graphile-bucket-provisioner-plugin 1.14.0 → 1.14.1

package/README.md

@@ -12,19 +12,16 @@
    <a href="https://www.npmjs.com/package/graphile-bucket-provisioner-plugin"><img height="20" src="https://img.shields.io/github/package-json/v/constructive-io/constructive?filename=graphile%2Fgraphile-bucket-provisioner-plugin%2Fpackage.json"/></a>
 </p>
 
-PostGraphile v5 plugin that automatically provisions S3-compatible buckets when bucket rows are created in the database. Wraps bucket creation mutations to call [`@constructive-io/bucket-provisioner`](../packages/bucket-provisioner) after the database row is inserted.
+PostGraphile v5 plugin that explicitly provisions S3-compatible buckets through a GraphQL mutation using [`@constructive-io/bucket-provisioner`](../packages/bucket-provisioner).
 
 ## Features
 
-- **Auto-provisioning hook** — Wraps `create*` mutations on tables tagged with `@storageBuckets` to automatically provision S3 buckets after row creation
-- **CORS update hook** — Wraps `update*` mutations to detect `allowed_origins` changes and re-apply CORS rules to the S3 bucket
+- **Explicit `provisionBucket` mutation** — GraphQL mutation for manual/retry provisioning of any bucket
 - **3-tier CORS resolution** — Bucket-level `allowed_origins` → storage module-level `allowed_origins` → plugin config `allowedOrigins`
 - **Wildcard CORS** — Set `allowed_origins = ['*']` on a bucket for fully open CDN/public deployments
-- **Explicit `provisionBucket` mutation** — GraphQL mutation for manual/retry provisioning of any bucket
 - **Per-database overrides** — Reads `endpoint`, `provider`, `public_url_prefix`, and `allowed_origins` from the `storage_module` table for multi-tenant setups
 - **Lazy S3 config** — Connection config can be a function (evaluated once, cached) to avoid eager env-var reads at import time
-- **Graceful error handling** — Provisioning and CORS update failures are logged but never fail the mutation (admin can retry via `provisionBucket`)
-- **Custom bucket naming** — Supports prefix-based naming or a fully custom `resolveBucketName` function
+- **Deployment-controlled naming** — Requires a `resolveBucketName` policy for tenant-aware physical bucket names
 
 ## Installation
 
@@ -120,10 +117,8 @@ Creates the plugin instance. Returns a `GraphileConfig.Plugin`.
 |--------|------|-------------|
 | `connection` | `StorageConnectionConfig \| () => StorageConnectionConfig` | S3 connection config (static or lazy getter) |
 | `allowedOrigins` | `string[]` | CORS allowed origins for bucket configuration |
-| `bucketNamePrefix` | `string?` | Prefix for S3 bucket names (e.g., `"myapp"` → `"myapp-public"`) |
-| `resolveBucketName` | `(bucketKey, databaseId) => string` | Custom bucket name resolver (takes precedence over prefix) |
+| `resolveBucketName` | `(databaseId, bucketKey) => string` | Deployment policy for deriving a tenant-aware physical bucket name |
 | `versioning` | `boolean?` | Enable S3 versioning on provisioned buckets (default: `false`) |
-| `autoProvision` | `boolean?` | Enable auto-provisioning hook on create mutations (default: `true`) |
 
 ### `BucketProvisionerPreset(options)`
 

package/esm/index.d.ts

@@ -1,13 +1,7 @@
 /**
  * Bucket Provisioner Plugin for PostGraphile v5
  *
- * Provides automatic S3 bucket provisioning for PostGraphile v5.
- * When bucket rows are created via GraphQL mutations, this plugin
- * automatically provisions the corresponding S3 bucket with the
- * correct privacy policies, CORS rules, and lifecycle settings.
- *
- * Also provides an explicit `provisionBucket` mutation for manual
- * provisioning or re-provisioning of S3 buckets.
+ * Provides an explicit `provisionBucket` mutation for PostGraphile v5.
  *
  * @example
  * ```typescript
@@ -31,7 +25,6 @@
  *     BucketProvisionerPreset({
  *       connection: getConnection, // pass function ref, NOT getConnection()
  *       allowedOrigins: ['https://app.example.com'],
- *       bucketNamePrefix: 'myapp',
  *     }),
  *   ],
  * };

package/esm/index.js

@@ -1,13 +1,7 @@
 /**
  * Bucket Provisioner Plugin for PostGraphile v5
  *
- * Provides automatic S3 bucket provisioning for PostGraphile v5.
- * When bucket rows are created via GraphQL mutations, this plugin
- * automatically provisions the corresponding S3 bucket with the
- * correct privacy policies, CORS rules, and lifecycle settings.
- *
- * Also provides an explicit `provisionBucket` mutation for manual
- * provisioning or re-provisioning of S3 buckets.
+ * Provides an explicit `provisionBucket` mutation for PostGraphile v5.
  *
  * @example
  * ```typescript
@@ -31,7 +25,6 @@
  *     BucketProvisionerPreset({
  *       connection: getConnection, // pass function ref, NOT getConnection()
  *       allowedOrigins: ['https://app.example.com'],
- *       bucketNamePrefix: 'myapp',
  *     }),
  *   ],
  * };

