wip: box.upload