vidspotai-shared 1.0.114 → 1.0.116

package/lib/globals/types.d.ts

@@ -152,6 +152,14 @@ export declare enum ERedisQueues {
      * repairs, and writes the report back. See notes/SAAS_DEMO_GENERATOR_PLAN.md §12.
      */
     VIDEO_QA_JOBS = "video-qa-job-queue",
+    /**
+     * VidSpot Reach — Phase 7 self-serve API integration. One job per outbound
+     * webhook delivery attempt (campaign.completed / video.ready /
+     * recipient.viewed). BullMQ's own attempts+backoff drive the retry — the
+     * dispatcher enqueues once per active subscriber per event, the worker owns
+     * the signed HTTP POST.
+     */
+    WEBHOOK_DELIVERY_JOBS = "webhook-delivery-job-queue",
     /**
      * R2 cutover — mirrors a resumable-upload object (already in GCS, up to
      * 1 GiB) into R2 off the request path. `completeUploadSessionController`

package/lib/globals/types.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"types.d.ts","sourceRoot":"","sources":["../../src/globals/types.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,UAAU,EAAE,MAAM,0BAA0B,CAAC;AACtD,OAAO,CAAC,MAAM,KAAK,CAAC;AAEpB,MAAM,WAAW,WAAW;IAC1B,QAAQ,EAAE,OAAO,CAAC;IAClB,SAAS,EAAE,MAAM,CAAC;IAClB,SAAS,EAAE;QACT,IAAI,EAAE,MAAM,CAAC;QACb,IAAI,EAAE,cAAc,CAAC;QACrB,OAAO,EAAE,MAAM,CAAC;QAChB,KAAK,EAAE,MAAM,CAAC;KACf,EAAE,CAAC;IACJ,MAAM,EAAE,GAAG,EAAE,CAAC;CACf;AAED,oBAAY,eAAe;IACzB,MAAM,WAAW,CAAE,wCAAwC;IAC3D,WAAW,eAAe,CAAE,2DAA2D;IAGvF,SAAS,cAAc,CAAE,8CAA8C;IACvE,MAAM,WAAW,CAAE,+BAA+B;IAClD,mBAAmB,uBAAuB,CAAE,oEAAoE;IAChH,SAAS,cAAc;CACxB;AAED,oBAAY,iBAAiB;IAC3B,WAAW,eAAe,CAAE,qFAAqF;IACjH,SAAS,cAAc,CAAE,2FAA2F;IACpH,OAAO,YAAY,CAAE,kKAAkK;IACvL,MAAM,WAAW,CAAE,kEAAkE;IACrF,SAAS,cAAc,CAAE,sCAAsC;IAC/D;;;;;OAKG;IACH,SAAS,aAAa;IACtB;;;;;;OAMG;IACH,SAAS,cAAc;CACxB;AAMD,oBAAY,YAAY;IACtB,UAAU,oBAAoB;IAC9B,iJAAiJ;IACjJ,eAAe,yBAAyB;IACxC,6FAA6F;IAC7F,WAAW,qBAAqB;IAChC,iFAAiF;IACjF,WAAW,qBAAqB;IAChC,mJAAmJ;IACnJ,UAAU,oBAAoB;IAC9B;;;;;OAKG;IACH,cAAc,wBAAwB;IACtC;;;;OAIG;IACH,gBAAgB,0BAA0B;IAC1C;;;;;;;;OAQG;IACH,eAAe,yBAAyB;IACxC;;;;;;;OAOG;IACH,eAAe,yBAAyB;IACxC;;;;;;;;OAQG;IACH,oBAAoB,8BAA8B;IAClD;;;;;;;;OAQG;IACH,iBAAiB,2BAA2B;IAC5C;;;;;OAKG;IACH,cAAc,wBAAwB;IACtC;;;;;;OAMG;IACH,mBAAmB,6BAA6B;IAChD;;;;OAIG;IACH,mBAAmB,6BAA6B;IAChD;;;;;;;;OAQG;IACH,eAAe,yBAAyB;IACxC;;;;;;OAMG;IACH,yBAAyB,mCAAmC;IAC5D;;;;;;;;OAQG;IACH,aAAa,uBAAuB;IACpC;;;;;;OAMG;IACH,iBAAiB,2BAA2B;CAC7C;AAED,eAAO,MAAM,YAAY,gBAmBxB,CAAC;AAEF,gFAAgF;AAChF,oBAAY,eAAe;IACzB,OAAO,YAAY;IACnB,SAAS,cAAc;IACvB,MAAM,WAAW;IACjB,QAAQ,aAAa;IAErB,QAAQ,aAAa;IACrB,CAAC,MAAM;IACP,SAAS,cAAc;IACvB,OAAO,YAAY;CACpB;AAED;;;;;GAKG;AACH,oBAAY,kBAAkB;IAC5B,QAAQ,aAAa;IACrB,OAAO,YAAY;IACnB,QAAQ,aAAa;IACrB,IAAI,SAAS,CAAE,gBAAgB;IAC/B,OAAO,YAAY;CACpB;AAED,yDAAyD;AACzD,oBAAY,oBAAoB;IAC9B,MAAM,WAAW;IACjB,6DAA6D;IAC7D,eAAe,mBAAmB;IAClC,2CAA2C;IAC3C,OAAO,YAAY;CACpB;AAED,kFAAkF;AAClF,oBAAY,iBAAiB;IAC3B,KAAK,UAAU;IACf,SAAS,cAAc;IACvB,UAAU,eAAe;IACzB,SAAS,cAAc;IACvB,qDAAqD;IACrD,OAAO,YAAY;IACnB,MAAM,WAAW;CAClB;AAED,sDAAsD;AACtD,oBAAY,mBAAmB;IAC7B,OAAO,YAAY;IACnB,UAAU,eAAe;IACzB,SAAS,cAAc;IACvB,MAAM,WAAW;CAClB;AAED,4CAA4C;AAC5C,oBAAY,oBAAoB;IAC9B,IAAI,SAAS;IACb,OAAO,YAAY;IACnB,QAAQ,aAAa;IACrB,QAAQ,aAAa;CACtB;AAED,oDAAoD;AACpD,oBAAY,gBAAgB;IAC1B,OAAO,YAAY;IACnB,OAAO,YAAY;IACnB,EAAE,OAAO;CACV;AAED,iCAAiC;AACjC,oBAAY,kBAAkB;IAC5B,MAAM,WAAW;IACjB,IAAI,SAAS;IACb,OAAO,YAAY;IACnB,MAAM,WAAW;CAClB;AAED,oBAAY,eAAe;IACzB,MAAM,WAAW;IACjB,WAAW,eAAe;IAC1B,SAAS,cAAc;IACvB,MAAM,WAAW;CAClB;AAED;;;;;;;;;GASG;AACH,oBAAY,gBAAgB;IAC1B,MAAM,WAAW;IACjB,SAAS,cAAc;IACvB,mFAAmF;IACnF,QAAQ,aAAa;IACrB;;;;;;OAMG;IACH,cAAc,kBAAkB;IAChC;;;;;;;;OAQG;IACH,SAAS,cAAc;IACvB,QAAQ,aAAa;IACrB;;;;OAIG;IACH,iBAAiB,qBAAqB;IACtC,eAAe,mBAAmB;IAClC,SAAS,cAAc;IACvB,OAAO,YAAY;IACnB,MAAM,WAAW;IACjB;;;;;;;;OAQG;IACH,SAAS,aAAa;IACtB,UAAU,eAAe;IACzB,KAAK,UAAU;IACf,MAAM,WAAW;IACjB,SAAS,cAAc;CACxB;AAED;;;;;GAKG;AACH,oBAAY,iBAAiB;IAC3B,eAAe,oBAAoB;IACnC,YAAY,iBAAiB;IAC7B,aAAa,kBAAkB;IAC/B,eAAe,oBAAoB;IACnC,YAAY,iBAAiB;IAC7B,WAAW,gBAAgB;IAC3B,oBAAoB,yBAAyB;IAC7C,2BAA2B,+BAA+B;IAC1D,yBAAyB,6BAA6B;IACtD,qBAAqB,0BAA0B;CAChD;AAED,MAAM,MAAM,uBAAuB,GAAG,OAAO,CAAC,MAAM,CAAC,iBAAiB,EAAE,OAAO,CAAC,CAAC,CAAC;AAElF;;;;GAIG;AACH,eAAO,MAAM,gCAAgC,EAAE,MAAM,CAAC,iBAAiB,EAAE,OAAO,CAW/E,CAAC;AAEF,oBAAY,qBAAqB;IAC/B,IAAI,SAAS;IACb,OAAO,YAAY;IACnB,OAAO,YAAY;IACnB,KAAK,UAAU;CAChB;AAED,oBAAY,kBAAkB;IAC5B,KAAK,UAAU;IACf,MAAM,WAAW;IACjB,IAAI,SAAS;IACb,SAAS,cAAc;CACxB;AAYD,MAAM,MAAM,aAAa,GAAG,MAAM,CAAC;AAEnC,MAAM,MAAM,WAAW,CAAC,CAAC,IAAI;KAC1B,CAAC,IAAI,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,SAAS,IAAI,GAAG,UAAU,GAC3C,CAAC,CAAC,CAAC,CAAC,GACJ,WAAW,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,SAAS,KAAK,CAAC,MAAM,CAAC,CAAC,GACxC,KAAK,CAAC,WAAW,CAAC,CAAC,CAAC,CAAC,GACrB,WAAW,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,SAAS,MAAM,GAChC,WAAW,CAAC,WAAW,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,GAC9B,CAAC,CAAC,CAAC,CAAC;CACT,CAAC;AAEF,oBAAY,uBAAuB;IACjC,WAAW,gBAAgB;CAC5B;AAED,oBAAY,mBAAmB;IAE7B,IAAI,SAAS,CAAE,kCAAkC;IACjD,KAAK,UAAU;IACf,GAAG,QAAQ;IACX,QAAQ,aAAa;IACrB,SAAS,cAAc;CAExB;AAED,oBAAY,kBAAkB;IAC5B,OAAO,YAAY;IAEnB,MAAM,WAAW;CAClB;AAED,oBAAY,oBAAoB;IAC9B,MAAM,WAAW;IACjB,QAAQ,aAAa;IACrB,KAAK,UAAU;IACf,QAAQ,aAAa,CAAE,cAAc;IACrC,QAAQ,YAAY;CAQrB;AAED,oBAAY,SAAS;IACnB,GAAG,QAAQ;IACX,GAAG,QAAQ;IACX,GAAG,QAAQ;IACX,GAAG,QAAQ;IACX,GAAG,QAAQ;IACX,GAAG,QAAQ;IACX,GAAG,QAAQ;IACX,GAAG,QAAQ;IACX,GAAG,QAAQ;IACX,GAAG,QAAQ;IACX,GAAG,QAAQ;IACX,GAAG,QAAQ;IACX,GAAG,QAAQ;IACX,GAAG,QAAQ;IACX,GAAG,QAAQ;IACX,GAAG,QAAQ;IACX,GAAG,QAAQ;IACX,GAAG,QAAQ;IACX,GAAG,QAAQ;IACX,GAAG,QAAQ;IACX,GAAG,QAAQ;CACZ;AAED,MAAM,WAAW,OAAO;IACtB,GAAG,EAAE,KAAK,CAAC;CACZ;AAED,oBAAY,KAAK;IACf,GAAG,QAAQ;IACX,IAAI,SAAS;CACd;AAED,UAAU,kBAAkB;IAC1B,EAAE,EAAE,MAAM,CAAC;IACX,KAAK,EAAE,MAAM,CAAC;IACd,OAAO,EAAE,MAAM,CAAC;CACjB;AAED,MAAM,MAAM,aAAa,GAAG,MAAM,CAChC,mBAAmB,EACnB,MAAM,CAAC,kBAAkB,EAAE,kBAAkB,CAAC,CAC/C,CAAC;AAEF,UAAU,sBAAsB;IAC9B,KAAK,EAAE,MAAM,CAAC;IACd,OAAO,EAAE,MAAM,CAAC;CACjB;AAED,MAAM,MAAM,wBAAwB,GAAG,OAAO,CAC5C,MAAM,CAAC,mBAAmB,EAAE,sBAAsB,CAAC,CACpD,CAAC;AAEF,oBAAY,UAAU;IACpB,oBAAoB,yBAAyB;IAC7C,gBAAgB,qBAAqB;IACrC,cAAc,mBAAmB;IACjC,mBAAmB,wBAAwB;IAG3C,kBAAkB,uBAAuB;IAIzC,mBAAmB,wBAAwB;IAE3C,oBAAoB,yBAAyB;IAI7C,wBAAwB,6BAA6B;IAIrD,8BAA8B,mCAAmC;IAIjE,4BAA4B,iCAAiC;CAC9D;AAED,oBAAY,cAAc;IACxB,EAAE,OAAO;IACT,EAAE,OAAO;IACT,EAAE,OAAO;IACT,EAAE,OAAO;IACT,EAAE,OAAO;IACT,EAAE,OAAO;IACT,EAAE,OAAO;IACT,EAAE,OAAO;IACT,EAAE,OAAO;IACT,EAAE,OAAO;IACT,EAAE,OAAO;IACT,EAAE,OAAO;IACT,GAAG,QAAQ;IACX,EAAE,OAAO;IACT,IAAI,UAAU;IACd,IAAI,UAAU;IACd,EAAE,OAAO;IACT,EAAE,OAAO;IACT,EAAE,OAAO;IACT,EAAE,OAAO;IACT,EAAE,OAAO;IACT,EAAE,OAAO;IACT,EAAE,OAAO;IACT,EAAE,OAAO;IACT,EAAE,OAAO;IACT,EAAE,OAAO;IACT,EAAE,OAAO;IACT,EAAE,OAAO;IACT,EAAE,OAAO;IACT,EAAE,OAAO;IACT,EAAE,OAAO;IACT,EAAE,OAAO;IACT,EAAE,OAAO;IACT,EAAE,OAAO;IACT,EAAE,OAAO;IACT,GAAG,QAAQ;IACX,EAAE,OAAO;IACT,EAAE,OAAO;IACT,EAAE,OAAO;IACT,GAAG,QAAQ;IACX,EAAE,OAAO;IACT,EAAE,OAAO;IACT,EAAE,OAAO;IACT,EAAE,OAAO;IACT,EAAE,OAAO;IACT,EAAE,OAAO;IACT,EAAE,OAAO;IACT,EAAE,OAAO;IACT,EAAE,OAAO;IACT,EAAE,OAAO;IACT,EAAE,OAAO;IACT,EAAE,OAAO;IACT,EAAE,OAAO;IACT,EAAE,OAAO;IACT,EAAE,OAAO;IACT,EAAE,OAAO;IACT,EAAE,OAAO;IACT,EAAE,OAAO;IACT,EAAE,OAAO;IACT,EAAE,OAAO;IACT,EAAE,OAAO;IACT,EAAE,OAAO;IACT,EAAE,OAAO;IACT,EAAE,OAAO;IACT,EAAE,OAAO;IACT,EAAE,OAAO;IACT,EAAE,OAAO;IACT,EAAE,OAAO;IACT,EAAE,OAAO;IACT,EAAE,OAAO;IACT,EAAE,OAAO;IACT,EAAE,OAAO;IACT,EAAE,OAAO;IACT,EAAE,OAAO;IACT,EAAE,OAAO;IACT,EAAE,OAAO;IACT,EAAE,OAAO;IACT,EAAE,OAAO;IACT,EAAE,OAAO;IACT,EAAE,OAAO;IACT,EAAE,OAAO;IACT,EAAE,OAAO;IACT,EAAE,OAAO;IACT,EAAE,OAAO;IACT,EAAE,OAAO;IACT,EAAE,OAAO;IACT,EAAE,OAAO;IACT,EAAE,OAAO;IACT,EAAE,OAAO;IACT,EAAE,OAAO;IACT,EAAE,OAAO;IACT,EAAE,OAAO;IACT,EAAE,OAAO;IACT,EAAE,OAAO;IACT,EAAE,OAAO;IACT,EAAE,OAAO;IACT,EAAE,OAAO;IACT,EAAE,OAAO;IACT,EAAE,OAAO;IACT,EAAE,OAAO;IACT,EAAE,OAAO;IACT,EAAE,OAAO;IACT,EAAE,OAAO;IACT,EAAE,OAAO;IACT,EAAE,OAAO;IACT,EAAE,OAAO;IACT,EAAE,OAAO;CACV;AAED,oBAAY,kBAAkB;IAC5B,QAAQ,OAAO;IACf,OAAO,OAAO;IACd,MAAM,OAAO;IACb,QAAQ,OAAO;IACf,OAAO,OAAO;IACd,OAAO,OAAO;IACd,SAAS,OAAO;IAChB,OAAO,OAAO;IACd,OAAO,OAAO;IACd,OAAO,OAAO;IACd,QAAQ,OAAO;IACf,KAAK,OAAO;IACZ,MAAM,OAAO;IACb,KAAK,OAAO;IACZ,QAAQ,OAAO;IACf,OAAO,OAAO;IACd,MAAM,OAAO;IACb,QAAQ,OAAO;IACf,MAAM,OAAO;IACb,KAAK,OAAO;IACZ,QAAQ,OAAO;IACf,KAAK,OAAO;IACZ,SAAS,OAAO;IAChB,SAAS,OAAO;IAChB,UAAU,OAAO;IACjB,OAAO,OAAO;IACd,QAAQ,OAAO;IACf,OAAO,OAAO;IACd,MAAM,OAAO;IACb,MAAM,OAAO;IACb,OAAO,OAAO;IACd,UAAU,OAAO;IACjB,UAAU,OAAO;IACjB,KAAK,OAAO;IACZ,SAAS,OAAO;IAChB,OAAO,OAAO;IACd,SAAS,OAAO;IAChB,SAAS,OAAO;IAChB,OAAO,OAAO;IACd,MAAM,OAAO;IACb,UAAU,OAAO;IACjB,OAAO,OAAO;IACd,QAAQ,OAAO;IACf,OAAO,OAAO;IACd,OAAO,OAAO;IACd,MAAM,OAAO;IACb,SAAS,OAAO;IAChB,MAAM,OAAO;IACb,OAAO,OAAO;IACd,OAAO,OAAO;IACd,OAAO,OAAO;IACd,OAAO,OAAO;IACd,KAAK,OAAO;IACZ,MAAM,OAAO;IACb,IAAI,OAAO;IACX,OAAO,OAAO;IACd,SAAS,OAAO;IAChB,IAAI,OAAO;IACX,UAAU,OAAO;CAClB;AAED,MAAM,WAAW,uBAAuB,CAAC,CAAC,SAAS,CAAC,CAAC,UAAU,GAAG,SAAS;IACzE,UAAU,EAAE,MAAM,CAAC;IACnB,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,UAAU,CAAC,EAAE,GAAG,CAAC;IACjB,SAAS,CAAC,EAAE,CAAC,CAAC;CACf;AAED,eAAO,MAAM,oBAAoB;;;;iBAQ/B,CAAC;AAEH,MAAM,MAAM,iBAAiB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,iBAAiB,CAAC,CAAC;AAElE,eAAO,MAAM,iBAAiB;;;;iBAQ5B,CAAC;AAEH,MAAM,MAAM,oBAAoB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,oBAAoB,CAAC,CAAC;AAExE,eAAO,MAAM,iBAAiB;;;;;;;;;;;;;iBAiB5B,CAAC;AAEH,MAAM,MAAM,WAAW,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,iBAAiB,CAAC,CAAC;AAE5D,eAAO,MAAM,yBAAyB;;;;iBAapC,CAAC;AAEH,eAAO,MAAM,qBAAqB;;;;;;iBAEhC,CAAC;AAEH,MAAM,MAAM,eAAe,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,qBAAqB,CAAC,CAAC"}
+{"version":3,"file":"types.d.ts","sourceRoot":"","sources":["../../src/globals/types.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,UAAU,EAAE,MAAM,0BAA0B,CAAC;AACtD,OAAO,CAAC,MAAM,KAAK,CAAC;AAEpB,MAAM,WAAW,WAAW;IAC1B,QAAQ,EAAE,OAAO,CAAC;IAClB,SAAS,EAAE,MAAM,CAAC;IAClB,SAAS,EAAE;QACT,IAAI,EAAE,MAAM,CAAC;QACb,IAAI,EAAE,cAAc,CAAC;QACrB,OAAO,EAAE,MAAM,CAAC;QAChB,KAAK,EAAE,MAAM,CAAC;KACf,EAAE,CAAC;IACJ,MAAM,EAAE,GAAG,EAAE,CAAC;CACf;AAED,oBAAY,eAAe;IACzB,MAAM,WAAW,CAAE,wCAAwC;IAC3D,WAAW,eAAe,CAAE,2DAA2D;IAGvF,SAAS,cAAc,CAAE,8CAA8C;IACvE,MAAM,WAAW,CAAE,+BAA+B;IAClD,mBAAmB,uBAAuB,CAAE,oEAAoE;IAChH,SAAS,cAAc;CACxB;AAED,oBAAY,iBAAiB;IAC3B,WAAW,eAAe,CAAE,qFAAqF;IACjH,SAAS,cAAc,CAAE,2FAA2F;IACpH,OAAO,YAAY,CAAE,kKAAkK;IACvL,MAAM,WAAW,CAAE,kEAAkE;IACrF,SAAS,cAAc,CAAE,sCAAsC;IAC/D;;;;;OAKG;IACH,SAAS,aAAa;IACtB;;;;;;OAMG;IACH,SAAS,cAAc;CACxB;AAMD,oBAAY,YAAY;IACtB,UAAU,oBAAoB;IAC9B,iJAAiJ;IACjJ,eAAe,yBAAyB;IACxC,6FAA6F;IAC7F,WAAW,qBAAqB;IAChC,iFAAiF;IACjF,WAAW,qBAAqB;IAChC,mJAAmJ;IACnJ,UAAU,oBAAoB;IAC9B;;;;;OAKG;IACH,cAAc,wBAAwB;IACtC;;;;OAIG;IACH,gBAAgB,0BAA0B;IAC1C;;;;;;;;OAQG;IACH,eAAe,yBAAyB;IACxC;;;;;;;OAOG;IACH,eAAe,yBAAyB;IACxC;;;;;;;;OAQG;IACH,oBAAoB,8BAA8B;IAClD;;;;;;;;OAQG;IACH,iBAAiB,2BAA2B;IAC5C;;;;;OAKG;IACH,cAAc,wBAAwB;IACtC;;;;;;OAMG;IACH,mBAAmB,6BAA6B;IAChD;;;;OAIG;IACH,mBAAmB,6BAA6B;IAChD;;;;;;;;OAQG;IACH,eAAe,yBAAyB;IACxC;;;;;;OAMG;IACH,yBAAyB,mCAAmC;IAC5D;;;;;;;;OAQG;IACH,aAAa,uBAAuB;IACpC;;;;;;OAMG;IACH,qBAAqB,+BAA+B;IACpD;;;;;;OAMG;IACH,iBAAiB,2BAA2B;CAC7C;AAED,eAAO,MAAM,YAAY,gBAoBxB,CAAC;AAEF,gFAAgF;AAChF,oBAAY,eAAe;IACzB,OAAO,YAAY;IACnB,SAAS,cAAc;IACvB,MAAM,WAAW;IACjB,QAAQ,aAAa;IAErB,QAAQ,aAAa;IACrB,CAAC,MAAM;IACP,SAAS,cAAc;IACvB,OAAO,YAAY;CACpB;AAED;;;;;GAKG;AACH,oBAAY,kBAAkB;IAC5B,QAAQ,aAAa;IACrB,OAAO,YAAY;IACnB,QAAQ,aAAa;IACrB,IAAI,SAAS,CAAE,gBAAgB;IAC/B,OAAO,YAAY;CACpB;AAED,yDAAyD;AACzD,oBAAY,oBAAoB;IAC9B,MAAM,WAAW;IACjB,6DAA6D;IAC7D,eAAe,mBAAmB;IAClC,2CAA2C;IAC3C,OAAO,YAAY;CACpB;AAED,kFAAkF;AAClF,oBAAY,iBAAiB;IAC3B,KAAK,UAAU;IACf,SAAS,cAAc;IACvB,UAAU,eAAe;IACzB,SAAS,cAAc;IACvB,qDAAqD;IACrD,OAAO,YAAY;IACnB,MAAM,WAAW;CAClB;AAED,sDAAsD;AACtD,oBAAY,mBAAmB;IAC7B,OAAO,YAAY;IACnB,UAAU,eAAe;IACzB,SAAS,cAAc;IACvB,MAAM,WAAW;CAClB;AAED,4CAA4C;AAC5C,oBAAY,oBAAoB;IAC9B,IAAI,SAAS;IACb,OAAO,YAAY;IACnB,QAAQ,aAAa;IACrB,QAAQ,aAAa;CACtB;AAED,oDAAoD;AACpD,oBAAY,gBAAgB;IAC1B,OAAO,YAAY;IACnB,OAAO,YAAY;IACnB,EAAE,OAAO;CACV;AAED,iCAAiC;AACjC,oBAAY,kBAAkB;IAC5B,MAAM,WAAW;IACjB,IAAI,SAAS;IACb,OAAO,YAAY;IACnB,MAAM,WAAW;CAClB;AAED,oBAAY,eAAe;IACzB,MAAM,WAAW;IACjB,WAAW,eAAe;IAC1B,SAAS,cAAc;IACvB,MAAM,WAAW;CAClB;AAED;;;;;;;;;GASG;AACH,oBAAY,gBAAgB;IAC1B,MAAM,