package/esm/plugin.d.ts

@@ -7,21 +7,7 @@
  *    logical bucket row in the database. Reads the bucket config via RLS,
  *    then calls BucketProvisioner to create and configure the S3 bucket.
  *
- * 2. Auto-provisioning hook — wraps `create*` mutations on tables tagged
- *    with `@storageBuckets` to automatically provision the S3 bucket after
- *    the database row is created.
- *
- * 3. CORS update hook — wraps `update*` mutations on `@storageBuckets` tables
- *    to detect changes to `allowed_origins` and re-apply CORS rules to the
- *    S3 bucket.
- *
- * CORS resolution hierarchy (most specific wins):
- *   1. Bucket-level `allowed_origins` column (per-bucket override)
- *   2. Storage-module-level `allowed_origins` column (per-database default)
- *   3. Plugin config `allowedOrigins` (global fallback)
- * Supports `['*']` for open/CDN mode (wildcard CORS).
- *
- * Both pathways use `@constructive-io/bucket-provisioner` for the actual
+ * This plugin uses `@constructive-io/bucket-provisioner` for the actual
  * S3 operations (bucket creation, Block Public Access, CORS, policies,
  * versioning, lifecycle rules).
  *
@@ -35,16 +21,12 @@ import type { BucketProvisionerPluginOptions } from './types';
 /**
  * Creates the bucket provisioner plugin.
  *
- * This plugin provides two provisioning pathways:
+ * This plugin provides one provisioning pathway:
  *
  * 1. **Explicit `provisionBucket` mutation** — Call this mutation with a
  *    bucket key to provision (or re-provision) the S3 bucket. Protected
  *    by RLS on the buckets table.
  *
- * 2. **Auto-provisioning hook** — When `autoProvision` is true (default),
- *    wraps `create*` mutation resolvers on tables tagged with `@storageBuckets`
- *    to automatically provision the S3 bucket after the row is created.
- *
  * @param options - Plugin configuration (S3 credentials, CORS origins, naming)
  */
 export declare function createBucketProvisionerPlugin(options: BucketProvisionerPluginOptions): GraphileConfig.Plugin;

