@open-mercato/core 0.10.1-develop.7841.1.af87ac614d → 0.10.1-develop.7857.1.259928eb85

package/dist/modules/wms/index.js.map

@@ -1,7 +1,7 @@
 {
   "version": 3,
   "sources": ["../../../src/modules/wms/index.ts"],
-  "sourcesContent": ["import type { ModuleInfo } from '@open-mercato/shared/modules/registry'\nimport './commands'\n\nexport const metadata: ModuleInfo = {\n  name: 'wms',\n  title: 'Warehouse Management System',\n  version: '0.1.0',\n  description: 'Warehouse topology, inventory balances, reservations, and movement ledger.',\n  author: 'Open Mercato Team',\n  license: 'MIT',\n  ejectable: true,\n  requires: ['catalog', 'sales', 'feature_toggles'],\n}\n\nexport { features } from './acl'\n"],
-  "mappings": "AACA,OAAO;AAEA,MAAM,WAAuB;AAAA,EAClC,MAAM;AAAA,EACN,OAAO;AAAA,EACP,SAAS;AAAA,EACT,aAAa;AAAA,EACb,QAAQ;AAAA,EACR,SAAS;AAAA,EACT,WAAW;AAAA,EACX,UAAU,CAAC,WAAW,SAAS,iBAAiB;AAClD;AAEA,SAAS,gBAAgB;",
+  "sourcesContent": ["import type { ModuleInfo } from '@open-mercato/shared/modules/registry'\nimport './commands'\n\nexport const metadata: ModuleInfo = {\n  name: 'wms',\n  title: 'Warehouse Management System',\n  version: '0.1.0',\n  description: 'Warehouse topology, inventory balances, reservations, and movement ledger.',\n  author: 'Open Mercato Team',\n  license: 'MIT',\n  ejectable: true,\n  requires: ['catalog', 'customers', 'sales', 'feature_toggles'],\n}\n\nexport { features } from './acl'\n"],
+  "mappings": "AACA,OAAO;AAEA,MAAM,WAAuB;AAAA,EAClC,MAAM;AAAA,EACN,OAAO;AAAA,EACP,SAAS;AAAA,EACT,aAAa;AAAA,EACb,QAAQ;AAAA,EACR,SAAS;AAAA,EACT,WAAW;AAAA,EACX,UAAU,CAAC,WAAW,aAAa,SAAS,iBAAiB;AAC/D;AAEA,SAAS,gBAAgB;",
   "names": []
 }

package/jest.config.cjs

@@ -41,7 +41,7 @@ module.exports = {
   },
   setupFilesAfterEnv: ['<rootDir>/jest.setup.ts'],
   transformIgnorePatterns: [
-    'node_modules/(?!(@mikro-orm|kysely|ai|@ai-sdk|ai-sdk-ollama|@workflow|@standard-schema|@tanstack/react-table|@tanstack/table-core|@tanstack/react-store|@tanstack/store)/)',
+    'node_modules/(?!(sanitize-html|htmlparser2|domhandler|domutils|dom-serializer|domelementtype|entities|@mikro-orm|kysely|ai|@ai-sdk|ai-sdk-ollama|@workflow|@standard-schema|@tanstack/react-table|@tanstack/table-core|@tanstack/react-store|@tanstack/store)/)',
   ],
   testMatch: ['<rootDir>/src/**/__tests__/**/*.test.(ts|tsx)'],
   passWithNoTests: true,

