@jami-studio/core 0.92.31 → 0.92.33

package/corpus/core/src/file-upload/types.ts

@@ -67,6 +67,15 @@ export interface FileUploadProvider {
    * during recording instead of assembling the full blob after stop().
    */
   resumable?: {
+    /**
+     * Provider-preferred chunk size in bytes. Servers surface this to upload
+     * clients so each relayed chunk maps to one provider part. S3-compatible
+     * multipart uploads require every part except the last to be >= 5 MiB
+     * (and R2 additionally requires uniform part sizes), so an S3-backed
+     * provider sets 5 MiB here while GCS-style providers can omit it and
+     * accept the client default.
+     */
+    preferredChunkBytes?: number;
     startSession(
       filename: string,
       mimeType: string,

package/corpus/core/src/shared/global-scope.ts

@@ -73,3 +73,35 @@ export function __deleteScopedGlobal(base: string): void {
   const key = Symbol.for(scopedGlobalKeyName(base));
   delete (globalThis as unknown as Record<symbol, unknown>)[key];
 }
+
+/**
+ * Per-module-graph env defaults for unified workspace deployments.
+ *
+ * workerd has no filesystem and no ambient build env, so per-app workspace
+ * config (app id, base path, audience, public/protected route lists) must be
+ * baked into the artifact. It CANNOT go through `process.env`: the unified
+ * worker shares ONE `process.env` across every app's module graph, so the
+ * first app's baked values would poison every sibling (the exact issue-35
+ * class the scope id above exists for — observed live as every app stripping
+ * paths against dispatch's base path, 401ing all framework routes).
+ *
+ * Instead the generated scope-init module stores this graph's per-app values
+ * here (module scope = per app bundle), and env readers fall back to
+ * `getModuleGraphEnvDefault` when the ambient env lacks the key. Real runtime
+ * env still wins; dev/single-app graphs never set defaults, so behavior is
+ * unchanged there.
+ */
+let moduleGraphEnvDefaults: Record<string, string> | null = null;
+
+/** Set (or clear with `null`) this module graph's baked env defaults. */
+export function setModuleGraphEnvDefaults(
+  defaults: Record<string, string> | null,
+): void {
+  moduleGraphEnvDefaults =
+    defaults && Object.keys(defaults).length > 0 ? { ...defaults } : null;
+}
+
+/** This module graph's baked default for `key`, or undefined. */
+export function getModuleGraphEnvDefault(key: string): string | undefined {
+  return moduleGraphEnvDefaults?.[key];
+}

package/corpus/core/src/shared/workspace-app-audience.ts

@@ -1,3 +1,5 @@
+import { getModuleGraphEnvDefault } from "./global-scope.js";
+
 export const WORKSPACE_APP_AUDIENCES = ["internal", "public"] as const;
 
 export type WorkspaceAppAudience = (typeof WORKSPACE_APP_AUDIENCES)[number];
@@ -48,7 +50,12 @@ export function workspaceAppAudienceFromEnv(
   const source = env ?? (typeof process !== "undefined" ? process.env : {});
   const raw =
     source.AGENT_NATIVE_WORKSPACE_APP_AUDIENCE ??
-    source.VITE_AGENT_NATIVE_WORKSPACE_APP_AUDIENCE;
+    source.VITE_AGENT_NATIVE_WORKSPACE_APP_AUDIENCE ??
+    // Unified workerd deployments deliver per-app config via the module
+    // graph (shared process.env would cross-poison sibling apps).
+    (env === undefined
+      ? getModuleGraphEnvDefault("AGENT_NATIVE_WORKSPACE_APP_AUDIENCE")
+      : undefined);
   if (raw === undefined) return undefined;
   return normalizeWorkspaceAppAudience(raw);
 }
@@ -57,14 +64,18 @@ export function workspaceAppRouteAccessFromEnv(
   env?: Record<string, string | undefined>,
 ): WorkspaceAppRouteAccess {
   const source = env ?? (typeof process !== "undefined" ? process.env : {});
+  const moduleGraphFallback = (key: string) =>
+    env === undefined ? getModuleGraphEnvDefault(key) : undefined;
   return {
     publicPaths: normalizeWorkspaceAppPathList(
       source.AGENT_NATIVE_WORKSPACE_APP_PUBLIC_PATHS ??
-        source.VITE_AGENT_NATIVE_WORKSPACE_APP_PUBLIC_PATHS,
+        source.VITE_AGENT_NATIVE_WORKSPACE_APP_PUBLIC_PATHS ??
+        moduleGraphFallback("AGENT_NATIVE_WORKSPACE_APP_PUBLIC_PATHS"),
     ),
     protectedPaths: normalizeWorkspaceAppPathList(
       source.AGENT_NATIVE_WORKSPACE_APP_PROTECTED_PATHS ??
-        source.VITE_AGENT_NATIVE_WORKSPACE_APP_PROTECTED_PATHS,
+        source.VITE_AGENT_NATIVE_WORKSPACE_APP_PROTECTED_PATHS ??
+        moduleGraphFallback("AGENT_NATIVE_WORKSPACE_APP_PROTECTED_PATHS"),
     ),
   };
 }

