@cedarjs/cli 7.1.0-rc.34 → 7.1.1-next.468

package/dist/commands/setup/ui/libraries/tailwindcssHandler.js

@@ -4,45 +4,33 @@ import { ListrEnquirerPromptAdapter } from "@listr2/prompt-adapter-enquirer";
 import execa from "execa";
 import { Listr } from "listr2";
 import { terminalLink } from "termi-link";
-import { recordTelemetryAttributes, colors as c } from "@cedarjs/cli-helpers";
+import { colors as c } from "@cedarjs/cli-helpers/colors";
 import { formatCedarCommand } from "@cedarjs/cli-helpers/packageManager/display";
-import { runBin } from "@cedarjs/cli-helpers/packageManager/exec";
 import {
   addRootPackages,
   addWorkspacePackages
 } from "@cedarjs/cli-helpers/packageManager/packages";
+import { recordTelemetryAttributes } from "@cedarjs/cli-helpers/telemetry";
 import { errorTelemetry } from "@cedarjs/telemetry";
 import { getPaths, usingVSCode } from "../../../../lib/index.js";
-const tailwindDirectives = [
-  "@tailwind base;",
-  "@tailwind components;",
-  "@tailwind utilities;"
-];
-const tailwindDirectivesExist = (indexCSS) => tailwindDirectives.every(
-  (tailwindDirective) => indexCSS.includes(tailwindDirective)
-);
-const tailwindImportsAndNotes = [
+import { insertPluginsBeforeCedar } from "../../deploy/helpers/index.js";
+const tailwindImport = "@import 'tailwindcss';";
+const tailwindImportRegExp = /@import\s+['"]tailwindcss['"]/;
+const tailwindImportAndNotes = [
   "/**",
   " * START --- SETUP TAILWINDCSS EDIT",
   " *",
-  ` * \`${formatCedarCommand(["setup", "ui", "tailwindcss"])}\` placed these directives here`,
+  ` * \`${formatCedarCommand(["setup", "ui", "tailwindcss"])}\` placed this import here`,
   " * to inject Tailwind's styles into your CSS.",
   " * For more information, see: https://tailwindcss.com/docs/installation",
   " */",
-  ...tailwindDirectives,
+  tailwindImport,
   "/**",
   " * END --- SETUP TAILWINDCSS EDIT",
   " */\n"
 ];
-const recommendedVSCodeExtensions = [
-  "csstools.postcss",
-  "bradlc.vscode-tailwindcss"
-];
+const recommendedVSCodeExtensions = ["bradlc.vscode-tailwindcss"];
 const recommendationTexts = {
-  "csstools.postcss": terminalLink(
-    "PostCSS Language Support",
-    "https://marketplace.visualstudio.com/items?itemName=csstools.postcss"
-  ),
   "bradlc.vscode-tailwindcss": terminalLink(
     "Tailwind CSS IntelliSense",
     "https://marketplace.visualstudio.com/items?itemName=bradlc.vscode-tailwindcss"
@@ -86,9 +74,8 @@ const handler = async ({
   const rwPaths = getPaths();
   const projectPackages = ["prettier-plugin-tailwindcss@^0.8.0"];
   const webWorkspacePackages = [
-    "postcss",
-    "tailwindcss@^3.4.17",
-    "autoprefixer"
+    "tailwindcss@^4.3.3",
+    "@tailwindcss/vite@^4.3.3"
   ];
   const tasks = new Listr(
     [
@@ -139,62 +126,45 @@ const handler = async ({
         }
       },
       {
-        title: "Configuring PostCSS...",
-        task: () => {
-          const postCSSConfigPath = rwPaths.web.postcss;
-          if (!force && fs.existsSync(postCSSConfigPath)) {
+        title: "Adding the Tailwind CSS plugin to the Vite config...",
+        task: (_ctx, task) => {
+          const viteConfigPath = rwPaths.web.viteConfig;
+          if (!viteConfigPath || !fs.existsSync(viteConfigPath)) {
+            throw new Error("Could not find web/vite.config.{ts,js}");
+          }
+          const viteConfig = fs.readFileSync(viteConfigPath, "utf-8");
+          if (viteConfig.includes("@tailwindcss/vite")) {