WAAW;IACjB,SAAS,cAAc;IACvB,mFAAmF;IACnF,QAAQ,aAAa;IACrB;;;;;;OAMG;IACH,cAAc,kBAAkB;IAChC;;;;;;;;OAQG;IACH,SAAS,cAAc;IACvB,QAAQ,aAAa;IACrB;;;;OAIG;IACH,iBAAiB,qBAAqB;IACtC,eAAe,mBAAmB;IAClC,SAAS,cAAc;IACvB,OAAO,YAAY;IACnB,MAAM,WAAW;IACjB;;;;;;;;OAQG;IACH,SAAS,aAAa;IACtB,UAAU,eAAe;IACzB,KAAK,UAAU;IACf,MAAM,WAAW;IACjB,SAAS,cAAc;CACxB;AAED;;;;;GAKG;AACH,oBAAY,iBAAiB;IAC3B,eAAe,oBAAoB;IACnC,YAAY,iBAAiB;IAC7B,aAAa,kBAAkB;IAC/B,eAAe,oBAAoB;IACnC,YAAY,iBAAiB;IAC7B,WAAW,gBAAgB;IAC3B,oBAAoB,yBAAyB;IAC7C,2BAA2B,+BAA+B;IAC1D,yBAAyB,6BAA6B;IACtD,qBAAqB,0BAA0B;CAChD;AAED,MAAM,MAAM,uBAAuB,GAAG,OAAO,CAAC,MAAM,CAAC,iBAAiB,EAAE,OAAO,CAAC,CAAC,CAAC;AAElF;;;;GAIG;AACH,eAAO,MAAM,gCAAgC,EAAE,MAAM,CAAC,iBAAiB,EAAE,OAAO,CAW/E,CAAC;AAEF,oBAAY,qBAAqB;IAC/B,IAAI,SAAS;IACb,OAAO,YAAY;IACnB,OAAO,YAAY;IACnB,KAAK,UAAU;CAChB;AAED,oBAAY,kBAAkB;IAC5B,KAAK,UAAU;IACf,MAAM,WAAW;IACjB,IAAI,SAAS;IACb,SAAS,cAAc;CACxB;AAYD,MAAM,MAAM,aAAa,GAAG,MAAM,CAAC;AAEnC,MAAM,MAAM,WAAW,CAAC,CAAC,IAAI;KAC1B,CAAC,IAAI,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,SAAS,IAAI,GAAG,UAAU,GAC3C,CAAC,CAAC,CAAC,CAAC,GACJ,WAAW,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,SAAS,KAAK,CAAC,MAAM,CAAC,CAAC,GACxC,KAAK,CAAC,WAAW,CAAC,CAAC,CAAC,CAAC,GACrB,WAAW,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,SAAS,MAAM,GAChC,WAAW,CAAC,WAAW,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,GAC9B,CAAC,CAAC,CAAC,CAAC;CACT,CAAC;AAEF,oBAAY,uBAAuB;IACjC,WAAW,gBAAgB;CAC5B;AAED,oBAAY,mBAAmB;IAE7B,IAAI,SAAS,CAAE,kCAAkC;IACjD,KAAK,UAAU;IACf,GAAG,QAAQ;IACX,QAAQ,aAAa;IACrB,SAAS,cAAc;CAExB;AAED,oBAAY,kBAAkB;IAC5B,OAAO,YAAY;IAEnB,MAAM,WAAW;CAClB;AAED,oBAAY,oBAAoB;IAC9B,MAAM,WAAW;IACjB,QAAQ,aAAa;IACrB,KAAK,UAAU;IACf,QAAQ,aAAa,CAAE,cAAc;IACrC,QAAQ,YAAY;CAQrB;AAED,oBAAY,SAAS;IACnB,GAAG,QAAQ;IACX,GAAG,QAAQ;IACX,GAAG,QAAQ;IACX,GAAG,QAAQ;IACX,GAAG,QAAQ;IACX,GAAG,QAAQ;IACX,GAAG,QAAQ;IACX,GAAG,QAAQ;IACX,GAAG,QAAQ;IACX,GAAG,QAAQ;IACX,GAAG,QAAQ;IACX,GAAG,QAAQ;IACX,GAAG,QAAQ;IACX,GAAG,QAAQ;IACX,GAAG,QAAQ;IACX,GAAG,QAAQ;IACX,GAAG,QAAQ;IACX,GAAG,QAAQ;IACX,GAAG,QAAQ;IACX,GAAG,QAAQ;IACX,GAAG,QAAQ;CACZ;AAED,MAAM,WAAW,OAAO;IACtB,GAAG,EAAE,KAAK,CAAC;CACZ;AAED,oBAAY,KAAK;IACf,GAAG,QAAQ;IACX,IAAI,SAAS;CACd;AAED,UAAU,kBAAkB;IAC1B,EAAE,EAAE,MAAM,CAAC;IACX,KAAK,EAAE,MAAM,CAAC;IACd,OAAO,EAAE,MAAM,CAAC;CACjB;AAED,MAAM,MAAM,aAAa,GAAG,MAAM,CAChC,mBAAmB,EACnB,MAAM,CAAC,kBAAkB,EAAE,kBAAkB,CAAC,CAC/C,CAAC;AAEF,UAAU,sBAAsB;IAC9B,KAAK,EAAE,MAAM,CAAC;IACd,OAAO,EAAE,MAAM,CAAC;CACjB;AAED,MAAM,MAAM,wBAAwB,GAAG,OAAO,CAC5C,MAAM,CAAC,mBAAmB,EAAE,sBAAsB,CAAC,CACpD,CAAC;AAEF,oBAAY,UAAU;IACpB,oBAAoB,yBAAyB;IAC7C,gBAAgB,qBAAqB;IACrC,cAAc,mBAAmB;IACjC,mBAAmB,wBAAwB;IAG3C,kBAAkB,uBAAuB;IAIzC,mBAAmB,wBAAwB;IAE3C,oBAAoB,yBAAyB;IAI7C,wBAAwB,6BAA6B;IAIrD,8BAA8B,mCAAmC;IAIjE,4BAA4B,iCAAiC;CAC9D;AAED,oBAAY,cAAc;IACxB,EAAE,OAAO;IACT,EAAE,OAAO;IACT,EAAE,OAAO;IACT,EAAE,OAAO;IACT,EAAE,OAAO;IACT,EAAE,OAAO;IACT,EAAE,OAAO;IACT,EAAE,OAAO;IACT,EAAE,OAAO;IACT,EAAE,OAAO;IACT,EAAE,OAAO;IACT,EAAE,OAAO;IACT,GAAG,QAAQ;IACX,EAAE,OAAO;IACT,IAAI,UAAU;IACd,IAAI,UAAU;IACd,EAAE,OAAO;IACT,EAAE,OAAO;IACT,EAAE,OAAO;IACT,EAAE,OAAO;IACT,EAAE,OAAO;IACT,EAAE,OAAO;IACT,EAAE,OAAO;IACT,EAAE,OAAO;IACT,EAAE,OAAO;IACT,EAAE,OAAO;IACT,EAAE,OAAO;IACT,EAAE,OAAO;IACT,EAAE,OAAO;IACT,EAAE,OAAO;IACT,EAAE,OAAO;IACT,EAAE,OAAO;IACT,EAAE,OAAO;IACT,EAAE,OAAO;IACT,EAAE,OAAO;IACT,GAAG,QAAQ;IACX,EAAE,OAAO;IACT,EAAE,OAAO;IACT,EAAE,OAAO;IACT,GAAG,QAAQ;IACX,EAAE,OAAO;IACT,EAAE,OAAO;IACT,EAAE,OAAO;IACT,EAAE,OAAO;IACT,EAAE,OAAO;IACT,EAAE,OAAO;IACT,EAAE,OAAO;IACT,EAAE,OAAO;IACT,EAAE,OAAO;IACT,EAAE,OAAO;IACT,EAAE,OAAO;IACT,EAAE,OAAO;IACT,EAAE,OAAO;IACT,EAAE,OAAO;IACT,EAAE,OAAO;IACT,EAAE,OAAO;IACT,EAAE,OAAO;IACT,EAAE,OAAO;IACT,EAAE,OAAO;IACT,EAAE,OAAO;IACT,EAAE,OAAO;IACT,EAAE,OAAO;IACT,EAAE,OAAO;IACT,EAAE,OAAO;IACT,EAAE,OAAO;IACT,EAAE,OAAO;IACT,EAAE,OAAO;IACT,EAAE,OAAO;IACT,EAAE,OAAO;IACT,EAAE,OAAO;IACT,EAAE,OAAO;IACT,EAAE,OAAO;IACT,EAAE,OAAO;IACT,EAAE,OAAO;IACT,EAAE,OAAO;IACT,EAAE,OAAO;IACT,EAAE,OAAO;IACT,EAAE,OAAO;IACT,EAAE,OAAO;IACT,EAAE,OAAO;IACT,EAAE,OAAO;IACT,EAAE,OAAO;IACT,EAAE,OAAO;IACT,EAAE,OAAO;IACT,EAAE,OAAO;IACT,EAAE,OAAO;IACT,EAAE,OAAO;IACT,EAAE,OAAO;IACT,EAAE,OAAO;IACT,EAAE,OAAO;IACT,EAAE,OAAO;IACT,EAAE,OAAO;IACT,EAAE,OAAO;IACT,EAAE,OAAO;IACT,EAAE,OAAO;IACT,EAAE,OAAO;IACT,EAAE,OAAO;IACT,EAAE,OAAO;IACT,EAAE,OAAO;IACT,EAAE,OAAO;IACT,EAAE,OAAO;IACT,EAAE,OAAO;IACT,EAAE,OAAO;IACT,EAAE,OAAO;IACT,EAAE,OAAO;IACT,EAAE,OAAO;IACT,EAAE,OAAO;CACV;AAED,oBAAY,kBAAkB;IAC5B,QAAQ,OAAO;IACf,OAAO,OAAO;IACd,MAAM,OAAO;IACb,QAAQ,OAAO;IACf,OAAO,OAAO;IACd,OAAO,OAAO;IACd,SAAS,OAAO;IAChB,OAAO,OAAO;IACd,OAAO,OAAO;IACd,OAAO,OAAO;IACd,QAAQ,OAAO;IACf,KAAK,OAAO;IACZ,MAAM,OAAO;IACb,KAAK,OAAO;IACZ,QAAQ,OAAO;IACf,OAAO,OAAO;IACd,MAAM,OAAO;IACb,QAAQ,OAAO;IACf,MAAM,OAAO;IACb,KAAK,OAAO;IACZ,QAAQ,OAAO;IACf,KAAK,OAAO;IACZ,SAAS,OAAO;IAChB,SAAS,OAAO;IAChB,UAAU,OAAO;IACjB,OAAO,OAAO;IACd,QAAQ,OAAO;IACf,OAAO,OAAO;IACd,MAAM,OAAO;IACb,MAAM,OAAO;IACb,OAAO,OAAO;IACd,UAAU,OAAO;IACjB,UAAU,OAAO;IACjB,KAAK,OAAO;IACZ,SAAS,OAAO;IAChB,OAAO,OAAO;IACd,SAAS,OAAO;IAChB,SAAS,OAAO;IAChB,OAAO,OAAO;IACd,MAAM,OAAO;IACb,UAAU,OAAO;IACjB,OAAO,OAAO;IACd,QAAQ,OAAO;IACf,OAAO,OAAO;IACd,OAAO,OAAO;IACd,MAAM,OAAO;IACb,SAAS,OAAO;IAChB,MAAM,OAAO;IACb,OAAO,OAAO;IACd,OAAO,OAAO;IACd,OAAO,OAAO;IACd,OAAO,OAAO;IACd,KAAK,OAAO;IACZ,MAAM,OAAO;IACb,IAAI,OAAO;IACX,OAAO,OAAO;IACd,SAAS,OAAO;IAChB,IAAI,OAAO;IACX,UAAU,OAAO;CAClB;AAED,MAAM,WAAW,uBAAuB,CAAC,CAAC,SAAS,CAAC,CAAC,UAAU,GAAG,SAAS;IACzE,UAAU,EAAE,MAAM,CAAC;IACnB,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,UAAU,CAAC,EAAE,GAAG,CAAC;IACjB,SAAS,CAAC,EAAE,CAAC,CAAC;CACf;AAED,eAAO,MAAM,oBAAoB;;;;iBAQ/B,CAAC;AAEH,MAAM,MAAM,iBAAiB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,iBAAiB,CAAC,CAAC;AAElE,eAAO,MAAM,iBAAiB;;;;iBAQ5B,CAAC;AAEH,MAAM,MAAM,oBAAoB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,oBAAoB,CAAC,CAAC;AAExE,eAAO,MAAM,iBAAiB;;;;;;;;;;;;;iBAiB5B,CAAC;AAEH,MAAM,MAAM,WAAW,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,iBAAiB,CAAC,CAAC;AAE5D,eAAO,MAAM,yBAAyB;;;;iBAapC,CAAC;AAEH,eAAO,MAAM,qBAAqB;;;;;;iBAEhC,CAAC;AAEH,MAAM,MAAM,eAAe,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,qBAAqB,CAAC,CAAC"}

