@open-mercato/storage-s3 0.6.7-develop.6860.1.f796b22e80 → 0.6.7

package/dist/modules/storage_s3/lib/endpoint-safety.js

@@ -1,133 +0,0 @@
-import { lookup as dnsLookup } from "node:dns/promises";
-import { Agent as HttpAgent } from "node:http";
-import { Agent as HttpsAgent } from "node:https";
-import { isIP } from "node:net";
-import { parseBooleanWithDefault } from "@open-mercato/shared/lib/boolean";
-import {
-  assertSafeOutboundUrl,
-  assertStaticallySafeOutboundUrl,
-  parseOutboundUrl,
-  resolveSafeOutboundUrl
-} from "@open-mercato/shared/lib/url-safety";
-const SUBJECT = "S3 endpoint";
-class UnsafeS3EndpointError extends Error {
-  constructor(reason, message) {
-    super(message ?? `S3 endpoint rejected: ${reason}`);
-    this.name = "UnsafeS3EndpointError";
-    this.reason = reason;
-  }
-}
-const s3EndpointErrorFactory = (reason, message) => new UnsafeS3EndpointError(reason, message);
-function assertStaticallySafeS3Endpoint(rawEndpoint, deps = {}) {
-  if (!rawEndpoint) return;
-  const allowPrivate = deps.allowInternal ?? isAllowInternalS3EndpointsEnabled();
-  assertStaticallySafeOutboundUrl(rawEndpoint, {
-    errorFactory: s3EndpointErrorFactory,
-    subject: SUBJECT,
-    allowPrivate
-  });
-}
-async function assertSafeS3Endpoint(rawEndpoint, deps = {}) {
-  if (!rawEndpoint) return;
-  const allowPrivate = deps.allowInternal ?? isAllowInternalS3EndpointsEnabled();
-  await assertSafeOutboundUrl(rawEndpoint, {
-    errorFactory: s3EndpointErrorFactory,
-    subject: SUBJECT,
-    allowPrivate,
-    lookupHost: deps.lookupHost
-  });
-}
-function createSafeS3EndpointLookup(rawEndpoint, deps = {}) {
-  if (!rawEndpoint) return void 0;
-  const allowPrivate = deps.allowInternal ?? isAllowInternalS3EndpointsEnabled();
-  if (allowPrivate) return void 0;
-  const { hostname } = parseOutboundUrl(rawEndpoint, {
-    errorFactory: s3EndpointErrorFactory,
-    subject: SUBJECT
-  });
-  const endpointHostname = normalizeLookupHostname(hostname);
-  return (host, options, callback) => {
-    const lookupHostname = normalizeLookupHostname(host);
-    if (!isAllowedS3LookupHost(lookupHostname, endpointHostname)) {
-      callback(new UnsafeS3EndpointError(
-        "blocked_hostname",
-        `S3 endpoint lookup host "${host}" does not match configured host "${endpointHostname}"`
-      ), "", 0);
-      return;
-    }
-    resolveSafeOutboundUrl(buildLookupValidationUrl(rawEndpoint, lookupHostname), {
-      errorFactory: s3EndpointErrorFactory,
-      subject: SUBJECT,
-      lookupHost: deps.lookupHost ?? defaultLookupHost
-    }).then(({ addresses }) => {
-      if (!addresses || addresses.length === 0) {
-        const family = isIP(lookupHostname);
-        if (options.all) callback(null, [{ address: lookupHostname, family }]);
-        else callback(null, lookupHostname, family);
-        return;
-      }
-      if (options.all) {
-        callback(null, addresses.map((record) => ({ address: record.address, family: record.family })));
-        return;
-      }
-      callback(null, addresses[0].address, addresses[0].family);
-    }).catch((error) => {
-      callback(error instanceof Error ? error : new UnsafeS3EndpointError("dns_resolution_failed"), "", 0);
-    });
-  };
-}
-function normalizeLookupHostname(hostname) {
-  let normalized = hostname.trim().toLowerCase();
-  if (normalized.startsWith("[") && normalized.endsWith("]")) {
-    normalized = normalized.slice(1, -1);
-  }
-  while (normalized.endsWith(".")) {
-    normalized = normalized.slice(0, -1);
-  }
-  return normalized;
-}
-function isAllowedS3LookupHost(lookupHostname, endpointHostname) {
-  if (lookupHostname === endpointHostname) return true;
-  if (isIP(endpointHostname)) return false;
-  return lookupHostname.endsWith(`.${endpointHostname}`);
-}
-function buildLookupValidationUrl(rawEndpoint, lookupHostname) {
-  const { url } = parseOutboundUrl(rawEndpoint, {
-    errorFactory: s3EndpointErrorFactory,
-    subject: SUBJECT
-  });
-  const host = isIP(lookupHostname) === 6 ? `[${lookupHostname}]` : lookupHostname;
-  const port = url.port ? `:${url.port}` : "";
-  return `${url.protocol}//${host}${port}`;
-}
-const S3_CONNECTION_TIMEOUT_MS = 1e4;
-const S3_REQUEST_TIMEOUT_MS = 12e4;
-function createSafeS3RequestHandler(rawEndpoint, deps = {}) {
-  const lookup = createSafeS3EndpointLookup(rawEndpoint, deps);
-  const timeouts = {
-    connectionTimeout: S3_CONNECTION_TIMEOUT_MS,
-    requestTimeout: S3_REQUEST_TIMEOUT_MS
-  };
-  if (!lookup) return timeouts;
-  return {
-    ...timeouts,
-    httpAgent: new HttpAgent({ lookup }),
-    httpsAgent: new HttpsAgent({ lookup })
-  };
-}
-function isAllowInternalS3EndpointsEnabled() {
-  return parseBooleanWithDefault(process.env.OM_STORAGE_S3_ALLOW_INTERNAL_ENDPOINTS, false);
-}
-const defaultLookupHost = async (hostname) => {
-  const records = await dnsLookup(hostname, { all: true, verbatim: true });
-  return records;
-};
-export {
-  UnsafeS3EndpointError,
-  assertSafeS3Endpoint,
-  assertStaticallySafeS3Endpoint,
-  createSafeS3EndpointLookup,
-  createSafeS3RequestHandler,
-  isAllowInternalS3EndpointsEnabled
-};
-//# sourceMappingURL=endpoint-safety.js.map

