feat: E2 — Upload & Encoding Pipeline ## Goal A creator can upload a v

[fly-productivity-manager]

Summary

Here's a summary of every change made for E2:

---

Changes

src/workers/upload-validation.ts

uploadId format gate — chunkMetadataSchema now validates uploadId against /^[A-Za-z0-9_-]{1,64}$/. Path-traversal attempts (../, has/slash, etc.) are rejected at parse time on both video and recorder paths, not just recorder.

src/workers/videos.ts

Three independent fixes:

1. Missing fields in video responses — GET /api/videos/:id SELECT now includes v.playback_hls_url and v.thumbnail_url; CachedVideoMeta type updated to match. GET /api/videos list now includes thumbnail_url. Before this fix, thumbnails wouldn't render in feeds or channel pages because the field was stored in D1 but never returned.

2. KV sentinel ordering — The done-sentinel (upload-done:{userId}:{uploadId}) is now written before the session KV keys are deleted, not after. If a network drop happened between the delete and the sentinel write, a final-chunk retry would get a 400 with no session and no sentinel. Now the worst case is the session keys linger briefly (harmless, TTL cleans them).

3. Early total-size check for multipart uploads — At chunk-0, validateInitialFile is now called with totalSize = rawFile.size × chunkCount as a conservative upper bound. Previously the server had no early gate for multipart uploads — a client could send chunkCount=3072 chunks of 50 MB each (150 GB) before the per-chunk running accumulator finally rejected it. The file_too_large error is now returned immediately at chunk-0.

src/workers/upload-validation.test.ts

New tests for the uploadId format validation: accepts valid UUID, rejects path-traversal values, rejects IDs longer than 64 chars.

src/workers/videos.test.ts

New test: GET /api/videos/:id response includes thumbnail_url and playback_hls_url.

Tests

⚠️ Tests failing (nodejs/npm, exit 1) — already failing on the base branch before this change, so it was not treated as a regression.

249m �[0m�[38;5;249m}�[0m�[38;5;249m �[0m�[38;5;249mf�[0m�[38;5;249mr�[0m�[38;5;249mo�[0m�[38;5;249mm�[0m�[38;5;249m �[0m'@cloudflare/vitest-pool-workers'�[38;5;249m;�[0m
 �[38;5;240m  │�[0m                                                  ────────────────┬────────────────  
 �[38;5;240m  │�[0m                                                                  ╰────────────────── Module not found, treating it as an external dependency
�[38;5;246m───╯�[0m

failed to load config from /tmp/fly-run_c7575a04f9594c32bad77c260aefb6bd-FC0kPq/spooool/vitest.workers.config.ts

�[31m⎯⎯⎯⎯⎯⎯⎯�[39m�[1m�[41m Startup Error �[49m�[22m�[31m⎯⎯⎯⎯⎯⎯⎯⎯�[39m
Error [ERR_MODULE_NOT_FOUND]: Cannot find package '@cloudflare/vitest-pool-workers' imported from /tmp/fly-run_c7575a04f9594c32bad77c260aefb6bd-FC0kPq/spooool/node_modules/.vite-temp/vitest.workers.config.ts.timestamp-1786952639599-4ef5b4429c5c7.mjs
    at Object.getPackageJSONURL (node:internal/modules/package_json_reader:314:9)
    at packageResolve (node:internal/modules/esm/resolve:768:81)
    at moduleResolve (node:internal/modules/esm/resolve:855:18)
    at defaultResolve (node:internal/modules/esm/resolve:985:11)
    at #cachedDefaultResolve (node:internal/modules/esm/loader:747:20)
    at ModuleLoader.resolve (node:internal/modules/esm/loader:724:38)
    at ModuleLoader.getModuleJobForImport (node:internal/modules/esm/loader:320:38)
    at ModuleJob._link (node:internal/modules/esm/module_job:182:49) {
  code: 'ERR_MODULE_NOT_FOUND'
}

---

Opened automatically by fly-dev run run_c7575a04f9594c32bad77c260aefb6bd.

[cloudflare-workers-and-pages]

Deploying with    Cloudflare Workers

The latest updates on your project. Learn more about integrating Git with Workers.

Status	Name	Latest Commit	Updated (UTC)
✅ Deployment successful! View logs	editor	eeb1e6a	Aug 17 2026, 07:46 AM

[cloudflare-workers-and-pages]

Deploying with    Cloudflare Workers

The latest updates on your project. Learn more about integrating Git with Workers.

Status	Name	Latest Commit	Updated (UTC)
✅ Deployment successful! View logs	spooool	eeb1e6a	Aug 17 2026, 07:46 AM