@open-mercato/core 0.6.2-develop.3381.1.8461b312a9 → 0.6.2-develop.3400.1.d948268f50

package/dist/modules/attachments/lib/drivers/legacyPublicDriver.js

@@ -0,0 +1,42 @@
+import { promises as fs } from "fs";
+import path from "path";
+class LegacyPublicStorageDriver {
+  constructor() {
+    this.key = "legacyPublic";
+  }
+  store(_payload) {
+    throw new Error("legacy-public driver is read-only");
+  }
+  async read(_partitionCode, storagePath) {
+    const absolutePath = this.resolveAbsolutePath(storagePath);
+    const buffer = await fs.readFile(absolutePath);
+    return { buffer };
+  }
+  async delete(_partitionCode, storagePath) {
+    const absolutePath = this.resolveAbsolutePath(storagePath);
+    try {
+      await fs.unlink(absolutePath);
+    } catch {
+    }
+  }
+  async toLocalPath(_partitionCode, storagePath) {
+    return {
+      filePath: this.resolveAbsolutePath(storagePath),
+      cleanup: async () => {
+      }
+    };
+  }
+  resolveAbsolutePath(storagePath) {
+    let safeRelative = storagePath.replace(/^\/*/, "");
+    let prev;
+    do {
+      prev = safeRelative;
+      safeRelative = safeRelative.replace(/\.\.(\/|\\)/g, "");
+    } while (safeRelative !== prev);
+    return path.join(process.cwd(), safeRelative);
+  }
+}
+export {
+  LegacyPublicStorageDriver
+};
+//# sourceMappingURL=legacyPublicDriver.js.map

package/dist/modules/attachments/lib/drivers/legacyPublicDriver.js.map

@@ -0,0 +1,7 @@
+{
+  "version": 3,
+  "sources": ["../../../../../src/modules/attachments/lib/drivers/legacyPublicDriver.ts"],
+  "sourcesContent": ["import { promises as fs } from 'fs'\nimport path from 'path'\nimport type { StorageDriver, StoreFilePayload, StoredFile, ReadFileResult } from './types'\n\nexport class LegacyPublicStorageDriver implements StorageDriver {\n  readonly key = 'legacyPublic'\n\n  store(_payload: StoreFilePayload): Promise<StoredFile> {\n    throw new Error('legacy-public driver is read-only')\n  }\n\n  async read(_partitionCode: string, storagePath: string): Promise<ReadFileResult> {\n    const absolutePath = this.resolveAbsolutePath(storagePath)\n    const buffer = await fs.readFile(absolutePath)\n    return { buffer }\n  }\n\n  async delete(_partitionCode: string, storagePath: string): Promise<void> {\n    const absolutePath = this.resolveAbsolutePath(storagePath)\n    try {\n      await fs.unlink(absolutePath)\n    } catch {\n      // best-effort removal\n    }\n  }\n\n  async toLocalPath(\n    _partitionCode: string,\n    storagePath: string,\n  ): Promise<{ filePath: string; cleanup: () => Promise<void> }> {\n    return {\n      filePath: this.resolveAbsolutePath(storagePath),\n      cleanup: async () => {},\n    }\n  }\n\n  private resolveAbsolutePath(storagePath: string): string {\n    let safeRelative = storagePath.replace(/^\\/*/, '')\n    let prev: string\n    do {\n      prev = safeRelative\n      safeRelative = safeRelative.replace(/\\.\\.(\\/|\\\\)/g, '')\n    } while (safeRelative !== prev)\n    return path.join(process.cwd(), safeRelative)\n  }\n}\n"],
+  "mappings": "AAAA,SAAS,YAAY,UAAU;AAC/B,OAAO,UAAU;AAGV,MAAM,0BAAmD;AAAA,EAAzD;AACL,SAAS,MAAM;AAAA;AAAA,EAEf,MAAM,UAAiD;AACrD,UAAM,IAAI,MAAM,mCAAmC;AAAA,EACrD;AAAA,EAEA,MAAM,KAAK,gBAAwB,aAA8C;AAC/E,UAAM,eAAe,KAAK,oBAAoB,WAAW;AACzD,UAAM,SAAS,MAAM,GAAG,SAAS,YAAY;AAC7C,WAAO,EAAE,OAAO;AAAA,EAClB;AAAA,EAEA,MAAM,OAAO,gBAAwB,aAAoC;AACvE,UAAM,eAAe,KAAK,oBAAoB,WAAW;AACzD,QAAI;AACF,YAAM,GAAG,OAAO,YAAY;AAAA,IAC9B,QAAQ;AAAA,IAER;AAAA,EACF;AAAA,EAEA,MAAM,YACJ,gBACA,aAC6D;AAC7D,WAAO;AAAA,MACL,UAAU,KAAK,oBAAoB,WAAW;AAAA,MAC9C,SAAS,YAAY;AAAA,MAAC;AAAA,IACxB;AAAA,EACF;AAAA,EAEQ,oBAAoB,aAA6B;AACvD,QAAI,eAAe,YAAY,QAAQ,QAAQ,EAAE;AACjD,QAAI;AACJ,OAAG;AACD,aAAO;AACP,qBAAe,aAAa,QAAQ,gBAAgB,EAAE;AAAA,IACxD,SAAS,iBAAiB;AAC1B,WAAO,KAAK,KAAK,QAAQ,IAAI,GAAG,YAAY;AAAA,EAC9C;AACF;",
+  "names": []
+}

package/dist/modules/attachments/lib/drivers/localDriver.js

@@ -0,0 +1,70 @@
+import { promises as fs } from "fs";
+import path from "path";
+import { randomUUID } from "crypto";
+import { resolvePartitionRoot } from "../storage.js";
+function sanitizeFileName(fileName) {
+  if (!fileName) return "file";
+  return fileName.replace(/[^a-zA-Z0-9._-]/g, "_");
+}
+function resolveOrgSegment(orgId) {
+  if (typeof orgId === "string" && orgId.trim().length > 0) return `org_${orgId}`;
+  return "org_shared";
+}
+function resolveTenantSegment(tenantId) {
+  if (typeof tenantId === "string" && tenantId.trim().length > 0) return `tenant_${tenantId}`;
+  return "tenant_shared";
+}
+class LocalStorageDriver {
+  constructor() {
+    this.key = "local";
+  }
+  async store(payload) {
+    const root = resolvePartitionRoot(payload.partitionCode);
+    const orgSegment = resolveOrgSegment(payload.orgId ?? null);
+    const tenantSegment = resolveTenantSegment(payload.tenantId ?? null);
+    const safeName = sanitizeFileName(payload.fileName || "file");
+    const uniqueSuffix = randomUUID().replace(/-/g, "").slice(0, 12);
+    const storedName = `${Date.now()}_${uniqueSuffix}_${safeName}`;
+    const relativePath = path.join(orgSegment, tenantSegment, storedName);
+    const absolutePath = path.join(root, relativePath);
+    await fs.mkdir(path.dirname(absolutePath), { recursive: true });
+    await fs.writeFile(absolutePath, payload.buffer);
+    return {
+      storagePath: relativePath.replace(/\\/g, "/")
+    };
+  }
+  async read(partitionCode, storagePath) {
+    const absolutePath = this.resolveAbsolutePath(partitionCode, storagePath);
+    const buffer = await fs.readFile(absolutePath);
+    return { buffer };
+  }
+  async delete(partitionCode, storagePath) {
+    const absolutePath = this.resolveAbsolutePath(partitionCode, storagePath);
+    try {
+      await fs.unlink(absolutePath);
+    } catch {
+    }
+  }
+  async toLocalPath(partitionCode, storagePath) {
+    const filePath = this.resolveAbsolutePath(partitionCode, storagePath);
+    return {
+      filePath,
+      cleanup: async () => {
+      }
+    };
+  }
+  resolveAbsolutePath(partitionCode, storagePath) {
+    let safeRelative = storagePath.replace(/^\/*/, "");
+    let prev;
+    do {
+      prev = safeRelative;
+      safeRelative = safeRelative.replace(/\.\.(\/|\\)/g, "");
+    } while (safeRelative !== prev);
+    const root = resolvePartitionRoot(partitionCode);
+    return path.join(root, safeRelative);
+  }
+}
+export {
+  LocalStorageDriver
+};
+//# sourceMappingURL=localDriver.js.map