package/corpus/templates/analytics/changelog/2026-07-11-tracking-and-session-replay-ingest-endpoints-are-reachable-f.md

@@ -0,0 +1,6 @@
+---
+type: fixed
+date: 2026-07-11
+---
+
+Tracking and session-replay ingest endpoints are reachable from tracked sites without workspace sign-in

package/corpus/templates/analytics/package.json

@@ -3,6 +3,15 @@
   "displayName": "Agent-Native Analytics",
   "private": true,
   "type": "module",
+  "agent-native": {
+    "workspaceApp": {
+      "publicPaths": [
+        "/track",
+        "/api/analytics/track",
+        "/api/analytics/replay"
+      ]
+    }
+  },
   "scripts": {
     "dev": "DATABASE_URL=${ANALYTICS_DATABASE_URL:-file:./data/app.db} agent-native dev",
     "build": "agent-native build && tsx scripts/emit-netlify-dashboard-report-cron.ts",

package/corpus/templates/clips/actions/create-recording.ts

@@ -24,6 +24,7 @@ import {
 } from "../server/lib/recordings.js";
 import { setResumableSession } from "../server/lib/resumable-session.js";
 import { shouldEnableStreamingUpload } from "../server/lib/streaming-upload-mode.js";
+import { maxChunkUploadBytes } from "../server/lib/upload-chunk-limits.js";
 import { createRecordingSchema } from "./lib/create-recording-schema.js";
 import { DEFAULT_RECORDING_TITLE } from "./lib/title-source.js";
 
@@ -86,14 +87,24 @@ export default defineAction({
     // to the SQL chunk path when no provider supports resumable uploads or the
     // init fails.
     let uploadMode: UploadMode = "buffered";
+    let uploadChunkBytes: number | undefined;
     const uploadProvider = await getActiveFileUploadProviderForRequest();
+    const providerChunkBytes = uploadProvider?.resumable?.preferredChunkBytes;
+    const chunkBytesViable =
+      !providerChunkBytes || providerChunkBytes <= maxChunkUploadBytes();
+    if (providerChunkBytes && !chunkBytesViable) {
+      console.warn(
+        `[create-recording] provider ${uploadProvider?.id} needs ${providerChunkBytes}-byte chunks but this platform caps chunk POSTs at ${maxChunkUploadBytes()} bytes — falling back to buffered`,
+      );
+    }
     if (
       args.requestStreaming === true &&
       shouldEnableStreamingUpload({
         client: args.streamingUploadClient,
         mimeType: args.mimeType,
       }) &&
-      uploadProvider?.resumable
+      uploadProvider?.resumable &&
+      chunkBytesViable
     ) {
       try {
         const recordingMimeType =
@@ -120,6 +131,7 @@ export default defineAction({
           lastCommittedIndex: -1,
         });
         uploadMode = "streaming";
+        uploadChunkBytes = providerChunkBytes;
         console.log(
           `[create-recording] resumable session ready for ${id}: provider=${uploadProvider.id}`,
         );
@@ -140,6 +152,9 @@ export default defineAction({
       // Frontend substitutes {index}/{total}/{isFinal}
       uploadChunkUrlTemplate: `/api/uploads/${id}/chunk?index={index}&total={total}&isFinal={isFinal}`,
       uploadMode,
+      // Provider-preferred chunk size for streaming mode (e.g. S3 multipart
+      // needs uniform >=5 MiB parts). Clients slice on this boundary.
+      ...(uploadChunkBytes ? { uploadChunkBytes } : {}),
     };
   },
 });

