From vivreal-infra
Use when working with Vivreal media / images / file uploads at the infra level — S3 bucket naming, presigned upload URLs, the CloudFront CDN (media.vivreal.io) and signed-URL generation, the media-router Lambda, the SignedUrlTtlSeconds cache-invalidation lever, or the array-signing latent-bug class where galleries silently come back unsigned. Use when an image 403s, a signed URL expired, media isn't loading on a customer site, or you need to know which bucket a group's media lives in. Triggers on: media, image not loading, S3 bucket, presigned URL, presignUpload, CloudFront, signed URL, media.vivreal.io, signCloudFrontUrl, buildMediaUrl, SignedUrlTtlSeconds, CDN, bucketname, vivreal- bucket, gallery not signed, MediaRouter, FFmpeg.
How this skill is triggered — by the user, by Claude, or both
Slash command
/vivreal-infra:vivreal-media-cdnThe summary Claude sees in its skill listing — used to decide when to auto-load this skill
How media is stored, uploaded, and delivered across the stack. Bytes live in **S3**, metadata in Mongo, delivery via **CloudFront signed URLs**.
How media is stored, uploaded, and delivered across the stack. Bytes live in S3, metadata in Mongo, delivery via CloudFront signed URLs.
vivreal-{group.key} (e.g. group key thecomedycollective → bucket vivreal-thecomedycollective). group.key is the URL slug — NOT dbKey (which is the database name general_shared/pro_plus). Confusing them is a classic bug (see vivreal-db).${group.type}-${group.key} as the S3 path prefix / bucketname (e.g. collection-thecomedycollective).arn:aws:s3:::vivreal-* via Vivreal-Client-S3-Access. New buckets are created fully locked (BlockPublicAcls/IgnorePublicAcls/BlockPublicPolicy/RestrictPublicBuckets: true) + a CloudFront OAC bucket policy — public read ONLY through the CDN, never direct S3.mediafiles collection). Deleting a doc deletes the S3 objects + decrements mainDb.groups.mediaUsage.POST /tenant/presignUpload (handleMedia Lambda). The portal proxies this via /api/proxy/uploadFiles → /tenant/presignedUploadUrl.fetch, never through a Lambda — keeps bytes off the 30s/6MB Lambda path).FFMPEG_ARN in hb-api-secrets, must be arm64 — see vivreal-lambda).media.vivreal.io with signed URLs.buildMediaUrl.js constructs the CDN URL → signCloudFrontUrl.js signs it with the CloudFront key pair. resolveMediaUrl.js is the entry point.vivreal-cdn-kg; private key in Secrets Manager (CLOUDFRONT_SIGNING_PRIVATE_KEY + CLOUDFRONT_SIGNING_KEY_PAIR_ID).signCloudFrontUrl.js gracefully falls back to unsigned if signing fails (wrong key type / missing config) — so "media loads but isn't signed" can hide a signing-config error. Check the signing key pair if URLs come back unsigned.Vivreal_Media_CDN_* / MediaRouterFn) fronts CDN media routing in AWS.The signed-URL / CloudFront TTL is parameterized (CLOUDFRONT_SIGNED_URL_TTL_SECONDS / SignedUrlTtlSeconds, default 300 = inert). Raising it (live value 86400 = 24h) is "cache-invalidation step A" — longer TTL = better cache hit rate / fewer re-signs. It must be passed in the deploy --parameter-overrides (the default is intentionally short so deploys don't accidentally lengthen it).
A media-signing pattern keyed on targetField.name silently no-ops on ARRAY fields — galleries (arrays of media) come back unsigned even though single-media fields work. This bug lived in 5 duplicate copies (3 inline + 2 helpers) in VR_Client_API before a shared-helper refactor (fixed 2026-05-27). Paired hazard: a mimeType-required looksLikeMediaItem check that drops items missing mimeType. When media in a gallery/array isn't signed but single images are, suspect this class. (For the array-signing analog in the portal renderer, see vivreal-renderer-knowledge.)
signCloudFrontUrl config + the key pair in Secrets Manager.vivreal-{group.key} (look up group.key in mainDb groups, NOT dbKey).VR_Client_API/CLAUDE.md (Media URLs / CloudFront sections), VR_CMS_API/CLAUDE.md (handleMedia / presignUpload / S3). Memory: insight_client_api_array_signing_5_copies.md, project_lambda_concurrency_reallocation.md (SignedUrlTtlSeconds step A).
npx claudepluginhub hillbombcreations/vivreal-skills --plugin vivreal-infraProvides CDSS development patterns for drug interaction checking, dose validation, clinical scoring (NEWS2, qSOFA), and alert classification integrated into EMR workflows.