@open-mercato/core 0.10.1-develop.7736.1.88e07906bf → 0.10.1-develop.7748.1.d745ba61aa

package/dist/modules/attachments/api/route.js.map

@@ -1,7 +1,7 @@
 {
   "version": 3,
   "sources": ["../../../../src/modules/attachments/api/route.ts"],
-  "sourcesContent": ["import { NextResponse } from 'next/server'\nimport { createRequestContainer } from '@open-mercato/shared/lib/di/container'\nimport { getAuthFromRequest } from '@open-mercato/shared/lib/auth/server'\nimport { z } from 'zod'\nimport { sql } from 'kysely'\nimport type { OpenApiRouteDoc } from '@open-mercato/shared/lib/openapi'\nimport { buildAttachmentFileUrl, buildAttachmentImageUrl, slugifyAttachmentFileName } from '../lib/imageUrls'\nimport { ensureDefaultPartitions, resolveDefaultPartitionCode, sanitizePartitionCode } from '../lib/partitions'\nimport { Attachment, AttachmentPartition } from '../data/entities'\nimport { extractAttachmentContent } from '../lib/textExtraction'\nimport { requestOcrProcessing } from '../lib/ocrQueue'\nimport { StorageDriverFactory } from '../lib/drivers'\nimport { OcrService, shouldUseLlmOcr } from '../lib/ocrService'\nimport { clearAttachmentThumbnailCache } from '../lib/thumbnailCache'\nimport { removeAttachmentRecord } from '../lib/storageReferences'\nimport { assertAttachmentScopeInvariant } from '../lib/access'\nimport { resolveAttachmentRequestScope } from '../lib/requestScope'\nimport {\n  mergeAttachmentMetadata,\n  normalizeAttachmentAssignments,\n  normalizeAttachmentTags,\n  readAttachmentMetadata,\n  upsertAssignment,\n  type AttachmentAssignment,\n} from '../lib/metadata'\nimport { randomUUID } from 'crypto'\nimport type { EntityManager } from '@mikro-orm/postgresql'\nimport { splitCustomFieldPayload } from '@open-mercato/shared/lib/crud/custom-fields'\nimport { emitCrudSideEffects, setCustomFieldsIfAny } from '@open-mercato/shared/lib/commands/helpers'\nimport { resolveTranslations } from '@open-mercato/shared/lib/i18n/server'\nimport { attachmentCrudEvents, attachmentCrudIndexer } from '../lib/crud'\nimport { E } from '#generated/entities.ids.generated'\nimport { resolveDefaultAttachmentOcrEnabled } from '../lib/ocrConfig'\nimport {\n  detectAttachmentMimeType,\n  hasDangerousExecutableExtension,\n  isActiveContentAttachment,\n  sanitizeUploadedFileName,\n} from '../lib/security'\nimport {\n  isMultipartUploadLimitError,\n  isMultipartRequestWithinUploadLimit,\n  parseMultipartFormDataWithinUploadLimit,\n  resolveAttachmentMaxBytes,\n  willExceedAttachmentTenantQuota,\n} from '../lib/upload-limits'\nimport { findWithDecryption } from '@open-mercato/shared/lib/encryption/find'\nimport { createLogger } from '@open-mercato/shared/lib/logger'\nimport type { AttachmentQuotaService } from '../lib/quota-service'\nimport { resolveAttachmentsUploadRateLimitConfig } from '../lib/ocrLimits'\nimport { checkRateLimit, RATE_LIMIT_ERROR_FALLBACK, RATE_LIMIT_ERROR_KEY } from '@open-mercato/shared/lib/ratelimit/helpers'\nimport type { RateLimiterService } from '@open-mercato/shared/lib/ratelimit/service'\n\nconst logger = createLogger('attachments')\n\nexport const metadata = {\n  GET: { requireAuth: true, requireFeatures: ['attachments.view'] },\n  POST: { requireAuth: true, requireFeatures: ['attachments.manage'] },\n  DELETE: { requireAuth: true, requireFeatures: ['attachments.manage'] },\n}\n\nconst ATTACHMENT_LIST_MAX_PAGE_SIZE = 100\n\nconst attachmentQuerySchema = z.object({\n  entityId: z.string().min(1).describe('Entity identifier that owns the attachments'),\n  recordId: z.string().min(1).describe('Record identifier within the entity'),\n  page: z.coerce.number().min(1).optional(),\n  pageSize: z.coerce.number().min(1).max(ATTACHMENT_LIST_MAX_PAGE_SIZE).optional(),\n})\n\nconst attachmentAssignmentSchema = z.object({\n  type: z.string().describe('Assignment type identifier'),\n  id: z.string().describe('Assignment record identifier'),\n  href: z.string().nullable().optional().describe('Optional link to the related record'),\n  label: z.string().nullable().optional().describe('Optional label for the assignment'),\n})\n\nconst attachmentItemSchema = z.object({\n  id: z.string().describe('Attachment identifier'),\n  url: z.string().describe('Public path to the stored asset'),\n  fileName: z.string().describe('Original filename'),\n  fileSize: z.number().int().nonnegative().describe('File size in bytes'),\n  createdAt: z.string().describe('Upload timestamp (ISO 8601)'),\n  mimeType: z.string().nullable().optional().describe('MIME type of the file'),\n  thumbnailUrl: z.string().optional().describe('Helper route that renders a thumbnail'),\n  partitionCode: z.string().optional().describe('Partition identifier'),\n  tags: z.array(z.string()).optional().describe('Tags assigned to the attachment'),\n  content: z.string().nullable().optional().describe('Extracted text or markdown content'),\n  assignments: z.array(attachmentAssignmentSchema).optional().describe('Records that reference this attachment'),\n})\n\nconst attachmentListResponseSchema = z.object({\n  items: z.array(attachmentItemSchema),\n  total: z.number().int().nonnegative().optional(),\n  page: z.number().int().min(1).optional(),\n  pageSize: z.number().int().min(1).optional(),\n  totalPages: z.number().int().min(1).optional(),\n})\n\nconst attachmentUploadBodySchema = z.object({\n  entityId: z.string().min(1),\n  recordId: z.string().min(1),\n  fieldKey: z.string().optional(),\n  file: z.string().min(1).describe('Binary file payload; supplied as multipart form-data'),\n  customFields: z\n    .string()\n    .optional()\n    .describe('JSON encoded map of custom field values collected from the upload form.'),\n})\n\nconst attachmentDeleteQuerySchema = z.object({\n  id: z.string().uuid(),\n})\n\nconst uploadResponseSchema = z.object({\n  ok: z.literal(true),\n  item: z.object({\n    id: z.string(),\n    url: z.string(),\n    fileName: z.string(),\n    fileSize: z.number().int().nonnegative(),\n    thumbnailUrl: z.string().optional(),\n    content: z.string().nullable().optional(),\n    tags: z.array(z.string()).optional(),\n    assignments: z.array(attachmentAssignmentSchema).optional(),\n    customFields: z.record(z.string(), z.unknown()).optional(),\n  }),\n})\n\nconst errorSchema = z.object({\n  error: z.string(),\n})\n\nconst LIBRARY_ENTITY_ID = 'attachments:library'\n\nfunction parseCustomFieldsEntry(value: FormDataEntryValue | null): Record<string, unknown> {\n  if (!value) return {}\n  if (typeof value === 'string') {\n    const trimmed = value.trim()\n    if (!trimmed) return {}\n    try {\n      const parsed = JSON.parse(trimmed)\n      if (parsed && typeof parsed === 'object' && !Array.isArray(parsed)) {\n        return parsed as Record<string, unknown>\n      }\n    } catch {\n      return {}\n    }\n  }\n  if (typeof value === 'object' && !Array.isArray(value) && !(value instanceof File)) {\n    return { ...(value as Record<string, unknown>) }\n  }\n  return {}\n}\n\nfunction buildFormPayload(form: FormData): Record<string, unknown> {\n  const payload: Record<string, unknown> = {}\n  form.forEach((value, key) => {\n    if (key === 'customFields') {\n      payload.customFields = parseCustomFieldsEntry(value)\n      return\n    }\n    payload[key] = value\n  })\n  return payload\n}\n\nfunction parseFormTags(value: FormDataEntryValue | null): string[] {\n  if (!value) return []\n  if (typeof value === 'string') {\n    const trimmed = value.trim()\n    if (!trimmed) return []\n    try {\n      const parsed = JSON.parse(trimmed)\n      return normalizeAttachmentTags(parsed)\n    } catch {\n      return normalizeAttachmentTags(value)\n    }\n  }\n  return []\n}\n\nfunction parseFormAssignments(value: FormDataEntryValue | null): AttachmentAssignment[] {\n  if (!value) return []\n  if (typeof value !== 'string') return []\n  const trimmed = value.trim()\n  if (!trimmed) return []\n  try {\n    const parsed = JSON.parse(trimmed)\n    return normalizeAttachmentAssignments(parsed)\n  } catch {\n    return []\n  }\n}\n\nexport async function GET(req: Request) {\n  const auth = await getAuthFromRequest(req)\n  if (!auth || !auth.tenantId || (!auth.orgId && !auth.isSuperAdmin)) return NextResponse.json({ error: 'Unauthorized' }, { status: 401 })\n  const url = new URL(req.url)\n  const parsedQuery = attachmentQuerySchema.safeParse({\n    entityId: url.searchParams.get('entityId') || '',\n    recordId: url.searchParams.get('recordId') || '',\n    page: url.searchParams.get('page') ?? undefined,\n    pageSize: url.searchParams.get('pageSize') ?? undefined,\n  })\n  if (!parsedQuery.success) {\n    return NextResponse.json({ error: 'entityId and recordId are required' }, { status: 400 })\n  }\n  const { entityId, recordId, page, pageSize } = parsedQuery.data\n\n  const container = await createRequestContainer()\n  const em = container.resolve('em') as EntityManager\n  const requestScope = await resolveAttachmentRequestScope(container, auth, req)\n  if (requestScope.denied) return NextResponse.json({ error: 'Forbidden' }, { status: 403 })\n  const orgId = requestScope.organizationId\n  const filter: Record<string, unknown> = { entityId, recordId, tenantId: auth.tenantId! }\n  if (orgId) filter.organizationId = orgId\n  const orderBy: Record<string, 'ASC' | 'DESC'> = { createdAt: 'DESC', id: 'DESC' }\n  const usePaging = typeof page === 'number' && typeof pageSize === 'number'\n  const total = usePaging ? await em.count(Attachment, filter) : null\n  const currentPage = usePaging ? Math.max(1, page) : null\n  const currentPageSize = usePaging ? pageSize : null\n  const totalPages = usePaging && total !== null ? Math.max(1, Math.ceil(total / currentPageSize!)) : null\n  const pageOffset = usePaging ? (currentPage! - 1) * currentPageSize! : undefined\n  const items = await findWithDecryption(\n    em,\n    Attachment,\n    filter,\n    {\n      orderBy,\n      ...(usePaging\n        ? {\n            limit: currentPageSize!,\n            offset: pageOffset,\n          }\n        : { limit: ATTACHMENT_LIST_MAX_PAGE_SIZE }),\n    },\n    {\n      tenantId: auth.tenantId ?? null,\n      organizationId: orgId ?? null,\n    },\n  )\n  return NextResponse.json({\n    items: items.map((a: any) => {\n      const metadata = readAttachmentMetadata(a.storageMetadata)\n      return {\n        id: a.id,\n        url: a.url,\n        fileName: a.fileName,\n        fileSize: a.fileSize,\n        createdAt: a.createdAt,\n        mimeType: a.mimeType ?? null,\n        partitionCode: a.partitionCode,\n        content: a.content ?? null,\n        thumbnailUrl: buildAttachmentImageUrl(a.id, {\n          width: 320,\n          height: 320,\n          slug: slugifyAttachmentFileName(a.fileName),\n        }),\n        tags: metadata.tags ?? [],\n        assignments: metadata.assignments ?? [],\n      }\n    }),\n    ...(usePaging\n      ? {\n          total,\n          page: currentPage,\n          pageSize: currentPageSize,\n          totalPages,\n        }\n      : {}),\n  })\n}\n\nexport async function POST(req: Request) {\n  const { t } = await resolveTranslations()\n  const auth = await getAuthFromRequest(req)\n  if (!auth || !auth.tenantId || (!auth.orgId && !auth.isSuperAdmin)) return NextResponse.json({ error: 'Unauthorized' }, { status: 401 })\n  // A superadmin browsing with \"All organizations\" selected has no concrete\n  // organization scope, but an attachment must be stored under exactly one\n  // organization (the scope invariant forbids partial-null rows). Reject with a\n  // clear, actionable error instead of a 401 \u2014 a 401 makes the client-side\n  // fetch layer treat it as session expiry, show a misleading toast, and reset\n  // the in-progress form (#3764).\n  if (!auth.orgId) {\n    return NextResponse.json({\n      error: t('attachments.errors.selectOrganization', 'Select a specific organization before uploading an attachment.'),\n    }, { status: 400 })\n  }\n  const tenantId = auth.tenantId\n\n  const container = await createRequestContainer()\n  let rateLimiterService: RateLimiterService | null = null\n  try {\n    rateLimiterService = container.resolve('rateLimiterService') as RateLimiterService | null\n  } catch (error) {\n    // Fail-open: uploads proceed when the limiter cannot be resolved (minimal/test containers).\n    logger.warn('Attachment upload rate limiter unavailable; throttle skipped', { err: error })\n  }\n  if (rateLimiterService) {\n    const principal = typeof auth.sub === 'string' && auth.sub.length > 0\n      ? auth.sub\n      : (typeof auth.userId === 'string' && auth.userId.length > 0 ? auth.userId : null)\n    if (!principal) {\n      logger.warn('Attachment upload rate limit skipped: missing authenticated principal')\n    } else {\n      const rateLimitResponse = await checkRateLimit(\n        rateLimiterService,\n        resolveAttachmentsUploadRateLimitConfig(),\n        `${tenantId}:${principal}`,\n        t(RATE_LIMIT_ERROR_KEY, RATE_LIMIT_ERROR_FALLBACK),\n      )\n      if (rateLimitResponse) return rateLimitResponse\n    }\n  } else {\n    logger.warn('Attachment upload rate limiter not registered; throttle skipped')\n  }\n\n  const contentType = req.headers.get('content-type') || ''\n  if (!contentType.toLowerCase().includes('multipart/form-data')) {\n    return NextResponse.json({ error: 'Expected multipart/form-data' }, { status: 400 })\n  }\n  if (!isMultipartRequestWithinUploadLimit(req.headers.get('content-length'))) {\n    return NextResponse.json({\n      error: t('attachments.errors.maxUploadSize', 'Attachment exceeds the maximum upload size.'),\n    }, { status: 413 })\n  }\n\n  let form: FormData\n  try {\n    form = await parseMultipartFormDataWithinUploadLimit(req)\n  } catch (error) {\n    if (isMultipartUploadLimitError(error)) {\n      return NextResponse.json({\n        error: t('attachments.errors.maxUploadSize', 'Attachment exceeds the maximum upload size.'),\n      }, { status: 413 })\n    }\n    throw error\n  }\n  const formPayload = buildFormPayload(form)\n  const customFieldValues = splitCustomFieldPayload(formPayload).custom\n  const entityId = String(form.get('entityId') || '')\n  const recordId = String(form.get('recordId') || '')\n  const fieldKey = String(form.get('fieldKey') || '')\n  const file = form.get('file') as unknown as File | null\n  if (!entityId || !recordId || !file) return NextResponse.json({ error: 'entityId, recordId and file are required' }, { status: 400 })\n  const partitionOverrideRaw = form.get('partitionCode')\n  const partitionOverride =\n    typeof partitionOverrideRaw === 'string' && partitionOverrideRaw.trim().length > 0\n      ? sanitizePartitionCode(partitionOverrideRaw)\n      : null\n  const tags = parseFormTags(form.get('tags'))\n  const assignmentsFromForm = parseFormAssignments(form.get('assignments'))\n\n  const em = container.resolve('em') as EntityManager\n  const dataEngine = container.resolve('dataEngine')\n  let attachmentQuotaService: AttachmentQuotaService | null = null\n  let attachmentQuotaRecoveryScheduler: ((\n    payload: { reservationId: string; tenantId: string; organizationId: string },\n    delayMs: number,\n  ) => Promise<void>) | null = null\n  try {\n    attachmentQuotaService = container.resolve('attachmentQuotaService') as AttachmentQuotaService\n    attachmentQuotaRecoveryScheduler = container.resolve('attachmentQuotaRecoveryScheduler') as (\n      payload: { reservationId: string; tenantId: string; organizationId: string },\n      delayMs: number,\n    ) => Promise<void>\n  } catch {\n    // Legacy fallback below when the quota service is not registered in this container.\n  }\n  const storageDriverFactory =\n    (container.resolve('storageDriverFactory') as StorageDriverFactory | null) ?? new StorageDriverFactory(em)\n  const uploadScope = await resolveAttachmentRequestScope(container, auth, req)\n  if (uploadScope.denied) return NextResponse.json({ error: 'Forbidden' }, { status: 403 })\n  const orgId = uploadScope.organizationId\n  if (!orgId) return NextResponse.json({ error: 'Unauthorized' }, { status: 401 })\n  await ensureDefaultPartitions(em)\n  // Optional per-field validations\n  let partitionFromField: string | null = null\n  let fieldMaxAttachmentSizeMb: number | null = null\n  if (fieldKey) {\n    try {\n      const { CustomFieldDef } = await import('@open-mercato/core/modules/entities/data/entities')\n      const def = await em.findOne(CustomFieldDef, {\n        entityId,\n        key: fieldKey,\n        $and: [\n          { $or: [ { tenantId: auth.tenantId }, { tenantId: null } ] },\n        ],\n        isActive: true,\n      })\n      const cfg = (def as any)?.configJson || {}\n      const ext = (file.name || '').split('.').pop()?.toLowerCase() || ''\n      if (Array.isArray(cfg.acceptExtensions) && cfg.acceptExtensions.length) {\n        const allowed = new Set((cfg.acceptExtensions as any[]).map((x: any) => String(x).toLowerCase().replace(/^\\./, '')))\n        if (!allowed.has(ext)) return NextResponse.json({ error: 'File type not allowed' }, { status: 400 })\n      }\n      if (typeof cfg.maxAttachmentSizeMb === 'number' && cfg.maxAttachmentSizeMb > 0) {\n        fieldMaxAttachmentSizeMb = cfg.maxAttachmentSizeMb\n      }\n      if (typeof cfg.partitionCode === 'string' && cfg.partitionCode.trim().length > 0) {\n        partitionFromField = sanitizePartitionCode(cfg.partitionCode)\n      }\n    } catch {}\n  }\n  if (hasDangerousExecutableExtension(file.name)) {\n    return NextResponse.json({\n      error: t('attachments.errors.dangerousExecutable', 'Executable file types are not allowed as attachments.'),\n    }, { status: 400 })\n  }\n  const effectiveMaxBytes = resolveAttachmentMaxBytes(fieldMaxAttachmentSizeMb)\n  if (file.size > effectiveMaxBytes) {\n    return NextResponse.json({\n      error: t('attachments.errors.maxUploadSize', 'Attachment exceeds the maximum upload size.'),\n    }, { status: 413 })\n  }\n  if (!attachmentQuotaService) {\n    try {\n      const tenantUsageBytes = await readTenantAttachmentUsageBytes(em, tenantId)\n      if (willExceedAttachmentTenantQuota(tenantUsageBytes, file.size)) {\n        return NextResponse.json({\n          error: t('attachments.errors.quotaExceeded', 'Attachment storage quota exceeded for this tenant.'),\n        }, { status: 413 })\n      }\n    } catch (error) {\n      logger.error('Attachment quota accounting failed', { err: error })\n      return NextResponse.json({\n        error: t('attachments.errors.quotaUnavailable', 'Storage quota accounting is unavailable.'),\n      }, { status: 500 })\n    }\n  }\n  const buf = Buffer.from(await file.arrayBuffer())\n  const safeName = sanitizeUploadedFileName(file.name)\n  const fileMimeType = detectAttachmentMimeType(buf, safeName, (file as any).type)\n  if (isActiveContentAttachment(buf, safeName, fileMimeType)) {\n    return NextResponse.json({ error: t('attachments.errors.activeContentBlocked', 'Active content uploads are not allowed.') }, { status: 400 })\n  }\n  const defaultPartitionCode = resolveDefaultPartitionCode(entityId)\n  const resolvedPartitionCode = partitionOverride ?? partitionFromField ?? defaultPartitionCode\n  const partitionCodeCandidates = Array.from(\n    new Set(\n      [partitionOverride, partitionFromField, resolvedPartitionCode].filter(\n        (code): code is string => typeof code === 'string' && code.length > 0,\n      ),\n    ),\n  )\n  let partition: AttachmentPartition | null = null\n  for (const code of partitionCodeCandidates) {\n    const record = await em.findOne(AttachmentPartition, { code })\n    if (record) {\n      partition = record\n      break\n    }\n  }\n  if (!partition) {\n    partition = await em.findOne(AttachmentPartition, { code: defaultPartitionCode })\n  }\n  if (!partition) {\n    return NextResponse.json({ error: 'Storage partition is not configured.' }, { status: 400 })\n  }\n  const requestedPublicOverride =\n    typeof partitionOverride === 'string' &&\n    partitionOverride.length > 0 &&\n    partition.code === partitionOverride &&\n    partition.isPublic === true &&\n    partition.code !== defaultPartitionCode &&\n    partition.code !