@open-mercato/core 0.10.1-develop.7736.1.88e07906bf → 0.10.1-develop.7748.1.d745ba61aa

package/dist/modules/attachments/di.js

@@ -1,3 +1,4 @@
+import { createAttachmentAccessContext } from "./lib/access-runner.js";
 import { asFunction, asValue } from "awilix";
 import { StorageDriverFactory } from "./lib/drivers/driverFactory.js";
 import { DefaultAttachmentService } from "./lib/attachment-service.js";
@@ -6,13 +7,14 @@ import { scheduleAttachmentQuotaRecovery } from "./lib/quota-recovery-queue.js";
 import { AttachmentTargetAccessService } from "./lib/target-access-service.js";
 import { ScopedAttachmentUploadService } from "./lib/scoped-upload-service.js";
 function register(container) {
+  const accessContext = () => createAttachmentAccessContext(container);
   container.register({
     attachmentQuotaRecoveryScheduler: asValue(scheduleAttachmentQuotaRecovery),
     attachmentQuotaService: asFunction(
       ({ em }) => createAttachmentQuotaService(em)
     ).scoped().proxy(),
     attachmentTargetAccessService: asFunction(
-      ({ em }) => new AttachmentTargetAccessService(em)
+      ({ em }) => new AttachmentTargetAccessService(em, accessContext)
     ).scoped().proxy(),
     attachmentScopedUploadService: asFunction(({
       em,
@@ -37,7 +39,8 @@ function register(container) {
     attachmentService: asFunction((cradle) => new DefaultAttachmentService(
       cradle.em,
       cradle.storageDriverFactory,
-      () => cradle.attachmentScopedUploadService ?? null
+      () => cradle.attachmentScopedUploadService ?? null,
+      accessContext
     )).scoped().proxy()
   });
 }

package/dist/modules/attachments/di.js.map

@@ -1,7 +1,7 @@
 {
   "version": 3,
   "sources": ["../../../src/modules/attachments/di.ts"],
-  "sourcesContent": ["import { asFunction, asValue } from 'awilix'\nimport type { AppContainer } from '@open-mercato/shared/lib/di/container'\nimport type { DataEngine } from '@open-mercato/shared/lib/data/engine'\nimport { StorageDriverFactory } from './lib/drivers/driverFactory'\nimport { DefaultAttachmentService } from './lib/attachment-service'\nimport { createAttachmentQuotaService, type AttachmentQuotaService } from './lib/quota-service'\nimport { scheduleAttachmentQuotaRecovery } from './lib/quota-recovery-queue'\nimport { AttachmentTargetAccessService } from './lib/target-access-service'\nimport { ScopedAttachmentUploadService } from './lib/scoped-upload-service'\n\nexport function register(container: AppContainer) {\n  container.register({\n    attachmentQuotaRecoveryScheduler: asValue(scheduleAttachmentQuotaRecovery),\n    attachmentQuotaService: asFunction(({ em }: { em: ConstructorParameters<typeof StorageDriverFactory>[0] }) =>\n      createAttachmentQuotaService(em),\n    )\n      .scoped()\n      .proxy(),\n    attachmentTargetAccessService: asFunction(({ em }: { em: ConstructorParameters<typeof StorageDriverFactory>[0] }) =>\n      new AttachmentTargetAccessService(em),\n    )\n      .scoped()\n      .proxy(),\n    attachmentScopedUploadService: asFunction(({\n      em,\n      dataEngine,\n      storageDriverFactory,\n      attachmentQuotaService,\n      attachmentQuotaRecoveryScheduler,\n    }: {\n      em: ConstructorParameters<typeof StorageDriverFactory>[0]\n      dataEngine: DataEngine\n      storageDriverFactory: StorageDriverFactory\n      attachmentQuotaService: AttachmentQuotaService\n      attachmentQuotaRecoveryScheduler: typeof scheduleAttachmentQuotaRecovery\n    }) => new ScopedAttachmentUploadService({\n      em,\n      dataEngine,\n      storageDriverFactory,\n      attachmentQuotaService,\n      attachmentQuotaRecoveryScheduler,\n    }))\n      .scoped()\n      .proxy(),\n    storageDriverFactory: asFunction(({ em }: { em: ConstructorParameters<typeof StorageDriverFactory>[0] }) =>\n      new StorageDriverFactory(em),\n    )\n      .singleton()\n      .proxy(),\n    // The scoped upload service is handed over as a lazy resolver so module\n    // uploads share the public attachment route's single fenced reservation\n    // ledger, without dragging that service's own dependencies into every\n    // container that merely constructs an `attachmentService`.\n    attachmentService: asFunction((cradle: {\n      em: ConstructorParameters<typeof DefaultAttachmentService>[0]\n      storageDriverFactory: ConstructorParameters<typeof DefaultAttachmentService>[1]\n      attachmentScopedUploadService: ScopedAttachmentUploadService\n    }) => new DefaultAttachmentService(\n      cradle.em,\n      cradle.storageDriverFactory,\n      () => cradle.attachmentScopedUploadService ?? null,\n    ))\n      .scoped()\n      .proxy(),\n  })\n}\n"],
-  "mappings": "AAAA,SAAS,YAAY,eAAe;AAGpC,SAAS,4BAA4B;AACrC,SAAS,gCAAgC;AACzC,SAAS,oCAAiE;AAC1E,SAAS,uCAAuC;AAChD,SAAS,qCAAqC;AAC9C,SAAS,qCAAqC;AAEvC,SAAS,SAAS,WAAyB;AAChD,YAAU,SAAS;AAAA,IACjB,kCAAkC,QAAQ,+BAA+B;AAAA,IACzE,wBAAwB;AAAA,MAAW,CAAC,EAAE,GAAG,MACvC,6BAA6B,EAAE;AAAA,IACjC,EACG,OAAO,EACP,MAAM;AAAA,IACT,+BAA+B;AAAA,MAAW,CAAC,EAAE,GAAG,MAC9C,IAAI,8BAA8B,EAAE;AAAA,IACtC,EACG,OAAO,EACP,MAAM;AAAA,IACT,+BAA+B,WAAW,CAAC;AAAA,MACzC;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,IACF,MAMM,IAAI,8BAA8B;AAAA,MACtC;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,IACF,CAAC,CAAC,EACC,OAAO,EACP,MAAM;AAAA,IACT,sBAAsB;AAAA,MAAW,CAAC,EAAE,GAAG,MACrC,IAAI,qBAAqB,EAAE;AAAA,IAC7B,EACG,UAAU,EACV,MAAM;AAAA;AAAA;AAAA;AAAA;AAAA,IAKT,mBAAmB,WAAW,CAAC,WAIzB,IAAI;AAAA,MACR,OAAO;AAAA,MACP,OAAO;AAAA,MACP,MAAM,OAAO,iCAAiC;AAAA,IAChD,CAAC,EACE,OAAO,EACP,MAAM;AAAA,EACX,CAAC;AACH;",
+  "sourcesContent": ["import { createAttachmentAccessContext } from './lib/access-runner'\nimport { asFunction, asValue } from 'awilix'\nimport type { AppContainer } from '@open-mercato/shared/lib/di/container'\nimport type { DataEngine } from '@open-mercato/shared/lib/data/engine'\nimport { StorageDriverFactory } from './lib/drivers/driverFactory'\nimport { DefaultAttachmentService } from './lib/attachment-service'\nimport { createAttachmentQuotaService, type AttachmentQuotaService } from './lib/quota-service'\nimport { scheduleAttachmentQuotaRecovery } from './lib/quota-recovery-queue'\nimport { AttachmentTargetAccessService } from './lib/target-access-service'\nimport { ScopedAttachmentUploadService } from './lib/scoped-upload-service'\n\nexport function register(container: AppContainer) {\n  const accessContext = () => createAttachmentAccessContext(container)\n  container.register({\n    attachmentQuotaRecoveryScheduler: asValue(scheduleAttachmentQuotaRecovery),\n    attachmentQuotaService: asFunction(({ em }: { em: ConstructorParameters<typeof StorageDriverFactory>[0] }) =>\n      createAttachmentQuotaService(em),\n    )\n      .scoped()\n      .proxy(),\n    attachmentTargetAccessService: asFunction(({ em }: { em: ConstructorParameters<typeof StorageDriverFactory>[0] }) =>\n      new AttachmentTargetAccessService(em, accessContext),\n    )\n      .scoped()\n      .proxy(),\n    attachmentScopedUploadService: asFunction(({\n      em,\n      dataEngine,\n      storageDriverFactory,\n      attachmentQuotaService,\n      attachmentQuotaRecoveryScheduler,\n    }: {\n      em: ConstructorParameters<typeof StorageDriverFactory>[0]\n      dataEngine: DataEngine\n      storageDriverFactory: StorageDriverFactory\n      attachmentQuotaService: AttachmentQuotaService\n      attachmentQuotaRecoveryScheduler: typeof scheduleAttachmentQuotaRecovery\n    }) => new ScopedAttachmentUploadService({\n      em,\n      dataEngine,\n      storageDriverFactory,\n      attachmentQuotaService,\n      attachmentQuotaRecoveryScheduler,\n    }))\n      .scoped()\n      .proxy(),\n    storageDriverFactory: asFunction(({ em }: { em: ConstructorParameters<typeof StorageDriverFactory>[0] }) =>\n      new StorageDriverFactory(em),\n    )\n      .singleton()\n      .proxy(),\n    // The scoped upload service is handed over as a lazy resolver so module\n    // uploads share the public attachment route's single fenced reservation\n    // ledger, without dragging that service's own dependencies into every\n    // container that merely constructs an `attachmentService`.\n    attachmentService: asFunction((cradle: {\n      em: ConstructorParameters<typeof DefaultAttachmentService>[0]\n      storageDriverFactory: ConstructorParameters<typeof DefaultAttachmentService>[1]\n      attachmentScopedUploadService: ScopedAttachmentUploadService\n    }) => new DefaultAttachmentService(\n      cradle.em,\n      cradle.storageDriverFactory,\n      () => cradle.attachmentScopedUploadService ?? null,\n      accessContext,\n    ))\n      .scoped()\n      .proxy(),\n  })\n}\n"],
+  "mappings": "AAAA,SAAS,qCAAqC;AAC9C,SAAS,YAAY,eAAe;AAGpC,SAAS,4BAA4B;AACrC,SAAS,gCAAgC;AACzC,SAAS,oCAAiE;AAC1E,SAAS,uCAAuC;AAChD,SAAS,qCAAqC;AAC9C,SAAS,qCAAqC;AAEvC,SAAS,SAAS,WAAyB;AAChD,QAAM,gBAAgB,MAAM,8BAA8B,SAAS;AACnE,YAAU,SAAS;AAAA,IACjB,kCAAkC,QAAQ,+BAA+B;AAAA,IACzE,wBAAwB;AAAA,MAAW,CAAC,EAAE,GAAG,MACvC,6BAA6B,EAAE;AAAA,IACjC,EACG,OAAO,EACP,MAAM;AAAA,IACT,+BAA+B;AAAA,MAAW,CAAC,EAAE,GAAG,MAC9C,IAAI,8BAA8B,IAAI,aAAa;AAAA,IACrD,EACG,OAAO,EACP,MAAM;AAAA,IACT,+BAA+B,WAAW,CAAC;AAAA,MACzC;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,IACF,MAMM,IAAI,8BAA8B;AAAA,MACtC;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,IACF,CAAC,CAAC,EACC,OAAO,EACP,MAAM;AAAA,IACT,sBAAsB;AAAA,MAAW,CAAC,EAAE,GAAG,MACrC,IAAI,qBAAqB,EAAE;AAAA,IAC7B,EACG,UAAU,EACV,MAAM;AAAA;AAAA;AAAA;AAAA;AAAA,IAKT,mBAAmB,WAAW,CAAC,WAIzB,IAAI;AAAA,MACR,OAAO;AAAA,MACP,OAAO;AAAA,MACP,MAAM,OAAO,iCAAiC;AAAA,MAC9C;AAAA,IACF,CAAC,EACE,OAAO,EACP,MAAM;AAAA,EACX,CAAC;AACH;",
   "names": []
 }

