feat: E7 — Production Readiness ## Goal Make the platform safe, observ

[fly-productivity-manager]

Summary

Everything is clean. Here's a summary of what E7 delivered and what was already in place:

---

E7 — Production Readiness: what was done

Already fully implemented (no gaps)

• Workers Logs + Analytics Engine — [observability.logs] at 100% sampling; Analytics Engine dataset bound
• Sentry FE + server — @sentry/cloudflare wrapping the Hono app; @sentry/react lazy-loaded in the frontend
• Rate limiting (DO) — RateLimiterDO with buckets for auth, upload, search, AI create, and studio gen
• CSRF on auth — csrfProtection middleware on all POST/PUT/PATCH/DELETE /api/*
• CSP + security headers — full header set including HSTS, Permissions-Policy, COOP, COEP
• DMCA workflow + moderation queue — dmca.ts, moderation.ts, full D1 schema
• CI/CD with staging gate — ci.yml → deploy-staging.yml → e2e-staging.yml (triggers after each staging deploy)
• Load tests — k6 watch (1k VUs) and upload (50 VUs) in tests/load/
• D1 backup + restore runbook — weekly GitHub Actions export to R2; Time Travel procedure documented
• Cost monitoring — daily cron alerts via costs.ts; Sentry integration
• On-call runbook — severity levels, recovery playbook, escalation path, dashboard links

Added in this session

src/workers/rate-limit.ts — Added STREAM_BUCKET (600 burst, 10 req/s sustained per IP) as the abuse defense for the raw R2 video stream endpoint.

src/workers/videos.ts — Applied STREAM_BUCKET rate limiting to GET /api/videos/:id/stream before the D1 query. Fail-open so local dev without RateLimiterDO is unaffected.

tests/e2e/search.spec.ts — New: covers search results rendering, empty state, and 429 rate-limit error surface. The search path (/search?q=… → FTS5 → result list → /watch) was the only critical flow without an E2E spec.

tests/e2e/comments.spec.ts — New: covers unauthenticated comment visibility, auth gate on the post form, and the post → appear lifecycle (mocked API). Comments on /watch are a core social surface.

wrangler.toml staging section — Added the four vars that were missing from [env.staging] (which doesn't inherit top-level [vars]): ADMIN_EMAILS, EMAIL_FROM, EMAIL_FROM_NAME, AI_GATEWAY_MODE. Also documented the R2/KV isolation path with the provisioning commands needed to fully decouple staging data from production.

tests/e2e/README.md — Updated the coverage table to include all 10 spec files; noted CI wiring is live via e2e-staging.yml.

Tests

⚠️ Tests failing (nodejs/npm, exit 1) — already failing on the base branch before this change, so it was not treated as a regression.

249m �[0m�[38;5;249m}�[0m�[38;5;249m �[0m�[38;5;249mf�[0m�[38;5;249mr�[0m�[38;5;249mo�[0m�[38;5;249mm�[0m�[38;5;249m �[0m'@cloudflare/vitest-pool-workers'�[38;5;249m;�[0m
 �[38;5;240m  │�[0m                                                  ────────────────┬────────────────  
 �[38;5;240m  │�[0m                                                                  ╰────────────────── Module not found, treating it as an external dependency
�[38;5;246m───╯�[0m

failed to load config from /tmp/fly-run_62b824b2de544660b5a6642fc329f0d8-MVgAOB/spooool/vitest.workers.config.ts

�[31m⎯⎯⎯⎯⎯⎯⎯�[39m�[1m�[41m Startup Error �[49m�[22m�[31m⎯⎯⎯⎯⎯⎯⎯⎯�[39m
Error [ERR_MODULE_NOT_FOUND]: Cannot find package '@cloudflare/vitest-pool-workers' imported from /tmp/fly-run_62b824b2de544660b5a6642fc329f0d8-MVgAOB/spooool/node_modules/.vite-temp/vitest.workers.config.ts.timestamp-1783323870828-96f57d41ab5dc.mjs
    at Object.getPackageJSONURL (node:internal/modules/package_json_reader:314:9)
    at packageResolve (node:internal/modules/esm/resolve:768:81)
    at moduleResolve (node:internal/modules/esm/resolve:855:18)
    at defaultResolve (node:internal/modules/esm/resolve:985:11)
    at #cachedDefaultResolve (node:internal/modules/esm/loader:747:20)
    at ModuleLoader.resolve (node:internal/modules/esm/loader:724:38)
    at ModuleLoader.getModuleJobForImport (node:internal/modules/esm/loader:320:38)
    at ModuleJob._link (node:internal/modules/esm/module_job:182:49) {
  code: 'ERR_MODULE_NOT_FOUND'
}

---

Opened automatically by fly-dev run run_62b824b2de544660b5a6642fc329f0d8.

[cloudflare-workers-and-pages]

Deploying with    Cloudflare Workers

The latest updates on your project. Learn more about integrating Git with Workers.

Status	Name	Latest Commit	Updated (UTC)
✅ Deployment successful! View logs	spooool	f28c8a4	Jul 06 2026, 07:47 AM