== partitionFromField\n  if (requestedPublicOverride) {\n    return NextResponse.json({ error: t('attachments.errors.publicPartitionBlocked', 'Public storage partitions cannot be selected explicitly for this upload.') }, { status: 403 })\n  }\n  const uploadDriver = await storageDriverFactory.resolveForPartition(partition.code, { tenantId, organizationId: orgId })\n  const preparedStoragePath = attachmentQuotaService\n    ? uploadDriver.prepareStoragePath?.({\n        partitionCode: partition.code,\n        orgId,\n        tenantId,\n        fileName: safeName,\n      })\n    : undefined\n  if (attachmentQuotaService && !preparedStoragePath) {\n    return NextResponse.json({\n      error: t('attachments.errors.quotaRecoveryUnsupported', 'Storage driver cannot participate in quota recovery.'),\n    }, { status: 500 })\n  }\n  let quotaReservation: { id: string; leaseToken: string; expiresAt: Date } | null = null\n  if (attachmentQuotaService) {\n    try {\n      quotaReservation = await attachmentQuotaService.reserve({\n        tenantId,\n        organizationId: orgId,\n        bytes: buf.length,\n        source: 'attachment',\n        storageDriver: uploadDriver.key,\n        storagePath: preparedStoragePath!,\n        partitionCode: partition.code,\n      })\n      if (!attachmentQuotaRecoveryScheduler) throw new Error('Attachment quota recovery is unavailable.')\n      await attachmentQuotaRecoveryScheduler({\n        reservationId: quotaReservation.id,\n        tenantId,\n        organizationId: orgId,\n      }, Math.max(1_000, quotaReservation.expiresAt.getTime() - Date.now()))\n      if (typeof attachmentQuotaService.beginStorage === 'function') {\n        await attachmentQuotaService.beginStorage(quotaReservation.id, quotaReservation.leaseToken)\n      }\n    } catch (error) {\n      if (quotaReservation) {\n        await attachmentQuotaService.release(quotaReservation.id, quotaReservation.leaseToken).catch(() => {})\n        quotaReservation = null\n      }\n      const code = (error as { code?: unknown })?.code\n      if (code === 'quota_exceeded') {\n        return NextResponse.json({\n          error: t('attachments.errors.quotaExceeded', 'Attachment storage quota exceeded for this tenant.'),\n        }, { status: 413 })\n      }\n      if (code === 'quota_target_exists') {\n        return NextResponse.json({\n          error: t('attachments.errors.storagePathExists', 'The target storage path already exists.'),\n        }, { status: 409 })\n      }\n      logger.error('Attachment quota reservation failed', { err: error })\n      return NextResponse.json({\n        error: t('attachments.errors.quotaUnavailable', 'Storage quota accounting is unavailable.'),\n      }, { status: 500 })\n    }\n  }\n  let storedPath: string\n  try {\n    const stored = await uploadDriver.store({\n      partitionCode: partition.code,\n      orgId,\n      tenantId,\n      fileName: safeName,\n      buffer: buf,\n      storagePath: preparedStoragePath,\n    })\n    storedPath = stored.storagePath\n    if (quotaReservation) {\n      await attachmentQuotaService!.markStored(quotaReservation.id, quotaReservation.leaseToken)\n    }\n  } catch (error) {\n    logger.error('Failed to persist file', { err: error })\n    if (preparedStoragePath) {\n      try {\n        await (uploadDriver.deleteStrict?.(partition.code, preparedStoragePath)\n          ?? uploadDriver.delete(partition.code, preparedStoragePath))\n        if (quotaReservation) {\n          await attachmentQuotaService!.release(quotaReservation.id, quotaReservation.leaseToken)\n        }\n      } catch (cleanupError) {\n        logger.error('Failed to compensate attachment storage', { err: cleanupError })\n      }\n    }\n    return NextResponse.json({ error: 'Failed to persist attachment.' }, { status: 500 })\n  }\n\n  const requiresOcr =\n    typeof (partition as any).requiresOcr === 'boolean'\n      ? Boolean((partition as any).requiresOcr)\n      : resolveDefaultAttachmentOcrEnabled()\n  let extractedContent: string | null = null\n  const wantsLlmOcr = requiresOcr && shouldUseLlmOcr(fileMimeType, safeName)\n  const ocrService = wantsLlmOcr ? new OcrService() : null\n  const useLlmOcr = Boolean(wantsLlmOcr && ocrService?.available)\n\n  if (requiresOcr && !useLlmOcr) {\n    const { filePath: localPath, cleanup } = await uploadDriver.toLocalPath(partition.code, storedPath)\n    try {\n      extractedContent = await extractAttachmentContent({\n        filePath: localPath,\n        mimeType: fileMimeType,\n      })\n    } catch (error) {\n      logger.error('Failed to extract attachment content', { err: error })\n    } finally {\n      await cleanup().catch(() => {})\n    }\n  }\n\n  let assignments = assignmentsFromForm.slice()\n  if (entityId !== LIBRARY_ENTITY_ID) {\n    assignments = upsertAssignment(assignments, { type: entityId, id: recordId })\n  }\n  const metadata = mergeAttachmentMetadata(null, { assignments, tags })\n  const attachmentId = randomUUID()\n  assertAttachmentScopeInvariant({ tenantId: auth.tenantId, organizationId: orgId })\n  const att = em.create(Attachment, {\n    id: attachmentId,\n    entityId,\n    recordId,\n    organizationId: orgId,\n    tenantId: auth.tenantId!,\n    fileName: safeName,\n    mimeType: fileMimeType,\n    fileSize: buf.length,\n    partitionCode: partition.code,\n    storageDriver: partition.storageDriver || 'local',\n    storagePath: storedPath,\n    url: buildAttachmentFileUrl(attachmentId),\n    content: extractedContent,\n    storageMetadata: metadata,\n  })\n  // Persist the attachment row and its custom-field values atomically so a\n  // custom-field failure cannot leave behind a committed orphan attachment.\n  try {\n    await em.transactional(async (tx) => {\n      await tx.persist(att).flush()\n      if (dataEngine) {\n        await setCustomFieldsIfAny({\n          dataEngine,\n          entityId: E.attachments.attachment,\n          recordId: attachmentId,\n          tenantId,\n          organizationId: orgId,\n          values: customFieldValues,\n        })\n      }\n      if (quotaReservation) {\n        await attachmentQuotaService!.completeAttachment(quotaReservation.id, quotaReservation.leaseToken, tx)\n      }\n    })\n  } catch (error) {\n    logger.error('Failed to persist attachment with custom attributes', { err: error })\n    try {\n      await (uploadDriver.deleteStrict?.(partition.code, storedPath)\n        ?? uploadDriver.delete(partition.code, storedPath))\n      if (quotaReservation) {\n        await attachmentQuotaService!.release(quotaReservation.id, quotaReservation.leaseToken)\n      }\n    } catch (cleanupError) {\n      logger.error('Failed to compensate attachment persistence', { err: cleanupError })\n    }\n    return NextResponse.json({ error: 'Failed to save attachment attributes.' }, { status: 500 })\n  }\n\n  if (useLlmOcr) {\n    // Await so wait-queue overflow can finish the inline text fallback before\n    // the response returns (background LLM OCR still schedules via setImmediate).\n    try {\n      await requestOcrProcessing(em, att, uploadDriver, storedPath)\n    } catch (error) {\n      logger.error('Failed to queue OCR processing', { err: error })\n    }\n  } else if (wantsLlmOcr) {\n    logger.warn('OCR requested but OPENAI_API_KEY not configured, falling back to text extraction when available')\n  }\n\n  if (dataEngine) {\n    await emitCrudSideEffects({\n      dataEngine,\n      action: 'created',\n      entity: att,\n      identifiers: {\n        id: att.id,\n        organizationId: att.organizationId ?? null,\n        tenantId: att.tenantId ?? null,\n      },\n      events: attachmentCrudEvents,\n      indexer: attachmentCrudIndexer,\n    })\n    await dataEngine.flushOrmEntityChanges()\n  }\n\n  return NextResponse.json({\n    ok: true,\n    item: {\n      id: attachmentId,\n      url: att.url,\n      fileName: safeName,\n      fileSize: buf.length,\n      partitionCode: partition.code,\n      thumbnailUrl: buildAttachmentImageUrl(attachmentId, {\n        width: 320,\n        height: 320,\n        slug: slugifyAttachmentFileName(safeName),\n      }),\n      content: extractedContent ?? null,\n      tags: metadata.tags ?? [],\n      assignments: metadata.assignments ?? [],\n      customFields: Object.keys(customFieldValues).length ? customFieldValues : undefined,\n    },\n  })\n}\n\nasync function readTenantAttachmentUsageBytes(em: EntityManager, tenantId: string): Promise<number> {\n  try {\n    const db = em.getKysely<any>() as any\n    const row = await db\n      .selectFrom('attachments')\n      .select(sql<string>`sum(file_size)`.as('total_size'))\n      .where('tenant_id', '=', tenantId)\n      .executeTakeFirst() as { total_size: string | number | null } | undefined\n    const total = row?.total_size\n    if (typeof total === 'number') return Number.isFinite(total) ? total : 0\n    if (typeof total === 'string') {\n      const parsed = Number(total)\n      return Number.isFinite(parsed) ? parsed : 0\n    }\n    return 0\n  } catch (error) {\n    throw new Error('Attachment quota accounting is unavailable.', { cause: error })\n  }\n}\n\nexport async function DELETE(req: Request) {\n  const auth = await getAuthFromRequest(req)\n  if (!auth || !auth.tenantId || (!auth.orgId && !auth.isSuperAdmin)) return NextResponse.json({ error: 'Unauthorized' }, { status: 401 })\n  const url = new URL(req.url)\n  const id = url.searchParams.get('id') || ''\n  if (!id) return NextResponse.json({ error: 'Attachment id is required' }, { status: 400 })\n  const container = await createRequestContainer()\n  const em = container.resolve('em') as EntityManager\n  const dataEngine = container.resolve('dataEngine')\n  const storageDriverFactory =\n    (container.resolve('storageDriverFactory') as StorageDriverFactory | null) ?? new StorageDriverFactory(em)\n  // Resolve the currently selected organization (#3765) so a multi-org admin who\n  // switched the header org deletes within that org, not their pinned home org.\n  // A superadmin browsing with \"All organizations\" selected has no concrete org,\n  // so resolution returns null and the delete falls back to a tenant-only scope\n  // (#3764) \u2014 letting them remove any attachment in the tenant.\n  const deleteScope = await resolveAttachmentRequestScope(container, auth, req)\n  if (deleteScope.denied) return NextResponse.json({ error: 'Attachment not found' }, { status: 404 })\n  const orgId = deleteScope.organizationId\n  const deleteFilter: Record<string, unknown> = { id, tenantId: auth.tenantId! }\n  if (orgId) deleteFilter.organizationId = orgId\n  const record = await em.findOne(Attachment, deleteFilter)\n  if (!record) return NextResponse.json({ error: 'Attachment not found' }, { status: 404 })\n  const removal = await removeAttachmentRecord(em, record)\n  if (!removal.removed) return NextResponse.json({ error: 'Attachment not found' }, { status: 404 })\n  await clearAttachmentThumbnailCache(record.partitionCode, record.id).catch((error) => {\n    logger.error('Failed to cleanup cached thumbnails', { err: error })\n  })\n  if (record.storagePath && removal.releaseStorage) {\n    const delDriver = await storageDriverFactory.resolveForPartition(record.partitionCode, {\n      tenantId: record.tenantId ?? auth.tenantId!,\n      organizationId: record.organizationId ?? orgId ?? '',\n    })\n    await delDriver.delete(record.partitionCode, record.storagePath)\n  }\n  if (dataEngine) {\n    await emitCrudSideEffects({\n      dataEngine,\n      action: 'deleted',\n      entity: record,\n      identifiers: {\n        id: record.id,\n        organizationId: record.organizationId ?? null,\n        tenantId: record.tenantId ?? null,\n      },\n      events: attachmentCrudEvents,\n      indexer: attachmentCrudIndexer,\n    })\n    await dataEngine.flushOrmEntityChanges()\n  }\n  return NextResponse.json({ ok: true })\n}\n\nexport const openApi: OpenApiRouteDoc = {\n  summary: 'Manage entity attachments',\n  description: 'Upload and list attachments associated with module entities and records.',\n  methods: {\n    GET: {\n      summary: 'List attachments for a record',\n      description: 'Returns uploaded attachments for the given entity record, ordered by newest first. Without both page and pageSize, only the newest 100 attachments are returned; pass page and pageSize to page through the rest.',\n      query: attachmentQuerySchema,\n      responses: [\n        { status: 200, description: 'Attachments found for the record', schema: attachmentListResponseSchema },\n      ],\n      errors: [\n        { status: 400, description: 'Missing entity or record identifiers', schema: errorSchema },\n        { status: 401, description: 'Unauthorized', schema: errorSchema },\n      ],\n    },\n    POST: {\n      summary: 'Upload attachment',\n      description: 'Uploads a new attachment using multipart form-data and stores metadata for later retrieval.',\n      requestBody: {\n        contentType: 'multipart/form-data',\n        schema: attachmentUploadBodySchema,\n      },\n      responses: [\n        { status: 200, description: 'Attachment stored successfully', schema: uploadResponseSchema },\n      ],\n      errors: [\n        { status: 400, description: 'Payload validation error', schema: errorSchema },\n        { status: 401, description: 'Unauthorized', schema: errorSchema },\n        { status: 403, description: 'Attachment violates field constraints', schema: errorSchema },\n      ],\n    },\n    DELETE: {\n      summary: 'Delete attachment',\n      description: 'Removes an uploaded attachment and deletes the stored asset.',\n      query: attachmentDeleteQuerySchema,\n      responses: [\n        { status: 200, description: 'Attachment deleted', schema: z.object({ ok: z.literal(true) }) },\n        { status: 404, description: 'Attachment not found', schema: errorSchema },\n      ],\n      errors: [\n        { status: 400, description: 'Missing attachment identifier', schema: errorSchema },\n        { status: 401, description: 'Unauthorized', schema: errorSchema },\n      ],\n    },\n  },\n}\n"],
-  "mappings": "AAAA,SAAS,oBAAoB;AAC7B,SAAS,8BAA8B;AACvC,SAAS,0BAA0B;AACnC,SAAS,SAAS;AAClB,SAAS,WAAW;AAEpB,SAAS,wBAAwB,yBAAyB,iCAAiC;AAC3F,SAAS,yBAAyB,6BAA6B,6BAA6B;AAC5F,SAAS,YAAY,2BAA2B;AAChD,SAAS,gCAAgC;AACzC,SAAS,4BAA4B;AACrC,SAAS,4BAA4B;AACrC,SAAS,YAAY,uBAAuB;AAC5C,SAAS,qCAAqC;AAC9C,SAAS,8BAA8B;AACvC,SAAS,sCAAsC;AAC/C,SAAS,qCAAqC;AAC9C;AAAA,EACE;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,OAEK;AACP,SAAS,kBAAkB;AAE3B,SAAS,+BAA+B;AACxC,SAAS,qBAAqB,4BAA4B;AAC1D,SAAS,2BAA2B;AACpC,SAAS,sBAAsB,6BAA6B;AAC5D,SAAS,SAAS;AAClB,SAAS,0CAA0C;AACnD;AAAA,EACE;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,OACK;AACP;AAAA,EACE;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,OACK;AACP,SAAS,0BAA0B;AACnC,SAAS,oBAAoB;AAE7B,SAAS,+CAA+C;AACxD,SAAS,gBAAgB,2BAA2B,4BAA4B;AAGhF,MAAM,SAAS,aAAa,aAAa;AAElC,MAAM,WAAW;AAAA,EACtB,KAAK,EAAE,aAAa,MAAM,iBAAiB,CAAC,kBAAkB,EAAE;AAAA,EAChE,MAAM,EAAE,aAAa,MAAM,iBAAiB,CAAC,oBAAoB,EAAE;AAAA,EACnE,QAAQ,EAAE,aAAa,MAAM,iBAAiB,CAAC,oBAAoB,EAAE;AACvE;AAEA,MAAM,gCAAgC;AAEtC,MAAM,wBAAwB,EAAE,OAAO;AAAA,EACrC,UAAU,EAAE,OAAO,EAAE,IAAI,CAAC,EAAE,SAAS,6CAA6C;AAAA,EAClF,UAAU,EAAE,OAAO,EAAE,IAAI,CAAC,EAAE,SAAS,qCAAqC;AAAA,EAC1E,MAAM,EAAE,OAAO,OAAO,EAAE,IAAI,CAAC,EAAE,SAAS;AAAA,EACxC,UAAU,EAAE,OAAO,OAAO,EAAE,IAAI,CAAC,EAAE,IAAI,6BAA6B,EAAE,SAAS;AACjF,CAAC;AAED,MAAM,6BAA6B,EAAE,OAAO;AAAA,EAC1C,MAAM,EAAE,OAAO,EAAE,SAAS,4BAA4B;AAAA,EACtD,IAAI,EAAE,OAAO,EAAE,SAAS,8BAA8B;AAAA,EACtD,MAAM,EAAE,OAAO,EAAE,SAAS,EAAE,SAAS,EAAE,SAAS,qCAAqC;AAAA,EACrF,OAAO,EAAE,OAAO,EAAE,SAAS,EAAE,SAAS,EAAE,SAAS,mCAAmC;AACtF,CAAC;AAED,MAAM,uBAAuB,EAAE,OAAO;AAAA,EACpC,IAAI,EAAE,OAAO,EAAE,SAAS,uBAAuB;AAAA,EAC/C,KAAK,EAAE,OAAO,EAAE,SAAS,iCAAiC;AAAA,EAC1D,UAAU,EAAE,OAAO,EAAE,SAAS,mBAAmB;AAAA,EACjD,UAAU,EAAE,OAAO,EAAE,IAAI,EAAE,YAAY,EAAE,SAAS,oBAAoB;AAAA,EACtE,WAAW,EAAE,OAAO,EAAE,SAAS,6BAA6B;AAAA,EAC5D,UAAU,EAAE,OAAO,EAAE,SAAS,EAAE,SAAS,EAAE,SAAS,uBAAuB;AAAA,EAC3E,cAAc,EAAE,OAAO,EAAE,SAAS,EAAE,SAAS,uCAAuC;AAAA,EACpF,eAAe,EAAE,OAAO,EAAE,SAAS,EAAE,SAAS,sBAAsB;AAAA,EACpE,MAAM,EAAE,MAAM,EAAE,OAAO,CAAC,EAAE,SAAS,EAAE,SAAS,iCAAiC;AAAA,EAC/E,SAAS,EAAE,OAAO,EAAE,SAAS,EAAE,SAAS,EAAE,SAAS,oCAAoC;AAAA,EACvF,aAAa,EAAE,MAAM,0BAA0B,EAAE,SAAS,EAAE,SAAS,wCAAwC;AAC/G,CAAC;AAED,MAAM,+BAA+B,EAAE,OAAO;AAAA,EAC5C,OAAO,EAAE,MAAM,oBAAoB;AAAA,EACnC,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,YAAY,EAAE,SAAS;AAAA,EAC/C,MAAM,EAAE,OAAO,EAAE,IAAI,EAAE,IAAI,CAAC,EAAE,SAAS;AAAA,EACvC,UAAU,EAAE,OAAO,EAAE,IAAI,EAAE,IAAI,CAAC,EAAE,SAAS;AAAA,EAC3C,YAAY,EAAE,OAAO,EAAE,IAAI,EAAE,IAAI,CAAC,EAAE,SAAS;AAC/C,CAAC;AAED,MAAM,6BAA6B,EAAE,OAAO;AAAA,EAC1C,UAAU,EAAE,OAAO,EAAE,IAAI,CAAC;AAAA,EAC1B,UAAU,EAAE,OAAO,EAAE,IAAI,CAAC;AAAA,EAC1B,UAAU,EAAE,OAAO,EAAE,SAAS;AAAA,EAC9B,MAAM,EAAE,OAAO,EAAE,IAAI,CAAC,EAAE,SAAS,sDAAsD;AAAA,EACvF,cAAc,EACX,OAAO,EACP,SAAS,EACT,SAAS,yEAAyE;AACvF,CAAC;AAED,MAAM,8BAA8B,EAAE,OAAO;AAAA,EAC3C,IAAI,EAAE,OAAO,EAAE,KAAK;AACtB,CAAC;AAED,MAAM,uBAAuB,EAAE,OAAO;AAAA,EACpC,IAAI,EAAE,QAAQ,IAAI;AAAA,EAClB,MAAM,EAAE,OAAO;AAAA,IACb,IAAI,EAAE,OAAO;AAAA,IACb,KAAK,EAAE,OAAO;AAAA,IACd,UAAU,EAAE,OAAO;AAAA,IACnB,UAAU,EAAE,OAAO,EAAE,IAAI,EAAE,YAAY;AAAA,IACvC,cAAc,EAAE,OAAO,EAAE,SAAS;AAAA,IAClC,SAAS,EAAE,OAAO,EAAE,SAAS,EAAE,SAAS;AAAA,IACxC,MAAM,EAAE,MAAM,EAAE,OAAO,CAAC,EAAE,SAAS;AAAA,IACnC,aAAa,EAAE,MAAM,0BAA0B,EAAE,SAAS;AAAA,IAC1D,cAAc,EAAE,OAAO,EAAE,OAAO,GAAG,EAAE,QAAQ,CAAC,EAAE,SAAS;AAAA,EAC3D,CAAC;AACH,CAAC;AAED,MAAM,cAAc,EAAE,OAAO;AAAA,EAC3B,OAAO,EAAE,OAAO;AAClB,CAAC;AAED,MAAM,oBAAoB;AAE1B,SAAS,uBAAuB,OAA2D;AACzF,MAAI,CAAC,MAAO,QAAO,CAAC;AACpB,MAAI,OAAO,UAAU,UAAU;AAC7B,UAAM,UAAU,MAAM,KAAK;AAC3B,QAAI,CAAC,QAAS,QAAO,CAAC;AACtB,QAAI;AACF,YAAM,SAAS,KAAK,MAAM,OAAO;AACjC,UAAI,UAAU,OAAO,WAAW,YAAY,CAAC,MAAM,QAAQ,MAAM,GAAG;AAClE,eAAO;AAAA,MACT;AAAA,IACF,QAAQ;AACN,aAAO,CAAC;AAAA,IACV;AAAA,EACF;AACA,MAAI,OAAO,UAAU,YAAY,CAAC,MAAM,QAAQ,KAAK,KAAK,EAAE,iBAAiB,OAAO;AAClF,WAAO,EAAE,GAAI,MAAkC;AAAA,EACjD;AACA,SAAO,CAAC;AACV;AAEA,SAAS,iBAAiB,MAAyC;AACjE,QAAM,UAAmC,CAAC;AAC1C,OAAK,QAAQ,CAAC,OAAO,QAAQ;AAC3B,QAAI,QAAQ,gBAAgB;AAC1B,cAAQ,eAAe,uBAAuB,KAAK;AACnD;AAAA,IACF;AACA,YAAQ,GAAG,IAAI;AAAA,EACjB,CAAC;AACD,SAAO;AACT;AAEA,SAAS,cAAc,OAA4C;AACjE,MAAI,CAAC,MAAO,QAAO,CAAC;AACpB,MAAI,OAAO,UAAU,UAAU;AAC7B,UAAM,UAAU,MAAM,KAAK;AAC3B,QAAI,CAAC,QAAS,QAAO,CAAC;AACtB,QAAI;AACF,YAAM,SAAS,KAAK,MAAM,OAAO;AACjC,aAAO,wBAAwB,MAAM;AAAA,IACvC,QAAQ;AACN,aAAO,wBAAwB,KAAK;AAAA,IACtC;AAAA,EACF;AACA,SAAO,CAAC;AACV;AAEA,SAAS,qBAAqB,OAA0D;AACtF,MAAI,CAAC,MAAO,QAAO,CAAC;AACpB,MAAI,OAAO,UAAU,SAAU,QAAO,CAAC;AACvC,QAAM,UAAU,MAAM,KAAK;AAC3B,MAAI,CAAC,QAAS,QAAO,CAAC;AACtB,MAAI;AACF,UAAM,SAAS,KAAK,MAAM,OAAO;AACjC,WAAO,+BAA+B,MAAM;AAAA,EAC9C,QAAQ;AACN,WAAO,CAAC;AAAA,EACV;AACF;AAEA,eAAsB,IAAI,KAAc;AACtC,QAAM,OAAO,MAAM,mBAAmB,GAAG;AACzC,MAAI,CAAC,QAAQ,CAAC,KAAK,YAAa,CAAC,KAAK,SAAS,CAAC,KAAK,aAAe,QAAO,aAAa,KAAK,EAAE,OAAO,eAAe,GAAG,EAAE,QAAQ,IAAI,CAAC;AACvI,QAAM,MAAM,IAAI,IAAI,IAAI,GAAG;AAC3B,QAAM,cAAc,sBAAsB,UAAU;AAAA,IAClD,UAAU,IAAI,aAAa,IAAI,UAAU,KAAK;AAAA,IAC9C,UAAU,IAAI,aAAa,IAAI,UAAU,KAAK;AAAA,IAC9C,MAAM,IAAI,aAAa,IAAI,MAAM,KAAK;AAAA,IACtC,UAAU,IAAI,aAAa,IAAI,UAAU,KAAK;AAAA,EAChD,CAAC;AACD,MAAI,CAAC,YAAY,SAAS;AACxB,WAAO,aAAa,KAAK,EAAE,OAAO,qCAAqC,GAAG,EAAE,QAAQ,IAAI,CAAC;AAAA,EAC3F;AACA,QAAM,EAAE,UAAU,UAAU,MAAM,SAAS,IAAI,YAAY;AAE3D,QAAM,YAAY,MAAM,uBAAuB;AAC/C,QAAM,KAAK,UAAU,QAAQ,IAAI;AACjC,QAAM,eAAe,MAAM,8BAA8B,WAAW,MAAM,GAAG;AAC7E,MAAI,aAAa,OAAQ,QAAO,aAAa,KAAK,EAAE,OAAO,YAAY,GAAG,EAAE,QAAQ,IAAI,CAAC;AACzF,QAAM,QAAQ,aAAa;AAC3B,QAAM,SAAkC,EAAE,UAAU,UAAU,UAAU,KAAK,SAAU;AACvF,MAAI,MAAO,QAAO,iBAAiB;AACnC,QAAM,UAA0C,EAAE,WAAW,QAAQ,IAAI,OAAO;AAChF,QAAM,YAAY,OAAO,SAAS,YAAY,OAAO,aAAa;AAClE,QAAM,QAAQ,YAAY,MAAM,GAAG,MAAM,YAAY,MAAM,IAAI;AAC/D,QAAM,cAAc,YAAY,KAAK,IAAI,GAAG,IAAI,IAAI;AACpD,QAAM,kBAAkB,YAAY,WAAW;AAC/C,QAAM,aAAa,aAAa,UAAU,OAAO,KAAK,IAAI,GAAG,KAAK,KAAK,QAAQ,eAAgB,CAAC,IAAI;AACpG,QAAM,aAAa,aAAa,cAAe,KAAK,kBAAmB;AACvE,QAAM,QAAQ,MAAM;AAAA,IAClB;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,MACE;AAAA,MACA,GAAI,YACA;AAAA,QACE,OAAO;AAAA,QACP,QAAQ;AAAA,MACV,IACA,EAAE,OAAO,8BAA8B;AAAA,IAC7C;AAAA,IACA;AAAA,MACE,UAAU,KAAK,YAAY;AAAA,MAC3B,gBAAgB,SAAS;AAAA,IAC3B;AAAA,EACF;AACA,SAAO,aAAa,KAAK;AAAA,IACvB,OAAO,MAAM,IAAI,CAAC,MAAW;AAC3B,YAAMA,YAAW,uBAAuB,EAAE,eAAe;AACzD,aAAO;AAAA,QACL,IAAI,EAAE;AAAA,QACN,KAAK,EAAE;AAAA,QACP,UAAU,EAAE;AAAA,QACZ,UAAU,EAAE;AAAA,QACZ,WAAW,EAAE;AAAA,QACb,UAAU,EAAE,YAAY;AAAA,QACxB,eAAe,EAAE;AAAA,QACjB,SAAS,EAAE,WAAW;AAAA,QACtB,cAAc,wBAAwB,EAAE,IAAI;AAAA,UAC1C,OAAO;AAAA,UACP,QAAQ;AAAA,UACR,MAAM,0BAA0B,EAAE,QAAQ;AAAA,QAC5C,CAAC;AAAA,QACD,MAAMA,UAAS,QAAQ,CAAC;AAAA,QACxB,aAAaA,UAAS,eAAe,CAAC;AAAA,MACxC;AAAA,IACF,CAAC;AAAA,IACD,GAAI,YACA;AAAA,MACE;AAAA,MACA,MAAM;AAAA,MACN,UAAU;AAAA,MACV;AAAA,IACF,IACA,CAAC;AAAA,EACP,CAAC;AACH;AAEA,eAAsB,KAAK,KAAc;AACvC,QAAM,EAAE,EAAE,IAAI,MAAM,oBAAoB;AACxC,QAAM,OAAO,MAAM,mBAAmB,GAAG;AACzC,MAAI,CAAC,QAAQ,CAAC,KAAK,YAAa,CAAC,KAAK,SAAS,CAAC,KAAK,aAAe,QAAO,aAAa,KAAK,EAAE,OAAO,eAAe,GAAG,EAAE,QAAQ,IAAI,CAAC;AAOvI,MAAI,CAAC,KAAK,OAAO;AACf,WAAO,aAAa,KAAK;AAAA,MACvB,OAAO,EAAE,yCAAyC,gEAAgE;AAAA,IACpH,GAAG,EAAE,QAAQ,IAAI,CAAC;AAAA,EACpB;AACA,QAAM,WAAW,KAAK;AAEtB,QAAM,YAAY,MAAM,uBAAuB;AAC/C,MAAI,qBAAgD;AACpD,MAAI;AACF,yBAAqB,UAAU,QAAQ,oBAAoB;AAAA,EAC7D,SAAS,OAAO;AAEd,WAAO,KAAK,gEAAgE,EAAE,KAAK,MAAM,CAAC;AAAA,EAC5F;AACA,MAAI,oBAAoB;AACtB,UAAM,YAAY,OAAO,KAAK,QAAQ,YAAY,KAAK,IAAI,SAAS,IAChE,KAAK,MACJ,OAAO,KAAK,WAAW,YAAY,KAAK,OAAO,SAAS,IAAI,KAAK,SAAS;AAC/E,QAAI,CAAC,WAAW;AACd,aAAO,KAAK,uEAAuE;AAAA,IACrF,OAAO;AACL,YAAM,oBAAoB,MAAM;AAAA,QAC9B;AAAA,QACA,wCAAwC;AAAA,QACxC,GAAG,QAAQ,IAAI,SAAS;AAAA,QACxB,EAAE,sBAAsB,yBAAyB;AAAA,MACnD;AACA,UAAI,kBAAmB,QAAO;AAAA,IAChC;AAAA,EACF,OAAO;AACL,WAAO,KAAK,iEAAiE;AAAA,EAC/E;AAEA,QAAM,cAAc,IAAI,QAAQ,IAAI,cAAc,KAAK;AACvD,MAAI,CAAC,YAAY,YAAY,EAAE,SAAS,qBAAqB,GAAG;AAC9D,WAAO,aAAa,KAAK,EAAE,OAAO,+BAA+B,GAAG,EAAE,QAAQ,IAAI,CAAC;AAAA,EACrF;AACA,MAAI,CAAC,oCAAoC,IAAI,QAAQ,IAAI,gBAAgB,CAAC,GAAG;AAC3E,WAAO,aAAa,KAAK;AAAA,MACvB,OAAO,EAAE,oCAAoC,6CAA6C;AAAA,IAC5F,GAAG,EAAE,QAAQ,IAAI,CAAC;AAAA,EACpB;AAEA,MAAI;AACJ,MAAI;AACF,WAAO,MAAM,wCAAwC,GAAG;AAAA,EAC1D,SAAS,OAAO;AACd,QAAI,4BAA4B,KAAK,GAAG;AACtC,aAAO,aAAa,KAAK;AAAA,QACvB,OAAO,EAAE,oCAAoC,6CAA6C;AAAA,MAC5F,GAAG,EAAE,QAAQ,IAAI,CAAC;AAAA,IACpB;AACA,UAAM;AAAA,EACR;AACA,QAAM,cAAc,iBAAiB,IAAI;AACzC,QAAM,oBAAoB,wBAAwB,WAAW,EAAE;AAC/D,QAAM,WAAW,OAAO,KAAK,IAAI,UAAU,KAAK,EAAE;AAClD,QAAM,WAAW,OAAO,KAAK,IAAI,UAAU,KAAK,EAAE;AAClD,QAAM,WAAW,OAAO,KAAK,IAAI,UAAU,KAAK,EAAE;AAClD,QAAM,OAAO,KAAK,IAAI,MAAM;AAC5B,MAAI,CAAC,YAAY,CAAC,YAAY,CAAC,KAAM,QAAO,aAAa,KAAK,EAAE,OAAO,2CAA2C,GAAG,EAAE,QAAQ,IAAI,CAAC;AACpI,QAAM,uBAAuB,KAAK,IAAI,eAAe;AACrD,QAAM,oBACJ,OAAO,yBAAyB,YAAY,qBAAqB,KAAK,EAAE,SAAS,IAC7E,sBAAsB,oBAAoB,IAC1C;AACN,QAAM,OAAO,cAAc,KAAK,IAAI,MAAM,CAAC;AAC3C,QAAM,sBAAsB,qBAAqB,KAAK,IAAI,aAAa,CAAC;AAExE,QAAM,KAAK,UAAU,QAAQ,IAAI;AACjC,QAAM,aAAa,UAAU,QAAQ,YAAY;AACjD,MAAI,yBAAwD;AAC5D,MAAI,mCAGyB;AAC7B,MAAI;AACF,6BAAyB,UAAU,QAAQ,wBAAwB;AACnE,uCAAmC,UAAU,QAAQ,kCAAkC;AAAA,EAIzF,QAAQ;AAAA,EAER;AACA,QAAM,uBACH,UAAU,QAAQ,sBAAsB,KAAqC,IAAI,qBAAqB,EAAE;AAC3G,QAAM,cAAc,MAAM,8BAA8B,WAAW,MAAM,GAAG;AAC5E,MAAI,YAAY,OAAQ,QAAO,aAAa,KAAK,EAAE,OAAO,YAAY,GAAG,EAAE,QAAQ,IAAI,CAAC;AACxF,QAAM,QAAQ,YAAY;AAC1B,MAAI,CAAC,MAAO,QAAO,aAAa,KAAK,EAAE,OAAO,eAAe,GAAG,EAAE,QAAQ,IAAI,CAAC;AAC/E,QAAM,wBAAwB,EAAE;AAEhC,MAAI,qBAAoC;AACxC,MAAI,2BAA0C;AAC9C,MAAI,UAAU;AACZ,QAAI;AACF,YAAM,EAAE,eAAe,IAAI,MAAM,OAAO,mDAAmD;AAC3F,YAAM,MAAM,MAAM,GAAG,QAAQ,gBAAgB;AAAA,QAC3C;AAAA,QACA,KAAK;AAAA,QACL,MAAM;AAAA,UACJ,EAAE,KAAK,CAAE,EAAE,UAAU,KAAK,SAAS,GAAG,EAAE,UAAU,KAAK,CAAE,EAAE;AAAA,QAC7D;AAAA,QACA,UAAU;AAAA,MACZ,CAAC;AACD,YAAM,MAAO,KAAa,cAAc,CAAC;AACzC,YAAM,OAAO,KAAK,QAAQ,IAAI,MAAM,GAAG,EAAE,IAAI,GAAG,YAAY,KAAK;AACjE,UAAI,MAAM,QAAQ,IAAI,gBAAgB,KAAK,IAAI,iBAAiB,QAAQ;AACtE,cAAM,UAAU,IAAI,IAAK,IAAI,iBAA2B,IAAI,CAAC,MAAW,OAAO,CAAC,EAAE,YAAY,EAAE,QAAQ,OAAO,EAAE,CAAC,CAAC;AACnH,YAAI,CAAC,QAAQ,IAAI,GAAG,EAAG,QAAO,aAAa,KAAK,EAAE,OAAO,wBAAwB,GAAG,EAAE,QAAQ,IAAI,CAAC;AAAA,MACrG;AACA,UAAI,OAAO,IAAI,wBAAwB,YAAY,IAAI,sBAAsB,GAAG;AAC9E,mCAA2B,IAAI;AAAA,MACjC;AACA,UAAI,OAAO,IAAI,kBAAkB,YAAY,IAAI,cAAc,KAAK,EAAE,SAAS,GAAG;AAChF,6BAAqB,sBAAsB,IAAI,aAAa;AAAA,MAC9D;AAAA,IACF,QAAQ;AAAA,IAAC;AAAA,EACX;AACA,MAAI,gCAAgC,KAAK,IAAI,GAAG;AAC9C,WAAO,aAAa,KAAK;AAAA,MACvB,OAAO,EAAE,0CAA0C,uDAAuD;AAAA,IAC5G,GAAG,EAAE,QAAQ,IAAI,CAAC;AAAA,EACpB;AACA,QAAM,oBAAoB,0BAA0B,wBAAwB;AAC5E,MAAI,KAAK,OAAO,mBAAmB;AACjC,WAAO,aAAa,KAAK;AAAA,MACvB,OAAO,EAAE,oCAAoC,6CAA6C;AAAA,IAC5F,GAAG,EAAE,QAAQ,IAAI,CAAC;AAAA,EACpB;AACA,MAAI,CAAC,wBAAwB;AAC3B,QAAI;AACF,YAAM,mBAAmB,MAAM,+BAA+B,IAAI,QAAQ;AAC1E,UAAI,gCAAgC,kBAAkB,KAAK,IAAI,GAAG;AAChE,eAAO,aAAa,KAAK;AAAA,UACvB,OAAO,EAAE,oCAAoC,oDAAoD;AAAA,QACnG,GAAG,EAAE,QAAQ,IAAI,CAAC;AAAA,MACpB;AAAA,IACF,SAAS,OAAO;AACd,aAAO,MAAM,sCAAsC,EAAE,KAAK,MAAM,CAAC;AACjE,aAAO,aAAa,KAAK;AAAA,QACvB,OAAO,EAAE,uCAAuC,0CAA0C;AAAA,MAC5F,GAAG,EAAE,QAAQ,IAAI,CAAC;AAAA,IACpB;AAAA,EACF;AACA,QAAM,MAAM,OAAO,KAAK,MAAM,KAAK,YAAY,CAAC;AAChD,QAAM,WAAW,yBAAyB,KAAK,IAAI;AACnD,QAAM,eAAe,yBAAyB,KAAK,UAAW,KAAa,IAAI;AAC/E,MAAI,0BAA0B,KAAK,UAAU,YAAY,GAAG;AAC1D,WAAO,aAAa,KAAK,EAAE,OAAO,EAAE,2CAA2C,yCAAyC,EAAE,GAAG,EAAE,QAAQ,IAAI,CAAC;AAAA,EAC9I;AACA,QAAM,uBAAuB,4BAA4B,QAAQ;AACjE,QAAM,wBAAwB,qBAAqB,sBAAsB;AACzE,QAAM,0BAA0B,MAAM;AAAA,IACpC,IAAI;AAAA,MACF,CAAC,mBAAmB,oBAAoB,qBAAqB,EAAE;AAAA,QAC7D,CAAC,SAAyB,OAAO,SAAS,YAAY,KAAK,SAAS;AAAA,MACtE;AAAA,IACF;AAAA,EACF;AACA,MAAI,YAAwC;AAC5C,aAAW,QAAQ,yBAAyB;AAC1C,UAAM,SAAS,MAAM,GAAG,QAAQ,qBAAqB,EAAE,KAAK,CAAC;AAC7D,QAAI,QAAQ;AACV,kBAAY;AACZ;AAAA,IACF;AAAA,EACF;AACA,MAAI,CAAC,WAAW;AACd,gBAAY,MAAM,GAAG,QAAQ,qBAAqB,EAAE,MAAM,qBAAqB,CAAC;AAAA,EAClF;AACA,MAAI,CAAC,WAAW;AACd,WAAO,aAAa,KAAK,EAAE,OAAO,uCAAuC,GAAG,EAAE,QAAQ,IAAI,CAAC;AAAA,EAC7F;AACA,QAAM,0BACJ,OAAO,sBAAsB,YAC7B,kBAAkB,SAAS,KAC3B,UAAU,SAAS,qBACnB,UAAU,aAAa,QACvB,UAAU,SAAS,wBACnB,UAAU,SAAS;AACrB,MAAI,yBAAyB;AAC3B,WAAO,aAAa,KAAK,EAAE,OAAO,EAAE,6CAA6C,0EAA0E,EAAE,GAAG,EAAE,QAAQ,IAAI,CAAC;AAAA,EACjL;AACA,QAAM,eAAe,MAAM,qBAAqB,oBAAoB,UAAU,MAAM,EAAE,UAAU,gBAAgB,MAAM,CAAC;AACvH,QAAM,sBAAsB,yBACxB,aAAa,qBAAqB;AAAA,IAChC,eAAe,UAAU;AAAA,IACzB;AAAA,IACA;AAAA,IACA,UAAU;AAAA,EACZ,CAAC,IACD;AACJ,MAAI,0BAA0B,CAAC,qBAAqB;AAClD,WAAO,aAAa,KAAK;AAAA,MACvB,OAAO,EAAE,+CAA+C,sDAAsD;AAAA,IAChH,GAAG,EAAE,QAAQ,IAAI,CAAC;AAAA,EACpB;AACA,MAAI,mBAA+E;AACnF,MAAI,wBAAwB;AAC1B,QAAI;AACF,yBAAmB,MAAM,uBAAuB,QAAQ;AAAA,QACtD;AAAA,QACA,gBAAgB;AAAA,QAChB,OAAO,IAAI;AAAA,QACX,QAAQ;AAAA,QACR,eAAe,aAAa;AAAA,QAC5B,aAAa;AAAA,QACb,eAAe,UAAU;AAAA,MAC3B,CAAC;AACD,UAAI,CAAC,iCAAkC,OAAM,IAAI,MAAM,2CAA2C;AAClG,YAAM,iCAAiC;AAAA,QACrC,eAAe,iBAAiB;AAAA,QAChC;AAAA,QACA,gBAAgB;AAAA,MAClB,GAAG,KAAK,IAAI,KAAO,iBAAiB,UAAU,QAAQ,IAAI,KAAK,IAAI,CAAC,CAAC;AACrE,UAAI,OAAO,uBAAuB,iBAAiB,YAAY;AAC7D,cAAM,uBAAuB,aAAa,iBAAiB,IAAI,iBAAiB,UAAU;AAAA,MAC5F;AAAA,IACF,SAAS,OAAO;AACd,UAAI,kBAAkB;AACpB,cAAM,uBAAuB,QAAQ,iBAAiB,IAAI,iBAAiB,UAAU,EAAE,MAAM,MAAM;AAAA,QAAC,CAAC;AACrG,2BAAmB;AAAA,MACrB;AACA,YAAM,OAAQ,OAA8B;AAC5C,UAAI,SAAS,kBAAkB;AAC7B,eAAO,aAAa,KAAK;AAAA,UACvB,OAAO,EAAE,oCAAoC,oDAAoD;AAAA,QACnG,GAAG,EAAE,QAAQ,IAAI,CAAC;AAAA,MACpB;AACA,UAAI,SAAS,uBAAuB;AAClC,eAAO,aAAa,KAAK;AAAA,UACvB,OAAO,EAAE,wCAAwC,yCAAyC;AAAA,QAC5F,GAAG,EAAE,QAAQ,IAAI,CAAC;AAAA,MACpB;AACA,aAAO,MAAM,uCAAuC,EAAE,KAAK,MAAM,CAAC;AAClE,aAAO,aAAa,KAAK;AAAA,QACvB,OAAO,EAAE,uCAAuC,0CAA0C;AAAA,MAC5F,GAAG,EAAE,QAAQ,IAAI,CAAC;AAAA,IACpB;AAAA,EACF;AACA,MAAI;AACJ,MAAI;AACF,UAAM,SAAS,MAAM,aAAa,MAAM;AAAA,MACtC,eAAe,UAAU;AAAA,MACzB;AAAA,MACA;AAAA,MACA,UAAU;AAAA,MACV,QAAQ;AAAA,MACR,aAAa;AAAA,IACf,CAAC;AACD,iBAAa,OAAO;AACpB,QAAI,kBAAkB;AACpB,YAAM,uBAAwB,WAAW,iBAAiB,IAAI,iBAAiB,UAAU;AAAA,IAC3F;AAAA,EACF,SAAS,OAAO;AACd,WAAO,MAAM,0BAA0B,EAAE,KAAK,MAAM,CAAC;AACrD,QAAI,qBAAqB;AACvB,UAAI;AACF,eAAO,aAAa,eAAe,UAAU,MAAM,mBAAmB,KACjE,aAAa,OAAO,UAAU,MAAM,mBAAmB;AAC5D,YAAI,kBAAkB;AACpB,gBAAM,uBAAwB,QAAQ,iBAAiB,IAAI,iBAAiB,UAAU;AAAA,QACxF;AAAA,MACF,SAAS,cAAc;AACrB,eAAO,MAAM,2CAA2C,EAAE,KAAK,aAAa,CAAC;AAAA,MAC/E;AAAA,IACF;AACA,WAAO,aAAa,KAAK,EAAE,OAAO,gCAAgC,GAAG,EAAE,QAAQ,IAAI,CAAC;AAAA,EACtF;AAEA,QAAM,cACJ,OAAQ,UAAkB,gBAAgB,YACtC,QAAS,UAAkB,WAAW,IACtC,mCAAmC;AACzC,MAAI,mBAAkC;AACtC,QAAM,cAAc,eAAe,gBAAgB,cAAc,QAAQ;AACzE,QAAM,aAAa,cAAc,IAAI,WAAW,IAAI;AACpD,QAAM,YAAY,QAAQ,eAAe,YAAY,SAAS;AAE9D,MAAI,eAAe,CAAC,WAAW;AAC7B,UAAM,EAAE,UAAU,WAAW,QAAQ,IAAI,MAAM,aAAa,YAAY,UAAU,MAAM,UAAU;AAClG,QAAI;AACF,yBAAmB,MAAM,yBAAyB;AAAA,QAChD,UAAU;AAAA,QACV,UAAU;AAAA,MACZ,CAAC;AAAA,IACH,SAAS,OAAO;AACd,aAAO,MAAM,wCAAwC,EAAE,KAAK,MAAM,CAAC;AAAA,IACrE,UAAE;AACA,YAAM,QAAQ,EAAE,MAAM,MAAM;AAAA,MAAC,CAAC;AAAA,IAChC;AAAA,EACF;AAEA,MAAI,cAAc,oBAAoB,MAAM;AAC5C,MAAI,aAAa,mBAAmB;AAClC,kBAAc,iBAAiB,aAAa,EAAE,MAAM,UAAU,IAAI,SAAS,CAAC;AAAA,EAC9E;AACA,QAAMA,YAAW,wBAAwB,MAAM,EAAE,aAAa,KAAK,CAAC;AACpE,QAAM,eAAe,WAAW;AAChC,iCAA+B,EAAE,UAAU,KAAK,UAAU,gBAAgB,MAAM,CAAC;AACjF,QAAM,MAAM,GAAG,OAAO,YAAY;AAAA,IAChC,IAAI;AAAA,IACJ;AAAA,IACA;AAAA,IACA,gBAAgB;AAAA,IAChB,UAAU,KAAK;AAAA,IACf,UAAU;AAAA,IACV,UAAU;AAAA,IACV,UAAU,IAAI;AAAA,IACd,eAAe,UAAU;AAAA,IACzB,eAAe,UAAU,iBAAiB;AAAA,IAC1C,aAAa;AAAA,IACb,KAAK,uBAAuB,YAAY;AAAA,IACxC,SAAS;AAAA,IACT,iBAAiBA;AAAA,EACnB,CAAC;AAGD,MAAI;AACF,UAAM,GAAG,cAAc,OAAO,OAAO;AACnC,YAAM,GAAG,QAAQ,GAAG,EAAE,MAAM;AAC5B,UAAI,YAAY;AACd,cAAM,qBAAqB;AAAA,UACzB;AAAA,UACA,UAAU,EAAE,YAAY;AAAA,UACxB,UAAU;AAAA,UACV;AAAA,UACA,gBAAgB;AAAA,UAChB,QAAQ;AAAA,QACV,CAAC;AAAA,MACH;AACA,UAAI,kBAAkB;AACpB,cAAM,uBAAwB,mBAAmB,iBAAiB,IAAI,iBAAiB,YAAY,EAAE;AAAA,MACvG;AAAA,IACF,CAAC;AAAA,EACH,SAAS,OAAO;AACd,WAAO,MAAM,uDAAuD,EAAE,KAAK,MAAM,CAAC;AAClF,QAAI;AACF,aAAO,aAAa,eAAe,UAAU,MAAM,UAAU,KACxD,aAAa,OAAO,UAAU,MAAM,UAAU;AACnD,UAAI,kBAAkB;AACpB,cAAM,uBAAwB,QAAQ,iBAAiB,IAAI,iBAAiB,UAAU;AAAA,MACxF;AAAA,IACF,SAAS,cAAc;AACrB,aAAO,MAAM,+CAA+C,EAAE,KAAK,aAAa,CAAC;AAAA,IACnF;AACA,WAAO,aAAa,KAAK,EAAE,OAAO,wCAAwC,GAAG,EAAE,QAAQ,IAAI,CAAC;AAAA,EAC9F;AAEA,MAAI,WAAW;AAGb,QAAI;AACF,YAAM,qBAAqB,IAAI,KAAK,cAAc,UAAU;AAAA,IAC9D,SAAS,OAAO;AACd,aAAO,MAAM,kCAAkC,EAAE,KAAK,MAAM,CAAC;AAAA,IAC/D;AAAA,EACF,WAAW,aAAa;AACtB,WAAO,KAAK,iGAAiG;AAAA,EAC/G;AAEA,MAAI,YAAY;AACd,UAAM,oBAAoB;AAAA,MACxB;AAAA,MACA,QAAQ;AAAA,MACR,QAAQ;AAAA,MACR,aAAa;AAAA,QACX,IAAI,IAAI;AAAA,QACR,gBAAgB,IAAI,kBAAkB;AAAA,QACtC,UAAU,IAAI,YAAY;AAAA,MAC5B;AAAA,MACA,QAAQ;AAAA,MACR,SAAS;AAAA,IACX,CAAC;AACD,UAAM,WAAW,sBAAsB;AAAA,EACzC;AAEA,SAAO,aAAa,KAAK;AAAA,IACvB,IAAI;AAAA,IACJ,MAAM;AAAA,MACJ,IAAI;AAAA,MACJ,KAAK,IAAI;AAAA,MACT,UAAU;AAAA,MACV,UAAU,IAAI;AAAA,MACd,eAAe,UAAU;AAAA,MACzB,cAAc,wBAAwB,cAAc;AAAA,QAClD,OAAO;AAAA,QACP,QAAQ;AAAA,QACR,MAAM,0BAA0B,QAAQ;AAAA,MAC1C,CAAC;AAAA,MACD,SAAS,oBAAoB;AAAA,MAC7B,MAAMA,UAAS,QAAQ,CAAC;AAAA,MACxB,aAAaA,UAAS,eAAe,CAAC;AAAA,MACtC,cAAc,OAAO,KAAK,iBAAiB,EAAE,SAAS,oBAAoB;AAAA,IAC5E;AAAA,EACF,CAAC;AACH;AAEA,eAAe,+BAA+B,IAAmB,UAAmC;AAClG,MAAI;AACF,UAAM,KAAK,GAAG,UAAe;AAC7B,UAAM,MAAM,MAAM,GACf,WAAW,aAAa,EACxB,OAAO,oBAA4B,GAAG,YAAY,CAAC,EACnD,MAAM,aAAa,KAAK,QAAQ,EAChC,iBAAiB;AACpB,UAAM,QAAQ,KAAK;AACnB,QAAI,OAAO,UAAU,SAAU,QAAO,OAAO,SAAS,KAAK,IAAI,QAAQ;AACvE,QAAI,OAAO,UAAU,UAAU;AAC7B,YAAM,SAAS,OAAO,KAAK;AAC3B,aAAO,OAAO,SAAS,MAAM,IAAI,SAAS;AAAA,IAC5C;AACA,WAAO;AAAA,EACT,SAAS,OAAO;AACd,UAAM,IAAI,MAAM,+CAA+C,EAAE,OAAO,MAAM,CAAC;AAAA,EACjF;AACF;AAEA,eAAsB,OAAO,KAAc;AACzC,QAAM,OAAO,MAAM,mBAAmB,GAAG;AACzC,MAAI,CAAC,QAAQ,CAAC,KAAK,YAAa,CAAC,KAAK,SAAS,CAAC,KAAK,aAAe,QAAO,aAAa,KAAK,EAAE,OAAO,eAAe,GAAG,EAAE,QAAQ,IAAI,CAAC;AACvI,QAAM,MAAM,IAAI,IAAI,IAAI,GAAG;AAC3B,QAAM,KAAK,IAAI,aAAa,IAAI,IAAI,KAAK;AACzC,MAAI,CAAC,GAAI,QAAO,aAAa,KAAK,EAAE,OAAO,4BAA4B,GAAG,EAAE,QAAQ,IAAI,CAAC;AACzF,QAAM,YAAY,MAAM,uBAAuB;AAC/C,QAAM,KAAK,UAAU,QAAQ,IAAI;AACjC,QAAM,aAAa,UAAU,QAAQ,YAAY;AACjD,QAAM,uBACH,UAAU,QAAQ,sBAAsB,KAAqC,IAAI,qBAAqB,EAAE;AAM3G,QAAM,cAAc,MAAM,8BAA8B,WAAW,MAAM,GAAG;AAC5E,MAAI,YAAY,OAAQ,QAAO,aAAa,KAAK,EAAE,OAAO,uBAAuB,GAAG,EAAE,QAAQ,IAAI,CAAC;AACnG,QAAM,QAAQ,YAAY;AAC1B,QAAM,eAAwC,EAAE,IAAI,UAAU,KAAK,SAAU;AAC7E,MAAI,MAAO,cAAa,iBAAiB;AACzC,QAAM,SAAS,MAAM,GAAG,QAAQ,YAAY,YAAY;AACxD,MAAI,CAAC,OAAQ,QAAO,aAAa,KAAK,EAAE,OAAO,uBAAuB,GAAG,EAAE,QAAQ,IAAI,CAAC;AACxF,QAAM,UAAU,MAAM,uBAAuB,IAAI,MAAM;AACvD,MAAI,CAAC,QAAQ,QAAS,QAAO,aAAa,KAAK,EAAE,OAAO,uBAAuB,GAAG,EAAE,QAAQ,IAAI,CAAC;AACjG,QAAM,8BAA8B,OAAO,eAAe,OAAO,EAAE,EAAE,MAAM,CAAC,UAAU;AACpF,WAAO,MAAM,uCAAuC,EAAE,KAAK,MAAM,CAAC;AAAA,EACpE,CAAC;AACD,MAAI,OAAO,eAAe,QAAQ,gBAAgB;AAChD,UAAM,YAAY,MAAM,qBAAqB,oBAAoB,OAAO,eAAe;AAAA,MACrF,UAAU,OAAO,YAAY,KAAK;AAAA,MAClC,gBAAgB,OAAO,kBAAkB,SAAS;AAAA,IACpD,CAAC;AACD,UAAM,UAAU,OAAO,OAAO,eAAe,OAAO,WAAW;AAAA,EACjE;AACA,MAAI,YAAY;AACd,UAAM,oBAAoB;AAAA,MACxB;AAAA,MACA,QAAQ;AAAA,MACR,QAAQ;AAAA,MACR,aAAa;AAAA,QACX,IAAI,OAAO;AAAA,QACX,gBAAgB,OAAO,kBAAkB;AAAA,QACzC,UAAU,OAAO,YAAY;AAAA,MAC/B;AAAA,MACA,QAAQ;AAAA,MACR,SAAS;AAAA,IACX,CAAC;AACD,UAAM,WAAW,sBAAsB;AAAA,EACzC;AACA,SAAO,aAAa,KAAK,EAAE,IAAI,KAAK,CAAC;AACvC;AAEO,MAAM,UAA2B;AAAA,EACtC,SAAS;AAAA,EACT,aAAa;AAAA,EACb,SAAS;AAAA,IACP,KAAK;AAAA,MACH,SAAS;AAAA,MACT,aAAa;AAAA,MACb,OAAO;AAAA,MACP,WAAW;AAAA,QACT,EAAE,QAAQ,KAAK,aAAa,oCAAoC,QAAQ,6BAA6B;AAAA,MACvG;AAAA,MACA,QAAQ;AAAA,QACN,EAAE,QAAQ,KAAK,aAAa,wCAAwC,QAAQ,YAAY;AAAA,QACxF,EAAE,QAAQ,KAAK,aAAa,gBAAgB,QAAQ,YAAY;AAAA,MAClE;AAAA,IACF;AAAA,IACA,MAAM;AAAA,MACJ,SAAS;AAAA,MACT,aAAa;AAAA,MACb,aAAa;AAAA,QACX,aAAa;AAAA,QACb,QAAQ;AAAA,MACV;AAAA,MACA,WAAW;AAAA,QACT,EAAE,QAAQ,KAAK,aAAa,kCAAkC,QAAQ,qBAAqB;AAAA,MAC7F;AAAA,MACA,QAAQ;AAAA,QACN,EAAE,QAAQ,KAAK,aAAa,4BAA4B,QAAQ,YAAY;AAAA,QAC5E,EAAE,QAAQ,KAAK,aAAa,gBAAgB,QAAQ,YAAY;AAAA,QAChE,EAAE,QAAQ,KAAK,aAAa,yCAAyC,QAAQ,YAAY;AAAA,MAC3F;AAAA,IACF;AAAA,IACA,QAAQ;AAAA,MACN,SAAS;AAAA,MACT,aAAa;AAAA,MACb,OAAO;AAAA,MACP,WAAW;AAAA,QACT,EAAE,QAAQ,KAAK,aAAa,sBAAsB,QAAQ,EAAE,OAAO,EAAE,IAAI,EAAE,QAAQ,IAAI,EAAE,CAAC,EAAE;AAAA,QAC5F,EAAE,QAAQ,KAAK,aAAa,wBAAwB,QAAQ,YAAY;AAAA,MAC1E;AAAA,MACA,QAAQ;AAAA,QACN,EAAE,QAAQ,KAAK,aAAa,iCAAiC,QAAQ,YAAY;AAAA,QACjF,EAAE,QAAQ,KAAK,aAAa,gBAAgB,QAAQ,YAAY;AAAA,MAClE;AAAA,IACF;AAAA,EACF;AACF;",
-  "names": ["metadata"]
+  "sourcesContent": ["import { LockMode } from '@mikro-orm/core'\nimport { findOneWithDecryption } from '@open-mercato/shared/lib/encryption/find'\nimport { prepareAttachmentMutation } from '../lib/access-mutation'\nimport { throwAttachmentAccessError } from '../lib/access-errors'\nimport { createAttachmentAccessContext } from '../lib/access-runner'\nimport { assertAttachmentOwnerAccess, requiresAttachmentAccessScan, scanAuthorizedAttachments } from '../lib/access-query'\nimport { withAttachmentAccessErrors } from '../lib/access-errors'\nimport { NextResponse } from 'next/server'\nimport { createRequestContainer } from '@open-mercato/shared/lib/di/container'\nimport { getAuthFromRequest } from '@open-mercato/shared/lib/auth/server'\nimport { z } from 'zod'\nimport { sql } from 'kysely'\nimport type { OpenApiRouteDoc } from '@open-mercato/shared/lib/openapi'\nimport { buildAttachmentFileUrl, buildAttachmentImageUrl, slugifyAttachmentFileName } from '../lib/imageUrls'\nimport { ensureAttachmentPartitionProtection } from '../lib/access-protection'\nimport { ensureDefaultPartitions, resolveDefaultPartitionCode, sanitizePartitionCode } from '../lib/partitions'\nimport { Attachment, AttachmentPartition } from '../data/entities'\nimport { extractAttachmentContent } from '../lib/textExtraction'\nimport { requestOcrProcessing } from '../lib/ocrQueue'\nimport { StorageDriverFactory } from '../lib/drivers'\nimport { OcrService, shouldUseLlmOcr } from '../lib/ocrService'\nimport { clearAttachmentThumbnailCache } from '../lib/thumbnailCache'\nimport { lockAttachmentStorageReferences, resolveAttachmentStorageRelease } from '../lib/storageReferences'\nimport { assertAttachmentScopeInvariant } from '../lib/access'\nimport { resolveAttachmentRequestScope } from '../lib/requestScope'\nimport {\n  mergeAttachmentMetadata,\n  normalizeAttachmentAssignments,\n  normalizeAttachmentTags,\n  readAttachmentMetadata,\n  upsertAssignment,\n  type AttachmentAssignment,\n} from '../lib/metadata'\nimport { randomUUID } from 'crypto'\nimport type { EntityManager } from '@mikro-orm/postgresql'\nimport { splitCustomFieldPayload } from '@open-mercato/shared/lib/crud/custom-fields'\nimport { emitCrudSideEffects, setCustomFieldsIfAny } from '@open-mercato/shared/lib/commands/helpers'\nimport { resolveTranslations } from '@open-mercato/shared/lib/i18n/server'\nimport { attachmentCrudEvents, attachmentCrudIndexer } from '../lib/crud'\nimport { E } from '#generated/entities.ids.generated'\nimport { resolveDefaultAttachmentOcrEnabled } from '../lib/ocrConfig'\nimport {\n  detectAttachmentMimeType,\n  hasDangerousExecutableExtension,\n  isActiveContentAttachment,\n  sanitizeUploadedFileName,\n} from '../lib/security'\nimport {\n  isMultipartUploadLimitError,\n  isMultipartRequestWithinUploadLimit,\n  parseMultipartFormDataWithinUploadLimit,\n  resolveAttachmentMaxBytes,\n  willExceedAttachmentTenantQuota,\n} from '../lib/upload-limits'\nimport { findWithDecryption } from '@open-mercato/shared/lib/encryption/find'\nimport { createLogger } from '@open-mercato/shared/lib/logger'\nimport type { AttachmentQuotaService } from '../lib/quota-service'\nimport { resolveAttachmentsUploadRateLimitConfig } from '../lib/ocrLimits'\nimport { checkRateLimit, RATE_LIMIT_ERROR_FALLBACK, RATE_LIMIT_ERROR_KEY } from '@open-mercato/shared/lib/ratelimit/helpers'\nimport type { RateLimiterService } from '@open-mercato/shared/lib/ratelimit/service'\n\nconst logger = createLogger('attachments')\n\nexport const metadata = {\n  GET: { requireAuth: true, requireFeatures: ['attachments.view'] },\n  POST: { requireAuth: true, requireFeatures: ['attachments.manage'] },\n  DELETE: { requireAuth: true, requireFeatures: ['attachments.manage'] },\n}\n\nconst ATTACHMENT_LIST_MAX_PAGE_SIZE = 100\n\nconst attachmentQuerySchema = z.object({\n  entityId: z.string().min(1).describe('Entity identifier that owns the attachments'),\n  recordId: z.string().min(1).describe('Record identifier within the entity'),\n  page: z.coerce.number().min(1).optional(),\n  pageSize: z.coerce.number().min(1).max(ATTACHMENT_LIST_MAX_PAGE_SIZE).optional(),\n})\n\nconst attachmentAssignmentSchema = z.object({\n  type: z.string().describe('Assignment type identifier'),\n  id: z.string().describe('Assignment record identifier'),\n  href: z.string().nullable().optional().describe('Optional link to the related record'),\n  label: z.string().nullable().optional().describe('Optional label for the assignment'),\n})\n\nconst attachmentItemSchema = z.object({\n  id: z.string().describe('Attachment identifier'),\n  url: z.string().describe('Public path to the stored asset'),\n  fileName: z.string().describe('Original filename'),\n  fileSize: z.number().int().nonnegative().describe('File size in bytes'),\n  createdAt: z.string().describe('Upload timestamp (ISO 8601)'),\n  mimeType: z.string().nullable().optional().describe('MIME type of the file'),\n  thumbnailUrl: z.string().optional().describe('Helper route that renders a thumbnail'),\n  partitionCode: z.string().optional().describe('Partition identifier'),\n  tags: z.array(z.string()).optional().describe('Tags assigned to the attachment'),\n  content: z.string().nullable().optional().describe('Extracted text or markdown content'),\n  assignments: z.array(attachmentAssignmentSchema).optional().describe('Records that reference this attachment'),\n})\n\nconst attachmentListResponseSchema = z.object({\n  items: z.array(attachmentItemSchema),\n  total: z.number().int().nonnegative().optional(),\n  page: z.number().int().min(1).optional(),\n  pageSize: z.number().int().min(1).optional(),\n  totalPages: z.number().int().min(1).optional(),\n})\n\nconst attachmentUploadBodySchema = z.object({\n  entityId: z.string().min(1),\n  recordId: z.string().min(1),\n  fieldKey: z.string().optional(),\n  file: z.string().min(1).describe('Binary file payload; supplied as multipart form-data'),\n  customFields: z\n    .string()\n    .optional()\n    .describe('JSON encoded map of custom field values collected from the upload form.'),\n})\n\nconst attachmentDeleteQuerySchema = z.object({\n  id: z.string().uuid(),\n})\n\nconst uploadResponseSchema = z.object({\n  ok: z.literal(true),\n  item: z.object({\n    id: z.string(),\n    url: z.string(),\n    fileName: z.string(),\n    fileSize: z.number().int().nonnegative(),\n    thumbnailUrl: z.string().optional(),\n    content: z.string().nullable().optional(),\n    tags: z.array(z.string()).optional(),\n    assignments: z.array(attachmentAssignmentSchema).optional(),\n    customFields: z.record(z.string(), z.unknown()).optional(),\n  }),\n})\n\nconst errorSchema = z.object({\n  error: z.string(),\n})\n\nconst LIBRARY_ENTITY_ID = 'attachments:library'\n\nfunction parseCustomFieldsEntry(value: FormDataEntryValue | null): Record<string, unknown> {\n  if (!value) return {}\n  if (typeof value === 'string') {\n    const trimmed = value.trim()\n    if (!trimmed) return {}\n    try {\n      const parsed = JSON.parse(trimmed)\n      if (parsed && typeof parsed === 'object' && !Array.isArray(parsed)) {\n        return parsed as Record<string, unknown>\n      }\n    } catch {\n      return {}\n    }\n  }\n  if (typeof value === 'object' && !Array.isArray(value) && !