@open-mercato/storage-s3 0.6.2-develop.3467.1.2a1818709d → 0.6.2

package/.turbo/turbo-build.log

@@ -1,2 +1,2 @@
-Found 16 entry points
+Found 18 entry points
 storage-s3 built successfully

package/dist/modules/storage_s3/cli.js

@@ -0,0 +1,123 @@
+import { createRequestContainer } from "@open-mercato/shared/lib/di/container";
+import { Organization } from "@open-mercato/core/modules/directory/data/entities";
+import { findWithDecryption } from "@open-mercato/shared/lib/encryption/find";
+import {
+  mapOrganizationsToScopes,
+  parseCliArgs,
+  resolveCliMode,
+  runConfigureFromEnv,
+  runConfigureFromEnvForScopes
+} from "./lib/configure-from-env.js";
+function printHelp() {
+  console.log("Usage: yarn mercato storage_s3 configure-from-env [--tenant <tenantId> --org <organizationId> | --all-tenants] [--force]");
+  console.log("");
+  console.log("Modes:");
+  console.log("  --tenant <id> --org <id>   Apply the preset to a single tenant + organization pair.");
+  console.log("  --all-tenants              Apply the preset to every active (tenant, organization) pair.");
+  console.log("                             Designed for unattended deploy hooks; per-tenant skip/force semantics still apply.");
+  console.log("");
+  console.log("Required env vars:");
+  console.log("  OM_INTEGRATION_STORAGE_S3_ACCESS_KEY_ID");
+  console.log("  OM_INTEGRATION_STORAGE_S3_SECRET_ACCESS_KEY");
+  console.log("  OM_INTEGRATION_STORAGE_S3_REGION");
+  console.log("  OM_INTEGRATION_STORAGE_S3_BUCKET");
+  console.log("");
+  console.log("Optional env vars:");
+  console.log("  OM_INTEGRATION_STORAGE_S3_SESSION_TOKEN");
+  console.log("  OM_INTEGRATION_STORAGE_S3_ENDPOINT");
+  console.log("  OM_INTEGRATION_STORAGE_S3_FORCE_PATH_STYLE");
+  console.log("  OM_INTEGRATION_STORAGE_S3_FORCE_PRECONFIGURE");
+}
+async function listActiveScopes(em) {
+  const organizations = await findWithDecryption(
+    em,
+    Organization,
+    { deletedAt: null, isActive: true },
+    { populate: ["tenant"] }
+  );
+  return mapOrganizationsToScopes(organizations);
+}
+const configureFromEnvCommand = {
+  command: "configure-from-env",
+  async run(rest) {
+    const mode = resolveCliMode(parseCliArgs(rest));
+    if (mode.kind === "help") {
+      printHelp();
+      return;
+    }
+    if (mode.kind === "conflict") {
+      console.error(`[storage_s3] ${mode.message}`);
+      throw new Error(`Conflicting CLI arguments: ${mode.message}`);
+    }
+    const container = await createRequestContainer();
+    try {
+      const credentialsService = container.resolve("integrationCredentialsService");
+      const integrationLogService = container.resolve("integrationLogService");
+      if (mode.kind === "all") {
+        const em = container.resolve("em");
+        const scopes = await listActiveScopes(em);
+        if (scopes.length === 0) {
+          console.log("[storage_s3] --all-tenants: no active organizations found. Nothing to do.");
+          return;
+        }
+        const summary = await runConfigureFromEnvForScopes(
+          { credentialsService, integrationLogService },
+          scopes,
+          { force: mode.force }
+        );
+        for (const entry of summary.perScope) {
+          const prefix = `[storage_s3] tenant=${entry.scope.tenantId} org=${entry.scope.organizationId}`;
+          if (entry.outcome.code === 1) {
+            console.error(`${prefix} ERROR: ${entry.outcome.message}`);
+          } else if (entry.outcome.status === "skipped") {
+            console.log(`${prefix} skipped: ${entry.outcome.message}`);
+          } else {
+            console.log(`${prefix} configured: ${entry.outcome.message}`);
+          }
+        }
+        console.log(
+          `[storage_s3] --all-tenants summary: ${summary.configured} configured, ${summary.skipped} skipped, ${summary.errored} error(s).`
+        );
+        if (summary.code === 1) {
+          throw new Error(
+            `--all-tenants completed with ${summary.errored} error(s) across ${scopes.length} scope(s). See per-scope errors above.`
+          );
+        }
+        return;
+      }
+      const outcome = await runConfigureFromEnv(
+        { credentialsService, integrationLogService },
+        {
+          tenantId: mode.tenantId,
+          organizationId: mode.organizationId,
+          force: mode.force
+        }
+      );
+      if (outcome.code === 0) {
+        if (outcome.status === "skipped") {
+          console.log(`[storage_s3] Skipped: ${outcome.message}`);
+        } else {
+          console.log(`[storage_s3] ${outcome.message}`);
+        }
+        return;
+      }
+      throw new Error(outcome.message);
+    } finally {
+      const disposable = container;
+      if (typeof disposable.dispose === "function") {
+        await disposable.dispose();
+      }
+    }
+  }
+};
+const helpCommand = {
+  command: "help",
+  async run() {
+    printHelp();
+  }
+};
+var cli_default = [configureFromEnvCommand, helpCommand];
+export {
+  cli_default as default
+};
+//# sourceMappingURL=cli.js.map

