@growth-labs/cms 0.1.0

package/src/routes/media.ts

@@ -0,0 +1,944 @@
+// Media route handlers (WS7-07). Ported from fulcrum-labs/fronts
+// src/pages/api/v1/publisher/media/{images,library,library/[id],podcast,
+// videos/{init,part,complete,abort}}.ts (inventory §3: extract + theme-token /
+// config). Auth/authz injected; R2 binding + media domain/site-id/binding-name
+// supplied via config. The video-multipart staging is the editor-side half of
+// the bead-08 Foundry flow — the dispatch-to-Foundry route itself stays in
+// bead 08.
+
+import { z } from 'zod'
+import { slugify } from '../engine/slug.js'
+import type { CmsRouteConfig } from './config.js'
+import { resolveConfig } from './config.js'
+import {
+	type Authz,
+	type Capability,
+	json,
+	type R2BucketLike,
+	type RouteContext,
+	requireId,
+} from './context.js'
+import {
+	buildAudioAssetKey,
+	buildImageAssetKey,
+	buildVideoSourceKey,
+	deleteStagedVideoSource,
+	EDITOR_AUDIO_PART_SIZE,
+	EDITOR_VIDEO_PART_SIZE,
+	getImageVariantUrl,
+	getMediaPublicDomain,
+	insertMediaAsset,
+	isAllowedAudioSource,
+	isAllowedVideoSource,
+	isAudioAssetKey,
+	isAudioAssetKeyForSlug,
+	isVideoSourceKey,
+	isVideoSourceKeyForVideoId,
+	MAX_EDITOR_AUDIO_SOURCE_BYTES,
+	MAX_EDITOR_VIDEO_SOURCE_BYTES,
+	mediaKey,
+	normalizeAudioSourceContentType,
+	normalizeVideoSourceContentType,
+	parseVideoIdSlug,
+	publicUrlFor,
+} from './media-lib.js'
+
+/**
+ * Media uploads/pipeline writes gate on media_pipeline (owner / senior_editor /
+ * editor / producer — NOT contributor) via requireRole when the host wires the
+ * role seam, falling back to the flat requirePublisher gate otherwise. Library
+ * reads (list/getById) stay at publisher level (any member).
+ */
+async function mediaGuard(authz: Authz, ctx: RouteContext): Promise<Response | null> {
+	if (authz.requireRole) {
+		return authz.requireRole('media_pipeline' satisfies Capability, ctx)
+	}
+	return authz.requirePublisher(ctx)
+}
+
+type AssetType = 'image' | 'video' | 'podcast'
+
+interface MediaRow {
+	id: string
+	object_key: string | null
+	public_url: string | null
+	url: string | null
+	created_at: number | string | null
+	asset_type: string | null
+	source_type: string | null
+	status: string | null
+	original_filename: string | null
+	r2_binding: string | null
+	pinned: number | null
+}
+
+function parseAssetType(value: string | null): AssetType {
+	if (value === 'video') return 'video'
+	if (value === 'podcast') return 'podcast'
+	return 'image'
+}
+
+function parseLimit(value: string | null): number {
+	if (value == null || value.trim() === '') return 30
+	const n = Number(value)
+	if (!Number.isFinite(n)) return 30
+	return Math.max(1, Math.min(100, Math.floor(n)))
+}
+
+function assetWhereClause(assetType: AssetType): string {
+	if (assetType === 'podcast') {
+		return "(asset_type = 'audio' OR COALESCE(object_key, '') LIKE 'audio/%')"
+	}
+	if (assetType === 'video') {
+		return "(asset_type = 'video' OR COALESCE(object_key, '') LIKE 'video/%')"
+	}
+	return "(asset_type = 'image' OR COALESCE(object_key, '') LIKE 'images/%')"
+}
+
+function deriveImageLabel(id: string): string {
+	const fileName = id.split('/').pop() || id
+	return fileName.replace(/\.[a-z0-9]+$/i, '')
+}
+
+async function readJson(ctx: RouteContext): Promise<unknown> {
+	return ctx.request.json().catch(() => null)
+}
+
+function requireBucket(ctx: RouteContext): { bucket: R2BucketLike } | { error: Response } {
+	if (!ctx.bucket) return { error: json({ error: 'Missing configuration' }, 500) }
+	return { bucket: ctx.bucket }
+}
+
+// --- video multipart schemas ----------------------------------------------
+
+const initVideoUploadSchema = z.object({
+	videoId: z.string().min(1),
+	fileName: z.string().min(1),
