@open-mercato/core 0.6.2-develop.3381.1.8461b312a9 → 0.6.2-develop.3400.2.d948268f50

package/.turbo/turbo-build.log

@@ -1,4 +1,4 @@
-[build:core] found 2517 entry points
+[build:core] found 2528 entry points
 [build:core] built successfully
 [build:core:generated] found 172 entry points
 [build:core:generated] built successfully

package/dist/modules/attachments/api/file/[id]/route.js

@@ -1,12 +1,10 @@
 import { NextResponse } from "next/server";
-import { promises as fs } from "fs";
 import { getAuthFromRequest } from "@open-mercato/shared/lib/auth/server";
 import { createRequestContainer } from "@open-mercato/shared/lib/di/container";
 import {
   Attachment,
   AttachmentPartition
 } from "@open-mercato/core/modules/attachments/data/entities";
-import { resolveAttachmentAbsolutePath } from "@open-mercato/core/modules/attachments/lib/storage";
 import { checkAttachmentAccess } from "@open-mercato/core/modules/attachments/lib/access";
 import { z } from "zod";
 import { attachmentsTag, attachmentErrorSchema } from "../../openapi.js";
@@ -14,6 +12,7 @@ import {
   buildAttachmentContentDisposition,
   canRenderInlineAttachment
 } from "@open-mercato/core/modules/attachments/lib/security";
+import { StorageDriverFactory } from "../../../lib/drivers/index.js";
 const metadata = {
   GET: { requireAuth: false }
 };
@@ -28,6 +27,7 @@ async function GET(req, context) {
   const auth = await getAuthFromRequest(req);
   const { resolve } = await createRequestContainer();
   const em = resolve("em");
+  const storageDriverFactory = resolve("storageDriverFactory") ?? new StorageDriverFactory(em);
   const attachment = await em.findOne(Attachment, { id });
   if (!attachment) {
     return NextResponse.json(
@@ -49,14 +49,14 @@ async function GET(req, context) {
     const message = access.status === 401 ? "Unauthorized" : "Forbidden";
     return NextResponse.json({ error: message }, { status: access.status });
   }
-  const filePath = resolveAttachmentAbsolutePath(
-    attachment.partitionCode,
-    attachment.storagePath,
-    attachment.storageDriver
-  );
+  const driver = await storageDriverFactory.resolveForPartition(attachment.partitionCode, {
+    tenantId: attachment.tenantId ?? "",
+    organizationId: attachment.organizationId ?? ""
+  });
   let buffer;
   try {
-    buffer = await fs.readFile(filePath);
+    const result = await driver.read(attachment.partitionCode, attachment.storagePath);
+    buffer = result.buffer;
   } catch {
     return NextResponse.json({ error: "File not available" }, { status: 404 });
   }

package/dist/modules/attachments/api/file/[id]/route.js.map

@@ -1,7 +1,7 @@
 {
   "version": 3,
   "sources": ["../../../../../../src/modules/attachments/api/file/%5Bid%5D/route.ts"],
-  "sourcesContent": ["import { NextRequest, NextResponse } from \"next/server\";\nimport { promises as fs } from \"fs\";\nimport type { OpenApiRouteDoc } from \"@open-mercato/shared/lib/openapi\";\nimport { getAuthFromRequest } from \"@open-mercato/shared/lib/auth/server\";\nimport { createRequestContainer } from \"@open-mercato/shared/lib/di/container\";\nimport {\n  Attachment,\n  AttachmentPartition,\n} from \"@open-mercato/core/modules/attachments/data/entities\";\nimport { resolveAttachmentAbsolutePath } from \"@open-mercato/core/modules/attachments/lib/storage\";\nimport type { EntityManager } from \"@mikro-orm/postgresql\";\nimport { checkAttachmentAccess } from \"@open-mercato/core/modules/attachments/lib/access\";\nimport { z } from \"zod\";\nimport { attachmentsTag, attachmentErrorSchema } from \"../../openapi\";\nimport {\n  buildAttachmentContentDisposition,\n  canRenderInlineAttachment,\n} from \"@open-mercato/core/modules/attachments/lib/security\";\n\nexport const metadata = {\n  GET: { requireAuth: false },\n};\n\nexport async function GET(\n  req: NextRequest,\n  context: { params: Promise<{ id: string }> },\n) {\n  const { id } = await context.params;\n  if (!id) {\n    return NextResponse.json(\n      { error: \"Attachment id is required\" },\n      { status: 400 },\n    );\n  }\n  const auth = await getAuthFromRequest(req);\n  const { resolve } = await createRequestContainer();\n  const em = resolve(\"em\") as EntityManager;\n\n  const attachment = await em.findOne(Attachment, { id });\n  if (!attachment) {\n    return NextResponse.json(\n      { error: \"Attachment not found\" },\n      { status: 404 },\n    );\n  }\n  const partition = await em.findOne(AttachmentPartition, {\n    code: attachment.partitionCode,\n  });\n  if (!partition) {\n    return NextResponse.json(\n      { error: \"Partition misconfigured\" },\n      { status: 500 },\n    );\n  }\n\n  const access = checkAttachmentAccess(auth, attachment, partition);\n  if (!access.ok) {\n    const message = access.status === 401 ? \"Unauthorized\" : \"Forbidden\";\n    return NextResponse.json({ error: message }, { status: access.status });\n  }\n\n  const filePath = resolveAttachmentAbsolutePath(\n    attachment.partitionCode,\n    attachment.storagePath,\n    attachment.storageDriver,\n  );\n  let buffer: Buffer;\n  try {\n    buffer = await fs.readFile(filePath);\n  } catch {\n    return NextResponse.json({ error: \"File not available\" }, { status: 404 });\n  }\n\n  const url = new URL(req.url);\n  const forceDownload = url.searchParams.get(\"download\") === \"1\";\n  const renderInline = !forceDownload && canRenderInlineAttachment(attachment.mimeType);\n  const headers: Record<string, string> = {\n    \"Cache-Control\": partition.isPublic\n      ? \"public, max-age=86400\"\n      : \"private, max-age=60\",\n    \"Content-Security-Policy\": \"default-src 'none'; sandbox\",\n    \"Content-Type\": renderInline\n      ? attachment.mimeType || \"application/octet-stream\"\n      : \"application/octet-stream\",\n    \"Content-Disposition\": buildAttachmentContentDisposition(\n      attachment.fileName,\n      renderInline ? \"inline\" : \"attachment\",\n    ),\n    \"X-Content-Type-Options\": \"nosniff\",\n  };\n  if (attachment.fileSize > 0) {\n    headers[\"Content-Length\"] = String(attachment.fileSize);\n  }\n\n  const responseBody = new Uint8Array(buffer);\n\n  return new NextResponse(responseBody, { status: 200, headers });\n}\n\nexport const openApi: OpenApiRouteDoc = {\n  tag: attachmentsTag,\n  summary: \"Download attachment file\",\n  methods: {\n    GET: {\n      summary: \"Download or serve attachment file\",\n      description:\n        \"Returns the raw file content for an attachment. Path parameter: {id} - Attachment UUID. Query parameter: ?download=1 - Force file download with Content-Disposition header. Access control is enforced based on partition settings.\",\n      responses: [\n        {\n          status: 200,\n          description: \"File content with appropriate MIME type\",\n          schema: z.any().describe(\"Binary file content\"),\n        },\n      ],\n      errors: [\n        {\n          status: 400,\n          description: \"Missing attachment ID\",\n          schema: attachmentErrorSchema,\n        },\n        {\n          status: 401,\n          description:\n            \"Unauthorized - authentication required for private partitions\",\n          schema: attachmentErrorSchema,\n        },\n        {\n          status: 403,\n          description: \"Forbidden - insufficient permissions\",\n          schema: attachmentErrorSchema,\n        },\n        {\n          status: 404,\n          description: \"Attachment or file not found\",\n          schema: attachmentErrorSchema,\n        },\n        {\n          status: 500,\n          description: \"Partition misconfigured\",\n          schema: attachmentErrorSchema,\n        },\n      ],\n    },\n  },\n};\n"],
-  "mappings": "AAAA,SAAsB,oBAAoB;AAC1C,SAAS,YAAY,UAAU;AAE/B,SAAS,0BAA0B;AACnC,SAAS,8BAA8B;AACvC;AAAA,EACE;AAAA,EACA;AAAA,OACK;AACP,SAAS,qCAAqC;AAE9C,SAAS,6BAA6B;AACtC,SAAS,SAAS;AAClB,SAAS,gBAAgB,6BAA6B;AACtD;AAAA,EACE;AAAA,EACA;AAAA,OACK;AAEA,MAAM,WAAW;AAAA,EACtB,KAAK,EAAE,aAAa,MAAM;AAC5B;AAEA,eAAsB,IACpB,KACA,SACA;AACA,QAAM,EAAE,GAAG,IAAI,MAAM,QAAQ;AAC7B,MAAI,CAAC,IAAI;AACP,WAAO,aAAa;AAAA,MAClB,EAAE,OAAO,4BAA4B;AAAA,MACrC,EAAE,QAAQ,IAAI;AAAA,IAChB;AAAA,EACF;AACA,QAAM,OAAO,MAAM,mBAAmB,GAAG;AACzC,QAAM,EAAE,QAAQ,IAAI,MAAM,uBAAuB;AACjD,QAAM,KAAK,QAAQ,IAAI;AAEvB,QAAM,aAAa,MAAM,GAAG,QAAQ,YAAY,EAAE,GAAG,CAAC;AACtD,MAAI,CAAC,YAAY;AACf,WAAO,aAAa;AAAA,MAClB,EAAE,OAAO,uBAAuB;AAAA,MAChC,EAAE,QAAQ,IAAI;AAAA,IAChB;AAAA,EACF;AACA,QAAM,YAAY,MAAM,GAAG,QAAQ,qBAAqB;AAAA,IACtD,MAAM,WAAW;AAAA,EACnB,CAAC;AACD,MAAI,CAAC,WAAW;AACd,WAAO,aAAa;AAAA,MAClB,EAAE,OAAO,0BAA0B;AAAA,MACnC,EAAE,QAAQ,IAAI;AAAA,IAChB;AAAA,EACF;AAEA,QAAM,SAAS,sBAAsB,MAAM,YAAY,SAAS;AAChE,MAAI,CAAC,OAAO,IAAI;AACd,UAAM,UAAU,OAAO,WAAW,MAAM,iBAAiB;AACzD,WAAO,aAAa,KAAK,EAAE,OAAO,QAAQ,GAAG,EAAE,QAAQ,OAAO,OAAO,CAAC;AAAA,EACxE;AAEA,QAAM,WAAW;AAAA,IACf,WAAW;AAAA,IACX,WAAW;AAAA,IACX,WAAW;AAAA,EACb;AACA,MAAI;AACJ,MAAI;AACF,aAAS,MAAM,GAAG,SAAS,QAAQ;AAAA,EACrC,QAAQ;AACN,WAAO,aAAa,KAAK,EAAE,OAAO,qBAAqB,GAAG,EAAE,QAAQ,IAAI,CAAC;AAAA,EAC3E;AAEA,QAAM,MAAM,IAAI,IAAI,IAAI,GAAG;AAC3B,QAAM,gBAAgB,IAAI,aAAa,IAAI,UAAU,MAAM;AAC3D,QAAM,eAAe,CAAC,iBAAiB,0BAA0B,WAAW,QAAQ;AACpF,QAAM,UAAkC;AAAA,IACtC,iBAAiB,UAAU,WACvB,0BACA;AAAA,IACJ,2BAA2B;AAAA,IAC3B,gBAAgB,eACZ,WAAW,YAAY,6BACvB;AAAA,IACJ,uBAAuB;AAAA,MACrB,WAAW;AAAA,MACX,eAAe,WAAW;AAAA,IAC5B;AAAA,IACA,0BAA0B;AAAA,EAC5B;AACA,MAAI,WAAW,WAAW,GAAG;AAC3B,YAAQ,gBAAgB,IAAI,OAAO,WAAW,QAAQ;AAAA,EACxD;AAEA,QAAM,eAAe,IAAI,WAAW,MAAM;AAE1C,SAAO,IAAI,aAAa,cAAc,EAAE,QAAQ,KAAK,QAAQ,CAAC;AAChE;AAEO,MAAM,UAA2B;AAAA,EACtC,KAAK;AAAA,EACL,SAAS;AAAA,EACT,SAAS;AAAA,IACP,KAAK;AAAA,MACH,SAAS;AAAA,MACT,aACE;AAAA,MACF,WAAW;AAAA,QACT;AAAA,UACE,QAAQ;AAAA,UACR,aAAa;AAAA,UACb,QAAQ,EAAE,IAAI,EAAE,SAAS,qBAAqB;AAAA,QAChD;AAAA,MACF;AAAA,MACA,QAAQ;AAAA,QACN;AAAA,UACE,QAAQ;AAAA,UACR,aAAa;AAAA,UACb,QAAQ;AAAA,QACV;AAAA,QACA;AAAA,UACE,QAAQ;AAAA,UACR,aACE;AAAA,UACF,QAAQ;AAAA,QACV;AAAA,QACA;AAAA,UACE,QAAQ;AAAA,UACR,aAAa;AAAA,UACb,QAAQ;AAAA,QACV;AAAA,QACA;AAAA,UACE,QAAQ;AAAA,UACR,aAAa;AAAA,UACb,QAAQ;AAAA,QACV;AAAA,QACA;AAAA,UACE,QAAQ;AAAA,UACR,aAAa;AAAA,UACb,QAAQ;AAAA,QACV;AAAA,MACF;AAAA,IACF;AAAA,EACF;AACF;",
+  "sourcesContent": ["import { NextRequest, NextResponse } from \"next/server\";\nimport type { OpenApiRouteDoc } from \"@open-mercato/shared/lib/openapi\";\nimport { getAuthFromRequest } from \"@open-mercato/shared/lib/auth/server\";\nimport { createRequestContainer } from \"@open-mercato/shared/lib/di/container\";\nimport {\n  Attachment,\n  AttachmentPartition,\n} from \"@open-mercato/core/modules/attachments/data/entities\";\nimport type { EntityManager } from \"@mikro-orm/postgresql\";\nimport { checkAttachmentAccess } from \"@open-mercato/core/modules/attachments/lib/access\";\nimport { z } from \"zod\";\nimport { attachmentsTag, attachmentErrorSchema } from \"../../openapi\";\nimport {\n  buildAttachmentContentDisposition,\n  canRenderInlineAttachment,\n} from \"@open-mercato/core/modules/attachments/lib/security\";\nimport { StorageDriverFactory } from '../../../lib/drivers';\n\nexport const metadata = {\n  GET: { requireAuth: false },\n};\n\nexport async function GET(\n  req: NextRequest,\n  context: { params: Promise<{ id: string }> },\n) {\n  const { id } = await context.params;\n  if (!id) {\n    return NextResponse.json(\n      { error: \"Attachment id is required\" },\n      { status: 400 },\n    );\n  }\n  const auth = await getAuthFromRequest(req);\n  const { resolve } = await createRequestContainer();\n  const em = resolve(\"em\") as EntityManager;\n  const storageDriverFactory =\n    (resolve(\"storageDriverFactory\") as StorageDriverFactory | null) ??\n    new StorageDriverFactory(em);\n\n  const attachment = await em.findOne(Attachment, { id });\n  if (!attachment) {\n    return NextResponse.json(\n      { error: \"Attachment not found\" },\n      { status: 404 },\n    );\n  }\n  const partition = await em.findOne(AttachmentPartition, {\n    code: attachment.partitionCode,\n  });\n  if (!partition) {\n    return NextResponse.json(\n      { error: \"Partition misconfigured\" },\n      { status: 500 },\n    );\n  }\n\n  const access = checkAttachmentAccess(auth, attachment, partition);\n  if (!access.ok) {\n    const message = access.status === 401 ? \"Unauthorized\" : \"Forbidden\";\n    return NextResponse.json({ error: message }, { status: access.status });\n  }\n\n  const driver = await storageDriverFactory.resolveForPartition(attachment.partitionCode, {\n    tenantId: attachment.tenantId ?? '',\n    organizationId: attachment.organizationId ?? '',\n  });\n  let buffer: Buffer;\n  try {\n    const result = await driver.read(attachment.partitionCode, attachment.storagePath);\n    buffer = result.buffer;\n  } catch {\n    return NextResponse.json({ error: \"File not available\" }, { status: 404 });\n  }\n\n  const url = new URL(req.url);\n  const forceDownload = url.searchParams.get(\"download\") === \"1\";\n  const renderInline = !forceDownload && canRenderInlineAttachment(attachment.mimeType);\n  const headers: Record<string, string> = {\n    \"Cache-Control\": partition.isPublic\n      ? \"public, max-age=86400\"\n      : \"private, max-age=60\",\n    \"Content-Security-Policy\": \"default-src 'none'; sandbox\",\n    \"Content-Type\": renderInline\n      ? attachment.mimeType || \"application/octet-stream\"\n      : \"application/octet-stream\",\n    \"Content-Disposition\": buildAttachmentContentDisposition(\n      attachment.fileName,\n      renderInline ? \"inline\" : \"attachment\",\n    ),\n    \"X-Content-Type-Options\": \"nosniff\",\n  };\n  if (attachment.fileSize > 0) {\n    headers[\"Content-Length\"] = String(attachment.fileSize);\n  }\n\n  const responseBody = new Uint8Array(buffer);\n\n  return new NextResponse(responseBody, { status: 200, headers });\n}\n\nexport const openApi: OpenApiRouteDoc = {\n  tag: attachmentsTag,\n  summary: \"Download attachment file\",\n  methods: {\n    GET: {\n      summary: \"Download or serve attachment file\",\n      description:\n        \"Returns the raw file content for an attachment. Path parameter: {id} - Attachment UUID. Query parameter: ?download=1 - Force file download with Content-Disposition header. Access control is enforced based on partition settings.\",\n      responses: [\n        {\n          status: 200,\n          description: \"File content with appropriate MIME type\",\n          schema: z.any().describe(\"Binary file content\"),\n        },\n      ],\n      errors: [\n        {\n          status: 400,\n          description: \"Missing attachment ID\",\n          schema: attachmentErrorSchema,\n        },\n        {\n          status: 401,\n          description:\n            \"Unauthorized - authentication required for private partitions\",\n          schema: attachmentErrorSchema,\n        },\n        {\n          status: 403,\n          description: \"Forbidden - insufficient permissions\",\n          schema: attachmentErrorSchema,\n        },\n        {\n          status: 404,\n          description: \"Attachment or file not found\",\n          schema: attachmentErrorSchema,\n        },\n        {\n          status: 500,\n          description: \"Partition misconfigured\",\n          schema: attachmentErrorSchema,\n        },\n      ],\n    },\n  },\n};\n"],
+  "mappings": "AAAA,SAAsB,oBAAoB;AAE1C,SAAS,0BAA0B;AACnC,SAAS,8BAA8B;AACvC;AAAA,EACE;AAAA,EACA;AAAA,OACK;AAEP,SAAS,6BAA6B;AACtC,SAAS,SAAS;AAClB,SAAS,gBAAgB,6BAA6B;AACtD;AAAA,EACE;AAAA,EACA;AAAA,OACK;AACP,SAAS,4BAA4B;AAE9B,MAAM,WAAW;AAAA,EACtB,KAAK,EAAE,aAAa,MAAM;AAC5B;AAEA,eAAsB,IACpB,KACA,SACA;AACA,QAAM,EAAE,GAAG,IAAI,MAAM,QAAQ;AAC7B,MAAI,CAAC,IAAI;AACP,WAAO,aAAa;AAAA,MAClB,EAAE,OAAO,4BAA4B;AAAA,MACrC,EAAE,QAAQ,IAAI;AAAA,IAChB;AAAA,EACF;AACA,QAAM,OAAO,MAAM,mBAAmB,GAAG;AACzC,QAAM,EAAE,QAAQ,IAAI,MAAM,uBAAuB;AACjD,QAAM,KAAK,QAAQ,IAAI;AACvB,QAAM,uBACH,QAAQ,sBAAsB,KAC/B,IAAI,qBAAqB,EAAE;AAE7B,QAAM,aAAa,MAAM,GAAG,QAAQ,YAAY,EAAE,GAAG,CAAC;AACtD,MAAI,CAAC,YAAY;AACf,WAAO,aAAa;AAAA,MAClB,EAAE,OAAO,uBAAuB;AAAA,MAChC,EAAE,QAAQ,IAAI;AAAA,IAChB;AAAA,EACF;AACA,QAAM,YAAY,MAAM,GAAG,QAAQ,qBAAqB;AAAA,IACtD,MAAM,WAAW;AAAA,EACnB,CAAC;AACD,MAAI,CAAC,WAAW;AACd,WAAO,aAAa;AAAA,MAClB,EAAE,OAAO,0BAA0B;AAAA,MACnC,EAAE,QAAQ,IAAI;AAAA,IAChB;AAAA,EACF;AAEA,QAAM,SAAS,sBAAsB,MAAM,YAAY,SAAS;AAChE,MAAI,CAAC,OAAO,IAAI;AACd,UAAM,UAAU,OAAO,WAAW,MAAM,iBAAiB;AACzD,WAAO,aAAa,KAAK,EAAE,OAAO,QAAQ,GAAG,EAAE,QAAQ,OAAO,OAAO,CAAC;AAAA,EACxE;AAEA,QAAM,SAAS,MAAM,qBAAqB,oBAAoB,WAAW,eAAe;AAAA,IACtF,UAAU,WAAW,YAAY;AAAA,IACjC,gBAAgB,WAAW,kBAAkB;AAAA,EAC/C,CAAC;AACD,MAAI;AACJ,MAAI;AACF,UAAM,SAAS,MAAM,OAAO,KAAK,WAAW,eAAe,WAAW,WAAW;AACjF,aAAS,OAAO;AAAA,EAClB,QAAQ;AACN,WAAO,aAAa,KAAK,EAAE,OAAO,qBAAqB,GAAG,EAAE,QAAQ,IAAI,CAAC;AAAA,EAC3E;AAEA,QAAM,MAAM,IAAI,IAAI,IAAI,GAAG;AAC3B,QAAM,gBAAgB,IAAI,aAAa,IAAI,UAAU,MAAM;AAC3D,QAAM,eAAe,CAAC,iBAAiB,0BAA0B,WAAW,QAAQ;AACpF,QAAM,UAAkC;AAAA,IACtC,iBAAiB,UAAU,WACvB,0BACA;AAAA,IACJ,2BAA2B;AAAA,IAC3B,gBAAgB,eACZ,WAAW,YAAY,6BACvB;AAAA,IACJ,uBAAuB;AAAA,MACrB,WAAW;AAAA,MACX,eAAe,WAAW;AAAA,IAC5B;AAAA,IACA,0BAA0B;AAAA,EAC5B;AACA,MAAI,WAAW,WAAW,GAAG;AAC3B,YAAQ,gBAAgB,IAAI,OAAO,WAAW,QAAQ;AAAA,EACxD;AAEA,QAAM,eAAe,IAAI,WAAW,MAAM;AAE1C,SAAO,IAAI,aAAa,cAAc,EAAE,QAAQ,KAAK,QAAQ,CAAC;AAChE;AAEO,MAAM,UAA2B;AAAA,EACtC,KAAK;AAAA,EACL,SAAS;AAAA,EACT,SAAS;AAAA,IACP,KAAK;AAAA,MACH,SAAS;AAAA,MACT,aACE;AAAA,MACF,WAAW;AAAA,QACT;AAAA,UACE,QAAQ;AAAA,UACR,aAAa;AAAA,UACb,QAAQ,EAAE,IAAI,EAAE,SAAS,qBAAqB;AAAA,QAChD;AAAA,MACF;AAAA,MACA,QAAQ;AAAA,QACN;AAAA,UACE,QAAQ;AAAA,UACR,aAAa;AAAA,UACb,QAAQ;AAAA,QACV;AAAA,QACA;AAAA,UACE,QAAQ;AAAA,UACR,aACE;AAAA,UACF,QAAQ;AAAA,QACV;AAAA,QACA;AAAA,UACE,QAAQ;AAAA,UACR,aAAa;AAAA,UACb,QAAQ;AAAA,QACV;AAAA,QACA;AAAA,UACE,QAAQ;AAAA,UACR,aAAa;AAAA,UACb,QAAQ;AAAA,QACV;AAAA,QACA;AAAA,UACE,QAAQ;AAAA,UACR,aAAa;AAAA,UACb,QAAQ;AAAA,QACV;AAAA,MACF;AAAA,IACF;AAAA,EACF;AACF;",
   "names": []
 }