package/dist/modules/storage_s3/cli.js.map

@@ -0,0 +1,7 @@
+{
+  "version": 3,
+  "sources": ["../../../src/modules/storage_s3/cli.ts"],
+  "sourcesContent": ["import { createRequestContainer } from '@open-mercato/shared/lib/di/container'\nimport type { EntityManager } from '@mikro-orm/postgresql'\nimport type { ModuleCli } from '@open-mercato/shared/modules/registry'\nimport type { CredentialsService } from '@open-mercato/core/modules/integrations/lib/credentials-service'\nimport type { IntegrationLogService } from '@open-mercato/core/modules/integrations/lib/log-service'\nimport { Organization } from '@open-mercato/core/modules/directory/data/entities'\nimport type { IntegrationScope } from '@open-mercato/shared/modules/integrations/types'\nimport { findWithDecryption } from '@open-mercato/shared/lib/encryption/find'\nimport {\n  mapOrganizationsToScopes,\n  parseCliArgs,\n  resolveCliMode,\n  runConfigureFromEnv,\n  runConfigureFromEnvForScopes,\n} from './lib/configure-from-env'\n\nfunction printHelp(): void {\n  console.log('Usage: yarn mercato storage_s3 configure-from-env [--tenant <tenantId> --org <organizationId> | --all-tenants] [--force]')\n  console.log('')\n  console.log('Modes:')\n  console.log('  --tenant <id> --org <id>   Apply the preset to a single tenant + organization pair.')\n  console.log('  --all-tenants              Apply the preset to every active (tenant, organization) pair.')\n  console.log('                             Designed for unattended deploy hooks; per-tenant skip/force semantics still apply.')\n  console.log('')\n  console.log('Required env vars:')\n  console.log('  OM_INTEGRATION_STORAGE_S3_ACCESS_KEY_ID')\n  console.log('  OM_INTEGRATION_STORAGE_S3_SECRET_ACCESS_KEY')\n  console.log('  OM_INTEGRATION_STORAGE_S3_REGION')\n  console.log('  OM_INTEGRATION_STORAGE_S3_BUCKET')\n  console.log('')\n  console.log('Optional env vars:')\n  console.log('  OM_INTEGRATION_STORAGE_S3_SESSION_TOKEN')\n  console.log('  OM_INTEGRATION_STORAGE_S3_ENDPOINT')\n  console.log('  OM_INTEGRATION_STORAGE_S3_FORCE_PATH_STYLE')\n  console.log('  OM_INTEGRATION_STORAGE_S3_FORCE_PRECONFIGURE')\n}\n\nasync function listActiveScopes(em: EntityManager): Promise<IntegrationScope[]> {\n  const organizations = await findWithDecryption(\n    em,\n    Organization,\n    { deletedAt: null, isActive: true },\n    { populate: ['tenant'] },\n  )\n  return mapOrganizationsToScopes(organizations)\n}\n\nconst configureFromEnvCommand: ModuleCli = {\n  command: 'configure-from-env',\n  async run(rest) {\n    const mode = resolveCliMode(parseCliArgs(rest))\n\n    if (mode.kind === 'help') {\n      printHelp()\n      return\n    }\n\n    if (mode.kind === 'conflict') {\n      console.error(`[storage_s3] ${mode.message}`)\n      throw new Error(`Conflicting CLI arguments: ${mode.message}`)\n    }\n\n    const container = await createRequestContainer()\n    try {\n      const credentialsService = container.resolve('integrationCredentialsService') as CredentialsService\n      const integrationLogService = container.resolve('integrationLogService') as IntegrationLogService\n\n      if (mode.kind === 'all') {\n        const em = container.resolve('em') as EntityManager\n        const scopes = await listActiveScopes(em)\n\n        if (scopes.length === 0) {\n          console.log('[storage_s3] --all-tenants: no active organizations found. Nothing to do.')\n          return\n        }\n\n        const summary = await runConfigureFromEnvForScopes(\n          { credentialsService, integrationLogService },\n          scopes,\n          { force: mode.force },\n        )\n\n        for (const entry of summary.perScope) {\n          const prefix = `[storage_s3] tenant=${entry.scope.tenantId} org=${entry.scope.organizationId}`\n          if (entry.outcome.code === 1) {\n            console.error(`${prefix} ERROR: ${entry.outcome.message}`)\n          } else if (entry.outcome.status === 'skipped') {\n            console.log(`${prefix} skipped: ${entry.outcome.message}`)\n          } else {\n            console.log(`${prefix} configured: ${entry.outcome.message}`)\n          }\n        }\n\n        console.log(\n          `[storage_s3] --all-tenants summary: ${summary.configured} configured, ` +\n            `${summary.skipped} skipped, ${summary.errored} error(s).`,\n        )\n\n        if (summary.code === 1) {\n          throw new Error(\n            `--all-tenants completed with ${summary.errored} error(s) across ${scopes.length} scope(s). See per-scope errors above.`,\n          )\n        }\n        return\n      }\n\n      const outcome = await runConfigureFromEnv(\n        { credentialsService, integrationLogService },\n        {\n          tenantId: mode.tenantId,\n          organizationId: mode.organizationId,\n          force: mode.force,\n        },\n      )\n\n      if (outcome.code === 0) {\n        if (outcome.status === 'skipped') {\n          console.log(`[storage_s3] Skipped: ${outcome.message}`)\n        } else {\n          console.log(`[storage_s3] ${outcome.message}`)\n        }\n        return\n      }\n\n      throw new Error(outcome.message)\n    } finally {\n      const disposable = container as unknown as { dispose?: () => Promise<void> }\n      if (typeof disposable.dispose === 'function') {\n        await disposable.dispose()\n      }\n    }\n  },\n}\n\nconst helpCommand: ModuleCli = {\n  command: 'help',\n  async run() {\n    printHelp()\n  },\n}\n\nexport default [configureFromEnvCommand, helpCommand]\n"],
+  "mappings": "AAAA,SAAS,8BAA8B;AAKvC,SAAS,oBAAoB;AAE7B,SAAS,0BAA0B;AACnC;AAAA,EACE;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,OACK;AAEP,SAAS,YAAkB;AACzB,UAAQ,IAAI,0HAA0H;AACtI,UAAQ,IAAI,EAAE;AACd,UAAQ,IAAI,QAAQ;AACpB,UAAQ,IAAI,uFAAuF;AACnG,UAAQ,IAAI,4FAA4F;AACxG,UAAQ,IAAI,iHAAiH;AAC7H,UAAQ,IAAI,EAAE;AACd,UAAQ,IAAI,oBAAoB;AAChC,UAAQ,IAAI,2CAA2C;AACvD,UAAQ,IAAI,+CAA+C;AAC3D,UAAQ,IAAI,oCAAoC;AAChD,UAAQ,IAAI,oCAAoC;AAChD,UAAQ,IAAI,EAAE;AACd,UAAQ,IAAI,oBAAoB;AAChC,UAAQ,IAAI,2CAA2C;AACvD,UAAQ,IAAI,sCAAsC;AAClD,UAAQ,IAAI,8CAA8C;AAC1D,UAAQ,IAAI,gDAAgD;AAC9D;AAEA,eAAe,iBAAiB,IAAgD;AAC9E,QAAM,gBAAgB,MAAM;AAAA,IAC1B;AAAA,IACA;AAAA,IACA,EAAE,WAAW,MAAM,UAAU,KAAK;AAAA,IAClC,EAAE,UAAU,CAAC,QAAQ,EAAE;AAAA,EACzB;AACA,SAAO,yBAAyB,aAAa;AAC/C;AAEA,MAAM,0BAAqC;AAAA,EACzC,SAAS;AAAA,EACT,MAAM,IAAI,MAAM;AACd,UAAM,OAAO,eAAe,aAAa,IAAI,CAAC;AAE9C,QAAI,KAAK,SAAS,QAAQ;AACxB,gBAAU;AACV;AAAA,IACF;AAEA,QAAI,KAAK,SAAS,YAAY;AAC5B,cAAQ,MAAM,gBAAgB,KAAK,OAAO,EAAE;AAC5C,YAAM,IAAI,MAAM,8BAA8B,KAAK,OAAO,EAAE;AAAA,IAC9D;AAEA,UAAM,YAAY,MAAM,uBAAuB;AAC/C,QAAI;AACF,YAAM,qBAAqB,UAAU,QAAQ,+BAA+B;AAC5E,YAAM,wBAAwB,UAAU,QAAQ,uBAAuB;AAEvE,UAAI,KAAK,SAAS,OAAO;AACvB,cAAM,KAAK,UAAU,QAAQ,IAAI;AACjC,cAAM,SAAS,MAAM,iBAAiB,EAAE;AAExC,YAAI,OAAO,WAAW,GAAG;AACvB,kBAAQ,IAAI,2EAA2E;AACvF;AAAA,QACF;AAEA,cAAM,UAAU,MAAM;AAAA,UACpB,EAAE,oBAAoB,sBAAsB;AAAA,UAC5C;AAAA,UACA,EAAE,OAAO,KAAK,MAAM;AAAA,QACtB;AAEA,mBAAW,SAAS,QAAQ,UAAU;AACpC,gBAAM,SAAS,uBAAuB,MAAM,MAAM,QAAQ,QAAQ,MAAM,MAAM,cAAc;AAC5F,cAAI,MAAM,QAAQ,SAAS,GAAG;AAC5B,oBAAQ,MAAM,GAAG,MAAM,WAAW,MAAM,QAAQ,OAAO,EAAE;AAAA,UAC3D,WAAW,MAAM,QAAQ,WAAW,WAAW;AAC7C,oBAAQ,IAAI,GAAG,MAAM,aAAa,MAAM,QAAQ,OAAO,EAAE;AAAA,UAC3D,OAAO;AACL,oBAAQ,IAAI,GAAG,MAAM,gBAAgB,MAAM,QAAQ,OAAO,EAAE;AAAA,UAC9D;AAAA,QACF;AAEA,gBAAQ;AAAA,UACN,uCAAuC,QAAQ,UAAU,gBACpD,QAAQ,OAAO,aAAa,QAAQ,OAAO;AAAA,QAClD;AAEA,YAAI,QAAQ,SAAS,GAAG;AACtB,gBAAM,IAAI;AAAA,YACR,gCAAgC,QAAQ,OAAO,oBAAoB,OAAO,MAAM;AAAA,UAClF;AAAA,QACF;AACA;AAAA,MACF;AAEA,YAAM,UAAU,MAAM;AAAA,QACpB,EAAE,oBAAoB,sBAAsB;AAAA,QAC5C;AAAA,UACE,UAAU,KAAK;AAAA,UACf,gBAAgB,KAAK;AAAA,UACrB,OAAO,KAAK;AAAA,QACd;AAAA,MACF;AAEA,UAAI,QAAQ,SAAS,GAAG;AACtB,YAAI,QAAQ,WAAW,WAAW;AAChC,kBAAQ,IAAI,yBAAyB,QAAQ,OAAO,EAAE;AAAA,QACxD,OAAO;AACL,kBAAQ,IAAI,gBAAgB,QAAQ,OAAO,EAAE;AAAA,QAC/C;AACA;AAAA,MACF;AAEA,YAAM,IAAI,MAAM,QAAQ,OAAO;AAAA,IACjC,UAAE;AACA,YAAM,aAAa;AACnB,UAAI,OAAO,WAAW,YAAY,YAAY;AAC5C,cAAM,WAAW,QAAQ;AAAA,MAC3B;AAAA,IACF;AAAA,EACF;AACF;AAEA,MAAM,cAAyB;AAAA,EAC7B,SAAS;AAAA,EACT,MAAM,MAAM;AACV,cAAU;AAAA,EACZ;AACF;AAEA,IAAO,cAAQ,CAAC,yBAAyB,WAAW;",
+  "names": []
+}

package/dist/modules/storage_s3/lib/configure-from-env.js

@@ -0,0 +1,103 @@
+import { applyS3EnvPreset, readS3EnvPreset } from "./preset.js";
+async function runConfigureFromEnv(deps, options) {
+  try {
+    const preset = readS3EnvPreset(deps.env ?? process.env);
+    if (!preset) {
+      return {
+        code: 0,
+        status: "skipped",
+        message: "No S3 env preset was found. Set OM_INTEGRATION_STORAGE_S3_* variables to enable preconfiguration."
+      };
+    }
+    const result = await applyS3EnvPreset({
+      credentialsService: deps.credentialsService,
+      integrationLogService: deps.integrationLogService,
+      scope: { tenantId: options.tenantId, organizationId: options.organizationId },
+      force: options.force,
+      env: deps.env ?? process.env
+    });
+    if (result.status === "skipped") {
+      return { code: 0, status: "skipped", message: result.reason };
+    }
+    return { code: 0, status: "configured", message: "S3 credentials were configured from env." };
+  } catch (error) {
+    const message = error instanceof Error ? error.message : "Unknown S3 preset error";
+    return { code: 1, status: "error", message };
+  }
+}
+async function runConfigureFromEnvForScopes(deps, scopes, options = {}) {
+  const perScope = [];
+  let configured = 0;
+  let skipped = 0;
+  let errored = 0;
+  for (const scope of scopes) {
+    const outcome = await runConfigureFromEnv(deps, {
+      tenantId: scope.tenantId,
+      organizationId: scope.organizationId,
+      force: options.force
+    });
+    perScope.push({ scope, outcome });
+    if (outcome.code === 1) errored += 1;
+    else if (outcome.status === "configured") configured += 1;
+    else skipped += 1;
+  }
+  const code = errored > 0 ? 1 : 0;
+  return { code, configured, skipped, errored, perScope };
+}
+function parseCliArgs(args) {
+  const result = {};
+  for (let i = 0; i < args.length; i++) {
+    const arg = args[i];
+    if (!arg.startsWith("--")) continue;
+    const key = arg.slice(2);
+    if (key.includes("=")) {
+      const [name, value] = key.split("=");
+      result[name] = value;
+      continue;
+    }
+    const next = args[i + 1];
+    if (next && !next.startsWith("--")) {
+      result[key] = next;
+      i += 1;
+      continue;
+    }
+    result[key] = true;
+  }
+  return result;
+}
+function resolveCliMode(args) {
+  const allTenants = args["all-tenants"] === true || args.allTenants === true;
+  const tenantId = String(args.tenantId ?? args.tenant ?? "");
+  const organizationId = String(args.organizationId ?? args.orgId ?? args.org ?? "");
+  const force = args.force === true ? true : void 0;
+  if (allTenants && (tenantId || organizationId)) {
+    return {
+      kind: "conflict",
+      message: "--all-tenants cannot be combined with --tenant or --org. Pick one mode."
+    };
+  }
+  if (allTenants) {
+    return { kind: "all", force };
+  }
+  if (!tenantId || !organizationId) {
+    return { kind: "help" };
+  }
+  return { kind: "single", tenantId, organizationId, force };
+}
+function mapOrganizationsToScopes(organizations) {
+  const scopes = [];
+  for (const organization of organizations) {
+    const tenantId = organization.tenant?.id;
+    if (!tenantId) continue;
+    scopes.push({ tenantId, organizationId: organization.id });
+  }
+  return scopes;
+}
+export {
+  mapOrganizationsToScopes,
+  parseCliArgs,
+  resolveCliMode,
+  runConfigureFromEnv,
+  runConfigureFromEnvForScopes
+};
+//# sourceMappingURL=configure-from-env.js.map

