Every clip answers only to its owner.
WAVE's media delivery origin. Public clips stream openly from the edge; private clips open only for a signature bound to one tenant, one path, one deadline — then the link is dead. No origin server, no bucket that leaks.
One leaky bucket is all it takes.
A raw storage domain exposes every object — one guessed URL spills every customer's media. WAVE Media flips that default. The moment a clip renders it is already tenant-locked. A private share link works for exactly one clip, one tenant, until exactly one deadline — and after that it opens nothing. You never stand up a server; the edge is the gate.
The gate is the delivery path, not a bolt-on.
WAVE Media is a Cloudflare Worker in front of the wave-clips R2 bucket — deliberately not a raw R2 public domain, which would serve every object with no per-tenant check. Public clips stream openly under an unguessable UUID, cached immutable at the edge. Private clips are served only against an HMAC-SHA256 signature minted over the exact request path plus an expiry, verified at the edge with a constant-time compare and bound to the org — so it can't be replayed for another tenant or after it expires. The signing module is shared byte-for-byte with the clip engine, and the cross-worker contract is pinned by tests.
One contract across the fabric.
This is the delivery plane of WAVE Clips. The same signing key the clip engine mints against is the key this origin verifies against — one contract, published as a did:web identity (did:web:media.wave.online, controlled by did:web:wave.online). Every media surface WAVE produces inherits the same tenant isolation and edge delivery for free.
Federated — auth, entitlement, and metering run through api.wave.online; this spoke verifies signatures and delivers the bytes.