@open-mercato/core 0.6.8-develop.7099.1.7ba2771d06 → 0.7.0

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@open-mercato/core",
-  "version": "0.6.8-develop.7099.1.7ba2771d06",
+  "version": "0.7.0",
   "license": "MIT",
   "type": "module",
   "main": "./dist/index.js",
@@ -231,6 +231,7 @@
     "@mikro-orm/core": "^7.1.8",
     "@mikro-orm/decorators": "^7.1.8",
     "@mikro-orm/postgresql": "^7.1.8",
+    "@types/html-to-text": "^9.0.4",
     "@types/leaflet": "^1.9.12",
     "@types/leaflet.markercluster": "^1.5.5",
     "@types/sanitize-html": "^2.13.0",
@@ -239,6 +240,7 @@
     "ai": "^7.0.4",
     "date-fns": "4.4.0",
     "date-fns-tz": "^3.2.0",
+    "html-to-text": "^10.0.0",
     "leaflet": "^1.9.4",
     "leaflet.markercluster": "^1.5.3",
     "mammoth": "^1.9.0",
@@ -252,16 +254,16 @@
     "zod": "^4.4.3"
   },
   "peerDependencies": {
-    "@open-mercato/ai-assistant": "0.6.8-develop.7099.1.7ba2771d06",
-    "@open-mercato/shared": "0.6.8-develop.7099.1.7ba2771d06",
-    "@open-mercato/ui": "0.6.8-develop.7099.1.7ba2771d06",
+    "@open-mercato/ai-assistant": "0.7.0",
+    "@open-mercato/shared": "0.7.0",
+    "@open-mercato/ui": "0.7.0",
     "react": "^19.0.0",
     "react-dom": "^19.0.0"
   },
   "devDependencies": {
-    "@open-mercato/ai-assistant": "0.6.8-develop.7099.1.7ba2771d06",
-    "@open-mercato/shared": "0.6.8-develop.7099.1.7ba2771d06",
-    "@open-mercato/ui": "0.6.8-develop.7099.1.7ba2771d06",
+    "@open-mercato/ai-assistant": "0.7.0",
+    "@open-mercato/shared": "0.7.0",
+    "@open-mercato/ui": "0.7.0",
     "@testing-library/dom": "^10.4.1",
     "@testing-library/jest-dom": "^7.0.0",
     "@testing-library/react": "^16.3.1",
@@ -284,6 +286,5 @@
     "type": "git",
     "url": "https://github.com/open-mercato/open-mercato",
     "directory": "packages/core"
-  },
-  "stableVersion": "0.6.7"
+  }
 }

package/src/helpers/integration/api.ts

@@ -1,4 +1,4 @@
-import { request as playwrightRequest, type APIRequestContext } from '@playwright/test';
+import { type APIRequestContext } from '@playwright/test';
 import { DEFAULT_CREDENTIALS, type Role } from './auth';
 
 const BASE_URL = process.env.BASE_URL?.trim() || null;
@@ -141,35 +141,3 @@ export async function postForm(
     data: form.toString(),
   });
 }
-
-/**
- * Runs `use` against a request context that shares no cookies with the caller's.
- *
- * The `request` fixture keeps a cookie jar, and `/api/auth/login` sets `auth_token`
- * on it. Every later call through that fixture therefore carries the LAST logged-in
- * user's session, even one that deliberately sends no Authorization header or an
- * `ApiKey` one.
- *
- * A spec asserting "no credentials are rejected" or "this API key alone decides
- * access" must therefore issue the request from a jar that never saw a login,
- * rather than assuming the fixture's jar is empty. TC-DOCUMENTS-009 and
- * TC-DOCUMENTS-018 both observably failed in the standalone lane — with the
- * replayed cookie visible in the trace — while passing in the ephemeral one, and
- * routing them through this helper fixed both.
- */
-export async function withCredentialIsolatedRequest<T>(
-  use: (request: APIRequestContext) => Promise<T>,
-): Promise<T> {
-  // A hand-built context does not inherit the project's `use.baseURL` the way the
-  // `request` fixture does, so it has to repeat the config's own resolution — otherwise
-  // a relative path throws here on any run that leaves BASE_URL unset, while the same
-  // path works through the fixture.
-  const context = await playwrightRequest.newContext({
-    baseURL: BASE_URL ?? 'http://localhost:3000',
-  });
-  try {
-    return await use(context);
-  } finally {
-    await context.dispose();
-  }
-}