package/dist/modules/storage_s3/lib/endpoint-safety.js.map

@@ -1,7 +0,0 @@
-{
-  "version": 3,
-  "sources": ["../../../../src/modules/storage_s3/lib/endpoint-safety.ts"],
-  "sourcesContent": ["import { lookup as dnsLookup } from 'node:dns/promises'\nimport { Agent as HttpAgent } from 'node:http'\nimport { Agent as HttpsAgent } from 'node:https'\nimport { isIP, type LookupFunction } from 'node:net'\nimport { parseBooleanWithDefault } from '@open-mercato/shared/lib/boolean'\nimport {\n  assertSafeOutboundUrl,\n  assertStaticallySafeOutboundUrl,\n  parseOutboundUrl,\n  resolveSafeOutboundUrl,\n  type HostLookup,\n  type ResolvedHostAddress,\n  type UrlSafetyReason,\n} from '@open-mercato/shared/lib/url-safety'\n\nconst SUBJECT = 'S3 endpoint'\n\nexport class UnsafeS3EndpointError extends Error {\n  public readonly reason: string\n\n  constructor(reason: string, message?: string) {\n    super(message ?? `S3 endpoint rejected: ${reason}`)\n    this.name = 'UnsafeS3EndpointError'\n    this.reason = reason\n  }\n}\n\nconst s3EndpointErrorFactory = (reason: UrlSafetyReason, message: string) =>\n  new UnsafeS3EndpointError(reason, message)\n\nexport type AssertStaticS3EndpointDeps = {\n  allowInternal?: boolean\n}\n\nexport function assertStaticallySafeS3Endpoint(\n  rawEndpoint: string | null | undefined,\n  deps: AssertStaticS3EndpointDeps = {},\n): void {\n  if (!rawEndpoint) return\n  const allowPrivate = deps.allowInternal ?? isAllowInternalS3EndpointsEnabled()\n  assertStaticallySafeOutboundUrl(rawEndpoint, {\n    errorFactory: s3EndpointErrorFactory,\n    subject: SUBJECT,\n    allowPrivate,\n  })\n}\n\nexport type AssertSafeS3EndpointDeps = {\n  lookupHost?: HostLookup\n  allowInternal?: boolean\n}\n\nexport async function assertSafeS3Endpoint(\n  rawEndpoint: string | null | undefined,\n  deps: AssertSafeS3EndpointDeps = {},\n): Promise<void> {\n  if (!rawEndpoint) return\n  const allowPrivate = deps.allowInternal ?? isAllowInternalS3EndpointsEnabled()\n  await assertSafeOutboundUrl(rawEndpoint, {\n    errorFactory: s3EndpointErrorFactory,\n    subject: SUBJECT,\n    allowPrivate,\n    lookupHost: deps.lookupHost,\n  })\n}\n\nexport type SafeS3EndpointLookupDeps = {\n  lookupHost?: HostLookup\n  allowInternal?: boolean\n}\n\nexport function createSafeS3EndpointLookup(\n  rawEndpoint: string | null | undefined,\n  deps: SafeS3EndpointLookupDeps = {},\n): LookupFunction | undefined {\n  if (!rawEndpoint) return undefined\n  const allowPrivate = deps.allowInternal ?? isAllowInternalS3EndpointsEnabled()\n  if (allowPrivate) return undefined\n\n  const { hostname } = parseOutboundUrl(rawEndpoint, {\n    errorFactory: s3EndpointErrorFactory,\n    subject: SUBJECT,\n  })\n  const endpointHostname = normalizeLookupHostname(hostname)\n\n  return (host, options, callback) => {\n    const lookupHostname = normalizeLookupHostname(host)\n    if (!isAllowedS3LookupHost(lookupHostname, endpointHostname)) {\n      callback(new UnsafeS3EndpointError(\n        'blocked_hostname',\n        `S3 endpoint lookup host \"${host}\" does not match configured host \"${endpointHostname}\"`,\n      ), '', 0)\n      return\n    }\n\n    resolveSafeOutboundUrl(buildLookupValidationUrl(rawEndpoint, lookupHostname), {\n      errorFactory: s3EndpointErrorFactory,\n      subject: SUBJECT,\n      lookupHost: deps.lookupHost ?? defaultLookupHost,\n    }).then(({ addresses }) => {\n      if (!addresses || addresses.length === 0) {\n        const family = isIP(lookupHostname)\n        if (options.all) callback(null, [{ address: lookupHostname, family }] as ResolvedHostAddress[])\n        else callback(null, lookupHostname, family)\n        return\n      }\n      if (options.all) {\n        callback(null, addresses.map((record) => ({ address: record.address, family: record.family })))\n        return\n      }\n      callback(null, addresses[0].address, addresses[0].family)\n    }).catch((error: unknown) => {\n      callback(error instanceof Error ? error : new UnsafeS3EndpointError('dns_resolution_failed'), '', 0)\n    })\n  }\n}\n\nfunction normalizeLookupHostname(hostname: string): string {\n  let normalized = hostname.trim().toLowerCase()\n  if (normalized.startsWith('[') && normalized.endsWith(']')) {\n    normalized = normalized.slice(1, -1)\n  }\n  while (normalized.endsWith('.')) {\n    normalized = normalized.slice(0, -1)\n  }\n  return normalized\n}\n\nfunction isAllowedS3LookupHost(lookupHostname: string, endpointHostname: string): boolean {\n  if (lookupHostname === endpointHostname) return true\n  if (isIP(endpointHostname)) return false\n  return lookupHostname.endsWith(`.