@pylonsync/sync 0.22.47 → 0.22.50

package/src/offline-conflict.test.ts

@@ -0,0 +1,110 @@
+// What happens today when two clients edit the same row while offline and
+// then reconnect (Plan 013 step 5). This records the behavior; it does not
+// change it.
+//
+// Result: the server applies each update as a field-level patch in the order
+// the pushes arrive. Different fields both survive. On the same field the
+// last push wins. Both pushes come back "applied", so neither client is told
+// that another edit replaced its value: the earlier writer's edit is
+// overwritten in silence, and its screen changes when the other edit syncs.
+
+import { afterEach, describe, expect, test } from "bun:test";
+
+import { SyncEngine, type Row } from "./index";
+import type { Storage } from "./storage";
+import { createTestEnv, type TestEnv } from "./test-harness";
+
+class MemoryStorage implements Storage {
+  private map = new Map<string, string>();
+  get(key: string) {
+    return this.map.get(key) ?? null;
+  }
+  set(key: string, value: string) {
+    this.map.set(key, value);
+  }
+  remove(key: string) {
+    this.map.delete(key);
+  }
+}
+
+describe("two clients edit one row offline", () => {
+  let env: TestEnv | null = null;
+  let second: SyncEngine | null = null;
+  afterEach(async () => {
+    second?.stop();
+    second = null;
+    if (env) await env.dispose();
+    env = null;
+  });
+
+  async function twoClients() {
+    // Client A is the harness engine; client B is a second engine against
+    // the same server, signed in as another rep.
+    env = createTestEnv({ transport: "poll", appName: "rep-a" });
+    env.signIn({ userId: "rep-a" });
+    env.server.seed("Lead", [{ id: "l1", status: "new", note: "", phone: "" }]);
+    await env.start();
+    const storage = new MemoryStorage();
+    storage.set("pylon:rep-b:token", env.server.signIn({ userId: "rep-b" }));
+    second = new SyncEngine({
+      baseUrl: "http://test.invalid",
+      appName: "rep-b",
+      persist: false,
+      storage,
+      transport: "poll",
+      multiTab: false,
+    });
+    await second.start();
+    await env.flush();
+    return { a: env.engine, b: second, server: env.server };
+  }
+
+  /** Let each push's catch-up pull finish, then pull the other's edit
+   *  (on the poll transport nothing pushes it). */
+  async function syncBoth(a: SyncEngine, b: SyncEngine) {
+    await env!.flush(20);
+    await a.pull();
+    await b.pull();
+  }
+
+  async function offlineUpdate(engine: SyncEngine, patch: Row) {
+    env!.server.primeNextPushOutcome({ kind: "network" });
+    await engine.update("Lead", "l1", patch);
+    expect(engine.pendingCount()).toBe(1);
+  }
+
+  test("different fields: both edits survive", async () => {
+    const { a, b, server } = await twoClients();
+    await offlineUpdate(a, { status: "sold" });
+    await offlineUpdate(b, { note: "dog in yard" });
+
+    await a.push();
+    await b.push();
+    await syncBoth(a, b);
+
+    const [row] = await server.listEntityRows("Lead", env!.token);
+    expect(row).toMatchObject({ status: "sold", note: "dog in yard" });
+    expect(a.store.get("Lead", "l1")).toMatchObject({ status: "sold", note: "dog in yard" });
+    expect(b.store.get("Lead", "l1")).toMatchObject({ status: "sold", note: "dog in yard" });
+  });
+
+  test("same field: the last push wins and neither client is told", async () => {
+    const { a, b, server } = await twoClients();
+    await offlineUpdate(a, { status: "sold" });
+    await offlineUpdate(b, { status: "not interested" });
+
+    // A reconnects first, then B.
+    await a.push();
+    await b.push();
+    await syncBoth(a, b);
+
+    const [row] = await server.listEntityRows("Lead", env!.token);
+    expect(row).toMatchObject({ status: "not interested" });
+    // A's edit was replaced: A now shows B's value...
+    expect(a.store.get("Lead", "l1")).toMatchObject({ status: "not interested" });
+    // ...and nothing reports it. Both writes were applied, so neither
+    // outbox has a failed write.
+    expect(a.outbox()).toEqual({ pending: [], failed: [] });
+    expect(b.outbox()).toEqual({ pending: [], failed: [] });
+  });
+});

