@entrinsik/vite-plugin-informer 2.7.0 → 2.10.0

package/src/index.js

@@ -1,13 +1,70 @@
-import { existsSync } from 'node:fs';
+import { existsSync, readFileSync } from 'node:fs';
+import { parse as parseYaml } from 'yaml';
 import { readFile, writeFile, mkdir } from 'node:fs/promises';
 import { resolve } from 'node:path';
 import { createClient } from './client.js';
-import { loadDependencies, validateDependencies, validateDevBindings, resolveAppBinding } from './dev-dependencies.js';
+import { loadDependencies, loadChannels, validateDependencies, validateDevBindings, resolveAppBinding } from './dev-dependencies.js';
 import { buildDeclarations } from './openapi-to-dts.js';
 import { loadEnv, envWritePath } from './env.js';
 import { createMiddleware as createServerRoutes } from './server-routes.js';
 import { createAgentMiddleware } from './agent-dev.js';
+import { createDevChannels, validateChannels, BROADCAST_EVENT, DEV_CHANNEL_EVENT } from './dev-channels.js';
+import { renderDevChannelScript } from './dev-channel-shim.js';
+import { createStreamStore, createUploadsMiddleware, createDownloadsMiddleware } from './dev-streams.js';
+import { streamsClientSource } from './streams-client.js';
 import { init, migrate } from './workspace.js';
+import { devPlatform } from './dev-platform.js';
+
+/**
+ * The dev `window.__INFORMER__` context: defaults overlaid with the plugin's
+ * `mock` option. Shared by the page injection and the dev channels hub (whose
+ * frames carry `report.id` as the app id).
+ */
+function buildMock(options) {
+    return {
+        report: {
+            id: 'dev-local',
+            name: 'Local Development'
+        },
+        theme: 'light',
+        roles: [],
+        // The viewer identity the server injects (window.__INFORMER__.user);
+        // override with mock.user to test @user/<username> channels as someone else.
+        user: { username: 'dev', displayName: 'Local Developer' },
+        ...options.mock,
+        // What the platform offers, as the server injects it; a mock
+        // override merges into the dev defaults (see dev-platform.js).
+        platform: devPlatform(options.mock && options.mock.platform)
+    };
+}
+
+/**
+ * Occupied-spot check for the dev /api mount: does informer.yaml's
+ * access.apis declare this method+path? Mirrors the server's matchWhitelist
+ * semantics — segment-aware, `*` matches exactly one segment.
+ */
+function manifestOccupies (projectRoot, req) {
+    let entries;
+    try {
+        const raw = parseYaml(readFileSync(resolve(projectRoot, 'informer.yaml'), 'utf8')) || {};
+        entries = (raw.access && Array.isArray(raw.access.apis)) ? raw.access.apis : [];
+    } catch {
+        return false; // no/invalid manifest: nothing is occupied
+    }
+    // Connect strips the mount prefix, so re-add it for whole-path matching.
+    const path = `/api${(req.url || '').split('?')[0]}`;
+    const segments = path.split('/').filter(Boolean);
+    const method = (req.method || 'GET').toUpperCase();
+    return entries.some(entry => {
+        const spec = typeof entry === 'string'
+            ? entry
+            : `${(entry && entry.method) || 'GET'} ${(entry && (entry.url || entry.path)) || ''}`;
+        const parsed = /^([A-Za-z]+)\s+(\S+)$/.exec(String(spec).trim());
+        if (!parsed || parsed[1].toUpperCase() !== method) return false;
+        const want = parsed[2].split('/').filter(Boolean);
+        return want.length === segments.length && want.every((s, i) => s === '*' || s === segments[i]);
+    });
+}
 