+            task.skip("The Tailwind CSS Vite plugin is already configured");
+            return;
+          }
+          const viteConfigWithPlugin = insertPluginsBeforeCedar({
+            content: viteConfig,
+            pluginCodes: ["tailwindcss()"]
+          });
+          if (!viteConfigWithPlugin) {
             throw new Error(
-              "PostCSS config already exists.\nUse --force to override existing config."
+              `Could not find \`cedar()\` in the plugins array in ${viteConfigPath}.
+Add \`import tailwindcss from '@tailwindcss/vite'\` to the top of the file and \`tailwindcss()\` to the plugins array yourself, and then run this command again.`
             );
-          } else {
-            const postCSSConfig = fs.readFileSync(
-              path.join(
-                import.meta.dirname,
-                "../templates/postcss.config.cjs.template"
-              ),
-              "utf-8"
-            );
-            fs.mkdirSync(path.dirname(postCSSConfigPath), { recursive: true });
-            return fs.writeFileSync(postCSSConfigPath, postCSSConfig);
           }
-        }
-      },
-      {
-        title: "Initializing Tailwind CSS...",
-        task: async () => {
-          const tailwindConfigPath = path.join(
-            rwPaths.web.config,
-            "tailwind.config.cjs"
+          const tailwindPluginImport = "import tailwindcss from '@tailwindcss/vite'\n";
+          const importAnchor = /^import .* from ['"]vite['"]/m.exec(viteConfigWithPlugin) ?? /^import /m.exec(viteConfigWithPlugin);
+          const insertAt = importAnchor?.index ?? 0;
+          fs.writeFileSync(
+            viteConfigPath,
+            viteConfigWithPlugin.slice(0, insertAt) + tailwindPluginImport + viteConfigWithPlugin.slice(insertAt)
           );
-          if (fs.existsSync(tailwindConfigPath)) {
-            if (force) {
-              fs.unlinkSync(tailwindConfigPath);
-            } else {
-              throw new Error(
-                "Tailwind CSS config already exists.\nUse --force to override existing config."
-              );
-            }
-          }
-          await runBin("tailwindcss", ["init", tailwindConfigPath], {
-            cwd: rwPaths.web.base
-          });
-          const tailwindConfig = fs.readFileSync(tailwindConfigPath, "utf-8");
-          const newTailwindConfig = 'const { join } = require("node:path");\n\n' + tailwindConfig.replace(
-            "content: []",
-            "content: [join(__dirname, '../src/**/*.{js,jsx,ts,tsx}')]"
-          ).replace("export default {", "module.exports = {");
-          fs.writeFileSync(tailwindConfigPath, newTailwindConfig);
         }
       },
       {
-        title: "Adding directives to index.css...",
+        title: "Adding Tailwind CSS import to index.css...",
         task: (_ctx, task) => {
           const INDEX_CSS_PATH = path.join(rwPaths.web.src, "index.css");
           const indexCSS = fs.readFileSync(INDEX_CSS_PATH, "utf-8");
-          if (tailwindDirectivesExist(indexCSS)) {
-            task.skip("Directives already exist in index.css");
+          if (tailwindImportRegExp.test(indexCSS)) {
+            task.skip("Tailwind CSS import already exists in index.css");
           } else {
-            const newIndexCSS = tailwindImportsAndNotes.join("\n") + indexCSS;
+            const newIndexCSS = tailwindImportAndNotes.join("\n") + indexCSS;
             fs.writeFileSync(INDEX_CSS_PATH, newIndexCSS);
           }
         }
@@ -275,7 +245,9 @@ const handler = async ({