package/src/outbox.test.ts

@@ -0,0 +1,333 @@
+// The outbox: list pending and failed writes, retry a failed write (with
+// corrected fields), dismiss one, and notify subscribers on every change.
+//
+// Before: a write the server rejected was rolled back and kept in the queue
+// as `failed`, but nothing listed it, so the user never learned it was lost.
+
+import "fake-indexeddb/auto";
+import { afterEach, describe, expect, test } from "bun:test";
+
+import {
+  IndexedDBPersistence,
+  MutationRejectedError,
+  OUTBOX_CHANNEL,
+  SyncEngine,
+} from "./index";
+import {
+  MutationQueue,
+  type MutationQueuePersistence,
+  type PendingMutation,
+} from "./mutation-queue";
+import { createTestEnv, type TestEnv } from "./test-harness";
+
+/** In-memory stand-in for the IndexedDB queue store. */
+class MemoryQueueStore implements MutationQueuePersistence {
+  rows = new Map<string, PendingMutation>();
+  async saveAll(mutations: PendingMutation[]) {
+    this.rows = new Map(mutations.map((m) => [m.id, structuredClone(m)]));
+  }
+  async loadAll() {
+    return Array.from(this.rows.values(), (m) => structuredClone(m));
+  }
+  async saveChanges(upserts: PendingMutation[], removedIds: string[]) {
+    for (const m of upserts) this.rows.set(m.id, structuredClone(m));
+    for (const id of removedIds) this.rows.delete(id);
+  }
+}
+
+const tick = () => new Promise((r) => setTimeout(r, 0));
+
+describe("MutationQueue", () => {
+  test("a failed write survives clear() and a reload", async () => {
+    const disk = new MemoryQueueStore();
+    const q = new MutationQueue(disk);
+    const applied = q.add({ entity: "Knock", row_id: "k1", kind: "insert", data: { id: "k1" } }, undefined, "u1");
+    const failed = q.add({ entity: "Knock", row_id: "k2", kind: "insert", data: { id: "k2" } }, undefined, "u1");
+    q.markApplied(applied);
+    q.markFailed(failed, "door number is required", "VALIDATION_FAILED");
+    q.clear();
+    await tick();
+    expect(q.failed().map((m) => m.id)).toEqual([failed]);
+
+    const reloaded = new MutationQueue(disk);
+    await reloaded.hydrate();
+    const [m] = reloaded.failed();
+    expect(m).toMatchObject({
+      id: failed,
+      status: "failed",
+      error: "door number is required",
+      errorCode: "VALIDATION_FAILED",
+      owner: "u1",
+    });
+    expect(typeof m!.createdAt).toBe("number");
+    expect(reloaded.get(applied)).toBeUndefined();
+  });
+
+  test("retry re-queues as pending under a new op id, with the owner and merged fields", async () => {
+    const disk = new MemoryQueueStore();
+    const q = new MutationQueue(disk);
+    const id = q.add(
+      { entity: "Knock", row_id: "k1", kind: "insert", data: { id: "k1", door: "", outcome: "no answer" } },
+      undefined,
+      "u1",
+    );
+    const createdAt = q.get(id)!.createdAt;
+    q.markFailed(id, "door number is required", "VALIDATION_FAILED");
+    const newId = q.retry(id, { door: "14B", id: "attempt-to-change-id" }, undefined);
+    await tick();
+
+    expect(newId).not.toBe(id);
+    expect(q.get(id)).toBeUndefined();
+    const m = q.get(newId)!;
+    expect(m.status).toBe("pending");
+    expect(m.owner).toBe("u1");
+    expect(m.createdAt).toBe(createdAt);
+    expect(m.change.op_id).toBe(newId);
+    expect(m.change.data).toEqual({ id: "k1", door: "14B", outcome: "no answer" });
+    // One persistence write removed the old entry and added the new one.
+    expect(Array.from(disk.rows.keys())).toEqual([newId]);