package/dist/modules/attachments/lib/drivers/localDriver.js.map

@@ -0,0 +1,7 @@
+{
+  "version": 3,
+  "sources": ["../../../../../src/modules/attachments/lib/drivers/localDriver.ts"],
+  "sourcesContent": ["import { promises as fs } from 'fs'\nimport path from 'path'\nimport { randomUUID } from 'crypto'\nimport { resolvePartitionRoot } from '../storage'\nimport type { StorageDriver, StoreFilePayload, StoredFile, ReadFileResult } from './types'\n\nfunction sanitizeFileName(fileName: string): string {\n  if (!fileName) return 'file'\n  return fileName.replace(/[^a-zA-Z0-9._-]/g, '_')\n}\n\nfunction resolveOrgSegment(orgId: string | null | undefined): string {\n  if (typeof orgId === 'string' && orgId.trim().length > 0) return `org_${orgId}`\n  return 'org_shared'\n}\n\nfunction resolveTenantSegment(tenantId: string | null | undefined): string {\n  if (typeof tenantId === 'string' && tenantId.trim().length > 0) return `tenant_${tenantId}`\n  return 'tenant_shared'\n}\n\nexport class LocalStorageDriver implements StorageDriver {\n  readonly key = 'local'\n\n  async store(payload: StoreFilePayload): Promise<StoredFile> {\n    const root = resolvePartitionRoot(payload.partitionCode)\n    const orgSegment = resolveOrgSegment(payload.orgId ?? null)\n    const tenantSegment = resolveTenantSegment(payload.tenantId ?? null)\n    const safeName = sanitizeFileName(payload.fileName || 'file')\n    const uniqueSuffix = randomUUID().replace(/-/g, '').slice(0, 12)\n    const storedName = `${Date.now()}_${uniqueSuffix}_${safeName}`\n    const relativePath = path.join(orgSegment, tenantSegment, storedName)\n    const absolutePath = path.join(root, relativePath)\n    await fs.mkdir(path.dirname(absolutePath), { recursive: true })\n    await fs.writeFile(absolutePath, payload.buffer)\n    return {\n      storagePath: relativePath.replace(/\\\\/g, '/'),\n    }\n  }\n\n  async read(partitionCode: string, storagePath: string): Promise<ReadFileResult> {\n    const absolutePath = this.resolveAbsolutePath(partitionCode, storagePath)\n    const buffer = await fs.readFile(absolutePath)\n    return { buffer }\n  }\n\n  async delete(partitionCode: string, storagePath: string): Promise<void> {\n    const absolutePath = this.resolveAbsolutePath(partitionCode, storagePath)\n    try {\n      await fs.unlink(absolutePath)\n    } catch {\n      // best-effort removal\n    }\n  }\n\n  async toLocalPath(\n    partitionCode: string,\n    storagePath: string,\n  ): Promise<{ filePath: string; cleanup: () => Promise<void> }> {\n    const filePath = this.resolveAbsolutePath(partitionCode, storagePath)\n    return {\n      filePath,\n      cleanup: async () => {\n        // no-op: local path is the real file, do not delete\n      },\n    }\n  }\n\n  private resolveAbsolutePath(partitionCode: string, storagePath: string): string {\n    let safeRelative = storagePath.replace(/^\\/*/, '')\n    let prev: string\n    do {\n      prev = safeRelative\n      safeRelative = safeRelative.replace(/\\.\\.(\\/|\\\\)/g, '')\n    } while (safeRelative !== prev)\n    const root = resolvePartitionRoot(partitionCode)\n    return path.join(root, safeRelative)\n  }\n}\n"],
+  "mappings": "AAAA,SAAS,YAAY,UAAU;AAC/B,OAAO,UAAU;AACjB,SAAS,kBAAkB;AAC3B,SAAS,4BAA4B;AAGrC,SAAS,iBAAiB,UAA0B;AAClD,MAAI,CAAC,SAAU,QAAO;AACtB,SAAO,SAAS,QAAQ,oBAAoB,GAAG;AACjD;AAEA,SAAS,kBAAkB,OAA0C;AACnE,MAAI,OAAO,UAAU,YAAY,MAAM,KAAK,EAAE,SAAS,EAAG,QAAO,OAAO,KAAK;AAC7E,SAAO;AACT;AAEA,SAAS,qBAAqB,UAA6C;AACzE,MAAI,OAAO,aAAa,YAAY,SAAS,KAAK,EAAE,SAAS,EAAG,QAAO,UAAU,QAAQ;AACzF,SAAO;AACT;AAEO,MAAM,mBAA4C;AAAA,EAAlD;AACL,SAAS,MAAM;AAAA;AAAA,EAEf,MAAM,MAAM,SAAgD;AAC1D,UAAM,OAAO,qBAAqB,QAAQ,aAAa;AACvD,UAAM,aAAa,kBAAkB,QAAQ,SAAS,IAAI;AAC1D,UAAM,gBAAgB,qBAAqB,QAAQ,YAAY,IAAI;AACnE,UAAM,WAAW,iBAAiB,QAAQ,YAAY,MAAM;AAC5D,UAAM,eAAe,WAAW,EAAE,QAAQ,MAAM,EAAE,EAAE,MAAM,GAAG,EAAE;AAC/D,UAAM,aAAa,GAAG,KAAK,IAAI,CAAC,IAAI,YAAY,IAAI,QAAQ;AAC5D,UAAM,eAAe,KAAK,KAAK,YAAY,eAAe,UAAU;AACpE,UAAM,eAAe,KAAK,KAAK,MAAM,YAAY;AACjD,UAAM,GAAG,MAAM,KAAK,QAAQ,YAAY,GAAG,EAAE,WAAW,KAAK,CAAC;AAC9D,UAAM,GAAG,UAAU,cAAc,QAAQ,MAAM;AAC/C,WAAO;AAAA,MACL,aAAa,aAAa,QAAQ,OAAO,GAAG;AAAA,IAC9C;AAAA,EACF;AAAA,EAEA,MAAM,KAAK,eAAuB,aAA8C;AAC9E,UAAM,eAAe,KAAK,oBAAoB,eAAe,WAAW;AACxE,UAAM,SAAS,MAAM,GAAG,SAAS,YAAY;AAC7C,WAAO,EAAE,OAAO;AAAA,EAClB;AAAA,EAEA,MAAM,OAAO,eAAuB,aAAoC;AACtE,UAAM,eAAe,KAAK,oBAAoB,eAAe,WAAW;AACxE,QAAI;AACF,YAAM,GAAG,OAAO,YAAY;AAAA,IAC9B,QAAQ;AAAA,IAER;AAAA,EACF;AAAA,EAEA,MAAM,YACJ,eACA,aAC6D;AAC7D,UAAM,WAAW,KAAK,oBAAoB,eAAe,WAAW;AACpE,WAAO;AAAA,MACL;AAAA,MACA,SAAS,YAAY;AAAA,MAErB;AAAA,IACF;AAAA,EACF;AAAA,EAEQ,oBAAoB,eAAuB,aAA6B;AAC9E,QAAI,eAAe,YAAY,QAAQ,QAAQ,EAAE;AACjD,QAAI;AACJ,OAAG;AACD,aAAO;AACP,qBAAe,aAAa,QAAQ,gBAAgB,EAAE;AAAA,IACxD,SAAS,iBAAiB;AAC1B,UAAM,OAAO,qBAAqB,aAAa;AAC/C,WAAO,KAAK,KAAK,MAAM,YAAY;AAAA,EACrC;AACF;",
+  "names": []
+}

package/dist/modules/attachments/lib/drivers/types.js

@@ -0,0 +1 @@
+//# sourceMappingURL=types.js.map

package/dist/modules/attachments/lib/drivers/types.js.map

@@ -0,0 +1,7 @@
+{
+  "version": 3,
+  "sources": [],
+  "sourcesContent": [],
+  "mappings": "",
+  "names": []
+}

