@open-mercato/core 0.6.6 → 0.6.7-develop.6552.1.5208a19369

package/dist/modules/attachments/api/route.js.map

@@ -1,7 +1,7 @@
 {
   "version": 3,
   "sources": ["../../../../src/modules/attachments/api/route.ts"],
-  "sourcesContent": ["import { NextResponse } from 'next/server'\nimport { createRequestContainer } from '@open-mercato/shared/lib/di/container'\nimport { getAuthFromRequest } from '@open-mercato/shared/lib/auth/server'\nimport { z } from 'zod'\nimport { sql } from 'kysely'\nimport type { OpenApiRouteDoc } from '@open-mercato/shared/lib/openapi'\nimport { buildAttachmentFileUrl, buildAttachmentImageUrl, slugifyAttachmentFileName } from '../lib/imageUrls'\nimport { ensureDefaultPartitions, resolveDefaultPartitionCode, sanitizePartitionCode } from '../lib/partitions'\nimport { Attachment, AttachmentPartition } from '../data/entities'\nimport { extractAttachmentContent } from '../lib/textExtraction'\nimport { requestOcrProcessing } from '../lib/ocrQueue'\nimport { StorageDriverFactory } from '../lib/drivers'\nimport { OcrService, shouldUseLlmOcr } from '../lib/ocrService'\nimport { clearAttachmentThumbnailCache } from '../lib/thumbnailCache'\nimport { assertAttachmentScopeInvariant } from '../lib/access'\nimport {\n  mergeAttachmentMetadata,\n  normalizeAttachmentAssignments,\n  normalizeAttachmentTags,\n  readAttachmentMetadata,\n  upsertAssignment,\n  type AttachmentAssignment,\n} from '../lib/metadata'\nimport { randomUUID } from 'crypto'\nimport type { EntityManager } from '@mikro-orm/postgresql'\nimport { splitCustomFieldPayload } from '@open-mercato/shared/lib/crud/custom-fields'\nimport { emitCrudSideEffects, setCustomFieldsIfAny } from '@open-mercato/shared/lib/commands/helpers'\nimport { resolveTranslations } from '@open-mercato/shared/lib/i18n/server'\nimport { attachmentCrudEvents, attachmentCrudIndexer } from '../lib/crud'\nimport { E } from '#generated/entities.ids.generated'\nimport { resolveDefaultAttachmentOcrEnabled } from '../lib/ocrConfig'\nimport {\n  detectAttachmentMimeType,\n  hasDangerousExecutableExtension,\n  isActiveContentAttachment,\n  sanitizeUploadedFileName,\n} from '../lib/security'\nimport {\n  isMultipartRequestWithinUploadLimit,\n  resolveAttachmentMaxBytes,\n  willExceedAttachmentTenantQuota,\n} from '../lib/upload-limits'\nimport { findWithDecryption } from '@open-mercato/shared/lib/encryption/find'\nimport { createLogger } from '@open-mercato/shared/lib/logger'\n\nconst logger = createLogger('attachments')\n\nexport const metadata = {\n  GET: { requireAuth: true, requireFeatures: ['attachments.view'] },\n  POST: { requireAuth: true, requireFeatures: ['attachments.manage'] },\n  DELETE: { requireAuth: true, requireFeatures: ['attachments.manage'] },\n}\n\nconst attachmentQuerySchema = z.object({\n  entityId: z.string().min(1).describe('Entity identifier that owns the attachments'),\n  recordId: z.string().min(1).describe('Record identifier within the entity'),\n  page: z.coerce.number().min(1).optional(),\n  pageSize: z.coerce.number().min(1).max(100).optional(),\n})\n\nconst attachmentAssignmentSchema = z.object({\n  type: z.string().describe('Assignment type identifier'),\n  id: z.string().describe('Assignment record identifier'),\n  href: z.string().nullable().optional().describe('Optional link to the related record'),\n  label: z.string().nullable().optional().describe('Optional label for the assignment'),\n})\n\nconst attachmentItemSchema = z.object({\n  id: z.string().describe('Attachment identifier'),\n  url: z.string().describe('Public path to the stored asset'),\n  fileName: z.string().describe('Original filename'),\n  fileSize: z.number().int().nonnegative().describe('File size in bytes'),\n  createdAt: z.string().describe('Upload timestamp (ISO 8601)'),\n  mimeType: z.string().nullable().optional().describe('MIME type of the file'),\n  thumbnailUrl: z.string().optional().describe('Helper route that renders a thumbnail'),\n  partitionCode: z.string().optional().describe('Partition identifier'),\n  tags: z.array(z.string()).optional().describe('Tags assigned to the attachment'),\n  content: z.string().nullable().optional().describe('Extracted text or markdown content'),\n  assignments: z.array(attachmentAssignmentSchema).optional().describe('Records that reference this attachment'),\n})\n\nconst attachmentListResponseSchema = z.object({\n  items: z.array(attachmentItemSchema),\n  total: z.number().int().nonnegative().optional(),\n  page: z.number().int().min(1).optional(),\n  pageSize: z.number().int().min(1).optional(),\n  totalPages: z.number().int().min(1).optional(),\n})\n\nconst attachmentUploadBodySchema = z.object({\n  entityId: z.string().min(1),\n  recordId: z.string().min(1),\n  fieldKey: z.string().optional(),\n  file: z.string().min(1).describe('Binary file payload; supplied as multipart form-data'),\n  customFields: z\n    .string()\n    .optional()\n    .describe('JSON encoded map of custom field values collected from the upload form.'),\n})\n\nconst attachmentDeleteQuerySchema = z.object({\n  id: z.string().uuid(),\n})\n\nconst uploadResponseSchema = z.object({\n  ok: z.literal(true),\n  item: z.object({\n    id: z.string(),\n    url: z.string(),\n    fileName: z.string(),\n    fileSize: z.number().int().nonnegative(),\n    thumbnailUrl: z.string().optional(),\n    content: z.string().nullable().optional(),\n    tags: z.array(z.string()).optional(),\n    assignments: z.array(attachmentAssignmentSchema).optional(),\n    customFields: z.record(z.string(), z.unknown()).optional(),\n  }),\n})\n\nconst errorSchema = z.object({\n  error: z.string(),\n})\n\nconst LIBRARY_ENTITY_ID = 'attachments:library'\n\nfunction parseCustomFieldsEntry(value: FormDataEntryValue | null): Record<string, unknown> {\n  if (!value) return {}\n  if (typeof value === 'string') {\n    const trimmed = value.trim()\n    if (!trimmed) return {}\n    try {\n      const parsed = JSON.parse(trimmed)\n      if (parsed && typeof parsed === 'object' && !Array.isArray(parsed)) {\n        return parsed as Record<string, unknown>\n      }\n    } catch {\n      return {}\n    }\n  }\n  if (typeof value === 'object' && !Array.isArray(value) && !(value instanceof File)) {\n    return { ...(value as Record<string, unknown>) }\n  }\n  return {}\n}\n\nfunction buildFormPayload(form: FormData): Record<string, unknown> {\n  const payload: Record<string, unknown> = {}\n  form.forEach((value, key) => {\n    if (key === 'customFields') {\n      payload.customFields = parseCustomFieldsEntry(value)\n      return\n    }\n    payload[key] = value\n  })\n  return payload\n}\n\nfunction parseFormTags(value: FormDataEntryValue | null): string[] {\n  if (!value) return []\n  if (typeof value === 'string') {\n    const trimmed = value.trim()\n    if (!trimmed) return []\n    try {\n      const parsed = JSON.parse(trimmed)\n      return normalizeAttachmentTags(parsed)\n    } catch {\n      return normalizeAttachmentTags(value)\n    }\n  }\n  return []\n}\n\nfunction parseFormAssignments(value: FormDataEntryValue | null): AttachmentAssignment[] {\n  if (!value) return []\n  if (typeof value !== 'string') return []\n  const trimmed = value.trim()\n  if (!trimmed) return []\n  try {\n    const parsed = JSON.parse(trimmed)\n    return normalizeAttachmentAssignments(parsed)\n  } catch {\n    return []\n  }\n}\n\nexport async function GET(req: Request) {\n  const auth = await getAuthFromRequest(req)\n  if (!auth || !auth.tenantId || (!auth.orgId && !auth.isSuperAdmin)) return NextResponse.json({ error: 'Unauthorized' }, { status: 401 })\n  const url = new URL(req.url)\n  const parsedQuery = attachmentQuerySchema.safeParse({\n    entityId: url.searchParams.get('entityId') || '',\n    recordId: url.searchParams.get('recordId') || '',\n    page: url.searchParams.get('page') ?? undefined,\n    pageSize: url.searchParams.get('pageSize') ?? undefined,\n  })\n  if (!parsedQuery.success) {\n    return NextResponse.json({ error: 'entityId and recordId are required' }, { status: 400 })\n  }\n  const { entityId, recordId, page, pageSize } = parsedQuery.data\n\n  const { resolve } = await createRequestContainer()\n  const em = resolve('em') as EntityManager\n  const filter: Record<string, unknown> = { entityId, recordId, tenantId: auth.tenantId! }\n  if (auth.orgId) filter.organizationId = auth.orgId\n  const orderBy: Record<string, 'ASC' | 'DESC'> = { createdAt: 'DESC' }\n  const usePaging = typeof page === 'number' && typeof pageSize === 'number'\n  const total = usePaging ? await em.count(Attachment, filter) : null\n  const currentPage = usePaging ? Math.max(1, page) : null\n  const currentPageSize = usePaging ? pageSize : null\n  const totalPages = usePaging && total !== null ? Math.max(1, Math.ceil(total / currentPageSize!)) : null\n  const pageOffset = usePaging ? (Math.min(currentPage!, totalPages!) - 1) * currentPageSize! : undefined\n  const items = await findWithDecryption(\n    em,\n    Attachment,\n    filter,\n    {\n      orderBy,\n      ...(usePaging\n        ? {\n            limit: currentPageSize!,\n            offset: pageOffset,\n          }\n        : {}),\n    },\n    {\n      tenantId: auth.tenantId ?? null,\n      organizationId: auth.orgId ?? null,\n    },\n  )\n  return NextResponse.json({\n    items: items.map((a: any) => {\n      const metadata = readAttachmentMetadata(a.storageMetadata)\n      return {\n        id: a.id,\n        url: a.url,\n        fileName: a.fileName,\n        fileSize: a.fileSize,\n        createdAt: a.createdAt,\n        mimeType: a.mimeType ?? null,\n        partitionCode: a.partitionCode,\n        content: a.content ?? null,\n        thumbnailUrl: buildAttachmentImageUrl(a.id, {\n          width: 320,\n          height: 320,\n          slug: slugifyAttachmentFileName(a.fileName),\n        }),\n        tags: metadata.tags ?? [],\n        assignments: metadata.assignments ?? [],\n      }\n    }),\n    ...(usePaging\n      ? {\n          total,\n          page: Math.min(currentPage!, totalPages!),\n          pageSize: currentPageSize,\n          totalPages,\n        }\n      : {}),\n  })\n}\n\nexport async function POST(req: Request) {\n  const { t } = await resolveTranslations()\n  const auth = await getAuthFromRequest(req)\n  if (!auth || !auth.tenantId || (!auth.orgId && !auth.isSuperAdmin)) return NextResponse.json({ error: 'Unauthorized' }, { status: 401 })\n  // A superadmin browsing with \"All organizations\" selected has no concrete\n  // organization scope, but an attachment must be stored under exactly one\n  // organization (the scope invariant forbids partial-null rows). Reject with a\n  // clear, actionable error instead of a 401 \u2014 a 401 makes the client-side\n  // fetch layer treat it as session expiry, show a misleading toast, and reset\n  // the in-progress form (#3764).\n  if (!auth.orgId) {\n    return NextResponse.json({\n      error: t('attachments.errors.selectOrganization', 'Select a specific organization before uploading an attachment.'),\n    }, { status: 400 })\n  }\n  const tenantId = auth.tenantId\n  const orgId = auth.orgId\n\n  const contentType = req.headers.get('content-type') || ''\n  if (!contentType.toLowerCase().includes('multipart/form-data')) {\n    return NextResponse.json({ error: 'Expected multipart/form-data' }, { status: 400 })\n  }\n  if (!isMultipartRequestWithinUploadLimit(req.headers.get('content-length'))) {\n    return NextResponse.json({ error: 'Attachment exceeds the maximum upload size.' }, { status: 413 })\n  }\n\n  const form = await req.formData()\n  const formPayload = buildFormPayload(form)\n  const customFieldValues = splitCustomFieldPayload(formPayload).custom\n  const entityId = String(form.get('entityId') || '')\n  const recordId = String(form.get('recordId') || '')\n  const fieldKey = String(form.get('fieldKey') || '')\n  const file = form.get('file') as unknown as File | null\n  if (!entityId || !recordId || !file) return NextResponse.json({ error: 'entityId, recordId and file are required' }, { status: 400 })\n  const partitionOverrideRaw = form.get('partitionCode')\n  const partitionOverride =\n    typeof partitionOverrideRaw === 'string' && partitionOverrideRaw.trim().length > 0\n      ? sanitizePartitionCode(partitionOverrideRaw)\n      : null\n  const tags = parseFormTags(form.get('tags'))\n  const assignmentsFromForm = parseFormAssignments(form.get('assignments'))\n\n  const { resolve } = await createRequestContainer()\n  const em = resolve('em') as EntityManager\n  const dataEngine = resolve('dataEngine')\n  const storageDriverFactory =\n    (resolve('storageDriverFactory') as StorageDriverFactory | null) ?? new StorageDriverFactory(em)\n  await ensureDefaultPartitions(em)\n  // Optional per-field validations\n  let partitionFromField: string | null = null\n  let fieldMaxAttachmentSizeMb: number | null = null\n  if (fieldKey) {\n    try {\n      const { CustomFieldDef } = await import('@open-mercato/core/modules/entities/data/entities')\n      const def = await em.findOne(CustomFieldDef, {\n        entityId,\n        key: fieldKey,\n        $and: [\n          { $or: [ { tenantId: auth.tenantId }, { tenantId: null } ] },\n        ],\n        isActive: true,\n      })\n      const cfg = (def as any)?.configJson || {}\n      const ext = (file.name || '').split('.').pop()?.toLowerCase() || ''\n      if (Array.isArray(cfg.acceptExtensions) && cfg.acceptExtensions.length) {\n        const allowed = new Set((cfg.acceptExtensions as any[]).map((x: any) => String(x).toLowerCase().replace(/^\\./, '')))\n        if (!allowed.has(ext)) return NextResponse.json({ error: 'File type not allowed' }, { status: 400 })\n      }\n      if (typeof cfg.maxAttachmentSizeMb === 'number' && cfg.maxAttachmentSizeMb > 0) {\n        fieldMaxAttachmentSizeMb = cfg.maxAttachmentSizeMb\n      }\n      if (typeof cfg.partitionCode === 'string' && cfg.partitionCode.trim().length > 0) {\n        