 /**
  * Write generated app-dependency type declarations under .informer/ and keep the
@@ -39,7 +96,8 @@ async function writeAppDepTypes (projectRoot, dts) {
  *
  * - Proxies /api requests to the Informer server with Basic auth
  * - Runs server/ route handlers locally via ssrLoadModule (if server/ dir exists)
- * - Injects window.__INFORMER__ context mock in dev mode
+ * - Injects window.__INFORMER__ context mock in dev mode, including a
+ *   `channel()` mock fed by handler broadcast() over Vite's dev websocket
  * - Sets base to './' so built assets use relative paths
  *
  * @param {Object} [options]
@@ -101,7 +159,12 @@ export default function informer(options = {}) {
                                     Authorization: authHeader
                                 },
                                 ...options.proxy
-                            }
+                            },
+                            // NOTE: no /informer-api mount. The server
+                            // retired that spelling — /api is ONE namespace
+                            // with manifest-driven precedence (a whitelisted
+                            // access.apis path OCCUPIES its spot; everything
+                            // else is the app's own routes), mirrored below.
                         }
                     };
                 }
@@ -185,6 +248,27 @@ export default function informer(options = {}) {
             for (const message of validateDevBindings(deps, options.devBindings || {})) {
                 console.error(`[informer] vite.config.js: ${message}`);
             }
+            // Same for the `channels:` relay block — the deploy 400s on a bad
+            // channel or event name; say so now instead of dropping relays.
+            try {
+                for (const message of validateChannels(await loadChannels(projectRoot))) {
+                    console.error(`[informer] informer.yaml: ${message}`);
+                }
+            } catch (err) {
+                console.warn(`[informer] Could not read informer.yaml channels: ${err.message}`);
+            }
+
+            // App Channels in dev. Handlers' broadcast() (and the `channels:`
+            // relay behind emit()) publish frames on this hub; each frame goes
+            // to the page as a custom event on Vite's own dev websocket, which
+            // the injected `__INFORMER__.channel` mock listens to via
+            // import.meta.hot. Riding the HMR socket means no second websocket,
+            // no `ws: true` on the /api proxy and no socket credential to mint
+            // — the dev server already owns a live connection to every page.
+            const channels = createDevChannels({ appId: buildMock(options).report.id });
+            channels.emitter.on(BROADCAST_EVENT, (frame) => {
+                server.ws.send({ type: 'custom', event: DEV_CHANNEL_EVENT, data: frame });
+            });
 
             // Generate .d.ts types for bound `target: app` / `target: pack`
             // deps from their published OpenAPI docs, so server/ handlers get
@@ -249,6 +333,16 @@ export default function informer(options = {}) {
                 console.warn(`[informer] app-dependency type generation skipped: ${err.message}`);
             }
 
+            // App streams (I5-12979): the dev origin's /_uploads and /_downloads
+            // — the same protocol the deployed app speaks on its own origin —
+            // backed by one in-memory store the server routes' `uploads` /
+            // `downloads` services share. Mounted regardless of server/: the
+            // client helper is always on __INFORMER__, so a page may stage an
+            // upload before any handler exists to consume it.
+            const streamStore = createStreamStore();
+            server.middlewares.use('/_uploads', createUploadsMiddleware(streamStore));
+            server.middlewares.use('/_downloads', createDownloadsMiddleware(streamStore));
+
             // Mount server-side route handlers if a server/ directory exists
             const serverDir = resolve(projectRoot, 'server');
 
@@ -259,14 +353,31 @@ export default function informer(options = {}) {
                     devWorkspaceId,
                     projectRoot,
                     roles: (options.mock && options.mock.roles) || [],
+                    user: buildMock(options).user,
                     // Dev-only bindings for `target: app` / `target: pack`
                     // slots (app: overrides the manifest defaultBinding; pack:
                     // names the locally-installed pack app). Shape:
                     //   devBindings: { kanban: { app: 'admin:kanban' } }
                     devBindings: options.devBindings || {},
-                    appToken
+                    appToken,
+                    channels,
+                    streamStore
                 });
                 server.middlewares.use('/api/_server', serverRoutes);
+                // Occupied-spot precedence (App API v2, matches production
+                // dispatch in view-api.js): a platform API declared in
+                // informer.yaml's access.apis OCCUPIES its /api path — those
+                // requests skip the local handlers (next() falls through to
+                // the /api proxy above); every unclaimed path dispatches the
+                // app's own routes. The manifest is re-read per request so
+                // edits apply without a restart. Dev limitation: only raw
+                // access.apis entries are consulted (dependency-derived
+                // grants proxy through their typed context slots anyway).
+                // /api/_server stays as the legacy exclusive spelling.
+                server.middlewares.use('/api', (req, res, next) => {
+                    if (manifestOccupies(projectRoot, req)) return next();
+                    return serverRoutes(req, res, next);
+                });
             }
 
