@open-mercato/core 0.10.1-develop.7741.1.61a2652671 → 0.10.1-develop.7749.1.ea3edf75e3

package/dist/modules/attachments/lib/attachment-service.js.map

@@ -1,7 +1,7 @@
 {
   "version": 3,
   "sources": ["../../../../src/modules/attachments/lib/attachment-service.ts"],
-  "sourcesContent": ["import type { EntityManager } from '@mikro-orm/postgresql'\nimport type { AuthContext } from '@open-mercato/shared/lib/auth/server'\nimport { CrudHttpError } from '@open-mercato/shared/lib/crud/errors'\nimport { findOneWithDecryption } from '@open-mercato/shared/lib/encryption/find'\nimport { resolveTranslations } from '@open-mercato/shared/lib/i18n/server'\nimport { createLogger } from '@open-mercato/shared/lib/logger'\nimport { Attachment, AttachmentPartition } from '../data/entities'\nimport { assertAttachmentScopeInvariant, checkAttachmentAccess } from './access'\nimport type { StorageDriverFactory } from './drivers'\nimport { buildAttachmentFileUrl } from './imageUrls'\nimport {\n  isScopedAttachmentUploadError,\n  type ScopedAttachmentUploadErrorCode,\n  type ScopedAttachmentUploadService,\n} from './scoped-upload-service'\nimport { readAttachmentMetadata, type AttachmentAssignment } from './metadata'\nimport {\n  listAttachmentStorageReferences,\n  lockAttachmentStorageReferences,\n  removeAttachmentRecord,\n  resolveAttachmentStorageRelease,\n} from './storageReferences'\nimport {\n  buildAttachmentContentDisposition,\n  canRenderInlineAttachment,\n  hasDangerousExecutableExtension,\n} from './security'\nimport {\n  isMultipartRequestWithinUploadLimit,\n  resolveAttachmentMaxBytes,\n  resolveAttachmentMultipartMaxBytes,\n} from './upload-limits'\n\nconst logger = createLogger('attachments').child({ component: 'attachment-service' })\n\ntype AttachmentErrorMessage = {\n  key: string\n  fallback: string\n}\n\n/**\n * The scoped upload service reports failures as machine codes. Each maps to the\n * translation key the public attachment route uses for the same condition, and\n * the key is resolved server-side before it reaches the response body \u2014 clients\n * render the `error` field verbatim, so handing them a raw key would surface\n * `attachments.errors.quotaExceeded` as the user-facing message.\n */\nconst SCOPED_UPLOAD_ERROR_MESSAGES: Record<ScopedAttachmentUploadErrorCode, AttachmentErrorMessage> = {\n  dangerous_executable: {\n    key: 'attachments.errors.dangerousExecutable',\n    fallback: 'Executable file types are not allowed as attachments.',\n  },\n  max_upload_size: {\n    key: 'attachments.errors.maxUploadSize',\n    fallback: 'Attachment exceeds the maximum upload size.',\n  },\n  active_content: {\n    key: 'attachments.errors.activeContentBlocked',\n    fallback: 'Active content uploads are not allowed.',\n  },\n  partition_unavailable: {\n    key: 'attachments.errors.partitionUnavailable',\n    fallback: 'Attachment partition is not available for this scope.',\n  },\n  quota_exceeded: {\n    key: 'attachments.errors.quotaExceeded',\n    fallback: 'Attachment storage quota exceeded for this tenant.',\n  },\n  quota_target_exists: {\n    key: 'attachments.errors.storagePathExists',\n    fallback: 'The target storage path already exists.',\n  },\n  quota_unavailable: {\n    key: 'attachments.errors.quotaUnavailable',\n    fallback: 'Storage quota accounting is unavailable.',\n  },\n  quota_recovery_unsupported: {\n    key: 'attachments.errors.quotaRecoveryUnsupported',\n    fallback: 'Storage driver cannot participate in quota recovery.',\n  },\n  storage_failed: {\n    key: 'attachments.errors.storageFailed',\n    fallback: 'Failed to store the attachment file.',\n  },\n  persistence_failed: {\n    key: 'attachments.errors.persistenceFailed',\n    fallback: 'Failed to persist attachment.',\n  },\n}\n\nconst UPLOAD_FAILED_MESSAGE: AttachmentErrorMessage = {\n  key: 'attachments.errors.uploadFailed',\n  fallback: 'Attachment upload failed.',\n}\n\nconst UPLOAD_SERVICE_UNAVAILABLE_MESSAGE: AttachmentErrorMessage = {\n  key: 'attachments.errors.uploadServiceUnavailable',\n  fallback: 'The attachment upload service is not available.',\n}\n\nasync function translateAttachmentError(message: AttachmentErrorMessage): Promise<string> {\n  const { t } = await resolveTranslations()\n  return t(message.key, message.fallback)\n}\n\nexport type AttachmentOwner = {\n  entityId: string\n  recordId: string\n}\n\nexport type CreateScopedAttachmentInput = AttachmentOwner & {\n  tenantId: string\n  organizationId: string\n  partitionCode: string\n  fileName: string\n  declaredMimeType?: string | null\n  buffer: Buffer\n  assignments?: AttachmentAssignment[]\n  /**\n   * Persists a module-owned link inside the same transaction as the Attachment\n   * row. The callback receives only the generated id, never an Attachment\n   * entity or storage implementation.\n   */\n  persistLink?: (tx: EntityManager, attachmentId: string) => Promise<void> | void\n}\n\nexport type CreatedScopedAttachment = {\n  id: string\n  url: string\n  fileName: string\n  mimeType: string\n  fileSize: number\n}\n\nexport type ReadScopedAttachmentInput = {\n  attachmentId: string\n  auth: NonNullable<AuthContext>\n  expectedOwner: AttachmentOwner\n  expectedAssignment?: AttachmentAssignment\n  expectedPartitionCode?: string\n  requirePrivatePartition?: boolean\n  forceDownload?: boolean\n}\n\nexport type ReadScopedAttachmentResult = {\n  buffer: Buffer\n  contentType: string\n  contentDisposition: string\n  fileName: string\n  mimeType: string\n}\n\nexport type ReleaseScopedAttachmentInput = {\n  attachmentId: string\n  tenantId: string\n  organizationId: string\n  expectedOwner: AttachmentOwner\n  /**\n   * Required: releasing an attachment deletes the row *and* the provider bytes,\n   * so the caller must name the one assignment it owns. The release only\n   * proceeds when that assignment is the attachment's sole reference.\n   */\n  expectedAssignment: AttachmentAssignment\n  expectedPartitionCode?: string\n}\n\nexport type AttachmentProviderCleanup = () => Promise<void>\n\nexport interface AttachmentService {\n  validateUpload(input: {\n    contentLength?: string | null\n    fileName?: string\n    fileSize?: number\n  }): void\n  readUploadForm?(request: Request): Promise<FormData>\n  createScoped(input: CreateScopedAttachmentInput): Promise<CreatedScopedAttachment>\n  readScoped(input: ReadScopedAttachmentInput): Promise<ReadScopedAttachmentResult>\n  /**\n   * Permanently deletes an attachment row and its stored object once no other row references it.\n   *\n   * With `{ flush: false }` call it inside your own transaction and run the returned cleanup after\n   * commit; `undefined` means another row still references the stored object.\n   *\n   * @deprecated Calling it with `{ flush: false }` outside a transaction. It still works for one\n   * minor version but logs a warning, and its reference check is not locked, so two racing releases\n   * of rows sharing the stored object keep it. Wrap the call in a transaction instead.\n   */\n  releaseScoped?(\n    input: ReleaseScopedAttachmentInput,\n    options?: { em?: EntityManager; flush?: boolean },\n  ): Promise<AttachmentProviderCleanup | void>\n}\n\nasync function readRequestBodyWithinLimit(request: Request, maxBytes: number): Promise<Uint8Array> {\n  const reader = request.body?.getReader()\n  if (!reader) throw new CrudHttpError(400, { error: 'File is required' })\n  const chunks: Uint8Array[] = []\n  let totalBytes = 0\n  try {\n    while (true) {\n      const { done, value } = await reader.read()\n      if (done) break\n      totalBytes += value.byteLength\n      if (totalBytes > maxBytes) {\n        await reader.cancel()\n        throw new CrudHttpError(413, { error: 'Attachment exceeds the maximum upload size.' })\n      }\n      chunks.push(value)\n    }\n  } finally {\n    reader.releaseLock()\n  }\n  const body = new Uint8Array(totalBytes)\n  let offset = 0\n  for (const chunk of chunks) {\n    body.set(chunk, offset)\n    offset += chunk.byteLength\n  }\n  return body\n}\n\n\nfunction assignmentMatches(candidate: AttachmentAssignment, expected: AttachmentAssignment): boolean {\n  return candidate.type === expected.type && candidate.id === expected.id\n}\n\nfunction partitionMatchesScope(\n  partition: AttachmentPartition,\n  tenantId: string | null | undefined,\n  organizationId: string | null | undefined,\n): boolean {\n  const partitionTenantId = partition.tenantId ?? null\n  const partitionOrganizationId = partition.organizationId ?? null\n  if (partitionTenantId === null && partitionOrganizationId === null) return true\n  if (partitionTenantId === null || partitionOrganizationId === null) return false\n  return partitionTenantId === tenantId && partitionOrganizationId === organizationId\n}\n\nexport class DefaultAttachmentService implements AttachmentService {\n  /**\n   * The scoped upload service is supplied as a *resolver*, not an instance:\n   * resolving it eagerly would drag its own dependencies (notably `dataEngine`)\n   * into every container that merely constructs an `attachmentService`, even\n   * one that never uploads. `createScoped` requires it \u2014 module uploads must\n   * share the one reservation ledger rather than run a parallel quota\n   * mechanism \u2014 so its absence surfaces there, at the call that needs it.\n   */\n  constructor(\n    private readonly em: EntityManager,\n    private readonly storageDriverFactory: StorageDriverFactory,\n    private readonly resolveScopedUploadService?: (() => ScopedAttachmentUploadService | null) | null,\n  ) {}\n\n  validateUpload(input: {\n    contentLength?: string | null\n    fileName?: string\n    fileSize?: number\n  }): void {\n    if (!isMultipartRequestWithinUploadLimit(input.contentLength ?? null)) {\n      throw new CrudHttpError(413, { error: 'Attachment exceeds the maximum upload size.' })\n    }\n    if (input.fileName && hasDangerousExecutableExtension(input.fileName)) {\n      throw new CrudHttpError(400, { error: 'Executable file types are not allowed as attachments.' })\n    }\n    if (typeof input.fileSize === 'number' && input.fileSize > resolveAttachmentMaxBytes(null)) {\n      throw new CrudHttpError(413, { error: 'Attachment exceeds the maximum upload size.' })\n    }\n  }\n\n  async readUploadForm(request: Request): Promise<FormData> {\n    this.validateUpload({ contentLength: request.headers.get('content-length') })\n    const contentType = request.headers.get('content-type') ?? ''\n    if (!contentType.toLowerCase().includes('multipart/form-data')) {\n      throw new CrudHttpError(400, { error: 'Expected multipart/form-data' })\n    }\n    const body = await readRequestBodyWithinLimit(request, resolveAttachmentMultipartMaxBytes())\n    const responseBody = body.buffer.slice(body.byteOffset, body.byteOffset + body.byteLength) as ArrayBuffer\n    try {\n      return await new Response(responseBody, { headers: { 'content-type': contentType } }).formData()\n    } catch {\n      throw new CrudHttpError(400, { error: 'Invalid multipart/form-data' })\n    }\n  }\n\n  async createScoped(input: CreateScopedAttachmentInput): Promise<CreatedScopedAttachment> {\n    assertAttachmentScopeInvariant(input)\n    this.validateUpload({ fileName: input.fileName, fileSize: input.buffer.length })\n\n    // Delegate to the platform's scoped upload service rather than repeating its\n    // work. It owns the fenced quota lease (reserve \u2192 storing \u2192 stored \u2192\n    // complete) that the recovery worker reconciles, writes to the provider\n    // outside the database transaction, and emits the attachment CRUD side\n    // effects. The previous implementation here ran a *second*, independent\n    // quota mechanism on a different advisory-lock key that counted only\n    // committed rows, so it could not see an in-flight reservation from the\n    // public attachment route and the two paths could jointly exceed a tenant's\n    // quota \u2014 and it wrote to storage inside the transaction, so a crash before\n    // commit left bytes nothing accounted for.\n    let uploadService: ScopedAttachmentUploadService | null = null\n    try {\n      uploadService = this.resolveScopedUploadService?.() ?? null\n    } catch (error) {\n      logger.error('Scoped attachment upload service could not be resolved', { err: error })\n    }\n    if (!uploadService) {\n      throw new CrudHttpError(500, {\n        error: await translateAttachmentError(UPLOAD_SERVICE_UNAVAILABLE_MESSAGE),\n      })\n    }\n\n    let attachment: Attachment\n    try {\n      attachment = await uploadService.upload({\n        tenantId: input.tenantId,\n        organizationId: input.organizationId,\n        entityId: input.entityId,\n        recordId: input.recordId,\n        fileName: input.fileName,\n        buffer: input.buffer,\n        declaredMimeType: input.declaredMimeType ?? null,\n        assignments: input.assignments,\n        partitionCode: input.partitionCode,\n        requirePrivatePartition: true,\n        persistLink: input.persistLink,\n      })\n    } catch (error) {\n      if (isScopedAttachmentUploadError(error)) {\n        const message = SCOPED_UPLOAD_ERROR_MESSAGES[error.code] ?? UPLOAD_FAILED_MESSAGE\n        throw new CrudHttpError(error.status, { error: await translateAttachmentError(message) })\n      }\n      throw error\n    }\n\n    return {\n      id: attachment.id,\n      url: attachment.url ?? buildAttachmentFileUrl(attachment.id),\n      fileName: attachment.fileName,\n      mimeType: attachment.mimeType,\n      fileSize: attachment.fileSize,\n    }\n  }\n\n  async readScoped(input: ReadScopedAttachmentInput): Promise<ReadScopedAttachmentResult> {\n    // Scope the lookup at the database boundary so a foreign-tenant row is\n    // never materialized, then keep checkAttachmentAccess below as defense in\n    // depth. This service only ever stores fully scoped rows, so global rows\n    // and super-admin status deliberately do not widen the requested scope \u2014\n    // a super admin reads another tenant's attachment by switching scope, not\n    // by bypassing the filter.\n    const attachment = await findOneWithDecryption(\n      this.em,\n      Attachment,\n      {\n        id: input.attachmentId,\n        tenantId: input.auth.tenantId ?? null,\n        organizationId: input.auth.orgId ?? null,\n      },\n      undefined,\n      { tenantId: input.auth.tenantId, organizationId: input.auth.orgId },\n    )\n    if (!attachment) throw new CrudHttpError(404, { error: 'Attachment not found' })\n    const partition = await findOneWithDecryption(\n      this.em,\n      AttachmentPartition,\n      { code: attachment.partitionCode },\n      undefined,\n      { tenantId: input.auth.tenantId, organizationId: input.auth.orgId },\n    )\n    if (!partition) throw new CrudHttpError(500, { error: 'Attachment partition is not configured' })\n\n    const access = checkAttachmentAccess(input.auth, attachment, partition, { requireAuthForPublic: true })\n    if (!access.ok) {\n      throw new CrudHttpError(access.status, { error: access.status === 401 ? 'Unauthorized' : 'Forbidden' })\n    }\n    if (!partitionMatchesScope(partition, input.auth.tenantId, input.auth.orgId)) {\n      throw new CrudHttpError(403, { error: 'Attachment partition is not accessible for this scope' })\n    }\n    if (input.requirePrivatePartition && partition.isPublic) {\n      throw new CrudHttpError(403, { error: 'Attachment partition is not accessible for this resource' })\n    }\n    if (input.expectedPartitionCode && attachment.partitionCode !== input.expectedPartitionCode) {\n      throw new CrudHttpError(404, { error: 'Attachment not found' })\n    }\n    if (\n      attachment.entityId !== input.expectedOwner.entityId ||\n      attachment.recordId !== input.expectedOwner.recordId\n    ) {\n      throw new CrudHttpError(404, { error: 'Attachment not found' })\n    }\n    if (input.expectedAssignment) {\n      const assignments = readAttachmentMetadata(attachment.storageMetadata).assignments ?? []\n      if (!assignments.some((candidate) => assignmentMatches(candidate, input.expectedAssignment!))) {\n        throw new CrudHttpError(404, { error: 'Attachment not found' })\n      }\n    }\n\n    const driver = await this.storageDriverFactory.resolveForPartition(attachment.partitionCode, {\n      tenantId: attachment.tenantId ?? '',\n      organizationId: attachment.organizationId ?? '',\n    })\n    let result: Awaited<ReturnType<typeof driver.read>>\n    try {\n      result = await driver.read(attachment.partitionCode, attachment.storagePath)\n    } catch {\n      throw new CrudHttpError(404, { error: 'File not available' })\n    }\n\n    const mimeType = attachment.mimeType || 'application/octet-stream'\n    const renderInline = !input.forceDownload && canRenderInlineAttachment(mimeType)\n    return {\n      buffer: result.buffer,\n      contentType: renderInline ? result.contentType ?? mimeType : 'application/octet-stream',\n      contentDisposition: buildAttachmentContentDisposition(\n        attachment.fileName,\n        renderInline ? 'inline' : 'attachment',\n      ),\n      fileName: attachment.fileName,\n      mimeType,\n    }\n  }\n\n  async releaseScoped(\n    input: ReleaseScopedAttachmentInput,\n    options: { em?: EntityManager; flush?: boolean } = {},\n  ): Promise<AttachmentProviderCleanup | void> {\n    const em = options.em ?? this.em\n    // The type makes `expectedAssignment` mandatory, but this service is handed\n    // out through untyped DI resolution and consumed through structural ports in\n    // other packages, so the shared-reference guard is enforced at runtime too:\n    // without it a caller could destroy an attachment other records still link.\n    const expectedAssignment = input.expectedAssignment\n    if (!expectedAssignment) {\n      throw new CrudHttpError(500, {\n        error: 'Attachment release requires the expected assignment of the releasing record',\n      })\n    }\n    const isInTransaction = (em as { isInTransaction?: () => boolean }).isInTransaction\n    if (\n      options.flush !== false\n      && typeof isInTransaction === 'function'\n      && isInTransaction.call(em)\n    ) {\n      throw new CrudHttpError(500, {\n        error: 'Attachment release inside an ambient transaction requires flush: false and deferred provider cleanup',\n      })\n    }\n    const deferredOutsideTransaction = options.flush === false\n      && typeof isInTransaction === 'function'\n      && !isInTransaction.call(em)\n    if (deferredOutsideTransaction) {\n      logger.warn(\n        '[deprecated] attachmentService.releaseScoped({ flush: false }) called outside a transaction; wrap it in a transaction so the storage reference lock is held until commit',\n        { attachmentId: input.attachmentId },\n      )\n    }\n    const scope = { tenantId: input.tenantId, organizationId: input.organizationId }\n    const attachment = await findOneWithDecryption(\n      em,\n      Attachment,\n      {\n        id: input.attachmentId,\n        tenantId: input.tenantId,\n        organizationId: input.organizationId,\n      },\n      undefined,\n      scope,\n    )\n    if (!attachment) throw new CrudHttpError(404, { error: 'Attachment not found' })\n    if (\n      attachment.entityId !== input.expectedOwner.entityId\n      || attachment.recordId !== input.expectedOwner.recordId\n      || (input.expectedPartitionCode && attachment.partitionCode !== input.expectedPartitionCode)\n    ) {\n      throw new CrudHttpError(404, { error: 'Attachment not found' })\n    }\n    const assignments = readAttachmentMetadata(attachment.storageMetadata).assignments ?? []\n    if (!assignments.some((candidate) => assignmentMatches(candidate, expectedAssignment))) {\n      throw new CrudHttpError(409, { error: 'Attachment is still referenced by another record' })\n    }\n    if (assignments.some((candidate) => !assignmentMatches(candidate, expectedAssignment))) {\n      throw new CrudHttpError(409, { error: 'Attachment is still referenced by another record' })\n    }\n\n    const driver = await this.storageDriverFactory.resolveForPartition(attachment.partitionCode, scope)\n    const deleteProviderBytes = () => driver.delete(attachment.partitionCode, attachment.storagePath)\n    if (options.flush === false) {\n      const referenceIds = deferredOutsideTransaction\n        ? await listAttachmentStorageReferences(em, attachment)\n        : await lockAttachmentStorageReferences(em, attachment)\n      const removal = resolveAttachmentStorageRelease(referenceIds, attachment.id)\n      if (!removal.removed) throw new CrudHttpError(404, { error: 'Attachment not found' })\n      em.remove(attachment)\n      return removal.releaseStorage ? deleteProviderBytes : undefined\n    }\n    const removal = await removeAttachmentRecord(em, attachment)\n    if (!removal.removed) throw new CrudHttpError(404, { error: 'Attachment not found' })\n    if (removal.releaseStorage) await deleteProviderBytes()\n  }\n}\n"],
-  "mappings": "AAEA,SAAS,qBAAqB;AAC9B,SAAS,6BAA6B;AACtC,SAAS,2BAA2B;AACpC,SAAS,oBAAoB;AAC7B,SAAS,YAAY,2BAA2B;AAChD,SAAS,gCAAgC,6BAA6B;AAEtE,SAAS,8BAA8B;AACvC;AAAA,EACE;AAAA,OAGK;AACP,SAAS,8BAAyD;AAClE;AAAA,EACE;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,OACK;AACP;AAAA,EACE;AAAA,EACA;AAAA,EACA;AAAA,OACK;AACP;AAAA,EACE;AAAA,EACA;AAAA,EACA;AAAA,OACK;AAEP,MAAM,SAAS,aAAa,aAAa,EAAE,MAAM,EAAE,WAAW,qBAAqB,CAAC;AAcpF,MAAM,+BAAgG;AAAA,EACpG,sBAAsB;AAAA,IACpB,KAAK;AAAA,IACL,UAAU;AAAA,EACZ;AAAA,EACA,iBAAiB;AAAA,IACf,KAAK;AAAA,IACL,UAAU;AAAA,EACZ;AAAA,EACA,gBAAgB;AAAA,IACd,KAAK;AAAA,IACL,UAAU;AAAA,EACZ;AAAA,EACA,uBAAuB;AAAA,IACrB,KAAK;AAAA,IACL,UAAU;AAAA,EACZ;AAAA,EACA,gBAAgB;AAAA,IACd,KAAK;AAAA,IACL,UAAU;AAAA,EACZ;AAAA,EACA,qBAAqB;AAAA,IACnB,KAAK;AAAA,IACL,UAAU;AAAA,EACZ;AAAA,EACA,mBAAmB;AAAA,IACjB,KAAK;AAAA,IACL,UAAU;AAAA,EACZ;AAAA,EACA,4BAA4B;AAAA,IAC1B,KAAK;AAAA,IACL,UAAU;AAAA,EACZ;AAAA,EACA,gBAAgB;AAAA,IACd,KAAK;AAAA,IACL,UAAU;AAAA,EACZ;AAAA,EACA,oBAAoB;AAAA,IAClB,KAAK;AAAA,IACL,UAAU;AAAA,EACZ;AACF;AAEA,MAAM,wBAAgD;AAAA,EACpD,KAAK;AAAA,EACL,UAAU;AACZ;AAEA,MAAM,qCAA6D;AAAA,EACjE,KAAK;AAAA,EACL,UAAU;AACZ;AAEA,eAAe,yBAAyB,SAAkD;AACxF,QAAM,EAAE,EAAE,IAAI,MAAM,oBAAoB;AACxC,SAAO,EAAE,QAAQ,KAAK,QAAQ,QAAQ;AACxC;AA0FA,eAAe,2BAA2B,SAAkB,UAAuC;AACjG,QAAM,SAAS,QAAQ,MAAM,UAAU;AACvC,MAAI,CAAC,OAAQ,OAAM,IAAI,cAAc,KAAK,EAAE,OAAO,mBAAmB,CAAC;AACvE,QAAM,SAAuB,CAAC;AAC9B,MAAI,aAAa;AACjB,MAAI;AACF,WAAO,MAAM;AACX,YAAM,EAAE,MAAM,MAAM,IAAI,MAAM,OAAO,KAAK;AAC1C,UAAI,KAAM;AACV,oBAAc,MAAM;AACpB,UAAI,aAAa,UAAU;AACzB,cAAM,OAAO,OAAO;AACpB,cAAM,IAAI,cAAc,KAAK,EAAE,OAAO,8CAA8C,CAAC;AAAA,MACvF;AACA,aAAO,KAAK,KAAK;AAAA,IACnB;AAAA,EACF,UAAE;AACA,WAAO,YAAY;AAAA,EACrB;AACA,QAAM,OAAO,IAAI,WAAW,UAAU;AACtC,MAAI,SAAS;AACb,aAAW,SAAS,QAAQ;AAC1B,SAAK,IAAI,OAAO,MAAM;AACtB,cAAU,MAAM;AAAA,EAClB;AACA,SAAO;AACT;AAGA,SAAS,kBAAkB,WAAiC,UAAyC;AACnG,SAAO,UAAU,SAAS,SAAS,QAAQ,UAAU,OAAO,SAAS;AACvE;AAEA,SAAS,sBACP,WACA,UACA,gBACS;AACT,QAAM,oBAAoB,UAAU,YAAY;AAChD,QAAM,0BAA0B,UAAU,kBAAkB;AAC5D,MAAI,sBAAsB,QAAQ,4BAA4B,KAAM,QAAO;AAC3E,MAAI,sBAAsB,QAAQ,4BAA4B,KAAM,QAAO;AAC3E,SAAO,sBAAsB,YAAY,4BAA4B;AACvE;AAEO,MAAM,yBAAsD;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EASjE,YACmB,IACA,sBACA,4BACjB;AAHiB;AACA;AACA;AAAA,EAChB;AAAA,EAEH,eAAe,OAIN;AACP,QAAI,CAAC,oCAAoC,MAAM,iBAAiB,IAAI,GAAG;AACrE,YAAM,IAAI,cAAc,KAAK,EAAE,OAAO,8CAA8C,CAAC;AAAA,IACvF;AACA,QAAI,MAAM,YAAY,gCAAgC,MAAM,QAAQ,GAAG;AACrE,YAAM,IAAI,cAAc,KAAK,EAAE,OAAO,wDAAwD,CAAC;AAAA,IACjG;AACA,QAAI,OAAO,MAAM,aAAa,YAAY,MAAM,WAAW,0BAA0B,IAAI,GAAG;AAC1F,YAAM,IAAI,cAAc,KAAK,EAAE,OAAO,8CAA8C,CAAC;AAAA,IACvF;AAAA,EACF;AAAA,EAEA,MAAM,eAAe,SAAqC;AACxD,SAAK,eAAe,EAAE,eAAe,QAAQ,QAAQ,IAAI,gBAAgB,EAAE,CAAC;AAC5E,UAAM,cAAc,QAAQ,QAAQ,IAAI,cAAc,KAAK;AAC3D,QAAI,CAAC,YAAY,YAAY,EAAE,SAAS,qBAAqB,GAAG;AAC9D,YAAM,IAAI,cAAc,KAAK,EAAE,OAAO,+BAA+B,CAAC;AAAA,IACxE;AACA,UAAM,OAAO,MAAM,2BAA2B,SAAS,mCAAmC,CAAC;AAC3F,UAAM,eAAe,KAAK,OAAO,MAAM,KAAK,YAAY,KAAK,aAAa,KAAK,UAAU;AACzF,QAAI;AACF,aAAO,MAAM,IAAI,SAAS,cAAc,EAAE,SAAS,EAAE,gBAAgB,YAAY,EAAE,CAAC,EAAE,SAAS;AAAA,IACjG,QAAQ;AACN,YAAM,IAAI,cAAc,KAAK,EAAE,OAAO,8BAA8B,CAAC;AAAA,IACvE;AAAA,EACF;AAAA,EAEA,MAAM,aAAa,OAAsE;AACvF,mCAA+B,KAAK;AACpC,SAAK,eAAe,EAAE,UAAU,MAAM,UAAU,UAAU,MAAM,OAAO,OAAO,CAAC;AAY/E,QAAI,gBAAsD;AAC1D,QAAI;AACF,sBAAgB,KAAK,6BAA6B,KAAK;AAAA,IACzD,SAAS,OAAO;AACd,aAAO,MAAM,0DAA0D,EAAE,KAAK,MAAM,CAAC;AAAA,IACvF;AACA,QAAI,CAAC,eAAe;AAClB,YAAM,IAAI,cAAc,KAAK;AAAA,QAC3B,OAAO,MAAM,yBAAyB,kCAAkC;AAAA,MAC1E,CAAC;AAAA,IACH;AAEA,QAAI;AACJ,QAAI;AACF,mBAAa,MAAM,cAAc,OAAO;AAAA,QACtC,UAAU,MAAM;AAAA,QAChB,gBAAgB,MAAM;AAAA,QACtB,UAAU,MAAM;AAAA,QAChB,UAAU,MAAM;AAAA,QAChB,UAAU,MAAM;AAAA,QAChB,QAAQ,MAAM;AAAA,QACd,kBAAkB,MAAM,oBAAoB;AAAA,QAC5C,aAAa,MAAM;AAAA,QACnB,eAAe,MAAM;AAAA,QACrB,yBAAyB;AAAA,QACzB,aAAa,MAAM;AAAA,MACrB,CAAC;AAAA,IACH,SAAS,OAAO;AACd,UAAI,8BAA8B,KAAK,GAAG;AACxC,cAAM,UAAU,6BAA6B,MAAM,IAAI,KAAK;AAC5D,cAAM,IAAI,cAAc,MAAM,QAAQ,EAAE,OAAO,MAAM,yBAAyB,OAAO,EAAE,CAAC;AAAA,MAC1F;AACA,YAAM;AAAA,IACR;AAEA,WAAO;AAAA,MACL,IAAI,WAAW;AAAA,MACf,KAAK,WAAW,OAAO,uBAAuB,WAAW,EAAE;AAAA,MAC3D,UAAU,WAAW;AAAA,MACrB,UAAU,WAAW;AAAA,MACrB,UAAU,WAAW;AAAA,IACvB;AAAA,EACF;AAAA,EAEA,MAAM,WAAW,OAAuE;AAOtF,UAAM,aAAa,MAAM;AAAA,MACvB,KAAK;AAAA,MACL;AAAA,MACA;AAAA,QACE,IAAI,MAAM;AAAA,QACV,UAAU,MAAM,KAAK,YAAY;AAAA,QACjC,gBAAgB,MAAM,KAAK,SAAS;AAAA,MACtC;AAAA,MACA;AAAA,MACA,EAAE,UAAU,MAAM,KAAK,UAAU,gBAAgB,MAAM,KAAK,MAAM;AAAA,IACpE;AACA,QAAI,CAAC,WAAY,OAAM,IAAI,cAAc,KAAK,EAAE,OAAO,uBAAuB,CAAC;AAC/E,UAAM,YAAY,MAAM;AAAA,MACtB,KAAK;AAAA,MACL;AAAA,MACA,EAAE,MAAM,WAAW,cAAc;AAAA,MACjC;AAAA,MACA,EAAE,UAAU,MAAM,KAAK,UAAU,gBAAgB,MAAM,KAAK,MAAM;AAAA,IACpE;AACA,QAAI,CAAC,UAAW,OAAM,IAAI,cAAc,KAAK,EAAE,OAAO,yCAAyC,CAAC;AAEhG,UAAM,SAAS,sBAAsB,MAAM,MAAM,YAAY,WAAW,EAAE,sBAAsB,KAAK,CAAC;AACtG,QAAI,CAAC,OAAO,IAAI;AACd,YAAM,IAAI,cAAc,OAAO,QAAQ,EAAE,OAAO,OAAO,WAAW,MAAM,iBAAiB,YAAY,CAAC;AAAA,IACxG;AACA,QAAI,CAAC,sBAAsB,WAAW,MAAM,KAAK,UAAU,MAAM,KAAK,KAAK,GAAG;AAC5E,YAAM,IAAI,cAAc,KAAK,EAAE,OAAO,wDAAwD,CAAC;AAAA,IACjG;AACA,QAAI,MAAM,2BAA2B,UAAU,UAAU;AACvD,YAAM,IAAI,cAAc,KAAK,EAAE,OAAO,2DAA2D,CAAC;AAAA,IACpG;AACA,QAAI,MAAM,yBAAyB,WAAW,kBAAkB,MAAM,uBAAuB;AAC3F,YAAM,IAAI,cAAc,KAAK,EAAE,OAAO,uBAAuB,CAAC;AAAA,IAChE;AACA,QACE,WAAW,aAAa,MAAM,cAAc,YAC5C,WAAW,aAAa,MAAM,cAAc,UAC5C;AACA,YAAM,IAAI,cAAc,KAAK,EAAE,OAAO,uBAAuB,CAAC;AAAA,IAChE;AACA,QAAI,MAAM,oBAAoB;AAC5B,YAAM,cAAc,uBAAuB,WAAW,eAAe,EAAE,eAAe,CAAC;AACvF,UAAI,CAAC,YAAY,KAAK,CAAC,cAAc,kBAAkB,WAAW,MAAM,kBAAmB,CAAC,GAAG;AAC7F,cAAM,IAAI,cAAc,KAAK,EAAE,OAAO,uBAAuB,CAAC;AAAA,MAChE;AAAA,IACF;AAEA,UAAM,SAAS,MAAM,KAAK,qBAAqB,oBAAoB,WAAW,eAAe;AAAA,MAC3F,UAAU,WAAW,YAAY;AAAA,MACjC,gBAAgB,WAAW,kBAAkB;AAAA,IAC/C,CAAC;AACD,QAAI;AACJ,QAAI;AACF,eAAS,MAAM,OAAO,KAAK,WAAW,eAAe,WAAW,WAAW;AAAA,IAC7E,QAAQ;AACN,YAAM,IAAI,cAAc,KAAK,EAAE,OAAO,qBAAqB,CAAC;AAAA,IAC9D;AAEA,UAAM,WAAW,WAAW,YAAY;AACxC,UAAM,eAAe,CAAC,MAAM,iBAAiB,0BAA0B,QAAQ;AAC/E,WAAO;AAAA,MACL,QAAQ,OAAO;AAAA,MACf,aAAa,eAAe,OAAO,eAAe,WAAW;AAAA,MAC7D,oBAAoB;AAAA,QAClB,WAAW;AAAA,QACX,eAAe,WAAW;AAAA,MAC5B;AAAA,MACA,UAAU,WAAW;AAAA,MACrB;AAAA,IACF;AAAA,EACF;AAAA,EAEA,MAAM,cACJ,OACA,UAAmD,CAAC,GACT;AAC3C,UAAM,KAAK,QAAQ,MAAM,KAAK;AAK9B,UAAM,qBAAqB,MAAM;AACjC,QAAI,CAAC,oBAAoB;AACvB,YAAM,IAAI,cAAc,KAAK;AAAA,QAC3B,OAAO;AAAA,MACT,CAAC;AAAA,IACH;AACA,UAAM,kBAAmB,GAA2C;AACpE,QACE,QAAQ,UAAU,SACf,OAAO,oBAAoB,cAC3B,gBAAgB,KAAK,EAAE,GAC1B;AACA,YAAM,IAAI,cAAc,KAAK;AAAA,QAC3B,OAAO;AAAA,MACT,CAAC;AAAA,IACH;AACA,UAAM,6BAA6B,QAAQ,UAAU,SAChD,OAAO,oBAAoB,cAC3B,CAAC,gBAAgB,KAAK,EAAE;AAC7B,QAAI,4BAA4B;AAC9B,aAAO;AAAA,QACL;AAAA,QACA,EAAE,cAAc,MAAM,aAAa;AAAA,MACrC;AAAA,IACF;AACA,UAAM,QAAQ,EAAE,UAAU,MAAM,UAAU,gBAAgB,MAAM,eAAe;AAC/E,UAAM,aAAa,MAAM;AAAA,MACvB;AAAA,MACA;AAAA,MACA;AAAA,QACE,IAAI,MAAM;AAAA,QACV,UAAU,MAAM;AAAA,QAChB,gBAAgB,MAAM;AAAA,MACxB;AAAA,MACA;AAAA,MACA;AAAA,IACF;AACA,QAAI,CAAC,WAAY,OAAM,IAAI,cAAc,KAAK,EAAE,OAAO,uBAAuB,CAAC;AAC/E,QACE,WAAW,aAAa,MAAM,cAAc,YACzC,WAAW,aAAa,MAAM,cAAc,YAC3C,MAAM,yBAAyB,WAAW,kBAAkB,MAAM,uBACtE;AACA,YAAM,IAAI,cAAc,KAAK,EAAE,OAAO,uBAAuB,CAAC;AAAA,IAChE;AACA,UAAM,cAAc,uBAAuB,WAAW,eAAe,EAAE,eAAe,CAAC;AACvF,QAAI,CAAC,YAAY,KAAK,CAAC,cAAc,kBAAkB,WAAW,kBAAkB,CAAC,GAAG;AACtF,YAAM,IAAI,cAAc,KAAK,EAAE,OAAO,mDAAmD,CAAC;AAAA,IAC5F;AACA,QAAI,YAAY,KAAK,CAAC,cAAc,CAAC,kBAAkB,WAAW,kBAAkB,CAAC,GAAG;AACtF,YAAM,IAAI,cAAc,KAAK,EAAE,OAAO,mDAAmD,CAAC;AAAA,IAC5F;AAEA,UAAM,SAAS,MAAM,KAAK,qBAAqB,oBAAoB,WAAW,eAAe,KAAK;AAClG,UAAM,sBAAsB,MAAM,OAAO,OAAO,WAAW,eAAe,WAAW,WAAW;AAChG,QAAI,QAAQ,UAAU,OAAO;AAC3B,YAAM,eAAe,6BACjB,MAAM,gCAAgC,IAAI,UAAU,IACpD,MAAM,gCAAgC,IAAI,UAAU;AACxD,YAAMA,WAAU,gCAAgC,cAAc,WAAW,EAAE;AAC3E,UAAI,CAACA,SAAQ,QAAS,OAAM,IAAI,cAAc,KAAK,EAAE,OAAO,uBAAuB,CAAC;AACpF,SAAG,OAAO,UAAU;AACpB,aAAOA,SAAQ,iBAAiB,sBAAsB;AAAA,IACxD;AACA,UAAM,UAAU,MAAM,uBAAuB,IAAI,UAAU;AAC3D,QAAI,CAAC,QAAQ,QAAS,OAAM,IAAI,cAAc,KAAK,EAAE,OAAO,uBAAuB,CAAC;AACpF,QAAI,QAAQ,eAAgB,OAAM,oBAAoB;AAAA,EACxD;AACF;",
+  "sourcesContent": ["import { evaluateAttachmentAccess, type AttachmentAccessContext } from './access-runner'\nimport { throwAttachmentAccessError } from './access-errors'\nimport type { EntityManager } from '@mikro-orm/postgresql'\nimport type { AuthContext } from '@open-mercato/shared/lib/auth/server'\nimport { CrudHttpError } from '@open-mercato/shared/lib/crud/errors'\nimport { findOneWithDecryption } from '@open-mercato/shared/lib/encryption/find'\nimport { resolveTranslations } from '@open-mercato/shared/lib/i18n/server'\nimport { createLogger } from '@open-mercato/shared/lib/logger'\nimport { Attachment, AttachmentPartition } from '../data/entities'\nimport { assertAttachmentScopeInvariant, checkAttachmentAccess } from './access'\nimport type { StorageDriverFactory } from './drivers'\nimport { buildAttachmentFileUrl } from './imageUrls'\nimport {\n  isScopedAttachmentUploadError,\n  type ScopedAttachmentUploadErrorCode,\n  type ScopedAttachmentUploadService,\n} from './scoped-upload-service'\nimport { readAttachmentMetadata, type AttachmentAssignment } from './metadata'\nimport {\n  listAttachmentStorageReferences,\n  lockAttachmentStorageReferences,\n  removeAttachmentRecord,\n  resolveAttachmentStorageRelease,\n} from './storageReferences'\nimport {\n  buildAttachmentContentDisposition,\n  canRenderInlineAttachment,\n  hasDangerousExecutableExtension,\n} from './security'\nimport {\n  isMultipartRequestWithinUploadLimit,\n  resolveAttachmentMaxBytes,\n  resolveAttachmentMultipartMaxBytes,\n} from './upload-limits'\n\nconst logger = createLogger('attachments').child({ component: 'attachment-service' })\n\ntype AttachmentErrorMessage = {\n  key: string\n  fallback: string\n}\n\n/**\n * The scoped upload service reports failures as machine codes. Each maps to the\n * translation key the public attachment route uses for the same condition, and\n * the key is resolved server-side before it reaches the response body \u2014 clients\n * render the `error` field verbatim, so handing them a raw key would surface\n * `attachments.errors.quotaExceeded` as the user-facing message.\n */\nconst SCOPED_UPLOAD_ERROR_MESSAGES: Record<ScopedAttachmentUploadErrorCode, AttachmentErrorMessage> = {\n  dangerous_executable: {\n    key: 'attachments.errors.dangerousExecutable',\n    fallback: 'Executable file types are not allowed as attachments.',\n  },\n  max_upload_size: {\n    key: 'attachments.errors.maxUploadSize',\n    fallback: 'Attachment exceeds the maximum upload size.',\n  },\n  active_content: {\n    key: 'attachments.errors.activeContentBlocked',\n    fallback: 'Active content uploads are not allowed.',\n  },\n  partition_unavailable: {\n    key: 'attachments.errors.partitionUnavailable',\n    fallback: 'Attachment partition is not available for this scope.',\n  },\n  quota_exceeded: {\n    key: 'attachments.errors.quotaExceeded',\n    fallback: 'Attachment storage quota exceeded for this tenant.',\n  },\n  quota_target_exists: {\n    key: 'attachments.errors.storagePathExists',\n    fallback: 'The target storage path already exists.',\n  },\n  quota_unavailable: {\n    key: 'attachments.errors.quotaUnavailable',\n    fallback: 'Storage quota accounting is unavailable.',\n  },\n  quota_recovery_unsupported: {\n    key: 'attachments.errors.quotaRecoveryUnsupported',\n    fallback: 'Storage driver cannot participate in quota recovery.',\n  },\n  storage_failed: {\n    key: 'attachments.errors.storageFailed',\n    fallback: 'Failed to store the attachment file.',\n  },\n  persistence_failed: {\n    key: 'attachments.errors.persistenceFailed',\n    fallback: 'Failed to persist attachment.',\n  },\n}\n\nconst UPLOAD_FAILED_MESSAGE: AttachmentErrorMessage = {\n  key: 'attachments.errors.uploadFailed',\n  fallback: 'Attachment upload failed.',\n}\n\nconst UPLOAD_SERVICE_UNAVAILABLE_MESSAGE: AttachmentErrorMessage = {\n  key: 'attachments.errors.uploadServiceUnavailable',\n  fallback: 'The attachment upload service is not available.',\n}\n\nasync function translateAttachmentError(message: AttachmentErrorMessage): Promise<string> {\n  const { t } = await resolveTranslations()\n  return t(message.key, message.fallback)\n}\n\nexport type AttachmentOwner = {\n  entityId: string\n  recordId: string\n}\n\nexport type CreateScopedAttachmentInput = AttachmentOwner & {\n  tenantId: string\n  organizationId: string\n  partitionCode: string\n  fileName: string\n  declaredMimeType?: string | null\n  buffer: Buffer\n  assignments?: AttachmentAssignment[]\n  /**\n   * Persists a module-owned link inside the same transaction as the Attachment\n   * row. The callback receives only the generated id, never an Attachment\n   * entity or storage implementation.\n   */\n  persistLink?: (tx: EntityManager, attachmentId: string) => Promise<void> | void\n}\n\nexport type CreatedScopedAttachment = {\n  id: string\n  url: string\n  fileName: string\n  mimeType: string\n  fileSize: number\n}\n\nexport type ReadScopedAttachmentInput = {\n  attachmentId: string\n  auth: NonNullable<AuthContext>\n  expectedOwner: AttachmentOwner\n  expectedAssignment?: AttachmentAssignment\n  expectedPartitionCode?: string\n  requirePrivatePartition?: boolean\n  forceDownload?: boolean\n}\n\nexport type ReadScopedAttachmentResult = {\n  buffer: Buffer\n  contentType: string\n  contentDisposition: string\n  fileName: string\n  mimeType: string\n}\n\nexport type ReleaseScopedAttachmentInput = {\n  attachmentId: string\n  tenantId: string\n  organizationId: string\n  expectedOwner: AttachmentOwner\n  /**\n   * Required: releasing an attachment deletes the row *and* the provider bytes,\n   * so the caller must name the one assignment it owns. The release only\n   * proceeds when that assignment is the attachment's sole reference.\n   */\n  expectedAssignment: AttachmentAssignment\n  expectedPartitionCode?: string\n}\n\nexport type AttachmentProviderCleanup = () => Promise<void>\n\nexport interface AttachmentService {\n  validateUpload(input: {\n    contentLength?: string | null\n    fileName?: string\n    fileSize?: number\n  }): void\n  readUploadForm?(request: Request): Promise<FormData>\n  createScoped(input: CreateScopedAttachmentInput): Promise<CreatedScopedAttachment>\n  readScoped(input: ReadScopedAttachmentInput): Promise<ReadScopedAttachmentResult>\n  /**\n   * Permanently deletes an attachment row and its stored object once no other row references it.\n   *\n   * With `{ flush: false }` call it inside your own transaction and run the returned cleanup after\n   * commit; `undefined` means another row still references the stored object.\n   *\n   * @deprecated Calling it with `{ flush: false }` outside a transaction. It still works for one\n   * minor version but logs a warning, and its reference check is not locked, so two racing releases\n   * of rows sharing the stored object keep it. Wrap the call in a transaction instead.\n   */\n  releaseScoped?(\n    input: ReleaseScopedAttachmentInput,\n    options?: { em?: EntityManager; flush?: boolean },\n  ): Promise<AttachmentProviderCleanup | void>\n}\n\nasync function readRequestBodyWithinLimit(request: Request, maxBytes: number): Promise<Uint8Array> {\n  const reader = request.body?.getReader()\n  if (!reader) throw new CrudHttpError(400, { error: 'File is required' })\n  const chunks: Uint8Array[] = []\n  let totalBytes = 0\n  try {\n    while (true) {\n      const { done, value } = await reader.read()\n      if (done) break\n      totalBytes += value.byteLength\n      if (totalBytes > maxBytes) {\n        await reader.cancel()\n        throw new CrudHttpError(413, { error: 'Attachment exceeds the maximum upload size.' })\n      }\n      chunks.push(value)\n    }\n  } finally {\n    reader.releaseLock()\n  }\n  const body = new Uint8Array(totalBytes)\n  let offset = 0\n  for (const chunk of chunks) {\n    body.set(chunk, offset)\n    offset += chunk.byteLength\n  }\n  return body\n}\n\n\nfunction assignmentMatches(candidate: AttachmentAssignment, expected: AttachmentAssignment): boolean {\n  return candidate.type === expected.type && candidate.id === expected.id\n}\n\nfunction partitionMatchesScope(\n  partition: AttachmentPartition,\n  tenantId: string | null | undefined,\n  organizationId: string | null | undefined,\n): boolean {\n  const partitionTenantId = partition.tenantId ?? null\n  const partitionOrganizationId = partition.organizationId ?? null\n  if (partitionTenantId === null && partitionOrganizationId === null) return true\n  if (partitionTenantId === null || partitionOrganizationId === null) return false\n  return partitionTenantId === tenantId && partitionOrganizationId === organizationId\n}\n\nexport class DefaultAttachmentService implements AttachmentService {\n  /**\n   * The scoped upload service is supplied as a *resolver*, not an instance:\n   * resolving it eagerly would drag its own dependencies (notably `dataEngine`)\n   * into every container that merely constructs an `attachmentService`, even\n   * one that never uploads. `createScoped` requires it \u2014 module uploads must\n   * share the one reservation ledger rather than run a parallel quota\n   * mechanism \u2014 so its absence surfaces there, at the call that needs it.