package/dist/modules/attachments/api/image/[id]/[[...slug]]/route.js

@@ -4,7 +4,6 @@ import { z } from "zod";
 import { getAuthFromRequest } from "@open-mercato/shared/lib/auth/server";
 import { createRequestContainer } from "@open-mercato/shared/lib/di/container";
 import { Attachment, AttachmentPartition } from "@open-mercato/core/modules/attachments/data/entities";
-import { resolveAttachmentAbsolutePath } from "@open-mercato/core/modules/attachments/lib/storage";
 import {
   buildThumbnailCacheKey,
   readThumbnailCache,
@@ -12,13 +11,13 @@ import {
 } from "@open-mercato/core/modules/attachments/lib/thumbnailCache";
 import { canRenderInlineAttachment } from "@open-mercato/core/modules/attachments/lib/security";
 import { checkAttachmentAccess } from "@open-mercato/core/modules/attachments/lib/access";
-import { promises as fs } from "fs";
 import { attachmentsTag, attachmentErrorSchema } from "../../../openapi.js";
 import {
   MAX_IMAGE_SOURCE_PIXELS,
   validateImageDimensions,
   validateImageMagicBytes
 } from "@open-mercato/core/modules/attachments/lib/imageSafety";
+import { StorageDriverFactory } from "../../../../lib/drivers/index.js";
 const querySchema = z.object({
   width: z.coerce.number().int().min(1).max(4e3).optional(),
   height: z.coerce.number().int().min(1).max(4e3).optional(),
@@ -42,6 +41,7 @@ async function GET(req, context) {
   const { width, height, cropType } = parsedQuery.data;
   const { resolve } = await createRequestContainer();
   const em = resolve("em");
+  const storageDriverFactory = resolve("storageDriverFactory") ?? new StorageDriverFactory(em);
   const attachment = await em.findOne(Attachment, {
     id
   });
@@ -60,11 +60,10 @@ async function GET(req, context) {
     const message = access.status === 401 ? "Unauthorized" : "Forbidden";
     return NextResponse.json({ error: message }, { status: access.status });
   }
-  const filePath = resolveAttachmentAbsolutePath(
-    attachment.partitionCode,
-    attachment.storagePath,
-    attachment.storageDriver
-  );
+  const driver = await storageDriverFactory.resolveForPartition(attachment.partitionCode, {
+    tenantId: attachment.tenantId ?? "",
+    organizationId: attachment.organizationId ?? ""
+  });
   const cacheKey = buildThumbnailCacheKey(width, height, cropType);
   try {
     let buffer = null;
@@ -72,7 +71,7 @@ async function GET(req, context) {
       buffer = await readThumbnailCache(attachment.partitionCode, attachment.id, cacheKey);
     }
     if (!buffer) {
-      const input = await fs.readFile(filePath);
+      const { buffer: input } = await driver.read(attachment.partitionCode, attachment.storagePath);
       const magicBytesValidation = validateImageMagicBytes(input, attachment.mimeType);
       if (!magicBytesValidation.ok) {
         return NextResponse.json({ error: magicBytesValidation.error }, { status: magicBytesValidation.status });

package/dist/modules/attachments/api/image/[id]/[[...slug]]/route.js.map

@@ -1,7 +1,7 @@
 {
   "version": 3,
   "sources": ["../../../../../../../src/modules/attachments/api/image/%5Bid%5D/%5B%5B...slug%5D%5D/route.ts"],
-  "sourcesContent": ["import { NextRequest, NextResponse } from 'next/server'\nimport sharp from 'sharp'\nimport { z } from 'zod'\nimport type { OpenApiRouteDoc } from '@open-mercato/shared/lib/openapi'\nimport { getAuthFromRequest } from '@open-mercato/shared/lib/auth/server'\nimport { createRequestContainer } from '@open-mercato/shared/lib/di/container'\nimport { Attachment, AttachmentPartition } from '@open-mercato/core/modules/attachments/data/entities'\nimport { resolveAttachmentAbsolutePath } from '@open-mercato/core/modules/attachments/lib/storage'\nimport {\n  buildThumbnailCacheKey,\n  readThumbnailCache,\n  writeThumbnailCache,\n} from '@open-mercato/core/modules/attachments/lib/thumbnailCache'\nimport { canRenderInlineAttachment } from '@open-mercato/core/modules/attachments/lib/security'\nimport { checkAttachmentAccess } from '@open-mercato/core/modules/attachments/lib/access'\nimport type { EntityManager } from '@mikro-orm/postgresql'\nimport { promises as fs } from 'fs'\nimport { attachmentsTag, imageQuerySchema, attachmentErrorSchema } from '../../../openapi'\nimport {\n  MAX_IMAGE_SOURCE_PIXELS,\n  validateImageDimensions,\n  validateImageMagicBytes,\n} from '@open-mercato/core/modules/attachments/lib/imageSafety'\n\nconst querySchema = z.object({\n  width: z.coerce.number().int().min(1).max(4000).optional(),\n  height: z.coerce.number().int().min(1).max(4000).optional(),\n  cropType: z.enum(['cover', 'contain']).optional(),\n})\n\nexport const metadata = {\n  GET: { requireAuth: false },\n}\n\nexport async function GET(\n  req: NextRequest,\n  context: { params: Promise<{ id: string; slug?: string[] | undefined }> }\n) {\n  const auth = await getAuthFromRequest(req)\n  const { id } = await context.params\n  if (!id) {\n    return NextResponse.json({ error: 'Attachment id is required' }, { status: 400 })\n  }\n  const parsedQuery = querySchema.safeParse(\n    Object.fromEntries(new URL(req.url).searchParams.entries())\n  )\n  if (!parsedQuery.success) {\n    return NextResponse.json({ error: 'Invalid size parameters' }, { status: 400 })\n  }\n  const { width, height, cropType } = parsedQuery.data\n\n  const { resolve } = await createRequestContainer()\n  const em = resolve('em') as EntityManager\n\n  const attachment = await em.findOne(Attachment, {\n    id,\n  })\n  if (!attachment) {\n    return NextResponse.json({ error: 'Not found' }, { status: 404 })\n  }\n  if (!canRenderInlineAttachment(attachment.mimeType)) {\n    return NextResponse.json({ error: 'Unsupported media type' }, { status: 400 })\n  }\n  const partition = await em.findOne(AttachmentPartition, { code: attachment.partitionCode })\n  if (!partition) {\n    return NextResponse.json({ error: 'Partition misconfigured' }, { status: 500 })\n  }\n  const access = checkAttachmentAccess(auth, attachment, partition)\n  if (!access.ok) {\n    const message = access.status === 401 ? 'Unauthorized' : 'Forbidden'\n    return NextResponse.json({ error: message }, { status: access.status })\n  }\n\n  const filePath = resolveAttachmentAbsolutePath(\n    attachment.partitionCode,\n    attachment.storagePath,\n    attachment.storageDriver\n  )\n  const cacheKey = buildThumbnailCacheKey(width, height, cropType)\n  try {\n    let buffer: Buffer | null = null\n    if (cacheKey) {\n      buffer = await readThumbnailCache(attachment.partitionCode, attachment.id, cacheKey)\n    }\n    if (!buffer) {\n      const input = await fs.readFile(filePath)\n      const magicBytesValidation = validateImageMagicBytes(input, attachment.mimeType)\n      if (!magicBytesValidation.ok) {\n        return NextResponse.json({ error: magicBytesValidation.error }, { status: magicBytesValidation.status })\n      }\n\n      const dimensionsValidation = await validateImageDimensions(input)\n      if (!dimensionsValidation.ok) {\n        return NextResponse.json({ error: dimensionsValidation.error }, { status: dimensionsValidation.status })\n      }\n\n      let transformer = sharp(input, {\n        failOn: 'error',\n        limitInputPixels: MAX_IMAGE_SOURCE_PIXELS,\n      })\n      if (width || height) {\n        const resizeOptions: sharp.ResizeOptions = {\n          width: width || undefined,\n          height: height || undefined,\n          fit: cropType === 'contain' ? 'contain' : 'cover',\n        }\n        if (cropType === 'contain') {\n          resizeOptions.background = { r: 0, g: 0, b: 0, alpha: 0 }\n        }\n        transformer = transformer.resize(resizeOptions)\n      }\n      buffer = await transformer.toBuffer()\n      if (cacheKey) {\n        void writeThumbnailCache(attachment.partitionCode, attachment.id, cacheKey, buffer).catch((cacheError) => {\n          console.error('attachments.image.cache.write failed', cacheError)\n        })\n      }\n    }\n    if (!buffer) {\n      return NextResponse.json({ error: 'Failed to render image' }, { status: 500 })\n    }\n    const responseBody = new Uint8Array(buffer)\n\n    return new NextResponse(responseBody, {\n      headers: {\n        'Content-Type': attachment.mimeType || 'image/jpeg',\n        'Cache-Control': partition.isPublic ? 'public, max-age=3600' : 'private, max-age=60',\n        'X-Content-Type-Options': 'nosniff',\n      },\n    })\n  } catch (error) {\n    console.error('attachments.image.read failed', error)\n    return NextResponse.json({ error: 'Failed to render image' }, { status: 500 })\n  }\n}\n\nexport const openApi: OpenApiRouteDoc = {\n  tag: attachmentsTag,\n  summary: 'Serve resized images',\n  methods: {\n    GET: {\n      summary: 'Serve image with optional resizing',\n      description: 'Returns an image attachment with optional on-the-fly resizing and cropping. Resized images are cached for performance. Only works with image MIME types. Path parameter: {id} - Attachment UUID. Query parameters: ?width=N (1-4000 pixels), ?height=N (1-4000 pixels), ?cropType=cover|contain (resize behavior).',\n      responses: [\n        {\n          status: 200,\n          description: 'Binary image content (Content-Type: image/jpeg, image/png, etc.)',\n          schema: z.any().describe('Binary image content - actual Content-Type header set to image MIME type, not application/json'),\n        },\n      ],\n      errors: [\n        { status: 400, description: 'Invalid parameters, missing ID, or non-image attachment', schema: attachmentErrorSchema },\n        { status: 401, description: 'Unauthorized - authentication required for private partitions', schema: attachmentErrorSchema },\n        { status: 403, description: 'Forbidden - insufficient permissions', schema: attachmentErrorSchema },\n        { status: 404, description: 'Image not found', schema: attachmentErrorSchema },\n        { status: 500, description: 'Partition misconfigured or image rendering failed', schema: attachmentErrorSchema },\n      ],\n    },\n  },\n}\n"],
-  "mappings": "AAAA,SAAsB,oBAAoB;AAC1C,OAAO,WAAW;AAClB,SAAS,SAAS;AAElB,SAAS,0BAA0B;AACnC,SAAS,8BAA8B;AACvC,SAAS,YAAY,2BAA2B;AAChD,SAAS,qCAAqC;AAC9C;AAAA,EACE;AAAA,EACA;AAAA,EACA;AAAA,OACK;AACP,SAAS,iCAAiC;AAC1C,SAAS,6BAA6B;AAEtC,SAAS,YAAY,UAAU;AAC/B,SAAS,gBAAkC,6BAA6B;AACxE;AAAA,EACE;AAAA,EACA;AAAA,EACA;AAAA,OACK;AAEP,MAAM,cAAc,EAAE,OAAO;AAAA,EAC3B,OAAO,EAAE,OAAO,OAAO,EAAE,IAAI,EAAE,IAAI,CAAC,EAAE,IAAI,GAAI,EAAE,SAAS;AAAA,EACzD,QAAQ,EAAE,OAAO,OAAO,EAAE,IAAI,EAAE,IAAI,CAAC,EAAE,IAAI,GAAI,EAAE,SAAS;AAAA,EAC1D,UAAU,EAAE,KAAK,CAAC,SAAS,SAAS,CAAC,EAAE,SAAS;AAClD,CAAC;AAEM,MAAM,WAAW;AAAA,EACtB,KAAK,EAAE,aAAa,MAAM;AAC5B;AAEA,eAAsB,IACpB,KACA,SACA;AACA,QAAM,OAAO,MAAM,mBAAmB,GAAG;AACzC,QAAM,EAAE,GAAG,IAAI,MAAM,QAAQ;AAC7B,MAAI,CAAC,IAAI;AACP,WAAO,aAAa,KAAK,EAAE,OAAO,4BAA4B,GAAG,EAAE,QAAQ,IAAI,CAAC;AAAA,EAClF;AACA,QAAM,cAAc,YAAY;AAAA,IAC9B,OAAO,YAAY,IAAI,IAAI,IAAI,GAAG,EAAE,aAAa,QAAQ,CAAC;AAAA,EAC5D;AACA,MAAI,CAAC,YAAY,SAAS;AACxB,WAAO,aAAa,KAAK,EAAE,OAAO,0BAA0B,GAAG,EAAE,QAAQ,IAAI,CAAC;AAAA,EAChF;AACA,QAAM,EAAE,OAAO,QAAQ,SAAS,IAAI,YAAY;AAEhD,QAAM,EAAE,QAAQ,IAAI,MAAM,uBAAuB;AACjD,QAAM,KAAK,QAAQ,IAAI;AAEvB,QAAM,aAAa,MAAM,GAAG,QAAQ,YAAY;AAAA,IAC9C;AAAA,EACF,CAAC;AACD,MAAI,CAAC,YAAY;AACf,WAAO,aAAa,KAAK,EAAE,OAAO,YAAY,GAAG,EAAE,QAAQ,IAAI,CAAC;AAAA,EAClE;AACA,MAAI,CAAC,0BAA0B,WAAW,QAAQ,GAAG;AACnD,WAAO,aAAa,KAAK,EAAE,OAAO,yBAAyB,GAAG,EAAE,QAAQ,IAAI,CAAC;AAAA,EAC/E;AACA,QAAM,YAAY,MAAM,GAAG,QAAQ,qBAAqB,EAAE,MAAM,WAAW,cAAc,CAAC;AAC1F,MAAI,CAAC,WAAW;AACd,WAAO,aAAa,KAAK,EAAE,OAAO,0BAA0B,GAAG,EAAE,QAAQ,IAAI,CAAC;AAAA,EAChF;AACA,QAAM,SAAS,sBAAsB,MAAM,YAAY,SAAS;AAChE,MAAI,CAAC,OAAO,IAAI;AACd,UAAM,UAAU,OAAO,WAAW,MAAM,iBAAiB;AACzD,WAAO,aAAa,KAAK,EAAE,OAAO,QAAQ,GAAG,EAAE,QAAQ,OAAO,OAAO,CAAC;AAAA,EACxE;AAEA,QAAM,WAAW;AAAA,IACf,WAAW;AAAA,IACX,WAAW;AAAA,IACX,WAAW;AAAA,EACb;AACA,QAAM,WAAW,uBAAuB,OAAO,QAAQ,QAAQ;AAC/D,MAAI;AACF,QAAI,SAAwB;AAC5B,QAAI,UAAU;AACZ,eAAS,MAAM,mBAAmB,WAAW,eAAe,WAAW,IAAI,QAAQ;AAAA,IACrF;AACA,QAAI,CAAC,QAAQ;AACX,YAAM,QAAQ,MAAM,GAAG,SAAS,QAAQ;AACxC,YAAM,uBAAuB,wBAAwB,OAAO,WAAW,QAAQ;AAC/E,UAAI,CAAC,qBAAqB,IAAI;AAC5B,eAAO,aAAa,KAAK,EAAE,OAAO,qBAAqB,MAAM,GAAG,EAAE,QAAQ,qBAAqB,OAAO,CAAC;AAAA,MACzG;AAEA,YAAM,uBAAuB,MAAM,wBAAwB,KAAK;AAChE,UAAI,CAAC,qBAAqB,IAAI;AAC5B,eAAO,aAAa,KAAK,EAAE,OAAO,qBAAqB,MAAM,GAAG,EAAE,QAAQ,qBAAqB,OAAO,CAAC;AAAA,MACzG;AAEA,UAAI,cAAc,MAAM,OAAO;AAAA,QAC7B,QAAQ;AAAA,QACR,kBAAkB;AAAA,MACpB,CAAC;AACD,UAAI,SAAS,QAAQ;AACnB,cAAM,gBAAqC;AAAA,UACzC,OAAO,SAAS;AAAA,UAChB,QAAQ,UAAU;AAAA,UAClB,KAAK,aAAa,YAAY,YAAY;AAAA,QAC5C;AACA,YAAI,aAAa,WAAW;AAC1B,wBAAc,aAAa,EAAE,GAAG,GAAG,GAAG,GAAG,GAAG,GAAG,OAAO,EAAE;AAAA,QAC1D;AACA,sBAAc,YAAY,OAAO,aAAa;AAAA,MAChD;AACA,eAAS,MAAM,YAAY,SAAS;AACpC,UAAI,UAAU;AACZ,aAAK,oBAAoB,WAAW,eAAe,WAAW,IAAI,UAAU,MAAM,EAAE,MAAM,CAAC,eAAe;AACxG,kBAAQ,MAAM,wCAAwC,UAAU;AAAA,QAClE,CAAC;AAAA,MACH;AAAA,IACF;AACA,QAAI,CAAC,QAAQ;AACX,aAAO,aAAa,KAAK,EAAE,OAAO,yBAAyB,GAAG,EAAE,QAAQ,IAAI,CAAC;AAAA,IAC/E;AACA,UAAM,eAAe,IAAI,WAAW,MAAM;AAE1C,WAAO,IAAI,aAAa,cAAc;AAAA,MACpC,SAAS;AAAA,QACP,gBAAgB,WAAW,YAAY;AAAA,QACvC,iBAAiB,UAAU,WAAW,yBAAyB;AAAA,QAC/D,0BAA0B;AAAA,MAC5B;AAAA,IACF,CAAC;AAAA,EACH,SAAS,OAAO;AACd,YAAQ,MAAM,iCAAiC,KAAK;AACpD,WAAO,aAAa,KAAK,EAAE,OAAO,yBAAyB,GAAG,EAAE,QAAQ,IAAI,CAAC;AAAA,EAC/E;AACF;AAEO,MAAM,UAA2B;AAAA,EACtC,KAAK;AAAA,EACL,SAAS;AAAA,EACT,SAAS;AAAA,IACP,KAAK;AAAA,MACH,SAAS;AAAA,MACT,aAAa;AAAA,MACb,WAAW;AAAA,QACT;AAAA,UACE,QAAQ;AAAA,UACR,aAAa;AAAA,UACb,QAAQ,EAAE,IAAI,EAAE,SAAS,gGAAgG;AAAA,QAC3H;AAAA,MACF;AAAA,MACA,QAAQ;AAAA,QACN,EAAE,QAAQ,KAAK,aAAa,2DAA2D,QAAQ,sBAAsB;AAAA,QACrH,EAAE,QAAQ,KAAK,aAAa,iEAAiE,QAAQ,sBAAsB;AAAA,QAC3H,EAAE,QAAQ,KAAK,aAAa,wCAAwC,QAAQ,sBAAsB;AAAA,QAClG,EAAE,QAAQ,KAAK,aAAa,mBAAmB,QAAQ,sBAAsB;AAAA,QAC7E,EAAE,QAAQ,KAAK,aAAa,qDAAqD,QAAQ,sBAAsB;AAAA,MACjH;AAAA,IACF;AAAA,EACF;AACF;",
+  "sourcesContent": ["import { NextRequest, NextResponse } from 'next/server'\nimport sharp from 'sharp'\nimport { z } from 'zod'\nimport type { OpenApiRouteDoc } from '@open-mercato/shared/lib/openapi'\nimport { getAuthFromRequest } from '@open-mercato/shared/lib/auth/server'\nimport { createRequestContainer } from '@open-mercato/shared/lib/di/container'\nimport { Attachment, AttachmentPartition } from '@open-mercato/core/modules/attachments/data/entities'\nimport {\n  buildThumbnailCacheKey,\n  readThumbnailCache,\n  writeThumbnailCache,\n} from '@open-mercato/core/modules/attachments/lib/thumbnailCache'\nimport { canRenderInlineAttachment } from '@open-mercato/core/modules/attachments/lib/security'\nimport { checkAttachmentAccess } from '@open-mercato/core/modules/attachments/lib/access'\nimport type { EntityManager } from '@mikro-orm/postgresql'\nimport { attachmentsTag, imageQuerySchema, attachmentErrorSchema } from '../../../openapi'\nimport {\n  MAX_IMAGE_SOURCE_PIXELS,\n  validateImageDimensions,\n  validateImageMagicBytes,\n} from '@open-mercato/core/modules/attachments/lib/imageSafety'\nimport { StorageDriverFactory } from '../../../../lib/drivers'\n\nconst querySchema = z.object({\n  width: z.coerce.number().int().min(1).max(4000).optional(),\n  height: z.coerce.number().int().min(1).max(4000).optional(),\n  cropType: z.enum(['cover', 'contain']).optional(),\n})\n\nexport const metadata = {\n  GET: { requireAuth: false },\n}\n\nexport async function GET(\n  req: NextRequest,\n  context: { params: Promise<{ id: string; slug?: string[] | undefined }> }\n) {\n  const auth = await getAuthFromRequest(req)\n  const { id } = await context.params\n  if (!id) {\n    return NextResponse.json({ error: 'Attachment id is required' }, { status: 400 })\n  }\n  const parsedQuery = querySchema.safeParse(\n    Object.fromEntries(new URL(req.url).searchParams.entries())\n  )\n  if (!parsedQuery.success) {\n    return NextResponse.json({ error: 'Invalid size parameters' }, { status: 400 })\n  }\n  const { width, height, cropType } = parsedQuery.data\n\n  const { resolve } = await createRequestContainer()\n  const em = resolve('em') as EntityManager\n  const storageDriverFactory =\n    (resolve('storageDriverFactory') as StorageDriverFactory | null) ?? new StorageDriverFactory(em)\n\n  const attachment = await em.findOne(Attachment, {\n    id,\n  })\n  if (!attachment) {\n    return NextResponse.json({ error: 'Not found' }, { status: 404 })\n  }\n  if (!canRenderInlineAttachment(attachment.mimeType)) {\n    return NextResponse.json({ error: 'Unsupported media type' }, { status: 400 })\n  }\n  const partition = await em.findOne(AttachmentPartition, { code: attachment.partitionCode })\n  if (!partition) {\n    return NextResponse.json({ error: 'Partition misconfigured' }, { status: 500 })\n  }\n  const access = checkAttachmentAccess(auth, attachment, partition)\n  if (!access.ok) {\n    const message = access.status === 401 ? 'Unauthorized' : 'Forbidden'\n    return NextResponse.json({ error: message }, { status: access.status })\n  }\n\n  const driver = await storageDriverFactory.resolveForPartition(attachment.partitionCode, {\n    tenantId: attachment.tenantId ?? '',\n    organizationId: attachment.organizationId ?? '',\n  })\n  const cacheKey = buildThumbnailCacheKey(width, height, cropType)\n  try {\n    let buffer: Buffer | null = null\n    if (cacheKey) {\n      buffer = await readThumbnailCache(attachment.partitionCode, attachment.id, cacheKey)\n    }\n    if (!buffer) {\n      const { buffer: input } = await driver.read(attachment.partitionCode, attachment.storagePath)\n      const magicBytesValidation = validateImageMagicBytes(input, attachment.mimeType)\n      if (!magicBytesValidation.ok) {\n        return NextResponse.json({ error: magicBytesValidation.error }, { status: magicBytesValidation.status })\n      }\n\n      const dimensionsValidation = await validateImageDimensions(input)\n      if (!dimensionsValidation.ok) {\n        return NextResponse.json({ error: dimensionsValidation.error }, { status: dimensionsValidation.status })\n      }\n\n      let transformer = sharp(input, {\n        failOn: 'error',\n        limitInputPixels: MAX_IMAGE_SOURCE_PIXELS,\n      })\n      if (width || height) {\n        const resizeOptions: sharp.ResizeOptions = {\n          width: width || undefined,\n          height: height || undefined,\n          fit: cropType === 'contain' ? 'contain' : 'cover',\n        }\n        if (cropType === 'contain') {\n          resizeOptions.background = { r: 0, g: 0, b: 0, alpha: 0 }\n        }\n        transformer = transformer.resize(resizeOptions)\n      }\n      buffer = await transformer.toBuffer()\n      if (cacheKey) {\n        void writeThumbnailCache(attachment.partitionCode, attachment.id, cacheKey, buffer).catch((cacheError) => {\n          console.error('attachments.image.cache.write failed', cacheError)\n        })\n      }\n    }\n    if (!buffer) {\n      return NextResponse.json({ error: 'Failed to render image' }, { status: 500 })\n    }\n    const responseBody = new Uint8Array(buffer)\n\n    return new NextResponse(responseBody, {\n      headers: {\n        'Content-Type': attachment.mimeType || 'image/jpeg',\n        'Cache-Control': partition.isPublic ? 'public, max-age=3600' : 'private, max-age=60',\n        'X-Content-Type-Options': 'nosniff',\n      },\n    })\n  } catch (error) {\n    console.error('attachments.image.read failed', error)\n    return NextResponse.json({ error: 'Failed to render image' }, { status: 500 })\n  }\n}\n\nexport const openApi: OpenApiRouteDoc = {\n  tag: attachmentsTag,\n  summary: 'Serve resized images',\n  methods: {\n    GET: {\n      summary: 'Serve image with optional resizing',\n      description: 'Returns an image attachment with optional on-the-fly resizing and cropping. Resized images are cached for performance. Only works with image MIME types. Path parameter: {id} - Attachment UUID. Query parameters: ?width=N (1-4000 pixels), ?height=N (1-4000 pixels), ?cropType=cover|contain (resize behavior).',\n      responses: [\n        {\n          status: 200,\n          description: 'Binary image content (Content-Type: image/jpeg, image/png, etc.)',\n          schema: z.any().describe('Binary image content - actual Content-Type header set to image MIME type, not application/json'),\n        },\n      ],\n      errors: [\n        { status: 400, description: 'Invalid parameters, missing ID, or non-image attachment', schema: attachmentErrorSchema },\n        { status: 401, description: 'Unauthorized - authentication required for private partitions', schema: attachmentErrorSchema },\n        { status: 403, description: 'Forbidden - insufficient permissions', schema: attachmentErrorSchema },\n        { status: 404, description: 'Image not found', schema: attachmentErrorSchema },\n        { status: 500, description: 'Partition misconfigured or image rendering failed', schema: attachmentErrorSchema },\n      ],\n    },\n  },\n}\n"],
+  "mappings": "AAAA,SAAsB,oBAAoB;AAC1C,OAAO,WAAW;AAClB,SAAS,SAAS;AAElB,SAAS,0BAA0B;AACnC,SAAS,8BAA8B;AACvC,SAAS,YAAY,2BAA2B;AAChD;AAAA,EACE;AAAA,EACA;AAAA,EACA;AAAA,OACK;AACP,SAAS,iCAAiC;AAC1C,SAAS,6BAA6B;AAEtC,SAAS,gBAAkC,6BAA6B;AACxE;AAAA,EACE;AAAA,EACA;AAAA,EACA;AAAA,OACK;AACP,SAAS,4BAA4B;AAErC,MAAM,cAAc,EAAE,OAAO;AAAA,EAC3B,OAAO,EAAE,OAAO,OAAO,EAAE,IAAI,EAAE,IAAI,CAAC,EAAE,IAAI,GAAI,EAAE,SAAS;AAAA,EACzD,QAAQ,EAAE,OAAO,OAAO,EAAE,IAAI,EAAE,IAAI,CAAC,EAAE,IAAI,GAAI,EAAE,SAAS;AAAA,EAC1D,UAAU,EAAE,KAAK,CAAC,SAAS,SAAS,CAAC,EAAE,SAAS;AAClD,CAAC;AAEM,MAAM,WAAW;AAAA,EACtB,KAAK,EAAE,aAAa,MAAM;AAC5B;AAEA,eAAsB,IACpB,KACA,SACA;AACA,QAAM,OAAO,MAAM,mBAAmB,GAAG;AACzC,QAAM,EAAE,GAAG,IAAI,MAAM,QAAQ;AAC7B,MAAI,CAAC,IAAI;AACP,WAAO,aAAa,KAAK,EAAE,OAAO,4BAA4B,GAAG,EAAE,QAAQ,IAAI,CAAC;AAAA,EAClF;AACA,QAAM,cAAc,YAAY;AAAA,IAC9B,OAAO,YAAY,IAAI,IAAI,IAAI,GAAG,EAAE,aAAa,QAAQ,CAAC;AAAA,EAC5D;AACA,MAAI,CAAC,YAAY,SAAS;AACxB,WAAO,aAAa,KAAK,EAAE,OAAO,0BAA0B,GAAG,EAAE,QAAQ,IAAI,CAAC;AAAA,EAChF;AACA,QAAM,EAAE,OAAO,QAAQ,SAAS,IAAI,YAAY;AAEhD,QAAM,EAAE,QAAQ,IAAI,MAAM,uBAAuB;AACjD,QAAM,KAAK,QAAQ,IAAI;AACvB,QAAM,uBACH,QAAQ,sBAAsB,KAAqC,IAAI,qBAAqB,EAAE;AAEjG,QAAM,aAAa,MAAM,GAAG,QAAQ,YAAY;AAAA,IAC9C;AAAA,EACF,CAAC;AACD,MAAI,CAAC,YAAY;AACf,WAAO,aAAa,KAAK,EAAE,OAAO,YAAY,GAAG,EAAE,QAAQ,IAAI,CAAC;AAAA,EAClE;AACA,MAAI,CAAC,0BAA0B,WAAW,QAAQ,GAAG;AACnD,WAAO,aAAa,KAAK,EAAE,OAAO,yBAAyB,GAAG,EAAE,QAAQ,IAAI,CAAC;AAAA,EAC/E;AACA,QAAM,YAAY,MAAM,GAAG,QAAQ,qBAAqB,EAAE,MAAM,WAAW,cAAc,CAAC;AAC1F,MAAI,CAAC,WAAW;AACd,WAAO,aAAa,KAAK,EAAE,OAAO,0BAA0B,GAAG,EAAE,QAAQ,IAAI,CAAC;AAAA,EAChF;AACA,QAAM,SAAS,sBAAsB,MAAM,YAAY,SAAS;AAChE,MAAI,CAAC,OAAO,IAAI;AACd,UAAM,UAAU,OAAO,WAAW,MAAM,iBAAiB;AACzD,WAAO,aAAa,KAAK,EAAE,OAAO,QAAQ,GAAG,EAAE,QAAQ,OAAO,OAAO,CAAC;AAAA,EACxE;AAEA,QAAM,SAAS,MAAM,qBAAqB,oBAAoB,WAAW,eAAe;AAAA,IACtF,UAAU,WAAW,YAAY;AAAA,IACjC,gBAAgB,WAAW,kBAAkB;AAAA,EAC/C,CAAC;AACD,QAAM,WAAW,uBAAuB,OAAO,QAAQ,QAAQ;AAC/D,MAAI;AACF,QAAI,SAAwB;AAC5B,QAAI,UAAU;AACZ,eAAS,MAAM,mBAAmB,WAAW,eAAe,WAAW,IAAI,QAAQ;AAAA,IACrF;AACA,QAAI,CAAC,QAAQ;AACX,YAAM,EAAE,QAAQ,MAAM,IAAI,MAAM,OAAO,KAAK,WAAW,eAAe,WAAW,WAAW;AAC5F,YAAM,uBAAuB,wBAAwB,OAAO,WAAW,QAAQ;AAC/E,UAAI,CAAC,qBAAqB,IAAI;AAC5B,eAAO,aAAa,KAAK,EAAE,OAAO,qBAAqB,MAAM,GAAG,EAAE,QAAQ,qBAAqB,OAAO,CAAC;AAAA,MACzG;AAEA,YAAM,uBAAuB,MAAM,wBAAwB,KAAK;AAChE,UAAI,CAAC,qBAAqB,IAAI;AAC5B,eAAO,aAAa,KAAK,EAAE,OAAO,qBAAqB,MAAM,GAAG,EAAE,QAAQ,qBAAqB,OAAO,CAAC;AAAA,MACzG;AAEA,UAAI,cAAc,MAAM,OAAO;AAAA,QAC7B,QAAQ;AAAA,QACR,kBAAkB;AAAA,MACpB,CAAC;AACD,UAAI,SAAS,QAAQ;AACnB,cAAM,gBAAqC;AAAA,UACzC,OAAO,SAAS;AAAA,UAChB,QAAQ,UAAU;AAAA,UAClB,KAAK,aAAa,YAAY,YAAY;AAAA,QAC5C;AACA,YAAI,aAAa,WAAW;AAC1B,wBAAc,aAAa,EAAE,GAAG,GAAG,GAAG,GAAG,GAAG,GAAG,OAAO,EAAE;AAAA,QAC1D;AACA,sBAAc,YAAY,OAAO,aAAa;AAAA,MAChD;AACA,eAAS,MAAM,YAAY,SAAS;AACpC,UAAI,UAAU;AACZ,aAAK,oBAAoB,WAAW,eAAe,WAAW,IAAI,UAAU,MAAM,EAAE,MAAM,CAAC,eAAe;AACxG,kBAAQ,MAAM,wCAAwC,UAAU;AAAA,QAClE,CAAC;AAAA,MACH;AAAA,IACF;AACA,QAAI,CAAC,QAAQ;AACX,aAAO,aAAa,KAAK,EAAE,OAAO,yBAAyB,GAAG,EAAE,QAAQ,IAAI,CAAC;AAAA,IAC/E;AACA,UAAM,eAAe,IAAI,WAAW,MAAM;AAE1C,WAAO,IAAI,aAAa,cAAc;AAAA,MACpC,SAAS;AAAA,QACP,gBAAgB,WAAW,YAAY;AAAA,QACvC,iBAAiB,UAAU,WAAW,yBAAyB;AAAA,QAC/D,0BAA0B;AAAA,MAC5B;AAAA,IACF,CAAC;AAAA,EACH,SAAS,OAAO;AACd,YAAQ,MAAM,iCAAiC,KAAK;AACpD,WAAO,aAAa,KAAK,EAAE,OAAO,yBAAyB,GAAG,EAAE,QAAQ,IAAI,CAAC;AAAA,EAC/E;AACF;AAEO,MAAM,UAA2B;AAAA,EACtC,KAAK;AAAA,EACL,SAAS;AAAA,EACT,SAAS;AAAA,IACP,KAAK;AAAA,MACH,SAAS;AAAA,MACT,aAAa;AAAA,MACb,WAAW;AAAA,QACT;AAAA,UACE,QAAQ;AAAA,UACR,aAAa;AAAA,UACb,QAAQ,EAAE,IAAI,EAAE,SAAS,gGAAgG;AAAA,QAC3H;AAAA,MACF;AAAA,MACA,QAAQ;AAAA,QACN,EAAE,QAAQ,KAAK,aAAa,2DAA2D,QAAQ,sBAAsB;AAAA,QACrH,EAAE,QAAQ,KAAK,aAAa,iEAAiE,QAAQ,sBAAsB;AAAA,QAC3H,EAAE,QAAQ,KAAK,aAAa,wCAAwC,QAAQ,sBAAsB;AAAA,QAClG,EAAE,QAAQ,KAAK,aAAa,mBAAmB,QAAQ,sBAAsB;AAAA,QAC7E,EAAE,QAAQ,KAAK,aAAa,qDAAqD,QAAQ,sBAAsB;AAAA,MACjH;AAAA,IACF;AAAA,EACF;AACF;",
   "names": []
 }