package/dist/modules/attachments/generators.js

@@ -0,0 +1,29 @@
+const accessPlugin = {
+  id: "attachments.access-resolvers",
+  conventionFile: "data/attachment-access.ts",
+  importPrefix: "ATTACHMENT_ACCESS",
+  configExpr: (importName, moduleId) => `{ moduleId: '${moduleId}', resolvers: (${importName}.attachmentAccessResolvers ?? []), protectedTargets: (${importName}.protectedAttachmentTargets ?? []) }`,
+  outputFileName: "attachment-access.generated.ts",
+  buildOutput: ({ importSection, entriesLiteral }) => `// AUTO-GENERATED by mercato generate registry
+import type { AttachmentAccessResolverEntry } from '@open-mercato/core/modules/attachments'
+${importSection}
+
+export const attachmentAccessEntries: AttachmentAccessResolverEntry[] = [
+${entriesLiteral ? `  ${entriesLiteral}
+` : ""}]
+`,
+  bootstrapRegistration: {
+    entriesExportName: "attachmentAccessEntries",
+    registrationImports: [
+      "import { registerAttachmentAccessResolvers } from '@open-mercato/core/modules/attachments/lib/access-registry'"
+    ],
+    buildCall: (entries) => `registerAttachmentAccessResolvers(${entries})`
+  }
+};
+const generatorPlugins = [accessPlugin];
+var generators_default = generatorPlugins;
+export {
+  generators_default as default,
+  generatorPlugins
+};
+//# sourceMappingURL=generators.js.map

package/dist/modules/attachments/generators.js.map

@@ -0,0 +1,7 @@
+{
+  "version": 3,
+  "sources": ["../../../src/modules/attachments/generators.ts"],
+  "sourcesContent": ["import type { GeneratorPlugin } from '@open-mercato/shared/modules/generators'\n\nconst accessPlugin: GeneratorPlugin = {\n  id: 'attachments.access-resolvers',\n  conventionFile: 'data/attachment-access.ts',\n  importPrefix: 'ATTACHMENT_ACCESS',\n  configExpr: (importName, moduleId) =>\n    `{ moduleId: '${moduleId}', resolvers: (${importName}.attachmentAccessResolvers ?? []), protectedTargets: (${importName}.protectedAttachmentTargets ?? []) }`,\n  outputFileName: 'attachment-access.generated.ts',\n  buildOutput: ({ importSection, entriesLiteral }) => `// AUTO-GENERATED by mercato generate registry\nimport type { AttachmentAccessResolverEntry } from '@open-mercato/core/modules/attachments'\n${importSection}\n\nexport const attachmentAccessEntries: AttachmentAccessResolverEntry[] = [\n${entriesLiteral ? `  ${entriesLiteral}\\n` : ''}]\n`,\n  bootstrapRegistration: {\n    entriesExportName: 'attachmentAccessEntries',\n    registrationImports: [\n      \"import { registerAttachmentAccessResolvers } from '@open-mercato/core/modules/attachments/lib/access-registry'\",\n    ],\n    buildCall: (entries) => `registerAttachmentAccessResolvers(${entries})`,\n  },\n}\n\nexport const generatorPlugins: GeneratorPlugin[] = [accessPlugin]\nexport default generatorPlugins\n"],
+  "mappings": "AAEA,MAAM,eAAgC;AAAA,EACpC,IAAI;AAAA,EACJ,gBAAgB;AAAA,EAChB,cAAc;AAAA,EACd,YAAY,CAAC,YAAY,aACvB,gBAAgB,QAAQ,kBAAkB,UAAU,yDAAyD,UAAU;AAAA,EACzH,gBAAgB;AAAA,EAChB,aAAa,CAAC,EAAE,eAAe,eAAe,MAAM;AAAA;AAAA,EAEpD,aAAa;AAAA;AAAA;AAAA,EAGb,iBAAiB,KAAK,cAAc;AAAA,IAAO,EAAE;AAAA;AAAA,EAE7C,uBAAuB;AAAA,IACrB,mBAAmB;AAAA,IACnB,qBAAqB;AAAA,MACnB;AAAA,IACF;AAAA,IACA,WAAW,CAAC,YAAY,qCAAqC,OAAO;AAAA,EACtE;AACF;AAEO,MAAM,mBAAsC,CAAC,YAAY;AAChE,IAAO,qBAAQ;",
+  "names": []
+}

package/dist/modules/attachments/index.js

@@ -6,7 +6,14 @@ const metadata = {
   author: "Open Mercato Team",
   license: "MIT"
 };
+import { registerAttachmentAccessResolvers } from "./lib/access-registry.js";
+import { syncAttachmentAccessProtection } from "./lib/access-protection.js";
+import { createAttachmentAccessContext, evaluateAttachmentAccess } from "./lib/access-runner.js";
 export {
-  metadata
+  createAttachmentAccessContext,
+  evaluateAttachmentAccess,
+  metadata,
+  registerAttachmentAccessResolvers,
+  syncAttachmentAccessProtection
 };
 //# sourceMappingURL=index.js.map