\n   */\n  constructor(\n    private readonly em: EntityManager,\n    private readonly storageDriverFactory: StorageDriverFactory,\n    private readonly resolveScopedUploadService?: (() => ScopedAttachmentUploadService | null) | null,\n    private readonly resolveAccessContext?: (() => AttachmentAccessContext) | null,\n  ) {}\n\n  validateUpload(input: {\n    contentLength?: string | null\n    fileName?: string\n    fileSize?: number\n  }): void {\n    if (!isMultipartRequestWithinUploadLimit(input.contentLength ?? null)) {\n      throw new CrudHttpError(413, { error: 'Attachment exceeds the maximum upload size.' })\n    }\n    if (input.fileName && hasDangerousExecutableExtension(input.fileName)) {\n      throw new CrudHttpError(400, { error: 'Executable file types are not allowed as attachments.' })\n    }\n    if (typeof input.fileSize === 'number' && input.fileSize > resolveAttachmentMaxBytes(null)) {\n      throw new CrudHttpError(413, { error: 'Attachment exceeds the maximum upload size.' })\n    }\n  }\n\n  async readUploadForm(request: Request): Promise<FormData> {\n    this.validateUpload({ contentLength: request.headers.get('content-length') })\n    const contentType = request.headers.get('content-type') ?? ''\n    if (!contentType.toLowerCase().includes('multipart/form-data')) {\n      throw new CrudHttpError(400, { error: 'Expected multipart/form-data' })\n    }\n    const body = await readRequestBodyWithinLimit(request, resolveAttachmentMultipartMaxBytes())\n    const responseBody = body.buffer.slice(body.byteOffset, body.byteOffset + body.byteLength) as ArrayBuffer\n    try {\n      return await new Response(responseBody, { headers: { 'content-type': contentType } }).formData()\n    } catch {\n      throw new CrudHttpError(400, { error: 'Invalid multipart/form-data' })\n    }\n  }\n\n  async createScoped(input: CreateScopedAttachmentInput): Promise<CreatedScopedAttachment> {\n    assertAttachmentScopeInvariant(input)\n    this.validateUpload({ fileName: input.fileName, fileSize: input.buffer.length })\n\n    // Delegate to the platform's scoped upload service rather than repeating its\n    // work. It owns the fenced quota lease (reserve \u2192 storing \u2192 stored \u2192\n    // complete) that the recovery worker reconciles, writes to the provider\n    // outside the database transaction, and emits the attachment CRUD side\n    // effects. The previous implementation here ran a *second*, independent\n    // quota mechanism on a different advisory-lock key that counted only\n    // committed rows, so it could not see an in-flight reservation from the\n    // public attachment route and the two paths could jointly exceed a tenant's\n    // quota \u2014 and it wrote to storage inside the transaction, so a crash before\n    // commit left bytes nothing accounted for.\n    let uploadService: ScopedAttachmentUploadService | null = null\n    try {\n      uploadService = this.resolveScopedUploadService?.() ?? null\n    } catch (error) {\n      logger.error('Scoped attachment upload service could not be resolved', { err: error })\n    }\n    if (!uploadService) {\n      throw new CrudHttpError(500, {\n        error: await translateAttachmentError(UPLOAD_SERVICE_UNAVAILABLE_MESSAGE),\n      })\n    }\n\n    let attachment: Attachment\n    try {\n      attachment = await uploadService.upload({\n        tenantId: input.tenantId,\n        organizationId: input.organizationId,\n        entityId: input.entityId,\n        recordId: input.recordId,\n        fileName: input.fileName,\n        buffer: input.buffer,\n        declaredMimeType: input.declaredMimeType ?? null,\n        assignments: input.assignments,\n        partitionCode: input.partitionCode,\n        requirePrivatePartition: true,\n        persistLink: input.persistLink,\n      })\n    } catch (error) {\n      if (isScopedAttachmentUploadError(error)) {\n        const message = SCOPED_UPLOAD_ERROR_MESSAGES[error.code] ?? UPLOAD_FAILED_MESSAGE\n        throw new CrudHttpError(error.status, { error: await translateAttachmentError(message) })\n      }\n      throw error\n    }\n\n    return {\n      id: attachment.id,\n      url: attachment.url ?? buildAttachmentFileUrl(attachment.id),\n      fileName: attachment.fileName,\n      mimeType: attachment.mimeType,\n      fileSize: attachment.fileSize,\n    }\n  }\n\n  async readScoped(input: ReadScopedAttachmentInput): Promise<ReadScopedAttachmentResult> {\n    // Scope the lookup at the database boundary so a foreign-tenant row is\n    // never materialized, then keep checkAttachmentAccess below as defense in\n    // depth. This service only ever stores fully scoped rows, so global rows\n    // and super-admin status deliberately do not widen the requested scope \u2014\n    // a super admin reads another tenant's attachment by switching scope, not\n    // by bypassing the filter.\n    const attachment = await findOneWithDecryption(\n      this.em,\n      Attachment,\n      {\n        id: input.attachmentId,\n        tenantId: input.auth.tenantId ?? null,\n        organizationId: input.auth.orgId ?? null,\n      },\n      undefined,\n      { tenantId: input.auth.tenantId, organizationId: input.auth.orgId },\n    )\n    if (!attachment) throw new CrudHttpError(404, { error: 'Attachment not found' })\n    const partition = await findOneWithDecryption(\n      this.em,\n      AttachmentPartition,\n      { code: attachment.partitionCode },\n      undefined,\n      { tenantId: input.auth.tenantId, organizationId: input.auth.orgId },\n    )\n    if (!partition) throw new CrudHttpError(500, { error: 'Attachment partition is not configured' })\n\n    const access = await evaluateAttachmentAccess({\n      auth: input.auth, attachment, partition, action: 'read',\n      context: this.resolveAccessContext?.(), requireAuthForPublic: true,\n    })\n    if (!access.ok) await throwAttachmentAccessError(access.status)\n    if (!partitionMatchesScope(partition, input.auth.tenantId, input.auth.orgId)) {\n      throw new CrudHttpError(403, { error: 'Attachment partition is not accessible for this scope' })\n    }\n    if (input.requirePrivatePartition && partition.isPublic) {\n      throw new CrudHttpError(403, { error: 'Attachment partition is not accessible for this resource' })\n    }\n    if (input.expectedPartitionCode && attachment.partitionCode !== input.expectedPartitionCode) {\n      throw new CrudHttpError(404, { error: 'Attachment not found' })\n    }\n    if (\n      attachment.entityId !== input.expectedOwner.entityId ||\n      attachment.recordId !== input.expectedOwner.recordId\n    ) {\n      throw new CrudHttpError(404, { error: 'Attachment not found' })\n    }\n    if (input.expectedAssignment) {\n      const assignments = readAttachmentMetadata(attachment.storageMetadata).assignments ?? []\n      if (!assignments.some((candidate) => assignmentMatches(candidate, input.expectedAssignment!))) {\n        throw new CrudHttpError(404, { error: 'Attachment not found' })\n      }\n    }\n\n    const driver = await this.storageDriverFactory.resolveForPartition(attachment.partitionCode, {\n      tenantId: attachment.tenantId ?? '',\n      organizationId: attachment.organizationId ?? '',\n    })\n    let result: Awaited<ReturnType<typeof driver.read>>\n    try {\n      result = await driver.read(attachment.partitionCode, attachment.storagePath)\n    } catch {\n      throw new CrudHttpError(404, { error: 'File not available' })\n    }\n\n    const mimeType = attachment.mimeType || 'application/octet-stream'\n    const renderInline = !input.forceDownload && canRenderInlineAttachment(mimeType)\n    return {\n      buffer: result.buffer,\n      contentType: renderInline ? result.contentType ?? mimeType : 'application/octet-stream',\n      contentDisposition: buildAttachmentContentDisposition(\n        attachment.fileName,\n        renderInline ? 'inline' : 'attachment',\n      ),\n      fileName: attachment.fileName,\n      mimeType,\n    }\n  }\n\n  async releaseScoped(\n    input: ReleaseScopedAttachmentInput,\n    options: { em?: EntityManager; flush?: boolean } = {},\n  ): Promise<AttachmentProviderCleanup | void> {\n    const em = options.em ?? this.em\n    // The type makes `expectedAssignment` mandatory, but this service is handed\n    // out through untyped DI resolution and consumed through structural ports in\n    // other packages, so the shared-reference guard is enforced at runtime too:\n    // without it a caller could destroy an attachment other records still link.\n    const expectedAssignment = input.expectedAssignment\n    if (!expectedAssignment) {\n      throw new CrudHttpError(500, {\n        error: 'Attachment release requires the expected assignment of the releasing record',\n      })\n    }\n    const isInTransaction = (em as { isInTransaction?: () => boolean }).isInTransaction\n    if (\n      options.flush !== false\n      && typeof isInTransaction === 'function'\n      && isInTransaction.call(em)\n    ) {\n      throw new CrudHttpError(500, {\n        error: 'Attachment release inside an ambient transaction requires flush: false and deferred provider cleanup',\n      })\n    }\n    const deferredOutsideTransaction = options.flush === false\n      && typeof isInTransaction === 'function'\n      && !isInTransaction.call(em)\n    if (deferredOutsideTransaction) {\n      logger.warn(\n        '[deprecated] attachmentService.releaseScoped({ flush: false }) called outside a transaction; wrap it in a transaction so the storage reference lock is held until commit',\n        { attachmentId: input.attachmentId },\n      )\n    }\n    const scope = { tenantId: input.tenantId, organizationId: input.organizationId }\n    const attachment = await findOneWithDecryption(\n      em,\n      Attachment,\n      {\n        id: input.attachmentId,\n        tenantId: input.tenantId,\n        organizationId: input.organizationId,\n      },\n      undefined,\n      scope,\n    )\n    if (!attachment) throw new CrudHttpError(404, { error: 'Attachment not found' })\n    if (\n      attachment.entityId !== input.expectedOwner.entityId\n      || attachment.recordId !== input.expectedOwner.recordId\n      || (input.expectedPartitionCode && attachment.partitionCode !== input.expectedPartitionCode)\n    ) {\n      throw new CrudHttpError(404, { error: 'Attachment not found' })\n    }\n    const assignments = readAttachmentMetadata(attachment.storageMetadata).assignments ?? []\n    if (!assignments.some((candidate) => assignmentMatches(candidate, expectedAssignment))) {\n      throw new CrudHttpError(409, { error: 'Attachment is still referenced by another record' })\n    }\n    if (assignments.some((candidate) => !assignmentMatches(candidate, expectedAssignment))) {\n      throw new CrudHttpError(409, { error: 'Attachment is still referenced by another record' })\n    }\n\n    const driver = await this.storageDriverFactory.resolveForPartition(attachment.partitionCode, scope)\n    const deleteProviderBytes = () => driver.delete(attachment.partitionCode, attachment.storagePath)\n    if (options.flush === false) {\n      const referenceIds = deferredOutsideTransaction\n        ? await listAttachmentStorageReferences(em, attachment)\n        : await lockAttachmentStorageReferences(em, attachment)\n      const removal = resolveAttachmentStorageRelease(referenceIds, attachment.id)\n      if (!removal.removed) throw new CrudHttpError(404, { error: 'Attachment not found' })\n      em.remove(attachment)\n      return removal.releaseStorage ? deleteProviderBytes : undefined\n    }\n    const removal = await removeAttachmentRecord(em, attachment)\n    if (!removal.removed) throw new CrudHttpError(404, { error: 'Attachment not found' })\n    if (removal.releaseStorage) await deleteProviderBytes()\n  }\n}\n"],
+  "mappings": "AAAA,SAAS,gCAA8D;AACvE,SAAS,kCAAkC;AAG3C,SAAS,qBAAqB;AAC9B,SAAS,6BAA6B;AACtC,SAAS,2BAA2B;AACpC,SAAS,oBAAoB;AAC7B,SAAS,YAAY,2BAA2B;AAChD,SAAS,sCAA6D;AAEtE,SAAS,8BAA8B;AACvC;AAAA,EACE;AAAA,OAGK;AACP,SAAS,8BAAyD;AAClE;AAAA,EACE;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,OACK;AACP;AAAA,EACE;AAAA,EACA;AAAA,EACA;AAAA,OACK;AACP;AAAA,EACE;AAAA,EACA;AAAA,EACA;AAAA,OACK;AAEP,MAAM,SAAS,aAAa,aAAa,EAAE,MAAM,EAAE,WAAW,qBAAqB,CAAC;AAcpF,MAAM,+BAAgG;AAAA,EACpG,sBAAsB;AAAA,IACpB,KAAK;AAAA,IACL,UAAU;AAAA,EACZ;AAAA,EACA,iBAAiB;AAAA,IACf,KAAK;AAAA,IACL,UAAU;AAAA,EACZ;AAAA,EACA,gBAAgB;AAAA,IACd,KAAK;AAAA,IACL,UAAU;AAAA,EACZ;AAAA,EACA,uBAAuB;AAAA,IACrB,KAAK;AAAA,IACL,UAAU;AAAA,EACZ;AAAA,EACA,gBAAgB;AAAA,IACd,KAAK;AAAA,IACL,UAAU;AAAA,EACZ;AAAA,EACA,qBAAqB;AAAA,IACnB,KAAK;AAAA,IACL,UAAU;AAAA,EACZ;AAAA,EACA,mBAAmB;AAAA,IACjB,KAAK;AAAA,IACL,UAAU;AAAA,EACZ;AAAA,EACA,4BAA4B;AAAA,IAC1B,KAAK;AAAA,IACL,UAAU;AAAA,EACZ;AAAA,EACA,gBAAgB;AAAA,IACd,KAAK;AAAA,IACL,UAAU;AAAA,EACZ;AAAA,EACA,oBAAoB;AAAA,IAClB,KAAK;AAAA,IACL,UAAU;AAAA,EACZ;AACF;AAEA,MAAM,wBAAgD;AAAA,EACpD,KAAK;AAAA,EACL,UAAU;AACZ;AAEA,MAAM,qCAA6D;AAAA,EACjE,KAAK;AAAA,EACL,UAAU;AACZ;AAEA,eAAe,yBAAyB,SAAkD;AACxF,QAAM,EAAE,EAAE,IAAI,MAAM,oBAAoB;AACxC,SAAO,EAAE,QAAQ,KAAK,QAAQ,QAAQ;AACxC;AA0FA,eAAe,2BAA2B,SAAkB,UAAuC;AACjG,QAAM,SAAS,QAAQ,MAAM,UAAU;AACvC,MAAI,CAAC,OAAQ,OAAM,IAAI,cAAc,KAAK,EAAE,OAAO,mBAAmB,CAAC;AACvE,QAAM,SAAuB,CAAC;AAC9B,MAAI,aAAa;AACjB,MAAI;AACF,WAAO,MAAM;AACX,YAAM,EAAE,MAAM,MAAM,IAAI,MAAM,OAAO,KAAK;AAC1C,UAAI,KAAM;AACV,oBAAc,MAAM;AACpB,UAAI,aAAa,UAAU;AACzB,cAAM,OAAO,OAAO;AACpB,cAAM,IAAI,cAAc,KAAK,EAAE,OAAO,8CAA8C,CAAC;AAAA,MACvF;AACA,aAAO,KAAK,KAAK;AAAA,IACnB;AAAA,EACF,UAAE;AACA,WAAO,YAAY;AAAA,EACrB;AACA,QAAM,OAAO,IAAI,WAAW,UAAU;AACtC,MAAI,SAAS;AACb,aAAW,SAAS,QAAQ;AAC1B,SAAK,IAAI,OAAO,MAAM;AACtB,cAAU,MAAM;AAAA,EAClB;AACA,SAAO;AACT;AAGA,SAAS,kBAAkB,WAAiC,UAAyC;AACnG,SAAO,UAAU,SAAS,SAAS,QAAQ,UAAU,OAAO,SAAS;AACvE;AAEA,SAAS,sBACP,WACA,UACA,gBACS;AACT,QAAM,oBAAoB,UAAU,YAAY;AAChD,QAAM,0BAA0B,UAAU,kBAAkB;AAC5D,MAAI,sBAAsB,QAAQ,4BAA4B,KAAM,QAAO;AAC3E,MAAI,sBAAsB,QAAQ,4BAA4B,KAAM,QAAO;AAC3E,SAAO,sBAAsB,YAAY,4BAA4B;AACvE;AAEO,MAAM,yBAAsD;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EASjE,YACmB,IACA,sBACA,4BACA,sBACjB;AAJiB;AACA;AACA;AACA;AAAA,EAChB;AAAA,EAEH,eAAe,OAIN;AACP,QAAI,CAAC,oCAAoC,MAAM,iBAAiB,IAAI,GAAG;AACrE,YAAM,IAAI,cAAc,KAAK,EAAE,OAAO,8CAA8C,CAAC;AAAA,IACvF;AACA,QAAI,MAAM,YAAY,gCAAgC,MAAM,QAAQ,GAAG;AACrE,YAAM,IAAI,cAAc,KAAK,EAAE,OAAO,wDAAwD,CAAC;AAAA,IACjG;AACA,QAAI,OAAO,MAAM,aAAa,YAAY,MAAM,WAAW,0BAA0B,IAAI,GAAG;AAC1F,YAAM,IAAI,cAAc,KAAK,EAAE,OAAO,8CAA8C,CAAC;AAAA,IACvF;AAAA,EACF;AAAA,EAEA,MAAM,eAAe,SAAqC;AACxD,SAAK,eAAe,EAAE,eAAe,QAAQ,QAAQ,IAAI,gBAAgB,EAAE,CAAC;AAC5E,UAAM,cAAc,QAAQ,QAAQ,IAAI,cAAc,KAAK;AAC3D,QAAI,CAAC,YAAY,YAAY,EAAE,SAAS,qBAAqB,GAAG;AAC9D,YAAM,IAAI,cAAc,KAAK,EAAE,OAAO,+BAA+B,CAAC;AAAA,IACxE;AACA,UAAM,OAAO,MAAM,2BAA2B,SAAS,mCAAmC,CAAC;AAC3F,UAAM,eAAe,KAAK,OAAO,MAAM,KAAK,YAAY,KAAK,aAAa,KAAK,UAAU;AACzF,QAAI;AACF,aAAO,MAAM,IAAI,SAAS,cAAc,EAAE,SAAS,EAAE,gBAAgB,YAAY,EAAE,CAAC,EAAE,SAAS;AAAA,IACjG,QAAQ;AACN,YAAM,IAAI,cAAc,KAAK,EAAE,OAAO,8BAA8B,CAAC;AAAA,IACvE;AAAA,EACF;AAAA,EAEA,MAAM,aAAa,OAAsE;AACvF,mCAA+B,KAAK;AACpC,SAAK,eAAe,EAAE,UAAU,MAAM,UAAU,UAAU,MAAM,OAAO,OAAO,CAAC;AAY/E,QAAI,gBAAsD;AAC1D,QAAI;AACF,sBAAgB,KAAK,6BAA6B,KAAK;AAAA,IACzD,SAAS,OAAO;AACd,aAAO,MAAM,0DAA0D,EAAE,KAAK,MAAM,CAAC;AAAA,IACvF;AACA,QAAI,CAAC,eAAe;AAClB,YAAM,IAAI,cAAc,KAAK;AAAA,QAC3B,OAAO,MAAM,yBAAyB,kCAAkC;AAAA,MAC1E,CAAC;AAAA,IACH;AAEA,QAAI;AACJ,QAAI;AACF,mBAAa,MAAM,cAAc,OAAO;AAAA,QACtC,UAAU,MAAM;AAAA,QAChB,gBAAgB,MAAM;AAAA,QACtB,UAAU,MAAM;AAAA,QAChB,UAAU,MAAM;AAAA,QAChB,UAAU,MAAM;AAAA,QAChB,QAAQ,MAAM;AAAA,QACd,kBAAkB,MAAM,oBAAoB;AAAA,QAC5C,aAAa,MAAM;AAAA,QACnB,eAAe,MAAM;AAAA,QACrB,yBAAyB;AAAA,QACzB,aAAa,MAAM;AAAA,MACrB,CAAC;AAAA,IACH,SAAS,OAAO;AACd,UAAI,8BAA8B,KAAK,GAAG;AACxC,cAAM,UAAU,6BAA6B,MAAM,IAAI,KAAK;AAC5D,cAAM,IAAI,cAAc,MAAM,QAAQ,EAAE,OAAO,MAAM,yBAAyB,OAAO,EAAE,CAAC;AAAA,MAC1F;AACA,YAAM;AAAA,IACR;AAEA,WAAO;AAAA,MACL,IAAI,WAAW;AAAA,MACf,KAAK,WAAW,OAAO,uBAAuB,WAAW,EAAE;AAAA,MAC3D,UAAU,WAAW;AAAA,MACrB,UAAU,WAAW;AAAA,MACrB,UAAU,WAAW;AAAA,IACvB;AAAA,EACF;AAAA,EAEA,MAAM,WAAW,OAAuE;AAOtF,UAAM,aAAa,MAAM;AAAA,MACvB,KAAK;AAAA,MACL;AAAA,MACA;AAAA,QACE,IAAI,MAAM;AAAA,QACV,UAAU,MAAM,KAAK,YAAY;AAAA,QACjC,gBAAgB,MAAM,KAAK,SAAS;AAAA,MACtC;AAAA,MACA;AAAA,MACA,EAAE,UAAU,MAAM,KAAK,UAAU,gBAAgB,MAAM,KAAK,MAAM;AAAA,IACpE;AACA,QAAI,CAAC,WAAY,OAAM,IAAI,cAAc,KAAK,EAAE,OAAO,uBAAuB,CAAC;AAC/E,UAAM,YAAY,MAAM;AAAA,MACtB,KAAK;AAAA,MACL;AAAA,MACA,EAAE,MAAM,WAAW,cAAc;AAAA,MACjC;AAAA,MACA,EAAE,UAAU,MAAM,KAAK,UAAU,gBAAgB,MAAM,KAAK,MAAM;AAAA,IACpE;AACA,QAAI,CAAC,UAAW,OAAM,IAAI,cAAc,KAAK,EAAE,OAAO,yCAAyC,CAAC;AAEhG,UAAM,SAAS,MAAM,yBAAyB;AAAA,MAC5C,MAAM,MAAM;AAAA,MAAM;AAAA,MAAY;AAAA,MAAW,QAAQ;AAAA,MACjD,SAAS,KAAK,uBAAuB;AAAA,MAAG,sBAAsB;AAAA,IAChE,CAAC;AACD,QAAI,CAAC,OAAO,GAAI,OAAM,2BAA2B,OAAO,MAAM;AAC9D,QAAI,CAAC,sBAAsB,WAAW,MAAM,KAAK,UAAU,MAAM,KAAK,KAAK,GAAG;AAC5E,YAAM,IAAI,cAAc,KAAK,EAAE,OAAO,wDAAwD,CAAC;AAAA,IACjG;AACA,QAAI,MAAM,2BAA2B,UAAU,UAAU;AACvD,YAAM,IAAI,cAAc,KAAK,EAAE,OAAO,2DAA2D,CAAC;AAAA,IACpG;AACA,QAAI,MAAM,yBAAyB,WAAW,kBAAkB,MAAM,uBAAuB;AAC3F,YAAM,IAAI,cAAc,KAAK,EAAE,OAAO,uBAAuB,CAAC;AAAA,IAChE;AACA,QACE,WAAW,aAAa,MAAM,cAAc,YAC5C,WAAW,aAAa,MAAM,cAAc,UAC5C;AACA,YAAM,IAAI,cAAc,KAAK,EAAE,OAAO,uBAAuB,CAAC;AAAA,IAChE;AACA,QAAI,MAAM,oBAAoB;AAC5B,YAAM,cAAc,uBAAuB,WAAW,eAAe,EAAE,eAAe,CAAC;AACvF,UAAI,CAAC,YAAY,KAAK,CAAC,cAAc,kBAAkB,WAAW,MAAM,kBAAmB,CAAC,GAAG;AAC7F,cAAM,IAAI,cAAc,KAAK,EAAE,OAAO,uBAAuB,CAAC;AAAA,MAChE;AAAA,IACF;AAEA,UAAM,SAAS,MAAM,KAAK,qBAAqB,oBAAoB,WAAW,eAAe;AAAA,MAC3F,UAAU,WAAW,YAAY;AAAA,MACjC,gBAAgB,WAAW,kBAAkB;AAAA,IAC/C,CAAC;AACD,QAAI;AACJ,QAAI;AACF,eAAS,MAAM,OAAO,KAAK,WAAW,eAAe,WAAW,WAAW;AAAA,IAC7E,QAAQ;AACN,YAAM,IAAI,cAAc,KAAK,EAAE,OAAO,qBAAqB,CAAC;AAAA,IAC9D;AAEA,UAAM,WAAW,WAAW,YAAY;AACxC,UAAM,eAAe,CAAC,MAAM,iBAAiB,0BAA0B,QAAQ;AAC/E,WAAO;AAAA,MACL,QAAQ,OAAO;AAAA,MACf,aAAa,eAAe,OAAO,eAAe,WAAW;AAAA,MAC7D,oBAAoB;AAAA,QAClB,WAAW;AAAA,QACX,eAAe,WAAW;AAAA,MAC5B;AAAA,MACA,UAAU,WAAW;AAAA,MACrB;AAAA,IACF;AAAA,EACF;AAAA,EAEA,MAAM,cACJ,OACA,UAAmD,CAAC,GACT;AAC3C,UAAM,KAAK,QAAQ,MAAM,KAAK;AAK9B,UAAM,qBAAqB,MAAM;AACjC,QAAI,CAAC,oBAAoB;AACvB,YAAM,IAAI,cAAc,KAAK;AAAA,QAC3B,OAAO;AAAA,MACT,CAAC;AAAA,IACH;AACA,UAAM,kBAAmB,GAA2C;AACpE,QACE,QAAQ,UAAU,SACf,OAAO,oBAAoB,cAC3B,gBAAgB,KAAK,EAAE,GAC1B;AACA,YAAM,IAAI,cAAc,KAAK;AAAA,QAC3B,OAAO;AAAA,MACT,CAAC;AAAA,IACH;AACA,UAAM,6BAA6B,QAAQ,UAAU,SAChD,OAAO,oBAAoB,cAC3B,CAAC,gBAAgB,KAAK,EAAE;AAC7B,QAAI,4BAA4B;AAC9B,aAAO;AAAA,QACL;AAAA,QACA,EAAE,cAAc,MAAM,aAAa;AAAA,MACrC;AAAA,IACF;AACA,UAAM,QAAQ,EAAE,UAAU,MAAM,UAAU,gBAAgB,MAAM,eAAe;AAC/E,UAAM,aAAa,MAAM;AAAA,MACvB;AAAA,MACA;AAAA,MACA;AAAA,QACE,IAAI,MAAM;AAAA,QACV,UAAU,MAAM;AAAA,QAChB,gBAAgB,MAAM;AAAA,MACxB;AAAA,MACA;AAAA,MACA;AAAA,IACF;AACA,QAAI,CAAC,WAAY,OAAM,IAAI,cAAc,KAAK,EAAE,OAAO,uBAAuB,CAAC;AAC/E,QACE,WAAW,aAAa,MAAM,cAAc,YACzC,WAAW,aAAa,MAAM,cAAc,YAC3C,MAAM,yBAAyB,WAAW,kBAAkB,MAAM,uBACtE;AACA,YAAM,IAAI,cAAc,KAAK,EAAE,OAAO,uBAAuB,CAAC;AAAA,IAChE;AACA,UAAM,cAAc,uBAAuB,WAAW,eAAe,EAAE,eAAe,CAAC;AACvF,QAAI,CAAC,YAAY,KAAK,CAAC,cAAc,kBAAkB,WAAW,kBAAkB,CAAC,GAAG;AACtF,YAAM,IAAI,cAAc,KAAK,EAAE,OAAO,mDAAmD,CAAC;AAAA,IAC5F;AACA,QAAI,YAAY,KAAK,CAAC,cAAc,CAAC,kBAAkB,WAAW,kBAAkB,CAAC,GAAG;AACtF,YAAM,IAAI,cAAc,KAAK,EAAE,OAAO,mDAAmD,CAAC;AAAA,IAC5F;AAEA,UAAM,SAAS,MAAM,KAAK,qBAAqB,oBAAoB,WAAW,eAAe,KAAK;AAClG,UAAM,sBAAsB,MAAM,OAAO,OAAO,WAAW,eAAe,WAAW,WAAW;AAChG,QAAI,QAAQ,UAAU,OAAO;AAC3B,YAAM,eAAe,6BACjB,MAAM,gCAAgC,IAAI,UAAU,IACpD,MAAM,gCAAgC,IAAI,UAAU;AACxD,YAAMA,WAAU,gCAAgC,cAAc,WAAW,EAAE;AAC3E,UAAI,CAACA,SAAQ,QAAS,OAAM,IAAI,cAAc,KAAK,EAAE,OAAO,uBAAuB,CAAC;AACpF,SAAG,OAAO,UAAU;AACpB,aAAOA,SAAQ,iBAAiB,sBAAsB;AAAA,IACxD;AACA,UAAM,UAAU,MAAM,uBAAuB,IAAI,UAAU;AAC3D,QAAI,CAAC,QAAQ,QAAS,OAAM,IAAI,cAAc,KAAK,EAAE,OAAO,uBAAuB,CAAC;AACpF,QAAI,QAAQ,eAAgB,OAAM,oBAAoB;AAAA,EACxD;AACF;",
   "names": ["removal"]
 }