package/dist/modules/attachments/api/library/[id]/route.js

@@ -9,7 +9,6 @@ import {
   normalizeAttachmentTags,
   readAttachmentMetadata
 } from "../../../lib/metadata.js";
-import { deletePartitionFile } from "../../../lib/storage.js";
 import { splitCustomFieldPayload, loadCustomFieldValues } from "@open-mercato/shared/lib/crud/custom-fields";
 import { emitCrudSideEffects, setCustomFieldsIfAny } from "@open-mercato/shared/lib/commands/helpers";
 import { normalizeCustomFieldResponse } from "@open-mercato/shared/lib/custom-fields/normalize";
@@ -208,6 +207,7 @@ async function DELETE(req, ctx) {
   const { resolve } = await createRequestContainer();
   const em = resolve("em");
   const dataEngine = resolve("dataEngine");
+  const storageDriverFactory = resolve("storageDriverFactory");
   const deleteFilter = {
     id: attachmentId,
     tenantId: auth.tenantId,
@@ -217,7 +217,11 @@ async function DELETE(req, ctx) {
   if (!record) {
     return NextResponse.json({ error: "Attachment not found" }, { status: 404 });
   }
-  await deletePartitionFile(record.partitionCode, record.storagePath, record.storageDriver);
+  const deleteDriver = await storageDriverFactory.resolveForPartition(record.partitionCode, {
+    tenantId: record.tenantId ?? auth.tenantId,
+    organizationId: record.organizationId ?? auth.orgId
+  });
+  await deleteDriver.delete(record.partitionCode, record.storagePath);
   await em.remove(record).flush();
   if (dataEngine) {
     await emitCrudSideEffects({