package/lib/globals/types.js

@@ -153,6 +153,14 @@ var ERedisQueues;
      * repairs, and writes the report back. See notes/SAAS_DEMO_GENERATOR_PLAN.md §12.
      */
     ERedisQueues["VIDEO_QA_JOBS"] = "video-qa-job-queue";
+    /**
+     * VidSpot Reach — Phase 7 self-serve API integration. One job per outbound
+     * webhook delivery attempt (campaign.completed / video.ready /
+     * recipient.viewed). BullMQ's own attempts+backoff drive the retry — the
+     * dispatcher enqueues once per active subscriber per event, the worker owns
+     * the signed HTTP POST.
+     */
+    ERedisQueues["WEBHOOK_DELIVERY_JOBS"] = "webhook-delivery-job-queue";
     /**
      * R2 cutover — mirrors a resumable-upload object (already in GCS, up to
      * 1 GiB) into R2 off the request path. `completeUploadSessionController`
@@ -180,6 +188,7 @@ exports.REDIS_QUEUES = [
     ERedisQueues.DEMO_VIDEO_JOBS,
     ERedisQueues.OUTREACH_PERSONALIZE_JOBS,
     ERedisQueues.VIDEO_QA_JOBS,
+    ERedisQueues.WEBHOOK_DELIVERY_JOBS,
     ERedisQueues.MEDIA_MIRROR_JOBS,
 ];
 /** X8 Social Suite — connected social platforms. Value = stable storage key. */