(value instanceof File)) {\n    return { ...(value as Record<string, unknown>) }\n  }\n  return {}\n}\n\nfunction buildFormPayload(form: FormData): Record<string, unknown> {\n  const payload: Record<string, unknown> = {}\n  form.forEach((value, key) => {\n    if (key === 'customFields') {\n      payload.customFields = parseCustomFieldsEntry(value)\n      return\n    }\n    payload[key] = value\n  })\n  return payload\n}\n\nfunction parseFormTags(value: FormDataEntryValue | null): string[] {\n  if (!value) return []\n  if (typeof value === 'string') {\n    const trimmed = value.trim()\n    if (!trimmed) return []\n    try {\n      const parsed = JSON.parse(trimmed)\n      return normalizeAttachmentTags(parsed)\n    } catch {\n      return normalizeAttachmentTags(value)\n    }\n  }\n  return []\n}\n\nfunction parseFormAssignments(value: FormDataEntryValue | null): AttachmentAssignment[] {\n  if (!value) return []\n  if (typeof value !== 'string') return []\n  const trimmed = value.trim()\n  if (!trimmed) return []\n  try {\n    const parsed = JSON.parse(trimmed)\n    return normalizeAttachmentAssignments(parsed)\n  } catch {\n    return []\n  }\n}\n\nasync function listRecordAttachments(req: Request) {\n  const auth = await getAuthFromRequest(req)\n  if (!auth || !auth.tenantId || (!auth.orgId && !auth.isSuperAdmin)) return NextResponse.json({ error: 'Unauthorized' }, { status: 401 })\n  const url = new URL(req.url)\n  const parsedQuery = attachmentQuerySchema.safeParse({\n    entityId: url.searchParams.get('entityId') || '',\n    recordId: url.searchParams.get('recordId') || '',\n    page: url.searchParams.get('page') ?? undefined,\n    pageSize: url.searchParams.get('pageSize') ?? undefined,\n  })\n  if (!parsedQuery.success) {\n    return NextResponse.json({ error: 'entityId and recordId are required' }, { status: 400 })\n  }\n  const { entityId, recordId, page, pageSize } = parsedQuery.data\n\n  const container = await createRequestContainer()\n  const em = container.resolve('em') as EntityManager\n  const requestScope = await resolveAttachmentRequestScope(container, auth, req)\n  if (requestScope.denied) return NextResponse.json({ error: 'Forbidden' }, { status: 403 })\n  const orgId = requestScope.organizationId\n  const filter: Record<string, unknown> = { entityId, recordId, tenantId: auth.tenantId! }\n  if (orgId) filter.organizationId = orgId\n  const orderBy: Record<string, 'ASC' | 'DESC'> = { createdAt: 'DESC', id: 'DESC' }\n  const usePaging = typeof page === 'number' && typeof pageSize === 'number'\n  const currentPage = usePaging ? Math.max(1, page) : null\n  const currentPageSize = usePaging ? pageSize : null\n  const pageOffset = usePaging ? (currentPage! - 1) * currentPageSize! : undefined\n  const partitions = await em.find(AttachmentPartition, {})\n  const protectedScan = requiresAttachmentAccessScan(partitions)\n  const scope = { tenantId: auth.tenantId ?? null, organizationId: orgId ?? null }\n  let items: Attachment[]\n  let total: number | null\n  if (protectedScan) {\n    const scanned = await scanAuthorizedAttachments({\n      auth: { ...auth, orgId }, context: createAttachmentAccessContext(container), partitions,\n      offset: pageOffset, limit: currentPageSize ?? ATTACHMENT_LIST_MAX_PAGE_SIZE,\n      loadBatch: (offset, limit) => findWithDecryption(em, Attachment, filter, { orderBy, offset, limit }, scope),\n    })\n    items = scanned.records\n    total = usePaging ? scanned.total : null\n  } else {\n    total = usePaging ? await em.count(Attachment, filter) : null\n    items = await findWithDecryption(em, Attachment, filter, {\n      orderBy, ...(usePaging ? { limit: currentPageSize!, offset: pageOffset } : { limit: ATTACHMENT_LIST_MAX_PAGE_SIZE }),\n    }, scope)\n  }\n  const totalPages = usePaging && total !== null ? Math.max(1, Math.ceil(total / currentPageSize!)) : null\n  return NextResponse.json({\n    items: items.map((a: any) => {\n      const metadata = readAttachmentMetadata(a.storageMetadata)\n      return {\n        id: a.id,\n        url: a.url,\n        fileName: a.fileName,\n        fileSize: a.fileSize,\n        createdAt: a.createdAt,\n        mimeType: a.mimeType ?? null,\n        partitionCode: a.partitionCode,\n        content: a.content ?? null,\n        thumbnailUrl: buildAttachmentImageUrl(a.id, {\n          width: 320,\n          height: 320,\n          slug: slugifyAttachmentFileName(a.fileName),\n        }),\n        tags: metadata.tags ?? [],\n        assignments: metadata.assignments ?? [],\n      }\n    }),\n    ...(usePaging\n      ? {\n          total,\n          page: currentPage,\n          pageSize: currentPageSize,\n          totalPages,\n        }\n      : {}),\n  }, { headers: protectedScan ? { 'Cache-Control': 'private, no-store' } : undefined })\n}\n\nexport const GET = withAttachmentAccessErrors(listRecordAttachments)\n\nexport async function POST(req: Request) {\n  const { t } = await resolveTranslations()\n  const auth = await getAuthFromRequest(req)\n  if (!auth || !auth.tenantId || (!auth.orgId && !auth.isSuperAdmin)) return NextResponse.json({ error: 'Unauthorized' }, { status: 401 })\n  // A superadmin browsing with \"All organizations\" selected has no concrete\n  // organization scope, but an attachment must be stored under exactly one\n  // organization (the scope invariant forbids partial-null rows). Reject with a\n  // clear, actionable error instead of a 401 \u2014 a 401 makes the client-side\n  // fetch layer treat it as session expiry, show a misleading toast, and reset\n  // the in-progress form (#3764).\n  if (!auth.orgId) {\n    return NextResponse.json({\n      error: t('attachments.errors.selectOrganization', 'Select a specific organization before uploading an attachment.'),\n    }, { status: 400 })\n  }\n  const tenantId = auth.tenantId\n\n  const container = await createRequestContainer()\n  let rateLimiterService: RateLimiterService | null = null\n  try {\n    rateLimiterService = container.resolve('rateLimiterService') as RateLimiterService | null\n  } catch (error) {\n    // Fail-open: uploads proceed when the limiter cannot be resolved (minimal/test containers).\n    logger.warn('Attachment upload rate limiter unavailable; throttle skipped', { err: error })\n  }\n  if (rateLimiterService) {\n    const principal = typeof auth.sub === 'string' && auth.sub.length > 0\n      ? auth.sub\n      : (typeof auth.userId === 'string' && auth.userId.length > 0 ? auth.userId : null)\n    if (!principal) {\n      logger.warn('Attachment upload rate limit skipped: missing authenticated principal')\n    } else {\n      const rateLimitResponse = await checkRateLimit(\n        rateLimiterService,\n        resolveAttachmentsUploadRateLimitConfig(),\n        `${tenantId}:${principal}`,\n        t(RATE_LIMIT_ERROR_KEY, RATE_LIMIT_ERROR_FALLBACK),\n      )\n      if (rateLimitResponse) return rateLimitResponse\n    }\n  } else {\n    logger.warn('Attachment upload rate limiter not registered; throttle skipped')\n  }\n\n  const contentType = req.headers.get('content-type') || ''\n  if (!contentType.toLowerCase().includes('multipart/form-data')) {\n    return NextResponse.json({ error: 'Expected multipart/form-data' }, { status: 400 })\n  }\n  if (!isMultipartRequestWithinUploadLimit(req.headers.get('content-length'))) {\n    return NextResponse.json({\n      error: t('attachments.errors.maxUploadSize', 'Attachment exceeds the maximum upload size.'),\n    }, { status: 413 })\n  }\n\n  let form: FormData\n  try {\n    form = await parseMultipartFormDataWithinUploadLimit(req)\n  } catch (error) {\n    if (isMultipartUploadLimitError(error)) {\n      return NextResponse.json({\n        error: t('attachments.errors.maxUploadSize', 'Attachment exceeds the maximum upload size.'),\n      }, { status: 413 })\n    }\n    throw error\n  }\n  const formPayload = buildFormPayload(form)\n  const customFieldValues = splitCustomFieldPayload(formPayload).custom\n  const entityId = String(form.get('entityId') || '')\n  const recordId = String(form.get('recordId') || '')\n  const fieldKey = String(form.get('fieldKey') || '')\n  const file = form.get('file') as unknown as File | null\n  if (!entityId || !recordId || !file) return NextResponse.json({ error: 'entityId, recordId and file are required' }, { status: 400 })\n  const partitionOverrideRaw = form.get('partitionCode')\n  const partitionOverride =\n    typeof partitionOverrideRaw === 'string' && partitionOverrideRaw.trim().length > 0\n      ? sanitizePartitionCode(partitionOverrideRaw)\n      : null\n  const tags = parseFormTags(form.get('tags'))\n  const assignmentsFromForm = parseFormAssignments(form.get('assignments'))\n\n  const em = container.resolve('em') as EntityManager\n  const dataEngine = container.resolve('dataEngine')\n  let attachmentQuotaService: AttachmentQuotaService | null = null\n  let attachmentQuotaRecoveryScheduler: ((\n    payload: { reservationId: string; tenantId: string; organizationId: string },\n    delayMs: number,\n  ) => Promise<void>) | null = null\n  try {\n    attachmentQuotaService = container.resolve('attachmentQuotaService') as AttachmentQuotaService\n    attachmentQuotaRecoveryScheduler = container.resolve('attachmentQuotaRecoveryScheduler') as (\n      payload: { reservationId: string; tenantId: string; organizationId: string },\n      delayMs: number,\n    ) => Promise<void>\n  } catch {\n    // Legacy fallback below when the quota service is not registered in this container.\n  }\n  const storageDriverFactory =\n    (container.resolve('storageDriverFactory') as StorageDriverFactory | null) ?? new StorageDriverFactory(em)\n  const uploadScope = await resolveAttachmentRequestScope(container, auth, req)\n  if (uploadScope.denied) return NextResponse.json({ error: 'Forbidden' }, { status: 403 })\n  const orgId = uploadScope.organizationId\n  if (!orgId) return NextResponse.json({ error: 'Unauthorized' }, { status: 401 })\n  await ensureDefaultPartitions(em)\n  // Optional per-field validations\n  let partitionFromField: string | null = null\n  let fieldMaxAttachmentSizeMb: number | null = null\n  if (fieldKey) {\n    try {\n      const { CustomFieldDef } = await import('@open-mercato/core/modules/entities/data/entities')\n      const def = await em.findOne(CustomFieldDef, {\n        entityId,\n        key: fieldKey,\n        $and: [\n          { $or: [ { tenantId: auth.tenantId }, { tenantId: null } ] },\n        ],\n        isActive: true,\n      })\n      const cfg = (def as any)?.configJson || {}\n      const ext = (file.name || '').split('.').pop()?.toLowerCase() || ''\n      if (Array.isArray(cfg.acceptExtensions) && cfg.acceptExtensions.length) {\n        const allowed = new Set((cfg.acceptExtensions as any[]).map((x: any) => String(x).toLowerCase().replace(/^\\./, '')))\n        if (!allowed.has(ext)) return NextResponse.json({ error: 'File type not allowed' }, { status: 400 })\n      }\n      if (typeof cfg.maxAttachmentSizeMb === 'number' && cfg.maxAttachmentSizeMb > 0) {\n        fieldMaxAttachmentSizeMb = cfg.maxAttachmentSizeMb\n      }\n      if (typeof cfg.partitionCode === 'string' && cfg.partitionCode.trim().length > 0) {\n        partitionFromField = sanitizePartitionCode(cfg.partitionCode)\n      }\n    } catch {}\n  }\n  if (hasDangerousExecutableExtension(file.name)) {\n    return NextResponse.json({\n      error: t('attachments.errors.dangerousExecutable', 'Executable file types are not allowed as attachments.'),\n    }, { status: 400 })\n  }\n  const effectiveMaxBytes = resolveAttachmentMaxBytes(fieldMaxAttachmentSizeMb)\n  if (file.size > effectiveMaxBytes) {\n    return NextResponse.json({\n      error: t('attachments.errors.maxUploadSize', 'Attachment exceeds the maximum upload size.'),\n    }, { status: 413 })\n  }\n  if (!attachmentQuotaService) {\n    try {\n      const tenantUsageBytes = await readTenantAttachmentUsageBytes(em, tenantId)\n      if (willExceedAttachmentTenantQuota(tenantUsageBytes, file.size)) {\n        return NextResponse.json({\n          error: t('attachments.errors.quotaExceeded', 'Attachment storage quota exceeded for this tenant.'),\n        }, { status: 413 })\n      }\n    } catch (error) {\n      logger.error('Attachment quota accounting failed', { err: error })\n      return NextResponse.json({\n        error: t('attachments.errors.quotaUnavailable', 'Storage quota accounting is unavailable.'),\n      }, { status: 500 })\n    }\n  }\n  const buf = Buffer.from(await file.arrayBuffer())\n  const safeName = sanitizeUploadedFileName(file.name)\n  const fileMimeType = detectAttachmentMimeType(buf, safeName, (file as any).type)\n  if (isActiveContentAttachment(buf, safeName, fileMimeType)) {\n    return NextResponse.json({ error: t('attachments.errors.activeContentBlocked', 'Active content uploads are not allowed.') }, { status: 400 })\n  }\n  const defaultPartitionCode = resolveDefaultPartitionCode(entityId)\n  const resolvedPartitionCode = partitionOverride ?? partitionFromField ?? defaultPartitionCode\n  const partitionCodeCandidates = Array.from(\n    new Set(\n      [partitionOverride, partitionFromField, resolvedPartitionCode].filter(\n        (code): code is string => typeof code === 'string' && code.length > 0,\n      ),\n    ),\n  )\n  let partition: AttachmentPartition | null = null\n  for (const code of partitionCodeCandidates) {\n    const record = await em.findOne(AttachmentPartition, { code })\n    if (record) {\n      partition = record\n      break\n    }\n  }\n  if (!partition) {\n    partition = await em.findOne(AttachmentPartition, { code: defaultPartitionCode })\n  }\n  if (!partition) {\n    return NextResponse.json({ error: 'Storage partition is not configured.' }, { status: 400 })\n  }\n  await ensureAttachmentPartitionProtection(em, partition)\n  const requestedPublicOverride =\n    typeof partitionOverride === 'string' &&\n    partitionOverride.length > 0 &&\n    partition.code === partitionOverride &&\n    partition.isPublic === true &&\n    partition.code !== defaultPartitionCode &&\n    partition.code !== partitionFromField\n  if (requestedPublicOverride) {\n    return NextResponse.json({ error: t('attachments.errors.publicPartitionBlocked', 'Public storage partitions cannot be selected explicitly for this upload.') }, { status: 403 })\n  }\n  const uploadDriver = await storageDriverFactory.resolveForPartition(partition.code, { tenantId, organizationId: orgId })\n  const preparedStoragePath = attachmentQuotaService\n    ? uploadDriver.prepareStoragePath?.({\n        partitionCode: partition.code,\n        orgId,\n        tenantId,\n        fileName: safeName,\n      })\n    : undefined\n  if (attachmentQuotaService && !preparedStoragePath) {\n    return NextResponse.json({\n      error: t('attachments.errors.quotaRecoveryUnsupported', 'Storage driver cannot participate in quota recovery.'),\n    }, { status: 500 })\n  }\n  let quotaReservation: { id: string; leaseToken: string; expiresAt: Date } | null = null\n  if (attachmentQuotaService) {\n    try {\n      quotaReservation = await attachmentQuotaService.reserve({\n        tenantId,\n        organizationId: orgId,\n        bytes: buf.length,\n        source: 'attachment',\n        storageDriver: uploadDriver.key,\n        storagePath: preparedStoragePath!,\n        partitionCode: partition.code,\n      })\n      if (!attachmentQuotaRecoveryScheduler) throw new Error('Attachment quota recovery is unavailable.')\n      await attachmentQuotaRecoveryScheduler({\n        reservationId: quotaReservation.id,\n        tenantId,\n        organizationId: orgId,\n      }, Math.max(1_000, quotaReservation.expiresAt.getTime() - Date.now()))\n      if (typeof attachmentQuotaService.beginStorage === 'function') {\n        await attachmentQuotaService.beginStorage(quotaReservation.id, quotaReservation.leaseToken)\n      }\n    } catch (error) {\n      if (quotaReservation) {\n        await attachmentQuotaService.release(quotaReservation.id, quotaReservation.leaseToken).catch(() => {})\n        quotaReservation = null\n      }\n      const code = (error as { code?: unknown })?.code\n      if (code === 'quota_exceeded') {\n        return NextResponse.json({\n          error: t('attachments.errors.quotaExceeded', 'Attachment storage quota exceeded for this tenant.'),\n        }, { status: 413 })\n      }\n      if (code === 'quota_target_exists') {\n        return NextResponse.json({\n          error: t('attachments.errors.storagePathExists', 'The target storage path already exists.'),\n        }, { status: 409 })\n      }\n      logger.error('Attachment quota reservation failed', { err: error })\n      return NextResponse.json({\n        error: t('attachments.errors.quotaUnavailable', 'Storage quota accounting is unavailable.'),\n      }, { status: 500 })\n    }\n  }\n  let storedPath: string\n  try {\n    const stored = await uploadDriver.store({\n      partitionCode: partition.code,\n      orgId,\n      tenantId,\n      fileName: safeName,\n      buffer: buf,\n      storagePath: preparedStoragePath,\n    })\n    storedPath = stored.storagePath\n    if (quotaReservation) {\n      await attachmentQuotaService!.markStored(quotaReservation.id, quotaReservation.leaseToken)\n    }\n  } catch (error) {\n    logger.error('Failed to persist file', { err: error })\n    if (preparedStoragePath) {\n      try {\n        await (uploadDriver.deleteStrict?.(partition.code, preparedStoragePath)\n          ?? uploadDriver.delete(partition.code, preparedStoragePath))\n        if (quotaReservation) {\n          await attachmentQuotaService!.release(quotaReservation.id, quotaReservation.leaseToken)\n        }\n      } catch (cleanupError) {\n        logger.error('Failed to compensate attachment storage', { err: cleanupError })\n      }\n    }\n    return NextResponse.json({ error: 'Failed to persist attachment.' }, { status: 500 })\n  }\n\n  const requiresOcr =\n    typeof (partition as any).requiresOcr === 'boolean'\n      ? Boolean((partition as any).requiresOcr)\n      : resolveDefaultAttachmentOcrEnabled()\n  let extractedContent: string | null = null\n  const wantsLlmOcr = requiresOcr && shouldUseLlmOcr(fileMimeType, safeName)\n  const ocrService = wantsLlmOcr ? new OcrService() : null\n  const useLlmOcr = Boolean(wantsLlmOcr && ocrService?.available)\n\n  if (requiresOcr && !useLlmOcr) {\n    const { filePath: localPath, cleanup } = await uploadDriver.toLocalPath(partition.code, storedPath)\n    try {\n      extractedContent = await extractAttachmentContent({\n        filePath: localPath,\n        mimeType: fileMimeType,\n      })\n    } catch (error) {\n      logger.error('Failed to extract attachment content', { err: error })\n    } finally {\n      await cleanup().catch(() => {})\n    }\n  }\n\n  let assignments = assignmentsFromForm.slice()\n  if (entityId !== LIBRARY_ENTITY_ID) {\n    assignments = upsertAssignment(assignments, { type: entityId, id: recordId })\n  }\n  const metadata = mergeAttachmentMetadata(null, { assignments, tags })\n  const attachmentId = randomUUID()\n  assertAttachmentScopeInvariant({ tenantId: auth.tenantId, organizationId: orgId })\n  const att = em.create(Attachment, {\n    id: attachmentId,\n    entityId,\n    recordId,\n    organizationId: orgId,\n    tenantId: auth.tenantId!,\n    fileName: safeName,\n    mimeType: fileMimeType,\n    fileSize: buf.length,\n    partitionCode: partition.code,\n    storageDriver: partition.storageDriver || 'local',\n    storagePath: storedPath,\n    url: buildAttachmentFileUrl(attachmentId),\n    content: extractedContent,\n    storageMetadata: metadata,\n  })\n  // Persist the attachment row and its custom-field values atomically so a\n  // custom-field failure cannot leave behind a committed orphan attachment.