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@open-mercato/core",
-  "version": "0.10.1-develop.7841.1.af87ac614d",
+  "version": "0.10.1-develop.7857.1.259928eb85",
   "license": "MIT",
   "type": "module",
   "main": "./dist/index.js",
@@ -258,7 +258,7 @@
     "pdf-lib": "^1.17.1",
     "pdfjs-dist": "^6.2.108",
     "resend": "^6.24.0",
-    "sanitize-html": "2.17.5",
+    "sanitize-html": "2.18.1",
     "semver": "^7.8.5",
     "sharp": "^0.35.3",
     "svix": "^1.99.1",
@@ -266,16 +266,16 @@
     "zod": "^4.6.6"
   },
   "peerDependencies": {
-    "@open-mercato/ai-assistant": "0.10.1-develop.7841.1.af87ac614d",
-    "@open-mercato/shared": "0.10.1-develop.7841.1.af87ac614d",
-    "@open-mercato/ui": "0.10.1-develop.7841.1.af87ac614d",
+    "@open-mercato/ai-assistant": "0.10.1-develop.7857.1.259928eb85",
+    "@open-mercato/shared": "0.10.1-develop.7857.1.259928eb85",
+    "@open-mercato/ui": "0.10.1-develop.7857.1.259928eb85",
     "react": "^19.0.0",
     "react-dom": "^19.0.0"
   },
   "devDependencies": {
-    "@open-mercato/ai-assistant": "0.10.1-develop.7841.1.af87ac614d",
-    "@open-mercato/shared": "0.10.1-develop.7841.1.af87ac614d",
-    "@open-mercato/ui": "0.10.1-develop.7841.1.af87ac614d",
+    "@open-mercato/ai-assistant": "0.10.1-develop.7857.1.259928eb85",
+    "@open-mercato/shared": "0.10.1-develop.7857.1.259928eb85",
+    "@open-mercato/ui": "0.10.1-develop.7857.1.259928eb85",
     "@testing-library/dom": "^10.4.1",
     "@testing-library/jest-dom": "^7.0.1",
     "@testing-library/react": "^16.3.3",

package/src/modules/api_keys/api/keys/route.ts

@@ -4,7 +4,7 @@ import type { EntityManager, FilterQuery } from '@mikro-orm/postgresql'
 import { makeCrudRoute } from '@open-mercato/shared/lib/crud/factory'
 import type { CrudCtx } from '@open-mercato/shared/lib/crud/factory'
 import type { RbacService } from '@open-mercato/core/modules/auth/services/rbacService'
-import { Role } from '@open-mercato/core/modules/auth/data/entities'
+import { Role, User } from '@open-mercato/core/modules/auth/data/entities'
 import { Organization } from '@open-mercato/core/modules/directory/data/entities'
 import { ApiKey } from '../../data/entities'
 import { createApiKeySchema } from '../../data/validators'
@@ -13,6 +13,7 @@ import { enforceTenantSelection, resolveIsSuperAdmin } from '@open-mercato/core/
 import { escapeLikePattern } from '@open-mercato/shared/lib/db/escapeLikePattern'
 import { assertActorCanGrantRoles } from '@open-mercato/core/modules/auth/lib/grantChecks'
 import { isOrganizationAccessAllowed } from '@open-mercato/shared/lib/auth/organizationAccess'
+import { findOneWithDecryption } from '@open-mercato/shared/lib/encryption/find'
 import type { CreateApiKeyCommandInput } from '../../commands/keys'
 
 const listQuerySchema = z.object({
@@ -138,6 +139,19 @@ async function prepareCreateCommandInput(
   })) {
     throw json({ error: translate('api_keys.errors.organizationOutOfScope', 'Organization out of scope') }, { status: 403 })
   }
+  if (organizationId) {
+    const creator = await findOneWithDecryption(
+      em,
+      User,
+      { id: auth.sub, tenantId: targetTenantId, deletedAt: null },
+      { fields: ['organizationId'] },
+      { tenantId: targetTenantId, organizationId: null },
+    )
+    if (creator?.organizationId?.toLowerCase() !== organizationId.toLowerCase()) {
+      const message = translate('api_keys.errors.organizationMustMatchCreator')
+      throw json({ error: message, fieldErrors: { organizationId: message } }, { status: 400 })
+    }
+  }
 