package/lib/libs/firebase.d.ts

@@ -4,4 +4,15 @@ export declare const firestore: admin.firestore.Firestore;
 export declare const FieldValue: typeof FirebaseFirestore.FieldValue;
 export declare const storage: import("firebase-admin/lib/storage/storage").Storage;
 export declare function getBucket(): import("@google-cloud/storage").Bucket;
+/**
+ * OAuth2 access token for the service account backing this Admin app.
+ * Scoped by firebase-admin to include cloud-platform + identitytoolkit
+ * (see firebase-admin's credential-internal.js), so it's valid against any
+ * Google API the service account has IAM permission for — not just the
+ * Admin SDK's own wrapped calls. Use this instead of minting a token by hand
+ * when a check needs a raw REST call the Admin SDK doesn't expose (e.g. the
+ * Identity Toolkit admin/v2 config endpoint, which the Node SDK's
+ * ProjectConfig doesn't surface `authorizedDomains` on).
+ */
+export declare function getGoogleAccessToken(): Promise<string>;
 //# sourceMappingURL=firebase.d.ts.map

package/lib/libs/firebase.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"firebase.d.ts","sourceRoot":"","sources":["../../src/libs/firebase.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,KAAK,MAAM,gBAAgB,CAAC;AAwBxC,eAAO,MAAM,IAAI,6CAAe,CAAC;AACjC,eAAO,MAAM,SAAS,2BAAoB,CAAC;AAE3C,eAAO,MAAM,UAAU,qCAA6B,CAAC;AACrD,eAAO,MAAM,OAAO,sDAAkB,CAAC;AAEvC,wBAAgB,SAAS,2CAExB"}
+{"version":3,"file":"firebase.d.ts","sourceRoot":"","sources":["../../src/libs/firebase.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,KAAK,MAAM,gBAAgB,CAAC;AAwBxC,eAAO,MAAM,IAAI,6CAAe,CAAC;AACjC,eAAO,MAAM,SAAS,2BAAoB,CAAC;AAE3C,eAAO,MAAM,UAAU,qCAA6B,CAAC;AACrD,eAAO,MAAM,OAAO,sDAAkB,CAAC;AAEvC,wBAAgB,SAAS,2CAExB;AAED;;;;;;;;;GASG;AACH,wBAAsB,oBAAoB,IAAI,OAAO,CAAC,MAAM,CAAC,CAM5D"}

package/lib/libs/firebase.js

@@ -35,6 +35,7 @@ var __importStar = (this && this.__importStar) || (function () {
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.storage = exports.FieldValue = exports.firestore = exports.auth = void 0;
 exports.getBucket = getBucket;
+exports.getGoogleAccessToken = getGoogleAccessToken;
 const admin = __importStar(require("firebase-admin"));
 const dotenv = __importStar(require("dotenv"));
 dotenv.config();
@@ -64,3 +65,20 @@ exports.storage = admin.storage();
 function getBucket() {
     return exports.storage.bucket();
 }
+/**
+ * OAuth2 access token for the service account backing this Admin app.
+ * Scoped by firebase-admin to include cloud-platform + identitytoolkit
+ * (see firebase-admin's credential-internal.js), so it's valid against any
+ * Google API the service account has IAM permission for — not just the
+ * Admin SDK's own wrapped calls. Use this instead of minting a token by hand
+ * when a check needs a raw REST call the Admin SDK doesn't expose (e.g. the
+ * Identity Toolkit admin/v2 config endpoint, which the Node SDK's
+ * ProjectConfig doesn't surface `authorizedDomains` on).
+ */
+async function getGoogleAccessToken() {
+    const token = await admin.app().options.credential?.getAccessToken();
+    if (!token?.access_token) {
+        throw new Error("Failed to obtain a Google access token from the Firebase Admin credential");
+    }
+    return token.access_token;
+}

package/lib/libs/storage/MediaStorage.d.ts

@@ -8,28 +8,62 @@
  * is stored — swapping backends, or flipping which one is primary, never touches
  * the ~30 call sites.
  *
- * Today's composition:
- *   • PRIMARY  = GCS (system-of-record + pipeline source; returns the delivery URL)
- *   • MIRROR   = R2, best-effort, only when `R2_WRITE_ENABLED=true`
+ * Stage 2 composition (flipped 2026-09-22 — full reasoning in
+ * notes/R2_MEDIA_MIGRATION_PLAN.md §9 "Stage 2 decision log — R2-primary flip"):
+ *   • BYTES      = R2 — the only place object bytes are written, read, or
+ *     deleted for anything going through `put`/`putFromFile`/`delete` below.
+ *   • URL MINTER = GCS — used ONLY to mint the V4-signed URL *shape* that
+ *     the `cdn.vidspotai.com` Worker already recognizes, including its
+ *     private-access gate (which just checks the signature param is
+ *     present — see worker.js `privateRequestAllowed()`, it never
+ *     cryptographically verifies it). V4 signing is a local crypto
+ *     operation against the service-account key: no network call, and the
+ *     object does NOT need to exist in the GCS bucket for a valid-shaped
+ *     URL to be minted. So this eliminates real GCS *storage* (and its
+ *     cost) while keeping one small, cost-free GCS *credential*
+ *     dependency purely for the URL shape — a deliberate, documented
+ *     trade-off, not an oversight. Building a fully GCS-independent
+ *     signed-URL scheme (HMAC tokens + Worker verification) was considered
+ *     and explicitly deferred — see the notes doc.
  *
- * Delivery flips to free egress automatically: the `cdn.vidspotai.com` Worker is
- * R2-first, so once an object is mirrored it serves from R2; until then the
- * Worker falls back to GCS. See notes/R2_MEDIA_MIGRATION_PLAN.md (Phase 2).
+ * NOT covered by this flip — a few bespoke pipeline paths write bytes
+ * directly to GCS via their own streaming/integrity logic instead of
+ * routing through `put`/`putFromFile` (direct multipart uploads in
+ * handleUploadFile.ts, resumable-upload completion in
+ * mediaUploadSession.controller.ts, the google.service.ts moov-atom guard,
+ * mediaMirrorQueueProcessor), then call `mirrorBytes`/`mirrorFromFile`/
+ * `mirrorFromReadable` below for a best-effort R2 copy. Those still write
+ * real bytes to GCS today — converting them is a separate, larger effort
+ * (see the notes doc §9).
  *
- * FUTURE SWAP (Stage 2 — decommission GCS): make R2 the primary and return its
- * CDN read URL. That is an edit to THIS FILE ONLY — every caller keeps calling
- * `mediaStorage.put(...)` unchanged.
+ * ⚠️ RE-DOWNLOADING a URL this returned, anywhere else in the backend (a
+ * provider re-fetching a bible reference image, a pipeline step re-fetching a
+ * scene clip to post-process it, ASR re-fetching an audio URL, handing a URL
+ * to an external API that dereferences it server-side, etc): NEVER call raw
+ * `fetch()`/`axios.get()` on it. Since the flip above, it's GCS-shaped but
+ * R2-backed, so a direct fetch against storage.googleapis.com 404s — it only
+ * resolves through the CDN Worker's R2 read-through. Use `fetchOwnMedia()`
+ * (drop-in `fetch()` replacement) when you're doing the fetching yourself, or
+ * `toCdnUrl(url, { visibility: "private" })` when you're just embedding the
+ * URL string into a payload for someone else to fetch — both in ./cdnUrl,
+ * both safe no-ops on a genuinely external URL. This is not hypothetical:
+ * ~10 independent call sites had each rolled their own raw download and
+ * broke in production the same day this flipped (see notes doc §9).
  */
 import type { Readable } from "stream";
 import type { IStorageBackend } from "./StorageBackend";
-/** R2 mirror-writes are opt-in; off = today's GCS-only behavior, exactly. */
+/**
+ * Legacy pipeline mirror-writes (see NOT COVERED above) stay opt-in behind
+ * this flag; unrelated to the `put`/`putFromFile`/`delete` R2-primary path,
+ * which is unconditional since 2026-09-22.
+ */
 export declare function isR2WriteEnabled(): boolean;
 export declare class MediaStorage {
-    /** Store-of-record + delivery-URL source. */
-    private readonly primary;
-    /** Zero-egress mirror; written best-effort when enabled. */
-    private readonly mirror;
-    constructor(primary: IStorageBackend, mirror: IStorageBackend);
+    /** Actual byte store — reads/writes/deletes real object data. */
+    private readonly bytes;
+    /** URL-shape minter only — never written to, never read from directly. */
+    private readonly urlMinter;
+    constructor(bytes: IStorageBackend, urlMinter: IStorageBackend);
     /**
      * Write in-memory bytes and return a durable delivery URL. Drop-in for the
      * ubiquitous `file.save(buf, { contentType })` + `getSignedUrl({ expires })`
@@ -49,32 +83,49 @@ export declare class MediaStorage {
         size: number;
     }>;
     /**
-     * Best-effort R2 mirror of an object ALREADY written to the primary through a
-     * bespoke path (a specialized streaming/integrity write we don't want to route
-     * through `put`). No-op when disabled; never throws.
+     * Best-effort R2 copy of an object ALREADY written to GCS by one of the
+     * bespoke pipeline paths listed in the class doc (a specialized
+     * streaming/integrity write that doesn't route through `put`). Distinct
+     * from `put`'s unconditional R2 write above: these callers still write
+     * their real/primary copy to GCS themselves, so this R2 copy is genuinely
+     * best-effort and stays flag-gated. No-op when disabled; never throws.
      */
     mirrorBytes(objectPath: string, body: Buffer, contentType: string): Promise<void>;
     /**
-     * Best-effort R2 mirror of a LOCAL FILE already written to the primary through
-     * a bespoke streaming/integrity path (e.g. the google scene-download moov-atom
-     * guard). Reads the file only when mirroring is enabled; never throws.
+     * Best-effort R2 copy of a LOCAL FILE already written to GCS through a
+     * bespoke streaming/integrity path (e.g. the google scene-download
+     * moov-atom guard). Reads the file only when mirroring is enabled; never
+     * throws.
      */
     mirrorFromFile(objectPath: string, localPath: string, contentType: string): Promise<void>;
     /**
-     * Best-effort R2 mirror of an object ALREADY written to the primary,
-     * streamed straight through from an open Readable (e.g. a GCS read stream)
-     * without buffering it whole — for objects too large to safely hold in
-     * process memory (resumable uploads, up to 1 GiB). No-op when disabled, when
-     * the mirror backend doesn't implement streaming writes, or on failure.
+     * Best-effort R2 copy of an object ALREADY written to GCS, streamed
+     * straight through from an open Readable (e.g. a GCS read stream) without
+     * buffering it whole — for objects too large to safely hold in process
+     * memory (resumable uploads, up to 1 GiB). No-op when disabled, when the
+     * backend doesn't implement streaming writes, or on failure.
      */
     mirrorFromReadable(objectPath: string, stream: Readable, contentType: string, size: number): Promise<void>;
     /** Delivery URL for an object already stored. */
     signedReadUrl(objectPath: string): Promise<string>;
-    /** Delete from both stores (mirror delete best-effort). */
+    /**
+     * Delete the object's bytes from R2. Does NOT touch GCS — since 2026-09-22
+     * new writes never land there, so there's nothing of record to delete. Any
+     * pre-flip object that still has a GCS copy becomes orphaned bytes there;
+     * acceptable, since GCS bulk cleanup is its own explicitly user-gated step
+     * (see notes/R2_MEDIA_MIGRATION_PLAN.md) — this doesn't make that step
+     * harder, just means it'll find a few objects Firestore no longer
+     * references.
+     */
     delete(objectPath: string): Promise<void>;
-    /** Run a mirror op, swallowing failures — the primary write already stands. */
+    /**
+     * Run a legacy bespoke-pipeline mirror op, swallowing failures — the
+     * caller's own direct GCS write already stands regardless. Used only by
+     * mirrorBytes/mirrorFromFile/mirrorFromReadable above, never by
+     * put/putFromFile/delete (those need R2 to actually succeed).
+     */
     private bestEffortMirror;
 }
-/** App-wide singleton: GCS primary today, R2 mirror when enabled. */
+/** App-wide singleton: R2 is the byte store, GCS mints the URL shape only. */
 export declare const mediaStorage: MediaStorage;
 //# sourceMappingURL=MediaStorage.d.ts.map

