@open-mercato/storage-s3 0.6.7-develop.6860.1.f796b22e80 → 0.6.7

package/src/modules/storage_s3/lib/s3-driver.ts

@@ -10,12 +10,7 @@ import {
   ListObjectsV2Command,
 } from '@aws-sdk/client-s3'
 import { getSignedUrl } from '@aws-sdk/s3-request-presigner'
-import type { PrepareFilePayload, StorageDriver, StoreFilePayload, StoredFile, ReadFileResult } from '@open-mercato/core/modules/attachments/lib/drivers'
-import {
-  assertSafeS3Endpoint,
-  assertStaticallySafeS3Endpoint,
-  createSafeS3RequestHandler,
-} from './endpoint-safety'
+import type { StorageDriver, StoreFilePayload, StoredFile, ReadFileResult } from '@open-mercato/core/modules/attachments/lib/drivers'
 import {
   assertS3KeyAddressableByTenantScope,
   assertS3KeyScopedToTenant,
@@ -76,14 +71,12 @@ export class S3StorageDriver implements StorageDriver {
   readonly key = 's3'
   private readonly client: S3Client
   private readonly bucket: string
-  private readonly endpoint?: string
   private readonly pathPrefix: string
   private readonly scope: S3TenantScope | null
 
   constructor(config: Record<string, unknown>) {
     const cfg = config as S3DriverConfig
     this.bucket = cfg.bucket
-    this.endpoint = cfg.endpoint
     this.pathPrefix = cfg.pathPrefix ?? ''
     this.scope = cfg.organizationId && cfg.tenantId
       ? { organizationId: cfg.organizationId, tenantId: cfg.tenantId }
@@ -116,15 +109,11 @@ export class S3StorageDriver implements StorageDriver {
       }
     }
 
-    assertStaticallySafeS3Endpoint(cfg.endpoint)
-    const requestHandler = createSafeS3RequestHandler(cfg.endpoint)
-
     this.client = new S3Client({
       region: cfg.region ?? 'us-east-1',
       endpoint: cfg.endpoint,
       forcePathStyle: cfg.forcePathStyle ?? false,
       credentials,
-      ...(requestHandler ? { requestHandler } : {}),
     })
   }
 
@@ -143,24 +132,17 @@ export class S3StorageDriver implements StorageDriver {
       : storagePath.replace(/^\/+/, '')
     const firstSegment = prefix.split('/').filter(Boolean)[0]
     if (firstSegment !== partitionCode) {
-      throw new Error('[internal] S3 key is not scoped to the requested partition')
+      throw new Error('S3 key is not scoped to the requested partition')
     }
   }
 
-  prepareStoragePath(payload: PrepareFilePayload): string {
+  async store(payload: StoreFilePayload): Promise<StoredFile> {
     const orgSegment = resolveOrgSegment(payload.orgId ?? null)
     const tenantSegment = resolveTenantSegment(payload.tenantId ?? null)
     const safeName = sanitizeFileName(payload.fileName || 'file')
     const uniqueSuffix = randomUUID().replace(/-/g, '').slice(0, 12)
     const storedName = `${Date.now()}_${uniqueSuffix}_${safeName}`
-    return `${this.pathPrefix}${payload.partitionCode}/${orgSegment}/${tenantSegment}/${storedName}`
-  }
-
-  async store(payload: StoreFilePayload): Promise<StoredFile> {
-    const key = payload.storagePath ?? this.prepareStoragePath(payload)
-    this.assertPartitionScoped(payload.partitionCode, key)
-    this.assertKeyScoped(key)
-    await this.assertEndpointSafe()
+    const key = `${this.pathPrefix}${payload.partitionCode}/${orgSegment}/${tenantSegment}/${storedName}`
 
     await this.client.send(
       new PutObjectCommand({
@@ -168,7 +150,6 @@ export class S3StorageDriver implements StorageDriver {
         Key: key,
         Body: payload.buffer,
         ContentLength: payload.buffer.length,
-        IfNoneMatch: '*',
       }),
     )
 
@@ -178,12 +159,11 @@ export class S3StorageDriver implements StorageDriver {
   async read(partitionCode: string, storagePath: string): Promise<ReadFileResult> {
     this.assertPartitionScoped(partitionCode, storagePath)
     this.assertKeyAddressable(storagePath)
-    await this.assertEndpointSafe()
     const response = await this.client.send(
       new GetObjectCommand({ Bucket: this.bucket, Key: storagePath }),
     )
     if (!response.Body) {
-      throw new Error(`[internal] S3 object body is empty for key: ${storagePath}`)
+      throw new Error(`S3 object body is empty for key: ${storagePath}`)
     }
     const buffer = await streamToBuffer(response.Body as NodeJS.ReadableStream)
     return { buffer, contentType: response.ContentType }
@@ -193,19 +173,14 @@ export class S3StorageDriver implements StorageDriver {
     this.assertPartitionScoped(partitionCode, storagePath)
     this.assertKeyAddressable(storagePath)
     try {
-      await this.deleteStrict(partitionCode, storagePath)
+      await this.client.send(
+        new DeleteObjectCommand({ Bucket: this.bucket, Key: storagePath }),
+      )
     } catch {
-      // Backward-compatible best-effort deletion.
+      // best-effort removal
     }
   }
 