+    expect(() => q.retry(newId, undefined, undefined)).toThrow();
+  });
+
+  test("dismiss removes a failed write from memory and persistence; a pending one stays", async () => {
+    const disk = new MemoryQueueStore();
+    const q = new MutationQueue(disk);
+    const failed = q.add({ entity: "Knock", row_id: "k1", kind: "insert", data: { id: "k1" } });
+    const pending = q.add({ entity: "Knock", row_id: "k2", kind: "insert", data: { id: "k2" } });
+    q.markFailed(failed, "no");
+    expect(q.dismiss(pending)).toBe(false);
+    expect(q.dismiss(failed)).toBe(true);
+    await tick();
+    expect(q.get(failed)).toBeUndefined();
+    expect(Array.from(disk.rows.keys())).toEqual([pending]);
+  });
+
+  test("writes from an older client (no createdAt) sort first", () => {
+    const q = new MutationQueue();
+    const newer = q.add({ entity: "K", row_id: "a", kind: "insert", data: { id: "a" } });
+    const older = q.add({ entity: "K", row_id: "b", kind: "insert", data: { id: "b" } });
+    delete q.get(older)!.createdAt;
+    q.markFailed(newer, "x");
+    q.markFailed(older, "y");
+    expect(q.failed().map((m) => m.id)).toEqual([older, newer]);
+  });
+});
+
+describe("SyncEngine outbox", () => {
+  let env: TestEnv | null = null;
+  afterEach(async () => {
+    if (env) await env.dispose();
+    env = null;
+  });
+
+  test("lists pending and failed writes with their fields and errors", async () => {
+    env = createTestEnv({ transport: "poll" });
+    env.signIn({ userId: "u1" });
+    await env.start();
+    env.server.rejectWritesWhere("Knock", (d) => d.door === "", "VALIDATION_FAILED", "door number is required");
+    await expect(env.engine.insert("Knock", { door: "", outcome: "no answer" })).rejects.toThrow();
+    env.server.primeNextPushOutcome({ kind: "network" });
+    await env.engine.insert("Knock", { door: "12", outcome: "sold" });
+
+    const { pending, failed } = env.engine.outbox();
+    expect(pending).toHaveLength(1);
+    expect(pending[0]).toMatchObject({ entity: "Knock", kind: "insert", data: { door: "12", outcome: "sold" } });
+    expect(pending[0]!.error).toBeUndefined();
+    expect(failed).toHaveLength(1);
+    expect(failed[0]).toMatchObject({
+      entity: "Knock",
+      kind: "insert",
+      data: { door: "", outcome: "no answer" },
+      error: "door number is required",
+      errorCode: "VALIDATION_FAILED",
+    });
+    // Same object until the queue changes.
+    expect(env.engine.outbox()).toBe(env.engine.outbox());
+  });
+
+  test("subscribers hear add, applied, failed, retry and dismiss", async () => {
+    env = createTestEnv({ transport: "poll" });
+    env.signIn({ userId: "u1" });
+    await env.start();
+    let calls = 0;
+    env.engine.store.subscribe(() => {
+      calls += 1;
+    }, OUTBOX_CHANNEL);
+    const heard = async (fn: () => Promise<unknown> | unknown) => {
+      const before = calls;
+      try {
+        await fn();
+      } catch {
+        // A rejected write still changes the outbox.
+      }
+      await env!.flush(5);
+      return calls > before;
+    };
+
+    // add + applied
+    expect(await heard(() => env!.engine.insert("Knock", { door: "1" }))).toBe(true);
+    // add + failed
+    env.server.rejectWritesWhere("Knock", (d) => d.door === "", "VALIDATION_FAILED", "required");
+    expect(await heard(() => env!.engine.insert("Knock", { door: "" }))).toBe(true);
+    const failedId = env.engine.outbox().failed[0]!.id;
+    // retry (fails again)