package/corpus/templates/clips/app/components/recorder/recorder-engine.ts

@@ -548,6 +548,12 @@ export class RecorderEngine {
    */
   private uploadAbort: AbortController | null = null;
   private uploadMode: UploadMode = "buffered";
+  /**
+   * Server/provider-negotiated chunk size (from create-recording's
+   * `uploadChunkBytes`, e.g. 5 MiB for S3 multipart parts). Null = use the
+   * GCS-aligned STREAM_CHUNK_BYTES default.
+   */
+  private streamChunkBytes: number | null = null;
   /**
    * Streaming-path buffer. MediaRecorder blobs accumulate here until at least
    * STREAM_CHUNK_BYTES is available, then a 256 KiB-aligned slice is PUT to API
@@ -1124,11 +1130,17 @@ export class RecorderEngine {
     uploadUrl: string;
     abortUrl: string;
     uploadMode?: UploadMode;
+    uploadChunkBytes?: number;
   }): void {
     this.opts.recordingId = target.recordingId;
     this.opts.uploadUrl = target.uploadUrl;
     this.opts.abortUrl = target.abortUrl;
     this.opts.uploadMode = target.uploadMode ?? "buffered";
+    this.streamChunkBytes =
+      typeof target.uploadChunkBytes === "number" &&
+      target.uploadChunkBytes > 0
+        ? target.uploadChunkBytes
+        : null;
   }
 
   // -------------------------------------------------------------------------
@@ -1550,6 +1562,7 @@ export class RecorderEngine {
   private async resetUploadedChunks(
     compression: CompressionUploadMeta | null,
     signal?: AbortSignal,
+    mimeType?: string,
   ): Promise<void> {
     const resetUrl = `${appBasePath()}/api/uploads/${
       this.opts.recordingId
@@ -1559,7 +1572,10 @@ export class RecorderEngine {
       resetRes = await fetch(resetUrl, {
         method: "POST",
         headers: { "Content-Type": "application/json" },
-        body: JSON.stringify({ compression }),
+        body: JSON.stringify({
+          compression,
+          mimeType: mimeType ?? this.mimeType ?? undefined,
+        }),
         signal,
       });
     } catch (err) {
@@ -1583,6 +1599,26 @@ export class RecorderEngine {
         }). ${text || resetRes.statusText}`,
       );
     }
+    // The server may have re-initialized a fresh provider streaming session
+    // for the re-upload (remote-DB deployments cannot buffer chunks in SQL).
+    // Honor its negotiated mode/chunk size for the slicing pass that follows.
+    try {
+      const resetInfo = (await resetRes.json()) as {
+        uploadMode?: UploadMode;
+        uploadChunkBytes?: number;
+      } | null;
+      if (resetInfo?.uploadMode) {
+        this.opts.uploadMode = resetInfo.uploadMode;
+        this.uploadMode = resetInfo.uploadMode;
+        this.streamChunkBytes =
+          typeof resetInfo.uploadChunkBytes === "number" &&
+          resetInfo.uploadChunkBytes > 0
+            ? resetInfo.uploadChunkBytes
+            : null;
+      }
+    } catch {
+      // Older servers return no JSON body — keep the current mode.
+    }
   }
 
   // -------------------------------------------------------------------------
@@ -1670,7 +1706,11 @@ export class RecorderEngine {
             outputMimeType: compression.outputMimeType,
           }
         : null;
-      await this.resetUploadedChunks(compressionPayload, abort.signal);
+      await this.resetUploadedChunks(
+        compressionPayload,
+        abort.signal,
+        compression.outputMimeType,
+      );
 
       if (compressionError) {
         // Compression itself failed — we still hold the original assembled
@@ -1872,22 +1912,21 @@ export class RecorderEngine {
   }
 