-  async deleteStrict(partitionCode: string, storagePath: string): Promise<void> {
-    this.assertPartitionScoped(partitionCode, storagePath)
-    this.assertKeyAddressable(storagePath)
-    await this.assertEndpointSafe()
-    await this.client.send(new DeleteObjectCommand({ Bucket: this.bucket, Key: storagePath }))
-  }
-
   async toLocalPath(
     partitionCode: string,
     storagePath: string,
@@ -232,7 +207,6 @@ export class S3StorageDriver implements StorageDriver {
    */
   async putObject(key: string, buffer: Buffer, contentType?: string): Promise<void> {
     this.assertKeyScoped(key)
-    await this.assertEndpointSafe()
     await this.client.send(
       new PutObjectCommand({
         Bucket: this.bucket,
@@ -240,7 +214,6 @@ export class S3StorageDriver implements StorageDriver {
         Body: buffer,
         ContentType: contentType,
         ContentLength: buffer.length,
-        IfNoneMatch: '*',
       }),
     )
   }
@@ -261,7 +234,6 @@ export class S3StorageDriver implements StorageDriver {
   }> {
     const activeScope = scope ?? this.scope
     assertS3ListPrefixScopedToTenant(prefix, activeScope, this.pathPrefix)
-    await this.assertEndpointSafe()
     const response = await this.client.send(
       new ListObjectsV2Command({
         Bucket: this.bucket,
@@ -285,54 +257,27 @@ export class S3StorageDriver implements StorageDriver {
   /**
    * Generate a pre-signed URL for direct browser upload or download.
    */
-  async getSignedUrl(
-    storagePath: string,
-    operation: 'upload' | 'download',
-    expiresIn?: number,
-    contentType?: string,
-    contentLength?: number,
-    createOnly?: boolean,
-    scope?: S3TenantScope | null,
-  ): Promise<string>
-  async getSignedUrl(
-    storagePath: string,
-    operation: 'upload' | 'download',
-    expiresIn: number,
-    contentType: string | undefined,
-    scope?: S3TenantScope | null,
-  ): Promise<string>
   async getSignedUrl(
     storagePath: string,
     operation: 'upload' | 'download',
     expiresIn = 3600,
     contentType?: string,
-    contentLengthOrScope?: number | S3TenantScope | null,
-    createOnly = false,
-    explicitScope?: S3TenantScope | null,
+    scope?: S3TenantScope | null,
   ): Promise<string> {
-    const contentLength = typeof contentLengthOrScope === 'number' ? contentLengthOrScope : undefined
-    const scope = typeof contentLengthOrScope === 'number' ? explicitScope : contentLengthOrScope
     if (operation === 'upload') {
       this.assertKeyScoped(storagePath, scope)
     } else {
       this.assertKeyAddressable(storagePath, scope)
     }
-    await this.assertEndpointSafe()
     if (operation === 'upload') {
       const command = new PutObjectCommand({
         Bucket: this.bucket,
         Key: storagePath,
         ContentType: contentType,
-        ContentLength: contentLength,
-        ...(createOnly ? { IfNoneMatch: '*' } : {}),
       })
       return getSignedUrl(this.client, command, { expiresIn })
     }
     const command = new GetObjectCommand({ Bucket: this.bucket, Key: storagePath })
     return getSignedUrl(this.client, command, { expiresIn })
   }
-
-  private async assertEndpointSafe(): Promise<void> {
-    await assertSafeS3Endpoint(this.endpoint)
-  }
 }

package/src/modules/storage_s3/lib/storage-service.ts

@@ -1,8 +1,5 @@
-import { createHash, randomBytes } from 'crypto'
+import { randomUUID } from 'crypto'
 import { S3StorageDriver } from './s3-driver'
-import type { AttachmentQuotaService } from '@open-mercato/core/modules/attachments/lib/quota-service'
-import { resolveAttachmentMaxBytes } from '@open-mercato/core/modules/attachments/lib/upload-limits'
-import { reconcileTenantS3Objects } from './quota-accounting'
 import {
   assertS3KeyAddressableByTenantScope,
   assertS3KeyScopedToTenant,
@@ -37,7 +34,6 @@ type SignedUrlInput = {
   operation: 'upload' | 'download'
   expiresIn?: number
   contentType?: string
-  size?: number
   scope: TenantScope
 }
 type ListInput = {
@@ -57,11 +53,6 @@ type S3Config = {
   accessKeyId?: string
   secretAccessKey?: string
   sessionToken?: string
-  quotaService?: AttachmentQuotaService
-  quotaRecoveryScheduler?: (
-    payload: { reservationId: string; tenantId: string; organizationId: string },
-    delayMs: number,
-  ) => Promise<void>
   pathPrefix?: string
   organizationId?: string | null
   tenantId?: string | null
@@ -71,11 +62,19 @@ function sanitizeSegment(value: string): string {
   return value.replace(/[^a-zA-Z0-9._-]/g, '_')
 }
 
