@open-mercato/storage-s3 0.6.7-develop.6860.1.f796b22e80 → 0.6.7

package/dist/modules/storage_s3/lib/storage-service.js

@@ -1,7 +1,5 @@
-import { createHash, randomBytes } from "crypto";
+import { randomUUID } from "crypto";
 import { S3StorageDriver } from "./s3-driver.js";
-import { resolveAttachmentMaxBytes } from "@open-mercato/core/modules/attachments/lib/upload-limits";
-import { reconcileTenantS3Objects } from "./quota-accounting.js";
 import {
   assertS3KeyAddressableByTenantScope,
   assertS3KeyScopedToTenant,
@@ -10,89 +8,32 @@ import {
 function sanitizeSegment(value) {
   return value.replace(/[^a-zA-Z0-9._-]/g, "_");
 }
+function buildKey(namespace, scope, fileName) {
+  const orgSeg = scope.organizationId ? `org_${scope.organizationId}` : "org_shared";
+  const tenantSeg = scope.tenantId ? `tenant_${scope.tenantId}` : "tenant_shared";
+  const uniqueSuffix = randomUUID().replace(/-/g, "").slice(0, 12);
+  const safeName = sanitizeSegment(fileName || "file");
+  return `${sanitizeSegment(namespace)}/${orgSeg}/${tenantSeg}/${Date.now()}_${uniqueSuffix}_${safeName}`;
+}
 function createStorageService(config) {
   const driver = new S3StorageDriver(config);
-  const quotaService = config.quotaService;
-  const quotaRecoveryScheduler = config.quotaRecoveryScheduler;
   const pathPrefix = config.pathPrefix;
   return {
     async upload({ namespace, fileName, buffer, contentType, scope }) {
-      const storagePath = driver.prepareStoragePath({
-        partitionCode: sanitizeSegment(namespace),
+      const stored = await driver.store({
+        partitionCode: namespace,
         orgId: scope.organizationId,
         tenantId: scope.tenantId,
-        fileName
+        fileName,
+        buffer
       });
-      assertS3KeyScopedToTenant(storagePath, scope, pathPrefix);
-      let reservation = null;
-      let storageStarted = false;
-      let objectStored = false;
-      try {
-        if (quotaService && scope.tenantId && scope.organizationId) {
-          await reconcileTenantS3Objects({
-            driver,
-            quotaService,
-            tenantId: scope.tenantId,
-            organizationId: scope.organizationId
-          });
-          reservation = await quotaService.reserve({
-            tenantId: scope.tenantId,
-            organizationId: scope.organizationId,
-            bytes: buffer.length,
-            source: "storage_service",
-            storageDriver: "s3",
-            storagePath,
-            partitionCode: namespace
-          });
-        }
-        if (reservation) {
-          if (!quotaRecoveryScheduler) throw new Error("Storage quota recovery is unavailable.");
-          await quotaRecoveryScheduler(
-            {
-              reservationId: reservation.id,
-              tenantId: scope.tenantId,
-              organizationId: scope.organizationId
-            },
-            Math.max(1e3, reservation.expiresAt.getTime() - Date.now())
-          );
-          await quotaService.beginStorage(reservation.id, reservation.leaseToken);
-          storageStarted = true;
-        }
-        const stored = await driver.store({
-          partitionCode: namespace,
-          orgId: scope.organizationId,
-          tenantId: scope.tenantId,
-          fileName,
-          buffer,
-          storagePath
-        });
-        objectStored = true;
-        if (reservation) {
-          await quotaService.markStored(reservation.id, reservation.leaseToken);
-          await quotaService.completeStandalone(reservation.id, reservation.leaseToken, buffer.length);
-        }
-        return {
-          key: stored.storagePath,
-          namespace,
-          fileName,
-          size: buffer.length,
-          contentType
-        };
-      } catch (error) {
-        if (reservation) {
-          if (objectStored) {
-            try {
-              await driver.deleteStrict("", storagePath);
-              await quotaService.release(reservation.id, reservation.leaseToken);
-            } catch {
-            }
-          } else if (!storageStarted) {
-            await quotaService.release(reservation.id, reservation.leaseToken).catch(() => {
-            });
-          }
-        }
-        throw error;
-      }
+      return {
+        key: stored.storagePath,
+        namespace,
+        fileName,
+        size: buffer.length,
+        contentType
+      };
     },
     async download({ key, scope }) {
       assertS3KeyAddressableByTenantScope(key, scope, pathPrefix);
@@ -100,61 +41,16 @@ function createStorageService(config) {
     },
     async delete({ key, scope }) {
       assertS3KeyAddressableByTenantScope(key, scope, pathPrefix);
-      return driver.deleteStrict("", key).then(async () => {
-        if (quotaService && scope.tenantId) {
-          await quotaService.releaseCommittedByPath({
-            tenantId: scope.tenantId,
-            storageDriver: "s3",
-            storagePath: key
-          });
-        }
-      });
+      return driver.delete("", key);
     },
-    async getSignedUrl({ key, operation, expiresIn = 3600, contentType, size, scope }) {
+    async getSignedUrl({ key, operation, expiresIn = 3600, contentType, scope }) {
       if (operation === "upload") {
         assertS3KeyScopedToTenant(key, scope, pathPrefix);
       } else {
         assertS3KeyAddressableByTenantScope(key, scope, pathPrefix);
       }
-      const expiresAt = new Date(Date.now() + expiresIn * 1e3);
-      if (operation === "upload" && quotaService && scope.tenantId && scope.organizationId) {
-        const compatibilityToken = randomBytes(32).toString("base64url");
-        let reservation = null;
-        try {
-          await reconcileTenantS3Objects({
-            driver,
-            quotaService,
-            tenantId: scope.tenantId,
-            organizationId: scope.organizationId
-          });
-          reservation = await quotaService.reserve({
-            tenantId: scope.tenantId,
-            organizationId: scope.organizationId,
-            bytes: size ?? resolveAttachmentMaxBytes(),
-            source: "storage_s3_signed",
-            storageDriver: "s3",
-            storagePath: key,
-            uploadTokenHash: createHash("sha256").update(compatibilityToken).digest("hex"),
-            ttlMs: expiresIn * 1e3
-          });
-          if (!quotaRecoveryScheduler) throw new Error("Storage quota recovery is unavailable.");
-          await quotaRecoveryScheduler({
-            reservationId: reservation.id,
-            tenantId: scope.tenantId,
-            organizationId: scope.organizationId
-          }, Math.max(1e3, reservation.expiresAt.getTime() - Date.now()));
-          const url2 = `/api/storage-providers/s3/signed-upload/${compatibilityToken}`;
-          return { url: url2, expiresAt, reservationId: reservation.id };
-        } catch (error) {
-          if (reservation) {
-            await quotaService.release(reservation.id, reservation.leaseToken).catch(() => {
-            });
-          }
-          throw error;
-        }
-      }
       const url = await driver.getSignedUrl(key, operation, expiresIn, contentType, scope);
-      return { url, expiresAt };
+      return { url, expiresAt: new Date(Date.now() + expiresIn * 1e3) };
     },
     async list({ prefix, maxKeys = 100, continuationToken, scope }) {
       assertS3ListPrefixScopedToTenant(prefix, scope, pathPrefix);