package/esm/plugin.js

@@ -7,21 +7,7 @@
  *    logical bucket row in the database. Reads the bucket config via RLS,
  *    then calls BucketProvisioner to create and configure the S3 bucket.
  *
- * 2. Auto-provisioning hook — wraps `create*` mutations on tables tagged
- *    with `@storageBuckets` to automatically provision the S3 bucket after
- *    the database row is created.
- *
- * 3. CORS update hook — wraps `update*` mutations on `@storageBuckets` tables
- *    to detect changes to `allowed_origins` and re-apply CORS rules to the
- *    S3 bucket.
- *
- * CORS resolution hierarchy (most specific wins):
- *   1. Bucket-level `allowed_origins` column (per-bucket override)
- *   2. Storage-module-level `allowed_origins` column (per-database default)
- *   3. Plugin config `allowedOrigins` (global fallback)
- * Supports `['*']` for open/CDN mode (wildcard CORS).
- *
- * Both pathways use `@constructive-io/bucket-provisioner` for the actual
+ * This plugin uses `@constructive-io/bucket-provisioner` for the actual
  * S3 operations (bucket creation, Block Public Access, CORS, policies,
  * versioning, lifecycle rules).
  *
@@ -34,33 +20,10 @@ import { BucketProvisioner, } from '@constructive-io/bucket-provisioner';
 import { Logger } from '@pgpmjs/logger';
 import { QuoteUtils } from '@pgsql/quotes';
 import { context as grafastContext, lambda, object } from 'grafast';
+import { recordPhysicalName as recordPhysicalBucketName } from 'graphile-storage-registry';
 import { extendSchema, gql } from 'graphile-utils';
 const log = new Logger('graphile-bucket-provisioner:plugin');
 // --- Storage module queries ---
-/**
- * Resolve the storage module whose buckets table is the one being addressed.
- *
- * The buckets table's identity (schema + table, from the codec being mutated or
- * the module row) is the fact that names the plane — never a scope literal.
- */
-const STORAGE_MODULE_BY_BUCKETS_TABLE_QUERY = `
-  SELECT
-    sm.id,
-    sm.scope,
-    sm.entity_table_id,
-    bs.schema_name AS buckets_schema,
-    bt.name AS buckets_table,
-    sm.endpoint,
-    sm.public_url_prefix,
-    sm.provider,
-    sm.allowed_origins
-  FROM metaschema_modules_public.storage_module sm
-  JOIN metaschema_public.table bt ON bt.id = sm.buckets_table_id
-  JOIN metaschema_public.schema bs ON bs.id = bt.schema_id
-  WHERE sm.database_id = $1
-    AND bs.schema_name = $2
-    AND bt.name = $3
-`;
 /**
  * Resolve ALL storage modules for a database (for bucket-key and ownerId-based
  * resolution in the explicit provisionBucket mutation).
@@ -96,30 +59,6 @@ const ALL_STORAGE_MODULES_QUERY = `
 function runQuery(pgClient, text, values) {
     return pgClient.query(values === undefined ? { text } : { text, values });
 }
-/**
- * Resolve the storage module whose buckets table is the one being addressed.
- *
- * This is the resolution the auto-provision/CORS hooks use: the codec being
- * mutated names its table, and the table names its module. A `@storageBuckets`
- * table with no module row (or with several) is a provisioning bug and throws.
- */
-async function resolveStorageModuleByBucketsTable(pgClient, databaseId, schemaName, tableName) {
-    const result = await runQuery(pgClient, STORAGE_MODULE_BY_BUCKETS_TABLE_QUERY, [
-        databaseId,
-        schemaName,
-        tableName,
-    ]);
-    const rows = result.rows;
-    if (rows.length === 0) {
-        throw new Error(`STORAGE_MODULE_NOT_FOUND: no storage module in database ${databaseId} records ` +
-            `${schemaName}.${tableName} as its buckets table`);
-    }
-    if (rows.length > 1) {
-        throw new Error(`STORAGE_MODULE_AMBIGUOUS: ${rows.length} storage modules in database ${databaseId} record ` +
-            `${schemaName}.${tableName} as their buckets table`);
-    }
-    return rows[0];
-}
 /**
  * The explicit provisionBucket mutation's resolution: find the plane that
  * actually holds the named bucket row.
@@ -185,17 +124,6 @@ async function resolveBucketByKey(pgClient, databaseId, bucketKey, ownerId) {
 function storedPhysicalName(row) {
     return row.physical_name == null ? null : row.physical_name;
 }
-/**
- * Record the physical S3 bucket name on the source bucket row.
- *
- * Runs in the system lane (`withPgClient(null, ...)`) — server bookkeeping,
- * RLS-independent. Idempotent via the `physical_name IS NULL` guard so a
- * re-provision never clobbers an already-recorded coordinate.
- */
-async function recordPhysicalName(withPgClient, bucketsTable, bucketId, physicalName) {
-    await withPgClient(null, (client) => runQuery(client, `UPDATE ${bucketsTable} SET physical_name = $1 WHERE id = $2 AND physical_name IS NULL`, [physicalName, bucketId]));
-    log.info(`Recorded physical_name="${physicalName}" on bucket ${bucketId}`);
-}
 // --- Helpers ---
 /**
  * Resolve the connection config from the options. If the option is a lazy
@@ -213,14 +141,14 @@ function resolveConnection(options) {
 /**
  * Resolve the S3 bucket name from a logical bucket key.
  */
-function resolveBucketName(bucketKey, databaseId, options) {
-    if (options.resolveBucketName) {
-        return options.resolveBucketName(bucketKey, databaseId);
+function resolveBucketName(databaseId, bucketKey, options) {
+    if (!options.resolveBucketName) {
+        throw new Error('STORAGE_BUCKET_NAME_POLICY_MISSING: no resolveBucketName was configured, so there is ' +
+            `no name to provision for bucket "${bucketKey}" of database ${databaseId}. ` +