+function buildKey(namespace: string, scope: TenantScope, fileName: string): string {
+  const orgSeg = scope.organizationId ? `org_${scope.organizationId}` : 'org_shared'
+  const tenantSeg = scope.tenantId ? `tenant_${scope.tenantId}` : 'tenant_shared'
+  const uniqueSuffix = randomUUID().replace(/-/g, '').slice(0, 12)
+  const safeName = sanitizeSegment(fileName || 'file')
+  return `${sanitizeSegment(namespace)}/${orgSeg}/${tenantSeg}/${Date.now()}_${uniqueSuffix}_${safeName}`
+}
+
 export interface StorageService {
   upload(input: UploadInput): Promise<StorageResult>
   download(input: DownloadInput): Promise<{ buffer: Buffer; contentType?: string }>
   delete(input: DeleteInput): Promise<void>
-  getSignedUrl(input: SignedUrlInput): Promise<{ url: string; expiresAt: Date; reservationId?: string }>
+  getSignedUrl(input: SignedUrlInput): Promise<{ url: string; expiresAt: Date }>
   list(input: ListInput): Promise<{
     files: Array<{ key: string; size: number; lastModified: Date }>
     truncated: boolean
@@ -86,86 +85,23 @@ export interface StorageService {
 
 export function createStorageService(config: S3Config): StorageService {
   const driver = new S3StorageDriver(config as Record<string, unknown>)
-  const quotaService = config.quotaService
-  const quotaRecoveryScheduler = config.quotaRecoveryScheduler
   const pathPrefix = config.pathPrefix
 
   return {
     async upload({ namespace, fileName, buffer, contentType, scope }): Promise<StorageResult> {
-      const storagePath = driver.prepareStoragePath({
-        partitionCode: sanitizeSegment(namespace),
+      const stored = await driver.store({
+        partitionCode: namespace,
         orgId: scope.organizationId,
         tenantId: scope.tenantId,
         fileName,
+        buffer,
       })
-      assertS3KeyScopedToTenant(storagePath, scope, pathPrefix)
-      let reservation = null as Awaited<ReturnType<AttachmentQuotaService['reserve']>> | null
-      let storageStarted = false
-      let objectStored = false
-      try {
-        if (quotaService && scope.tenantId && scope.organizationId) {
-          await reconcileTenantS3Objects({
-            driver,
-            quotaService,
-            tenantId: scope.tenantId,
-            organizationId: scope.organizationId,
-          })
-          reservation = await quotaService.reserve({
-            tenantId: scope.tenantId,
-            organizationId: scope.organizationId,
-            bytes: buffer.length,
-            source: 'storage_service',
-            storageDriver: 's3',
-            storagePath,
-            partitionCode: namespace,
-          })
-        }
-        if (reservation) {
-          if (!quotaRecoveryScheduler) throw new Error('Storage quota recovery is unavailable.')
-          await quotaRecoveryScheduler({
-            reservationId: reservation.id,
-            tenantId: scope.tenantId!,
-            organizationId: scope.organizationId!,
-          },
-            Math.max(1_000, reservation.expiresAt.getTime() - Date.now()),
-          )
-          await quotaService!.beginStorage(reservation.id, reservation.leaseToken)
-          storageStarted = true
-        }
-        const stored = await driver.store({
-          partitionCode: namespace,
-          orgId: scope.organizationId,
-          tenantId: scope.tenantId,
-          fileName,
-          buffer,
-          storagePath,
-        })
-        objectStored = true
-        if (reservation) {
-          await quotaService!.markStored(reservation.id, reservation.leaseToken)
-          await quotaService!.completeStandalone(reservation.id, reservation.leaseToken, buffer.length)
-        }
-        return {
-          key: stored.storagePath,
-          namespace,
-          fileName,
-          size: buffer.length,
-          contentType,
-        }
-      } catch (error) {
-        if (reservation) {
-          if (objectStored) {
-            try {
-              await driver.deleteStrict('', storagePath)
-              await quotaService!.release(reservation.id, reservation.leaseToken)
-            } catch {
-              // Keep the reservation counted for recovery when absence is ambiguous.
-            }
-          } else if (!storageStarted) {
-            await quotaService!.release(reservation.id, reservation.leaseToken).catch(() => {})
-          }
-        }
-        throw error
+      return {
+        key: stored.storagePath,
+        namespace,
+        fileName,
+        size: buffer.length,
+        contentType,
       }
     },
 
@@ -176,62 +112,17 @@ export function createStorageService(config: S3Config): StorageService {
 
     async delete({ key, scope }): Promise<void> {
       assertS3KeyAddressableByTenantScope(key, scope, pathPrefix)
-      return driver.deleteStrict('', key)
-        .then(async () => {
-          if (quotaService && scope.tenantId) {
-            await quotaService.releaseCommittedByPath({
-              tenantId: scope.tenantId,
-              storageDriver: 's3',
-              storagePath: key,
-            })
-          }
-        })
+      return driver.delete('', key)
     },
 