\n  try {\n    await em.transactional(async (tx) => {\n      await tx.persist(att).flush()\n      if (dataEngine) {\n        await setCustomFieldsIfAny({\n          dataEngine,\n          entityId: E.attachments.attachment,\n          recordId: attachmentId,\n          tenantId,\n          organizationId: orgId,\n          values: customFieldValues,\n        })\n      }\n      if (quotaReservation) {\n        await attachmentQuotaService!.completeAttachment(quotaReservation.id, quotaReservation.leaseToken, tx)\n      }\n    })\n  } catch (error) {\n    logger.error('Failed to persist attachment with custom attributes', { err: error })\n    try {\n      await (uploadDriver.deleteStrict?.(partition.code, storedPath)\n        ?? uploadDriver.delete(partition.code, storedPath))\n      if (quotaReservation) {\n        await attachmentQuotaService!.release(quotaReservation.id, quotaReservation.leaseToken)\n      }\n    } catch (cleanupError) {\n      logger.error('Failed to compensate attachment persistence', { err: cleanupError })\n    }\n    return NextResponse.json({ error: 'Failed to save attachment attributes.' }, { status: 500 })\n  }\n\n  if (useLlmOcr) {\n    // Await so wait-queue overflow can finish the inline text fallback before\n    // the response returns (background LLM OCR still schedules via setImmediate).\n    try {\n      await requestOcrProcessing(em, att, uploadDriver, storedPath)\n    } catch (error) {\n      logger.error('Failed to queue OCR processing', { err: error })\n    }\n  } else if (wantsLlmOcr) {\n    logger.warn('OCR requested but OPENAI_API_KEY not configured, falling back to text extraction when available')\n  }\n\n  if (dataEngine) {\n    await emitCrudSideEffects({\n      dataEngine,\n      action: 'created',\n      entity: att,\n      identifiers: {\n        id: att.id,\n        organizationId: att.organizationId ?? null,\n        tenantId: att.tenantId ?? null,\n      },\n      events: attachmentCrudEvents,\n      indexer: attachmentCrudIndexer,\n    })\n    await dataEngine.flushOrmEntityChanges()\n  }\n\n  return NextResponse.json({\n    ok: true,\n    item: {\n      id: attachmentId,\n      url: att.url,\n      fileName: safeName,\n      fileSize: buf.length,\n      partitionCode: partition.code,\n      thumbnailUrl: buildAttachmentImageUrl(attachmentId, {\n        width: 320,\n        height: 320,\n        slug: slugifyAttachmentFileName(safeName),\n      }),\n      content: extractedContent ?? null,\n      tags: metadata.tags ?? [],\n      assignments: metadata.assignments ?? [],\n      customFields: Object.keys(customFieldValues).length ? customFieldValues : undefined,\n    },\n  })\n}\n\nasync function readTenantAttachmentUsageBytes(em: EntityManager, tenantId: string): Promise<number> {\n  try {\n    const db = em.getKysely<any>() as any\n    const row = await db\n      .selectFrom('attachments')\n      .select(sql<string>`sum(file_size)`.as('total_size'))\n      .where('tenant_id', '=', tenantId)\n      .executeTakeFirst() as { total_size: string | number | null } | undefined\n    const total = row?.total_size\n    if (typeof total === 'number') return Number.isFinite(total) ? total : 0\n    if (typeof total === 'string') {\n      const parsed = Number(total)\n      return Number.isFinite(parsed) ? parsed : 0\n    }\n    return 0\n  } catch (error) {\n    throw new Error('Attachment quota accounting is unavailable.', { cause: error })\n  }\n}\n\nasync function deleteAttachment(req: Request) {\n  const auth = await getAuthFromRequest(req)\n  if (!auth || !auth.tenantId || (!auth.orgId && !auth.isSuperAdmin)) return NextResponse.json({ error: 'Unauthorized' }, { status: 401 })\n  const url = new URL(req.url)\n  const id = url.searchParams.get('id') || ''\n  if (!id) return NextResponse.json({ error: 'Attachment id is required' }, { status: 400 })\n  const container = await createRequestContainer()\n  const em = container.resolve('em') as EntityManager\n  const dataEngine = container.resolve('dataEngine')\n  const storageDriverFactory =\n    (container.resolve('storageDriverFactory') as StorageDriverFactory | null) ?? new StorageDriverFactory(em)\n  // Resolve the currently selected organization (#3765) so a multi-org admin who\n  // switched the header org deletes within that org, not their pinned home org.\n  // A superadmin browsing with \"All organizations\" selected has no concrete org,\n  // so resolution returns null and the delete falls back to a tenant-only scope\n  // (#3764) \u2014 letting them remove any attachment in the tenant.\n  const deleteScope = await resolveAttachmentRequestScope(container, auth, req)\n  if (deleteScope.denied) return NextResponse.json({ error: 'Attachment not found' }, { status: 404 })\n  const orgId = deleteScope.organizationId\n  const deleteFilter: Record<string, unknown> = { id, tenantId: auth.tenantId! }\n  if (orgId) deleteFilter.organizationId = orgId\n  const scopedAuth = { ...auth, orgId }\n  const outcome = await em.transactional(async (tx) => {\n    const candidate = await findOneWithDecryption(tx, Attachment, deleteFilter, undefined, {\n      tenantId: auth.tenantId, organizationId: orgId,\n    })\n    if (!candidate) return throwAttachmentAccessError(404)\n    const referenceIds = await lockAttachmentStorageReferences(tx, candidate)\n    const removal = resolveAttachmentStorageRelease(referenceIds, candidate.id)\n    if (!removal.removed) return throwAttachmentAccessError(404)\n    const record = await findOneWithDecryption(tx, Attachment, deleteFilter, {\n      lockMode: LockMode.PESSIMISTIC_WRITE, refresh: true,\n    }, { tenantId: auth.tenantId, organizationId: orgId })\n    if (!record) return throwAttachmentAccessError(404)\n    const guard = await prepareAttachmentMutation({ container, req, auth: scopedAuth, recordId: record.id, operation: 'delete' })\n    await assertAttachmentOwnerAccess({ em: tx, context: createAttachmentAccessContext(container), auth: scopedAuth, attachment: record, action: 'delete' })\n    const driver = record.storagePath ? await storageDriverFactory.resolveForPartition(record.partitionCode, {\n      tenantId: record.tenantId ?? auth.tenantId!, organizationId: record.organizationId ?? orgId ?? '',\n    }) : null\n    tx.remove(record)\n    await tx.flush()\n    return { record, driver, guard, releaseStorage: removal.releaseStorage }\n  })\n  const { record } = outcome\n  await clearAttachmentThumbnailCache(record.partitionCode, record.id).catch((error) => {\n    logger.error('Failed to cleanup cached thumbnails', { err: error })\n  })\n  if (outcome.driver && outcome.releaseStorage) await outcome.driver.delete(record.partitionCode, record.storagePath)\n  await outcome.guard.runAfterSuccess()\n  if (dataEngine) {\n    await emitCrudSideEffects({\n      dataEngine,\n      action: 'deleted',\n      entity: record,\n      identifiers: {\n        id: record.id,\n        organizationId: record.organizationId ?? null,\n        tenantId: record.tenantId ?? null,\n      },\n      events: attachmentCrudEvents,\n      indexer: attachmentCrudIndexer,\n    })\n    await dataEngine.flushOrmEntityChanges()\n  }\n  return NextResponse.json({ ok: true })\n}\n\nexport const DELETE = withAttachmentAccessErrors(deleteAttachment)\n\nexport const openApi: OpenApiRouteDoc = {\n  summary: 'Manage entity attachments',\n  description: 'Upload and list attachments associated with module entities and records.',\n  methods: {\n    GET: {\n      summary: 'List attachments for a record',\n      description: 'Returns uploaded attachments for the given entity record, ordered by newest first. Without both page and pageSize, only the newest 100 attachments are returned; pass page and pageSize to page through the rest.',\n      query: attachmentQuerySchema,\n      responses: [\n        { status: 200, description: 'Attachments found for the record', schema: attachmentListResponseSchema },\n      ],\n      errors: [\n        { status: 400, description: 'Missing entity or record identifiers', schema: errorSchema },\n        { status: 401, description: 'Unauthorized', schema: errorSchema },\n        { status: 403, description: 'Owner policy denies access', schema: errorSchema },\n        { status: 404, description: 'Attachment or owner is unavailable', schema: errorSchema },\n        { status: 504, description: 'Owner authorization timed out', schema: errorSchema },\n      ],\n    },\n    POST: {\n      summary: 'Upload attachment',\n      description: 'Uploads a new attachment using multipart form-data and stores metadata for later retrieval.',\n      requestBody: {\n        contentType: 'multipart/form-data',\n        schema: attachmentUploadBodySchema,\n      },\n      responses: [\n        { status: 200, description: 'Attachment stored successfully', schema: uploadResponseSchema },\n      ],\n      errors: [\n        { status: 400, description: 'Payload validation error', schema: errorSchema },\n        { status: 401, description: 'Unauthorized', schema: errorSchema },\n        { status: 403, description: 'Attachment violates field constraints', schema: errorSchema },\n      ],\n    },\n    DELETE: {\n      summary: 'Delete attachment',\n      description: 'Removes an uploaded attachment and deletes the stored asset.',\n      query: attachmentDeleteQuerySchema,\n      responses: [\n        { status: 200, description: 'Attachment deleted', schema: z.object({ ok: z.literal(true) }) },\n        { status: 404, description: 'Attachment not found', schema: errorSchema },\n      ],\n      errors: [\n        { status: 400, description: 'Missing attachment identifier', schema: errorSchema },\n        { status: 401, description: 'Unauthorized', schema: errorSchema },\n        { status: 403, description: 'Owner policy denies access', schema: errorSchema },\n        { status: 404, description: 'Attachment or owner is unavailable', schema: errorSchema },\n        { status: 504, description: 'Owner authorization timed out', schema: errorSchema },\n      ],\n    },\n  },\n}\n"],
+  "mappings": "AAAA,SAAS,gBAAgB;AACzB,SAAS,6BAA6B;AACtC,SAAS,iCAAiC;AAC1C,SAAS,kCAAkC;AAC3C,SAAS,qCAAqC;AAC9C,SAAS,6BAA6B,8BAA8B,iCAAiC;AACrG,SAAS,kCAAkC;AAC3C,SAAS,oBAAoB;AAC7B,SAAS,8BAA8B;AACvC,SAAS,0BAA0B;AACnC,SAAS,SAAS;AAClB,SAAS,WAAW;AAEpB,SAAS,wBAAwB,yBAAyB,iCAAiC;AAC3F,SAAS,2CAA2C;AACpD,SAAS,yBAAyB,6BAA6B,6BAA6B;AAC5F,SAAS,YAAY,2BAA2B;AAChD,SAAS,gCAAgC;AACzC,SAAS,4BAA4B;AACrC,SAAS,4BAA4B;AACrC,SAAS,YAAY,uBAAuB;AAC5C,SAAS,qCAAqC;AAC9C,SAAS,iCAAiC,uCAAuC;AACjF,SAAS,sCAAsC;AAC/C,SAAS,qCAAqC;AAC9C;AAAA,EACE;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,OAEK;AACP,SAAS,kBAAkB;AAE3B,SAAS,+BAA+B;AACxC,SAAS,qBAAqB,4BAA4B;AAC1D,SAAS,2BAA2B;AACpC,SAAS,sBAAsB,6BAA6B;AAC5D,SAAS,SAAS;AAClB,SAAS,0CAA0C;AACnD;AAAA,EACE;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,OACK;AACP;AAAA,EACE;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,OACK;AACP,SAAS,0BAA0B;AACnC,SAAS,oBAAoB;AAE7B,SAAS,+CAA+C;AACxD,SAAS,gBAAgB,2BAA2B,4BAA4B;AAGhF,MAAM,SAAS,aAAa,aAAa;AAElC,MAAM,WAAW;AAAA,EACtB,KAAK,EAAE,aAAa,MAAM,iBAAiB,CAAC,kBAAkB,EAAE;AAAA,EAChE,MAAM,EAAE,aAAa,MAAM,iBAAiB,CAAC,oBAAoB,EAAE;AAAA,EACnE,QAAQ,EAAE,aAAa,MAAM,iBAAiB,CAAC,oBAAoB,EAAE;AACvE;AAEA,MAAM,gCAAgC;AAEtC,MAAM,wBAAwB,EAAE,OAAO;AAAA,EACrC,UAAU,EAAE,OAAO,EAAE,IAAI,CAAC,EAAE,SAAS,6CAA6C;AAAA,EAClF,UAAU,EAAE,OAAO,EAAE,IAAI,CAAC,EAAE,SAAS,qCAAqC;AAAA,EAC1E,MAAM,EAAE,OAAO,OAAO,EAAE,IAAI,CAAC,EAAE,SAAS;AAAA,EACxC,UAAU,EAAE,OAAO,OAAO,EAAE,IAAI,CAAC,EAAE,IAAI,6BAA6B,EAAE,SAAS;AACjF,CAAC;AAED,MAAM,6BAA6B,EAAE,OAAO;AAAA,EAC1C,MAAM,EAAE,OAAO,EAAE,SAAS,4BAA4B;AAAA,EACtD,IAAI,EAAE,OAAO,EAAE,SAAS,8BAA8B;AAAA,EACtD,MAAM,EAAE,OAAO,EAAE,SAAS,EAAE,SAAS,EAAE,SAAS,qCAAqC;AAAA,EACrF,OAAO,EAAE,OAAO,EAAE,SAAS,EAAE,SAAS,EAAE,SAAS,mCAAmC;AACtF,CAAC;AAED,MAAM,uBAAuB,EAAE,OAAO;AAAA,EACpC,IAAI,EAAE,OAAO,EAAE,SAAS,uBAAuB;AAAA,EAC/C,KAAK,EAAE,OAAO,EAAE,SAAS,iCAAiC;AAAA,EAC1D,UAAU,EAAE,OAAO,EAAE,SAAS,mBAAmB;AAAA,EACjD,UAAU,EAAE,OAAO,EAAE,IAAI,EAAE,YAAY,EAAE,SAAS,oBAAoB;AAAA,EACtE,WAAW,EAAE,OAAO,EAAE,SAAS,6BAA6B;AAAA,EAC5D,UAAU,EAAE,OAAO,EAAE,SAAS,EAAE,SAAS,EAAE,SAAS,uBAAuB;AAAA,EAC3E,cAAc,EAAE,OAAO,EAAE,SAAS,EAAE,SAAS,uCAAuC;AAAA,EACpF,eAAe,EAAE,OAAO,EAAE,SAAS,EAAE,SAAS,sBAAsB;AAAA,EACpE,MAAM,EAAE,MAAM,EAAE,OAAO,CAAC,EAAE,SAAS,EAAE,SAAS,iCAAiC;AAAA,EAC/E,SAAS,EAAE,OAAO,EAAE,SAAS,EAAE,SAAS,EAAE,SAAS,oCAAoC;AAAA,EACvF,aAAa,EAAE,MAAM,0BAA0B,EAAE,SAAS,EAAE,SAAS,wCAAwC;AAC/G,CAAC;AAED,MAAM,+BAA+B,EAAE,OAAO;AAAA,EAC5C,OAAO,EAAE,MAAM,oBAAoB;AAAA,EACnC,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,YAAY,EAAE,SAAS;AAAA,EAC/C,MAAM,EAAE,OAAO,EAAE,IAAI,EAAE,IAAI,CAAC,EAAE,SAAS;AAAA,EACvC,UAAU,EAAE,OAAO,EAAE,IAAI,EAAE,IAAI,CAAC,EAAE,SAAS;AAAA,EAC3C,YAAY,EAAE,OAAO,EAAE,IAAI,EAAE,IAAI,CAAC,EAAE,SAAS;AAC/C,CAAC;AAED,MAAM,6BAA6B,EAAE,OAAO;AAAA,EAC1C,UAAU,EAAE,OAAO,EAAE,IAAI,CAAC;AAAA,EAC1B,UAAU,EAAE,OAAO,EAAE,IAAI,CAAC;AAAA,EAC1B,UAAU,EAAE,OAAO,EAAE,SAAS;AAAA,EAC9B,MAAM,EAAE,OAAO,EAAE,IAAI,CAAC,EAAE,SAAS,sDAAsD;AAAA,EACvF,cAAc,EACX,OAAO,EACP,SAAS,EACT,SAAS,yEAAyE;AACvF,CAAC;AAED,MAAM,8BAA8B,EAAE,OAAO;AAAA,EAC3C,IAAI,EAAE,OAAO,EAAE,KAAK;AACtB,CAAC;AAED,MAAM,uBAAuB,EAAE,OAAO;AAAA,EACpC,IAAI,EAAE,QAAQ,IAAI;AAAA,EAClB,MAAM,EAAE,OAAO;AAAA,IACb,IAAI,EAAE,OAAO;AAAA,IACb,KAAK,EAAE,OAAO;AAAA,IACd,UAAU,EAAE,OAAO;AAAA,IACnB,UAAU,EAAE,OAAO,EAAE,IAAI,EAAE,YAAY;AAAA,IACvC,cAAc,EAAE,OAAO,EAAE,SAAS;AAAA,IAClC,SAAS,EAAE,OAAO,EAAE,SAAS,EAAE,SAAS;AAAA,IACxC,MAAM,EAAE,MAAM,EAAE,OAAO,CAAC,EAAE,SAAS;AAAA,IACnC,aAAa,EAAE,MAAM,0BAA0B,EAAE,SAAS;AAAA,IAC1D,cAAc,EAAE,OAAO,EAAE,OAAO,GAAG,EAAE,QAAQ,CAAC,EAAE,SAAS;AAAA,EAC3D,CAAC;AACH,CAAC;AAED,MAAM,cAAc,EAAE,OAAO;AAAA,EAC3B,OAAO,EAAE,OAAO;AAClB,CAAC;AAED,MAAM,oBAAoB;AAE1B,SAAS,uBAAuB,OAA2D;AACzF,MAAI,CAAC,MAAO,QAAO,CAAC;AACpB,MAAI,OAAO,UAAU,UAAU;AAC7B,UAAM,UAAU,MAAM,KAAK;AAC3B,QAAI,CAAC,QAAS,QAAO,CAAC;AACtB,QAAI;AACF,YAAM,SAAS,KAAK,MAAM,OAAO;AACjC,UAAI,UAAU,OAAO,WAAW,YAAY,CAAC,MAAM,QAAQ,MAAM,GAAG;AAClE,eAAO;AAAA,MACT;AAAA,IACF,QAAQ;AACN,aAAO,CAAC;AAAA,IACV;AAAA,EACF;AACA,MAAI,OAAO,UAAU,YAAY,CAAC,MAAM,QAAQ,KAAK,KAAK,EAAE,iBAAiB,OAAO;AAClF,WAAO,EAAE,GAAI,MAAkC;AAAA,EACjD;AACA,SAAO,CAAC;AACV;AAEA,SAAS,iBAAiB,MAAyC;AACjE,QAAM,UAAmC,CAAC;AAC1C,OAAK,QAAQ,CAAC,OAAO,QAAQ;AAC3B,QAAI,QAAQ,gBAAgB;AAC1B,cAAQ,eAAe,uBAAuB,KAAK;AACnD;AAAA,IACF;AACA,YAAQ,GAAG,IAAI;AAAA,EACjB,CAAC;AACD,SAAO;AACT;AAEA,SAAS,cAAc,OAA4C;AACjE,MAAI,CAAC,MAAO,QAAO,CAAC;AACpB,MAAI,OAAO,UAAU,UAAU;AAC7B,UAAM,UAAU,MAAM,KAAK;AAC3B,QAAI,CAAC,QAAS,QAAO,CAAC;AACtB,QAAI;AACF,YAAM,SAAS,KAAK,MAAM,OAAO;AACjC,aAAO,wBAAwB,MAAM;AAAA,IACvC,QAAQ;AACN,aAAO,wBAAwB,KAAK;AAAA,IACtC;AAAA,EACF;AACA,SAAO,CAAC;AACV;AAEA,SAAS,qBAAqB,OAA0D;AACtF,MAAI,CAAC,MAAO,QAAO,CAAC;AACpB,MAAI,OAAO,UAAU,SAAU,QAAO,CAAC;AACvC,QAAM,UAAU,MAAM,KAAK;AAC3B,MAAI,CAAC,QAAS,QAAO,CAAC;AACtB,MAAI;AACF,UAAM,SAAS,KAAK,MAAM,OAAO;AACjC,WAAO,+BAA+B,MAAM;AAAA,EAC9C,QAAQ;AACN,WAAO,CAAC;AAAA,EACV;AACF;AAEA,eAAe,sBAAsB,KAAc;AACjD,QAAM,OAAO,MAAM,mBAAmB,GAAG;AACzC,MAAI,CAAC,QAAQ,CAAC,KAAK,YAAa,CAAC,KAAK,SAAS,CAAC,KAAK,aAAe,QAAO,aAAa,KAAK,EAAE,OAAO,eAAe,GAAG,EAAE,QAAQ,IAAI,CAAC;AACvI,QAAM,MAAM,IAAI,IAAI,IAAI,GAAG;AAC3B,QAAM,cAAc,sBAAsB,UAAU;AAAA,IAClD,UAAU,IAAI,aAAa,IAAI,UAAU,KAAK;AAAA,IAC9C,UAAU,IAAI,aAAa,IAAI,UAAU,KAAK;AAAA,IAC9C,MAAM,IAAI,aAAa,IAAI,MAAM,KAAK;AAAA,IACtC,UAAU,IAAI,aAAa,IAAI,UAAU,KAAK;AAAA,EAChD,CAAC;AACD,MAAI,CAAC,YAAY,SAAS;AACxB,WAAO,aAAa,KAAK,EAAE,OAAO,qCAAqC,GAAG,EAAE,QAAQ,IAAI,CAAC;AAAA,EAC3F;AACA,QAAM,EAAE,UAAU,UAAU,MAAM,SAAS,IAAI,YAAY;AAE3D,QAAM,YAAY,MAAM,uBAAuB;AAC/C,QAAM,KAAK,UAAU,QAAQ,IAAI;AACjC,QAAM,eAAe,MAAM,8BAA8B,WAAW,MAAM,GAAG;AAC7E,MAAI,aAAa,OAAQ,QAAO,aAAa,KAAK,EAAE,OAAO,YAAY,GAAG,EAAE,QAAQ,IAAI,CAAC;AACzF,QAAM,QAAQ,aAAa;AAC3B,QAAM,SAAkC,EAAE,UAAU,UAAU,UAAU,KAAK,SAAU;AACvF,MAAI,MAAO,QAAO,iBAAiB;AACnC,QAAM,UAA0C,EAAE,WAAW,QAAQ,IAAI,OAAO;AAChF,QAAM,YAAY,OAAO,SAAS,YAAY,OAAO,aAAa;AAClE,QAAM,cAAc,YAAY,KAAK,IAAI,GAAG,IAAI,IAAI;AACpD,QAAM,kBAAkB,YAAY,WAAW;AAC/C,QAAM,aAAa,aAAa,cAAe,KAAK,kBAAmB;AACvE,QAAM,aAAa,MAAM,GAAG,KAAK,qBAAqB,CAAC,CAAC;AACxD,QAAM,gBAAgB,6BAA6B,UAAU;AAC7D,QAAM,QAAQ,EAAE,UAAU,KAAK,YAAY,MAAM,gBAAgB,SAAS,KAAK;AAC/E,MAAI;AACJ,MAAI;AACJ,MAAI,eAAe;AACjB,UAAM,UAAU,MAAM,0BAA0B;AAAA,MAC9C,MAAM,EAAE,GAAG,MAAM,MAAM;AAAA,MAAG,SAAS,8BAA8B,SAAS;AAAA,MAAG;AAAA,MAC7E,QAAQ;AAAA,MAAY,OAAO,mBAAmB;AAAA,MAC9C,WAAW,CAAC,QAAQ,UAAU,mBAAmB,IAAI,YAAY,QAAQ,EAAE,SAAS,QAAQ,MAAM,GAAG,KAAK;AAAA,IAC5G,CAAC;AACD,YAAQ,QAAQ;AAChB,YAAQ,YAAY,QAAQ,QAAQ;AAAA,EACtC,OAAO;AACL,YAAQ,YAAY,MAAM,GAAG,MAAM,YAAY,MAAM,IAAI;AACzD,YAAQ,MAAM,mBAAmB,IAAI,YAAY,QAAQ;AAAA,MACvD;AAAA,MAAS,GAAI,YAAY,EAAE,OAAO,iBAAkB,QAAQ,WAAW,IAAI,EAAE,OAAO,8BAA8B;AAAA,IACpH,GAAG,KAAK;AAAA,EACV;AACA,QAAM,aAAa,aAAa,UAAU,OAAO,KAAK,IAAI,GAAG,KAAK,KAAK,QAAQ,eAAgB,CAAC,IAAI;AACpG,SAAO,aAAa,KAAK;AAAA,IACvB,OAAO,MAAM,IAAI,CAAC,MAAW;AAC3B,YAAMA,YAAW,uBAAuB,EAAE,eAAe;AACzD,aAAO;AAAA,QACL,IAAI,EAAE;AAAA,QACN,KAAK,EAAE;AAAA,QACP,UAAU,EAAE;AAAA,QACZ,UAAU,EAAE;AAAA,QACZ,WAAW,EAAE;AAAA,QACb,UAAU,EAAE,YAAY;AAAA,QACxB,eAAe,EAAE;AAAA,QACjB,SAAS,EAAE,WAAW;AAAA,QACtB,cAAc,wBAAwB,EAAE,IAAI;AAAA,UAC1C,OAAO;AAAA,UACP,QAAQ;AAAA,UACR,MAAM,0BAA0B,EAAE,QAAQ;AAAA,QAC5C,CAAC;AAAA,QACD,MAAMA,UAAS,QAAQ,CAAC;AAAA,QACxB,aAAaA,UAAS,eAAe,CAAC;AAAA,MACxC;AAAA,IACF,CAAC;AAAA,IACD,GAAI,YACA;AAAA,MACE;AAAA,MACA,MAAM;AAAA,MACN,UAAU;AAAA,MACV;AAAA,IACF,IACA,CAAC;AAAA,EACP,GAAG,EAAE,SAAS,gBAAgB,EAAE,iBAAiB,oBAAoB,IAAI,OAAU,CAAC;AACtF;AAEO,MAAM,MAAM,2BAA2B,qBAAqB;AAEnE,eAAsB,KAAK,KAAc;AACvC,QAAM,EAAE,EAAE,IAAI,MAAM,oBAAoB;AACxC,QAAM,OAAO,MAAM,mBAAmB,GAAG;AACzC,MAAI,CAAC,QAAQ,CAAC,KAAK,YAAa,CAAC,KAAK,SAAS,CAAC,KAAK,aAAe,QAAO,aAAa,KAAK,EAAE,OAAO,eAAe,GAAG,EAAE,QAAQ,IAAI,CAAC;AAOvI,MAAI,CAAC,KAAK,OAAO;AACf,WAAO,aAAa,KAAK;AAAA,MACvB,OAAO,EAAE,yCAAyC,gEAAgE;AAAA,IACpH,GAAG,EAAE,QAAQ,IAAI,CAAC;AAAA,EACpB;AACA,QAAM,WAAW,KAAK;AAEtB,QAAM,YAAY,MAAM,uBAAuB;AAC/C,MAAI,qBAAgD;AACpD,MAAI;AACF,yBAAqB,UAAU,QAAQ,oBAAoB;AAAA,EAC7D,SAAS,OAAO;AAEd,WAAO,KAAK,gEAAgE,EAAE,KAAK,MAAM,CAAC;AAAA,EAC5F;AACA,MAAI,oBAAoB;AACtB,UAAM,YAAY,OAAO,KAAK,QAAQ,YAAY,KAAK,IAAI,SAAS,IAChE,KAAK,MACJ,OAAO,KAAK,WAAW,YAAY,KAAK,OAAO,SAAS,IAAI,KAAK,SAAS;AAC/E,QAAI,CAAC,WAAW;AACd,aAAO,KAAK,uEAAuE;AAAA,IACrF,OAAO;AACL,YAAM,oBAAoB,MAAM;AAAA,QAC9B;AAAA,QACA,wCAAwC;AAAA,QACxC,GAAG,QAAQ,IAAI,SAAS;AAAA,QACxB,EAAE,sBAAsB,yBAAyB;AAAA,MACnD;AACA,UAAI,kBAAmB,QAAO;AAAA,IAChC;AAAA,EACF,OAAO;AACL,WAAO,KAAK,iEAAiE;AAAA,EAC/E;AAEA,QAAM,cAAc,IAAI,QAAQ,IAAI,cAAc,KAAK;AACvD,MAAI,CAAC,YAAY,YAAY,EAAE,SAAS,qBAAqB,GAAG;AAC9D,WAAO,aAAa,KAAK,EAAE,OAAO,+BAA+B,GAAG,EAAE,QAAQ,IAAI,CAAC;AAAA,EACrF;AACA,MAAI,CAAC,oCAAoC,IAAI,QAAQ,IAAI,gBAAgB,CAAC,GAAG;AAC3E,WAAO,aAAa,KAAK;AAAA,MACvB,OAAO,EAAE,oCAAoC,6CAA6C;AAAA,IAC5F,GAAG,EAAE,QAAQ,IAAI,CAAC;AAAA,EACpB;AAEA,MAAI;AACJ,MAAI;AACF,WAAO,MAAM,wCAAwC,GAAG;AAAA,EAC1D,SAAS,OAAO;AACd,QAAI,4BAA4B,KAAK,GAAG;AACtC,aAAO,aAAa,KAAK;AAAA,QACvB,OAAO,EAAE,oCAAoC,6CAA6C;AAAA,MAC5F,GAAG,EAAE,QAAQ,IAAI,CAAC;AAAA,IACpB;AACA,UAAM;AAAA,EACR;AACA,QAAM,cAAc,iBAAiB,IAAI;AACzC,QAAM,oBAAoB,wBAAwB,WAAW,EAAE;AAC/D,QAAM,WAAW,OAAO,KAAK,IAAI,UAAU,KAAK,EAAE;AAClD,QAAM,WAAW,OAAO,KAAK,IAAI,UAAU,KAAK,EAAE;AAClD,QAAM,WAAW,OAAO,KAAK,IAAI,UAAU,KAAK,EAAE;AAClD,QAAM,OAAO,KAAK,IAAI,MAAM;AAC5B,MAAI,CAAC,YAAY,CAAC,YAAY,CAAC,KAAM,QAAO,aAAa,KAAK,EAAE,OAAO,2CAA2C,GAAG,EAAE,QAAQ,IAAI,CAAC;AACpI,QAAM,uBAAuB,KAAK,IAAI,eAAe;AACrD,QAAM,oBACJ,OAAO,yBAAyB,YAAY,qBAAqB,KAAK,EAAE,SAAS,IAC7E,sBAAsB,oBAAoB,IAC1C;AACN,QAAM,OAAO,cAAc,KAAK,IAAI,MAAM,CAAC;AAC3C,QAAM,sBAAsB,qBAAqB,KAAK,IAAI,aAAa,CAAC;AAExE,QAAM,KAAK,UAAU,QAAQ,IAAI;AACjC,QAAM,aAAa,UAAU,QAAQ,YAAY;AACjD,MAAI,yBAAwD;AAC5D,MAAI,mCAGyB;AAC7B,MAAI;AACF,6BAAyB,UAAU,QAAQ,wBAAwB;AACnE,uCAAmC,UAAU,QAAQ,kCAAkC;AAAA,EAIzF,QAAQ;AAAA,EAER;AACA,QAAM,uBACH,UAAU,QAAQ,sBAAsB,KAAqC,IAAI,qBAAqB,EAAE;AAC3G,QAAM,cAAc,MAAM,8BAA8B,WAAW,MAAM,GAAG;AAC5E,MAAI,YAAY,OAAQ,QAAO,aAAa,KAAK,EAAE,OAAO,YAAY,GAAG,EAAE,QAAQ,IAAI,CAAC;AACxF,QAAM,QAAQ,YAAY;AAC1B,MAAI,CAAC,MAAO,QAAO,aAAa,KAAK,EAAE,OAAO,eAAe,GAAG,EAAE,QAAQ,IAAI,CAAC;AAC/E,QAAM,wBAAwB,EAAE;AAEhC,MAAI,qBAAoC;AACxC,MAAI,2BAA0C;AAC9C,MAAI,UAAU;AACZ,QAAI;AACF,YAAM,EAAE,eAAe,IAAI,MAAM,OAAO,mDAAmD;AAC3F,YAAM,MAAM,MAAM,GAAG,QAAQ,gBAAgB;AAAA,QAC3C;AAAA,QACA,KAAK;AAAA,QACL,MAAM;AAAA,UACJ,EAAE,KAAK,CAAE,EAAE,UAAU,KAAK,SAAS,GAAG,EAAE,UAAU,KAAK,CAAE,EAAE;AAAA,QAC7D;AAAA,QACA,UAAU;AAAA,MACZ,CAAC;AACD,YAAM,MAAO,KAAa,cAAc,CAAC;AACzC,YAAM,OAAO,KAAK,QAAQ,IAAI,MAAM,GAAG,EAAE,IAAI,GAAG,YAAY,KAAK;AACjE,UAAI,MAAM,QAAQ,IAAI,gBAAgB,KAAK,IAAI,iBAAiB,QAAQ;AACtE,cAAM,UAAU,IAAI,IAAK,IAAI,iBAA2B,IAAI,CAAC,MAAW,OAAO,CAAC,EAAE,YAAY,EAAE,QAAQ,OAAO,EAAE,CAAC,CAAC;AACnH,YAAI,CAAC,QAAQ,IAAI,GAAG,EAAG,QAAO,aAAa,KAAK,EAAE,OAAO,wBAAwB,GAAG,EAAE,QAAQ,IAAI,CAAC;AAAA,MACrG;AACA,UAAI,OAAO,IAAI,wBAAwB,YAAY,IAAI,sBAAsB,GAAG;AAC9E