package/dist/modules/attachments/index.js.map

@@ -1,7 +1,7 @@
 {
   "version": 3,
   "sources": ["../../../src/modules/attachments/index.ts"],
-  "sourcesContent": ["import type { ModuleInfo } from '@open-mercato/shared/modules/registry'\n\nexport const metadata: ModuleInfo = {\n  name: 'attachments',\n  title: 'Attachments',\n  version: '0.1.0',\n  description: 'File attachments and media management.',\n  author: 'Open Mercato Team',\n  license: 'MIT',\n}\n\nexport {\n  type AttachmentOwner,\n  type AttachmentProviderCleanup,\n  type AttachmentService,\n  type CreatedScopedAttachment,\n  type CreateScopedAttachmentInput,\n  type ReadScopedAttachmentInput,\n  type ReadScopedAttachmentResult,\n  type ReleaseScopedAttachmentInput,\n} from './lib/attachment-service'\n"],
-  "mappings": "AAEO,MAAM,WAAuB;AAAA,EAClC,MAAM;AAAA,EACN,OAAO;AAAA,EACP,SAAS;AAAA,EACT,aAAa;AAAA,EACb,QAAQ;AAAA,EACR,SAAS;AACX;",
+  "sourcesContent": ["import type { ModuleInfo } from '@open-mercato/shared/modules/registry'\n\nexport const metadata: ModuleInfo = {\n  name: 'attachments',\n  title: 'Attachments',\n  version: '0.1.0',\n  description: 'File attachments and media management.',\n  author: 'Open Mercato Team',\n  license: 'MIT',\n}\n\nexport {\n  type AttachmentOwner,\n  type AttachmentProviderCleanup,\n  type AttachmentService,\n  type CreatedScopedAttachment,\n  type CreateScopedAttachmentInput,\n  type ReadScopedAttachmentInput,\n  type ReadScopedAttachmentResult,\n  type ReleaseScopedAttachmentInput,\n} from './lib/attachment-service'\n\nexport type {\n  AttachmentAccessAction,\n  AttachmentAccessDecision,\n  AttachmentAccessInput,\n  AttachmentAccessPartition,\n  AttachmentAccessRecord,\n  AttachmentAccessRequirement,\n  AttachmentAccessResolver,\n  AttachmentAccessResolverEntry,\n  AttachmentAccessSubject,\n  AttachmentAccessTarget,\n  ProtectedAttachmentTarget,\n} from './lib/access-types'\nexport { registerAttachmentAccessResolvers } from './lib/access-registry'\nexport { syncAttachmentAccessProtection } from './lib/access-protection'\nexport { createAttachmentAccessContext, evaluateAttachmentAccess } from './lib/access-runner'\nexport type { AttachmentAccessContext, AttachmentAccessResult } from './lib/access-runner'\n"],
+  "mappings": "AAEO,MAAM,WAAuB;AAAA,EAClC,MAAM;AAAA,EACN,OAAO;AAAA,EACP,SAAS;AAAA,EACT,aAAa;AAAA,EACb,QAAQ;AAAA,EACR,SAAS;AACX;AA0BA,SAAS,yCAAyC;AAClD,SAAS,sCAAsC;AAC/C,SAAS,+BAA+B,gCAAgC;",
   "names": []
 }

package/dist/modules/attachments/lib/access-errors.js

@@ -0,0 +1,35 @@
+import { CrudHttpError, isCrudHttpError } from "@open-mercato/shared/lib/crud/errors";
+import { resolveTranslations } from "@open-mercato/shared/lib/i18n/server";
+async function attachmentAccessErrorBody(status) {
+  const { t } = await resolveTranslations();
+  const key = status === 401 ? "unauthorized" : status === 404 ? "notFound" : status === 504 ? "timeout" : "forbidden";
+  return { error: t(`attachments.access.${key}`) };
+}
+async function attachmentAccessErrorResponse(decision) {
+  return Response.json(await attachmentAccessErrorBody(decision.status), {
+    status: decision.status,
+    headers: { "Cache-Control": "private, no-store" }
+  });
+}
+async function throwAttachmentAccessError(status) {
+  throw new CrudHttpError(status, await attachmentAccessErrorBody(status));
+}
+function withAttachmentAccessErrors(handler) {
+  return async (...args) => {
+    try {
+      return await handler(...args);
+    } catch (error) {
+      if (isCrudHttpError(error)) {
+        return Response.json(error.body, { status: error.status, headers: { "Cache-Control": "private, no-store" } });
+      }
+      throw error;
+    }
+  };
+}
+export {
+  attachmentAccessErrorBody,
+  attachmentAccessErrorResponse,
+  throwAttachmentAccessError,
+  withAttachmentAccessErrors
+};
+//# sourceMappingURL=access-errors.js.map

package/dist/modules/attachments/lib/access-errors.js.map

@@ -0,0 +1,7 @@
+{
+  "version": 3,
+  "sources": ["../../../../src/modules/attachments/lib/access-errors.ts"],
+  "sourcesContent": ["import { CrudHttpError, isCrudHttpError } from '@open-mercato/shared/lib/crud/errors'\nimport { resolveTranslations } from '@open-mercato/shared/lib/i18n/server'\nimport type { AttachmentAccessDecision } from './access-types'\n\nexport async function attachmentAccessErrorBody(status: number): Promise<{ error: string }> {\n  const { t } = await resolveTranslations()\n  const key = status === 401 ? 'unauthorized' : status === 404 ? 'notFound' : status === 504 ? 'timeout' : 'forbidden'\n  return { error: t(`attachments.access.${key}`) }\n}\n\nexport async function attachmentAccessErrorResponse(decision: Extract<AttachmentAccessDecision, { ok: false }>): Promise<Response> {\n  return Response.json(await attachmentAccessErrorBody(decision.status), {\n    status: decision.status, headers: { 'Cache-Control': 'private, no-store' },\n  })\n}\n\nexport async function throwAttachmentAccessError(status: number): Promise<never> {\n  throw new CrudHttpError(status, await attachmentAccessErrorBody(status))\n}\n\nexport function withAttachmentAccessErrors<Arguments extends unknown[]>(handler: (...args: Arguments) => Promise<Response>) {\n  return async (...args: Arguments): Promise<Response> => {\n    try {\n      return await handler(...args)\n    } catch (error) {\n      if (isCrudHttpError(error)) {\n        return Response.json(error.body, { status: error.status, headers: { 'Cache-Control': 'private, no-store' } })\n      }\n      throw error\n    }\n  }\n}\n"],
+  "mappings": "AAAA,SAAS,eAAe,uBAAuB;AAC/C,SAAS,2BAA2B;AAGpC,eAAsB,0BAA0B,QAA4C;AAC1F,QAAM,EAAE,EAAE,IAAI,MAAM,oBAAoB;AACxC,QAAM,MAAM,WAAW,MAAM,iBAAiB,WAAW,MAAM,aAAa,WAAW,MAAM,YAAY;AACzG,SAAO,EAAE,OAAO,EAAE,sBAAsB,GAAG,EAAE,EAAE;AACjD;AAEA,eAAsB,8BAA8B,UAA+E;AACjI,SAAO,SAAS,KAAK,MAAM,0BAA0B,SAAS,MAAM,GAAG;AAAA,IACrE,QAAQ,SAAS;AAAA,IAAQ,SAAS,EAAE,iBAAiB,oBAAoB;AAAA,EAC3E,CAAC;AACH;AAEA,eAAsB,2BAA2B,QAAgC;AAC/E,QAAM,IAAI,cAAc,QAAQ,MAAM,0BAA0B,MAAM,CAAC;AACzE;AAEO,SAAS,2BAAwD,SAAoD;AAC1H,SAAO,UAAU,SAAuC;AACtD,QAAI;AACF,aAAO,MAAM,QAAQ,GAAG,IAAI;AAAA,IAC9B,SAAS,OAAO;AACd,UAAI,gBAAgB,KAAK,GAAG;AAC1B,eAAO,SAAS,KAAK,MAAM,MAAM,EAAE,QAAQ,MAAM,QAAQ,SAAS,EAAE,iBAAiB,oBAAoB,EAAE,CAAC;AAAA,MAC9G;AACA,YAAM;AAAA,IACR;AAAA,EACF;AACF;",
+  "names": []
+}

package/dist/modules/attachments/lib/access-mutation.js

@@ -0,0 +1,23 @@
+import { throwAttachmentAccessError } from "./access-errors.js";
+import { CrudHttpError } from "@open-mercato/shared/lib/crud/errors";
+import { runRouteMutationGuards } from "@open-mercato/shared/lib/crud/route-mutation-guard";
+async function prepareAttachmentMutation(input) {
+  if (!input.auth.tenantId) return throwAttachmentAccessError(401);
+  const guard = await runRouteMutationGuards({
+    container: input.container,
+    req: input.req,
+    auth: { tenantId: input.auth.tenantId, organizationId: input.auth.orgId ?? null, userId: input.auth.sub },
+    input: {
+      resourceKind: "attachments:attachment",
+      resourceId: input.recordId,
+      operation: input.operation,
+      mutationPayload: input.payload
+    }
+  });
+  if (!guard.ok) throw new CrudHttpError(guard.errorStatus, guard.errorBody);
+  return guard;
+}
+export {
+  prepareAttachmentMutation
+};
+//# sourceMappingURL=access-mutation.js.map