package/dist/modules/attachments/api/library/[id]/route.js.map

@@ -1,7 +1,7 @@
 {
   "version": 3,
   "sources": ["../../../../../../src/modules/attachments/api/library/%5Bid%5D/route.ts"],
-  "sourcesContent": ["import { NextRequest, NextResponse } from 'next/server'\nimport { z } from 'zod'\nimport type { OpenApiRouteDoc } from '@open-mercato/shared/lib/openapi'\nimport { getAuthFromRequest } from '@open-mercato/shared/lib/auth/server'\nimport { createRequestContainer } from '@open-mercato/shared/lib/di/container'\nimport type { EntityManager } from '@mikro-orm/postgresql'\nimport { Attachment, AttachmentPartition } from '../../../data/entities'\nimport {\n  mergeAttachmentMetadata,\n  normalizeAttachmentAssignments,\n  normalizeAttachmentTags,\n  readAttachmentMetadata,\n} from '../../../lib/metadata'\nimport { deletePartitionFile } from '../../../lib/storage'\nimport { splitCustomFieldPayload, loadCustomFieldValues } from '@open-mercato/shared/lib/crud/custom-fields'\nimport { emitCrudSideEffects, setCustomFieldsIfAny } from '@open-mercato/shared/lib/commands/helpers'\nimport { normalizeCustomFieldResponse } from '@open-mercato/shared/lib/custom-fields/normalize'\nimport { E } from '#generated/entities.ids.generated'\nimport type { QueryEngine } from '@open-mercato/shared/lib/query/types'\nimport type { DataEngine } from '@open-mercato/shared/lib/data/engine'\nimport { attachmentCrudEvents, attachmentCrudIndexer } from '../../../lib/crud'\nimport { applyAssignmentEnrichments, resolveAssignmentEnrichments } from '../../../lib/assignmentDetails'\nimport {\n  attachmentsTag,\n  attachmentDetailResponseSchema,\n  attachmentErrorSchema,\n} from '../../openapi'\n\nconst updateSchema = z.object({\n  tags: z.array(z.string()).optional(),\n  assignments: z\n    .array(\n      z.object({\n        type: z.string().min(1),\n        id: z.string().min(1),\n        href: z.string().nullable().optional(),\n        label: z.string().nullable().optional(),\n      }),\n    )\n    .optional(),\n})\n\nexport const metadata = {\n  GET: { requireAuth: true, requireFeatures: ['attachments.view'] },\n  PATCH: { requireAuth: true, requireFeatures: ['attachments.manage'] },\n  DELETE: { requireAuth: true, requireFeatures: ['attachments.manage'] },\n}\n\ntype RouteParams = { id: string }\ntype RouteContext = { params: Promise<RouteParams> }\n\nasync function resolveAttachmentId(ctx: RouteContext): Promise<string | null> {\n  const params = ctx?.params\n  try {\n    const { id } = await params\n    if (typeof id === 'string' && id.trim().length) {\n      return id\n    }\n    return null\n  } catch {\n    return null\n  }\n}\n\nexport async function GET(req: NextRequest, ctx: RouteContext) {\n  const auth = await getAuthFromRequest(req)\n  if (!auth || !auth.tenantId || (!auth.orgId && !auth.isSuperAdmin)) {\n    return NextResponse.json({ error: 'Unauthorized' }, { status: 401 })\n  }\n  const attachmentId = await resolveAttachmentId(ctx)\n  if (!attachmentId) {\n    return NextResponse.json({ error: 'Attachment id is required' }, { status: 400 })\n  }\n  const { resolve } = await createRequestContainer()\n  const em = resolve('em') as EntityManager\n  let queryEngine: QueryEngine | null = null\n  try {\n    queryEngine = resolve('queryEngine') as QueryEngine\n  } catch {\n    queryEngine = null\n  }\n  const findFilter: Record<string, unknown> = {\n    id: attachmentId,\n    tenantId: auth.tenantId,\n  }\n  if (auth.orgId) {\n    findFilter.organizationId = auth.orgId\n  }\n  const record = await em.findOne(Attachment, findFilter)\n  if (!record) {\n    return NextResponse.json({ error: 'Attachment not found' }, { status: 404 })\n  }\n  const metadata = readAttachmentMetadata(record.storageMetadata)\n  const partition = record.partitionCode\n    ? await em.findOne(AttachmentPartition, { code: record.partitionCode })\n    : null\n  const customFieldValues = await loadCustomFieldValues({\n    em,\n    entityId: E.attachments.attachment,\n    recordIds: [record.id],\n    tenantIdByRecord: { [record.id]: record.tenantId ?? auth.tenantId ?? null },\n    organizationIdByRecord: { [record.id]: record.organizationId ?? auth.orgId ?? null },\n    tenantFallbacks: [auth.tenantId ?? null].filter((value): value is string => !!value),\n  })\n  const customFields = normalizeCustomFieldResponse(customFieldValues[record.id])\n  const assignments = metadata.assignments ?? []\n  const enrichments = await resolveAssignmentEnrichments(assignments, {\n    queryEngine,\n    tenantId: auth.tenantId,\n    organizationId: auth.orgId,\n  })\n  const enrichedAssignments = applyAssignmentEnrichments(assignments, enrichments)\n  return NextResponse.json({\n    item: {\n      id: record.id,\n      fileName: record.fileName,\n      fileSize: record.fileSize,\n      mimeType: record.mimeType,\n      partitionCode: record.partitionCode,\n      partitionTitle: partition?.title ?? null,\n      tags: metadata.tags ?? [],\n      assignments: enrichedAssignments,\n      content: record.content && record.content.trim() ? record.content : null,\n      customFields,\n    },\n  })\n}\n\nexport async function PATCH(req: NextRequest, ctx: RouteContext) {\n  const auth = await getAuthFromRequest(req)\n  if (!auth || !auth.tenantId || !auth.orgId) {\n    return NextResponse.json({ error: 'Unauthorized' }, { status: 401 })\n  }\n  const attachmentId = await resolveAttachmentId(ctx)\n  if (!attachmentId) {\n    return NextResponse.json({ error: 'Attachment id is required' }, { status: 400 })\n  }\n  const rawBody = await req.json().catch(() => null)\n  const { base, custom } = splitCustomFieldPayload(rawBody)\n  const parsed = updateSchema.safeParse(base)\n  if (!parsed.success) {\n    return NextResponse.json({ error: 'Invalid payload' }, { status: 400 })\n  }\n  const { resolve } = await createRequestContainer()\n  const em = resolve('em') as EntityManager\n  let queryEngine: QueryEngine | null = null\n  try {\n    queryEngine = resolve('queryEngine') as QueryEngine\n  } catch {\n    queryEngine = null\n  }\n  const dataEngine = resolve('dataEngine') as DataEngine\n  const patchFilter: Record<string, unknown> = {\n    id: attachmentId,\n    tenantId: auth.tenantId,\n    organizationId: auth.orgId,\n  }\n  const record = await em.findOne(Attachment, patchFilter)\n  if (!record) {\n    return NextResponse.json({ error: 'Attachment not found' }, { status: 404 })\n  }\n  const patch: Record<string, unknown> = {}\n  if (parsed.data.tags) patch.tags = normalizeAttachmentTags(parsed.data.tags)\n  if (parsed.data.assignments) patch.assignments = normalizeAttachmentAssignments(parsed.data.assignments)\n  record.storageMetadata = mergeAttachmentMetadata(record.storageMetadata, patch)\n  await em.flush()\n\n  if (dataEngine && custom && Object.keys(custom).length) {\n    try {\n      await setCustomFieldsIfAny({\n        dataEngine,\n        entityId: E.attachments.attachment,\n        recordId: record.id,\n        tenantId: record.tenantId ?? auth.tenantId ?? null,\n        organizationId: record.organizationId ?? auth.orgId ?? null,\n        values: custom,\n      })\n    } catch (error) {\n      console.error('[attachments] failed to persist custom attributes', error)\n      return NextResponse.json({ error: 'Failed to save attachment attributes.' }, { status: 500 })\n    }\n  }\n\n  if (dataEngine) {\n    await emitCrudSideEffects({\n      dataEngine,\n      action: 'updated',\n      entity: record,\n      identifiers: {\n        id: record.id,\n        organizationId: record.organizationId ?? auth.orgId ?? null,\n        tenantId: record.tenantId ?? auth.tenantId ?? null,\n      },\n      events: attachmentCrudEvents,\n      indexer: attachmentCrudIndexer,\n    })\n    await dataEngine.flushOrmEntityChanges()\n  }\n\n  const metadata = readAttachmentMetadata(record.storageMetadata)\n  const assignments = metadata.assignments ?? []\n  const enrichments = await resolveAssignmentEnrichments(assignments, {\n    queryEngine,\n    tenantId: auth.tenantId,\n    organizationId: auth.orgId,\n  })\n  const enrichedAssignments = applyAssignmentEnrichments(assignments, enrichments)\n  return NextResponse.json({\n    ok: true,\n    item: {\n      id: record.id,\n      tags: metadata.tags ?? [],\n      assignments: enrichedAssignments,\n      customFields: normalizeCustomFieldResponse(custom ?? null),\n    },\n  })\n}\n\nexport async function DELETE(req: NextRequest, ctx: RouteContext) {\n  const auth = await getAuthFromRequest(req)\n  if (!auth || !auth.tenantId || !auth.orgId) {\n    return NextResponse.json({ error: 'Unauthorized' }, { status: 401 })\n  }\n  const attachmentId = await resolveAttachmentId(ctx)\n  if (!attachmentId) {\n    return NextResponse.json({ error: 'Attachment id is required' }, { status: 400 })\n  }\n  const { resolve } = await createRequestContainer()\n  const em = resolve('em') as EntityManager\n  const dataEngine = resolve('dataEngine') as DataEngine\n  const deleteFilter: Record<string, unknown> = {\n    id: attachmentId,\n    tenantId: auth.tenantId,\n    organizationId: auth.orgId,\n  }\n  const record = await em.findOne(Attachment, deleteFilter)\n  if (!record) {\n    return NextResponse.json({ error: 'Attachment not found' }, { status: 404 })\n  }\n\n  await deletePartitionFile(record.partitionCode, record.storagePath, record.storageDriver)\n  await em.remove(record).flush()\n\n  if (dataEngine) {\n    await emitCrudSideEffects({\n      dataEngine,\n      action: 'deleted',\n      entity: record,\n      identifiers: {\n        id: record.id,\n        organizationId: record.organizationId ?? auth.orgId ?? null,\n        tenantId: record.tenantId ?? auth.tenantId ?? null,\n      },\n      events: attachmentCrudEvents,\n      indexer: attachmentCrudIndexer,\n    })\n    await dataEngine.flushOrmEntityChanges()\n  }\n\n  return NextResponse.json({ ok: true })\n}\n\nexport const openApi: OpenApiRouteDoc = {\n  tag: attachmentsTag,\n  summary: 'Attachment detail management',\n  methods: {\n    GET: {\n      summary: 'Get attachment details',\n      description: 'Returns complete details of an attachment including metadata, tags, assignments, and custom fields.',\n      responses: [\n        { status: 200, description: 'Attachment details', schema: attachmentDetailResponseSchema },\n      ],\n      errors: [\n        { status: 400, description: 'Invalid attachment ID', schema: attachmentErrorSchema },\n        { status: 401, description: 'Unauthorized', schema: attachmentErrorSchema },\n        { status: 404, description: 'Attachment not found', schema: attachmentErrorSchema },\n      ],\n    },\n    PATCH: {\n      summary: 'Update attachment metadata',\n      description: 'Updates attachment tags, assignments, and custom fields. Emits CRUD side effects for indexing and events.',\n      requestBody: {\n        contentType: 'application/json',\n        schema: updateSchema,\n      },\n      responses: [\n        { status: 200, description: 'Attachment updated successfully', schema: z.object({ ok: z.literal(true), item: z.any() }) },\n      ],\n      errors: [\n        { status: 400, description: 'Invalid payload or attachment ID', schema: attachmentErrorSchema },\n        { status: 401, description: 'Unauthorized', schema: attachmentErrorSchema },\n        { status: 404, description: 'Attachment not found', schema: attachmentErrorSchema },\n        { status: 500, description: 'Failed to save attributes', schema: attachmentErrorSchema },\n      ],\n    },\n    DELETE: {\n      summary: 'Delete attachment',\n      description: 'Permanently deletes an attachment file from storage and database. Emits CRUD side effects.',\n      responses: [\n        { status: 200, description: 'Attachment deleted successfully', schema: z.object({ ok: z.literal(true) }) },\n      ],\n      errors: [\n        { status: 400, description: 'Invalid attachment ID', schema: attachmentErrorSchema },\n        { status: 401, description: 'Unauthorized', schema: attachmentErrorSchema },\n        { status: 404, description: 'Attachment not found', schema: attachmentErrorSchema },\n      ],\n    },\n  },\n}\n"],
-  "mappings": "AAAA,SAAsB,oBAAoB;AAC1C,SAAS,SAAS;AAElB,SAAS,0BAA0B;AACnC,SAAS,8BAA8B;AAEvC,SAAS,YAAY,2BAA2B;AAChD;AAAA,EACE;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,OACK;AACP,SAAS,2BAA2B;AACpC,SAAS,yBAAyB,6BAA6B;AAC/D,SAAS,qBAAqB,4BAA4B;AAC1D,SAAS,oCAAoC;AAC7C,SAAS,SAAS;AAGlB,SAAS,sBAAsB,6BAA6B;AAC5D,SAAS,4BAA4B,oCAAoC;AACzE;AAAA,EACE;AAAA,EACA;AAAA,EACA;AAAA,OACK;AAEP,MAAM,eAAe,EAAE,OAAO;AAAA,EAC5B,MAAM,EAAE,MAAM,EAAE,OAAO,CAAC,EAAE,SAAS;AAAA,EACnC,aAAa,EACV;AAAA,IACC,EAAE,OAAO;AAAA,MACP,MAAM,EAAE,OAAO,EAAE,IAAI,CAAC;AAAA,MACtB,IAAI,EAAE,OAAO,EAAE,IAAI,CAAC;AAAA,MACpB,MAAM,EAAE,OAAO,EAAE,SAAS,EAAE,SAAS;AAAA,MACrC,OAAO,EAAE,OAAO,EAAE,SAAS,EAAE,SAAS;AAAA,IACxC,CAAC;AAAA,EACH,EACC,SAAS;AACd,CAAC;AAEM,MAAM,WAAW;AAAA,EACtB,KAAK,EAAE,aAAa,MAAM,iBAAiB,CAAC,kBAAkB,EAAE;AAAA,EAChE,OAAO,EAAE,aAAa,MAAM,iBAAiB,CAAC,oBAAoB,EAAE;AAAA,EACpE,QAAQ,EAAE,aAAa,MAAM,iBAAiB,CAAC,oBAAoB,EAAE;AACvE;AAKA,eAAe,oBAAoB,KAA2C;AAC5E,QAAM,SAAS,KAAK;AACpB,MAAI;AACF,UAAM,EAAE,GAAG,IAAI,MAAM;AACrB,QAAI,OAAO,OAAO,YAAY,GAAG,KAAK,EAAE,QAAQ;AAC9C,aAAO;AAAA,IACT;AACA,WAAO;AAAA,EACT,QAAQ;AACN,WAAO;AAAA,EACT;AACF;AAEA,eAAsB,IAAI,KAAkB,KAAmB;AAC7D,QAAM,OAAO,MAAM,mBAAmB,GAAG;AACzC,MAAI,CAAC,QAAQ,CAAC,KAAK,YAAa,CAAC,KAAK,SAAS,CAAC,KAAK,cAAe;AAClE,WAAO,aAAa,KAAK,EAAE,OAAO,eAAe,GAAG,EAAE,QAAQ,IAAI,CAAC;AAAA,EACrE;AACA,QAAM,eAAe,MAAM,oBAAoB,GAAG;AAClD,MAAI,CAAC,cAAc;AACjB,WAAO,aAAa,KAAK,EAAE,OAAO,4BAA4B,GAAG,EAAE,QAAQ,IAAI,CAAC;AAAA,EAClF;AACA,QAAM,EAAE,QAAQ,IAAI,MAAM,uBAAuB;AACjD,QAAM,KAAK,QAAQ,IAAI;AACvB,MAAI,cAAkC;AACtC,MAAI;AACF,kBAAc,QAAQ,aAAa;AAAA,EACrC,QAAQ;AACN,kBAAc;AAAA,EAChB;AACA,QAAM,aAAsC;AAAA,IAC1C,IAAI;AAAA,IACJ,UAAU,KAAK;AAAA,EACjB;AACA,MAAI,KAAK,OAAO;AACd,eAAW,iBAAiB,KAAK;AAAA,EACnC;AACA,QAAM,SAAS,MAAM,GAAG,QAAQ,YAAY,UAAU;AACtD,MAAI,CAAC,QAAQ;AACX,WAAO,aAAa,KAAK,EAAE,OAAO,uBAAuB,GAAG,EAAE,QAAQ,IAAI,CAAC;AAAA,EAC7E;AACA,QAAMA,YAAW,uBAAuB,OAAO,eAAe;AAC9D,QAAM,YAAY,OAAO,gBACrB,MAAM,GAAG,QAAQ,qBAAqB,EAAE,MAAM,OAAO,cAAc,CAAC,IACpE;AACJ,QAAM,oBAAoB,MAAM,sBAAsB;AAAA,IACpD;AAAA,IACA,UAAU,EAAE,YAAY;AAAA,IACxB,WAAW,CAAC,OAAO,EAAE;AAAA,IACrB,kBAAkB,EAAE,CAAC,OAAO,EAAE,GAAG,OAAO,YAAY,KAAK,YAAY,KAAK;AAAA,IAC1E,wBAAwB,EAAE,CAAC,OAAO,EAAE,GAAG,OAAO,kBAAkB,KAAK,SAAS,KAAK;AAAA,IACnF,iBAAiB,CAAC,KAAK,YAAY,IAAI,EAAE,OAAO,CAAC,UAA2B,CAAC,CAAC,KAAK;AAAA,EACrF,CAAC;AACD,QAAM,eAAe,6BAA6B,kBAAkB,OAAO,EAAE,CAAC;AAC9E,QAAM,cAAcA,UAAS,eAAe,CAAC;AAC7C,QAAM,cAAc,MAAM,6BAA6B,aAAa;AAAA,IAClE;AAAA,IACA,UAAU,KAAK;AAAA,IACf,gBAAgB,KAAK;AAAA,EACvB,CAAC;AACD,QAAM,sBAAsB,2BAA2B,aAAa,WAAW;AAC/E,SAAO,aAAa,KAAK;AAAA,IACvB,MAAM;AAAA,MACJ,IAAI,OAAO;AAAA,MACX,UAAU,OAAO;AAAA,MACjB,UAAU,OAAO;AAAA,MACjB,UAAU,OAAO;AAAA,MACjB,eAAe,OAAO;AAAA,MACtB,gBAAgB,WAAW,SAAS;AAAA,MACpC,MAAMA,UAAS,QAAQ,CAAC;AAAA,MACxB,aAAa;AAAA,MACb,SAAS,OAAO,WAAW,OAAO,QAAQ,KAAK,IAAI,OAAO,UAAU;AAAA,MACpE;AAAA,IACF;AAAA,EACF,CAAC;AACH;AAEA,eAAsB,MAAM,KAAkB,KAAmB;AAC/D,QAAM,OAAO,MAAM,mBAAmB,GAAG;AACzC,MAAI,CAAC,QAAQ,CAAC,KAAK,YAAY,CAAC,KAAK,OAAO;AAC1C,WAAO,aAAa,KAAK,EAAE,OAAO,eAAe,GAAG,EAAE,QAAQ,IAAI,CAAC;AAAA,EACrE;AACA,QAAM,eAAe,MAAM,oBAAoB,GAAG;AAClD,MAAI,CAAC,cAAc;AACjB,WAAO,aAAa,KAAK,EAAE,OAAO,4BAA4B,GAAG,EAAE,QAAQ,IAAI,CAAC;AAAA,EAClF;AACA,QAAM,UAAU,MAAM,IAAI,KAAK,EAAE,MAAM,MAAM,IAAI;AACjD,QAAM,EAAE,MAAM,OAAO,IAAI,wBAAwB,OAAO;AACxD,QAAM,SAAS,aAAa,UAAU,IAAI;AAC1C,MAAI,CAAC,OAAO,SAAS;AACnB,WAAO,aAAa,KAAK,EAAE,OAAO,kBAAkB,GAAG,EAAE,QAAQ,IAAI,CAAC;AAAA,EACxE;AACA,QAAM,EAAE,QAAQ,IAAI,MAAM,uBAAuB;AACjD,QAAM,KAAK,QAAQ,IAAI;AACvB,MAAI,cAAkC;AACtC,MAAI;AACF,kBAAc,QAAQ,aAAa;AAAA,EACrC,QAAQ;AACN,kBAAc;AAAA,EAChB;AACA,QAAM,aAAa,QAAQ,YAAY;AACvC,QAAM,cAAuC;AAAA,IAC3C,IAAI;AAAA,IACJ,UAAU,KAAK;AAAA,IACf,gBAAgB,KAAK;AAAA,EACvB;AACA,QAAM,SAAS,MAAM,GAAG,QAAQ,YAAY,WAAW;AACvD,MAAI,CAAC,QAAQ;AACX,WAAO,aAAa,KAAK,EAAE,OAAO,uBAAuB,GAAG,EAAE,QAAQ,IAAI,CAAC;AAAA,EAC7E;AACA,QAAM,QAAiC,CAAC;AACxC,MAAI,OAAO,KAAK,KAAM,OAAM,OAAO,wBAAwB,OAAO,KAAK,IAAI;AAC3E,MAAI,OAAO,KAAK,YAAa,OAAM,cAAc,+BAA+B,OAAO,KAAK,WAAW;AACvG,SAAO,kBAAkB,wBAAwB,OAAO,iBAAiB,KAAK;AAC9E,QAAM,GAAG,MAAM;AAEf,MAAI,cAAc,UAAU,OAAO,KAAK,MAAM,EAAE,QAAQ;AACtD,QAAI;AACF,YAAM,qBAAqB;AAAA,QACzB;AAAA,QACA,UAAU,EAAE,YAAY;AAAA,QACxB,UAAU,OAAO;AAAA,QACjB,UAAU,OAAO,YAAY,KAAK,YAAY;AAAA,QAC9C,gBAAgB,OAAO,kBAAkB,KAAK,SAAS;AAAA,QACvD,QAAQ;AAAA,MACV,CAAC;AAAA,IACH,SAAS,OAAO;AACd,cAAQ,MAAM,qDAAqD,KAAK;AACxE,aAAO,aAAa,KAAK,EAAE,OAAO,wCAAwC,GAAG,EAAE,QAAQ,IAAI,CAAC;AAAA,IAC9F;AAAA,EACF;AAEA,MAAI,YAAY;AACd,UAAM,oBAAoB;AAAA,MACxB;AAAA,MACA,QAAQ;AAAA,MACR,QAAQ;AAAA,MACR,aAAa;AAAA,QACX,IAAI,OAAO;AAAA,QACX,gBAAgB,OAAO,kBAAkB,KAAK,SAAS;AAAA,QACvD,UAAU,OAAO,YAAY,KAAK,YAAY;AAAA,MAChD;AAAA,MACA,QAAQ;AAAA,MACR,SAAS;AAAA,IACX,CAAC;AACD,UAAM,WAAW,sBAAsB;AAAA,EACzC;AAEA,QAAMA,YAAW,uBAAuB,OAAO,eAAe;AAC9D,QAAM,cAAcA,UAAS,eAAe,CAAC;AAC7C,QAAM,cAAc,MAAM,6BAA6B,aAAa;AAAA,IAClE;AAAA,IACA,UAAU,KAAK;AAAA,IACf,gBAAgB,KAAK;AAAA,EACvB,CAAC;AACD,QAAM,sBAAsB,2BAA2B,aAAa,WAAW;AAC/E,SAAO,aAAa,KAAK;AAAA,IACvB,IAAI;AAAA,IACJ,MAAM;AAAA,MACJ,IAAI,OAAO;AAAA,MACX,MAAMA,UAAS,QAAQ,CAAC;AAAA,MACxB,aAAa;AAAA,MACb,cAAc,6BAA6B,UAAU,IAAI;AAAA,IAC3D;AAAA,EACF,CAAC;AACH;AAEA,eAAsB,OAAO,KAAkB,KAAmB;AAChE,QAAM,OAAO,MAAM,mBAAmB,GAAG;AACzC,MAAI,CAAC,QAAQ,CAAC,KAAK,YAAY,CAAC,KAAK,OAAO;AAC1C,WAAO,aAAa,KAAK,EAAE,OAAO,eAAe,GAAG,EAAE,QAAQ,IAAI,CAAC;AAAA,EACrE;AACA,QAAM,eAAe,MAAM,oBAAoB,GAAG;AAClD,MAAI,CAAC,cAAc;AACjB,WAAO,aAAa,KAAK,EAAE,OAAO,4BAA4B,GAAG,EAAE,QAAQ,IAAI,CAAC;AAAA,EAClF;AACA,QAAM,EAAE,QAAQ,IAAI,MAAM,uBAAuB;AACjD,QAAM,KAAK,QAAQ,IAAI;AACvB,QAAM,aAAa,QAAQ,YAAY;AACvC,QAAM,eAAwC;AAAA,IAC5C,IAAI;AAAA,IACJ,UAAU,KAAK;AAAA,IACf,gBAAgB,KAAK;AAAA,EACvB;AACA,QAAM,SAAS,MAAM,GAAG,QAAQ,YAAY,YAAY;AACxD,MAAI,CAAC,QAAQ;AACX,WAAO,aAAa,KAAK,EAAE,OAAO,uBAAuB,GAAG,EAAE,QAAQ,IAAI,CAAC;AAAA,EAC7E;AAEA,QAAM,oBAAoB,OAAO,eAAe,OAAO,aAAa,OAAO,aAAa;AACxF,QAAM,GAAG,OAAO,MAAM,EAAE,MAAM;AAE9B,MAAI,YAAY;AACd,UAAM,oBAAoB;AAAA,MACxB;AAAA,MACA,QAAQ;AAAA,MACR,QAAQ;AAAA,MACR,aAAa;AAAA,QACX,IAAI,OAAO;AAAA,QACX,gBAAgB,OAAO,kBAAkB,KAAK,SAAS;AAAA,QACvD,UAAU,OAAO,YAAY,KAAK,YAAY;AAAA,MAChD;AAAA,MACA,QAAQ;AAAA,MACR,SAAS;AAAA,IACX,CAAC;AACD,UAAM,WAAW,sBAAsB;AAAA,EACzC;AAEA,SAAO,aAAa,KAAK,EAAE,IAAI,KAAK,CAAC;AACvC;AAEO,MAAM,UAA2B;AAAA,EACtC,KAAK;AAAA,EACL,SAAS;AAAA,EACT,SAAS;AAAA,IACP,KAAK;AAAA,MACH,SAAS;AAAA,MACT,aAAa;AAAA,MACb,WAAW;AAAA,QACT,EAAE,QAAQ,KAAK,aAAa,sBAAsB,QAAQ,+BAA+B;AAAA,MAC3F;AAAA,MACA,QAAQ;AAAA,QACN,EAAE,QAAQ,KAAK,aAAa,yBAAyB,QAAQ,sBAAsB;AAAA,QACnF,EAAE,QAAQ,KAAK,aAAa,gBAAgB,QAAQ,sBAAsB;AAAA,QAC1E,EAAE,QAAQ,KAAK,aAAa,wBAAwB,QAAQ,sBAAsB;AAAA,MACpF;AAAA,IACF;AAAA,IACA,OAAO;AAAA,MACL,SAAS;AAAA,MACT,aAAa;AAAA,MACb,aAAa;AAAA,QACX,aAAa;AAAA,QACb,QAAQ;AAAA,MACV;AAAA,MACA,WAAW;AAAA,QACT,EAAE,QAAQ,KAAK,aAAa,mCAAmC,QAAQ,EAAE,OAAO,EAAE,IAAI,EAAE,QAAQ,IAAI,GAAG,MAAM,EAAE,IAAI,EAAE,CAAC,EAAE;AAAA,MAC1H;AAAA,MACA,QAAQ;AAAA,QACN,EAAE,QAAQ,KAAK,aAAa,oCAAoC,QAAQ,sBAAsB;AAAA,QAC9F,EAAE,QAAQ,KAAK,aAAa,gBAAgB,QAAQ,sBAAsB;AAAA,QAC1E,EAAE,QAAQ,KAAK,aAAa,wBAAwB,QAAQ,sBAAsB;AAAA,QAClF,EAAE,QAAQ,KAAK,aAAa,6BAA6B,QAAQ,sBAAsB;AAAA,MACzF;AAAA,IACF;AAAA,IACA,QAAQ;AAAA,MACN,SAAS;AAAA,MACT,aAAa;AAAA,MACb,WAAW;AAAA,QACT,EAAE,QAAQ,KAAK,aAAa,mCAAmC,QAAQ,EAAE,OAAO,EAAE,IAAI,EAAE,QAAQ,IAAI,EAAE,CAAC,EAAE;AAAA,MAC3G;AAAA,MACA,QAAQ;AAAA,QACN,EAAE,QAAQ,KAAK,aAAa,yBAAyB,QAAQ,sBAAsB;AAAA,QACnF,EAAE,QAAQ,KAAK,aAAa,gBAAgB,QAAQ,sBAAsB;AAAA,QAC1E,EAAE,QAAQ,KAAK,aAAa,wBAAwB,QAAQ,sBAAsB;AAAA,MACpF;AAAA,IACF;AAAA,EACF;AACF;",