package/src/helpers/integration/communicationChannelsFixtures.ts

@@ -42,18 +42,7 @@ export async function isChannelSeedingAvailable(
 export async function seedConnectedChannel(
   request: APIRequestContext,
   token: string,
-  input: {
-    displayName?: string;
-    externalIdentifier?: string;
-    /**
-     * `chat` connects the non-email stub instead: a channel whose senders carry
-     * an opaque handle and no address, and whose `externalIdentifier` is NULL —
-     * the shape a real Discord/Slack channel has. Use it for anything asserting
-     * the hub's sender-identity contract (#4975); the default `email` flavor
-     * cannot prove it, because it can only ever supply email-shaped data.
-     */
-    providerFlavor?: 'email' | 'chat';
-  } = {},
+  input: { displayName?: string; externalIdentifier?: string } = {},
 ): Promise<string> {
   const response = await apiRequest(request, 'POST', TEST_SEED_PATH, {
     token,
@@ -126,63 +115,6 @@ export async function seedInboundMessage(
  * Best-effort delete of a seeded channel via the owner-scoped DELETE route.
  * Safe to call with a null id in `finally`.
  */
-/**
- * Ingest an inbound chat message through the REAL `ingest_inbound_message`
- * command: the stub adapter normalizes the frame and the hub composes the
- * platform message via `messages.messages.compose`.
- *
- * Unlike {@link seedInboundMessage}, nothing here is short-circuited — no row is
- * inserted behind the compose path — so a hub contract the provider cannot
- * satisfy fails the test instead of hiding behind seeded data. That bypass is
- * exactly why CI was green while every real inbound Discord message was rejected
- * (#4975).
- *
- * The sender is identified only by `senderIdentifier` (a Discord snowflake, a
- * Slack member id, …). There is deliberately no way to pass an address.
- */
-export async function ingestInboundChatMessage(
-  request: APIRequestContext,
-  token: string,
-  input: {
-    channelId: string;
-    senderIdentifier: string;
-    senderDisplayName?: string;
-    body?: string;
-    externalMessageId: string;
-    externalConversationId: string;
-  },
-): Promise<{
-  status: string;
-  messageId: string | null;
-  conversationId: string | null;
-  channelLinkId: string | null;
-  channelType: string | null;
-}> {
-  const response = await apiRequest(request, 'POST', TEST_SEED_PATH, {
-    token,
-    data: { action: 'ingest-inbound', ...input },
-  });
-  expect(
-    response.status(),
-    'POST /api/communication_channels/test-seed (ingest-inbound) should return 201 — ' +
-      'a non-201 here means the hub rejected a sender with no email address',
-  ).toBe(201);
-  const body = await readJsonSafe<{
-    status?: string;
-    messageId?: string | null;
-    conversationId?: string | null;
-    channelLinkId?: string | null;
-    channelType?: string | null;
-  }>(response);
-  return {
-    status: body?.status ?? 'unknown',
-    messageId: body?.messageId ?? null,
-    conversationId: body?.conversationId ?? null,
-    channelLinkId: body?.channelLinkId ?? null,
-    channelType: body?.channelType ?? null,
-  };
-}
-
 export async function deleteChannelIfExists(
   request: APIRequestContext,
   token: string | null,

package/src/modules/api_keys/api/keys/route.ts

@@ -298,9 +298,7 @@ const crud = makeCrudRoute<
       scopedCtx.__apiKeyRoleIds = roleIds
 
       const allowedIds = ctx.organizationScope?.allowedIds ?? null
-      const organizationId = Object.prototype.hasOwnProperty.call(input, 'organizationId')
-        ? input.organizationId ?? null
-        : ctx.selectedOrganizationId ?? auth.orgId ?? null
+      const organizationId = input.organizationId ?? ctx.selectedOrganizationId ?? auth.orgId ?? null
       const isSuperAdmin = await resolveIsSuperAdmin(scopedCtx)
       if (
         !isOrganizationAccessAllowed({