-    async getSignedUrl({ key, operation, expiresIn = 3600, contentType, size, scope }) {
+    async getSignedUrl({ key, operation, expiresIn = 3600, contentType, scope }): Promise<{ url: string; expiresAt: Date }> {
       if (operation === 'upload') {
         assertS3KeyScopedToTenant(key, scope, pathPrefix)
       } else {
         assertS3KeyAddressableByTenantScope(key, scope, pathPrefix)
       }
-      const expiresAt = new Date(Date.now() + expiresIn * 1000)
-      if (operation === 'upload' && quotaService && scope.tenantId && scope.organizationId) {
-        const compatibilityToken = randomBytes(32).toString('base64url')
-        let reservation: Awaited<ReturnType<AttachmentQuotaService['reserve']>> | null = null
-        try {
-          await reconcileTenantS3Objects({
-            driver,
-            quotaService,
-            tenantId: scope.tenantId,
-            organizationId: scope.organizationId,
-          })
-          reservation = await quotaService.reserve({
-            tenantId: scope.tenantId,
-            organizationId: scope.organizationId,
-            bytes: size ?? resolveAttachmentMaxBytes(),
-            source: 'storage_s3_signed',
-            storageDriver: 's3',
-            storagePath: key,
-            uploadTokenHash: createHash('sha256').update(compatibilityToken).digest('hex'),
-            ttlMs: expiresIn * 1000,
-          })
-          if (!quotaRecoveryScheduler) throw new Error('Storage quota recovery is unavailable.')
-          await quotaRecoveryScheduler({
-            reservationId: reservation.id,
-            tenantId: scope.tenantId!,
-            organizationId: scope.organizationId!,
-          }, Math.max(1_000, reservation.expiresAt.getTime() - Date.now()))
-          const url = `/api/storage-providers/s3/signed-upload/${compatibilityToken}`
-          return { url, expiresAt, reservationId: reservation.id }
-        } catch (error) {
-          if (reservation) {
-            await quotaService.release(reservation.id, reservation.leaseToken).catch(() => {})
-          }
-          throw error
-        }
-      }
       const url = await driver.getSignedUrl(key, operation, expiresIn, contentType, scope)
-      return { url, expiresAt }
+      return { url, expiresAt: new Date(Date.now() + expiresIn * 1000) }
     },
 
     async list({ prefix, maxKeys = 100, continuationToken, scope }): Promise<{

package/dist/modules/storage_s3/api/put/storage-providers/s3/signed-upload/[token].js