+    expect(await heard(() => env!.engine.retryWrite(failedId))).toBe(true);
+    // dismiss
+    const again = env.engine.outbox().failed[0]!.id;
+    expect(await heard(() => env!.engine.dismissWrite(again))).toBe(true);
+    expect(env.engine.outbox().failed).toHaveLength(0);
+
+    // Entity listeners are not woken by outbox-only changes.
+    let entityCalls = 0;
+    env.engine.store.subscribe(() => {
+      entityCalls += 1;
+    }, "Other");
+    env.engine.mutations.markFailed("nope", "x");
+    env.engine.store.notify(OUTBOX_CHANNEL);
+    expect(entityCalls).toBe(0);
+  });
+
+  test("retry with corrected data is applied; the rejected op is never applied", async () => {
+    env = createTestEnv({ transport: "poll" });
+    env.signIn({ userId: "u1" });
+    await env.start();
+    env.server.rejectWritesWhere("Knock", (d) => d.door === "", "VALIDATION_FAILED", "door number is required");
+
+    let rowId = "";
+    try {
+      await env.engine.insert("Knock", { door: "", outcome: "sold" });
+    } catch (err) {
+      rowId = (err as MutationRejectedError).rowId;
+    }
+    // The rejection rolled the row back.
+    expect(env.engine.store.get("Knock", rowId)).toBeNull();
+    const failed = env.engine.outbox().failed[0]!;
+
+    const newOp = await env.engine.retryWrite(failed.id, { door: "14B" });
+    expect(newOp).not.toBe(failed.id);
+    expect(env.engine.store.get("Knock", rowId)).toMatchObject({ door: "14B", outcome: "sold" });
+    expect(env.engine.outbox()).toEqual({ pending: [], failed: [] });
+    const onServer = await env.server.listEntityRows("Knock", env.token);
+    expect(onServer).toEqual([{ id: rowId, door: "14B", outcome: "sold" }]);
+  });
+
+  test("a retry the server rejects again is failed again with the new error", async () => {
+    env = createTestEnv({ transport: "poll" });
+    env.signIn({ userId: "u1" });
+    await env.start();
+    env.server.seed("Knock", [{ id: "k1", door: "3", outcome: "no answer" }]);
+    await env.engine.pull();
+    env.server.rejectWritesWhere("Knock", (d) => d.outcome === "bogus", "VALIDATION_FAILED", "unknown outcome");
+    env.server.rejectWritesWhere("Knock", (d) => d.outcome === "worse", "POLICY_DENIED", "not allowed");
+    await expect(env.engine.update("Knock", "k1", { outcome: "bogus" })).rejects.toThrow();
+    expect(env.engine.store.get("Knock", "k1")).toMatchObject({ outcome: "no answer" });
+
+    const id = env.engine.outbox().failed[0]!.id;
+    await expect(env.engine.retryWrite(id, { outcome: "worse" })).rejects.toMatchObject({
+      code: "POLICY_DENIED",
+    });
+    const [failed] = env.engine.outbox().failed;
+    expect(failed).toMatchObject({ errorCode: "POLICY_DENIED", error: "not allowed", data: { outcome: "worse" } });
+    expect(failed!.id).not.toBe(id);
+    // Rolled back to the server's value again.
+    expect(env.engine.store.get("Knock", "k1")).toMatchObject({ outcome: "no answer" });
+  });
+
+  test("a failed write is never retried as another user", async () => {
+    env = createTestEnv({ transport: "poll" });
+    env.signIn({ userId: "u1" });
+    await env.start();
+    env.server.denyWrites("Knock", "POLICY_DENIED", "no");
+    await expect(env.engine.insert("Knock", { door: "1" })).rejects.toThrow();
+    const id = env.engine.outbox().failed[0]!.id;
+
+    env.signIn({ userId: "u2" });
+    await env.engine.refreshResolvedSession();
+    await env.flush(10);
+    await expect(env.engine.retryWrite(id)).rejects.toMatchObject({ code: "OWNER_MISMATCH" });