   /**
-   * Drain the streaming buffer in 256 KiB-aligned chunks.
+   * Drain the streaming buffer in aligned chunks.
    * GCS rejects non-final resumable chunks that are not a multiple of 256 KiB,
-   * so we slice on STREAM_CHUNK_BYTES boundaries and carry the remainder. The
-   * leftover is uploaded as the final chunk on stop().
+   * so the default slices on STREAM_CHUNK_BYTES boundaries and carries the
+   * remainder; providers with their own part-size rules (S3 multipart needs
+   * uniform >=5 MiB parts) negotiate `streamChunkBytes` via create-recording.
+   * The leftover is uploaded as the final chunk on stop().
    */
   private flushAlignedStreamChunks(): void {
-    while (this.pendingStreamBytes >= STREAM_CHUNK_BYTES) {
+    const chunkBytes = this.streamChunkBytes ?? STREAM_CHUNK_BYTES;
+    while (this.pendingStreamBytes >= chunkBytes) {
       const combined = new Blob(this.pendingStreamBlobs, {
         type: this.mimeType,
       });
-      const head = combined.slice(0, STREAM_CHUNK_BYTES, this.mimeType);
-      const tail = combined.slice(
-        STREAM_CHUNK_BYTES,
-        combined.size,
-        this.mimeType,
-      );
+      const head = combined.slice(0, chunkBytes, this.mimeType);
+      const tail = combined.slice(chunkBytes, combined.size, this.mimeType);
       this.pendingStreamBlobs = tail.size > 0 ? [tail] : [];
       this.pendingStreamBytes = tail.size;
       const index = this.chunkIndex++;
@@ -1945,8 +1984,15 @@ export class RecorderEngine {
 
     // Keep binary uploads comfortably under Netlify's effective function
     // payload limit. This mirrors the local-file upload path in record.tsx.
-    const UPLOAD_SLICE_BYTES = 3 * 1024 * 1024;
-    const PARALLELISM = 4;
+    // Streaming mode uses the provider-negotiated part size instead (S3
+    // multipart needs uniform >=5 MiB parts) and MUST upload sequentially —
+    // the resumable chunk route advances provider offsets in index order.
+    const streaming = (this.opts.uploadMode ?? this.uploadMode) === "streaming";
+    const UPLOAD_SLICE_BYTES =
+      streaming && this.streamChunkBytes
+        ? this.streamChunkBytes
+        : 3 * 1024 * 1024;
+    const PARALLELISM = streaming ? 1 : 4;
     const totalSlices = Math.max(1, Math.ceil(blob.size / UPLOAD_SLICE_BYTES));
 
     const slices = Array.from({ length: totalSlices }, (_, i) => {

package/corpus/templates/clips/app/routes/record.tsx

@@ -1580,7 +1580,10 @@ export default function RecordRoute() {
               spaceIds: spaceIdFromUrl ? [spaceIdFromUrl] : undefined,
               folderId: folderIdFromUrl ?? undefined,
               mimeType: uploadMimeType,
-              requestStreaming: false,
+              // Streaming lets deployments without SQL chunk scratch (remote
+              // DB + S3-compatible storage) relay chunks straight to the
+              // provider. The server decides; buffered stays the fallback.
+              requestStreaming: true,
             }),
           },
         );
@@ -1596,10 +1599,18 @@ export default function RecordRoute() {
           );
         }
         const created = (await res.json()) as {
-          result?: { id: string; uploadChunkUrl: string; abortUrl?: string };
+          result?: {
+            id: string;
+            uploadChunkUrl: string;
+            abortUrl?: string;
+            uploadMode?: UploadMode;
+            uploadChunkBytes?: number;
+          };
           id?: string;
           uploadChunkUrl?: string;
           abortUrl?: string;
+          uploadMode?: UploadMode;
+          uploadChunkBytes?: number;
         };
         const info =
           created.result ??
@@ -1607,6 +1618,8 @@ export default function RecordRoute() {
             id: string;
             uploadChunkUrl: string;
             abortUrl?: string;
+            uploadMode?: UploadMode;
+            uploadChunkBytes?: number;
           });
         if (!info?.id) {
           throw new Error("create-recording did not return an id");
@@ -1616,14 +1629,22 @@ export default function RecordRoute() {
         if (isStale()) throw makeAbortError("Upload cancelled");
         const uploadBase = `${appBasePath()}${info.uploadChunkUrl}`;
 