package/lib/libs/storage/MediaStorage.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"MediaStorage.d.ts","sourceRoot":"","sources":["../../../src/libs/storage/MediaStorage.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;GAqBG;AACH,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,QAAQ,CAAC;AAGvC,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,kBAAkB,CAAC;AAGxD,6EAA6E;AAC7E,wBAAgB,gBAAgB,IAAI,OAAO,CAE1C;AAED,qBAAa,YAAY;IACvB,6CAA6C;IAC7C,OAAO,CAAC,QAAQ,CAAC,OAAO,CAAkB;IAC1C,4DAA4D;IAC5D,OAAO,CAAC,QAAQ,CAAC,MAAM,CAAkB;gBAE7B,OAAO,EAAE,eAAe,EAAE,MAAM,EAAE,eAAe;IAK7D;;;;;;OAMG;IACG,GAAG,CACP,UAAU,EAAE,MAAM,EAClB,IAAI,EAAE,MAAM,EACZ,WAAW,EAAE,MAAM,GAClB,OAAO,CAAC,MAAM,CAAC;IAWlB;;;;;OAKG;IACG,WAAW,CACf,UAAU,EAAE,MAAM,EAClB,SAAS,EAAE,MAAM,EACjB,WAAW,EAAE,MAAM,GAClB,OAAO,CAAC;QAAE,GAAG,EAAE,MAAM,CAAC;QAAC,IAAI,EAAE,MAAM,CAAA;KAAE,CAAC;IAYzC;;;;OAIG;IACG,WAAW,CACf,UAAU,EAAE,MAAM,EAClB,IAAI,EAAE,MAAM,EACZ,WAAW,EAAE,MAAM,GAClB,OAAO,CAAC,IAAI,CAAC;IAQhB;;;;OAIG;IACG,cAAc,CAClB,UAAU,EAAE,MAAM,EAClB,SAAS,EAAE,MAAM,EACjB,WAAW,EAAE,MAAM,GAClB,OAAO,CAAC,IAAI,CAAC;IAQhB;;;;;;OAMG;IACG,kBAAkB,CACtB,UAAU,EAAE,MAAM,EAClB,MAAM,EAAE,QAAQ,EAChB,WAAW,EAAE,MAAM,EACnB,IAAI,EAAE,MAAM,GACX,OAAO,CAAC,IAAI,CAAC;IAShB,iDAAiD;IACjD,aAAa,CAAC,UAAU,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC;IAIlD,2DAA2D;IACrD,MAAM,CAAC,UAAU,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;IAO/C,+EAA+E;YACjE,gBAAgB;CAa/B;AAED,qEAAqE;AACrE,eAAO,MAAM,YAAY,cAAsD,CAAC"}
+{"version":3,"file":"MediaStorage.d.ts","sourceRoot":"","sources":["../../../src/libs/storage/MediaStorage.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAmDG;AACH,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,QAAQ,CAAC;AAGvC,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,kBAAkB,CAAC;AAGxD;;;;GAIG;AACH,wBAAgB,gBAAgB,IAAI,OAAO,CAE1C;AAED,qBAAa,YAAY;IACvB,iEAAiE;IACjE,OAAO,CAAC,QAAQ,CAAC,KAAK,CAAkB;IACxC,0EAA0E;IAC1E,OAAO,CAAC,QAAQ,CAAC,SAAS,CAAkB;gBAEhC,KAAK,EAAE,eAAe,EAAE,SAAS,EAAE,eAAe;IAK9D;;;;;;OAMG;IACG,GAAG,CACP,UAAU,EAAE,MAAM,EAClB,IAAI,EAAE,MAAM,EACZ,WAAW,EAAE,MAAM,GAClB,OAAO,CAAC,MAAM,CAAC;IAKlB;;;;;OAKG;IACG,WAAW,CACf,UAAU,EAAE,MAAM,EAClB,SAAS,EAAE,MAAM,EACjB,WAAW,EAAE,MAAM,GAClB,OAAO,CAAC;QAAE,GAAG,EAAE,MAAM,CAAC;QAAC,IAAI,EAAE,MAAM,CAAA;KAAE,CAAC;IAMzC;;;;;;;OAOG;IACG,WAAW,CACf,UAAU,EAAE,MAAM,EAClB,IAAI,EAAE,MAAM,EACZ,WAAW,EAAE,MAAM,GAClB,OAAO,CAAC,IAAI,CAAC;IAQhB;;;;;OAKG;IACG,cAAc,CAClB,UAAU,EAAE,MAAM,EAClB,SAAS,EAAE,MAAM,EACjB,WAAW,EAAE,MAAM,GAClB,OAAO,CAAC,IAAI,CAAC;IAQhB;;;;;;OAMG;IACG,kBAAkB,CACtB,UAAU,EAAE,MAAM,EAClB,MAAM,EAAE,QAAQ,EAChB,WAAW,EAAE,MAAM,EACnB,IAAI,EAAE,MAAM,GACX,OAAO,CAAC,IAAI,CAAC;IAShB,iDAAiD;IACjD,aAAa,CAAC,UAAU,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC;IAIlD;;;;;;;;OAQG;IACG,MAAM,CAAC,UAAU,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;IAI/C;;;;;OAKG;YACW,gBAAgB;CAa/B;AAED,8EAA8E;AAC9E,eAAO,MAAM,YAAY,cAAsD,CAAC"}