package/dist/modules/attachments/lib/access-mutation.js.map

@@ -0,0 +1,7 @@
+{
+  "version": 3,
+  "sources": ["../../../../src/modules/attachments/lib/access-mutation.ts"],
+  "sourcesContent": ["import type { AwilixContainer } from 'awilix'\nimport type { AuthContext } from '@open-mercato/shared/lib/auth/server'\nimport { throwAttachmentAccessError } from './access-errors'\nimport { CrudHttpError } from '@open-mercato/shared/lib/crud/errors'\nimport { runRouteMutationGuards } from '@open-mercato/shared/lib/crud/route-mutation-guard'\n\nexport async function prepareAttachmentMutation(input: {\n  container: AwilixContainer\n  req: Request\n  auth: NonNullable<AuthContext>\n  recordId?: string\n  operation: 'update' | 'delete'\n  payload?: Record<string, unknown>\n}) {\n  if (!input.auth.tenantId) return throwAttachmentAccessError(401)\n  const guard = await runRouteMutationGuards({\n    container: input.container, req: input.req,\n    auth: { tenantId: input.auth.tenantId, organizationId: input.auth.orgId ?? null, userId: input.auth.sub },\n    input: {\n      resourceKind: 'attachments:attachment', resourceId: input.recordId,\n      operation: input.operation, mutationPayload: input.payload,\n    },\n  })\n  if (!guard.ok) throw new CrudHttpError(guard.errorStatus, guard.errorBody)\n  return guard\n}\n"],
+  "mappings": "AAEA,SAAS,kCAAkC;AAC3C,SAAS,qBAAqB;AAC9B,SAAS,8BAA8B;AAEvC,eAAsB,0BAA0B,OAO7C;AACD,MAAI,CAAC,MAAM,KAAK,SAAU,QAAO,2BAA2B,GAAG;AAC/D,QAAM,QAAQ,MAAM,uBAAuB;AAAA,IACzC,WAAW,MAAM;AAAA,IAAW,KAAK,MAAM;AAAA,IACvC,MAAM,EAAE,UAAU,MAAM,KAAK,UAAU,gBAAgB,MAAM,KAAK,SAAS,MAAM,QAAQ,MAAM,KAAK,IAAI;AAAA,IACxG,OAAO;AAAA,MACL,cAAc;AAAA,MAA0B,YAAY,MAAM;AAAA,MAC1D,WAAW,MAAM;AAAA,MAAW,iBAAiB,MAAM;AAAA,IACrD;AAAA,EACF,CAAC;AACD,MAAI,CAAC,MAAM,GAAI,OAAM,IAAI,cAAc,MAAM,aAAa,MAAM,SAAS;AACzE,SAAO;AACT;",
+  "names": []
+}

package/dist/modules/attachments/lib/access-protection.js

@@ -0,0 +1,73 @@
+import { LockMode } from "@mikro-orm/core";
+import { findOneWithDecryption, findWithDecryption } from "@open-mercato/shared/lib/encryption/find";
+import { AttachmentPartition } from "../data/entities.js";
+import { attachmentAccessRequirementsSchema } from "../data/validators.js";
+import { getAttachmentAccessRegistry, matchesAttachmentAccessSelector } from "./access-registry.js";
+function getDeclaredAttachmentAccessRequirements(partitionCode) {
+  const registry = getAttachmentAccessRegistry();
+  if (registry.invalid) throw new Error("[internal] Attachment access registry is invalid");
+  return registry.protectedTargets.filter((target) => matchesAttachmentAccessSelector(target.targetPartition, partitionCode)).map(({ resolverId, targetEntity }) => ({ resolverId, targetEntity }));
+}
+function mergeAttachmentAccessRequirements(current, required) {
+  const existing = attachmentAccessRequirementsSchema.parse(current ?? []);
+  const union = /* @__PURE__ */ new Map();
+  for (const requirement of [...existing, ...required]) {
+    union.set(JSON.stringify([requirement.resolverId, requirement.targetEntity]), { ...requirement });
+  }
+  return [...union.values()];
+}
+async function syncAttachmentAccessProtection(em, options = {}) {
+  const registry = getAttachmentAccessRegistry();
+  if (registry.invalid) throw new Error("[internal] Attachment access registry is invalid");
+  if (!registry.protectedTargets.length) return 0;
+  const isolated = em.fork({ clear: true, useContext: false });
+  const candidates = await findWithDecryption(
+    isolated,
+    AttachmentPartition,
+    options.partitionCode ? { code: options.partitionCode } : {},
+    { orderBy: { id: "asc" } },
+    { tenantId: null, organizationId: null }
+  );
+  if (options.partitionCode && getDeclaredAttachmentAccessRequirements(options.partitionCode).length && !candidates.length) {
+    throw new Error("[internal] Protected attachment partition is not durably configured");
+  }
+  const pending = candidates.filter((partition) => {
+    const required = getDeclaredAttachmentAccessRequirements(partition.code);
+    if (!required.length) return false;
+    const existing = attachmentAccessRequirementsSchema.parse(partition.accessResolverRequirements ?? []);
+    return JSON.stringify(mergeAttachmentAccessRequirements(existing, required)) !== JSON.stringify(existing);
+  });
+  if (!pending.length) return 0;
+  return isolated.transactional(async (transaction) => {
+    let changed = 0;
+    for (const candidate of pending) {
+      const partition = await findOneWithDecryption(transaction, AttachmentPartition, { id: candidate.id }, {
+        lockMode: LockMode.PESSIMISTIC_WRITE,
+        refresh: true
+      }, { tenantId: null, organizationId: null });
+      if (!partition) throw new Error("[internal] Attachment partition disappeared during access protection synchronization");
+      const existing = attachmentAccessRequirementsSchema.parse(partition.accessResolverRequirements ?? []);
+      const merged = mergeAttachmentAccessRequirements(existing, getDeclaredAttachmentAccessRequirements(partition.code));
+      if (JSON.stringify(merged) === JSON.stringify(existing)) continue;
+      partition.accessResolverRequirements = merged;
+      changed += 1;
+    }
+    if (changed) await transaction.flush();
+    return changed;
+  });
+}
+async function ensureAttachmentPartitionProtection(em, partition) {
+  const required = getDeclaredAttachmentAccessRequirements(partition.code);
+  if (!required.length) return;
+  const existing = attachmentAccessRequirementsSchema.parse(partition.accessResolverRequirements ?? []);
+  const merged = mergeAttachmentAccessRequirements(existing, required);
+  if (JSON.stringify(existing) === JSON.stringify(merged)) return;
+  await syncAttachmentAccessProtection(em, { partitionCode: partition.code });
+}
+export {
+  ensureAttachmentPartitionProtection,
+  getDeclaredAttachmentAccessRequirements,
+  mergeAttachmentAccessRequirements,
+  syncAttachmentAccessProtection
+};
+//# sourceMappingURL=access-protection.js.map