   return {
     name: input.name,

package/src/modules/api_keys/i18n/de.json

@@ -5,6 +5,7 @@
   "api_keys.copy.warning": "Bewahre diesen Schlüssel sicher auf – er kann später nicht erneut abgerufen werden.",
   "api_keys.errors.forbidden": "Verboten",
   "api_keys.errors.notFound": "Nicht gefunden",
+  "api_keys.errors.organizationMustMatchCreator": "Ein organisationsgebundener API-Schlüssel muss die Organisation Ihres Kontos verwenden. Wählen Sie diese Organisation aus, um einen nutzbaren Schlüssel zu erstellen.",
   "api_keys.errors.organizationOutOfScope": "Organisation außerhalb des Geltungsbereichs",
   "api_keys.errors.roleNotFound": "Rolle {identifier} nicht gefunden",
   "api_keys.errors.roleWrongTenant": "Rolle {role} gehört zu einem anderen Mandanten",

package/src/modules/api_keys/i18n/en.json

@@ -5,6 +5,7 @@
   "api_keys.copy.warning": "Keep this key safe — it cannot be retrieved later.",
   "api_keys.errors.forbidden": "Forbidden",
   "api_keys.errors.notFound": "Not found",
+  "api_keys.errors.organizationMustMatchCreator": "An organization-scoped API key must use your account’s organization. Select that organization to create a usable key.",
   "api_keys.errors.organizationOutOfScope": "Organization out of scope",
   "api_keys.errors.roleNotFound": "Role {identifier} not found",
   "api_keys.errors.roleWrongTenant": "Role {role} belongs to another tenant",

package/src/modules/api_keys/i18n/es.json

@@ -5,6 +5,7 @@
   "api_keys.copy.warning": "Mantén esta clave a salvo; no se puede recuperar más tarde.",
   "api_keys.errors.forbidden": "Prohibido",
   "api_keys.errors.notFound": "No encontrado",
+  "api_keys.errors.organizationMustMatchCreator": "Una clave API limitada a una organización debe usar la organización de tu cuenta. Selecciona esa organización para crear una clave utilizable.",
   "api_keys.errors.organizationOutOfScope": "Organización fuera del ámbito",
   "api_keys.errors.roleNotFound": "Rol {identifier} no encontrado",
   "api_keys.errors.roleWrongTenant": "El rol {role} pertenece a otro inquilino",

package/src/modules/api_keys/i18n/ko.json

@@ -5,6 +5,7 @@
   "api_keys.copy.warning": "이 키를 안전하게 보관하세요 — 나중에 다시 확인할 수 없습니다.",
   "api_keys.errors.forbidden": "접근이 거부되었습니다",
   "api_keys.errors.notFound": "찾을 수 없습니다",
+  "api_keys.errors.organizationMustMatchCreator": "조직 범위 API 키는 계정의 조직을 사용해야 합니다. 사용 가능한 키를 만들려면 해당 조직을 선택하세요.",
   "api_keys.errors.organizationOutOfScope": "조직이 범위를 벗어났습니다",
   "api_keys.errors.roleNotFound": "역할 {identifier}을(를) 찾을 수 없습니다",
   "api_keys.errors.roleWrongTenant": "역할 {role}은(는) 다른 테넌트에 속합니다",

package/src/modules/api_keys/i18n/pl.json

@@ -5,6 +5,7 @@
   "api_keys.copy.warning": "Zachowaj ten klucz w bezpiecznym miejscu – nie można go później odzyskać.",
   "api_keys.errors.forbidden": "Brak uprawnień",
   "api_keys.errors.notFound": "Nie znaleziono",
+  "api_keys.errors.organizationMustMatchCreator": "Klucz API przypisany do organizacji musi używać organizacji Twojego konta. Wybierz tę organizację, aby utworzyć działający klucz.",
   "api_keys.errors.organizationOutOfScope": "Organizacja poza zakresem",
   "api_keys.errors.roleNotFound": "Nie znaleziono roli {identifier}",
   "api_keys.errors.roleWrongTenant": "Rola {role} należy do innego najemcy",

package/src/modules/attachments/api/file/[id]/route.ts

@@ -1,3 +1,5 @@
+import { withAttachmentStorageErrors } from '@open-mercato/core/modules/attachments/lib/storageErrors'
+import { assertAttachmentStoragePartitionExists } from '@open-mercato/core/modules/attachments/lib/drivers/storageValidation'
 import { createAttachmentAccessContext, evaluateAttachmentAccess } from '../../../lib/access-runner'
 import { attachmentAccessErrorResponse } from '../../../lib/access-errors'
 import { NextRequest, NextResponse } from "next/server";
@@ -23,7 +25,7 @@ export const metadata = {
   GET: { requireAuth: false },
 };
 