package/dist/modules/attachments/lib/createFromBuffer.js

@@ -7,6 +7,7 @@ import { buildAttachmentFileUrl } from "./imageUrls.js";
 import { mergeAttachmentMetadata, upsertAssignment } from "./metadata.js";
 import { assertAttachmentScopeInvariant } from "./access.js";
 import { attachmentCrudEvents, attachmentCrudIndexer } from "./crud.js";
+import { ensureAttachmentPartitionProtection } from "./access-protection.js";
 async function createAttachmentFromBuffer(input) {
   const { em } = input;
   const code = input.partitionCode && input.partitionCode.length > 0 ? input.partitionCode : resolveDefaultPartitionCode(input.entityId);
@@ -16,6 +17,7 @@ async function createAttachmentFromBuffer(input) {
     partition = await em.findOne(AttachmentPartition, { code });
   }
   if (!partition) throw new Error(`[internal] attachment partition "${code}" is not available`);
+  await ensureAttachmentPartitionProtection(em, partition);
   const driver = await new StorageDriverFactory(em).resolveForPartition(partition.code, {
     tenantId: input.tenantId,
     organizationId: input.organizationId

package/dist/modules/attachments/lib/createFromBuffer.js.map

@@ -1,7 +1,7 @@
 {
   "version": 3,
   "sources": ["../../../../src/modules/attachments/lib/createFromBuffer.ts"],
-  "sourcesContent": ["import { randomUUID } from 'node:crypto'\nimport type { EntityManager } from '@mikro-orm/postgresql'\nimport { emitCrudSideEffects } from '@open-mercato/shared/lib/commands/helpers'\nimport { Attachment, AttachmentPartition } from '../data/entities'\nimport { StorageDriverFactory } from './drivers'\nimport { ensureDefaultPartitions, resolveDefaultPartitionCode } from './partitions'\nimport { buildAttachmentFileUrl } from './imageUrls'\nimport { mergeAttachmentMetadata, upsertAssignment } from './metadata'\nimport { assertAttachmentScopeInvariant } from './access'\nimport { attachmentCrudEvents, attachmentCrudIndexer } from './crud'\n\n/** DataEngine handle whose exact type is derived from `emitCrudSideEffects` (no `any`). */\ntype CrudDataEngine = Parameters<typeof emitCrudSideEffects>[0]['dataEngine']\n\nexport type CreateAttachmentFromBufferInput = {\n  em: EntityManager\n  /** When provided, fires CRUD side effects (events + indexing). Omit to skip. */\n  dataEngine?: CrudDataEngine\n  tenantId: string\n  organizationId: string\n  /** Domain entity this attachment is linked to (e.g. 'customers:deal'). */\n  entityId: string\n  recordId: string\n  fileName: string\n  mimeType: string\n  buffer: Buffer\n  /** Storage partition; defaults to the entity's default partition. */\n  partitionCode?: string | null\n}\n\nexport type CreatedAttachment = {\n  id: string\n  fileName: string\n  mimeType: string\n  fileSize: number\n  url: string\n}\n\n/**\n * Create a durable `Attachment` from an in-memory buffer, linked to a domain\n * record. Additive reusable seam extracted from the upload route's store block so\n * server-side producers (e.g. the agent file-plane artifact-promotion effector,\n * #12) can materialize an attachment without going through the multipart HTTP\n * route. Resolves the partition + driver, stores the bytes, persists the row\n * atomically, and (when a `dataEngine` is passed) fires CRUD side effects so the\n * attachment is indexed and its events emitted \u2014 exactly like an uploaded file.\n */\nexport async function createAttachmentFromBuffer(input: CreateAttachmentFromBufferInput): Promise<CreatedAttachment> {\n  const { em } = input\n  const code = (input.partitionCode && input.partitionCode.length > 0)\n    ? input.partitionCode\n    : resolveDefaultPartitionCode(input.entityId)\n\n  let partition = await em.findOne(AttachmentPartition, { code })\n  if (!partition) {\n    await ensureDefaultPartitions(em)\n    partition = await em.findOne(AttachmentPartition, { code })\n  }\n  if (!partition) throw new Error(`[internal] attachment partition \"${code}\" is not available`)\n\n  const driver = await new StorageDriverFactory(em).resolveForPartition(partition.code, {\n    tenantId: input.tenantId,\n    organizationId: input.organizationId,\n  })\n  const stored = await driver.store({\n    partitionCode: partition.code,\n    orgId: input.organizationId,\n    tenantId: input.tenantId,\n    fileName: input.fileName,\n    buffer: input.buffer,\n  })\n\n  const metadata = mergeAttachmentMetadata(null, {\n    assignments: upsertAssignment([], { type: input.entityId, id: input.recordId }),\n  })\n  const attachmentId = randomUUID()\n  assertAttachmentScopeInvariant({ tenantId: input.tenantId, organizationId: input.organizationId })\n  const attachment = em.create(Attachment, {\n    id: attachmentId,\n    entityId: input.entityId,\n    recordId: input.recordId,\n    organizationId: input.organizationId,\n    tenantId: input.tenantId,\n    fileName: input.fileName,\n    mimeType: input.mimeType,\n    fileSize: input.buffer.length,\n    partitionCode: partition.code,\n    storageDriver: partition.storageDriver || 'local',\n    storagePath: stored.storagePath,\n    url: buildAttachmentFileUrl(attachmentId),\n    content: null,\n    storageMetadata: metadata,\n  })\n  await em.transactional(async (tx) => {\n    await tx.persist(attachment).flush()\n  })\n\n  if (input.dataEngine) {\n    await emitCrudSideEffects({\n      dataEngine: input.dataEngine,\n      action: 'created',\n      entity: attachment,\n      identifiers: {\n        id: attachment.id,\n        organizationId: attachment.organizationId ?? null,\n        tenantId: attachment.tenantId ?? null,\n      },\n      events: attachmentCrudEvents,\n      indexer: attachmentCrudIndexer,\n    })\n  }\n\n  return {\n    id: attachmentId,\n    fileName: input.fileName,\n    mimeType: input.mimeType,\n    fileSize: input.buffer.length,\n    url: attachment.url,\n  }\n}\n"],
-  "mappings": "AAAA,SAAS,kBAAkB;AAE3B,SAAS,2BAA2B;AACpC,SAAS,YAAY,2BAA2B;AAChD,SAAS,4BAA4B;AACrC,SAAS,yBAAyB,mCAAmC;AACrE,SAAS,8BAA8B;AACvC,SAAS,yBAAyB,wBAAwB;AAC1D,SAAS,sCAAsC;AAC/C,SAAS,sBAAsB,6BAA6B;AAsC5D,eAAsB,2BAA2B,OAAoE;AACnH,QAAM,EAAE,GAAG,IAAI;AACf,QAAM,OAAQ,MAAM,iBAAiB,MAAM,cAAc,SAAS,IAC9D,MAAM,gBACN,4BAA4B,MAAM,QAAQ;AAE9C,MAAI,YAAY,MAAM,GAAG,QAAQ,qBAAqB,EAAE,KAAK,CAAC;AAC9D,MAAI,CAAC,WAAW;AACd,UAAM,wBAAwB,EAAE;AAChC,gBAAY,MAAM,GAAG,QAAQ,qBAAqB,EAAE,KAAK,CAAC;AAAA,EAC5D;AACA,MAAI,CAAC,UAAW,OAAM,IAAI,MAAM,oCAAoC,IAAI,oBAAoB;AAE5F,QAAM,SAAS,MAAM,IAAI,qBAAqB,EAAE,EAAE,oBAAoB,UAAU,MAAM;AAAA,IACpF,UAAU,MAAM;AAAA,IAChB,gBAAgB,MAAM;AAAA,EACxB,CAAC;AACD,QAAM,SAAS,MAAM,OAAO,MAAM;AAAA,IAChC,eAAe,UAAU;AAAA,IACzB,OAAO,MAAM;AAAA,IACb,UAAU,MAAM;AAAA,IAChB,UAAU,MAAM;AAAA,IAChB,QAAQ,MAAM;AAAA,EAChB,CAAC;AAED,QAAM,WAAW,wBAAwB,MAAM;AAAA,IAC7C,aAAa,iBAAiB,CAAC,GAAG,EAAE,MAAM,MAAM,UAAU,IAAI,MAAM,SAAS,CAAC;AAAA,EAChF,CAAC;AACD,QAAM,eAAe,WAAW;AAChC,iCAA+B,EAAE,UAAU,MAAM,UAAU,gBAAgB,MAAM,eAAe,CAAC;AACjG,QAAM,aAAa,GAAG,OAAO,YAAY;AAAA,IACvC,IAAI;AAAA,IACJ,UAAU,MAAM;AAAA,IAChB,UAAU,MAAM;AAAA,IAChB,gBAAgB,MAAM;AAAA,IACtB,UAAU,MAAM;AAAA,IAChB,UAAU,MAAM;AAAA,IAChB,UAAU,MAAM;AAAA,IAChB,UAAU,MAAM,OAAO;AAAA,IACvB,eAAe,UAAU;AAAA,IACzB,eAAe,UAAU,iBAAiB;AAAA,IAC1C,aAAa,OAAO;AAAA,IACpB,KAAK,uBAAuB,YAAY;AAAA,IACxC,SAAS;AAAA,IACT,iBAAiB;AAAA,EACnB,CAAC;AACD,QAAM,GAAG,cAAc,OAAO,OAAO;AACnC,UAAM,GAAG,QAAQ,UAAU,EAAE,MAAM;AAAA,EACrC,CAAC;AAED,MAAI,MAAM,YAAY;AACpB,UAAM,oBAAoB;AAAA,MACxB,YAAY,MAAM;AAAA,MAClB,QAAQ;AAAA,MACR,QAAQ;AAAA,MACR,aAAa;AAAA,QACX,IAAI,WAAW;AAAA,QACf,gBAAgB,WAAW,kBAAkB;AAAA,QAC7C,UAAU,WAAW,YAAY;AAAA,MACnC;AAAA,MACA,QAAQ;AAAA,MACR,SAAS;AAAA,IACX,CAAC;AAAA,EACH;AAEA,SAAO;AAAA,IACL,IAAI;AAAA,IACJ,UAAU,MAAM;AAAA,IAChB,UAAU,MAAM;AAAA,IAChB,UAAU,MAAM,OAAO;AAAA,IACvB,KAAK,WAAW;AAAA,EAClB;AACF;",
+  "sourcesContent": ["import { randomUUID } from 'node:crypto'\nimport type { EntityManager } from '@mikro-orm/postgresql'\nimport { emitCrudSideEffects } from '@open-mercato/shared/lib/commands/helpers'\nimport { Attachment, AttachmentPartition } from '../data/entities'\nimport { StorageDriverFactory } from './drivers'\nimport { ensureDefaultPartitions, resolveDefaultPartitionCode } from './partitions'\nimport { buildAttachmentFileUrl } from './imageUrls'\nimport { mergeAttachmentMetadata, upsertAssignment } from './metadata'\nimport { assertAttachmentScopeInvariant } from './access'\nimport { attachmentCrudEvents, attachmentCrudIndexer } from './crud'\nimport { ensureAttachmentPartitionProtection } from './access-protection'\n\n/** DataEngine handle whose exact type is derived from `emitCrudSideEffects` (no `any`). */\ntype CrudDataEngine = Parameters<typeof emitCrudSideEffects>[0]['dataEngine']\n\nexport type CreateAttachmentFromBufferInput = {\n  em: EntityManager\n  /** When provided, fires CRUD side effects (events + indexing). Omit to skip. */\n  dataEngine?: CrudDataEngine\n  tenantId: string\n  organizationId: string\n  /** Domain entity this attachment is linked to (e.g. 'customers:deal'). */\n  entityId: string\n  recordId: string\n  fileName: string\n  mimeType: string\n  buffer: Buffer\n  /** Storage partition; defaults to the entity's default partition. */\n  partitionCode?: string | null\n}\n\nexport type CreatedAttachment = {\n  id: string\n  fileName: string\n  mimeType: string\n  fileSize: number\n  url: string\n}\n\n/**\n * Create a durable `Attachment` from an in-memory buffer, linked to a domain\n * record. Additive reusable seam extracted from the upload route's store block so\n * server-side producers (e.g. the agent file-plane artifact-promotion effector,\n * #12) can materialize an attachment without going through the multipart HTTP\n * route. Resolves the partition + driver, stores the bytes, persists the row\n * atomically, and (when a `dataEngine` is passed) fires CRUD side effects so the\n * attachment is indexed and its events emitted \u2014 exactly like an uploaded file.\n */\nexport async function createAttachmentFromBuffer(input: CreateAttachmentFromBufferInput): Promise<CreatedAttachment> {\n  const { em } = input\n  const code = (input.partitionCode && input.partitionCode.length > 0)\n    ? input.partitionCode\n    : resolveDefaultPartitionCode(input.entityId)\n\n  let partition = await em.findOne(AttachmentPartition, { code })\n  if (!partition) {\n    await ensureDefaultPartitions(em)\n    partition = await em.findOne(AttachmentPartition, { code })\n  }\n  if (!partition) throw new Error(`[internal] attachment partition \"${code}\" is not available`)\n\n  await ensureAttachmentPartitionProtection(em, partition)\n\n  const driver = await new StorageDriverFactory(em).resolveForPartition(partition.code, {\n    tenantId: input.tenantId,\n    organizationId: input.organizationId,\n  })\n  const stored = await driver.store({\n    partitionCode: partition.code,\n    orgId: input.organizationId,\n    tenantId: input.tenantId,\n    fileName: input.fileName,\n    buffer: input.buffer,\n  })\n\n  const metadata = mergeAttachmentMetadata(null, {\n    assignments: upsertAssignment([], { type: input.entityId, id: input.recordId }),\n  })\n  const attachmentId = randomUUID()\n  assertAttachmentScopeInvariant({ tenantId: input.tenantId, organizationId: input.organizationId })\n  const attachment = em.create(Attachment, {\n    id: attachmentId,\n    entityId: input.entityId,\n    recordId: input.recordId,\n    organizationId: input.organizationId,\n    tenantId: input.tenantId,\n    fileName: input.fileName,\n    mimeType: input.mimeType,\n    fileSize: input.buffer.length,\n    partitionCode: partition.code,\n    storageDriver: partition.storageDriver || 'local',\n    storagePath: stored.storagePath,\n    url: buildAttachmentFileUrl(attachmentId),\n    content: null,\n    storageMetadata: metadata,\n  })\n  await em.transactional(async (tx) => {\n    await tx.persist(attachment).flush()\n  })\n\n  if (input.dataEngine) {\n    await emitCrudSideEffects({\n      dataEngine: input.dataEngine,\n      action: 'created',\n      entity: attachment,\n      identifiers: {\n        id: attachment.id,\n        organizationId: attachment.organizationId ?? null,\n        tenantId: attachment.tenantId ?? null,\n      },\n      events: attachmentCrudEvents,\n      indexer: attachmentCrudIndexer,\n    })\n  }\n\n  return {\n    id: attachmentId,\n    fileName: input.fileName,\n    mimeType: input.mimeType,\n    fileSize: input.buffer.length,\n    url: attachment.url,\n  }\n}\n"],
+  "mappings": "AAAA,SAAS,kBAAkB;AAE3B,SAAS,2BAA2B;AACpC,SAAS,YAAY,2BAA2B;AAChD,SAAS,4BAA4B;AACrC,SAAS,yBAAyB,mCAAmC;AACrE,SAAS,8BAA8B;AACvC,SAAS,yBAAyB,wBAAwB;AAC1D,SAAS,sCAAsC;AAC/C,SAAS,sBAAsB,6BAA6B;AAC5D,SAAS,2CAA2C;AAsCpD,eAAsB,2BAA2B,OAAoE;AACnH,QAAM,EAAE,GAAG,IAAI;AACf,QAAM,OAAQ,MAAM,iBAAiB,MAAM,cAAc,SAAS,IAC9D,MAAM,gBACN,4BAA4B,MAAM,QAAQ;AAE9C,MAAI,YAAY,MAAM,GAAG,QAAQ,qBAAqB,EAAE,KAAK,CAAC;AAC9D,MAAI,CAAC,WAAW;AACd,UAAM,wBAAwB,EAAE;AAChC,gBAAY,MAAM,GAAG,QAAQ,qBAAqB,EAAE,KAAK,CAAC;AAAA,EAC5D;AACA,MAAI,CAAC,UAAW,OAAM,IAAI,MAAM,oCAAoC,IAAI,oBAAoB;AAE5F,QAAM,oCAAoC,IAAI,SAAS;AAEvD,QAAM,SAAS,MAAM,IAAI,qBAAqB,EAAE,EAAE,oBAAoB,UAAU,MAAM;AAAA,IACpF,UAAU,MAAM;AAAA,IAChB,gBAAgB,MAAM;AAAA,EACxB,CAAC;AACD,QAAM,SAAS,MAAM,OAAO,MAAM;AAAA,IAChC,eAAe,UAAU;AAAA,IACzB,OAAO,MAAM;AAAA,IACb,UAAU,MAAM;AAAA,IAChB,UAAU,MAAM;AAAA,IAChB,QAAQ,MAAM;AAAA,EAChB,CAAC;AAED,QAAM,WAAW,wBAAwB,MAAM;AAAA,IAC7C,aAAa,iBAAiB,CAAC,GAAG,EAAE,MAAM,MAAM,UAAU,IAAI,MAAM,SAAS,CAAC;AAAA,EAChF,CAAC;AACD,QAAM,eAAe,WAAW;AAChC,iCAA+B,EAAE,UAAU,MAAM,UAAU,gBAAgB,MAAM,eAAe,CAAC;AACjG,QAAM,aAAa,GAAG,OAAO,YAAY;AAAA,IACvC,IAAI;AAAA,IACJ,UAAU,MAAM;AAAA,IAChB,UAAU,MAAM;AAAA,IAChB,gBAAgB,MAAM;AAAA,IACtB,UAAU,MAAM;AAAA,IAChB,UAAU,MAAM;AAAA,IAChB,UAAU,MAAM;AAAA,IAChB,UAAU,MAAM,OAAO;AAAA,IACvB,eAAe,UAAU;AAAA,IACzB,eAAe,UAAU,iBAAiB;AAAA,IAC1C,aAAa,OAAO;AAAA,IACpB,KAAK,uBAAuB,YAAY;AAAA,IACxC,SAAS;AAAA,IACT,iBAAiB;AAAA,EACnB,CAAC;AACD,QAAM,GAAG,cAAc,OAAO,OAAO;AACnC,UAAM,GAAG,QAAQ,UAAU,EAAE,MAAM;AAAA,EACrC,CAAC;AAED,MAAI,MAAM,YAAY;AACpB,UAAM,oBAAoB;AAAA,MACxB,YAAY,MAAM;AAAA,MAClB,QAAQ;AAAA,MACR,QAAQ;AAAA,MACR,aAAa;AAAA,QACX,IAAI,WAAW;AAAA,QACf,gBAAgB,WAAW,kBAAkB;AAAA,QAC7C,UAAU,WAAW,YAAY;AAAA,MACnC;AAAA,MACA,QAAQ;AAAA,MACR,SAAS;AAAA,IACX,CAAC;AAAA,EACH;AAEA,SAAO;AAAA,IACL,IAAI;AAAA,IACJ,UAAU,MAAM;AAAA,IAChB,UAAU,MAAM;AAAA,IAChB,UAAU,MAAM,OAAO;AAAA,IACvB,KAAK,WAAW;AAAA,EAClB;AACF;",
   "names": []
 }

package/dist/modules/attachments/lib/partitions.js

@@ -2,6 +2,7 @@ import { AttachmentPartition } from "../data/entities.js";
 import { resolveDefaultAttachmentOcrEnabled } from "./ocrConfig.js";
 import { parseBooleanToken } from "@open-mercato/shared/lib/boolean";
 import { E } from "../../../generated/entities.ids.generated.js";
+import { getDeclaredAttachmentAccessRequirements } from "./access-protection.js";
 const DEFAULT_ATTACHMENT_PARTITIONS = [
   {
     code: "productsMedia",
@@ -30,7 +31,6 @@ async function ensureDefaultPartitions(em) {
   const existing = await repo.findAll({ fields: ["code"] });
   const existingCodes = new Set(existing.map((entry) => entry.code));
   const pending = DEFAULT_ATTACHMENT_PARTITIONS.filter((seed) => !existingCodes.has(seed.code));
-  if (!pending.length) return;
   for (const seed of pending) {
     const record = repo.create({
       code: seed.code,
@@ -38,11 +38,12 @@ async function ensureDefaultPartitions(em) {
       description: seed.description ?? null,
       storageDriver: "local",
       isPublic: seed.isPublic ?? false,
+      accessResolverRequirements: getDeclaredAttachmentAccessRequirements(seed.code),
       requiresOcr: resolveDefaultAttachmentOcrEnabled()
     });
     em.persist(record);
   }
-  await em.flush();
+  if (pending.length) await em.flush();
 }
 function sanitizePartitionCode(input) {
   const trimmed = input.trim();