             "activeClassName",
             "errorClassName"
           ];
+          const fileAssociations = { "*.css": "tailwindcss" };
           let newSettingsJson = {
+            ["files.associations"]: fileAssociations,
             ["tailwindCSS.classAttributes"]: classAttributes
           };
           if (fs.existsSync(VS_CODE_SETTINGS_PATH)) {
@@ -293,8 +265,13 @@ const handler = async ({
             const mergedClassAttributes = Array.from(
               /* @__PURE__ */ new Set([...classAttributes, ...originalTwClassAttributesJson])
             );
+            const existingAssociations = originalSettingsJson["files.associations"];
             newSettingsJson = {
               ...originalSettingsJson,
+              ["files.associations"]: {
+                ...existingAssociations && typeof existingAssociations === "object" && !Array.isArray(existingAssociations) ? existingAssociations : {},
+                ...fileAssociations
+              },
               ["tailwindCSS.classAttributes"]: mergedClassAttributes
             };
           }
@@ -305,34 +282,38 @@ const handler = async ({
         }
       },
       {
-        title: "Adding tailwind config entry in prettier...",
+        title: "Adding tailwind stylesheet entry in prettier...",
         task: async (_ctx) => {
           const prettierConfigPath = path.join(
             rwPaths.base,
             "prettier.config.cjs"
           );
           const prettierConfig = fs.readFileSync(prettierConfigPath, "utf-8");
-          const tailwindConfigPath = path.relative(
-            rwPaths.base,
-            path.posix.join(rwPaths.web.config, "tailwind.config.cjs")
-          ).replaceAll("\\", "/");
+          const tailwindStylesheetPath = path.relative(rwPaths.base, path.join(rwPaths.web.src, "index.css")).replaceAll("\\", "/");
+          const tailwindStylesheetEntry = `tailwindStylesheet: './${tailwindStylesheetPath}',`;
           let newPrettierConfig = prettierConfig;
-          if (newPrettierConfig.includes("tailwindConfig: ")) {
-            if (force) {
-              newPrettierConfig = newPrettierConfig.replace(
-                /tailwindConfig: .*(,)?/,
-                `tailwindConfig: './${tailwindConfigPath}',`
+          const stringEntryRegExp = /tailwindStylesheet:\s*(['"`])[^'"`\n]*\1,?/;
+          if (newPrettierConfig.includes("tailwindStylesheet")) {
+            if (!force) {
+              throw new Error(
+                "tailwindStylesheet setting already exists in prettier configuration.\nUse --force to override existing config."
               );
-            } else {
+            }
+            if (!stringEntryRegExp.test(newPrettierConfig)) {
               throw new Error(
-                "tailwindConfig setting already exists in prettier configuration.\nUse --force to override existing config."
+                `Could not update the tailwindStylesheet setting in ${prettierConfigPath}.
+Set it to './${tailwindStylesheetPath}' yourself.`
               );
             }
+            newPrettierConfig = newPrettierConfig.replace(
+              stringEntryRegExp,
+              tailwindStylesheetEntry
+            );
           } else {
             newPrettierConfig = newPrettierConfig.replace(
               /,(\n\s*)(\}\n?)$/,
               `,
-  tailwindConfig: './${tailwindConfigPath}',$1$2`
+  ${tailwindStylesheetEntry}$1$2`
             );
           }
           fs.writeFileSync(prettierConfigPath, newPrettierConfig);