${endpointHostname}`)\n}\n\nfunction buildLookupValidationUrl(rawEndpoint: string, lookupHostname: string): string {\n  const { url } = parseOutboundUrl(rawEndpoint, {\n    errorFactory: s3EndpointErrorFactory,\n    subject: SUBJECT,\n  })\n  const host = isIP(lookupHostname) === 6 ? `[${lookupHostname}]` : lookupHostname\n  const port = url.port ? `:${url.port}` : ''\n  return `${url.protocol}//${host}${port}`\n}\n\nexport type SafeS3RequestHandlerOptions = {\n  connectionTimeout: number\n  requestTimeout: number\n  httpAgent?: HttpAgent\n  httpsAgent?: HttpsAgent\n}\n\nconst S3_CONNECTION_TIMEOUT_MS = 10_000\nconst S3_REQUEST_TIMEOUT_MS = 120_000\n\nexport function createSafeS3RequestHandler(\n  rawEndpoint: string | null | undefined,\n  deps: SafeS3EndpointLookupDeps = {},\n): SafeS3RequestHandlerOptions | undefined {\n  const lookup = createSafeS3EndpointLookup(rawEndpoint, deps)\n  const timeouts = {\n    connectionTimeout: S3_CONNECTION_TIMEOUT_MS,\n    requestTimeout: S3_REQUEST_TIMEOUT_MS,\n  }\n  if (!lookup) return timeouts\n  return {\n    ...timeouts,\n    httpAgent: new HttpAgent({ lookup }),\n    httpsAgent: new HttpsAgent({ lookup }),\n  }\n}\n\nexport function isAllowInternalS3EndpointsEnabled(): boolean {\n  return parseBooleanWithDefault(process.env.OM_STORAGE_S3_ALLOW_INTERNAL_ENDPOINTS, false)\n}\n\nconst defaultLookupHost: HostLookup = async (hostname) => {\n  const records = await dnsLookup(hostname, { all: true, verbatim: true })\n  return records\n}\n"],
-  "mappings": "AAAA,SAAS,UAAU,iBAAiB;AACpC,SAAS,SAAS,iBAAiB;AACnC,SAAS,SAAS,kBAAkB;AACpC,SAAS,YAAiC;AAC1C,SAAS,+BAA+B;AACxC;AAAA,EACE;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,OAIK;AAEP,MAAM,UAAU;AAET,MAAM,8BAA8B,MAAM;AAAA,EAG/C,YAAY,QAAgB,SAAkB;AAC5C,UAAM,WAAW,yBAAyB,MAAM,EAAE;AAClD,SAAK,OAAO;AACZ,SAAK,SAAS;AAAA,EAChB;AACF;AAEA,MAAM,yBAAyB,CAAC,QAAyB,YACvD,IAAI,sBAAsB,QAAQ,OAAO;AAMpC,SAAS,+BACd,aACA,OAAmC,CAAC,GAC9B;AACN,MAAI,CAAC,YAAa;AAClB,QAAM,eAAe,KAAK,iBAAiB,kCAAkC;AAC7E,kCAAgC,aAAa;AAAA,IAC3C,cAAc;AAAA,IACd,SAAS;AAAA,IACT;AAAA,EACF,CAAC;AACH;AAOA,eAAsB,qBACpB,aACA,OAAiC,CAAC,GACnB;AACf,MAAI,CAAC,YAAa;AAClB,QAAM,eAAe,KAAK,iBAAiB,kCAAkC;AAC7E,QAAM,sBAAsB,aAAa;AAAA,IACvC,cAAc;AAAA,IACd,SAAS;AAAA,IACT;AAAA,IACA,YAAY,KAAK;AAAA,EACnB,CAAC;AACH;AAOO,SAAS,2BACd,aACA,OAAiC,CAAC,GACN;AAC5B,MAAI,CAAC,YAAa,QAAO;AACzB,QAAM,eAAe,KAAK,iBAAiB,kCAAkC;AAC7E,MAAI,aAAc,QAAO;AAEzB,QAAM,EAAE,SAAS,IAAI,iBAAiB,aAAa;AAAA,IACjD,cAAc;AAAA,IACd,SAAS;AAAA,EACX,CAAC;AACD,QAAM,mBAAmB,wBAAwB,QAAQ;AAEzD,SAAO,CAAC,MAAM,SAAS,aAAa;AAClC,UAAM,iBAAiB,wBAAwB,IAAI;AACnD,QAAI,CAAC,sBAAsB,gBAAgB,gBAAgB,GAAG;AAC5D,eAAS,IAAI;AAAA,QACX;AAAA,QACA,4BAA4B,IAAI,qCAAqC,gBAAgB;AAAA,MACvF,GAAG,IAAI,CAAC;AACR;AAAA,IACF;AAEA,2BAAuB,yBAAyB,aAAa,cAAc,GAAG;AAAA,MAC5E,cAAc;AAAA,MACd,SAAS;AAAA,MACT,YAAY,KAAK,cAAc;AAAA,IACjC,CAAC,EAAE,KAAK,CAAC,EAAE,UAAU,MAAM;AACzB,UAAI,CAAC,aAAa,UAAU,WAAW,GAAG;AACxC,cAAM,SAAS,KAAK,cAAc;AAClC,YAAI,QAAQ,IAAK,UAAS,MAAM,CAAC,EAAE,SAAS,gBAAgB,OAAO,CAAC,CAA0B;AAAA,YACzF,UAAS,MAAM,gBAAgB,MAAM;AAC1C;AAAA,MACF;AACA,UAAI,QAAQ,KAAK;AACf,iBAAS,MAAM,UAAU,IAAI,CAAC,YAAY,EAAE,SAAS,OAAO,SAAS,QAAQ,OAAO,OAAO,EAAE,CAAC;AAC9F;AAAA,MACF;AACA,eAAS,MAAM,UAAU,CAAC,EAAE,SAAS,UAAU,CAAC,EAAE,MAAM;AAAA,IAC1D,CAAC,EAAE,MAAM,CAAC,UAAmB;AAC3B,eAAS,iBAAiB,QAAQ,QAAQ,IAAI,sBAAsB,uBAAuB,GAAG,IAAI,CAAC;AAAA,IACrG,CAAC;AAAA,EACH;AACF;AAEA,SAAS,wBAAwB,UAA0B;AACzD,MAAI,aAAa,SAAS,KAAK,EAAE,YAAY;AAC7C,MAAI,WAAW,WAAW,GAAG,KAAK,WAAW,SAAS,GAAG,GAAG;AAC1D,iBAAa,WAAW,MAAM,GAAG,EAAE;AAAA,EACrC;AACA,SAAO,WAAW,SAAS,GAAG,GAAG;AAC/B,iBAAa,WAAW,MAAM,GAAG,EAAE;AAAA,EACrC;AACA,SAAO;AACT;AAEA,SAAS,sBAAsB,gBAAwB,kBAAmC;AACxF,MAAI,mBAAmB,iBAAkB,QAAO;AAChD,MAAI,KAAK,gBAAgB,EAAG,QAAO;AACnC,SAAO,eAAe,SAAS,IAAI,gBAAgB,EAAE;AACvD;AAEA,SAAS,yBAAyB,aAAqB,gBAAgC;AACrF,QAAM,EAAE,IAAI,IAAI,iBAAiB,aAAa;AAAA,IAC5C,cAAc;AAAA,IACd,SAAS;AAAA,EACX,CAAC;AACD,QAAM,OAAO,KAAK,cAAc,MAAM,IAAI,IAAI,cAAc,MAAM;AAClE,QAAM,OAAO,IAAI,OAAO,IAAI,IAAI,IAAI,KAAK;AACzC,SAAO,GAAG,IAAI,QAAQ,KAAK,IAAI,GAAG,IAAI;AACxC;AASA,MAAM,2BAA2B;AACjC,MAAM,wBAAwB;AAEvB,SAAS,2BACd,aACA,OAAiC,CAAC,GACO;AACzC,QAAM,SAAS,2BAA2B,aAAa,IAAI;AAC3D,QAAM,WAAW;AAAA,IACf,mBAAmB;AAAA,IACnB,gBAAgB;AAAA,EAClB;AACA,MAAI,CAAC,OAAQ,QAAO;AACpB,SAAO;AAAA,IACL,GAAG;AAAA,IACH,WAAW,IAAI,UAAU,EAAE,OAAO,CAAC;AAAA,IACnC,YAAY,IAAI,WAAW,EAAE,OAAO,CAAC;AAAA,EACvC;AACF;AAEO,SAAS,oCAA6C;AAC3D,SAAO,wBAAwB,QAAQ,IAAI,wCAAwC,KAAK;AAC1F;AAEA,MAAM,oBAAgC,OAAO,aAAa;AACxD,QAAM,UAAU,MAAM,UAAU,UAAU,EAAE,KAAK,MAAM,UAAU,KAAK,CAAC;AACvE,SAAO;AACT;",
-  "names": []
-}