package/dist/modules/attachments/lib/ocrQueue.js

@@ -1,9 +1,10 @@
 import { Attachment, AttachmentPartition } from "../data/entities.js";
 import { OcrService } from "./ocrService.js";
-async function processAttachmentOcr(em, payload) {
-  const { attachmentId, filePath, mimeType, partitionCode } = payload;
+async function processAttachmentOcr(em, payload, driver) {
+  const { attachmentId, storagePath, mimeType, partitionCode } = payload;
   console.log(`[attachments.ocr] Processing started for attachment: ${attachmentId}`);
   const startTime = Date.now();
+  const { filePath, cleanup } = await driver.toLocalPath(partitionCode, storagePath);
   try {
     const partition = await em.findOne(AttachmentPartition, { code: partitionCode });
     const resolvedModel = partition?.ocrModel ?? process.env.OCR_MODEL ?? "gpt-4o";
@@ -40,12 +41,16 @@ async function processAttachmentOcr(em, payload) {
       attachmentId,
       error: error instanceof Error ? error.message : String(error)
     });
+  } finally {
+    await cleanup().catch((cleanupError) => {
+      console.warn(`[attachments.ocr] Temp file cleanup failed:`, cleanupError);
+    });
   }
 }
-async function requestOcrProcessing(em, attachment, filePath) {
+async function requestOcrProcessing(em, attachment, driver, storagePath) {
   const payload = {
     attachmentId: attachment.id,
-    filePath,
+    storagePath,
     mimeType: attachment.mimeType,
     partitionCode: attachment.partitionCode,
     organizationId: attachment.organizationId ?? null,
@@ -53,7 +58,7 @@ async function requestOcrProcessing(em, attachment, filePath) {
   };
   setImmediate(() => {
     const workerEm = typeof em?.fork === "function" ? em.fork() : em;
-    processAttachmentOcr(workerEm, payload).catch((error) => {
+    processAttachmentOcr(workerEm, payload, driver).catch((error) => {
       console.error(`[attachments.ocr] Background processing error:`, error);
     });
   });