package/dist/modules/attachments/lib/access-protection.js.map

@@ -0,0 +1,7 @@
+{
+  "version": 3,
+  "sources": ["../../../../src/modules/attachments/lib/access-protection.ts"],
+  "sourcesContent": ["import { LockMode } from '@mikro-orm/core'\nimport type { EntityManager } from '@mikro-orm/postgresql'\nimport { findOneWithDecryption, findWithDecryption } from '@open-mercato/shared/lib/encryption/find'\nimport { AttachmentPartition } from '../data/entities'\nimport { attachmentAccessRequirementsSchema } from '../data/validators'\nimport { getAttachmentAccessRegistry, matchesAttachmentAccessSelector } from './access-registry'\nimport type { AttachmentAccessRequirement } from './access-types'\n\nexport function getDeclaredAttachmentAccessRequirements(partitionCode: string): AttachmentAccessRequirement[] {\n  const registry = getAttachmentAccessRegistry()\n  if (registry.invalid) throw new Error('[internal] Attachment access registry is invalid')\n  return registry.protectedTargets\n    .filter((target) => matchesAttachmentAccessSelector(target.targetPartition, partitionCode))\n    .map(({ resolverId, targetEntity }) => ({ resolverId, targetEntity }))\n}\n\nexport function mergeAttachmentAccessRequirements(\n  current: unknown,\n  required: readonly AttachmentAccessRequirement[],\n): AttachmentAccessRequirement[] {\n  const existing = attachmentAccessRequirementsSchema.parse(current ?? [])\n  const union = new Map<string, AttachmentAccessRequirement>()\n  for (const requirement of [...existing, ...required]) {\n    union.set(JSON.stringify([requirement.resolverId, requirement.targetEntity]), { ...requirement })\n  }\n  return [...union.values()]\n}\n\nexport async function syncAttachmentAccessProtection(\n  em: EntityManager,\n  options: { partitionCode?: string } = {},\n): Promise<number> {\n  const registry = getAttachmentAccessRegistry()\n  if (registry.invalid) throw new Error('[internal] Attachment access registry is invalid')\n  if (!registry.protectedTargets.length) return 0\n  const isolated = em.fork({ clear: true, useContext: false })\n  const candidates = await findWithDecryption(\n    isolated,\n    AttachmentPartition,\n    options.partitionCode ? { code: options.partitionCode } : {},\n    { orderBy: { id: 'asc' } },\n    { tenantId: null, organizationId: null },\n  )\n  if (options.partitionCode && getDeclaredAttachmentAccessRequirements(options.partitionCode).length && !candidates.length) {\n    throw new Error('[internal] Protected attachment partition is not durably configured')\n  }\n  const pending = candidates.filter((partition) => {\n    const required = getDeclaredAttachmentAccessRequirements(partition.code)\n    if (!required.length) return false\n    const existing = attachmentAccessRequirementsSchema.parse(partition.accessResolverRequirements ?? [])\n    return JSON.stringify(mergeAttachmentAccessRequirements(existing, required)) !== JSON.stringify(existing)\n  })\n  if (!pending.length) return 0\n  return isolated.transactional(async (transaction) => {\n    let changed = 0\n    for (const candidate of pending) {\n      const partition = await findOneWithDecryption(transaction, AttachmentPartition, { id: candidate.id }, {\n        lockMode: LockMode.PESSIMISTIC_WRITE,\n        refresh: true,\n      }, { tenantId: null, organizationId: null })\n      if (!partition) throw new Error('[internal] Attachment partition disappeared during access protection synchronization')\n      const existing = attachmentAccessRequirementsSchema.parse(partition.accessResolverRequirements ?? [])\n      const merged = mergeAttachmentAccessRequirements(existing, getDeclaredAttachmentAccessRequirements(partition.code))\n      if (JSON.stringify(merged) === JSON.stringify(existing)) continue\n      partition.accessResolverRequirements = merged\n      changed += 1\n    }\n    if (changed) await transaction.flush()\n    return changed\n  })\n}\n\nexport async function ensureAttachmentPartitionProtection(\n  em: EntityManager,\n  partition: AttachmentPartition,\n): Promise<void> {\n  const required = getDeclaredAttachmentAccessRequirements(partition.code)\n  if (!required.length) return\n  const existing = attachmentAccessRequirementsSchema.parse(partition.accessResolverRequirements ?? [])\n  const merged = mergeAttachmentAccessRequirements(existing, required)\n  if (JSON.stringify(existing) === JSON.stringify(merged)) return\n  await syncAttachmentAccessProtection(em, { partitionCode: partition.code })\n}\n"],
+  "mappings": "AAAA,SAAS,gBAAgB;AAEzB,SAAS,uBAAuB,0BAA0B;AAC1D,SAAS,2BAA2B;AACpC,SAAS,0CAA0C;AACnD,SAAS,6BAA6B,uCAAuC;AAGtE,SAAS,wCAAwC,eAAsD;AAC5G,QAAM,WAAW,4BAA4B;AAC7C,MAAI,SAAS,QAAS,OAAM,IAAI,MAAM,kDAAkD;AACxF,SAAO,SAAS,iBACb,OAAO,CAAC,WAAW,gCAAgC,OAAO,iBAAiB,aAAa,CAAC,EACzF,IAAI,CAAC,EAAE,YAAY,aAAa,OAAO,EAAE,YAAY,aAAa,EAAE;AACzE;AAEO,SAAS,kCACd,SACA,UAC+B;AAC/B,QAAM,WAAW,mCAAmC,MAAM,WAAW,CAAC,CAAC;AACvE,QAAM,QAAQ,oBAAI,IAAyC;AAC3D,aAAW,eAAe,CAAC,GAAG,UAAU,GAAG,QAAQ,GAAG;AACpD,UAAM,IAAI,KAAK,UAAU,CAAC,YAAY,YAAY,YAAY,YAAY,CAAC,GAAG,EAAE,GAAG,YAAY,CAAC;AAAA,EAClG;AACA,SAAO,CAAC,GAAG,MAAM,OAAO,CAAC;AAC3B;AAEA,eAAsB,+BACpB,IACA,UAAsC,CAAC,GACtB;AACjB,QAAM,WAAW,4BAA4B;AAC7C,MAAI,SAAS,QAAS,OAAM,IAAI,MAAM,kDAAkD;AACxF,MAAI,CAAC,SAAS,iBAAiB,OAAQ,QAAO;AAC9C,QAAM,WAAW,GAAG,KAAK,EAAE,OAAO,MAAM,YAAY,MAAM,CAAC;AAC3D,QAAM,aAAa,MAAM;AAAA,IACvB;AAAA,IACA;AAAA,IACA,QAAQ,gBAAgB,EAAE,MAAM,QAAQ,cAAc,IAAI,CAAC;AAAA,IAC3D,EAAE,SAAS,EAAE,IAAI,MAAM,EAAE;AAAA,IACzB,EAAE,UAAU,MAAM,gBAAgB,KAAK;AAAA,EACzC;AACA,MAAI,QAAQ,iBAAiB,wCAAwC,QAAQ,aAAa,EAAE,UAAU,CAAC,WAAW,QAAQ;AACxH,UAAM,IAAI,MAAM,qEAAqE;AAAA,EACvF;AACA,QAAM,UAAU,WAAW,OAAO,CAAC,cAAc;AAC/C,UAAM,WAAW,wCAAwC,UAAU,IAAI;AACvE,QAAI,CAAC,SAAS,OAAQ,QAAO;AAC7B,UAAM,WAAW,mCAAmC,MAAM,UAAU,8BAA8B,CAAC,CAAC;AACpG,WAAO,KAAK,UAAU,kCAAkC,UAAU,QAAQ,CAAC,MAAM,KAAK,UAAU,QAAQ;AAAA,EAC1G,CAAC;AACD,MAAI,CAAC,QAAQ,OAAQ,QAAO;AAC5B,SAAO,SAAS,cAAc,OAAO,gBAAgB;AACnD,QAAI,UAAU;AACd,eAAW,aAAa,SAAS;AAC/B,YAAM,YAAY,MAAM,sBAAsB,aAAa,qBAAqB,EAAE,IAAI,UAAU,GAAG,GAAG;AAAA,QACpG,UAAU,SAAS;AAAA,QACnB,SAAS;AAAA,MACX,GAAG,EAAE,UAAU,MAAM,gBAAgB,KAAK,CAAC;AAC3C,UAAI,CAAC,UAAW,OAAM,IAAI,MAAM,sFAAsF;AACtH,YAAM,WAAW,mCAAmC,MAAM,UAAU,8BAA8B,CAAC,CAAC;AACpG,YAAM,SAAS,kCAAkC,UAAU,wCAAwC,UAAU,IAAI,CAAC;AAClH,UAAI,KAAK,UAAU,MAAM,MAAM,KAAK,UAAU,QAAQ,EAAG;AACzD,gBAAU,6BAA6B;AACvC,iBAAW;AAAA,IACb;AACA,QAAI,QAAS,OAAM,YAAY,MAAM;AACrC,WAAO;AAAA,EACT,CAAC;AACH;AAEA,eAAsB,oCACpB,IACA,WACe;AACf,QAAM,WAAW,wCAAwC,UAAU,IAAI;AACvE,MAAI,CAAC,SAAS,OAAQ;AACtB,QAAM,WAAW,mCAAmC,MAAM,UAAU,8BAA8B,CAAC,CAAC;AACpG,QAAM,SAAS,kCAAkC,UAAU,QAAQ;AACnE,MAAI,KAAK,UAAU,QAAQ,MAAM,KAAK,UAAU,MAAM,EAAG;AACzD,QAAM,+BAA+B,IAAI,EAAE,eAAe,UAAU,KAAK,CAAC;AAC5E;",
+  "names": []
+}

package/dist/modules/attachments/lib/access-query.js

@@ -0,0 +1,74 @@
+import { ensureAttachmentPartitionProtection } from "./access-protection.js";
+import { findOneWithDecryption } from "@open-mercato/shared/lib/encryption/find";
+import { AttachmentPartition } from "../data/entities.js";
+import { attachmentAccessRequirementsSchema } from "../data/validators.js";
+import { getAttachmentAccessRegistry } from "./access-registry.js";
+import { evaluateAttachmentAccess } from "./access-runner.js";
+import { CrudHttpError } from "@open-mercato/shared/lib/crud/errors";
+import { attachmentAccessErrorBody, throwAttachmentAccessError } from "./access-errors.js";
+import { readAttachmentMetadata } from "./metadata.js";
+function requiresAttachmentAccessScan(partitions) {
+  const registry = getAttachmentAccessRegistry();
+  return registry.invalid || registry.resolvers.length > 0 || registry.protectedTargets.length > 0 || partitions.some((partition) => {
+    const parsed = attachmentAccessRequirementsSchema.safeParse(partition.accessResolverRequirements ?? []);
+    return !parsed.success || parsed.data.length > 0;
+  });
+}
+async function assertAttachmentOwnerAccess(input) {
+  const partition = await findOneWithDecryption(input.em, AttachmentPartition, { code: input.attachment.partitionCode }, void 0, {
+    tenantId: input.attachment.tenantId,
+    organizationId: input.attachment.organizationId
+  });
+  if (!partition) await throwAttachmentAccessError(404);
+  if (input.persistProtection) await ensureAttachmentPartitionProtection(input.em, partition);
+  const result = await evaluateAttachmentAccess({ ...input, partition, requireAuthForPublic: true });
+  if (!result.ok) await throwAttachmentAccessError(result.status);
+}
+async function scanAuthorizedAttachments(input) {
+  const deadline = input.deadline ?? Date.now() + 15e3;
+  const timeoutBody = await attachmentAccessErrorBody(504);
+  let timer;
+  const scan = async () => {
+    const partitions = new Map(input.partitions.map((partition) => [partition.code, partition]));
+    const records = [];
+    const tags = /* @__PURE__ */ new Set();
+    let total = 0;
+    for (let batchOffset = 0; ; batchOffset += 100) {
+      if (Date.now() >= deadline) await throwAttachmentAccessError(504);
+      const batch = await input.loadBatch(batchOffset, 100);
+      for (const attachment of batch) {
+        if (Date.now() >= deadline) await throwAttachmentAccessError(504);
+        const partition = partitions.get(attachment.partitionCode);
+        if (!partition) continue;
+        const access = await evaluateAttachmentAccess({
+          auth: input.auth,
+          attachment,
+          partition,
+          action: "metadata",
+          context: input.context,
+          requireAuthForPublic: true
+        });
+        if (Date.now() >= deadline || !access.ok && access.status === 504) await throwAttachmentAccessError(504);
+        if (!access.ok) continue;
+        if (input.collectTags) for (const tag of readAttachmentMetadata(attachment.storageMetadata).tags ?? []) tags.add(tag);
+        if (total >= (input.offset ?? 0) && (input.limit === void 0 || records.length < input.limit)) records.push(attachment);
+        total += 1;
+      }
+      if (batch.length < 100) break;
+    }
+    return { records, total, tags: [...tags].sort((left, right) => left < right ? -1 : left > right ? 1 : 0) };
+  };
+  try {
+    return await Promise.race([scan(), new Promise((_resolve, reject) => {
+      timer = setTimeout(() => reject(new CrudHttpError(504, timeoutBody)), Math.max(1, deadline - Date.now()));
+    })]);
+  } finally {
+    if (timer) clearTimeout(timer);
+  }
+}
+export {
+  assertAttachmentOwnerAccess,
+  requiresAttachmentAccessScan,
+  scanAuthorizedAttachments
+};
+//# sourceMappingURL=access-query.js.map