package/dist/modules/storage_s3/lib/quota-accounting.js

@@ -1,24 +0,0 @@
-import { isS3KeyScopedToTenant } from "./key-scope.js";
-async function reconcileTenantS3Objects(input) {
-  const objects = [];
-  let continuationToken;
-  do {
-    const page = await input.driver.listObjects("", 1e3, continuationToken);
-    for (const file of page.files) {
-      if (isS3KeyScopedToTenant(file.key, input.organizationId, input.tenantId)) {
-        objects.push({ path: file.key, bytes: file.size });
-      }
-    }
-    continuationToken = page.truncated ? page.nextContinuationToken : void 0;
-  } while (continuationToken);
-  await input.quotaService.reconcileStandaloneObjects({
-    tenantId: input.tenantId,
-    organizationId: input.organizationId,
-    storageDriver: "s3",
-    objects
-  });
-}
-export {
-  reconcileTenantS3Objects
-};
-//# sourceMappingURL=quota-accounting.js.map

package/dist/modules/storage_s3/lib/quota-accounting.js.map

@@ -1,7 +0,0 @@
-{
-  "version": 3,
-  "sources": ["../../../../src/modules/storage_s3/lib/quota-accounting.ts"],
-  "sourcesContent": ["import type { AttachmentQuotaService } from '@open-mercato/core/modules/attachments/lib/quota-service'\nimport { isS3KeyScopedToTenant } from './key-scope'\nimport type { S3StorageDriver } from './s3-driver'\n\nexport async function reconcileTenantS3Objects(input: {\n  driver: S3StorageDriver\n  quotaService: AttachmentQuotaService\n  tenantId: string\n  organizationId: string\n}): Promise<void> {\n  const objects: Array<{ path: string; bytes: number }> = []\n  let continuationToken: string | undefined\n  do {\n    const page = await input.driver.listObjects('', 1000, continuationToken)\n    for (const file of page.files) {\n      if (isS3KeyScopedToTenant(file.key, input.organizationId, input.tenantId)) {\n        objects.push({ path: file.key, bytes: file.size })\n      }\n    }\n    continuationToken = page.truncated ? page.nextContinuationToken : undefined\n  } while (continuationToken)\n\n  await input.quotaService.reconcileStandaloneObjects({\n    tenantId: input.tenantId,\n    organizationId: input.organizationId,\n    storageDriver: 's3',\n    objects,\n  })\n}\n"],
-  "mappings": "AACA,SAAS,6BAA6B;AAGtC,eAAsB,yBAAyB,OAK7B;AAChB,QAAM,UAAkD,CAAC;AACzD,MAAI;AACJ,KAAG;AACD,UAAM,OAAO,MAAM,MAAM,OAAO,YAAY,IAAI,KAAM,iBAAiB;AACvE,eAAW,QAAQ,KAAK,OAAO;AAC7B,UAAI,sBAAsB,KAAK,KAAK,MAAM,gBAAgB,MAAM,QAAQ,GAAG;AACzE,gBAAQ,KAAK,EAAE,MAAM,KAAK,KAAK,OAAO,KAAK,KAAK,CAAC;AAAA,MACnD;AAAA,IACF;AACA,wBAAoB,KAAK,YAAY,KAAK,wBAAwB;AAAA,EACpE,SAAS;AAET,QAAM,MAAM,aAAa,2BAA2B;AAAA,IAClD,UAAU,MAAM;AAAA,IAChB,gBAAgB,MAAM;AAAA,IACtB,eAAe;AAAA,IACf;AAAA,EACF,CAAC;AACH;",
-  "names": []
-}

package/dist/modules/storage_s3/lib/quota-recovery-queue.js

@@ -1,9 +0,0 @@
-import { createModuleQueue } from "@open-mercato/queue";
-const queue = createModuleQueue("storage-s3-quota-recovery", { concurrency: 2 });
-async function scheduleStorageS3QuotaRecovery(payload, delayMs) {
-  await queue.enqueue(payload, { delayMs: Math.max(1e3, delayMs) });
-}
-export {
-  scheduleStorageS3QuotaRecovery
-};
-//# sourceMappingURL=quota-recovery-queue.js.map

package/dist/modules/storage_s3/lib/quota-recovery-queue.js.map

@@ -1,7 +0,0 @@
-{
-  "version": 3,
-  "sources": ["../../../../src/modules/storage_s3/lib/quota-recovery-queue.ts"],
-  "sourcesContent": ["import { createModuleQueue } from '@open-mercato/queue'\n\nexport type StorageS3QuotaRecoveryJob = {\n  reservationId: string\n  tenantId: string\n  organizationId: string\n  absenceCheck?: number\n}\n\nconst queue = createModuleQueue<StorageS3QuotaRecoveryJob>('storage-s3-quota-recovery', { concurrency: 2 })\n\nexport async function scheduleStorageS3QuotaRecovery(\n  payload: StorageS3QuotaRecoveryJob,\n  delayMs: number,\n): Promise<void> {\n  await queue.enqueue(payload, { delayMs: Math.max(1_000, delayMs) })\n}\n"],
-  "mappings": "AAAA,SAAS,yBAAyB;AASlC,MAAM,QAAQ,kBAA6C,6BAA6B,EAAE,aAAa,EAAE,CAAC;AAE1G,eAAsB,+BACpB,SACA,SACe;AACf,QAAM,MAAM,QAAQ,SAAS,EAAE,SAAS,KAAK,IAAI,KAAO,OAAO,EAAE,CAAC;AACpE;",
-  "names": []
-}