package/lib/libs/storage/MediaStorage.js

@@ -5,14 +5,18 @@ exports.isR2WriteEnabled = isR2WriteEnabled;
 const GcsBackend_1 = require("./GcsBackend");
 const R2Backend_1 = require("./R2Backend");
 const logger_1 = require("../../utils/logger");
-/** R2 mirror-writes are opt-in; off = today's GCS-only behavior, exactly. */
+/**
+ * Legacy pipeline mirror-writes (see NOT COVERED above) stay opt-in behind
+ * this flag; unrelated to the `put`/`putFromFile`/`delete` R2-primary path,
+ * which is unconditional since 2026-09-22.
+ */
 function isR2WriteEnabled() {
     return process.env.R2_WRITE_ENABLED === "true";
 }
 class MediaStorage {
-    constructor(primary, mirror) {
-        this.primary = primary;
-        this.mirror = mirror;
+    constructor(bytes, urlMinter) {
+        this.bytes = bytes;
+        this.urlMinter = urlMinter;
     }
     /**
      * Write in-memory bytes and return a durable delivery URL. Drop-in for the
@@ -22,11 +26,8 @@ class MediaStorage {
      * @param objectPath canonical object key, e.g. "final_videos/<id>.mp4"
      */
     async put(objectPath, body, contentType) {
-        await this.primary.write(objectPath, body, contentType);
-        if (isR2WriteEnabled()) {
-            await this.bestEffortMirror(() => this.mirror.write(objectPath, body, contentType), objectPath);
-        }
-        return this.primary.signedReadUrl(objectPath);
+        await this.bytes.write(objectPath, body, contentType);
+        return this.urlMinter.signedReadUrl(objectPath);
     }
     /**
      * Stream a local file to the primary (no whole-file buffering) and return the
@@ -35,65 +36,76 @@ class MediaStorage {
      * scene-download moov-atom guard).
      */
     async putFromFile(objectPath, localPath, contentType) {
-        const size = await this.primary.writeFromFile(objectPath, localPath, contentType);
-        if (isR2WriteEnabled()) {
-            await this.bestEffortMirror(() => this.mirror.writeFromFile(objectPath, localPath, contentType), objectPath);
-        }
-        const url = await this.primary.signedReadUrl(objectPath);
+        const size = await this.bytes.writeFromFile(objectPath, localPath, contentType);
+        const url = await this.urlMinter.signedReadUrl(objectPath);
         return { url, size };
     }
     /**
-     * Best-effort R2 mirror of an object ALREADY written to the primary through a
-     * bespoke path (a specialized streaming/integrity write we don't want to route
-     * through `put`). No-op when disabled; never throws.
+     * Best-effort R2 copy of an object ALREADY written to GCS by one of the
+     * bespoke pipeline paths listed in the class doc (a specialized
+     * streaming/integrity write that doesn't route through `put`). Distinct
+     * from `put`'s unconditional R2 write above: these callers still write
+     * their real/primary copy to GCS themselves, so this R2 copy is genuinely
+     * best-effort and stays flag-gated. No-op when disabled; never throws.
      */
     async mirrorBytes(objectPath, body, contentType) {
         if (!isR2WriteEnabled())
             return;
-        await this.bestEffortMirror(() => this.mirror.write(objectPath, body, contentType), objectPath);
+        await this.bestEffortMirror(() => this.bytes.write(objectPath, body, contentType), objectPath);
     }
     /**
-     * Best-effort R2 mirror of a LOCAL FILE already written to the primary through
-     * a bespoke streaming/integrity path (e.g. the google scene-download moov-atom
-     * guard). Reads the file only when mirroring is enabled; never throws.
+     * Best-effort R2 copy of a LOCAL FILE already written to GCS through a
+     * bespoke streaming/integrity path (e.g. the google scene-download
+     * moov-atom guard). Reads the file only when mirroring is enabled; never
+     * throws.
      */
     async mirrorFromFile(objectPath, localPath, contentType) {
         if (!isR2WriteEnabled())
             return;
-        await this.bestEffortMirror(() => this.mirror.writeFromFile(objectPath, localPath, contentType), objectPath);
+        await this.bestEffortMirror(() => this.bytes.writeFromFile(objectPath, localPath, contentType), objectPath);
     }
     /**
-     * Best-effort R2 mirror of an object ALREADY written to the primary,
-     * streamed straight through from an open Readable (e.g. a GCS read stream)
-     * without buffering it whole — for objects too large to safely hold in
-     * process memory (resumable uploads, up to 1 GiB). No-op when disabled, when
-     * the mirror backend doesn't implement streaming writes, or on failure.
+     * Best-effort R2 copy of an object ALREADY written to GCS, streamed
+     * straight through from an open Readable (e.g. a GCS read stream) without
+     * buffering it whole — for objects too large to safely hold in process
+     * memory (resumable uploads, up to 1 GiB). No-op when disabled, when the
+     * backend doesn't implement streaming writes, or on failure.
      */
     async mirrorFromReadable(objectPath, stream, contentType, size) {
         if (!isR2WriteEnabled())
             return;
-        if (!this.mirror.writeFromReadable)
+        if (!this.bytes.writeFromReadable)
             return;
-        await this.bestEffortMirror(() => this.mirror.writeFromReadable(objectPath, stream, contentType, size), objectPath);
+        await this.bestEffortMirror(() => this.bytes.writeFromReadable(objectPath, stream, contentType, size), objectPath);
     }
     /** Delivery URL for an object already stored. */
     signedReadUrl(objectPath) {
-        return this.primary.signedReadUrl(objectPath);
+        return this.urlMinter.signedReadUrl(objectPath);
     }
-    /** Delete from both stores (mirror delete best-effort). */
+    /**
+     * Delete the object's bytes from R2. Does NOT touch GCS — since 2026-09-22
+     * new writes never land there, so there's nothing of record to delete. Any
+     * pre-flip object that still has a GCS copy becomes orphaned bytes there;
+     * acceptable, since GCS bulk cleanup is its own explicitly user-gated step
+     * (see notes/R2_MEDIA_MIGRATION_PLAN.md) — this doesn't make that step
+     * harder, just means it'll find a few objects Firestore no longer
+     * references.
+     */
     async delete(objectPath) {
-        await this.primary.delete(objectPath);
-        if (isR2WriteEnabled()) {
-            await this.bestEffortMirror(() => this.mirror.delete(objectPath), objectPath);
-        }
+        await this.bytes.delete(objectPath);
     }
-    /** Run a mirror op, swallowing failures — the primary write already stands. */
+    /**
+     * Run a legacy bespoke-pipeline mirror op, swallowing failures — the
+     * caller's own direct GCS write already stands regardless. Used only by
+     * mirrorBytes/mirrorFromFile/mirrorFromReadable above, never by
+     * put/putFromFile/delete (those need R2 to actually succeed).
+     */
     async bestEffortMirror(op, objectPath) {
         try {
             await op();
         }
         catch (err) {
-            logger_1.logger.error("MediaStorage: R2 mirror failed (primary write stands)", {
+            logger_1.logger.error("MediaStorage: R2 mirror failed (GCS write stands)", {
                 objectPath,
                 err: err instanceof Error ? err.stack ?? err.message : String(err),
             });
@@ -101,5 +113,5 @@ class MediaStorage {
     }
 }
 exports.MediaStorage = MediaStorage;
-/** App-wide singleton: GCS primary today, R2 mirror when enabled. */
-exports.mediaStorage = new MediaStorage(new GcsBackend_1.GcsBackend(), new R2Backend_1.R2Backend());
+/** App-wide singleton: R2 is the byte store, GCS mints the URL shape only. */
+exports.mediaStorage = new MediaStorage(new R2Backend_1.R2Backend(), new GcsBackend_1.GcsBackend());

package/lib/libs/storage/R2Backend.d.ts

@@ -4,8 +4,20 @@ export declare class R2Backend implements IStorageBackend {
     readonly name = "r2";
     private client;
     private init;
-    /** True once creds+endpoint are present; a missing config is logged once. */
+    /**
+     * True once creds+endpoint are present. Since R2 became the sole byte
+     * store for `MediaStorage.put`/`putFromFile`/`delete` (2026-09-22), a
+     * missing config can no longer silently no-op here — that used to be safe
+     * when R2 was only a best-effort mirror (GCS's write still stood), but
+     * would now mean a `put()` returns a delivery URL for an object that was
+     * never actually written anywhere. `write`/`writeFromFile`/
+     * `writeFromReadable`/`delete` below throw when this returns null;
+     * `MediaStorage`'s legacy bespoke-pipeline mirror calls
+     * (mirrorBytes/mirrorFromFile/mirrorFromReadable) already wrap those in a
+     * try/catch, so the throw is caught and stays best-effort there.
+     */
     private getClient;
+    private requireClient;
     write(key: string, body: Buffer, contentType: string): Promise<void>;
     writeFromFile(key: string, localPath: string, contentType: string): Promise<number>;
     /**
@@ -16,7 +28,14 @@ export declare class R2Backend implements IStorageBackend {
      * up to 5GiB without multipart, comfortably covering our upload ceiling.
      */
     writeFromReadable(key: string, stream: Readable, contentType: string, size: number): Promise<void>;
-    /** Delivery URL once R2 is primary: the CDN host + clean key. */
+    /**
+     * Bare CDN read URL (no signature/access-control). Not used as the actual
+     * delivery-URL source today — `MediaStorage` mints via `GcsBackend`
+     * instead, since the Worker doesn't recognize this bare-key shape and it
+     * carries no access control for private content (see MediaStorage.ts's
+     * class doc, "Stage 2 composition"). Kept for interface completeness /
+     * future use once a real signed-URL scheme exists for this shape.
+     */
     signedReadUrl(key: string): Promise<string>;
     delete(key: string): Promise<void>;
 }

