suaveplan/openspec/archive/2026-05-19-add-api-plugin-file-upload/tasks.md

Tasks — add-api-plugin-file-upload

Every checkbox MUST reflect work actually done in this change. No retroactive ticking.

1. Spec authoring

• 1.1 Read ../suaveplan/enterprise/api-plugin-file-upload.md end-to-end
• 1.2 Read openspec/AGENTS.md Sections 13 and 14
• 1.3 Draft proposal.md from openspec/templates/proposal.md
• 1.4 Fill in ## Source mapping — every requirement cites a line range or appears in the "no source line" table
• 1.5 Draft specs/api-plugin-file-upload/spec.md
• 1.6 Every requirement carries a **Verified by:** line naming concrete it(...) titles

2. Implementation

• 2.1 Author src/error-codes/error-codes.ts (11 codes + FileUploadError)
• 2.2 Author src/types/types.ts (config + adapter contracts)
• 2.3 Author src/schemas/options.ts + per-route Zod schemas under src/schemas/routes/
• 2.4 Author src/otel/instruments.ts (4 counters + 1 histogram)
• 2.5 Author src/storage/memory.ts + src/storage/file-system.ts
• 2.6 Author src/session-store/memory.ts
• 2.7 Author src/validators/mime.ts + src/validators/size.ts
• 2.8 Author src/assembler/assembler.ts (SHA-256 streaming hasher + chunk concat)
• 2.9 Author src/services/file-upload-service.ts + src/services/registry-augmentation.ts
• 2.10 Author src/routes/build-routes.ts + per-route handlers
• 2.11 Author src/middleware/context-augmentation.ts (tenant optional)
• 2.12 Author src/plugin/plugin.ts (createFileUploadPlugin factory + onInit lifecycle)
• 2.13 Author src/index.ts barrel (explicit named exports)

3. Tests

• 3.1 Unit tests at src/<feature>/<feature>.test.ts covering every scenario
• 3.2 Spec-conformance tests at src/<feature>/<feature>.spec-conformance.test.ts pinning code-registry / type-level scenarios
• 3.3 Integration tests at tests/integration/full-flow.test.ts covering all 6 routes (single-shot, chunked, resume, abort, isolation)
• 3.4 Fast-check property test at tests/property.test.ts
• 3.5 tests/dep-graph.test.ts invariants
• 3.6 Every it(...) carries { timeout: 5000 } (or 30000 for async)

4. Documentation

• 4.1 Sibling .md for every implementation .ts (≥200 words, basic + advanced examples, API reference)
• 4.2 README.md linking every co-located .md
• 4.3 No CLAUDE.md listing update needed — package not in foundation list

5. Pre-archive verification (the 5-gate triple)

• 5.1 bun run check — Biome 0 errors / 0 warnings / 0 info across the touched files
• 5.2 bunx turbo lint typecheck test --filter=@suaveplan/api-plugin-file-upload --force — green
• 5.3 bunx turbo test:coverage --filter=@suaveplan/api-plugin-file-upload — 100/100/100/100
• 5.4 bun scripts/openspec-conformance.ts @suaveplan/api-plugin-file-upload — exit 0
• 5.5 bunx turbo build --filter=@suaveplan/api-plugin-file-upload --force — green
• 5.6 bun scripts/lint/check-test-runner-imports.ts — exit 0

6. Pre-archive 9-row checklist (skill §7)

• 6.1 Generics threaded; expectTypeOf assertions on public surface
• 6.2 Zod schemas wired at every declared boundary
• 6.3 Every error code in error-codes.ts thrown from a production path
• 6.4 Auth gating tested both on (with principal) and off (anonymous → 401)
• 6.5 OTel instruments emitted from production paths and asserted with real in-memory MeterProvider
• 6.6 Resume / dedup tested where claimed (GET status returns chunk indices; idempotent abort)
• 6.7 No retroactive tick
• 6.8 No export * in any feature-module barrel
• 6.9 No direct vitest / bun:test imports

7. Archive

• 7.1 Fold specs/api-plugin-file-upload/spec.md into openspec/specs/api-plugin-file-upload/spec.md
• 7.2 Move openspec/changes/add-api-plugin-file-upload/ → openspec/archive/2026-05-19-add-api-plugin-file-upload/