package/dist/modules/storage_s3/workers/quota-recovery.js

@@ -1,70 +0,0 @@
-import { S3StorageDriver } from "../lib/s3-driver.js";
-import { scheduleStorageS3QuotaRecovery } from "../lib/quota-recovery-queue.js";
-const metadata = {
-  queue: "storage-s3-quota-recovery",
-  id: "storage_s3:quota-recovery",
-  concurrency: 2
-};
-async function handle(job, ctx) {
-  const quotaService = ctx.resolve("attachmentQuotaService");
-  const scope = {
-    tenantId: job.payload.tenantId,
-    organizationId: job.payload.organizationId
-  };
-  const record = await quotaService.getReservation(job.payload.reservationId, scope);
-  if (!record || record.status === "committed") return;
-  if (record.expiresAt && record.expiresAt.getTime() > Date.now()) {
-    await scheduleStorageS3QuotaRecovery(job.payload, record.expiresAt.getTime() - Date.now());
-    return;
-  }
-  const claimed = await quotaService.claimExpired(record.id, scope);
-  if (!claimed) return;
-  try {
-    const credentialsService = ctx.resolve("integrationCredentialsService");
-    const credentials = await credentialsService.resolve("storage_s3", {
-      tenantId: claimed.tenantId,
-      organizationId: claimed.organizationId
-    });
-    if (!credentials) throw new Error("S3 integration is not configured for quota recovery.");
-    const driver = new S3StorageDriver({
-      ...credentials,
-      organizationId: claimed.organizationId,
-      tenantId: claimed.tenantId
-    });
-    if (claimed.source === "storage_s3_signed") {
-      const listed = await driver.listObjects(claimed.storagePath, 1);
-      const object = listed.files.find((file) => file.key === claimed.storagePath);
-      if (!object) {
-        if (record.status === "storing" && (job.payload.absenceCheck ?? 0) === 0 && claimed.expiresAt) {
-          await scheduleStorageS3QuotaRecovery(
-            {
-              ...job.payload,
-              absenceCheck: 1
-            },
-            claimed.expiresAt.getTime() - Date.now()
-          );
-          return;
-        }
-        await quotaService.release(claimed.id, claimed.leaseToken);
-        return;
-      }
-      const validSize = claimed.uploadTokenHash ? object.size <= claimed.reservedBytes : object.size === claimed.reservedBytes;
-      if (validSize) {
-        await quotaService.commitRecoveredStandalone(claimed.id, claimed.leaseToken, object.size);
-        return;
-      }
-    }
-    await driver.deleteStrict("", claimed.storagePath);
-    await quotaService.release(claimed.id, claimed.leaseToken);
-  } catch (error) {
-    if (claimed.expiresAt) {
-      await scheduleStorageS3QuotaRecovery(job.payload, claimed.expiresAt.getTime() - Date.now());
-    }
-    throw error;
-  }
-}
-export {
-  handle as default,
-  metadata
-};
-//# sourceMappingURL=quota-recovery.js.map