+  "sourcesContent": ["import { NextRequest, NextResponse } from 'next/server'\nimport { z } from 'zod'\nimport type { OpenApiRouteDoc } from '@open-mercato/shared/lib/openapi'\nimport { getAuthFromRequest } from '@open-mercato/shared/lib/auth/server'\nimport { createRequestContainer } from '@open-mercato/shared/lib/di/container'\nimport type { EntityManager } from '@mikro-orm/postgresql'\nimport { Attachment, AttachmentPartition } from '../../../data/entities'\nimport {\n  mergeAttachmentMetadata,\n  normalizeAttachmentAssignments,\n  normalizeAttachmentTags,\n  readAttachmentMetadata,\n} from '../../../lib/metadata'\nimport type { StorageDriverFactory } from '../../../lib/drivers'\nimport { splitCustomFieldPayload, loadCustomFieldValues } from '@open-mercato/shared/lib/crud/custom-fields'\nimport { emitCrudSideEffects, setCustomFieldsIfAny } from '@open-mercato/shared/lib/commands/helpers'\nimport { normalizeCustomFieldResponse } from '@open-mercato/shared/lib/custom-fields/normalize'\nimport { E } from '#generated/entities.ids.generated'\nimport type { QueryEngine } from '@open-mercato/shared/lib/query/types'\nimport type { DataEngine } from '@open-mercato/shared/lib/data/engine'\nimport { attachmentCrudEvents, attachmentCrudIndexer } from '../../../lib/crud'\nimport { applyAssignmentEnrichments, resolveAssignmentEnrichments } from '../../../lib/assignmentDetails'\nimport {\n  attachmentsTag,\n  attachmentDetailResponseSchema,\n  attachmentErrorSchema,\n} from '../../openapi'\n\nconst updateSchema = z.object({\n  tags: z.array(z.string()).optional(),\n  assignments: z\n    .array(\n      z.object({\n        type: z.string().min(1),\n        id: z.string().min(1),\n        href: z.string().nullable().optional(),\n        label: z.string().nullable().optional(),\n      }),\n    )\n    .optional(),\n})\n\nexport const metadata = {\n  GET: { requireAuth: true, requireFeatures: ['attachments.view'] },\n  PATCH: { requireAuth: true, requireFeatures: ['attachments.manage'] },\n  DELETE: { requireAuth: true, requireFeatures: ['attachments.manage'] },\n}\n\ntype RouteParams = { id: string }\ntype RouteContext = { params: Promise<RouteParams> }\n\nasync function resolveAttachmentId(ctx: RouteContext): Promise<string | null> {\n  const params = ctx?.params\n  try {\n    const { id } = await params\n    if (typeof id === 'string' && id.trim().length) {\n      return id\n    }\n    return null\n  } catch {\n    return null\n  }\n}\n\nexport async function GET(req: NextRequest, ctx: RouteContext) {\n  const auth = await getAuthFromRequest(req)\n  if (!auth || !auth.tenantId || (!auth.orgId && !auth.isSuperAdmin)) {\n    return NextResponse.json({ error: 'Unauthorized' }, { status: 401 })\n  }\n  const attachmentId = await resolveAttachmentId(ctx)\n  if (!attachmentId) {\n    return NextResponse.json({ error: 'Attachment id is required' }, { status: 400 })\n  }\n  const { resolve } = await createRequestContainer()\n  const em = resolve('em') as EntityManager\n  let queryEngine: QueryEngine | null = null\n  try {\n    queryEngine = resolve('queryEngine') as QueryEngine\n  } catch {\n    queryEngine = null\n  }\n  const findFilter: Record<string, unknown> = {\n    id: attachmentId,\n    tenantId: auth.tenantId,\n  }\n  if (auth.orgId) {\n    findFilter.organizationId = auth.orgId\n  }\n  const record = await em.findOne(Attachment, findFilter)\n  if (!record) {\n    return NextResponse.json({ error: 'Attachment not found' }, { status: 404 })\n  }\n  const metadata = readAttachmentMetadata(record.storageMetadata)\n  const partition = record.partitionCode\n    ? await em.findOne(AttachmentPartition, { code: record.partitionCode })\n    : null\n  const customFieldValues = await loadCustomFieldValues({\n    em,\n    entityId: E.attachments.attachment,\n    recordIds: [record.id],\n    tenantIdByRecord: { [record.id]: record.tenantId ?? auth.tenantId ?? null },\n    organizationIdByRecord: { [record.id]: record.organizationId ?? auth.orgId ?? null },\n    tenantFallbacks: [auth.tenantId ?? null].filter((value): value is string => !!value),\n  })\n  const customFields = normalizeCustomFieldResponse(customFieldValues[record.id])\n  const assignments = metadata.assignments ?? []\n  const enrichments = await resolveAssignmentEnrichments(assignments, {\n    queryEngine,\n    tenantId: auth.tenantId,\n    organizationId: auth.orgId,\n  })\n  const enrichedAssignments = applyAssignmentEnrichments(assignments, enrichments)\n  return NextResponse.json({\n    item: {\n      id: record.id,\n      fileName: record.fileName,\n      fileSize: record.fileSize,\n      mimeType: record.mimeType,\n      partitionCode: record.partitionCode,\n      partitionTitle: partition?.title ?? null,\n      tags: metadata.tags ?? [],\n      assignments: enrichedAssignments,\n      content: record.content && record.content.trim() ? record.content : null,\n      customFields,\n    },\n  })\n}\n\nexport async function PATCH(req: NextRequest, ctx: RouteContext) {\n  const auth = await getAuthFromRequest(req)\n  if (!auth || !auth.tenantId || !auth.orgId) {\n    return NextResponse.json({ error: 'Unauthorized' }, { status: 401 })\n  }\n  const attachmentId = await resolveAttachmentId(ctx)\n  if (!attachmentId) {\n    return NextResponse.json({ error: 'Attachment id is required' }, { status: 400 })\n  }\n  const rawBody = await req.json().catch(() => null)\n  const { base, custom } = splitCustomFieldPayload(rawBody)\n  const parsed = updateSchema.safeParse(base)\n  if (!parsed.success) {\n    return NextResponse.json({ error: 'Invalid payload' }, { status: 400 })\n  }\n  const { resolve } = await createRequestContainer()\n  const em = resolve('em') as EntityManager\n  let queryEngine: QueryEngine | null = null\n  try {\n    queryEngine = resolve('queryEngine') as QueryEngine\n  } catch {\n    queryEngine = null\n  }\n  const dataEngine = resolve('dataEngine') as DataEngine\n  const patchFilter: Record<string, unknown> = {\n    id: attachmentId,\n    tenantId: auth.tenantId,\n    organizationId: auth.orgId,\n  }\n  const record = await em.findOne(Attachment, patchFilter)\n  if (!record) {\n    return NextResponse.json({ error: 'Attachment not found' }, { status: 404 })\n  }\n  const patch: Record<string, unknown> = {}\n  if (parsed.data.tags) patch.tags = normalizeAttachmentTags(parsed.data.tags)\n  if (parsed.data.assignments) patch.assignments = normalizeAttachmentAssignments(parsed.data.assignments)\n  record.storageMetadata = mergeAttachmentMetadata(record.storageMetadata, patch)\n  await em.flush()\n\n  if (dataEngine && custom && Object.keys(custom).length) {\n    try {\n      await setCustomFieldsIfAny({\n        dataEngine,\n        entityId: E.attachments.attachment,\n        recordId: record.id,\n        tenantId: record.tenantId ?? auth.tenantId ?? null,\n        organizationId: record.organizationId ?? auth.orgId ?? null,\n        values: custom,\n      })\n    } catch (error) {\n      console.error('[attachments] failed to persist custom attributes', error)\n      return NextResponse.json({ error: 'Failed to save attachment attributes.' }, { status: 500 })\n    }\n  }\n\n  if (dataEngine) {\n    await emitCrudSideEffects({\n      dataEngine,\n      action: 'updated',\n      entity: record,\n      identifiers: {\n        id: record.id,\n        organizationId: record.organizationId ?? auth.orgId ?? null,\n        tenantId: record.tenantId ?? auth.tenantId ?? null,\n      },\n      events: attachmentCrudEvents,\n      indexer: attachmentCrudIndexer,\n    })\n    await dataEngine.flushOrmEntityChanges()\n  }\n\n  const metadata = readAttachmentMetadata(record.storageMetadata)\n  const assignments = metadata.assignments ?? []\n  const enrichments = await resolveAssignmentEnrichments(assignments, {\n    queryEngine,\n    tenantId: auth.tenantId,\n    organizationId: auth.orgId,\n  })\n  const enrichedAssignments = applyAssignmentEnrichments(assignments, enrichments)\n  return NextResponse.json({\n    ok: true,\n    item: {\n      id: record.id,\n      tags: metadata.tags ?? [],\n      assignments: enrichedAssignments,\n      customFields: normalizeCustomFieldResponse(custom ?? null),\n    },\n  })\n}\n\nexport async function DELETE(req: NextRequest, ctx: RouteContext) {\n  const auth = await getAuthFromRequest(req)\n  if (!auth || !auth.tenantId || !auth.orgId) {\n    return NextResponse.json({ error: 'Unauthorized' }, { status: 401 })\n  }\n  const attachmentId = await resolveAttachmentId(ctx)\n  if (!attachmentId) {\n    return NextResponse.json({ error: 'Attachment id is required' }, { status: 400 })\n  }\n  const { resolve } = await createRequestContainer()\n  const em = resolve('em') as EntityManager\n  const dataEngine = resolve('dataEngine') as DataEngine\n  const storageDriverFactory = resolve('storageDriverFactory') as StorageDriverFactory\n  const deleteFilter: Record<string, unknown> = {\n    id: attachmentId,\n    tenantId: auth.tenantId,\n    organizationId: auth.orgId,\n  }\n  const record = await em.findOne(Attachment, deleteFilter)\n  if (!record) {\n    return NextResponse.json({ error: 'Attachment not found' }, { status: 404 })\n  }\n  const deleteDriver = await storageDriverFactory.resolveForPartition(record.partitionCode, {\n    tenantId: record.tenantId ?? auth.tenantId,\n    organizationId: record.organizationId ?? auth.orgId,\n  })\n  await deleteDriver.delete(record.partitionCode, record.storagePath)\n  await em.remove(record).flush()\n\n  if (dataEngine) {\n    await emitCrudSideEffects({\n      dataEngine,\n      action: 'deleted',\n      entity: record,\n      identifiers: {\n        id: record.id,\n        organizationId: record.organizationId ?? auth.orgId ?? null,\n        tenantId: record.tenantId ?? auth.tenantId ?? null,\n      },\n      events: attachmentCrudEvents,\n      indexer: attachmentCrudIndexer,\n    })\n    await dataEngine.flushOrmEntityChanges()\n  }\n\n  return NextResponse.json({ ok: true })\n}\n\nexport const openApi: OpenApiRouteDoc = {\n  tag: attachmentsTag,\n  summary: 'Attachment detail management',\n  methods: {\n    GET: {\n      summary: 'Get attachment details',\n      description: 'Returns complete details of an attachment including metadata, tags, assignments, and custom fields.',\n      responses: [\n        { status: 200, description: 'Attachment details', schema: attachmentDetailResponseSchema },\n      ],\n      errors: [\n        { status: 400, description: 'Invalid attachment ID', schema: attachmentErrorSchema },\n        { status: 401, description: 'Unauthorized', schema: attachmentErrorSchema },\n        { status: 404, description: 'Attachment not found', schema: attachmentErrorSchema },\n      ],\n    },\n    PATCH: {\n      summary: 'Update attachment metadata',\n      description: 'Updates attachment tags, assignments, and custom fields. Emits CRUD side effects for indexing and events.',\n      requestBody: {\n        contentType: 'application/json',\n        schema: updateSchema,\n      },\n      responses: [\n        { status: 200, description: 'Attachment updated successfully', schema: z.object({ ok: z.literal(true), item: z.any() }) },\n      ],\n      errors: [\n        { status: 400, description: 'Invalid payload or attachment ID', schema: attachmentErrorSchema },\n        { status: 401, description: 'Unauthorized', schema: attachmentErrorSchema },\n        { status: 404, description: 'Attachment not found', schema: attachmentErrorSchema },\n        { status: 500, description: 'Failed to save attributes', schema: attachmentErrorSchema },\n      ],\n    },\n    DELETE: {\n      summary: 'Delete attachment',\n      description: 'Permanently deletes an attachment file from storage and database. Emits CRUD side effects.',\n      responses: [\n        { status: 200, description: 'Attachment deleted successfully', schema: z.object({ ok: z.literal(true) }) },\n      ],\n      errors: [\n        { status: 400, description: 'Invalid attachment ID', schema: attachmentErrorSchema },\n        { status: 401, description: 'Unauthorized', schema: attachmentErrorSchema },\n        { status: 404, description: 'Attachment not found', schema: attachmentErrorSchema },\n      ],\n    },\n  },\n}\n"],
+  "mappings": "AAAA,SAAsB,oBAAoB;AAC1C,SAAS,SAAS;AAElB,SAAS,0BAA0B;AACnC,SAAS,8BAA8B;AAEvC,SAAS,YAAY,2BAA2B;AAChD;AAAA,EACE;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,OACK;AAEP,SAAS,yBAAyB,6BAA6B;AAC/D,SAAS,qBAAqB,4BAA4B;AAC1D,SAAS,oCAAoC;AAC7C,SAAS,SAAS;AAGlB,SAAS,sBAAsB,6BAA6B;AAC5D,SAAS,4BAA4B,oCAAoC;AACzE;AAAA,EACE;AAAA,EACA;AAAA,EACA;AAAA,OACK;AAEP,MAAM,eAAe,EAAE,OAAO;AAAA,EAC5B,MAAM,EAAE,MAAM,EAAE,OAAO,CAAC,EAAE,SAAS;AAAA,EACnC,aAAa,EACV;AAAA,IACC,EAAE,OAAO;AAAA,MACP,MAAM,EAAE,OAAO,EAAE,IAAI,CAAC;AAAA,MACtB,IAAI,EAAE,OAAO,EAAE,IAAI,CAAC;AAAA,MACpB,MAAM,EAAE,OAAO,EAAE,SAAS,EAAE,SAAS;AAAA,MACrC,OAAO,EAAE,OAAO,EAAE,SAAS,EAAE,SAAS;AAAA,IACxC,CAAC;AAAA,EACH,EACC,SAAS;AACd,CAAC;AAEM,MAAM,WAAW;AAAA,EACtB,KAAK,EAAE,aAAa,MAAM,iBAAiB,CAAC,kBAAkB,EAAE;AAAA,EAChE,OAAO,EAAE,aAAa,MAAM,iBAAiB,CAAC,oBAAoB,EAAE;AAAA,EACpE,QAAQ,EAAE,aAAa,MAAM,iBAAiB,CAAC,oBAAoB,EAAE;AACvE;AAKA,eAAe,oBAAoB,KAA2C;AAC5E,QAAM,SAAS,KAAK;AACpB,MAAI;AACF,UAAM,EAAE,GAAG,IAAI,MAAM;AACrB,QAAI,OAAO,OAAO,YAAY,GAAG,KAAK,EAAE,QAAQ;AAC9C,aAAO;AAAA,IACT;AACA,WAAO;AAAA,EACT,QAAQ;AACN,WAAO;AAAA,EACT;AACF;AAEA,eAAsB,IAAI,KAAkB,KAAmB;AAC7D,QAAM,OAAO,MAAM,mBAAmB,GAAG;AACzC,MAAI,CAAC,QAAQ,CAAC,KAAK,YAAa,CAAC,KAAK,SAAS,CAAC,KAAK,cAAe;AAClE,WAAO,aAAa,KAAK,EAAE,OAAO,eAAe,GAAG,EAAE,QAAQ,IAAI,CAAC;AAAA,EACrE;AACA,QAAM,eAAe,MAAM,oBAAoB,GAAG;AAClD,MAAI,CAAC,cAAc;AACjB,WAAO,aAAa,KAAK,EAAE,OAAO,4BAA4B,GAAG,EAAE,QAAQ,IAAI,CAAC;AAAA,EAClF;AACA,QAAM,EAAE,QAAQ,IAAI,MAAM,uBAAuB;AACjD,QAAM,KAAK,QAAQ,IAAI;AACvB,MAAI,cAAkC;AACtC,MAAI;AACF,kBAAc,QAAQ,aAAa;AAAA,EACrC,QAAQ;AACN,kBAAc;AAAA,EAChB;AACA,QAAM,aAAsC;AAAA,IAC1C,IAAI;AAAA,IACJ,UAAU,KAAK;AAAA,EACjB;AACA,MAAI,KAAK,OAAO;AACd,eAAW,iBAAiB,KAAK;AAAA,EACnC;AACA,QAAM,SAAS,MAAM,GAAG,QAAQ,YAAY,UAAU;AACtD,MAAI,CAAC,QAAQ;AACX,WAAO,aAAa,KAAK,EAAE,OAAO,uBAAuB,GAAG,EAAE,QAAQ,IAAI,CAAC;AAAA,EAC7E;AACA,QAAMA,YAAW,uBAAuB,OAAO,eAAe;AAC9D,QAAM,YAAY,OAAO,gBACrB,MAAM,GAAG,QAAQ,qBAAqB,EAAE,MAAM,OAAO,cAAc,CAAC,IACpE;AACJ,QAAM,oBAAoB,MAAM,sBAAsB;AAAA,IACpD;AAAA,IACA,UAAU,EAAE,YAAY;AAAA,IACxB,WAAW,CAAC,OAAO,EAAE;AAAA,IACrB,kBAAkB,EAAE,CAAC,OAAO,EAAE,GAAG,OAAO,YAAY,KAAK,YAAY,KAAK;AAAA,IAC1E,wBAAwB,EAAE,CAAC,OAAO,EAAE,GAAG,OAAO,kBAAkB,KAAK,SAAS,KAAK;AAAA,IACnF,iBAAiB,CAAC,KAAK,YAAY,IAAI,EAAE,OAAO,CAAC,UAA2B,CAAC,CAAC,KAAK;AAAA,EACrF,CAAC;AACD,QAAM,eAAe,6BAA6B,kBAAkB,OAAO,EAAE,CAAC;AAC9E,QAAM,cAAcA,UAAS,eAAe,CAAC;AAC7C,QAAM,cAAc,MAAM,6BAA6B,aAAa;AAAA,IAClE;AAAA,IACA,UAAU,KAAK;AAAA,IACf,gBAAgB,KAAK;AAAA,EACvB,CAAC;AACD,QAAM,sBAAsB,2BAA2B,aAAa,WAAW;AAC/E,SAAO,aAAa,KAAK;AAAA,IACvB,MAAM;AAAA,MACJ,IAAI,OAAO;AAAA,MACX,UAAU,OAAO;AAAA,MACjB,UAAU,OAAO;AAAA,MACjB,UAAU,OAAO;AAAA,MACjB,eAAe,OAAO;AAAA,MACtB,gBAAgB,WAAW,SAAS;AAAA,MACpC,MAAMA,UAAS,QAAQ,CAAC;AAAA,MACxB,aAAa;AAAA,MACb,SAAS,OAAO,WAAW,OAAO,QAAQ,KAAK,IAAI,OAAO,UAAU;AAAA,MACpE;AAAA,IACF;AAAA,EACF,CAAC;AACH;AAEA,eAAsB,MAAM,KAAkB,KAAmB;AAC/D,QAAM,OAAO,MAAM,mBAAmB,GAAG;AACzC,MAAI,CAAC,QAAQ,CAAC,KAAK,YAAY,CAAC,KAAK,OAAO;AAC1C,WAAO,aAAa,KAAK,EAAE,OAAO,eAAe,GAAG,EAAE,QAAQ,IAAI,CAAC;AAAA,EACrE;AACA,QAAM,eAAe,MAAM,oBAAoB,GAAG;AAClD,MAAI,CAAC,cAAc;AACjB,WAAO,aAAa,KAAK,EAAE,OAAO,4BAA4B,GAAG,EAAE,QAAQ,IAAI,CAAC;AAAA,EAClF;AACA,QAAM,UAAU,MAAM,IAAI,KAAK,EAAE,MAAM,MAAM,IAAI;AACjD,QAAM,EAAE,MAAM,OAAO,IAAI,wBAAwB,OAAO;AACxD,QAAM,SAAS,aAAa,UAAU,IAAI;AAC1C,MAAI,CAAC,OAAO,SAAS;AACnB,WAAO,aAAa,KAAK,EAAE,OAAO,kBAAkB,GAAG,EAAE,QAAQ,IAAI,CAAC;AAAA,EACxE;AACA,QAAM,EAAE,QAAQ,IAAI,MAAM,uBAAuB;AACjD,QAAM,KAAK,QAAQ,IAAI;AACvB,MAAI,cAAkC;AACtC,MAAI;AACF,kBAAc,QAAQ,aAAa;AAAA,EACrC,QAAQ;AACN,kBAAc;AAAA,EAChB;AACA,QAAM,aAAa,QAAQ,YAAY;AACvC,QAAM,cAAuC;AAAA,IAC3C,IAAI;AAAA,IACJ,UAAU,KAAK;AAAA,IACf,gBAAgB,KAAK;AAAA,EACvB;AACA,QAAM,SAAS,MAAM,GAAG,QAAQ,YAAY,WAAW;AACvD,MAAI,CAAC,QAAQ;AACX,WAAO,aAAa,KAAK,EAAE,OAAO,uBAAuB,GAAG,EAAE,QAAQ,IAAI,CAAC;AAAA,EAC7E;AACA,QAAM,QAAiC,CAAC;AACxC,MAAI,OAAO,KAAK,KAAM,OAAM,OAAO,wBAAwB,OAAO,KAAK,IAAI;AAC3E,MAAI,OAAO,KAAK,YAAa,OAAM,cAAc,+BAA+B,OAAO,KAAK,WAAW;AACvG,SAAO,kBAAkB,wBAAwB,OAAO,iBAAiB,KAAK;AAC9E,QAAM,GAAG,MAAM;AAEf,MAAI,cAAc,UAAU,OAAO,KAAK,MAAM,EAAE,QAAQ;AACtD,QAAI;AACF,YAAM,qBAAqB;AAAA,QACzB;AAAA,QACA,UAAU,EAAE,YAAY;AAAA,QACxB,UAAU,OAAO;AAAA,QACjB,UAAU,OAAO,YAAY,KAAK,YAAY;AAAA,QAC9C,gBAAgB,OAAO,kBAAkB,KAAK,SAAS;AAAA,QACvD,QAAQ;AAAA,MACV,CAAC;AAAA,IACH,SAAS,OAAO;AACd,cAAQ,MAAM,qDAAqD,KAAK;AACxE,aAAO,aAAa,KAAK,EAAE,OAAO,wCAAwC,GAAG,EAAE,QAAQ,IAAI,CAAC;AAAA,IAC9F;AAAA,EACF;AAEA,MAAI,YAAY;AACd,UAAM,oBAAoB;AAAA,MACxB;AAAA,MACA,QAAQ;AAAA,MACR,QAAQ;AAAA,MACR,aAAa;AAAA,QACX,IAAI,OAAO;AAAA,QACX,gBAAgB,OAAO,kBAAkB,KAAK,SAAS;AAAA,QACvD,UAAU,OAAO,YAAY,KAAK,YAAY;AAAA,MAChD;AAAA,MACA,QAAQ;AAAA,MACR,SAAS;AAAA,IACX,CAAC;AACD,UAAM,WAAW,sBAAsB;AAAA,EACzC;AAEA,QAAMA,YAAW,uBAAuB,OAAO,eAAe;AAC9D,QAAM,cAAcA,UAAS,eAAe,CAAC;AAC7C,QAAM,cAAc,MAAM,6BAA6B,aAAa;AAAA,IAClE;AAAA,IACA,UAAU,KAAK;AAAA,IACf,gBAAgB,KAAK;AAAA,EACvB,CAAC;AACD,QAAM,sBAAsB,2BAA2B,aAAa,WAAW;AAC/E,SAAO,aAAa,KAAK;AAAA,IACvB,IAAI;AAAA,IACJ,MAAM;AAAA,MACJ,IAAI,OAAO;AAAA,MACX,MAAMA,UAAS,QAAQ,CAAC;AAAA,MACxB,aAAa;AAAA,MACb,cAAc,6BAA6B,UAAU,IAAI;AAAA,IAC3D;AAAA,EACF,CAAC;AACH;AAEA,eAAsB,OAAO,KAAkB,KAAmB;AAChE,QAAM,OAAO,MAAM,mBAAmB,GAAG;AACzC,MAAI,CAAC,QAAQ,CAAC,KAAK,YAAY,CAAC,KAAK,OAAO;AAC1C,WAAO,aAAa,KAAK,EAAE,OAAO,eAAe,GAAG,EAAE,QAAQ,IAAI,CAAC;AAAA,EACrE;AACA,QAAM,eAAe,MAAM,oBAAoB,GAAG;AAClD,MAAI,CAAC,cAAc;AACjB,WAAO,aAAa,KAAK,EAAE,OAAO,4BAA4B,GAAG,EAAE,QAAQ,IAAI,CAAC;AAAA,EAClF;AACA,QAAM,EAAE,QAAQ,IAAI,MAAM,uBAAuB;AACjD,QAAM,KAAK,QAAQ,IAAI;AACvB,QAAM,aAAa,QAAQ,YAAY;AACvC,QAAM,uBAAuB,QAAQ,sBAAsB;AAC3D,QAAM,eAAwC;AAAA,IAC5C,IAAI;AAAA,IACJ,UAAU,KAAK;AAAA,IACf,gBAAgB,KAAK;AAAA,EACvB;AACA,QAAM,SAAS,MAAM,GAAG,QAAQ,YAAY,YAAY;AACxD,MAAI,CAAC,QAAQ;AACX,WAAO,aAAa,KAAK,EAAE,OAAO,uBAAuB,GAAG,EAAE,QAAQ,IAAI,CAAC;AAAA,EAC7E;AACA,QAAM,eAAe,MAAM,qBAAqB,oBAAoB,OAAO,eAAe;AAAA,IACxF,UAAU,OAAO,YAAY,KAAK;AAAA,IAClC,gBAAgB,OAAO,kBAAkB,KAAK;AAAA,EAChD,CAAC;AACD,QAAM,aAAa,OAAO,OAAO,eAAe,OAAO,WAAW;AAClE,QAAM,GAAG,OAAO,MAAM,EAAE,MAAM;AAE9B,MAAI,YAAY;AACd,UAAM,oBAAoB;AAAA,MACxB;AAAA,MACA,QAAQ;AAAA,MACR,QAAQ;AAAA,MACR,aAAa;AAAA,QACX,IAAI,OAAO;AAAA,QACX,gBAAgB,OAAO,kBAAkB,KAAK,SAAS;AAAA,QACvD,UAAU,OAAO,YAAY,KAAK,YAAY;AAAA,MAChD;AAAA,MACA,QAAQ;AAAA,MACR,SAAS;AAAA,IACX,CAAC;AACD,UAAM,WAAW,sBAAsB;AAAA,EACzC;AAEA,SAAO,aAAa,KAAK,EAAE,IAAI,KAAK,CAAC;AACvC;AAEO,MAAM,UAA2B;AAAA,EACtC,KAAK;AAAA,EACL,SAAS;AAAA,EACT,SAAS;AAAA,IACP,KAAK;AAAA,MACH,SAAS;AAAA,MACT,aAAa;AAAA,MACb,WAAW;AAAA,QACT,EAAE,QAAQ,KAAK,aAAa,sBAAsB,QAAQ,+BAA+B;AAAA,MAC3F;AAAA,MACA,QAAQ;AAAA,QACN,EAAE,QAAQ,KAAK,aAAa,yBAAyB,QAAQ,sBAAsB;AAAA,QACnF,EAAE,QAAQ,KAAK,aAAa,gBAAgB,QAAQ,sBAAsB;AAAA,QAC1E,EAAE,QAAQ,KAAK,aAAa,wBAAwB,QAAQ,sBAAsB;AAAA,MACpF;AAAA,IACF;AAAA,IACA,OAAO;AAAA,MACL,SAAS;AAAA,MACT,aAAa;AAAA,MACb,aAAa;AAAA,QACX,aAAa;AAAA,QACb,QAAQ;AAAA,MACV;AAAA,MACA,WAAW;AAAA,QACT,EAAE,QAAQ,KAAK,aAAa,mCAAmC,QAAQ,EAAE,OAAO,EAAE,IAAI,EAAE,QAAQ,IAAI,GAAG,MAAM,EAAE,IAAI,EAAE,CAAC,EAAE;AAAA,MAC1H;AAAA,MACA,QAAQ;AAAA,QACN,EAAE,QAAQ,KAAK,aAAa,oCAAoC,QAAQ,sBAAsB;AAAA,QAC9F,EAAE,QAAQ,KAAK,aAAa,gBAAgB,QAAQ,sBAAsB;AAAA,QAC1E,EAAE,QAAQ,KAAK,aAAa,wBAAwB,QAAQ,sBAAsB;AAAA,QAClF,EAAE,QAAQ,KAAK,aAAa,6BAA6B,QAAQ,sBAAsB;AAAA,MACzF;AAAA,IACF;AAAA,IACA,QAAQ;AAAA,MACN,SAAS;AAAA,MACT,aAAa;AAAA,MACb,WAAW;AAAA,QACT,EAAE,QAAQ,KAAK,aAAa,mCAAmC,QAAQ,EAAE,OAAO,EAAE,IAAI,EAAE,QAAQ,IAAI,EAAE,CAAC,EAAE;AAAA,MAC3G;AAAA,MACA,QAAQ;AAAA,QACN,EAAE,QAAQ,KAAK,aAAa,yBAAyB,QAAQ,sBAAsB;AAAA,QACnF,EAAE,QAAQ,KAAK,aAAa,gBAAgB,QAAQ,sBAAsB;AAAA,QAC1E,EAAE,QAAQ,KAAK,aAAa,wBAAwB,QAAQ,sBAAsB;AAAA,MACpF;AAAA,IACF;AAAA,EACF;AACF;",
   "names": ["metadata"]
 }