package/dist/modules/attachments/lib/access-query.js.map

@@ -0,0 +1,7 @@
+{
+  "version": 3,
+  "sources": ["../../../../src/modules/attachments/lib/access-query.ts"],
+  "sourcesContent": ["import { ensureAttachmentPartitionProtection } from './access-protection'\nimport type { EntityManager } from '@mikro-orm/postgresql'\nimport type { AuthContext } from '@open-mercato/shared/lib/auth/server'\nimport { findOneWithDecryption } from '@open-mercato/shared/lib/encryption/find'\nimport { AttachmentPartition, type Attachment } from '../data/entities'\nimport { attachmentAccessRequirementsSchema } from '../data/validators'\nimport { getAttachmentAccessRegistry } from './access-registry'\nimport { evaluateAttachmentAccess, type AttachmentAccessContext } from './access-runner'\nimport type { AttachmentAccessAction, AttachmentAccessRecord } from './access-types'\nimport { CrudHttpError } from '@open-mercato/shared/lib/crud/errors'\nimport { attachmentAccessErrorBody, throwAttachmentAccessError } from './access-errors'\nimport { readAttachmentMetadata } from './metadata'\n\nexport function requiresAttachmentAccessScan(partitions: readonly AttachmentPartition[]): boolean {\n  const registry = getAttachmentAccessRegistry()\n  return registry.invalid || registry.resolvers.length > 0 || registry.protectedTargets.length > 0\n    || partitions.some((partition) => {\n      const parsed = attachmentAccessRequirementsSchema.safeParse(partition.accessResolverRequirements ?? [])\n      return !parsed.success || parsed.data.length > 0\n    })\n}\n\nexport async function assertAttachmentOwnerAccess(input: {\n  em: EntityManager\n  context: AttachmentAccessContext\n  auth: NonNullable<AuthContext>\n  attachment: AttachmentAccessRecord\n  action: AttachmentAccessAction\n  persistProtection?: boolean\n}): Promise<void> {\n  const partition = await findOneWithDecryption(input.em, AttachmentPartition, { code: input.attachment.partitionCode }, undefined, {\n    tenantId: input.attachment.tenantId, organizationId: input.attachment.organizationId,\n  })\n  if (!partition) await throwAttachmentAccessError(404)\n  if (input.persistProtection) await ensureAttachmentPartitionProtection(input.em, partition!)\n  const result = await evaluateAttachmentAccess({ ...input, partition: partition!, requireAuthForPublic: true })\n  if (!result.ok) await throwAttachmentAccessError(result.status)\n}\n\nexport async function scanAuthorizedAttachments(input: {\n  auth: NonNullable<AuthContext>\n  context: AttachmentAccessContext\n  partitions: readonly AttachmentPartition[]\n  loadBatch(offset: number, limit: number): Promise<Attachment[]>\n  offset?: number\n  limit?: number\n  collectTags?: boolean\n  deadline?: number\n}): Promise<{ records: Attachment[]; total: number; tags: string[] }> {\n  const deadline = input.deadline ?? Date.now() + 15_000\n  const timeoutBody = await attachmentAccessErrorBody(504)\n  let timer: ReturnType<typeof setTimeout> | undefined\n  const scan = async () => {\n    const partitions = new Map(input.partitions.map((partition) => [partition.code, partition]))\n    const records: Attachment[] = []\n    const tags = new Set<string>()\n    let total = 0\n    for (let batchOffset = 0; ; batchOffset += 100) {\n      if (Date.now() >= deadline) await throwAttachmentAccessError(504)\n      const batch = await input.loadBatch(batchOffset, 100)\n      for (const attachment of batch) {\n        if (Date.now() >= deadline) await throwAttachmentAccessError(504)\n        const partition = partitions.get(attachment.partitionCode)\n        if (!partition) continue\n        const access = await evaluateAttachmentAccess({\n          auth: input.auth, attachment, partition, action: 'metadata', context: input.context,\n          requireAuthForPublic: true,\n        })\n        if (Date.now() >= deadline || (!access.ok && access.status === 504)) await throwAttachmentAccessError(504)\n        if (!access.ok) continue\n        if (input.collectTags) for (const tag of readAttachmentMetadata(attachment.storageMetadata).tags ?? []) tags.add(tag)\n        if (total >= (input.offset ?? 0) && (input.limit === undefined || records.length < input.limit)) records.push(attachment)\n        total += 1\n      }\n      if (batch.length < 100) break\n    }\n    return { records, total, tags: [...tags].sort((left, right) => left < right ? -1 : left > right ? 1 : 0) }\n  }\n  try {\n    return await Promise.race([scan(), new Promise<never>((_resolve, reject) => {\n      timer = setTimeout(() => reject(new CrudHttpError(504, timeoutBody)), Math.max(1, deadline - Date.now()))\n    })])\n  } finally {\n    if (timer) clearTimeout(timer)\n  }\n}\n"],
+  "mappings": "AAAA,SAAS,2CAA2C;AAGpD,SAAS,6BAA6B;AACtC,SAAS,2BAA4C;AACrD,SAAS,0CAA0C;AACnD,SAAS,mCAAmC;AAC5C,SAAS,gCAA8D;AAEvE,SAAS,qBAAqB;AAC9B,SAAS,2BAA2B,kCAAkC;AACtE,SAAS,8BAA8B;AAEhC,SAAS,6BAA6B,YAAqD;AAChG,QAAM,WAAW,4BAA4B;AAC7C,SAAO,SAAS,WAAW,SAAS,UAAU,SAAS,KAAK,SAAS,iBAAiB,SAAS,KAC1F,WAAW,KAAK,CAAC,cAAc;AAChC,UAAM,SAAS,mCAAmC,UAAU,UAAU,8BAA8B,CAAC,CAAC;AACtG,WAAO,CAAC,OAAO,WAAW,OAAO,KAAK,SAAS;AAAA,EACjD,CAAC;AACL;AAEA,eAAsB,4BAA4B,OAOhC;AAChB,QAAM,YAAY,MAAM,sBAAsB,MAAM,IAAI,qBAAqB,EAAE,MAAM,MAAM,WAAW,cAAc,GAAG,QAAW;AAAA,IAChI,UAAU,MAAM,WAAW;AAAA,IAAU,gBAAgB,MAAM,WAAW;AAAA,EACxE,CAAC;AACD,MAAI,CAAC,UAAW,OAAM,2BAA2B,GAAG;AACpD,MAAI,MAAM,kBAAmB,OAAM,oCAAoC,MAAM,IAAI,SAAU;AAC3F,QAAM,SAAS,MAAM,yBAAyB,EAAE,GAAG,OAAO,WAAuB,sBAAsB,KAAK,CAAC;AAC7G,MAAI,CAAC,OAAO,GAAI,OAAM,2BAA2B,OAAO,MAAM;AAChE;AAEA,eAAsB,0BAA0B,OASsB;AACpE,QAAM,WAAW,MAAM,YAAY,KAAK,IAAI,IAAI;AAChD,QAAM,cAAc,MAAM,0BAA0B,GAAG;AACvD,MAAI;AACJ,QAAM,OAAO,YAAY;AACvB,UAAM,aAAa,IAAI,IAAI,MAAM,WAAW,IAAI,CAAC,cAAc,CAAC,UAAU,MAAM,SAAS,CAAC,CAAC;AAC3F,UAAM,UAAwB,CAAC;AAC/B,UAAM,OAAO,oBAAI,IAAY;AAC7B,QAAI,QAAQ;AACZ,aAAS,cAAc,KAAK,eAAe,KAAK;AAC9C,UAAI,KAAK,IAAI,KAAK,SAAU,OAAM,2BAA2B,GAAG;AAChE,YAAM,QAAQ,MAAM,MAAM,UAAU,aAAa,GAAG;AACpD,iBAAW,cAAc,OAAO;AAC9B,YAAI,KAAK,IAAI,KAAK,SAAU,OAAM,2BAA2B,GAAG;AAChE,cAAM,YAAY,WAAW,IAAI,WAAW,aAAa;AACzD,YAAI,CAAC,UAAW;AAChB,cAAM,SAAS,MAAM,yBAAyB;AAAA,UAC5C,MAAM,MAAM;AAAA,UAAM;AAAA,UAAY;AAAA,UAAW,QAAQ;AAAA,UAAY,SAAS,MAAM;AAAA,UAC5E,sBAAsB;AAAA,QACxB,CAAC;AACD,YAAI,KAAK,IAAI,KAAK,YAAa,CAAC,OAAO,MAAM,OAAO,WAAW,IAAM,OAAM,2BAA2B,GAAG;AACzG,YAAI,CAAC,OAAO,GAAI;AAChB,YAAI,MAAM,YAAa,YAAW,OAAO,uBAAuB,WAAW,eAAe,EAAE,QAAQ,CAAC,EAAG,MAAK,IAAI,GAAG;AACpH,YAAI,UAAU,MAAM,UAAU,OAAO,MAAM,UAAU,UAAa,QAAQ,SAAS,MAAM,OAAQ,SAAQ,KAAK,UAAU;AACxH,iBAAS;AAAA,MACX;AACA,UAAI,MAAM,SAAS,IAAK;AAAA,IAC1B;AACA,WAAO,EAAE,SAAS,OAAO,MAAM,CAAC,GAAG,IAAI,EAAE,KAAK,CAAC,MAAM,UAAU,OAAO,QAAQ,KAAK,OAAO,QAAQ,IAAI,CAAC,EAAE;AAAA,EAC3G;AACA,MAAI;AACF,WAAO,MAAM,QAAQ,KAAK,CAAC,KAAK,GAAG,IAAI,QAAe,CAAC,UAAU,WAAW;AAC1E,cAAQ,WAAW,MAAM,OAAO,IAAI,cAAc,KAAK,WAAW,CAAC,GAAG,KAAK,IAAI,GAAG,WAAW,KAAK,IAAI,CAAC,CAAC;AAAA,IAC1G,CAAC,CAAC,CAAC;AAAA,EACL,UAAE;AACA,QAAI,MAAO,cAAa,KAAK;AAAA,EAC/B;AACF;",
+  "names": []
+}