package/dist/commands/setup/uploads/gitignore.js

@@ -0,0 +1,17 @@
+const UPLOADS_GITIGNORE_ENTRY = "api/.uploads";
+function transformGitignore(source) {
+  const activeLines = source.split("\n").map((line) => line.trimEnd()).filter((line) => line.length > 0 && !line.startsWith("#"));
+  if (activeLines.includes(UPLOADS_GITIGNORE_ENTRY)) {
+    return source;
+  }
+  if (/^dev\.db\*$/m.test(source)) {
+    return source.replace(/^(dev\.db\*)$/m, `$1
+${UPLOADS_GITIGNORE_ENTRY}`);
+  }
+  const prefix = source === "" || source.endsWith("\n") ? source : source + "\n";
+  return prefix + UPLOADS_GITIGNORE_ENTRY + "\n";
+}
+export {
+  UPLOADS_GITIGNORE_ENTRY,
+  transformGitignore
+};

package/dist/commands/setup/uploads/schemaPrisma.js

@@ -0,0 +1,41 @@
+const UPLOAD_MODEL = `model Upload {
+  id             String   @id @default(cuid())
+  /// Name of the storage target, as configured in api/src/lib/uploads
+  target         String
+  /// "pending" | "completed" | "failed"
+  status         String   @default("pending")
+  filename       String
+  mimeType       String
+  /// Bytes. BigInt because Int caps at 2 GB.
+  size           BigInt
+  /// Provider-specific reference: S3 object key, filename on disk, or null
+  /// for files stored inline
+  storageKey     String?
+  /// Inline bytes, only for DB targets
+  data           Bytes?
+  /// The user the file belongs to, when it belongs to one
+  userId         String?
+  /// Id of the upload token that created this row
+  tokenId        String?
+  /// The organization the file belongs to, in multi-tenant apps
+  organizationId String?
+  createdAt      DateTime @default(now())
+  updatedAt      DateTime @updatedAt
+}`;
+function hasModel(schema, modelName) {
+  return new RegExp(`\\bmodel\\s+${modelName}\\s*\\{`).test(schema);
+}
+function addUploadModel(schema) {
+  if (hasModel(schema, "Upload")) {
+    return schema;
+  }
+  return `${schema.trimEnd()}
+
+${UPLOAD_MODEL}
+`;
+}
+export {
+  UPLOAD_MODEL,
+  addUploadModel,
+  hasModel
+};