package/src/modules/api_keys/backend/api-keys/page.tsx

@@ -36,7 +36,6 @@ type ResponsePayload = {
   total: number
   page: number
   totalPages: number
-  totalIsCapped?: boolean
 }
 
 function formatDate(value: string | null, t: (key: string, params?: Record<string, string | number>) => string) {
@@ -55,7 +54,6 @@ export default function ApiKeysListPage() {
   const [page, setPage] = React.useState(1)
   const [total, setTotal] = React.useState(0)
   const [totalPages, setTotalPages] = React.useState(1)
-  const [totalIsCapped, setTotalIsCapped] = React.useState(false)
   const [search, setSearch] = React.useState('')
   const [isLoading, setIsLoading] = React.useState(true)
   const [reloadToken, setReloadToken] = React.useState(0)
@@ -89,7 +87,6 @@ export default function ApiKeysListPage() {
           setRows(Array.isArray(payload.items) ? payload.items : [])
           setTotal(payload.total || 0)
           setTotalPages(payload.totalPages || 1)
-          setTotalIsCapped(payload?.totalIsCapped === true)
         }
       } catch (error) {
         if (!cancelled) {
@@ -201,7 +198,7 @@ export default function ApiKeysListPage() {
               createLabel={t('api_keys.list.actions.create')}
             />
           )}
-          pagination={{ page, pageSize: 20, total, totalPages, totalIsCapped, onPageChange: setPage }}
+          pagination={{ page, pageSize: 20, total, totalPages, onPageChange: setPage }}
           isLoading={isLoading}
         />
       </PageBody>

package/src/modules/attachments/AGENTS.md

@@ -34,18 +34,6 @@ write time.
 
 ## Always
 
-- Cross-module consumers MUST resolve the public `attachmentService` DI contract
-  and import its type from `@open-mercato/core/modules/attachments`. Keep
-  attachment entities, partitions, storage drivers, quota accounting, file
-  security, and `checkAttachmentAccess` behind that boundary.
-- Cross-module multipart uploads MUST use `attachmentService.readUploadForm()` so
-  the raw request stream is bounded before `FormData` decoding, including when
-  `Content-Length` is missing or the request is chunked.
-- Cross-module permanent deletion MUST use `attachmentService.releaseScoped()`
-  with the exact owner, assignment, partition, and tenant/organization scope. In
-  an ambient transaction pass `{ flush: false }`, commit the returned database
-  removal first, and invoke the returned provider cleanup only after commit;
-  never delete provider bytes before a transaction can still roll back.
 - **MUST call `assertAttachmentScopeInvariant({ tenantId, organizationId })` from
   `lib/access.ts` before persisting any new `Attachment` row.** It throws on a
   partial-null scope and accepts both fully-scoped and fully-global rows. The
@@ -58,9 +46,6 @@ write time.
 
 ## Never
 
-- Never make a peer module construct `StorageDriverFactory` or read Attachment /
-  AttachmentPartition entities directly as a fallback. Missing service wiring
-  must fail closed.
 - **Never create a partial-null attachment** (one scope column set, the other null).
 - **Never read or expose attachment rows without `checkAttachmentAccess`** — bypassing
   it reintroduces the cross-tenant fail-open class.

package/src/modules/attachments/api/route.ts

@@ -213,7 +213,7 @@ export async function GET(req: Request) {
   const currentPage = usePaging ? Math.max(1, page) : null
   const currentPageSize = usePaging ? pageSize : null
   const totalPages = usePaging && total !== null ? Math.max(1, Math.ceil(total / currentPageSize!)) : null
-  const pageOffset = usePaging ? (currentPage! - 1) * currentPageSize! : undefined
+  const pageOffset = usePaging ? (Math.min(currentPage!, totalPages!) - 1) * currentPageSize! : undefined
   const items = await findWithDecryption(
     em,
     Attachment,
@@ -256,7 +256,7 @@ export async function GET(req: Request) {
     ...(usePaging
       ? {
           total,
-          page: currentPage,
+          page: Math.min(currentPage!, totalPages!),
           pageSize: currentPageSize,
           totalPages,
         }