partitionFromField = sanitizePartitionCode(cfg.partitionCode)\n      }\n    } catch {}\n  }\n  if (hasDangerousExecutableExtension(file.name)) {\n    return NextResponse.json({\n      error: t('attachments.errors.dangerousExecutable', 'Executable file types are not allowed as attachments.'),\n    }, { status: 400 })\n  }\n  const effectiveMaxBytes = resolveAttachmentMaxBytes(fieldMaxAttachmentSizeMb)\n  if (file.size > effectiveMaxBytes) {\n    return NextResponse.json({\n      error: t('attachments.errors.maxUploadSize', 'Attachment exceeds the maximum upload size.'),\n    }, { status: 413 })\n  }\n  const tenantUsageBytes = await readTenantAttachmentUsageBytes(em, tenantId)\n  if (willExceedAttachmentTenantQuota(tenantUsageBytes, file.size)) {\n    return NextResponse.json({\n      error: t('attachments.errors.quotaExceeded', 'Attachment storage quota exceeded for this tenant.'),\n    }, { status: 413 })\n  }\n  const buf = Buffer.from(await file.arrayBuffer())\n  const safeName = sanitizeUploadedFileName(file.name)\n  const fileMimeType = detectAttachmentMimeType(buf, safeName, (file as any).type)\n  if (isActiveContentAttachment(buf, safeName, fileMimeType)) {\n    return NextResponse.json({ error: t('attachments.errors.activeContentBlocked', 'Active content uploads are not allowed.') }, { status: 400 })\n  }\n  const defaultPartitionCode = resolveDefaultPartitionCode(entityId)\n  const resolvedPartitionCode = partitionOverride ?? partitionFromField ?? defaultPartitionCode\n  const partitionCodeCandidates = Array.from(\n    new Set(\n      [partitionOverride, partitionFromField, resolvedPartitionCode].filter(\n        (code): code is string => typeof code === 'string' && code.length > 0,\n      ),\n    ),\n  )\n  let partition: AttachmentPartition | null = null\n  for (const code of partitionCodeCandidates) {\n    const record = await em.findOne(AttachmentPartition, { code })\n    if (record) {\n      partition = record\n      break\n    }\n  }\n  if (!partition) {\n    partition = await em.findOne(AttachmentPartition, { code: defaultPartitionCode })\n  }\n  if (!partition) {\n    return NextResponse.json({ error: 'Storage partition is not configured.' }, { status: 400 })\n  }\n  const requestedPublicOverride =\n    typeof partitionOverride === 'string' &&\n    partitionOverride.length > 0 &&\n    partition.code === partitionOverride &&\n    partition.isPublic === true &&\n    partition.code !== defaultPartitionCode &&\n    partition.code !== partitionFromField\n  if (requestedPublicOverride) {\n    return NextResponse.json({ error: t('attachments.errors.publicPartitionBlocked', 'Public storage partitions cannot be selected explicitly for this upload.') }, { status: 403 })\n  }\n  const uploadDriver = await storageDriverFactory.resolveForPartition(partition.code, { tenantId, organizationId: orgId })\n  let storedPath: string\n  try {\n    const stored = await uploadDriver.store({\n      partitionCode: partition.code,\n      orgId,\n      tenantId,\n      fileName: safeName,\n      buffer: buf,\n    })\n    storedPath = stored.storagePath\n  } catch (error) {\n    logger.error('Failed to persist file', { err: error })\n    return NextResponse.json({ error: 'Failed to persist attachment.' }, { status: 500 })\n  }\n\n  const requiresOcr =\n    typeof (partition as any).requiresOcr === 'boolean'\n      ? Boolean((partition as any).requiresOcr)\n      : resolveDefaultAttachmentOcrEnabled()\n  let extractedContent: string | null = null\n  const wantsLlmOcr = requiresOcr && shouldUseLlmOcr(fileMimeType, safeName)\n  const ocrService = wantsLlmOcr ? new OcrService() : null\n  const useLlmOcr = Boolean(wantsLlmOcr && ocrService?.available)\n\n  if (requiresOcr && !useLlmOcr) {\n    const { filePath: localPath, cleanup } = await uploadDriver.toLocalPath(partition.code, storedPath)\n    try {\n      extractedContent = await extractAttachmentContent({\n        filePath: localPath,\n        mimeType: fileMimeType,\n      })\n    } catch (error) {\n      logger.error('Failed to extract attachment content', { err: error })\n    } finally {\n      await cleanup().catch(() => {})\n    }\n  }\n\n  let assignments = assignmentsFromForm.slice()\n  if (entityId !== LIBRARY_ENTITY_ID) {\n    assignments = upsertAssignment(assignments, { type: entityId, id: recordId })\n  }\n  const metadata = mergeAttachmentMetadata(null, { assignments, tags })\n  const attachmentId = randomUUID()\n  assertAttachmentScopeInvariant({ tenantId: auth.tenantId, organizationId: auth.orgId })\n  const att = em.create(Attachment, {\n    id: attachmentId,\n    entityId,\n    recordId,\n    organizationId: auth.orgId!,\n    tenantId: auth.tenantId!,\n    fileName: safeName,\n    mimeType: fileMimeType,\n    fileSize: buf.length,\n    partitionCode: partition.code,\n    storageDriver: partition.storageDriver || 'local',\n    storagePath: storedPath,\n    url: buildAttachmentFileUrl(attachmentId),\n    content: extractedContent,\n    storageMetadata: metadata,\n  })\n  // Persist the attachment row and its custom-field values atomically so a\n  // custom-field failure cannot leave behind a committed orphan attachment.\n  try {\n    await em.transactional(async (tx) => {\n      await tx.persist(att).flush()\n      if (dataEngine) {\n        await setCustomFieldsIfAny({\n          dataEngine,\n          entityId: E.attachments.attachment,\n          recordId: attachmentId,\n          tenantId,\n          organizationId: orgId,\n          values: customFieldValues,\n        })\n      }\n    })\n  } catch (error) {\n    logger.error('Failed to persist attachment with custom attributes', { err: error })\n    return NextResponse.json({ error: 'Failed to save attachment attributes.' }, { status: 500 })\n  }\n\n  if (useLlmOcr) {\n    requestOcrProcessing(em, att, uploadDriver, storedPath).catch((error) => {\n      logger.error('Failed to queue OCR processing', { err: error })\n    })\n  } else if (wantsLlmOcr) {\n    logger.warn('OCR requested but OPENAI_API_KEY not configured, falling back to text extraction when available')\n  }\n\n  if (dataEngine) {\n    await emitCrudSideEffects({\n      dataEngine,\n      action: 'created',\n      entity: att,\n      identifiers: {\n        id: att.id,\n        organizationId: att.organizationId ?? null,\n        tenantId: att.tenantId ?? null,\n      },\n      events: attachmentCrudEvents,\n      indexer: attachmentCrudIndexer,\n    })\n    await dataEngine.flushOrmEntityChanges()\n  }\n\n  return NextResponse.json({\n    ok: true,\n    item: {\n      id: attachmentId,\n      url: att.url,\n      fileName: safeName,\n      fileSize: buf.length,\n      partitionCode: partition.code,\n      thumbnailUrl: buildAttachmentImageUrl(attachmentId, {\n        width: 320,\n        height: 320,\n        slug: slugifyAttachmentFileName(safeName),\n      }),\n      content: extractedContent ?? null,\n      tags: metadata.tags ?? [],\n      assignments: metadata.assignments ?? [],\n      customFields: Object.keys(customFieldValues).length ? customFieldValues : undefined,\n    },\n  })\n}\n\nasync function readTenantAttachmentUsageBytes(em: EntityManager, tenantId: string): Promise<number> {\n  try {\n    const db = em.getKysely<any>() as any\n    const row = await db\n      .selectFrom('attachments')\n      .select(sql<string>`sum(file_size)`.as('total_size'))\n      .where('tenant_id', '=', tenantId)\n      .executeTakeFirst() as { total_size: string | number | null } | undefined\n    const total = row?.total_size\n    if (typeof total === 'number') return Number.isFinite(total) ? total : 0\n    if (typeof total === 'string') {\n      const parsed = Number(total)\n      return Number.isFinite(parsed) ? parsed : 0\n    }\n    return 0\n  } catch {\n    return 0\n  }\n}\n\nexport async function DELETE(req: Request) {\n  const auth = await getAuthFromRequest(req)\n  if (!auth || !auth.tenantId || (!auth.orgId && !auth.isSuperAdmin)) return NextResponse.json({ error: 'Unauthorized' }, { status: 401 })\n  const url = new URL(req.url)\n  const id = url.searchParams.get('id') || ''\n  if (!id) return NextResponse.json({ error: 'Attachment id is required' }, { status: 400 })\n  const { resolve } = await createRequestContainer()\n  const em = resolve('em') as EntityManager\n  const dataEngine = resolve('dataEngine')\n  const storageDriverFactory =\n    (resolve('storageDriverFactory') as StorageDriverFactory | null) ?? new StorageDriverFactory(em)\n  // Mirror the GET handler's superadmin bypass: a superadmin browsing with \"All\n  // organizations\" selected has no concrete org, so scope the delete by tenant\n  // only and let them remove any attachment in the tenant. Non-superadmins stay\n  // scoped to their own organization (#3764).\n  const deleteFilter: Record<string, unknown> = { id, tenantId: auth.tenantId! }\n  if (auth.orgId) deleteFilter.organizationId = auth.orgId\n  const record = await em.findOne(Attachment, deleteFilter)\n  if (!record) return NextResponse.json({ error: 'Attachment not found' }, { status: 404 })\n  await em.remove(record).flush()\n  await clearAttachmentThumbnailCache(record.partitionCode, record.id).catch((error) => {\n    logger.error('Failed to cleanup cached thumbnails', { err: error })\n  })\n  if (record.storagePath) {\n    const delDriver = await storageDriverFactory.resolveForPartition(record.partitionCode, {\n      tenantId: record.tenantId ?? auth.tenantId!,\n      organizationId: record.organizationId ?? auth.orgId ?? '',\n    })\n    await delDriver.delete(record.partitionCode, record.storagePath)\n  }\n  if (dataEngine) {\n    await emitCrudSideEffects({\n      dataEngine,\n      action: 'deleted',\n      entity: record,\n      identifiers: {\n        id: record.id,\n        organizationId: record.organizationId ?? null,\n        tenantId: record.tenantId ?? null,\n      },\n      events: attachmentCrudEvents,\n      indexer: attachmentCrudIndexer,\n    })\n    await dataEngine.flushOrmEntityChanges()\n  }\n  return NextResponse.json({ ok: true })\n}\n\nexport const openApi: OpenApiRouteDoc = {\n  summary: 'Manage entity attachments',\n  description: 'Upload and list attachments associated with module entities and records.',\n  methods: {\n    GET: {\n      summary: 'List attachments for a record',\n      description: 'Returns uploaded attachments for the given entity record, ordered by newest first.',\n      query: attachmentQuerySchema,\n      responses: [\n        { status: 200, description: 'Attachments found for the record', schema: attachmentListResponseSchema },\n      ],\n      errors: [\n        { status: 400, description: 'Missing entity or record identifiers', schema: errorSchema },\n        { status: 401, description: 'Unauthorized', schema: errorSchema },\n      ],\n    },\n    POST: {\n      summary: 'Upload attachment',\n      description: 'Uploads a new attachment using multipart form-data and stores metadata for later retrieval.',\n      requestBody: {\n        contentType: 'multipart/form-data',\n        schema: attachmentUploadBodySchema,\n      },\n      responses: [\n        { status: 200, description: 'Attachment stored successfully', schema: uploadResponseSchema },\n      ],\n      errors: [\n        { status: 400, description: 'Payload validation error', schema: errorSchema },\n        { status: 401, description: 'Unauthorized', schema: errorSchema },\n        { status: 403, description: 'Attachment violates field constraints', schema: errorSchema },\n      ],\n    },\n    DELETE: {\n      summary: 'Delete attachment',\n      description: 'Removes an uploaded attachment and deletes the stored asset.',\n      query: attachmentDeleteQuerySchema,\n      responses: [\n        { status: 200, description: 'Attachment deleted', schema: z.object({ ok: z.literal(true) }) },\n        { status: 404, description: 'Attachment not found', schema: errorSchema },\n      ],\n      errors: [\n        { status: 400, description: 'Missing attachment identifier', schema: errorSchema },\n        { status: 401, description: 'Unauthorized', schema: errorSchema },\n      ],\n    },\n  },\n}\n"],