+            'Physical bucket naming is a deployment policy; the configured s3.bucket is a ' +
+            'connection default and is never a tenant bucket.');
     }
-    if (options.bucketNamePrefix) {
-        return `${options.bucketNamePrefix}-${bucketKey}`;
-    }
-    return bucketKey;
+    return options.resolveBucketName(databaseId, bucketKey);
 }
 /**
  * Resolve the database_id from the JWT context.
@@ -262,8 +190,7 @@ function buildProvisioner(options, storageModule, effectiveOrigins) {
     });
 }
 /**
- * Core provisioning logic shared by both the explicit mutation and the
- * auto-provisioning hook.
+ * Core provisioning logic for the explicit mutation.
  */
 async function provisionBucketForRow(storageModule, databaseId, bucketKey, bucketType, bucketAllowedOrigins, options, s3BucketName) {
     const accessType = bucketType;
@@ -283,40 +210,19 @@ async function provisionBucketForRow(storageModule, databaseId, bucketKey, bucke
         `(provider=${result.provider}, blockPublicAccess=${result.blockPublicAccess})`);
     return result;
 }
-/**
- * Update CORS on an existing S3 bucket when allowed_origins changes.
- */
-async function updateBucketCors(storageModule, databaseId, bucketKey, bucketType, bucketAllowedOrigins, options, s3BucketName) {
-    const accessType = bucketType;
-    const effectiveOrigins = resolveAllowedOrigins(bucketAllowedOrigins, storageModule?.allowed_origins, options.allowedOrigins);
-    const provisioner = buildProvisioner(options, storageModule, effectiveOrigins);
-    log.info(`Updating CORS on S3 bucket "${s3BucketName}" ` +
-        `(origins=${JSON.stringify(effectiveOrigins)}) for database ${databaseId}`);
-    await provisioner.updateCors({
-        bucketName: s3BucketName,
-        accessType,
-        allowedOrigins: effectiveOrigins,
-    });
-    log.info(`Successfully updated CORS on S3 bucket "${s3BucketName}"`);
-}
 // --- Plugin factory ---
 /**
  * Creates the bucket provisioner plugin.
  *
- * This plugin provides two provisioning pathways:
+ * This plugin provides one provisioning pathway:
  *
  * 1. **Explicit `provisionBucket` mutation** — Call this mutation with a
  *    bucket key to provision (or re-provision) the S3 bucket. Protected
  *    by RLS on the buckets table.
  *
- * 2. **Auto-provisioning hook** — When `autoProvision` is true (default),
- *    wraps `create*` mutation resolvers on tables tagged with `@storageBuckets`
- *    to automatically provision the S3 bucket after the row is created.
- *
  * @param options - Plugin configuration (S3 credentials, CORS origins, naming)
  */
 export function createBucketProvisionerPlugin(options) {
-    const autoProvision = options.autoProvision ?? true;
     // The extendSchema plugin adds the explicit provisionBucket mutation
     const mutationPlugin = extendSchema(() => ({
         typeDefs: gql `
@@ -391,12 +297,13 @@ export function createBucketProvisionerPlugin(options) {
                             // is authoritative and the naming hook is never consulted again.
                             const recorded = storedPhysicalName(bucket);
                             const s3BucketName = recorded === null
-                                ? resolveBucketName(bucket.key, databaseId, options)
+                                ? resolveBucketName(databaseId, bucket.key, options)
                                 : recorded;
                             try {
                                 const result = await provisionBucketForRow(storageModule, databaseId, bucket.key, bucket.type, bucket.allowed_origins, options, s3BucketName);
                                 // Record the exact provisioned name on the source row.
-                                await recordPhysicalName(withPgClient, bucketsTable, bucket.id, result.bucketName);
+                                await withPgClient(null, (client) => recordPhysicalBucketName((query) => runQuery(client, query.text, query.values), bucketsTable, bucket.id, result.bucketName));
+                                log.info(`Recorded physical_name="${result.bucketName}" on bucket ${bucket.id}`);
                                 return {
                                     success: true,
                                     bucketName: result.bucketName,
@@ -423,165 +330,7 @@ export function createBucketProvisionerPlugin(options) {
             },
         },
     }));
-    // If autoProvision is disabled, return only the mutation plugin
-    if (!autoProvision) {
-        return mutationPlugin;
-    }
-    // Build a composite plugin that includes both the mutation and the hook
-    return {
-        ...mutationPlugin,
-        name: 'BucketProvisionerPlugin',
-        version: '0.1.0',
-        description: 'Auto-provisions S3 buckets when bucket rows are created, ' +
-            'updates CORS when allowed_origins changes on update, ' +
-            'and provides a provisionBucket mutation for explicit provisioning',
-        after: ['PgAttributesPlugin', 'PgMutationCreatePlugin', 'PgMutationUpdateDeletePlugin'],
-        schema: {
-            ...mutationPlugin.schema,
-            hooks: {
-                ...(mutationPlugin.schema?.hooks ?? {}),
-                /**
-                 * Wrap create and update mutation resolvers on tables tagged with @storageBuckets.
-                 *
-                 * - create*: After the row is created, provision the S3 bucket.