package/dist/modules/storage_s3/lib/storage-service.js.map

@@ -1,7 +1,7 @@
 {
   "version": 3,
   "sources": ["../../../../src/modules/storage_s3/lib/storage-service.ts"],
-  "sourcesContent": ["import { createHash, randomBytes } from 'crypto'\nimport { S3StorageDriver } from './s3-driver'\nimport type { AttachmentQuotaService } from '@open-mercato/core/modules/attachments/lib/quota-service'\nimport { resolveAttachmentMaxBytes } from '@open-mercato/core/modules/attachments/lib/upload-limits'\nimport { reconcileTenantS3Objects } from './quota-accounting'\nimport {\n  assertS3KeyAddressableByTenantScope,\n  assertS3KeyScopedToTenant,\n  assertS3ListPrefixScopedToTenant,\n} from './key-scope'\n\ntype TenantScope = {\n  tenantId: string | null | undefined\n  organizationId: string | null | undefined\n}\n\ntype UploadInput = {\n  namespace: string\n  fileName: string\n  buffer: Buffer\n  contentType?: string\n  scope: TenantScope\n}\n\ntype StorageResult = {\n  key: string\n  namespace: string\n  fileName: string\n  size: number\n  contentType?: string\n}\n\ntype DownloadInput = { key: string; scope: TenantScope }\ntype DeleteInput = { key: string; scope: TenantScope }\ntype SignedUrlInput = {\n  key: string\n  operation: 'upload' | 'download'\n  expiresIn?: number\n  contentType?: string\n  size?: number\n  scope: TenantScope\n}\ntype ListInput = {\n  prefix: string\n  maxKeys?: number\n  continuationToken?: string\n  scope: TenantScope\n}\n\ntype S3Config = {\n  bucket: string\n  region?: string\n  endpoint?: string\n  forcePathStyle?: boolean\n  authMode?: 'access_keys' | 'ambient'\n  credentialsEnvPrefix?: string\n  accessKeyId?: string\n  secretAccessKey?: string\n  sessionToken?: string\n  quotaService?: AttachmentQuotaService\n  quotaRecoveryScheduler?: (\n    payload: { reservationId: string; tenantId: string; organizationId: string },\n    delayMs: number,\n  ) => Promise<void>\n  pathPrefix?: string\n  organizationId?: string | null\n  tenantId?: string | null\n}\n\nfunction sanitizeSegment(value: string): string {\n  return value.replace(/[^a-zA-Z0-9._-]/g, '_')\n}\n\nexport interface StorageService {\n  upload(input: UploadInput): Promise<StorageResult>\n  download(input: DownloadInput): Promise<{ buffer: Buffer; contentType?: string }>\n  delete(input: DeleteInput): Promise<void>\n  getSignedUrl(input: SignedUrlInput): Promise<{ url: string; expiresAt: Date; reservationId?: string }>\n  list(input: ListInput): Promise<{\n    files: Array<{ key: string; size: number; lastModified: Date }>\n    truncated: boolean\n    nextContinuationToken?: string\n  }>\n  toLocalPath(input: { key: string; scope: TenantScope }): Promise<{ filePath: string; cleanup: () => Promise<void> }>\n}\n\nexport function createStorageService(config: S3Config): StorageService {\n  const driver = new S3StorageDriver(config as Record<string, unknown>)\n  const quotaService = config.quotaService\n  const quotaRecoveryScheduler = config.quotaRecoveryScheduler\n  const pathPrefix = config.pathPrefix\n\n  return {\n    async upload({ namespace, fileName, buffer, contentType, scope }): Promise<StorageResult> {\n      const storagePath = driver.prepareStoragePath({\n        partitionCode: sanitizeSegment(namespace),\n        orgId: scope.organizationId,\n        tenantId: scope.tenantId,\n        fileName,\n      })\n      assertS3KeyScopedToTenant(storagePath, scope, pathPrefix)\n      let reservation = null as Awaited<ReturnType<AttachmentQuotaService['reserve']>> | null\n      let storageStarted = false\n      let objectStored = false\n      try {\n        if (quotaService && scope.tenantId && scope.organizationId) {\n          await reconcileTenantS3Objects({\n            driver,\n            quotaService,\n            tenantId: scope.tenantId,\n            organizationId: scope.organizationId,\n          })\n          reservation = await quotaService.reserve({\n            tenantId: scope.tenantId,\n            organizationId: scope.organizationId,\n            bytes: buffer.length,\n            source: 'storage_service',\n            storageDriver: 's3',\n            storagePath,\n            partitionCode: namespace,\n          })\n        }\n        if (reservation) {\n          if (!quotaRecoveryScheduler) throw new Error('Storage quota recovery is unavailable.')