             // Mount agent dev middleware if tools/, mcp/, or informer.yaml agents exist
@@ -281,7 +392,8 @@ export default function informer(options = {}) {
                     devWorkspaceId,
                     projectRoot,
                     devBindings: options.devBindings || {},
-                    appToken
+                    appToken,
+                    channels
                 });
                 server.middlewares.use('/api/_agent', agentDev);
             }
@@ -293,22 +405,25 @@ export default function informer(options = {}) {
             handler(html) {
                 if (!isDev) return html;
 
-                const mock = {
-                    report: {
-                        id: 'dev-local',
-                        name: 'Local Development'
-                    },
-                    theme: 'light',
-                    roles: [],
-                    ...options.mock
-                };
+                const mock = buildMock(options);
 
+                // The context is a classic script (synchronous, so it exists
+                // before anything else runs). The streams client (upload /
+                // downloadUrl) rides inside it: the one piece of the mock that is
+                // code, not data, the same helper the deployed page gets,
+                // speaking to the /_uploads and /_downloads mounted in
+                // configureServer. The channel mock follows as a module script
+                // because only a Vite-processed module gets import.meta.hot.
                 const script = `<script>
 (function() {
     'use strict';
     window.__INFORMER__ = ${JSON.stringify(mock)};
+    var __streams = ${streamsClientSource()};
+    window.__INFORMER__.upload = __streams.upload;
+    window.__INFORMER__.downloadUrl = __streams.downloadUrl;
 })();
-</script>`;
+</script>
+${renderDevChannelScript({ hub: Boolean(serverOrigin) })}`;
 
                 // Insert after <head> tag, matching server behavior
                 const headIdx = html.indexOf('<head>');

package/src/server-routes.js

@@ -1,7 +1,18 @@
 import { readdir, stat } from 'node:fs/promises';
 import { join, relative, posix } from 'node:path';
 import { parse as parseUrl } from 'node:url';
-import { loadDependencies, buildDevContext, loadAppEnv, buildDevCrypto, buildDevMessaging, normalizeFetchPath } from './dev-dependencies.js';
+import { loadManifest, manifestBlock, buildDevContext, buildDevCrypto, buildDevMessaging, normalizeFetchPath } from './dev-dependencies.js';
+import { createDevChannels, createDevEmit } from './dev-channels.js';
+import { devPlatform } from './dev-platform.js';
+import { createStreamStore, createStreamServices, isStreamRef, serveDownload as serveDevDownload } from './dev-streams.js';
+
+// embed() is present on a real install even without the embeddings
+// capability, where it throws a written explanation. Mirroring that here
+// keeps the dev failure the same lesson as the deployed one, instead of a
+// bare "embed is not a function" that reads like a missing binding.
+const embed = async () => {
+    throw new Error('embed() is not available in the dev mirror: the embeddings capability needs a real Informer (platform.capabilities.embeddings is false)');
+};
 
 const VALID_METHODS = ['GET', 'POST', 'PUT', 'PATCH', 'DELETE'];
 