package/src/modules/attachments/components/AttachmentLibrary.tsx

@@ -42,7 +42,6 @@ type AttachmentLibraryResponse = {
   pageSize: number
   total: number
   totalPages: number
-  totalIsCapped?: boolean
   availableTags: string[]
   partitions: Array<{ code: string; title: string; description?: string | null; isPublic?: boolean }>
   error?: string
@@ -1055,7 +1054,6 @@ export function AttachmentLibrary() {
 
   const total = data?.total ?? 0
   const totalPages = data?.totalPages ?? 0
-  const totalIsCapped = data?.totalIsCapped === true
   return (
     <>
       <DataTable<AttachmentRow>
@@ -1156,7 +1154,6 @@ export function AttachmentLibrary() {
           pageSize: PAGE_SIZE,
           total,
           totalPages,
-          totalIsCapped,
           onPageChange: (next) => setPage(next),
         }}
       />

package/src/modules/attachments/di.ts

@@ -2,7 +2,6 @@ import { asFunction, asValue } from 'awilix'
 import type { AppContainer } from '@open-mercato/shared/lib/di/container'
 import type { DataEngine } from '@open-mercato/shared/lib/data/engine'
 import { StorageDriverFactory } from './lib/drivers/driverFactory'
-import { DefaultAttachmentService } from './lib/attachment-service'
 import { createAttachmentQuotaService, type AttachmentQuotaService } from './lib/quota-service'
 import { scheduleAttachmentQuotaRecovery } from './lib/quota-recovery-queue'
 import { AttachmentTargetAccessService } from './lib/target-access-service'
@@ -47,20 +46,5 @@ export function register(container: AppContainer) {
     )
       .singleton()
       .proxy(),
-    // The scoped upload service is handed over as a lazy resolver so module
-    // uploads share the public attachment route's single fenced reservation
-    // ledger, without dragging that service's own dependencies into every
-    // container that merely constructs an `attachmentService`.
-    attachmentService: asFunction((cradle: {
-      em: ConstructorParameters<typeof DefaultAttachmentService>[0]
-      storageDriverFactory: ConstructorParameters<typeof DefaultAttachmentService>[1]
-      attachmentScopedUploadService: ScopedAttachmentUploadService
-    }) => new DefaultAttachmentService(
-      cradle.em,
-      cradle.storageDriverFactory,
-      () => cradle.attachmentScopedUploadService ?? null,
-    ))
-      .scoped()
-      .proxy(),
   })
 }

package/src/modules/attachments/i18n/de.json

@@ -2,17 +2,12 @@
   "attachments.errors.activeContentBlocked": "Das Hochladen aktiver Inhalte ist nicht erlaubt.",
   "attachments.errors.dangerousExecutable": "Ausführbare Dateitypen sind als Anhänge nicht erlaubt.",
   "attachments.errors.maxUploadSize": "Der Anhang überschreitet die maximal zulässige Upload-Größe.",
-  "attachments.errors.partitionUnavailable": "Die Anhang-Partition ist für diesen Bereich nicht verfügbar.",
-  "attachments.errors.persistenceFailed": "Der Anhang konnte nicht gespeichert werden.",
   "attachments.errors.publicPartitionBlocked": "Öffentliche Speicherpartitionen können für diesen Upload nicht explizit ausgewählt werden.",
   "attachments.errors.quotaExceeded": "Das Speicherlimit für Anhänge dieses Tenants wurde überschritten.",
   "attachments.errors.quotaRecoveryUnsupported": "Der Speichertreiber kann nicht an der Kontingent-Wiederherstellung teilnehmen.",
   "attachments.errors.quotaUnavailable": "Die Speicherkontingent-Abrechnung ist nicht verfügbar.",
   "attachments.errors.selectOrganization": "Wählen Sie eine bestimmte Organisation aus, bevor Sie einen Anhang hochladen.",
-  "attachments.errors.storageFailed": "Die Anhangsdatei konnte nicht im Speicher abgelegt werden.",
   "attachments.errors.storagePathExists": "Der Zielspeicherpfad existiert bereits.",
-  "attachments.errors.uploadFailed": "Das Hochladen des Anhangs ist fehlgeschlagen.",
-  "attachments.errors.uploadServiceUnavailable": "Der Anhang-Upload-Dienst ist nicht verfügbar.",
   "attachments.library.actions.chooseReplacement": "Ersatzdatei auswählen",
   "attachments.library.actions.copied": "Link kopiert.",
   "attachments.library.actions.copyError": "Link konnte nicht kopiert werden.",