-  "mappings": "AAAA,SAAS,oBAAoB;AAC7B,SAAS,8BAA8B;AACvC,SAAS,0BAA0B;AACnC,SAAS,SAAS;AAClB,SAAS,WAAW;AAEpB,SAAS,wBAAwB,yBAAyB,iCAAiC;AAC3F,SAAS,yBAAyB,6BAA6B,6BAA6B;AAC5F,SAAS,YAAY,2BAA2B;AAChD,SAAS,gCAAgC;AACzC,SAAS,4BAA4B;AACrC,SAAS,4BAA4B;AACrC,SAAS,YAAY,uBAAuB;AAC5C,SAAS,qCAAqC;AAC9C,SAAS,sCAAsC;AAC/C;AAAA,EACE;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,OAEK;AACP,SAAS,kBAAkB;AAE3B,SAAS,+BAA+B;AACxC,SAAS,qBAAqB,4BAA4B;AAC1D,SAAS,2BAA2B;AACpC,SAAS,sBAAsB,6BAA6B;AAC5D,SAAS,SAAS;AAClB,SAAS,0CAA0C;AACnD;AAAA,EACE;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,OACK;AACP;AAAA,EACE;AAAA,EACA;AAAA,EACA;AAAA,OACK;AACP,SAAS,0BAA0B;AACnC,SAAS,oBAAoB;AAE7B,MAAM,SAAS,aAAa,aAAa;AAElC,MAAM,WAAW;AAAA,EACtB,KAAK,EAAE,aAAa,MAAM,iBAAiB,CAAC,kBAAkB,EAAE;AAAA,EAChE,MAAM,EAAE,aAAa,MAAM,iBAAiB,CAAC,oBAAoB,EAAE;AAAA,EACnE,QAAQ,EAAE,aAAa,MAAM,iBAAiB,CAAC,oBAAoB,EAAE;AACvE;AAEA,MAAM,wBAAwB,EAAE,OAAO;AAAA,EACrC,UAAU,EAAE,OAAO,EAAE,IAAI,CAAC,EAAE,SAAS,6CAA6C;AAAA,EAClF,UAAU,EAAE,OAAO,EAAE,IAAI,CAAC,EAAE,SAAS,qCAAqC;AAAA,EAC1E,MAAM,EAAE,OAAO,OAAO,EAAE,IAAI,CAAC,EAAE,SAAS;AAAA,EACxC,UAAU,EAAE,OAAO,OAAO,EAAE,IAAI,CAAC,EAAE,IAAI,GAAG,EAAE,SAAS;AACvD,CAAC;AAED,MAAM,6BAA6B,EAAE,OAAO;AAAA,EAC1C,MAAM,EAAE,OAAO,EAAE,SAAS,4BAA4B;AAAA,EACtD,IAAI,EAAE,OAAO,EAAE,SAAS,8BAA8B;AAAA,EACtD,MAAM,EAAE,OAAO,EAAE,SAAS,EAAE,SAAS,EAAE,SAAS,qCAAqC;AAAA,EACrF,OAAO,EAAE,OAAO,EAAE,SAAS,EAAE,SAAS,EAAE,SAAS,mCAAmC;AACtF,CAAC;AAED,MAAM,uBAAuB,EAAE,OAAO;AAAA,EACpC,IAAI,EAAE,OAAO,EAAE,SAAS,uBAAuB;AAAA,EAC/C,KAAK,EAAE,OAAO,EAAE,SAAS,iCAAiC;AAAA,EAC1D,UAAU,EAAE,OAAO,EAAE,SAAS,mBAAmB;AAAA,EACjD,UAAU,EAAE,OAAO,EAAE,IAAI,EAAE,YAAY,EAAE,SAAS,oBAAoB;AAAA,EACtE,WAAW,EAAE,OAAO,EAAE,SAAS,6BAA6B;AAAA,EAC5D,UAAU,EAAE,OAAO,EAAE,SAAS,EAAE,SAAS,EAAE,SAAS,uBAAuB;AAAA,EAC3E,cAAc,EAAE,OAAO,EAAE,SAAS,EAAE,SAAS,uCAAuC;AAAA,EACpF,eAAe,EAAE,OAAO,EAAE,SAAS,EAAE,SAAS,sBAAsB;AAAA,EACpE,MAAM,EAAE,MAAM,EAAE,OAAO,CAAC,EAAE,SAAS,EAAE,SAAS,iCAAiC;AAAA,EAC/E,SAAS,EAAE,OAAO,EAAE,SAAS,EAAE,SAAS,EAAE,SAAS,oCAAoC;AAAA,EACvF,aAAa,EAAE,MAAM,0BAA0B,EAAE,SAAS,EAAE,SAAS,wCAAwC;AAC/G,CAAC;AAED,MAAM,+BAA+B,EAAE,OAAO;AAAA,EAC5C,OAAO,EAAE,MAAM,oBAAoB;AAAA,EACnC,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,YAAY,EAAE,SAAS;AAAA,EAC/C,MAAM,EAAE,OAAO,EAAE,IAAI,EAAE,IAAI,CAAC,EAAE,SAAS;AAAA,EACvC,UAAU,EAAE,OAAO,EAAE,IAAI,EAAE,IAAI,CAAC,EAAE,SAAS;AAAA,EAC3C,YAAY,EAAE,OAAO,EAAE,IAAI,EAAE,IAAI,CAAC,EAAE,SAAS;AAC/C,CAAC;AAED,MAAM,6BAA6B,EAAE,OAAO;AAAA,EAC1C,UAAU,EAAE,OAAO,EAAE,IAAI,CAAC;AAAA,EAC1B,UAAU,EAAE,OAAO,EAAE,IAAI,CAAC;AAAA,EAC1B,UAAU,EAAE,OAAO,EAAE,SAAS;AAAA,EAC9B,MAAM,EAAE,OAAO,EAAE,IAAI,CAAC,EAAE,SAAS,sDAAsD;AAAA,EACvF,cAAc,EACX,OAAO,EACP,SAAS,EACT,SAAS,yEAAyE;AACvF,CAAC;AAED,MAAM,8BAA8B,EAAE,OAAO;AAAA,EAC3C,IAAI,EAAE,OAAO,EAAE,KAAK;AACtB,CAAC;AAED,MAAM,uBAAuB,EAAE,OAAO;AAAA,EACpC,IAAI,EAAE,QAAQ,IAAI;AAAA,EAClB,MAAM,EAAE,OAAO;AAAA,IACb,IAAI,EAAE,OAAO;AAAA,IACb,KAAK,EAAE,OAAO;AAAA,IACd,UAAU,EAAE,OAAO;AAAA,IACnB,UAAU,EAAE,OAAO,EAAE,IAAI,EAAE,YAAY;AAAA,IACvC,cAAc,EAAE,OAAO,EAAE,SAAS;AAAA,IAClC,SAAS,EAAE,OAAO,EAAE,SAAS,EAAE,SAAS;AAAA,IACxC,MAAM,EAAE,MAAM,EAAE,OAAO,CAAC,EAAE,SAAS;AAAA,IACnC,aAAa,EAAE,MAAM,0BAA0B,EAAE,SAAS;AAAA,IAC1D,cAAc,EAAE,OAAO,EAAE,OAAO,GAAG,EAAE,QAAQ,CAAC,EAAE,SAAS;AAAA,EAC3D,CAAC;AACH,CAAC;AAED,MAAM,cAAc,EAAE,OAAO;AAAA,EAC3B,OAAO,EAAE,OAAO;AAClB,CAAC;AAED,MAAM,oBAAoB;AAE1B,SAAS,uBAAuB,OAA2D;AACzF,MAAI,CAAC,MAAO,QAAO,CAAC;AACpB,MAAI,OAAO,UAAU,UAAU;AAC7B,UAAM,UAAU,MAAM,KAAK;AAC3B,QAAI,CAAC,QAAS,QAAO,CAAC;AACtB,QAAI;AACF,YAAM,SAAS,KAAK,MAAM,OAAO;AACjC,UAAI,UAAU,OAAO,WAAW,YAAY,CAAC,MAAM,QAAQ,MAAM,GAAG;AAClE,eAAO;AAAA,MACT;AAAA,IACF,QAAQ;AACN,aAAO,CAAC;AAAA,IACV;AAAA,EACF;AACA,MAAI,OAAO,UAAU,YAAY,CAAC,MAAM,QAAQ,KAAK,KAAK,EAAE,iBAAiB,OAAO;AAClF,WAAO,EAAE,GAAI,MAAkC;AAAA,EACjD;AACA,SAAO,CAAC;AACV;AAEA,SAAS,iBAAiB,MAAyC;AACjE,QAAM,UAAmC,CAAC;AAC1C,OAAK,QAAQ,CAAC,OAAO,QAAQ;AAC3B,QAAI,QAAQ,gBAAgB;AAC1B,cAAQ,eAAe,uBAAuB,KAAK;AACnD;AAAA,IACF;AACA,YAAQ,GAAG,IAAI;AAAA,EACjB,CAAC;AACD,SAAO;AACT;AAEA,SAAS,cAAc,OAA4C;AACjE,MAAI,CAAC,MAAO,QAAO,CAAC;AACpB,MAAI,OAAO,UAAU,UAAU;AAC7B,UAAM,UAAU,MAAM,KAAK;AAC3B,QAAI,CAAC,QAAS,QAAO,CAAC;AACtB,QAAI;AACF,YAAM,SAAS,KAAK,MAAM,OAAO;AACjC,aAAO,wBAAwB,MAAM;AAAA,IACvC,QAAQ;AACN,aAAO,wBAAwB,KAAK;AAAA,IACtC;AAAA,EACF;AACA,SAAO,CAAC;AACV;AAEA,SAAS,qBAAqB,OAA0D;AACtF,MAAI,CAAC,MAAO,QAAO,CAAC;AACpB,MAAI,OAAO,UAAU,SAAU,QAAO,CAAC;AACvC,QAAM,UAAU,MAAM,KAAK;AAC3B,MAAI,CAAC,QAAS,QAAO,CAAC;AACtB,MAAI;AACF,UAAM,SAAS,KAAK,MAAM,OAAO;AACjC,WAAO,+BAA+B,MAAM;AAAA,EAC9C,QAAQ;AACN,WAAO,CAAC;AAAA,EACV;AACF;AAEA,eAAsB,IAAI,KAAc;AACtC,QAAM,OAAO,MAAM,mBAAmB,GAAG;AACzC,MAAI,CAAC,QAAQ,CAAC,KAAK,YAAa,CAAC,KAAK,SAAS,CAAC,KAAK,aAAe,QAAO,aAAa,KAAK,EAAE,OAAO,eAAe,GAAG,EAAE,QAAQ,IAAI,CAAC;AACvI,QAAM,MAAM,IAAI,IAAI,IAAI,GAAG;AAC3B,QAAM,cAAc,sBAAsB,UAAU;AAAA,IAClD,UAAU,IAAI,aAAa,IAAI,UAAU,KAAK;AAAA,IAC9C,UAAU,IAAI,aAAa,IAAI,UAAU,KAAK;AAAA,IAC9C,MAAM,IAAI,aAAa,IAAI,MAAM,KAAK;AAAA,IACtC,UAAU,IAAI,aAAa,IAAI,UAAU,KAAK;AAAA,EAChD,CAAC;AACD,MAAI,CAAC,YAAY,SAAS;AACxB,WAAO,aAAa,KAAK,EAAE,OAAO,qCAAqC,GAAG,EAAE,QAAQ,IAAI,CAAC;AAAA,EAC3F;AACA,QAAM,EAAE,UAAU,UAAU,MAAM,SAAS,IAAI,YAAY;AAE3D,QAAM,EAAE,QAAQ,IAAI,MAAM,uBAAuB;AACjD,QAAM,KAAK,QAAQ,IAAI;AACvB,QAAM,SAAkC,EAAE,UAAU,UAAU,UAAU,KAAK,SAAU;AACvF,MAAI,KAAK,MAAO,QAAO,iBAAiB,KAAK;AAC7C,QAAM,UAA0C,EAAE,WAAW,OAAO;AACpE,QAAM,YAAY,OAAO,SAAS,YAAY,OAAO,aAAa;AAClE,QAAM,QAAQ,YAAY,MAAM,GAAG,MAAM,YAAY,MAAM,IAAI;AAC/D,QAAM,cAAc,YAAY,KAAK,IAAI,GAAG,IAAI,IAAI;AACpD,QAAM,kBAAkB,YAAY,WAAW;AAC/C,QAAM,aAAa,aAAa,UAAU,OAAO,KAAK,IAAI,GAAG,KAAK,KAAK,QAAQ,eAAgB,CAAC,IAAI;AACpG,QAAM,aAAa,aAAa,KAAK,IAAI,aAAc,UAAW,IAAI,KAAK,kBAAmB;AAC9F,QAAM,QAAQ,MAAM;AAAA,IAClB;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,MACE;AAAA,MACA,GAAI,YACA;AAAA,QACE,OAAO;AAAA,QACP,QAAQ;AAAA,MACV,IACA,CAAC;AAAA,IACP;AAAA,IACA;AAAA,MACE,UAAU,KAAK,YAAY;AAAA,MAC3B,gBAAgB,KAAK,SAAS;AAAA,IAChC;AAAA,EACF;AACA,SAAO,aAAa,KAAK;AAAA,IACvB,OAAO,MAAM,IAAI,CAAC,MAAW;AAC3B,YAAMA,YAAW,uBAAuB,EAAE,eAAe;AACzD,aAAO;AAAA,QACL,IAAI,EAAE;AAAA,QACN,KAAK,EAAE;AAAA,QACP,UAAU,EAAE;AAAA,QACZ,UAAU,EAAE;AAAA,QACZ,WAAW,EAAE;AAAA,QACb,UAAU,EAAE,YAAY;AAAA,QACxB,eAAe,EAAE;AAAA,QACjB,SAAS,EAAE,WAAW;AAAA,QACtB,cAAc,wBAAwB,EAAE,IAAI;AAAA,UAC1C,OAAO;AAAA,UACP,QAAQ;AAAA,UACR,MAAM,0BAA0B,EAAE,QAAQ;AAAA,QAC5C,CAAC;AAAA,QACD,MAAMA,UAAS,QAAQ,CAAC;AAAA,QACxB,aAAaA,UAAS,eAAe,CAAC;AAAA,MACxC;AAAA,IACF,CAAC;AAAA,IACD,GAAI,YACA;AAAA,MACE;AAAA,MACA,MAAM,KAAK,IAAI,aAAc,UAAW;AAAA,MACxC,UAAU;AAAA,MACV;AAAA,IACF,IACA,CAAC;AAAA,EACP,CAAC;AACH;AAEA,eAAsB,KAAK,KAAc;AACvC,QAAM,EAAE,EAAE,IAAI,MAAM,oBAAoB;AACxC,QAAM,OAAO,MAAM,mBAAmB,GAAG;AACzC,MAAI,CAAC,QAAQ,CAAC,KAAK,YAAa,CAAC,KAAK,SAAS,CAAC,KAAK,aAAe,QAAO,aAAa,KAAK,EAAE,OAAO,eAAe,GAAG,EAAE,QAAQ,IAAI,CAAC;AAOvI,MAAI,CAAC,KAAK,OAAO;AACf,WAAO,aAAa,KAAK;AAAA,MACvB,OAAO,EAAE,yCAAyC,gEAAgE;AAAA,IACpH,GAAG,EAAE,QAAQ,IAAI,CAAC;AAAA,EACpB;AACA,QAAM,WAAW,KAAK;AACtB,QAAM,QAAQ,KAAK;AAEnB,QAAM,cAAc,IAAI,QAAQ,IAAI,cAAc,KAAK;AACvD,MAAI,CAAC,YAAY,YAAY,EAAE,SAAS,qBAAqB,GAAG;AAC9D,WAAO,aAAa,KAAK,EAAE,OAAO,+BAA+B,GAAG,EAAE,QAAQ,IAAI,CAAC;AAAA,EACrF;AACA,MAAI,CAAC,oCAAoC,IAAI,QAAQ,IAAI,gBAAgB,CAAC,GAAG;AAC3E,WAAO,aAAa,KAAK,EAAE,OAAO,8CAA8C,GAAG,EAAE,QAAQ,IAAI,CAAC;AAAA,EACpG;AAEA,QAAM,OAAO,MAAM,IAAI,SAAS;AAChC,QAAM,cAAc,iBAAiB,IAAI;AACzC,QAAM,oBAAoB,wBAAwB,WAAW,EAAE;AAC/D,QAAM,WAAW,OAAO,KAAK,IAAI,UAAU,KAAK,EAAE;AAClD,QAAM,WAAW,OAAO,KAAK,IAAI,UAAU,KAAK,EAAE;AAClD,QAAM,WAAW,OAAO,KAAK,IAAI,UAAU,KAAK,EAAE;AAClD,QAAM,OAAO,KAAK,IAAI,MAAM;AAC5B,MAAI,CAAC,YAAY,CAAC,YAAY,CAAC,KAAM,QAAO,aAAa,KAAK,EAAE,OAAO,2CAA2C,GAAG,EAAE,QAAQ,IAAI,CAAC;AACpI,QAAM,uBAAuB,KAAK,IAAI,eAAe;AACrD,QAAM,oBACJ,OAAO,yBAAyB,YAAY,qBAAqB,KAAK,EAAE,SAAS,IAC7E,sBAAsB,oBAAoB,IAC1C;AACN,QAAM,OAAO,cAAc,KAAK,IAAI,MAAM,CAAC;AAC3C,QAAM,sBAAsB,qBAAqB,KAAK,IAAI,aAAa,CAAC;AAExE,QAAM,EAAE,QAAQ,IAAI,MAAM,uBAAuB;AACjD,QAAM,KAAK,QAAQ,IAAI;AACvB,QAAM,aAAa,QAAQ,YAAY;AACvC,QAAM,uBACH,QAAQ,sBAAsB,KAAqC,IAAI,qBAAqB,EAAE;AACjG,QAAM,wBAAwB,EAAE;AAEhC,MAAI,qBAAoC;AACxC,MAAI,2BAA0C;AAC9C,MAAI,UAAU;AACZ,QAAI;AACF,YAAM,EAAE,eAAe,IAAI,MAAM,OAAO,mDAAmD;AAC3F,YAAM,MAAM,MAAM,GAAG,QAAQ,gBAAgB;AAAA,QAC3C;AAAA,QACA,KAAK;AAAA,QACL,MAAM;AAAA,UACJ,EAAE,KAAK,CAAE,EAAE,UAAU,KAAK,SAAS,GAAG,EAAE,UAAU,KAAK,CAAE,EAAE;AAAA,QAC7D;AAAA,QACA,UAAU;AAAA,MACZ,CAAC;AACD,YAAM,MAAO,KAAa,cAAc,CAAC;AACzC,YAAM,OAAO,KAAK,QAAQ,IAAI,MAAM,GAAG,EAAE,IAAI,GAAG,YAAY,KAAK;AACjE,UAAI,MAAM,QAAQ,IAAI,gBAAgB,KAAK,IAAI,iBAAiB,QAAQ;AACtE,cAAM,UAAU,IAAI,IAAK,IAAI,iBAA2B,IAAI,CAAC,MAAW,OAAO,CAAC,EAAE,YAAY,EAAE,QAAQ,OAAO,EAAE,CAAC,CAAC;AACnH,YAAI,CAAC,QAAQ,IAAI,GAAG,EAAG,QAAO,aAAa,KAAK,EAAE,OAAO,wBAAwB,GAAG,EAAE,QAAQ,IAAI,CAAC;AAAA,MACrG;AACA,UAAI,OAAO,IAAI,wBAAwB,YAAY,IAAI,sBAAsB,GAAG;AAC9E,mCAA2B,IAAI;AAAA,MACjC;AACA,UAAI,OAAO,IAAI,kBAAkB,YAAY,IAAI,cAAc,KAAK,EAAE,SAAS,GAAG;AAChF,6BAAqB,sBAAsB,IAAI,aAAa;AAAA,MAC9D;AAAA,IACF,QAAQ;AAAA,IAAC;AAAA,EACX;AACA,MAAI,gCAAgC,KAAK,IAAI,GAAG;AAC9C,WAAO,aAAa,KAAK;AAAA,MACvB,OAAO,EAAE,0CAA0C,uDAAuD;AAAA,IAC5G,GAAG,EAAE,QAAQ,IAAI,CAAC;AAAA,EACpB;AACA,QAAM,oBAAoB,0BAA0B,wBAAwB;AAC5E,MAAI,KAAK,OAAO,mBAAmB;AACjC,WAAO,aAAa,KAAK;AAAA,MACvB,OAAO,EAAE,oCAAoC,6CAA6C;AAAA,IAC5F,GAAG,EAAE,QAAQ,IAAI,CAAC;AAAA,EACpB;AACA,QAAM,mBAAmB,MAAM,+BAA+B,IAAI,QAAQ;AAC1E,MAAI,gCAAgC,kBAAkB,KAAK,IAAI,GAAG;AAChE,WAAO,aAAa,KAAK;AAAA,MACvB,OAAO,EAAE,oCAAoC,oDAAoD;AAAA,IACnG,GAAG,EAAE,QAAQ,IAAI,CAAC;AAAA,EACpB;AACA,QAAM,MAAM,OAAO,KAAK,MAAM,KAAK,YAAY,CAAC;AAChD,QAAM,WAAW,yBAAyB,KAAK,IAAI;AACnD,QAAM,eAAe,yBAAyB,KAAK,UAAW,KAAa,IAAI;AAC/E,MAAI,0BAA0B,KAAK,UAAU,YAAY,GAAG;AAC1D,WAAO,aAAa,KAAK,EAAE,OAAO,EAAE,2CAA2C,yCAAyC,EAAE,GAAG,EAAE,QAAQ,IAAI,CAAC;AAAA,EAC9I;AACA,QAAM,uBAAuB,4BAA4B,QAAQ;AACjE,QAAM,wBAAwB,qBAAqB,sBAAsB;AACzE,QAAM,0BAA0B,MAAM;AAAA,IACpC,IAAI;AAAA,MACF,CAAC,mBAAmB,oBAAoB,qBAAqB,EAAE;AAAA,QAC7D,CAAC,SAAyB,OAAO,SAAS,YAAY,KAAK,SAAS;AAAA,MACtE;AAAA,IACF;AAAA,EACF;AACA,MAAI,YAAwC;AAC5C,aAAW,QAAQ,yBAAyB;AAC1C,UAAM,SAAS,MAAM,GAAG,QAAQ,qBAAqB,EAAE,KAAK,CAAC;AAC7D,QAAI,QAAQ;AACV,kBAAY;AACZ;AAAA,IACF;AAAA,EACF;AACA,MAAI,CAAC,WAAW;AACd,gBAAY,MAAM,GAAG,QAAQ,qBAAqB,EAAE,MAAM,qBAAqB,CAAC;AAAA,EAClF;AACA,MAAI,CAAC,WAAW;AACd,WAAO,aAAa,KAAK,EAAE,OAAO,uCAAuC,GAAG,EAAE,QAAQ,IAAI,CAAC;AAAA,EAC7F;AACA,QAAM,0BACJ,OAAO,sBAAsB,YAC7B,kBAAkB,SAAS,KAC3B,UAAU,SAAS,qBACnB,UAAU,aAAa,QACvB,UAAU,SAAS,wBACnB,UAAU,SAAS;AACrB,MAAI,yBAAyB;AAC3B,WAAO,aAAa,KAAK,EAAE,OAAO,EAAE,6CAA6C,0EAA0E,EAAE,GAAG,EAAE,QAAQ,IAAI,CAAC;AAAA,EACjL;AACA,QAAM,eAAe,MAAM,qBAAqB,oBAAoB,UAAU,MAAM,EAAE,UAAU,gBAAgB,MAAM,CAAC;AACvH,MAAI;AACJ,MAAI;AACF,UAAM,SAAS,MAAM,aAAa,MAAM;AAAA,MACtC,eAAe,UAAU;AAAA,MACzB;AAAA,MACA;AAAA,MACA,UAAU;AAAA,MACV,QAAQ;AAAA,IACV,CAAC;AACD,iBAAa,OAAO;AAAA,EACtB,SAAS,OAAO;AACd,WAAO,MAAM,0BAA0B,EAAE,KAAK,MAAM,CAAC;AACrD,WAAO,aAAa,KAAK,EAAE,OAAO,gCAAgC,GAAG,EAAE,QAAQ,IAAI,CAAC;AAAA,EACtF;AAEA,QAAM,cACJ,OAAQ,UAAkB,gBAAgB,YACtC,QAAS,UAAkB,WAAW,IACtC,mCAAmC;AACzC,MAAI,mBAAkC;AACtC,QAAM,cAAc,eAAe,gBAAgB,cAAc,QAAQ;AACzE,QAAM,aAAa,cAAc,IAAI,WAAW,IAAI;AACpD,QAAM,YAAY,QAAQ,eAAe,YAAY,SAAS;AAE9D,MAAI,eAAe,CAAC,WAAW;AAC7B,UAAM,EAAE,UAAU,WAAW,QAAQ,IAAI,MAAM,aAAa,YAAY,UAAU,MAAM,UAAU;AAClG,QAAI;AACF,yBAAmB,MAAM,yBAAyB;AAAA,QAChD,UAAU;AAAA,QACV,UAAU;AAAA,MACZ,CAAC;AAAA,IACH,SAAS,OAAO;AACd,aAAO,MAAM,wCAAwC,EAAE,KAAK,MAAM,CAAC;AAAA,IACrE,UAAE;AACA,YAAM,QAAQ,EAAE,MAAM,MAAM;AAAA,MAAC,CAAC;AAAA,IAChC;AAAA,EACF;AAEA,MAAI,cAAc,oBAAoB,MAAM;AAC5C,MAAI,aAAa,mBAAmB;AAClC,kBAAc,iBAAiB,aAAa,EAAE,MAAM,UAAU,IAAI,SAAS,CAAC;AAAA,EAC9E;AACA,QAAMA,YAAW,wBAAwB,MAAM,EAAE,aAAa,KAAK,CAAC;AACpE,QAAM,eAAe,WAAW;AAChC,iCAA+B,EAAE,UAAU,KAAK,UAAU,gBAAgB,KAAK,MAAM,CAAC;AACtF,QAAM,MAAM,GAAG,OAAO,YAAY;AAAA,IAChC,IAAI;AAAA,IACJ;AAAA,IACA;AAAA,IACA,gBAAgB,KAAK;AAAA,IACrB,UAAU,KAAK;AAAA,IACf,UAAU;AAAA,IACV,UAAU;AAAA,IACV,UAAU,IAAI;AAAA,IACd,eAAe,UAAU;AAAA,IACzB,eAAe,UAAU,iBAAiB;AAAA,IAC1C,aAAa;AAAA,IACb,KAAK,uBAAuB,YAAY;AAAA,IACxC,SAAS;AAAA,IACT,iBAAiBA;AAAA,EACnB,CAAC;AAGD,MAAI;AACF,UAAM,GAAG,cAAc,OAAO,OAAO;AACnC,YAAM,GAAG,QAAQ,GAAG,EAAE,MAAM;AAC5B,UAAI,YAAY;AACd,cAAM,qBAAqB;AAAA,UACzB;AAAA,UACA,UAAU,EAAE,YAAY;AAAA,UACxB,UAAU;AAAA,UACV;AAAA,UACA,gBAAgB;AAAA,UAChB,QAAQ;AAAA,QACV,CAAC;AAAA,MACH;AAAA,IACF,CAAC;AAAA,EACH,SAAS,OAAO;AACd,WAAO,MAAM,uDAAuD,EAAE,KAAK,MAAM,CAAC;AAClF,WAAO,aAAa,KAAK,EAAE,OAAO,wCAAwC,GAAG,EAAE,QAAQ,IAAI,CAAC;AAAA,EAC9F;AAEA,MAAI,WAAW;AACb,yBAAqB,IAAI,KAAK,cAAc,UAAU,EAAE,MAAM,CAAC,UAAU;AACvE,aAAO,MAAM,kCAAkC,EAAE,KAAK,MAAM,CAAC;AAAA,IAC/D,CAAC;AAAA,EACH,WAAW,aAAa;AACtB,WAAO,KAAK,iGAAiG;AAAA,EAC/G;AAEA,MAAI,YAAY;AACd,UAAM,oBAAoB;AAAA,MACxB;AAAA,MACA,QAAQ;AAAA,MACR,QAAQ;AAAA,MACR,aAAa;AAAA,QACX,IAAI,IAAI;AAAA,QACR,gBAAgB,IAAI,kBAAkB;AAAA,QACtC,UAAU,IAAI,YAAY;AAAA,MAC5B;AAAA,MACA,QAAQ;AAAA,MACR,SAAS;AAAA,IACX,CAAC;AACD,UAAM,WAAW,sBAAsB;AAAA,EACzC;AAEA,SAAO,aAAa,KAAK;AAAA,IACvB,IAAI;AAAA,IACJ,MAAM;AAAA,MACJ,IAAI;AAAA,MACJ,KAAK,IAAI;AAAA,MACT,UAAU;AAAA,MACV,UAAU,IAAI;AAAA,MACd,eAAe,UAAU;AAAA,MACzB,cAAc,wBAAwB,cAAc;AAAA,QAClD,OAAO;AAAA,QACP,QAAQ;AAAA,QACR,MAAM,0BAA0B,QAAQ;AAAA,MAC1C,CAAC;AAAA,MACD,SAAS,oBAAoB;AAAA,MAC7B,MAAMA,UAAS,QAAQ,CAAC;AAAA,MACxB,aAAaA,UAAS,eAAe,CAAC;AAAA,MACtC,cAAc,OAAO,KAAK,iBAAiB,EAAE,SAAS,oBAAoB;AAAA,IAC5E;AAAA,EACF,CAAC;AACH;AAEA,eAAe,+BAA+B,IAAmB,UAAmC;AAClG,MAAI;AACF,UAAM,KAAK,GAAG,UAAe;AAC7B,UAAM,MAAM,MAAM,GACf,WAAW,aAAa,EACxB,OAAO,oBAA4B,GAAG,YAAY,CAAC,EACnD,MAAM,aAAa,KAAK,QAAQ,EAChC,iBAAiB;AACpB,UAAM,QAAQ,KAAK;AACnB,QAAI,OAAO,UAAU,SAAU,QAAO,OAAO,SAAS,KAAK,IAAI,QAAQ;AACvE,QAAI,OAAO,UAAU,UAAU;AAC7B,YAAM,SAAS,OAAO,KAAK;AAC3B,aAAO,OAAO,SAAS,MAAM,IAAI,SAAS;AAAA,IAC5C;AACA,WAAO;AAAA,EACT,QAAQ;AACN,WAAO;AAAA,EACT;AACF;AAEA,eAAsB,OAAO,KAAc;AACzC,QAAM,OAAO,MAAM,mBAAmB,GAAG;AACzC,MAAI,CAAC,QAAQ,CAAC,KAAK,YAAa,CAAC,KAAK,SAAS,CAAC,KAAK,aAAe,QAAO,aAAa,KAAK,EAAE,OAAO,eAAe,GAAG,EAAE,QAAQ,IAAI,CAAC;AACvI,QAAM,MAAM,IAAI,IAAI,IAAI,GAAG;AAC3B,QAAM,KAAK,IAAI,aAAa,IAAI,IAAI,KAAK;AACzC,MAAI,CAAC,GAAI,QAAO,aAAa,KAAK,EAAE,OAAO,4BAA4B,GAAG,EAAE,QAAQ,IAAI,CAAC;AACzF,QAAM,EAAE,QAAQ,IAAI,MAAM,uBAAuB;AACjD,QAAM,KAAK,QAAQ,IAAI;AACvB,QAAM,aAAa,QAAQ,YAAY;AACvC,QAAM,uBACH,QAAQ,sBAAsB,KAAqC,IAAI,qBAAqB,EAAE;AAKjG,QAAM,eAAwC,EAAE,IAAI,UAAU,KAAK,SAAU;AAC7E,MAAI,KAAK,MAAO,cAAa,iBAAiB,KAAK;AACnD,QAAM,SAAS,MAAM,GAAG,QAAQ,YAAY,YAAY;AACxD,MAAI,CAAC,OAAQ,QAAO,aAAa,KAAK,EAAE,OAAO,uBAAuB,GAAG,EAAE,QAAQ,IAAI,CAAC;AACxF,QAAM,GAAG,OAAO,MAAM,EAAE,MAAM;AAC9B,QAAM,8BAA8B,OAAO,eAAe,OAAO,EAAE,EAAE,MAAM,CAAC,UAAU;AACpF,WAAO,MAAM,uCAAuC,EAAE,KAAK,MAAM,CAAC;AAAA,EACpE,CAAC;AACD,MAAI,OAAO,aAAa;AACtB,UAAM,YAAY,MAAM,qBAAqB,oBAAoB,OAAO,eAAe;AAAA,MACrF,UAAU,OAAO,YAAY,KAAK;AAAA,MAClC,gBAAgB,OAAO,kBAAkB,KAAK,SAAS;AAAA,IACzD,CAAC;AACD,UAAM,UAAU,OAAO,OAAO,eAAe,OAAO,WAAW;AAAA,EACjE;AACA,MAAI,YAAY;AACd,UAAM,oBAAoB;AAAA,MACxB;AAAA,MACA,QAAQ;AAAA,MACR,QAAQ;AAAA,MACR,aAAa;AAAA,QACX,IAAI,OAAO;AAAA,QACX,gBAAgB,OAAO,kBAAkB;AAAA,QACzC,UAAU,OAAO,YAAY;AAAA,MAC/B;AAAA,MACA,QAAQ;AAAA,MACR,SAAS;AAAA,IACX,CAAC;AACD,UAAM,WAAW,sBAAsB;AAAA,EACzC;AACA,SAAO,aAAa,KAAK,EAAE,IAAI,KAAK,CAAC;AACvC;AAEO,MAAM,UAA2B;AAAA,EACtC,SAAS;AAAA,EACT,aAAa;AAAA,EACb,SAAS;AAAA,IACP,KAAK;AAAA,MACH,SAAS;AAAA,MACT,aAAa;AAAA,MACb,OAAO;AAAA,MACP,WAAW;AAAA,QACT,EAAE,QAAQ,KAAK,aAAa,oCAAoC,QAAQ,6BAA6B;AAAA,MACvG;AAAA,MACA,QAAQ;AAAA,QACN,EAAE,QAAQ,KAAK,aAAa,wCAAwC,QAAQ,YAAY;AAAA,QACxF,EAAE,QAAQ,KAAK,aAAa,gBAAgB,QAAQ,YAAY;AAAA,MAClE;AAAA,IACF;AAAA,IACA,MAAM;AAAA,MACJ,SAAS;AAAA,MACT,aAAa;AAAA,MACb,aAAa;AAAA,QACX,aAAa;AAAA,QACb,QAAQ;AAAA,MACV;AAAA,MACA,WAAW;AAAA,QACT,EAAE,QAAQ,KAAK,aAAa,kCAAkC,QAAQ,qBAAqB;AAAA,MAC7F;AAAA,MACA,QAAQ;AAAA,QACN,EAAE,QAAQ,KAAK,aAAa,4BAA4B,QAAQ,YAAY;AAAA,QAC5E,EAAE,QAAQ,KAAK,aAAa,gBAAgB,QAAQ,YAAY;AAAA,QAChE,EAAE,QAAQ,KAAK,aAAa,yCAAyC,QAAQ,YAAY;AAAA,MAC3F;AAAA,IACF;AAAA,IACA,QAAQ;AAAA,MACN,SAAS;AAAA,MACT,aAAa;AAAA,MACb,OAAO;AAAA,MACP,WAAW;AAAA,QACT,EAAE,QAAQ,KAAK,aAAa,sBAAsB,QAAQ,EAAE,OAAO,EAAE,IAAI,EAAE,QAAQ,IAAI,EAAE,CAAC,EAAE;AAAA,QAC5F,EAAE,QAAQ,KAAK,aAAa,wBAAwB,QAAQ,YAAY;AAAA,MAC1E;AAAA,MACA,QAAQ;AAAA,QACN,EAAE,QAAQ,KAAK,aAAa,iCAAiC,QAAQ,YAAY;AAAA,QACjF,EAAE,QAAQ,KAAK,aAAa,gBAAgB,QAAQ,YAAY;AAAA,MAClE;AAAA,IACF;AAAA,EACF;AACF;",