@@ -170,10 +181,24 @@ async function walkJsFiles(dir, basePath) {
  * @param {string[]} [opts.roles] - dev user roles surfaced on request.roles
  * @param {Object} [opts.devBindings] - dev bindings for `target: app` deps
  * @param {string|null} [opts.appToken] - INFORMER_APP_TOKEN for cross-app request()
+ * @param {ReturnType<typeof createDevChannels>} [opts.channels] - the dev channels hub
+ *   behind `broadcast()` and the `channels:` relay (a private one when omitted)
+ * @param {Object} [opts.streamStore] - dev stream store shared with the /_uploads
+ *   and /_downloads middleware (createStreamStore()); a private one when omitted
  * @returns {Function} Connect middleware
  */
-export function createMiddleware(viteServer, { serverOrigin, authHeader, devWorkspaceId, projectRoot, roles, devBindings, appToken }) {
+export function createMiddleware(viteServer, { serverOrigin, authHeader, devWorkspaceId, projectRoot, roles, user, devBindings, appToken, channels = createDevChannels(), streamStore }) {
+    // The viewer identity dev handlers see — the same object the page gets as
+    // window.__INFORMER__.user, so `@user/${request.user.username}` on the
+    // server names the channel the page subscribes to.
+    const devUser = {
+        username: (user && user.username) || 'dev',
+        displayName: (user && user.displayName) || 'Local Developer',
+        email: (user && user.email) || null,
+        timezone: (user && user.timezone) || null
+    };
     const serverDir = join(projectRoot, 'server');
+    const streams = streamStore || createStreamStore();
 
     // query() implementation — proxies to the workspace _sql endpoint
     async function query(sql, params) {
@@ -323,12 +348,6 @@ export function createMiddleware(viteServer, { serverOrigin, authHeader, devWork
             // markdown helper — passthrough in dev (production uses `marked`)
             const markdown = (text) => text;
 
-            // emit helper — no-op in dev (logs to console)
-            const emit = (event, payload) => {
-                console.log(`[app-event] emit("${event}",`, JSON.stringify(payload), ')');
-                return { ok: true };
-            };
-
             // notify/email — delivery is a console-logged no-op in dev, but the
             // required-field validation mirrors prod so an app that passes here
             // won't 500 in production.
@@ -344,18 +363,43 @@ export function createMiddleware(viteServer, { serverOrigin, authHeader, devWork
                 rawBody,
                 headers: req.headers,
                 roles: roles || [],
-                user: {
-                    username: 'dev-user',
-                    displayName: 'Dev User',
-                    email: null,
-                    timezone: null
-                }
+                user: { ...devUser }
             };
 
-            // respond() — sends early response, handler continues in background
+            // App streams (I5-12979): per-invocation uploads/downloads services.
+            // An upload handle passed as a query() parameter is swapped for a
+            // \x bytea literal on the way to the _sql proxy (prod passes the
+            // bytes as a Buffer parameter — same column-typed coercion).
+            const streamServices = createStreamServices({ store: streams, query: devWorkspaceId ? query : null });
+            const streamQuery = async (sql, params) => await query(sql, await streamServices.resolveQueryParams(params || []));
+
+            // Serve a download handle as the response, like view-api.js does
+            // when a handler returns one (single-use, prod headers).
+            function serveDownloadHandle(ref) {
+                const item = streams.get('download', ref.id);
+                if (!item) throw new Error(`Unknown download ${ref.id} — was it discarded?`);
+                // Do NOT force complete: production 404s an unsealed download
+                // (app-streams.js#serveDownload), so forcing it here would hide
+                // a half-written download that fails once deployed.
+                if (!item.complete) {
+                    throw new Error(`Download ${ref.id} was never ended — call end() (or return it) before serving it.`);
+                }
+                serveDevDownload(streams, item, res);
+            }
+
+            // respond() — sends early response, handler continues in background.
+            // respond(download) streams the staged bytes instead of JSON.
             let responded = false;
-            function respond(earlyBody) {
+            async function respond(earlyBody) {
                 if (responded) return;
+                if (isStreamRef(earlyBody, 'download')) {
+                    // Seal it first, as production does (app-sandbox.js
+                    // respondCallback), then claim the response — not before,
+                    // or a failure here would leave the request unanswered.
+                    await streamServices.endDownload(earlyBody.id);
+                    responded = true;
+                    return serveDownloadHandle(earlyBody);
+                }
                 responded = true;
                 res.statusCode = 200;
                 res.setHeader('Content-Type', 'application/json');
@@ -364,18 +408,32 @@ export function createMiddleware(viteServer, { serverOrigin, authHeader, devWork
 