package/dist/modules/attachments/api/library/route.js

@@ -8,6 +8,7 @@ import { buildAttachmentImageUrl, slugifyAttachmentFileName } from "../../lib/im
 import { readAttachmentMetadata } from "../../lib/metadata.js";
 import { applyAssignmentEnrichments, resolveAssignmentEnrichments } from "../../lib/assignmentDetails.js";
 import { escapeLikePattern } from "@open-mercato/shared/lib/db/escapeLikePattern";
+import { ensureDefaultPartitions } from "../../lib/partitions.js";
 import {
   attachmentsTag,
   attachmentListQuerySchema as openApiListQuerySchema,
@@ -58,6 +59,7 @@ async function GET(req) {
   const offset = (page - 1) * pageSize;
   const { resolve } = await createRequestContainer();
   const em = resolve("em");
+  await ensureDefaultPartitions(em);
   let queryEngine = null;
   try {
     queryEngine = resolve("queryEngine");

package/dist/modules/attachments/api/library/route.js.map

@@ -1,7 +1,7 @@
 {
   "version": 3,
   "sources": ["../../../../../src/modules/attachments/api/library/route.ts"],
-  "sourcesContent": ["import { NextResponse } from 'next/server'\nimport { z } from 'zod'\nimport type { OpenApiRouteDoc } from '@open-mercato/shared/lib/openapi'\nimport { getAuthFromRequest } from '@open-mercato/shared/lib/auth/server'\nimport { createRequestContainer } from '@open-mercato/shared/lib/di/container'\nimport type { EntityManager } from '@mikro-orm/postgresql'\nimport { sql } from 'kysely'\nimport { Attachment, AttachmentPartition } from '../../data/entities'\nimport { buildAttachmentImageUrl, slugifyAttachmentFileName } from '../../lib/imageUrls'\nimport { readAttachmentMetadata } from '../../lib/metadata'\nimport type { QueryEngine } from '@open-mercato/shared/lib/query/types'\nimport { applyAssignmentEnrichments, resolveAssignmentEnrichments } from '../../lib/assignmentDetails'\nimport { escapeLikePattern } from '@open-mercato/shared/lib/db/escapeLikePattern'\nimport {\n  attachmentsTag,\n  attachmentListQuerySchema as openApiListQuerySchema,\n  attachmentListResponseSchema,\n  attachmentErrorSchema,\n} from '../openapi'\n\nconst listQuerySchema = z.object({\n  page: z.coerce.number().min(1).default(1),\n  pageSize: z.coerce.number().min(1).max(100).default(25),\n  search: z.string().optional(),\n  partition: z.string().optional(),\n  tags: z.string().optional(),\n  sortField: z.enum(['fileName', 'fileSize', 'createdAt']).optional(),\n  sortDir: z.enum(['asc', 'desc']).optional(),\n})\n\nexport const metadata = {\n  GET: { requireAuth: true, requireFeatures: ['attachments.view'] },\n}\n\nfunction buildTagFilter(raw?: string): string[] {\n  if (!raw) return []\n  return raw\n    .split(',')\n    .map((tag) => tag.trim())\n    .filter((tag) => tag.length > 0)\n}\n\nfunction formatDateValue(value: unknown): string {\n  const toDate = (): Date => {\n    if (value instanceof Date) return value\n    if (typeof value === 'string') {\n      const parsed = new Date(value)\n      if (!Number.isNaN(parsed.getTime())) return parsed\n    }\n    const fallback = new Date(value as any)\n    if (!Number.isNaN(fallback.getTime())) return fallback\n    return new Date()\n  }\n  return toDate().toISOString()\n}\n\nexport async function GET(req: Request) {\n  const auth = await getAuthFromRequest(req)\n  if (!auth || !auth.tenantId || (!auth.orgId && !auth.isSuperAdmin)) {\n    return NextResponse.json({ error: 'Unauthorized' }, { status: 401 })\n  }\n  const url = new URL(req.url)\n  const parsed = listQuerySchema.safeParse(Object.fromEntries(url.searchParams.entries()))\n  if (!parsed.success) {\n    return NextResponse.json({ error: 'Invalid query' }, { status: 400 })\n  }\n\n  const { page, pageSize, search, partition, tags, sortField, sortDir } = parsed.data\n  const tagList = buildTagFilter(tags)\n  const offset = (page - 1) * pageSize\n  const { resolve } = await createRequestContainer()\n  const em = resolve('em') as EntityManager\n  let queryEngine: QueryEngine | null = null\n  try {\n    queryEngine = resolve('queryEngine') as QueryEngine\n  } catch {\n    queryEngine = null\n  }\n  const qb = em.createQueryBuilder(Attachment, 'a')\n  const baseFilter: Record<string, unknown> = { tenantId: auth.tenantId }\n  if (auth.orgId) {\n    baseFilter.organizationId = auth.orgId\n  }\n  qb.where(baseFilter)\n  if (search && search.trim().length > 0) {\n    qb.andWhere({ fileName: { $ilike: `%${escapeLikePattern(search.trim())}%` } })\n  }\n  if (partition && partition.trim().length > 0) {\n    qb.andWhere({ partitionCode: partition.trim() })\n  }\n  if (tagList.length > 0) {\n    qb.andWhere(`coalesce(a.storage_metadata->'tags', '[]'::jsonb) @> ?::jsonb`, [JSON.stringify(tagList)])\n  }\n  const countQb = qb.clone()\n  const orderMap: Record<string, string> = {\n    fileName: 'a.file_name',\n    fileSize: 'a.file_size',\n    createdAt: 'a.created_at',\n  }\n  const orderColumn = orderMap[sortField ?? 'createdAt'] ?? 'a.created_at'\n  qb.orderBy({ [orderColumn]: sortDir === 'asc' ? 'asc' : 'desc' })\n  qb.limit(pageSize).offset(offset)\n\n  const partitionsPromise = em.find(\n    AttachmentPartition,\n    {},\n    { orderBy: { title: 'asc' }, fields: ['code', 'title', 'description'] as any },\n  )\n  const [records, total, partitions] = await Promise.all([qb.getResultList(), countQb.getCount('a.id', true), partitionsPromise])\n  const partitionTitleByCode = partitions.reduce<Record<string, string>>((acc, entry) => {\n    if (entry.code) acc[entry.code] = entry.title ?? entry.code\n    return acc\n  }, {})\n  const items = records.map((record) => {\n    const metadata = readAttachmentMetadata(record.storageMetadata)\n    const fileName = record.fileName || ''\n    const isImage = typeof record.mimeType === 'string' && record.mimeType.toLowerCase().startsWith('image/')\n    const thumbnailUrl = isImage\n      ? buildAttachmentImageUrl(record.id, {\n          width: 200,\n          height: 200,\n          slug: slugifyAttachmentFileName(fileName),\n        })\n      : undefined\n    return {\n      id: record.id,\n      fileName,\n      fileSize: record.fileSize,\n      mimeType: record.mimeType,\n      partitionCode: record.partitionCode,\n      partitionTitle: partitionTitleByCode[record.partitionCode] ?? null,\n      url: record.url,\n      createdAt: formatDateValue(record.createdAt),\n      tags: metadata.tags ?? [],\n      assignments: metadata.assignments ?? [],\n      thumbnailUrl,\n      content: record.content && record.content.trim() ? record.content : null,\n    }\n  })\n\n  const allAssignments = items.flatMap((item) => item.assignments ?? [])\n  const enrichments = await resolveAssignmentEnrichments(allAssignments, {\n    queryEngine,\n    tenantId: auth.tenantId,\n    organizationId: auth.orgId,\n  })\n  const enrichedItems = enrichments.size\n    ? items.map((item) => ({\n        ...item,\n        assignments: applyAssignmentEnrichments(item.assignments ?? [], enrichments),\n      }))\n    : items\n\n  const totalPages = Math.max(1, Math.ceil(Number(total) / pageSize))\n  const db = em.getKysely<any>() as any\n  let tagQuery = db\n    .selectFrom('attachments')\n    .select(sql<string>`distinct jsonb_array_elements_text(coalesce(storage_metadata->'tags', '[]'::jsonb))`.as('tag'))\n    .where('tenant_id', '=', auth.tenantId)\n  if (auth.orgId) {\n    tagQuery = tagQuery.where('organization_id', '=', auth.orgId)\n  }\n  const tagRows = await tagQuery.orderBy('tag', 'asc').execute() as Array<{ tag?: string | null }>\n  const availableTags = tagRows\n    .map((row) => (typeof row.tag === 'string' ? row.tag.trim() : ''))\n    .filter((tag) => tag.length > 0)\n\n  return NextResponse.json({\n    items: enrichedItems,\n    page,\n    pageSize,\n    total,\n    totalPages,\n    availableTags,\n    partitions: partitions.map((entry) => ({\n      code: entry.code,\n      title: entry.title,\n      description: entry.description ?? null,\n      isPublic: entry.isPublic ?? false,\n    })),\n  })\n}\n\nexport const openApi: OpenApiRouteDoc = {\n  tag: attachmentsTag,\n  summary: 'Attachment library management',\n  methods: {\n    GET: {\n      summary: 'List attachments',\n      description: 'Returns paginated list of attachments with optional filtering by search term, partition, and tags. Includes available tags and partitions.',\n      query: openApiListQuerySchema,\n      responses: [\n        { status: 200, description: 'Attachments list with pagination and metadata', schema: attachmentListResponseSchema },\n      ],\n      errors: [\n        { status: 400, description: 'Invalid query parameters', schema: attachmentErrorSchema },\n        { status: 401, description: 'Unauthorized', schema: attachmentErrorSchema },\n      ],\n    },\n  },\n}\n"],
-  "mappings": "AAAA,SAAS,oBAAoB;AAC7B,SAAS,SAAS;AAElB,SAAS,0BAA0B;AACnC,SAAS,8BAA8B;AAEvC,SAAS,WAAW;AACpB,SAAS,YAAY,2BAA2B;AAChD,SAAS,yBAAyB,iCAAiC;AACnE,SAAS,8BAA8B;AAEvC,SAAS,4BAA4B,oCAAoC;AACzE,SAAS,yBAAyB;AAClC;AAAA,EACE;AAAA,EACA,6BAA6B;AAAA,EAC7B;AAAA,EACA;AAAA,OACK;AAEP,MAAM,kBAAkB,EAAE,OAAO;AAAA,EAC/B,MAAM,EAAE,OAAO,OAAO,EAAE,IAAI,CAAC,EAAE,QAAQ,CAAC;AAAA,EACxC,UAAU,EAAE,OAAO,OAAO,EAAE,IAAI,CAAC,EAAE,IAAI,GAAG,EAAE,QAAQ,EAAE;AAAA,EACtD,QAAQ,EAAE,OAAO,EAAE,SAAS;AAAA,EAC5B,WAAW,EAAE,OAAO,EAAE,SAAS;AAAA,EAC/B,MAAM,EAAE,OAAO,EAAE,SAAS;AAAA,EAC1B,WAAW,EAAE,KAAK,CAAC,YAAY,YAAY,WAAW,CAAC,EAAE,SAAS;AAAA,EAClE,SAAS,EAAE,KAAK,CAAC,OAAO,MAAM,CAAC,EAAE,SAAS;AAC5C,CAAC;AAEM,MAAM,WAAW;AAAA,EACtB,KAAK,EAAE,aAAa,MAAM,iBAAiB,CAAC,kBAAkB,EAAE;AAClE;AAEA,SAAS,eAAe,KAAwB;AAC9C,MAAI,CAAC,IAAK,QAAO,CAAC;AAClB,SAAO,IACJ,MAAM,GAAG,EACT,IAAI,CAAC,QAAQ,IAAI,KAAK,CAAC,EACvB,OAAO,CAAC,QAAQ,IAAI,SAAS,CAAC;AACnC;AAEA,SAAS,gBAAgB,OAAwB;AAC/C,QAAM,SAAS,MAAY;AACzB,QAAI,iBAAiB,KAAM,QAAO;AAClC,QAAI,OAAO,UAAU,UAAU;AAC7B,YAAM,SAAS,IAAI,KAAK,KAAK;AAC7B,UAAI,CAAC,OAAO,MAAM,OAAO,QAAQ,CAAC,EAAG,QAAO;AAAA,IAC9C;AACA,UAAM,WAAW,IAAI,KAAK,KAAY;AACtC,QAAI,CAAC,OAAO,MAAM,SAAS,QAAQ,CAAC,EAAG,QAAO;AAC9C,WAAO,oBAAI,KAAK;AAAA,EAClB;AACA,SAAO,OAAO,EAAE,YAAY;AAC9B;AAEA,eAAsB,IAAI,KAAc;AACtC,QAAM,OAAO,MAAM,mBAAmB,GAAG;AACzC,MAAI,CAAC,QAAQ,CAAC,KAAK,YAAa,CAAC,KAAK,SAAS,CAAC,KAAK,cAAe;AAClE,WAAO,aAAa,KAAK,EAAE,OAAO,eAAe,GAAG,EAAE,QAAQ,IAAI,CAAC;AAAA,EACrE;AACA,QAAM,MAAM,IAAI,IAAI,IAAI,GAAG;AAC3B,QAAM,SAAS,gBAAgB,UAAU,OAAO,YAAY,IAAI,aAAa,QAAQ,CAAC,CAAC;AACvF,MAAI,CAAC,OAAO,SAAS;AACnB,WAAO,aAAa,KAAK,EAAE,OAAO,gBAAgB,GAAG,EAAE,QAAQ,IAAI,CAAC;AAAA,EACtE;AAEA,QAAM,EAAE,MAAM,UAAU,QAAQ,WAAW,MAAM,WAAW,QAAQ,IAAI,OAAO;AAC/E,QAAM,UAAU,eAAe,IAAI;AACnC,QAAM,UAAU,OAAO,KAAK;AAC5B,QAAM,EAAE,QAAQ,IAAI,MAAM,uBAAuB;AACjD,QAAM,KAAK,QAAQ,IAAI;AACvB,MAAI,cAAkC;AACtC,MAAI;AACF,kBAAc,QAAQ,aAAa;AAAA,EACrC,QAAQ;AACN,kBAAc;AAAA,EAChB;AACA,QAAM,KAAK,GAAG,mBAAmB,YAAY,GAAG;AAChD,QAAM,aAAsC,EAAE,UAAU,KAAK,SAAS;AACtE,MAAI,KAAK,OAAO;AACd,eAAW,iBAAiB,KAAK;AAAA,EACnC;AACA,KAAG,MAAM,UAAU;AACnB,MAAI,UAAU,OAAO,KAAK,EAAE,SAAS,GAAG;AACtC,OAAG,SAAS,EAAE,UAAU,EAAE,QAAQ,IAAI,kBAAkB,OAAO,KAAK,CAAC,CAAC,IAAI,EAAE,CAAC;AAAA,EAC/E;AACA,MAAI,aAAa,UAAU,KAAK,EAAE,SAAS,GAAG;AAC5C,OAAG,SAAS,EAAE,eAAe,UAAU,KAAK,EAAE,CAAC;AAAA,EACjD;AACA,MAAI,QAAQ,SAAS,GAAG;AACtB,OAAG,SAAS,iEAAiE,CAAC,KAAK,UAAU,OAAO,CAAC,CAAC;AAAA,EACxG;AACA,QAAM,UAAU,GAAG,MAAM;AACzB,QAAM,WAAmC;AAAA,IACvC,UAAU;AAAA,IACV,UAAU;AAAA,IACV,WAAW;AAAA,EACb;AACA,QAAM,cAAc,SAAS,aAAa,WAAW,KAAK;AAC1D,KAAG,QAAQ,EAAE,CAAC,WAAW,GAAG,YAAY,QAAQ,QAAQ,OAAO,CAAC;AAChE,KAAG,MAAM,QAAQ,EAAE,OAAO,MAAM;AAEhC,QAAM,oBAAoB,GAAG;AAAA,IAC3B;AAAA,IACA,CAAC;AAAA,IACD,EAAE,SAAS,EAAE,OAAO,MAAM,GAAG,QAAQ,CAAC,QAAQ,SAAS,aAAa,EAAS;AAAA,EAC/E;AACA,QAAM,CAAC,SAAS,OAAO,UAAU,IAAI,MAAM,QAAQ,IAAI,CAAC,GAAG,cAAc,GAAG,QAAQ,SAAS,QAAQ,IAAI,GAAG,iBAAiB,CAAC;AAC9H,QAAM,uBAAuB,WAAW,OAA+B,CAAC,KAAK,UAAU;AACrF,QAAI,MAAM,KAAM,KAAI,MAAM,IAAI,IAAI,MAAM,SAAS,MAAM;AACvD,WAAO;AAAA,EACT,GAAG,CAAC,CAAC;AACL,QAAM,QAAQ,QAAQ,IAAI,CAAC,WAAW;AACpC,UAAMA,YAAW,uBAAuB,OAAO,eAAe;AAC9D,UAAM,WAAW,OAAO,YAAY;AACpC,UAAM,UAAU,OAAO,OAAO,aAAa,YAAY,OAAO,SAAS,YAAY,EAAE,WAAW,QAAQ;AACxG,UAAM,eAAe,UACjB,wBAAwB,OAAO,IAAI;AAAA,MACjC,OAAO;AAAA,MACP,QAAQ;AAAA,MACR,MAAM,0BAA0B,QAAQ;AAAA,IAC1C,CAAC,IACD;AACJ,WAAO;AAAA,MACL,IAAI,OAAO;AAAA,MACX;AAAA,MACA,UAAU,OAAO;AAAA,MACjB,UAAU,OAAO;AAAA,MACjB,eAAe,OAAO;AAAA,MACtB,gBAAgB,qBAAqB,OAAO,aAAa,KAAK;AAAA,MAC9D,KAAK,OAAO;AAAA,MACZ,WAAW,gBAAgB,OAAO,SAAS;AAAA,MAC3C,MAAMA,UAAS,QAAQ,CAAC;AAAA,MACxB,aAAaA,UAAS,eAAe,CAAC;AAAA,MACtC;AAAA,MACA,SAAS,OAAO,WAAW,OAAO,QAAQ,KAAK,IAAI,OAAO,UAAU;AAAA,IACtE;AAAA,EACF,CAAC;AAED,QAAM,iBAAiB,MAAM,QAAQ,CAAC,SAAS,KAAK,eAAe,CAAC,CAAC;AACrE,QAAM,cAAc,MAAM,6BAA6B,gBAAgB;AAAA,IACrE;AAAA,IACA,UAAU,KAAK;AAAA,IACf,gBAAgB,KAAK;AAAA,EACvB,CAAC;AACD,QAAM,gBAAgB,YAAY,OAC9B,MAAM,IAAI,CAAC,UAAU;AAAA,IACnB,GAAG;AAAA,IACH,aAAa,2BAA2B,KAAK,eAAe,CAAC,GAAG,WAAW;AAAA,EAC7E,EAAE,IACF;AAEJ,QAAM,aAAa,KAAK,IAAI,GAAG,KAAK,KAAK,OAAO,KAAK,IAAI,QAAQ,CAAC;AAClE,QAAM,KAAK,GAAG,UAAe;AAC7B,MAAI,WAAW,GACZ,WAAW,aAAa,EACxB,OAAO,yFAAiG,GAAG,KAAK,CAAC,EACjH,MAAM,aAAa,KAAK,KAAK,QAAQ;AACxC,MAAI,KAAK,OAAO;AACd,eAAW,SAAS,MAAM,mBAAmB,KAAK,KAAK,KAAK;AAAA,EAC9D;AACA,QAAM,UAAU,MAAM,SAAS,QAAQ,OAAO,KAAK,EAAE,QAAQ;AAC7D,QAAM,gBAAgB,QACnB,IAAI,CAAC,QAAS,OAAO,IAAI,QAAQ,WAAW,IAAI,IAAI,KAAK,IAAI,EAAG,EAChE,OAAO,CAAC,QAAQ,IAAI,SAAS,CAAC;AAEjC,SAAO,aAAa,KAAK;AAAA,IACvB,OAAO;AAAA,IACP;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA,YAAY,WAAW,IAAI,CAAC,WAAW;AAAA,MACrC,MAAM,MAAM;AAAA,MACZ,OAAO,MAAM;AAAA,MACb,aAAa,MAAM,eAAe;AAAA,MAClC,UAAU,MAAM,YAAY;AAAA,IAC9B,EAAE;AAAA,EACJ,CAAC;AACH;AAEO,MAAM,UAA2B;AAAA,EACtC,KAAK;AAAA,EACL,SAAS;AAAA,EACT,SAAS;AAAA,IACP,KAAK;AAAA,MACH,SAAS;AAAA,MACT,aAAa;AAAA,MACb,OAAO;AAAA,MACP,WAAW;AAAA,QACT,EAAE,QAAQ,KAAK,aAAa,iDAAiD,QAAQ,6BAA6B;AAAA,MACpH;AAAA,MACA,QAAQ;AAAA,QACN,EAAE,QAAQ,KAAK,aAAa,4BAA4B,QAAQ,sBAAsB;AAAA,QACtF,EAAE,QAAQ,KAAK,aAAa,gBAAgB,QAAQ,sBAAsB;AAAA,MAC5E;AAAA,IACF;AAAA,EACF;AACF;",
+  "sourcesContent": ["import { NextResponse } from 'next/server'\nimport { z } from 'zod'\nimport type { OpenApiRouteDoc } from '@open-mercato/shared/lib/openapi'\nimport { getAuthFromRequest } from '@open-mercato/shared/lib/auth/server'\nimport { createRequestContainer } from '@open-mercato/shared/lib/di/container'\nimport type { EntityManager } from '@mikro-orm/postgresql'\nimport { sql } from 'kysely'\nimport { Attachment, AttachmentPartition } from '../../data/entities'\nimport { buildAttachmentImageUrl, slugifyAttachmentFileName } from '../../lib/imageUrls'\nimport { readAttachmentMetadata } from '../../lib/metadata'\nimport type { QueryEngine } from '@open-mercato/shared/lib/query/types'\nimport { applyAssignmentEnrichments, resolveAssignmentEnrichments } from '../../lib/assignmentDetails'\nimport { escapeLikePattern } from '@open-mercato/shared/lib/db/escapeLikePattern'\nimport { ensureDefaultPartitions } from '../../lib/partitions'\nimport {\n  attachmentsTag,\n  attachmentListQuerySchema as openApiListQuerySchema,\n  attachmentListResponseSchema,\n  attachmentErrorSchema,\n} from '../openapi'\n\nconst listQuerySchema = z.object({\n  page: z.coerce.number().min(1).default(1),\n  pageSize: z.coerce.number().min(1).max(100).default(25),\n  search: z.string().optional(),\n  partition: z.string().optional(),\n  tags: z.string().optional(),\n  sortField: z.enum(['fileName', 'fileSize', 'createdAt']).optional(),\n  sortDir: z.enum(['asc', 'desc']).optional(),\n})\n\nexport const metadata = {\n  GET: { requireAuth: true, requireFeatures: ['attachments.view'] },\n}\n\nfunction buildTagFilter(raw?: string): string[] {\n  if (!raw) return []\n  return raw\n    .split(',')\n    .map((tag) => tag.trim())\n    .filter((tag) => tag.length > 0)\n}\n\nfunction formatDateValue(value: unknown): string {\n  const toDate = (): Date => {\n    if (value instanceof Date) return value\n    if (typeof value === 'string') {\n      const parsed = new Date(value)\n      if (!Number.isNaN(parsed.getTime())) return parsed\n    }\n    const fallback = new Date(value as any)\n    if (!Number.isNaN(fallback.getTime())) return fallback\n    return new Date()\n  }\n  return toDate().toISOString()\n}\n\nexport async function GET(req: Request) {\n  const auth = await getAuthFromRequest(req)\n  if (!auth || !auth.tenantId || (!auth.orgId && !auth.isSuperAdmin)) {\n    return NextResponse.json({ error: 'Unauthorized' }, { status: 401 })\n  }\n  const url = new URL(req.url)\n  const parsed = listQuerySchema.safeParse(Object.fromEntries(url.searchParams.entries()))\n  if (!parsed.success) {\n    return NextResponse.json({ error: 'Invalid query' }, { status: 400 })\n  }\n\n  const { page, pageSize, search, partition, tags, sortField, sortDir } = parsed.data\n  const tagList = buildTagFilter(tags)\n  const offset = (page - 1) * pageSize\n  const { resolve } = await createRequestContainer()\n  const em = resolve('em') as EntityManager\n  await ensureDefaultPartitions(em)\n  let queryEngine: QueryEngine | null = null\n  try {\n    queryEngine = resolve('queryEngine') as QueryEngine\n  } catch {\n    queryEngine = null\n  }\n  const qb = em.createQueryBuilder(Attachment, 'a')\n  const baseFilter: Record<string, unknown> = { tenantId: auth.tenantId }\n  if (auth.orgId) {\n    baseFilter.organizationId = auth.orgId\n  }\n  qb.where(baseFilter)\n  if (search && search.trim().length > 0) {\n    qb.andWhere({ fileName: { $ilike: `%${escapeLikePattern(search.trim())}%` } })\n  }\n  if (partition && partition.trim().length > 0) {\n    qb.andWhere({ partitionCode: partition.trim() })\n  }\n  if (tagList.length > 0) {\n    qb.andWhere(`coalesce(a.storage_metadata->'tags', '[]'::jsonb) @> ?::jsonb`, [JSON.stringify(tagList)])\n  }\n  const countQb = qb.clone()\n  const orderMap: Record<string, string> = {\n    fileName: 'a.file_name',\n    fileSize: 'a.file_size',\n    createdAt: 'a.created_at',\n  }\n  const orderColumn = orderMap[sortField ?? 'createdAt'] ?? 'a.created_at'\n  qb.orderBy({ [orderColumn]: sortDir === 'asc' ? 'asc' : 'desc' })\n  qb.limit(pageSize).offset(offset)\n\n  const partitionsPromise = em.find(\n    AttachmentPartition,\n    {},\n    { orderBy: { title: 'asc' }, fields: ['code', 'title', 'description'] as any },\n  )\n  const [records, total, partitions] = await Promise.all([qb.getResultList(), countQb.getCount('a.id', true), partitionsPromise])\n  const partitionTitleByCode = partitions.reduce<Record<string, string>>((acc, entry) => {\n    if (entry.code) acc[entry.code] = entry.title ?? entry.code\n    return acc\n  }, {})\n  const items = records.map((record) => {\n    const metadata = readAttachmentMetadata(record.storageMetadata)\n    const fileName = record.fileName || ''\n    const isImage = typeof record.mimeType === 'string' && record.mimeType.toLowerCase().startsWith('image/')\n    const thumbnailUrl = isImage\n      ? buildAttachmentImageUrl(record.id, {\n          width: 200,\n          height: 200,\n          slug: slugifyAttachmentFileName(fileName),\n        })\n      : undefined\n    return {\n      id: record.id,\n      fileName,\n      fileSize: record.fileSize,\n      mimeType: record.mimeType,\n      partitionCode: record.partitionCode,\n      partitionTitle: partitionTitleByCode[record.partitionCode] ?? null,\n      url: record.url,\n      createdAt: formatDateValue(record.createdAt),\n      tags: metadata.tags ?? [],\n      assignments: metadata.assignments ?? [],\n      thumbnailUrl,\n      content: record.content && record.content.trim() ? record.content : null,\n    }\n  })\n\n  const allAssignments = items.flatMap((item) => item.assignments ?? [])\n  const enrichments = await resolveAssignmentEnrichments(allAssignments, {\n    queryEngine,\n    tenantId: auth.tenantId,\n    organizationId: auth.orgId,\n  })\n  const enrichedItems = enrichments.size\n    ? items.map((item) => ({\n        ...item,\n        assignments: applyAssignmentEnrichments(item.assignments ?? [], enrichments),\n      }))\n    : items\n\n  const totalPages = Math.max(1, Math.ceil(Number(total) / pageSize))\n  const db = em.getKysely<any>() as any\n  let tagQuery = db\n    .selectFrom('attachments')\n    .select(sql<string>`distinct jsonb_array_elements_text(coalesce(storage_metadata->'tags', '[]'::jsonb))`.as('tag'))\n    .where('tenant_id', '=', auth.tenantId)\n  if (auth.orgId) {\n    tagQuery = tagQuery.where('organization_id', '=', auth.orgId)\n  }\n  const tagRows = await tagQuery.orderBy('tag', 'asc').execute() as Array<{ tag?: string | null }>\n  const availableTags = tagRows\n    .map((row) => (typeof row.tag === 'string' ? row.tag.trim() : ''))\n    .filter((tag) => tag.length > 0)\n\n  return NextResponse.json({\n    items: enrichedItems,\n    page,\n    pageSize,\n    total,\n    totalPages,\n    availableTags,\n    partitions: partitions.map((entry) => ({\n      code: entry.code,\n      title: entry.title,\n      description: entry.description ?? null,\n      isPublic: entry.isPublic ?? false,\n    })),\n  })\n}\n\nexport const openApi: OpenApiRouteDoc = {\n  tag: attachmentsTag,\n  summary: 'Attachment library management',\n  methods: {\n    GET: {\n      summary: 'List attachments',\n      description: 'Returns paginated list of attachments with optional filtering by search term, partition, and tags. Includes available tags and partitions.',\n      query: openApiListQuerySchema,\n      responses: [\n        { status: 200, description: 'Attachments list with pagination and metadata', schema: attachmentListResponseSchema },\n      ],\n      errors: [\n        { status: 400, description: 'Invalid query parameters', schema: attachmentErrorSchema },\n        { status: 401, description: 'Unauthorized', schema: attachmentErrorSchema },\n      ],\n    },\n  },\n}\n"],
+  "mappings": "AAAA,SAAS,oBAAoB;AAC7B,SAAS,SAAS;AAElB,SAAS,0BAA0B;AACnC,SAAS,8BAA8B;AAEvC,SAAS,WAAW;AACpB,SAAS,YAAY,2BAA2B;AAChD,SAAS,yBAAyB,iCAAiC;AACnE,SAAS,8BAA8B;AAEvC,SAAS,4BAA4B,oCAAoC;AACzE,SAAS,yBAAyB;AAClC,SAAS,+BAA+B;AACxC;AAAA,EACE;AAAA,EACA,6BAA6B;AAAA,EAC7B;AAAA,EACA;AAAA,OACK;AAEP,MAAM,kBAAkB,EAAE,OAAO;AAAA,EAC/B,MAAM,EAAE,OAAO,OAAO,EAAE,IAAI,CAAC,EAAE,QAAQ,CAAC;AAAA,EACxC,UAAU,EAAE,OAAO,OAAO,EAAE,IAAI,CAAC,EAAE,IAAI,GAAG,EAAE,QAAQ,EAAE;AAAA,EACtD,QAAQ,EAAE,OAAO,EAAE,SAAS;AAAA,EAC5B,WAAW,EAAE,OAAO,EAAE,SAAS;AAAA,EAC/B,MAAM,EAAE,OAAO,EAAE,SAAS;AAAA,EAC1B,WAAW,EAAE,KAAK,CAAC,YAAY,YAAY,WAAW,CAAC,EAAE,SAAS;AAAA,EAClE,SAAS,EAAE,KAAK,CAAC,OAAO,MAAM,CAAC,EAAE,SAAS;AAC5C,CAAC;AAEM,MAAM,WAAW;AAAA,EACtB,KAAK,EAAE,aAAa,MAAM,iBAAiB,CAAC,kBAAkB,EAAE;AAClE;AAEA,SAAS,eAAe,KAAwB;AAC9C,MAAI,CAAC,IAAK,QAAO,CAAC;AAClB,SAAO,IACJ,MAAM,GAAG,EACT,IAAI,CAAC,QAAQ,IAAI,KAAK,CAAC,EACvB,OAAO,CAAC,QAAQ,IAAI,SAAS,CAAC;AACnC;AAEA,SAAS,gBAAgB,OAAwB;AAC/C,QAAM,SAAS,MAAY;AACzB,QAAI,iBAAiB,KAAM,QAAO;AAClC,QAAI,OAAO,UAAU,UAAU;AAC7B,YAAM,SAAS,IAAI,KAAK,KAAK;AAC7B,UAAI,CAAC,OAAO,MAAM,OAAO,QAAQ,CAAC,EAAG,QAAO;AAAA,IAC9C;AACA,UAAM,WAAW,IAAI,KAAK,KAAY;AACtC,QAAI,CAAC,OAAO,MAAM,SAAS,QAAQ,CAAC,EAAG,QAAO;AAC9C,WAAO,oBAAI,KAAK;AAAA,EAClB;AACA,SAAO,OAAO,EAAE,YAAY;AAC9B;AAEA,eAAsB,IAAI,KAAc;AACtC,QAAM,OAAO,MAAM,mBAAmB,GAAG;AACzC,MAAI,CAAC,QAAQ,CAAC,KAAK,YAAa,CAAC,KAAK,SAAS,CAAC,KAAK,cAAe;AAClE,WAAO,aAAa,KAAK,EAAE,OAAO,eAAe,GAAG,EAAE,QAAQ,IAAI,CAAC;AAAA,EACrE;AACA,QAAM,MAAM,IAAI,IAAI,IAAI,GAAG;AAC3B,QAAM,SAAS,gBAAgB,UAAU,OAAO,YAAY,IAAI,aAAa,QAAQ,CAAC,CAAC;AACvF,MAAI,CAAC,OAAO,SAAS;AACnB,WAAO,aAAa,KAAK,EAAE,OAAO,gBAAgB,GAAG,EAAE,QAAQ,IAAI,CAAC;AAAA,EACtE;AAEA,QAAM,EAAE,MAAM,UAAU,QAAQ,WAAW,MAAM,WAAW,QAAQ,IAAI,OAAO;AAC/E,QAAM,UAAU,eAAe,IAAI;AACnC,QAAM,UAAU,OAAO,KAAK;AAC5B,QAAM,EAAE,QAAQ,IAAI,MAAM,uBAAuB;AACjD,QAAM,KAAK,QAAQ,IAAI;AACvB,QAAM,wBAAwB,EAAE;AAChC,MAAI,cAAkC;AACtC,MAAI;AACF,kBAAc,QAAQ,aAAa;AAAA,EACrC,QAAQ;AACN,kBAAc;AAAA,EAChB;AACA,QAAM,KAAK,GAAG,mBAAmB,YAAY,GAAG;AAChD,QAAM,aAAsC,EAAE,UAAU,KAAK,SAAS;AACtE,MAAI,KAAK,OAAO;AACd,eAAW,iBAAiB,KAAK;AAAA,EACnC;AACA,KAAG,MAAM,UAAU;AACnB,MAAI,UAAU,OAAO,KAAK,EAAE,SAAS,GAAG;AACtC,OAAG,SAAS,EAAE,UAAU,EAAE,QAAQ,IAAI,kBAAkB,OAAO,KAAK,CAAC,CAAC,IAAI,EAAE,CAAC;AAAA,EAC/E;AACA,MAAI,aAAa,UAAU,KAAK,EAAE,SAAS,GAAG;AAC5C,OAAG,SAAS,EAAE,eAAe,UAAU,KAAK,EAAE,CAAC;AAAA,EACjD;AACA,MAAI,QAAQ,SAAS,GAAG;AACtB,OAAG,SAAS,iEAAiE,CAAC,KAAK,UAAU,OAAO,CAAC,CAAC;AAAA,EACxG;AACA,QAAM,UAAU,GAAG,MAAM;AACzB,QAAM,WAAmC;AAAA,IACvC,UAAU;AAAA,IACV,UAAU;AAAA,IACV,WAAW;AAAA,EACb;AACA,QAAM,cAAc,SAAS,aAAa,WAAW,KAAK;AAC1D,KAAG,QAAQ,EAAE,CAAC,WAAW,GAAG,YAAY,QAAQ,QAAQ,OAAO,CAAC;AAChE,KAAG,MAAM,QAAQ,EAAE,OAAO,MAAM;AAEhC,QAAM,oBAAoB,GAAG;AAAA,IAC3B;AAAA,IACA,CAAC;AAAA,IACD,EAAE,SAAS,EAAE,OAAO,MAAM,GAAG,QAAQ,CAAC,QAAQ,SAAS,aAAa,EAAS;AAAA,EAC/E;AACA,QAAM,CAAC,SAAS,OAAO,UAAU,IAAI,MAAM,QAAQ,IAAI,CAAC,GAAG,cAAc,GAAG,QAAQ,SAAS,QAAQ,IAAI,GAAG,iBAAiB,CAAC;AAC9H,QAAM,uBAAuB,WAAW,OAA+B,CAAC,KAAK,UAAU;AACrF,QAAI,MAAM,KAAM,KAAI,MAAM,IAAI,IAAI,MAAM,SAAS,MAAM;AACvD,WAAO;AAAA,EACT,GAAG,CAAC,CAAC;AACL,QAAM,QAAQ,QAAQ,IAAI,CAAC,WAAW;AACpC,UAAMA,YAAW,uBAAuB,OAAO,eAAe;AAC9D,UAAM,WAAW,OAAO,YAAY;AACpC,UAAM,UAAU,OAAO,OAAO,aAAa,YAAY,OAAO,SAAS,YAAY,EAAE,WAAW,QAAQ;AACxG,UAAM,eAAe,UACjB,wBAAwB,OAAO,IAAI;AAAA,MACjC,OAAO;AAAA,MACP,QAAQ;AAAA,MACR,MAAM,0BAA0B,QAAQ;AAAA,IAC1C,CAAC,IACD;AACJ,WAAO;AAAA,MACL,IAAI,OAAO;AAAA,MACX;AAAA,MACA,UAAU,OAAO;AAAA,MACjB,UAAU,OAAO;AAAA,MACjB,eAAe,OAAO;AAAA,MACtB,gBAAgB,qBAAqB,OAAO,aAAa,KAAK;AAAA,MAC9D,KAAK,OAAO;AAAA,MACZ,WAAW,gBAAgB,OAAO,SAAS;AAAA,MAC3C,MAAMA,UAAS,QAAQ,CAAC;AAAA,MACxB,aAAaA,UAAS,eAAe,CAAC;AAAA,MACtC;AAAA,MACA,SAAS,OAAO,WAAW,OAAO,QAAQ,KAAK,IAAI,OAAO,UAAU;AAAA,IACtE;AAAA,EACF,CAAC;AAED,QAAM,iBAAiB,MAAM,QAAQ,CAAC,SAAS,KAAK,eAAe,CAAC,CAAC;AACrE,QAAM,cAAc,MAAM,6BAA6B,gBAAgB;AAAA,IACrE;AAAA,IACA,UAAU,KAAK;AAAA,IACf,gBAAgB,KAAK;AAAA,EACvB,CAAC;AACD,QAAM,gBAAgB,YAAY,OAC9B,MAAM,IAAI,CAAC,UAAU;AAAA,IACnB,GAAG;AAAA,IACH,aAAa,2BAA2B,KAAK,eAAe,CAAC,GAAG,WAAW;AAAA,EAC7E,EAAE,IACF;AAEJ,QAAM,aAAa,KAAK,IAAI,GAAG,KAAK,KAAK,OAAO,KAAK,IAAI,QAAQ,CAAC;AAClE,QAAM,KAAK,GAAG,UAAe;AAC7B,MAAI,WAAW,GACZ,WAAW,aAAa,EACxB,OAAO,yFAAiG,GAAG,KAAK,CAAC,EACjH,MAAM,aAAa,KAAK,KAAK,QAAQ;AACxC,MAAI,KAAK,OAAO;AACd,eAAW,SAAS,MAAM,mBAAmB,KAAK,KAAK,KAAK;AAAA,EAC9D;AACA,QAAM,UAAU,MAAM,SAAS,QAAQ,OAAO,KAAK,EAAE,QAAQ;AAC7D,QAAM,gBAAgB,QACnB,IAAI,CAAC,QAAS,OAAO,IAAI,QAAQ,WAAW,IAAI,IAAI,KAAK,IAAI,EAAG,EAChE,OAAO,CAAC,QAAQ,IAAI,SAAS,CAAC;AAEjC,SAAO,aAAa,KAAK;AAAA,IACvB,OAAO;AAAA,IACP;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA,YAAY,WAAW,IAAI,CAAC,WAAW;AAAA,MACrC,MAAM,MAAM;AAAA,MACZ,OAAO,MAAM;AAAA,MACb,aAAa,MAAM,eAAe;AAAA,MAClC,UAAU,MAAM,YAAY;AAAA,IAC9B,EAAE;AAAA,EACJ,CAAC;AACH;AAEO,MAAM,UAA2B;AAAA,EACtC,KAAK;AAAA,EACL,SAAS;AAAA,EACT,SAAS;AAAA,IACP,KAAK;AAAA,MACH,SAAS;AAAA,MACT,aAAa;AAAA,MACb,OAAO;AAAA,MACP,WAAW;AAAA,QACT,EAAE,QAAQ,KAAK,aAAa,iDAAiD,QAAQ,6BAA6B;AAAA,MACpH;AAAA,MACA,QAAQ;AAAA,QACN,EAAE,QAAQ,KAAK,aAAa,4BAA4B,QAAQ,sBAAsB;AAAA,QACtF,EAAE,QAAQ,KAAK,aAAa,gBAAgB,QAAQ,sBAAsB;AAAA,MAC5E;AAAA,IACF;AAAA,EACF;AACF;",
   "names": ["metadata"]
 }