-        const totalChunks = Math.max(
-          1,
-          Math.ceil(uploadBlob.size / UPLOAD_CHUNK_BYTES),
-        );
+        // Streaming mode relays each chunk to the provider as one part — the
+        // provider dictates the part size (S3 multipart: uniform >=5 MiB) and
+        // parts must arrive in order, so the parallel pool drops to 1.
+        const streamingUpload = info.uploadMode === "streaming";
+        const chunkBytes =
+          streamingUpload &&
+          typeof info.uploadChunkBytes === "number" &&
+          info.uploadChunkBytes > 0
+            ? info.uploadChunkBytes
+            : UPLOAD_CHUNK_BYTES;
+
+        const totalChunks = Math.max(1, Math.ceil(uploadBlob.size / chunkBytes));
 
         const chunkDescs = Array.from({ length: totalChunks }, (_, i) => {
-          const start = i * UPLOAD_CHUNK_BYTES;
-          const end = Math.min(start + UPLOAD_CHUNK_BYTES, uploadBlob.size);
+          const start = i * chunkBytes;
+          const end = Math.min(start + chunkBytes, uploadBlob.size);
           const isFinal = i === totalChunks - 1;
           return {
             index: i,
@@ -1707,7 +1728,12 @@ export default function RecordRoute() {
 
         await Promise.all(
           Array.from(
-            { length: Math.min(UPLOAD_PARALLELISM, parallelChunks.length) },
+            {
+              length: Math.min(
+                streamingUpload ? 1 : UPLOAD_PARALLELISM,
+                parallelChunks.length,
+              ),
+            },
             worker,
           ),
         );

package/corpus/templates/clips/changelog/2026-07-11-uploads-now-stream-straight-to-s3-compatible-storage-r2-s3-m.md

@@ -0,0 +1,6 @@
+---
+type: fixed
+date: 2026-07-11
+---
+
+Uploads now stream straight to S3-compatible storage (R2, S3, MinIO) so recordings and file uploads work on hosted deployments

package/corpus/templates/clips/server/lib/s3-upload-provider.ts

@@ -394,6 +394,155 @@ export async function deleteS3ObjectByUrl(url: string): Promise<boolean> {
   return true;
 }
 