package/dist/modules/storage_s3/lib/configure-from-env.js.map

@@ -0,0 +1,7 @@
+{
+  "version": 3,
+  "sources": ["../../../../src/modules/storage_s3/lib/configure-from-env.ts"],
+  "sourcesContent": ["import type { CredentialsService } from '@open-mercato/core/modules/integrations/lib/credentials-service'\nimport type { IntegrationLogService } from '@open-mercato/core/modules/integrations/lib/log-service'\nimport type { IntegrationScope } from '@open-mercato/shared/modules/integrations/types'\nimport { applyS3EnvPreset, readS3EnvPreset } from './preset'\n\nexport type ConfigureFromEnvDeps = {\n  credentialsService: CredentialsService\n  integrationLogService: IntegrationLogService\n  env?: NodeJS.ProcessEnv\n}\n\nexport type ConfigureFromEnvOptions = {\n  tenantId: string\n  organizationId: string\n  force?: boolean\n}\n\nexport type ConfigureFromEnvOutcome =\n  | { code: 0; status: 'configured' | 'skipped'; message: string }\n  | { code: 1; status: 'error'; message: string }\n\nexport async function runConfigureFromEnv(\n  deps: ConfigureFromEnvDeps,\n  options: ConfigureFromEnvOptions,\n): Promise<ConfigureFromEnvOutcome> {\n  try {\n    const preset = readS3EnvPreset(deps.env ?? process.env)\n    if (!preset) {\n      return {\n        code: 0,\n        status: 'skipped',\n        message: 'No S3 env preset was found. Set OM_INTEGRATION_STORAGE_S3_* variables to enable preconfiguration.',\n      }\n    }\n\n    const result = await applyS3EnvPreset({\n      credentialsService: deps.credentialsService,\n      integrationLogService: deps.integrationLogService,\n      scope: { tenantId: options.tenantId, organizationId: options.organizationId },\n      force: options.force,\n      env: deps.env ?? process.env,\n    })\n\n    if (result.status === 'skipped') {\n      return { code: 0, status: 'skipped', message: result.reason }\n    }\n\n    return { code: 0, status: 'configured', message: 'S3 credentials were configured from env.' }\n  } catch (error) {\n    const message = error instanceof Error ? error.message : 'Unknown S3 preset error'\n    return { code: 1, status: 'error', message }\n  }\n}\n\nexport type ConfigureFromEnvScopeOutcome = {\n  scope: IntegrationScope\n  outcome: ConfigureFromEnvOutcome\n}\n\nexport type ConfigureFromEnvAllOutcome = {\n  code: 0 | 1\n  configured: number\n  skipped: number\n  errored: number\n  perScope: ConfigureFromEnvScopeOutcome[]\n}\n\nexport async function runConfigureFromEnvForScopes(\n  deps: ConfigureFromEnvDeps,\n  scopes: IntegrationScope[],\n  options: { force?: boolean } = {},\n): Promise<ConfigureFromEnvAllOutcome> {\n  const perScope: ConfigureFromEnvScopeOutcome[] = []\n  let configured = 0\n  let skipped = 0\n  let errored = 0\n\n  for (const scope of scopes) {\n    const outcome = await runConfigureFromEnv(deps, {\n      tenantId: scope.tenantId,\n      organizationId: scope.organizationId,\n      force: options.force,\n    })\n    perScope.push({ scope, outcome })\n    if (outcome.code === 1) errored += 1\n    else if (outcome.status === 'configured') configured += 1\n    else skipped += 1\n  }\n\n  const code: 0 | 1 = errored > 0 ? 1 : 0\n  return { code, configured, skipped, errored, perScope }\n}\n\nexport function parseCliArgs(args: string[]): Record<string, string | boolean> {\n  const result: Record<string, string | boolean> = {}\n\n  for (let i = 0; i < args.length; i++) {\n    const arg = args[i]\n    if (!arg.startsWith('--')) continue\n\n    const key = arg.slice(2)\n    if (key.includes('=')) {\n      const [name, value] = key.split('=')\n      result[name] = value\n      continue\n    }\n\n    const next = args[i + 1]\n    if (next && !next.startsWith('--')) {\n      result[key] = next\n      i += 1\n      continue\n    }\n\n    result[key] = true\n  }\n\n  return result\n}\n\nexport type ConfigureFromEnvCliMode =\n  | { kind: 'help' }\n  | { kind: 'conflict'; message: string }\n  | { kind: 'all'; force?: boolean }\n  | { kind: 'single'; tenantId: string; organizationId: string; force?: boolean }\n\nexport function resolveCliMode(args: Record<string, string | boolean>): ConfigureFromEnvCliMode {\n  const allTenants = args['all-tenants'] === true || args.allTenants === true\n  const tenantId = String(args.tenantId ?? args.tenant ?? '')\n  const organizationId = String(args.organizationId ?? args.orgId ?? args.org ?? '')\n  const force = args.force === true ? true : undefined\n\n  if (allTenants && (tenantId || organizationId)) {\n    return {\n      kind: 'conflict',\n      message: '--all-tenants cannot be combined with --tenant or --org. Pick one mode.',\n    }\n  }\n\n  if (allTenants) {\n    return { kind: 'all', force }\n  }\n\n  if (!tenantId || !organizationId) {\n    return { kind: 'help' }\n  }\n\n  return { kind: 'single', tenantId, organizationId, force }\n}\n\ntype OrganizationRow = {\n  id: string\n  tenant?: { id?: string | null } | null\n}\n\nexport function mapOrganizationsToScopes(organizations: OrganizationRow[]): IntegrationScope[] {\n  const scopes: IntegrationScope[] = []\n  for (const organization of organizations) {\n    const tenantId = organization.tenant?.id\n    if (!tenantId) continue\n    scopes.push({ tenantId, organizationId: organization.id })\n  }\n  return scopes\n}\n"],
+  "mappings": "AAGA,SAAS,kBAAkB,uBAAuB;AAkBlD,eAAsB,oBACpB,MACA,SACkC;AAClC,MAAI;AACF,UAAM,SAAS,gBAAgB,KAAK,OAAO,QAAQ,GAAG;AACtD,QAAI,CAAC,QAAQ;AACX,aAAO;AAAA,QACL,MAAM;AAAA,QACN,QAAQ;AAAA,QACR,SAAS;AAAA,MACX;AAAA,IACF;AAEA,UAAM,SAAS,MAAM,iBAAiB;AAAA,MACpC,oBAAoB,KAAK;AAAA,MACzB,uBAAuB,KAAK;AAAA,MAC5B,OAAO,EAAE,UAAU,QAAQ,UAAU,gBAAgB,QAAQ,eAAe;AAAA,MAC5E,OAAO,QAAQ;AAAA,MACf,KAAK,KAAK,OAAO,QAAQ;AAAA,IAC3B,CAAC;AAED,QAAI,OAAO,WAAW,WAAW;AAC/B,aAAO,EAAE,MAAM,GAAG,QAAQ,WAAW,SAAS,OAAO,OAAO;AAAA,IAC9D;AAEA,WAAO,EAAE,MAAM,GAAG,QAAQ,cAAc,SAAS,2CAA2C;AAAA,EAC9F,SAAS,OAAO;AACd,UAAM,UAAU,iBAAiB,QAAQ,MAAM,UAAU;AACzD,WAAO,EAAE,MAAM,GAAG,QAAQ,SAAS,QAAQ;AAAA,EAC7C;AACF;AAeA,eAAsB,6BACpB,MACA,QACA,UAA+B,CAAC,GACK;AACrC,QAAM,WAA2C,CAAC;AAClD,MAAI,aAAa;AACjB,MAAI,UAAU;AACd,MAAI,UAAU;AAEd,aAAW,SAAS,QAAQ;AAC1B,UAAM,UAAU,MAAM,oBAAoB,MAAM;AAAA,MAC9C,UAAU,MAAM;AAAA,MAChB,gBAAgB,MAAM;AAAA,MACtB,OAAO,QAAQ;AAAA,IACjB,CAAC;AACD,aAAS,KAAK,EAAE,OAAO,QAAQ,CAAC;AAChC,QAAI,QAAQ,SAAS,EAAG,YAAW;AAAA,aAC1B,QAAQ,WAAW,aAAc,eAAc;AAAA,QACnD,YAAW;AAAA,EAClB;AAEA,QAAM,OAAc,UAAU,IAAI,IAAI;AACtC,SAAO,EAAE,MAAM,YAAY,SAAS,SAAS,SAAS;AACxD;AAEO,SAAS,aAAa,MAAkD;AAC7E,QAAM,SAA2C,CAAC;AAElD,WAAS,IAAI,GAAG,IAAI,KAAK,QAAQ,KAAK;AACpC,UAAM,MAAM,KAAK,CAAC;AAClB,QAAI,CAAC,IAAI,WAAW,IAAI,EAAG;AAE3B,UAAM,MAAM,IAAI,MAAM,CAAC;AACvB,QAAI,IAAI,SAAS,GAAG,GAAG;AACrB,YAAM,CAAC,MAAM,KAAK,IAAI,IAAI,MAAM,GAAG;AACnC,aAAO,IAAI,IAAI;AACf;AAAA,IACF;AAEA,UAAM,OAAO,KAAK,IAAI,CAAC;AACvB,QAAI,QAAQ,CAAC,KAAK,WAAW,IAAI,GAAG;AAClC,aAAO,GAAG,IAAI;AACd,WAAK;AACL;AAAA,IACF;AAEA,WAAO,GAAG,IAAI;AAAA,EAChB;AAEA,SAAO;AACT;AAQO,SAAS,eAAe,MAAiE;AAC9F,QAAM,aAAa,KAAK,aAAa,MAAM,QAAQ,KAAK,eAAe;AACvE,QAAM,WAAW,OAAO,KAAK,YAAY,KAAK,UAAU,EAAE;AAC1D,QAAM,iBAAiB,OAAO,KAAK,kBAAkB,KAAK,SAAS,KAAK,OAAO,EAAE;AACjF,QAAM,QAAQ,KAAK,UAAU,OAAO,OAAO;AAE3C,MAAI,eAAe,YAAY,iBAAiB;AAC9C,WAAO;AAAA,MACL,MAAM;AAAA,MACN,SAAS;AAAA,IACX;AAAA,EACF;AAEA,MAAI,YAAY;AACd,WAAO,EAAE,MAAM,OAAO,MAAM;AAAA,EAC9B;AAEA,MAAI,CAAC,YAAY,CAAC,gBAAgB;AAChC,WAAO,EAAE,MAAM,OAAO;AAAA,EACxB;AAEA,SAAO,EAAE,MAAM,UAAU,UAAU,gBAAgB,MAAM;AAC3D;AAOO,SAAS,yBAAyB,eAAsD;AAC7F,QAAM,SAA6B,CAAC;AACpC,aAAW,gBAAgB,eAAe;AACxC,UAAM,WAAW,aAAa,QAAQ;AACtC,QAAI,CAAC,SAAU;AACf,WAAO,KAAK,EAAE,UAAU,gBAAgB,aAAa,GAAG,CAAC;AAAA,EAC3D;AACA,SAAO;AACT;",
+  "names": []
+}