package/dist/modules/attachments/lib/ocrQueue.js.map

@@ -1,7 +1,7 @@
 {
   "version": 3,
   "sources": ["../../../../src/modules/attachments/lib/ocrQueue.ts"],
-  "sourcesContent": ["import type { EntityManager } from '@mikro-orm/postgresql'\nimport { Attachment, AttachmentPartition } from '../data/entities'\nimport { OcrService } from './ocrService'\n\nexport type OcrRequestedEvent = {\n  attachmentId: string\n  filePath: string\n  mimeType: string\n  partitionCode: string\n  organizationId: string | null\n  tenantId: string | null\n}\n\nexport async function processAttachmentOcr(\n  em: EntityManager,\n  payload: OcrRequestedEvent\n): Promise<void> {\n  const { attachmentId, filePath, mimeType, partitionCode } = payload\n\n  console.log(`[attachments.ocr] Processing started for attachment: ${attachmentId}`)\n  const startTime = Date.now()\n\n  try {\n    const partition = await em.findOne(AttachmentPartition, { code: partitionCode })\n    const resolvedModel = partition?.ocrModel ?? process.env.OCR_MODEL ?? 'gpt-4o'\n\n    const ocrService = new OcrService()\n\n    if (!ocrService.available) {\n      console.warn(`[attachments.ocr] OPENAI_API_KEY not configured, skipping OCR for: ${attachmentId}`)\n      return\n    }\n\n    const result = await ocrService.processFile({\n      filePath,\n      mimeType,\n      model: resolvedModel,\n    })\n\n    if (!result) {\n      console.log(`[attachments.ocr] No content extracted for attachment: ${attachmentId}`)\n      return\n    }\n\n    const attachment = await em.findOne(Attachment, { id: attachmentId })\n    if (!attachment) {\n      console.error(`[attachments.ocr] Attachment not found: ${attachmentId}`)\n      return\n    }\n\n    attachment.content = result.content\n    await em.persist(attachment).flush()\n\n    console.log(`[attachments.ocr] Processing completed:`, {\n      attachmentId,\n      pageCount: result.pageCount,\n      contentLength: result.content.length,\n      timeMs: result.processingTimeMs,\n      totalTimeMs: Date.now() - startTime,\n    })\n  } catch (error) {\n    console.error(`[attachments.ocr] Processing failed:`, {\n      attachmentId,\n      error: error instanceof Error ? error.message : String(error),\n    })\n  }\n}\n\nexport async function requestOcrProcessing(\n  em: EntityManager,\n  attachment: Attachment,\n  filePath: string\n): Promise<void> {\n  const payload: OcrRequestedEvent = {\n    attachmentId: attachment.id,\n    filePath,\n    mimeType: attachment.mimeType,\n    partitionCode: attachment.partitionCode,\n    organizationId: attachment.organizationId ?? null,\n    tenantId: attachment.tenantId ?? null,\n  }\n\n  setImmediate(() => {\n    const workerEm = typeof (em as any)?.fork === 'function' ? (em as any).fork() : em\n    processAttachmentOcr(workerEm, payload).catch((error) => {\n      console.error(`[attachments.ocr] Background processing error:`, error)\n    })\n  })\n}\n"],
-  "mappings": "AACA,SAAS,YAAY,2BAA2B;AAChD,SAAS,kBAAkB;AAW3B,eAAsB,qBACpB,IACA,SACe;AACf,QAAM,EAAE,cAAc,UAAU,UAAU,cAAc,IAAI;AAE5D,UAAQ,IAAI,wDAAwD,YAAY,EAAE;AAClF,QAAM,YAAY,KAAK,IAAI;AAE3B,MAAI;AACF,UAAM,YAAY,MAAM,GAAG,QAAQ,qBAAqB,EAAE,MAAM,cAAc,CAAC;AAC/E,UAAM,gBAAgB,WAAW,YAAY,QAAQ,IAAI,aAAa;AAEtE,UAAM,aAAa,IAAI,WAAW;AAElC,QAAI,CAAC,WAAW,WAAW;AACzB,cAAQ,KAAK,sEAAsE,YAAY,EAAE;AACjG;AAAA,IACF;AAEA,UAAM,SAAS,MAAM,WAAW,YAAY;AAAA,MAC1C;AAAA,MACA;AAAA,MACA,OAAO;AAAA,IACT,CAAC;AAED,QAAI,CAAC,QAAQ;AACX,cAAQ,IAAI,0DAA0D,YAAY,EAAE;AACpF;AAAA,IACF;AAEA,UAAM,aAAa,MAAM,GAAG,QAAQ,YAAY,EAAE,IAAI,aAAa,CAAC;AACpE,QAAI,CAAC,YAAY;AACf,cAAQ,MAAM,2CAA2C,YAAY,EAAE;AACvE;AAAA,IACF;AAEA,eAAW,UAAU,OAAO;AAC5B,UAAM,GAAG,QAAQ,UAAU,EAAE,MAAM;AAEnC,YAAQ,IAAI,2CAA2C;AAAA,MACrD;AAAA,MACA,WAAW,OAAO;AAAA,MAClB,eAAe,OAAO,QAAQ;AAAA,MAC9B,QAAQ,OAAO;AAAA,MACf,aAAa,KAAK,IAAI,IAAI;AAAA,IAC5B,CAAC;AAAA,EACH,SAAS,OAAO;AACd,YAAQ,MAAM,wCAAwC;AAAA,MACpD;AAAA,MACA,OAAO,iBAAiB,QAAQ,MAAM,UAAU,OAAO,KAAK;AAAA,IAC9D,CAAC;AAAA,EACH;AACF;AAEA,eAAsB,qBACpB,IACA,YACA,UACe;AACf,QAAM,UAA6B;AAAA,IACjC,cAAc,WAAW;AAAA,IACzB;AAAA,IACA,UAAU,WAAW;AAAA,IACrB,eAAe,WAAW;AAAA,IAC1B,gBAAgB,WAAW,kBAAkB;AAAA,IAC7C,UAAU,WAAW,YAAY;AAAA,EACnC;AAEA,eAAa,MAAM;AACjB,UAAM,WAAW,OAAQ,IAAY,SAAS,aAAc,GAAW,KAAK,IAAI;AAChF,yBAAqB,UAAU,OAAO,EAAE,MAAM,CAAC,UAAU;AACvD,cAAQ,MAAM,kDAAkD,KAAK;AAAA,IACvE,CAAC;AAAA,EACH,CAAC;AACH;",
+  "sourcesContent": ["import type { EntityManager } from '@mikro-orm/postgresql'\nimport { Attachment, AttachmentPartition } from '../data/entities'\nimport { OcrService } from './ocrService'\nimport type { StorageDriver } from './drivers/types'\n\nexport type OcrRequestedEvent = {\n  attachmentId: string\n  storagePath: string\n  mimeType: string\n  partitionCode: string\n  organizationId: string | null\n  tenantId: string | null\n}\n\nexport async function processAttachmentOcr(\n  em: EntityManager,\n  payload: OcrRequestedEvent,\n  driver: StorageDriver,\n): Promise<void> {\n  const { attachmentId, storagePath, mimeType, partitionCode } = payload\n\n  console.log(`[attachments.ocr] Processing started for attachment: ${attachmentId}`)\n  const startTime = Date.now()\n\n  const { filePath, cleanup } = await driver.toLocalPath(partitionCode, storagePath)\n  try {\n    const partition = await em.findOne(AttachmentPartition, { code: partitionCode })\n    const resolvedModel = partition?.ocrModel ?? process.env.OCR_MODEL ?? 'gpt-4o'\n\n    const ocrService = new OcrService()\n\n    if (!ocrService.available) {\n      console.warn(`[attachments.ocr] OPENAI_API_KEY not configured, skipping OCR for: ${attachmentId}`)\n      return\n    }\n\n    const result = await ocrService.processFile({\n      filePath,\n      mimeType,\n      model: resolvedModel,\n    })\n\n    if (!result) {\n      console.log(`[attachments.ocr] No content extracted for attachment: ${attachmentId}`)\n      return\n    }\n\n    const attachment = await em.findOne(Attachment, { id: attachmentId })\n    if (!attachment) {\n      console.error(`[attachments.ocr] Attachment not found: ${attachmentId}`)\n      return\n    }\n\n    attachment.content = result.content\n    await em.persist(attachment).flush()\n\n    console.log(`[attachments.ocr] Processing completed:`, {\n      attachmentId,\n      pageCount: result.pageCount,\n      contentLength: result.content.length,\n      timeMs: result.processingTimeMs,\n      totalTimeMs: Date.now() - startTime,\n    })\n  } catch (error) {\n    console.error(`[attachments.ocr] Processing failed:`, {\n      attachmentId,\n      error: error instanceof Error ? error.message : String(error),\n    })\n  } finally {\n    await cleanup().catch((cleanupError) => {\n      console.warn(`[attachments.ocr] Temp file cleanup failed:`, cleanupError)\n    })\n  }\n}\n\nexport async function requestOcrProcessing(\n  em: EntityManager,\n  attachment: Attachment,\n  driver: StorageDriver,\n  storagePath: string,\n): Promise<void> {\n  const payload: OcrRequestedEvent = {\n    attachmentId: attachment.id,\n    storagePath,\n    mimeType: attachment.mimeType,\n    partitionCode: attachment.partitionCode,\n    organizationId: attachment.organizationId ?? null,\n    tenantId: attachment.tenantId ?? null,\n  }\n\n  setImmediate(() => {\n    const workerEm = typeof (em as any)?.fork === 'function' ? (em as any).fork() : em\n    processAttachmentOcr(workerEm, payload, driver).catch((error) => {\n      console.error(`[attachments.ocr] Background processing error:`, error)\n    })\n  })\n}\n"],
+  "mappings": "AACA,SAAS,YAAY,2BAA2B;AAChD,SAAS,kBAAkB;AAY3B,eAAsB,qBACpB,IACA,SACA,QACe;AACf,QAAM,EAAE,cAAc,aAAa,UAAU,cAAc,IAAI;AAE/D,UAAQ,IAAI,wDAAwD,YAAY,EAAE;AAClF,QAAM,YAAY,KAAK,IAAI;AAE3B,QAAM,EAAE,UAAU,QAAQ,IAAI,MAAM,OAAO,YAAY,eAAe,WAAW;AACjF,MAAI;AACF,UAAM,YAAY,MAAM,GAAG,QAAQ,qBAAqB,EAAE,MAAM,cAAc,CAAC;AAC/E,UAAM,gBAAgB,WAAW,YAAY,QAAQ,IAAI,aAAa;AAEtE,UAAM,aAAa,IAAI,WAAW;AAElC,QAAI,CAAC,WAAW,WAAW;AACzB,cAAQ,KAAK,sEAAsE,YAAY,EAAE;AACjG;AAAA,IACF;AAEA,UAAM,SAAS,MAAM,WAAW,YAAY;AAAA,MAC1C;AAAA,MACA;AAAA,MACA,OAAO;AAAA,IACT,CAAC;AAED,QAAI,CAAC,QAAQ;AACX,cAAQ,IAAI,0DAA0D,YAAY,EAAE;AACpF;AAAA,IACF;AAEA,UAAM,aAAa,MAAM,GAAG,QAAQ,YAAY,EAAE,IAAI,aAAa,CAAC;AACpE,QAAI,CAAC,YAAY;AACf,cAAQ,MAAM,2CAA2C,YAAY,EAAE;AACvE;AAAA,IACF;AAEA,eAAW,UAAU,OAAO;AAC5B,UAAM,GAAG,QAAQ,UAAU,EAAE,MAAM;AAEnC,YAAQ,IAAI,2CAA2C;AAAA,MACrD;AAAA,MACA,WAAW,OAAO;AAAA,MAClB,eAAe,OAAO,QAAQ;AAAA,MAC9B,QAAQ,OAAO;AAAA,MACf,aAAa,KAAK,IAAI,IAAI;AAAA,IAC5B,CAAC;AAAA,EACH,SAAS,OAAO;AACd,YAAQ,MAAM,wCAAwC;AAAA,MACpD;AAAA,MACA,OAAO,iBAAiB,QAAQ,MAAM,UAAU,OAAO,KAAK;AAAA,IAC9D,CAAC;AAAA,EACH,UAAE;AACA,UAAM,QAAQ,EAAE,MAAM,CAAC,iBAAiB;AACtC,cAAQ,KAAK,+CAA+C,YAAY;AAAA,IAC1E,CAAC;AAAA,EACH;AACF;AAEA,eAAsB,qBACpB,IACA,YACA,QACA,aACe;AACf,QAAM,UAA6B;AAAA,IACjC,cAAc,WAAW;AAAA,IACzB;AAAA,IACA,UAAU,WAAW;AAAA,IACrB,eAAe,WAAW;AAAA,IAC1B,gBAAgB,WAAW,kBAAkB;AAAA,IAC7C,UAAU,WAAW,YAAY;AAAA,EACnC;AAEA,eAAa,MAAM;AACjB,UAAM,WAAW,OAAQ,IAAY,SAAS,aAAc,GAAW,KAAK,IAAI;AAChF,yBAAqB,UAAU,SAAS,MAAM,EAAE,MAAM,CAAC,UAAU;AAC/D,cAAQ,MAAM,kDAAkD,KAAK;AAAA,IACvE,CAAC;AAAA,EACH,CAAC;AACH;",
   "names": []
 }