+// ── Multipart (resumable) upload ──────────────────────────────────────
+//
+// Maps the framework's GCS-shaped resumable seam onto S3 multipart uploads:
+// startSession → CreateMultipartUpload, relayChunk → UploadPart (one part per
+// relayed chunk, ETags carried in session meta), completeSession →
+// CompleteMultipartUpload. S3/R2 require every part except the last to be at
+// least 5 MiB (R2 additionally requires uniform part sizes), so the provider
+// advertises `preferredChunkBytes` and upload clients slice on that boundary.
+
+/** S3/R2 multipart minimum part size (all parts except the last). */
+export const S3_MULTIPART_PART_BYTES = 5 * 1024 * 1024;
+
+interface S3MultipartMeta {
+  key: string;
+  uploadId: string;
+  parts: Array<{ partNumber: number; etag: string }>;
+}
+
+function multipartMetaFromSession(meta: Record<string, unknown>): S3MultipartMeta {
+  const key = typeof meta.key === "string" ? meta.key : "";
+  const uploadId = typeof meta.uploadId === "string" ? meta.uploadId : "";
+  const parts = Array.isArray(meta.parts)
+    ? (meta.parts as Array<{ partNumber: number; etag: string }>).filter(
+        (p) =>
+          p &&
+          typeof p.partNumber === "number" &&
+          typeof p.etag === "string",
+      )
+    : [];
+  if (!key || !uploadId) {
+    throw new Error("S3 resumable session meta is missing key/uploadId");
+  }
+  return { key, uploadId, parts };
+}
+
+/**
+ * Sign and send one S3 request (SigV4, Web Crypto) with query-string support.
+ * Multipart operations need canonical query strings (`uploads=`,
+ * `partNumber=…&uploadId=…`), which the single-object helpers above never
+ * used.
+ */
+async function s3SignedRequest(
+  cfg: S3Config,
+  input: {
+    method: string;
+    key: string;
+    query?: Record<string, string>;
+    body?: Uint8Array;
+    contentType?: string;
+    timeoutMs?: number;
+  },
+): Promise<Response> {
+  const now = new Date();
+  const amzDate =
+    now
+      .toISOString()
+      .replace(/[:-]|\.\d{3}/g, "")
+      .slice(0, 15) + "Z";
+  const dateStamp = amzDate.slice(0, 8);
+  const credentialScope = `${dateStamp}/${cfg.region}/s3/aws4_request`;
+
+  const hostUrl = new URL(cfg.endpoint);
+  const host = hostUrl.host;
+  const canonicalUri = `/${cfg.bucket}/${input.key.split("/").map(rfc3986).join("/")}`;
+  const canonicalQuery = Object.entries(input.query ?? {})
+    .map(([k, v]) => [rfc3986(k), rfc3986(v)] as const)
+    .sort(([a], [b]) => (a < b ? -1 : a > b ? 1 : 0))
+    .map(([k, v]) => `${k}=${v}`)
+    .join("&");
+
+  const body = input.body ?? new Uint8Array(0);
+  const payloadHash = await sha256(body);
+
+  const headers: Record<string, string> = {
+    host,
+    ...(input.contentType ? { "content-type": input.contentType } : {}),
+    "x-amz-content-sha256": payloadHash,
+    "x-amz-date": amzDate,
+  };
+
+  const signedHeaderKeys = Object.keys(headers).sort();
+  const signedHeaders = signedHeaderKeys.join(";");
+  const canonicalHeaders =
+    signedHeaderKeys.map((k) => `${k}:${headers[k]}`).join("\n") + "\n";
+
+  const canonicalRequest = [
+    input.method,
+    canonicalUri,
+    canonicalQuery,
+    canonicalHeaders,
+    signedHeaders,
+    payloadHash,
+  ].join("\n");
+
+  const crHash = await sha256(new TextEncoder().encode(canonicalRequest));
+  const stringToSign = [
+    "AWS4-HMAC-SHA256",
+    amzDate,
+    credentialScope,
+    crHash,
+  ].join("\n");
+
+  const signingKey = await deriveSigningKey(
+    cfg.secretAccessKey,
+    dateStamp,
+    cfg.region,
+  );
+  const signature = toHex(await hmac(signingKey, stringToSign));
+
+  const authorization =
+    `AWS4-HMAC-SHA256 Credential=${cfg.accessKeyId}/${credentialScope}, ` +
+    `SignedHeaders=${signedHeaders}, Signature=${signature}`;
+
+  const url = `${cfg.endpoint}${canonicalUri}${canonicalQuery ? `?${canonicalQuery}` : ""}`;
+  return fetchWithTimeout(
+    url,
+    {
+      method: input.method,
+      headers: {
+        ...headers,
+        Authorization: authorization,
+        ...(input.body ? { "Content-Length": String(body.byteLength) } : {}),
+      },
+      ...(input.body
+        ? {
+            body: body.buffer.slice(
+              body.byteOffset,
+              body.byteOffset + body.byteLength,
+            ) as BodyInit,
+          }
+        : {}),
+    },
+    input.timeoutMs ?? S3_PUT_TIMEOUT_MS,
+  );
+}
+
+function publicObjectUrl(cfg: S3Config, key: string): string {
+  return cfg.publicBaseUrl
+    ? `${cfg.publicBaseUrl}/${key}`
+    : `${cfg.endpoint}/${cfg.bucket}/${key}`;
+}
+
+function xmlEscape(value: string): string {
+  return value
+    .replace(/&/g, "&amp;")
+    .replace(/</g, "&lt;")
+    .replace(/>/g, "&gt;");
+}
+
 // ── Provider ──────────────────────────────────────────────────────────
 