package/dist/modules/storage_s3/setup.js

@@ -1,21 +1,30 @@
 import { createCredentialsService } from "@open-mercato/core/modules/integrations/lib/credentials-service";
 import { createIntegrationLogService } from "@open-mercato/core/modules/integrations/lib/log-service";
 import { applyS3EnvPreset } from "./lib/preset.js";
+const S3_INTEGRATION_ID = "storage_s3";
 const setup = {
   defaultRoleFeatures: {
     superadmin: ["storage_providers.manage"],
     admin: ["storage_providers.manage"]
   },
   async onTenantCreated({ em, organizationId, tenantId }) {
+    const integrationLogService = createIntegrationLogService(em);
     try {
       await applyS3EnvPreset({
         credentialsService: createCredentialsService(em),
-        integrationLogService: createIntegrationLogService(em),
+        integrationLogService,
         scope: { tenantId, organizationId }
       });
     } catch (error) {
       const message = error instanceof Error ? error.message : "Unknown S3 preset error";
-      console.warn(`[storage_s3] Failed to apply env preset during tenant setup: ${message}`);
+      try {
+        await integrationLogService.scoped(S3_INTEGRATION_ID, { tenantId, organizationId }).error(`Failed to apply S3 env preset during tenant setup: ${message}`);
+      } catch (logError) {
+        const logMessage = logError instanceof Error ? logError.message : "Unknown integration log error";
+        console.error(
+          `[storage_s3] Failed to apply env preset during tenant setup: ${message}. Also failed to persist the error to integration logs: ${logMessage}`
+        );
+      }
     }
   }
 };

package/dist/modules/storage_s3/setup.js.map

@@ -1,7 +1,7 @@
 {
   "version": 3,
   "sources": ["../../../src/modules/storage_s3/setup.ts"],
-  "sourcesContent": ["import type { ModuleSetupConfig } from '@open-mercato/shared/modules/setup'\nimport { createCredentialsService } from '@open-mercato/core/modules/integrations/lib/credentials-service'\nimport { createIntegrationLogService } from '@open-mercato/core/modules/integrations/lib/log-service'\nimport { applyS3EnvPreset } from './lib/preset'\n\nexport const setup: ModuleSetupConfig = {\n  defaultRoleFeatures: {\n    superadmin: ['storage_providers.manage'],\n    admin: ['storage_providers.manage'],\n  },\n\n  async onTenantCreated({ em, organizationId, tenantId }) {\n    try {\n      await applyS3EnvPreset({\n        credentialsService: createCredentialsService(em),\n        integrationLogService: createIntegrationLogService(em),\n        scope: { tenantId, organizationId },\n      })\n    } catch (error) {\n      const message = error instanceof Error ? error.message : 'Unknown S3 preset error'\n      console.warn(`[storage_s3] Failed to apply env preset during tenant setup: ${message}`)\n    }\n  },\n}\n\nexport default setup\n"],
-  "mappings": "AACA,SAAS,gCAAgC;AACzC,SAAS,mCAAmC;AAC5C,SAAS,wBAAwB;AAE1B,MAAM,QAA2B;AAAA,EACtC,qBAAqB;AAAA,IACnB,YAAY,CAAC,0BAA0B;AAAA,IACvC,OAAO,CAAC,0BAA0B;AAAA,EACpC;AAAA,EAEA,MAAM,gBAAgB,EAAE,IAAI,gBAAgB,SAAS,GAAG;AACtD,QAAI;AACF,YAAM,iBAAiB;AAAA,QACrB,oBAAoB,yBAAyB,EAAE;AAAA,QAC/C,uBAAuB,4BAA4B,EAAE;AAAA,QACrD,OAAO,EAAE,UAAU,eAAe;AAAA,MACpC,CAAC;AAAA,IACH,SAAS,OAAO;AACd,YAAM,UAAU,iBAAiB,QAAQ,MAAM,UAAU;AACzD,cAAQ,KAAK,gEAAgE,OAAO,EAAE;AAAA,IACxF;AAAA,EACF;AACF;AAEA,IAAO,gBAAQ;",
+  "sourcesContent": ["import type { ModuleSetupConfig } from '@open-mercato/shared/modules/setup'\nimport { createCredentialsService } from '@open-mercato/core/modules/integrations/lib/credentials-service'\nimport { createIntegrationLogService } from '@open-mercato/core/modules/integrations/lib/log-service'\nimport { applyS3EnvPreset } from './lib/preset'\n\nconst S3_INTEGRATION_ID = 'storage_s3'\n\nexport const setup: ModuleSetupConfig = {\n  defaultRoleFeatures: {\n    superadmin: ['storage_providers.manage'],\n    admin: ['storage_providers.manage'],\n  },\n\n  async onTenantCreated({ em, organizationId, tenantId }) {\n    const integrationLogService = createIntegrationLogService(em)\n    try {\n      await applyS3EnvPreset({\n        credentialsService: createCredentialsService(em),\n        integrationLogService,\n        scope: { tenantId, organizationId },\n      })\n    } catch (error) {\n      const message = error instanceof Error ? error.message : 'Unknown S3 preset error'\n      try {\n        await integrationLogService\n          .scoped(S3_INTEGRATION_ID, { tenantId, organizationId })\n          .error(`Failed to apply S3 env preset during tenant setup: ${message}`)\n      } catch (logError) {\n        const logMessage = logError instanceof Error ? logError.message : 'Unknown integration log error'\n        console.error(\n          `[storage_s3] Failed to apply env preset during tenant setup: ${message}. ` +\n            `Also failed to persist the error to integration logs: ${logMessage}`,\n        )\n      }\n    }\n  },\n}\n\nexport default setup\n"],
+  "mappings": "AACA,SAAS,gCAAgC;AACzC,SAAS,mCAAmC;AAC5C,SAAS,wBAAwB;AAEjC,MAAM,oBAAoB;AAEnB,MAAM,QAA2B;AAAA,EACtC,qBAAqB;AAAA,IACnB,YAAY,CAAC,0BAA0B;AAAA,IACvC,OAAO,CAAC,0BAA0B;AAAA,EACpC;AAAA,EAEA,MAAM,gBAAgB,EAAE,IAAI,gBAAgB,SAAS,GAAG;AACtD,UAAM,wBAAwB,4BAA4B,EAAE;AAC5D,QAAI;AACF,YAAM,iBAAiB;AAAA,QACrB,oBAAoB,yBAAyB,EAAE;AAAA,QAC/C;AAAA,QACA,OAAO,EAAE,UAAU,eAAe;AAAA,MACpC,CAAC;AAAA,IACH,SAAS,OAAO;AACd,YAAM,UAAU,iBAAiB,QAAQ,MAAM,UAAU;AACzD,UAAI;AACF,cAAM,sBACH,OAAO,mBAAmB,EAAE,UAAU,eAAe,CAAC,EACtD,MAAM,sDAAsD,OAAO,EAAE;AAAA,MAC1E,SAAS,UAAU;AACjB,cAAM,aAAa,oBAAoB,QAAQ,SAAS,UAAU;AAClE,gBAAQ;AAAA,UACN,gEAAgE,OAAO,2DACZ,UAAU;AAAA,QACvE;AAAA,MACF;AAAA,IACF;AAAA,EACF;AACF;AAEA,IAAO,gBAAQ;",
   "names": []
 }

package/jest.config.cjs

@@ -15,6 +15,8 @@ module.exports = {
       {
         tsconfig: {
           jsx: 'react-jsx',
+          rootDir: '.',
+          ignoreDeprecations: '6.0',
         },
       },
     ],

