when the upload declares one",
+        code: "part_sha256_required"
+      },
+      400
+    );
+  }
+  if (!partSha256) return null;
+  const digest = await digestBody(body, void 0, partSha256);
+  if ("mismatch" in digest) return sha256Mismatch(context, digest.mismatch.expected, digest.mismatch.actual);
+  return null;
+}
+async function handleMultipartPost(context) {
+  const key = context.req.param("key") ?? "";
+  const kind = uploadRequestKindOf(context);
+  if (kind === UploadRequestKind.MULTIPART_COMPLETE) return handleMultipartComplete(context, key);
+  if (kind === UploadRequestKind.INVALID) return invalidMultipartRequest(context);
+  if (kind !== UploadRequestKind.MULTIPART_CREATE) return context.json({ error: "Not found" }, 404);
+  const resolved = await lookupUploadPending(context, key);
+  if (resolved === null) return uploadNotFound(context);
+  if (resolved) return handleMultipartCreate(context, key, resolved);
+  const derived = await derivedAssetPending(context, key);
+  const derivedKvKey = derivedSessionKvKey(context, key);
+  if (!derived || !derivedKvKey) return uploadNotFound(context);
+  return handleMultipartCreate(context, key, { pending: derived, kvKey: derivedKvKey });
+}
+async function handleMultipartAbort(context) {
+  if (uploadRequestKindOf(context) !== UploadRequestKind.MULTIPART_ABORT) return invalidMultipartRequest(context);
+  const key = context.req.param("key") ?? "";
+  const active = await readActiveMultipart(context, key, context.req.query(MULTIPART_QUERY.UPLOAD_ID));
+  if (!active) return uploadNotFound(context);
+  await context.env.MEDIA_BUCKET.resumeMultipartUpload(active.pending.storageKey, active.multipart.uploadId).abort();
+  await context.env.MEDIA_KV.delete(active.kvKey);
+  return context.json({ aborted: true });
+}
+
+// src/routes/upload.ts
+var upload = new Hono9();
+upload.post("/", async (context) => {
+  const body = await context.req.json();
+  const isAssetRequest = body.path !== void 0;
+  const filename = body.filename ?? (typeof body.path === "string" ? body.path.split("/").pop() : void 0);
+  if (!filename || !body.contentType) {
+    return context.json({ error: "filename and contentType are required" }, 400);
+  }
+  const inferredType = inferMediaType(body.contentType);
+  if (body.mediaType && inferredType && body.mediaType !== inferredType) {
+    return context.json(
+      {
+        error: `mediaType "${body.mediaType}" does not match content type ${body.contentType}`,
+        code: "media_type_mismatch"
+      },
+      400
+    );
+  }
+  const mediaType = body.mediaType ?? inferredType ?? (isAssetRequest ? MediaType2.FILE : null);
+  if (!mediaType) {
+    return context.json({ error: `Unsupported content type: ${body.contentType}` }, 400);
+  }
+  const scope = getRequestState(context);
+  const uploadRule = scope.config?.uploadRules?.[mediaType];
+  if (!isContentTypeAllowed(body.contentType, uploadRule?.accept)) {
+    return context.json(
+      { error: `Content type ${body.contentType} is not allowed`, code: "content_type_not_allowed" },
+      415
+    );
+  }
+  const grant = scope.access?.uploadGrant;
+  const target = resolveUploadTarget(
+    body,
+    mediaType,
+    resolveVisibility(body.visibility, uploadRule?.visibility),
+    grant
+  );
+  if (isUploadTargetError(target)) return targetFailure(context, target);
+  const expiresAt = resolveExpiresAt(body.expiresIn, grant, Date.now(), scope.config?.maxFileLifetimeSeconds);
+  if (isUploadTargetError(expiresAt)) return targetFailure(context, expiresAt);
+  const sha256 = resolveDeclaredSha256(body.sha256);
+  if (isUploadTargetError(sha256)) return targetFailure(context, sha256);
+  const cacheControl = resolveObjectCacheControl(body.cacheControl, target, scope.config?.cacheRules);
+  if (isUploadTargetError(cacheControl)) return targetFailure(context, cacheControl);
+  const maxSizeBytes = effectiveMaxBytes(uploadRule?.maxSizeBytes, grant);
+  const declaredSize = Number(body.size);
+  if (maxSizeBytes != null && Number.isFinite(declaredSize) && declaredSize > maxSizeBytes) {
+    return context.json({ error: "File exceeds the allowed size", code: "file_too_large", limit: maxSizeBytes }, 413);
+  }
+  const virtualKey = target.key;
+  const fullKey = storageKey(context, virtualKey);
+  const shouldOverwrite = body.overwrite === true;
+  if (target.isAsset && !shouldOverwrite && await context.env.MEDIA_BUCKET.head(fullKey)) {
+    return alreadyExists(context, virtualKey);
+  }
+  if (grant) {
+    const exhausted = await claimTokenFileSlot(context.env.MEDIA_KV, grant);
+    if (exhausted) return targetFailure(context, exhausted);
+  }
+  const resolvedSecurity = resolveSecurity5(body.security, scope.config?.security);
+  const pending = {
+    contentType: body.contentType,
+    storageKey: fullKey,
+    key: virtualKey,
+    originalFilename: filename,
+    security: resolvedSecurity,
+    ...maxSizeBytes != null ? { maxSizeBytes } : {},
+    ...scope.context ? { context: scope.context } : {},
+    // Only the video raw: image/file and the transcode assets always go in Standard.