package/src/modules/attachments/i18n/en.json

@@ -2,17 +2,12 @@
   "attachments.errors.activeContentBlocked": "Active content uploads are not allowed.",
   "attachments.errors.dangerousExecutable": "Executable file types are not allowed as attachments.",
   "attachments.errors.maxUploadSize": "Attachment exceeds the maximum upload size.",
-  "attachments.errors.partitionUnavailable": "Attachment partition is not available for this scope.",
-  "attachments.errors.persistenceFailed": "Failed to persist attachment.",
   "attachments.errors.publicPartitionBlocked": "Public storage partitions cannot be selected explicitly for this upload.",
   "attachments.errors.quotaExceeded": "Attachment storage quota exceeded for this tenant.",
   "attachments.errors.quotaRecoveryUnsupported": "Storage driver cannot participate in quota recovery.",
   "attachments.errors.quotaUnavailable": "Storage quota accounting is unavailable.",
   "attachments.errors.selectOrganization": "Select a specific organization before uploading an attachment.",
-  "attachments.errors.storageFailed": "Failed to store the attachment file.",
   "attachments.errors.storagePathExists": "The target storage path already exists.",
-  "attachments.errors.uploadFailed": "Attachment upload failed.",
-  "attachments.errors.uploadServiceUnavailable": "The attachment upload service is not available.",
   "attachments.library.actions.chooseReplacement": "Choose replacement file",
   "attachments.library.actions.copied": "Link copied.",
   "attachments.library.actions.copyError": "Unable to copy link.",

package/src/modules/attachments/i18n/es.json

@@ -2,17 +2,12 @@
   "attachments.errors.activeContentBlocked": "No se permite la carga de contenido activo.",
   "attachments.errors.dangerousExecutable": "No se permiten archivos ejecutables como adjuntos.",
   "attachments.errors.maxUploadSize": "El archivo adjunto supera el tamaño máximo de carga permitido.",
-  "attachments.errors.partitionUnavailable": "La partición de adjuntos no está disponible para este ámbito.",
-  "attachments.errors.persistenceFailed": "No se pudo guardar el archivo adjunto.",
   "attachments.errors.publicPartitionBlocked": "No se pueden seleccionar explícitamente particiones de almacenamiento públicas para esta carga.",
   "attachments.errors.quotaExceeded": "Se superó la cuota de almacenamiento de adjuntos para este tenant.",
   "attachments.errors.quotaRecoveryUnsupported": "El controlador de almacenamiento no puede participar en la recuperación de cuota.",
   "attachments.errors.quotaUnavailable": "La contabilidad de la cuota de almacenamiento no está disponible.",
   "attachments.errors.selectOrganization": "Selecciona una organización específica antes de subir un adjunto.",
-  "attachments.errors.storageFailed": "No se pudo almacenar el archivo adjunto.",
   "attachments.errors.storagePathExists": "La ruta de almacenamiento de destino ya existe.",
-  "attachments.errors.uploadFailed": "Error al subir el archivo adjunto.",
-  "attachments.errors.uploadServiceUnavailable": "El servicio de carga de adjuntos no está disponible.",
   "attachments.library.actions.chooseReplacement": "Elegir archivo de reemplazo",
   "attachments.library.actions.copied": "Enlace copiado.",
   "attachments.library.actions.copyError": "No se pudo copiar el enlace.",