-export async function GET(
+async function readAttachmentFile(
   req: NextRequest,
   context: { params: Promise<{ id: string }> },
 ) {
@@ -64,6 +66,7 @@ export async function GET(
   const partition = await em.findOne(AttachmentPartition, {
     code: attachment.partitionCode,
   });
+  assertAttachmentStoragePartitionExists(Boolean(partition))
   if (!partition) {
     return NextResponse.json(
       { error: "Partition misconfigured" },
@@ -115,6 +118,8 @@ export async function GET(
   return new NextResponse(responseBody, { status: 200, headers });
 }
 
+export const GET = withAttachmentStorageErrors(readAttachmentFile)
+
 export const openApi: OpenApiRouteDoc = {
   tag: attachmentsTag,
   summary: "Download attachment file",
@@ -131,6 +136,7 @@ export const openApi: OpenApiRouteDoc = {
         },
       ],
       errors: [
+        { status: 503, description: 'Attachment storage configuration rejected by policy', schema: attachmentErrorSchema },
         {
           status: 400,
           description: "Missing attachment ID",

package/src/modules/attachments/api/image/[id]/[[...slug]]/route.ts

@@ -1,3 +1,5 @@
+import { withAttachmentStorageErrors } from '@open-mercato/core/modules/attachments/lib/storageErrors'
+import { assertAttachmentStoragePartitionExists } from '@open-mercato/core/modules/attachments/lib/drivers/storageValidation'
 import { createAttachmentAccessContext, evaluateAttachmentAccess } from '../../../../lib/access-runner'
 import { attachmentAccessErrorResponse } from '../../../../lib/access-errors'
 import { NextRequest, NextResponse } from 'next/server'
@@ -37,7 +39,7 @@ export const metadata = {
   GET: { requireAuth: false },
 }
 
-export async function GET(
+async function readAttachmentImage(
   req: NextRequest,
   context: { params: Promise<{ id: string; slug?: string[] | undefined }> }
 ) {
@@ -74,6 +76,7 @@ export async function GET(
     return NextResponse.json({ error: 'Not found' }, { status: 404 })
   }
   const partition = await em.findOne(AttachmentPartition, { code: attachment.partitionCode })
+  assertAttachmentStoragePartitionExists(Boolean(partition))
   if (!partition) {
     return NextResponse.json({ error: 'Partition misconfigured' }, { status: 500 })
   }
@@ -147,6 +150,8 @@ export async function GET(
   }
 }
 
+export const GET = withAttachmentStorageErrors(readAttachmentImage)
+
 export const openApi: OpenApiRouteDoc = {
   tag: attachmentsTag,
   summary: 'Serve resized images',
@@ -162,6 +167,7 @@ export const openApi: OpenApiRouteDoc = {
         },
       ],
       errors: [
+        { status: 503, description: 'Attachment storage configuration rejected by policy', schema: attachmentErrorSchema },
         { status: 400, description: 'Invalid parameters, missing ID, or non-image attachment', schema: attachmentErrorSchema },
         { status: 401, description: 'Unauthorized - authentication required for private partitions', schema: attachmentErrorSchema },
         { status: 403, description: 'Forbidden - insufficient permissions', schema: attachmentErrorSchema },