\n          await quotaRecoveryScheduler({\n            reservationId: reservation.id,\n            tenantId: scope.tenantId!,\n            organizationId: scope.organizationId!,\n          },\n            Math.max(1_000, reservation.expiresAt.getTime() - Date.now()),\n          )\n          await quotaService!.beginStorage(reservation.id, reservation.leaseToken)\n          storageStarted = true\n        }\n        const stored = await driver.store({\n          partitionCode: namespace,\n          orgId: scope.organizationId,\n          tenantId: scope.tenantId,\n          fileName,\n          buffer,\n          storagePath,\n        })\n        objectStored = true\n        if (reservation) {\n          await quotaService!.markStored(reservation.id, reservation.leaseToken)\n          await quotaService!.completeStandalone(reservation.id, reservation.leaseToken, buffer.length)\n        }\n        return {\n          key: stored.storagePath,\n          namespace,\n          fileName,\n          size: buffer.length,\n          contentType,\n        }\n      } catch (error) {\n        if (reservation) {\n          if (objectStored) {\n            try {\n              await driver.deleteStrict('', storagePath)\n              await quotaService!.release(reservation.id, reservation.leaseToken)\n            } catch {\n              // Keep the reservation counted for recovery when absence is ambiguous.\n            }\n          } else if (!storageStarted) {\n            await quotaService!.release(reservation.id, reservation.leaseToken).catch(() => {})\n          }\n        }\n        throw error\n      }\n    },\n\n    async download({ key, scope }): Promise<{ buffer: Buffer; contentType?: string }> {\n      assertS3KeyAddressableByTenantScope(key, scope, pathPrefix)\n      return driver.read('', key)\n    },\n\n    async delete({ key, scope }): Promise<void> {\n      assertS3KeyAddressableByTenantScope(key, scope, pathPrefix)\n      return driver.deleteStrict('', key)\n        .then(async () => {\n          if (quotaService && scope.tenantId) {\n            await quotaService.releaseCommittedByPath({\n              tenantId: scope.tenantId,\n              storageDriver: 's3',\n              storagePath: key,\n            })\n          }\n        })\n    },\n\n    async getSignedUrl({ key, operation, expiresIn = 3600, contentType, size, scope }) {\n      if (operation === 'upload') {\n        assertS3KeyScopedToTenant(key, scope, pathPrefix)\n      } else {\n        assertS3KeyAddressableByTenantScope(key, scope, pathPrefix)\n      }\n      const expiresAt = new Date(Date.now() + expiresIn * 1000)\n      if (operation === 'upload' && quotaService && scope.tenantId && scope.organizationId) {\n        const compatibilityToken = randomBytes(32).toString('base64url')\n        let reservation: Awaited<ReturnType<AttachmentQuotaService['reserve']>> | null = null\n        try {\n          await reconcileTenantS3Objects({\n            driver,\n            quotaService,\n            tenantId: scope.tenantId,\n            organizationId: scope.organizationId,\n          })\n          reservation = await quotaService.reserve({\n            tenantId: scope.tenantId,\n            organizationId: scope.organizationId,\n            bytes: size ?? resolveAttachmentMaxBytes(),\n            source: 'storage_s3_signed',\n            storageDriver: 's3',\n            storagePath: key,\n            uploadTokenHash: createHash('sha256').update(compatibilityToken).digest('hex'),\n            ttlMs: expiresIn * 1000,\n          })\n          if (!quotaRecoveryScheduler) throw new Error('Storage quota recovery is unavailable.')\n          await quotaRecoveryScheduler({\n            reservationId: reservation.id,\n            tenantId: scope.tenantId!,\n            organizationId: scope.organizationId!,\n          }, Math.max(1_000, reservation.expiresAt.getTime() - Date.now()))\n          const url = `/api/storage-providers/s3/signed-upload/${compatibilityToken}`\n          return { url, expiresAt, reservationId: reservation.id }\n        } catch (error) {\n          if (reservation) {\n            await quotaService.release(reservation.id, reservation.leaseToken).catch(() => {})\n          }\n          throw error\n        }\n      }\n      const url = await driver.getSignedUrl(key, operation, expiresIn, contentType, scope)\n      return { url, expiresAt }\n    },\n\n    async list({ prefix, maxKeys = 100, continuationToken, scope }): Promise<{\n      files: Array<{ key: string; size: number; lastModified: Date }>\n      truncated: boolean\n      nextContinuationToken?: string\n    }> {\n      assertS3ListPrefixScopedToTenant(prefix, scope, pathPrefix)\n      return driver.listObjects(prefix, maxKeys, continuationToken, scope)\n    },\n\n    async toLocalPath({ key, scope }) {\n      assertS3KeyAddressableByTenantScope(key, scope, pathPrefix)\n      return driver.toLocalPath('', key)\n    },\n  }\n}\n"],