package/src/modules/attachments/i18n/ko.json

@@ -2,17 +2,12 @@
   "attachments.errors.activeContentBlocked": "활성 콘텐츠 업로드는 허용되지 않습니다.",
   "attachments.errors.dangerousExecutable": "실행 파일 형식은 첨부 파일로 허용되지 않습니다.",
   "attachments.errors.maxUploadSize": "첨부 파일이 최대 업로드 크기를 초과합니다.",
-  "attachments.errors.partitionUnavailable": "이 범위에서는 첨부 파일 파티션을 사용할 수 없습니다.",
-  "attachments.errors.persistenceFailed": "첨부 파일을 저장하지 못했습니다.",
   "attachments.errors.publicPartitionBlocked": "이 업로드에는 공개 저장소 파티션을 명시적으로 선택할 수 없습니다.",
   "attachments.errors.quotaExceeded": "이 테넌트의 첨부 파일 저장소 할당량을 초과했습니다.",
   "attachments.errors.quotaRecoveryUnsupported": "저장 용량 복구가 지원되지 않습니다.",
   "attachments.errors.quotaUnavailable": "첨부파일 저장 용량 정보를 확인할 수 없습니다.",
   "attachments.errors.selectOrganization": "첨부파일을 업로드하기 전에 특정 조직을 선택하세요.",
-  "attachments.errors.storageFailed": "첨부 파일을 저장소에 기록하지 못했습니다.",
   "attachments.errors.storagePathExists": "대상 저장 경로가 이미 존재합니다.",
-  "attachments.errors.uploadFailed": "첨부 파일 업로드에 실패했습니다.",
-  "attachments.errors.uploadServiceUnavailable": "첨부 파일 업로드 서비스를 사용할 수 없습니다.",
   "attachments.library.actions.chooseReplacement": "교체 파일 선택",
   "attachments.library.actions.copied": "링크가 복사되었습니다.",
   "attachments.library.actions.copyError": "링크를 복사할 수 없습니다.",

package/src/modules/attachments/i18n/pl.json

@@ -2,17 +2,12 @@
   "attachments.errors.activeContentBlocked": "Przesyłanie treści aktywnych nie jest dozwolone.",
   "attachments.errors.dangerousExecutable": "Pliki wykonywalne nie są dozwolone jako załączniki.",
   "attachments.errors.maxUploadSize": "Załącznik przekracza maksymalny dopuszczalny rozmiar przesyłania.",
-  "attachments.errors.partitionUnavailable": "Partycja załączników nie jest dostępna w tym zakresie.",
-  "attachments.errors.persistenceFailed": "Nie udało się zapisać załącznika.",
   "attachments.errors.publicPartitionBlocked": "Nie można jawnie wybrać publicznej partycji do tego przesyłania.",
   "attachments.errors.quotaExceeded": "Przekroczono limit miejsca na załączniki dla tego tenantu.",
   "attachments.errors.quotaRecoveryUnsupported": "Sterownik przechowywania nie może uczestniczyć w odzyskiwaniu limitu.",
   "attachments.errors.quotaUnavailable": "Rozliczanie limitu przestrzeni dyskowej jest niedostępne.",
   "attachments.errors.selectOrganization": "Wybierz konkretną organizację przed przesłaniem załącznika.",
-  "attachments.errors.storageFailed": "Nie udało się zapisać pliku załącznika w magazynie.",
   "attachments.errors.storagePathExists": "Docelowa ścieżka przechowywania już istnieje.",
-  "attachments.errors.uploadFailed": "Przesyłanie załącznika nie powiodło się.",
-  "attachments.errors.uploadServiceUnavailable": "Usługa przesyłania załączników jest niedostępna.",
   "attachments.library.actions.chooseReplacement": "Wybierz plik zastępczy",
   "attachments.library.actions.copied": "Link skopiowany.",
   "attachments.library.actions.copyError": "Nie można skopiować linku.",

package/src/modules/attachments/index.ts

@@ -9,13 +9,3 @@ export const metadata: ModuleInfo = {
   license: 'MIT',
 }
 
-export {
-  type AttachmentOwner,
-  type AttachmentProviderCleanup,
-  type AttachmentService,
-  type CreatedScopedAttachment,
-  type CreateScopedAttachmentInput,
-  type ReadScopedAttachmentInput,
-  type ReadScopedAttachmentResult,
-  type ReleaseScopedAttachmentInput,
-} from './lib/attachment-service'

package/src/modules/attachments/lib/scoped-upload-service.ts

@@ -2,7 +2,6 @@ import { randomUUID } from 'node:crypto'
 import type { EntityManager } from '@mikro-orm/postgresql'
 import type { DataEngine } from '@open-mercato/shared/lib/data/engine'
 import { emitCrudSideEffects } from '@open-mercato/shared/lib/commands/helpers'
-import { isCrudHttpError } from '@open-mercato/shared/lib/crud/errors'
 import { createLogger } from '@open-mercato/shared/lib/logger'
 import { Attachment, AttachmentPartition } from '../data/entities'
 import { attachmentCrudEvents, attachmentCrudIndexer } from './crud'
@@ -41,16 +40,7 @@ export type ScopedAttachmentUploadErrorCode =
   | 'storage_failed'
   | 'persistence_failed'
 