package/src/modules/attachments/api/library/[id]/route.ts

@@ -1,3 +1,5 @@
+import { withAttachmentStorageErrors } from '@open-mercato/core/modules/attachments/lib/storageErrors'
+import { getAttachmentStoragePolicy } from '../../../lib/drivers/storageValidation'
 import { LockMode } from '@mikro-orm/core'
 import { findOneWithDecryption } from '@open-mercato/shared/lib/encryption/find'
 import { readJsonSafe } from '@open-mercato/shared/lib/http/readJsonSafe'
@@ -256,6 +258,16 @@ async function deleteAttachment(req: NextRequest, ctx: RouteContext) {
     tenantId: auth.tenantId,
     organizationId: auth.orgId,
   }
+  if (getAttachmentStoragePolicy() === 'strict') {
+    const preflightRecord = await findOneWithDecryption(em, Attachment, deleteFilter, undefined, {
+      tenantId: auth.tenantId, organizationId: auth.orgId,
+    })
+    if (!preflightRecord) return throwAttachmentAccessError(404)
+    await assertAttachmentOwnerAccess({ em, context: createAttachmentAccessContext(container), auth, attachment: preflightRecord, action: 'delete' })
+    await storageDriverFactory.resolveForPartition(preflightRecord.partitionCode, {
+      tenantId: preflightRecord.tenantId ?? auth.tenantId, organizationId: preflightRecord.organizationId ?? auth.orgId,
+    })
+  }
   const outcome = await em.transactional(async (tx) => {
     const candidate = await findOneWithDecryption(tx, Attachment, deleteFilter, undefined, {
       tenantId: auth.tenantId, organizationId: auth.orgId,
@@ -301,7 +313,7 @@ async function deleteAttachment(req: NextRequest, ctx: RouteContext) {
 }
 
 export const PATCH = withAttachmentAccessErrors(updateAttachment)
-export const DELETE = withAttachmentAccessErrors(deleteAttachment)
+export const DELETE = withAttachmentAccessErrors(withAttachmentStorageErrors(deleteAttachment))
 
 export const openApi: OpenApiRouteDoc = {
   tag: attachmentsTag,
@@ -347,6 +359,7 @@ export const openApi: OpenApiRouteDoc = {
         { status: 200, description: 'Attachment deleted successfully', schema: z.object({ ok: z.literal(true) }) },
       ],
       errors: [
+        { status: 503, description: 'Attachment storage configuration rejected by policy', schema: attachmentErrorSchema },
         { status: 400, description: 'Invalid attachment ID', schema: attachmentErrorSchema },
         { status: 401, description: 'Unauthorized', schema: attachmentErrorSchema },
         { status: 404, description: 'Attachment not found', schema: attachmentErrorSchema },

package/src/modules/attachments/api/route.ts

@@ -1,3 +1,6 @@
+import { attachmentErrorSchema } from './openapi'
+import { withAttachmentStorageErrors } from '@open-mercato/core/modules/attachments/lib/storageErrors'
+import { assertAttachmentStoragePartitionExists, getAttachmentStoragePolicy } from '@open-mercato/core/modules/attachments/lib/drivers/storageValidation'
 import { LockMode } from '@mikro-orm/core'
 import { findOneWithDecryption } from '@open-mercato/shared/lib/encryption/find'
 import { prepareAttachmentMutation } from '../lib/access-mutation'
@@ -282,7 +285,7 @@ async function listRecordAttachments(req: Request) {
 
 export const GET = withAttachmentAccessErrors(listRecordAttachments)
 