,mCAA2B,IAAI;AAAA,MACjC;AACA,UAAI,OAAO,IAAI,kBAAkB,YAAY,IAAI,cAAc,KAAK,EAAE,SAAS,GAAG;AAChF,6BAAqB,sBAAsB,IAAI,aAAa;AAAA,MAC9D;AAAA,IACF,QAAQ;AAAA,IAAC;AAAA,EACX;AACA,MAAI,gCAAgC,KAAK,IAAI,GAAG;AAC9C,WAAO,aAAa,KAAK;AAAA,MACvB,OAAO,EAAE,0CAA0C,uDAAuD;AAAA,IAC5G,GAAG,EAAE,QAAQ,IAAI,CAAC;AAAA,EACpB;AACA,QAAM,oBAAoB,0BAA0B,wBAAwB;AAC5E,MAAI,KAAK,OAAO,mBAAmB;AACjC,WAAO,aAAa,KAAK;AAAA,MACvB,OAAO,EAAE,oCAAoC,6CAA6C;AAAA,IAC5F,GAAG,EAAE,QAAQ,IAAI,CAAC;AAAA,EACpB;AACA,MAAI,CAAC,wBAAwB;AAC3B,QAAI;AACF,YAAM,mBAAmB,MAAM,+BAA+B,IAAI,QAAQ;AAC1E,UAAI,gCAAgC,kBAAkB,KAAK,IAAI,GAAG;AAChE,eAAO,aAAa,KAAK;AAAA,UACvB,OAAO,EAAE,oCAAoC,oDAAoD;AAAA,QACnG,GAAG,EAAE,QAAQ,IAAI,CAAC;AAAA,MACpB;AAAA,IACF,SAAS,OAAO;AACd,aAAO,MAAM,sCAAsC,EAAE,KAAK,MAAM,CAAC;AACjE,aAAO,aAAa,KAAK;AAAA,QACvB,OAAO,EAAE,uCAAuC,0CAA0C;AAAA,MAC5F,GAAG,EAAE,QAAQ,IAAI,CAAC;AAAA,IACpB;AAAA,EACF;AACA,QAAM,MAAM,OAAO,KAAK,MAAM,KAAK,YAAY,CAAC;AAChD,QAAM,WAAW,yBAAyB,KAAK,IAAI;AACnD,QAAM,eAAe,yBAAyB,KAAK,UAAW,KAAa,IAAI;AAC/E,MAAI,0BAA0B,KAAK,UAAU,YAAY,GAAG;AAC1D,WAAO,aAAa,KAAK,EAAE,OAAO,EAAE,2CAA2C,yCAAyC,EAAE,GAAG,EAAE,QAAQ,IAAI,CAAC;AAAA,EAC9I;AACA,QAAM,uBAAuB,4BAA4B,QAAQ;AACjE,QAAM,wBAAwB,qBAAqB,sBAAsB;AACzE,QAAM,0BAA0B,MAAM;AAAA,IACpC,IAAI;AAAA,MACF,CAAC,mBAAmB,oBAAoB,qBAAqB,EAAE;AAAA,QAC7D,CAAC,SAAyB,OAAO,SAAS,YAAY,KAAK,SAAS;AAAA,MACtE;AAAA,IACF;AAAA,EACF;AACA,MAAI,YAAwC;AAC5C,aAAW,QAAQ,yBAAyB;AAC1C,UAAM,SAAS,MAAM,GAAG,QAAQ,qBAAqB,EAAE,KAAK,CAAC;AAC7D,QAAI,QAAQ;AACV,kBAAY;AACZ;AAAA,IACF;AAAA,EACF;AACA,MAAI,CAAC,WAAW;AACd,gBAAY,MAAM,GAAG,QAAQ,qBAAqB,EAAE,MAAM,qBAAqB,CAAC;AAAA,EAClF;AACA,MAAI,CAAC,WAAW;AACd,WAAO,aAAa,KAAK,EAAE,OAAO,uCAAuC,GAAG,EAAE,QAAQ,IAAI,CAAC;AAAA,EAC7F;AACA,QAAM,oCAAoC,IAAI,SAAS;AACvD,QAAM,0BACJ,OAAO,sBAAsB,YAC7B,kBAAkB,SAAS,KAC3B,UAAU,SAAS,qBACnB,UAAU,aAAa,QACvB,UAAU,SAAS,wBACnB,UAAU,SAAS;AACrB,MAAI,yBAAyB;AAC3B,WAAO,aAAa,KAAK,EAAE,OAAO,EAAE,6CAA6C,0EAA0E,EAAE,GAAG,EAAE,QAAQ,IAAI,CAAC;AAAA,EACjL;AACA,QAAM,eAAe,MAAM,qBAAqB,oBAAoB,UAAU,MAAM,EAAE,UAAU,gBAAgB,MAAM,CAAC;AACvH,QAAM,sBAAsB,yBACxB,aAAa,qBAAqB;AAAA,IAChC,eAAe,UAAU;AAAA,IACzB;AAAA,IACA;AAAA,IACA,UAAU;AAAA,EACZ,CAAC,IACD;AACJ,MAAI,0BAA0B,CAAC,qBAAqB;AAClD,WAAO,aAAa,KAAK;AAAA,MACvB,OAAO,EAAE,+CAA+C,sDAAsD;AAAA,IAChH,GAAG,EAAE,QAAQ,IAAI,CAAC;AAAA,EACpB;AACA,MAAI,mBAA+E;AACnF,MAAI,wBAAwB;AAC1B,QAAI;AACF,yBAAmB,MAAM,uBAAuB,QAAQ;AAAA,QACtD;AAAA,QACA,gBAAgB;AAAA,QAChB,OAAO,IAAI;AAAA,QACX,QAAQ;AAAA,QACR,eAAe,aAAa;AAAA,QAC5B,aAAa;AAAA,QACb,eAAe,UAAU;AAAA,MAC3B,CAAC;AACD,UAAI,CAAC,iCAAkC,OAAM,IAAI,MAAM,2CAA2C;AAClG,YAAM,iCAAiC;AAAA,QACrC,eAAe,iBAAiB;AAAA,QAChC;AAAA,QACA,gBAAgB;AAAA,MAClB,GAAG,KAAK,IAAI,KAAO,iBAAiB,UAAU,QAAQ,IAAI,KAAK,IAAI,CAAC,CAAC;AACrE,UAAI,OAAO,uBAAuB,iBAAiB,YAAY;AAC7D,cAAM,uBAAuB,aAAa,iBAAiB,IAAI,iBAAiB,UAAU;AAAA,MAC5F;AAAA,IACF,SAAS,OAAO;AACd,UAAI,kBAAkB;AACpB,cAAM,uBAAuB,QAAQ,iBAAiB,IAAI,iBAAiB,UAAU,EAAE,MAAM,MAAM;AAAA,QAAC,CAAC;AACrG,2BAAmB;AAAA,MACrB;AACA,YAAM,OAAQ,OAA8B;AAC5C,UAAI,SAAS,kBAAkB;AAC7B,eAAO,aAAa,KAAK;AAAA,UACvB,OAAO,EAAE,oCAAoC,oDAAoD;AAAA,QACnG,GAAG,EAAE,QAAQ,IAAI,CAAC;AAAA,MACpB;AACA,UAAI,SAAS,uBAAuB;AAClC,eAAO,aAAa,KAAK;AAAA,UACvB,OAAO,EAAE,wCAAwC,yCAAyC;AAAA,QAC5F,GAAG,EAAE,QAAQ,IAAI,CAAC;AAAA,MACpB;AACA,aAAO,MAAM,uCAAuC,EAAE,KAAK,MAAM,CAAC;AAClE,aAAO,aAAa,KAAK;AAAA,QACvB,OAAO,EAAE,uCAAuC,0CAA0C;AAAA,MAC5F,GAAG,EAAE,QAAQ,IAAI,CAAC;AAAA,IACpB;AAAA,EACF;AACA,MAAI;AACJ,MAAI;AACF,UAAM,SAAS,MAAM,aAAa,MAAM;AAAA,MACtC,eAAe,UAAU;AAAA,MACzB;AAAA,MACA;AAAA,MACA,UAAU;AAAA,MACV,QAAQ;AAAA,MACR,aAAa;AAAA,IACf,CAAC;AACD,iBAAa,OAAO;AACpB,QAAI,kBAAkB;AACpB,YAAM,uBAAwB,WAAW,iBAAiB,IAAI,iBAAiB,UAAU;AAAA,IAC3F;AAAA,EACF,SAAS,OAAO;AACd,WAAO,MAAM,0BAA0B,EAAE,KAAK,MAAM,CAAC;AACrD,QAAI,qBAAqB;AACvB,UAAI;AACF,eAAO,aAAa,eAAe,UAAU,MAAM,mBAAmB,KACjE,aAAa,OAAO,UAAU,MAAM,mBAAmB;AAC5D,YAAI,kBAAkB;AACpB,gBAAM,uBAAwB,QAAQ,iBAAiB,IAAI,iBAAiB,UAAU;AAAA,QACxF;AAAA,MACF,SAAS,cAAc;AACrB,eAAO,MAAM,2CAA2C,EAAE,KAAK,aAAa,CAAC;AAAA,MAC/E;AAAA,IACF;AACA,WAAO,aAAa,KAAK,EAAE,OAAO,gCAAgC,GAAG,EAAE,QAAQ,IAAI,CAAC;AAAA,EACtF;AAEA,QAAM,cACJ,OAAQ,UAAkB,gBAAgB,YACtC,QAAS,UAAkB,WAAW,IACtC,mCAAmC;AACzC,MAAI,mBAAkC;AACtC,QAAM,cAAc,eAAe,gBAAgB,cAAc,QAAQ;AACzE,QAAM,aAAa,cAAc,IAAI,WAAW,IAAI;AACpD,QAAM,YAAY,QAAQ,eAAe,YAAY,SAAS;AAE9D,MAAI,eAAe,CAAC,WAAW;AAC7B,UAAM,EAAE,UAAU,WAAW,QAAQ,IAAI,MAAM,aAAa,YAAY,UAAU,MAAM,UAAU;AAClG,QAAI;AACF,yBAAmB,MAAM,yBAAyB;AAAA,QAChD,UAAU;AAAA,QACV,UAAU;AAAA,MACZ,CAAC;AAAA,IACH,SAAS,OAAO;AACd,aAAO,MAAM,wCAAwC,EAAE,KAAK,MAAM,CAAC;AAAA,IACrE,UAAE;AACA,YAAM,QAAQ,EAAE,MAAM,MAAM;AAAA,MAAC,CAAC;AAAA,IAChC;AAAA,EACF;AAEA,MAAI,cAAc,oBAAoB,MAAM;AAC5C,MAAI,aAAa,mBAAmB;AAClC,kBAAc,iBAAiB,aAAa,EAAE,MAAM,UAAU,IAAI,SAAS,CAAC;AAAA,EAC9E;AACA,QAAMA,YAAW,wBAAwB,MAAM,EAAE,aAAa,KAAK,CAAC;AACpE,QAAM,eAAe,WAAW;AAChC,iCAA+B,EAAE,UAAU,KAAK,UAAU,gBAAgB,MAAM,CAAC;AACjF,QAAM,MAAM,GAAG,OAAO,YAAY;AAAA,IAChC,IAAI;AAAA,IACJ;AAAA,IACA;AAAA,IACA,gBAAgB;AAAA,IAChB,UAAU,KAAK;AAAA,IACf,UAAU;AAAA,IACV,UAAU;AAAA,IACV,UAAU,IAAI;AAAA,IACd,eAAe,UAAU;AAAA,IACzB,eAAe,UAAU,iBAAiB;AAAA,IAC1C,aAAa;AAAA,IACb,KAAK,uBAAuB,YAAY;AAAA,IACxC,SAAS;AAAA,IACT,iBAAiBA;AAAA,EACnB,CAAC;AAGD,MAAI;AACF,UAAM,GAAG,cAAc,OAAO,OAAO;AACnC,YAAM,GAAG,QAAQ,GAAG,EAAE,MAAM;AAC5B,UAAI,YAAY;AACd,cAAM,qBAAqB;AAAA,UACzB;AAAA,UACA,UAAU,EAAE,YAAY;AAAA,UACxB,UAAU;AAAA,UACV;AAAA,UACA,gBAAgB;AAAA,UAChB,QAAQ;AAAA,QACV,CAAC;AAAA,MACH;AACA,UAAI,kBAAkB;AACpB,cAAM,uBAAwB,mBAAmB,iBAAiB,IAAI,iBAAiB,YAAY,EAAE;AAAA,MACvG;AAAA,IACF,CAAC;AAAA,EACH,SAAS,OAAO;AACd,WAAO,MAAM,uDAAuD,EAAE,KAAK,MAAM,CAAC;AAClF,QAAI;AACF,aAAO,aAAa,eAAe,UAAU,MAAM,UAAU,KACxD,aAAa,OAAO,UAAU,MAAM,UAAU;AACnD,UAAI,kBAAkB;AACpB,cAAM,uBAAwB,QAAQ,iBAAiB,IAAI,iBAAiB,UAAU;AAAA,MACxF;AAAA,IACF,SAAS,cAAc;AACrB,aAAO,MAAM,+CAA+C,EAAE,KAAK,aAAa,CAAC;AAAA,IACnF;AACA,WAAO,aAAa,KAAK,EAAE,OAAO,wCAAwC,GAAG,EAAE,QAAQ,IAAI,CAAC;AAAA,EAC9F;AAEA,MAAI,WAAW;AAGb,QAAI;AACF,YAAM,qBAAqB,IAAI,KAAK,cAAc,UAAU;AAAA,IAC9D,SAAS,OAAO;AACd,aAAO,MAAM,kCAAkC,EAAE,KAAK,MAAM,CAAC;AAAA,IAC/D;AAAA,EACF,WAAW,aAAa;AACtB,WAAO,KAAK,iGAAiG;AAAA,EAC/G;AAEA,MAAI,YAAY;AACd,UAAM,oBAAoB;AAAA,MACxB;AAAA,MACA,QAAQ;AAAA,MACR,QAAQ;AAAA,MACR,aAAa;AAAA,QACX,IAAI,IAAI;AAAA,QACR,gBAAgB,IAAI,kBAAkB;AAAA,QACtC,UAAU,IAAI,YAAY;AAAA,MAC5B;AAAA,MACA,QAAQ;AAAA,MACR,SAAS;AAAA,IACX,CAAC;AACD,UAAM,WAAW,sBAAsB;AAAA,EACzC;AAEA,SAAO,aAAa,KAAK;AAAA,IACvB,IAAI;AAAA,IACJ,MAAM;AAAA,MACJ,IAAI;AAAA,MACJ,KAAK,IAAI;AAAA,MACT,UAAU;AAAA,MACV,UAAU,IAAI;AAAA,MACd,eAAe,UAAU;AAAA,MACzB,cAAc,wBAAwB,cAAc;AAAA,QAClD,OAAO;AAAA,QACP,QAAQ;AAAA,QACR,MAAM,0BAA0B,QAAQ;AAAA,MAC1C,CAAC;AAAA,MACD,SAAS,oBAAoB;AAAA,MAC7B,MAAMA,UAAS,QAAQ,CAAC;AAAA,MACxB,aAAaA,UAAS,eAAe,CAAC;AAAA,MACtC,cAAc,OAAO,KAAK,iBAAiB,EAAE,SAAS,oBAAoB;AAAA,IAC5E;AAAA,EACF,CAAC;AACH;AAEA,eAAe,+BAA+B,IAAmB,UAAmC;AAClG,MAAI;AACF,UAAM,KAAK,GAAG,UAAe;AAC7B,UAAM,MAAM,MAAM,GACf,WAAW,aAAa,EACxB,OAAO,oBAA4B,GAAG,YAAY,CAAC,EACnD,MAAM,aAAa,KAAK,QAAQ,EAChC,iBAAiB;AACpB,UAAM,QAAQ,KAAK;AACnB,QAAI,OAAO,UAAU,SAAU,QAAO,OAAO,SAAS,KAAK,IAAI,QAAQ;AACvE,QAAI,OAAO,UAAU,UAAU;AAC7B,YAAM,SAAS,OAAO,KAAK;AAC3B,aAAO,OAAO,SAAS,MAAM,IAAI,SAAS;AAAA,IAC5C;AACA,WAAO;AAAA,EACT,SAAS,OAAO;AACd,UAAM,IAAI,MAAM,+CAA+C,EAAE,OAAO,MAAM,CAAC;AAAA,EACjF;AACF;AAEA,eAAe,iBAAiB,KAAc;AAC5C,QAAM,OAAO,MAAM,mBAAmB,GAAG;AACzC,MAAI,CAAC,QAAQ,CAAC,KAAK,YAAa,CAAC,KAAK,SAAS,CAAC,KAAK,aAAe,QAAO,aAAa,KAAK,EAAE,OAAO,eAAe,GAAG,EAAE,QAAQ,IAAI,CAAC;AACvI,QAAM,MAAM,IAAI,IAAI,IAAI,GAAG;AAC3B,QAAM,KAAK,IAAI,aAAa,IAAI,IAAI,KAAK;AACzC,MAAI,CAAC,GAAI,QAAO,aAAa,KAAK,EAAE,OAAO,4BAA4B,GAAG,EAAE,QAAQ,IAAI,CAAC;AACzF,QAAM,YAAY,MAAM,uBAAuB;AAC/C,QAAM,KAAK,UAAU,QAAQ,IAAI;AACjC,QAAM,aAAa,UAAU,QAAQ,YAAY;AACjD,QAAM,uBACH,UAAU,QAAQ,sBAAsB,KAAqC,IAAI,qBAAqB,EAAE;AAM3G,QAAM,cAAc,MAAM,8BAA8B,WAAW,MAAM,GAAG;AAC5E,MAAI,YAAY,OAAQ,QAAO,aAAa,KAAK,EAAE,OAAO,uBAAuB,GAAG,EAAE,QAAQ,IAAI,CAAC;AACnG,QAAM,QAAQ,YAAY;AAC1B,QAAM,eAAwC,EAAE,IAAI,UAAU,KAAK,SAAU;AAC7E,MAAI,MAAO,cAAa,iBAAiB;AACzC,QAAM,aAAa,EAAE,GAAG,MAAM,MAAM;AACpC,QAAM,UAAU,MAAM,GAAG,cAAc,OAAO,OAAO;AACnD,UAAM,YAAY,MAAM,sBAAsB,IAAI,YAAY,cAAc,QAAW;AAAA,MACrF,UAAU,KAAK;AAAA,MAAU,gBAAgB;AAAA,IAC3C,CAAC;AACD,QAAI,CAAC,UAAW,QAAO,2BAA2B,GAAG;AACrD,UAAM,eAAe,MAAM,gCAAgC,IAAI,SAAS;AACxE,UAAM,UAAU,gCAAgC,cAAc,UAAU,EAAE;AAC1E,QAAI,CAAC,QAAQ,QAAS,QAAO,2BAA2B,GAAG;AAC3D,UAAMC,UAAS,MAAM,sBAAsB,IAAI,YAAY,cAAc;AAAA,MACvE,UAAU,SAAS;AAAA,MAAmB,SAAS;AAAA,IACjD,GAAG,EAAE,UAAU,KAAK,UAAU,gBAAgB,MAAM,CAAC;AACrD,QAAI,CAACA,QAAQ,QAAO,2BAA2B,GAAG;AAClD,UAAM,QAAQ,MAAM,0BAA0B,EAAE,WAAW,KAAK,MAAM,YAAY,UAAUA,QAAO,IAAI,WAAW,SAAS,CAAC;AAC5H,UAAM,4BAA4B,EAAE,IAAI,IAAI,SAAS,8BAA8B,SAAS,GAAG,MAAM,YAAY,YAAYA,SAAQ,QAAQ,SAAS,CAAC;AACvJ,UAAM,SAASA,QAAO,cAAc,MAAM,qBAAqB,oBAAoBA,QAAO,eAAe;AAAA,MACvG,UAAUA,QAAO,YAAY,KAAK;AAAA,MAAW,gBAAgBA,QAAO,kBAAkB,SAAS;AAAA,IACjG,CAAC,IAAI;AACL,OAAG,OAAOA,OAAM;AAChB,UAAM,GAAG,MAAM;AACf,WAAO,EAAE,QAAAA,SAAQ,QAAQ,OAAO,gBAAgB,QAAQ,eAAe;AAAA,EACzE,CAAC;AACD,QAAM,EAAE,OAAO,IAAI;AACnB,QAAM,8BAA8B,OAAO,eAAe,OAAO,EAAE,EAAE,MAAM,CAAC,UAAU;AACpF,WAAO,MAAM,uCAAuC,EAAE,KAAK,MAAM,CAAC;AAAA,EACpE,CAAC;AACD,MAAI,QAAQ,UAAU,QAAQ,eAAgB,OAAM,QAAQ,OAAO,OAAO,OAAO,eAAe,OAAO,WAAW;AAClH,QAAM,QAAQ,MAAM,gBAAgB;AACpC,MAAI,YAAY;AACd,UAAM,oBAAoB;AAAA,MACxB;AAAA,MACA,QAAQ;AAAA,MACR,QAAQ;AAAA,MACR,aAAa;AAAA,QACX,IAAI,OAAO;AAAA,QACX,gBAAgB,OAAO,kBAAkB;AAAA,QACzC,UAAU,OAAO,YAAY;AAAA,MAC/B;AAAA,MACA,QAAQ;AAAA,MACR,SAAS;AAAA,IACX,CAAC;AACD,UAAM,WAAW,sBAAsB;AAAA,EACzC;AACA,SAAO,aAAa,KAAK,EAAE,IAAI,KAAK,CAAC;AACvC;AAEO,MAAM,SAAS,2BAA2B,gBAAgB;AAE1D,MAAM,UAA2B;AAAA,EACtC,SAAS;AAAA,EACT,aAAa;AAAA,EACb,SAAS;AAAA,IACP,KAAK;AAAA,MACH,SAAS;AAAA,MACT,aAAa;AAAA,MACb,OAAO;AAAA,MACP,WAAW;AAAA,QACT,EAAE,QAAQ,KAAK,aAAa,oCAAoC,QAAQ,6BAA6B;AAAA,MACvG;AAAA,MACA,QAAQ;AAAA,QACN,EAAE,QAAQ,KAAK,aAAa,wCAAwC,QAAQ,YAAY;AAAA,QACxF,EAAE,QAAQ,KAAK,aAAa,gBAAgB,QAAQ,YAAY;AAAA,QAChE,EAAE,QAAQ,KAAK,aAAa,8BAA8B,QAAQ,YAAY;AAAA,QAC9E,EAAE,QAAQ,KAAK,aAAa,sCAAsC,QAAQ,YAAY;AAAA,QACtF,EAAE,QAAQ,KAAK,aAAa,iCAAiC,QAAQ,YAAY;AAAA,MACnF;AAAA,IACF;AAAA,IACA,MAAM;AAAA,MACJ,SAAS;AAAA,MACT,aAAa;AAAA,MACb,aAAa;AAAA,QACX,aAAa;AAAA,QACb,QAAQ;AAAA,MACV;AAAA,MACA,WAAW;AAAA,QACT,EAAE,QAAQ,KAAK,aAAa,kCAAkC,QAAQ,qBAAqB;AAAA,MAC7F;AAAA,MACA,QAAQ;AAAA,QACN,EAAE,QAAQ,KAAK,aAAa,4BAA4B,QAAQ,YAAY;AAAA,QAC5E,EAAE,QAAQ,KAAK,aAAa,gBAAgB,QAAQ,YAAY;AAAA,QAChE,EAAE,QAAQ,KAAK,aAAa,yCAAyC,QAAQ,YAAY;AAAA,MAC3F;AAAA,IACF;AAAA,IACA,QAAQ;AAAA,MACN,SAAS;AAAA,MACT,aAAa;AAAA,MACb,OAAO;AAAA,MACP,WAAW;AAAA,QACT,EAAE,QAAQ,KAAK,aAAa,sBAAsB,QAAQ,EAAE,OAAO,EAAE,IAAI,EAAE,QAAQ,IAAI,EAAE,CAAC,EAAE;AAAA,QAC5F,EAAE,QAAQ,KAAK,aAAa,wBAAwB,QAAQ,YAAY;AAAA,MAC1E;AAAA,MACA,QAAQ;AAAA,QACN,EAAE,QAAQ,KAAK,aAAa,iCAAiC,QAAQ,YAAY;AAAA,QACjF,EAAE,QAAQ,KAAK,aAAa,gBAAgB,QAAQ,YAAY;AAAA,QAChE,EAAE,QAAQ,KAAK,aAAa,8BAA8B,QAAQ,YAAY;AAAA,QAC9E,EAAE,QAAQ,KAAK,aAAa,sCAAsC,QAAQ,YAAY;AAAA,QACtF,EAAE,QAAQ,KAAK,aAAa,iCAAiC,QAAQ,YAAY;AAAA,MACnF;AAAA,IACF;AAAA,EACF;AACF;",
+  "names": ["metadata", "record"]
 }

package/dist/modules/attachments/api/transfer/route.js

@@ -1,3 +1,11 @@
+import { LockMode } from "@mikro-orm/core";
+import { findWithDecryption } from "@open-mercato/shared/lib/encryption/find";
+import { Attachment } from "../../data/entities.js";
+import { createAttachmentAccessContext } from "../../lib/access-runner.js";
+import { assertAttachmentOwnerAccess } from "../../lib/access-query.js";
+import { withAttachmentAccessErrors, throwAttachmentAccessError } from "../../lib/access-errors.js";
+import { prepareAttachmentMutation } from "../../lib/access-mutation.js";
+import { readJsonSafe } from "@open-mercato/shared/lib/http/readJsonSafe";
 import { NextResponse } from "next/server";
 import { z } from "zod";
 import { getAuthFromRequest } from "@open-mercato/shared/lib/auth/server";
@@ -18,56 +26,72 @@ const transferSchema = z.object({
 const metadata = {
   POST: { requireAuth: true, requireFeatures: ["attachments.manage"] }
 };
-async function POST(req) {
+async function transferAttachments(req) {
   const auth = await getAuthFromRequest(req);
   if (!auth || !auth.tenantId || !auth.orgId) {
     return NextResponse.json({ error: "Unauthorized" }, { status: 401 });
   }
-  const json = await req.json().catch(() => null);
+  const json = await readJsonSafe(req, null);
   const parsed = transferSchema.safeParse(json);
   if (!parsed.success) {
     return NextResponse.json({ error: "Invalid payload" }, { status: 400 });
   }
-  const { attachmentIds, entityId, fromRecordId, toRecordId } = parsed.data;
-  const { resolve } = await createRequestContainer();
-  const em = resolve("em");
-  let AttachmentEntity;
-  try {
-    const mod = await import("@open-mercato/core/modules/attachments/data/entities");
-    AttachmentEntity = mod.Attachment;
-  } catch {
-    return NextResponse.json({ error: "Attachment model missing" }, { status: 500 });
-  }
+  const container = await createRequestContainer();
+  const em = container.resolve("em");
+  const guard = await prepareAttachmentMutation({ container, req, auth, operation: "update", payload: parsed.data });
+  const effective = transferSchema.safeParse(guard.modifiedPayload ?? parsed.data);
+  if (!effective.success) return throwAttachmentAccessError(403);
+  const { attachmentIds, entityId, fromRecordId } = effective.data;
   const filters = {
-    id: { $in: attachmentIds },
+    id: { $in: [...new Set(attachmentIds)].sort((left, right) => left < right ? -1 : left > right ? 1 : 0) },
     entityId,
     tenantId: auth.tenantId,
-    organizationId: auth.orgId
+    organizationId: auth.orgId,
+    ...fromRecordId ? { recordId: fromRecordId } : {}
   };
-  if (fromRecordId) {
-    filters.recordId = fromRecordId;
-  }
-  const records = await em.find(AttachmentEntity, filters);
-  if (!records.length) {
-    return NextResponse.json({ error: "Attachments not found" }, { status: 404 });
-  }
-  for (const record of records) {
-    const previousRecordId = record.recordId;
-    record.recordId = toRecordId;
-    const metadata2 = readAttachmentMetadata(record.storageMetadata);
-    const nextAssignments = metadata2.assignments?.map((assignment) => {
-      const matchesType = assignment.type === entityId;
-      const matchesRecord = fromRecordId ? assignment.id === fromRecordId : assignment.id === previousRecordId;
-      if (matchesType && matchesRecord) {
-        return { ...assignment, id: toRecordId };
+  const accessContext = createAttachmentAccessContext(container);
+  const outcome = await em.transactional(async (tx) => {
+    const records = await findWithDecryption(tx, Attachment, filters, {
+      orderBy: { id: "asc" },
+      lockMode: LockMode.PESSIMISTIC_WRITE,
+      refresh: true
+    }, { tenantId: auth.tenantId, organizationId: auth.orgId });
+    if (records.length !== new Set(attachmentIds).size) return throwAttachmentAccessError(404);
+    const changes = [];
+    for (const record of records) {
+      const recordPayload = { ...effective.data, attachmentIds: [record.id] };
+      const recordGuard = await prepareAttachmentMutation({
+        container,
+        req,
+        auth,
+        recordId: record.id,
+        operation: "update",
+        payload: recordPayload
+      });
+      const recordEffective = transferSchema.safeParse(recordGuard.modifiedPayload ?? recordPayload);
+      if (!recordEffective.success || recordEffective.data.attachmentIds.length !== 1 || recordEffective.data.attachmentIds[0] !== record.id || recordEffective.data.entityId !== record.entityId || recordEffective.data.fromRecordId && recordEffective.data.fromRecordId !== record.recordId) {
+        return throwAttachmentAccessError(403);
       }
-      return assignment;
-    }) ?? [];
-    record.storageMetadata = mergeAttachmentMetadata(record.storageMetadata, { assignments: nextAssignments });
-  }
-  await em.persist(records).flush();
-  return NextResponse.json({ ok: true, updated: records.length });
+      const destinationId = recordEffective.data.toRecordId;
+      const metadata2 = readAttachmentMetadata(record.storageMetadata);
+      const assignments = metadata2.assignments?.map((assignment) => assignment.type === entityId && assignment.id === (fromRecordId ?? record.recordId) ? { ...assignment, id: destinationId } : assignment) ?? [];
+      const storageMetadata = mergeAttachmentMetadata(record.storageMetadata, { assignments });
+      await assertAttachmentOwnerAccess({ em: tx, context: accessContext, auth, attachment: record, action: "reassign", persistProtection: true });
+      await assertAttachmentOwnerAccess({ em: tx, context: accessContext, auth, attachment: { ...record, recordId: destinationId, storageMetadata }, action: "reassign" });
+      changes.push({ record, storageMetadata, destinationId, guard: recordGuard });
+    }
+    for (const { record, storageMetadata, destinationId } of changes) {
+      record.recordId = destinationId;
+      record.storageMetadata = storageMetadata;
+    }
+    await tx.flush();
+    return { updated: records.length, guards: changes.map((change) => change.guard) };
+  });
+  await guard.runAfterSuccess();
+  for (const recordGuard of outcome.guards) await recordGuard.runAfterSuccess();
+  return NextResponse.json({ ok: true, updated: outcome.updated });
 }
+const POST = withAttachmentAccessErrors(transferAttachments);
 const openApi = {
   tag: attachmentsTag,
   summary: "Transfer attachments between records",
@@ -86,7 +110,9 @@ const openApi = {
         { status: 400, description: "Invalid payload", schema: attachmentErrorSchema },
         { status: 401, description: "Unauthorized", schema: attachmentErrorSchema },
         { status: 404, description: "Attachments not found", schema: attachmentErrorSchema },
-        { status: 500, description: "Attachment model missing", schema: attachmentErrorSchema }
+        { status: 500, description: "Attachment model missing", schema: attachmentErrorSchema },
+        { status: 403, description: "Owner policy denies access", schema: attachmentErrorSchema },
+        { status: 504, description: "Owner authorization timed out", schema: attachmentErrorSchema }
       ]
     }
   }

package/dist/modules/attachments/api/transfer/route.js.map

@@ -1,7 +1,7 @@
 {
   "version": 3,
   "sources": ["../../../../../src/modules/attachments/api/transfer/route.ts"],
-  "sourcesContent": ["import { NextResponse } from 'next/server'\nimport { z } from 'zod'\nimport type { OpenApiRouteDoc } from '@open-mercato/shared/lib/openapi'\nimport { getAuthFromRequest } from '@open-mercato/shared/lib/auth/server'\nimport { createRequestContainer } from '@open-mercato/shared/lib/di/container'\nimport { mergeAttachmentMetadata, readAttachmentMetadata } from '../../lib/metadata'\nimport {\n  attachmentsTag,\n  transferAttachmentsRequestSchema,\n  transferAttachmentsResponseSchema,\n  attachmentErrorSchema,\n} from '../openapi'\n\nconst transferSchema = z.object({\n  entityId: z.string().min(1),\n  attachmentIds: z.array(z.string().uuid()).min(1),\n  fromRecordId: z.string().min(1).optional(),\n  toRecordId: z.string().min(1),\n})\n\nexport const metadata = {\n  POST: { requireAuth: true, requireFeatures: ['attachments.manage'] },\n}\n\nexport async function POST(req: Request) {\n  const auth = await getAuthFromRequest(req)\n  if (!auth || !auth.tenantId || !auth.orgId) {\n    return NextResponse.json({ error: 'Unauthorized' }, { status: 401 })\n  }\n  const json = await req.json().catch(() => null)\n  const parsed = transferSchema.safeParse(json)\n  if (!parsed.success) {\n    return NextResponse.json({ error: 'Invalid payload' }, { status: 400 })\n  }\n  const { attachmentIds, entityId, fromRecordId, toRecordId } = parsed.data\n  const { resolve } = await createRequestContainer()\n  const em = resolve('em') as any\n  let AttachmentEntity: any\n  try {\n    const mod = await import('@open-mercato/core/modules/attachments/data/entities')\n    AttachmentEntity = mod.Attachment\n  } catch {\n    return NextResponse.json({ error: 'Attachment model missing' }, { status: 500 })\n  }\n  const filters: Record<string, unknown> = {\n    id: { $in: attachmentIds },\n    entityId,\n    tenantId: auth.tenantId,\n    organizationId: auth.orgId,\n  }\n  if (fromRecordId) {\n    filters.recordId = fromRecordId\n  }\n  const records = await em.find(AttachmentEntity, filters)\n  if (!records.length) {\n    return NextResponse.json({ error: 'Attachments not found' }, { status: 404 })\n  }\n  for (const record of records) {\n    const previousRecordId = record.recordId\n    record.recordId = toRecordId\n    const metadata = readAttachmentMetadata(record.storageMetadata)\n    const nextAssignments =\n      metadata.assignments?.map((assignment) => {\n        const matchesType = assignment.type === entityId\n        const matchesRecord = fromRecordId\n          ? assignment.id === fromRecordId\n          : assignment.id === previousRecordId\n        if (matchesType && matchesRecord) {\n          return { ...assignment, id: toRecordId }\n        }\n        return assignment\n      }) ?? []\n    record.storageMetadata = mergeAttachmentMetadata(record.storageMetadata, { assignments: nextAssignments })\n  }\n  await em.persist(records).flush()\n  return NextResponse.json({ ok: true, updated: records.length })\n}\n\nexport const openApi: OpenApiRouteDoc = {\n  tag: attachmentsTag,\n  summary: 'Transfer attachments between records',\n  methods: {\n    POST: {\n      summary: 'Transfer attachments to different record',\n      description: 'Transfers one or more attachments from one record to another within the same entity type. Updates attachment assignments and metadata to reflect the new record.',\n      requestBody: {\n        contentType: 'application/json',\n        schema: transferAttachmentsRequestSchema,\n      },\n      responses: [\n        { status: 200, description: 'Attachments transferred successfully', schema: transferAttachmentsResponseSchema },\n      ],\n      errors: [\n        { status: 400, description: 'Invalid payload', schema: attachmentErrorSchema },\n        { status: 401, description: 'Unauthorized', schema: attachmentErrorSchema },\n        { status: 404, description: 'Attachments not found', schema: attachmentErrorSchema },\n        { status: 500, description: 'Attachment model missing', schema: attachmentErrorSchema },\n      ],\n    },\n  },\n}\n"],