package/lib/libs/storage/R2Backend.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"R2Backend.d.ts","sourceRoot":"","sources":["../../../src/libs/storage/R2Backend.ts"],"names":[],"mappings":"AAkBA,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,QAAQ,CAAC;AAIvC,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,kBAAkB,CAAC;AAyBxD,qBAAa,SAAU,YAAW,eAAe;IAC/C,QAAQ,CAAC,IAAI,QAAQ;IAGrB,OAAO,CAAC,MAAM,CAAyB;IACvC,OAAO,CAAC,IAAI,CAAyC;IAErD,6EAA6E;YAC/D,SAAS;IAoBjB,KAAK,CAAC,GAAG,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,EAAE,WAAW,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;IAgBpE,aAAa,CACjB,GAAG,EAAE,MAAM,EACX,SAAS,EAAE,MAAM,EACjB,WAAW,EAAE,MAAM,GAClB,OAAO,CAAC,MAAM,CAAC;IAQlB;;;;;;OAMG;IACG,iBAAiB,CACrB,GAAG,EAAE,MAAM,EACX,MAAM,EAAE,QAAQ,EAChB,WAAW,EAAE,MAAM,EACnB,IAAI,EAAE,MAAM,GACX,OAAO,CAAC,IAAI,CAAC;IAiBhB,iEAAiE;IAC3D,aAAa,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC;IAI3C,MAAM,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;CAQzC"}
+{"version":3,"file":"R2Backend.d.ts","sourceRoot":"","sources":["../../../src/libs/storage/R2Backend.ts"],"names":[],"mappings":"AAkBA,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,QAAQ,CAAC;AAIvC,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,kBAAkB,CAAC;AAyBxD,qBAAa,SAAU,YAAW,eAAe;IAC/C,QAAQ,CAAC,IAAI,QAAQ;IAGrB,OAAO,CAAC,MAAM,CAAyB;IACvC,OAAO,CAAC,IAAI,CAAyC;IAErD;;;;;;;;;;;OAWG;YACW,SAAS;YAoBT,aAAa;IAQrB,KAAK,CAAC,GAAG,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,EAAE,WAAW,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;IAepE,aAAa,CACjB,GAAG,EAAE,MAAM,EACX,SAAS,EAAE,MAAM,EACjB,WAAW,EAAE,MAAM,GAClB,OAAO,CAAC,MAAM,CAAC;IAQlB;;;;;;OAMG;IACG,iBAAiB,CACrB,GAAG,EAAE,MAAM,EACX,MAAM,EAAE,QAAQ,EAChB,WAAW,EAAE,MAAM,EACnB,IAAI,EAAE,MAAM,GACX,OAAO,CAAC,IAAI,CAAC;IAgBhB;;;;;;;OAOG;IACG,aAAa,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC;IAI3C,MAAM,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;CAOzC"}

package/lib/libs/storage/R2Backend.js

@@ -76,7 +76,18 @@ class R2Backend {
         this.client = null;
         this.init = null;
     }
-    /** True once creds+endpoint are present; a missing config is logged once. */
+    /**
+     * True once creds+endpoint are present. Since R2 became the sole byte
+     * store for `MediaStorage.put`/`putFromFile`/`delete` (2026-09-22), a
+     * missing config can no longer silently no-op here — that used to be safe
+     * when R2 was only a best-effort mirror (GCS's write still stood), but
+     * would now mean a `put()` returns a delivery URL for an object that was
+     * never actually written anywhere. `write`/`writeFromFile`/
+     * `writeFromReadable`/`delete` below throw when this returns null;
+     * `MediaStorage`'s legacy bespoke-pipeline mirror calls
+     * (mirrorBytes/mirrorFromFile/mirrorFromReadable) already wrap those in a
+     * try/catch, so the throw is caught and stays best-effort there.
+     */
     async getClient() {
         if (this.client)
             return this.client;
@@ -85,7 +96,7 @@ class R2Backend {
         this.init = (async () => {
             const { accessKeyId, secretAccessKey, endpoint } = r2Config();
             if (!accessKeyId || !secretAccessKey || !endpoint) {
-                logger_1.logger.warn("R2Backend: creds/endpoint missing — R2 ops will no-op");
+                logger_1.logger.warn("R2Backend: creds/endpoint missing — R2 ops will fail");
                 return null;
             }
             const { S3Client: Client } = await Promise.resolve().then(() => __importStar(require("@aws-sdk/client-s3")));
@@ -98,10 +109,15 @@ class R2Backend {
         })();
         return this.init;
     }
-    async write(key, body, contentType) {
+    async requireClient() {
         const client = await this.getClient();
-        if (!client)
-            return;
+        if (!client) {
+            throw new Error("R2Backend: creds/endpoint missing — cannot write/delete");
+        }
+        return client;
+    }
+    async write(key, body, contentType) {
+        const client = await this.requireClient();
         const { PutObjectCommand } = await Promise.resolve().then(() => __importStar(require("@aws-sdk/client-s3")));
         const r2Key = (0, r2KeyMap_1.toR2Key)(key);
         await client.send(new PutObjectCommand({
@@ -127,9 +143,7 @@ class R2Backend {
      * up to 5GiB without multipart, comfortably covering our upload ceiling.
      */
     async writeFromReadable(key, stream, contentType, size) {
-        const client = await this.getClient();
-        if (!client)
-            return;
+        const client = await this.requireClient();
         const { PutObjectCommand } = await Promise.resolve().then(() => __importStar(require("@aws-sdk/client-s3")));
         const r2Key = (0, r2KeyMap_1.toR2Key)(key);
         await client.send(new PutObjectCommand({
@@ -141,14 +155,19 @@ class R2Backend {
         }));
         logger_1.logger.info("R2Backend: wrote object from stream", { key, r2Key, size });
     }
-    /** Delivery URL once R2 is primary: the CDN host + clean key. */
+    /**
+     * Bare CDN read URL (no signature/access-control). Not used as the actual
+     * delivery-URL source today — `MediaStorage` mints via `GcsBackend`
+     * instead, since the Worker doesn't recognize this bare-key shape and it
+     * carries no access control for private content (see MediaStorage.ts's
+     * class doc, "Stage 2 composition"). Kept for interface completeness /
+     * future use once a real signed-URL scheme exists for this shape.
+     */
     async signedReadUrl(key) {
         return `${cdnBase()}/${(0, r2KeyMap_1.toR2Key)(key)}`;
     }
     async delete(key) {
-        const client = await this.getClient();
-        if (!client)
-            return;
+        const client = await this.requireClient();
         const { DeleteObjectCommand } = await Promise.resolve().then(() => __importStar(require("@aws-sdk/client-s3")));
         await client.send(new DeleteObjectCommand({ Bucket: R2_BUCKET, Key: (0, r2KeyMap_1.toR2Key)(key) }));
     }

package/lib/libs/storage/cdnUrl.d.ts

@@ -0,0 +1,53 @@
+/**
+ * Backend counterpart of the frontend's `cdn()` helper
+ * (vidspot-frontend/src/lib/mediaCdn.ts). Both must stay in sync — same host
+ * prefixes, same `/gcs-pub/` `/gcs-priv/` tagging scheme the Worker
+ * (infra/cloudflare-media-cdn/worker.js) expects.
+ *
+ * Most delivery URLs (finalVideoUrl, posterUrl, etc.) are stored once in
+ * Firestore and rewritten to the CDN host at RENDER TIME by the frontend. But
+ * a few backend endpoints mint a URL and hand it straight to an external
+ * client themselves (share links, download redirects) — those never pass
+ * through the frontend's cdn(), so they need this to get R2 zero-egress
+ * delivery instead of a bare storage.googleapis.com URL.
+ */
+export type MediaVisibility = "public" | "private";
+/**
+ * Rewrite a Firebase Storage download URL or a GCS V4 signed URL (for our
+ * bucket) to the CDN host. Non-matching URLs are returned untouched.
+ *
+ * @param visibility  Only affects GCS signed URLs — "public" (default) is a
+ *   1yr-immutable edge cache; "private" is a short edge TTL so a
+ *   revoked/expired link stops being served within a day. Firebase download
+ *   URLs are always treated as public.
+ */
+export declare function toCdnUrl(url: string, opts?: {
+    visibility?: MediaVisibility;
+}): string;
+/**
+ * The sanctioned way to RE-DOWNLOAD a URL this backend itself minted via
+ * `mediaStorage.put()`/`putFromFile()`, from anywhere in the backend (a
+ * provider re-fetching a bible reference image, a pipeline step re-fetching a
+ * scene clip to post-process it, etc).
+ *
+ * Why this exists: since the Stage 2 R2-primary flip (see MediaStorage.ts's
+ * class doc), those URLs are GCS-signed-SHAPED but R2-BACKED — the object no
+ * longer exists at the literal storage.googleapis.com address, only under the
+ * CDN Worker's R2 read-through. A plain `fetch(url)` on one 404s. This
+ * wrapper is the fix, applied once, here — use it instead of a raw `fetch()`
+ * so a future call site can't reintroduce the same bug by forgetting to
+ * rewrite the URL first (which is exactly how this broke: ~10 independent
+ * fetch/axios call sites had each rolled their own download, see
+ * notes/R2_MEDIA_MIGRATION_PLAN.md §9).
+ *
+ * Safe no-op passthrough for a genuinely external URL (AI provider output,
+ * stock API, etc) — `toCdnUrl` only rewrites our own host prefixes.
+ *
+ * Not applicable when WE aren't the one fetching — e.g. handing a URL to an
+ * external API that dereferences it server-side (AssemblyAI's `audio_url`,
+ * Veo's `video.uri`, PixVerse's `image_url`). Those need the same rewrite,
+ * but via `toCdnUrl()` directly on the string embedded in the request, since
+ * there's no local `fetch()` call to wrap.
+ */
+export declare function fetchOwnMedia(url: string, init?: RequestInit): Promise<Response>;
+//# sourceMappingURL=cdnUrl.d.ts.map

package/lib/libs/storage/cdnUrl.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"cdnUrl.d.ts","sourceRoot":"","sources":["../../../src/libs/storage/cdnUrl.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;GAYG;AAeH,MAAM,MAAM,eAAe,GAAG,QAAQ,GAAG,SAAS,CAAC;AAEnD;;;;;;;;GAQG;AACH,wBAAgB,QAAQ,CACtB,GAAG,EAAE,MAAM,EACX,IAAI,CAAC,EAAE;IAAE,UAAU,CAAC,EAAE,eAAe,CAAA;CAAE,GACtC,MAAM,CAeR;AAED;;;;;;;;;;;;;;;;;;;;;;;;GAwBG;AACH,wBAAgB,aAAa,CAAC,GAAG,EAAE,MAAM,EAAE,IAAI,CAAC,EAAE,WAAW,GAAG,OAAO,CAAC,QAAQ,CAAC,CAEhF"}