+    ...mediaType === MediaType2.VIDEO && scope.config?.originalStorageClass ? { storageClass: scope.config.originalStorageClass } : {},
+    ...sha256 ? { sha256 } : {},
+    ...expiresAt ? { expiresAt } : {},
+    ...target.isAsset ? { isAsset: true, overwrite: shouldOverwrite } : {},
+    ...cacheControl ? { cacheControl } : {},
+    ...scope.config?.uploadMetadata ? { uploadMetadata: scope.config.uploadMetadata } : {}
+  };
+  const pendingId = newUploadPendingId();
+  await context.env.MEDIA_KV.put(uploadPendingKvKey(pendingId), JSON.stringify(pending), {
+    expirationTtl: UPLOAD_TOKEN_TTL_SECONDS
+  });
+  return context.json({
+    key: virtualKey,
+    uploadUrl: uploadUrlFor(virtualKey, pendingId),
+    id: target.id,
+    kind: mediaType,
+    visibility: target.visibility,
+    ...expiresAt ? { expiresAt } : {}
+  });
+});
+upload.post("/:key{.+}", handleMultipartPost);
+upload.delete("/:key{.+}", handleMultipartAbort);
+upload.put("/:key{.+}", async (context) => {
+  const kind = uploadRequestKindOf(context);
+  if (kind === UploadRequestKind2.INVALID) return invalidMultipartRequest(context);
+  if (kind === UploadRequestKind2.MULTIPART_PART) return handleMultipartPart(context);
+  const key = context.req.param("key");
+  const resolved = await lookupUploadPending(context, key);
+  if (resolved === null || !resolved && !isAuthenticated(context)) return uploadNotFound(context);
+  const pending = resolved?.pending ?? null;
+  const finalStorageKey = pending?.storageKey ?? storageKey(context, key);
+  const expectedContentType = pending?.contentType ?? null;
+  const originalFilename = pending?.originalFilename ?? null;
+  const maxSizeBytes = pending?.maxSizeBytes ?? null;
+  const storageClass = pending?.storageClass ?? "Standard";
+  const resourceSecurity = pending?.security ?? parseSecurityHeader(context.req.header(RESOURCE_SECURITY_HEADER));
+  const contentType = context.req.header("Content-Type") ?? "application/octet-stream";
+  if (expectedContentType && contentType !== expectedContentType) {
+    return context.json({ error: `Expected Content-Type ${expectedContentType}, got ${contentType}` }, 400);
+  }
+  const declaredSize = Number(context.req.header("content-length") ?? "0");
+  if (maxSizeBytes != null && Number.isFinite(declaredSize) && declaredSize > maxSizeBytes) {
+    return context.json(
+      { error: "File exceeds the allowed size for this media type", code: "file_too_large", limit: maxSizeBytes },
+      413
+    );
+  }
+  const body = await context.req.arrayBuffer();
+  if (maxSizeBytes != null && body.byteLength > maxSizeBytes) {
+    return context.json(
+      { error: "File exceeds the allowed size for this media type", code: "file_too_large", limit: maxSizeBytes },
+      413
+    );
+  }
+  const digest = await digestBody(body, pending?.sha256, headerSha256(context));
+  if ("invalid" in digest) {
+    return context.json({ error: "x-devultur-sha256 must be a 64-character hex string", code: "invalid_sha256" }, 400);
+  }
+  if ("mismatch" in digest) return sha256Mismatch(context, digest.mismatch.expected, digest.mismatch.actual);
+  const policy = resolveSecurity5(resourceSecurity, getRequestState(context).config?.security);
+  const shouldEncrypt = shouldEncryptAtRest(policy, key, Boolean(context.env.KEYS_BUCKET));
+  const customMetadata = {
+    ...allowedUploadMetadata(pending?.uploadMetadata ?? getRequestState(context).config?.uploadMetadata),
+    ...integrityMetadata(digest.sha256, true, pending?.expiresAt)
+  };
+  if (resourceSecurity) customMetadata.security = JSON.stringify(resourceSecurity);
+  let storedBody = body;
+  if (shouldEncrypt && context.env.KEYS_BUCKET) {
+    const result = await encryptForStorage(context.env.KEYS_BUCKET, finalStorageKey, body, customMetadata);
+    storedBody = result.body;
+    customMetadata.enc = result.enc;
+  }
+  const isCreateOnly = Boolean(pending?.isAsset && !pending.overwrite);
+  const stored = await context.env.MEDIA_BUCKET.put(finalStorageKey, storedBody, {
+    ...isCreateOnly ? { onlyIf: createOnlyCondition() } : {},
+    // Standard except for the video raw when the config retains it ≥30 days (Infrequent Access, see
+    // `RAW_STORAGE_CLASS`): IA has a 30-day minimum and charges retrieval ($0.01/GB) on every read — the
+    // transcode's read, and the direct MP4 delivery if it isn't transcoded. With retention `off` the raw lives
+    // for minutes.