package/dist/modules/attachments/lib/storage.js.map

@@ -1,7 +1,7 @@
 {
   "version": 3,
   "sources": ["../../../../src/modules/attachments/lib/storage.ts"],
-  "sourcesContent": ["import { promises as fs } from 'fs'\nimport path from 'path'\nimport { randomUUID } from 'crypto'\nimport { resolvePartitionEnvKey } from './partitionEnv'\n\nexport function resolvePartitionRoot(code: string): string {\n  const envKey = resolvePartitionEnvKey(code)\n  const envPath = process.env[envKey]\n  if (envPath && envPath.trim().length > 0) {\n    return path.resolve(envPath)\n  }\n  return path.join(process.cwd(), 'storage', 'attachments', code)\n}\n\nfunction sanitizeFileName(fileName: string): string {\n  if (!fileName) return 'file'\n  return fileName.replace(/[^a-zA-Z0-9._-]/g, '_')\n}\n\nfunction resolveOrgSegment(orgId: string | null | undefined): string {\n  if (typeof orgId === 'string' && orgId.trim().length > 0) return `org_${orgId}`\n  return 'org_shared'\n}\n\nfunction resolveTenantSegment(tenantId: string | null | undefined): string {\n  if (typeof tenantId === 'string' && tenantId.trim().length > 0) return `tenant_${tenantId}`\n  return 'tenant_shared'\n}\n\nexport type StorePartitionFilePayload = {\n  partitionCode: string\n  orgId: string | null | undefined\n  tenantId: string | null | undefined\n  fileName: string\n  buffer: Buffer\n}\n\nexport type StoredPartitionFile = {\n  storagePath: string\n  absolutePath: string\n  fileName: string\n}\n\nexport async function storePartitionFile(payload: StorePartitionFilePayload): Promise<StoredPartitionFile> {\n  const root = resolvePartitionRoot(payload.partitionCode)\n  const orgSegment = resolveOrgSegment(payload.orgId ?? null)\n  const tenantSegment = resolveTenantSegment(payload.tenantId ?? null)\n  const safeName = sanitizeFileName(payload.fileName || 'file')\n  const uniqueSuffix = randomUUID().replace(/-/g, '').slice(0, 12)\n  const storedName = `${Date.now()}_${uniqueSuffix}_${safeName}`\n  const relativePath = path.join(orgSegment, tenantSegment, storedName)\n  const absolutePath = path.join(root, relativePath)\n  await fs.mkdir(path.dirname(absolutePath), { recursive: true })\n  await fs.writeFile(absolutePath, payload.buffer)\n  return {\n    storagePath: relativePath.replace(/\\\\/g, '/'),\n    absolutePath,\n    fileName: storedName,\n  }\n}\n\nexport function resolveAttachmentAbsolutePath(\n  partitionCode: string,\n  storagePath: string,\n  storageDriver?: string | null\n): string {\n  // Remove leading slashes first\n  let safeRelative = storagePath.replace(/^\\/*/, '')\n  // Remove all ../ (and ..\\) path traversal segments, repeatedly until gone\n  do {\n    var prev = safeRelative\n    safeRelative = safeRelative.replace(/\\.\\.(\\/|\\\\)/g, '')\n  } while (safeRelative !== prev)\n  if (storageDriver === 'legacyPublic') {\n    return path.join(process.cwd(), safeRelative)\n  }\n  const root = resolvePartitionRoot(partitionCode)\n  return path.join(root, safeRelative)\n}\n\nexport async function deletePartitionFile(\n  partitionCode: string,\n  storagePath: string,\n  storageDriver?: string | null\n): Promise<void> {\n  const absolutePath = resolveAttachmentAbsolutePath(partitionCode, storagePath, storageDriver)\n  try {\n    await fs.unlink(absolutePath)\n  } catch {\n    // best-effort removal\n  }\n}\n"],
-  "mappings": "AAAA,SAAS,YAAY,UAAU;AAC/B,OAAO,UAAU;AACjB,SAAS,kBAAkB;AAC3B,SAAS,8BAA8B;AAEhC,SAAS,qBAAqB,MAAsB;AACzD,QAAM,SAAS,uBAAuB,IAAI;AAC1C,QAAM,UAAU,QAAQ,IAAI,MAAM;AAClC,MAAI,WAAW,QAAQ,KAAK,EAAE,SAAS,GAAG;AACxC,WAAO,KAAK,QAAQ,OAAO;AAAA,EAC7B;AACA,SAAO,KAAK,KAAK,QAAQ,IAAI,GAAG,WAAW,eAAe,IAAI;AAChE;AAEA,SAAS,iBAAiB,UAA0B;AAClD,MAAI,CAAC,SAAU,QAAO;AACtB,SAAO,SAAS,QAAQ,oBAAoB,GAAG;AACjD;AAEA,SAAS,kBAAkB,OAA0C;AACnE,MAAI,OAAO,UAAU,YAAY,MAAM,KAAK,EAAE,SAAS,EAAG,QAAO,OAAO,KAAK;AAC7E,SAAO;AACT;AAEA,SAAS,qBAAqB,UAA6C;AACzE,MAAI,OAAO,aAAa,YAAY,SAAS,KAAK,EAAE,SAAS,EAAG,QAAO,UAAU,QAAQ;AACzF,SAAO;AACT;AAgBA,eAAsB,mBAAmB,SAAkE;AACzG,QAAM,OAAO,qBAAqB,QAAQ,aAAa;AACvD,QAAM,aAAa,kBAAkB,QAAQ,SAAS,IAAI;AAC1D,QAAM,gBAAgB,qBAAqB,QAAQ,YAAY,IAAI;AACnE,QAAM,WAAW,iBAAiB,QAAQ,YAAY,MAAM;AAC5D,QAAM,eAAe,WAAW,EAAE,QAAQ,MAAM,EAAE,EAAE,MAAM,GAAG,EAAE;AAC/D,QAAM,aAAa,GAAG,KAAK,IAAI,CAAC,IAAI,YAAY,IAAI,QAAQ;AAC5D,QAAM,eAAe,KAAK,KAAK,YAAY,eAAe,UAAU;AACpE,QAAM,eAAe,KAAK,KAAK,MAAM,YAAY;AACjD,QAAM,GAAG,MAAM,KAAK,QAAQ,YAAY,GAAG,EAAE,WAAW,KAAK,CAAC;AAC9D,QAAM,GAAG,UAAU,cAAc,QAAQ,MAAM;AAC/C,SAAO;AAAA,IACL,aAAa,aAAa,QAAQ,OAAO,GAAG;AAAA,IAC5C;AAAA,IACA,UAAU;AAAA,EACZ;AACF;AAEO,SAAS,8BACd,eACA,aACA,eACQ;AAER,MAAI,eAAe,YAAY,QAAQ,QAAQ,EAAE;AAEjD,KAAG;AACD,QAAI,OAAO;AACX,mBAAe,aAAa,QAAQ,gBAAgB,EAAE;AAAA,EACxD,SAAS,iBAAiB;AAC1B,MAAI,kBAAkB,gBAAgB;AACpC,WAAO,KAAK,KAAK,QAAQ,IAAI,GAAG,YAAY;AAAA,EAC9C;AACA,QAAM,OAAO,qBAAqB,aAAa;AAC/C,SAAO,KAAK,KAAK,MAAM,YAAY;AACrC;AAEA,eAAsB,oBACpB,eACA,aACA,eACe;AACf,QAAM,eAAe,8BAA8B,eAAe,aAAa,aAAa;AAC5F,MAAI;AACF,UAAM,GAAG,OAAO,YAAY;AAAA,EAC9B,QAAQ;AAAA,EAER;AACF;",