-  "mappings": "AAAA,SAAS,oBAAoB;AAC7B,SAAS,SAAS;AAElB,SAAS,0BAA0B;AACnC,SAAS,8BAA8B;AACvC,SAAS,yBAAyB,8BAA8B;AAChE;AAAA,EACE;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,OACK;AAEP,MAAM,iBAAiB,EAAE,OAAO;AAAA,EAC9B,UAAU,EAAE,OAAO,EAAE,IAAI,CAAC;AAAA,EAC1B,eAAe,EAAE,MAAM,EAAE,OAAO,EAAE,KAAK,CAAC,EAAE,IAAI,CAAC;AAAA,EAC/C,cAAc,EAAE,OAAO,EAAE,IAAI,CAAC,EAAE,SAAS;AAAA,EACzC,YAAY,EAAE,OAAO,EAAE,IAAI,CAAC;AAC9B,CAAC;AAEM,MAAM,WAAW;AAAA,EACtB,MAAM,EAAE,aAAa,MAAM,iBAAiB,CAAC,oBAAoB,EAAE;AACrE;AAEA,eAAsB,KAAK,KAAc;AACvC,QAAM,OAAO,MAAM,mBAAmB,GAAG;AACzC,MAAI,CAAC,QAAQ,CAAC,KAAK,YAAY,CAAC,KAAK,OAAO;AAC1C,WAAO,aAAa,KAAK,EAAE,OAAO,eAAe,GAAG,EAAE,QAAQ,IAAI,CAAC;AAAA,EACrE;AACA,QAAM,OAAO,MAAM,IAAI,KAAK,EAAE,MAAM,MAAM,IAAI;AAC9C,QAAM,SAAS,eAAe,UAAU,IAAI;AAC5C,MAAI,CAAC,OAAO,SAAS;AACnB,WAAO,aAAa,KAAK,EAAE,OAAO,kBAAkB,GAAG,EAAE,QAAQ,IAAI,CAAC;AAAA,EACxE;AACA,QAAM,EAAE,eAAe,UAAU,cAAc,WAAW,IAAI,OAAO;AACrE,QAAM,EAAE,QAAQ,IAAI,MAAM,uBAAuB;AACjD,QAAM,KAAK,QAAQ,IAAI;AACvB,MAAI;AACJ,MAAI;AACF,UAAM,MAAM,MAAM,OAAO,sDAAsD;AAC/E,uBAAmB,IAAI;AAAA,EACzB,QAAQ;AACN,WAAO,aAAa,KAAK,EAAE,OAAO,2BAA2B,GAAG,EAAE,QAAQ,IAAI,CAAC;AAAA,EACjF;AACA,QAAM,UAAmC;AAAA,IACvC,IAAI,EAAE,KAAK,cAAc;AAAA,IACzB;AAAA,IACA,UAAU,KAAK;AAAA,IACf,gBAAgB,KAAK;AAAA,EACvB;AACA,MAAI,cAAc;AAChB,YAAQ,WAAW;AAAA,EACrB;AACA,QAAM,UAAU,MAAM,GAAG,KAAK,kBAAkB,OAAO;AACvD,MAAI,CAAC,QAAQ,QAAQ;AACnB,WAAO,aAAa,KAAK,EAAE,OAAO,wBAAwB,GAAG,EAAE,QAAQ,IAAI,CAAC;AAAA,EAC9E;AACA,aAAW,UAAU,SAAS;AAC5B,UAAM,mBAAmB,OAAO;AAChC,WAAO,WAAW;AAClB,UAAMA,YAAW,uBAAuB,OAAO,eAAe;AAC9D,UAAM,kBACJA,UAAS,aAAa,IAAI,CAAC,eAAe;AACxC,YAAM,cAAc,WAAW,SAAS;AACxC,YAAM,gBAAgB,eAClB,WAAW,OAAO,eAClB,WAAW,OAAO;AACtB,UAAI,eAAe,eAAe;AAChC,eAAO,EAAE,GAAG,YAAY,IAAI,WAAW;AAAA,MACzC;AACA,aAAO;AAAA,IACT,CAAC,KAAK,CAAC;AACT,WAAO,kBAAkB,wBAAwB,OAAO,iBAAiB,EAAE,aAAa,gBAAgB,CAAC;AAAA,EAC3G;AACA,QAAM,GAAG,QAAQ,OAAO,EAAE,MAAM;AAChC,SAAO,aAAa,KAAK,EAAE,IAAI,MAAM,SAAS,QAAQ,OAAO,CAAC;AAChE;AAEO,MAAM,UAA2B;AAAA,EACtC,KAAK;AAAA,EACL,SAAS;AAAA,EACT,SAAS;AAAA,IACP,MAAM;AAAA,MACJ,SAAS;AAAA,MACT,aAAa;AAAA,MACb,aAAa;AAAA,QACX,aAAa;AAAA,QACb,QAAQ;AAAA,MACV;AAAA,MACA,WAAW;AAAA,QACT,EAAE,QAAQ,KAAK,aAAa,wCAAwC,QAAQ,kCAAkC;AAAA,MAChH;AAAA,MACA,QAAQ;AAAA,QACN,EAAE,QAAQ,KAAK,aAAa,mBAAmB,QAAQ,sBAAsB;AAAA,QAC7E,EAAE,QAAQ,KAAK,aAAa,gBAAgB,QAAQ,sBAAsB;AAAA,QAC1E,EAAE,QAAQ,KAAK,aAAa,yBAAyB,QAAQ,sBAAsB;AAAA,QACnF,EAAE,QAAQ,KAAK,aAAa,4BAA4B,QAAQ,sBAAsB;AAAA,MACxF;AAAA,IACF;AAAA,EACF;AACF;",
+  "sourcesContent": ["import type { EntityManager } from '@mikro-orm/postgresql'\nimport { LockMode } from '@mikro-orm/core'\nimport { findWithDecryption } from '@open-mercato/shared/lib/encryption/find'\nimport { Attachment } from '../../data/entities'\nimport { createAttachmentAccessContext } from '../../lib/access-runner'\nimport { assertAttachmentOwnerAccess } from '../../lib/access-query'\nimport { withAttachmentAccessErrors, throwAttachmentAccessError } from '../../lib/access-errors'\nimport { prepareAttachmentMutation } from '../../lib/access-mutation'\nimport { readJsonSafe } from '@open-mercato/shared/lib/http/readJsonSafe'\nimport { NextResponse } from 'next/server'\nimport { z } from 'zod'\nimport type { OpenApiRouteDoc } from '@open-mercato/shared/lib/openapi'\nimport { getAuthFromRequest } from '@open-mercato/shared/lib/auth/server'\nimport { createRequestContainer } from '@open-mercato/shared/lib/di/container'\nimport { mergeAttachmentMetadata, readAttachmentMetadata } from '../../lib/metadata'\nimport {\n  attachmentsTag,\n  transferAttachmentsRequestSchema,\n  transferAttachmentsResponseSchema,\n  attachmentErrorSchema,\n} from '../openapi'\n\nconst transferSchema = z.object({\n  entityId: z.string().min(1),\n  attachmentIds: z.array(z.string().uuid()).min(1),\n  fromRecordId: z.string().min(1).optional(),\n  toRecordId: z.string().min(1),\n})\n\nexport const metadata = {\n  POST: { requireAuth: true, requireFeatures: ['attachments.manage'] },\n}\n\nasync function transferAttachments(req: Request) {\n  const auth = await getAuthFromRequest(req)\n  if (!auth || !auth.tenantId || !auth.orgId) {\n    return NextResponse.json({ error: 'Unauthorized' }, { status: 401 })\n  }\n  const json = await readJsonSafe(req, null)\n  const parsed = transferSchema.safeParse(json)\n  if (!parsed.success) {\n    return NextResponse.json({ error: 'Invalid payload' }, { status: 400 })\n  }\n  const container = await createRequestContainer()\n  const em = container.resolve<EntityManager>('em')\n  const guard = await prepareAttachmentMutation({ container, req, auth, operation: 'update', payload: parsed.data })\n  const effective = transferSchema.safeParse(guard.modifiedPayload ?? parsed.data)\n  if (!effective.success) return throwAttachmentAccessError(403)\n  const { attachmentIds, entityId, fromRecordId } = effective.data\n  const filters: Record<string, unknown> = {\n    id: { $in: [...new Set(attachmentIds)].sort((left, right) => left < right ? -1 : left > right ? 1 : 0) }, entityId,\n    tenantId: auth.tenantId, organizationId: auth.orgId,\n    ...(fromRecordId ? { recordId: fromRecordId } : {}),\n  }\n  const accessContext = createAttachmentAccessContext(container)\n  const outcome = await em.transactional(async (tx) => {\n    const records = await findWithDecryption(tx, Attachment, filters, {\n      orderBy: { id: 'asc' }, lockMode: LockMode.PESSIMISTIC_WRITE, refresh: true,\n    }, { tenantId: auth.tenantId, organizationId: auth.orgId })\n    if (records.length !== new Set(attachmentIds).size) return throwAttachmentAccessError(404)\n    const changes = []\n    for (const record of records) {\n      const recordPayload = { ...effective.data, attachmentIds: [record.id] }\n      const recordGuard = await prepareAttachmentMutation({\n        container, req, auth, recordId: record.id, operation: 'update', payload: recordPayload,\n      })\n      const recordEffective = transferSchema.safeParse(recordGuard.modifiedPayload ?? recordPayload)\n      if (!recordEffective.success\n        || recordEffective.data.attachmentIds.length !== 1\n        || recordEffective.data.attachmentIds[0] !== record.id\n        || recordEffective.data.entityId !== record.entityId\n        || (recordEffective.data.fromRecordId && recordEffective.data.fromRecordId !== record.recordId)) {\n        return throwAttachmentAccessError(403)\n      }\n      const destinationId = recordEffective.data.toRecordId\n      const metadata = readAttachmentMetadata(record.storageMetadata)\n      const assignments = metadata.assignments?.map((assignment) => (\n        assignment.type === entityId && assignment.id === (fromRecordId ?? record.recordId)\n          ? { ...assignment, id: destinationId } : assignment\n      )) ?? []\n      const storageMetadata = mergeAttachmentMetadata(record.storageMetadata, { assignments })\n      await assertAttachmentOwnerAccess({ em: tx, context: accessContext, auth, attachment: record, action: 'reassign', persistProtection: true })\n      await assertAttachmentOwnerAccess({ em: tx, context: accessContext, auth, attachment: { ...record, recordId: destinationId, storageMetadata }, action: 'reassign' })\n      changes.push({ record, storageMetadata, destinationId, guard: recordGuard })\n    }\n    for (const { record, storageMetadata, destinationId } of changes) {\n      record.recordId = destinationId\n      record.storageMetadata = storageMetadata\n    }\n    await tx.flush()\n    return { updated: records.length, guards: changes.map((change) => change.guard) }\n  })\n  await guard.runAfterSuccess()\n  for (const recordGuard of outcome.guards) await recordGuard.runAfterSuccess()\n  return NextResponse.json({ ok: true, updated: outcome.updated })\n}\n\nexport const POST = withAttachmentAccessErrors(transferAttachments)\n\nexport const openApi: OpenApiRouteDoc = {\n  tag: attachmentsTag,\n  summary: 'Transfer attachments between records',\n  methods: {\n    POST: {\n      summary: 'Transfer attachments to different record',\n      description: 'Transfers one or more attachments from one record to another within the same entity type. Updates attachment assignments and metadata to reflect the new record.',\n      requestBody: {\n        contentType: 'application/json',\n        schema: transferAttachmentsRequestSchema,\n      },\n      responses: [\n        { status: 200, description: 'Attachments transferred successfully', schema: transferAttachmentsResponseSchema },\n      ],\n      errors: [\n        { status: 400, description: 'Invalid payload', schema: attachmentErrorSchema },\n        { status: 401, description: 'Unauthorized', schema: attachmentErrorSchema },\n        { status: 404, description: 'Attachments not found', schema: attachmentErrorSchema },\n        { status: 500, description: 'Attachment model missing', schema: attachmentErrorSchema },\n        { status: 403, description: 'Owner policy denies access', schema: attachmentErrorSchema },\n        { status: 504, description: 'Owner authorization timed out', schema: attachmentErrorSchema },\n      ],\n    },\n  },\n}\n"],
+  "mappings": "AACA,SAAS,gBAAgB;AACzB,SAAS,0BAA0B;AACnC,SAAS,kBAAkB;AAC3B,SAAS,qCAAqC;AAC9C,SAAS,mCAAmC;AAC5C,SAAS,4BAA4B,kCAAkC;AACvE,SAAS,iCAAiC;AAC1C,SAAS,oBAAoB;AAC7B,SAAS,oBAAoB;AAC7B,SAAS,SAAS;AAElB,SAAS,0BAA0B;AACnC,SAAS,8BAA8B;AACvC,SAAS,yBAAyB,8BAA8B;AAChE;AAAA,EACE;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,OACK;AAEP,MAAM,iBAAiB,EAAE,OAAO;AAAA,EAC9B,UAAU,EAAE,OAAO,EAAE,IAAI,CAAC;AAAA,EAC1B,eAAe,EAAE,MAAM,EAAE,OAAO,EAAE,KAAK,CAAC,EAAE,IAAI,CAAC;AAAA,EAC/C,cAAc,EAAE,OAAO,EAAE,IAAI,CAAC,EAAE,SAAS;AAAA,EACzC,YAAY,EAAE,OAAO,EAAE,IAAI,CAAC;AAC9B,CAAC;AAEM,MAAM,WAAW;AAAA,EACtB,MAAM,EAAE,aAAa,MAAM,iBAAiB,CAAC,oBAAoB,EAAE;AACrE;AAEA,eAAe,oBAAoB,KAAc;AAC/C,QAAM,OAAO,MAAM,mBAAmB,GAAG;AACzC,MAAI,CAAC,QAAQ,CAAC,KAAK,YAAY,CAAC,KAAK,OAAO;AAC1C,WAAO,aAAa,KAAK,EAAE,OAAO,eAAe,GAAG,EAAE,QAAQ,IAAI,CAAC;AAAA,EACrE;AACA,QAAM,OAAO,MAAM,aAAa,KAAK,IAAI;AACzC,QAAM,SAAS,eAAe,UAAU,IAAI;AAC5C,MAAI,CAAC,OAAO,SAAS;AACnB,WAAO,aAAa,KAAK,EAAE,OAAO,kBAAkB,GAAG,EAAE,QAAQ,IAAI,CAAC;AAAA,EACxE;AACA,QAAM,YAAY,MAAM,uBAAuB;AAC/C,QAAM,KAAK,UAAU,QAAuB,IAAI;AAChD,QAAM,QAAQ,MAAM,0BAA0B,EAAE,WAAW,KAAK,MAAM,WAAW,UAAU,SAAS,OAAO,KAAK,CAAC;AACjH,QAAM,YAAY,eAAe,UAAU,MAAM,mBAAmB,OAAO,IAAI;AAC/E,MAAI,CAAC,UAAU,QAAS,QAAO,2BAA2B,GAAG;AAC7D,QAAM,EAAE,eAAe,UAAU,aAAa,IAAI,UAAU;AAC5D,QAAM,UAAmC;AAAA,IACvC,IAAI,EAAE,KAAK,CAAC,GAAG,IAAI,IAAI,aAAa,CAAC,EAAE,KAAK,CAAC,MAAM,UAAU,OAAO,QAAQ,KAAK,OAAO,QAAQ,IAAI,CAAC,EAAE;AAAA,IAAG;AAAA,IAC1G,UAAU,KAAK;AAAA,IAAU,gBAAgB,KAAK;AAAA,IAC9C,GAAI,eAAe,EAAE,UAAU,aAAa,IAAI,CAAC;AAAA,EACnD;AACA,QAAM,gBAAgB,8BAA8B,SAAS;AAC7D,QAAM,UAAU,MAAM,GAAG,cAAc,OAAO,OAAO;AACnD,UAAM,UAAU,MAAM,mBAAmB,IAAI,YAAY,SAAS;AAAA,MAChE,SAAS,EAAE,IAAI,MAAM;AAAA,MAAG,UAAU,SAAS;AAAA,MAAmB,SAAS;AAAA,IACzE,GAAG,EAAE,UAAU,KAAK,UAAU,gBAAgB,KAAK,MAAM,CAAC;AAC1D,QAAI,QAAQ,WAAW,IAAI,IAAI,aAAa,EAAE,KAAM,QAAO,2BAA2B,GAAG;AACzF,UAAM,UAAU,CAAC;AACjB,eAAW,UAAU,SAAS;AAC5B,YAAM,gBAAgB,EAAE,GAAG,UAAU,MAAM,eAAe,CAAC,OAAO,EAAE,EAAE;AACtE,YAAM,cAAc,MAAM,0BAA0B;AAAA,QAClD;AAAA,QAAW;AAAA,QAAK;AAAA,QAAM,UAAU,OAAO;AAAA,QAAI,WAAW;AAAA,QAAU,SAAS;AAAA,MAC3E,CAAC;AACD,YAAM,kBAAkB,eAAe,UAAU,YAAY,mBAAmB,aAAa;AAC7F,UAAI,CAAC,gBAAgB,WAChB,gBAAgB,KAAK,cAAc,WAAW,KAC9C,gBAAgB,KAAK,cAAc,CAAC,MAAM,OAAO,MACjD,gBAAgB,KAAK,aAAa,OAAO,YACxC,gBAAgB,KAAK,gBAAgB,gBAAgB,KAAK,iBAAiB,OAAO,UAAW;AACjG,eAAO,2BAA2B,GAAG;AAAA,MACvC;AACA,YAAM,gBAAgB,gBAAgB,KAAK;AAC3C,YAAMA,YAAW,uBAAuB,OAAO,eAAe;AAC9D,YAAM,cAAcA,UAAS,aAAa,IAAI,CAAC,eAC7C,WAAW,SAAS,YAAY,WAAW,QAAQ,gBAAgB,OAAO,YACtE,EAAE,GAAG,YAAY,IAAI,cAAc,IAAI,UAC5C,KAAK,CAAC;AACP,YAAM,kBAAkB,wBAAwB,OAAO,iBAAiB,EAAE,YAAY,CAAC;AACvF,YAAM,4BAA4B,EAAE,IAAI,IAAI,SAAS,eAAe,MAAM,YAAY,QAAQ,QAAQ,YAAY,mBAAmB,KAAK,CAAC;AAC3I,YAAM,4BAA4B,EAAE,IAAI,IAAI,SAAS,eAAe,MAAM,YAAY,EAAE,GAAG,QAAQ,UAAU,eAAe,gBAAgB,GAAG,QAAQ,WAAW,CAAC;AACnK,cAAQ,KAAK,EAAE,QAAQ,iBAAiB,eAAe,OAAO,YAAY,CAAC;AAAA,IAC7E;AACA,eAAW,EAAE,QAAQ,iBAAiB,cAAc,KAAK,SAAS;AAChE,aAAO,WAAW;AAClB,aAAO,kBAAkB;AAAA,IAC3B;AACA,UAAM,GAAG,MAAM;AACf,WAAO,EAAE,SAAS,QAAQ,QAAQ,QAAQ,QAAQ,IAAI,CAAC,WAAW,OAAO,KAAK,EAAE;AAAA,EAClF,CAAC;AACD,QAAM,MAAM,gBAAgB;AAC5B,aAAW,eAAe,QAAQ,OAAQ,OAAM,YAAY,gBAAgB;AAC5E,SAAO,aAAa,KAAK,EAAE,IAAI,MAAM,SAAS,QAAQ,QAAQ,CAAC;AACjE;AAEO,MAAM,OAAO,2BAA2B,mBAAmB;AAE3D,MAAM,UAA2B;AAAA,EACtC,KAAK;AAAA,EACL,SAAS;AAAA,EACT,SAAS;AAAA,IACP,MAAM;AAAA,MACJ,SAAS;AAAA,MACT,aAAa;AAAA,MACb,aAAa;AAAA,QACX,aAAa;AAAA,QACb,QAAQ;AAAA,MACV;AAAA,MACA,WAAW;AAAA,QACT,EAAE,QAAQ,KAAK,aAAa,wCAAwC,QAAQ,kCAAkC;AAAA,MAChH;AAAA,MACA,QAAQ;AAAA,QACN,EAAE,QAAQ,KAAK,aAAa,mBAAmB,QAAQ,sBAAsB;AAAA,QAC7E,EAAE,QAAQ,KAAK,aAAa,gBAAgB,QAAQ,sBAAsB;AAAA,QAC1E,EAAE,QAAQ,KAAK,aAAa,yBAAyB,QAAQ,sBAAsB;AAAA,QACnF,EAAE,QAAQ,KAAK,aAAa,4BAA4B,QAAQ,sBAAsB;AAAA,QACtF,EAAE,QAAQ,KAAK,aAAa,8BAA8B,QAAQ,sBAAsB;AAAA,QACxF,EAAE,QAAQ,KAAK,aAAa,iCAAiC,QAAQ,sBAAsB;AAAA,MAC7F;AAAA,IACF;AAAA,EACF;AACF;",
   "names": ["metadata"]
 }

package/dist/modules/attachments/data/entities.js

@@ -39,6 +39,9 @@ __decorateClass([
 __decorateClass([
   Property({ name: "config_json", type: "json", nullable: true })
 ], AttachmentPartition.prototype, "configJson", 2);
+__decorateClass([
+  Property({ name: "access_resolver_requirements", type: "jsonb", nullable: true })
+], AttachmentPartition.prototype, "accessResolverRequirements", 2);
 __decorateClass([
   Property({ name: "is_public", type: "boolean", default: false })
 ], AttachmentPartition.prototype, "isPublic", 2);

package/dist/modules/attachments/data/entities.js.map

@@ -1,7 +1,7 @@
 {
   "version": 3,
   "sources": ["../../../../src/modules/attachments/data/entities.ts"],
-  "sourcesContent": ["import { BigIntType, OptionalProps } from '@mikro-orm/core'\nimport { Entity, Index, PrimaryKey, Property, Unique } from '@mikro-orm/decorators/legacy'\nimport { resolveDefaultAttachmentOcrEnabled } from '../lib/ocrConfig'\n\n@Entity({ tableName: 'attachment_partitions' })\n@Unique({ name: 'attachment_partitions_code_unique', properties: ['code'] })\nexport class AttachmentPartition {\n  [OptionalProps]?: 'createdAt' | 'updatedAt'\n\n  @PrimaryKey({ type: 'uuid', defaultRaw: 'gen_random_uuid()' })\n  id!: string\n\n  @Property({ type: 'text' })\n  code!: string\n\n  @Property({ type: 'text' })\n  title!: string\n\n  @Property({ type: 'text', nullable: true })\n  description?: string | null\n\n  @Property({ name: 'storage_driver', type: 'text', default: 'local' })\n  storageDriver: string = 'local'\n\n  @Property({ name: 'config_json', type: 'json', nullable: true })\n  configJson?: Record<string, unknown> | null\n\n  @Property({ name: 'is_public', type: 'boolean', default: false })\n  isPublic: boolean = false\n\n  @Property({ name: 'requires_ocr', type: 'boolean', default: resolveDefaultAttachmentOcrEnabled() })\n  requiresOcr: boolean = resolveDefaultAttachmentOcrEnabled()\n\n  @Property({ name: 'ocr_model', type: 'text', nullable: true })\n  ocrModel?: string | null\n\n  @Property({ name: 'organization_id', type: 'uuid', nullable: true })\n  organizationId?: string | null\n\n  @Property({ name: 'tenant_id', type: 'uuid', nullable: true })\n  @Index({ name: 'attachment_partitions_tenant_idx' })\n  tenantId?: string | null\n\n  @Property({ name: 'created_at', type: Date, onCreate: () => new Date() })\n  createdAt: Date = new Date()\n\n  @Property({ name: 'updated_at', type: Date, onUpdate: () => new Date() })\n  updatedAt: Date = new Date()\n}\n\n@Entity({ tableName: 'attachments' })\n@Index({ name: 'attachments_storage_reference_idx', properties: ['partitionCode', 'storagePath'] })\nexport class Attachment {\n  [OptionalProps]?: 'createdAt'\n\n  @PrimaryKey({ type: 'uuid', defaultRaw: 'gen_random_uuid()' })\n  id!: string\n\n  @Property({ name: 'entity_id', type: 'text' })\n  entityId!: string\n\n  @Property({ name: 'record_id', type: 'text' })\n  @Index({ name: 'attachments_entity_record_idx' })\n  recordId!: string\n\n  @Property({ name: 'organization_id', type: 'uuid', nullable: true })\n  organizationId?: string | null\n\n  @Property({ name: 'tenant_id', type: 'uuid', nullable: true })\n  tenantId?: string | null\n\n  @Property({ name: 'partition_code', type: 'text' })\n  @Index({ name: 'attachments_partition_code_idx' })\n  partitionCode!: string\n\n  @Property({ name: 'file_name', type: 'text' })\n  fileName!: string\n\n  @Property({ name: 'mime_type', type: 'text' })\n  mimeType!: string\n\n  @Property({ name: 'file_size', type: 'int' })\n  fileSize!: number\n\n  @Property({ name: 'storage_driver', type: 'text', default: 'local' })\n  storageDriver: string = 'local'\n\n  @Property({ name: 'storage_path', type: 'text' })\n  storagePath!: string\n\n  @Property({ name: 'storage_metadata', type: 'jsonb', nullable: true })\n  storageMetadata?: Record<string, unknown> | null\n\n  @Property({ name: 'url', type: 'text' })\n  url!: string\n\n  @Property({ name: 'content', type: 'text', nullable: true })\n  content: string | null = null\n\n  @Property({ name: 'created_at', type: Date, onCreate: () => new Date() })\n  createdAt: Date = new Date()\n}\n\n@Entity({ tableName: 'attachment_quota_reservations' })\n@Unique({\n  name: 'attachment_quota_reservations_scope_path_unique',\n  properties: ['tenantId', 'storageDriver', 'storagePath'],\n})\n@Index({\n  name: 'attachment_quota_reservations_tenant_status_idx',\n  properties: ['tenantId', 'status'],\n})\nexport class AttachmentQuotaReservation {\n  [OptionalProps]?: 'actualBytes' | 'createdAt' | 'status' | 'updatedAt' | 'uploadTokenHash'\n\n  @PrimaryKey({ type: 'uuid' })\n  id!: string\n\n  @Property({ name: 'tenant_id', type: 'uuid' })\n  tenantId!: string\n\n  @Property({ name: 'organization_id', type: 'uuid' })\n  organizationId!: string\n\n  /** Backed by a `bigint` column; hydrate as `number` (safe under Number.MAX_SAFE_INTEGER for attachment byte counts) instead of MikroORM's default JS `bigint`. */\n  @Property({ name: 'reserved_bytes', type: new BigIntType('number') })\n  reservedBytes!: number\n\n  /** Backed by a `bigint` column; hydrate as `number`, not MikroORM's default JS `bigint`. */\n  @Property({ name: 'actual_bytes', type: new BigIntType('number'), nullable: true })\n  actualBytes?: number | null\n\n  @Property({ type: 'text', default: 'reserved' })\n  status: 'reserved' | 'storing' | 'stored' | 'recovering' | 'committed' = 'reserved'\n\n  @Property({ type: 'text' })\n  source!: string\n\n  @Property({ name: 'storage_driver', type: 'text' })\n  storageDriver!: string\n\n  @Property({ name: 'partition_code', type: 'text', nullable: true })\n  partitionCode?: string | null\n\n  @Property({ name: 'storage_path', type: 'text' })\n  storagePath!: string\n\n  @Property({ name: 'lease_token', type: 'uuid' })\n  leaseToken!: string\n\n  @Property({ name: 'upload_token_hash', type: 'text', nullable: true })\n  uploadTokenHash?: string | null\n\n  @Property({ name: 'expires_at', type: Date, nullable: true })\n  @Index({ name: 'attachment_quota_reservations_expires_idx' })\n  expiresAt?: Date | null\n\n  @Property({ name: 'created_at', type: Date, onCreate: () => new Date() })\n  createdAt: Date = new Date()\n\n  @Property({ name: 'updated_at', type: Date, onUpdate: () => new Date() })\n  updatedAt: Date = new Date()\n}\n"],
