fix: stream generated media with byte ranges

[iamjr15]

Summary

• forwards browser byte-range requests directly to R2
• returns standards-compliant partial-content headers for native media playback and seeking
• preserves an explicit cross-origin resource policy only for signed output streams while all other gateway responses remain same-origin
• documents the output-serving and gateway security contracts

Architecture

The signed gateway capability remains the only public artifact URL. The gateway forwards the request headers over its service binding; the agent worker validates the capability and ownership, asks R2 for the requested range, then streams that body with 206, Content-Range, Content-Length, Accept-Ranges, and ETag metadata.

Decisions

Decision	Choice	Reasoning
Range source	R2 binding range support	Keeps media streaming zero-copy and avoids buffering artifacts in Worker memory
Resource policy	Explicit cross-origin only on signed artifact streams	Enables trycheatcode.com to render gateway.trycheatcode.com media without weakening every API response
URL model	Reuse the existing signed download capability	Preview and download retain one ownership-checked source of truth

Verification

• pnpm lint
• pnpm typecheck
• pnpm turbo build --force
• pnpm deadcode
• pnpm architecture:check
• pnpm turbo skills:build
• production acceptance: verify a single-range request returns 206 and only the requested bytes
• production acceptance: play and seek the existing 4-second generated MP4 in the Deliverables card
• production acceptance: inspect desktop and narrow double-shell layout, Files opening, and browser console

[vercel]

The latest updates on your projects. Learn more about Vercel for GitHub.

1 Skipped Deployment

Project	Deployment	Actions	Updated (UTC)
cheatcode	Skipped		Aug 13, 2026 10:34am