package/dist/modules/attachments/lib/partitions.js.map

@@ -1,7 +1,7 @@
 {
   "version": 3,
   "sources": ["../../../../src/modules/attachments/lib/partitions.ts"],
-  "sourcesContent": ["import type { EntityManager } from '@mikro-orm/postgresql'\nimport { AttachmentPartition } from '../data/entities'\nimport { resolveDefaultAttachmentOcrEnabled } from './ocrConfig'\nimport { parseBooleanToken } from '@open-mercato/shared/lib/boolean'\nimport { E } from '#generated/entities.ids.generated'\n\nexport type AttachmentPartitionSeed = {\n  code: string\n  title: string\n  description?: string | null\n  isPublic?: boolean\n}\n\nexport const DEFAULT_ATTACHMENT_PARTITIONS: AttachmentPartitionSeed[] = [\n  {\n    code: 'productsMedia',\n    title: 'Products media',\n    description: 'Public media uploaded for catalog products.',\n    isPublic: true,\n  },\n  {\n    code: 'privateAttachments',\n    title: 'Private attachments',\n    description: 'Internal attachments scoped to tenants and organizations.',\n    isPublic: false,\n  },\n]\n\nconst PRODUCT_MEDIA_ENTITY_IDS = new Set<string>(\n  [(E as any).catalog?.catalog_product].filter(Boolean) as string[]\n)\n\nconst FALLBACK_PARTITION = 'privateAttachments'\n\nexport function resolveDefaultPartitionCode(entityId: string | null | undefined): string {\n  if (!entityId) return FALLBACK_PARTITION\n  if (PRODUCT_MEDIA_ENTITY_IDS.has(entityId)) return 'productsMedia'\n  return FALLBACK_PARTITION\n}\n\nexport async function ensureDefaultPartitions(em: EntityManager): Promise<void> {\n  const repo = em.getRepository(AttachmentPartition)\n  const existing = await repo.findAll({ fields: ['code'] })\n  const existingCodes = new Set(existing.map((entry) => entry.code))\n  const pending = DEFAULT_ATTACHMENT_PARTITIONS.filter((seed) => !existingCodes.has(seed.code))\n  if (!pending.length) return\n  for (const seed of pending) {\n    const record = repo.create({\n      code: seed.code,\n      title: seed.title,\n      description: seed.description ?? null,\n      storageDriver: 'local',\n      isPublic: seed.isPublic ?? false,\n      requiresOcr: resolveDefaultAttachmentOcrEnabled(),\n    })\n    em.persist(record)\n  }\n  await em.flush()\n}\n\nexport function sanitizePartitionCode(input: string): string {\n  const trimmed = input.trim()\n  const normalized = trimmed.replace(/[^a-zA-Z0-9_-]/g, '')\n  return normalized\n}\n\nexport function isPartitionSettingsLocked(): boolean {\n  const demoModeParsed = parseBooleanToken(process.env.DEMO_MODE ?? '')\n  const demoModeEnabled = demoModeParsed === false ? false : true\n  const onboardingEnabled = parseBooleanToken(process.env.SELF_SERVICE_ONBOARDING_ENABLED ?? '') === true\n  return demoModeEnabled || onboardingEnabled\n}\n"],
-  "mappings": "AACA,SAAS,2BAA2B;AACpC,SAAS,0CAA0C;AACnD,SAAS,yBAAyB;AAClC,SAAS,SAAS;AASX,MAAM,gCAA2D;AAAA,EACtE;AAAA,IACE,MAAM;AAAA,IACN,OAAO;AAAA,IACP,aAAa;AAAA,IACb,UAAU;AAAA,EACZ;AAAA,EACA;AAAA,IACE,MAAM;AAAA,IACN,OAAO;AAAA,IACP,aAAa;AAAA,IACb,UAAU;AAAA,EACZ;AACF;AAEA,MAAM,2BAA2B,IAAI;AAAA,EACnC,CAAE,EAAU,SAAS,eAAe,EAAE,OAAO,OAAO;AACtD;AAEA,MAAM,qBAAqB;AAEpB,SAAS,4BAA4B,UAA6C;AACvF,MAAI,CAAC,SAAU,QAAO;AACtB,MAAI,yBAAyB,IAAI,QAAQ,EAAG,QAAO;AACnD,SAAO;AACT;AAEA,eAAsB,wBAAwB,IAAkC;AAC9E,QAAM,OAAO,GAAG,cAAc,mBAAmB;AACjD,QAAM,WAAW,MAAM,KAAK,QAAQ,EAAE,QAAQ,CAAC,MAAM,EAAE,CAAC;AACxD,QAAM,gBAAgB,IAAI,IAAI,SAAS,IAAI,CAAC,UAAU,MAAM,IAAI,CAAC;AACjE,QAAM,UAAU,8BAA8B,OAAO,CAAC,SAAS,CAAC,cAAc,IAAI,KAAK,IAAI,CAAC;AAC5F,MAAI,CAAC,QAAQ,OAAQ;AACrB,aAAW,QAAQ,SAAS;AAC1B,UAAM,SAAS,KAAK,OAAO;AAAA,MACzB,MAAM,KAAK;AAAA,MACX,OAAO,KAAK;AAAA,MACZ,aAAa,KAAK,eAAe;AAAA,MACjC,eAAe;AAAA,MACf,UAAU,KAAK,YAAY;AAAA,MAC3B,aAAa,mCAAmC;AAAA,IAClD,CAAC;AACD,OAAG,QAAQ,MAAM;AAAA,EACnB;AACA,QAAM,GAAG,MAAM;AACjB;AAEO,SAAS,sBAAsB,OAAuB;AAC3D,QAAM,UAAU,MAAM,KAAK;AAC3B,QAAM,aAAa,QAAQ,QAAQ,mBAAmB,EAAE;AACxD,SAAO;AACT;AAEO,SAAS,4BAAqC;AACnD,QAAM,iBAAiB,kBAAkB,QAAQ,IAAI,aAAa,EAAE;AACpE,QAAM,kBAAkB,mBAAmB,QAAQ,QAAQ;AAC3D,QAAM,oBAAoB,kBAAkB,QAAQ,IAAI,mCAAmC,EAAE,MAAM;AACnG,SAAO,mBAAmB;AAC5B;",
+  "sourcesContent": ["import type { EntityManager } from '@mikro-orm/postgresql'\nimport { AttachmentPartition } from '../data/entities'\nimport { resolveDefaultAttachmentOcrEnabled } from './ocrConfig'\nimport { parseBooleanToken } from '@open-mercato/shared/lib/boolean'\nimport { E } from '#generated/entities.ids.generated'\nimport { getDeclaredAttachmentAccessRequirements } from './access-protection'\n\nexport type AttachmentPartitionSeed = {\n  code: string\n  title: string\n  description?: string | null\n  isPublic?: boolean\n}\n\nexport const DEFAULT_ATTACHMENT_PARTITIONS: AttachmentPartitionSeed[] = [\n  {\n    code: 'productsMedia',\n    title: 'Products media',\n    description: 'Public media uploaded for catalog products.',\n    isPublic: true,\n  },\n  {\n    code: 'privateAttachments',\n    title: 'Private attachments',\n    description: 'Internal attachments scoped to tenants and organizations.',\n    isPublic: false,\n  },\n]\n\nconst PRODUCT_MEDIA_ENTITY_IDS = new Set<string>(\n  [(E as any).catalog?.catalog_product].filter(Boolean) as string[]\n)\n\nconst FALLBACK_PARTITION = 'privateAttachments'\n\nexport function resolveDefaultPartitionCode(entityId: string | null | undefined): string {\n  if (!entityId) return FALLBACK_PARTITION\n  if (PRODUCT_MEDIA_ENTITY_IDS.has(entityId)) return 'productsMedia'\n  return FALLBACK_PARTITION\n}\n\nexport async function ensureDefaultPartitions(em: EntityManager): Promise<void> {\n  const repo = em.getRepository(AttachmentPartition)\n  const existing = await repo.findAll({ fields: ['code'] })\n  const existingCodes = new Set(existing.map((entry) => entry.code))\n  const pending = DEFAULT_ATTACHMENT_PARTITIONS.filter((seed) => !existingCodes.has(seed.code))\n  for (const seed of pending) {\n    const record = repo.create({\n      code: seed.code,\n      title: seed.title,\n      description: seed.description ?? null,\n      storageDriver: 'local',\n      isPublic: seed.isPublic ?? false,\n      accessResolverRequirements: getDeclaredAttachmentAccessRequirements(seed.code),\n      requiresOcr: resolveDefaultAttachmentOcrEnabled(),\n    })\n    em.persist(record)\n  }\n  if (pending.length) await em.flush()\n}\n\nexport function sanitizePartitionCode(input: string): string {\n  const trimmed = input.trim()\n  const normalized = trimmed.replace(/[^a-zA-Z0-9_-]/g, '')\n  return normalized\n}\n\nexport function isPartitionSettingsLocked(): boolean {\n  const demoModeParsed = parseBooleanToken(process.env.DEMO_MODE ?? '')\n  const demoModeEnabled = demoModeParsed === false ? false : true\n  const onboardingEnabled = parseBooleanToken(process.env.SELF_SERVICE_ONBOARDING_ENABLED ?? '') === true\n  return demoModeEnabled || onboardingEnabled\n}\n"],
+  "mappings": "AACA,SAAS,2BAA2B;AACpC,SAAS,0CAA0C;AACnD,SAAS,yBAAyB;AAClC,SAAS,SAAS;AAClB,SAAS,+CAA+C;AASjD,MAAM,gCAA2D;AAAA,EACtE;AAAA,IACE,MAAM;AAAA,IACN,OAAO;AAAA,IACP,aAAa;AAAA,IACb,UAAU;AAAA,EACZ;AAAA,EACA;AAAA,IACE,MAAM;AAAA,IACN,OAAO;AAAA,IACP,aAAa;AAAA,IACb,UAAU;AAAA,EACZ;AACF;AAEA,MAAM,2BAA2B,IAAI;AAAA,EACnC,CAAE,EAAU,SAAS,eAAe,EAAE,OAAO,OAAO;AACtD;AAEA,MAAM,qBAAqB;AAEpB,SAAS,4BAA4B,UAA6C;AACvF,MAAI,CAAC,SAAU,QAAO;AACtB,MAAI,yBAAyB,IAAI,QAAQ,EAAG,QAAO;AACnD,SAAO;AACT;AAEA,eAAsB,wBAAwB,IAAkC;AAC9E,QAAM,OAAO,GAAG,cAAc,mBAAmB;AACjD,QAAM,WAAW,MAAM,KAAK,QAAQ,EAAE,QAAQ,CAAC,MAAM,EAAE,CAAC;AACxD,QAAM,gBAAgB,IAAI,IAAI,SAAS,IAAI,CAAC,UAAU,MAAM,IAAI,CAAC;AACjE,QAAM,UAAU,8BAA8B,OAAO,CAAC,SAAS,CAAC,cAAc,IAAI,KAAK,IAAI,CAAC;AAC5F,aAAW,QAAQ,SAAS;AAC1B,UAAM,SAAS,KAAK,OAAO;AAAA,MACzB,MAAM,KAAK;AAAA,MACX,OAAO,KAAK;AAAA,MACZ,aAAa,KAAK,eAAe;AAAA,MACjC,eAAe;AAAA,MACf,UAAU,KAAK,YAAY;AAAA,MAC3B,4BAA4B,wCAAwC,KAAK,IAAI;AAAA,MAC7E,aAAa,mCAAmC;AAAA,IAClD,CAAC;AACD,OAAG,QAAQ,MAAM;AAAA,EACnB;AACA,MAAI,QAAQ,OAAQ,OAAM,GAAG,MAAM;AACrC;AAEO,SAAS,sBAAsB,OAAuB;AAC3D,QAAM,UAAU,MAAM,KAAK;AAC3B,QAAM,aAAa,QAAQ,QAAQ,mBAAmB,EAAE;AACxD,SAAO;AACT;AAEO,SAAS,4BAAqC;AACnD,QAAM,iBAAiB,kBAAkB,QAAQ,IAAI,aAAa,EAAE;AACpE,QAAM,kBAAkB,mBAAmB,QAAQ,QAAQ;AAC3D,QAAM,oBAAoB,kBAAkB,QAAQ,IAAI,mCAAmC,EAAE,MAAM;AACnG,SAAO,mBAAmB;AAC5B;",
   "names": []
 }

package/dist/modules/attachments/lib/scoped-upload-service.js

@@ -6,6 +6,7 @@ import { createLogger } from "@open-mercato/shared/lib/logger";
 import { Attachment, AttachmentPartition } from "../data/entities.js";
 import { attachmentCrudEvents, attachmentCrudIndexer } from "./crud.js";
 import { buildAttachmentFileUrl } from "./imageUrls.js";
+import { ensureAttachmentPartitionProtection } from "./access-protection.js";
 import { ensureDefaultPartitions, resolveDefaultPartitionCode } from "./partitions.js";
 import { extractAttachmentContent } from "./textExtraction.js";
 import { requestOcrProcessing } from "./ocrQueue.js";
@@ -66,6 +67,7 @@ class ScopedAttachmentUploadService {
     if (input.requirePrivatePartition && partition.isPublic) {
       throw new ScopedAttachmentUploadError("partition_unavailable", 403);
     }
+    await ensureAttachmentPartitionProtection(em, partition);
     const driver = await storageDriverFactory.resolveForPartition(partition.code, {
       tenantId: input.tenantId,
       organizationId: input.organizationId