-  "mappings": ";;;;;;;;;;AAAA,SAAS,YAAY,qBAAqB;AAC1C,SAAS,QAAQ,OAAO,YAAY,UAAU,cAAc;AAC5D,SAAS,0CAA0C;AAKhD;AADI,IAAM,sBAAN,MAA0B;AAAA,EAA1B;AAgBL,yBAAwB;AAMxB,oBAAoB;AAGpB,uBAAuB,mCAAmC;AAa1D,qBAAkB,oBAAI,KAAK;AAG3B,qBAAkB,oBAAI,KAAK;AAAA;AAC7B;AAtCE;AAAA,EADC,WAAW,EAAE,MAAM,QAAQ,YAAY,oBAAoB,CAAC;AAAA,GAHlD,oBAIX;AAGA;AAAA,EADC,SAAS,EAAE,MAAM,OAAO,CAAC;AAAA,GANf,oBAOX;AAGA;AAAA,EADC,SAAS,EAAE,MAAM,OAAO,CAAC;AAAA,GATf,oBAUX;AAGA;AAAA,EADC,SAAS,EAAE,MAAM,QAAQ,UAAU,KAAK,CAAC;AAAA,GAZ/B,oBAaX;AAGA;AAAA,EADC,SAAS,EAAE,MAAM,kBAAkB,MAAM,QAAQ,SAAS,QAAQ,CAAC;AAAA,GAfzD,oBAgBX;AAGA;AAAA,EADC,SAAS,EAAE,MAAM,eAAe,MAAM,QAAQ,UAAU,KAAK,CAAC;AAAA,GAlBpD,oBAmBX;AAGA;AAAA,EADC,SAAS,EAAE,MAAM,aAAa,MAAM,WAAW,SAAS,MAAM,CAAC;AAAA,GArBrD,oBAsBX;AAGA;AAAA,EADC,SAAS,EAAE,MAAM,gBAAgB,MAAM,WAAW,SAAS,mCAAmC,EAAE,CAAC;AAAA,GAxBvF,oBAyBX;AAGA;AAAA,EADC,SAAS,EAAE,MAAM,aAAa,MAAM,QAAQ,UAAU,KAAK,CAAC;AAAA,GA3BlD,oBA4BX;AAGA;AAAA,EADC,SAAS,EAAE,MAAM,mBAAmB,MAAM,QAAQ,UAAU,KAAK,CAAC;AAAA,GA9BxD,oBA+BX;AAIA;AAAA,EAFC,SAAS,EAAE,MAAM,aAAa,MAAM,QAAQ,UAAU,KAAK,CAAC;AAAA,EAC5D,MAAM,EAAE,MAAM,mCAAmC,CAAC;AAAA,GAlCxC,oBAmCX;AAGA;AAAA,EADC,SAAS,EAAE,MAAM,cAAc,MAAM,MAAM,UAAU,MAAM,oBAAI,KAAK,EAAE,CAAC;AAAA,GArC7D,oBAsCX;AAGA;AAAA,EADC,SAAS,EAAE,MAAM,cAAc,MAAM,MAAM,UAAU,MAAM,oBAAI,KAAK,EAAE,CAAC;AAAA,GAxC7D,oBAyCX;AAzCW,sBAAN;AAAA,EAFN,OAAO,EAAE,WAAW,wBAAwB,CAAC;AAAA,EAC7C,OAAO,EAAE,MAAM,qCAAqC,YAAY,CAAC,MAAM,EAAE,CAAC;AAAA,GAC9D;AA+CV;AADI,IAAM,aAAN,MAAiB;AAAA,EAAjB;AAiCL,yBAAwB;AAYxB,mBAAyB;AAGzB,qBAAkB,oBAAI,KAAK;AAAA;AAC7B;AA7CE;AAAA,EADC,WAAW,EAAE,MAAM,QAAQ,YAAY,oBAAoB,CAAC;AAAA,GAHlD,WAIX;AAGA;AAAA,EADC,SAAS,EAAE,MAAM,aAAa,MAAM,OAAO,CAAC;AAAA,GANlC,WAOX;AAIA;AAAA,EAFC,SAAS,EAAE,MAAM,aAAa,MAAM,OAAO,CAAC;AAAA,EAC5C,MAAM,EAAE,MAAM,gCAAgC,CAAC;AAAA,GAVrC,WAWX;AAGA;AAAA,EADC,SAAS,EAAE,MAAM,mBAAmB,MAAM,QAAQ,UAAU,KAAK,CAAC;AAAA,GAbxD,WAcX;AAGA;AAAA,EADC,SAAS,EAAE,MAAM,aAAa,MAAM,QAAQ,UAAU,KAAK,CAAC;AAAA,GAhBlD,WAiBX;AAIA;AAAA,EAFC,SAAS,EAAE,MAAM,kBAAkB,MAAM,OAAO,CAAC;AAAA,EACjD,MAAM,EAAE,MAAM,iCAAiC,CAAC;AAAA,GApBtC,WAqBX;AAGA;AAAA,EADC,SAAS,EAAE,MAAM,aAAa,MAAM,OAAO,CAAC;AAAA,GAvBlC,WAwBX;AAGA;AAAA,EADC,SAAS,EAAE,MAAM,aAAa,MAAM,OAAO,CAAC;AAAA,GA1BlC,WA2BX;AAGA;AAAA,EADC,SAAS,EAAE,MAAM,aAAa,MAAM,MAAM,CAAC;AAAA,GA7BjC,WA8BX;AAGA;AAAA,EADC,SAAS,EAAE,MAAM,kBAAkB,MAAM,QAAQ,SAAS,QAAQ,CAAC;AAAA,GAhCzD,WAiCX;AAGA;AAAA,EADC,SAAS,EAAE,MAAM,gBAAgB,MAAM,OAAO,CAAC;AAAA,GAnCrC,WAoCX;AAGA;AAAA,EADC,SAAS,EAAE,MAAM,oBAAoB,MAAM,SAAS,UAAU,KAAK,CAAC;AAAA,GAtC1D,WAuCX;AAGA;AAAA,EADC,SAAS,EAAE,MAAM,OAAO,MAAM,OAAO,CAAC;AAAA,GAzC5B,WA0CX;AAGA;AAAA,EADC,SAAS,EAAE,MAAM,WAAW,MAAM,QAAQ,UAAU,KAAK,CAAC;AAAA,GA5ChD,WA6CX;AAGA;AAAA,EADC,SAAS,EAAE,MAAM,cAAc,MAAM,MAAM,UAAU,MAAM,oBAAI,KAAK,EAAE,CAAC;AAAA,GA/C7D,WAgDX;AAhDW,aAAN;AAAA,EAFN,OAAO,EAAE,WAAW,cAAc,CAAC;AAAA,EACnC,MAAM,EAAE,MAAM,qCAAqC,YAAY,CAAC,iBAAiB,aAAa,EAAE,CAAC;AAAA,GACrF;AA6DV;AADI,IAAM,6BAAN,MAAiC;AAAA,EAAjC;AAqBL,kBAAyE;AAyBzE,qBAAkB,oBAAI,KAAK;AAG3B,qBAAkB,oBAAI,KAAK;AAAA;AAC7B;AA9CE;AAAA,EADC,WAAW,EAAE,MAAM,OAAO,CAAC;AAAA,GAHjB,2BAIX;AAGA;AAAA,EADC,SAAS,EAAE,MAAM,aAAa,MAAM,OAAO,CAAC;AAAA,GANlC,2BAOX;AAGA;AAAA,EADC,SAAS,EAAE,MAAM,mBAAmB,MAAM,OAAO,CAAC;AAAA,GATxC,2BAUX;AAIA;AAAA,EADC,SAAS,EAAE,MAAM,kBAAkB,MAAM,IAAI,WAAW,QAAQ,EAAE,CAAC;AAAA,GAbzD,2BAcX;AAIA;AAAA,EADC,SAAS,EAAE,MAAM,gBAAgB,MAAM,IAAI,WAAW,QAAQ,GAAG,UAAU,KAAK,CAAC;AAAA,GAjBvE,2BAkBX;AAGA;AAAA,EADC,SAAS,EAAE,MAAM,QAAQ,SAAS,WAAW,CAAC;AAAA,GApBpC,2BAqBX;AAGA;AAAA,EADC,SAAS,EAAE,MAAM,OAAO,CAAC;AAAA,GAvBf,2BAwBX;AAGA;AAAA,EADC,SAAS,EAAE,MAAM,kBAAkB,MAAM,OAAO,CAAC;AAAA,GA1BvC,2BA2BX;AAGA;AAAA,EADC,SAAS,EAAE,MAAM,kBAAkB,MAAM,QAAQ,UAAU,KAAK,CAAC;AAAA,GA7BvD,2BA8BX;AAGA;AAAA,EADC,SAAS,EAAE,MAAM,gBAAgB,MAAM,OAAO,CAAC;AAAA,GAhCrC,2BAiCX;AAGA;AAAA,EADC,SAAS,EAAE,MAAM,eAAe,MAAM,OAAO,CAAC;AAAA,GAnCpC,2BAoCX;AAGA;AAAA,EADC,SAAS,EAAE,MAAM,qBAAqB,MAAM,QAAQ,UAAU,KAAK,CAAC;AAAA,GAtC1D,2BAuCX;AAIA;AAAA,EAFC,SAAS,EAAE,MAAM,cAAc,MAAM,MAAM,UAAU,KAAK,CAAC;AAAA,EAC3D,MAAM,EAAE,MAAM,4CAA4C,CAAC;AAAA,GA1CjD,2BA2CX;AAGA;AAAA,EADC,SAAS,EAAE,MAAM,cAAc,MAAM,MAAM,UAAU,MAAM,oBAAI,KAAK,EAAE,CAAC;AAAA,GA7C7D,2BA8CX;AAGA;AAAA,EADC,SAAS,EAAE,MAAM,cAAc,MAAM,MAAM,UAAU,MAAM,oBAAI,KAAK,EAAE,CAAC;AAAA,GAhD7D,2BAiDX;AAjDW,6BAAN;AAAA,EATN,OAAO,EAAE,WAAW,gCAAgC,CAAC;AAAA,EACrD,OAAO;AAAA,IACN,MAAM;AAAA,IACN,YAAY,CAAC,YAAY,iBAAiB,aAAa;AAAA,EACzD,CAAC;AAAA,EACA,MAAM;AAAA,IACL,MAAM;AAAA,IACN,YAAY,CAAC,YAAY,QAAQ;AAAA,EACnC,CAAC;AAAA,GACY;",
+  "sourcesContent": ["import { BigIntType, OptionalProps } from '@mikro-orm/core'\nimport { Entity, Index, PrimaryKey, Property, Unique } from '@mikro-orm/decorators/legacy'\nimport { resolveDefaultAttachmentOcrEnabled } from '../lib/ocrConfig'\nimport type { AttachmentAccessRequirement } from '../lib/access-types'\n\n@Entity({ tableName: 'attachment_partitions' })\n@Unique({ name: 'attachment_partitions_code_unique', properties: ['code'] })\nexport class AttachmentPartition {\n  [OptionalProps]?: 'createdAt' | 'updatedAt'\n\n  @PrimaryKey({ type: 'uuid', defaultRaw: 'gen_random_uuid()' })\n  id!: string\n\n  @Property({ type: 'text' })\n  code!: string\n\n  @Property({ type: 'text' })\n  title!: string\n\n  @Property({ type: 'text', nullable: true })\n  description?: string | null\n\n  @Property({ name: 'storage_driver', type: 'text', default: 'local' })\n  storageDriver: string = 'local'\n\n  @Property({ name: 'config_json', type: 'json', nullable: true })\n  configJson?: Record<string, unknown> | null\n\n  @Property({ name: 'access_resolver_requirements', type: 'jsonb', nullable: true })\n  accessResolverRequirements?: AttachmentAccessRequirement[] | null\n\n  @Property({ name: 'is_public', type: 'boolean', default: false })\n  isPublic: boolean = false\n\n  @Property({ name: 'requires_ocr', type: 'boolean', default: resolveDefaultAttachmentOcrEnabled() })\n  requiresOcr: boolean = resolveDefaultAttachmentOcrEnabled()\n\n  @Property({ name: 'ocr_model', type: 'text', nullable: true })\n  ocrModel?: string | null\n\n  @Property({ name: 'organization_id', type: 'uuid', nullable: true })\n  organizationId?: string | null\n\n  @Property({ name: 'tenant_id', type: 'uuid', nullable: true })\n  @Index({ name: 'attachment_partitions_tenant_idx' })\n  tenantId?: string | null\n\n  @Property({ name: 'created_at', type: Date, onCreate: () => new Date() })\n  createdAt: Date = new Date()\n\n  @Property({ name: 'updated_at', type: Date, onUpdate: () => new Date() })\n  updatedAt: Date = new Date()\n}\n\n@Entity({ tableName: 'attachments' })\n@Index({ name: 'attachments_storage_reference_idx', properties: ['partitionCode', 'storagePath'] })\nexport class Attachment {\n  [OptionalProps]?: 'createdAt'\n\n  @PrimaryKey({ type: 'uuid', defaultRaw: 'gen_random_uuid()' })\n  id!: string\n\n  @Property({ name: 'entity_id', type: 'text' })\n  entityId!: string\n\n  @Property({ name: 'record_id', type: 'text' })\n  @Index({ name: 'attachments_entity_record_idx' })\n  recordId!: string\n\n  @Property({ name: 'organization_id', type: 'uuid', nullable: true })\n  organizationId?: string | null\n\n  @Property({ name: 'tenant_id', type: 'uuid', nullable: true })\n  tenantId?: string | null\n\n  @Property({ name: 'partition_code', type: 'text' })\n  @Index({ name: 'attachments_partition_code_idx' })\n  partitionCode!: string\n\n  @Property({ name: 'file_name', type: 'text' })\n  fileName!: string\n\n  @Property({ name: 'mime_type', type: 'text' })\n  mimeType!: string\n\n  @Property({ name: 'file_size', type: 'int' })\n  fileSize!: number\n\n  @Property({ name: 'storage_driver', type: 'text', default: 'local' })\n  storageDriver: string = 'local'\n\n  @Property({ name: 'storage_path', type: 'text' })\n  storagePath!: string\n\n  @Property({ name: 'storage_metadata', type: 'jsonb', nullable: true })\n  storageMetadata?: Record<string, unknown> | null\n\n  @Property({ name: 'url', type: 'text' })\n  url!: string\n\n  @Property({ name: 'content', type: 'text', nullable: true })\n  content: string | null = null\n\n  @Property({ name: 'created_at', type: Date, onCreate: () => new Date() })\n  createdAt: Date = new Date()\n}\n\n@Entity({ tableName: 'attachment_quota_reservations' })\n@Unique({\n  name: 'attachment_quota_reservations_scope_path_unique',\n  properties: ['tenantId', 'storageDriver', 'storagePath'],\n})\n@Index({\n  name: 'attachment_quota_reservations_tenant_status_idx',\n  properties: ['tenantId', 'status'],\n})\nexport class AttachmentQuotaReservation {\n  [OptionalProps]?: 'actualBytes' | 'createdAt' | 'status' | 'updatedAt' | 'uploadTokenHash'\n\n  @PrimaryKey({ type: 'uuid' })\n  id!: string\n\n  @Property({ name: 'tenant_id', type: 'uuid' })\n  tenantId!: string\n\n  @Property({ name: 'organization_id', type: 'uuid' })\n  organizationId!: string\n\n  /** Backed by a `bigint` column; hydrate as `number` (safe under Number.MAX_SAFE_INTEGER for attachment byte counts) instead of MikroORM's default JS `bigint`. */\n  @Property({ name: 'reserved_bytes', type: new BigIntType('number') })\n  reservedBytes!: number\n\n  /** Backed by a `bigint` column; hydrate as `number`, not MikroORM's default JS `bigint`. */\n  @Property({ name: 'actual_bytes', type: new BigIntType('number'), nullable: true })\n  actualBytes?: number | null\n\n  @Property({ type: 'text', default: 'reserved' })\n  status: 'reserved' | 'storing' | 'stored' | 'recovering' | 'committed' = 'reserved'\n\n  @Property({ type: 'text' })\n  source!: string\n\n  @Property({ name: 'storage_driver', type: 'text' })\n  storageDriver!: string\n\n  @Property({ name: 'partition_code', type: 'text', nullable: true })\n  partitionCode?: string | null\n\n  @Property({ name: 'storage_path', type: 'text' })\n  storagePath!: string\n\n  @Property({ name: 'lease_token', type: 'uuid' })\n  leaseToken!: string\n\n  @Property({ name: 'upload_token_hash', type: 'text', nullable: true })\n  uploadTokenHash?: string | null\n\n  @Property({ name: 'expires_at', type: Date, nullable: true })\n  @Index({ name: 'attachment_quota_reservations_expires_idx' })\n  expiresAt?: Date | null\n\n  @Property({ name: 'created_at', type: Date, onCreate: () => new Date() })\n  createdAt: Date = new Date()\n\n  @Property({ name: 'updated_at', type: Date, onUpdate: () => new Date() })\n  updatedAt: Date = new Date()\n}\n"],
+  "mappings": ";;;;;;;;;;AAAA,SAAS,YAAY,qBAAqB;AAC1C,SAAS,QAAQ,OAAO,YAAY,UAAU,cAAc;AAC5D,SAAS,0CAA0C;AAMhD;AADI,IAAM,sBAAN,MAA0B;AAAA,EAA1B;AAgBL,yBAAwB;AASxB,oBAAoB;AAGpB,uBAAuB,mCAAmC;AAa1D,qBAAkB,oBAAI,KAAK;AAG3B,qBAAkB,oBAAI,KAAK;AAAA;AAC7B;AAzCE;AAAA,EADC,WAAW,EAAE,MAAM,QAAQ,YAAY,oBAAoB,CAAC;AAAA,GAHlD,oBAIX;AAGA;AAAA,EADC,SAAS,EAAE,MAAM,OAAO,CAAC;AAAA,GANf,oBAOX;AAGA;AAAA,EADC,SAAS,EAAE,MAAM,OAAO,CAAC;AAAA,GATf,oBAUX;AAGA;AAAA,EADC,SAAS,EAAE,MAAM,QAAQ,UAAU,KAAK,CAAC;AAAA,GAZ/B,oBAaX;AAGA;AAAA,EADC,SAAS,EAAE,MAAM,kBAAkB,MAAM,QAAQ,SAAS,QAAQ,CAAC;AAAA,GAfzD,oBAgBX;AAGA;AAAA,EADC,SAAS,EAAE,MAAM,eAAe,MAAM,QAAQ,UAAU,KAAK,CAAC;AAAA,GAlBpD,oBAmBX;AAGA;AAAA,EADC,SAAS,EAAE,MAAM,gCAAgC,MAAM,SAAS,UAAU,KAAK,CAAC;AAAA,GArBtE,oBAsBX;AAGA;AAAA,EADC,SAAS,EAAE,MAAM,aAAa,MAAM,WAAW,SAAS,MAAM,CAAC;AAAA,GAxBrD,oBAyBX;AAGA;AAAA,EADC,SAAS,EAAE,MAAM,gBAAgB,MAAM,WAAW,SAAS,mCAAmC,EAAE,CAAC;AAAA,GA3BvF,oBA4BX;AAGA;AAAA,EADC,SAAS,EAAE,MAAM,aAAa,MAAM,QAAQ,UAAU,KAAK,CAAC;AAAA,GA9BlD,oBA+BX;AAGA;AAAA,EADC,SAAS,EAAE,MAAM,mBAAmB,MAAM,QAAQ,UAAU,KAAK,CAAC;AAAA,GAjCxD,oBAkCX;AAIA;AAAA,EAFC,SAAS,EAAE,MAAM,aAAa,MAAM,QAAQ,UAAU,KAAK,CAAC;AAAA,EAC5D,MAAM,EAAE,MAAM,mCAAmC,CAAC;AAAA,GArCxC,oBAsCX;AAGA;AAAA,EADC,SAAS,EAAE,MAAM,cAAc,MAAM,MAAM,UAAU,MAAM,oBAAI,KAAK,EAAE,CAAC;AAAA,GAxC7D,oBAyCX;AAGA;AAAA,EADC,SAAS,EAAE,MAAM,cAAc,MAAM,MAAM,UAAU,MAAM,oBAAI,KAAK,EAAE,CAAC;AAAA,GA3C7D,oBA4CX;AA5CW,sBAAN;AAAA,EAFN,OAAO,EAAE,WAAW,wBAAwB,CAAC;AAAA,EAC7C,OAAO,EAAE,MAAM,qCAAqC,YAAY,CAAC,MAAM,EAAE,CAAC;AAAA,GAC9D;AAkDV;AADI,IAAM,aAAN,MAAiB;AAAA,EAAjB;AAiCL,yBAAwB;AAYxB,mBAAyB;AAGzB,qBAAkB,oBAAI,KAAK;AAAA;AAC7B;AA7CE;AAAA,EADC,WAAW,EAAE,MAAM,QAAQ,YAAY,oBAAoB,CAAC;AAAA,GAHlD,WAIX;AAGA;AAAA,EADC,SAAS,EAAE,MAAM,aAAa,MAAM,OAAO,CAAC;AAAA,GANlC,WAOX;AAIA;AAAA,EAFC,SAAS,EAAE,MAAM,aAAa,MAAM,OAAO,CAAC;AAAA,EAC5C,MAAM,EAAE,MAAM,gCAAgC,CAAC;AAAA,GAVrC,WAWX;AAGA;AAAA,EADC,SAAS,EAAE,MAAM,mBAAmB,MAAM,QAAQ,UAAU,KAAK,CAAC;AAAA,GAbxD,WAcX;AAGA;AAAA,EADC,SAAS,EAAE,MAAM,aAAa,MAAM,QAAQ,UAAU,KAAK,CAAC;AAAA,GAhBlD,WAiBX;AAIA;AAAA,EAFC,SAAS,EAAE,MAAM,kBAAkB,MAAM,OAAO,CAAC;AAAA,EACjD,MAAM,EAAE,MAAM,iCAAiC,CAAC;AAAA,GApBtC,WAqBX;AAGA;AAAA,EADC,SAAS,EAAE,MAAM,aAAa,MAAM,OAAO,CAAC;AAAA,GAvBlC,WAwBX;AAGA;AAAA,EADC,SAAS,EAAE,MAAM,aAAa,MAAM,OAAO,CAAC;AAAA,GA1BlC,WA2BX;AAGA;AAAA,EADC,SAAS,EAAE,MAAM,aAAa,MAAM,MAAM,CAAC;AAAA,GA7BjC,WA8BX;AAGA;AAAA,EADC,SAAS,EAAE,MAAM,kBAAkB,MAAM,QAAQ,SAAS,QAAQ,CAAC;AAAA,GAhCzD,WAiCX;AAGA;AAAA,EADC,SAAS,EAAE,MAAM,gBAAgB,MAAM,OAAO,CAAC;AAAA,GAnCrC,WAoCX;AAGA;AAAA,EADC,SAAS,EAAE,MAAM,oBAAoB,MAAM,SAAS,UAAU,KAAK,CAAC;AAAA,GAtC1D,WAuCX;AAGA;AAAA,EADC,SAAS,EAAE,MAAM,OAAO,MAAM,OAAO,CAAC;AAAA,GAzC5B,WA0CX;AAGA;AAAA,EADC,SAAS,EAAE,MAAM,WAAW,MAAM,QAAQ,UAAU,KAAK,CAAC;AAAA,GA5ChD,WA6CX;AAGA;AAAA,EADC,SAAS,EAAE,MAAM,cAAc,MAAM,MAAM,UAAU,MAAM,oBAAI,KAAK,EAAE,CAAC;AAAA,GA/C7D,WAgDX;AAhDW,aAAN;AAAA,EAFN,OAAO,EAAE,WAAW,cAAc,CAAC;AAAA,EACnC,MAAM,EAAE,MAAM,qCAAqC,YAAY,CAAC,iBAAiB,aAAa,EAAE,CAAC;AAAA,GACrF;AA6DV;AADI,IAAM,6BAAN,MAAiC;AAAA,EAAjC;AAqBL,kBAAyE;AAyBzE,qBAAkB,oBAAI,KAAK;AAG3B,qBAAkB,oBAAI,KAAK;AAAA;AAC7B;AA9CE;AAAA,EADC,WAAW,EAAE,MAAM,OAAO,CAAC;AAAA,GAHjB,2BAIX;AAGA;AAAA,EADC,SAAS,EAAE,MAAM,aAAa,MAAM,OAAO,CAAC;AAAA,GANlC,2BAOX;AAGA;AAAA,EADC,SAAS,EAAE,MAAM,mBAAmB,MAAM,OAAO,CAAC;AAAA,GATxC,2BAUX;AAIA;AAAA,EADC,SAAS,EAAE,MAAM,kBAAkB,MAAM,IAAI,WAAW,QAAQ,EAAE,CAAC;AAAA,GAbzD,2BAcX;AAIA;AAAA,EADC,SAAS,EAAE,MAAM,gBAAgB,MAAM,IAAI,WAAW,QAAQ,GAAG,UAAU,KAAK,CAAC;AAAA,GAjBvE,2BAkBX;AAGA;AAAA,EADC,SAAS,EAAE,MAAM,QAAQ,SAAS,WAAW,CAAC;AAAA,GApBpC,2BAqBX;AAGA;AAAA,EADC,SAAS,EAAE,MAAM,OAAO,CAAC;AAAA,GAvBf,2BAwBX;AAGA;AAAA,EADC,SAAS,EAAE,MAAM,kBAAkB,MAAM,OAAO,CAAC;AAAA,GA1BvC,2BA2BX;AAGA;AAAA,EADC,SAAS,EAAE,MAAM,kBAAkB,MAAM,QAAQ,UAAU,KAAK,CAAC;AAAA,GA7BvD,2BA8BX;AAGA;AAAA,EADC,SAAS,EAAE,MAAM,gBAAgB,MAAM,OAAO,CAAC;AAAA,GAhCrC,2BAiCX;AAGA;AAAA,EADC,SAAS,EAAE,MAAM,eAAe,MAAM,OAAO,CAAC;AAAA,GAnCpC,2BAoCX;AAGA;AAAA,EADC,SAAS,EAAE,MAAM,qBAAqB,MAAM,QAAQ,UAAU,KAAK,CAAC;AAAA,GAtC1D,2BAuCX;AAIA;AAAA,EAFC,SAAS,EAAE,MAAM,cAAc,MAAM,MAAM,UAAU,KAAK,CAAC;AAAA,EAC3D,MAAM,EAAE,MAAM,4CAA4C,CAAC;AAAA,GA1CjD,2BA2CX;AAGA;AAAA,EADC,SAAS,EAAE,MAAM,cAAc,MAAM,MAAM,UAAU,MAAM,oBAAI,KAAK,EAAE,CAAC;AAAA,GA7C7D,2BA8CX;AAGA;AAAA,EADC,SAAS,EAAE,MAAM,cAAc,MAAM,MAAM,UAAU,MAAM,oBAAI,KAAK,EAAE,CAAC;AAAA,GAhD7D,2BAiDX;AAjDW,6BAAN;AAAA,EATN,OAAO,EAAE,WAAW,gCAAgC,CAAC;AAAA,EACrD,OAAO;AAAA,IACN,MAAM;AAAA,IACN,YAAY,CAAC,YAAY,iBAAiB,aAAa;AAAA,EACzD,CAAC;AAAA,EACA,MAAM;AAAA,IACL,MAAM;AAAA,IACN,YAAY,CAAC,YAAY,QAAQ;AAAA,EACnC,CAAC;AAAA,GACY;",
   "names": []
 }

package/dist/modules/attachments/data/validators.js

@@ -0,0 +1,41 @@
+import { z } from "zod";
+const attachmentAccessActionSchema = z.enum(["read", "render", "metadata", "reassign", "delete", "export"]);
+const attachmentAccessSubjectFeaturesSchema = z.array(z.string());
+const attachmentAccessSelectorSchema = z.string().min(1).max(200).regex(/^(?:\*|[^*\s]+(?:\.\*)?)$/);
+const resolverIdSchema = z.string().min(3).max(200).regex(/^[a-zA-Z0-9_-]+\.[a-zA-Z0-9_.-]+$/);
+const attachmentAccessRequirementSchema = z.object({
+  resolverId: resolverIdSchema,
+  targetEntity: attachmentAccessSelectorSchema
+}).strict();
+const protectedAttachmentTargetSchema = attachmentAccessRequirementSchema.extend({
+  targetPartition: attachmentAccessSelectorSchema
+});
+const attachmentAccessResolverSchema = z.object({
+  id: resolverIdSchema,
+  targetPartition: attachmentAccessSelectorSchema,
+  targetEntity: attachmentAccessSelectorSchema.optional(),
+  actions: z.array(attachmentAccessActionSchema).min(1).optional(),
+  priority: z.number().finite().optional(),
+  timeoutMs: z.number().int().min(1).max(15e3).optional(),
+  resolve: z.custom((value) => typeof value === "function")
+}).strict();
+const attachmentAccessRequirementsSchema = z.array(attachmentAccessRequirementSchema);
+const attachmentAccessDecisionSchema = z.discriminatedUnion("ok", [
+  z.object({ ok: z.literal(true) }).strict(),
+  z.object({
+    ok: z.literal(false),
+    status: z.union([z.literal(401), z.literal(403), z.literal(404), z.literal(504)]),
+    reason: z.string().min(1).max(200).regex(/^[a-zA-Z0-9_.:-]+$/)
+  }).strict()
+]);
+export {
+  attachmentAccessActionSchema,
+  attachmentAccessDecisionSchema,
+  attachmentAccessRequirementSchema,
+  attachmentAccessRequirementsSchema,
+  attachmentAccessResolverSchema,
+  attachmentAccessSelectorSchema,
+  attachmentAccessSubjectFeaturesSchema,
+  protectedAttachmentTargetSchema
+};
+//# sourceMappingURL=validators.js.map

package/dist/modules/attachments/data/validators.js.map

@@ -0,0 +1,7 @@
+{
+  "version": 3,
+  "sources": ["../../../../src/modules/attachments/data/validators.ts"],
+  "sourcesContent": ["import { z } from 'zod'\nimport type { AttachmentAccessResolver } from '../lib/access-types'\n\nexport const attachmentAccessActionSchema = z.enum(['read', 'render', 'metadata', 'reassign', 'delete', 'export'])\nexport const attachmentAccessSubjectFeaturesSchema = z.array(z.string())\nexport const attachmentAccessSelectorSchema = z.string().min(1).max(200).regex(/^(?:\\*|[^*\\s]+(?:\\.\\*)?)$/)\nconst resolverIdSchema = z.string().min(3).max(200).regex(/^[a-zA-Z0-9_-]+\\.[a-zA-Z0-9_.-]+$/)\n\nexport const attachmentAccessRequirementSchema = z.object({\n  resolverId: resolverIdSchema,\n  targetEntity: attachmentAccessSelectorSchema,\n}).strict()\n\nexport const protectedAttachmentTargetSchema = attachmentAccessRequirementSchema.extend({\n  targetPartition: attachmentAccessSelectorSchema,\n})\n\nexport const attachmentAccessResolverSchema = z.object({\n  id: resolverIdSchema,\n  targetPartition: attachmentAccessSelectorSchema,\n  targetEntity: attachmentAccessSelectorSchema.optional(),\n  actions: z.array(attachmentAccessActionSchema).min(1).optional(),\n  priority: z.number().finite().optional(),\n  timeoutMs: z.number().int().min(1).max(15_000).optional(),\n  resolve: z.custom<AttachmentAccessResolver['resolve']>((value) => typeof value === 'function'),\n}).strict()\n\nexport const attachmentAccessRequirementsSchema = z.array(attachmentAccessRequirementSchema)\nexport const attachmentAccessDecisionSchema = z.discriminatedUnion('ok', [\n  z.object({ ok: z.literal(true) }).strict(),\n  z.object({\n    ok: z.literal(false),\n    status: z.union([z.literal(401), z.literal(403), z.literal(404), z.literal(504)]),\n    reason: z.string().min(1).max(200).regex(/^[a-zA-Z0-9_.:-]+$/),\n  }).strict(),\n])\n"],
+  "mappings": "AAAA,SAAS,SAAS;AAGX,MAAM,+BAA+B,EAAE,KAAK,CAAC,QAAQ,UAAU,YAAY,YAAY,UAAU,QAAQ,CAAC;AAC1G,MAAM,wCAAwC,EAAE,MAAM,EAAE,OAAO,CAAC;AAChE,MAAM,iCAAiC,EAAE,OAAO,EAAE,IAAI,CAAC,EAAE,IAAI,GAAG,EAAE,MAAM,2BAA2B;AAC1G,MAAM,mBAAmB,EAAE,OAAO,EAAE,IAAI,CAAC,EAAE,IAAI,GAAG,EAAE,MAAM,mCAAmC;AAEtF,MAAM,oCAAoC,EAAE,OAAO;AAAA,EACxD,YAAY;AAAA,EACZ,cAAc;AAChB,CAAC,EAAE,OAAO;AAEH,MAAM,kCAAkC,kCAAkC,OAAO;AAAA,EACtF,iBAAiB;AACnB,CAAC;AAEM,MAAM,iCAAiC,EAAE,OAAO;AAAA,EACrD,IAAI;AAAA,EACJ,iBAAiB;AAAA,EACjB,cAAc,+BAA+B,SAAS;AAAA,EACtD,SAAS,EAAE,MAAM,4BAA4B,EAAE,IAAI,CAAC,EAAE,SAAS;AAAA,EAC/D,UAAU,EAAE,OAAO,EAAE,OAAO,EAAE,SAAS;AAAA,EACvC,WAAW,EAAE,OAAO,EAAE,IAAI,EAAE,IAAI,CAAC,EAAE,IAAI,IAAM,EAAE,SAAS;AAAA,EACxD,SAAS,EAAE,OAA4C,CAAC,UAAU,OAAO,UAAU,UAAU;AAC/F,CAAC,EAAE,OAAO;AAEH,MAAM,qCAAqC,EAAE,MAAM,iCAAiC;AACpF,MAAM,iCAAiC,EAAE,mBAAmB,MAAM;AAAA,EACvE,EAAE,OAAO,EAAE,IAAI,EAAE,QAAQ,IAAI,EAAE,CAAC,EAAE,OAAO;AAAA,EACzC,EAAE,OAAO;AAAA,IACP,IAAI,EAAE,QAAQ,KAAK;AAAA,IACnB,QAAQ,EAAE,MAAM,CAAC,EAAE,QAAQ,GAAG,GAAG,EAAE,QAAQ,GAAG,GAAG,EAAE,QAAQ,GAAG,GAAG,EAAE,QAAQ,GAAG,CAAC,CAAC;AAAA,IAChF,QAAQ,EAAE,OAAO,EAAE,IAAI,CAAC,EAAE,IAAI,GAAG,EAAE,MAAM,oBAAoB;AAAA,EAC/D,CAAC,EAAE,OAAO;AACZ,CAAC;",
+  "names": []
+}