+  "sourcesContent": ["import { NextResponse } from 'next/server'\nimport { createRequestContainer } from '@open-mercato/shared/lib/di/container'\nimport { getAuthFromRequest } from '@open-mercato/shared/lib/auth/server'\nimport { z } from 'zod'\nimport { sql } from 'kysely'\nimport type { OpenApiRouteDoc } from '@open-mercato/shared/lib/openapi'\nimport { buildAttachmentFileUrl, buildAttachmentImageUrl, slugifyAttachmentFileName } from '../lib/imageUrls'\nimport { ensureDefaultPartitions, resolveDefaultPartitionCode, sanitizePartitionCode } from '../lib/partitions'\nimport { Attachment, AttachmentPartition } from '../data/entities'\nimport { extractAttachmentContent } from '../lib/textExtraction'\nimport { requestOcrProcessing } from '../lib/ocrQueue'\nimport { StorageDriverFactory } from '../lib/drivers'\nimport { OcrService, shouldUseLlmOcr } from '../lib/ocrService'\nimport { clearAttachmentThumbnailCache } from '../lib/thumbnailCache'\nimport { assertAttachmentScopeInvariant } from '../lib/access'\nimport { resolveAttachmentOrganizationId } from '../lib/requestScope'\nimport {\n  mergeAttachmentMetadata,\n  normalizeAttachmentAssignments,\n  normalizeAttachmentTags,\n  readAttachmentMetadata,\n  upsertAssignment,\n  type AttachmentAssignment,\n} from '../lib/metadata'\nimport { randomUUID } from 'crypto'\nimport type { EntityManager } from '@mikro-orm/postgresql'\nimport { splitCustomFieldPayload } from '@open-mercato/shared/lib/crud/custom-fields'\nimport { emitCrudSideEffects, setCustomFieldsIfAny } from '@open-mercato/shared/lib/commands/helpers'\nimport { resolveTranslations } from '@open-mercato/shared/lib/i18n/server'\nimport { attachmentCrudEvents, attachmentCrudIndexer } from '../lib/crud'\nimport { E } from '#generated/entities.ids.generated'\nimport { resolveDefaultAttachmentOcrEnabled } from '../lib/ocrConfig'\nimport {\n  detectAttachmentMimeType,\n  hasDangerousExecutableExtension,\n  isActiveContentAttachment,\n  sanitizeUploadedFileName,\n} from '../lib/security'\nimport {\n  isMultipartRequestWithinUploadLimit,\n  resolveAttachmentMaxBytes,\n  willExceedAttachmentTenantQuota,\n} from '../lib/upload-limits'\nimport { findWithDecryption } from '@open-mercato/shared/lib/encryption/find'\nimport { createLogger } from '@open-mercato/shared/lib/logger'\n\nconst logger = createLogger('attachments')\n\nexport const metadata = {\n  GET: { requireAuth: true, requireFeatures: ['attachments.view'] },\n  POST: { requireAuth: true, requireFeatures: ['attachments.manage'] },\n  DELETE: { requireAuth: true, requireFeatures: ['attachments.manage'] },\n}\n\nconst attachmentQuerySchema = z.object({\n  entityId: z.string().min(1).describe('Entity identifier that owns the attachments'),\n  recordId: z.string().min(1).describe('Record identifier within the entity'),\n  page: z.coerce.number().min(1).optional(),\n  pageSize: z.coerce.number().min(1).max(100).optional(),\n})\n\nconst attachmentAssignmentSchema = z.object({\n  type: z.string().describe('Assignment type identifier'),\n  id: z.string().describe('Assignment record identifier'),\n  href: z.string().nullable().optional().describe('Optional link to the related record'),\n  label: z.string().nullable().optional().describe('Optional label for the assignment'),\n})\n\nconst attachmentItemSchema = z.object({\n  id: z.string().describe('Attachment identifier'),\n  url: z.string().describe('Public path to the stored asset'),\n  fileName: z.string().describe('Original filename'),\n  fileSize: z.number().int().nonnegative().describe('File size in bytes'),\n  createdAt: z.string().describe('Upload timestamp (ISO 8601)'),\n  mimeType: z.string().nullable().optional().describe('MIME type of the file'),\n  thumbnailUrl: z.string().optional().describe('Helper route that renders a thumbnail'),\n  partitionCode: z.string().optional().describe('Partition identifier'),\n  tags: z.array(z.string()).optional().describe('Tags assigned to the attachment'),\n  content: z.string().nullable().optional().describe('Extracted text or markdown content'),\n  assignments: z.array(attachmentAssignmentSchema).optional().describe('Records that reference this attachment'),\n})\n\nconst attachmentListResponseSchema = z.object({\n  items: z.array(attachmentItemSchema),\n  total: z.number().int().nonnegative().optional(),\n  page: z.number().int().min(1).optional(),\n  pageSize: z.number().int().min(1).optional(),\n  totalPages: z.number().int().min(1).optional(),\n})\n\nconst attachmentUploadBodySchema = z.object({\n  entityId: z.string().min(1),\n  recordId: z.string().min(1),\n  fieldKey: z.string().optional(),\n  file: z.string().min(1).describe('Binary file payload; supplied as multipart form-data'),\n  customFields: z\n    .string()\n    .optional()\n    .describe('JSON encoded map of custom field values collected from the upload form.'),\n})\n\nconst attachmentDeleteQuerySchema = z.object({\n  id: z.string().uuid(),\n})\n\nconst uploadResponseSchema = z.object({\n  ok: z.literal(true),\n  item: z.object({\n    id: z.string(),\n    url: z.string(),\n    fileName: z.string(),\n    fileSize: z.number().int().nonnegative(),\n    thumbnailUrl: z.string().optional(),\n    content: z.string().nullable().optional(),\n    tags: z.array(z.string()).optional(),\n    assignments: z.array(attachmentAssignmentSchema).optional(),\n    customFields: z.record(z.string(), z.unknown()).optional(),\n  }),\n})\n\nconst errorSchema = z.object({\n  error: z.string(),\n})\n\nconst LIBRARY_ENTITY_ID = 'attachments:library'\n\nfunction parseCustomFieldsEntry(value: FormDataEntryValue | null): Record<string, unknown> {\n  if (!value) return {}\n  if (typeof value === 'string') {\n    const trimmed = value.trim()\n    if (!trimmed) return {}\n    try {\n      const parsed = JSON.parse(trimmed)\n      if (parsed && typeof parsed === 'object' && !Array.isArray(parsed)) {\n        return parsed as Record<string, unknown>\n      }\n    } catch {\n      return {}\n    }\n  }\n  if (typeof value === 'object' && !Array.isArray(value) && !(value instanceof File)) {\n    return { ...(value as Record<string, unknown>) }\n  }\n  return {}\n}\n\nfunction buildFormPayload(form: FormData): Record<string, unknown> {\n  const payload: Record<string, unknown> = {}\n  form.forEach((value, key) => {\n    if (key === 'customFields') {\n      payload.customFields = parseCustomFieldsEntry(value)\n      return\n    }\n    payload[key] = value\n  })\n  return payload\n}\n\nfunction parseFormTags(value: FormDataEntryValue | null): string[] {\n  if (!value) return []\n  if (typeof value === 'string') {\n    const trimmed = value.trim()\n    if (!trimmed) return []\n    try {\n      const parsed = JSON.parse(trimmed)\n      return normalizeAttachmentTags(parsed)\n    } catch {\n      return normalizeAttachmentTags(value)\n    }\n  }\n  return []\n}\n\nfunction parseFormAssignments(value: FormDataEntryValue | null): AttachmentAssignment[] {\n  if (!value) return []\n  if (typeof value !== 'string') return []\n  const trimmed = value.trim()\n  if (!trimmed) return []\n  try {\n    const parsed = JSON.parse(trimmed)\n    return normalizeAttachmentAssignments(parsed)\n  } catch {\n    return []\n  }\n}\n\nexport async function GET(req: Request) {\n  const auth = await getAuthFromRequest(req)\n  if (!auth || !auth.tenantId || (!auth.orgId && !auth.isSuperAdmin)) return NextResponse.json({ error: 'Unauthorized' }, { status: 401 })\n  const url = new URL(req.url)\n  const parsedQuery = attachmentQuerySchema.safeParse({\n    entityId: url.searchParams.get('entityId') || '',\n    recordId: url.searchParams.get('recordId') || '',\n    page: url.searchParams.get('page') ?? undefined,\n    pageSize: url.searchParams.get('pageSize') ?? undefined,\n  })\n  if (!parsedQuery.success) {\n    return NextResponse.json({ error: 'entityId and recordId are required' }, { status: 400 })\n  }\n  const { entityId, recordId, page, pageSize } = parsedQuery.data\n\n  const container = await createRequestContainer()\n  const em = container.resolve('em') as EntityManager\n  const orgId = await resolveAttachmentOrganizationId(container, auth, req)\n  const filter: Record<string, unknown> = { entityId, recordId, tenantId: auth.tenantId! }\n  if (orgId) filter.organizationId = orgId\n  const orderBy: Record<string, 'ASC' | 'DESC'> = { createdAt: 'DESC' }\n  const usePaging = typeof page === 'number' && typeof pageSize === 'number'\n  const total = usePaging ? await em.count(Attachment, filter) : null\n  const currentPage = usePaging ? Math.max(1, page) : null\n  const currentPageSize = usePaging ? pageSize : null\n  const totalPages = usePaging && total !== null ? Math.max(1, Math.ceil(total / currentPageSize!)) : null\n  const pageOffset = usePaging ? (Math.min(currentPage!, totalPages!) - 1) * currentPageSize! : undefined\n  const items = await findWithDecryption(\n    em,\n    Attachment,\n    filter,\n    {\n      orderBy,\n      ...(usePaging\n        ? {\n            limit: currentPageSize!,\n            offset: pageOffset,\n          }\n        : {}),\n    },\n    {\n      tenantId: auth.tenantId ?? null,\n      organizationId: orgId ?? null,\n    },\n  )\n  return NextResponse.json({\n    items: items.map((a: any) => {\n      const metadata = readAttachmentMetadata(a.storageMetadata)\n      return {\n        id: a.id,\n        url: a.url,\n        fileName: a.fileName,\n        fileSize: a.fileSize,\n        createdAt: a.createdAt,\n        mimeType: a.mimeType ?? null,\n        partitionCode: a.partitionCode,\n        content: a.content ?? null,\n        thumbnailUrl: buildAttachmentImageUrl(a.id, {\n          width: 320,\n          height: 320,\n          slug: slugifyAttachmentFileName(a.fileName),\n        }),\n        tags: metadata.tags ?? [],\n        assignments: metadata.assignments ?? [],\n      }\n    }),\n    ...(usePaging\n      ? {\n          total,\n          page: Math.min(currentPage!, totalPages!),\n          pageSize: currentPageSize,\n          totalPages,\n        }\n      : {}),\n  })\n}\n\nexport async function POST(req: Request) {\n  const { t } = await resolveTranslations()\n  const auth = await getAuthFromRequest(req)\n  if (!auth || !auth.tenantId || (!auth.orgId && !auth.isSuperAdmin)) return NextResponse.json({ error: 'Unauthorized' }, { status: 401 })\n  // A superadmin browsing with \"All organizations\" selected has no concrete\n  // organization scope, but an attachment must be stored under exactly one\n  // organization (the scope invariant forbids partial-null rows). Reject with a\n  // clear, actionable error instead of a 401 \u2014 a 401 makes the client-side\n  // fetch layer treat it as session expiry, show a misleading toast, and reset\n  // the in-progress form (#3764).\n  if (!auth.orgId) {\n    return NextResponse.json({\n      error: t('attachments.errors.selectOrganization', 'Select a specific organization before uploading an attachment.'),\n    }, { status: 400 })\n  }\n  const tenantId = auth.tenantId\n\n  const contentType = req.headers.get('content-type') || ''\n  if (!contentType.toLowerCase().includes('multipart/form-data')) {\n    return NextResponse.json({ error: 'Expected multipart/form-data' }, { status: 400 })\n  }\n  if (!isMultipartRequestWithinUploadLimit(req.headers.get('content-length'))) {\n    return NextResponse.json({ error: 'Attachment exceeds the maximum upload size.' }, { status: 413 })\n  }\n\n  const form = await req.formData()\n  const formPayload = buildFormPayload(form)\n  const customFieldValues = splitCustomFieldPayload(formPayload).custom\n  const entityId = String(form.get('entityId') || '')\n  const recordId = String(form.get('recordId') || '')\n  const fieldKey = String(form.get('fieldKey') || '')\n  const file = form.get('file') as unknown as File | null\n  if (!entityId || !recordId || !file) return NextResponse.json({ error: 'entityId, recordId and file are required' }, { status: 400 })\n  const partitionOverrideRaw = form.get('partitionCode')\n  const partitionOverride =\n    typeof partitionOverrideRaw === 'string' && partitionOverrideRaw.trim().length > 0\n      ? sanitizePartitionCode(partitionOverrideRaw)\n      : null\n  const tags = parseFormTags(form.get('tags'))\n  const assignmentsFromForm = parseFormAssignments(form.get('assignments'))\n\n  const container = await createRequestContainer()\n  const em = container.resolve('em') as EntityManager\n  const dataEngine = container.resolve('dataEngine')\n  const storageDriverFactory =\n    (container.resolve('storageDriverFactory') as StorageDriverFactory | null) ?? new StorageDriverFactory(em)\n  const orgId = await resolveAttachmentOrganizationId(container, auth, req)\n  if (!orgId) return NextResponse.json({ error: 'Unauthorized' }, { status: 401 })\n  await ensureDefaultPartitions(em)\n  // Optional per-field validations\n  let partitionFromField: string | null = null\n  let fieldMaxAttachmentSizeMb: number | null = null\n  if (fieldKey) {\n    try {\n      const { CustomFieldDef } = await import('@open-mercato/core/modules/entities/data/entities')\n      const def = await em.findOne(CustomFieldDef, {\n        entityId,\n        key: fieldKey,\n        $and: [\n          { $or: [ { tenantId: auth.tenantId }, { tenantId: null } ] },\n        ],\n        isActive: true,\n      })\n      const cfg = (def as any)?.configJson || {}\n      const ext = (file.name || '').split('.').pop()?.toLowerCase() || ''\n      if (Array.isArray(cfg.acceptExtensions) && cfg.acceptExtensions.length) {\n        const allowed = new Set((cfg.acceptExtensions as any[]).map((x: any) => String(x).toLowerCase().replace(/^\\./, '')))\n        if (!allowed.has(ext)) return NextResponse.json({ error: 'File type not allowed' }, { status: 400 })\n      }\n      if (typeof cfg.maxAttachmentSizeMb === 'number' && cfg.maxAttachmentSizeMb > 0) {\n        fieldMaxAttachmentSizeMb = cfg.maxAttachmentSizeMb\n      }\n      if (typeof cfg.partitionCode === 'string' && cfg.partitionCode.trim().length > 0) {\n        partitionFromField = sanitizePartitionCode(cfg.partitionCode)\n      }\n    } catch {}\n  }\n  if (hasDangerousExecutableExtension(file.name)) {\n    