package/dist/modules/attachments/lib/scoped-upload-service.js.map

@@ -1,7 +1,7 @@
 {
   "version": 3,
   "sources": ["../../../../src/modules/attachments/lib/scoped-upload-service.ts"],
-  "sourcesContent": ["import { randomUUID } from 'node:crypto'\nimport type { EntityManager } from '@mikro-orm/postgresql'\nimport type { DataEngine } from '@open-mercato/shared/lib/data/engine'\nimport { emitCrudSideEffects } from '@open-mercato/shared/lib/commands/helpers'\nimport { isCrudHttpError } from '@open-mercato/shared/lib/crud/errors'\nimport { createLogger } from '@open-mercato/shared/lib/logger'\nimport { Attachment, AttachmentPartition } from '../data/entities'\nimport { attachmentCrudEvents, attachmentCrudIndexer } from './crud'\nimport type { StorageDriverFactory } from './drivers'\nimport { buildAttachmentFileUrl } from './imageUrls'\nimport { ensureDefaultPartitions, resolveDefaultPartitionCode } from './partitions'\nimport { extractAttachmentContent } from './textExtraction'\nimport { requestOcrProcessing } from './ocrQueue'\nimport { OcrService, shouldUseLlmOcr } from './ocrService'\nimport { assertAttachmentScopeInvariant } from './access'\nimport {\n  mergeAttachmentMetadata,\n  upsertAssignment,\n  type AttachmentAssignment,\n} from './metadata'\nimport {\n  detectAttachmentMimeType,\n  hasDangerousExecutableExtension,\n  isActiveContentAttachment,\n  sanitizeUploadedFileName,\n} from './security'\nimport { resolveAttachmentMaxBytes } from './upload-limits'\nimport type { AttachmentQuotaService } from './quota-service'\n\nconst logger = createLogger('attachments')\n\nexport type ScopedAttachmentUploadErrorCode =\n  | 'dangerous_executable'\n  | 'max_upload_size'\n  | 'active_content'\n  | 'partition_unavailable'\n  | 'quota_exceeded'\n  | 'quota_target_exists'\n  | 'quota_unavailable'\n  | 'quota_recovery_unsupported'\n  | 'storage_failed'\n  | 'persistence_failed'\n\n// Use Symbol.for so the marker survives module duplication across bundle\n// boundaries. The production build emits this module into several server\n// chunks, so a consumer's `instanceof` compares against a different copy of the\n// class than the DI-resolved service threw from: the check silently fails, the\n// error escapes the caller's catch, and a deliberate 400/413 surfaces as a 500.\nconst SCOPED_ATTACHMENT_UPLOAD_ERROR_MARKER = Symbol.for('@open-mercato/ScopedAttachmentUploadError')\n\nexport class ScopedAttachmentUploadError extends Error {\n  readonly [SCOPED_ATTACHMENT_UPLOAD_ERROR_MARKER] = true\n\n  constructor(\n    public readonly code: ScopedAttachmentUploadErrorCode,\n    public readonly status: number,\n  ) {\n    super(code)\n    this.name = 'ScopedAttachmentUploadError'\n  }\n}\n\n/**\n * Bundle-safe check for `ScopedAttachmentUploadError`. Prefer this over\n * `instanceof` at every call site \u2014 the class is duplicated across server\n * chunks, so `instanceof` is only reliable inside this module.\n */\nexport function isScopedAttachmentUploadError(error: unknown): error is ScopedAttachmentUploadError {\n  return Boolean(error)\n    && typeof error === 'object'\n    && (error as Record<symbol, unknown>)[SCOPED_ATTACHMENT_UPLOAD_ERROR_MARKER] === true\n}\n\nexport type ScopedAttachmentUploadInput = {\n  tenantId: string\n  organizationId: string\n  entityId: string\n  recordId: string\n  fileName: string\n  declaredMimeType?: string | null\n  buffer: Buffer\n  tags?: string[]\n  assignments?: AttachmentAssignment[]\n  partitionCode?: string | null\n  maxBytes?: number\n  /**\n   * Reject a partition flagged public, so a module-owned upload (documents,\n   * warranty claims) never lands where an anonymous reader can reach it. The\n   * tenant/organization half of that guarantee is not this flag's job: the\n   * partition lookup below already matches only a global partition or one owned\n   * by this tenant and organization, whether or not the flag is set.\n   */\n  requirePrivatePartition?: boolean\n  /**\n   * Persists a module-owned link row inside the same transaction as the\n   * Attachment, so a link failure cannot leave a committed orphan attachment.\n   * The callback receives only the generated id, never the entity or the\n   * storage implementation.\n   */\n  persistLink?: (tx: EntityManager, attachmentId: string) => Promise<void> | void\n}\n\ntype QuotaRecoveryScheduler = (\n  payload: { reservationId: string; tenantId: string; organizationId: string },\n  delayMs: number,\n) => Promise<void>\n\nexport class ScopedAttachmentUploadService {\n  constructor(private readonly deps: {\n    em: EntityManager\n    dataEngine?: DataEngine | null\n    storageDriverFactory: StorageDriverFactory\n    attachmentQuotaService: AttachmentQuotaService\n    attachmentQuotaRecoveryScheduler: QuotaRecoveryScheduler\n  }) {}\n\n  async upload(input: ScopedAttachmentUploadInput): Promise<Attachment> {\n    const safeName = sanitizeUploadedFileName(input.fileName)\n    if (hasDangerousExecutableExtension(safeName)) {\n      throw new ScopedAttachmentUploadError('dangerous_executable', 400)\n    }\n    if (input.buffer.length > (input.maxBytes ?? resolveAttachmentMaxBytes())) {\n      throw new ScopedAttachmentUploadError('max_upload_size', 413)\n    }\n    const mimeType = detectAttachmentMimeType(input.buffer, safeName, input.declaredMimeType ?? '')\n    if (isActiveContentAttachment(input.buffer, safeName, mimeType)) {\n      throw new ScopedAttachmentUploadError('active_content', 400)\n    }\n\n    const { em, storageDriverFactory, attachmentQuotaService, attachmentQuotaRecoveryScheduler } = this.deps\n    await ensureDefaultPartitions(em)\n    const partitionCode = input.partitionCode ?? resolveDefaultPartitionCode(input.entityId)\n    const partition = await em.findOne(AttachmentPartition, {\n      code: partitionCode,\n      $or: [\n        { tenantId: null, organizationId: null },\n        { tenantId: input.tenantId, organizationId: input.organizationId },\n      ],\n    })\n    if (!partition) throw new ScopedAttachmentUploadError('partition_unavailable', 400)\n    if (input.requirePrivatePartition && partition.isPublic) {\n      throw new ScopedAttachmentUploadError('partition_unavailable', 403)\n    }\n\n    const driver = await storageDriverFactory.resolveForPartition(partition.code, {\n      tenantId: input.tenantId,\n      organizationId: input.organizationId,\n    })\n    const preparedStoragePath = driver.prepareStoragePath?.({\n      partitionCode: partition.code,\n      orgId: input.organizationId,\n      tenantId: input.tenantId,\n      fileName: safeName,\n    })\n    if (!preparedStoragePath) {\n      throw new ScopedAttachmentUploadError('quota_recovery_unsupported', 500)\n    }\n\n    let reservation: { id: string; leaseToken: string; expiresAt: Date } | null = null\n    try {\n      reservation = await attachmentQuotaService.reserve({\n        tenantId: input.tenantId,\n        organizationId: input.organizationId,\n        bytes: input.buffer.length,\n        source: 'attachment',\n        storageDriver: driver.key,\n        storagePath: preparedStoragePath,\n        partitionCode: partition.code,\n      })\n      await attachmentQuotaRecoveryScheduler({\n        reservationId: reservation.id,\n        tenantId: input.tenantId,\n        organizationId: input.organizationId,\n      }, Math.max(1_000, reservation.expiresAt.getTime() - Date.now()))\n      await attachmentQuotaService.beginStorage(reservation.id, reservation.leaseToken)\n    } catch (error) {\n      if (reservation) {\n        await attachmentQuotaService.release(reservation.id, reservation.leaseToken).catch(() => undefined)\n      }\n      const code = (error as { code?: unknown })?.code\n      if (code === 'quota_exceeded') throw new ScopedAttachmentUploadError('quota_exceeded', 413)\n      if (code === 'quota_target_exists') throw new ScopedAttachmentUploadError('quota_target_exists', 409)\n      throw new ScopedAttachmentUploadError('quota_unavailable', 500)\n    }\n\n    if (!reservation) throw new ScopedAttachmentUploadError('quota_unavailable', 500)\n\n    let storedPath = preparedStoragePath\n    try {\n      const stored = await driver.store({\n        partitionCode: partition.code,\n        orgId: input.organizationId,\n        tenantId: input.tenantId,\n        fileName: safeName,\n        buffer: input.buffer,\n        storagePath: preparedStoragePath,\n      })\n      storedPath = stored.storagePath\n      await attachmentQuotaService.markStored(reservation.id, reservation.leaseToken)\n    } catch (error) {\n      await this.compensateStorage(driver, partition.code, storedPath, reservation)\n      logger.error('Scoped attachment storage failed', { err: error })\n      throw new ScopedAttachmentUploadError('storage_failed', 500)\n    }\n\n    let extractedContent: string | null = null\n    const wantsLlmOcr = partition.requiresOcr && shouldUseLlmOcr(mimeType, safeName)\n    const ocrService = wantsLlmOcr ? new OcrService() : null\n    const useLlmOcr = Boolean(wantsLlmOcr && ocrService?.available)\n    if (partition.requiresOcr && !useLlmOcr) {\n      try {\n        const { filePath, cleanup } = await driver.toLocalPath(partition.code, storedPath)\n        try {\n          extractedContent = await extractAttachmentContent({ filePath, mimeType })\n        } finally {\n          await cleanup().catch(() => undefined)\n        }\n      } catch (error) {\n        logger.error('Scoped attachment text extraction failed', { err: error })\n      }\n    }\n\n    let assignments = input.assignments?.slice() ?? []\n    assignments = upsertAssignment(assignments, { type: input.entityId, id: input.recordId })\n    const metadata = mergeAttachmentMetadata(null, {\n      assignments,\n      tags: input.tags ?? [],\n    })\n    const attachmentId = randomUUID()\n    let attachment!: Attachment\n\n    try {\n      await em.transactional(async (tx) => {\n        attachment = tx.create(Attachment, {\n          id: attachmentId,\n          entityId: input.entityId,\n          recordId: input.recordId,\n          organizationId: input.organizationId,\n          tenantId: input.tenantId,\n          fileName: safeName,\n          mimeType,\n          fileSize: input.buffer.length,\n          partitionCode: partition.code,\n          storageDriver: partition.storageDriver || 'local',\n          storagePath: storedPath,\n          url: buildAttachmentFileUrl(attachmentId),\n          content: extractedContent,\n          storageMetadata: metadata,\n        })\n        assertAttachmentScopeInvariant({ tenantId: attachment.tenantId, organizationId: attachment.organizationId })\n        await tx.persist(attachment).flush()\n        await input.persistLink?.(tx, attachmentId)\n        await attachmentQuotaService.completeAttachment(reservation.id, reservation.leaseToken, tx)\n      })\n    } catch (error) {\n      await this.compensateStorage(driver, partition.code, storedPath, reservation)\n      logger.error('Scoped attachment persistence failed', { err: error })\n      // `persistLink` is where callers run their own authorization (the\n      // documents module re-checks the edit capability inside this\n      // transaction), so a deliberate HTTP error from it must reach the route\n      // with its own status. Flattening it to 500 turns a documented 403 into\n      // an apparent server fault.\n      if (isCrudHttpError(error)) throw error\n      throw new ScopedAttachmentUploadError('persistence_failed', 500)\n    }\n\n    if (useLlmOcr) {\n      try {\n        await requestOcrProcessing(em, attachment, driver, storedPath)\n      } catch (error) {\n        logger.error('Scoped attachment OCR scheduling failed', { err: error })\n      }\n    }\n    if (this.deps.dataEngine) {\n      await emitCrudSideEffects({\n        dataEngine: this.deps.dataEngine,\n        action: 'created',\n        entity: attachment,\n        identifiers: {\n          id: attachment.id,\n          organizationId: attachment.organizationId ?? null,\n          tenantId: attachment.tenantId ?? null,\n        },\n        events: attachmentCrudEvents,\n        indexer: attachmentCrudIndexer,\n      })\n      await this.deps.dataEngine.flushOrmEntityChanges()\n    }\n    return attachment\n  }\n\n  private async compensateStorage(\n    driver: Awaited<ReturnType<StorageDriverFactory['resolveForPartition']>>,\n    partitionCode: string,\n    storagePath: string,\n    reservation: { id: string; leaseToken: string },\n  ): Promise<void> {\n    try {\n      await (driver.deleteStrict?.(partitionCode, storagePath) ?? driver.delete(partitionCode, storagePath))\n      await this.deps.attachmentQuotaService.release(reservation.id, reservation.leaseToken)\n    } catch (error) {\n      logger.error('Scoped attachment compensation failed', { err: error })\n    }\n  }\n}\n"],
-  "mappings": "AAAA;AAAA,SAAS,kBAAkB;AAG3B,SAAS,2BAA2B;AACpC,SAAS,uBAAuB;AAChC,SAAS,oBAAoB;AAC7B,SAAS,YAAY,2BAA2B;AAChD,SAAS,sBAAsB,6BAA6B;AAE5D,SAAS,8BAA8B;AACvC,SAAS,yBAAyB,mCAAmC;AACrE,SAAS,gCAAgC;AACzC,SAAS,4BAA4B;AACrC,SAAS,YAAY,uBAAuB;AAC5C,SAAS,sCAAsC;AAC/C;AAAA,EACE;AAAA,EACA;AAAA,OAEK;AACP;AAAA,EACE;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,OACK;AACP,SAAS,iCAAiC;AAG1C,MAAM,SAAS,aAAa,aAAa;AAmBzC,MAAM,wCAAwC,uBAAO,IAAI,2CAA2C;AAE7F,MAAM,qCAAoC,YACrC,4CADqC,IAAM;AAAA,EAGrD,YACkB,MACA,QAChB;AACA,UAAM,IAAI;AAHM;AACA;AAJlB,SAAU,MAAyC;AAOjD,SAAK,OAAO;AAAA,EACd;AACF;AAOO,SAAS,8BAA8B,OAAsD;AAClG,SAAO,QAAQ,KAAK,KACf,OAAO,UAAU,YAChB,MAAkC,qCAAqC,MAAM;AACrF;AAoCO,MAAM,8BAA8B;AAAA,EACzC,YAA6B,MAM1B;AAN0B;AAAA,EAMzB;AAAA,EAEJ,MAAM,OAAO,OAAyD;AACpE,UAAM,WAAW,yBAAyB,MAAM,QAAQ;AACxD,QAAI,gCAAgC,QAAQ,GAAG;AAC7C,YAAM,IAAI,4BAA4B,wBAAwB,GAAG;AAAA,IACnE;AACA,QAAI,MAAM,OAAO,UAAU,MAAM,YAAY,0BAA0B,IAAI;AACzE,YAAM,IAAI,4BAA4B,mBAAmB,GAAG;AAAA,IAC9D;AACA,UAAM,WAAW,yBAAyB,MAAM,QAAQ,UAAU,MAAM,oBAAoB,EAAE;AAC9F,QAAI,0BAA0B,MAAM,QAAQ,UAAU,QAAQ,GAAG;AAC/D,YAAM,IAAI,4BAA4B,kBAAkB,GAAG;AAAA,IAC7D;AAEA,UAAM,EAAE,IAAI,sBAAsB,wBAAwB,iCAAiC,IAAI,KAAK;AACpG,UAAM,wBAAwB,EAAE;AAChC,UAAM,gBAAgB,MAAM,iBAAiB,4BAA4B,MAAM,QAAQ;AACvF,UAAM,YAAY,MAAM,GAAG,QAAQ,qBAAqB;AAAA,MACtD,MAAM;AAAA,MACN,KAAK;AAAA,QACH,EAAE,UAAU,MAAM,gBAAgB,KAAK;AAAA,QACvC,EAAE,UAAU,MAAM,UAAU,gBAAgB,MAAM,eAAe;AAAA,MACnE;AAAA,IACF,CAAC;AACD,QAAI,CAAC,UAAW,OAAM,IAAI,4BAA4B,yBAAyB,GAAG;AAClF,QAAI,MAAM,2BAA2B,UAAU,UAAU;AACvD,YAAM,IAAI,4BAA4B,yBAAyB,GAAG;AAAA,IACpE;AAEA,UAAM,SAAS,MAAM,qBAAqB,oBAAoB,UAAU,MAAM;AAAA,MAC5E,UAAU,MAAM;AAAA,MAChB,gBAAgB,MAAM;AAAA,IACxB,CAAC;AACD,UAAM,sBAAsB,OAAO,qBAAqB;AAAA,MACtD,eAAe,UAAU;AAAA,MACzB,OAAO,MAAM;AAAA,MACb,UAAU,MAAM;AAAA,MAChB,UAAU;AAAA,IACZ,CAAC;AACD,QAAI,CAAC,qBAAqB;AACxB,YAAM,IAAI,4BAA4B,8BAA8B,GAAG;AAAA,IACzE;AAEA,QAAI,cAA0E;AAC9E,QAAI;AACF,oBAAc,MAAM,uBAAuB,QAAQ;AAAA,QACjD,UAAU,MAAM;AAAA,QAChB,gBAAgB,MAAM;AAAA,QACtB,OAAO,MAAM,OAAO;AAAA,QACpB,QAAQ;AAAA,QACR,eAAe,OAAO;AAAA,QACtB,aAAa;AAAA,QACb,eAAe,UAAU;AAAA,MAC3B,CAAC;AACD,YAAM,iCAAiC;AAAA,QACrC,eAAe,YAAY;AAAA,QAC3B,UAAU,MAAM;AAAA,QAChB,gBAAgB,MAAM;AAAA,MACxB,GAAG,KAAK,IAAI,KAAO,YAAY,UAAU,QAAQ,IAAI,KAAK,IAAI,CAAC,CAAC;AAChE,YAAM,uBAAuB,aAAa,YAAY,IAAI,YAAY,UAAU;AAAA,IAClF,SAAS,OAAO;AACd,UAAI,aAAa;AACf,cAAM,uBAAuB,QAAQ,YAAY,IAAI,YAAY,UAAU,EAAE,MAAM,MAAM,MAAS;AAAA,MACpG;AACA,YAAM,OAAQ,OAA8B;AAC5C,UAAI,SAAS,iBAAkB,OAAM,IAAI,4BAA4B,kBAAkB,GAAG;AAC1F,UAAI,SAAS,sBAAuB,OAAM,IAAI,4BAA4B,uBAAuB,GAAG;AACpG,YAAM,IAAI,4BAA4B,qBAAqB,GAAG;AAAA,IAChE;AAEA,QAAI,CAAC,YAAa,OAAM,IAAI,4BAA4B,qBAAqB,GAAG;AAEhF,QAAI,aAAa;AACjB,QAAI;AACF,YAAM,SAAS,MAAM,OAAO,MAAM;AAAA,QAChC,eAAe,UAAU;AAAA,QACzB,OAAO,MAAM;AAAA,QACb,UAAU,MAAM;AAAA,QAChB,UAAU;AAAA,QACV,QAAQ,MAAM;AAAA,QACd,aAAa;AAAA,MACf,CAAC;AACD,mBAAa,OAAO;AACpB,YAAM,uBAAuB,WAAW,YAAY,IAAI,YAAY,UAAU;AAAA,IAChF,SAAS,OAAO;AACd,YAAM,KAAK,kBAAkB,QAAQ,UAAU,MAAM,YAAY,WAAW;AAC5E,aAAO,MAAM,oCAAoC,EAAE,KAAK,MAAM,CAAC;AAC/D,YAAM,IAAI,4BAA4B,kBAAkB,GAAG;AAAA,IAC7D;AAEA,QAAI,mBAAkC;AACtC,UAAM,cAAc,UAAU,eAAe,gBAAgB,UAAU,QAAQ;AAC/E,UAAM,aAAa,cAAc,IAAI,WAAW,IAAI;AACpD,UAAM,YAAY,QAAQ,eAAe,YAAY,SAAS;AAC9D,QAAI,UAAU,eAAe,CAAC,WAAW;AACvC,UAAI;AACF,cAAM,EAAE,UAAU,QAAQ,IAAI,MAAM,OAAO,YAAY,UAAU,MAAM,UAAU;AACjF,YAAI;AACF,6BAAmB,MAAM,yBAAyB,EAAE,UAAU,SAAS,CAAC;AAAA,QAC1E,UAAE;AACA,gBAAM,QAAQ,EAAE,MAAM,MAAM,MAAS;AAAA,QACvC;AAAA,MACF,SAAS,OAAO;AACd,eAAO,MAAM,4CAA4C,EAAE,KAAK,MAAM,CAAC;AAAA,MACzE;AAAA,IACF;AAEA,QAAI,cAAc,MAAM,aAAa,MAAM,KAAK,CAAC;AACjD,kBAAc,iBAAiB,aAAa,EAAE,MAAM,MAAM,UAAU,IAAI,MAAM,SAAS,CAAC;AACxF,UAAM,WAAW,wBAAwB,MAAM;AAAA,MAC7C;AAAA,MACA,MAAM,MAAM,QAAQ,CAAC;AAAA,IACvB,CAAC;AACD,UAAM,eAAe,WAAW;AAChC,QAAI;AAEJ,QAAI;AACF,YAAM,GAAG,cAAc,OAAO,OAAO;AACnC,qBAAa,GAAG,OAAO,YAAY;AAAA,UACjC,IAAI;AAAA,UACJ,UAAU,MAAM;AAAA,UAChB,UAAU,MAAM;AAAA,UAChB,gBAAgB,MAAM;AAAA,UACtB,UAAU,MAAM;AAAA,UAChB,UAAU;AAAA,UACV;AAAA,UACA,UAAU,MAAM,OAAO;AAAA,UACvB,eAAe,UAAU;AAAA,UACzB,eAAe,UAAU,iBAAiB;AAAA,UAC1C,aAAa;AAAA,UACb,KAAK,uBAAuB,YAAY;AAAA,UACxC,SAAS;AAAA,UACT,iBAAiB;AAAA,QACnB,CAAC;AACD,uCAA+B,EAAE,UAAU,WAAW,UAAU,gBAAgB,WAAW,eAAe,CAAC;AAC3G,cAAM,GAAG,QAAQ,UAAU,EAAE,MAAM;AACnC,cAAM,MAAM,cAAc,IAAI,YAAY;AAC1C,cAAM,uBAAuB,mBAAmB,YAAY,IAAI,YAAY,YAAY,EAAE;AAAA,MAC5F,CAAC;AAAA,IACH,SAAS,OAAO;AACd,YAAM,KAAK,kBAAkB,QAAQ,UAAU,MAAM,YAAY,WAAW;AAC5E,aAAO,MAAM,wCAAwC,EAAE,KAAK,MAAM,CAAC;AAMnE,UAAI,gBAAgB,KAAK,EAAG,OAAM;AAClC,YAAM,IAAI,4BAA4B,sBAAsB,GAAG;AAAA,IACjE;AAEA,QAAI,WAAW;AACb,UAAI;AACF,cAAM,qBAAqB,IAAI,YAAY,QAAQ,UAAU;AAAA,MAC/D,SAAS,OAAO;AACd,eAAO,MAAM,2CAA2C,EAAE,KAAK,MAAM,CAAC;AAAA,MACxE;AAAA,IACF;AACA,QAAI,KAAK,KAAK,YAAY;AACxB,YAAM,oBAAoB;AAAA,QACxB,YAAY,KAAK,KAAK;AAAA,QACtB,QAAQ;AAAA,QACR,QAAQ;AAAA,QACR,aAAa;AAAA,UACX,IAAI,WAAW;AAAA,UACf,gBAAgB,WAAW,kBAAkB;AAAA,UAC7C,UAAU,WAAW,YAAY;AAAA,QACnC;AAAA,QACA,QAAQ;AAAA,QACR,SAAS;AAAA,MACX,CAAC;AACD,YAAM,KAAK,KAAK,WAAW,sBAAsB;AAAA,IACnD;AACA,WAAO;AAAA,EACT;AAAA,EAEA,MAAc,kBACZ,QACA,eACA,aACA,aACe;AACf,QAAI;AACF,aAAO,OAAO,eAAe,eAAe,WAAW,KAAK,OAAO,OAAO,eAAe,WAAW;AACpG,YAAM,KAAK,KAAK,uBAAuB,QAAQ,YAAY,IAAI,YAAY,UAAU;AAAA,IACvF,SAAS,OAAO;AACd,aAAO,MAAM,yCAAyC,EAAE,KAAK,MAAM,CAAC;AAAA,IACtE;AAAA,EACF;AACF;",
+  "sourcesContent": ["import { randomUUID } from 'node:crypto'\nimport type { EntityManager } from '@mikro-orm/postgresql'\nimport type { DataEngine } from '@open-mercato/shared/lib/data/engine'\nimport { emitCrudSideEffects } from '@open-mercato/shared/lib/commands/helpers'\nimport { isCrudHttpError } from '@open-mercato/shared/lib/crud/errors'\nimport { createLogger } from '@open-mercato/shared/lib/logger'\nimport { Attachment, AttachmentPartition } from '../data/entities'\nimport { attachmentCrudEvents, attachmentCrudIndexer } from './crud'\nimport type { StorageDriverFactory } from './drivers'\nimport { buildAttachmentFileUrl } from './imageUrls'\nimport { ensureAttachmentPartitionProtection } from './access-protection'\nimport { ensureDefaultPartitions, resolveDefaultPartitionCode } from './partitions'\nimport { extractAttachmentContent } from './textExtraction'\nimport { requestOcrProcessing } from './ocrQueue'\nimport { OcrService, shouldUseLlmOcr } from './ocrService'\nimport { assertAttachmentScopeInvariant } from './access'\nimport {\n  mergeAttachmentMetadata,\n  upsertAssignment,\n  type AttachmentAssignment,\n} from './metadata'\nimport {\n  detectAttachmentMimeType,\n  hasDangerousExecutableExtension,\n  isActiveContentAttachment,\n  sanitizeUploadedFileName,\n} from './security'\nimport { resolveAttachmentMaxBytes } from './upload-limits'\nimport type { AttachmentQuotaService } from './quota-service'\n\nconst logger = createLogger('attachments')\n\nexport type ScopedAttachmentUploadErrorCode =\n  | 'dangerous_executable'\n  | 'max_upload_size'\n  | 'active_content'\n  | 'partition_unavailable'\n  | 'quota_exceeded'\n  | 'quota_target_exists'\n  | 'quota_unavailable'\n  | 'quota_recovery_unsupported'\n  | 'storage_failed'\n  | 'persistence_failed'\n\n// Use Symbol.for so the marker survives module duplication across bundle\n// boundaries. The production build emits this module into several server\n// chunks, so a consumer's `instanceof` compares against a different copy of the\n// class than the DI-resolved service threw from: the check silently fails, the\n// error escapes the caller's catch, and a deliberate 400/413 surfaces as a 500.\nconst SCOPED_ATTACHMENT_UPLOAD_ERROR_MARKER = Symbol.for('@open-mercato/ScopedAttachmentUploadError')\n\nexport class ScopedAttachmentUploadError extends Error {\n  readonly [SCOPED_ATTACHMENT_UPLOAD_ERROR_MARKER] = true\n\n  constructor(\n    public readonly code: ScopedAttachmentUploadErrorCode,\n    public readonly status: number,\n  ) {\n    super(code)\n    this.name = 'ScopedAttachmentUploadError'\n  }\n}\n\n/**\n * Bundle-safe check for `ScopedAttachmentUploadError`. Prefer this over\n * `instanceof` at every call site \u2014 the class is duplicated across server\n * chunks, so `instanceof` is only reliable inside this module.\n */\nexport function isScopedAttachmentUploadError(error: unknown): error is ScopedAttachmentUploadError {\n  return Boolean(error)\n    && typeof error === 'object'\n    && (error as Record<symbol, unknown>)[SCOPED_ATTACHMENT_UPLOAD_ERROR_MARKER] === true\n}\n\nexport type ScopedAttachmentUploadInput = {\n  tenantId: string\n  organizationId: string\n  entityId: string\n  recordId: string\n  fileName: string\n  declaredMimeType?: string | null\n  buffer: Buffer\n  tags?: string[]\n  assignments?: AttachmentAssignment[]\n  partitionCode?: string | null\n  maxBytes?: number\n  /**\n   * Reject a partition flagged public, so a module-owned upload (documents,\n   * warranty claims) never lands where an anonymous reader can reach it. The\n   * tenant/organization half of that guarantee is not this flag's job: the\n   * partition lookup below already matches only a global partition or one owned\n   * by this tenant and organization, whether or not the flag is set.\n   */\n  requirePrivatePartition?: boolean\n  /**\n   * Persists a module-owned link row inside the same transaction as the\n   * Attachment, so a link failure cannot leave a committed orphan attachment.\n   * The callback receives only the generated id, never the entity or the\n   * storage implementation.\n   */\n  persistLink?: (tx: EntityManager, attachmentId: string) => Promise<void> | void\n}\n\ntype QuotaRecoveryScheduler = (\n  payload: { reservationId: string; tenantId: string; organizationId: string },\n  delayMs: number,\n) => Promise<void>\n\nexport class ScopedAttachmentUploadService {\n  constructor(private readonly deps: {\n    em: EntityManager\n    dataEngine?: DataEngine | null\n    storageDriverFactory: StorageDriverFactory\n    attachmentQuotaService: AttachmentQuotaService\n    attachmentQuotaRecoveryScheduler: QuotaRecoveryScheduler\n  }) {}\n\n  async upload(input: ScopedAttachmentUploadInput): Promise<Attachment> {\n    const safeName = sanitizeUploadedFileName(input.fileName)\n    if (hasDangerousExecutableExtension(safeName)) {\n      throw new ScopedAttachmentUploadError('dangerous_executable', 400)\n    }\n    if (input.buffer.length > (input.maxBytes ?? resolveAttachmentMaxBytes())) {\n      throw new ScopedAttachmentUploadError('max_upload_size', 413)\n    }\n    const mimeType = detectAttachmentMimeType(input.buffer, safeName, input.declaredMimeType ?? '')\n    if (isActiveContentAttachment(input.buffer, safeName, mimeType)) {\n      throw new ScopedAttachmentUploadError('active_content', 400)\n    }\n\n    const { em, storageDriverFactory, attachmentQuotaService, attachmentQuotaRecoveryScheduler } = this.deps\n    await ensureDefaultPartitions(em)\n    const partitionCode = input.partitionCode ?? resolveDefaultPartitionCode(input.entityId)\n    const partition = await em.findOne(AttachmentPartition, {\n      code: partitionCode,\n      $or: [\n        { tenantId: null, organizationId: null },\n        { tenantId: input.tenantId, organizationId: input.organizationId },\n      ],\n    })\n    if (!partition) throw new ScopedAttachmentUploadError('partition_unavailable', 400)\n    if (input.requirePrivatePartition && partition.isPublic) {\n      throw new ScopedAttachmentUploadError('partition_unavailable', 403)\n    }\n\n    await ensureAttachmentPartitionProtection(em, partition)\n    const driver = await storageDriverFactory.resolveForPartition(partition.code, {\n      tenantId: input.tenantId,\n      organizationId: input.organizationId,\n    })\n    const preparedStoragePath = driver.prepareStoragePath?.({\n      partitionCode: partition.code,\n      orgId: input.organizationId,\n      tenantId: input.tenantId,\n      fileName: safeName,\n    })\n    if (!preparedStoragePath) {\n      throw new ScopedAttachmentUploadError('quota_recovery_unsupported', 500)\n    }\n\n    let reservation: { id: string; leaseToken: string; expiresAt: Date } | null = null\n    try {\n      reservation = await attachmentQuotaService.reserve({\n        tenantId: input.tenantId,\n        organizationId: input.organizationId,\n        bytes: input.buffer.length,\n        source: 'attachment',\n        storageDriver: driver.key,\n        storagePath: preparedStoragePath,\n        partitionCode: partition.code,\n      })\n      await attachmentQuotaRecoveryScheduler({\n        reservationId: reservation.id,\n        tenantId: input.tenantId,\n        organizationId: input.organizationId,\n      }, Math.max(1_000, reservation.expiresAt.getTime() - Date.now()))\n      await attachmentQuotaService.beginStorage(reservation.id, reservation.leaseToken)\n    } catch (error) {\n      if (reservation) {\n        await attachmentQuotaService.release(reservation.id, reservation.leaseToken).catch(() => undefined)\n      }\n      const code = (error as { code?: unknown })?.code\n      if (code === 'quota_exceeded') throw new ScopedAttachmentUploadError('quota_exceeded', 413)\n      if (code === 'quota_target_exists') throw new ScopedAttachmentUploadError('quota_target_exists', 409)\n      throw new ScopedAttachmentUploadError('quota_unavailable', 500)\n    }\n\n    if (!reservation) throw new ScopedAttachmentUploadError('quota_unavailable', 500)\n\n    let storedPath = preparedStoragePath\n    try {\n      const stored = await driver.store({\n        partitionCode: partition.code,\n        orgId: input.organizationId,\n        tenantId: input.tenantId,\n        fileName: safeName,\n        buffer: input.buffer,\n        storagePath: preparedStoragePath,\n      })\n      storedPath = stored.storagePath\n      await attachmentQuotaService.markStored(reservation.id, reservation.leaseToken)\n    } catch (error) {\n      await this.compensateStorage(driver, partition.code, storedPath, reservation)\n      logger.error('Scoped attachment storage failed', { err: error })\n      throw new ScopedAttachmentUploadError('storage_failed', 500)\n    }\n\n    let extractedContent: string | null = null\n    const wantsLlmOcr = partition.requiresOcr && shouldUseLlmOcr(mimeType, safeName)\n    const ocrService = wantsLlmOcr ? new OcrService() : null\n    const useLlmOcr = Boolean(wantsLlmOcr && ocrService?.available)\n    if (partition.requiresOcr && !useLlmOcr) {\n      try {\n        const { filePath, cleanup } = await driver.toLocalPath(partition.code, storedPath)\n        try {\n          extractedContent = await extractAttachmentContent({ filePath, mimeType })\n        } finally {\n          await cleanup().catch(() => undefined)\n        }\n      } catch (error) {\n        logger.error('Scoped attachment text extraction failed', { err: error })\n      }\n    }\n\n    let assignments = input.assignments?.slice() ?? []\n    assignments = upsertAssignment(assignments, { type: input.entityId, id: input.recordId })\n    const metadata = mergeAttachmentMetadata(null, {\n      assignments,\n      tags: input.tags ?? [],\n    })\n    const attachmentId = randomUUID()\n    let attachment!: Attachment\n\n    try {\n      await em.transactional(async (tx) => {\n        attachment = tx.create(Attachment, {\n          id: attachmentId,\n          entityId: input.entityId,\n          recordId: input.recordId,\n          organizationId: input.organizationId,\n          tenantId: input.tenantId,\n          fileName: safeName,\n          mimeType,\n          fileSize: input.buffer.length,\n          partitionCode: partition.code,\n          storageDriver: partition.storageDriver || 'local',\n          storagePath: storedPath,\n          url: buildAttachmentFileUrl(attachmentId),\n          content: extractedContent,\n          storageMetadata: metadata,\n        })\n        assertAttachmentScopeInvariant({ tenantId: attachment.tenantId, organizationId: attachment.organizationId })\n        await tx.persist(attachment).flush()\n        await input.persistLink?.(tx, attachmentId)\n        await attachmentQuotaService.completeAttachment(reservation.id, reservation.leaseToken, tx)\n      })\n    } catch (error) {\n      await this.compensateStorage(driver, partition.code, storedPath, reservation)\n      logger.error('Scoped attachment persistence failed', { err: error })\n      // `persistLink` is where callers run their own authorization (the\n      // documents module re-checks the edit capability inside this\n      // transaction), so a deliberate HTTP error from it must reach the route\n      // with its own status. Flattening it to 500 turns a documented 403 into\n      // an apparent server fault.\n      if (isCrudHttpError(error)) throw error\n      throw new ScopedAttachmentUploadError('persistence_failed', 500)\n    }\n\n    if (useLlmOcr) {\n      try {\n        await requestOcrProcessing(em, attachment, driver, storedPath)\n      } catch (error) {\n        logger.error('Scoped attachment OCR scheduling failed', { err: error })\n      }\n    }\n    if (this.deps.dataEngine) {\n      await emitCrudSideEffects({\n        dataEngine: this.deps.dataEngine,\n        action: 'created',\n        entity: attachment,\n        identifiers: {\n          id: attachment.id,\n          organizationId: attachment.organizationId ?? null,\n          tenantId: attachment.tenantId ?? null,\n        },\n        events: attachmentCrudEvents,\n        indexer: attachmentCrudIndexer,\n      })\n      await this.deps.dataEngine.flushOrmEntityChanges()\n    }\n    return attachment\n  }\n\n  private async compensateStorage(\n    driver: Awaited<ReturnType<StorageDriverFactory['resolveForPartition']>>,\n    partitionCode: string,\n    storagePath: string,\n    reservation: { id: string; leaseToken: string },\n  ): Promise<void> {\n    try {\n      await (driver.deleteStrict?.(partitionCode, storagePath) ?? driver.delete(partitionCode, storagePath))\n      await this.deps.attachmentQuotaService.release(reservation.id, reservation.leaseToken)\n    } catch (error) {\n      logger.error('Scoped attachment compensation failed', { err: error })\n    }\n  }\n}\n"],
+  "mappings": "AAAA;AAAA,SAAS,kBAAkB;AAG3B,SAAS,2BAA2B;AACpC,SAAS,uBAAuB;AAChC,SAAS,oBAAoB;AAC7B,SAAS,YAAY,2BAA2B;AAChD,SAAS,sBAAsB,6BAA6B;AAE5D,SAAS,8BAA8B;AACvC,SAAS,2CAA2C;AACpD,SAAS,yBAAyB,mCAAmC;AACrE,SAAS,gCAAgC;AACzC,SAAS,4BAA4B;AACrC,SAAS,YAAY,uBAAuB;AAC5C,SAAS,sCAAsC;AAC/C;AAAA,EACE;AAAA,EACA;AAAA,OAEK;AACP;AAAA,EACE;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,OACK;AACP,SAAS,iCAAiC;AAG1C,MAAM,SAAS,aAAa,aAAa;AAmBzC,MAAM,wCAAwC,uBAAO,IAAI,2CAA2C;AAE7F,MAAM,qCAAoC,YACrC,4CADqC,IAAM;AAAA,EAGrD,YACkB,MACA,QAChB;AACA,UAAM,IAAI;AAHM;AACA;AAJlB,SAAU,MAAyC;AAOjD,SAAK,OAAO;AAAA,EACd;AACF;AAOO,SAAS,8BAA8B,OAAsD;AAClG,SAAO,QAAQ,KAAK,KACf,OAAO,UAAU,YAChB,MAAkC,qCAAqC,MAAM;AACrF;AAoCO,MAAM,8BAA8B;AAAA,EACzC,YAA6B,MAM1B;AAN0B;AAAA,EAMzB;AAAA,EAEJ,MAAM,OAAO,OAAyD;AACpE,UAAM,WAAW,yBAAyB,MAAM,QAAQ;AACxD,QAAI,gCAAgC,QAAQ,GAAG;AAC7C,YAAM,IAAI,4BAA4B,wBAAwB,GAAG;AAAA,IACnE;AACA,QAAI,MAAM,OAAO,UAAU,MAAM,YAAY,0BAA0B,IAAI;AACzE,YAAM,IAAI,4BAA4B,mBAAmB,GAAG;AAAA,IAC9D;AACA,UAAM,WAAW,yBAAyB,MAAM,QAAQ,UAAU,MAAM,oBAAoB,EAAE;AAC9F,QAAI,0BAA0B,MAAM,QAAQ,UAAU,QAAQ,GAAG;AAC/D,YAAM,IAAI,4BAA4B,kBAAkB,GAAG;AAAA,IAC7D;AAEA,UAAM,EAAE,IAAI,sBAAsB,wBAAwB,iCAAiC,IAAI,KAAK;AACpG,UAAM,wBAAwB,EAAE;AAChC,UAAM,gBAAgB,MAAM,iBAAiB,4BAA4B,MAAM,QAAQ;AACvF,UAAM,YAAY,MAAM,GAAG,QAAQ,qBAAqB;AAAA,MACtD,MAAM;AAAA,MACN,KAAK;AAAA,QACH,EAAE,UAAU,MAAM,gBAAgB,KAAK;AAAA,QACvC,EAAE,UAAU,MAAM,UAAU,gBAAgB,MAAM,eAAe;AAAA,MACnE;AAAA,IACF,CAAC;AACD,QAAI,CAAC,UAAW,OAAM,IAAI,4BAA4B,yBAAyB,GAAG;AAClF,QAAI,MAAM,2BAA2B,UAAU,UAAU;AACvD,YAAM,IAAI,4BAA4B,yBAAyB,GAAG;AAAA,IACpE;AAEA,UAAM,oCAAoC,IAAI,SAAS;AACvD,UAAM,SAAS,MAAM,qBAAqB,oBAAoB,UAAU,MAAM;AAAA,MAC5E,UAAU,MAAM;AAAA,MAChB,gBAAgB,MAAM;AAAA,IACxB,CAAC;AACD,UAAM,sBAAsB,OAAO,qBAAqB;AAAA,MACtD,eAAe,UAAU;AAAA,MACzB,OAAO,MAAM;AAAA,MACb,UAAU,MAAM;AAAA,MAChB,UAAU;AAAA,IACZ,CAAC;AACD,QAAI,CAAC,qBAAqB;AACxB,YAAM,IAAI,4BAA4B,8BAA8B,GAAG;AAAA,IACzE;AAEA,QAAI,cAA0E;AAC9E,QAAI;AACF,oBAAc,MAAM,uBAAuB,QAAQ;AAAA,QACjD,UAAU,MAAM;AAAA,QAChB,gBAAgB,MAAM;AAAA,QACtB,OAAO,MAAM,OAAO;AAAA,QACpB,QAAQ;AAAA,QACR,eAAe,OAAO;AAAA,QACtB,aAAa;AAAA,QACb,eAAe,UAAU;AAAA,MAC3B,CAAC;AACD,YAAM,iCAAiC;AAAA,QACrC,eAAe,YAAY;AAAA,QAC3B,UAAU,MAAM;AAAA,QAChB,gBAAgB,MAAM;AAAA,MACxB,GAAG,KAAK,IAAI,KAAO,YAAY,UAAU,QAAQ,IAAI,KAAK,IAAI,CAAC,CAAC;AAChE,YAAM,uBAAuB,aAAa,YAAY,IAAI,YAAY,UAAU;AAAA,IAClF,SAAS,OAAO;AACd,UAAI,aAAa;AACf,cAAM,uBAAuB,QAAQ,YAAY,IAAI,YAAY,UAAU,EAAE,MAAM,MAAM,MAAS;AAAA,MACpG;AACA,YAAM,OAAQ,OAA8B;AAC5C,UAAI,SAAS,iBAAkB,OAAM,IAAI,4BAA4B,kBAAkB,GAAG;AAC1F,UAAI,SAAS,sBAAuB,OAAM,IAAI,4BAA4B,uBAAuB,GAAG;AACpG,YAAM,IAAI,4BAA4B,qBAAqB,GAAG;AAAA,IAChE;AAEA,QAAI,CAAC,YAAa,OAAM,IAAI,4BAA4B,qBAAqB,GAAG;AAEhF,QAAI,aAAa;AACjB,QAAI;AACF,YAAM,SAAS,MAAM,OAAO,MAAM;AAAA,QAChC,eAAe,UAAU;AAAA,QACzB,OAAO,MAAM;AAAA,QACb,UAAU,MAAM;AAAA,QAChB,UAAU;AAAA,QACV,QAAQ,MAAM;AAAA,QACd,aAAa;AAAA,MACf,CAAC;AACD,mBAAa,OAAO;AACpB,YAAM,uBAAuB,WAAW,YAAY,IAAI,YAAY,UAAU;AAAA,IAChF,SAAS,OAAO;AACd,YAAM,KAAK,kBAAkB,QAAQ,UAAU,MAAM,YAAY,WAAW;AAC5E,aAAO,MAAM,oCAAoC,EAAE,KAAK,MAAM,CAAC;AAC/D,YAAM,IAAI,4BAA4B,kBAAkB,GAAG;AAAA,IAC7D;AAEA,QAAI,mBAAkC;AACtC,UAAM,cAAc,UAAU,eAAe,gBAAgB,UAAU,QAAQ;AAC/E,UAAM,aAAa,cAAc,IAAI,WAAW,IAAI;AACpD,UAAM,YAAY,QAAQ,eAAe,YAAY,SAAS;AAC9D,QAAI,UAAU,eAAe,CAAC,WAAW;AACvC,UAAI;AACF,cAAM,EAAE,UAAU,QAAQ,IAAI,MAAM,OAAO,YAAY,UAAU,MAAM,UAAU;AACjF,YAAI;AACF,6BAAmB,MAAM,yBAAyB,EAAE,UAAU,SAAS,CAAC;AAAA,QAC1E,UAAE;AACA,gBAAM,QAAQ,EAAE,MAAM,MAAM,MAAS;AAAA,QACvC;AAAA,MACF,SAAS,OAAO;AACd,eAAO,MAAM,4CAA4C,EAAE,KAAK,MAAM,CAAC;AAAA,MACzE;AAAA,IACF;AAEA,QAAI,cAAc,MAAM,aAAa,MAAM,KAAK,CAAC;AACjD,kBAAc,iBAAiB,aAAa,EAAE,MAAM,MAAM,UAAU,IAAI,MAAM,SAAS,CAAC;AACxF,UAAM,WAAW,wBAAwB,MAAM;AAAA,MAC7C;AAAA,MACA,MAAM,MAAM,QAAQ,CAAC;AAAA,IACvB,CAAC;AACD,UAAM,eAAe,WAAW;AAChC,QAAI;AAEJ,QAAI;AACF,YAAM,GAAG,cAAc,OAAO,OAAO;AACnC,qBAAa,GAAG,OAAO,YAAY;AAAA,UACjC,IAAI;AAAA,UACJ,UAAU,MAAM;AAAA,UAChB,UAAU,MAAM;AAAA,UAChB,gBAAgB,MAAM;AAAA,UACtB,UAAU,MAAM;AAAA,UAChB,UAAU;AAAA,UACV;AAAA,UACA,UAAU,MAAM,OAAO;AAAA,UACvB,eAAe,UAAU;AAAA,UACzB,eAAe,UAAU,iBAAiB;AAAA,UAC1C,aAAa;AAAA,UACb,KAAK,uBAAuB,YAAY;AAAA,UACxC,SAAS;AAAA,UACT,iBAAiB;AAAA,QACnB,CAAC;AACD,uCAA+B,EAAE,UAAU,WAAW,UAAU,gBAAgB,WAAW,eAAe,CAAC;AAC3G,cAAM,GAAG,QAAQ,UAAU,EAAE,MAAM;AACnC,cAAM,MAAM,cAAc,IAAI,YAAY;AAC1C,cAAM,uBAAuB,mBAAmB,YAAY,IAAI,YAAY,YAAY,EAAE;AAAA,MAC5F,CAAC;AAAA,IACH,SAAS,OAAO;AACd,YAAM,KAAK,kBAAkB,QAAQ,UAAU,MAAM,YAAY,WAAW;AAC5E,aAAO,MAAM,wCAAwC,EAAE,KAAK,MAAM,CAAC;AAMnE,UAAI,gBAAgB,KAAK,EAAG,OAAM;AAClC,YAAM,IAAI,4BAA4B,sBAAsB,GAAG;AAAA,IACjE;AAEA,QAAI,WAAW;AACb,UAAI;AACF,cAAM,qBAAqB,IAAI,YAAY,QAAQ,UAAU;AAAA,MAC/D,SAAS,OAAO;AACd,eAAO,MAAM,2CAA2C,EAAE,KAAK,MAAM,CAAC;AAAA,MACxE;AAAA,IACF;AACA,QAAI,KAAK,KAAK,YAAY;AACxB,YAAM,oBAAoB;AAAA,QACxB,YAAY,KAAK,KAAK;AAAA,QACtB,QAAQ;AAAA,QACR,QAAQ;AAAA,QACR,aAAa;AAAA,UACX,IAAI,WAAW;AAAA,UACf,gBAAgB,WAAW,kBAAkB;AAAA,UAC7C,UAAU,WAAW,YAAY;AAAA,QACnC;AAAA,QACA,QAAQ;AAAA,QACR,SAAS;AAAA,MACX,CAAC;AACD,YAAM,KAAK,KAAK,WAAW,sBAAsB;AAAA,IACnD;AACA,WAAO;AAAA,EACT;AAAA,EAEA,MAAc,kBACZ,QACA,eACA,aACA,aACe;AACf,QAAI;AACF,aAAO,OAAO,eAAe,eAAe,WAAW,KAAK,OAAO,OAAO,eAAe,WAAW;AACpG,YAAM,KAAK,KAAK,uBAAuB,QAAQ,YAAY,IAAI,YAAY,UAAU;AAAA,IACvF,SAAS,OAAO;AACd,aAAO,MAAM,yCAAyC,EAAE,KAAK,MAAM,CAAC;AAAA,IACtE;AAAA,EACF;AACF;",
   "names": []
 }