+    storageClass,
+    httpMetadata: {
+      contentType,
+      ...originalFilename ? { contentDisposition: contentDispositionInline(originalFilename) } : {},
+      ...pending?.cacheControl ? { cacheControl: pending.cacheControl } : {}
+    },
+    ...Object.keys(customMetadata).length > 0 ? { customMetadata } : {}
+  });
+  if (isCreateOnly && !stored) {
+    await discardObjectKey(context.env.KEYS_BUCKET, finalStorageKey, customMetadata.enc);
+    return alreadyExists(context, key);
+  }
+  if (resolved) await context.env.MEDIA_KV.delete(resolved.kvKey);
+  await discardStaleVariants(context.env.MEDIA_BUCKET, pending);
+  return context.json({ key, size: body.byteLength, sha256: digest.sha256, sha256Verified: true });
+});
+async function discardObjectKey(keysBucket, objectStorageKey, enc) {
+  const meta = decodeEncryptionMeta6(enc);
+  if (keysBucket && meta) await keysBucket.delete(`${objectStorageKey}/${meta.keyId}`);
+}
+
+// src/index.ts
+function createWorker(options) {
+  const { middleware, routes, hooks } = composePlugins(options?.plugins ?? defaultPlugins());
+  const app = new Hono10();
+  app.use("*", logger());
+  app.use(
+    "*",
+    cors({
+      origin: "*",
+      allowMethods: ["GET", "HEAD", "POST", "PUT", "DELETE", "OPTIONS"],
+      allowHeaders: ["Content-Type", "Authorization", "Range", SESSION_HEADER2, SHA256_HEADER3],
+      exposeHeaders: [SHA256_HEADER3, SHA256_VERIFIED_HEADER2, REPR_DIGEST_HEADER2, EXPIRES_AT_HEADER2, "Content-Range"]
+    })
+  );
+  app.use("*", async (context, next) => {
+    context.set(PLUGIN_HOOKS_VARIABLE, hooks);
+    await next();
+  });
+  for (const handler of middleware) app.use("*", handler);
+  app.get("/health", (c) => c.json({ status: "ok" }));
+  app.post("/v1/metrics/playback", (c) => c.body(null, 204));
+  app.route("/v1/webhooks", webhooks);
+  app.route("/v1/upload", upload);
+  app.route("/v1/media", media);
+  app.route("/v1/assets", assets);
+  app.route("/v1/transcode", transcode);
+  app.route("/v1/captions", captions);
+  app.route("/v1/token", token);
+  for (const route of routes) app.route(route.path, route.app);
+  app.notFound((c) => c.json({ error: "Not found" }, 404));
+  app.onError((err, c) => {
+    console.error("Unhandled error:", err);
+    return c.json({ error: "Internal server error" }, 500);
+  });
+  return app;
+}
+export {
+  DownloadLink,
+  MAX_ASSET_LIST_LIMIT,
+  MAX_UPLOAD_TOKEN_TTL_SECONDS,
+  MaxResolution,
+  ObjectMeta,
+  TOKEN_REJECTED_CODE,
+  UPLOAD_TOKEN_TYPE,
+  WorkerAuthErrorCode,
+  cancelPendingUpload,
+  createWorker,
+  credentialPolicy,
+  defaultPlugins,
+  deletePrefix,
+  downloadLinks,
+  edgeCacheTag,
+  getPendingUpload,
+  getRequestState,
+  getRouteResult,
+  hashKey,
+  imageOriginAuthorization,
+  isAuthenticated,
+  isImageOriginRequest,
+  isObjectExpired,
+  isOpenRoute,
+  isServiceToken,
+  isUploadUrl,
+  isVariantKey,
+  logEncodeMetrics,
+  parseEncodeMetrics,
+  parseTransformParams,
+  readImageOriginScope,
+  readStoryboardKey,
+  readTokenScopes,
+  readTranscodeOutputKeys,
+  readTranscodeOutputs,
+  servedCacheControl,
+  staticConfig,
+  storageKey,
+  updateRequestState,
+  uploadGrantFromClaims,
+  variantPrefix,
+  vcpuSecondsPerVideoMinute,
+  verifyViewerToken,
+  withOutputUrls,
+  workerSecretAuth
+};