-  "mappings": "AAAA,SAAS,YAAY,mBAAmB;AACxC,SAAS,uBAAuB;AAEhC,SAAS,iCAAiC;AAC1C,SAAS,gCAAgC;AACzC;AAAA,EACE;AAAA,EACA;AAAA,EACA;AAAA,OACK;AA4DP,SAAS,gBAAgB,OAAuB;AAC9C,SAAO,MAAM,QAAQ,oBAAoB,GAAG;AAC9C;AAeO,SAAS,qBAAqB,QAAkC;AACrE,QAAM,SAAS,IAAI,gBAAgB,MAAiC;AACpE,QAAM,eAAe,OAAO;AAC5B,QAAM,yBAAyB,OAAO;AACtC,QAAM,aAAa,OAAO;AAE1B,SAAO;AAAA,IACL,MAAM,OAAO,EAAE,WAAW,UAAU,QAAQ,aAAa,MAAM,GAA2B;AACxF,YAAM,cAAc,OAAO,mBAAmB;AAAA,QAC5C,eAAe,gBAAgB,SAAS;AAAA,QACxC,OAAO,MAAM;AAAA,QACb,UAAU,MAAM;AAAA,QAChB;AAAA,MACF,CAAC;AACD,gCAA0B,aAAa,OAAO,UAAU;AACxD,UAAI,cAAc;AAClB,UAAI,iBAAiB;AACrB,UAAI,eAAe;AACnB,UAAI;AACF,YAAI,gBAAgB,MAAM,YAAY,MAAM,gBAAgB;AAC1D,gBAAM,yBAAyB;AAAA,YAC7B;AAAA,YACA;AAAA,YACA,UAAU,MAAM;AAAA,YAChB,gBAAgB,MAAM;AAAA,UACxB,CAAC;AACD,wBAAc,MAAM,aAAa,QAAQ;AAAA,YACvC,UAAU,MAAM;AAAA,YAChB,gBAAgB,MAAM;AAAA,YACtB,OAAO,OAAO;AAAA,YACd,QAAQ;AAAA,YACR,eAAe;AAAA,YACf;AAAA,YACA,eAAe;AAAA,UACjB,CAAC;AAAA,QACH;AACA,YAAI,aAAa;AACf,cAAI,CAAC,uBAAwB,OAAM,IAAI,MAAM,wCAAwC;AACrF,gBAAM;AAAA,YAAuB;AAAA,cAC3B,eAAe,YAAY;AAAA,cAC3B,UAAU,MAAM;AAAA,cAChB,gBAAgB,MAAM;AAAA,YACxB;AAAA,YACE,KAAK,IAAI,KAAO,YAAY,UAAU,QAAQ,IAAI,KAAK,IAAI,CAAC;AAAA,UAC9D;AACA,gBAAM,aAAc,aAAa,YAAY,IAAI,YAAY,UAAU;AACvE,2BAAiB;AAAA,QACnB;AACA,cAAM,SAAS,MAAM,OAAO,MAAM;AAAA,UAChC,eAAe;AAAA,UACf,OAAO,MAAM;AAAA,UACb,UAAU,MAAM;AAAA,UAChB;AAAA,UACA;AAAA,UACA;AAAA,QACF,CAAC;AACD,uBAAe;AACf,YAAI,aAAa;AACf,gBAAM,aAAc,WAAW,YAAY,IAAI,YAAY,UAAU;AACrE,gBAAM,aAAc,mBAAmB,YAAY,IAAI,YAAY,YAAY,OAAO,MAAM;AAAA,QAC9F;AACA,eAAO;AAAA,UACL,KAAK,OAAO;AAAA,UACZ;AAAA,UACA;AAAA,UACA,MAAM,OAAO;AAAA,UACb;AAAA,QACF;AAAA,MACF,SAAS,OAAO;AACd,YAAI,aAAa;AACf,cAAI,cAAc;AAChB,gBAAI;AACF,oBAAM,OAAO,aAAa,IAAI,WAAW;AACzC,oBAAM,aAAc,QAAQ,YAAY,IAAI,YAAY,UAAU;AAAA,YACpE,QAAQ;AAAA,YAER;AAAA,UACF,WAAW,CAAC,gBAAgB;AAC1B,kBAAM,aAAc,QAAQ,YAAY,IAAI,YAAY,UAAU,EAAE,MAAM,MAAM;AAAA,YAAC,CAAC;AAAA,UACpF;AAAA,QACF;AACA,cAAM;AAAA,MACR;AAAA,IACF;AAAA,IAEA,MAAM,SAAS,EAAE,KAAK,MAAM,GAAsD;AAChF,0CAAoC,KAAK,OAAO,UAAU;AAC1D,aAAO,OAAO,KAAK,IAAI,GAAG;AAAA,IAC5B;AAAA,IAEA,MAAM,OAAO,EAAE,KAAK,MAAM,GAAkB;AAC1C,0CAAoC,KAAK,OAAO,UAAU;AAC1D,aAAO,OAAO,aAAa,IAAI,GAAG,EAC/B,KAAK,YAAY;AAChB,YAAI,gBAAgB,MAAM,UAAU;AAClC,gBAAM,aAAa,uBAAuB;AAAA,YACxC,UAAU,MAAM;AAAA,YAChB,eAAe;AAAA,YACf,aAAa;AAAA,UACf,CAAC;AAAA,QACH;AAAA,MACF,CAAC;AAAA,IACL;AAAA,IAEA,MAAM,aAAa,EAAE,KAAK,WAAW,YAAY,MAAM,aAAa,MAAM,MAAM,GAAG;AACjF,UAAI,cAAc,UAAU;AAC1B,kCAA0B,KAAK,OAAO,UAAU;AAAA,MAClD,OAAO;AACL,4CAAoC,KAAK,OAAO,UAAU;AAAA,MAC5D;AACA,YAAM,YAAY,IAAI,KAAK,KAAK,IAAI,IAAI,YAAY,GAAI;AACxD,UAAI,cAAc,YAAY,gBAAgB,MAAM,YAAY,MAAM,gBAAgB;AACpF,cAAM,qBAAqB,YAAY,EAAE,EAAE,SAAS,WAAW;AAC/D,YAAI,cAA6E;AACjF,YAAI;AACF,gBAAM,yBAAyB;AAAA,YAC7B;AAAA,YACA;AAAA,YACA,UAAU,MAAM;AAAA,YAChB,gBAAgB,MAAM;AAAA,UACxB,CAAC;AACD,wBAAc,MAAM,aAAa,QAAQ;AAAA,YACvC,UAAU,MAAM;AAAA,YAChB,gBAAgB,MAAM;AAAA,YACtB,OAAO,QAAQ,0BAA0B;AAAA,YACzC,QAAQ;AAAA,YACR,eAAe;AAAA,YACf,aAAa;AAAA,YACb,iBAAiB,WAAW,QAAQ,EAAE,OAAO,kBAAkB,EAAE,OAAO,KAAK;AAAA,YAC7E,OAAO,YAAY;AAAA,UACrB,CAAC;AACD,cAAI,CAAC,uBAAwB,OAAM,IAAI,MAAM,wCAAwC;AACrF,gBAAM,uBAAuB;AAAA,YAC3B,eAAe,YAAY;AAAA,YAC3B,UAAU,MAAM;AAAA,YAChB,gBAAgB,MAAM;AAAA,UACxB,GAAG,KAAK,IAAI,KAAO,YAAY,UAAU,QAAQ,IAAI,KAAK,IAAI,CAAC,CAAC;AAChE,gBAAMA,OAAM,2CAA2C,kBAAkB;AACzE,iBAAO,EAAE,KAAAA,MAAK,WAAW,eAAe,YAAY,GAAG;AAAA,QACzD,SAAS,OAAO;AACd,cAAI,aAAa;AACf,kBAAM,aAAa,QAAQ,YAAY,IAAI,YAAY,UAAU,EAAE,MAAM,MAAM;AAAA,YAAC,CAAC;AAAA,UACnF;AACA,gBAAM;AAAA,QACR;AAAA,MACF;AACA,YAAM,MAAM,MAAM,OAAO,aAAa,KAAK,WAAW,WAAW,aAAa,KAAK;AACnF,aAAO,EAAE,KAAK,UAAU;AAAA,IAC1B;AAAA,IAEA,MAAM,KAAK,EAAE,QAAQ,UAAU,KAAK,mBAAmB,MAAM,GAI1D;AACD,uCAAiC,QAAQ,OAAO,UAAU;AAC1D,aAAO,OAAO,YAAY,QAAQ,SAAS,mBAAmB,KAAK;AAAA,IACrE;AAAA,IAEA,MAAM,YAAY,EAAE,KAAK,MAAM,GAAG;AAChC,0CAAoC,KAAK,OAAO,UAAU;AAC1D,aAAO,OAAO,YAAY,IAAI,GAAG;AAAA,IACnC;AAAA,EACF;AACF;",
-  "names": ["url"]
+  "sourcesContent": ["import { randomUUID } from 'crypto'\nimport { S3StorageDriver } from './s3-driver'\nimport {\n  assertS3KeyAddressableByTenantScope,\n  assertS3KeyScopedToTenant,\n  assertS3ListPrefixScopedToTenant,\n} from './key-scope'\n\ntype TenantScope = {\n  tenantId: string | null | undefined\n  organizationId: string | null | undefined\n}\n\ntype UploadInput = {\n  namespace: string\n  fileName: string\n  buffer: Buffer\n  contentType?: string\n  scope: TenantScope\n}\n\ntype StorageResult = {\n  key: string\n  namespace: string\n  fileName: string\n  size: number\n  contentType?: string\n}\n\ntype DownloadInput = { key: string; scope: TenantScope }\ntype DeleteInput = { key: string; scope: TenantScope }\ntype SignedUrlInput = {\n  key: string\n  operation: 'upload' | 'download'\n  expiresIn?: number\n  contentType?: string\n  scope: TenantScope\n}\ntype ListInput = {\n  prefix: string\n  maxKeys?: number\n  continuationToken?: string\n  scope: TenantScope\n}\n\ntype S3Config = {\n  bucket: string\n  region?: string\n  endpoint?: string\n  forcePathStyle?: boolean\n  authMode?: 'access_keys' | 'ambient'\n  credentialsEnvPrefix?: string\n  accessKeyId?: string\n  secretAccessKey?: string\n  sessionToken?: string\n  pathPrefix?: string\n  organizationId?: string | null\n  tenantId?: string | null\n}\n\nfunction sanitizeSegment(value: string): string {\n  return value.replace(/[^a-zA-Z0-9._-]/g, '_')\n}\n\nfunction