return NextResponse.json({\n      error: t('attachments.errors.dangerousExecutable', 'Executable file types are not allowed as attachments.'),\n    }, { status: 400 })\n  }\n  const effectiveMaxBytes = resolveAttachmentMaxBytes(fieldMaxAttachmentSizeMb)\n  if (file.size > effectiveMaxBytes) {\n    return NextResponse.json({\n      error: t('attachments.errors.maxUploadSize', 'Attachment exceeds the maximum upload size.'),\n    }, { status: 413 })\n  }\n  const tenantUsageBytes = await readTenantAttachmentUsageBytes(em, tenantId)\n  if (willExceedAttachmentTenantQuota(tenantUsageBytes, file.size)) {\n    return NextResponse.json({\n      error: t('attachments.errors.quotaExceeded', 'Attachment storage quota exceeded for this tenant.'),\n    }, { status: 413 })\n  }\n  const buf = Buffer.from(await file.arrayBuffer())\n  const safeName = sanitizeUploadedFileName(file.name)\n  const fileMimeType = detectAttachmentMimeType(buf, safeName, (file as any).type)\n  if (isActiveContentAttachment(buf, safeName, fileMimeType)) {\n    return NextResponse.json({ error: t('attachments.errors.activeContentBlocked', 'Active content uploads are not allowed.') }, { status: 400 })\n  }\n  const defaultPartitionCode = resolveDefaultPartitionCode(entityId)\n  const resolvedPartitionCode = partitionOverride ?? partitionFromField ?? defaultPartitionCode\n  const partitionCodeCandidates = Array.from(\n    new Set(\n      [partitionOverride, partitionFromField, resolvedPartitionCode].filter(\n        (code): code is string => typeof code === 'string' && code.length > 0,\n      ),\n    ),\n  )\n  let partition: AttachmentPartition | null = null\n  for (const code of partitionCodeCandidates) {\n    const record = await em.findOne(AttachmentPartition, { code })\n    if (record) {\n      partition = record\n      break\n    }\n  }\n  if (!partition) {\n    partition = await em.findOne(AttachmentPartition, { code: defaultPartitionCode })\n  }\n  if (!partition) {\n    return NextResponse.json({ error: 'Storage partition is not configured.' }, { status: 400 })\n  }\n  const requestedPublicOverride =\n    typeof partitionOverride === 'string' &&\n    partitionOverride.length > 0 &&\n    partition.code === partitionOverride &&\n    partition.isPublic === true &&\n    partition.code !== defaultPartitionCode &&\n    partition.code !== partitionFromField\n  if (requestedPublicOverride) {\n    return NextResponse.json({ error: t('attachments.errors.publicPartitionBlocked', 'Public storage partitions cannot be selected explicitly for this upload.') }, { status: 403 })\n  }\n  const uploadDriver = await storageDriverFactory.resolveForPartition(partition.code, { tenantId, organizationId: orgId })\n  let storedPath: string\n  try {\n    const stored = await uploadDriver.store({\n      partitionCode: partition.code,\n      orgId,\n      tenantId,\n      fileName: safeName,\n      buffer: buf,\n    })\n    storedPath = stored.storagePath\n  } catch (error) {\n    logger.error('Failed to persist file', { err: error })\n    return NextResponse.json({ error: 'Failed to persist attachment.' }, { status: 500 })\n  }\n\n  const requiresOcr =\n    typeof (partition as any).requiresOcr === 'boolean'\n      ? Boolean((partition as any).requiresOcr)\n      : resolveDefaultAttachmentOcrEnabled()\n  let extractedContent: string | null = null\n  const wantsLlmOcr = requiresOcr && shouldUseLlmOcr(fileMimeType, safeName)\n  const ocrService = wantsLlmOcr ? new OcrService() : null\n  const useLlmOcr = Boolean(wantsLlmOcr && ocrService?.available)\n\n  if (requiresOcr && !useLlmOcr) {\n    const { filePath: localPath, cleanup } = await uploadDriver.toLocalPath(partition.code, storedPath)\n    try {\n      extractedContent = await extractAttachmentContent({\n        filePath: localPath,\n        mimeType: fileMimeType,\n      })\n    } catch (error) {\n      logger.error('Failed to extract attachment content', { err: error })\n    } finally {\n      await cleanup().catch(() => {})\n    }\n  }\n\n  let assignments = assignmentsFromForm.slice()\n  if (entityId !== LIBRARY_ENTITY_ID) {\n    assignments = upsertAssignment(assignments, { type: entityId, id: recordId })\n  }\n  const metadata = mergeAttachmentMetadata(null, { assignments, tags })\n  const attachmentId = randomUUID()\n  assertAttachmentScopeInvariant({ tenantId: auth.tenantId, organizationId: orgId })\n  const att = em.create(Attachment, {\n    id: attachmentId,\n    entityId,\n    recordId,\n    organizationId: orgId,\n    tenantId: auth.tenantId!,\n    fileName: safeName,\n    mimeType: fileMimeType,\n    fileSize: buf.length,\n    partitionCode: partition.code,\n    storageDriver: partition.storageDriver || 'local',\n    storagePath: storedPath,\n    url: buildAttachmentFileUrl(attachmentId),\n    content: extractedContent,\n    storageMetadata: metadata,\n  })\n  // Persist the attachment row and its custom-field values atomically so a\n  // custom-field failure cannot leave behind a committed orphan attachment.\n  try {\n    await em.transactional(async (tx) => {\n      await tx.persist(att).flush()\n      if (dataEngine) {\n        await setCustomFieldsIfAny({\n          dataEngine,\n          entityId: E.attachments.attachment,\n          recordId: attachmentId,\n          tenantId,\n          organizationId: orgId,\n          values: customFieldValues,\n        })\n      }\n    })\n  } catch (error) {\n    logger.error('Failed to persist attachment with custom attributes', { err: error })\n    return NextResponse.json({ error: 'Failed to save attachment attributes.' }, { status: 500 })\n  }\n\n  if (useLlmOcr) {\n    requestOcrProcessing(em, att, uploadDriver, storedPath).catch((error) => {\n      logger.error('Failed to queue OCR processing', { err: error })\n    })\n  } else if (wantsLlmOcr) {\n    logger.warn('OCR requested but OPENAI_API_KEY not configured, falling back to text extraction when available')\n  }\n\n  if (dataEngine) {\n    await emitCrudSideEffects({\n      dataEngine,\n      action: 'created',\n      entity: att,\n      identifiers: {\n        id: att.id,\n        organizationId: att.organizationId ?? null,\n        tenantId: att.tenantId ?? null,\n      },\n      events: attachmentCrudEvents,\n      indexer: attachmentCrudIndexer,\n    })\n    await dataEngine.flushOrmEntityChanges()\n  }\n\n  return NextResponse.json({\n    ok: true,\n    item: {\n      id: attachmentId,\n      url: att.url,\n      fileName: safeName,\n      fileSize: buf.length,\n      partitionCode: partition.code,\n      thumbnailUrl: buildAttachmentImageUrl(attachmentId, {\n        width: 320,\n        height: 320,\n        slug: slugifyAttachmentFileName(safeName),\n      }),\n      content: extractedContent ?? null,\n      tags: metadata.tags ?? [],\n      assignments: metadata.assignments ?? [],\n      customFields: Object.keys(customFieldValues).length ? customFieldValues : undefined,\n    },\n  })\n}\n\nasync function readTenantAttachmentUsageBytes(em: EntityManager, tenantId: string): Promise<number> {\n  try {\n    const db = em.getKysely<any>() as any\n    const row = await db\n      .selectFrom('attachments')\n      .select(sql<string>`sum(file_size)`.as('total_size'))\n      .where('tenant_id', '=', tenantId)\n      .executeTakeFirst() as { total_size: string | number | null } | undefined\n    const total = row?.total_size\n    if (typeof total === 'number') return Number.isFinite(total) ? total : 0\n    if (typeof total === 'string') {\n      const parsed = Number(total)\n      return Number.isFinite(parsed) ? parsed : 0\n    }\n    return 0\n  } catch {\n    return 0\n  }\n}\n\nexport async function DELETE(req: Request) {\n  const auth = await getAuthFromRequest(req)\n  if (!auth || !auth.tenantId || (!auth.orgId && !auth.isSuperAdmin)) return NextResponse.json({ error: 'Unauthorized' }, { status: 401 })\n  const url = new URL(req.url)\n  const id = url.searchParams.get('id') || ''\n  if (!id) return NextResponse.json({ error: 'Attachment id is required' }, { status: 400 })\n  const container = await createRequestContainer()\n  const em = container.resolve('em') as EntityManager\n  const dataEngine = container.resolve('dataEngine')\n  const storageDriverFactory =\n    (container.resolve('storageDriverFactory') as StorageDriverFactory | null) ?? new StorageDriverFactory(em)\n  // Resolve the currently selected organization (#3765) so a multi-org admin who\n  // switched the header org deletes within that org, not their pinned home org.\n  // A superadmin browsing with \"All organizations\" selected has no concrete org,\n  // so resolution returns null and the delete falls back to a tenant-only scope\n  // (#3764) \u2014 letting them remove any attachment in the tenant.\n  const orgId = await resolveAttachmentOrganizationId(container, auth, req)\n  const deleteFilter: Record<string, unknown> = { id, tenantId: auth.tenantId! }\n  if (orgId) deleteFilter.organizationId = orgId\n  const record = await em.findOne(Attachment, deleteFilter)\n  if (!record) return NextResponse.json({ error: 'Attachment not found' }, { status: 404 })\n  await em.remove(record).flush()\n  await clearAttachmentThumbnailCache(record.partitionCode, record.id).catch((error) => {\n    logger.error('Failed to cleanup cached thumbnails', { err: error })\n  })\n  if (record.storagePath) {\n    const delDriver = await storageDriverFactory.resolveForPartition(record.partitionCode, {\n      tenantId: record.tenantId ?? auth.tenantId!,\n      organizationId: record.organizationId ?? orgId ?? '',\n    })\n    await delDriver.delete(record.partitionCode, record.storagePath)\n  }\n  if (dataEngine) {\n    await emitCrudSideEffects({\n      dataEngine,\n      action: 'deleted',\n      entity: record,\n      identifiers: {\n        id: record.id,\n        organizationId: record.organizationId ?? null,\n        tenantId: record.tenantId ?? null,\n      },\n      events: attachmentCrudEvents,\n      indexer: attachmentCrudIndexer,\n    })\n    await dataEngine.flushOrmEntityChanges()\n  }\n  return NextResponse.json({ ok: true })\n}\n\nexport const openApi: OpenApiRouteDoc = {\n  summary: 'Manage entity attachments',\n  description: 'Upload and list attachments associated with module entities and records.',\n  methods: {\n    GET: {\n      summary: 'List attachments for a record',\n      description: 'Returns uploaded attachments for the given entity record, ordered by newest first.',\n      query: attachmentQuerySchema,\n      responses: [\n        { status: 200, description: 'Attachments found for the record', schema: attachmentListResponseSchema },\n      ],\n      errors: [\n        { status: 400, description: 'Missing entity or record identifiers', schema: errorSchema },\n        { status: 401, description: 'Unauthorized', schema: errorSchema },\n      ],\n    },\n    POST: {\n      summary: 'Upload attachment',\n      description: 'Uploads a new attachment using multipart form-data and stores metadata for later retrieval.',\n      requestBody: {\n        contentType: 'multipart/form-data',\n        schema: attachmentUploadBodySchema,\n      },\n      responses: [\n        { status: 200, description: 'Attachment stored successfully', schema: uploadResponseSchema },\n      ],\n      errors: [\n        { status: 400, description: 'Payload validation error', schema: errorSchema },\n        { status: 401, description: 'Unauthorized', schema: errorSchema },\n        { status: 403, description: 'Attachment violates field constraints', schema: errorSchema },\n      ],\n    },\n    DELETE: {\n      summary: 'Delete attachment',\n      description: 'Removes an uploaded attachment and deletes the stored asset.',\n      query: attachmentDeleteQuerySchema,\n      responses: [\n        { status: 200, description: 'Attachment deleted', schema: z.object({ ok: z.literal(true) }) },\n        { status: 404, description: 'Attachment not found', schema: errorSchema },\n      ],\n      errors: [\n        { status: 400, description: 'Missing attachment identifier', schema: errorSchema },\n        { status: 401, description: 'Unauthorized', schema: errorSchema },\n      ],\n    },\n  },\n}\n"],