package/dist/commands/setup/uploads/serverFile.js

@@ -0,0 +1,217 @@
+import { isBuiltin } from "node:module";
+const START_LINE = /^([ \t]*)await server\.start\(\)/m;
+const FACTORY_IMPORT = /import\s*\{[^}]*\bcreateAuthDecoder\b[^}]*\}\s*from\s*['"](@cedarjs\/auth-[a-z0-9-]+-api)['"]/;
+const DECODER_IMPORT = /import\s*\{[^}]*\bauthDecoder\b[^}]*\}\s*from\s*['"](@cedarjs\/auth-[a-z0-9-]+-api)['"]/;
+function detectServerAuth(graphqlSource) {
+  const factory = FACTORY_IMPORT.exec(graphqlSource);
+  if (factory) {
+    return { decoderPackage: factory[1], usesFactory: true };
+  }
+  const decoder = DECODER_IMPORT.exec(graphqlSource);
+  if (decoder) {
+    return { decoderPackage: decoder[1], usesFactory: false };
+  }
+  return null;
+}
+function importedBindings(source) {
+  const names = /* @__PURE__ */ new Set();
+  const statements = source.matchAll(
+    /^import\s+(type\s+)?([^;]*?)\s+from\s+['"][^'"]+['"]/gm
+  );
+  for (const [, typeOnly, clause] of statements) {
+    if (typeOnly) {
+      continue;
+    }
+    const braces = /\{([^}]*)\}/.exec(clause);
+    const defaultOrNamespace = clause.replace(/\{[^}]*\}/, "");
+    for (const part of defaultOrNamespace.split(",")) {
+      const local = part.replace(/^\s*\*\s+as\s+/, "").trim();
+      if (local) {
+        names.add(local);
+      }
+    }
+    for (const specifier of braces?.[1].split(",") ?? []) {
+      const trimmed = specifier.trim();
+      if (!trimmed || trimmed.startsWith("type ")) {
+        continue;
+      }
+      const alias = / as (\w+)$/.exec(trimmed);
+      names.add(alias ? alias[1] : trimmed);
+    }
+  }
+  return names;
+}
+function hasBinding(source, name) {
+  const declared = new RegExp(
+    `^(?:export\\s+)?(?:const|let|var|function)\\s+${name}\\b`,
+    "m"
+  );
+  return importedBindings(source).has(name) || declared.test(source);
+}
+function uploadsServerImports(source, auth) {
+  const specs = [];
+  if (auth) {
+    if (auth.usesFactory) {
+      if (!hasBinding(source, "authDecoder")) {
+        specs.push({
+          names: ["createAuthDecoder"],
+          from: auth.decoderPackage
+        });
+      }
+    } else {
+      specs.push({ names: ["authDecoder"], from: auth.decoderPackage });
+    }
+  }
+  specs.push({
+    names: auth ? ["cedarUploadsPlugin", "createUploadAuthenticator"] : ["cedarUploadsPlugin"],
+    from: "@cedarjs/uploads"
+  });
+  if (auth) {
+    const authNames = ["getCurrentUser"];
+    if (auth.usesFactory && !hasBinding(source, "authDecoder")) {
+      authNames.unshift("cookieName");
+    }
+    specs.push({ names: authNames, from: "src/lib/auth" });
+  }
+  specs.push({ names: ["db"], from: "src/lib/db" });
+  specs.push({ names: ["targets"], from: "src/lib/uploads" });
+  return specs.map((spec) => ({
+    ...spec,
+    names: spec.names.filter((name) => !hasBinding(source, name))
+  })).filter((spec) => spec.names.length > 0).map((spec) => ({
+    line: `import { ${spec.names.join(", ")} } from '${spec.from}'`,
+    from: spec.from
+  }));
+}
+function findImports(lines) {
+  const imports = [];
+  for (let start = 0; start < lines.length; start++) {
+    if (!/^import\b/.test(lines[start])) {
+      continue;
+    }
+    const sideEffect = /^import\s*['"]([^'"]+)['"]/.exec(lines[start]);
+    if (sideEffect) {
+      imports.push({ start, end: start, from: sideEffect[1] });
+      continue;
+    }
+    for (let end = start; end < lines.length; end++) {
+      const from = /\bfrom\s*['"]([^'"]+)['"]/.exec(lines[end]);
+      if (from) {
+        imports.push({ start, end, from: from[1] });
+        start = end;
+        break;
+      }
+    }
+  }