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@open-mercato/storage-s3",
-  "version": "0.6.2-develop.3467.1.2a1818709d",
+  "version": "0.6.2",
   "type": "module",
   "main": "./dist/index.js",
   "scripts": {
@@ -68,14 +68,14 @@
   "dependencies": {
     "@aws-sdk/client-s3": "^3.821.0",
     "@aws-sdk/s3-request-presigner": "^3.821.0",
-    "@open-mercato/core": "0.6.2-develop.3467.1.2a1818709d"
+    "@open-mercato/core": "0.6.2"
   },
   "peerDependencies": {
     "@mikro-orm/postgresql": "^6.6.10",
-    "@open-mercato/shared": "0.6.2-develop.3467.1.2a1818709d"
+    "@open-mercato/shared": "0.6.2"
   },
   "devDependencies": {
-    "@open-mercato/shared": "0.6.2-develop.3467.1.2a1818709d",
+    "@open-mercato/shared": "0.6.2",
     "@types/jest": "^30.0.0",
     "esbuild": "^0.25.2",
     "glob": "^11.0.3",
@@ -89,6 +89,5 @@
     "type": "git",
     "url": "https://github.com/open-mercato/open-mercato",
     "directory": "packages/storage-s3"
-  },
-  "stableVersion": "0.4.10"
+  }
 }