package/dist/modules/storage_s3/workers/quota-recovery.js.map

@@ -1,7 +0,0 @@
-{
-  "version": 3,
-  "sources": ["../../../../src/modules/storage_s3/workers/quota-recovery.ts"],
-  "sourcesContent": ["import type { JobContext, QueuedJob, WorkerMeta } from '@open-mercato/queue'\nimport type { AttachmentQuotaService } from '@open-mercato/core/modules/attachments/lib/quota-service'\nimport { S3StorageDriver } from '../lib/s3-driver'\nimport { scheduleStorageS3QuotaRecovery, type StorageS3QuotaRecoveryJob } from '../lib/quota-recovery-queue'\n\nexport const metadata: WorkerMeta = {\n  queue: 'storage-s3-quota-recovery',\n  id: 'storage_s3:quota-recovery',\n  concurrency: 2,\n}\n\ntype HandlerContext = JobContext & { resolve: <T = unknown>(name: string) => T }\n\ntype IntegrationCredentialsService = {\n  resolve(integrationId: string, scope: { tenantId: string; organizationId: string }): Promise<Record<string, unknown> | null>\n}\n\nexport default async function handle(\n  job: QueuedJob<StorageS3QuotaRecoveryJob>,\n  ctx: HandlerContext,\n): Promise<void> {\n  const quotaService = ctx.resolve<AttachmentQuotaService>('attachmentQuotaService')\n  const scope = {\n    tenantId: job.payload.tenantId,\n    organizationId: job.payload.organizationId,\n  }\n  const record = await quotaService.getReservation(job.payload.reservationId, scope)\n  if (!record || record.status === 'committed') return\n  if (record.expiresAt && record.expiresAt.getTime() > Date.now()) {\n    await scheduleStorageS3QuotaRecovery(job.payload, record.expiresAt.getTime() - Date.now())\n    return\n  }\n\n  const claimed = await quotaService.claimExpired(record.id, scope)\n  if (!claimed) return\n  try {\n    const credentialsService = ctx.resolve<IntegrationCredentialsService>('integrationCredentialsService')\n    const credentials = await credentialsService.resolve('storage_s3', {\n      tenantId: claimed.tenantId,\n      organizationId: claimed.organizationId,\n    })\n    if (!credentials) throw new Error('S3 integration is not configured for quota recovery.')\n    const driver = new S3StorageDriver({\n      ...credentials,\n      organizationId: claimed.organizationId,\n      tenantId: claimed.tenantId,\n    })\n\n    if (claimed.source === 'storage_s3_signed') {\n      const listed = await driver.listObjects(claimed.storagePath, 1)\n      const object = listed.files.find((file) => file.key === claimed.storagePath)\n      if (!object) {\n        if (record.status === 'storing' && (job.payload.absenceCheck ?? 0) === 0 && claimed.expiresAt) {\n          await scheduleStorageS3QuotaRecovery({\n            ...job.payload,\n            absenceCheck: 1,\n          },\n            claimed.expiresAt.getTime() - Date.now(),\n          )\n          return\n        }\n        await quotaService.release(claimed.id, claimed.leaseToken)\n        return\n      }\n      const validSize = claimed.uploadTokenHash\n        ? object.size <= claimed.reservedBytes\n        : object.size === claimed.reservedBytes\n      if (validSize) {\n        await quotaService.commitRecoveredStandalone(claimed.id, claimed.leaseToken, object.size)\n        return\n      }\n    }\n\n    await driver.deleteStrict('', claimed.storagePath)\n    await quotaService.release(claimed.id, claimed.leaseToken)\n  } catch (error) {\n    if (claimed.expiresAt) {\n      await scheduleStorageS3QuotaRecovery(job.payload, claimed.expiresAt.getTime() - Date.now())\n    }\n    throw error\n  }\n}\n"],
-  "mappings": "AAEA,SAAS,uBAAuB;AAChC,SAAS,sCAAsE;AAExE,MAAM,WAAuB;AAAA,EAClC,OAAO;AAAA,EACP,IAAI;AAAA,EACJ,aAAa;AACf;AAQA,eAAO,OACL,KACA,KACe;AACf,QAAM,eAAe,IAAI,QAAgC,wBAAwB;AACjF,QAAM,QAAQ;AAAA,IACZ,UAAU,IAAI,QAAQ;AAAA,IACtB,gBAAgB,IAAI,QAAQ;AAAA,EAC9B;AACA,QAAM,SAAS,MAAM,aAAa,eAAe,IAAI,QAAQ,eAAe,KAAK;AACjF,MAAI,CAAC,UAAU,OAAO,WAAW,YAAa;AAC9C,MAAI,OAAO,aAAa,OAAO,UAAU,QAAQ,IAAI,KAAK,IAAI,GAAG;AAC/D,UAAM,+BAA+B,IAAI,SAAS,OAAO,UAAU,QAAQ,IAAI,KAAK,IAAI,CAAC;AACzF;AAAA,EACF;AAEA,QAAM,UAAU,MAAM,aAAa,aAAa,OAAO,IAAI,KAAK;AAChE,MAAI,CAAC,QAAS;AACd,MAAI;AACF,UAAM,qBAAqB,IAAI,QAAuC,+BAA+B;AACrG,UAAM,cAAc,MAAM,mBAAmB,QAAQ,cAAc;AAAA,MACjE,UAAU,QAAQ;AAAA,MAClB,gBAAgB,QAAQ;AAAA,IAC1B,CAAC;AACD,QAAI,CAAC,YAAa,OAAM,IAAI,MAAM,sDAAsD;AACxF,UAAM,SAAS,IAAI,gBAAgB;AAAA,MACjC,GAAG;AAAA,MACH,gBAAgB,QAAQ;AAAA,MACxB,UAAU,QAAQ;AAAA,IACpB,CAAC;AAED,QAAI,QAAQ,WAAW,qBAAqB;AAC1C,YAAM,SAAS,MAAM,OAAO,YAAY,QAAQ,aAAa,CAAC;AAC9D,YAAM,SAAS,OAAO,MAAM,KAAK,CAAC,SAAS,KAAK,QAAQ,QAAQ,WAAW;AAC3E,UAAI,CAAC,QAAQ;AACX,YAAI,OAAO,WAAW,cAAc,IAAI,QAAQ,gBAAgB,OAAO,KAAK,QAAQ,WAAW;AAC7F,gBAAM;AAAA,YAA+B;AAAA,cACnC,GAAG,IAAI;AAAA,cACP,cAAc;AAAA,YAChB;AAAA,YACE,QAAQ,UAAU,QAAQ,IAAI,KAAK,IAAI;AAAA,UACzC;AACA;AAAA,QACF;AACA,cAAM,aAAa,QAAQ,QAAQ,IAAI,QAAQ,UAAU;AACzD;AAAA,MACF;AACA,YAAM,YAAY,QAAQ,kBACtB,OAAO,QAAQ,QAAQ,gBACvB,OAAO,SAAS,QAAQ;AAC5B,UAAI,WAAW;AACb,cAAM,aAAa,0BAA0B,QAAQ,IAAI,QAAQ,YAAY,OAAO,IAAI;AACxF;AAAA,MACF;AAAA,IACF;AAEA,UAAM,OAAO,aAAa,IAAI,QAAQ,WAAW;AACjD,UAAM,aAAa,QAAQ,QAAQ,IAAI,QAAQ,UAAU;AAAA,EAC3D,SAAS,OAAO;AACd,QAAI,QAAQ,WAAW;AACrB,YAAM,+BAA+B,IAAI,SAAS,QAAQ,UAAU,QAAQ,IAAI,KAAK,IAAI,CAAC;AAAA,IAC5F;AACA,UAAM;AAAA,EACR;AACF;",
-  "names": []
-}

package/src/modules/storage_s3/__tests__/endpoint-safety.test.ts

@@ -1,71 +0,0 @@
-/** @jest-environment node */
-
-import { createSafeS3EndpointLookup, UnsafeS3EndpointError } from '../lib/endpoint-safety'
-
-function runLookup(
-  lookup: NonNullable<ReturnType<typeof createSafeS3EndpointLookup>>,
-  hostname: string,
-): Promise<{ address: string; family: number | undefined }> {
-  return new Promise((resolve, reject) => {
-    lookup(hostname, {}, (err, address, family) => {
-      if (err) {
-        reject(err)
-        return
-      }
-      if (typeof address !== 'string') {
-        reject(new Error('Expected a single lookup result'))
-        return
-      }
-      resolve({ address, family })
-    })
-  })
-}
-
-describe('S3 endpoint safety', () => {
-  it('validates the DNS result used by the AWS SDK lookup callback', async () => {
-    const lookupHost = jest
-      .fn()
-      .mockResolvedValueOnce([{ address: '93.184.216.34', family: 4 }])
-      .mockResolvedValueOnce([{ address: '169.254.169.254', family: 4 }])
-
-    const lookup = createSafeS3EndpointLookup('https://objects.example.com', { lookupHost })
-    expect(lookup).toBeDefined()
-
-    await expect(runLookup(lookup!, 'objects.example.com')).resolves.toEqual({
-      address: '93.184.216.34',
-      family: 4,
-    })
-    await expect(runLookup(lookup!, 'objects.example.com')).rejects.toMatchObject({
-      reason: 'private_ip_resolved',
-    })
-  })
-
-  it('validates virtual-hosted bucket endpoint hosts requested by the AWS SDK', async () => {
-    const lookupHost = jest.fn().mockResolvedValueOnce([{ address: '93.184.216.34', family: 4 }])
-    const lookup = createSafeS3EndpointLookup('https://objects.example.com', { lookupHost })
-
-    await expect(runLookup(lookup!, 'test-bucket.objects.example.com')).resolves.toEqual({
-      address: '93.184.216.34',
-      family: 4,
-    })
-
-    expect(lookupHost).toHaveBeenCalledWith('test-bucket.objects.example.com')
-  })
-
-  it('rejects virtual-hosted bucket endpoint hosts that resolve to private addresses', async () => {
-    const lookupHost = jest.fn().mockResolvedValueOnce([{ address: '169.254.169.254', family: 4 }])
-    const lookup = createSafeS3EndpointLookup('https://objects.example.com', { lookupHost })
-
-    await expect(runLookup(lookup!, 'test-bucket.objects.example.com')).rejects.toMatchObject({
-      reason: 'private_ip_resolved',
-    })
-  })
-
-  it('refuses lookup attempts for hosts other than the configured endpoint host', async () => {
-    const lookup = createSafeS3EndpointLookup('https://objects.example.com')
-
-    await expect(runLookup(lookup!, 'metadata.google.internal')).rejects.toBeInstanceOf(
-      UnsafeS3EndpointError,
-    )
-  })
-})