package/dist/modules/attachments/lib/access-registry.js

@@ -0,0 +1,87 @@
+import { matchesEntity } from "@open-mercato/shared/lib/crud/mutation-guard-registry";
+import { attachmentAccessResolverSchema, protectedAttachmentTargetSchema } from "../data/validators.js";
+const GLOBAL_KEY = "__openMercatoAttachmentAccessRegistry__";
+const emptyRegistry = Object.freeze({ invalid: false, resolvers: [], protectedTargets: [] });
+function getAttachmentAccessRegistry() {
+  return globalThis[GLOBAL_KEY] ?? emptyRegistry;
+}
+function registerAttachmentAccessResolvers(entries) {
+  const globalState = globalThis;
+  globalState[GLOBAL_KEY] = { invalid: true, resolvers: [], protectedTargets: [] };
+  const resolvers = [];
+  const protectedTargets = [];
+  const ids = /* @__PURE__ */ new Set();
+  for (const [moduleOrder, entry] of entries.entries()) {
+    if (typeof entry.moduleId !== "string" || !entry.moduleId || !Array.isArray(entry.resolvers)) {
+      throw new Error("[internal] Invalid attachment access registry entry");
+    }
+    for (const [declarationOrder, raw] of entry.resolvers.entries()) {
+      const resolver = attachmentAccessResolverSchema.parse(raw);
+      if (!resolver.id.startsWith(`${entry.moduleId}.`) || ids.has(resolver.id)) {
+        throw new Error("[internal] Attachment access resolver IDs must be unique and owned by their module");
+      }
+      ids.add(resolver.id);
+      resolvers.push(Object.freeze({
+        ...resolver,
+        actions: resolver.actions ? Object.freeze([...resolver.actions]) : void 0,
+        moduleOrder,
+        declarationOrder
+      }));
+    }
+    for (const raw of entry.protectedTargets ?? []) {
+      const target = protectedAttachmentTargetSchema.parse(raw);
+      if (!target.resolverId.startsWith(`${entry.moduleId}.`)) {
+        throw new Error("[internal] Attachment access requirements must name their module resolver");
+      }
+      protectedTargets.push(Object.freeze(target));
+    }
+  }
+  resolvers.sort((left, right) => (left.priority ?? 50) - (right.priority ?? 50) || left.moduleOrder - right.moduleOrder || left.declarationOrder - right.declarationOrder);
+  globalState[GLOBAL_KEY] = Object.freeze({
+    invalid: false,
+    resolvers: Object.freeze(resolvers),
+    protectedTargets: Object.freeze(protectedTargets)
+  });
+}
+function matchesAttachmentAccessSelector(selector, value) {
+  return matchesEntity(selector, value);
+}
+function matchesAttachmentAccessTargets(selector, targets) {
+  return selector === "*" || targets.some((target) => matchesAttachmentAccessSelector(selector, target.entityId));
+}
+function matchesAttachmentAccessResolver(resolver, partitionCode, targets, action) {
+  return matchesAttachmentAccessSelector(resolver.targetPartition, partitionCode) && matchesAttachmentAccessTargets(resolver.targetEntity ?? "*", targets) && (!resolver.actions || resolver.actions.includes(action));
+}
+function isRecord(value) {
+  return value !== null && typeof value === "object" && !Array.isArray(value);
+}
+function collectAttachmentAccessTargets(attachment) {
+  const targets = [];
+  function append(entityId, recordId, origin) {
+    if (typeof entityId !== "string" || !entityId.trim()) return;
+    const target = Object.freeze({
+      entityId: entityId.trim(),
+      recordId: typeof recordId === "string" ? recordId.trim() : "",
+      origin
+    });
+    if (!targets.some((candidate) => candidate.entityId === target.entityId && candidate.recordId === target.recordId)) {
+      targets.push(target);
+    }
+  }
+  append(attachment.entityId, attachment.recordId, "primary");
+  const assignments = isRecord(attachment.storageMetadata) ? attachment.storageMetadata.assignments : void 0;
+  const entries = Array.isArray(assignments) ? assignments : isRecord(assignments) ? [assignments] : [];
+  for (const assignment of entries) {
+    if (isRecord(assignment)) append(assignment.type, assignment.id, "assignment");
+  }
+  return Object.freeze(targets);
+}
+export {
+  collectAttachmentAccessTargets,
+  getAttachmentAccessRegistry,
+  matchesAttachmentAccessResolver,
+  matchesAttachmentAccessSelector,
+  matchesAttachmentAccessTargets,
+  registerAttachmentAccessResolvers
+};
+//# sourceMappingURL=access-registry.js.map