package/src/modules/storage_s3/__tests__/cli.test.ts

@@ -0,0 +1,418 @@
+import type { CredentialsService } from '@open-mercato/core/modules/integrations/lib/credentials-service'
+import type { IntegrationLogService } from '@open-mercato/core/modules/integrations/lib/log-service'
+import {
+  mapOrganizationsToScopes,
+  parseCliArgs,
+  resolveCliMode,
+  runConfigureFromEnv,
+  runConfigureFromEnvForScopes,
+} from '../lib/configure-from-env'
+
+function buildLogService() {
+  const info = jest.fn()
+  const integrationLogService = {
+    scoped: jest.fn(() => ({ info })),
+  } as unknown as IntegrationLogService
+  return { integrationLogService, info }
+}
+
+describe('storage_s3 configure-from-env CLI handler', () => {
+  it('skips when no env vars are set', async () => {
+    const credentialsService = {
+      getRaw: jest.fn(),
+      save: jest.fn(),
+    } as unknown as CredentialsService
+    const { integrationLogService } = buildLogService()
+
+    const outcome = await runConfigureFromEnv(
+      { credentialsService, integrationLogService, env: {} },
+      { tenantId: 't', organizationId: 'o' },
+    )
+
+    expect(outcome).toEqual({
+      code: 0,
+      status: 'skipped',
+      message: expect.stringMatching(/No S3 env preset/),
+    })
+    expect(credentialsService.save).not.toHaveBeenCalled()
+  })
+
+  it('configures credentials with a complete env preset', async () => {
+    const credentialsService = {
+      getRaw: jest.fn().mockResolvedValue(null),
+      save: jest.fn(),
+    } as unknown as CredentialsService
+    const { integrationLogService, info } = buildLogService()
+
+    const outcome = await runConfigureFromEnv(
+      {
+        credentialsService,
+        integrationLogService,
+        env: {
+          OM_INTEGRATION_STORAGE_S3_ACCESS_KEY_ID: 'AKIAEXAMPLE',
+          OM_INTEGRATION_STORAGE_S3_SECRET_ACCESS_KEY: 'secret',
+          OM_INTEGRATION_STORAGE_S3_REGION: 'eu-central-1',
+          OM_INTEGRATION_STORAGE_S3_BUCKET: 'om-bucket',
+        },
+      },
+      { tenantId: 't', organizationId: 'o' },
+    )
+
+    expect(outcome).toEqual({
+      code: 0,
+      status: 'configured',
+      message: expect.stringMatching(/configured from env/i),
+    })
+    expect(credentialsService.save).toHaveBeenCalledTimes(1)
+    expect(info).toHaveBeenCalledTimes(1)
+  })
+
+  it('skips when credentials already exist and --force is not set', async () => {
+    const credentialsService = {
+      getRaw: jest.fn().mockResolvedValue({ accessKeyId: 'existing' }),
+      save: jest.fn(),
+    } as unknown as CredentialsService
+    const { integrationLogService } = buildLogService()
+
+    const outcome = await runConfigureFromEnv(
+      {
+        credentialsService,
+        integrationLogService,
+        env: {
+          OM_INTEGRATION_STORAGE_S3_ACCESS_KEY_ID: 'AKIAEXAMPLE',
+          OM_INTEGRATION_STORAGE_S3_SECRET_ACCESS_KEY: 'secret',
+          OM_INTEGRATION_STORAGE_S3_REGION: 'eu-central-1',
+          OM_INTEGRATION_STORAGE_S3_BUCKET: 'om-bucket',
+        },
+      },
+      { tenantId: 't', organizationId: 'o' },
+    )
+
+    expect(outcome).toEqual({
+      code: 0,
+      status: 'skipped',
+      message: expect.stringMatching(/already exist/i),
+    })
+    expect(credentialsService.save).not.toHaveBeenCalled()
+  })
+
+  it('overwrites credentials when --force is true', async () => {
+    const credentialsService = {
+      getRaw: jest.fn().mockResolvedValue({ accessKeyId: 'existing' }),
+      save: jest.fn(),
+    } as unknown as CredentialsService
+    const { integrationLogService } = buildLogService()
+
+    const outcome = await runConfigureFromEnv(
+      {
+        credentialsService,
+        integrationLogService,
+        env: {
+          OM_INTEGRATION_STORAGE_S3_ACCESS_KEY_ID: 'AKIAEXAMPLE',
+          OM_INTEGRATION_STORAGE_S3_SECRET_ACCESS_KEY: 'secret',
+          OM_INTEGRATION_STORAGE_S3_REGION: 'eu-central-1',
+          OM_INTEGRATION_STORAGE_S3_BUCKET: 'om-bucket',
+        },
+      },
+      { tenantId: 't', organizationId: 'o', force: true },
+    )
+
+    expect(outcome.code).toBe(0)
+    expect(outcome.status).toBe('configured')
+    expect(credentialsService.save).toHaveBeenCalledTimes(1)
+  })
+
+  it('returns code 1 with a clear message for incomplete env presets', async () => {
+    const credentialsService = {
+      getRaw: jest.fn(),
+      save: jest.fn(),
+    } as unknown as CredentialsService
+    const { integrationLogService } = buildLogService()
+
+    const outcome = await runConfigureFromEnv(
+      {
+        credentialsService,
+        integrationLogService,
+        env: {
+          OM_INTEGRATION_STORAGE_S3_ACCESS_KEY_ID: 'AKIAEXAMPLE',
+          OM_INTEGRATION_STORAGE_S3_SECRET_ACCESS_KEY: 'secret',
+        },
+      },
+      { tenantId: 't', organizationId: 'o' },
+    )
+
+    expect(outcome.code).toBe(1)
+    expect(outcome.status).toBe('error')
+    expect(outcome.message).toMatch(/Incomplete S3 env preset/)
+    expect(credentialsService.save).not.toHaveBeenCalled()
+  })
+})
+
+describe('storage_s3 configure-from-env --all-tenants helper', () => {
+  function buildFullEnv() {
+    return {
+      OM_INTEGRATION_STORAGE_S3_ACCESS_KEY_ID: 'AKIAEXAMPLE',
+      OM_INTEGRATION_STORAGE_S3_SECRET_ACCESS_KEY: 'secret',
+      OM_INTEGRATION_STORAGE_S3_REGION: 'eu-central-1',
+      OM_INTEGRATION_STORAGE_S3_BUCKET: 'om-bucket',
+    }
+  }
+
+  it('iterates every scope and reports per-scope outcomes', async () => {
+    const existing = new Set(['org-existing'])
+    const saved: Array<{ tenantId: string; organizationId: string }> = []
+
+    const credentialsService = {
+      getRaw: jest.fn(async (_id: string, scope: { tenantId: string; organizationId: string }) =>
+        existing.has(scope.organizationId) ? { accessKeyId: 'existing' } : null,
+      ),
+      save: jest.fn(async (_id: string, _creds: unknown, scope: { tenantId: string; organizationId: string }) => {
+        saved.push(scope)
+      }),
+    } as unknown as CredentialsService
+
+    const { integrationLogService } = buildLogService()
+
+    const summary = await runConfigureFromEnvForScopes(
+      { credentialsService, integrationLogService, env: buildFullEnv() },
+      [
+        { tenantId: 't1', organizationId: 'org-fresh' },
+        { tenantId: 't2', organizationId: 'org-existing' },
+      ],
+    )
+
+    expect(summary).toMatchObject({ code: 0, configured: 1, skipped: 1, errored: 0 })
+    expect(summary.perScope).toHaveLength(2)
+    expect(summary.perScope[0].outcome.status).toBe('configured')
+    expect(summary.perScope[1].outcome.status).toBe('skipped')
+    expect(saved).toEqual([{ tenantId: 't1', organizationId: 'org-fresh' }])
+  })
+
+  it('returns exit code 1 when at least one scope errors', async () => {
+    const credentialsService = {
+      getRaw: jest.fn().mockResolvedValue(null),
+      save: jest.fn(async (_id, _creds, scope) => {
+        if ((scope as { organizationId: string }).organizationId === 'broken') {
+          throw new Error('boom')
+        }
+      }),
+    } as unknown as CredentialsService
+
+    const { integrationLogService } = buildLogService()
+
+    const summary = await runConfigureFromEnvForScopes(
+      { credentialsService, integrationLogService, env: buildFullEnv() },
+      [
+        { tenantId: 't1', organizationId: 'ok' },
+        { tenantId: 't2', organizationId: 'broken' },
+      ],
+    )
+
+    expect(summary.code).toBe(1)
+    expect(summary.configured).toBe(1)
+    expect(summary.errored).toBe(1)
+    expect(summary.perScope[1].outcome.status).toBe('error')
+    expect((summary.perScope[1].outcome as { message: string }).message).toMatch(/boom/)
+  })
+
+  it('returns exit code 0 with skip-only outcomes when env is unset', async () => {
+    const credentialsService = {
+      getRaw: jest.fn(),
+      save: jest.fn(),
+    } as unknown as CredentialsService
+
+    const { integrationLogService } = buildLogService()
+
+    const summary = await runConfigureFromEnvForScopes(
+      { credentialsService, integrationLogService, env: {} },
+      [
+        { tenantId: 't1', organizationId: 'a' },
+        { tenantId: 't2', organizationId: 'b' },
+      ],
+    )
+
+    expect(summary.code).toBe(0)
+    expect(summary.skipped).toBe(2)
+    expect(summary.configured).toBe(0)
+    expect(summary.errored).toBe(0)
+    expect(credentialsService.save).not.toHaveBeenCalled()
+  })
+
+  it('propagates --force to every scope', async () => {
+    const saveCalls: Array<{ scope: { tenantId: string; organizationId: string } }> = []
+    const credentialsService = {
+      getRaw: jest.fn().mockResolvedValue({ accessKeyId: 'existing' }),
+      save: jest.fn(async (_id, _creds, scope) => {
+        saveCalls.push({ scope: scope as { tenantId: string; organizationId: string } })
+      }),
+    } as unknown as CredentialsService
+
+    const { integrationLogService } = buildLogService()
+
+    const summary = await runConfigureFromEnvForScopes(
+      { credentialsService, integrationLogService, env: buildFullEnv() },
+      [
+        { tenantId: 't1', organizationId: 'a' },
+        { tenantId: 't2', organizationId: 'b' },
+      ],
+      { force: true },
+    )
+
+    expect(summary.code).toBe(0)
+    expect(summary.configured).toBe(2)
+    expect(saveCalls).toHaveLength(2)
+  })
+})
+
+describe('storage_s3 parseCliArgs', () => {
+  it('parses standalone flags as boolean true', () => {
+    expect(parseCliArgs(['--all-tenants'])).toEqual({ 'all-tenants': true })
+    expect(parseCliArgs(['--force'])).toEqual({ force: true })
+  })
+
+  it('parses --key value pairs', () => {
+    expect(parseCliArgs(['--tenant', 'abc', '--org', 'def'])).toEqual({
+      tenant: 'abc',
+      org: 'def',
+    })
+  })
+
+  it('parses --key=value form', () => {
+    expect(parseCliArgs(['--tenant=abc', '--org=def'])).toEqual({
+      tenant: 'abc',
+      org: 'def',
+    })
+  })
+
+  it('treats the next --flag as a separate flag, not a value', () => {
+    expect(parseCliArgs(['--all-tenants', '--force'])).toEqual({
+      'all-tenants': true,
+      force: true,
+    })
+  })
+
+  it('ignores positional arguments without a leading --', () => {
+    expect(parseCliArgs(['ignored', '--tenant', 'abc', 'also-ignored'])).toEqual({
+      tenant: 'abc',
+    })
+  })
+})
+
+describe('storage_s3 resolveCliMode', () => {
+  it('returns help when no tenant/org and no --all-tenants is provided', () => {
+    expect(resolveCliMode({})).toEqual({ kind: 'help' })
+    expect(resolveCliMode({ force: true })).toEqual({ kind: 'help' })
+  })
+
+  it('returns help when only --tenant is provided without --org', () => {
+    expect(resolveCliMode({ tenant: 'abc' })).toEqual({ kind: 'help' })
+  })
+
+  it('returns help when only --org is provided without --tenant', () => {
+    expect(resolveCliMode({ org: 'def' })).toEqual({ kind: 'help' })
+  })
+
+  it('returns single mode when both --tenant and --org are provided', () => {
+    expect(resolveCliMode({ tenant: 'abc', org: 'def' })).toEqual({
+      kind: 'single',
+      tenantId: 'abc',
+      organizationId: 'def',
+      force: undefined,
+    })
+  })
+
+  it('accepts the alias forms --tenantId / --organizationId / --orgId', () => {
+    expect(resolveCliMode({ tenantId: 'abc', organizationId: 'def' })).toEqual({
+      kind: 'single',
+      tenantId: 'abc',
+      organizationId: 'def',
+      force: undefined,
+    })
+    expect(resolveCliMode({ tenant: 'abc', orgId: 'def' })).toEqual({
+      kind: 'single',
+      tenantId: 'abc',
+      organizationId: 'def',
+      force: undefined,
+    })
+  })
+
+  it('propagates --force to single mode', () => {
+    expect(resolveCliMode({ tenant: 'abc', org: 'def', force: true })).toEqual({
+      kind: 'single',
+      tenantId: 'abc',
+      organizationId: 'def',
+      force: true,
+    })
+  })
+
+  it('returns all mode when --all-tenants is provided alone', () => {
+    expect(resolveCliMode({ 'all-tenants': true })).toEqual({
+      kind: 'all',
+      force: undefined,
+    })
+  })
+
+  it('accepts --allTenants as a camelCase alias for --all-tenants', () => {
+    expect(resolveCliMode({ allTenants: true })).toEqual({
+      kind: 'all',
+      force: undefined,
+    })
+  })
+
+  it('propagates --force to all mode', () => {
+    expect(resolveCliMode({ 'all-tenants': true, force: true })).toEqual({
+      kind: 'all',
+      force: true,
+    })
+  })
+
+  it('returns conflict when --all-tenants is combined with --tenant', () => {
+    const mode = resolveCliMode({ 'all-tenants': true, tenant: 'abc' })
+    expect(mode.kind).toBe('conflict')
+    if (mode.kind === 'conflict') {
+      expect(mode.message).toMatch(/cannot be combined/i)
+    }
+  })
+
+  it('returns conflict when --all-tenants is combined with --org', () => {
+    const mode = resolveCliMode({ 'all-tenants': true, org: 'def' })
+    expect(mode.kind).toBe('conflict')
+  })
+
+  it('returns conflict when --all-tenants is combined with both --tenant and --org', () => {
+    expect(resolveCliMode({ 'all-tenants': true, tenant: 'abc', org: 'def' }).kind).toBe('conflict')
+  })
+})
+
+describe('storage_s3 mapOrganizationsToScopes', () => {
+  it('returns an empty array when there are no organizations', () => {
+    expect(mapOrganizationsToScopes([])).toEqual([])
+  })
+
+  it('returns a scope per organization with its tenant id', () => {
+    const orgs = [
+      { id: 'org-1', tenant: { id: 'tenant-1' } },
+      { id: 'org-2', tenant: { id: 'tenant-1' } },
+      { id: 'org-3', tenant: { id: 'tenant-2' } },
+    ]
+    expect(mapOrganizationsToScopes(orgs)).toEqual([
+      { tenantId: 'tenant-1', organizationId: 'org-1' },
+      { tenantId: 'tenant-1', organizationId: 'org-2' },
+      { tenantId: 'tenant-2', organizationId: 'org-3' },
+    ])
+  })
+
+  it('skips organizations without a populated tenant (defensive guard)', () => {
+    const orgs = [
+      { id: 'org-1', tenant: { id: 'tenant-1' } },
+      { id: 'org-2', tenant: null },
+      { id: 'org-3' },
+      { id: 'org-4', tenant: { id: null } },
+      { id: 'org-5', tenant: { id: 'tenant-2' } },
+    ]
+    expect(mapOrganizationsToScopes(orgs)).toEqual([
+      { tenantId: 'tenant-1', organizationId: 'org-1' },
+      { tenantId: 'tenant-2', organizationId: 'org-5' },
+    ])
+  })
+})