package/dist/modules/attachments/lib/target-access-service.js

@@ -1,10 +1,11 @@
 import { findOneWithDecryption } from "@open-mercato/shared/lib/encryption/find";
 import { Attachment, AttachmentPartition } from "../data/entities.js";
-import { checkAttachmentAccess } from "./access.js";
+import { evaluateAttachmentAccess } from "./access-runner.js";
 import { readAttachmentMetadata } from "./metadata.js";
 class AttachmentTargetAccessService {
-  constructor(em) {
+  constructor(em, resolveAccessContext) {
     this.em = em;
+    this.resolveAccessContext = resolveAccessContext;
   }
   async canAccessLinkedTarget(input) {
     if (!input.targets.length) return false;
@@ -28,7 +29,15 @@ class AttachmentTargetAccessService {
       ]
     });
     if (!partition) return false;
-    if (!checkAttachmentAccess(input.auth, attachment, partition, { requireAuthForPublic: true }).ok) return false;
+    const access = await evaluateAttachmentAccess({
+      auth: input.auth,
+      attachment,
+      partition,
+      action: "read",
+      context: this.resolveAccessContext?.(),
+      requireAuthForPublic: true
+    });
+    if (!access.ok) return false;
     const metadata = readAttachmentMetadata(attachment.storageMetadata);
     return input.targets.some((target) => attachment.entityId === target.entityId && attachment.recordId === target.recordId || metadata.assignments?.some((assignment) => assignment.type === target.entityId && assignment.id === target.recordId) === true);
   }

package/dist/modules/attachments/lib/target-access-service.js.map

@@ -1,7 +1,7 @@
 {
   "version": 3,
   "sources": ["../../../../src/modules/attachments/lib/target-access-service.ts"],
-  "sourcesContent": ["import type { EntityManager } from '@mikro-orm/postgresql'\nimport type { AuthContext } from '@open-mercato/shared/lib/auth/server'\nimport { findOneWithDecryption } from '@open-mercato/shared/lib/encryption/find'\nimport { Attachment, AttachmentPartition } from '../data/entities'\nimport { checkAttachmentAccess } from './access'\nimport { readAttachmentMetadata } from './metadata'\n\nexport type AttachmentRecordTarget = {\n  entityId: string\n  recordId: string\n}\n\nexport type AttachmentTargetAccessInput = {\n  attachmentId: string\n  tenantId: string\n  organizationId: string\n  auth: Exclude<AuthContext, null>\n  targets: AttachmentRecordTarget[]\n}\n\nexport class AttachmentTargetAccessService {\n  constructor(private readonly em: EntityManager) {}\n\n  async canAccessLinkedTarget(input: AttachmentTargetAccessInput): Promise<boolean> {\n    if (!input.targets.length) return false\n    const attachment = await findOneWithDecryption(\n      this.em,\n      Attachment,\n      {\n        id: input.attachmentId,\n        tenantId: input.tenantId,\n        organizationId: input.organizationId,\n      },\n      {},\n      { tenantId: input.tenantId, organizationId: input.organizationId },\n    )\n    if (!attachment) return false\n\n    const partition = await this.em.findOne(AttachmentPartition, {\n      code: attachment.partitionCode,\n      $or: [\n        { tenantId: null, organizationId: null },\n        { tenantId: input.tenantId, organizationId: input.organizationId },\n      ],\n    })\n    if (!partition) return false\n    if (!checkAttachmentAccess(input.auth, attachment, partition, { requireAuthForPublic: true }).ok) return false\n\n    const metadata = readAttachmentMetadata(attachment.storageMetadata)\n    return input.targets.some((target) => (\n      (attachment.entityId === target.entityId && attachment.recordId === target.recordId)\n      || metadata.assignments?.some((assignment) => (\n        assignment.type === target.entityId && assignment.id === target.recordId\n      )) === true\n    ))\n  }\n}\n"],
-  "mappings": "AAEA,SAAS,6BAA6B;AACtC,SAAS,YAAY,2BAA2B;AAChD,SAAS,6BAA6B;AACtC,SAAS,8BAA8B;AAehC,MAAM,8BAA8B;AAAA,EACzC,YAA6B,IAAmB;AAAnB;AAAA,EAAoB;AAAA,EAEjD,MAAM,sBAAsB,OAAsD;AAChF,QAAI,CAAC,MAAM,QAAQ,OAAQ,QAAO;AAClC,UAAM,aAAa,MAAM;AAAA,MACvB,KAAK;AAAA,MACL;AAAA,MACA;AAAA,QACE,IAAI,MAAM;AAAA,QACV,UAAU,MAAM;AAAA,QAChB,gBAAgB,MAAM;AAAA,MACxB;AAAA,MACA,CAAC;AAAA,MACD,EAAE,UAAU,MAAM,UAAU,gBAAgB,MAAM,eAAe;AAAA,IACnE;AACA,QAAI,CAAC,WAAY,QAAO;AAExB,UAAM,YAAY,MAAM,KAAK,GAAG,QAAQ,qBAAqB;AAAA,MAC3D,MAAM,WAAW;AAAA,MACjB,KAAK;AAAA,QACH,EAAE,UAAU,MAAM,gBAAgB,KAAK;AAAA,QACvC,EAAE,UAAU,MAAM,UAAU,gBAAgB,MAAM,eAAe;AAAA,MACnE;AAAA,IACF,CAAC;AACD,QAAI,CAAC,UAAW,QAAO;AACvB,QAAI,CAAC,sBAAsB,MAAM,MAAM,YAAY,WAAW,EAAE,sBAAsB,KAAK,CAAC,EAAE,GAAI,QAAO;AAEzG,UAAM,WAAW,uBAAuB,WAAW,eAAe;AAClE,WAAO,MAAM,QAAQ,KAAK,CAAC,WACxB,WAAW,aAAa,OAAO,YAAY,WAAW,aAAa,OAAO,YACxE,SAAS,aAAa,KAAK,CAAC,eAC7B,WAAW,SAAS,OAAO,YAAY,WAAW,OAAO,OAAO,QACjE,MAAM,IACR;AAAA,EACH;AACF;",
+  "sourcesContent": ["import type { EntityManager } from '@mikro-orm/postgresql'\nimport type { AuthContext } from '@open-mercato/shared/lib/auth/server'\nimport { findOneWithDecryption } from '@open-mercato/shared/lib/encryption/find'\nimport { Attachment, AttachmentPartition } from '../data/entities'\nimport { evaluateAttachmentAccess, type AttachmentAccessContext } from './access-runner'\nimport { readAttachmentMetadata } from './metadata'\n\nexport type AttachmentRecordTarget = {\n  entityId: string\n  recordId: string\n}\n\nexport type AttachmentTargetAccessInput = {\n  attachmentId: string\n  tenantId: string\n  organizationId: string\n  auth: Exclude<AuthContext, null>\n  targets: AttachmentRecordTarget[]\n}\n\nexport class AttachmentTargetAccessService {\n  constructor(\n    private readonly em: EntityManager,\n    private readonly resolveAccessContext?: (() => AttachmentAccessContext) | null,\n  ) {}\n\n  async canAccessLinkedTarget(input: AttachmentTargetAccessInput): Promise<boolean> {\n    if (!input.targets.length) return false\n    const attachment = await findOneWithDecryption(\n      this.em,\n      Attachment,\n      {\n        id: input.attachmentId,\n        tenantId: input.tenantId,\n        organizationId: input.organizationId,\n      },\n      {},\n      { tenantId: input.tenantId, organizationId: input.organizationId },\n    )\n    if (!attachment) return false\n\n    const partition = await this.em.findOne(AttachmentPartition, {\n      code: attachment.partitionCode,\n      $or: [\n        { tenantId: null, organizationId: null },\n        { tenantId: input.tenantId, organizationId: input.organizationId },\n      ],\n    })\n    if (!partition) return false\n    const access = await evaluateAttachmentAccess({\n      auth: input.auth, attachment, partition, action: 'read',\n      context: this.resolveAccessContext?.(), requireAuthForPublic: true,\n    })\n    if (!access.ok) return false\n\n    const metadata = readAttachmentMetadata(attachment.storageMetadata)\n    return input.targets.some((target) => (\n      (attachment.entityId === target.entityId && attachment.recordId === target.recordId)\n      || metadata.assignments?.some((assignment) => (\n        assignment.type === target.entityId && assignment.id === target.recordId\n      )) === true\n    ))\n  }\n}\n"],
+  "mappings": "AAEA,SAAS,6BAA6B;AACtC,SAAS,YAAY,2BAA2B;AAChD,SAAS,gCAA8D;AACvE,SAAS,8BAA8B;AAehC,MAAM,8BAA8B;AAAA,EACzC,YACmB,IACA,sBACjB;AAFiB;AACA;AAAA,EAChB;AAAA,EAEH,MAAM,sBAAsB,OAAsD;AAChF,QAAI,CAAC,MAAM,QAAQ,OAAQ,QAAO;AAClC,UAAM,aAAa,MAAM;AAAA,MACvB,KAAK;AAAA,MACL;AAAA,MACA;AAAA,QACE,IAAI,MAAM;AAAA,QACV,UAAU,MAAM;AAAA,QAChB,gBAAgB,MAAM;AAAA,MACxB;AAAA,MACA,CAAC;AAAA,MACD,EAAE,UAAU,MAAM,UAAU,gBAAgB,MAAM,eAAe;AAAA,IACnE;AACA,QAAI,CAAC,WAAY,QAAO;AAExB,UAAM,YAAY,MAAM,KAAK,GAAG,QAAQ,qBAAqB;AAAA,MAC3D,MAAM,WAAW;AAAA,MACjB,KAAK;AAAA,QACH,EAAE,UAAU,MAAM,gBAAgB,KAAK;AAAA,QACvC,EAAE,UAAU,MAAM,UAAU,gBAAgB,MAAM,eAAe;AAAA,MACnE;AAAA,IACF,CAAC;AACD,QAAI,CAAC,UAAW,QAAO;AACvB,UAAM,SAAS,MAAM,yBAAyB;AAAA,MAC5C,MAAM,MAAM;AAAA,MAAM;AAAA,MAAY;AAAA,MAAW,QAAQ;AAAA,MACjD,SAAS,KAAK,uBAAuB;AAAA,MAAG,sBAAsB;AAAA,IAChE,CAAC;AACD,QAAI,CAAC,OAAO,GAAI,QAAO;AAEvB,UAAM,WAAW,uBAAuB,WAAW,eAAe;AAClE,WAAO,MAAM,QAAQ,KAAK,CAAC,WACxB,WAAW,aAAa,OAAO,YAAY,WAAW,aAAa,OAAO,YACxE,SAAS,aAAa,KAAK,CAAC,eAC7B,WAAW,SAAS,OAAO,YAAY,WAAW,OAAO,OAAO,QACjE,MAAM,IACR;AAAA,EACH;AACF;",
   "names": []
 }

package/dist/modules/attachments/migrations/Migration20261001120000_attachments.js