+	contentType: z.string().optional().nullable(),
+	sizeBytes: z.number().int().positive().max(MAX_EDITOR_VIDEO_SOURCE_BYTES),
+})
+
+const uploadedPartSchema = z.object({
+	partNumber: z.number().int().min(1).max(10_000),
+	etag: z.string().min(1),
+})
+
+const completeVideoUploadSchema = z.object({
+	key: z.string().min(1),
+	uploadId: z.string().min(1),
+	videoId: z.string().min(1),
+	fileName: z.string().min(1),
+	contentType: z.string().optional().nullable(),
+	sizeBytes: z.number().int().positive().max(MAX_EDITOR_VIDEO_SOURCE_BYTES),
+	parts: z.array(uploadedPartSchema).min(1).max(10_000),
+})
+
+const abortVideoUploadSchema = z.object({
+	key: z.string().min(1),
+	uploadId: z.string().min(1),
+})
+
+const initPodcastUploadSchema = z.object({
+	slug: z.string().min(1),
+	fileName: z.string().min(1),
+	contentType: z.string().optional().nullable(),
+	sizeBytes: z.number().int().positive().max(MAX_EDITOR_AUDIO_SOURCE_BYTES),
+})
+
+const completePodcastUploadSchema = z.object({
+	slug: z.string().min(1),
+	key: z.string().min(1),
+	uploadId: z.string().min(1),
+	fileName: z.string().min(1),
+	contentType: z.string().optional().nullable(),
+	sizeBytes: z.number().int().positive().max(MAX_EDITOR_AUDIO_SOURCE_BYTES),
+	parts: z.array(uploadedPartSchema).min(1).max(10_000),
+})
+
+const abortPodcastUploadSchema = z.object({
+	key: z.string().min(1),
+	uploadId: z.string().min(1),
+})
+
+function parsePartNumber(value: string | null): number | null {
+	if (!value) return null
+	const partNumber = Number.parseInt(value, 10)
+	if (!Number.isInteger(partNumber) || partNumber < 1 || partNumber > 10_000) return null
+	return partNumber
+}
+
+function parseContentLength(value: string | null): number | null {
+	if (!value) return null
+	const contentLength = Number.parseInt(value, 10)
+	if (!Number.isInteger(contentLength) || contentLength < 0) return null
+	return contentLength
+}
+
+async function deletePodcastAudioAsset(
+	ctx: RouteContext,
+	bucket: R2BucketLike | undefined,
+	key: string,
+): Promise<void> {
+	if (!isAudioAssetKey(key)) return
+	try {
+		if (bucket && typeof bucket.delete === 'function') {
+			await bucket.delete(key)
+		}
+	} catch {
+		// R2 cleanup is best-effort; the media row is removed below so the
+		// library does not offer a stale audio object.
+	}
+	await ctx.db
+		.prepare(
+			`DELETE FROM media_assets
+			WHERE id = ?
+				AND asset_type = 'audio'
+				AND (source_type = 'editor-upload' OR source_type IS NULL)`,
+		)
+		.bind(key)
+		.run()
+}
+
+async function clearPodcastAudioStagingRow(ctx: RouteContext, key: string): Promise<void> {
+	if (!isAudioAssetKey(key)) return
+	await ctx.db
+		.prepare(
+			`DELETE FROM media_assets
+			WHERE id = ?
+				AND asset_type = 'audio'
+				AND status = 'processing'
+				AND (source_type = 'editor-upload' OR source_type IS NULL)`,
+		)
+		.bind(key)
+		.run()
+}
+
+export interface MediaRouteHandlers {
+	/** POST /media/images — R2 image upload + media_assets row + variant URLs. */
+	uploadImage(ctx: RouteContext): Promise<Response>
+	/** GET /media/library — list media assets (image|video|podcast). */
+	listLibrary(ctx: RouteContext): Promise<Response>
+	/** GET /media/:id — fetch a single media asset row by id (inspector). */
+	getById(ctx: RouteContext): Promise<Response>
+	/** POST /media/library/:id?action=pin|unpin — pin/unpin a media asset. */
+	libraryAction(ctx: RouteContext): Promise<Response>
+	/** POST /media/podcast — R2 audio upload + media_assets row. */
+	uploadPodcast(ctx: RouteContext): Promise<Response>
+	/** POST /media/podcast/init — start an R2 multipart podcast audio upload. */
+	initPodcastUpload(ctx: RouteContext): Promise<Response>
+	/** PUT /media/podcast/part — upload one podcast audio multipart part. */