package/src/modules/storage_s3/__tests__/preset.test.ts

@@ -0,0 +1,175 @@
+import type { CredentialsService } from '@open-mercato/core/modules/integrations/lib/credentials-service'
+import type { IntegrationLogService } from '@open-mercato/core/modules/integrations/lib/log-service'
+import { applyS3EnvPreset, readS3EnvPreset } from '../lib/preset'
+
+describe('storage_s3 preset', () => {
+  it('returns null when no env vars are provided', () => {
+    expect(readS3EnvPreset({})).toBeNull()
+  })
+
+  it('reads required credentials from env and applies optional fields', () => {
+    const preset = readS3EnvPreset({
+      OM_INTEGRATION_STORAGE_S3_ACCESS_KEY_ID: 'AKIAEXAMPLE',
+      OM_INTEGRATION_STORAGE_S3_SECRET_ACCESS_KEY: 'secret',
+      OM_INTEGRATION_STORAGE_S3_REGION: 'eu-central-1',
+      OM_INTEGRATION_STORAGE_S3_BUCKET: 'om-bucket',
+      OM_INTEGRATION_STORAGE_S3_SESSION_TOKEN: 'session',
+      OM_INTEGRATION_STORAGE_S3_ENDPOINT: 'https://example.com',
+      OM_INTEGRATION_STORAGE_S3_FORCE_PATH_STYLE: 'true',
+      OM_INTEGRATION_STORAGE_S3_FORCE_PRECONFIGURE: 'true',
+    })
+
+    expect(preset).not.toBeNull()
+    expect(preset?.credentials).toEqual({
+      authMode: 'access_keys',
+      accessKeyId: 'AKIAEXAMPLE',
+      secretAccessKey: 'secret',
+      sessionToken: 'session',
+      region: 'eu-central-1',
+      bucket: 'om-bucket',
+      endpoint: 'https://example.com',
+      forcePathStyle: true,
+    })
+    expect(preset?.force).toBe(true)
+  })
+
+  it('throws when any required env value is missing', () => {
+    expect(() =>
+      readS3EnvPreset({
+        OM_INTEGRATION_STORAGE_S3_ACCESS_KEY_ID: 'AKIAEXAMPLE',
+        OM_INTEGRATION_STORAGE_S3_SECRET_ACCESS_KEY: 'secret',
+      }),
+    ).toThrow(/Incomplete S3 env preset/)
+  })
+
+  it('saves credentials and writes an info log when applied for the first time', async () => {
+    const saved: Array<Record<string, unknown>> = []
+    const logCalls: Array<{ message: string; payload?: Record<string, unknown> }> = []
+
+    const credentialsService = {
+      getRaw: jest.fn().mockResolvedValue(null),
+      save: jest.fn(async (_integrationId, credentials) => {
+        saved.push(credentials as Record<string, unknown>)
+      }),
+    } as unknown as CredentialsService
+
+    const integrationLogService = {
+      scoped: jest.fn(() => ({
+        info: async (message: string, payload?: Record<string, unknown>) => {
+          logCalls.push({ message, payload })
+        },
+      })),
+    } as unknown as IntegrationLogService
+
+    const result = await applyS3EnvPreset({
+      credentialsService,
+      integrationLogService,
+      scope: { tenantId: 'tenant-1', organizationId: 'org-1' },
+      env: {
+        OM_INTEGRATION_STORAGE_S3_ACCESS_KEY_ID: 'AKIAEXAMPLE',
+        OM_INTEGRATION_STORAGE_S3_SECRET_ACCESS_KEY: 'secret',
+        OM_INTEGRATION_STORAGE_S3_REGION: 'eu-central-1',
+        OM_INTEGRATION_STORAGE_S3_BUCKET: 'om-bucket',
+      },
+    })
+
+    expect(result).toEqual({ status: 'configured' })
+    expect(saved).toEqual([
+      {
+        authMode: 'access_keys',
+        accessKeyId: 'AKIAEXAMPLE',
+        secretAccessKey: 'secret',
+        region: 'eu-central-1',
+        bucket: 'om-bucket',
+      },
+    ])
+    expect(logCalls).toHaveLength(1)
+    expect(logCalls[0].payload).toMatchObject({
+      region: 'eu-central-1',
+      bucket: 'om-bucket',
+      endpoint: null,
+    })
+  })
+
+  it('skips when credentials already exist and force is not set', async () => {
+    const credentialsService = {
+      getRaw: jest.fn().mockResolvedValue({ accessKeyId: 'existing' }),
+      save: jest.fn(),
+    } as unknown as CredentialsService
+
+    const integrationLogService = {
+      scoped: jest.fn(() => ({ info: jest.fn() })),
+    } as unknown as IntegrationLogService
+
+    const result = await applyS3EnvPreset({
+      credentialsService,
+      integrationLogService,
+      scope: { tenantId: 't', organizationId: 'o' },
+      env: {
+        OM_INTEGRATION_STORAGE_S3_ACCESS_KEY_ID: 'AKIAEXAMPLE',
+        OM_INTEGRATION_STORAGE_S3_SECRET_ACCESS_KEY: 'secret',
+        OM_INTEGRATION_STORAGE_S3_REGION: 'eu-central-1',
+        OM_INTEGRATION_STORAGE_S3_BUCKET: 'om-bucket',
+      },
+    })
+
+    expect(result.status).toBe('skipped')
+    expect(credentialsService.save).not.toHaveBeenCalled()
+  })
+
+  it('overwrites existing credentials when force is true', async () => {
+    const saveSpy = jest.fn()
+    const credentialsService = {
+      getRaw: jest.fn().mockResolvedValue({ accessKeyId: 'existing' }),
+      save: saveSpy,
+    } as unknown as CredentialsService
+
+    const integrationLogService = {
+      scoped: jest.fn(() => ({ info: jest.fn() })),
+    } as unknown as IntegrationLogService
+
+    const result = await applyS3EnvPreset({
+      credentialsService,
+      integrationLogService,
+      scope: { tenantId: 't', organizationId: 'o' },
+      force: true,
+      env: {
+        OM_INTEGRATION_STORAGE_S3_ACCESS_KEY_ID: 'AKIAEXAMPLE',
+        OM_INTEGRATION_STORAGE_S3_SECRET_ACCESS_KEY: 'secret',
+        OM_INTEGRATION_STORAGE_S3_REGION: 'eu-central-1',
+        OM_INTEGRATION_STORAGE_S3_BUCKET: 'om-bucket',
+      },
+    })
+
+    expect(result.status).toBe('configured')
+    expect(saveSpy).toHaveBeenCalledTimes(1)
+  })
+
+  it('honors OM_INTEGRATION_STORAGE_S3_FORCE_PRECONFIGURE when no explicit force is passed', async () => {
+    const saveSpy = jest.fn()
+    const credentialsService = {
+      getRaw: jest.fn().mockResolvedValue({ accessKeyId: 'existing' }),
+      save: saveSpy,
+    } as unknown as CredentialsService
+
+    const integrationLogService = {
+      scoped: jest.fn(() => ({ info: jest.fn() })),
+    } as unknown as IntegrationLogService
+
+    const result = await applyS3EnvPreset({
+      credentialsService,
+      integrationLogService,
+      scope: { tenantId: 't', organizationId: 'o' },
+      env: {
+        OM_INTEGRATION_STORAGE_S3_ACCESS_KEY_ID: 'AKIAEXAMPLE',
+        OM_INTEGRATION_STORAGE_S3_SECRET_ACCESS_KEY: 'secret',
+        OM_INTEGRATION_STORAGE_S3_REGION: 'eu-central-1',
+        OM_INTEGRATION_STORAGE_S3_BUCKET: 'om-bucket',
+        OM_INTEGRATION_STORAGE_S3_FORCE_PRECONFIGURE: 'true',
+      },
+    })
+
+    expect(result.status).toBe('configured')
+    expect(saveSpy).toHaveBeenCalledTimes(1)
+  })
+})

package/src/modules/storage_s3/cli.ts

@@ -0,0 +1,142 @@
+import { createRequestContainer } from '@open-mercato/shared/lib/di/container'
+import type { EntityManager } from '@mikro-orm/postgresql'
+import type { ModuleCli } from '@open-mercato/shared/modules/registry'
+import type { CredentialsService } from '@open-mercato/core/modules/integrations/lib/credentials-service'
+import type { IntegrationLogService } from '@open-mercato/core/modules/integrations/lib/log-service'
+import { Organization } from '@open-mercato/core/modules/directory/data/entities'
+import type { IntegrationScope } from '@open-mercato/shared/modules/integrations/types'
+import { findWithDecryption } from '@open-mercato/shared/lib/encryption/find'
+import {
+  mapOrganizationsToScopes,
+  parseCliArgs,
+  resolveCliMode,
+  runConfigureFromEnv,
+  runConfigureFromEnvForScopes,
+} from './lib/configure-from-env'
+
+function printHelp(): void {
+  console.log('Usage: yarn mercato storage_s3 configure-from-env [--tenant <tenantId> --org <organizationId> | --all-tenants] [--force]')
+  console.log('')
+  console.log('Modes:')
+  console.log('  --tenant <id> --org <id>   Apply the preset to a single tenant + organization pair.')
+  console.log('  --all-tenants              Apply the preset to every active (tenant, organization) pair.')
+  console.log('                             Designed for unattended deploy hooks; per-tenant skip/force semantics still apply.')
+  console.log('')
+  console.log('Required env vars:')
+  console.log('  OM_INTEGRATION_STORAGE_S3_ACCESS_KEY_ID')
+  console.log('  OM_INTEGRATION_STORAGE_S3_SECRET_ACCESS_KEY')
+  console.log('  OM_INTEGRATION_STORAGE_S3_REGION')
+  console.log('  OM_INTEGRATION_STORAGE_S3_BUCKET')
+  console.log('')
+  console.log('Optional env vars:')
+  console.log('  OM_INTEGRATION_STORAGE_S3_SESSION_TOKEN')
+  console.log('  OM_INTEGRATION_STORAGE_S3_ENDPOINT')
+  console.log('  OM_INTEGRATION_STORAGE_S3_FORCE_PATH_STYLE')
+  console.log('  OM_INTEGRATION_STORAGE_S3_FORCE_PRECONFIGURE')
+}
+
+async function listActiveScopes(em: EntityManager): Promise<IntegrationScope[]> {
+  const organizations = await findWithDecryption(
+    em,
+    Organization,
+    { deletedAt: null, isActive: true },
+    { populate: ['tenant'] },
+  )
+  return mapOrganizationsToScopes(organizations)
+}
+
+const configureFromEnvCommand: ModuleCli = {
+  command: 'configure-from-env',
+  async run(rest) {
+    const mode = resolveCliMode(parseCliArgs(rest))
+
+    if (mode.kind === 'help') {
+      printHelp()
+      return
+    }
+
+    if (mode.kind === 'conflict') {
+      console.error(`[storage_s3] ${mode.message}`)
+      throw new Error(`Conflicting CLI arguments: ${mode.message}`)
+    }
+
+    const container = await createRequestContainer()
+    try {
+      const credentialsService = container.resolve('integrationCredentialsService') as CredentialsService
+      const integrationLogService = container.resolve('integrationLogService') as IntegrationLogService
+
+      if (mode.kind === 'all') {
+        const em = container.resolve('em') as EntityManager
+        const scopes = await listActiveScopes(em)
+
+        if (scopes.length === 0) {
+          console.log('[storage_s3] --all-tenants: no active organizations found. Nothing to do.')
+          return
+        }
+
+        const summary = await runConfigureFromEnvForScopes(
+          { credentialsService, integrationLogService },
+          scopes,
+          { force: mode.force },
+        )
+
+        for (const entry of summary.perScope) {
+          const prefix = `[storage_s3] tenant=${entry.scope.tenantId} org=${entry.scope.organizationId}`
+          if (entry.outcome.code === 1) {
+            console.error(`${prefix} ERROR: ${entry.outcome.message}`)
+          } else if (entry.outcome.status === 'skipped') {
+            console.log(`${prefix} skipped: ${entry.outcome.message}`)
+          } else {
+            console.log(`${prefix} configured: ${entry.outcome.message}`)
+          }
+        }
+
+        console.log(
+          `[storage_s3] --all-tenants summary: ${summary.configured} configured, ` +
+            `${summary.skipped} skipped, ${summary.errored} error(s).`,
+        )
+
+        if (summary.code === 1) {
+          throw new Error(
+            `--all-tenants completed with ${summary.errored} error(s) across ${scopes.length} scope(s). See per-scope errors above.`,
+          )
+        }
+        return
+      }
+
+      const outcome = await runConfigureFromEnv(
+        { credentialsService, integrationLogService },
+        {
+          tenantId: mode.tenantId,
+          organizationId: mode.organizationId,
+          force: mode.force,
+        },
+      )
+
+      if (outcome.code === 0) {
+        if (outcome.status === 'skipped') {
+          console.log(`[storage_s3] Skipped: ${outcome.message}`)
+        } else {
+          console.log(`[storage_s3] ${outcome.message}`)
+        }
+        return
+      }
+
+      throw new Error(outcome.message)
+    } finally {
+      const disposable = container as unknown as { dispose?: () => Promise<void> }
+      if (typeof disposable.dispose === 'function') {
+        await disposable.dispose()
+      }
+    }
+  },
+}
+
+const helpCommand: ModuleCli = {
+  command: 'help',
+  async run() {
+    printHelp()
+  },
+}
+
+export default [configureFromEnvCommand, helpCommand]