-                 * - update*: After the row is updated, re-apply CORS if allowed_origins changed.
-                 *
-                 * If provisioning/CORS update fails, the DB row still exists (the mutation
-                 * already committed), and the error is logged. Admin can retry via provisionBucket.
-                 */
-                GraphQLObjectType_fields_field(field, build, context) {
-                    const { scope: { isRootMutation, fieldName, pgCodec }, } = context;
-                    // Only wrap root mutation fields
-                    if (!isRootMutation || !pgCodec || !pgCodec.attributes) {
-                        return field;
-                    }
-                    // Check for @storageBuckets smart tag
-                    const tags = pgCodec.extensions?.tags;
-                    if (!tags?.storageBuckets) {
-                        return field;
-                    }
-                    const isCreate = fieldName.startsWith('create');
-                    const isUpdate = fieldName.startsWith('update');
-                    // Only wrap create and update mutations (not delete)
-                    if (!isCreate && !isUpdate) {
-                        return field;
-                    }
-                    log.debug(`Wrapping mutation "${fieldName}" for ${isCreate ? 'auto-provisioning' : 'CORS update'} (codec: ${pgCodec.name})`);
-                    // The codec being mutated names the buckets table — the hook always
-                    // operates on the plane that table belongs to, never a guessed scope.
-                    const codecSchemaName = pgCodec.extensions?.pg?.schemaName;
-                    const codecTableName = pgCodec.extensions?.pg?.name;
-                    const defaultResolver = (obj) => obj[fieldName];
-                    const { resolve: oldResolve = defaultResolver, ...rest } = field;
-                    return {
-                        ...rest,
-                        async resolve(source, args, graphqlContext, info) {
-                            // Call the original resolver first (creates/updates the DB row)
-                            const result = await oldResolve(source, args, graphqlContext, info);
-                            try {
-                                const inputKey = Object.keys(args.input || {}).find((k) => k !== 'clientMutationId');
-                                const bucketInput = inputKey ? args.input[inputKey] : null;
-                                const withPgClient = graphqlContext.withPgClient;
-                                const pgSettings = graphqlContext.pgSettings;
-                                if (!withPgClient) {
-                                    log.warn(`${isCreate ? 'Auto-provision' : 'CORS update'} skipped: withPgClient not available in context`);
-                                    return result;
-                                }
-                                if (isCreate) {
-                                    // --- CREATE: full provisioning ---
-                                    if (!bucketInput?.key || !bucketInput?.type) {
-                                        log.warn(`Auto-provision skipped for "${fieldName}": ` +
-                                            `could not extract key/type from mutation input`);
-                                        return result;
-                                    }
-                                    if (!codecSchemaName || !codecTableName) {
-                                        throw new Error(`Auto-provision failed for "${fieldName}": codec ${pgCodec.name} carries no pg schema/table identity`);
-                                    }
-                                    await withPgClient(pgSettings, async (pgClient) => {
-                                        const databaseId = await resolveDatabaseId(pgClient);
-                                        if (!databaseId) {
-                                            log.warn('Auto-provision skipped: could not resolve database_id');
-                                            return;
-                                        }
-                                        // The mutated table names its module — the plane being written
-                                        // is the plane that gets provisioned.
-                                        const storageModule = await resolveStorageModuleByBucketsTable(pgClient, databaseId, codecSchemaName, codecTableName);
-                                        // Newly-created row has no stored coordinate yet — mint on first provision.
-                                        const result = await provisionBucketForRow(storageModule, databaseId, bucketInput.key, bucketInput.type, bucketInput.allowedOrigins ?? bucketInput.allowed_origins ?? null, options, resolveBucketName(bucketInput.key, databaseId, options));
-                                        // Record the provisioned name on the just-created row.
-                                        const bucketsTable = QuoteUtils.quoteQualifiedIdentifier(storageModule.buckets_schema, storageModule.buckets_table);
-                                        const ownerId = bucketInput.ownerId ?? bucketInput.owner_id ?? null;
-                                        const idResult = await runQuery(pgClient, ownerId
-                                            ? `SELECT id FROM ${bucketsTable} WHERE key = $1 AND owner_id = $2 LIMIT 1`