@@ -0,0 +1,38 @@
+import { Migration } from "@mikro-orm/migrations";
+class Migration20261001120000_attachments extends Migration {
+  up() {
+    this.addSql('alter table "attachment_partitions" add column if not exists "access_resolver_requirements" jsonb null;');
+    this.addSql(`
+      update attachment_partitions as partition
+      set access_resolver_requirements = coalesce(partition.access_resolver_requirements, '[]'::jsonb)
+        || '[{"resolverId":"documents.document-attachments","targetEntity":"documents:document"}]'::jsonb,
+        updated_at = now()
+      where (partition.access_resolver_requirements is null or jsonb_typeof(partition.access_resolver_requirements) = 'array')
+        and not coalesce(partition.access_resolver_requirements, '[]'::jsonb)
+          @> '[{"resolverId":"documents.document-attachments","targetEntity":"documents:document"}]'::jsonb
+        and exists (
+          select 1 from attachments as attachment
+          where attachment.partition_code = partition.code
+            and (
+              btrim(attachment.entity_id) = 'documents:document'
+              or exists (
+                select 1
+                from jsonb_array_elements(
+                  case jsonb_typeof(attachment.storage_metadata->'assignments')
+                    when 'array' then attachment.storage_metadata->'assignments'
+                    when 'object' then jsonb_build_array(attachment.storage_metadata->'assignments')
+                    else '[]'::jsonb
+                  end
+                ) as assignment
+                where jsonb_typeof(assignment) = 'object'
+                  and btrim(assignment->>'type') = 'documents:document'
+              )
+            )
+        );
+    `);
+  }
+}
+export {
+  Migration20261001120000_attachments
+};
+//# sourceMappingURL=Migration20261001120000_attachments.js.map

package/dist/modules/attachments/migrations/Migration20261001120000_attachments.js.map

@@ -0,0 +1,7 @@
+{
+  "version": 3,
+  "sources": ["../../../../src/modules/attachments/migrations/Migration20261001120000_attachments.ts"],
+  "sourcesContent": ["import { Migration } from '@mikro-orm/migrations'\n\nexport class Migration20261001120000_attachments extends Migration {\n  override up(): void {\n    this.addSql('alter table \"attachment_partitions\" add column if not exists \"access_resolver_requirements\" jsonb null;')\n    this.addSql(`\n      update attachment_partitions as partition\n      set access_resolver_requirements = coalesce(partition.access_resolver_requirements, '[]'::jsonb)\n        || '[{\"resolverId\":\"documents.document-attachments\",\"targetEntity\":\"documents:document\"}]'::jsonb,\n        updated_at = now()\n      where (partition.access_resolver_requirements is null or jsonb_typeof(partition.access_resolver_requirements) = 'array')\n        and not coalesce(partition.access_resolver_requirements, '[]'::jsonb)\n          @> '[{\"resolverId\":\"documents.document-attachments\",\"targetEntity\":\"documents:document\"}]'::jsonb\n        and exists (\n          select 1 from attachments as attachment\n          where attachment.partition_code = partition.code\n            and (\n              btrim(attachment.entity_id) = 'documents:document'\n              or exists (\n                select 1\n                from jsonb_array_elements(\n                  case jsonb_typeof(attachment.storage_metadata->'assignments')\n                    when 'array' then attachment.storage_metadata->'assignments'\n                    when 'object' then jsonb_build_array(attachment.storage_metadata->'assignments')\n                    else '[]'::jsonb\n                  end\n                ) as assignment\n                where jsonb_typeof(assignment) = 'object'\n                  and btrim(assignment->>'type') = 'documents:document'\n              )\n            )\n        );\n    `)\n  }\n}\n"],
+  "mappings": "AAAA,SAAS,iBAAiB;AAEnB,MAAM,4CAA4C,UAAU;AAAA,EACxD,KAAW;AAClB,SAAK,OAAO,yGAAyG;AACrH,SAAK,OAAO;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,KA2BX;AAAA,EACH;AACF;",
+  "names": []
+}

package/dist/modules/attachments/setup.js

@@ -1,4 +1,14 @@
+import { syncAttachmentAccessProtection } from "./lib/access-protection.js";
+import { ensureDefaultPartitions } from "./lib/partitions.js";
 const setup = {
+  async onTenantCreated({ em }) {
+    await ensureDefaultPartitions(em);
+    await syncAttachmentAccessProtection(em);
+  },
+  async seedDefaults({ em }) {
+    await ensureDefaultPartitions(em);
+    await syncAttachmentAccessProtection(em);
+  },
   defaultRoleFeatures: {
     admin: ["attachments.*", "attachments.view", "attachments.manage"],
     employee: ["attachments.view"]

package/dist/modules/attachments/setup.js.map

@@ -1,7 +1,7 @@
 {
   "version": 3,
   "sources": ["../../../src/modules/attachments/setup.ts"],
-  "sourcesContent": ["import type { ModuleSetupConfig } from '@open-mercato/shared/modules/setup'\n\nexport const setup: ModuleSetupConfig = {\n  defaultRoleFeatures: {\n    admin: ['attachments.*', 'attachments.view', 'attachments.manage'],\n    employee: ['attachments.view'],\n  },\n}\n\nexport default setup\n"],
-  "mappings": "AAEO,MAAM,QAA2B;AAAA,EACtC,qBAAqB;AAAA,IACnB,OAAO,CAAC,iBAAiB,oBAAoB,oBAAoB;AAAA,IACjE,UAAU,CAAC,kBAAkB;AAAA,EAC/B;AACF;AAEA,IAAO,gBAAQ;",
+  "sourcesContent": ["import type { ModuleSetupConfig } from '@open-mercato/shared/modules/setup'\nimport { syncAttachmentAccessProtection } from './lib/access-protection'\nimport { ensureDefaultPartitions } from './lib/partitions'\n\nexport const setup: ModuleSetupConfig = {\n  async onTenantCreated({ em }) {\n    await ensureDefaultPartitions(em)\n    await syncAttachmentAccessProtection(em)\n  },\n  async seedDefaults({ em }) {\n    await ensureDefaultPartitions(em)\n    await syncAttachmentAccessProtection(em)\n  },\n  defaultRoleFeatures: {\n    admin: ['attachments.*', 'attachments.view', 'attachments.manage'],\n    employee: ['attachments.view'],\n  },\n}\n\nexport default setup\n"],
+  "mappings": "AACA,SAAS,sCAAsC;AAC/C,SAAS,+BAA+B;AAEjC,MAAM,QAA2B;AAAA,EACtC,MAAM,gBAAgB,EAAE,GAAG,GAAG;AAC5B,UAAM,wBAAwB,EAAE;AAChC,UAAM,+BAA+B,EAAE;AAAA,EACzC;AAAA,EACA,MAAM,aAAa,EAAE,GAAG,GAAG;AACzB,UAAM,wBAAwB,EAAE;AAChC,UAAM,+BAA+B,EAAE;AAAA,EACzC;AAAA,EACA,qBAAqB;AAAA,IACnB,OAAO,CAAC,iBAAiB,oBAAoB,oBAAoB;AAAA,IACjE,UAAU,CAAC,kBAAkB;AAAA,EAC/B;AACF;AAEA,IAAO,gBAAQ;",
   "names": []
 }

package/dist/modules/notifications/api/[id]/action/route.js

@@ -89,6 +89,14 @@ const openApi = {
           }
         }
       },
+      403: {
+        description: "The stored action command is not declared by the notification type with the same action id and command, or the user lacks the features the declared action requires (`code: notification_action_forbidden`)",
+        content: {
+          "application/json": {
+            schema: actionConflictResponseSchema
+          }
+        }
+      },
       400: {
         description: "Action not found or failed",
         content: {

package/dist/modules/notifications/api/[id]/action/route.js.map

@@ -1,7 +1,7 @@
 {
   "version": 3,
   "sources": ["../../../../../../src/modules/notifications/api/%5Bid%5D/action/route.ts"],
-  "sourcesContent": ["import { executeActionSchema } from '../../../data/validators'\nimport { actionConflictResponseSchema, actionResultResponseSchema, errorResponseSchema } from '../../openapi'\nimport {\n  NOTIFICATION_RESOURCE_KIND,\n  notificationCrudErrorResponse,\n  notificationValidationErrorResponse,\n  resolveNotificationContext,\n  runGuardedNotificationWrite,\n} from '../../../lib/routeHelpers'\nimport { resolveTranslations } from '@open-mercato/shared/lib/i18n/server'\nimport { resolveNotificationActionHref, toSafeNotificationHref } from '../../../lib/safeHref'\n\nexport const metadata = {\n  POST: { requireAuth: true },\n}\n\nexport async function POST(req: Request, { params }: { params: Promise<{ id: string }> }) {\n  const { id } = await params\n  const { service, scope, ctx } = await resolveNotificationContext(req)\n\n  const body = await req.json().catch(() => ({}))\n  const parsed = executeActionSchema.safeParse(body)\n  if (!parsed.success) {\n    return notificationValidationErrorResponse(parsed.error)\n  }\n  const input = parsed.data\n\n  try {\n    const guarded = await runGuardedNotificationWrite(\n      ctx.container,\n      scope,\n      req,\n      {\n        resourceKind: NOTIFICATION_RESOURCE_KIND,\n        resourceId: id,\n        operation: 'custom',\n        payload: input as Record<string, unknown>,\n      },\n      () => service.executeAction(id, input, scope),\n    )\n    if (!guarded.ok) return guarded.response\n    const { notification, result } = guarded.result\n\n    const action = notification.actionData?.actions?.find((a) => a.id === input.actionId)\n    const href = toSafeNotificationHref(resolveNotificationActionHref(action?.href, notification.sourceEntityId)) ?? undefined\n\n    return Response.json({\n      ok: true,\n      result,\n      href,\n    })\n  } catch (error) {\n    const errorResponse = notificationCrudErrorResponse(error)\n    if (errorResponse) return errorResponse\n\n    const { t } = await resolveTranslations()\n    const fallback = t('notifications.error.action', 'Failed to execute action')\n    const message = error instanceof Error && error.message ? error.message : fallback\n    return Response.json({ error: message }, { status: 400 })\n  }\n}\n\nexport const openApi = {\n  POST: {\n    summary: 'Execute notification action',\n    tags: ['Notifications'],\n    parameters: [\n      {\n        name: 'id',\n        in: 'path',\n        required: true,\n        schema: { type: 'string', format: 'uuid' },\n      },\n    ],\n    requestBody: {\n      required: true,\n      content: {\n        'application/json': {\n          schema: executeActionSchema,\n        },\n      },\n    },\n    responses: {\n      200: {\n        description: 'Action executed successfully',\n        content: {\n          'application/json': {\n            schema: actionResultResponseSchema,\n          },\n        },\n      },\n      409: {\n        description: 'The notification action was already executed (`code: notification_action_already_executed`), or a mutation guard or the action command reported a conflict',\n        content: {\n          'application/json': {\n            schema: actionConflictResponseSchema,\n          },\n        },\n      },\n      400: {\n        description: 'Action not found or failed',\n        content: {\n          'application/json': {\n            schema: errorResponseSchema,\n          },\n        },\n      },\n    },\n  },\n}\n"],
-  "mappings": "AAAA,SAAS,2BAA2B;AACpC,SAAS,8BAA8B,4BAA4B,2BAA2B;AAC9F;AAAA,EACE;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,OACK;AACP,SAAS,2BAA2B;AACpC,SAAS,+BAA+B,8BAA8B;AAE/D,MAAM,WAAW;AAAA,EACtB,MAAM,EAAE,aAAa,KAAK;AAC5B;AAEA,eAAsB,KAAK,KAAc,EAAE,OAAO,GAAwC;AACxF,QAAM,EAAE,GAAG,IAAI,MAAM;AACrB,QAAM,EAAE,SAAS,OAAO,IAAI,IAAI,MAAM,2BAA2B,GAAG;AAEpE,QAAM,OAAO,MAAM,IAAI,KAAK,EAAE,MAAM,OAAO,CAAC,EAAE;AAC9C,QAAM,SAAS,oBAAoB,UAAU,IAAI;AACjD,MAAI,CAAC,OAAO,SAAS;AACnB,WAAO,oCAAoC,OAAO,KAAK;AAAA,EACzD;AACA,QAAM,QAAQ,OAAO;AAErB,MAAI;AACF,UAAM,UAAU,MAAM;AAAA,MACpB,IAAI;AAAA,MACJ;AAAA,MACA;AAAA,MACA;AAAA,QACE,cAAc;AAAA,QACd,YAAY;AAAA,QACZ,WAAW;AAAA,QACX,SAAS;AAAA,MACX;AAAA,MACA,MAAM,QAAQ,cAAc,IAAI,OAAO,KAAK;AAAA,IAC9C;AACA,QAAI,CAAC,QAAQ,GAAI,QAAO,QAAQ;AAChC,UAAM,EAAE,cAAc,OAAO,IAAI,QAAQ;AAEzC,UAAM,SAAS,aAAa,YAAY,SAAS,KAAK,CAAC,MAAM,EAAE,OAAO,MAAM,QAAQ;AACpF,UAAM,OAAO,uBAAuB,8BAA8B,QAAQ,MAAM,aAAa,cAAc,CAAC,KAAK;AAEjH,WAAO,SAAS,KAAK;AAAA,MACnB,IAAI;AAAA,MACJ;AAAA,MACA;AAAA,IACF,CAAC;AAAA,EACH,SAAS,OAAO;AACd,UAAM,gBAAgB,8BAA8B,KAAK;AACzD,QAAI,cAAe,QAAO;AAE1B,UAAM,EAAE,EAAE,IAAI,MAAM,oBAAoB;AACxC,UAAM,WAAW,EAAE,8BAA8B,0BAA0B;AAC3E,UAAM,UAAU,iBAAiB,SAAS,MAAM,UAAU,MAAM,UAAU;AAC1E,WAAO,SAAS,KAAK,EAAE,OAAO,QAAQ,GAAG,EAAE,QAAQ,IAAI,CAAC;AAAA,EAC1D;AACF;AAEO,MAAM,UAAU;AAAA,EACrB,MAAM;AAAA,IACJ,SAAS;AAAA,IACT,MAAM,CAAC,eAAe;AAAA,IACtB,YAAY;AAAA,MACV;AAAA,QACE,MAAM;AAAA,QACN,IAAI;AAAA,QACJ,UAAU;AAAA,QACV,QAAQ,EAAE,MAAM,UAAU,QAAQ,OAAO;AAAA,MAC3C;AAAA,IACF;AAAA,IACA,aAAa;AAAA,MACX,UAAU;AAAA,MACV,SAAS;AAAA,QACP,oBAAoB;AAAA,UAClB,QAAQ;AAAA,QACV;AAAA,MACF;AAAA,IACF;AAAA,IACA,WAAW;AAAA,MACT,KAAK;AAAA,QACH,aAAa;AAAA,QACb,SAAS;AAAA,UACP,oBAAoB;AAAA,YAClB,QAAQ;AAAA,UACV;AAAA,QACF;AAAA,MACF;AAAA,MACA,KAAK;AAAA,QACH,aAAa;AAAA,QACb,SAAS;AAAA,UACP,oBAAoB;AAAA,YAClB,QAAQ;AAAA,UACV;AAAA,QACF;AAAA,MACF;AAAA,MACA,KAAK;AAAA,QACH,aAAa;AAAA,QACb,SAAS;AAAA,UACP,oBAAoB;AAAA,YAClB,QAAQ;AAAA,UACV;AAAA,QACF;AAAA,MACF;AAAA,IACF;AAAA,EACF;AACF;",
+  "sourcesContent": ["import { executeActionSchema } from '../../../data/validators'\nimport { actionConflictResponseSchema, actionResultResponseSchema, errorResponseSchema } from '../../openapi'\nimport {\n  NOTIFICATION_RESOURCE_KIND,\n  notificationCrudErrorResponse,\n  notificationValidationErrorResponse,\n  resolveNotificationContext,\n  runGuardedNotificationWrite,\n} from '../../../lib/routeHelpers'\nimport { resolveTranslations } from '@open-mercato/shared/lib/i18n/server'\nimport { resolveNotificationActionHref, toSafeNotificationHref } from '../../../lib/safeHref'\n\nexport const metadata = {\n  POST: { requireAuth: true },\n}\n\nexport async function POST(req: Request, { params }: { params: Promise<{ id: string }> }) {\n  const { id } = await params\n  const { service, scope, ctx } = await resolveNotificationContext(req)\n\n  const body = await req.json().catch(() => ({}))\n  const parsed = executeActionSchema.safeParse(body)\n  if (!parsed.success) {\n    return notificationValidationErrorResponse(parsed.error)\n  }\n  const input = parsed.data\n\n  try {\n    const guarded = await runGuardedNotificationWrite(\n      ctx.container,\n      scope,\n      req,\n      {\n        resourceKind: NOTIFICATION_RESOURCE_KIND,\n        resourceId: id,\n        operation: 'custom',\n        payload: input as Record<string, unknown>,\n      },\n      () => service.executeAction(id, input, scope),\n    )\n    if (!guarded.ok) return guarded.response\n    const { notification, result } = guarded.result\n\n    const action = notification.actionData?.actions?.find((a) => a.id === input.actionId)\n    const href = toSafeNotificationHref(resolveNotificationActionHref(action?.href, notification.sourceEntityId)) ?? undefined\n\n    return Response.json({\n      ok: true,\n      result,\n      href,\n    })\n  } catch (error) {\n    const errorResponse = notificationCrudErrorResponse(error)\n    if (errorResponse) return errorResponse\n\n    const { t } = await resolveTranslations()\n    const fallback = t('notifications.error.action', 'Failed to execute action')\n    const message = error instanceof Error && error.message ? error.message : fallback\n    return Response.json({ error: message }, { status: 400 })\n  }\n}\n\nexport const openApi = {\n  POST: {\n    summary: 'Execute notification action',\n    tags: ['Notifications'],\n    parameters: [\n      {\n        name: 'id',\n        in: 'path',\n        required: true,\n        schema: { type: 'string', format: 'uuid' },\n      },\n    ],\n    requestBody: {\n      required: true,\n      content: {\n        'application/json': {\n          schema: executeActionSchema,\n        },\n      },\n    },\n    responses: {\n      200: {\n        description: 'Action executed successfully',\n        content: {\n          'application/json': {\n            schema: actionResultResponseSchema,\n          },\n        },\n      },\n      409: {\n        description: 'The notification action was already executed (`code: notification_action_already_executed`), or a mutation guard or the action command reported a conflict',\n        content: {\n          'application/json': {\n            schema: actionConflictResponseSchema,\n          },\n        },\n      },\n      403: {\n        description: 'The stored action command is not declared by the notification type with the same action id and command, or the user lacks the features the declared action requires (`code: notification_action_forbidden`)',\n        content: {\n          'application/json': {\n            schema: actionConflictResponseSchema,\n          },\n        },\n      },\n      400: {\n        description: 'Action not found or failed',\n        content: {\n          'application/json': {\n            schema: errorResponseSchema,\n          },\n        },\n      },\n    },\n  },\n}\n"],
+  "mappings": "AAAA,SAAS,2BAA2B;AACpC,SAAS,8BAA8B,4BAA4B,2BAA2B;AAC9F;AAAA,EACE;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,OACK;AACP,SAAS,2BAA2B;AACpC,SAAS,+BAA+B,8BAA8B;AAE/D,MAAM,WAAW;AAAA,EACtB,MAAM,EAAE,aAAa,KAAK;AAC5B;AAEA,eAAsB,KAAK,KAAc,EAAE,OAAO,GAAwC;AACxF,QAAM,EAAE,GAAG,IAAI,MAAM;AACrB,QAAM,EAAE,SAAS,OAAO,IAAI,IAAI,MAAM,2BAA2B,GAAG;AAEpE,QAAM,OAAO,MAAM,IAAI,KAAK,EAAE,MAAM,OAAO,CAAC,EAAE;AAC9C,QAAM,SAAS,oBAAoB,UAAU,IAAI;AACjD,MAAI,CAAC,OAAO,SAAS;AACnB,WAAO,oCAAoC,OAAO,KAAK;AAAA,EACzD;AACA,QAAM,QAAQ,OAAO;AAErB,MAAI;AACF,UAAM,UAAU,MAAM;AAAA,MACpB,IAAI;AAAA,MACJ;AAAA,MACA;AAAA,MACA;AAAA,QACE,cAAc;AAAA,QACd,YAAY;AAAA,QACZ,WAAW;AAAA,QACX,SAAS;AAAA,MACX;AAAA,MACA,MAAM,QAAQ,cAAc,IAAI,OAAO,KAAK;AAAA,IAC9C;AACA,QAAI,CAAC,QAAQ,GAAI,QAAO,QAAQ;AAChC,UAAM,EAAE,cAAc,OAAO,IAAI,QAAQ;AAEzC,UAAM,SAAS,aAAa,YAAY,SAAS,KAAK,CAAC,MAAM,EAAE,OAAO,MAAM,QAAQ;AACpF,UAAM,OAAO,uBAAuB,8BAA8B,QAAQ,MAAM,aAAa,cAAc,CAAC,KAAK;AAEjH,WAAO,SAAS,KAAK;AAAA,MACnB,IAAI;AAAA,MACJ;AAAA,MACA;AAAA,IACF,CAAC;AAAA,EACH,SAAS,OAAO;AACd,UAAM,gBAAgB,8BAA8B,KAAK;AACzD,QAAI,cAAe,QAAO;AAE1B,UAAM,EAAE,EAAE,IAAI,MAAM,oBAAoB;AACxC,UAAM,WAAW,EAAE,8BAA8B,0BAA0B;AAC3E,UAAM,UAAU,iBAAiB,SAAS,MAAM,UAAU,MAAM,UAAU;AAC1E,WAAO,SAAS,KAAK,EAAE,OAAO,QAAQ,GAAG,EAAE,QAAQ,IAAI,CAAC;AAAA,EAC1D;AACF;AAEO,MAAM,UAAU;AAAA,EACrB,MAAM;AAAA,IACJ,SAAS;AAAA,IACT,MAAM,CAAC,eAAe;AAAA,IACtB,YAAY;AAAA,MACV;AAAA,QACE,MAAM;AAAA,QACN,IAAI;AAAA,QACJ,UAAU;AAAA,QACV,QAAQ,EAAE,MAAM,UAAU,QAAQ,OAAO;AAAA,MAC3C;AAAA,IACF;AAAA,IACA,aAAa;AAAA,MACX,UAAU;AAAA,MACV,SAAS;AAAA,QACP,oBAAoB;AAAA,UAClB,QAAQ;AAAA,QACV;AAAA,MACF;AAAA,IACF;AAAA,IACA,WAAW;AAAA,MACT,KAAK;AAAA,QACH,aAAa;AAAA,QACb,SAAS;AAAA,UACP,oBAAoB;AAAA,YAClB,QAAQ;AAAA,UACV;AAAA,QACF;AAAA,MACF;AAAA,MACA,KAAK;AAAA,QACH,aAAa;AAAA,QACb,SAAS;AAAA,UACP,oBAAoB;AAAA,YAClB,QAAQ;AAAA,UACV;AAAA,QACF;AAAA,MACF;AAAA,MACA,KAAK;AAAA,QACH,aAAa;AAAA,QACb,SAAS;AAAA,UACP,oBAAoB;AAAA,YAClB,QAAQ;AAAA,UACV;AAAA,QACF;AAAA,MACF;AAAA,MACA,KAAK;AAAA,QACH,aAAa;AAAA,QACb,SAAS;AAAA,UACP,oBAAoB;AAAA,YAClB,QAAQ;AAAA,UACV;AAAA,QACF;AAAA,MACF;AAAA,IACF;AAAA,EACF;AACF;",
   "names": []
 }