+	uploadPodcastPart(ctx: RouteContext): Promise<Response>
+	/** POST /media/podcast/complete — finalize + record podcast audio. */
+	completePodcastUpload(ctx: RouteContext): Promise<Response>
+	/** POST /media/podcast/abort — abort the multipart upload + clear staging. */
+	abortPodcastUpload(ctx: RouteContext): Promise<Response>
+	/** POST /media/videos/init — start an R2 multipart video-source upload. */
+	initVideoUpload(ctx: RouteContext): Promise<Response>
+	/** PUT /media/videos/part — upload one multipart part. */
+	uploadVideoPart(ctx: RouteContext): Promise<Response>
+	/** POST /media/videos/complete — finalize + stage the video source. */
+	completeVideoUpload(ctx: RouteContext): Promise<Response>
+	/** POST /media/videos/abort — abort the multipart upload + clear staging. */
+	abortVideoUpload(ctx: RouteContext): Promise<Response>
+}
+
+export function createMediaRoutes(config: CmsRouteConfig): MediaRouteHandlers {
+	const resolved = resolveConfig(config)
+	const { mediaR2Binding, mediaSiteId, mediaPublicDomain } = resolved
+
+	const resolveDomain = (ctx: RouteContext): string =>
+		getMediaPublicDomain(
+			ctx.env as { MEDIA_PUBLIC_DOMAIN?: unknown } | undefined,
+			mediaPublicDomain,
+		)
+
+	return {
+		async uploadImage(ctx) {
+			const denied = await mediaGuard(resolved.authz, ctx)
+			if (denied) return denied
+			const bucketResult = requireBucket(ctx)
+			if ('error' in bucketResult) return bucketResult.error
+			const bucket = bucketResult.bucket
+
+			const formData = await ctx.request.formData()
+			const file = formData.get('file')
+			const slug = formData.get('slug')
+			if (!(file instanceof File) || typeof slug !== 'string' || !slug) {
+				return json({ error: 'Missing file or slug' }, 400)
+			}
+
+			const domain = resolveDomain(ctx)
+			const imageKey = buildImageAssetKey(slug, file.name)
+			const contentType = file.type || 'image/jpeg'
+			await bucket.put(imageKey, await file.arrayBuffer(), {
+				httpMetadata: { contentType, cacheControl: 'public, max-age=31536000, immutable' },
+				customMetadata: { originalFilename: file.name, slug },
+			})
+
+			const url = getImageVariantUrl(imageKey, 'hero', domain)
+			if (!url) return json({ error: 'Invalid image key' }, 500)
+
+			const variants = resolved.imageVariants.map((variant) => ({
+				name: variant,
+				url: getImageVariantUrl(imageKey, variant, domain),
+			}))
+
+			const now = new Date().toISOString()
+			const publicUrl = publicUrlFor({
+				r2Binding: mediaR2Binding,
+				objectKey: imageKey,
+				publicDomain: domain,
+			})
+			await insertMediaAsset(ctx.db, {
+				id: imageKey,
+				siteId: mediaSiteId,
+				assetType: 'image',
+				sourceType: 'editor-upload',
+				originalFilename: file.name,
+				status: 'ready',
+				objectKey: imageKey,
+				publicUrl,
+				url: publicUrl,
+				width: null,
+				height: null,
+				variantsJson: JSON.stringify(variants),
+				r2Binding: mediaR2Binding,
+			})
+
+			return json({ imageId: imageKey, imageKey, url, publicUrl, variants, uploadedAt: now })
+		},
+
+		async listLibrary(ctx) {
+			const denied = await resolved.authz.requirePublisher(ctx)
+			if (denied) return denied
+
+			const url = new URL(ctx.request.url)
+			const assetType = parseAssetType(
+				url.searchParams.get('provider') || url.searchParams.get('type'),
+			)
+			const q = (url.searchParams.get('q') || '').trim()
+			const limit = parseLimit(url.searchParams.get('limit'))
+
+			const pattern = `%${q.replace(/%/g, '\\%').replace(/_/g, '\\_')}%`
+			const rows = await ctx.db
+				.prepare(
+					`SELECT id, object_key, public_url, url, created_at, asset_type, source_type,
+						status, original_filename, r2_binding, pinned
+					FROM media_assets
+					WHERE COALESCE(r2_binding, ?) = ?