-                                            : `SELECT id FROM ${bucketsTable} WHERE key = $1 LIMIT 1`, ownerId ? [bucketInput.key, ownerId] : [bucketInput.key]);
-                                        const bucketId = idResult.rows[0]?.id;
-                                        if (bucketId)
-                                            await recordPhysicalName(withPgClient, bucketsTable, bucketId, result.bucketName);
-                                    });
-                                }
-                                else {
-                                    // --- UPDATE: re-apply CORS if allowed_origins is in the patch ---
-                                    const hasOriginsUpdate = bucketInput &&
-                                        ('allowedOrigins' in bucketInput || 'allowed_origins' in bucketInput);
-                                    if (!hasOriginsUpdate) {
-                                        // allowed_origins not being changed, nothing to do
-                                        return result;
-                                    }
-                                    if (!codecSchemaName || !codecTableName) {
-                                        throw new Error(`CORS update failed for "${fieldName}": codec ${pgCodec.name} carries no pg schema/table identity`);
-                                    }
-                                    await withPgClient(pgSettings, async (pgClient) => {
-                                        const databaseId = await resolveDatabaseId(pgClient);
-                                        if (!databaseId) {
-                                            log.warn('CORS update skipped: could not resolve database_id');
-                                            return;
-                                        }
-                                        // The mutated table names its module — CORS applies to the
-                                        // plane whose row was updated.
-                                        const storageModule = await resolveStorageModuleByBucketsTable(pgClient, databaseId, codecSchemaName, codecTableName);
-                                        // We need the bucket key — it may come from input or patch
-                                        // For updates, PostGraphile uses nodeId or the row's PK, so
-                                        // we read the bucket from the patch's key or from the nodeId
-                                        const patchKey = bucketInput?.key;
-                                        if (!patchKey) {
-                                            log.warn(`CORS update skipped for "${fieldName}": ` +
-                                                `could not determine bucket key from mutation input`);
-                                            return;
-                                        }
-                                        // Read the full bucket row (post-update) to get type + origins
-                                        const bucketsTable = QuoteUtils.quoteQualifiedIdentifier(storageModule.buckets_schema, storageModule.buckets_table);
-                                        const bucketResult = await runQuery(pgClient, `SELECT id, key, type, is_public, allowed_origins, physical_name
-                       FROM ${bucketsTable}
-                       WHERE key = $1
-                       LIMIT 1`, [patchKey]);
-                                        if (bucketResult.rows.length === 0) {
-                                            log.warn(`CORS update skipped: bucket "${patchKey}" not found`);
-                                            return;
-                                        }
-                                        const bucket = bucketResult.rows[0];
-                                        // CORS applies to the recorded physical bucket; if the row was
-                                        // never provisioned there is nothing to update yet, so mint the
-                                        // conventional name the first provision would use.
-                                        const recorded = storedPhysicalName(bucket);
-                                        await updateBucketCors(storageModule, databaseId, bucket.key, bucket.type, bucket.allowed_origins, options, recorded === null
-                                            ? resolveBucketName(bucket.key, databaseId, options)
-                                            : recorded);
-                                    });
-                                }
-                            }
-                            catch (err) {
-                                log.error(`${isCreate ? 'Auto-provision' : 'CORS update'} failed for "${fieldName}": ${err.message}. ` +
-                                    (isCreate
-                                        ? `The bucket row was created but the S3 bucket was not provisioned. Use the provisionBucket mutation to retry.`
-                                        : `The bucket row was updated but CORS was not applied to the S3 bucket. Use the provisionBucket mutation to retry.`));
-                            }
-                            return result;
-                        },
-                    };
-                },
-            },
-        },
-    };
+    return mutationPlugin;
 }
 export const BucketProvisionerPlugin = createBucketProvisionerPlugin;
 export default BucketProvisionerPlugin;