@@ -1,145 +0,0 @@
-import { createHash } from "node:crypto";
-import path from "node:path";
-import { NextResponse } from "next/server";
-import { z } from "zod";
-import { createRequestContainer } from "@open-mercato/shared/lib/di/container";
-import {
-  detectAttachmentMimeType,
-  hasDangerousExecutableExtension,
-  isActiveContentAttachment
-} from "@open-mercato/core/modules/attachments/lib/security";
-import { S3StorageDriver } from "../../../../../lib/s3-driver.js";
-const metadata = {
-  path: "/storage-providers/s3/signed-upload/:token",
-  PUT: { requireAuth: false }
-};
-class UploadBodyTooLargeError extends Error {
-}
-async function readBoundedBody(req, maxBytes) {
-  if (!req.body) return Buffer.alloc(0);
-  const reader = req.body.getReader();
-  const chunks = [];
-  let totalBytes = 0;
-  try {
-    while (true) {
-      const { done, value } = await reader.read();
-      if (done) break;
-      totalBytes += value.byteLength;
-      if (totalBytes > maxBytes) {
-        await reader.cancel();
-        throw new UploadBodyTooLargeError("Attachment exceeds the reserved upload size.");
-      }
-      chunks.push(Buffer.from(value));
-    }
-  } finally {
-    reader.releaseLock();
-  }
-  return Buffer.concat(chunks, totalBytes);
-}
-async function PUT(req, ctx) {
-  const params = ctx.params instanceof Promise ? await ctx.params : ctx.params;
-  const token = params?.token?.trim();
-  if (!token) return NextResponse.json({ error: "Upload token is required." }, { status: 400 });
-  const { resolve } = await createRequestContainer();
-  let quotaService = null;
-  try {
-    quotaService = resolve("attachmentQuotaService");
-  } catch {
-  }
-  if (!quotaService) return NextResponse.json({ error: "Storage quota accounting is unavailable." }, { status: 500 });
-  const tokenHash = createHash("sha256").update(token).digest("hex");
-  const reservation = await quotaService.claimPendingByUploadTokenHash(tokenHash);
-  if (!reservation || reservation.source !== "storage_s3_signed") {
-    return NextResponse.json({ error: "Upload token is invalid or expired." }, { status: 410 });
-  }
-  const declaredLengthHeader = req.headers.get("content-length");
-  const declaredLength = declaredLengthHeader == null ? null : Number(declaredLengthHeader);
-  if (declaredLength !== null && Number.isFinite(declaredLength) && declaredLength > reservation.reservedBytes) {
-    await quotaService.release(reservation.id, reservation.leaseToken).catch(() => {
-    });
-    return NextResponse.json({ error: "Attachment exceeds the reserved upload size." }, { status: 413 });
-  }
-  let buffer;
-  try {
-    buffer = await readBoundedBody(req, reservation.reservedBytes);
-  } catch (error) {
-    await quotaService.release(reservation.id, reservation.leaseToken).catch(() => {
-    });
-    if (error instanceof UploadBodyTooLargeError) {
-      return NextResponse.json({ error: error.message }, { status: 413 });
-    }
-    return NextResponse.json({ error: "Failed to read attachment." }, { status: 400 });
-  }
-  if (buffer.length > reservation.reservedBytes) {
-    await quotaService.release(reservation.id, reservation.leaseToken).catch(() => {
-    });
-    return NextResponse.json({ error: "Attachment exceeds the reserved upload size." }, { status: 413 });
-  }
-  const fileName = path.posix.basename(reservation.storagePath);
-  if (hasDangerousExecutableExtension(fileName)) {
-    await quotaService.release(reservation.id, reservation.leaseToken).catch(() => {
-    });
-    return NextResponse.json({ error: "Executable file types are not allowed as attachments." }, { status: 400 });
-  }
-  const contentType = detectAttachmentMimeType(buffer, fileName, req.headers.get("content-type"));
-  if (isActiveContentAttachment(buffer, fileName, contentType)) {
-    await quotaService.release(reservation.id, reservation.leaseToken).catch(() => {
-    });
-    return NextResponse.json({ error: "Active content uploads are not allowed." }, { status: 400 });
-  }
-  const credentialsService = resolve("integrationCredentialsService");
-  const credentials = await credentialsService.resolve("storage_s3", {
-    tenantId: reservation.tenantId,
-    organizationId: reservation.organizationId
-  });
-  if (!credentials) {
-    await quotaService.release(reservation.id, reservation.leaseToken).catch(() => {
-    });
-    return NextResponse.json({ error: "S3 integration is not configured." }, { status: 400 });
-  }
-  const driver = new S3StorageDriver({
-    ...credentials,
-    organizationId: reservation.organizationId,
-    tenantId: reservation.tenantId
-  });
-  let objectStored = false;
-  try {
-    await driver.putObject(reservation.storagePath, buffer, contentType);
-    objectStored = true;
-    await quotaService.markStored(reservation.id, reservation.leaseToken);
-    await quotaService.completeStandalone(reservation.id, reservation.leaseToken, buffer.length);
-    return new NextResponse(null, { status: 200 });
-  } catch (error) {
-    if (objectStored) {
-      try {
-        await driver.deleteStrict("", reservation.storagePath);
-        await quotaService.release(reservation.id, reservation.leaseToken);
-      } catch {
-      }
-    }
-    return NextResponse.json({ error: "Failed to persist attachment." }, { status: 500 });
-  }
-}
-var token_default = PUT;
-const openApi = {
-  tag: "Storage",
-  summary: "Upload through a bounded one-time compatibility URL",
-  methods: {
-    PUT: {
-      summary: "Upload an object using a bounded one-time token",
-      responses: [{ status: 200, description: "Upload completed", schema: z.any() }],
-      errors: [
-        { status: 400, description: "Invalid upload", schema: z.object({ error: z.string() }) },
-        { status: 410, description: "Token invalid or expired", schema: z.object({ error: z.string() }) },
-        { status: 413, description: "Upload exceeds reserved size", schema: z.object({ error: z.string() }) }
-      ]
-    }
-  }
-};
-export {
-  PUT,
-  token_default as default,
-  metadata,
-  openApi
-};
-//# sourceMappingURL=%5Btoken%5D.js.map

package/dist/modules/storage_s3/api/put/storage-providers/s3/signed-upload/[token].js.map