+  "sourcesContent": ["import { promises as fs } from 'fs'\nimport path from 'path'\nimport { randomUUID } from 'crypto'\nimport { resolvePartitionEnvKey } from './partitionEnv'\n\nexport function resolvePartitionRoot(code: string): string {\n  const envKey = resolvePartitionEnvKey(code)\n  const envPath = process.env[envKey]\n  if (envPath && envPath.trim().length > 0) {\n    return path.resolve(envPath)\n  }\n  return path.join(process.cwd(), 'storage', 'attachments', code)\n}\n\nfunction sanitizeFileName(fileName: string): string {\n  if (!fileName) return 'file'\n  return fileName.replace(/[^a-zA-Z0-9._-]/g, '_')\n}\n\nfunction resolveOrgSegment(orgId: string | null | undefined): string {\n  if (typeof orgId === 'string' && orgId.trim().length > 0) return `org_${orgId}`\n  return 'org_shared'\n}\n\nfunction resolveTenantSegment(tenantId: string | null | undefined): string {\n  if (typeof tenantId === 'string' && tenantId.trim().length > 0) return `tenant_${tenantId}`\n  return 'tenant_shared'\n}\n\n/**\n * @deprecated Use `StorageDriverFactory.resolveForPartition()` + `driver.store()` instead.\n * Kept for backward compatibility with external callers.\n */\nexport type StorePartitionFilePayload = {\n  partitionCode: string\n  orgId: string | null | undefined\n  tenantId: string | null | undefined\n  fileName: string\n  buffer: Buffer\n}\n\nexport type StoredPartitionFile = {\n  storagePath: string\n  absolutePath: string\n  fileName: string\n}\n\n/**\n * @deprecated Use `StorageDriverFactory.resolveForPartition()` + `driver.store()` instead.\n */\nexport async function storePartitionFile(payload: StorePartitionFilePayload): Promise<StoredPartitionFile> {\n  const root = resolvePartitionRoot(payload.partitionCode)\n  const orgSegment = resolveOrgSegment(payload.orgId ?? null)\n  const tenantSegment = resolveTenantSegment(payload.tenantId ?? null)\n  const safeName = sanitizeFileName(payload.fileName || 'file')\n  const uniqueSuffix = randomUUID().replace(/-/g, '').slice(0, 12)\n  const storedName = `${Date.now()}_${uniqueSuffix}_${safeName}`\n  const relativePath = path.join(orgSegment, tenantSegment, storedName)\n  const absolutePath = path.join(root, relativePath)\n  await fs.mkdir(path.dirname(absolutePath), { recursive: true })\n  await fs.writeFile(absolutePath, payload.buffer)\n  return {\n    storagePath: relativePath.replace(/\\\\/g, '/'),\n    absolutePath,\n    fileName: storedName,\n  }\n}\n\n/**\n * @deprecated Use `StorageDriverFactory.resolveForAttachment()` + `driver.read()` / `driver.toLocalPath()` instead.\n */\nexport function resolveAttachmentAbsolutePath(\n  partitionCode: string,\n  storagePath: string,\n  storageDriver?: string | null\n): string {\n  // Remove leading slashes first\n  let safeRelative = storagePath.replace(/^\\/*/, '')\n  // Remove all ../ (and ..\\) path traversal segments, repeatedly until gone\n  do {\n    var prev = safeRelative\n    safeRelative = safeRelative.replace(/\\.\\.(\\/|\\\\)/g, '')\n  } while (safeRelative !== prev)\n  if (storageDriver === 'legacyPublic') {\n    return path.join(process.cwd(), safeRelative)\n  }\n  const root = resolvePartitionRoot(partitionCode)\n  return path.join(root, safeRelative)\n}\n\n/**\n * @deprecated Use `StorageDriverFactory.resolveForAttachment()` + `driver.delete()` instead.\n */\nexport async function deletePartitionFile(\n  partitionCode: string,\n  storagePath: string,\n  storageDriver?: string | null\n): Promise<void> {\n  const absolutePath = resolveAttachmentAbsolutePath(partitionCode, storagePath, storageDriver)\n  try {\n    await fs.unlink(absolutePath)\n  } catch {\n    // best-effort removal\n  }\n}\n"],
+  "mappings": "AAAA,SAAS,YAAY,UAAU;AAC/B,OAAO,UAAU;AACjB,SAAS,kBAAkB;AAC3B,SAAS,8BAA8B;AAEhC,SAAS,qBAAqB,MAAsB;AACzD,QAAM,SAAS,uBAAuB,IAAI;AAC1C,QAAM,UAAU,QAAQ,IAAI,MAAM;AAClC,MAAI,WAAW,QAAQ,KAAK,EAAE,SAAS,GAAG;AACxC,WAAO,KAAK,QAAQ,OAAO;AAAA,EAC7B;AACA,SAAO,KAAK,KAAK,QAAQ,IAAI,GAAG,WAAW,eAAe,IAAI;AAChE;AAEA,SAAS,iBAAiB,UAA0B;AAClD,MAAI,CAAC,SAAU,QAAO;AACtB,SAAO,SAAS,QAAQ,oBAAoB,GAAG;AACjD;AAEA,SAAS,kBAAkB,OAA0C;AACnE,MAAI,OAAO,UAAU,YAAY,MAAM,KAAK,EAAE,SAAS,EAAG,QAAO,OAAO,KAAK;AAC7E,SAAO;AACT;AAEA,SAAS,qBAAqB,UAA6C;AACzE,MAAI,OAAO,aAAa,YAAY,SAAS,KAAK,EAAE,SAAS,EAAG,QAAO,UAAU,QAAQ;AACzF,SAAO;AACT;AAuBA,eAAsB,mBAAmB,SAAkE;AACzG,QAAM,OAAO,qBAAqB,QAAQ,aAAa;AACvD,QAAM,aAAa,kBAAkB,QAAQ,SAAS,IAAI;AAC1D,QAAM,gBAAgB,qBAAqB,QAAQ,YAAY,IAAI;AACnE,QAAM,WAAW,iBAAiB,QAAQ,YAAY,MAAM;AAC5D,QAAM,eAAe,WAAW,EAAE,QAAQ,MAAM,EAAE,EAAE,MAAM,GAAG,EAAE;AAC/D,QAAM,aAAa,GAAG,KAAK,IAAI,CAAC,IAAI,YAAY,IAAI,QAAQ;AAC5D,QAAM,eAAe,KAAK,KAAK,YAAY,eAAe,UAAU;AACpE,QAAM,eAAe,KAAK,KAAK,MAAM,YAAY;AACjD,QAAM,GAAG,MAAM,KAAK,QAAQ,YAAY,GAAG,EAAE,WAAW,KAAK,CAAC;AAC9D,QAAM,GAAG,UAAU,cAAc,QAAQ,MAAM;AAC/C,SAAO;AAAA,IACL,aAAa,aAAa,QAAQ,OAAO,GAAG;AAAA,IAC5C;AAAA,IACA,UAAU;AAAA,EACZ;AACF;AAKO,SAAS,8BACd,eACA,aACA,eACQ;AAER,MAAI,eAAe,YAAY,QAAQ,QAAQ,EAAE;AAEjD,KAAG;AACD,QAAI,OAAO;AACX,mBAAe,aAAa,QAAQ,gBAAgB,EAAE;AAAA,EACxD,SAAS,iBAAiB;AAC1B,MAAI,kBAAkB,gBAAgB;AACpC,WAAO,KAAK,KAAK,QAAQ,IAAI,GAAG,YAAY;AAAA,EAC9C;AACA,QAAM,OAAO,qBAAqB,aAAa;AAC/C,SAAO,KAAK,KAAK,MAAM,YAAY;AACrC;AAKA,eAAsB,oBACpB,eACA,aACA,eACe;AACf,QAAM,eAAe,8BAA8B,eAAe,aAAa,aAAa;AAC5F,MAAI;AACF,UAAM,GAAG,OAAO,YAAY;AAAA,EAC9B,QAAQ;AAAA,EAER;AACF;",
   "names": []
 }