-// Use Symbol.for so the marker survives module duplication across bundle
-// boundaries. The production build emits this module into several server
-// chunks, so a consumer's `instanceof` compares against a different copy of the
-// class than the DI-resolved service threw from: the check silently fails, the
-// error escapes the caller's catch, and a deliberate 400/413 surfaces as a 500.
-const SCOPED_ATTACHMENT_UPLOAD_ERROR_MARKER = Symbol.for('@open-mercato/ScopedAttachmentUploadError')
-
 export class ScopedAttachmentUploadError extends Error {
-  readonly [SCOPED_ATTACHMENT_UPLOAD_ERROR_MARKER] = true
-
   constructor(
     public readonly code: ScopedAttachmentUploadErrorCode,
     public readonly status: number,
@@ -60,17 +50,6 @@ export class ScopedAttachmentUploadError extends Error {
   }
 }
 
-/**
- * Bundle-safe check for `ScopedAttachmentUploadError`. Prefer this over
- * `instanceof` at every call site — the class is duplicated across server
- * chunks, so `instanceof` is only reliable inside this module.
- */
-export function isScopedAttachmentUploadError(error: unknown): error is ScopedAttachmentUploadError {
-  return Boolean(error)
-    && typeof error === 'object'
-    && (error as Record<symbol, unknown>)[SCOPED_ATTACHMENT_UPLOAD_ERROR_MARKER] === true
-}
-
 export type ScopedAttachmentUploadInput = {
   tenantId: string
   organizationId: string
@@ -83,21 +62,6 @@ export type ScopedAttachmentUploadInput = {
   assignments?: AttachmentAssignment[]
   partitionCode?: string | null
   maxBytes?: number
-  /**
-   * Reject a partition flagged public, so a module-owned upload (documents,
-   * warranty claims) never lands where an anonymous reader can reach it. The
-   * tenant/organization half of that guarantee is not this flag's job: the
-   * partition lookup below already matches only a global partition or one owned
-   * by this tenant and organization, whether or not the flag is set.
-   */
-  requirePrivatePartition?: boolean
-  /**
-   * Persists a module-owned link row inside the same transaction as the
-   * Attachment, so a link failure cannot leave a committed orphan attachment.
-   * The callback receives only the generated id, never the entity or the
-   * storage implementation.
-   */
-  persistLink?: (tx: EntityManager, attachmentId: string) => Promise<void> | void
 }
 
 type QuotaRecoveryScheduler = (
@@ -138,9 +102,6 @@ export class ScopedAttachmentUploadService {
       ],
     })
     if (!partition) throw new ScopedAttachmentUploadError('partition_unavailable', 400)
-    if (input.requirePrivatePartition && partition.isPublic) {
-      throw new ScopedAttachmentUploadError('partition_unavailable', 403)
-    }
 
     const driver = await storageDriverFactory.resolveForPartition(partition.code, {
       tenantId: input.tenantId,
@@ -249,18 +210,11 @@ export class ScopedAttachmentUploadService {
         })
         assertAttachmentScopeInvariant({ tenantId: attachment.tenantId, organizationId: attachment.organizationId })
         await tx.persist(attachment).flush()
-        await input.persistLink?.(tx, attachmentId)
         await attachmentQuotaService.completeAttachment(reservation.id, reservation.leaseToken, tx)
       })
     } catch (error) {
       await this.compensateStorage(driver, partition.code, storedPath, reservation)
       logger.error('Scoped attachment persistence failed', { err: error })
-      // `persistLink` is where callers run their own authorization (the
-      // documents module re-checks the edit capability inside this
-      // transaction), so a deliberate HTTP error from it must reach the route
-      // with its own status. Flattening it to 500 turns a documented 403 into
-      // an apparent server fault.
-      if (isCrudHttpError(error)) throw error
       throw new ScopedAttachmentUploadError('persistence_failed', 500)
     }
 

package/src/modules/attachments/lib/upload-limits.ts

@@ -39,15 +39,11 @@ export function resolveAttachmentMaxBytes(fieldMaxAttachmentSizeMb?: number | nu
   return Math.min(defaultMaxBytes, Math.floor(fieldMaxAttachmentSizeMb * 1024 * 1024))
 }
 