+    expect(env.server.receivedPushKeys.filter((k) => k.startsWith("Knock/"))).toHaveLength(1);
+  });
+
+  test("retryWrite and dismissWrite refuse a write that is not failed", async () => {
+    env = createTestEnv({ transport: "poll" });
+    env.signIn({ userId: "u1" });
+    await env.start();
+    env.server.primeNextPushOutcome({ kind: "network" });
+    await env.engine.insert("Knock", { door: "1" });
+    const id = env.engine.outbox().pending[0]!.id;
+    await expect(env.engine.retryWrite(id)).rejects.toThrow("no failed write");
+    expect(env.engine.dismissWrite(id)).toBe(false);
+  });
+});
+
+describe("pending writes after a reload", () => {
+  const realFetch = globalThis.fetch;
+  afterEach(() => {
+    globalThis.fetch = realFetch;
+  });
+
+  test("rows written offline are on screen again before the network answers", async () => {
+    // Offline: every request fails.
+    globalThis.fetch = (async () => {
+      throw new TypeError("Failed to fetch");
+    }) as unknown as typeof fetch;
+    const name = `reload-${Math.random().toString(36).slice(2)}`;
+    const disk = new IndexedDBPersistence(name);
+    await disk.open();
+    await disk.saveIdentity("u1");
+    await disk.saveCursor({ last_seq: 5 });
+    await disk.saveRow("Knock", "k-old", { id: "k-old", door: "1", outcome: "no answer" });
+    const { IndexedDBMutationPersistence } = await import("./persistence");
+    const now = Date.now();
+    await new IndexedDBMutationPersistence(disk).saveAll([
+      {
+        id: "op-insert",
+        change: { entity: "Knock", row_id: "k-new", kind: "insert", data: { id: "k-new", door: "2", outcome: "sold" }, op_id: "op-insert" },
+        status: "pending",
+        owner: "u1",
+        createdAt: now - 2000,
+      },
+      {
+        id: "op-update",
+        change: { entity: "Knock", row_id: "k-old", kind: "update", data: { outcome: "callback" }, op_id: "op-update" },
+        status: "pending",
+        owner: "u1",
+        prevRow: { id: "k-old", door: "1", outcome: "no answer" },
+        createdAt: now - 1000,
+      },
+      {
+        id: "op-failed",
+        change: { entity: "Knock", row_id: "k-bad", kind: "insert", data: { id: "k-bad" }, op_id: "op-failed" },
+        status: "failed",
+        error: "rejected",
+        owner: "u1",
+        createdAt: now - 500,
+      },
+    ]);
+
+    disk.connection?.close();
+
+    const reopened = new IndexedDBPersistence(name);
+    const engine = new SyncEngine({
+      baseUrl: "http://test.invalid",
+      appName: name,
+      persistence: reopened,
+      multiTab: false,
+      transport: "poll",
+      pollInterval: 1e9,
+    });
+    const started = engine.start().catch(() => {});
+    for (let i = 0; i < 50 && !engine.isHydrated(); i++) await new Promise((r) => setTimeout(r, 10));
+    await new Promise((r) => setTimeout(r, 20));
+    expect(engine.store.get("Knock", "k-new")).toMatchObject({ door: "2", outcome: "sold" });
+    expect(engine.store.get("Knock", "k-old")).toMatchObject({ outcome: "callback" });
+    // A failed write was rolled back; it is not re-applied.
+    expect(engine.store.get("Knock", "k-bad")).toBeNull();
+    expect(engine.outbox().pending.map((m) => m.id)).toEqual(["op-insert", "op-update"]);
+    expect(engine.outbox().failed.map((m) => m.id)).toEqual(["op-failed"]);
+    engine.stop();
+    await started;
+    // An open connection blocks other suites' deleteDatabase.
+    reopened.connection?.close();
+  });
+});