+  "mappings": "AAAA,SAAS,oBAAoB;AAC7B,SAAS,8BAA8B;AACvC,SAAS,0BAA0B;AACnC,SAAS,SAAS;AAClB,SAAS,WAAW;AAEpB,SAAS,wBAAwB,yBAAyB,iCAAiC;AAC3F,SAAS,yBAAyB,6BAA6B,6BAA6B;AAC5F,SAAS,YAAY,2BAA2B;AAChD,SAAS,gCAAgC;AACzC,SAAS,4BAA4B;AACrC,SAAS,4BAA4B;AACrC,SAAS,YAAY,uBAAuB;AAC5C,SAAS,qCAAqC;AAC9C,SAAS,sCAAsC;AAC/C,SAAS,uCAAuC;AAChD;AAAA,EACE;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,OAEK;AACP,SAAS,kBAAkB;AAE3B,SAAS,+BAA+B;AACxC,SAAS,qBAAqB,4BAA4B;AAC1D,SAAS,2BAA2B;AACpC,SAAS,sBAAsB,6BAA6B;AAC5D,SAAS,SAAS;AAClB,SAAS,0CAA0C;AACnD;AAAA,EACE;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,OACK;AACP;AAAA,EACE;AAAA,EACA;AAAA,EACA;AAAA,OACK;AACP,SAAS,0BAA0B;AACnC,SAAS,oBAAoB;AAE7B,MAAM,SAAS,aAAa,aAAa;AAElC,MAAM,WAAW;AAAA,EACtB,KAAK,EAAE,aAAa,MAAM,iBAAiB,CAAC,kBAAkB,EAAE;AAAA,EAChE,MAAM,EAAE,aAAa,MAAM,iBAAiB,CAAC,oBAAoB,EAAE;AAAA,EACnE,QAAQ,EAAE,aAAa,MAAM,iBAAiB,CAAC,oBAAoB,EAAE;AACvE;AAEA,MAAM,wBAAwB,EAAE,OAAO;AAAA,EACrC,UAAU,EAAE,OAAO,EAAE,IAAI,CAAC,EAAE,SAAS,6CAA6C;AAAA,EAClF,UAAU,EAAE,OAAO,EAAE,IAAI,CAAC,EAAE,SAAS,qCAAqC;AAAA,EAC1E,MAAM,EAAE,OAAO,OAAO,EAAE,IAAI,CAAC,EAAE,SAAS;AAAA,EACxC,UAAU,EAAE,OAAO,OAAO,EAAE,IAAI,CAAC,EAAE,IAAI,GAAG,EAAE,SAAS;AACvD,CAAC;AAED,MAAM,6BAA6B,EAAE,OAAO;AAAA,EAC1C,MAAM,EAAE,OAAO,EAAE,SAAS,4BAA4B;AAAA,EACtD,IAAI,EAAE,OAAO,EAAE,SAAS,8BAA8B;AAAA,EACtD,MAAM,EAAE,OAAO,EAAE,SAAS,EAAE,SAAS,EAAE,SAAS,qCAAqC;AAAA,EACrF,OAAO,EAAE,OAAO,EAAE,SAAS,EAAE,SAAS,EAAE,SAAS,mCAAmC;AACtF,CAAC;AAED,MAAM,uBAAuB,EAAE,OAAO;AAAA,EACpC,IAAI,EAAE,OAAO,EAAE,SAAS,uBAAuB;AAAA,EAC/C,KAAK,EAAE,OAAO,EAAE,SAAS,iCAAiC;AAAA,EAC1D,UAAU,EAAE,OAAO,EAAE,SAAS,mBAAmB;AAAA,EACjD,UAAU,EAAE,OAAO,EAAE,IAAI,EAAE,YAAY,EAAE,SAAS,oBAAoB;AAAA,EACtE,WAAW,EAAE,OAAO,EAAE,SAAS,6BAA6B;AAAA,EAC5D,UAAU,EAAE,OAAO,EAAE,SAAS,EAAE,SAAS,EAAE,SAAS,uBAAuB;AAAA,EAC3E,cAAc,EAAE,OAAO,EAAE,SAAS,EAAE,SAAS,uCAAuC;AAAA,EACpF,eAAe,EAAE,OAAO,EAAE,SAAS,EAAE,SAAS,sBAAsB;AAAA,EACpE,MAAM,EAAE,MAAM,EAAE,OAAO,CAAC,EAAE,SAAS,EAAE,SAAS,iCAAiC;AAAA,EAC/E,SAAS,EAAE,OAAO,EAAE,SAAS,EAAE,SAAS,EAAE,SAAS,oCAAoC;AAAA,EACvF,aAAa,EAAE,MAAM,0BAA0B,EAAE,SAAS,EAAE,SAAS,wCAAwC;AAC/G,CAAC;AAED,MAAM,+BAA+B,EAAE,OAAO;AAAA,EAC5C,OAAO,EAAE,MAAM,oBAAoB;AAAA,EACnC,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,YAAY,EAAE,SAAS;AAAA,EAC/C,MAAM,EAAE,OAAO,EAAE,IAAI,EAAE,IAAI,CAAC,EAAE,SAAS;AAAA,EACvC,UAAU,EAAE,OAAO,EAAE,IAAI,EAAE,IAAI,CAAC,EAAE,SAAS;AAAA,EAC3C,YAAY,EAAE,OAAO,EAAE,IAAI,EAAE,IAAI,CAAC,EAAE,SAAS;AAC/C,CAAC;AAED,MAAM,6BAA6B,EAAE,OAAO;AAAA,EAC1C,UAAU,EAAE,OAAO,EAAE,IAAI,CAAC;AAAA,EAC1B,UAAU,EAAE,OAAO,EAAE,IAAI,CAAC;AAAA,EAC1B,UAAU,EAAE,OAAO,EAAE,SAAS;AAAA,EAC9B,MAAM,EAAE,OAAO,EAAE,IAAI,CAAC,EAAE,SAAS,sDAAsD;AAAA,EACvF,cAAc,EACX,OAAO,EACP,SAAS,EACT,SAAS,yEAAyE;AACvF,CAAC;AAED,MAAM,8BAA8B,EAAE,OAAO;AAAA,EAC3C,IAAI,EAAE,OAAO,EAAE,KAAK;AACtB,CAAC;AAED,MAAM,uBAAuB,EAAE,OAAO;AAAA,EACpC,IAAI,EAAE,QAAQ,IAAI;AAAA,EAClB,MAAM,EAAE,OAAO;AAAA,IACb,IAAI,EAAE,OAAO;AAAA,IACb,KAAK,EAAE,OAAO;AAAA,IACd,UAAU,EAAE,OAAO;AAAA,IACnB,UAAU,EAAE,OAAO,EAAE,IAAI,EAAE,YAAY;AAAA,IACvC,cAAc,EAAE,OAAO,EAAE,SAAS;AAAA,IAClC,SAAS,EAAE,OAAO,EAAE,SAAS,EAAE,SAAS;AAAA,IACxC,MAAM,EAAE,MAAM,EAAE,OAAO,CAAC,EAAE,SAAS;AAAA,IACnC,aAAa,EAAE,MAAM,0BAA0B,EAAE,SAAS;AAAA,IAC1D,cAAc,EAAE,OAAO,EAAE,OAAO,GAAG,EAAE,QAAQ,CAAC,EAAE,SAAS;AAAA,EAC3D,CAAC;AACH,CAAC;AAED,MAAM,cAAc,EAAE,OAAO;AAAA,EAC3B,OAAO,EAAE,OAAO;AAClB,CAAC;AAED,MAAM,oBAAoB;AAE1B,SAAS,uBAAuB,OAA2D;AACzF,MAAI,CAAC,MAAO,QAAO,CAAC;AACpB,MAAI,OAAO,UAAU,UAAU;AAC7B,UAAM,UAAU,MAAM,KAAK;AAC3B,QAAI,CAAC,QAAS,QAAO,CAAC;AACtB,QAAI;AACF,YAAM,SAAS,KAAK,MAAM,OAAO;AACjC,UAAI,UAAU,OAAO,WAAW,YAAY,CAAC,MAAM,QAAQ,MAAM,GAAG;AAClE,eAAO;AAAA,MACT;AAAA,IACF,QAAQ;AACN,aAAO,CAAC;AAAA,IACV;AAAA,EACF;AACA,MAAI,OAAO,UAAU,YAAY,CAAC,MAAM,QAAQ,KAAK,KAAK,EAAE,iBAAiB,OAAO;AAClF,WAAO,EAAE,GAAI,MAAkC;AAAA,EACjD;AACA,SAAO,CAAC;AACV;AAEA,SAAS,iBAAiB,MAAyC;AACjE,QAAM,UAAmC,CAAC;AAC1C,OAAK,QAAQ,CAAC,OAAO,QAAQ;AAC3B,QAAI,QAAQ,gBAAgB;AAC1B,cAAQ,eAAe,uBAAuB,KAAK;AACnD;AAAA,IACF;AACA,YAAQ,GAAG,IAAI;AAAA,EACjB,CAAC;AACD,SAAO;AACT;AAEA,SAAS,cAAc,OAA4C;AACjE,MAAI,CAAC,MAAO,QAAO,CAAC;AACpB,MAAI,OAAO,UAAU,UAAU;AAC7B,UAAM,UAAU,MAAM,KAAK;AAC3B,QAAI,CAAC,QAAS,QAAO,CAAC;AACtB,QAAI;AACF,YAAM,SAAS,KAAK,MAAM,OAAO;AACjC,aAAO,wBAAwB,MAAM;AAAA,IACvC,QAAQ;AACN,aAAO,wBAAwB,KAAK;AAAA,IACtC;AAAA,EACF;AACA,SAAO,CAAC;AACV;AAEA,SAAS,qBAAqB,OAA0D;AACtF,MAAI,CAAC,MAAO,QAAO,CAAC;AACpB,MAAI,OAAO,UAAU,SAAU,QAAO,CAAC;AACvC,QAAM,UAAU,MAAM,KAAK;AAC3B,MAAI,CAAC,QAAS,QAAO,CAAC;AACtB,MAAI;AACF,UAAM,SAAS,KAAK,MAAM,OAAO;AACjC,WAAO,+BAA+B,MAAM;AAAA,EAC9C,QAAQ;AACN,WAAO,CAAC;AAAA,EACV;AACF;AAEA,eAAsB,IAAI,KAAc;AACtC,QAAM,OAAO,MAAM,mBAAmB,GAAG;AACzC,MAAI,CAAC,QAAQ,CAAC,KAAK,YAAa,CAAC,KAAK,SAAS,CAAC,KAAK,aAAe,QAAO,aAAa,KAAK,EAAE,OAAO,eAAe,GAAG,EAAE,QAAQ,IAAI,CAAC;AACvI,QAAM,MAAM,IAAI,IAAI,IAAI,GAAG;AAC3B,QAAM,cAAc,sBAAsB,UAAU;AAAA,IAClD,UAAU,IAAI,aAAa,IAAI,UAAU,KAAK;AAAA,IAC9C,UAAU,IAAI,aAAa,IAAI,UAAU,KAAK;AAAA,IAC9C,MAAM,IAAI,aAAa,IAAI,MAAM,KAAK;AAAA,IACtC,UAAU,IAAI,aAAa,IAAI,UAAU,KAAK;AAAA,EAChD,CAAC;AACD,MAAI,CAAC,YAAY,SAAS;AACxB,WAAO,aAAa,KAAK,EAAE,OAAO,qCAAqC,GAAG,EAAE,QAAQ,IAAI,CAAC;AAAA,EAC3F;AACA,QAAM,EAAE,UAAU,UAAU,MAAM,SAAS,IAAI,YAAY;AAE3D,QAAM,YAAY,MAAM,uBAAuB;AAC/C,QAAM,KAAK,UAAU,QAAQ,IAAI;AACjC,QAAM,QAAQ,MAAM,gCAAgC,WAAW,MAAM,GAAG;AACxE,QAAM,SAAkC,EAAE,UAAU,UAAU,UAAU,KAAK,SAAU;AACvF,MAAI,MAAO,QAAO,iBAAiB;AACnC,QAAM,UAA0C,EAAE,WAAW,OAAO;AACpE,QAAM,YAAY,OAAO,SAAS,YAAY,OAAO,aAAa;AAClE,QAAM,QAAQ,YAAY,MAAM,GAAG,MAAM,YAAY,MAAM,IAAI;AAC/D,QAAM,cAAc,YAAY,KAAK,IAAI,GAAG,IAAI,IAAI;AACpD,QAAM,kBAAkB,YAAY,WAAW;AAC/C,QAAM,aAAa,aAAa,UAAU,OAAO,KAAK,IAAI,GAAG,KAAK,KAAK,QAAQ,eAAgB,CAAC,IAAI;AACpG,QAAM,aAAa,aAAa,KAAK,IAAI,aAAc,UAAW,IAAI,KAAK,kBAAmB;AAC9F,QAAM,QAAQ,MAAM;AAAA,IAClB;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,MACE;AAAA,MACA,GAAI,YACA;AAAA,QACE,OAAO;AAAA,QACP,QAAQ;AAAA,MACV,IACA,CAAC;AAAA,IACP;AAAA,IACA;AAAA,MACE,UAAU,KAAK,YAAY;AAAA,MAC3B,gBAAgB,SAAS;AAAA,IAC3B;AAAA,EACF;AACA,SAAO,aAAa,KAAK;AAAA,IACvB,OAAO,MAAM,IAAI,CAAC,MAAW;AAC3B,YAAMA,YAAW,uBAAuB,EAAE,eAAe;AACzD,aAAO;AAAA,QACL,IAAI,EAAE;AAAA,QACN,KAAK,EAAE;AAAA,QACP,UAAU,EAAE;AAAA,QACZ,UAAU,EAAE;AAAA,QACZ,WAAW,EAAE;AAAA,QACb,UAAU,EAAE,YAAY;AAAA,QACxB,eAAe,EAAE;AAAA,QACjB,SAAS,EAAE,WAAW;AAAA,QACtB,cAAc,wBAAwB,EAAE,IAAI;AAAA,UAC1C,OAAO;AAAA,UACP,QAAQ;AAAA,UACR,MAAM,0BAA0B,EAAE,QAAQ;AAAA,QAC5C,CAAC;AAAA,QACD,MAAMA,UAAS,QAAQ,CAAC;AAAA,QACxB,aAAaA,UAAS,eAAe,CAAC;AAAA,MACxC;AAAA,IACF,CAAC;AAAA,IACD,GAAI,YACA;AAAA,MACE;AAAA,MACA,MAAM,KAAK,IAAI,aAAc,UAAW;AAAA,MACxC,UAAU;AAAA,MACV;AAAA,IACF,IACA,CAAC;AAAA,EACP,CAAC;AACH;AAEA,eAAsB,KAAK,KAAc;AACvC,QAAM,EAAE,EAAE,IAAI,MAAM,oBAAoB;AACxC,QAAM,OAAO,MAAM,mBAAmB,GAAG;AACzC,MAAI,CAAC,QAAQ,CAAC,KAAK,YAAa,CAAC,KAAK,SAAS,CAAC,KAAK,aAAe,QAAO,aAAa,KAAK,EAAE,OAAO,eAAe,GAAG,EAAE,QAAQ,IAAI,CAAC;AAOvI,MAAI,CAAC,KAAK,OAAO;AACf,WAAO,aAAa,KAAK;AAAA,MACvB,OAAO,EAAE,yCAAyC,gEAAgE;AAAA,IACpH,GAAG,EAAE,QAAQ,IAAI,CAAC;AAAA,EACpB;AACA,QAAM,WAAW,KAAK;AAEtB,QAAM,cAAc,IAAI,QAAQ,IAAI,cAAc,KAAK;AACvD,MAAI,CAAC,YAAY,YAAY,EAAE,SAAS,qBAAqB,GAAG;AAC9D,WAAO,aAAa,KAAK,EAAE,OAAO,+BAA+B,GAAG,EAAE,QAAQ,IAAI,CAAC;AAAA,EACrF;AACA,MAAI,CAAC,oCAAoC,IAAI,QAAQ,IAAI,gBAAgB,CAAC,GAAG;AAC3E,WAAO,aAAa,KAAK,EAAE,OAAO,8CAA8C,GAAG,EAAE,QAAQ,IAAI,CAAC;AAAA,EACpG;AAEA,QAAM,OAAO,MAAM,IAAI,SAAS;AAChC,QAAM,cAAc,iBAAiB,IAAI;AACzC,QAAM,oBAAoB,wBAAwB,WAAW,EAAE;AAC/D,QAAM,WAAW,OAAO,KAAK,IAAI,UAAU,KAAK,EAAE;AAClD,QAAM,WAAW,OAAO,KAAK,IAAI,UAAU,KAAK,EAAE;AAClD,QAAM,WAAW,OAAO,KAAK,IAAI,UAAU,KAAK,EAAE;AAClD,QAAM,OAAO,KAAK,IAAI,MAAM;AAC5B,MAAI,CAAC,YAAY,CAAC,YAAY,CAAC,KAAM,QAAO,aAAa,KAAK,EAAE,OAAO,2CAA2C,GAAG,EAAE,QAAQ,IAAI,CAAC;AACpI,QAAM,uBAAuB,KAAK,IAAI,eAAe;AACrD,QAAM,oBACJ,OAAO,yBAAyB,YAAY,qBAAqB,KAAK,EAAE,SAAS,IAC7E,sBAAsB,oBAAoB,IAC1C;AACN,QAAM,OAAO,cAAc,KAAK,IAAI,MAAM,CAAC;AAC3C,QAAM,sBAAsB,qBAAqB,KAAK,IAAI,aAAa,CAAC;AAExE,QAAM,YAAY,MAAM,uBAAuB;AAC/C,QAAM,KAAK,UAAU,QAAQ,IAAI;AACjC,QAAM,aAAa,UAAU,QAAQ,YAAY;AACjD,QAAM,uBACH,UAAU,QAAQ,sBAAsB,KAAqC,IAAI,qBAAqB,EAAE;AAC3G,QAAM,QAAQ,MAAM,gCAAgC,WAAW,MAAM,GAAG;AACxE,MAAI,CAAC,MAAO,QAAO,aAAa,KAAK,EAAE,OAAO,eAAe,GAAG,EAAE,QAAQ,IAAI,CAAC;AAC/E,QAAM,wBAAwB,EAAE;AAEhC,MAAI,qBAAoC;AACxC,MAAI,2BAA0C;AAC9C,MAAI,UAAU;AACZ,QAAI;AACF,YAAM,EAAE,eAAe,IAAI,MAAM,OAAO,mDAAmD;AAC3F,YAAM,MAAM,MAAM,GAAG,QAAQ,gBAAgB;AAAA,QAC3C;AAAA,QACA,KAAK;AAAA,QACL,MAAM;AAAA,UACJ,EAAE,KAAK,CAAE,EAAE,UAAU,KAAK,SAAS,GAAG,EAAE,UAAU,KAAK,CAAE,EAAE;AAAA,QAC7D;AAAA,QACA,UAAU;AAAA,MACZ,CAAC;AACD,YAAM,MAAO,KAAa,cAAc,CAAC;AACzC,YAAM,OAAO,KAAK,QAAQ,IAAI,MAAM,GAAG,EAAE,IAAI,GAAG,YAAY,KAAK;AACjE,UAAI,MAAM,QAAQ,IAAI,gBAAgB,KAAK,IAAI,iBAAiB,QAAQ;AACtE,cAAM,UAAU,IAAI,IAAK,IAAI,iBAA2B,IAAI,CAAC,MAAW,OAAO,CAAC,EAAE,YAAY,EAAE,QAAQ,OAAO,EAAE,CAAC,CAAC;AACnH,YAAI,CAAC,QAAQ,IAAI,GAAG,EAAG,QAAO,aAAa,KAAK,EAAE,OAAO,wBAAwB,GAAG,EAAE,QAAQ,IAAI,CAAC;AAAA,MACrG;AACA,UAAI,OAAO,IAAI,wBAAwB,YAAY,IAAI,sBAAsB,GAAG;AAC9E,mCAA2B,IAAI;AAAA,MACjC;AACA,UAAI,OAAO,IAAI,kBAAkB,YAAY,IAAI,cAAc,KAAK,EAAE,SAAS,GAAG;AAChF,6BAAqB,sBAAsB,IAAI,aAAa;AAAA,MAC9D;AAAA,IACF,QAAQ;AAAA,IAAC;AAAA,EACX;AACA,MAAI,gCAAgC,KAAK,IAAI,GAAG;AAC9C,WAAO,aAAa,KAAK;AAAA,MACvB,OAAO,EAAE,0CAA0C,uDAAuD;AAAA,IAC5G,GAAG,EAAE,QAAQ,IAAI,CAAC;AAAA,EACpB;AACA,QAAM,oBAAoB,0BAA0B,wBAAwB;AAC5E,MAAI,KAAK,OAAO,mBAAmB;AACjC,WAAO,aAAa,KAAK;AAAA,MACvB,OAAO,EAAE,oCAAoC,6CAA6C;AAAA,IAC5F,GAAG,EAAE,QAAQ,IAAI,CAAC;AAAA,EACpB;AACA,QAAM,mBAAmB,MAAM,+BAA+B,IAAI,QAAQ;AAC1E,MAAI,gCAAgC,kBAAkB,KAAK,IAAI,GAAG;AAChE,WAAO,aAAa,KAAK;AAAA,MACvB,OAAO,EAAE,oCAAoC,oDAAoD;AAAA,IACnG,GAAG,EAAE,QAAQ,IAAI,CAAC;AAAA,EACpB;AACA,QAAM,MAAM,OAAO,KAAK,MAAM,KAAK,YAAY,CAAC;AAChD,QAAM,WAAW,yBAAyB,KAAK,IAAI;AACnD,QAAM,eAAe,yBAAyB,KAAK,UAAW,KAAa,IAAI;AAC/E,MAAI,0BAA0B,KAAK,UAAU,YAAY,GAAG;AAC1D,WAAO,aAAa,KAAK,EAAE,OAAO,EAAE,2CAA2C,yCAAyC,EAAE,GAAG,EAAE,QAAQ,IAAI,CAAC;AAAA,EAC9I;AACA,QAAM,uBAAuB,4BAA4B,QAAQ;AACjE,QAAM,wBAAwB,qBAAqB,sBAAsB;AACzE,QAAM,0BAA0B,MAAM;AAAA,IACpC,IAAI;AAAA,MACF,CAAC,mBAAmB,oBAAoB,qBAAqB,EAAE;AAAA,QAC7D,CAAC,SAAyB,OAAO,SAAS,YAAY,KAAK,SAAS;AAAA,MACtE;AAAA,IACF;AAAA,EACF;AACA,MAAI,YAAwC;AAC5C,aAAW,QAAQ,yBAAyB;AAC1C,UAAM,SAAS,MAAM,GAAG,QAAQ,qBAAqB,EAAE,KAAK,CAAC;AAC7D,QAAI,QAAQ;AACV,kBAAY;AACZ;AAAA,IACF;AAAA,EACF;AACA,MAAI,CAAC,WAAW;AACd,gBAAY,MAAM,GAAG,QAAQ,qBAAqB,EAAE,MAAM,qBAAqB,CAAC;AAAA,EAClF;AACA,MAAI,CAAC,WAAW;AACd,WAAO,aAAa,KAAK,EAAE,OAAO,uCAAuC,GAAG,EAAE,QAAQ,IAAI,CAAC;AAAA,EAC7F;AACA,QAAM,0BACJ,OAAO,sBAAsB,YAC7B,kBAAkB,SAAS,KAC3B,UAAU,SAAS,qBACnB,UAAU,aAAa,QACvB,UAAU,SAAS,wBACnB,UAAU,SAAS;AACrB,MAAI,yBAAyB;AAC3B,WAAO,aAAa,KAAK,EAAE,OAAO,EAAE,6CAA6C,0EAA0E,EAAE,GAAG,EAAE,QAAQ,IAAI,CAAC;AAAA,EACjL;AACA,QAAM,eAAe,MAAM,qBAAqB,oBAAoB,UAAU,MAAM,EAAE,UAAU,gBAAgB,MAAM,CAAC;AACvH,MAAI;AACJ,MAAI;AACF,UAAM,SAAS,MAAM,aAAa,MAAM;AAAA,MACtC,eAAe,UAAU;AAAA,MACzB;AAAA,MACA;AAAA,MACA,UAAU;AAAA,MACV,QAAQ;AAAA,IACV,CAAC;AACD,iBAAa,OAAO;AAAA,EACtB,SAAS,OAAO;AACd,WAAO,MAAM,0BAA0B,EAAE,KAAK,MAAM,CAAC;AACrD,WAAO,aAAa,KAAK,EAAE,OAAO,gCAAgC,GAAG,EAAE,QAAQ,IAAI,CAAC;AAAA,EACtF;AAEA,QAAM,cACJ,OAAQ,UAAkB,gBAAgB,YACtC,QAAS,UAAkB,WAAW,IACtC,mCAAmC;AACzC,MAAI,mBAAkC;AACtC,QAAM,cAAc,eAAe,gBAAgB,cAAc,QAAQ;AACzE,QAAM,aAAa,cAAc,IAAI,WAAW,IAAI;AACpD,QAAM,YAAY,QAAQ,eAAe,YAAY,SAAS;AAE9D,MAAI,eAAe,CAAC,WAAW;AAC7B,UAAM,EAAE,UAAU,WAAW,QAAQ,IAAI,MAAM,aAAa,YAAY,UAAU,MAAM,UAAU;AAClG,QAAI;AACF,yBAAmB,MAAM,yBAAyB;AAAA,QAChD,UAAU;AAAA,QACV,UAAU;AAAA,MACZ,CAAC;AAAA,IACH,SAAS,OAAO;AACd,aAAO,MAAM,wCAAwC,EAAE,KAAK,MAAM,CAAC;AAAA,IACrE,UAAE;AACA,YAAM,QAAQ,EAAE,MAAM,MAAM;AAAA,MAAC,CAAC;AAAA,IAChC;AAAA,EACF;AAEA,MAAI,cAAc,oBAAoB,MAAM;AAC5C,MAAI,aAAa,mBAAmB;AAClC,kBAAc,iBAAiB,aAAa,EAAE,MAAM,UAAU,IAAI,SAAS,CAAC;AAAA,EAC9E;AACA,QAAMA,YAAW,wBAAwB,MAAM,EAAE,aAAa,KAAK,CAAC;AACpE,QAAM,eAAe,WAAW;AAChC,iCAA+B,EAAE,UAAU,KAAK,UAAU,gBAAgB,MAAM,CAAC;AACjF,QAAM,MAAM,GAAG,OAAO,YAAY;AAAA,IAChC,IAAI;AAAA,IACJ;AAAA,IACA;AAAA,IACA,gBAAgB;AAAA,IAChB,UAAU,KAAK;AAAA,IACf,UAAU;AAAA,IACV,UAAU;AAAA,IACV,UAAU,IAAI;AAAA,IACd,eAAe,UAAU;AAAA,IACzB,eAAe,UAAU,iBAAiB;AAAA,IAC1C,aAAa;AAAA,IACb,KAAK,uBAAuB,YAAY;AAAA,IACxC,SAAS;AAAA,IACT,iBAAiBA;AAAA,EACnB,CAAC;AAGD,MAAI;AACF,UAAM,GAAG,cAAc,OAAO,OAAO;AACnC,YAAM,GAAG,QAAQ,GAAG,EAAE,MAAM;AAC5B,UAAI,YAAY;AACd,cAAM,qBAAqB;AAAA,UACzB;AAAA,UACA,UAAU,EAAE,YAAY;AAAA,UACxB,UAAU;AAAA,UACV;AAAA,UACA,gBAAgB;AAAA,UAChB,QAAQ;AAAA,QACV,CAAC;AAAA,MACH;AAAA,IACF,CAAC;AAAA,EACH,SAAS,OAAO;AACd,WAAO,MAAM,uDAAuD,EAAE,KAAK,MAAM,CAAC;AAClF,WAAO,aAAa,KAAK,EAAE,OAAO,wCAAwC,GAAG,EAAE,QAAQ,IAAI,CAAC;AAAA,EAC9F;AAEA,MAAI,WAAW;AACb,yBAAqB,IAAI,KAAK,cAAc,UAAU,EAAE,MAAM,CAAC,UAAU;AACvE,aAAO,MAAM,kCAAkC,EAAE,KAAK,MAAM,CAAC;AAAA,IAC/D,CAAC;AAAA,EACH,WAAW,aAAa;AACtB,WAAO,KAAK,iGAAiG;AAAA,EAC/G;AAEA,MAAI,YAAY;AACd,UAAM,oBAAoB;AAAA,MACxB;AAAA,MACA,QAAQ;AAAA,MACR,QAAQ;AAAA,MACR,aAAa;AAAA,QACX,IAAI,IAAI;AAAA,QACR,gBAAgB,IAAI,kBAAkB;AAAA,QACtC,UAAU,IAAI,YAAY;AAAA,MAC5B;AAAA,MACA,QAAQ;AAAA,MACR,SAAS;AAAA,IACX,CAAC;AACD,UAAM,WAAW,sBAAsB;AAAA,EACzC;AAEA,SAAO,aAAa,KAAK;AAAA,IACvB,IAAI;AAAA,IACJ,MAAM;AAAA,MACJ,IAAI;AAAA,MACJ,KAAK,IAAI;AAAA,MACT,UAAU;AAAA,MACV,UAAU,IAAI;AAAA,MACd,eAAe,UAAU;AAAA,MACzB,cAAc,wBAAwB,cAAc;AAAA,QAClD,OAAO;AAAA,QACP,QAAQ;AAAA,QACR,MAAM,0BAA0B,QAAQ;AAAA,MAC1C,CAAC;AAAA,MACD,SAAS,oBAAoB;AAAA,MAC7B,MAAMA,UAAS,QAAQ,CAAC;AAAA,MACxB,aAAaA,UAAS,eAAe,CAAC;AAAA,MACtC,cAAc,OAAO,KAAK,iBAAiB,EAAE,SAAS,oBAAoB;AAAA,IAC5E;AAAA,EACF,CAAC;AACH;AAEA,eAAe,+BAA+B,IAAmB,UAAmC;AAClG,MAAI;AACF,UAAM,KAAK,GAAG,UAAe;AAC7B,UAAM,MAAM,MAAM,GACf,WAAW,aAAa,EACxB,OAAO,oBAA4B,GAAG,YAAY,CAAC,EACnD,MAAM,aAAa,KAAK,QAAQ,EAChC,iBAAiB;AACpB,UAAM,QAAQ,KAAK;AACnB,QAAI,OAAO,UAAU,SAAU,QAAO,OAAO,SAAS,KAAK,IAAI,QAAQ;AACvE,QAAI,OAAO,UAAU,UAAU;AAC7B,YAAM,SAAS,OAAO,KAAK;AAC3B,aAAO,OAAO,SAAS,MAAM,IAAI,SAAS;AAAA,IAC5C;AACA,WAAO;AAAA,EACT,QAAQ;AACN,WAAO;AAAA,EACT;AACF;AAEA,eAAsB,OAAO,KAAc;AACzC,QAAM,OAAO,MAAM,mBAAmB,GAAG;AACzC,MAAI,CAAC,QAAQ,CAAC,KAAK,YAAa,CAAC,KAAK,SAAS,CAAC,KAAK,aAAe,QAAO,aAAa,KAAK,EAAE,OAAO,eAAe,GAAG,EAAE,QAAQ,IAAI,CAAC;AACvI,QAAM,MAAM,IAAI,IAAI,IAAI,GAAG;AAC3B,QAAM,KAAK,IAAI,aAAa,IAAI,IAAI,KAAK;AACzC,MAAI,CAAC,GAAI,QAAO,aAAa,KAAK,EAAE,OAAO,4BAA4B,GAAG,EAAE,QAAQ,IAAI,CAAC;AACzF,QAAM,YAAY,MAAM,uBAAuB;AAC/C,QAAM,KAAK,UAAU,QAAQ,IAAI;AACjC,QAAM,aAAa,UAAU,QAAQ,YAAY;AACjD,QAAM,uBACH,UAAU,QAAQ,sBAAsB,KAAqC,IAAI,qBAAqB,EAAE;AAM3G,QAAM,QAAQ,MAAM,gCAAgC,WAAW,MAAM,GAAG;AACxE,QAAM,eAAwC,EAAE,IAAI,UAAU,KAAK,SAAU;AAC7E,MAAI,MAAO,cAAa,iBAAiB;AACzC,QAAM,SAAS,MAAM,GAAG,QAAQ,YAAY,YAAY;AACxD,MAAI,CAAC,OAAQ,QAAO,aAAa,KAAK,EAAE,OAAO,uBAAuB,GAAG,EAAE,QAAQ,IAAI,CAAC;AACxF,QAAM,GAAG,OAAO,MAAM,EAAE,MAAM;AAC9B,QAAM,8BAA8B,OAAO,eAAe,OAAO,EAAE,EAAE,MAAM,CAAC,UAAU;AACpF,WAAO,MAAM,uCAAuC,EAAE,KAAK,MAAM,CAAC;AAAA,EACpE,CAAC;AACD,MAAI,OAAO,aAAa;AACtB,UAAM,YAAY,MAAM,qBAAqB,oBAAoB,OAAO,eAAe;AAAA,MACrF,UAAU,OAAO,YAAY,KAAK;AAAA,MAClC,gBAAgB,OAAO,kBAAkB,SAAS;AAAA,IACpD,CAAC;AACD,UAAM,UAAU,OAAO,OAAO,eAAe,OAAO,WAAW;AAAA,EACjE;AACA,MAAI,YAAY;AACd,UAAM,oBAAoB;AAAA,MACxB;AAAA,MACA,QAAQ;AAAA,MACR,QAAQ;AAAA,MACR,aAAa;AAAA,QACX,IAAI,OAAO;AAAA,QACX,gBAAgB,OAAO,kBAAkB;AAAA,QACzC,UAAU,OAAO,YAAY;AAAA,MAC/B;AAAA,MACA,QAAQ;AAAA,MACR,SAAS;AAAA,IACX,CAAC;AACD,UAAM,WAAW,sBAAsB;AAAA,EACzC;AACA,SAAO,aAAa,KAAK,EAAE,IAAI,KAAK,CAAC;AACvC;AAEO,MAAM,UAA2B;AAAA,EACtC,SAAS;AAAA,EACT,aAAa;AAAA,EACb,SAAS;AAAA,IACP,KAAK;AAAA,MACH,SAAS;AAAA,MACT,aAAa;AAAA,MACb,OAAO;AAAA,MACP,WAAW;AAAA,QACT,EAAE,QAAQ,KAAK,aAAa,oCAAoC,QAAQ,6BAA6B;AAAA,MACvG;AAAA,MACA,QAAQ;AAAA,QACN,EAAE,QAAQ,KAAK,aAAa,wCAAwC,QAAQ,YAAY;AAAA,QACxF,EAAE,QAAQ,KAAK,aAAa,gBAAgB,QAAQ,YAAY;AAAA,MAClE;AAAA,IACF;AAAA,IACA,MAAM;AAAA,MACJ,SAAS;AAAA,MACT,aAAa;AAAA,MACb,aAAa;AAAA,QACX,aAAa;AAAA,QACb,QAAQ;AAAA,MACV;AAAA,MACA,WAAW;AAAA,QACT,EAAE,QAAQ,KAAK,aAAa,kCAAkC,QAAQ,qBAAqB;AAAA,MAC7F;AAAA,MACA,QAAQ;AAAA,QACN,EAAE,QAAQ,KAAK,aAAa,4BAA4B,QAAQ,YAAY;AAAA,QAC5E,EAAE,QAAQ,KAAK,aAAa,gBAAgB,QAAQ,YAAY;AAAA,QAChE,EAAE,QAAQ,KAAK,aAAa,yCAAyC,QAAQ,YAAY;AAAA,MAC3F;AAAA,IACF;AAAA,IACA,QAAQ;AAAA,MACN,SAAS;AAAA,MACT,aAAa;AAAA,MACb,OAAO;AAAA,MACP,WAAW;AAAA,QACT,EAAE,QAAQ,KAAK,aAAa,sBAAsB,QAAQ,EAAE,OAAO,EAAE,IAAI,EAAE,QAAQ,IAAI,EAAE,CAAC,EAAE;AAAA,QAC5F,EAAE,QAAQ,KAAK,aAAa,wBAAwB,QAAQ,YAAY;AAAA,MAC1E;AAAA,MACA,QAAQ;AAAA,QACN,EAAE,QAAQ,KAAK,aAAa,iCAAiC,QAAQ,YAAY;AAAA,QACjF,EAAE,QAAQ,KAAK,aAAa,gBAAgB,QAAQ,YAAY;AAAA,MAClE;AAAA,IACF;AAAA,EACF;AACF;",
   "names": ["metadata"]
 }