-export async function POST(req: Request) {
+async function uploadAttachment(req: Request) {
   const { t } = await resolveTranslations()
   const auth = await getAuthFromRequest(req)
   if (!auth || !auth.tenantId || (!auth.orgId && !auth.isSuperAdmin)) return NextResponse.json({ error: 'Unauthorized' }, { status: 401 })
@@ -384,7 +387,7 @@ export async function POST(req: Request) {
   if (uploadScope.denied) return NextResponse.json({ error: 'Forbidden' }, { status: 403 })
   const orgId = uploadScope.organizationId
   if (!orgId) return NextResponse.json({ error: 'Unauthorized' }, { status: 401 })
-  await ensureDefaultPartitions(em)
+  if (getAttachmentStoragePolicy() === 'legacy') await ensureDefaultPartitions(em)
   // Optional per-field validations
   let partitionFromField: string | null = null
   let fieldMaxAttachmentSizeMb: number | null = null
@@ -457,6 +460,7 @@ export async function POST(req: Request) {
   let partition: AttachmentPartition | null = null
   for (const code of partitionCodeCandidates) {
     const record = await em.findOne(AttachmentPartition, { code })
+    assertAttachmentStoragePartitionExists(Boolean(record))
     if (record) {
       partition = record
       break
@@ -466,6 +470,7 @@ export async function POST(req: Request) {
     partition = await em.findOne(AttachmentPartition, { code: defaultPartitionCode })
   }
   if (!partition) {
+    assertAttachmentStoragePartitionExists(false)
     return NextResponse.json({ error: 'Storage partition is not configured.' }, { status: 400 })
   }
   await ensureAttachmentPartitionProtection(em, partition)
@@ -781,7 +786,8 @@ async function deleteAttachment(req: Request) {
   return NextResponse.json({ ok: true })
 }
 
-export const DELETE = withAttachmentAccessErrors(deleteAttachment)
+export const POST = withAttachmentAccessErrors(withAttachmentStorageErrors(uploadAttachment))
+export const DELETE = withAttachmentAccessErrors(withAttachmentStorageErrors(deleteAttachment))
 
 export const openApi: OpenApiRouteDoc = {
   summary: 'Manage entity attachments',
@@ -813,6 +819,7 @@ export const openApi: OpenApiRouteDoc = {
         { status: 200, description: 'Attachment stored successfully', schema: uploadResponseSchema },
       ],
       errors: [
+        { status: 503, description: 'Attachment storage configuration rejected by policy', schema: attachmentErrorSchema },
         { status: 400, description: 'Payload validation error', schema: errorSchema },
         { status: 401, description: 'Unauthorized', schema: errorSchema },
         { status: 403, description: 'Attachment violates field constraints', schema: errorSchema },
@@ -827,6 +834,7 @@ export const openApi: OpenApiRouteDoc = {
         { status: 404, description: 'Attachment not found', schema: errorSchema },
       ],
       errors: [
+        { status: 503, description: 'Attachment storage configuration rejected by policy', schema: attachmentErrorSchema },
         { status: 400, description: 'Missing attachment identifier', schema: errorSchema },
         { status: 401, description: 'Unauthorized', schema: errorSchema },
         { status: 403, description: 'Owner policy denies access', schema: errorSchema },

package/src/modules/attachments/cli.ts

@@ -3,6 +3,7 @@ import { createRequestContainer } from '@open-mercato/shared/lib/di/container'
 import type { EntityManager } from '@mikro-orm/postgresql'
 import { Attachment } from './data/entities'
 import type { StorageDriverFactory } from './lib/drivers'
+import { isAttachmentStorageConfigurationError } from './lib/drivers/storageValidation'
 import { removeAttachmentRecord } from './lib/storageReferences'
 
 type ParsedArgs = Record<string, string | boolean>
@@ -93,6 +94,7 @@ const deleteAttachments: ModuleCli = {
         console.log(`Not found: ${missing.join(', ')}`)
       }
     } catch (err) {
+      if (isAttachmentStorageConfigurationError(err)) throw err
       console.error('[attachments] delete command failed:', err)
     }
   },

package/src/modules/attachments/data/validators.ts

@@ -1,6 +1,17 @@
 import { z } from 'zod'
 import type { AttachmentAccessResolver } from '../lib/access-types'
 