+						AND ${assetWhereClause(assetType)}
+						AND (
+							? = ''
+							OR id LIKE ? ESCAPE '\\'
+							OR COALESCE(object_key, '') LIKE ? ESCAPE '\\'
+							OR COALESCE(original_filename, '') LIKE ? ESCAPE '\\'
+							OR COALESCE(public_url, '') LIKE ? ESCAPE '\\'
+							OR COALESCE(url, '') LIKE ? ESCAPE '\\'
+						)
+					ORDER BY pinned DESC, created_at DESC, id DESC
+					LIMIT ?`,
+				)
+				.bind(mediaR2Binding, mediaR2Binding, q, pattern, pattern, pattern, pattern, pattern, limit)
+				.all<MediaRow>()
+
+			const items = (rows.results || []).map((row) => {
+				const keyOrUid = row.object_key || row.id
+				return {
+					id: row.id,
+					provider: 'r2',
+					keyOrUid,
+					url: row.public_url || row.url,
+					createdAt: row.created_at,
+					pinned: Boolean(row.pinned),
+					name: assetType === 'video' ? keyOrUid : deriveImageLabel(row.id),
+				}
+			})
+
+			return json({ provider: assetType, q, limit, items })
+		},
+
+		async getById(ctx) {
+			const denied = await resolved.authz.requirePublisher(ctx)
+			if (denied) return denied
+
+			const idResult = requireId(ctx)
+			if ('error' in idResult) return idResult.error
+			const id = idResult.id
+
+			const row = await ctx.db
+				.prepare(
+					`SELECT id, object_key, public_url, url, created_at, asset_type, source_type,
+						status, original_filename, r2_binding, pinned
+					FROM media_assets WHERE id = ? LIMIT 1`,
+				)
+				.bind(id)
+				.first<MediaRow>()
+
+			if (!row) return json({ error: 'Not found' }, 404)
+
+			const keyOrUid = row.object_key || row.id
+			return json({
+				item: {
+					id: row.id,
+					provider: 'r2',
+					keyOrUid,
+					url: row.public_url || row.url,
+					createdAt: row.created_at,
+					assetType: row.asset_type,
+					sourceType: row.source_type,
+					status: row.status,
+					originalFilename: row.original_filename,
+					pinned: Boolean(row.pinned),
+				},
+			})
+		},
+
+		async libraryAction(ctx) {
+			const denied = await mediaGuard(resolved.authz, ctx)
+			if (denied) return denied
+
+			const idResult = requireId(ctx)
+			if ('error' in idResult) return idResult.error
+			const id = idResult.id
+
+			const action = new URL(ctx.request.url).searchParams.get('action')
+			if (action !== 'pin' && action !== 'unpin') return json({ error: 'Unknown action' }, 400)
+
+			const pinned = action === 'pin' ? 1 : 0
+			const result = await ctx.db
+				.prepare('UPDATE media_assets SET pinned = ? WHERE id = ?')
+				.bind(pinned, id)
+				.run()
+
+			const meta = result.meta as { changes?: number } | undefined
+			if (meta?.changes === 0) return json({ error: 'Not found' }, 404)
+
+			return json({ id, pinned: Boolean(pinned) })
+		},
+
+		async uploadPodcast(ctx) {
+			const denied = await mediaGuard(resolved.authz, ctx)
+			if (denied) return denied
+			const bucketResult = requireBucket(ctx)
+			if ('error' in bucketResult) return bucketResult.error
+			const bucket = bucketResult.bucket
+
+			const formData = await ctx.request.formData()
+			const file = formData.get('file')
+			const slug = formData.get('slug')
+			if (!(file instanceof File) || typeof slug !== 'string' || !slug) {
+				return json({ error: 'Missing file or slug' }, 400)
+			}
+
+			const domain = resolveDomain(ctx)
+			const extension = file.name.split('.').pop()?.toLowerCase() || 'mp3'
+			const key = mediaKey('audio/', slugify(slug) || 'podcast', extension)
+			const contentType = file.type || 'audio/mpeg'
+			await bucket.put(key, await file.arrayBuffer(), {
+				httpMetadata: { contentType, cacheControl: 'public, max-age=31536000, immutable' },
+			})
+
+			const publicUrl = publicUrlFor({
+				r2Binding: mediaR2Binding,
+				objectKey: key,
+				publicDomain: domain,
+			})
+			await insertMediaAsset(ctx.db, {
+				id: key,
+				siteId: mediaSiteId,
+				assetType: 'audio',
+				sourceType: 'editor-upload',
+				originalFilename: file.name,
+				status: 'ready',
+				objectKey: key,
+				publicUrl,
+				url: publicUrl,
+				width: null,
+				height: null,
+				variantsJson: null,
+				r2Binding: mediaR2Binding,
+			})
+
+			return json({ key })
+		},
+
+		async initPodcastUpload(ctx) {
+			const denied = await mediaGuard(resolved.authz, ctx)
+			if (denied) return denied
+			const bucketResult = requireBucket(ctx)
+			if ('error' in bucketResult) return bucketResult.error