             // Build the dependency-injection context the same way the prod
             // sandbox does, so handlers using `await context.myDep.method(...)`
-            // work locally. Loaded per request so edits to informer.yaml take
-            // effect without a dev-server restart.
-            const deps = await loadDependencies(projectRoot);
+            // work locally. The manifest is parsed once per request (deps, env
+            // and channels all come from that one read) so edits to
+            // informer.yaml take effect without a dev-server restart.
+            const manifest = await loadManifest(projectRoot);
+            const deps = manifestBlock(manifest, 'dependencies');
             const context = buildDevContext({ deps, apiFetch, devBindings, appFetch });
-            const env = await loadAppEnv(projectRoot);
+            const env = manifestBlock(manifest, 'env');
+
+            // emit() writes no app_event row in dev, but still relays a listed
+            // event to its `channels:` channel; broadcast() publishes a live
+            // frame to the page (see dev-channels.js).
+            const emit = createDevEmit({ channels, manifestChannels: manifestBlock(manifest, 'channels'), logPrefix: '[app-event]' });
+            const { broadcast } = channels;
 
             // Call handler — bag mirrors the prod sandbox (see app-sandbox.js).
-            const result = await handler({ request, context, query, fetch: apiFetch, respond, emit, notify, email, crypto: cryptoHelper, markdown, log, env });
+            const result = await handler({ request, context, query: streamQuery, fetch: apiFetch, respond, emit, broadcast, notify, email, embed, crypto: cryptoHelper, markdown, uploads: streamServices.uploads, downloads: streamServices.downloads, log, env, platform: devPlatform() });
+
+            // Seal any download the handler left open (prod finalizes the same way).
+            await streamServices.finalize();
 
             // If respond() was already called, the response is already sent
             if (responded) return;
 
+            // A returned download handle streams as the response.
+            if (isStreamRef(result, 'download')) return serveDownloadHandle(result);
+
             // Normalize response (mirrors app-sandbox.js buildInvokeScript logic).
             // The encoding allow-list and contract checks are enforced inside the
             // ivm in production; replicate them here so handlers see the same