package/dist/modules/attachments/lib/thumbnailCache.js

@@ -1,26 +1,25 @@
 import { promises as fs } from "fs";
 import path from "path";
-import { resolvePartitionRoot } from "./storage.js";
-const CACHE_ROOT_SEGMENTS = [".cache", "thumbnails"];
 function sanitizeSegment(value) {
   return value.replace(/[^a-zA-Z0-9._-]/g, "_");
 }
-function buildThumbnailCacheKey(width, height, cropType) {
-  if (!width && !height) return null;
-  const safeWidth = typeof width === "number" && Number.isFinite(width) ? width : "auto";
-  const safeHeight = typeof height === "number" && Number.isFinite(height) ? height : "auto";
-  const safeCrop = cropType === "contain" ? "contain" : "cover";
-  return `w${safeWidth}-h${safeHeight}-c${safeCrop}`;
+function resolveCacheRoot(partitionCode) {
+  return path.join(process.cwd(), "storage", ".cache", "thumbnails", sanitizeSegment(partitionCode));
 }
 function resolveCachePath(partitionCode, attachmentId, cacheKey) {
-  const root = resolvePartitionRoot(partitionCode);
   return path.join(
-    root,
-    ...CACHE_ROOT_SEGMENTS,
+    resolveCacheRoot(partitionCode),
     sanitizeSegment(attachmentId),
     sanitizeSegment(cacheKey)
   );
 }
+function buildThumbnailCacheKey(width, height, cropType) {
+  if (!width && !height) return null;
+  const safeWidth = typeof width === "number" && Number.isFinite(width) ? width : "auto";
+  const safeHeight = typeof height === "number" && Number.isFinite(height) ? height : "auto";
+  const safeCrop = cropType === "contain" ? "contain" : "cover";
+  return `w${safeWidth}-h${safeHeight}-c${safeCrop}`;
+}
 async function readThumbnailCache(partitionCode, attachmentId, cacheKey) {
   const cachePath = resolveCachePath(partitionCode, attachmentId, cacheKey);
   try {
@@ -35,8 +34,7 @@ async function writeThumbnailCache(partitionCode, attachmentId, cacheKey, data)
   await fs.writeFile(cachePath, data);
 }
 async function clearAttachmentThumbnailCache(partitionCode, attachmentId) {
-  const root = resolvePartitionRoot(partitionCode);
-  const dir = path.join(root, ...CACHE_ROOT_SEGMENTS, sanitizeSegment(attachmentId));
+  const dir = path.join(resolveCacheRoot(partitionCode), sanitizeSegment(attachmentId));
   try {
     await fs.rm(dir, { recursive: true, force: true });
   } catch {

package/dist/modules/attachments/lib/thumbnailCache.js.map

@@ -1,7 +1,7 @@
 {
   "version": 3,
   "sources": ["../../../../src/modules/attachments/lib/thumbnailCache.ts"],
-  "sourcesContent": ["import { promises as fs } from 'fs'\nimport path from 'path'\nimport { resolvePartitionRoot } from './storage'\n\nconst CACHE_ROOT_SEGMENTS = ['.cache', 'thumbnails']\n\nfunction sanitizeSegment(value: string): string {\n  return value.replace(/[^a-zA-Z0-9._-]/g, '_')\n}\n\nexport function buildThumbnailCacheKey(\n  width?: number,\n  height?: number,\n  cropType?: 'cover' | 'contain'\n): string | null {\n  if (!width && !height) return null\n  const safeWidth = typeof width === 'number' && Number.isFinite(width) ? width : 'auto'\n  const safeHeight = typeof height === 'number' && Number.isFinite(height) ? height : 'auto'\n  const safeCrop = cropType === 'contain' ? 'contain' : 'cover'\n  return `w${safeWidth}-h${safeHeight}-c${safeCrop}`\n}\n\nfunction resolveCachePath(partitionCode: string, attachmentId: string, cacheKey: string): string {\n  const root = resolvePartitionRoot(partitionCode)\n  return path.join(\n    root,\n    ...CACHE_ROOT_SEGMENTS,\n    sanitizeSegment(attachmentId),\n    sanitizeSegment(cacheKey)\n  )\n}\n\nexport async function readThumbnailCache(\n  partitionCode: string,\n  attachmentId: string,\n  cacheKey: string\n): Promise<Buffer | null> {\n  const cachePath = resolveCachePath(partitionCode, attachmentId, cacheKey)\n  try {\n    return await fs.readFile(cachePath)\n  } catch {\n    return null\n  }\n}\n\nexport async function writeThumbnailCache(\n  partitionCode: string,\n  attachmentId: string,\n  cacheKey: string,\n  data: Buffer\n): Promise<void> {\n  const cachePath = resolveCachePath(partitionCode, attachmentId, cacheKey)\n  await fs.mkdir(path.dirname(cachePath), { recursive: true })\n  await fs.writeFile(cachePath, data)\n}\n\nexport async function clearAttachmentThumbnailCache(partitionCode: string, attachmentId: string): Promise<void> {\n  const root = resolvePartitionRoot(partitionCode)\n  const dir = path.join(root, ...CACHE_ROOT_SEGMENTS, sanitizeSegment(attachmentId))\n  try {\n    await fs.rm(dir, { recursive: true, force: true })\n  } catch {\n    // ignore cache cleanup failure\n  }\n}\n"],
-  "mappings": "AAAA,SAAS,YAAY,UAAU;AAC/B,OAAO,UAAU;AACjB,SAAS,4BAA4B;AAErC,MAAM,sBAAsB,CAAC,UAAU,YAAY;AAEnD,SAAS,gBAAgB,OAAuB;AAC9C,SAAO,MAAM,QAAQ,oBAAoB,GAAG;AAC9C;AAEO,SAAS,uBACd,OACA,QACA,UACe;AACf,MAAI,CAAC,SAAS,CAAC,OAAQ,QAAO;AAC9B,QAAM,YAAY,OAAO,UAAU,YAAY,OAAO,SAAS,KAAK,IAAI,QAAQ;AAChF,QAAM,aAAa,OAAO,WAAW,YAAY,OAAO,SAAS,MAAM,IAAI,SAAS;AACpF,QAAM,WAAW,aAAa,YAAY,YAAY;AACtD,SAAO,IAAI,SAAS,KAAK,UAAU,KAAK,QAAQ;AAClD;AAEA,SAAS,iBAAiB,eAAuB,cAAsB,UAA0B;AAC/F,QAAM,OAAO,qBAAqB,aAAa;AAC/C,SAAO,KAAK;AAAA,IACV;AAAA,IACA,GAAG;AAAA,IACH,gBAAgB,YAAY;AAAA,IAC5B,gBAAgB,QAAQ;AAAA,EAC1B;AACF;AAEA,eAAsB,mBACpB,eACA,cACA,UACwB;AACxB,QAAM,YAAY,iBAAiB,eAAe,cAAc,QAAQ;AACxE,MAAI;AACF,WAAO,MAAM,GAAG,SAAS,SAAS;AAAA,EACpC,QAAQ;AACN,WAAO;AAAA,EACT;AACF;AAEA,eAAsB,oBACpB,eACA,cACA,UACA,MACe;AACf,QAAM,YAAY,iBAAiB,eAAe,cAAc,QAAQ;AACxE,QAAM,GAAG,MAAM,KAAK,QAAQ,SAAS,GAAG,EAAE,WAAW,KAAK,CAAC;AAC3D,QAAM,GAAG,UAAU,WAAW,IAAI;AACpC;AAEA,eAAsB,8BAA8B,eAAuB,cAAqC;AAC9G,QAAM,OAAO,qBAAqB,aAAa;AAC/C,QAAM,MAAM,KAAK,KAAK,MAAM,GAAG,qBAAqB,gBAAgB,YAAY,CAAC;AACjF,MAAI;AACF,UAAM,GAAG,GAAG,KAAK,EAAE,WAAW,MAAM,OAAO,KAAK,CAAC;AAAA,EACnD,QAAQ;AAAA,EAER;AACF;",
+  "sourcesContent": ["import { promises as fs } from 'fs'\nimport path from 'path'\n\nfunction sanitizeSegment(value: string): string {\n  return value.replace(/[^a-zA-Z0-9._-]/g, '_')\n}\n\n/**\n * Resolves the thumbnail cache root. Uses a dedicated directory under\n * `storage/.cache/thumbnails/<partitionCode>/` that is independent of\n * the partition's storage backend (local or S3).\n */\nfunction resolveCacheRoot(partitionCode: string): string {\n  return path.join(process.cwd(), 'storage', '.cache', 'thumbnails', sanitizeSegment(partitionCode))\n}\n\nfunction resolveCachePath(partitionCode: string, attachmentId: string, cacheKey: string): string {\n  return path.join(\n    resolveCacheRoot(partitionCode),\n    sanitizeSegment(attachmentId),\n    sanitizeSegment(cacheKey),\n  )\n}\n\nexport function buildThumbnailCacheKey(\n  width?: number,\n  height?: number,\n  cropType?: 'cover' | 'contain',\n): string | null {\n  if (!width && !height) return null\n  const safeWidth = typeof width === 'number' && Number.isFinite(width) ? width : 'auto'\n  const safeHeight = typeof height === 'number' && Number.isFinite(height) ? height : 'auto'\n  const safeCrop = cropType === 'contain' ? 'contain' : 'cover'\n  return `w${safeWidth}-h${safeHeight}-c${safeCrop}`\n}\n\nexport async function readThumbnailCache(\n  partitionCode: string,\n  attachmentId: string,\n  cacheKey: string,\n): Promise<Buffer | null> {\n  const cachePath = resolveCachePath(partitionCode, attachmentId, cacheKey)\n  try {\n    return await fs.readFile(cachePath)\n  } catch {\n    return null\n  }\n}\n\nexport async function writeThumbnailCache(\n  partitionCode: string,\n  attachmentId: string,\n  cacheKey: string,\n  data: Buffer,\n): Promise<void> {\n  const cachePath = resolveCachePath(partitionCode, attachmentId, cacheKey)\n  await fs.mkdir(path.dirname(cachePath), { recursive: true })\n  await fs.writeFile(cachePath, data)\n}\n\nexport async function clearAttachmentThumbnailCache(\n  partitionCode: string,\n  attachmentId: string,\n): Promise<void> {\n  const dir = path.join(resolveCacheRoot(partitionCode), sanitizeSegment(attachmentId))\n  try {\n    await fs.rm(dir, { recursive: true, force: true })\n  } catch {\n    // ignore cache cleanup failure\n  }\n}\n"],
+  "mappings": "AAAA,SAAS,YAAY,UAAU;AAC/B,OAAO,UAAU;AAEjB,SAAS,gBAAgB,OAAuB;AAC9C,SAAO,MAAM,QAAQ,oBAAoB,GAAG;AAC9C;AAOA,SAAS,iBAAiB,eAA+B;AACvD,SAAO,KAAK,KAAK,QAAQ,IAAI,GAAG,WAAW,UAAU,cAAc,gBAAgB,aAAa,CAAC;AACnG;AAEA,SAAS,iBAAiB,eAAuB,cAAsB,UAA0B;AAC/F,SAAO,KAAK;AAAA,IACV,iBAAiB,aAAa;AAAA,IAC9B,gBAAgB,YAAY;AAAA,IAC5B,gBAAgB,QAAQ;AAAA,EAC1B;AACF;AAEO,SAAS,uBACd,OACA,QACA,UACe;AACf,MAAI,CAAC,SAAS,CAAC,OAAQ,QAAO;AAC9B,QAAM,YAAY,OAAO,UAAU,YAAY,OAAO,SAAS,KAAK,IAAI,QAAQ;AAChF,QAAM,aAAa,OAAO,WAAW,YAAY,OAAO,SAAS,MAAM,IAAI,SAAS;AACpF,QAAM,WAAW,aAAa,YAAY,YAAY;AACtD,SAAO,IAAI,SAAS,KAAK,UAAU,KAAK,QAAQ;AAClD;AAEA,eAAsB,mBACpB,eACA,cACA,UACwB;AACxB,QAAM,YAAY,iBAAiB,eAAe,cAAc,QAAQ;AACxE,MAAI;AACF,WAAO,MAAM,GAAG,SAAS,SAAS;AAAA,EACpC,QAAQ;AACN,WAAO;AAAA,EACT;AACF;AAEA,eAAsB,oBACpB,eACA,cACA,UACA,MACe;AACf,QAAM,YAAY,iBAAiB,eAAe,cAAc,QAAQ;AACxE,QAAM,GAAG,MAAM,KAAK,QAAQ,SAAS,GAAG,EAAE,WAAW,KAAK,CAAC;AAC3D,QAAM,GAAG,UAAU,WAAW,IAAI;AACpC;AAEA,eAAsB,8BACpB,eACA,cACe;AACf,QAAM,MAAM,KAAK,KAAK,iBAAiB,aAAa,GAAG,gBAAgB,YAAY,CAAC;AACpF,MAAI;AACF,UAAM,GAAG,GAAG,KAAK,EAAE,WAAW,MAAM,OAAO,KAAK,CAAC;AAAA,EACnD,QAAQ;AAAA,EAER;AACF;",
   "names": []
 }