+			const bucket = bucketResult.bucket
+			if (typeof bucket.createMultipartUpload !== 'function') {
+				return json({ error: 'Missing configuration' }, 500)
+			}
+
+			const parsed = initPodcastUploadSchema.safeParse(await readJson(ctx))
+			if (!parsed.success) return json({ error: 'Invalid podcast upload request' }, 400)
+			if (!isAllowedAudioSource(parsed.data.contentType, parsed.data.fileName)) {
+				return json({ error: 'Upload a podcast audio file.' }, 400)
+			}
+
+			const domain = resolveDomain(ctx)
+			const contentType = normalizeAudioSourceContentType(
+				parsed.data.contentType,
+				parsed.data.fileName,
+			)
+			const key = buildAudioAssetKey(parsed.data.slug, parsed.data.fileName)
+			const upload = await bucket.createMultipartUpload(key, {
+				httpMetadata: {
+					contentType,
+					cacheControl: 'public, max-age=31536000, immutable',
+				},
+				customMetadata: {
+					originalFilename: parsed.data.fileName,
+					sizeBytes: String(parsed.data.sizeBytes),
+					source: 'cms',
+					mediaKind: 'podcast',
+					slug: slugify(parsed.data.slug) || 'podcast',
+				},
+			})
+			const publicUrl = publicUrlFor({
+				r2Binding: mediaR2Binding,
+				objectKey: key,
+				publicDomain: domain,
+			})
+
+			return json({
+				uploadId: upload.uploadId,
+				key: upload.key,
+				partSize: EDITOR_AUDIO_PART_SIZE,
+				publicUrl,
+				maxSizeBytes: MAX_EDITOR_AUDIO_SOURCE_BYTES,
+			})
+		},
+
+		async uploadPodcastPart(ctx) {
+			const denied = await mediaGuard(resolved.authz, ctx)
+			if (denied) return denied
+			const bucketResult = requireBucket(ctx)
+			if ('error' in bucketResult) return bucketResult.error
+			const bucket = bucketResult.bucket
+			if (typeof bucket.resumeMultipartUpload !== 'function') {
+				return json({ error: 'Missing configuration' }, 500)
+			}
+
+			const params = new URL(ctx.request.url).searchParams
+			const key = params.get('key') || ''
+			const uploadId = params.get('uploadId') || ''
+			const partNumber = parsePartNumber(params.get('partNumber'))
+			if (!isAudioAssetKey(key) || !uploadId || !partNumber) {
+				return json({ error: 'Invalid podcast upload part request' }, 400)
+			}
+
+			const contentLength = parseContentLength(ctx.request.headers.get('Content-Length'))
+			if (contentLength !== null && contentLength > EDITOR_AUDIO_PART_SIZE) {
+				return json({ error: 'Podcast upload part is too large' }, 413)
+			}
+
+			const upload = bucket.resumeMultipartUpload(key, uploadId)
+			const body = await ctx.request.arrayBuffer()
+			if (body.byteLength === 0) return json({ error: 'Missing upload part body' }, 400)
+			if (body.byteLength > EDITOR_AUDIO_PART_SIZE) {
+				return json({ error: 'Podcast upload part is too large' }, 413)
+			}
+			const part = await upload.uploadPart(partNumber, body)
+
+			return json({ part: { partNumber: part.partNumber, etag: part.etag } })
+		},
+
+		async completePodcastUpload(ctx) {
+			const denied = await mediaGuard(resolved.authz, ctx)
+			if (denied) return denied
+			const bucketResult = requireBucket(ctx)
+			if ('error' in bucketResult) return bucketResult.error
+			const bucket = bucketResult.bucket
+			if (typeof bucket.resumeMultipartUpload !== 'function') {
+				return json({ error: 'Missing configuration' }, 500)
+			}
+
+			const parsed = completePodcastUploadSchema.safeParse(await readJson(ctx))
+			if (!parsed.success) return json({ error: 'Invalid podcast upload completion request' }, 400)
+			if (
+				!isAudioAssetKeyForSlug(parsed.data.key, parsed.data.slug, parsed.data.fileName) ||
+				!isAllowedAudioSource(parsed.data.contentType, parsed.data.fileName)
+			) {
+				return json({ error: 'Invalid podcast audio key' }, 400)
+			}
+
+			const domain = resolveDomain(ctx)
+			const publicUrl = publicUrlFor({
+				r2Binding: mediaR2Binding,
+				objectKey: parsed.data.key,
+				publicDomain: domain,
+			})
+			const maxClaimableBytes = parsed.data.parts.length * EDITOR_AUDIO_PART_SIZE
+			if (
+				parsed.data.sizeBytes > MAX_EDITOR_AUDIO_SOURCE_BYTES ||
+				maxClaimableBytes > MAX_EDITOR_AUDIO_SOURCE_BYTES + EDITOR_AUDIO_PART_SIZE
+			) {
+				await clearPodcastAudioStagingRow(ctx, parsed.data.key)
+				try {
+					await bucket.resumeMultipartUpload(parsed.data.key, parsed.data.uploadId).abort()
+				} catch {
+					// Abort is best-effort.