+  return imports;
+}
+function importGroup(from) {
+  if (isBuiltin(from)) {
+    return 0;
+  }
+  if (from === "react") {
+    return 1;
+  }
+  if (from.startsWith("@cedarjs/")) {
+    return 3;
+  }
+  if (from.startsWith("src/")) {
+    return /^src\/[^/]+\/.+\.(?:sdl\.)?(?:js|ts)$/.test(from) ? 4 : 5;
+  }
+  if (from === ".." || from.startsWith("../")) {
+    return 6;
+  }
+  if (/^\.\/?(?:index(?:\.[jt]sx?)?)?$/.test(from)) {
+    return 8;
+  }
+  if (from.startsWith("./")) {
+    return 7;
+  }
+  return 2;
+}
+function compareSpecifiers(a, b) {
+  const segmentsA = a.toLowerCase().split("/");
+  const segmentsB = b.toLowerCase().split("/");
+  for (let i = 0; i < Math.min(segmentsA.length, segmentsB.length); i++) {
+    if (segmentsA[i] !== segmentsB[i]) {
+      return segmentsA[i] < segmentsB[i] ? -1 : 1;
+    }
+  }
+  return segmentsA.length - segmentsB.length;
+}
+function insertImport(lines, serverImport) {
+  const imports = findImports(lines);
+  const group = importGroup(serverImport.from);
+  const sameGroup = imports.filter((i) => importGroup(i.from) === group);
+  if (sameGroup.length > 0) {
+    const next = sameGroup.find(
+      (i) => compareSpecifiers(i.from, serverImport.from) > 0
+    );
+    const at2 = next ? next.start : sameGroup[sameGroup.length - 1].end + 1;
+    return [...lines.slice(0, at2), serverImport.line, ...lines.slice(at2)];
+  }
+  const earlier = imports.filter((i) => importGroup(i.from) < group);
+  if (earlier.length > 0) {
+    const at2 = Math.max(...earlier.map((i) => i.end)) + 1;
+    const inserted = ["", serverImport.line];
+    if (at2 < lines.length && lines[at2].trim() !== "") {
+      inserted.push("");
+    }
+    return [...lines.slice(0, at2), ...inserted, ...lines.slice(at2)];
+  }
+  const later = imports.find((i) => importGroup(i.from) > group);
+  const at = later ? later.start : 0;
+  return [...lines.slice(0, at), serverImport.line, "", ...lines.slice(at)];
+}
+function uploadsServerRegistration(source, auth) {
+  if (!auth) {
+    return `  await server.register(cedarUploadsPlugin, {
+    tokenSecret: process.env.UPLOAD_TOKEN_SECRET,
+    targets,
+    db,
+    // Once the app has auth, bind upload tokens to the logged-in user:
+    //
+    //   authenticate: createUploadAuthenticator({ authDecoder, getCurrentUser }),
+  })
+`;
+  }
+  const decoder = auth.usesFactory && !hasBinding(source, "authDecoder") ? "  const authDecoder = createAuthDecoder(cookieName)\n\n" : "";
+  return `${decoder}  await server.register(cedarUploadsPlugin, {
+    tokenSecret: process.env.UPLOAD_TOKEN_SECRET,
+    targets,
+    db,
+    // Binds upload tokens to the logged-in user through the same auth
+    // pipeline the GraphQL server uses
+    authenticate: createUploadAuthenticator({ authDecoder, getCurrentUser }),
+  })
+`;
+}
+function hasUploadsPlugin(source) {
+  return /^[ \t]*(?:(?:await|void)\s+|(?:const|let|var)\s+\w+\s*=\s*)?[\w.]+\.register\(\s*cedarUploadsPlugin\b/m.test(
+    source
+  );
+}
+function addUploadsPlugin(source, { auth = null } = {}) {
+  if (hasUploadsPlugin(source)) {
+    return source;
+  }
+  const start = START_LINE.exec(source);
+  if (!start) {
+    throw new Error("CEDAR_UPLOADS_ERR_NO_START");
+  }
+  const withImports = uploadsServerImports(source, auth).reduce(insertImport, source.split("\n")).join("\n");
+  return withImports.replace(
+    START_LINE,
+    (line) => `${uploadsServerRegistration(source, auth)}
+${line}`
+  );
+}
+export {
+  addUploadsPlugin,
+  detectServerAuth,
+  hasBinding,
+  hasUploadsPlugin,
+  importedBindings,
+  uploadsServerImports,
+  uploadsServerRegistration
+};