package/src/streams-client.js

@@ -0,0 +1,200 @@
+/**
+ * Dev copy of the injected app streams client (I5-12979):
+ * `__INFORMER__.upload(file, opts)` and `__INFORMER__.downloadUrl(id, filename)`.
+ *
+ * VERBATIM copy of modules/app/routes/lib/html-utils.js#generateStreamsHelper
+ * in its origin-mode form (base "", plain window.fetch / XHR transport — the
+ * dev server IS the app's origin, so the same-origin /_uploads and /_downloads
+ * middleware serves it). The plugin cannot import the server module (different
+ * runtime, no dependency), so the copy is pinned byte-for-byte by
+ * test/streams-parity.test.js: change the protocol or retry policy there, and
+ * that test says exactly what to paste here. The dev page must upload the way
+ * a deployed one does.
+ *
+ * @returns {string} JavaScript expression evaluating to { upload, downloadUrl }
+ */
+export function streamsClientSource() {
+    return `(function (base, transport) {
+        var DEFAULTS = { chunkSize: 4 * 1024 * 1024, concurrency: 3, retries: 5 };
+
+        function delay (ms) { return new Promise(function (resolve) { setTimeout(resolve, ms); }); }
+        function backoff (attempt) { return Math.min(8000, 500 * Math.pow(2, attempt)) * (0.5 + Math.random()); }
+        function retryable (status) { return status === 0 || status === 408 || status === 429 || status >= 500; }
+        function httpError (status, data, fallback) {
+            var err = new Error((data && (data.message || data.error)) || fallback || ('HTTP ' + status));
+            err.status = status;
+            err.data = data && data.data;
+            return err;
+        }
+
+        function json (method, url, body) {
+            var opts = { method: method, credentials: 'same-origin', headers: {} };
+            if (body !== undefined) { opts.headers['Content-Type'] = 'application/json'; opts.body = JSON.stringify(body); }
+            return transport.fetch(url, opts).then(function (res) {
+                return res.text().then(function (text) {
+                    var data = null;
+                    try { data = text ? JSON.parse(text) : null; } catch (e) { data = text; }
+                    if (!res.ok) throw httpError(res.status, data);
+                    return data;
+                });
+            });
+        }
+
+        // XHR rather than fetch for the chunk body: byte-level upload progress
+        // events and a synchronous abort.
+        function putChunk (url, blob, signal, onProgress) {
+            return new Promise(function (resolve, reject) {
+                var xhr = new XMLHttpRequest();
+                transport.open(xhr, 'PUT', url);
+                xhr.setRequestHeader('Content-Type', 'application/octet-stream');
+                xhr.withCredentials = true;
+                // Without this, ontimeout can never fire and a half-open socket
+                // (VPN drop, laptop sleep, an idle reap with no RST) leaves the
+                // promise pending forever. Allows ~8 KB/s before giving up, so a
+                // genuinely slow link retries rather than stalls.
+                xhr.timeout = Math.max(60000, Math.ceil(blob.size / 8));
+                if (xhr.upload && onProgress) {
+                    xhr.upload.onprogress = function (e) { if (e.lengthComputable) onProgress(e.loaded); };
+                }
+                xhr.onload = function () {
+                    if (xhr.status >= 200 && xhr.status < 300) return resolve();
+                    var data = null;
+                    try { data = xhr.responseText ? JSON.parse(xhr.responseText) : null; } catch (e) { data = null; }
+                    reject(httpError(xhr.status, data, 'Chunk upload failed: HTTP ' + xhr.status));
+                };
+                xhr.onerror = function () { reject(httpError(0, null, 'Network error during chunk upload')); };
+                xhr.ontimeout = function () { reject(httpError(408, null, 'Chunk upload timed out')); };
+                xhr.onabort = function () { var err = new Error('Upload aborted'); err.code = 'aborted'; reject(err); };
+                if (signal) {
+                    if (signal.aborted) { xhr.abort(); return; }
+                    signal.addEventListener('abort', function () { xhr.abort(); });
+                }
+                xhr.send(blob);
+            });
+        }
+
+        // Name + length + mtime. Enough to stop a different file being spliced
+        // into a resumed upload; not a checksum, which would mean reading the
+        // whole file in the page before the first byte goes out.
+        function fingerprintOf (file, opts) {
+            return [opts.filename || file.name || '', file.size, file.lastModified || 0].join(':');
+        }
+
+        function upload (file, opts) {
+            opts = opts || {};
+            if (!file || typeof file.slice !== 'function' || typeof file.size !== 'number') {
+                return Promise.reject(new Error('upload(file): a File or Blob is required'));
+            }
+            var controller = new AbortController();
+            if (opts.signal) {
+                // An already-aborted signal never fires 'abort' — mirror its state now.
+                if (opts.signal.aborted) controller.abort();
+                else opts.signal.addEventListener('abort', function () { controller.abort(); });
+            }
+            var signal = controller.signal;
+            var retries = opts.retries != null ? opts.retries : DEFAULTS.retries;
+            var concurrency = Math.max(1, opts.concurrency || DEFAULTS.concurrency);
+            var task = { id: opts.resume || null, abort: function () { controller.abort(); } };
+            var loaded = {};
+
+            function progress () {