+				}
+				return json(
+					{
+						error: 'Uploaded podcast audio exceeds the configured size limit',
+						maxSizeBytes: MAX_EDITOR_AUDIO_SOURCE_BYTES,
+					},
+					413,
+				)
+			}
+
+			const contentType = normalizeAudioSourceContentType(
+				parsed.data.contentType,
+				parsed.data.fileName,
+			)
+			const parts = [...parsed.data.parts].sort((a, b) => a.partNumber - b.partNumber)
+			const upload = bucket.resumeMultipartUpload(parsed.data.key, parsed.data.uploadId)
+			await upload.complete(parts)
+
+			let sizeVerification: 'verified' | 'unsupported' = 'unsupported'
+			if (typeof bucket.head === 'function') {
+				const object = await bucket.head(parsed.data.key)
+				if (
+					!object ||
+					object.size !== parsed.data.sizeBytes ||
+					object.size > MAX_EDITOR_AUDIO_SOURCE_BYTES
+				) {
+					await deletePodcastAudioAsset(ctx, bucket, parsed.data.key)
+					return json(
+						{
+							error: 'Uploaded podcast audio size did not match the expected size',
+							expectedSizeBytes: parsed.data.sizeBytes,
+							actualSizeBytes: object?.size ?? null,
+						},
+						400,
+					)
+				}
+				sizeVerification = 'verified'
+			}
+
+			try {
+				await insertMediaAsset(ctx.db, {
+					id: parsed.data.key,
+					siteId: mediaSiteId,
+					assetType: 'audio',
+					sourceType: 'editor-upload',
+					originalFilename: parsed.data.fileName,
+					status: 'ready',
+					objectKey: parsed.data.key,
+					publicUrl,
+					url: publicUrl,
+					width: null,
+					height: null,
+					variantsJson: JSON.stringify({
+						contentType,
+						sizeBytes: parsed.data.sizeBytes,
+						slug: slugify(parsed.data.slug) || 'podcast',
+					}),
+					r2Binding: mediaR2Binding,
+				})
+			} catch (error) {
+				await deletePodcastAudioAsset(ctx, bucket, parsed.data.key)
+				return json(
+					{
+						error: 'Could not record podcast audio',
+						details: error instanceof Error ? error.message : 'database error',
+					},
+					500,
+				)
+			}
+
+			return json({
+				key: parsed.data.key,
+				publicUrl,
+				url: publicUrl,
+				sizeVerification,
+				sizeBytes: parsed.data.sizeBytes,
+			})
+		},
+
+		async abortPodcastUpload(ctx) {
+			const denied = await mediaGuard(resolved.authz, ctx)
+			if (denied) return denied
+			const bucketResult = requireBucket(ctx)
+			if ('error' in bucketResult) return bucketResult.error
+			const bucket = bucketResult.bucket
+			if (typeof bucket.resumeMultipartUpload !== 'function') {
+				return json({ error: 'Missing configuration' }, 500)
+			}
+
+			const parsed = abortPodcastUploadSchema.safeParse(await readJson(ctx))
+			if (!parsed.success || !isAudioAssetKey(parsed.data.key)) {
+				return json({ error: 'Invalid multipart upload abort request' }, 400)
+			}
+
+			const upload = bucket.resumeMultipartUpload(parsed.data.key, parsed.data.uploadId)
+			try {
+				await upload.abort()
+			} catch {
+				// R2 multipart abort is best-effort — the staged row is cleared below.