package/src/modules/storage_s3/__tests__/health.test.ts

@@ -1,38 +0,0 @@
-/** @jest-environment node */
-
-const mockSend = jest.fn()
-
-jest.mock('@aws-sdk/client-s3', () => ({
-  S3Client: jest.fn().mockImplementation(() => ({ send: mockSend })),
-  HeadBucketCommand: jest.fn().mockImplementation((params) => ({ _type: 'HeadBucket', ...params })),
-}))
-
-import { S3Client } from '@aws-sdk/client-s3'
-import { s3HealthCheck } from '../lib/health'
-
-const BASE_CREDENTIALS = {
-  bucket: 'test-bucket',
-  region: 'eu-central-1',
-  authMode: 'access_keys',
-  accessKeyId: 'AKID',
-  secretAccessKey: 'SECRET',
-}
-
-beforeEach(() => {
-  mockSend.mockReset()
-  ;(S3Client as jest.Mock).mockClear()
-})
-
-describe('s3HealthCheck', () => {
-  it('rejects link-local custom endpoints before probing the bucket', async () => {
-    const result = await s3HealthCheck.check({
-      ...BASE_CREDENTIALS,
-      endpoint: 'http://169.254.169.254/latest/meta-data/',
-    })
-
-    expect(result.status).toBe('unhealthy')
-    expect(result.message).toMatch(/private or reserved IP range/i)
-    expect(S3Client).not.toHaveBeenCalled()
-    expect(mockSend).not.toHaveBeenCalled()
-  })
-})

package/src/modules/storage_s3/__tests__/i18nPackageExports.test.ts

@@ -1,13 +0,0 @@
-import { createRequire } from 'node:module'
-import { readFileSync } from 'node:fs'
-
-const packageRequire = createRequire(__filename)
-
-describe('storage_s3 locale package exports', () => {
-  it.each(['en', 'de', 'es', 'pl'] as const)('resolves the %s locale through the package export map', (locale) => {
-    const localePath = packageRequire.resolve(`@open-mercato/storage-s3/modules/storage_s3/i18n/${locale}.json`)
-    const translations = JSON.parse(readFileSync(localePath, 'utf8')) as Record<string, unknown>
-
-    expect(translations['storage_s3.errors.unauthorized']).toEqual(expect.any(String))
-  })
-})