@@ -1,7 +0,0 @@
-{
-  "version": 3,
-  "sources": ["../../../../../../../../src/modules/storage_s3/api/put/storage-providers/s3/signed-upload/%5Btoken%5D.ts"],
-  "sourcesContent": ["import { createHash } from 'node:crypto'\nimport path from 'node:path'\nimport { NextResponse } from 'next/server'\nimport { z } from 'zod'\nimport type { OpenApiRouteDoc } from '@open-mercato/shared/lib/openapi'\nimport { createRequestContainer } from '@open-mercato/shared/lib/di/container'\nimport {\n  detectAttachmentMimeType,\n  hasDangerousExecutableExtension,\n  isActiveContentAttachment,\n} from '@open-mercato/core/modules/attachments/lib/security'\nimport type { AttachmentQuotaService } from '@open-mercato/core/modules/attachments/lib/quota-service'\nimport { S3StorageDriver } from '../../../../../lib/s3-driver'\n\nexport const metadata = {\n  path: '/storage-providers/s3/signed-upload/:token',\n  PUT: { requireAuth: false },\n}\n\ntype RouteContext = { params?: Promise<{ token?: string }> | { token?: string } }\n\nclass UploadBodyTooLargeError extends Error {}\n\nasync function readBoundedBody(req: Request, maxBytes: number): Promise<Buffer> {\n  if (!req.body) return Buffer.alloc(0)\n  const reader = req.body.getReader()\n  const chunks: Buffer[] = []\n  let totalBytes = 0\n  try {\n    while (true) {\n      const { done, value } = await reader.read()\n      if (done) break\n      totalBytes += value.byteLength\n      if (totalBytes > maxBytes) {\n        await reader.cancel()\n        throw new UploadBodyTooLargeError('Attachment exceeds the reserved upload size.')\n      }\n      chunks.push(Buffer.from(value))\n    }\n  } finally {\n    reader.releaseLock()\n  }\n  return Buffer.concat(chunks, totalBytes)\n}\n\nexport async function PUT(req: Request, ctx: RouteContext) {\n  const params = ctx.params instanceof Promise ? await ctx.params : ctx.params\n  const token = params?.token?.trim()\n  if (!token) return NextResponse.json({ error: 'Upload token is required.' }, { status: 400 })\n\n  const { resolve } = await createRequestContainer()\n  let quotaService: AttachmentQuotaService | null = null\n  try {\n    quotaService = resolve('attachmentQuotaService') as AttachmentQuotaService\n  } catch {\n    // Fail closed below when the attachments quota service is not registered.\n  }\n  if (!quotaService) return NextResponse.json({ error: 'Storage quota accounting is unavailable.' }, { status: 500 })\n\n  const tokenHash = createHash('sha256').update(token).digest('hex')\n  const reservation = await quotaService.claimPendingByUploadTokenHash(tokenHash)\n  if (!reservation || reservation.source !== 'storage_s3_signed') {\n    return NextResponse.json({ error: 'Upload token is invalid or expired.' }, { status: 410 })\n  }\n\n  const declaredLengthHeader = req.headers.get('content-length')\n  const declaredLength = declaredLengthHeader == null ? null : Number(declaredLengthHeader)\n  if (declaredLength !== null && Number.isFinite(declaredLength) && declaredLength > reservation.reservedBytes) {\n    await quotaService.release(reservation.id, reservation.leaseToken).catch(() => {})\n    return NextResponse.json({ error: 'Attachment exceeds the reserved upload size.' }, { status: 413 })\n  }\n  let buffer: Buffer\n  try {\n    buffer = await readBoundedBody(req, reservation.reservedBytes)\n  } catch (error) {\n    await quotaService.release(reservation.id, reservation.leaseToken).catch(() => {})\n    if (error instanceof UploadBodyTooLargeError) {\n      return NextResponse.json({ error: error.message }, { status: 413 })\n    }\n    return NextResponse.json({ error: 'Failed to read attachment.' }, { status: 400 })\n  }\n  if (buffer.length > reservation.reservedBytes) {\n    await quotaService.release(reservation.id, reservation.leaseToken).catch(() => {})\n    return NextResponse.json({ error: 'Attachment exceeds the reserved upload size.' }, { status: 413 })\n  }\n  const fileName = path.posix.basename(reservation.storagePath)\n  if (hasDangerousExecutableExtension(fileName)) {\n    await quotaService.release(reservation.id, reservation.leaseToken).catch(() => {})\n    return NextResponse.json({ error: 'Executable file types are not allowed as attachments.' }, { status: 400 })\n  }\n  const contentType = detectAttachmentMimeType(buffer, fileName, req.headers.get('content-type'))\n  if (isActiveContentAttachment(buffer, fileName, contentType)) {\n    await quotaService.release(reservation.id, reservation.leaseToken).catch(() => {})\n    return NextResponse.json({ error: 'Active content uploads are not allowed.' }, { status: 400 })\n  }\n\n  const credentialsService = resolve('integrationCredentialsService') as {\n    resolve(integrationId: string, scope: { tenantId: string; organizationId: string }): Promise<Record<string, unknown> | null>\n  }\n  const credentials = await credentialsService.resolve('storage_s3', {\n    tenantId: reservation.tenantId,\n    organizationId: reservation.organizationId,\n  })\n  if (!credentials) {\n    await quotaService.release(reservation.id, reservation.leaseToken).catch(() => {})\n    return NextResponse.json({ error: 'S3 integration is not configured.' }, { status: 400 })\n  }\n\n  const driver = new S3StorageDriver({\n    ...credentials,\n    organizationId: reservation.organizationId,\n    tenantId: reservation.tenantId,\n  })\n  let objectStored = false\n  try {\n    await driver.putObject(reservation.storagePath, buffer, contentType)\n    objectStored = true\n    await quotaService.markStored(reservation.id, reservation.leaseToken)\n    await quotaService.completeStandalone(reservation.id, reservation.leaseToken, buffer.length)\n    return new NextResponse(null, { status: 200 })\n  } catch (error) {\n    if (objectStored) {\n      try {\n        await driver.deleteStrict('', reservation.storagePath)\n        await quotaService.release(reservation.id, reservation.leaseToken)\n      } catch {\n        // Retain the reservation when object absence cannot be proven.\n      }\n    }\n    return NextResponse.json({ error: 'Failed to persist attachment.' }, { status: 500 })\n  }\n}\n\nexport default PUT\n\nexport const openApi: OpenApiRouteDoc = {\n  tag: 'Storage',\n  summary: 'Upload through a bounded one-time compatibility URL',\n  methods: {\n    PUT: {\n      summary: 'Upload an object using a bounded one-time token',\n      responses: [{ status: 200, description: 'Upload completed', schema: z.any() }],\n      errors: [\n        { status: 400, description: 'Invalid upload', schema: z.object({ error: z.string() }) },\n        { status: 410, description: 'Token invalid or expired', schema: z.object({ error: z.string() }) },\n        { status: 413, description: 'Upload exceeds reserved size', schema: z.object({ error: z.string() }) },\n      ],\n    },\n  },\n}\n"],