+			}
+			await clearPodcastAudioStagingRow(ctx, parsed.data.key)
+
+			return json({ ok: true })
+		},
+
+		async initVideoUpload(ctx) {
+			const denied = await mediaGuard(resolved.authz, ctx)
+			if (denied) return denied
+			const bucketResult = requireBucket(ctx)
+			if ('error' in bucketResult) return bucketResult.error
+			const bucket = bucketResult.bucket
+			if (typeof bucket.createMultipartUpload !== 'function') {
+				return json({ error: 'Missing configuration' }, 500)
+			}
+
+			const parsed = initVideoUploadSchema.safeParse(await readJson(ctx))
+			if (!parsed.success) return json({ error: 'Invalid video upload request' }, 400)
+
+			const videoId = parseVideoIdSlug(parsed.data.videoId)
+			if (!videoId) {
+				return json(
+					{ error: 'Video ID must use only letters, numbers, underscores, and hyphens.' },
+					400,
+				)
+			}
+
+			if (!isAllowedVideoSource(parsed.data.contentType, parsed.data.fileName)) {
+				return json({ error: 'Upload a video source file.' }, 400)
+			}
+
+			const domain = resolveDomain(ctx)
+			const contentType = normalizeVideoSourceContentType(
+				parsed.data.contentType,
+				parsed.data.fileName,
+			)
+			const key = buildVideoSourceKey(videoId, parsed.data.fileName)
+			const upload = await bucket.createMultipartUpload(key, {
+				httpMetadata: { contentType, cacheControl: 'public, max-age=3600' },
+				customMetadata: {
+					originalFilename: parsed.data.fileName,
+					sizeBytes: String(parsed.data.sizeBytes),
+					source: 'cms',
+					videoId,
+				},
+			})
+			const sourceUrl = publicUrlFor({
+				r2Binding: mediaR2Binding,
+				objectKey: key,
+				publicDomain: domain,
+			})
+
+			return json({
+				uploadId: upload.uploadId,
+				key: upload.key,
+				partSize: EDITOR_VIDEO_PART_SIZE,
+				sourceUrl,
+				sourceKind: 'http_url',
+				videoId,
+				maxSizeBytes: MAX_EDITOR_VIDEO_SOURCE_BYTES,
+			})
+		},
+
+		async uploadVideoPart(ctx) {
+			const denied = await mediaGuard(resolved.authz, ctx)
+			if (denied) return denied
+			const bucketResult = requireBucket(ctx)
+			if ('error' in bucketResult) return bucketResult.error
+			const bucket = bucketResult.bucket
+			if (typeof bucket.resumeMultipartUpload !== 'function') {
+				return json({ error: 'Missing configuration' }, 500)
+			}
+
+			const params = new URL(ctx.request.url).searchParams
+			const key = params.get('key') || ''
+			const uploadId = params.get('uploadId') || ''
+			const partNumber = parsePartNumber(params.get('partNumber'))
+			if (!isVideoSourceKey(key) || !uploadId || !partNumber) {
+				return json({ error: 'Invalid multipart upload part request' }, 400)
+			}
+
+			const contentLength = parseContentLength(ctx.request.headers.get('Content-Length'))
+			if (contentLength !== null && contentLength > EDITOR_VIDEO_PART_SIZE) {
+				return json({ error: 'Video upload part is too large' }, 413)
+			}
+
+			const upload = bucket.resumeMultipartUpload(key, uploadId)
+			const body = await ctx.request.arrayBuffer()
+			if (body.byteLength === 0) return json({ error: 'Missing upload part body' }, 400)
+			if (body.byteLength > EDITOR_VIDEO_PART_SIZE) {
+				return json({ error: 'Video upload part is too large' }, 413)
+			}
+			const part = await upload.uploadPart(partNumber, body)
+
+			return json({ part: { partNumber: part.partNumber, etag: part.etag } })
+		},
+
+		async completeVideoUpload(ctx) {
+			const denied = await mediaGuard(resolved.authz, ctx)
+			if (denied) return denied
+			const bucketResult = requireBucket(ctx)
+			if ('error' in bucketResult) return bucketResult.error
+			const bucket = bucketResult.bucket
+			if (typeof bucket.resumeMultipartUpload !== 'function') {
+				return json({ error: 'Missing configuration' }, 500)
+			}
+
+			const parsed = completeVideoUploadSchema.safeParse(await readJson(ctx))
+			if (!parsed.success) return json({ error: 'Invalid video upload completion request' }, 400)
+
+			const videoId = parseVideoIdSlug(parsed.data.videoId)
+			if (!videoId || !isVideoSourceKeyForVideoId(parsed.data.key, videoId)) {
+				return json({ error: 'Invalid video source key' }, 400)
+			}
+			if (!isAllowedVideoSource(parsed.data.contentType, parsed.data.fileName)) {
+				return json({ error: 'Upload a video source file.' }, 400)
+			}
+
+			const domain = resolveDomain(ctx)
+
+			// Conservative upper-bound check before contacting R2. Each part is
+			// capped server-side, so max total bytes is parts.length * part-size.