package/dist/modules/attachments/components/AttachmentContentPreview.js

@@ -2,6 +2,7 @@ import { jsx, jsxs } from "react/jsx-runtime";
 import * as React from "react";
 import { MarkdownContent } from "@open-mercato/ui/backend/markdown";
 import { Button } from "@open-mercato/ui/primitives/button";
+import { Tabs, TabsList, TabsTrigger } from "@open-mercato/ui/primitives/tabs";
 function AttachmentContentPreview({
   content,
   maxLength = 480,
@@ -14,50 +15,21 @@ function AttachmentContentPreview({
   const [expanded, setExpanded] = React.useState(false);
   const [tab, setTab] = React.useState("source");
   const text = (content ?? "").trim();
-  const sourceTabId = "attachment-content-preview-tab-source";
-  const previewTabId = "attachment-content-preview-tab-preview";
-  const sourcePanelId = "attachment-content-preview-panel-source";
-  const previewPanelId = "attachment-content-preview-panel-preview";
   if (!text) {
     return /* @__PURE__ */ jsx("div", { className: "text-xs text-muted-foreground italic", children: emptyLabel });
   }
   const shouldTruncate = !expanded && text.length > maxLength;
   const display = tab === "source" && shouldTruncate ? `${text.slice(0, maxLength)}\u2026` : text;
   return /* @__PURE__ */ jsxs("div", { className: "space-y-2", children: [
-    /* @__PURE__ */ jsx("div", { className: "border-b border-border", children: /* @__PURE__ */ jsxs("nav", { className: "flex items-center gap-4 text-xs", role: "tablist", "aria-label": "Content preview mode", children: [
-      /* @__PURE__ */ jsx(
-        "button",
-        {
-          type: "button",
-          id: sourceTabId,
-          role: "tab",
-          "aria-selected": tab === "source",
-          "aria-controls": sourcePanelId,
-          className: `-mb-px border-b-2 px-0 pb-2 font-medium transition-colors ${tab === "source" ? "border-accent-indigo text-foreground" : "border-transparent text-muted-foreground hover:text-foreground"}`,
-          onClick: () => setTab("source"),
-          children: sourceLabel
-        }
-      ),
-      /* @__PURE__ */ jsx(
-        "button",
-        {
-          type: "button",
-          id: previewTabId,
-          role: "tab",
-          "aria-selected": tab === "preview",
-          "aria-controls": previewPanelId,
-          className: `-mb-px border-b-2 px-0 pb-2 font-medium transition-colors ${tab === "preview" ? "border-accent-indigo text-foreground" : "border-transparent text-muted-foreground hover:text-foreground"}`,
-          onClick: () => setTab("preview"),
-          children: previewLabel
-        }
-      )
+    /* @__PURE__ */ jsx(Tabs, { value: tab, onValueChange: (value) => setTab(value), variant: "underline", children: /* @__PURE__ */ jsxs(TabsList, { className: "w-full", children: [
+      /* @__PURE__ */ jsx(TabsTrigger, { value: "source", children: sourceLabel }),
+      /* @__PURE__ */ jsx(TabsTrigger, { value: "preview", children: previewLabel })
     ] }) }),
     tab === "source" ? /* @__PURE__ */ jsx(
       "div",
       {
         role: "tabpanel",
-        id: sourcePanelId,
-        "aria-labelledby": sourceTabId,
+        "aria-label": sourceLabel,
         "data-testid": "attachment-content-preview",
         className: "whitespace-pre-wrap text-sm text-muted-foreground",
         children: display
@@ -66,8 +38,7 @@ function AttachmentContentPreview({
       "div",
       {
         role: "tabpanel",
-        id: previewPanelId,
-        "aria-labelledby": previewTabId,
+        "aria-label": previewLabel,
         "data-testid": "markdown-preview",
         children: /* @__PURE__ */ jsx(
           MarkdownContent,

package/dist/modules/attachments/components/AttachmentContentPreview.js.map

@@ -1,7 +1,7 @@
 {
   "version": 3,
   "sources": ["../../../../src/modules/attachments/components/AttachmentContentPreview.tsx"],
-  "sourcesContent": ["import * as React from 'react'\nimport { MarkdownContent } from '@open-mercato/ui/backend/markdown'\nimport { Button } from '@open-mercato/ui/primitives/button'\n\ntype Props = {\n  content?: string | null\n  maxLength?: number\n  emptyLabel?: string\n  showMoreLabel?: string\n  showLessLabel?: string\n  sourceLabel?: string\n  previewLabel?: string\n}\n\nexport function AttachmentContentPreview({\n  content,\n  maxLength = 480,\n  emptyLabel = 'No text extracted',\n  showMoreLabel = 'Show more',\n  showLessLabel = 'Show less',\n  sourceLabel = 'Source',\n  previewLabel = 'Preview',\n}: Props) {\n  const [expanded, setExpanded] = React.useState(false)\n  const [tab, setTab] = React.useState<'source' | 'preview'>('source')\n  const text = (content ?? '').trim()\n\n  // ARIA IDs for accessibility\n  const sourceTabId = 'attachment-content-preview-tab-source'\n  const previewTabId = 'attachment-content-preview-tab-preview'\n  const sourcePanelId = 'attachment-content-preview-panel-source'\n  const previewPanelId = 'attachment-content-preview-panel-preview'\n\n  if (!text) {\n    return <div className=\"text-xs text-muted-foreground italic\">{emptyLabel}</div>\n  }\n\n  const shouldTruncate = !expanded && text.length > maxLength\n  const display = tab === 'source' && shouldTruncate ? `${text.slice(0, maxLength)}\u2026` : text\n\n  return (\n    <div className=\"space-y-2\">\n      {/* Tab Navigation */}\n      <div className=\"border-b border-border\">\n        <nav className=\"flex items-center gap-4 text-xs\" role=\"tablist\" aria-label=\"Content preview mode\">\n          <button\n            type=\"button\"\n            id={sourceTabId}\n            role=\"tab\"\n            aria-selected={tab === 'source'}\n            aria-controls={sourcePanelId}\n            className={`-mb-px border-b-2 px-0 pb-2 font-medium transition-colors ${\n              tab === 'source'\n                ? 'border-accent-indigo text-foreground'\n                : 'border-transparent text-muted-foreground hover:text-foreground'\n            }`}\n            onClick={() => setTab('source')}\n          >\n            {sourceLabel}\n          </button>\n          <button\n            type=\"button\"\n            id={previewTabId}\n            role=\"tab\"\n            aria-selected={tab === 'preview'}\n            aria-controls={previewPanelId}\n            className={`-mb-px border-b-2 px-0 pb-2 font-medium transition-colors ${\n              tab === 'preview'\n                ? 'border-accent-indigo text-foreground'\n                : 'border-transparent text-muted-foreground hover:text-foreground'\n            }`}\n            onClick={() => setTab('preview')}\n          >\n            {previewLabel}\n          </button>\n        </nav>\n      </div>\n\n      {/* Tab Panels */}\n      {tab === 'source' ? (\n        <div\n          role=\"tabpanel\"\n          id={sourcePanelId}\n          aria-labelledby={sourceTabId}\n          data-testid=\"attachment-content-preview\"\n          className=\"whitespace-pre-wrap text-sm text-muted-foreground\"\n        >\n          {display}\n        </div>\n      ) : (\n        <div\n          role=\"tabpanel\"\n          id={previewPanelId}\n          aria-labelledby={previewTabId}\n          data-testid=\"markdown-preview\"\n        >\n          <MarkdownContent\n            body={text}\n            format=\"markdown\"\n            className=\"text-sm text-muted-foreground [&>*]:mb-2 [&>*:last-child]:mb-0 [&_ul]:ml-4 [&_ul]:list-disc [&_ol]:ml-4 [&_ol]:list-decimal [&_code]:rounded [&_code]:bg-muted [&_code]:px-1 [&_code]:py-0.5 [&_pre]:rounded-md [&_pre]:bg-muted [&_pre]:p-3 [&_pre]:text-xs\"\n          />\n        </div>\n      )}\n\n      {/* Show More/Less Button (only on source tab) */}\n      {tab === 'source' && text.length > maxLength ? (\n        <Button\n          type=\"button\"\n          variant=\"ghost\"\n          size=\"sm\"\n          className=\"h-auto px-0 py-1 text-xs\"\n          onClick={() => setExpanded((prev) => !prev)}\n        >\n          {expanded ? showLessLabel : showMoreLabel}\n        </Button>\n      ) : null}\n    </div>\n  )\n}\n"],
-  "mappings": "AAkCW,cAUH,YAVG;AAlCX,YAAY,WAAW;AACvB,SAAS,uBAAuB;AAChC,SAAS,cAAc;AAYhB,SAAS,yBAAyB;AAAA,EACvC;AAAA,EACA,YAAY;AAAA,EACZ,aAAa;AAAA,EACb,gBAAgB;AAAA,EAChB,gBAAgB;AAAA,EAChB,cAAc;AAAA,EACd,eAAe;AACjB,GAAU;AACR,QAAM,CAAC,UAAU,WAAW,IAAI,MAAM,SAAS,KAAK;AACpD,QAAM,CAAC,KAAK,MAAM,IAAI,MAAM,SAA+B,QAAQ;AACnE,QAAM,QAAQ,WAAW,IAAI,KAAK;AAGlC,QAAM,cAAc;AACpB,QAAM,eAAe;AACrB,QAAM,gBAAgB;AACtB,QAAM,iBAAiB;AAEvB,MAAI,CAAC,MAAM;AACT,WAAO,oBAAC,SAAI,WAAU,wCAAwC,sBAAW;AAAA,EAC3E;AAEA,QAAM,iBAAiB,CAAC,YAAY,KAAK,SAAS;AAClD,QAAM,UAAU,QAAQ,YAAY,iBAAiB,GAAG,KAAK,MAAM,GAAG,SAAS,CAAC,WAAM;AAEtF,SACE,qBAAC,SAAI,WAAU,aAEb;AAAA,wBAAC,SAAI,WAAU,0BACb,+BAAC,SAAI,WAAU,mCAAkC,MAAK,WAAU,cAAW,wBACzE;AAAA;AAAA,QAAC;AAAA;AAAA,UACC,MAAK;AAAA,UACL,IAAI;AAAA,UACJ,MAAK;AAAA,UACL,iBAAe,QAAQ;AAAA,UACvB,iBAAe;AAAA,UACf,WAAW,6DACT,QAAQ,WACJ,yCACA,gEACN;AAAA,UACA,SAAS,MAAM,OAAO,QAAQ;AAAA,UAE7B;AAAA;AAAA,MACH;AAAA,MACA;AAAA,QAAC;AAAA;AAAA,UACC,MAAK;AAAA,UACL,IAAI;AAAA,UACJ,MAAK;AAAA,UACL,iBAAe,QAAQ;AAAA,UACvB,iBAAe;AAAA,UACf,WAAW,6DACT,QAAQ,YACJ,yCACA,gEACN;AAAA,UACA,SAAS,MAAM,OAAO,SAAS;AAAA,UAE9B;AAAA;AAAA,MACH;AAAA,OACF,GACF;AAAA,IAGC,QAAQ,WACP;AAAA,MAAC;AAAA;AAAA,QACC,MAAK;AAAA,QACL,IAAI;AAAA,QACJ,mBAAiB;AAAA,QACjB,eAAY;AAAA,QACZ,WAAU;AAAA,QAET;AAAA;AAAA,IACH,IAEA;AAAA,MAAC;AAAA;AAAA,QACC,MAAK;AAAA,QACL,IAAI;AAAA,QACJ,mBAAiB;AAAA,QACjB,eAAY;AAAA,QAEZ;AAAA,UAAC;AAAA;AAAA,YACC,MAAM;AAAA,YACN,QAAO;AAAA,YACP,WAAU;AAAA;AAAA,QACZ;AAAA;AAAA,IACF;AAAA,IAID,QAAQ,YAAY,KAAK,SAAS,YACjC;AAAA,MAAC;AAAA;AAAA,QACC,MAAK;AAAA,QACL,SAAQ;AAAA,QACR,MAAK;AAAA,QACL,WAAU;AAAA,QACV,SAAS,MAAM,YAAY,CAAC,SAAS,CAAC,IAAI;AAAA,QAEzC,qBAAW,gBAAgB;AAAA;AAAA,IAC9B,IACE;AAAA,KACN;AAEJ;",
+  "sourcesContent": ["import * as React from 'react'\nimport { MarkdownContent } from '@open-mercato/ui/backend/markdown'\nimport { Button } from '@open-mercato/ui/primitives/button'\nimport { Tabs, TabsList, TabsTrigger } from '@open-mercato/ui/primitives/tabs'\n\ntype Props = {\n  content?: string | null\n  maxLength?: number\n  emptyLabel?: string\n  showMoreLabel?: string\n  showLessLabel?: string\n  sourceLabel?: string\n  previewLabel?: string\n}\n\nexport function AttachmentContentPreview({\n  content,\n  maxLength = 480,\n  emptyLabel = 'No text extracted',\n  showMoreLabel = 'Show more',\n  showLessLabel = 'Show less',\n  sourceLabel = 'Source',\n  previewLabel = 'Preview',\n}: Props) {\n  const [expanded, setExpanded] = React.useState(false)\n  const [tab, setTab] = React.useState<'source' | 'preview'>('source')\n  const text = (content ?? '').trim()\n\n  if (!text) {\n    return <div className=\"text-xs text-muted-foreground italic\">{emptyLabel}</div>\n  }\n\n  const shouldTruncate = !expanded && text.length > maxLength\n  const display = tab === 'source' && shouldTruncate ? `${text.slice(0, maxLength)}\u2026` : text\n\n  return (\n    <div className=\"space-y-2\">\n      {/* Tab Navigation */}\n      <Tabs value={tab} onValueChange={(value) => setTab(value as 'source' | 'preview')} variant=\"underline\">\n        <TabsList className=\"w-full\">\n          <TabsTrigger value=\"source\">{sourceLabel}</TabsTrigger>\n          <TabsTrigger value=\"preview\">{previewLabel}</TabsTrigger>\n        </TabsList>\n      </Tabs>\n\n      {/* Tab Panels */}\n      {tab === 'source' ? (\n        <div\n          role=\"tabpanel\"\n          aria-label={sourceLabel}\n          data-testid=\"attachment-content-preview\"\n          className=\"whitespace-pre-wrap text-sm text-muted-foreground\"\n        >\n          {display}\n        </div>\n      ) : (\n        <div\n          role=\"tabpanel\"\n          aria-label={previewLabel}\n          data-testid=\"markdown-preview\"\n        >\n          <MarkdownContent\n            body={text}\n            format=\"markdown\"\n            className=\"text-sm text-muted-foreground [&>*]:mb-2 [&>*:last-child]:mb-0 [&_ul]:ml-4 [&_ul]:list-disc [&_ol]:ml-4 [&_ol]:list-decimal [&_code]:rounded [&_code]:bg-muted [&_code]:px-1 [&_code]:py-0.5 [&_pre]:rounded-md [&_pre]:bg-muted [&_pre]:p-3 [&_pre]:text-xs\"\n          />\n        </div>\n      )}\n\n      {/* Show More/Less Button (only on source tab) */}\n      {tab === 'source' && text.length > maxLength ? (\n        <Button\n          type=\"button\"\n          variant=\"ghost\"\n          size=\"sm\"\n          className=\"h-auto px-0 py-1 text-xs\"\n          onClick={() => setExpanded((prev) => !prev)}\n        >\n          {expanded ? showLessLabel : showMoreLabel}\n        </Button>\n      ) : null}\n    </div>\n  )\n}\n"],
+  "mappings": "AA6BW,cAUH,YAVG;AA7BX,YAAY,WAAW;AACvB,SAAS,uBAAuB;AAChC,SAAS,cAAc;AACvB,SAAS,MAAM,UAAU,mBAAmB;AAYrC,SAAS,yBAAyB;AAAA,EACvC;AAAA,EACA,YAAY;AAAA,EACZ,aAAa;AAAA,EACb,gBAAgB;AAAA,EAChB,gBAAgB;AAAA,EAChB,cAAc;AAAA,EACd,eAAe;AACjB,GAAU;AACR,QAAM,CAAC,UAAU,WAAW,IAAI,MAAM,SAAS,KAAK;AACpD,QAAM,CAAC,KAAK,MAAM,IAAI,MAAM,SAA+B,QAAQ;AACnE,QAAM,QAAQ,WAAW,IAAI,KAAK;AAElC,MAAI,CAAC,MAAM;AACT,WAAO,oBAAC,SAAI,WAAU,wCAAwC,sBAAW;AAAA,EAC3E;AAEA,QAAM,iBAAiB,CAAC,YAAY,KAAK,SAAS;AAClD,QAAM,UAAU,QAAQ,YAAY,iBAAiB,GAAG,KAAK,MAAM,GAAG,SAAS,CAAC,WAAM;AAEtF,SACE,qBAAC,SAAI,WAAU,aAEb;AAAA,wBAAC,QAAK,OAAO,KAAK,eAAe,CAAC,UAAU,OAAO,KAA6B,GAAG,SAAQ,aACzF,+BAAC,YAAS,WAAU,UAClB;AAAA,0BAAC,eAAY,OAAM,UAAU,uBAAY;AAAA,MACzC,oBAAC,eAAY,OAAM,WAAW,wBAAa;AAAA,OAC7C,GACF;AAAA,IAGC,QAAQ,WACP;AAAA,MAAC;AAAA;AAAA,QACC,MAAK;AAAA,QACL,cAAY;AAAA,QACZ,eAAY;AAAA,QACZ,WAAU;AAAA,QAET;AAAA;AAAA,IACH,IAEA;AAAA,MAAC;AAAA;AAAA,QACC,MAAK;AAAA,QACL,cAAY;AAAA,QACZ,eAAY;AAAA,QAEZ;AAAA,UAAC;AAAA;AAAA,YACC,MAAM;AAAA,YACN,QAAO;AAAA,YACP,WAAU;AAAA;AAAA,QACZ;AAAA;AAAA,IACF;AAAA,IAID,QAAQ,YAAY,KAAK,SAAS,YACjC;AAAA,MAAC;AAAA;AAAA,QACC,MAAK;AAAA,QACL,SAAQ;AAAA,QACR,MAAK;AAAA,QACL,WAAU;AAAA,QACV,SAAS,MAAM,YAAY,CAAC,SAAS,CAAC,IAAI;AAAA,QAEzC,qBAAW,gBAAgB;AAAA;AAAA,IAC9B,IACE;AAAA,KACN;AAEJ;",
   "names": []
 }