-export function resolveAttachmentMultipartMaxBytes(): number {
-  return resolveDefaultAttachmentMaxUploadBytes() + MULTIPART_CONTENT_LENGTH_OVERHEAD_BYTES
-}
-
 export function isMultipartRequestWithinUploadLimit(contentLengthHeader: string | null): boolean {
   if (!contentLengthHeader) return true
   const contentLength = Number(contentLengthHeader)
-  if (!Number.isSafeInteger(contentLength) || contentLength <= 0) return false
-  return contentLength <= resolveAttachmentMultipartMaxBytes()
+  if (!Number.isFinite(contentLength) || contentLength <= 0) return true
+  return contentLength <= (resolveDefaultAttachmentMaxUploadBytes() + MULTIPART_CONTENT_LENGTH_OVERHEAD_BYTES)
 }
 
 export class MultipartUploadLimitError extends Error {

package/src/modules/audit_logs/backend/audit-logs/page.tsx

@@ -21,7 +21,6 @@ type ActionLogResponse = {
   pageSize: number
   total: number
   totalPages: number
-  totalIsCapped?: boolean
 }
 
 type AccessLogResponse = {
@@ -31,7 +30,6 @@ type AccessLogResponse = {
   pageSize: number
   total: number
   totalPages: number
-  totalIsCapped?: boolean
 }
 
 type TabOption = 'actions' | 'access'
@@ -50,13 +48,11 @@ export default function AuditLogsPage() {
   const [actionsPageSize, setActionsPageSize] = React.useState(DEFAULT_PAGE_SIZE)
   const [actionsTotal, setActionsTotal] = React.useState(0)
   const [actionsTotalPages, setActionsTotalPages] = React.useState(1)
-  const [actionsTotalIsCapped, setActionsTotalIsCapped] = React.useState(false)
   const actionsPageSizeRef = React.useRef(DEFAULT_PAGE_SIZE)
   const [accessPage, setAccessPage] = React.useState(1)
   const [accessPageSize, setAccessPageSize] = React.useState(DEFAULT_PAGE_SIZE)
   const [accessTotal, setAccessTotal] = React.useState(0)
   const [accessTotalPages, setAccessTotalPages] = React.useState(1)
-  const [accessTotalIsCapped, setAccessTotalIsCapped] = React.useState(false)
   const accessPageSizeRef = React.useRef(DEFAULT_PAGE_SIZE)
 
   const fetchActions = React.useCallback(async (page: number, pageSize: number) => {
@@ -99,7 +95,6 @@ export default function AuditLogsPage() {
     })
     setActionsTotal(actionsRes.total ?? (actionsRes.items?.length ?? 0))
     setActionsTotalPages(actionsRes.totalPages ?? 1)
-    setActionsTotalIsCapped(actionsRes.totalIsCapped === true)
     setAccessLogs(accessRes.items ?? [])
     const resolvedPage = accessRes.page ?? accessPageNum
     const resolvedPageSize = accessRes.pageSize ?? accessPageSizeNum
@@ -116,7 +111,6 @@ export default function AuditLogsPage() {
     })
     setAccessTotal(resolvedTotal)
     setAccessTotalPages(resolvedTotalPages)
-    setAccessTotalIsCapped(accessRes.totalIsCapped === true)
   }, [fetchActions, fetchAccess])
 
   const loadWithState = React.useCallback(async (
@@ -216,7 +210,6 @@ export default function AuditLogsPage() {
               pageSize: actionsPageSize,
               total: actionsTotal,
               totalPages: actionsTotalPages,
-              totalIsCapped: actionsTotalIsCapped,
               onPageChange: handleActionsPageChange,
             }}
           />
@@ -232,7 +225,6 @@ export default function AuditLogsPage() {
               pageSize: accessPageSize,
               total: accessTotal,
               totalPages: accessTotalPages,
-              totalIsCapped: accessTotalIsCapped,
               onPageChange: handleAccessPageChange,
             }}
           />