package/src/test-harness/server.ts

@@ -221,6 +221,9 @@ export class TestServer {
    *  answers. Lets a test queue a write while a push is in flight. */
   pushGate: Promise<void> | null = null;
 
+  /** The file endpoints (`/api/files/init`, PUT, `/api/files/confirm`). */
+  readonly files = new TestFileServer(this);
+
   /** Entities whose pushed writes are rejected per op, like a write
    *  policy denial on the real server (HTTP 200 with a per-op error). */
   private deniedWrites = new Map<string, { code: string; message: string }>();
@@ -228,6 +231,22 @@ export class TestServer {
     this.deniedWrites.set(entity, { code, message });
   }
 
+  /** Reject a pushed insert/update of `entity` whose fields match
+   *  `predicate`, like a write policy that checks a field value. */
+  private conditionalDenials: Array<{
+    entity: string;
+    predicate: (data: Row) => boolean;
+    error: { code: string; message: string };
+  }> = [];
+  rejectWritesWhere(
+    entity: string,
+    predicate: (data: Row) => boolean,
+    code = "POLICY_DENIED",
+    message = "write denied by policy",
+  ): void {
+    this.conditionalDenials.push({ entity, predicate, error: { code, message } });
+  }
+
   private nextPushOutcome:
     | { kind: "network" }
     | { kind: "status"; status: number }
@@ -390,6 +409,11 @@ export class TestServer {
     if (denied) {
       return { op_id, status: "error", error: denied };
     }
+    if (kind !== "delete") {
+      const merged = { ...(this.rows.get(entity)?.get(row_id) ?? {}), ...(change.data ?? {}) } as Row;
+      const rule = this.conditionalDenials.find((d) => d.entity === entity && d.predicate(merged));
+      if (rule) return { op_id, status: "error", error: rule.error };
+    }
     const exists = this.rows.get(entity)?.has(row_id) ?? false;
     if (kind === "insert") {
       this.insert(entity, { ...(change.data ?? {}), id: row_id } as Row);
@@ -569,3 +593,70 @@ export class TestServer {
     }
   }
 }
+
+/**
+ * In-memory stand-in for the runtime's file routes. Records every request
+ * so a test can count uploads, and lets a test refuse a file (`rejectInit`)
+ * or drop the connection during the next PUT (`dropNextPut`).
+ */
+export class TestFileServer {
+  private nextId = 1;
+  private slots = new Map<string, { owner: string | null; filename: string; size: number; bytes?: number }>();
+  readonly stored = new Map<string, { filename: string; size: number; owner: string | null }>();
+  initCount = 0;
+  putCount = 0;
+  private rejection: { status: number; code: string; message: string } | null = null;
+  private dropPut = false;
+
+  constructor(private readonly server: TestServer) {}
+
+  /** Refuse every init with this status, like a type or size check. */
+  rejectInit(status: number, code: string, message: string): void {
+    this.rejection = { status, code, message };
+  }
+  clearRejection(): void {
+    this.rejection = null;
+  }
+  /** When set, every PUT waits for it before it answers. */
+  putGate: Promise<void> | null = null;
+  /** The next PUT fails like a dropped connection (no status). */
+  dropNextPut(): void {
+    this.dropPut = true;
+  }
+
+  init(token: string | undefined, body: { filename?: string; size?: number }) {
+    this.initCount += 1;
+    if (this.rejection) {
+      const r = this.rejection;
+      return { status: r.status, body: { error: { code: r.code, message: r.message } } };
+    }
+    const id = `f_${this.nextId++}`;
+    const owner = this.server.authContextFor(token).userId;
+    this.slots.set(id, { owner, filename: body.filename ?? "upload", size: body.size ?? 0 });
+    return { status: 200, body: { uploadUrl: `/api/files/local-put/${id}`, assetId: id } };
+  }
+
+  put(id: string, bytes: unknown) {
+    this.putCount += 1;
+    if (this.dropPut) {
+      this.dropPut = false;
+      throw new TypeError("simulated dropped connection during upload");
+    }
+    const slot = this.slots.get(id);
+    if (!slot) return { status: 404, body: { error: { code: "NOT_FOUND" } } };
+    slot.bytes = bytes instanceof ArrayBuffer ? bytes.byteLength : slot.size;
+    return { status: 200, body: null };
+  }
+
+  confirm(token: string | undefined, id: string) {
+    const slot = this.slots.get(id);
+    if (!slot || slot.bytes === undefined) {
+      return { status: 400, body: { error: { code: "NOT_UPLOADED" } } };
+    }
+    if (slot.owner !== this.server.authContextFor(token).userId) {
+      return { status: 403, body: { error: { code: "FORBIDDEN" } } };
+    }
+    this.stored.set(id, { filename: slot.filename, size: slot.bytes, owner: slot.owner });
+    return { status: 200, body: { id, url: `/api/files/${id}`, size: slot.bytes } };
+  }
+}

package/src/test-harness/transport.ts

@@ -374,6 +374,23 @@ async function handle(
     };
   }
 
+  // File uploads: /api/files/init, the PUT to the returned URL, and
+  // /api/files/confirm (see TestServer.files).
+  if (url.endsWith("/api/files/init") && method === "POST") {
+    const body = typeof _init?.body === "string" ? JSON.parse(_init.body) : {};
+    return server.files.init(token, body);
+  }
+  const put = url.match(/\/api\/files\/local-put\/([^/?]+)$/);
+  if (put && method === "PUT") {
+    const bytes = _init?.body instanceof Blob ? await _init.body.arrayBuffer() : _init?.body;
+    if (server.files.putGate) await server.files.putGate;
+    return server.files.put(put[1]!, bytes);
+  }
+  if (url.endsWith("/api/files/confirm") && method === "POST") {
+    const body = typeof _init?.body === "string" ? JSON.parse(_init.body) : {};
+    return server.files.confirm(token, body.assetId);
+  }
+
   // Anything else: 404 with a clear error so test failures point
   // at the exact missing route rather than a generic JSON parse.
   return {