buildKey(namespace: string, scope: TenantScope, fileName: string): string {\n  const orgSeg = scope.organizationId ? `org_${scope.organizationId}` : 'org_shared'\n  const tenantSeg = scope.tenantId ? `tenant_${scope.tenantId}` : 'tenant_shared'\n  const uniqueSuffix = randomUUID().replace(/-/g, '').slice(0, 12)\n  const safeName = sanitizeSegment(fileName || 'file')\n  return `${sanitizeSegment(namespace)}/${orgSeg}/${tenantSeg}/${Date.now()}_${uniqueSuffix}_${safeName}`\n}\n\nexport interface StorageService {\n  upload(input: UploadInput): Promise<StorageResult>\n  download(input: DownloadInput): Promise<{ buffer: Buffer; contentType?: string }>\n  delete(input: DeleteInput): Promise<void>\n  getSignedUrl(input: SignedUrlInput): Promise<{ url: string; expiresAt: Date }>\n  list(input: ListInput): Promise<{\n    files: Array<{ key: string; size: number; lastModified: Date }>\n    truncated: boolean\n    nextContinuationToken?: string\n  }>\n  toLocalPath(input: { key: string; scope: TenantScope }): Promise<{ filePath: string; cleanup: () => Promise<void> }>\n}\n\nexport function createStorageService(config: S3Config): StorageService {\n  const driver = new S3StorageDriver(config as Record<string, unknown>)\n  const pathPrefix = config.pathPrefix\n\n  return {\n    async upload({ namespace, fileName, buffer, contentType, scope }): Promise<StorageResult> {\n      const stored = await driver.store({\n        partitionCode: namespace,\n        orgId: scope.organizationId,\n        tenantId: scope.tenantId,\n        fileName,\n        buffer,\n      })\n      return {\n        key: stored.storagePath,\n        namespace,\n        fileName,\n        size: buffer.length,\n        contentType,\n      }\n    },\n\n    async download({ key, scope }): Promise<{ buffer: Buffer; contentType?: string }> {\n      assertS3KeyAddressableByTenantScope(key, scope, pathPrefix)\n      return driver.read('', key)\n    },\n\n    async delete({ key, scope }): Promise<void> {\n      assertS3KeyAddressableByTenantScope(key, scope, pathPrefix)\n      return driver.delete('', key)\n    },\n\n    async getSignedUrl({ key, operation, expiresIn = 3600, contentType, scope }): Promise<{ url: string; expiresAt: Date }> {\n      if (operation === 'upload') {\n        assertS3KeyScopedToTenant(key, scope, pathPrefix)\n      } else {\n        assertS3KeyAddressableByTenantScope(key, scope, pathPrefix)\n      }\n      const url = await driver.getSignedUrl(key, operation, expiresIn, contentType, scope)\n      return { url, expiresAt: new Date(Date.now() + expiresIn * 1000) }\n    },\n\n    async list({ prefix, maxKeys = 100, continuationToken, scope }): Promise<{\n      files: Array<{ key: string; size: number; lastModified: Date }>\n      truncated: boolean\n      nextContinuationToken?: string\n    }> {\n      assertS3ListPrefixScopedToTenant(prefix, scope, pathPrefix)\n      return driver.listObjects(prefix, maxKeys, continuationToken, scope)\n    },\n\n    async toLocalPath({ key, scope }) {\n      assertS3KeyAddressableByTenantScope(key, scope, pathPrefix)\n      return driver.toLocalPath('', key)\n    },\n  }\n}\n"],
+  "mappings": "AAAA,SAAS,kBAAkB;AAC3B,SAAS,uBAAuB;AAChC;AAAA,EACE;AAAA,EACA;AAAA,EACA;AAAA,OACK;AAsDP,SAAS,gBAAgB,OAAuB;AAC9C,SAAO,MAAM,QAAQ,oBAAoB,GAAG;AAC9C;AAEA,SAAS,SAAS,WAAmB,OAAoB,UAA0B;AACjF,QAAM,SAAS,MAAM,iBAAiB,OAAO,MAAM,cAAc,KAAK;AACtE,QAAM,YAAY,MAAM,WAAW,UAAU,MAAM,QAAQ,KAAK;AAChE,QAAM,eAAe,WAAW,EAAE,QAAQ,MAAM,EAAE,EAAE,MAAM,GAAG,EAAE;AAC/D,QAAM,WAAW,gBAAgB,YAAY,MAAM;AACnD,SAAO,GAAG,gBAAgB,SAAS,CAAC,IAAI,MAAM,IAAI,SAAS,IAAI,KAAK,IAAI,CAAC,IAAI,YAAY,IAAI,QAAQ;AACvG;AAeO,SAAS,qBAAqB,QAAkC;AACrE,QAAM,SAAS,IAAI,gBAAgB,MAAiC;AACpE,QAAM,aAAa,OAAO;AAE1B,SAAO;AAAA,IACL,MAAM,OAAO,EAAE,WAAW,UAAU,QAAQ,aAAa,MAAM,GAA2B;AACxF,YAAM,SAAS,MAAM,OAAO,MAAM;AAAA,QAChC,eAAe;AAAA,QACf,OAAO,MAAM;AAAA,QACb,UAAU,MAAM;AAAA,QAChB;AAAA,QACA;AAAA,MACF,CAAC;AACD,aAAO;AAAA,QACL,KAAK,OAAO;AAAA,QACZ;AAAA,QACA;AAAA,QACA,MAAM,OAAO;AAAA,QACb;AAAA,MACF;AAAA,IACF;AAAA,IAEA,MAAM,SAAS,EAAE,KAAK,MAAM,GAAsD;AAChF,0CAAoC,KAAK,OAAO,UAAU;AAC1D,aAAO,OAAO,KAAK,IAAI,GAAG;AAAA,IAC5B;AAAA,IAEA,MAAM,OAAO,EAAE,KAAK,MAAM,GAAkB;AAC1C,0CAAoC,KAAK,OAAO,UAAU;AAC1D,aAAO,OAAO,OAAO,IAAI,GAAG;AAAA,IAC9B;AAAA,IAEA,MAAM,aAAa,EAAE,KAAK,WAAW,YAAY,MAAM,aAAa,MAAM,GAA8C;AACtH,UAAI,cAAc,UAAU;AAC1B,kCAA0B,KAAK,OAAO,UAAU;AAAA,MAClD,OAAO;AACL,4CAAoC,KAAK,OAAO,UAAU;AAAA,MAC5D;AACA,YAAM,MAAM,MAAM,OAAO,aAAa,KAAK,WAAW,WAAW,aAAa,KAAK;AACnF,aAAO,EAAE,KAAK,WAAW,IAAI,KAAK,KAAK,IAAI,IAAI,YAAY,GAAI,EAAE;AAAA,IACnE;AAAA,IAEA,MAAM,KAAK,EAAE,QAAQ,UAAU,KAAK,mBAAmB,MAAM,GAI1D;AACD,uCAAiC,QAAQ,OAAO,UAAU;AAC1D,aAAO,OAAO,YAAY,QAAQ,SAAS,mBAAmB,KAAK;AAAA,IACrE;AAAA,IAEA,MAAM,YAAY,EAAE,KAAK,MAAM,GAAG;AAChC,0CAAoC,KAAK,OAAO,UAAU;AAC1D,aAAO,OAAO,YAAY,IAAI,GAAG;AAAA,IACnC;AAAA,EACF;AACF;",
+  "names": []
 }