package/src/modules/storage_s3/lib/configure-from-env.ts

@@ -0,0 +1,164 @@
+import type { CredentialsService } from '@open-mercato/core/modules/integrations/lib/credentials-service'
+import type { IntegrationLogService } from '@open-mercato/core/modules/integrations/lib/log-service'
+import type { IntegrationScope } from '@open-mercato/shared/modules/integrations/types'
+import { applyS3EnvPreset, readS3EnvPreset } from './preset'
+
+export type ConfigureFromEnvDeps = {
+  credentialsService: CredentialsService
+  integrationLogService: IntegrationLogService
+  env?: NodeJS.ProcessEnv
+}
+
+export type ConfigureFromEnvOptions = {
+  tenantId: string
+  organizationId: string
+  force?: boolean
+}
+
+export type ConfigureFromEnvOutcome =
+  | { code: 0; status: 'configured' | 'skipped'; message: string }
+  | { code: 1; status: 'error'; message: string }
+
+export async function runConfigureFromEnv(
+  deps: ConfigureFromEnvDeps,
+  options: ConfigureFromEnvOptions,
+): Promise<ConfigureFromEnvOutcome> {
+  try {
+    const preset = readS3EnvPreset(deps.env ?? process.env)
+    if (!preset) {
+      return {
+        code: 0,
+        status: 'skipped',
+        message: 'No S3 env preset was found. Set OM_INTEGRATION_STORAGE_S3_* variables to enable preconfiguration.',
+      }
+    }
+
+    const result = await applyS3EnvPreset({
+      credentialsService: deps.credentialsService,
+      integrationLogService: deps.integrationLogService,
+      scope: { tenantId: options.tenantId, organizationId: options.organizationId },
+      force: options.force,
+      env: deps.env ?? process.env,
+    })
+
+    if (result.status === 'skipped') {
+      return { code: 0, status: 'skipped', message: result.reason }
+    }
+
+    return { code: 0, status: 'configured', message: 'S3 credentials were configured from env.' }
+  } catch (error) {
+    const message = error instanceof Error ? error.message : 'Unknown S3 preset error'
+    return { code: 1, status: 'error', message }
+  }
+}
+
+export type ConfigureFromEnvScopeOutcome = {
+  scope: IntegrationScope
+  outcome: ConfigureFromEnvOutcome
+}
+
+export type ConfigureFromEnvAllOutcome = {
+  code: 0 | 1
+  configured: number
+  skipped: number
+  errored: number
+  perScope: ConfigureFromEnvScopeOutcome[]
+}
+
+export async function runConfigureFromEnvForScopes(
+  deps: ConfigureFromEnvDeps,
+  scopes: IntegrationScope[],
+  options: { force?: boolean } = {},
+): Promise<ConfigureFromEnvAllOutcome> {
+  const perScope: ConfigureFromEnvScopeOutcome[] = []
+  let configured = 0
+  let skipped = 0
+  let errored = 0
+
+  for (const scope of scopes) {
+    const outcome = await runConfigureFromEnv(deps, {
+      tenantId: scope.tenantId,
+      organizationId: scope.organizationId,
+      force: options.force,
+    })
+    perScope.push({ scope, outcome })
+    if (outcome.code === 1) errored += 1
+    else if (outcome.status === 'configured') configured += 1
+    else skipped += 1
+  }
+
+  const code: 0 | 1 = errored > 0 ? 1 : 0
+  return { code, configured, skipped, errored, perScope }
+}
+
+export function parseCliArgs(args: string[]): Record<string, string | boolean> {
+  const result: Record<string, string | boolean> = {}
+
+  for (let i = 0; i < args.length; i++) {
+    const arg = args[i]
+    if (!arg.startsWith('--')) continue
+
+    const key = arg.slice(2)
+    if (key.includes('=')) {
+      const [name, value] = key.split('=')
+      result[name] = value
+      continue
+    }
+
+    const next = args[i + 1]
+    if (next && !next.startsWith('--')) {
+      result[key] = next
+      i += 1
+      continue
+    }
+
+    result[key] = true
+  }
+
+  return result
+}
+
+export type ConfigureFromEnvCliMode =
+  | { kind: 'help' }
+  | { kind: 'conflict'; message: string }
+  | { kind: 'all'; force?: boolean }
+  | { kind: 'single'; tenantId: string; organizationId: string; force?: boolean }
+
+export function resolveCliMode(args: Record<string, string | boolean>): ConfigureFromEnvCliMode {
+  const allTenants = args['all-tenants'] === true || args.allTenants === true
+  const tenantId = String(args.tenantId ?? args.tenant ?? '')
+  const organizationId = String(args.organizationId ?? args.orgId ?? args.org ?? '')
+  const force = args.force === true ? true : undefined
+
+  if (allTenants && (tenantId || organizationId)) {
+    return {
+      kind: 'conflict',
+      message: '--all-tenants cannot be combined with --tenant or --org. Pick one mode.',
+    }
+  }
+
+  if (allTenants) {
+    return { kind: 'all', force }
+  }
+
+  if (!tenantId || !organizationId) {
+    return { kind: 'help' }
+  }
+
+  return { kind: 'single', tenantId, organizationId, force }
+}
+
+type OrganizationRow = {
+  id: string
+  tenant?: { id?: string | null } | null
+}
+
+export function mapOrganizationsToScopes(organizations: OrganizationRow[]): IntegrationScope[] {
+  const scopes: IntegrationScope[] = []
+  for (const organization of organizations) {
+    const tenantId = organization.tenant?.id
+    if (!tenantId) continue
+    scopes.push({ tenantId, organizationId: organization.id })
+  }
+  return scopes
+}

package/src/modules/storage_s3/setup.ts

@@ -3,6 +3,8 @@ import { createCredentialsService } from '@open-mercato/core/modules/integration
 import { createIntegrationLogService } from '@open-mercato/core/modules/integrations/lib/log-service'
 import { applyS3EnvPreset } from './lib/preset'
 
+const S3_INTEGRATION_ID = 'storage_s3'
+
 export const setup: ModuleSetupConfig = {
   defaultRoleFeatures: {
     superadmin: ['storage_providers.manage'],
@@ -10,15 +12,26 @@ export const setup: ModuleSetupConfig = {
   },
 
   async onTenantCreated({ em, organizationId, tenantId }) {
+    const integrationLogService = createIntegrationLogService(em)
     try {
       await applyS3EnvPreset({
         credentialsService: createCredentialsService(em),
-        integrationLogService: createIntegrationLogService(em),
+        integrationLogService,
         scope: { tenantId, organizationId },
       })
     } catch (error) {
       const message = error instanceof Error ? error.message : 'Unknown S3 preset error'
-      console.warn(`[storage_s3] Failed to apply env preset during tenant setup: ${message}`)
+      try {
+        await integrationLogService
+          .scoped(S3_INTEGRATION_ID, { tenantId, organizationId })
+          .error(`Failed to apply S3 env preset during tenant setup: ${message}`)
+      } catch (logError) {
+        const logMessage = logError instanceof Error ? logError.message : 'Unknown integration log error'
+        console.error(
+          `[storage_s3] Failed to apply env preset during tenant setup: ${message}. ` +
+            `Also failed to persist the error to integration logs: ${logMessage}`,
+        )
+      }
     }
   },
 }