package/dist/modules/attachments/lib/reconcileOrganization.js

@@ -0,0 +1,110 @@
+import { createLogger } from "@open-mercato/shared/lib/logger";
+import { Attachment } from "../data/entities.js";
+const logger = createLogger("attachments").child({ component: "reconcileOrganization" });
+const LIBRARY_ENTITY_ID = "attachments:library";
+const DEFAULT_BATCH_SIZE = 500;
+function readParentOrganizationId(record) {
+  const raw = record["organization_id"] ?? record["organizationId"];
+  if (typeof raw === "string" && raw.trim().length) return raw.trim();
+  return null;
+}
+function ensureBucket(report, entityId) {
+  const existing = report.byEntity[entityId];
+  if (existing) return existing;
+  const bucket = { scanned: 0, updated: 0, unresolved: 0 };
+  report.byEntity[entityId] = bucket;
+  return bucket;
+}
+async function reconcileAttachmentOrganizations(opts) {
+  const { em, queryEngine, tenantId } = opts;
+  const batchSize = opts.batchSize && opts.batchSize > 0 ? opts.batchSize : DEFAULT_BATCH_SIZE;
+  const report = {
+    scanned: 0,
+    updated: 0,
+    unresolved: 0,
+    skippedVirtual: 0,
+    byEntity: {}
+  };
+  const rows = await em.getConnection().execute(
+    "select id, entity_id, record_id, organization_id from attachments where tenant_id = ?",
+    [tenantId]
+  );
+  report.scanned = rows.length;
+  if (!rows.length) return report;
+  const groups = /* @__PURE__ */ new Map();
+  for (const row of rows) {
+    if (!row.id || !row.entity_id || !row.record_id) continue;
+    const list = groups.get(row.entity_id) ?? [];
+    list.push(row);
+    groups.set(row.entity_id, list);
+  }
+  const pendingUpdates = [];
+  for (const [entityId, group] of groups) {
+    const bucket = ensureBucket(report, entityId);
+    bucket.scanned += group.length;
+    if (entityId === LIBRARY_ENTITY_ID) {
+      report.skippedVirtual += group.length;
+      continue;
+    }
+    const recordIds = Array.from(
+      new Set(group.map((row) => row.record_id).filter((value) => !!value))
+    );
+    const parentOrgByRecordId = /* @__PURE__ */ new Map();
+    let resolvable = true;
+    for (let index = 0; index < recordIds.length; index += batchSize) {
+      const chunk = recordIds.slice(index, index + batchSize);
+      try {
+        const result = await queryEngine.query(entityId, {
+          fields: ["id", "organization_id"],
+          filters: { id: chunk.length === 1 ? { $eq: chunk[0] } : { $in: chunk } },
+          tenantId,
+          withDeleted: true,
+          page: { pageSize: Math.max(chunk.length, 1) }
+        });
+        for (const item of result.items ?? []) {
+          const record = item;
+          const recordId = record.id != null ? String(record.id) : null;
+          if (!recordId) continue;
+          parentOrgByRecordId.set(recordId, readParentOrganizationId(record));
+        }
+      } catch (error) {
+        resolvable = false;
+        logger.warn("org reconcile: cannot resolve parent organization for entity", {
+          entityId,
+          error
+        });
+        break;
+      }
+    }
+    if (!resolvable) {
+      bucket.unresolved += group.length;
+      report.unresolved += group.length;
+      continue;
+    }
+    for (const row of group) {
+      const target = row.record_id ? parentOrgByRecordId.get(row.record_id) : null;
+      if (!target) {
+        bucket.unresolved += 1;
+        report.unresolved += 1;
+        continue;
+      }
+      if ((row.organization_id ?? null) === target) continue;
+      pendingUpdates.push({ id: row.id, organizationId: target });
+      bucket.updated += 1;
+      report.updated += 1;
+    }
+  }
+  for (let index = 0; index < pendingUpdates.length; index += batchSize) {
+    const chunk = pendingUpdates.slice(index, index + batchSize);
+    for (const update of chunk) {
+      const reference = em.getReference(Attachment, update.id);
+      reference.organizationId = update.organizationId;
+    }
+    await em.flush();
+  }
+  return report;
+}
+export {
+  reconcileAttachmentOrganizations
+};
+//# sourceMappingURL=reconcileOrganization.js.map

package/dist/modules/attachments/lib/reconcileOrganization.js.map

@@ -0,0 +1,7 @@
+{
+  "version": 3,
+  "sources": ["../../../../src/modules/attachments/lib/reconcileOrganization.ts"],
+  "sourcesContent": ["import type { EntityManager } from '@mikro-orm/postgresql'\nimport { createLogger } from '@open-mercato/shared/lib/logger'\nimport type { QueryEngine } from '@open-mercato/shared/lib/query/types'\nimport { Attachment } from '../data/entities'\n\nconst logger = createLogger('attachments').child({ component: 'reconcileOrganization' })\n\n/**\n * Virtual entity id for library attachments \u2014 these are not attached to a\n * parent record that owns an organization, so there is nothing to reconcile\n * against. They are counted as skipped rather than unresolved.\n */\nconst LIBRARY_ENTITY_ID = 'attachments:library'\n\nconst DEFAULT_BATCH_SIZE = 500\n\nexport type AttachmentOrgReconcileEntityStat = {\n  scanned: number\n  updated: number\n  unresolved: number\n}\n\nexport type AttachmentOrgReconcileReport = {\n  scanned: number\n  updated: number\n  unresolved: number\n  skippedVirtual: number\n  byEntity: Record<string, AttachmentOrgReconcileEntityStat>\n}\n\ntype AttachmentScanRow = {\n  id: string\n  entity_id: string | null\n  record_id: string | null\n  organization_id: string | null\n}\n\nfunction readParentOrganizationId(record: Record<string, unknown>): string | null {\n  const raw = record['organization_id'] ?? record['organizationId']\n  if (typeof raw === 'string' && raw.trim().length) return raw.trim()\n  return null\n}\n\nfunction ensureBucket(\n  report: AttachmentOrgReconcileReport,\n  entityId: string,\n): AttachmentOrgReconcileEntityStat {\n  const existing = report.byEntity[entityId]\n  if (existing) return existing\n  const bucket: AttachmentOrgReconcileEntityStat = { scanned: 0, updated: 0, unresolved: 0 }\n  report.byEntity[entityId] = bucket\n  return bucket\n}\n\n/**\n * Reconcile the `organization_id` of existing attachments to the organization\n * of the record they are attached to.\n *\n * Background (#3765): before the upload route became selected-organization\n * aware, a multi-org admin who switched the header organization uploaded files\n * that were silently stored under their *home* organization instead of the\n * selected one (the organization of the parent record). Those rows are now\n * invisible to org-scoped reads and stay orphaned. This heals them forward.\n *\n * The parent record's organization is the ground truth: an attachment is not\n * distinguishable from a legitimately home-org one by looking at the attachment\n * alone. Parent organizations are resolved generically through the Query Engine\n * by `entityId` (works for both base and custom entities, tenant-scoped and\n * organization-agnostic so the parent's real org is returned regardless of\n * which org the caller sits in) \u2014 the same mechanism the attachments module\n * already uses to enrich assignment details.\n *\n * The reconciliation is:\n * - idempotent \u2014 rows already matching their parent are left untouched;\n * - conservative \u2014 when the parent org cannot be resolved (unregistered\n *   entity id, hard-deleted parent, parent without an org column) the row is\n *   counted as `unresolved` and left as-is rather than guessed at;\n * - tenant-scoped \u2014 it reconciles every attachment in the tenant across all\n *   organizations (the whole point is moving rows between orgs).\n *\n * Writes go through the passed `EntityManager` (which the caller runs inside a\n * transaction) so the whole reconciliation commits atomically.\n */\nexport async function reconcileAttachmentOrganizations(opts: {\n  em: EntityManager\n  queryEngine: QueryEngine\n  tenantId: string\n  batchSize?: number\n}): Promise<AttachmentOrgReconcileReport> {\n  const { em, queryEngine, tenantId } = opts\n  const batchSize = opts.batchSize && opts.batchSize > 0 ? opts.batchSize : DEFAULT_BATCH_SIZE\n  const report: AttachmentOrgReconcileReport = {\n    scanned: 0,\n    updated: 0,\n    unresolved: 0,\n    skippedVirtual: 0,\n    byEntity: {},\n  }\n\n  const rows = (await em.getConnection().execute(\n    'select id, entity_id, record_id, organization_id from attachments where tenant_id = ?',\n    [tenantId],\n  )) as AttachmentScanRow[]\n  report.scanned = rows.length\n  if (!rows.length) return report\n\n  const groups = new Map<string, AttachmentScanRow[]>()\n  for (const row of rows) {\n    if (!row.id || !row.entity_id || !row.record_id) continue\n    const list = groups.get(row.entity_id) ?? []\n    list.push(row)\n    groups.set(row.entity_id, list)\n  }\n\n  const pendingUpdates: Array<{ id: string; organizationId: string }> = []\n\n  for (const [entityId, group] of groups) {\n    const bucket = ensureBucket(report, entityId)\n    bucket.scanned += group.length\n\n    if (entityId === LIBRARY_ENTITY_ID) {\n      report.skippedVirtual += group.length\n      continue\n    }\n\n    const recordIds = Array.from(\n      new Set(group.map((row) => row.record_id).filter((value): value is string => !!value)),\n    )\n    const parentOrgByRecordId = new Map<string, string | null>()\n    let resolvable = true\n\n    for (let index = 0; index < recordIds.length; index += batchSize) {\n      const chunk = recordIds.slice(index, index + batchSize)\n      try {\n        const result = await queryEngine.query(entityId as any, {\n          fields: ['id', 'organization_id'],\n          filters: { id: chunk.length === 1 ? { $eq: chunk[0] } : { $in: chunk } },\n          tenantId,\n          withDeleted: true,\n          page: { pageSize: Math.max(chunk.length, 1) },\n        })\n        for (const item of result.items ?? []) {\n          const record = item as Record<string, unknown>\n          const recordId = record.id != null ? String(record.id) : null\n          if (!recordId) continue\n          parentOrgByRecordId.set(recordId, readParentOrganizationId(record))\n        }\n      } catch (error) {\n        resolvable = false\n        logger.warn('org reconcile: cannot resolve parent organization for entity', {\n          entityId,\n          error,\n        })\n        break\n      }\n    }\n\n    if (!resolvable) {\n      bucket.unresolved += group.length\n      report.unresolved += group.length\n      continue\n    }\n\n    for (const row of group) {\n      const target = row.record_id ? parentOrgByRecordId.get(row.record_id) : null\n      if (!target) {\n        bucket.unresolved += 1\n        report.unresolved += 1\n        continue\n      }\n      if ((row.organization_id ?? null) === target) continue\n      pendingUpdates.push({ id: row.id, organizationId: target })\n      bucket.updated += 1\n      report.updated += 1\n    }\n  }\n\n  for (let index = 0; index < pendingUpdates.length; index += batchSize) {\n    const chunk = pendingUpdates.slice(index, index + batchSize)\n    for (const update of chunk) {\n      const reference = em.getReference(Attachment, update.id)\n      reference.organizationId = update.organizationId\n    }\n    await em.flush()\n  }\n\n  return report\n}\n"],
+  "mappings": "AACA,SAAS,oBAAoB;AAE7B,SAAS,kBAAkB;AAE3B,MAAM,SAAS,aAAa,aAAa,EAAE,MAAM,EAAE,WAAW,wBAAwB,CAAC;AAOvF,MAAM,oBAAoB;AAE1B,MAAM,qBAAqB;AAuB3B,SAAS,yBAAyB,QAAgD;AAChF,QAAM,MAAM,OAAO,iBAAiB,KAAK,OAAO,gBAAgB;AAChE,MAAI,OAAO,QAAQ,YAAY,IAAI,KAAK,EAAE,OAAQ,QAAO,IAAI,KAAK;AAClE,SAAO;AACT;AAEA,SAAS,aACP,QACA,UACkC;AAClC,QAAM,WAAW,OAAO,SAAS,QAAQ;AACzC,MAAI,SAAU,QAAO;AACrB,QAAM,SAA2C,EAAE,SAAS,GAAG,SAAS,GAAG,YAAY,EAAE;AACzF,SAAO,SAAS,QAAQ,IAAI;AAC5B,SAAO;AACT;AA+BA,eAAsB,iCAAiC,MAKb;AACxC,QAAM,EAAE,IAAI,aAAa,SAAS,IAAI;AACtC,QAAM,YAAY,KAAK,aAAa,KAAK,YAAY,IAAI,KAAK,YAAY;AAC1E,QAAM,SAAuC;AAAA,IAC3C,SAAS;AAAA,IACT,SAAS;AAAA,IACT,YAAY;AAAA,IACZ,gBAAgB;AAAA,IAChB,UAAU,CAAC;AAAA,EACb;AAEA,QAAM,OAAQ,MAAM,GAAG,cAAc,EAAE;AAAA,IACrC;AAAA,IACA,CAAC,QAAQ;AAAA,EACX;AACA,SAAO,UAAU,KAAK;AACtB,MAAI,CAAC,KAAK,OAAQ,QAAO;AAEzB,QAAM,SAAS,oBAAI,IAAiC;AACpD,aAAW,OAAO,MAAM;AACtB,QAAI,CAAC,IAAI,MAAM,CAAC,IAAI,aAAa,CAAC,IAAI,UAAW;AACjD,UAAM,OAAO,OAAO,IAAI,IAAI,SAAS,KAAK,CAAC;AAC3C,SAAK,KAAK,GAAG;AACb,WAAO,IAAI,IAAI,WAAW,IAAI;AAAA,EAChC;AAEA,QAAM,iBAAgE,CAAC;AAEvE,aAAW,CAAC,UAAU,KAAK,KAAK,QAAQ;AACtC,UAAM,SAAS,aAAa,QAAQ,QAAQ;AAC5C,WAAO,WAAW,MAAM;AAExB,QAAI,aAAa,mBAAmB;AAClC,aAAO,kBAAkB,MAAM;AAC/B;AAAA,IACF;AAEA,UAAM,YAAY,MAAM;AAAA,MACtB,IAAI,IAAI,MAAM,IAAI,CAAC,QAAQ,IAAI,SAAS,EAAE,OAAO,CAAC,UAA2B,CAAC,CAAC,KAAK,CAAC;AAAA,IACvF;AACA,UAAM,sBAAsB,oBAAI,IAA2B;AAC3D,QAAI,aAAa;AAEjB,aAAS,QAAQ,GAAG,QAAQ,UAAU,QAAQ,SAAS,WAAW;AAChE,YAAM,QAAQ,UAAU,MAAM,OAAO,QAAQ,SAAS;AACtD,UAAI;AACF,cAAM,SAAS,MAAM,YAAY,MAAM,UAAiB;AAAA,UACtD,QAAQ,CAAC,MAAM,iBAAiB;AAAA,UAChC,SAAS,EAAE,IAAI,MAAM,WAAW,IAAI,EAAE,KAAK,MAAM,CAAC,EAAE,IAAI,EAAE,KAAK,MAAM,EAAE;AAAA,UACvE;AAAA,UACA,aAAa;AAAA,UACb,MAAM,EAAE,UAAU,KAAK,IAAI,MAAM,QAAQ,CAAC,EAAE;AAAA,QAC9C,CAAC;AACD,mBAAW,QAAQ,OAAO,SAAS,CAAC,GAAG;AACrC,gBAAM,SAAS;AACf,gBAAM,WAAW,OAAO,MAAM,OAAO,OAAO,OAAO,EAAE,IAAI;AACzD,cAAI,CAAC,SAAU;AACf,8BAAoB,IAAI,UAAU,yBAAyB,MAAM,CAAC;AAAA,QACpE;AAAA,MACF,SAAS,OAAO;AACd,qBAAa;AACb,eAAO,KAAK,gEAAgE;AAAA,UAC1E;AAAA,UACA;AAAA,QACF,CAAC;AACD;AAAA,MACF;AAAA,IACF;AAEA,QAAI,CAAC,YAAY;AACf,aAAO,cAAc,MAAM;AAC3B,aAAO,cAAc,MAAM;AAC3B;AAAA,IACF;AAEA,eAAW,OAAO,OAAO;AACvB,YAAM,SAAS,IAAI,YAAY,oBAAoB,IAAI,IAAI,SAAS,IAAI;AACxE,UAAI,CAAC,QAAQ;AACX,eAAO,cAAc;AACrB,eAAO,cAAc;AACrB;AAAA,MACF;AACA,WAAK,IAAI,mBAAmB,UAAU,OAAQ;AAC9C,qBAAe,KAAK,EAAE,IAAI,IAAI,IAAI,gBAAgB,OAAO,CAAC;AAC1D,aAAO,WAAW;AAClB,aAAO,WAAW;AAAA,IACpB;AAAA,EACF;AAEA,WAAS,QAAQ,GAAG,QAAQ,eAAe,QAAQ,SAAS,WAAW;AACrE,UAAM,QAAQ,eAAe,MAAM,OAAO,QAAQ,SAAS;AAC3D,eAAW,UAAU,OAAO;AAC1B,YAAM,YAAY,GAAG,aAAa,YAAY,OAAO,EAAE;AACvD,gBAAU,iBAAiB,OAAO;AAAA,IACpC;AACA,UAAM,GAAG,MAAM;AAAA,EACjB;AAEA,SAAO;AACT;",
+  "names": []
+}

package/dist/modules/attachments/lib/requestScope.js

@@ -0,0 +1,10 @@
+import { resolveOrganizationScopeForRequest } from "@open-mercato/core/modules/directory/utils/organizationScope";
+async function resolveAttachmentOrganizationId(container, auth, request) {
+  if (!auth) return null;
+  const scope = await resolveOrganizationScopeForRequest({ container, auth, request });
+  return scope?.selectedId ?? auth.orgId ?? null;
+}
+export {
+  resolveAttachmentOrganizationId
+};
+//# sourceMappingURL=requestScope.js.map

package/dist/modules/attachments/lib/requestScope.js.map

@@ -0,0 +1,7 @@
+{
+  "version": 3,
+  "sources": ["../../../../src/modules/attachments/lib/requestScope.ts"],
+  "sourcesContent": ["import type { AwilixContainer } from 'awilix'\nimport type { AuthContext } from '@open-mercato/shared/lib/auth/server'\nimport { resolveOrganizationScopeForRequest } from '@open-mercato/core/modules/directory/utils/organizationScope'\n\n/**\n * Resolve the organization an attachment request should act within.\n *\n * `auth.orgId` alone is NOT selected-organization aware for non-superadmin\n * principals: `applySuperAdminScope` only rewrites `orgId` from the\n * `om_selected_org` cookie for superadmins, so a regular multi-org admin who\n * switches the header organization keeps `auth.orgId` pinned to their own home\n * organization. The CRUD factory and other org-scoped routes derive the active\n * organization via `resolveOrganizationScopeForRequest` (cookie-driven and\n * RBAC-validated for ALL users, falling back to the home org when the selection\n * is absent or inaccessible). Attachments must do the same so uploaded files\n * land under \u2014 and are read back from \u2014 the currently selected organization\n * rather than the uploader's home organization (#3765).\n */\nexport async function resolveAttachmentOrganizationId(\n  container: AwilixContainer,\n  auth: AuthContext,\n  request: Request,\n): Promise<string | null> {\n  if (!auth) return null\n  const scope = await resolveOrganizationScopeForRequest({ container, auth, request })\n  return scope?.selectedId ?? auth.orgId ?? null\n}\n"],
+  "mappings": "AAEA,SAAS,0CAA0C;AAgBnD,eAAsB,gCACpB,WACA,MACA,SACwB;AACxB,MAAI,CAAC,KAAM,QAAO;AAClB,QAAM,QAAQ,MAAM,mCAAmC,EAAE,WAAW,MAAM,QAAQ,CAAC;AACnF,SAAO,OAAO,cAAc,KAAK,SAAS;AAC5C;",
+  "names": []
+}

package/dist/modules/audit_logs/backend/audit-logs/page.js

@@ -4,6 +4,7 @@ import React from "react";
 import { Page, PageBody } from "@open-mercato/ui/backend/Page";
 import { readApiResultOrThrow } from "@open-mercato/ui/backend/utils/apiCall";
 import { Button } from "@open-mercato/ui/primitives/button";
+import { Tabs, TabsList, TabsTrigger } from "@open-mercato/ui/primitives/tabs";
 import { useT } from "@open-mercato/shared/lib/i18n/context";
 import { AuditLogsActions } from "../../components/AuditLogsActions.js";
 import { AccessLogsTable } from "../../components/AccessLogsTable.js";
@@ -139,30 +140,19 @@ function AuditLogsPage() {
     ] })
   ] });
   return /* @__PURE__ */ jsx(Page, { children: /* @__PURE__ */ jsxs(PageBody, { children: [
-    /* @__PURE__ */ jsx("div", { className: "mb-6 border-b border-border", children: /* @__PURE__ */ jsxs("nav", { className: "flex items-center gap-6 text-sm", role: "tablist", "aria-label": t("audit_logs.tabs.label"), children: [
-      /* @__PURE__ */ jsx(
-        "button",
-        {
-          type: "button",
-          role: "tab",
-          "aria-selected": tab === "actions",
-          className: `relative -mb-px border-b-2 px-0 pb-3 pt-2 font-medium transition-colors ${tab === "actions" ? "border-accent-indigo text-foreground" : "border-transparent text-muted-foreground hover:text-foreground"}`,
-          onClick: () => setTab("actions"),
-          children: t("audit_logs.actions.title")
-        }
-      ),
-      /* @__PURE__ */ jsx(
-        "button",
-        {
-          type: "button",
-          role: "tab",
-          "aria-selected": tab === "access",
-          className: `relative -mb-px border-b-2 px-0 pb-3 pt-2 font-medium transition-colors ${tab === "access" ? "border-accent-indigo text-foreground" : "border-transparent text-muted-foreground hover:text-foreground"}`,
-          onClick: () => setTab("access"),
-          children: t("audit_logs.access.title")
-        }
-      )
-    ] }) }),
+    /* @__PURE__ */ jsx(
+      Tabs,
+      {
+        value: tab,
+        onValueChange: (value) => setTab(value),
+        variant: "underline",
+        className: "mb-6",
+        children: /* @__PURE__ */ jsxs(TabsList, { className: "w-full flex-wrap", "aria-label": t("audit_logs.tabs.label"), children: [
+          /* @__PURE__ */ jsx(TabsTrigger, { value: "actions", children: t("audit_logs.actions.title") }),
+          /* @__PURE__ */ jsx(TabsTrigger, { value: "access", children: t("audit_logs.access.title") })
+        ] })
+      }
+    ),
     error && /* @__PURE__ */ jsx("div", { className: "mb-4 rounded-md border border-status-error-border bg-status-error-bg p-3 text-sm text-status-error-text", children: error }),
     tab === "actions" && /* @__PURE__ */ jsx(
       AuditLogsActions,