+                if (typeof opts.onProgress !== 'function') return;
+                var sum = 0;
+                for (var k in loaded) sum += loaded[k];
+                opts.onProgress({ loaded: sum, total: file.size, percent: file.size ? Math.min(100, Math.floor(sum * 100 / file.size)) : 100 });
+            }
+            function abortError () { var err = new Error('Upload aborted'); err.code = 'aborted'; return err; }
+
+            function sendChunk (meta, n, attempt) {
+                if (signal.aborted) return Promise.reject(abortError());
+                var start = (n - 1) * meta.chunkSize;
+                var blob = file.slice(start, Math.min(file.size, start + meta.chunkSize));
+                return putChunk(base + '/_uploads/' + meta.id + '/' + n, blob, signal, function (sent) { loaded[n] = sent; progress(); })
+                    .then(function () { loaded[n] = blob.size; progress(); })
+                    .catch(function (err) {
+                        if (err.code === 'aborted' || signal.aborted) throw err;
+                        if (err.status === 404) { var gone = new Error('Upload expired before it completed'); gone.code = 'upload_expired'; gone.status = 404; throw gone; }
+                        if (!retryable(err.status) || attempt >= retries) throw err;
+                        return delay(backoff(attempt)).then(function () { return sendChunk(meta, n, attempt + 1); });
+                    });
+            }
+
+            function sendAll (meta, chunks) {
+                var next = 0;
+                function worker () {
+                    if (next >= chunks.length || signal.aborted) return Promise.resolve();
+                    var n = chunks[next++];
+                    return sendChunk(meta, n, 0).then(worker);
+                }
+                var workers = [];
+                for (var i = 0; i < Math.min(concurrency, chunks.length); i++) workers.push(worker());
+                return Promise.all(workers);
+            }
+
+            var plan = signal.aborted ? Promise.reject(abortError()) : opts.resume
+                ? json('GET', base + '/_uploads/' + encodeURIComponent(opts.resume)).then(function (meta) {
+                    // Size alone is not identity: two same-length files would be
+                    // spliced into one upload that completes without complaint.
+                    var fp = fingerprintOf(file, opts);
+                    if (meta.size !== file.size || (meta.fingerprint && meta.fingerprint !== fp)) {
+                        throw new Error('upload({ resume }): the file does not match the upload being resumed');
+                    }
+                    (meta.received || []).forEach(function (n) {
+                        loaded[n] = n < meta.chunks ? meta.chunkSize : meta.size - meta.chunkSize * (meta.chunks - 1);
+                    });
+                    return { meta: meta, chunks: meta.complete ? [] : (meta.missing || []) };
+                })
+                : json('POST', base + '/_uploads', {
+                    filename: opts.filename || file.name || 'upload',
+                    contentType: opts.contentType || file.type || undefined,
+                    size: file.size,
+                    fingerprint: fingerprintOf(file, opts),
+                    chunkSize: opts.chunkSize || DEFAULTS.chunkSize
+                }).then(function (meta) {
+                    var chunks = [];
+                    for (var n = 1; n <= meta.chunks; n++) chunks.push(n);
+                    return { meta: meta, chunks: chunks };
+                });
+
+            var promise = plan
+                .then(function (p) {
+                    task.id = p.meta.id;
+                    progress();
+                    return sendAll(p.meta, p.chunks).then(function () {
+                        if (signal.aborted) throw abortError();
+                        return json('POST', base + '/_uploads/' + p.meta.id + '/_complete');
+                    });
+                })
+                .then(function (handle) { progress(); return handle; })
+                .catch(function (err) {
+                    var aborted = err.code === 'aborted' || signal.aborted;
+                    // Promise.all rejects on the first failure but leaves the other
+                    // workers retrying with backoff; stop them before returning.
+                    controller.abort();
+                    if (task.id) {
+                        // Discard only on an explicit abort — the caller is done
+                        // with it. Any other failure keeps the staged chunks so
+                        // upload({ resume: err.uploadId }) can finish the job; the
+                        // TTL reclaims them if it never does.
+                        if (aborted) transport.fetch(base + '/_uploads/' + task.id, { method: 'DELETE', credentials: 'same-origin' }).catch(function () {});
+                        else err.uploadId = task.id;
+                    }
+                    throw err;
+                });
+
+            task.then = function (onFulfilled, onRejected) { return promise.then(onFulfilled, onRejected); };
+            task['catch'] = function (onRejected) { return promise['catch'](onRejected); };
+            task['finally'] = function (onFinally) { return promise['finally'](onFinally); };
+            return task;
+        }
+
+        function downloadUrl (id, filename) {
+            return base + '/_downloads/' + encodeURIComponent(id) + (filename ? '/' + encodeURIComponent(filename) : '');
+        }
+
+        return { upload: upload, downloadUrl: downloadUrl };
+    })("", {
+            fetch: function (url, opts) { return window.fetch(url, opts); },
+            open: function (xhr, method, url) { xhr.open(method, url); }
+        })`;
+}