package/jest.config.cjs

@@ -9,7 +9,6 @@ module.exports = {
   moduleFileExtensions: ['ts', 'tsx', 'js', 'jsx', 'json'],
   moduleNameMapper: {
     '^@open-mercato/core/(.*)$': '<rootDir>/../core/src/$1',
-    '^@open-mercato/queue$': '<rootDir>/../queue/src/index.ts',
     '^@open-mercato/shared/(.*)$': '<rootDir>/../shared/src/$1',
   },
   transform: {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@open-mercato/storage-s3",
-  "version": "0.6.7-develop.6860.1.f796b22e80",
+  "version": "0.6.7",
   "license": "MIT",
   "type": "module",
   "main": "./dist/index.js",
@@ -16,7 +16,6 @@
       "types": "./src/*.ts",
       "default": "./dist/*.js"
     },
-    "./*.json": "./src/*.json",
     "./*": {
       "types": [
         "./src/*.ts",
@@ -24,7 +23,6 @@
       ],
       "default": "./dist/*.js"
     },
-    "./*/*.json": "./src/*/*.json",
     "./*/*": {
       "types": [
         "./src/*/*.ts",
@@ -32,7 +30,6 @@
       ],
       "default": "./dist/*/*.js"
     },
-    "./*/*/*.json": "./src/*/*/*.json",
     "./*/*/*": {
       "types": [
         "./src/*/*/*.ts",
@@ -40,7 +37,6 @@
       ],
       "default": "./dist/*/*/*.js"
     },
-    "./*/*/*/*.json": "./src/*/*/*/*.json",
     "./*/*/*/*": {
       "types": [
         "./src/*/*/*/*.ts",
@@ -48,7 +44,6 @@
       ],
       "default": "./dist/*/*/*/*.js"
     },
-    "./*/*/*/*/*.json": "./src/*/*/*/*/*.json",
     "./*/*/*/*/*": {
       "types": [
         "./src/*/*/*/*/*.ts",
@@ -74,20 +69,19 @@
   "dependencies": {
     "@aws-sdk/client-s3": "^3.1085.0",
     "@aws-sdk/s3-request-presigner": "^3.1085.0",
-    "@open-mercato/core": "0.6.7-develop.6860.1.f796b22e80",
-    "@open-mercato/queue": "0.6.7-develop.6860.1.f796b22e80"
+    "@open-mercato/core": "0.6.7"
   },
   "peerDependencies": {
     "@mikro-orm/postgresql": "^6.6.10",
-    "@open-mercato/shared": "0.6.7-develop.6860.1.f796b22e80"
+    "@open-mercato/shared": "0.6.7"
   },
   "devDependencies": {
-    "@open-mercato/shared": "0.6.7-develop.6860.1.f796b22e80",
+    "@open-mercato/shared": "0.6.7",
     "@types/jest": "^30.0.0",
     "esbuild": "^0.28.1",
     "glob": "^13.0.6",
     "jest": "^30.4.2",
-    "ts-jest": "^29.4.12",
+    "ts-jest": "^29.4.11",
     "typescript": "7.0.2"
   },
   "publishConfig": {
@@ -97,6 +91,5 @@
     "type": "git",
     "url": "https://github.com/open-mercato/open-mercato",
     "directory": "packages/storage-s3"
-  },
-  "stableVersion": "0.6.6"
+  }
 }

package/src/modules/storage_s3/__tests__/s3Driver.test.ts

@@ -99,10 +99,6 @@ describe('S3StorageDriver', () => {
       new S3StorageDriver(BASE_CONFIG)
       const [[arg]] = (S3Client as jest.Mock).mock.calls
       expect(arg.credentials).toBeUndefined()
-      expect(arg.requestHandler).toEqual(expect.objectContaining({
-        connectionTimeout: 10_000,
-        requestTimeout: 120_000,
-      }))
     })
 
     it('applies forcePathStyle and custom endpoint', () => {
@@ -111,17 +107,6 @@ describe('S3StorageDriver', () => {
       expect(arg.endpoint).toBe('http://minio:9000')
       expect(arg.forcePathStyle).toBe(true)
     })
-
-    it('rejects link-local custom endpoints before constructing an S3 client', () => {
-      expect(() => {
-        new S3StorageDriver({
-          ...BASE_CONFIG,
-          endpoint: 'http://169.254.169.254/latest/meta-data/',
-          forcePathStyle: true,
-        })
-      }).toThrow(/private or reserved IP range/i)
-      expect(S3Client).not.toHaveBeenCalled()
-    })
   })
 