-  "mappings": "AAAA,SAAS,kBAAkB;AAC3B,OAAO,UAAU;AACjB,SAAS,oBAAoB;AAC7B,SAAS,SAAS;AAElB,SAAS,8BAA8B;AACvC;AAAA,EACE;AAAA,EACA;AAAA,EACA;AAAA,OACK;AAEP,SAAS,uBAAuB;AAEzB,MAAM,WAAW;AAAA,EACtB,MAAM;AAAA,EACN,KAAK,EAAE,aAAa,MAAM;AAC5B;AAIA,MAAM,gCAAgC,MAAM;AAAC;AAE7C,eAAe,gBAAgB,KAAc,UAAmC;AAC9E,MAAI,CAAC,IAAI,KAAM,QAAO,OAAO,MAAM,CAAC;AACpC,QAAM,SAAS,IAAI,KAAK,UAAU;AAClC,QAAM,SAAmB,CAAC;AAC1B,MAAI,aAAa;AACjB,MAAI;AACF,WAAO,MAAM;AACX,YAAM,EAAE,MAAM,MAAM,IAAI,MAAM,OAAO,KAAK;AAC1C,UAAI,KAAM;AACV,oBAAc,MAAM;AACpB,UAAI,aAAa,UAAU;AACzB,cAAM,OAAO,OAAO;AACpB,cAAM,IAAI,wBAAwB,8CAA8C;AAAA,MAClF;AACA,aAAO,KAAK,OAAO,KAAK,KAAK,CAAC;AAAA,IAChC;AAAA,EACF,UAAE;AACA,WAAO,YAAY;AAAA,EACrB;AACA,SAAO,OAAO,OAAO,QAAQ,UAAU;AACzC;AAEA,eAAsB,IAAI,KAAc,KAAmB;AACzD,QAAM,SAAS,IAAI,kBAAkB,UAAU,MAAM,IAAI,SAAS,IAAI;AACtE,QAAM,QAAQ,QAAQ,OAAO,KAAK;AAClC,MAAI,CAAC,MAAO,QAAO,aAAa,KAAK,EAAE,OAAO,4BAA4B,GAAG,EAAE,QAAQ,IAAI,CAAC;AAE5F,QAAM,EAAE,QAAQ,IAAI,MAAM,uBAAuB;AACjD,MAAI,eAA8C;AAClD,MAAI;AACF,mBAAe,QAAQ,wBAAwB;AAAA,EACjD,QAAQ;AAAA,EAER;AACA,MAAI,CAAC,aAAc,QAAO,aAAa,KAAK,EAAE,OAAO,2CAA2C,GAAG,EAAE,QAAQ,IAAI,CAAC;AAElH,QAAM,YAAY,WAAW,QAAQ,EAAE,OAAO,KAAK,EAAE,OAAO,KAAK;AACjE,QAAM,cAAc,MAAM,aAAa,8BAA8B,SAAS;AAC9E,MAAI,CAAC,eAAe,YAAY,WAAW,qBAAqB;AAC9D,WAAO,aAAa,KAAK,EAAE,OAAO,sCAAsC,GAAG,EAAE,QAAQ,IAAI,CAAC;AAAA,EAC5F;AAEA,QAAM,uBAAuB,IAAI,QAAQ,IAAI,gBAAgB;AAC7D,QAAM,iBAAiB,wBAAwB,OAAO,OAAO,OAAO,oBAAoB;AACxF,MAAI,mBAAmB,QAAQ,OAAO,SAAS,cAAc,KAAK,iBAAiB,YAAY,eAAe;AAC5G,UAAM,aAAa,QAAQ,YAAY,IAAI,YAAY,UAAU,EAAE,MAAM,MAAM;AAAA,IAAC,CAAC;AACjF,WAAO,aAAa,KAAK,EAAE,OAAO,+CAA+C,GAAG,EAAE,QAAQ,IAAI,CAAC;AAAA,EACrG;AACA,MAAI;AACJ,MAAI;AACF,aAAS,MAAM,gBAAgB,KAAK,YAAY,aAAa;AAAA,EAC/D,SAAS,OAAO;AACd,UAAM,aAAa,QAAQ,YAAY,IAAI,YAAY,UAAU,EAAE,MAAM,MAAM;AAAA,IAAC,CAAC;AACjF,QAAI,iBAAiB,yBAAyB;AAC5C,aAAO,aAAa,KAAK,EAAE,OAAO,MAAM,QAAQ,GAAG,EAAE,QAAQ,IAAI,CAAC;AAAA,IACpE;AACA,WAAO,aAAa,KAAK,EAAE,OAAO,6BAA6B,GAAG,EAAE,QAAQ,IAAI,CAAC;AAAA,EACnF;AACA,MAAI,OAAO,SAAS,YAAY,eAAe;AAC7C,UAAM,aAAa,QAAQ,YAAY,IAAI,YAAY,UAAU,EAAE,MAAM,MAAM;AAAA,IAAC,CAAC;AACjF,WAAO,aAAa,KAAK,EAAE,OAAO,+CAA+C,GAAG,EAAE,QAAQ,IAAI,CAAC;AAAA,EACrG;AACA,QAAM,WAAW,KAAK,MAAM,SAAS,YAAY,WAAW;AAC5D,MAAI,gCAAgC,QAAQ,GAAG;AAC7C,UAAM,aAAa,QAAQ,YAAY,IAAI,YAAY,UAAU,EAAE,MAAM,MAAM;AAAA,IAAC,CAAC;AACjF,WAAO,aAAa,KAAK,EAAE,OAAO,wDAAwD,GAAG,EAAE,QAAQ,IAAI,CAAC;AAAA,EAC9G;AACA,QAAM,cAAc,yBAAyB,QAAQ,UAAU,IAAI,QAAQ,IAAI,cAAc,CAAC;AAC9F,MAAI,0BAA0B,QAAQ,UAAU,WAAW,GAAG;AAC5D,UAAM,aAAa,QAAQ,YAAY,IAAI,YAAY,UAAU,EAAE,MAAM,MAAM;AAAA,IAAC,CAAC;AACjF,WAAO,aAAa,KAAK,EAAE,OAAO,0CAA0C,GAAG,EAAE,QAAQ,IAAI,CAAC;AAAA,EAChG;AAEA,QAAM,qBAAqB,QAAQ,+BAA+B;AAGlE,QAAM,cAAc,MAAM,mBAAmB,QAAQ,cAAc;AAAA,IACjE,UAAU,YAAY;AAAA,IACtB,gBAAgB,YAAY;AAAA,EAC9B,CAAC;AACD,MAAI,CAAC,aAAa;AAChB,UAAM,aAAa,QAAQ,YAAY,IAAI,YAAY,UAAU,EAAE,MAAM,MAAM;AAAA,IAAC,CAAC;AACjF,WAAO,aAAa,KAAK,EAAE,OAAO,oCAAoC,GAAG,EAAE,QAAQ,IAAI,CAAC;AAAA,EAC1F;AAEA,QAAM,SAAS,IAAI,gBAAgB;AAAA,IACjC,GAAG;AAAA,IACH,gBAAgB,YAAY;AAAA,IAC5B,UAAU,YAAY;AAAA,EACxB,CAAC;AACD,MAAI,eAAe;AACnB,MAAI;AACF,UAAM,OAAO,UAAU,YAAY,aAAa,QAAQ,WAAW;AACnE,mBAAe;AACf,UAAM,aAAa,WAAW,YAAY,IAAI,YAAY,UAAU;AACpE,UAAM,aAAa,mBAAmB,YAAY,IAAI,YAAY,YAAY,OAAO,MAAM;AAC3F,WAAO,IAAI,aAAa,MAAM,EAAE,QAAQ,IAAI,CAAC;AAAA,EAC/C,SAAS,OAAO;AACd,QAAI,cAAc;AAChB,UAAI;AACF,cAAM,OAAO,aAAa,IAAI,YAAY,WAAW;AACrD,cAAM,aAAa,QAAQ,YAAY,IAAI,YAAY,UAAU;AAAA,MACnE,QAAQ;AAAA,MAER;AAAA,IACF;AACA,WAAO,aAAa,KAAK,EAAE,OAAO,gCAAgC,GAAG,EAAE,QAAQ,IAAI,CAAC;AAAA,EACtF;AACF;AAEA,IAAO,gBAAQ;AAER,MAAM,UAA2B;AAAA,EACtC,KAAK;AAAA,EACL,SAAS;AAAA,EACT,SAAS;AAAA,IACP,KAAK;AAAA,MACH,SAAS;AAAA,MACT,WAAW,CAAC,EAAE,QAAQ,KAAK,aAAa,oBAAoB,QAAQ,EAAE,IAAI,EAAE,CAAC;AAAA,MAC7E,QAAQ;AAAA,QACN,EAAE,QAAQ,KAAK,aAAa,kBAAkB,QAAQ,EAAE,OAAO,EAAE,OAAO,EAAE,OAAO,EAAE,CAAC,EAAE;AAAA,QACtF,EAAE,QAAQ,KAAK,aAAa,4BAA4B,QAAQ,EAAE,OAAO,EAAE,OAAO,EAAE,OAAO,EAAE,CAAC,EAAE;AAAA,QAChG,EAAE,QAAQ,KAAK,aAAa,gCAAgC,QAAQ,EAAE,OAAO,EAAE,OAAO,EAAE,OAAO,EAAE,CAAC,EAAE;AAAA,MACtG;AAAA,IACF;AAAA,EACF;AACF;",
-  "names": []
-}