package/dist/modules/attachments/api/openapi.js

@@ -66,6 +66,8 @@ const partitionSchema = z.object({
   isPublic: z.boolean(),
   requiresOcr: z.boolean(),
   ocrModel: z.string().nullable(),
+  storageDriver: z.string().optional().describe("Storage driver: local (default) or s3"),
+  configJson: z.record(z.string(), z.unknown()).nullable().optional().describe("Driver-specific configuration"),
   createdAt: z.string().nullable(),
   updatedAt: z.string().nullable(),
   envKey: z.string()
@@ -79,7 +81,9 @@ const partitionCreateSchema = z.object({
   description: z.string().max(500).nullable().optional().describe("Optional description"),
   isPublic: z.boolean().optional().describe("Whether partition is publicly accessible"),
   requiresOcr: z.boolean().optional().describe("Whether OCR should be performed on uploads"),
-  ocrModel: z.string().max(50).nullable().optional().describe("OCR model to use")
+  ocrModel: z.string().max(50).nullable().optional().describe("OCR model to use"),
+  storageDriver: z.enum(["local", "s3"]).optional().default("local").describe("Storage driver to use"),
+  configJson: z.record(z.string(), z.unknown()).nullable().optional().describe("Driver-specific configuration (e.g. S3 bucket, region, endpoint)")
 });
 const partitionUpdateSchema = partitionCreateSchema.extend({
   id: z.string().uuid().describe("Partition ID")