+export const attachmentStorageConfigurationSchema = z.custom<Record<string, unknown>>((value) => {
+  if (!value || typeof value !== 'object' || Array.isArray(value)) return false
+  const prototype = Object.getPrototypeOf(value)
+  return prototype === Object.prototype || prototype === null
+})
+
+export const attachmentStorageScopeSchema = z.object({
+  tenantId: z.string(),
+  organizationId: z.string(),
+}).refine((scope) => Boolean(scope.tenantId.trim()) === Boolean(scope.organizationId.trim()))
+
 export const attachmentAccessActionSchema = z.enum(['read', 'render', 'metadata', 'reassign', 'delete', 'export'])
 export const attachmentAccessSubjectFeaturesSchema = z.array(z.string())
 export const attachmentAccessSelectorSchema = z.string().min(1).max(200).regex(/^(?:\*|[^*\s]+(?:\.\*)?)$/)

package/src/modules/attachments/i18n/de.json

@@ -13,6 +13,7 @@
   "attachments.errors.quotaRecoveryUnsupported": "Der Speichertreiber kann nicht an der Kontingent-Wiederherstellung teilnehmen.",
   "attachments.errors.quotaUnavailable": "Die Speicherkontingent-Abrechnung ist nicht verfügbar.",
   "attachments.errors.selectOrganization": "Wählen Sie eine bestimmte Organisation aus, bevor Sie einen Anhang hochladen.",
+  "attachments.errors.storageConfigurationInvalid": "Die Speicherkonfiguration für Anhänge ist nicht verfügbar.",
   "attachments.errors.storageFailed": "Die Anhangsdatei konnte nicht im Speicher abgelegt werden.",
   "attachments.errors.storagePathExists": "Der Zielspeicherpfad existiert bereits.",
   "attachments.errors.uploadFailed": "Das Hochladen des Anhangs ist fehlgeschlagen.",

package/src/modules/attachments/i18n/en.json

@@ -13,6 +13,7 @@
   "attachments.errors.quotaRecoveryUnsupported": "Storage driver cannot participate in quota recovery.",
   "attachments.errors.quotaUnavailable": "Storage quota accounting is unavailable.",
   "attachments.errors.selectOrganization": "Select a specific organization before uploading an attachment.",
+  "attachments.errors.storageConfigurationInvalid": "Attachment storage configuration is unavailable.",
   "attachments.errors.storageFailed": "Failed to store the attachment file.",
   "attachments.errors.storagePathExists": "The target storage path already exists.",
   "attachments.errors.uploadFailed": "Attachment upload failed.",

package/src/modules/attachments/i18n/es.json

@@ -13,6 +13,7 @@
   "attachments.errors.quotaRecoveryUnsupported": "El controlador de almacenamiento no puede participar en la recuperación de cuota.",
   "attachments.errors.quotaUnavailable": "La contabilidad de la cuota de almacenamiento no está disponible.",
   "attachments.errors.selectOrganization": "Selecciona una organización específica antes de subir un adjunto.",
+  "attachments.errors.storageConfigurationInvalid": "La configuración del almacenamiento de archivos adjuntos no está disponible.",
   "attachments.errors.storageFailed": "No se pudo almacenar el archivo adjunto.",
   "attachments.errors.storagePathExists": "La ruta de almacenamiento de destino ya existe.",
   "attachments.errors.uploadFailed": "Error al subir el archivo adjunto.",

package/src/modules/attachments/i18n/ko.json

@@ -13,6 +13,7 @@
   "attachments.errors.quotaRecoveryUnsupported": "저장 용량 복구가 지원되지 않습니다.",
   "attachments.errors.quotaUnavailable": "첨부파일 저장 용량 정보를 확인할 수 없습니다.",
   "attachments.errors.selectOrganization": "첨부파일을 업로드하기 전에 특정 조직을 선택하세요.",
+  "attachments.errors.storageConfigurationInvalid": "첨부 파일 저장소 구성을 사용할 수 없습니다.",
   "attachments.errors.storageFailed": "첨부 파일을 저장소에 기록하지 못했습니다.",
   "attachments.errors.storagePathExists": "대상 저장 경로가 이미 존재합니다.",
   "attachments.errors.uploadFailed": "첨부 파일 업로드에 실패했습니다.",