package/dist/commands/setup/uploads/templates/requireUploadToken.ts.template

@@ -0,0 +1,15 @@
+import { createRequireUploadTokenDirective } from '@cedarjs/uploads'
+
+/**
+ * Requires a valid upload token in the x-upload-token request header and
+ * makes its claims available to the resolver through
+ * `getUploadTokenPayload(context)`. The token must have been issued to the
+ * requesting user.
+ */
+const requireUploadToken = createRequireUploadTokenDirective({
+  secret: process.env.UPLOAD_TOKEN_SECRET ?? '',
+})
+
+export const schema = requireUploadToken.schema
+
+export default requireUploadToken

package/dist/commands/setup/uploads/templates/srcLibUploads.ts.template

@@ -1,25 +1,24 @@
-import { createUploadsConfig, setupStorage } from '@cedarjs/storage'
-import { FileSystemStorage } from '@cedarjs/storage/FileSystemStorage'
-import { UrlSigner } from '@cedarjs/storage/UrlSigner'
+__PATH_IMPORT____S3_IMPORTS__import {
+  __FS_IMPORT__
+  __DB_IMPORT__
+  __DB_MAX_IMPORT__
+  defineStorageTargets,
+  defineUploadProfiles,
+} from '@cedarjs/uploads'
+__GET_PATHS_IMPORT__
+__S3_CLIENT__
+/**
+ * Where files live. Each target is a provider instance; the Upload row
+ * records which target holds a file so it can be read, served, and deleted
+ * later. Look one up by name with `resolveTarget(targets, upload.target)`.
+ */
+export const targets = defineStorageTargets({
+__TARGETS__})
 
-const uploadsConfig = createUploadsConfig({
-  // Configure your fields here
-  // e.g. modelName: { fields: ['fieldWithUpload']}
-})
-
-export const fsStorage = new FileSystemStorage({
-  baseDir: './uploads',
-})
-
-export const urlSigner = new UrlSigner({
-  secret: process.env.UPLOADS_SECRET,
-  endpoint: '/signedUrl',
-})
-
-const { saveFiles, storagePrismaExtension } = setupStorage({
-  uploadsConfig,
-  storageAdapter: fsStorage,
-  urlSigner,
-})
-
-export { saveFiles, storagePrismaExtension }
+/**
+ * What clients may upload. A profile names a target and the constraints the
+ * server signs into every upload token issued for it. The client never
+ * supplies constraints; it names a profile.
+ */
+export const profiles = defineUploadProfiles({
+__PROFILES__})

package/dist/commands/setup/uploads/templates/uploads.sdl.ts.template

@@ -0,0 +1,79 @@
+export const schema = gql`
+  type Upload {
+    id: String!
+    target: String!
+    status: String!
+    filename: String!
+    mimeType: String!
+    size: BigInt!
+    storageKey: String
+    userId: String
+    organizationId: String
+    createdAt: DateTime!
+    updatedAt: DateTime!
+  }
+
+  type UploadToken {
+    token: String!
+    """
+    The profile's constraints, echoed for client-side UX (file-picker
+    filters, pre-upload validation). The authoritative copy is inside the
+    signed token.
+    """
+    allowedMimeTypes: [String!]!
+    maxFileSize: BigInt!
+    maxFiles: Int!
+  }
+
+  type PresignedUploadUrl {
+    uploadId: String!
+    url: String!
+    method: String!
+    headers: JSON!
+  }
+
+  input CreatePresignedUploadUrlInput {
+    filename: String!
+    contentType: String!
+    size: BigInt!
+  }
+
+  input UploadFileInput {
+    filename: String!
+    mimeType: String!
+    """
+    The file's bytes, base64-encoded. Only for profiles whose target stores
+    files inline in the database.
+    """
+    data: String!
+  }
+
+  type Query {
+    """
+    Issues an upload token for a server-defined profile. The profile name
+    must match a key of \`profiles\` in api/src/lib/uploads.
+    """
+    requestUploadToken(profile: String!): UploadToken! @requireAuth
+  }
+
+  type Mutation {
+    """
+    Direct-to-storage uploads: returns a presigned URL for one file. Send the
+    upload token in the x-upload-token header.
+    """
+    createPresignedUploadUrl(
+      input: CreatePresignedUploadUrlInput!
+    ): PresignedUploadUrl! @requireAuth @requireUploadToken
+
+    """
+    Confirms a direct-to-storage upload once the client has PUT the bytes.
+    """
+    confirmUpload(uploadId: String!): Upload! @requireAuth
+
+    """
+    Stores a small file sent as base64, for profiles whose target keeps files
+    inline in the database.
+    """
+    uploadFile(profile: String!, input: UploadFileInput!): Upload! @requireAuth
+  }
+`