package/dist/modules/attachments/api/openapi.js.map

@@ -1,7 +1,7 @@
 {
   "version": 3,
   "sources": ["../../../../src/modules/attachments/api/openapi.ts"],
-  "sourcesContent": ["import { z } from 'zod'\n\nexport const attachmentsTag = 'Attachments'\n\nexport const attachmentErrorSchema = z\n  .object({\n    error: z.string(),\n    details: z.unknown().optional(),\n  })\n  .passthrough()\n\nexport const attachmentListItemSchema = z.object({\n  id: z.string().uuid(),\n  fileName: z.string(),\n  fileSize: z.number().int(),\n  mimeType: z.string(),\n  partitionCode: z.string(),\n  partitionTitle: z.string().nullable(),\n  url: z.string().nullable().optional(),\n  createdAt: z.string(),\n  tags: z.array(z.string()),\n  assignments: z.array(z.unknown()),\n  thumbnailUrl: z.string().optional(),\n  content: z.unknown().nullable().optional(),\n})\n\nexport const attachmentSchema = attachmentListItemSchema\n\nexport const attachmentListQuerySchema = z.object({\n  page: z.coerce.number().min(1).default(1).describe('Page number for pagination'),\n  pageSize: z.coerce.number().min(1).max(100).default(25).describe('Number of items per page (max 100)'),\n  search: z.string().optional().describe('Search by file name (case-insensitive)'),\n  partition: z.string().optional().describe('Filter by partition code'),\n  tags: z.string().optional().describe('Filter by tags (comma-separated)'),\n  sortField: z.enum(['fileName', 'fileSize', 'createdAt']).optional().describe('Field to sort by'),\n  sortDir: z.enum(['asc', 'desc']).optional().describe('Sort direction'),\n})\n\nexport const attachmentLibraryPartitionSchema = z.object({\n  code: z.string(),\n  title: z.string(),\n  description: z.string().nullable(),\n  isPublic: z.boolean(),\n})\n\nexport const attachmentListResponseSchema = z.object({\n  items: z.array(attachmentListItemSchema),\n  total: z.number().int().nonnegative(),\n  page: z.number().int().positive(),\n  pageSize: z.number().int().positive(),\n  totalPages: z.number().int().positive(),\n  availableTags: z.array(z.string()),\n  partitions: z.array(attachmentLibraryPartitionSchema),\n})\n\nexport const attachmentDetailItemSchema = z.object({\n  id: z.string().uuid(),\n  fileName: z.string(),\n  fileSize: z.number().int(),\n  mimeType: z.string(),\n  partitionCode: z.string(),\n  partitionTitle: z.string().nullable(),\n  tags: z.array(z.string()),\n  assignments: z.array(z.unknown()),\n  content: z.unknown().nullable().optional(),\n  customFields: z.unknown().nullable().optional(),\n})\n\nexport const attachmentDetailResponseSchema = z.object({\n  item: attachmentDetailItemSchema,\n})\n\nexport const partitionSchema = z.object({\n  id: z.string().uuid(),\n  code: z.string(),\n  title: z.string(),\n  description: z.string().nullable(),\n  isPublic: z.boolean(),\n  requiresOcr: z.boolean(),\n  ocrModel: z.string().nullable(),\n  createdAt: z.string().nullable(),\n  updatedAt: z.string().nullable(),\n  envKey: z.string(),\n})\n\nexport const partitionListResponseSchema = z.object({\n  items: z.array(partitionSchema),\n})\n\nexport const partitionCreateSchema = z.object({\n  code: z\n    .string()\n    .min(2)\n    .max(60)\n    .regex(/^[A-Za-z0-9_-]+$/)\n    .describe('Partition code (letters, numbers, dashes, underscores)'),\n  title: z.string().min(1).max(120).describe('Partition title'),\n  description: z.string().max(500).nullable().optional().describe('Optional description'),\n  isPublic: z.boolean().optional().describe('Whether partition is publicly accessible'),\n  requiresOcr: z.boolean().optional().describe('Whether OCR should be performed on uploads'),\n  ocrModel: z.string().max(50).nullable().optional().describe('OCR model to use'),\n})\n\nexport const partitionUpdateSchema = partitionCreateSchema.extend({\n  id: z.string().uuid().describe('Partition ID'),\n})\n\nexport const partitionResponseSchema = z.object({\n  item: partitionSchema,\n})\n\nexport const transferAttachmentsRequestSchema = z.object({\n  entityId: z.string().min(1).describe('Entity type identifier'),\n  attachmentIds: z.array(z.string().uuid()).min(1).describe('Array of attachment IDs to transfer'),\n  fromRecordId: z.string().min(1).optional().describe('Optional source record ID'),\n  toRecordId: z.string().min(1).describe('Target record ID'),\n})\n\nexport const transferAttachmentsResponseSchema = z.object({\n  ok: z.literal(true),\n  updated: z.number().int().describe('Number of attachments transferred'),\n})\n\nexport const imageQuerySchema = z.object({\n  width: z.coerce.number().int().min(1).max(4000).optional().describe('Target width in pixels (max 4000)'),\n  height: z.coerce.number().int().min(1).max(4000).optional().describe('Target height in pixels (max 4000)'),\n  cropType: z.enum(['cover', 'contain']).optional().describe('Resize behavior: cover (crop to fill) or contain (fit within bounds)'),\n})\n"],
-  "mappings": "AAAA,SAAS,SAAS;AAEX,MAAM,iBAAiB;AAEvB,MAAM,wBAAwB,EAClC,OAAO;AAAA,EACN,OAAO,EAAE,OAAO;AAAA,EAChB,SAAS,EAAE,QAAQ,EAAE,SAAS;AAChC,CAAC,EACA,YAAY;AAER,MAAM,2BAA2B,EAAE,OAAO;AAAA,EAC/C,IAAI,EAAE,OAAO,EAAE,KAAK;AAAA,EACpB,UAAU,EAAE,OAAO;AAAA,EACnB,UAAU,EAAE,OAAO,EAAE,IAAI;AAAA,EACzB,UAAU,EAAE,OAAO;AAAA,EACnB,eAAe,EAAE,OAAO;AAAA,EACxB,gBAAgB,EAAE,OAAO,EAAE,SAAS;AAAA,EACpC,KAAK,EAAE,OAAO,EAAE,SAAS,EAAE,SAAS;AAAA,EACpC,WAAW,EAAE,OAAO;AAAA,EACpB,MAAM,EAAE,MAAM,EAAE,OAAO,CAAC;AAAA,EACxB,aAAa,EAAE,MAAM,EAAE,QAAQ,CAAC;AAAA,EAChC,cAAc,EAAE,OAAO,EAAE,SAAS;AAAA,EAClC,SAAS,EAAE,QAAQ,EAAE,SAAS,EAAE,SAAS;AAC3C,CAAC;AAEM,MAAM,mBAAmB;AAEzB,MAAM,4BAA4B,EAAE,OAAO;AAAA,EAChD,MAAM,EAAE,OAAO,OAAO,EAAE,IAAI,CAAC,EAAE,QAAQ,CAAC,EAAE,SAAS,4BAA4B;AAAA,EAC/E,UAAU,EAAE,OAAO,OAAO,EAAE,IAAI,CAAC,EAAE,IAAI,GAAG,EAAE,QAAQ,EAAE,EAAE,SAAS,oCAAoC;AAAA,EACrG,QAAQ,EAAE,OAAO,EAAE,SAAS,EAAE,SAAS,wCAAwC;AAAA,EAC/E,WAAW,EAAE,OAAO,EAAE,SAAS,EAAE,SAAS,0BAA0B;AAAA,EACpE,MAAM,EAAE,OAAO,EAAE,SAAS,EAAE,SAAS,kCAAkC;AAAA,EACvE,WAAW,EAAE,KAAK,CAAC,YAAY,YAAY,WAAW,CAAC,EAAE,SAAS,EAAE,SAAS,kBAAkB;AAAA,EAC/F,SAAS,EAAE,KAAK,CAAC,OAAO,MAAM,CAAC,EAAE,SAAS,EAAE,SAAS,gBAAgB;AACvE,CAAC;AAEM,MAAM,mCAAmC,EAAE,OAAO;AAAA,EACvD,MAAM,EAAE,OAAO;AAAA,EACf,OAAO,EAAE,OAAO;AAAA,EAChB,aAAa,EAAE,OAAO,EAAE,SAAS;AAAA,EACjC,UAAU,EAAE,QAAQ;AACtB,CAAC;AAEM,MAAM,+BAA+B,EAAE,OAAO;AAAA,EACnD,OAAO,EAAE,MAAM,wBAAwB;AAAA,EACvC,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,YAAY;AAAA,EACpC,MAAM,EAAE,OAAO,EAAE,IAAI,EAAE,SAAS;AAAA,EAChC,UAAU,EAAE,OAAO,EAAE,IAAI,EAAE,SAAS;AAAA,EACpC,YAAY,EAAE,OAAO,EAAE,IAAI,EAAE,SAAS;AAAA,EACtC,eAAe,EAAE,MAAM,EAAE,OAAO,CAAC;AAAA,EACjC,YAAY,EAAE,MAAM,gCAAgC;AACtD,CAAC;AAEM,MAAM,6BAA6B,EAAE,OAAO;AAAA,EACjD,IAAI,EAAE,OAAO,EAAE,KAAK;AAAA,EACpB,UAAU,EAAE,OAAO;AAAA,EACnB,UAAU,EAAE,OAAO,EAAE,IAAI;AAAA,EACzB,UAAU,EAAE,OAAO;AAAA,EACnB,eAAe,EAAE,OAAO;AAAA,EACxB,gBAAgB,EAAE,OAAO,EAAE,SAAS;AAAA,EACpC,MAAM,EAAE,MAAM,EAAE,OAAO,CAAC;AAAA,EACxB,aAAa,EAAE,MAAM,EAAE,QAAQ,CAAC;AAAA,EAChC,SAAS,EAAE,QAAQ,EAAE,SAAS,EAAE,SAAS;AAAA,EACzC,cAAc,EAAE,QAAQ,EAAE,SAAS,EAAE,SAAS;AAChD,CAAC;AAEM,MAAM,iCAAiC,EAAE,OAAO;AAAA,EACrD,MAAM;AACR,CAAC;AAEM,MAAM,kBAAkB,EAAE,OAAO;AAAA,EACtC,IAAI,EAAE,OAAO,EAAE,KAAK;AAAA,EACpB,MAAM,EAAE,OAAO;AAAA,EACf,OAAO,EAAE,OAAO;AAAA,EAChB,aAAa,EAAE,OAAO,EAAE,SAAS;AAAA,EACjC,UAAU,EAAE,QAAQ;AAAA,EACpB,aAAa,EAAE,QAAQ;AAAA,EACvB,UAAU,EAAE,OAAO,EAAE,SAAS;AAAA,EAC9B,WAAW,EAAE,OAAO,EAAE,SAAS;AAAA,EAC/B,WAAW,EAAE,OAAO,EAAE,SAAS;AAAA,EAC/B,QAAQ,EAAE,OAAO;AACnB,CAAC;AAEM,MAAM,8BAA8B,EAAE,OAAO;AAAA,EAClD,OAAO,EAAE,MAAM,eAAe;AAChC,CAAC;AAEM,MAAM,wBAAwB,EAAE,OAAO;AAAA,EAC5C,MAAM,EACH,OAAO,EACP,IAAI,CAAC,EACL,IAAI,EAAE,EACN,MAAM,kBAAkB,EACxB,SAAS,wDAAwD;AAAA,EACpE,OAAO,EAAE,OAAO,EAAE,IAAI,CAAC,EAAE,IAAI,GAAG,EAAE,SAAS,iBAAiB;AAAA,EAC5D,aAAa,EAAE,OAAO,EAAE,IAAI,GAAG,EAAE,SAAS,EAAE,SAAS,EAAE,SAAS,sBAAsB;AAAA,EACtF,UAAU,EAAE,QAAQ,EAAE,SAAS,EAAE,SAAS,0CAA0C;AAAA,EACpF,aAAa,EAAE,QAAQ,EAAE,SAAS,EAAE,SAAS,4CAA4C;AAAA,EACzF,UAAU,EAAE,OAAO,EAAE,IAAI,EAAE,EAAE,SAAS,EAAE,SAAS,EAAE,SAAS,kBAAkB;AAChF,CAAC;AAEM,MAAM,wBAAwB,sBAAsB,OAAO;AAAA,EAChE,IAAI,EAAE,OAAO,EAAE,KAAK,EAAE,SAAS,cAAc;AAC/C,CAAC;AAEM,MAAM,0BAA0B,EAAE,OAAO;AAAA,EAC9C,MAAM;AACR,CAAC;AAEM,MAAM,mCAAmC,EAAE,OAAO;AAAA,EACvD,UAAU,EAAE,OAAO,EAAE,IAAI,CAAC,EAAE,SAAS,wBAAwB;AAAA,EAC7D,eAAe,EAAE,MAAM,EAAE,OAAO,EAAE,KAAK,CAAC,EAAE,IAAI,CAAC,EAAE,SAAS,qCAAqC;AAAA,EAC/F,cAAc,EAAE,OAAO,EAAE,IAAI,CAAC,EAAE,SAAS,EAAE,SAAS,2BAA2B;AAAA,EAC/E,YAAY,EAAE,OAAO,EAAE,IAAI,CAAC,EAAE,SAAS,kBAAkB;AAC3D,CAAC;AAEM,MAAM,oCAAoC,EAAE,OAAO;AAAA,EACxD,IAAI,EAAE,QAAQ,IAAI;AAAA,EAClB,SAAS,EAAE,OAAO,EAAE,IAAI,EAAE,SAAS,mCAAmC;AACxE,CAAC;AAEM,MAAM,mBAAmB,EAAE,OAAO;AAAA,EACvC,OAAO,EAAE,OAAO,OAAO,EAAE,IAAI,EAAE,IAAI,CAAC,EAAE,IAAI,GAAI,EAAE,SAAS,EAAE,SAAS,mCAAmC;AAAA,EACvG,QAAQ,EAAE,OAAO,OAAO,EAAE,IAAI,EAAE,IAAI,CAAC,EAAE,IAAI,GAAI,EAAE,SAAS,EAAE,SAAS,oCAAoC;AAAA,EACzG,UAAU,EAAE,KAAK,CAAC,SAAS,SAAS,CAAC,EAAE,SAAS,EAAE,SAAS,sEAAsE;AACnI,CAAC;",
+  "sourcesContent": ["import { z } from 'zod'\n\nexport const attachmentsTag = 'Attachments'\n\nexport const attachmentErrorSchema = z\n  .object({\n    error: z.string(),\n    details: z.unknown().optional(),\n  })\n  .passthrough()\n\nexport const attachmentListItemSchema = z.object({\n  id: z.string().uuid(),\n  fileName: z.string(),\n  fileSize: z.number().int(),\n  mimeType: z.string(),\n  partitionCode: z.string(),\n  partitionTitle: z.string().nullable(),\n  url: z.string().nullable().optional(),\n  createdAt: z.string(),\n  tags: z.array(z.string()),\n  assignments: z.array(z.unknown()),\n  thumbnailUrl: z.string().optional(),\n  content: z.unknown().nullable().optional(),\n})\n\nexport const attachmentSchema = attachmentListItemSchema\n\nexport const attachmentListQuerySchema = z.object({\n  page: z.coerce.number().min(1).default(1).describe('Page number for pagination'),\n  pageSize: z.coerce.number().min(1).max(100).default(25).describe('Number of items per page (max 100)'),\n  search: z.string().optional().describe('Search by file name (case-insensitive)'),\n  partition: z.string().optional().describe('Filter by partition code'),\n  tags: z.string().optional().describe('Filter by tags (comma-separated)'),\n  sortField: z.enum(['fileName', 'fileSize', 'createdAt']).optional().describe('Field to sort by'),\n  sortDir: z.enum(['asc', 'desc']).optional().describe('Sort direction'),\n})\n\nexport const attachmentLibraryPartitionSchema = z.object({\n  code: z.string(),\n  title: z.string(),\n  description: z.string().nullable(),\n  isPublic: z.boolean(),\n})\n\nexport const attachmentListResponseSchema = z.object({\n  items: z.array(attachmentListItemSchema),\n  total: z.number().int().nonnegative(),\n  page: z.number().int().positive(),\n  pageSize: z.number().int().positive(),\n  totalPages: z.number().int().positive(),\n  availableTags: z.array(z.string()),\n  partitions: z.array(attachmentLibraryPartitionSchema),\n})\n\nexport const attachmentDetailItemSchema = z.object({\n  id: z.string().uuid(),\n  fileName: z.string(),\n  fileSize: z.number().int(),\n  mimeType: z.string(),\n  partitionCode: z.string(),\n  partitionTitle: z.string().nullable(),\n  tags: z.array(z.string()),\n  assignments: z.array(z.unknown()),\n  content: z.unknown().nullable().optional(),\n  customFields: z.unknown().nullable().optional(),\n})\n\nexport const attachmentDetailResponseSchema = z.object({\n  item: attachmentDetailItemSchema,\n})\n\nexport const partitionSchema = z.object({\n  id: z.string().uuid(),\n  code: z.string(),\n  title: z.string(),\n  description: z.string().nullable(),\n  isPublic: z.boolean(),\n  requiresOcr: z.boolean(),\n  ocrModel: z.string().nullable(),\n  storageDriver: z.string().optional().describe('Storage driver: local (default) or s3'),\n  configJson: z.record(z.string(), z.unknown()).nullable().optional().describe('Driver-specific configuration'),\n  createdAt: z.string().nullable(),\n  updatedAt: z.string().nullable(),\n  envKey: z.string(),\n})\n\nexport const partitionListResponseSchema = z.object({\n  items: z.array(partitionSchema),\n})\n\nexport const partitionCreateSchema = z.object({\n  code: z\n    .string()\n    .min(2)\n    .max(60)\n    .regex(/^[A-Za-z0-9_-]+$/)\n    .describe('Partition code (letters, numbers, dashes, underscores)'),\n  title: z.string().min(1).max(120).describe('Partition title'),\n  description: z.string().max(500).nullable().optional().describe('Optional description'),\n  isPublic: z.boolean().optional().describe('Whether partition is publicly accessible'),\n  requiresOcr: z.boolean().optional().describe('Whether OCR should be performed on uploads'),\n  ocrModel: z.string().max(50).nullable().optional().describe('OCR model to use'),\n  storageDriver: z.enum(['local', 's3']).optional().default('local').describe('Storage driver to use'),\n  configJson: z.record(z.string(), z.unknown()).nullable().optional().describe('Driver-specific configuration (e.g. S3 bucket, region, endpoint)'),\n})\n\nexport const partitionUpdateSchema = partitionCreateSchema.extend({\n  id: z.string().uuid().describe('Partition ID'),\n})\n\nexport const partitionResponseSchema = z.object({\n  item: partitionSchema,\n})\n\nexport const transferAttachmentsRequestSchema = z.object({\n  entityId: z.string().min(1).describe('Entity type identifier'),\n  attachmentIds: z.array(z.string().uuid()).min(1).describe('Array of attachment IDs to transfer'),\n  fromRecordId: z.string().min(1).optional().describe('Optional source record ID'),\n  toRecordId: z.string().min(1).describe('Target record ID'),\n})\n\nexport const transferAttachmentsResponseSchema = z.object({\n  ok: z.literal(true),\n  updated: z.number().int().describe('Number of attachments transferred'),\n})\n\nexport const imageQuerySchema = z.object({\n  width: z.coerce.number().int().min(1).max(4000).optional().describe('Target width in pixels (max 4000)'),\n  height: z.coerce.number().int().min(1).max(4000).optional().describe('Target height in pixels (max 4000)'),\n  cropType: z.enum(['cover', 'contain']).optional().describe('Resize behavior: cover (crop to fill) or contain (fit within bounds)'),\n})\n"],
+  "mappings": "AAAA,SAAS,SAAS;AAEX,MAAM,iBAAiB;AAEvB,MAAM,wBAAwB,EAClC,OAAO;AAAA,EACN,OAAO,EAAE,OAAO;AAAA,EAChB,SAAS,EAAE,QAAQ,EAAE,SAAS;AAChC,CAAC,EACA,YAAY;AAER,MAAM,2BAA2B,EAAE,OAAO;AAAA,EAC/C,IAAI,EAAE,OAAO,EAAE,KAAK;AAAA,EACpB,UAAU,EAAE,OAAO;AAAA,EACnB,UAAU,EAAE,OAAO,EAAE,IAAI;AAAA,EACzB,UAAU,EAAE,OAAO;AAAA,EACnB,eAAe,EAAE,OAAO;AAAA,EACxB,gBAAgB,EAAE,OAAO,EAAE,SAAS;AAAA,EACpC,KAAK,EAAE,OAAO,EAAE,SAAS,EAAE,SAAS;AAAA,EACpC,WAAW,EAAE,OAAO;AAAA,EACpB,MAAM,EAAE,MAAM,EAAE,OAAO,CAAC;AAAA,EACxB,aAAa,EAAE,MAAM,EAAE,QAAQ,CAAC;AAAA,EAChC,cAAc,EAAE,OAAO,EAAE,SAAS;AAAA,EAClC,SAAS,EAAE,QAAQ,EAAE,SAAS,EAAE,SAAS;AAC3C,CAAC;AAEM,MAAM,mBAAmB;AAEzB,MAAM,4BAA4B,EAAE,OAAO;AAAA,EAChD,MAAM,EAAE,OAAO,OAAO,EAAE,IAAI,CAAC,EAAE,QAAQ,CAAC,EAAE,SAAS,4BAA4B;AAAA,EAC/E,UAAU,EAAE,OAAO,OAAO,EAAE,IAAI,CAAC,EAAE,IAAI,GAAG,EAAE,QAAQ,EAAE,EAAE,SAAS,oCAAoC;AAAA,EACrG,QAAQ,EAAE,OAAO,EAAE,SAAS,EAAE,SAAS,wCAAwC;AAAA,EAC/E,WAAW,EAAE,OAAO,EAAE,SAAS,EAAE,SAAS,0BAA0B;AAAA,EACpE,MAAM,EAAE,OAAO,EAAE,SAAS,EAAE,SAAS,kCAAkC;AAAA,EACvE,WAAW,EAAE,KAAK,CAAC,YAAY,YAAY,WAAW,CAAC,EAAE,SAAS,EAAE,SAAS,kBAAkB;AAAA,EAC/F,SAAS,EAAE,KAAK,CAAC,OAAO,MAAM,CAAC,EAAE,SAAS,EAAE,SAAS,gBAAgB;AACvE,CAAC;AAEM,MAAM,mCAAmC,EAAE,OAAO;AAAA,EACvD,MAAM,EAAE,OAAO;AAAA,EACf,OAAO,EAAE,OAAO;AAAA,EAChB,aAAa,EAAE,OAAO,EAAE,SAAS;AAAA,EACjC,UAAU,EAAE,QAAQ;AACtB,CAAC;AAEM,MAAM,+BAA+B,EAAE,OAAO;AAAA,EACnD,OAAO,EAAE,MAAM,wBAAwB;AAAA,EACvC,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,YAAY;AAAA,EACpC,MAAM,EAAE,OAAO,EAAE,IAAI,EAAE,SAAS;AAAA,EAChC,UAAU,EAAE,OAAO,EAAE,IAAI,EAAE,SAAS;AAAA,EACpC,YAAY,EAAE,OAAO,EAAE,IAAI,EAAE,SAAS;AAAA,EACtC,eAAe,EAAE,MAAM,EAAE,OAAO,CAAC;AAAA,EACjC,YAAY,EAAE,MAAM,gCAAgC;AACtD,CAAC;AAEM,MAAM,6BAA6B,EAAE,OAAO;AAAA,EACjD,IAAI,EAAE,OAAO,EAAE,KAAK;AAAA,EACpB,UAAU,EAAE,OAAO;AAAA,EACnB,UAAU,EAAE,OAAO,EAAE,IAAI;AAAA,EACzB,UAAU,EAAE,OAAO;AAAA,EACnB,eAAe,EAAE,OAAO;AAAA,EACxB,gBAAgB,EAAE,OAAO,EAAE,SAAS;AAAA,EACpC,MAAM,EAAE,MAAM,EAAE,OAAO,CAAC;AAAA,EACxB,aAAa,EAAE,MAAM,EAAE,QAAQ,CAAC;AAAA,EAChC,SAAS,EAAE,QAAQ,EAAE,SAAS,EAAE,SAAS;AAAA,EACzC,cAAc,EAAE,QAAQ,EAAE,SAAS,EAAE,SAAS;AAChD,CAAC;AAEM,MAAM,iCAAiC,EAAE,OAAO;AAAA,EACrD,MAAM;AACR,CAAC;AAEM,MAAM,kBAAkB,EAAE,OAAO;AAAA,EACtC,IAAI,EAAE,OAAO,EAAE,KAAK;AAAA,EACpB,MAAM,EAAE,OAAO;AAAA,EACf,OAAO,EAAE,OAAO;AAAA,EAChB,aAAa,EAAE,OAAO,EAAE,SAAS;AAAA,EACjC,UAAU,EAAE,QAAQ;AAAA,EACpB,aAAa,EAAE,QAAQ;AAAA,EACvB,UAAU,EAAE,OAAO,EAAE,SAAS;AAAA,EAC9B,eAAe,EAAE,OAAO,EAAE,SAAS,EAAE,SAAS,uCAAuC;AAAA,EACrF,YAAY,EAAE,OAAO,EAAE,OAAO,GAAG,EAAE,QAAQ,CAAC,EAAE,SAAS,EAAE,SAAS,EAAE,SAAS,+BAA+B;AAAA,EAC5G,WAAW,EAAE,OAAO,EAAE,SAAS;AAAA,EAC/B,WAAW,EAAE,OAAO,EAAE,SAAS;AAAA,EAC/B,QAAQ,EAAE,OAAO;AACnB,CAAC;AAEM,MAAM,8BAA8B,EAAE,OAAO;AAAA,EAClD,OAAO,EAAE,MAAM,eAAe;AAChC,CAAC;AAEM,MAAM,wBAAwB,EAAE,OAAO;AAAA,EAC5C,MAAM,EACH,OAAO,EACP,IAAI,CAAC,EACL,IAAI,EAAE,EACN,MAAM,kBAAkB,EACxB,SAAS,wDAAwD;AAAA,EACpE,OAAO,EAAE,OAAO,EAAE,IAAI,CAAC,EAAE,IAAI,GAAG,EAAE,SAAS,iBAAiB;AAAA,EAC5D,aAAa,EAAE,OAAO,EAAE,IAAI,GAAG,EAAE,SAAS,EAAE,SAAS,EAAE,SAAS,sBAAsB;AAAA,EACtF,UAAU,EAAE,QAAQ,EAAE,SAAS,EAAE,SAAS,0CAA0C;AAAA,EACpF,aAAa,EAAE,QAAQ,EAAE,SAAS,EAAE,SAAS,4CAA4C;AAAA,EACzF,UAAU,EAAE,OAAO,EAAE,IAAI,EAAE,EAAE,SAAS,EAAE,SAAS,EAAE,SAAS,kBAAkB;AAAA,EAC9E,eAAe,EAAE,KAAK,CAAC,SAAS,IAAI,CAAC,EAAE,SAAS,EAAE,QAAQ,OAAO,EAAE,SAAS,uBAAuB;AAAA,EACnG,YAAY,EAAE,OAAO,EAAE,OAAO,GAAG,EAAE,QAAQ,CAAC,EAAE,SAAS,EAAE,SAAS,EAAE,SAAS,kEAAkE;AACjJ,CAAC;AAEM,MAAM,wBAAwB,sBAAsB,OAAO;AAAA,EAChE,IAAI,EAAE,OAAO,EAAE,KAAK,EAAE,SAAS,cAAc;AAC/C,CAAC;AAEM,MAAM,0BAA0B,EAAE,OAAO;AAAA,EAC9C,MAAM;AACR,CAAC;AAEM,MAAM,mCAAmC,EAAE,OAAO;AAAA,EACvD,UAAU,EAAE,OAAO,EAAE,IAAI,CAAC,EAAE,SAAS,wBAAwB;AAAA,EAC7D,eAAe,EAAE,MAAM,EAAE,OAAO,EAAE,KAAK,CAAC,EAAE,IAAI,CAAC,EAAE,SAAS,qCAAqC;AAAA,EAC/F,cAAc,EAAE,OAAO,EAAE,IAAI,CAAC,EAAE,SAAS,EAAE,SAAS,2BAA2B;AAAA,EAC/E,YAAY,EAAE,OAAO,EAAE,IAAI,CAAC,EAAE,SAAS,kBAAkB;AAC3D,CAAC;AAEM,MAAM,oCAAoC,EAAE,OAAO;AAAA,EACxD,IAAI,EAAE,QAAQ,IAAI;AAAA,EAClB,SAAS,EAAE,OAAO,EAAE,IAAI,EAAE,SAAS,mCAAmC;AACxE,CAAC;AAEM,MAAM,mBAAmB,EAAE,OAAO;AAAA,EACvC,OAAO,EAAE,OAAO,OAAO,EAAE,IAAI,EAAE,IAAI,CAAC,EAAE,IAAI,GAAI,EAAE,SAAS,EAAE,SAAS,mCAAmC;AAAA,EACvG,QAAQ,EAAE,OAAO,OAAO,EAAE,IAAI,EAAE,IAAI,CAAC,EAAE,IAAI,GAAI,EAAE,SAAS,EAAE,SAAS,oCAAoC;AAAA,EACzG,UAAU,EAAE,KAAK,CAAC,SAAS,SAAS,CAAC,EAAE,SAAS,EAAE,SAAS,sEAAsE;AACnI,CAAC;",
   "names": []
 }

package/dist/modules/attachments/api/partitions/route.js

@@ -27,6 +27,8 @@ function serializePartition(entry) {
     isPublic: entry.isPublic ?? false,
     requiresOcr: entry.requiresOcr ?? resolveDefaultAttachmentOcrEnabled(),
     ocrModel: entry.ocrModel ?? null,
+    storageDriver: entry.storageDriver ?? "local",
+    configJson: entry.configJson ?? null,
     createdAt: entry.createdAt instanceof Date ? entry.createdAt.toISOString() : null,
     updatedAt: entry.updatedAt instanceof Date ? entry.updatedAt.toISOString() : null,
     envKey: resolvePartitionEnvKey(entry.code)
@@ -87,7 +89,8 @@ async function POST(req) {
     code,
     title: parsed.data.title.trim(),
     description: parsed.data.description?.trim() ?? null,
-    storageDriver: "local",
+    storageDriver: parsed.data.storageDriver ?? "local",
+    configJson: parsed.data.configJson ?? null,
     isPublic: parsed.data.isPublic ?? false,
     requiresOcr: typeof parsed.data.requiresOcr === "boolean" ? parsed.data.requiresOcr : resolveDefaultAttachmentOcrEnabled(),
     ocrModel: parsed.data.ocrModel?.trim() || null
@@ -133,6 +136,12 @@ async function PUT(req) {
   if (parsed.data.ocrModel !== void 0) {
     entry.ocrModel = parsed.data.ocrModel?.trim() || null;
   }
+  if (parsed.data.storageDriver !== void 0) {
+    entry.storageDriver = parsed.data.storageDriver;
+  }
+  if (parsed.data.configJson !== void 0) {
+    entry.configJson = parsed.data.configJson ?? null;
+  }
   await em.persist(entry).flush();
   return NextResponse.json({ item: serializePartition(entry) });
 }