package/dist/modules/attachments/lib/access-registry.js.map

@@ -0,0 +1,7 @@
+{
+  "version": 3,
+  "sources": ["../../../../src/modules/attachments/lib/access-registry.ts"],
+  "sourcesContent": ["import { matchesEntity } from '@open-mercato/shared/lib/crud/mutation-guard-registry'\nimport { attachmentAccessResolverSchema, protectedAttachmentTargetSchema } from '../data/validators'\nimport type {\n  AttachmentAccessAction,\n  AttachmentAccessRecord,\n  AttachmentAccessResolver,\n  AttachmentAccessResolverEntry,\n  AttachmentAccessTarget,\n  ProtectedAttachmentTarget,\n} from './access-types'\n\nconst GLOBAL_KEY = '__openMercatoAttachmentAccessRegistry__'\n\ntype RegisteredResolver = AttachmentAccessResolver & {\n  moduleOrder: number\n  declarationOrder: number\n}\n\ntype Registry = {\n  invalid: boolean\n  resolvers: readonly RegisteredResolver[]\n  protectedTargets: readonly ProtectedAttachmentTarget[]\n}\n\nconst emptyRegistry: Registry = Object.freeze({ invalid: false, resolvers: [], protectedTargets: [] })\n\nexport function getAttachmentAccessRegistry(): Registry {\n  return (globalThis as Record<string, unknown>)[GLOBAL_KEY] as Registry | undefined ?? emptyRegistry\n}\n\nexport function registerAttachmentAccessResolvers(entries: readonly AttachmentAccessResolverEntry[]): void {\n  const globalState = globalThis as Record<string, unknown>\n  globalState[GLOBAL_KEY] = { invalid: true, resolvers: [], protectedTargets: [] } satisfies Registry\n  const resolvers: RegisteredResolver[] = []\n  const protectedTargets: ProtectedAttachmentTarget[] = []\n  const ids = new Set<string>()\n  for (const [moduleOrder, entry] of entries.entries()) {\n    if (typeof entry.moduleId !== 'string' || !entry.moduleId || !Array.isArray(entry.resolvers)) {\n      throw new Error('[internal] Invalid attachment access registry entry')\n    }\n    for (const [declarationOrder, raw] of entry.resolvers.entries()) {\n      const resolver = attachmentAccessResolverSchema.parse(raw)\n      if (!resolver.id.startsWith(`${entry.moduleId}.`) || ids.has(resolver.id)) {\n        throw new Error('[internal] Attachment access resolver IDs must be unique and owned by their module')\n      }\n      ids.add(resolver.id)\n      resolvers.push(Object.freeze({\n        ...resolver,\n        actions: resolver.actions ? Object.freeze([...resolver.actions]) : undefined,\n        moduleOrder,\n        declarationOrder,\n      }))\n    }\n    for (const raw of entry.protectedTargets ?? []) {\n      const target = protectedAttachmentTargetSchema.parse(raw)\n      if (!target.resolverId.startsWith(`${entry.moduleId}.`)) {\n        throw new Error('[internal] Attachment access requirements must name their module resolver')\n      }\n      protectedTargets.push(Object.freeze(target))\n    }\n  }\n  resolvers.sort((left, right) => (\n    (left.priority ?? 50) - (right.priority ?? 50)\n    || left.moduleOrder - right.moduleOrder\n    || left.declarationOrder - right.declarationOrder\n  ))\n  globalState[GLOBAL_KEY] = Object.freeze({\n    invalid: false,\n    resolvers: Object.freeze(resolvers),\n    protectedTargets: Object.freeze(protectedTargets),\n  }) satisfies Registry\n}\n\nexport function matchesAttachmentAccessSelector(selector: string, value: string): boolean {\n  return matchesEntity(selector, value)\n}\n\nexport function matchesAttachmentAccessTargets(selector: string, targets: readonly AttachmentAccessTarget[]): boolean {\n  return selector === '*' || targets.some((target) => matchesAttachmentAccessSelector(selector, target.entityId))\n}\n\nexport function matchesAttachmentAccessResolver(\n  resolver: AttachmentAccessResolver,\n  partitionCode: string,\n  targets: readonly AttachmentAccessTarget[],\n  action: AttachmentAccessAction,\n): boolean {\n  return matchesAttachmentAccessSelector(resolver.targetPartition, partitionCode)\n    && matchesAttachmentAccessTargets(resolver.targetEntity ?? '*', targets)\n    && (!resolver.actions || resolver.actions.includes(action))\n}\n\nfunction isRecord(value: unknown): value is Record<string, unknown> {\n  return value !== null && typeof value === 'object' && !Array.isArray(value)\n}\n\nexport function collectAttachmentAccessTargets(attachment: AttachmentAccessRecord): readonly AttachmentAccessTarget[] {\n  const targets: AttachmentAccessTarget[] = []\n  function append(entityId: unknown, recordId: unknown, origin: AttachmentAccessTarget['origin']) {\n    if (typeof entityId !== 'string' || !entityId.trim()) return\n    const target = Object.freeze({\n      entityId: entityId.trim(),\n      recordId: typeof recordId === 'string' ? recordId.trim() : '',\n      origin,\n    })\n    if (!targets.some((candidate) => candidate.entityId === target.entityId && candidate.recordId === target.recordId)) {\n      targets.push(target)\n    }\n  }\n  append(attachment.entityId, attachment.recordId, 'primary')\n  const assignments = isRecord(attachment.storageMetadata) ? attachment.storageMetadata.assignments : undefined\n  const entries = Array.isArray(assignments) ? assignments : isRecord(assignments) ? [assignments] : []\n  for (const assignment of entries) {\n    if (isRecord(assignment)) append(assignment.type, assignment.id, 'assignment')\n  }\n  return Object.freeze(targets)\n}\n"],
+  "mappings": "AAAA,SAAS,qBAAqB;AAC9B,SAAS,gCAAgC,uCAAuC;AAUhF,MAAM,aAAa;AAanB,MAAM,gBAA0B,OAAO,OAAO,EAAE,SAAS,OAAO,WAAW,CAAC,GAAG,kBAAkB,CAAC,EAAE,CAAC;AAE9F,SAAS,8BAAwC;AACtD,SAAQ,WAAuC,UAAU,KAA6B;AACxF;AAEO,SAAS,kCAAkC,SAAyD;AACzG,QAAM,cAAc;AACpB,cAAY,UAAU,IAAI,EAAE,SAAS,MAAM,WAAW,CAAC,GAAG,kBAAkB,CAAC,EAAE;AAC/E,QAAM,YAAkC,CAAC;AACzC,QAAM,mBAAgD,CAAC;AACvD,QAAM,MAAM,oBAAI,IAAY;AAC5B,aAAW,CAAC,aAAa,KAAK,KAAK,QAAQ,QAAQ,GAAG;AACpD,QAAI,OAAO,MAAM,aAAa,YAAY,CAAC,MAAM,YAAY,CAAC,MAAM,QAAQ,MAAM,SAAS,GAAG;AAC5F,YAAM,IAAI,MAAM,qDAAqD;AAAA,IACvE;AACA,eAAW,CAAC,kBAAkB,GAAG,KAAK,MAAM,UAAU,QAAQ,GAAG;AAC/D,YAAM,WAAW,+BAA+B,MAAM,GAAG;AACzD,UAAI,CAAC,SAAS,GAAG,WAAW,GAAG,MAAM,QAAQ,GAAG,KAAK,IAAI,IAAI,SAAS,EAAE,GAAG;AACzE,cAAM,IAAI,MAAM,oFAAoF;AAAA,MACtG;AACA,UAAI,IAAI,SAAS,EAAE;AACnB,gBAAU,KAAK,OAAO,OAAO;AAAA,QAC3B,GAAG;AAAA,QACH,SAAS,SAAS,UAAU,OAAO,OAAO,CAAC,GAAG,SAAS,OAAO,CAAC,IAAI;AAAA,QACnE;AAAA,QACA;AAAA,MACF,CAAC,CAAC;AAAA,IACJ;AACA,eAAW,OAAO,MAAM,oBAAoB,CAAC,GAAG;AAC9C,YAAM,SAAS,gCAAgC,MAAM,GAAG;AACxD,UAAI,CAAC,OAAO,WAAW,WAAW,GAAG,MAAM,QAAQ,GAAG,GAAG;AACvD,cAAM,IAAI,MAAM,2EAA2E;AAAA,MAC7F;AACA,uBAAiB,KAAK,OAAO,OAAO,MAAM,CAAC;AAAA,IAC7C;AAAA,EACF;AACA,YAAU,KAAK,CAAC,MAAM,WACnB,KAAK,YAAY,OAAO,MAAM,YAAY,OACxC,KAAK,cAAc,MAAM,eACzB,KAAK,mBAAmB,MAAM,gBAClC;AACD,cAAY,UAAU,IAAI,OAAO,OAAO;AAAA,IACtC,SAAS;AAAA,IACT,WAAW,OAAO,OAAO,SAAS;AAAA,IAClC,kBAAkB,OAAO,OAAO,gBAAgB;AAAA,EAClD,CAAC;AACH;AAEO,SAAS,gCAAgC,UAAkB,OAAwB;AACxF,SAAO,cAAc,UAAU,KAAK;AACtC;AAEO,SAAS,+BAA+B,UAAkB,SAAqD;AACpH,SAAO,aAAa,OAAO,QAAQ,KAAK,CAAC,WAAW,gCAAgC,UAAU,OAAO,QAAQ,CAAC;AAChH;AAEO,SAAS,gCACd,UACA,eACA,SACA,QACS;AACT,SAAO,gCAAgC,SAAS,iBAAiB,aAAa,KACzE,+BAA+B,SAAS,gBAAgB,KAAK,OAAO,MACnE,CAAC,SAAS,WAAW,SAAS,QAAQ,SAAS,MAAM;AAC7D;AAEA,SAAS,SAAS,OAAkD;AAClE,SAAO,UAAU,QAAQ,OAAO,UAAU,YAAY,CAAC,MAAM,QAAQ,KAAK;AAC5E;AAEO,SAAS,+BAA+B,YAAuE;AACpH,QAAM,UAAoC,CAAC;AAC3C,WAAS,OAAO,UAAmB,UAAmB,QAA0C;AAC9F,QAAI,OAAO,aAAa,YAAY,CAAC,SAAS,KAAK,EAAG;AACtD,UAAM,SAAS,OAAO,OAAO;AAAA,MAC3B,UAAU,SAAS,KAAK;AAAA,MACxB,UAAU,OAAO,aAAa,WAAW,SAAS,KAAK,IAAI;AAAA,MAC3D;AAAA,IACF,CAAC;AACD,QAAI,CAAC,QAAQ,KAAK,CAAC,cAAc,UAAU,aAAa,OAAO,YAAY,UAAU,aAAa,OAAO,QAAQ,GAAG;AAClH,cAAQ,KAAK,MAAM;AAAA,IACrB;AAAA,EACF;AACA,SAAO,WAAW,UAAU,WAAW,UAAU,SAAS;AAC1D,QAAM,cAAc,SAAS,WAAW,eAAe,IAAI,WAAW,gBAAgB,cAAc;AACpG,QAAM,UAAU,MAAM,QAAQ,WAAW,IAAI,cAAc,SAAS,WAAW,IAAI,CAAC,WAAW,IAAI,CAAC;AACpG,aAAW,cAAc,SAAS;AAChC,QAAI,SAAS,UAAU,EAAG,QAAO,WAAW,MAAM,WAAW,IAAI,YAAY;AAAA,EAC/E;AACA,SAAO,OAAO,OAAO,OAAO;AAC9B;",
+  "names": []
+}