   describe('store()', () => {
@@ -213,7 +198,7 @@ describe('S3StorageDriver', () => {
 
       await expect(
         driver.read('', 'docs/org_org-victim/tenant_tenant-owned/secret.txt'),
-      ).rejects.toThrow('[internal] S3 key is not scoped to the active tenant')
+      ).rejects.toThrow('S3 key is not scoped to the active tenant')
 
       expect(mockSend).not.toHaveBeenCalled()
     })
@@ -244,7 +229,7 @@ describe('S3StorageDriver', () => {
 
       await expect(
         driver.read('docs', 'exports/org_o/tenant_t/file.txt'),
-      ).rejects.toThrow('[internal] S3 key is not scoped to the requested partition')
+      ).rejects.toThrow('S3 key is not scoped to the requested partition')
 
       expect(mockSend).not.toHaveBeenCalled()
     })
@@ -258,7 +243,7 @@ describe('S3StorageDriver', () => {
 
       await expect(
         driver.read('', 'docs/org_org-victim/tenant_tenant-owned/org_org-owned/tenant_tenant-owned/private.txt'),
-      ).rejects.toThrow('[internal] S3 key is not scoped to the active tenant')
+      ).rejects.toThrow('S3 key is not scoped to the active tenant')
 
       expect(mockSend).not.toHaveBeenCalled()
     })
@@ -274,7 +259,7 @@ describe('S3StorageDriver', () => {
 
       await expect(
         driver.putObject('docs/org_org-victim/tenant_tenant-owned/file.txt', Buffer.from('secret')),
-      ).rejects.toThrow('[internal] S3 key is not scoped to the active tenant')
+      ).rejects.toThrow('S3 key is not scoped to the active tenant')
 
       expect(mockSend).not.toHaveBeenCalled()
     })
@@ -306,7 +291,7 @@ describe('S3StorageDriver', () => {
 
       await expect(
         driver.delete('', 'docs/org_org-owned/tenant_tenant-victim/file.txt'),
-      ).rejects.toThrow('[internal] S3 key is not scoped to the active tenant')
+      ).rejects.toThrow('S3 key is not scoped to the active tenant')
 
       expect(mockSend).not.toHaveBeenCalled()
     })
@@ -329,7 +314,7 @@ describe('S3StorageDriver', () => {
 
       await expect(
         driver.delete('docs', 'exports/org_o/tenant_t/file.txt'),
-      ).rejects.toThrow('[internal] S3 key is not scoped to the requested partition')
+      ).rejects.toThrow('S3 key is not scoped to the requested partition')
 
       expect(mockSend).not.toHaveBeenCalled()
     })
@@ -409,7 +394,7 @@ describe('S3StorageDriver', () => {
 
       await expect(
         driver.getSignedUrl('docs/org_org-victim/tenant_tenant-owned/file.pdf', 'download'),
-      ).rejects.toThrow('[internal] S3 key is not scoped to the active tenant')
+      ).rejects.toThrow('S3 key is not scoped to the active tenant')
 
       expect(mockGetSignedUrl).not.toHaveBeenCalled()
     })
@@ -435,7 +420,7 @@ describe('S3StorageDriver', () => {
 
       await expect(
         driver.getSignedUrl('docs/org_shared/tenant_shared/shared.pdf', 'upload'),
-      ).rejects.toThrow('[internal] S3 key is not scoped to the active tenant')
+      ).rejects.toThrow('S3 key is not scoped to the active tenant')
 
       expect(mockGetSignedUrl).not.toHaveBeenCalled()
     })

package/src/modules/storage_s3/__tests__/s3ListRoute.test.ts

@@ -9,12 +9,6 @@ jest.mock('@open-mercato/shared/lib/auth/server', () => ({
   getAuthFromRequest: async () => ({ tenantId, orgId, sub: null }),
 }))
 
-jest.mock('@open-mercato/shared/lib/i18n/server', () => ({
-  resolveTranslations: async () => ({
-    t: (key: string) => `translated:${key}`,
-  }),
-}))
-
 jest.mock('@open-mercato/shared/lib/di/container', () => ({
   createRequestContainer: async () => ({
     resolve: (token: string) => {
@@ -75,7 +69,7 @@ describe('storage_s3 list route tenant scoping', () => {
 
     expect(response.status).toBe(403)
     await expect(response.json()).resolves.toEqual({
-      error: 'translated:storage_s3.errors.prefixAccessDenied',
+      error: 'Access denied: prefix is not scoped to this tenant.',
     })
     expect(listObjectsMock).not.toHaveBeenCalled()
   })

package/src/modules/storage_s3/__tests__/s3Routes.test.ts

@@ -5,12 +5,6 @@ jest.mock('@open-mercato/shared/lib/auth/server', () => ({
   getAuthFromRequest: (...args: unknown[]) => mockGetAuthFromRequest(...args),
 }))
 
-jest.mock('@open-mercato/shared/lib/i18n/server', () => ({
-  resolveTranslations: async () => ({
-    t: (key: string) => `translated:${key}`,
-  }),
-}))
-
 const mockResolveCredentials = jest.fn()
 jest.mock('@open-mercato/shared/lib/di/container', () => ({
   createRequestContainer: jest.fn(async () => ({
@@ -99,26 +93,9 @@ describe('storage_s3 standalone route key scope', () => {
     }))
 
     expect(response.status).toBe(403)
-    await expect(response.json()).resolves.toEqual({
-      error: 'translated:storage_s3.errors.keyAccessDenied',
-    })
     expect(mockGetSignedUrl).not.toHaveBeenCalled()
   })
 
-  it('localizes invalid delete payload errors', async () => {
-    const response = await DELETE(new Request('http://example.test/api/storage-providers/s3/delete', {
-      method: 'DELETE',
-      headers: { 'content-type': 'application/json' },
-      body: JSON.stringify({}),
-    }))
-
-    expect(response.status).toBe(400)
-    await expect(response.json()).resolves.toEqual({
-      error: 'translated:storage_s3.errors.invalidPayload',
-    })
-    expect(mockDelete).not.toHaveBeenCalled()
-  })
-
   it('deletes shared namespace objects for an authorized storage manager', async () => {
     mockDelete.mockResolvedValueOnce(undefined)
 