 export const s3FileUploadProvider: FileUploadProvider = {
@@ -419,4 +568,111 @@ export const s3FileUploadProvider: FileUploadProvider = {
     const publicUrl = await putObject(cfg, objectKey, bytes, contentType);
     return { url: publicUrl, provider: "s3" };
   },
+  resumable: {
+    preferredChunkBytes: S3_MULTIPART_PART_BYTES,
+    startSession: async (filename, mimeType) => {
+      const cfg = await readS3Config();
+      if (!cfg) throw new Error("S3 credentials are not configured");
+
+      const ext = filename?.split(".").pop() ?? "bin";
+      const stamp = Date.now();
+      const rand = Math.random().toString(36).slice(2, 10);
+      const objectKey = `clips/${stamp}-${rand}.${ext}`;
+      const contentType = mimeType || "application/octet-stream";
+
+      const res = await s3SignedRequest(cfg, {
+        method: "POST",
+        key: objectKey,
+        query: { uploads: "" },
+        contentType,
+        timeoutMs: S3_DELETE_TIMEOUT_MS,
+      });
+      const text = await res.text().catch(() => "");
+      if (!res.ok) {
+        throw new Error(
+          `S3 CreateMultipartUpload failed (${res.status}): ${text || res.statusText}`,
+        );
+      }
+      const uploadId = /<UploadId>([^<]+)<\/UploadId>/.exec(text)?.[1];
+      if (!uploadId) {
+        throw new Error(
+          "S3 CreateMultipartUpload succeeded but no UploadId was returned",
+        );
+      }
+      return {
+        sessionId: uploadId,
+        meta: { key: objectKey, uploadId, contentType, parts: [] },
+      };
+    },
+    relayChunk: async (session, contentRange, bytes) => {
+      // Recorder close sentinel ("bytes */<total>", empty body): all data
+      // parts were already uploaded; CompleteMultipartUpload happens in
+      // completeSession. Nothing to relay.
+      if (/^bytes \*\//.test(contentRange)) {
+        return { ok: true, status: 200 };
+      }
+      const cfg = await readS3Config();
+      if (!cfg) return { ok: false, status: 500 };
+      const meta = multipartMetaFromSession(session.meta);
+      const partNumber = meta.parts.length + 1;
+      const res = await s3SignedRequest(cfg, {
+        method: "PUT",
+        key: meta.key,
+        query: {
+          partNumber: String(partNumber),
+          uploadId: meta.uploadId,
+        },
+        body: bytes,
+      });
+      if (!res.ok) {
+        const text = await res.text().catch(() => "");
+        console.error(
+          `[s3-resumable] UploadPart ${partNumber} failed (${res.status}): ${text.slice(0, 300)}`,
+        );
+        return { ok: false, status: res.status };
+      }
+      await res.body?.cancel().catch(() => {});
+      const etag = res.headers.get("etag") ?? "";
+      if (!etag) return { ok: false, status: 502 };
+      return {
+        ok: true,
+        status: 200,
+        updatedMeta: {
+          parts: [...meta.parts, { partNumber, etag }],
+        },
+      };
+    },
+    completeSession: async (session) => {
+      const cfg = await readS3Config();
+      if (!cfg) throw new Error("S3 credentials are not configured");
+      const meta = multipartMetaFromSession(session.meta);
+      if (meta.parts.length === 0) {
+        throw new Error("S3 resumable session has no uploaded parts");
+      }
+      const xml =
+        `<CompleteMultipartUpload>` +
+        meta.parts
+          .map(
+            (p) =>
+              `<Part><PartNumber>${p.partNumber}</PartNumber><ETag>${xmlEscape(p.etag)}</ETag></Part>`,
+          )
+          .join("") +
+        `</CompleteMultipartUpload>`;
+      const res = await s3SignedRequest(cfg, {
+        method: "POST",
+        key: meta.key,
+        query: { uploadId: meta.uploadId },
+        body: new TextEncoder().encode(xml),
+        contentType: "application/xml",
+      });
+      const text = await res.text().catch(() => "");
+      // S3 can return 200 with an <Error> body for CompleteMultipartUpload.
+      if (!res.ok || /<Error>/.test(text)) {
+        throw new Error(
+          `S3 CompleteMultipartUpload failed (${res.status}): ${text.slice(0, 300) || res.statusText}`,
+        );
+      }
+      return publicObjectUrl(cfg, meta.key);
+    },
+  },
 };