package/dist/modules/integrations/backend/integrations/[id]/page.js

@@ -176,7 +176,8 @@ function buildCredentialFields(credFields) {
         /* @__PURE__ */ jsx(WebhookSetupGuide, { guide: field.helpDetails, buttonLabel: "Show details" })
       ] }) : field.helpText,
       placeholder: field.placeholder,
-      required: field.required
+      required: field.required,
+      visibleWhen: field.visibleWhen
     };
     if (field.type === "secret") {
       return {
@@ -326,7 +327,15 @@ function IntegrationDetailPage({ params }) {
       { fallback: null }
     );
     if (call.ok && call.result?.credentials) {
-      setCredValues(call.result.credentials);
+      const next = { ...call.result.credentials };
+      if (currentIntegrationId === "storage_s3") {
+        const authMode = next.authMode;
+        if (authMode !== "access_keys" && authMode !== "ambient") {
+          const hasKeys = Boolean(next.accessKeyId || next.secretAccessKey);
+          next.authMode = hasKeys ? "access_keys" : "ambient";
+        }
+      }
+      setCredValues(next);
       setCredentialsFormKey((current) => current + 1);
     }
   }, [resolveCurrentIntegrationId]);
@@ -517,18 +526,31 @@ function IntegrationDetailPage({ params }) {
     if (!currentIntegrationId) return;
     setIsSavingCredentials(true);
     try {
+      const sanitizedValues = { ...values };
+      if (currentIntegrationId === "storage_s3") {
+        const authMode = sanitizedValues.authMode;
+        if (authMode !== "access_keys" && authMode !== "ambient") {
+          const hasKeys = Boolean(sanitizedValues.accessKeyId || sanitizedValues.secretAccessKey);
+          sanitizedValues.authMode = hasKeys ? "access_keys" : "ambient";
+        }
+        if (sanitizedValues.authMode === "ambient") {
+          delete sanitizedValues.accessKeyId;
+          delete sanitizedValues.secretAccessKey;
+          delete sanitizedValues.sessionToken;
+        }
+      }
       const call = await runMutationWithContext({
         actionId: "save-credentials",
         tabId: "credentials",
-        mutationPayload: { integrationId: currentIntegrationId, credentials: values },
+        mutationPayload: { integrationId: currentIntegrationId, credentials: sanitizedValues },
         operation: () => apiCall(`/api/integrations/${encodeURIComponent(currentIntegrationId)}/credentials`, {
           method: "PUT",
           headers: { "Content-Type": "application/json" },
-          body: JSON.stringify({ credentials: values })
+          body: JSON.stringify({ credentials: sanitizedValues })
         }, { fallback: null })
       });
       if (call.ok) {
-        setCredValues(values);
+        setCredValues(sanitizedValues);
         setCredentialsFormKey((current) => current + 1);
         flash(t("integrations.detail.credentials.saved"), "success");
         return;
@@ -619,6 +641,10 @@ function IntegrationDetailPage({ params }) {
   const credentialSchema = React.useMemo(() => z.object({}).passthrough().superRefine((rawValues, ctx) => {
     const values = rawValues;
     editableCredentialFields.forEach((field) => {
+      if (field.visibleWhen) {
+        const targetValue = values[field.visibleWhen.field];
+        if (targetValue !== field.visibleWhen.equals) return;
+      }
       const value = values[field.key];
       if (field.type === "boolean") {
         if (value !== void 0 && value !== null && typeof value !== "boolean") {