+			const maxClaimableBytes = parsed.data.parts.length * EDITOR_VIDEO_PART_SIZE
+			if (
+				parsed.data.sizeBytes > MAX_EDITOR_VIDEO_SOURCE_BYTES ||
+				maxClaimableBytes > MAX_EDITOR_VIDEO_SOURCE_BYTES + EDITOR_VIDEO_PART_SIZE
+			) {
+				await deleteStagedVideoSource(
+					ctx.db,
+					bucket,
+					publicUrlFor({
+						r2Binding: mediaR2Binding,
+						objectKey: parsed.data.key,
+						publicDomain: domain,
+					}),
+					domain,
+				)
+				try {
+					await bucket.resumeMultipartUpload(parsed.data.key, parsed.data.uploadId).abort()
+				} catch {
+					// Abort is best-effort.
+				}
+				return json(
+					{
+						error: 'Uploaded video source exceeds the configured size limit',
+						maxSizeBytes: MAX_EDITOR_VIDEO_SOURCE_BYTES,
+					},
+					413,
+				)
+			}
+
+			const contentType = normalizeVideoSourceContentType(
+				parsed.data.contentType,
+				parsed.data.fileName,
+			)
+			const parts = [...parsed.data.parts].sort((a, b) => a.partNumber - b.partNumber)
+			const upload = bucket.resumeMultipartUpload(parsed.data.key, parsed.data.uploadId)
+			await upload.complete(parts)
+			const sourceUrl = publicUrlFor({
+				r2Binding: mediaR2Binding,
+				objectKey: parsed.data.key,
+				publicDomain: domain,
+			})
+
+			let sizeVerification: 'verified' | 'unsupported' = 'unsupported'
+			if (typeof bucket.head === 'function') {
+				const object = await bucket.head(parsed.data.key)
+				if (
+					!object ||
+					object.size !== parsed.data.sizeBytes ||
+					object.size > MAX_EDITOR_VIDEO_SOURCE_BYTES
+				) {
+					await deleteStagedVideoSource(ctx.db, bucket, sourceUrl, domain)
+					return json(
+						{
+							error: 'Uploaded video source size did not match the expected size',
+							expectedSizeBytes: parsed.data.sizeBytes,
+							actualSizeBytes: object?.size ?? null,
+						},
+						400,
+					)
+				}
+				sizeVerification = 'verified'
+			}
+
+			try {
+				await insertMediaAsset(ctx.db, {
+					id: parsed.data.key,
+					siteId: mediaSiteId,
+					assetType: 'video',
+					sourceType: 'editor-video-source',
+					originalFilename: parsed.data.fileName,
+					status: 'processing',
+					objectKey: parsed.data.key,
+					publicUrl: sourceUrl,
+					url: sourceUrl,
+					width: null,
+					height: null,
+					variantsJson: JSON.stringify({ contentType, sizeBytes: parsed.data.sizeBytes, videoId }),
+					r2Binding: mediaR2Binding,
+				})
+			} catch (error) {
+				await deleteStagedVideoSource(ctx.db, bucket, sourceUrl, domain)
+				return json(
+					{
+						error: 'Could not record staged video source',
+						details: error instanceof Error ? error.message : 'database error',
+					},
+					500,
+				)
+			}
+
+			return json({
+				key: parsed.data.key,
+				message: 'Video source staged in R2. Queue processing to generate HLS.',
+				processingStatus: 'processing',
+				sourceUrl,
+				sourceKind: 'http_url',
+				sizeVerification,
+				videoId,
+				sizeBytes: parsed.data.sizeBytes,
+			})
+		},
+
+		async abortVideoUpload(ctx) {
+			const denied = await mediaGuard(resolved.authz, ctx)
+			if (denied) return denied
+			const bucketResult = requireBucket(ctx)
+			if ('error' in bucketResult) return bucketResult.error
+			const bucket = bucketResult.bucket
+			if (typeof bucket.resumeMultipartUpload !== 'function') {
+				return json({ error: 'Missing configuration' }, 500)
+			}
+
+			const parsed = abortVideoUploadSchema.safeParse(await readJson(ctx))
+			if (!parsed.success || !isVideoSourceKey(parsed.data.key)) {
+				return json({ error: 'Invalid multipart upload abort request' }, 400)
+			}
+
+			const upload = bucket.resumeMultipartUpload(parsed.data.key, parsed.data.uploadId)
+			try {
+				await upload.abort()
+			} catch {
+				// R2 multipart abort is best-effort — the staged row is cleared below.
+			}
+
+			const domain = resolveDomain(ctx)
+			await deleteStagedVideoSource(
+				ctx.db,
+				bucket,
+				publicUrlFor({
+					r2Binding: mediaR2Binding,
+					objectKey: parsed.data.key,
+					publicDomain: domain,
+				}),
+				domain,
+			)
+
+			return json({ ok: true })
+		},
+	}
+}