@@ -139,9 +116,6 @@ describe('storage_s3 standalone route key scope', () => {
       )
 
       expect(response.status).toBe(403)
-      await expect(response.json()).resolves.toEqual({
-        error: 'translated:storage_s3.errors.keyAccessDenied',
-      })
     }
     expect(mockRead).not.toHaveBeenCalled()
   })

package/src/modules/storage_s3/__tests__/storageService.test.ts

@@ -27,21 +27,6 @@ beforeEach(() => {
 })
 
 describe('createStorageService', () => {
-  it('preserves the configured path prefix for programmatic uploads', async () => {
-    mockSend.mockResolvedValueOnce({})
-    const service = createStorageService({ ...BASE_CONFIG, pathPrefix: 'backups/' })
-
-    const result = await service.upload({
-      namespace: 'docs',
-      fileName: 'report.pdf',
-      buffer: Buffer.from('pdf'),
-      scope: TENANT_SCOPE,
-    })
-
-    expect(result.key).toMatch(/^backups\/docs\/org_org-owned\/tenant_tenant-owned\//)
-    expect(mockSend.mock.calls[0]?.[0]?.Key).toBe(result.key)
-  })
-
   it('rejects cross-tenant downloads before calling S3', async () => {
     const service = createStorageService(BASE_CONFIG)
 
@@ -50,7 +35,7 @@ describe('createStorageService', () => {
         key: 'docs/org_org-victim/tenant_tenant-owned/file.txt',
         scope: TENANT_SCOPE,
       }),
-    ).rejects.toThrow('[internal] S3 key is not scoped to the active tenant')
+    ).rejects.toThrow('S3 key is not scoped to the active tenant')
 
     expect(mockSend).not.toHaveBeenCalled()
   })
@@ -85,7 +70,7 @@ describe('createStorageService', () => {
         key: 'docs/org_org-victim/tenant_tenant-owned/file.txt',
         scope: TENANT_SCOPE,
       }),
-    ).rejects.toThrow('[internal] S3 key is not scoped to the active tenant')
+    ).rejects.toThrow('S3 key is not scoped to the active tenant')
 
     expect(mockSend).not.toHaveBeenCalled()
   })
@@ -98,7 +83,7 @@ describe('createStorageService', () => {
         key: 'docs/org_org-owned/tenant_tenant-victim/file.txt',
         scope: TENANT_SCOPE,
       }),
-    ).rejects.toThrow('[internal] S3 key is not scoped to the active tenant')
+    ).rejects.toThrow('S3 key is not scoped to the active tenant')
 
     expect(mockSend).not.toHaveBeenCalled()
   })
@@ -112,7 +97,7 @@ describe('createStorageService', () => {
         operation: 'download',
         scope: TENANT_SCOPE,
       }),
-    ).rejects.toThrow('[internal] S3 key is not scoped to the active tenant')
+    ).rejects.toThrow('S3 key is not scoped to the active tenant')
 
     expect(mockGetSignedUrl).not.toHaveBeenCalled()
   })
@@ -126,7 +111,7 @@ describe('createStorageService', () => {
         operation: 'upload',
         scope: TENANT_SCOPE,
       }),
-    ).rejects.toThrow('[internal] S3 key is not scoped to the active tenant')
+    ).rejects.toThrow('S3 key is not scoped to the active tenant')
 
     expect(mockGetSignedUrl).not.toHaveBeenCalled()
   })

package/src/modules/storage_s3/api/delete/storage-providers/s3/delete.ts

@@ -3,10 +3,8 @@ import { z } from 'zod'
 import type { OpenApiRouteDoc } from '@open-mercato/shared/lib/openapi'
 import { getAuthFromRequest } from '@open-mercato/shared/lib/auth/server'
 import { createRequestContainer } from '@open-mercato/shared/lib/di/container'
-import { resolveTranslations } from '@open-mercato/shared/lib/i18n/server'
 import { isS3KeyAddressableByScope } from '../../../../lib/key-scope'
 import { S3StorageDriver } from '../../../../lib/s3-driver'
-import type { AttachmentQuotaService } from '@open-mercato/core/modules/attachments/lib/quota-service'
 
 export const metadata = {
   path: '/storage-providers/s3/delete',
@@ -28,42 +26,27 @@ async function resolveDriver(tenantId: string, orgId: string): Promise<S3Storage
 }
 
 export async function DELETE(req: Request) {
-  const { t } = await resolveTranslations()
   const auth = await getAuthFromRequest(req)
   if (!auth?.tenantId || !auth.orgId) {
-    return NextResponse.json({ error: t('storage_s3.errors.unauthorized', 'Unauthorized') }, { status: 401 })
+    return NextResponse.json({ error: 'Unauthorized' }, { status: 401 })
   }
 
   const json = await req.json().catch(() => null)
   const parsed = requestSchema.safeParse(json)
   if (!parsed.success) {
-    return NextResponse.json({ error: t('storage_s3.errors.invalidPayload', 'Invalid payload') }, { status: 400 })
+    return NextResponse.json({ error: 'Invalid payload' }, { status: 400 })
   }
 
   if (!isS3KeyAddressableByScope(parsed.data.key, auth.orgId, auth.tenantId)) {
-    return NextResponse.json({ error: t('storage_s3.errors.keyAccessDenied', 'Access denied: key is not scoped to this tenant.') }, { status: 403 })
+    return NextResponse.json({ error: 'Access denied: key is not scoped to this tenant.' }, { status: 403 })
   }
 
   const driver = await resolveDriver(auth.tenantId, auth.orgId)
   if (!driver) {
-    return NextResponse.json({ error: t('storage_s3.errors.integrationNotConfigured', 'S3 integration is not configured.') }, { status: 400 })
+    return NextResponse.json({ error: 'S3 integration is not configured.' }, { status: 400 })
   }
 
-  await (driver.deleteStrict?.('', parsed.data.key) ?? driver.delete('', parsed.data.key))
-  const { resolve } = await createRequestContainer()
-  let attachmentQuotaService: AttachmentQuotaService | null = null
-  try {
-    attachmentQuotaService = resolve('attachmentQuotaService') as AttachmentQuotaService | null
-  } catch {
-    // Backward-compatible when the attachments quota service is not registered.
-  }
-  if (attachmentQuotaService) {
-    await attachmentQuotaService.releaseCommittedByPath({
-      tenantId: auth.tenantId,
-      storageDriver: 's3',
-      storagePath: parsed.data.key,
-    })
-  }
+  await driver.delete('', parsed.data.key)
   return new NextResponse(null, { status: 204 })
 }