package/esm/preset.d.ts

@@ -31,7 +31,6 @@ import type { BucketProvisionerPluginOptions } from './types';
  *     BucketProvisionerPreset({
  *       connection: getConnection, // pass function ref, NOT getConnection()
  *       allowedOrigins: ['https://app.example.com'],
- *       bucketNamePrefix: 'myapp',
  *     }),
  *   ],
  * };

package/esm/preset.js

@@ -30,7 +30,6 @@ import { createBucketProvisionerPlugin } from './plugin';
  *     BucketProvisionerPreset({
  *       connection: getConnection, // pass function ref, NOT getConnection()
  *       allowedOrigins: ['https://app.example.com'],
- *       bucketNamePrefix: 'myapp',
  *     }),
  *   ],
  * };

package/esm/types.d.ts

@@ -1,9 +1,5 @@
 /**
  * Types for the bucket provisioner plugin.
- *
- * Defines plugin options, connection configuration, and provisioning result
- * types used by the Graphile plugin to auto-provision S3 buckets when
- * bucket rows are created via GraphQL mutations.
  */
 import type { BucketAccessType, ProvisionResult, StorageConnectionConfig, StorageProvider } from '@constructive-io/bucket-provisioner';
 export type { BucketAccessType, ProvisionResult, StorageConnectionConfig, StorageProvider };
@@ -18,11 +14,11 @@ export type ConnectionConfigOrGetter = StorageConnectionConfig | (() => StorageC
 /**
  * Function to derive the actual S3 bucket name from a logical bucket key.
  *
- * @param bucketKey - The logical bucket key from the database (e.g., "public", "private")
  * @param databaseId - The metaschema database UUID
+ * @param bucketKey - The logical bucket key from the database (e.g., "public", "private")
  * @returns The S3 bucket name to create/configure
  */
-export type BucketNameResolver = (bucketKey: string, databaseId: string) => string;
+export type BucketNameResolver = (databaseId: string, bucketKey: string) => string;
 /**
  * Plugin options for the bucket provisioner plugin.
  */
@@ -38,15 +34,9 @@ export interface BucketProvisionerPluginOptions {
      * Required for browser-based presigned URL uploads.
      */
     allowedOrigins: string[];
-    /**
-     * Optional prefix for S3 bucket names.
-     * When set, the S3 bucket name becomes `{prefix}-{bucketKey}`.
-     * Example: prefix "myapp" + key "public" → S3 bucket "myapp-public"
-     */
-    bucketNamePrefix?: string;
     /**
      * Optional custom function to derive S3 bucket names from logical bucket keys.
-     * Takes precedence over `bucketNamePrefix` when provided.
+     * Naming is a deployment policy and must be supplied by the caller.
      */
     resolveBucketName?: BucketNameResolver;
     /**
@@ -54,15 +44,6 @@ export interface BucketProvisionerPluginOptions {
      * Default: false
      */
     versioning?: boolean;
-    /**
-     * Whether to auto-provision S3 buckets when bucket rows are created
-     * via GraphQL mutations. When true, the plugin wraps create mutations
-     * on tables tagged with `@storageBuckets` to trigger provisioning
-     * after the mutation succeeds.
-     *
-     * Default: true
-     */
-    autoProvision?: boolean;
 }
 /**
  * Input for the provisionBucket mutation.

package/esm/types.js

@@ -1,8 +1,4 @@
 /**
  * Types for the bucket provisioner plugin.
- *
- * Defines plugin options, connection configuration, and provisioning result
- * types used by the Graphile plugin to auto-provision S3 buckets when
- * bucket rows are created via GraphQL mutations.
  */
 export {};

package/index.d.ts

@@ -1,13 +1,7 @@
 /**
  * Bucket Provisioner Plugin for PostGraphile v5
  *
- * Provides automatic S3 bucket provisioning for PostGraphile v5.
- * When bucket rows are created via GraphQL mutations, this plugin
- * automatically provisions the corresponding S3 bucket with the
- * correct privacy policies, CORS rules, and lifecycle settings.
- *
- * Also provides an explicit `provisionBucket` mutation for manual
- * provisioning or re-provisioning of S3 buckets.
+ * Provides an explicit `provisionBucket` mutation for PostGraphile v5.
  *
  * @example
  * ```typescript
@@ -31,7 +25,6 @@
  *     BucketProvisionerPreset({
  *       connection: getConnection, // pass function ref, NOT getConnection()
  *       allowedOrigins: ['https://app.example.com'],
- *       bucketNamePrefix: 'myapp',
  *     }),
  *   ],
  * };

package/index.js

@@ -2,13 +2,7 @@
 /**
  * Bucket Provisioner Plugin for PostGraphile v5
  *
- * Provides automatic S3 bucket provisioning for PostGraphile v5.
- * When bucket rows are created via GraphQL mutations, this plugin
- * automatically provisions the corresponding S3 bucket with the
- * correct privacy policies, CORS rules, and lifecycle settings.
- *
- * Also provides an explicit `provisionBucket` mutation for manual
- * provisioning or re-provisioning of S3 buckets.
+ * Provides an explicit `provisionBucket` mutation for PostGraphile v5.
  *
  * @example
  * ```typescript
@@ -32,7 +26,6 @@
  *     BucketProvisionerPreset({
  *       connection: getConnection, // pass function ref, NOT getConnection()
  *       allowedOrigins: ['https://app.example.com'],
- *       bucketNamePrefix: 'myapp',
  *     }),
  *   ],
  * };