package/src/modules/attachments/i18n/pl.json

@@ -13,6 +13,7 @@
   "attachments.errors.quotaRecoveryUnsupported": "Sterownik przechowywania nie może uczestniczyć w odzyskiwaniu limitu.",
   "attachments.errors.quotaUnavailable": "Rozliczanie limitu przestrzeni dyskowej jest niedostępne.",
   "attachments.errors.selectOrganization": "Wybierz konkretną organizację przed przesłaniem załącznika.",
+  "attachments.errors.storageConfigurationInvalid": "Konfiguracja magazynu załączników jest niedostępna.",
   "attachments.errors.storageFailed": "Nie udało się zapisać pliku załącznika w magazynie.",
   "attachments.errors.storagePathExists": "Docelowa ścieżka przechowywania już istnieje.",
   "attachments.errors.uploadFailed": "Przesyłanie załącznika nie powiodło się.",

package/src/modules/attachments/index.ts

@@ -20,6 +20,18 @@ export {
   type ReleaseScopedAttachmentInput,
 } from './lib/attachment-service'
 
+export {
+  AttachmentStorageConfigurationError,
+  getAttachmentStoragePolicy,
+  isAttachmentStorageConfigurationError,
+  registerStorageDriverValidator,
+  type AttachmentStoragePolicy,
+  type AttachmentStorageScope,
+  type AttachmentStorageValidationStage,
+  type AttachmentStorageValidationContext,
+  type AttachmentStorageValidator,
+  type AttachmentStorageConfigurationReason,
+} from './lib/drivers/storageValidation'
 export type {
   AttachmentAccessAction,
   AttachmentAccessDecision,

package/src/modules/attachments/lib/access-query.ts

@@ -9,6 +9,7 @@ import { evaluateAttachmentAccess, type AttachmentAccessContext } from './access
 import type { AttachmentAccessAction, AttachmentAccessRecord } from './access-types'
 import { CrudHttpError } from '@open-mercato/shared/lib/crud/errors'
 import { attachmentAccessErrorBody, throwAttachmentAccessError } from './access-errors'
+import { assertAttachmentStoragePartitionExists } from './drivers/storageValidation'
 import { readAttachmentMetadata } from './metadata'
 
 export function requiresAttachmentAccessScan(partitions: readonly AttachmentPartition[]): boolean {
@@ -31,7 +32,10 @@ export async function assertAttachmentOwnerAccess(input: {
   const partition = await findOneWithDecryption(input.em, AttachmentPartition, { code: input.attachment.partitionCode }, undefined, {
     tenantId: input.attachment.tenantId, organizationId: input.attachment.organizationId,
   })
-  if (!partition) await throwAttachmentAccessError(404)
+  if (!partition) {
+    if (input.action === 'delete') assertAttachmentStoragePartitionExists(false)
+    await throwAttachmentAccessError(404)
+  }
   if (input.persistProtection) await ensureAttachmentPartitionProtection(input.em, partition!)
   const result = await evaluateAttachmentAccess({ ...input, partition: partition!, requireAuthForPublic: true })
   if (!result.ok) await throwAttachmentAccessError(result.status)

package/src/modules/attachments/lib/createFromBuffer.ts

@@ -3,6 +3,7 @@ import type { EntityManager } from '@mikro-orm/postgresql'
 import { emitCrudSideEffects } from '@open-mercato/shared/lib/commands/helpers'
 import { Attachment, AttachmentPartition } from '../data/entities'
 import { StorageDriverFactory } from './drivers'
+import { assertAttachmentStoragePartitionExists } from './drivers/storageValidation'
 import { ensureDefaultPartitions, resolveDefaultPartitionCode } from './partitions'
 import { buildAttachmentFileUrl } from './imageUrls'
 import { mergeAttachmentMetadata, upsertAssignment } from './metadata'
@@ -54,6 +55,7 @@ export async function createAttachmentFromBuffer(input: CreateAttachmentFromBuff
 
   let partition = await em.findOne(AttachmentPartition, { code })
   if (!partition) {
+    assertAttachmentStoragePartitionExists(false)
     await ensureDefaultPartitions(em)
     partition = await em.findOne(AttachmentPartition, { code })
   }