package/src/modules/storage_s3/__tests__/quota-lifecycle.test.ts

@@ -1,216 +0,0 @@
-/** @jest-environment node */
-
-const mockPutObject = jest.fn(async () => {})
-const mockDelete = jest.fn(async () => {})
-const mockGetSignedUrl = jest.fn(async () => 'https://s3.test/signed')
-const mockListObjects = jest.fn(async () => ({ files: [], truncated: false }))
-const mockScheduleRecovery = jest.fn(async () => {})
-
-jest.mock('../lib/s3-driver', () => ({
-  S3StorageDriver: jest.fn().mockImplementation(() => ({
-    putObject: mockPutObject,
-    delete: mockDelete,
-    deleteStrict: mockDelete,
-    getSignedUrl: mockGetSignedUrl,
-    listObjects: mockListObjects,
-    getBucket: () => 'bucket',
-  })),
-}))
-
-const mockQuotaService = {
-  reconcileStandaloneObjects: jest.fn(async () => {}),
-  reserve: jest.fn(async () => ({ id: 'reservation-1', leaseToken: 'lease-1', expiresAt: new Date(Date.now() + 60_000) })),
-  claimPendingByUploadTokenHash: jest.fn(async () => null as Record<string, unknown> | null),
-  beginStorage: jest.fn(async () => {}),
-  markStored: jest.fn(async () => {}),
-  completeStandalone: jest.fn(async () => {}),
-  release: jest.fn(async () => {}),
-  releaseCommittedByPath: jest.fn(async () => {}),
-}
-
-jest.mock('@open-mercato/shared/lib/di/container', () => ({
-  createRequestContainer: jest.fn(async () => ({
-    resolve: (key: string) => {
-      if (key === 'integrationCredentialsService') {
-        return { resolve: jest.fn(async () => ({ bucket: 'bucket', region: 'us-east-1' })) }
-      }
-      if (key === 'attachmentQuotaService') return mockQuotaService
-      if (key === 'storageS3QuotaRecoveryScheduler') return mockScheduleRecovery
-      return null
-    },
-  })),
-}))
-
-jest.mock('@open-mercato/shared/lib/auth/server', () => ({
-  getAuthFromRequest: jest.fn(async () => ({ tenantId: 'tenant-1', orgId: 'org-1' })),
-}))
-
-function multipartRequest() {
-  const form = new FormData()
-  form.set('file', new File([new Uint8Array([1, 2, 3])], 'safe.pdf', { type: 'application/pdf' }))
-  return new Request('http://localhost/api/storage-providers/s3/upload', { method: 'POST', body: form })
-}
-
-describe('storage_s3 quota lifecycle', () => {
-  beforeEach(() => {
-    jest.clearAllMocks()
-    process.env.OM_ATTACHMENT_MAX_UPLOAD_MB = '5'
-    process.env.OM_ATTACHMENT_TENANT_QUOTA_MB = '10'
-  })
-
-  afterEach(() => {
-    delete process.env.OM_ATTACHMENT_MAX_UPLOAD_MB
-    delete process.env.OM_ATTACHMENT_TENANT_QUOTA_MB
-  })
-
-  it('routes multipart uploads through the shared reservation service', async () => {
-    const { POST } = await import('../api/post/storage-providers/s3/upload')
-    const response = await POST(multipartRequest())
-
-    expect(response.status).toBe(200)
-    expect(mockQuotaService.reserve).toHaveBeenCalledWith(expect.objectContaining({
-      tenantId: 'tenant-1',
-      organizationId: 'org-1',
-      bytes: 3,
-      source: 'storage_s3_upload',
-    }))
-    expect(mockQuotaService.completeStandalone).toHaveBeenCalledWith(
-      'reservation-1',
-      'lease-1',
-      3,
-    )
-    expect(mockScheduleRecovery).toHaveBeenCalledWith({
-      reservationId: 'reservation-1',
-      tenantId: 'tenant-1',
-      organizationId: 'org-1',
-    }, expect.any(Number))
-  })
-
-  it('releases multipart capacity when durable recovery cannot be scheduled', async () => {
-    mockScheduleRecovery.mockRejectedValueOnce(new Error('queue unavailable'))
-    const { POST } = await import('../api/post/storage-providers/s3/upload')
-
-    const response = await POST(multipartRequest())
-
-    expect(response.status).toBe(500)
-    expect(mockQuotaService.release).toHaveBeenCalledWith('reservation-1', 'lease-1')
-    expect(mockPutObject).not.toHaveBeenCalled()
-  })
-
-  it('reserves exact bytes before generating a signed upload URL', async () => {
-    const { POST } = await import('../api/post/storage-providers/s3/signed-url')
-    const key = 'uploads/org_org-1/tenant_tenant-1/safe.pdf'
-    const response = await POST(new Request('http://localhost/api/storage-providers/s3/signed-url', {
-      method: 'POST',
-      headers: { 'content-type': 'application/json' },
-      body: JSON.stringify({ key, operation: 'upload', contentType: 'application/pdf', size: 3 }),
-    }))
-
-    expect(response.status).toBe(200)
-    expect(mockQuotaService.reserve).toHaveBeenCalledWith(expect.objectContaining({
-      storagePath: key,
-      bytes: 3,
-      source: 'storage_s3_signed',
-    }))
-    expect(mockQuotaService.reconcileStandaloneObjects).toHaveBeenCalled()
-    expect(await response.json()).toEqual(expect.objectContaining({
-      reservationId: 'reservation-1',
-      url: expect.stringContaining('/api/storage-providers/s3/signed-upload/'),
-    }))
-  })
-
-  it('atomically consumes a compatibility token so replay cannot delete the winning object', async () => {
-    mockQuotaService.claimPendingByUploadTokenHash
-      .mockResolvedValueOnce({
-        id: 'reservation-1',
-        leaseToken: 'lease-claimed',
-        source: 'storage_s3_signed',
-        reservedBytes: 3,
-        storagePath: 'uploads/org_org-1/tenant_tenant-1/safe.pdf',
-        tenantId: 'tenant-1',
-        organizationId: 'org-1',
-      })
-      .mockResolvedValueOnce(null)
-    const { PUT } = await import('../api/put/storage-providers/s3/signed-upload/[token]')
-    const request = () => new Request('http://localhost/api/storage-providers/s3/signed-upload/token', {
-      method: 'PUT',
-      headers: { 'content-type': 'application/pdf' },
-      body: new Uint8Array([1, 2, 3]),
-    })
-
-    const first = await PUT(request(), { params: { token: 'token' } })
-    const replay = await PUT(request(), { params: { token: 'token' } })
-
-    expect(first.status).toBe(200)
-    expect(replay.status).toBe(410)
-    expect(mockPutObject).toHaveBeenCalledTimes(1)
-    expect(mockDelete).not.toHaveBeenCalled()
-  })
-
-  it('stops a chunked compatibility upload as soon as it crosses the reserved bound', async () => {
-    mockQuotaService.claimPendingByUploadTokenHash.mockResolvedValueOnce({
-      id: 'reservation-1',
-      leaseToken: 'lease-claimed',
-      source: 'storage_s3_signed',
-      reservedBytes: 3,
-      storagePath: 'uploads/org_org-1/tenant_tenant-1/safe.pdf',
-      tenantId: 'tenant-1',
-      organizationId: 'org-1',
-    })
-    const stream = new ReadableStream<Uint8Array>({
-      start(controller) {
-        controller.enqueue(new Uint8Array([1, 2]))
-        controller.enqueue(new Uint8Array([3, 4]))
-        controller.close()
-      },
-    })
-    const { PUT } = await import('../api/put/storage-providers/s3/signed-upload/[token]')
-    const response = await PUT(new Request('http://localhost/api/storage-providers/s3/signed-upload/token', {
-      method: 'PUT',
-      body: stream,
-      duplex: 'half',
-    } as RequestInit & { duplex: 'half' }), { params: { token: 'token' } })
-
-    expect(response.status).toBe(413)
-    expect(mockPutObject).not.toHaveBeenCalled()
-    expect(mockQuotaService.release).toHaveBeenCalledWith('reservation-1', 'lease-claimed')
-  })
-
-  it('removes committed quota only after standalone object deletion succeeds', async () => {
-    const { DELETE } = await import('../api/delete/storage-providers/s3/delete')
-    const key = 'uploads/org_org-1/tenant_tenant-1/safe.pdf'
-    const response = await DELETE(new Request('http://localhost/api/storage-providers/s3/delete', {
-      method: 'DELETE',
-      headers: { 'content-type': 'application/json' },
-      body: JSON.stringify({ key }),
-    }))
-
-    expect(response.status).toBe(204)
-    expect(mockDelete).toHaveBeenCalled()
-    expect(mockQuotaService.releaseCommittedByPath).toHaveBeenCalledWith(expect.objectContaining({
-      tenantId: 'tenant-1',
-      storageDriver: 's3',
-      storagePath: key,
-    }))
-  })
-
-  it('releases a programmatic signed-url reservation when recovery scheduling fails', async () => {
-    const { createStorageService } = await import('../lib/storage-service')
-    const service = createStorageService({
-      bucket: 'bucket',
-      region: 'us-east-1',
-      quotaService: mockQuotaService as never,
-      quotaRecoveryScheduler: jest.fn(async () => {
-        throw new Error('queue unavailable')
-      }),
-    })
-
-    await expect(service.getSignedUrl({
-      key: 'uploads/org_org-1/tenant_tenant-1/safe.pdf',
-      operation: 'upload',
-      size: 3,
-      scope: { tenantId: 'tenant-1', organizationId: 'org-1' },
-    })).rejects.toThrow('queue unavailable')
-    expect(mockQuotaService.release).toHaveBeenCalledWith('reservation-1', 'lease-1')
-  })
-})