# Tasks — add-api-plugin-file-upload

> Every checkbox MUST reflect work actually done in this change. No retroactive ticking.

## 1. Spec authoring

- [x] 1.1 Read `../suaveplan/enterprise/api-plugin-file-upload.md` end-to-end
- [x] 1.2 Read `openspec/AGENTS.md` Sections 13 and 14
- [x] 1.3 Draft `proposal.md` from `openspec/templates/proposal.md`
- [x] 1.4 Fill in `## Source mapping` — every requirement cites a line range or appears in the "no source line" table
- [x] 1.5 Draft `specs/api-plugin-file-upload/spec.md`
- [x] 1.6 Every requirement carries a `**Verified by:**` line naming concrete `it(...)` titles

## 2. Implementation

- [x] 2.1 Author `src/error-codes/error-codes.ts` (11 codes + `FileUploadError`)
- [x] 2.2 Author `src/types/types.ts` (config + adapter contracts)
- [x] 2.3 Author `src/schemas/options.ts` + per-route Zod schemas under `src/schemas/routes/`
- [x] 2.4 Author `src/otel/instruments.ts` (4 counters + 1 histogram)
- [x] 2.5 Author `src/storage/memory.ts` + `src/storage/file-system.ts`
- [x] 2.6 Author `src/session-store/memory.ts`
- [x] 2.7 Author `src/validators/mime.ts` + `src/validators/size.ts`
- [x] 2.8 Author `src/assembler/assembler.ts` (SHA-256 streaming hasher + chunk concat)
- [x] 2.9 Author `src/services/file-upload-service.ts` + `src/services/registry-augmentation.ts`
- [x] 2.10 Author `src/routes/build-routes.ts` + per-route handlers
- [x] 2.11 Author `src/middleware/context-augmentation.ts` (tenant optional)
- [x] 2.12 Author `src/plugin/plugin.ts` (`createFileUploadPlugin` factory + `onInit` lifecycle)
- [x] 2.13 Author `src/index.ts` barrel (explicit named exports)

## 3. Tests

- [x] 3.1 Unit tests at `src/<feature>/<feature>.test.ts` covering every scenario
- [x] 3.2 Spec-conformance tests at `src/<feature>/<feature>.spec-conformance.test.ts` pinning code-registry / type-level scenarios
- [x] 3.3 Integration tests at `tests/integration/full-flow.test.ts` covering all 6 routes (single-shot, chunked, resume, abort, isolation)
- [x] 3.4 Fast-check property test at `tests/property.test.ts`
- [x] 3.5 `tests/dep-graph.test.ts` invariants
- [x] 3.6 Every `it(...)` carries `{ timeout: 5000 }` (or 30000 for async)

## 4. Documentation

- [x] 4.1 Sibling `.md` for every implementation `.ts` (≥200 words, basic + advanced examples, API reference)
- [x] 4.2 `README.md` linking every co-located `.md`
- [x] 4.3 No `CLAUDE.md` listing update needed — package not in foundation list

## 5. Pre-archive verification (the 5-gate triple)

- [ ] 5.1 `bun run check` — Biome 0 errors / 0 warnings / 0 info across the touched files
- [ ] 5.2 `bunx turbo lint typecheck test --filter=@suaveplan/api-plugin-file-upload --force` — green
- [ ] 5.3 `bunx turbo test:coverage --filter=@suaveplan/api-plugin-file-upload` — 100/100/100/100
- [ ] 5.4 `bun scripts/openspec-conformance.ts @suaveplan/api-plugin-file-upload` — exit 0
- [ ] 5.5 `bunx turbo build --filter=@suaveplan/api-plugin-file-upload --force` — green
- [ ] 5.6 `bun scripts/lint/check-test-runner-imports.ts` — exit 0

## 6. Pre-archive 9-row checklist (skill §7)

- [ ] 6.1 Generics threaded; `expectTypeOf` assertions on public surface
- [ ] 6.2 Zod schemas wired at every declared boundary
- [ ] 6.3 Every error code in `error-codes.ts` thrown from a production path
- [ ] 6.4 Auth gating tested both on (with principal) and off (anonymous → 401)
- [ ] 6.5 OTel instruments emitted from production paths and asserted with real in-memory `MeterProvider`
- [ ] 6.6 Resume / dedup tested where claimed (GET status returns chunk indices; idempotent abort)
- [ ] 6.7 No retroactive tick
- [ ] 6.8 No `export *` in any feature-module barrel
- [ ] 6.9 No direct `vitest` / `bun:test` imports

## 7. Archive

- [ ] 7.1 Fold `specs/api-plugin-file-upload/spec.md` into `openspec/specs/api-plugin-file-upload/spec.md`
- [ ] 7.2 Move `openspec/changes/add-api-plugin-file-upload/` → `openspec/archive/2026-05-19-add-api-plugin-file-upload/`