package/package.json

@@ -1,7 +1,7 @@
 {
   "name": "graphile-bucket-provisioner-plugin",
-  "version": "1.14.0",
-  "description": "Bucket provisioning plugin for PostGraphile v5 — auto-provisions S3 buckets on bucket table mutations",
+  "version": "1.14.1",
+  "description": "Bucket provisioning plugin for PostGraphile v5 — explicitly provisions S3 buckets via a GraphQL mutation",
   "author": "Constructive <developers@constructive.io>",
   "homepage": "https://github.com/constructive-io/constructive",
   "license": "MIT",
@@ -40,9 +40,10 @@
     "url": "https://github.com/constructive-io/constructive/issues"
   },
   "dependencies": {
-    "@constructive-io/bucket-provisioner": "^0.25.0",
+    "@constructive-io/bucket-provisioner": "^0.25.1",
     "@pgpmjs/logger": "^2.25.0",
-    "@pgsql/quotes": "^18.2.4"
+    "@pgsql/quotes": "^18.2.4",
+    "graphile-storage-registry": "^0.1.1"
   },
   "peerDependencies": {
     "grafast": "^1.1.1",
@@ -57,5 +58,5 @@
     "@types/node": "^22.19.11",
     "makage": "^0.3.0"
   },
-  "gitHead": "d10fe91ede80a4c2dfe2c1c6dcf6fe7193784eba"
+  "gitHead": "7e6cc68f5659d12ec852835a7d8fcca6b05a8f50"
 }

package/plugin.d.ts

@@ -7,21 +7,7 @@
  *    logical bucket row in the database. Reads the bucket config via RLS,
  *    then calls BucketProvisioner to create and configure the S3 bucket.
  *
- * 2. Auto-provisioning hook — wraps `create*` mutations on tables tagged
- *    with `@storageBuckets` to automatically provision the S3 bucket after
- *    the database row is created.
- *
- * 3. CORS update hook — wraps `update*` mutations on `@storageBuckets` tables
- *    to detect changes to `allowed_origins` and re-apply CORS rules to the
- *    S3 bucket.
- *
- * CORS resolution hierarchy (most specific wins):
- *   1. Bucket-level `allowed_origins` column (per-bucket override)
- *   2. Storage-module-level `allowed_origins` column (per-database default)
- *   3. Plugin config `allowedOrigins` (global fallback)
- * Supports `['*']` for open/CDN mode (wildcard CORS).
- *
- * Both pathways use `@constructive-io/bucket-provisioner` for the actual
+ * This plugin uses `@constructive-io/bucket-provisioner` for the actual
  * S3 operations (bucket creation, Block Public Access, CORS, policies,
  * versioning, lifecycle rules).
  *
@@ -35,16 +21,12 @@ import type { BucketProvisionerPluginOptions } from './types';
 /**
  * Creates the bucket provisioner plugin.
  *
- * This plugin provides two provisioning pathways:
+ * This plugin provides one provisioning pathway:
  *
  * 1. **Explicit `provisionBucket` mutation** — Call this mutation with a
  *    bucket key to provision (or re-provision) the S3 bucket. Protected
  *    by RLS on the buckets table.
  *
- * 2. **Auto-provisioning hook** — When `autoProvision` is true (default),
- *    wraps `create*` mutation resolvers on tables tagged with `@storageBuckets`
- *    to automatically provision the S3 bucket after the row is created.
- *
  * @param options - Plugin configuration (S3 credentials, CORS origins, naming)
  */
 export declare function createBucketProvisionerPlugin(options: BucketProvisionerPluginOptions): GraphileConfig.Plugin;

package/plugin.js

@@ -8,21 +8,7 @@
  *    logical bucket row in the database. Reads the bucket config via RLS,
  *    then calls BucketProvisioner to create and configure the S3 bucket.
  *
- * 2. Auto-provisioning hook — wraps `create*` mutations on tables tagged
- *    with `@storageBuckets` to automatically provision the S3 bucket after
- *    the database row is created.
- *
- * 3. CORS update hook — wraps `update*` mutations on `@storageBuckets` tables
- *    to detect changes to `allowed_origins` and re-apply CORS rules to the
- *    S3 bucket.
- *
- * CORS resolution hierarchy (most specific wins):
- *   1. Bucket-level `allowed_origins` column (per-bucket override)
- *   2. Storage-module-level `allowed_origins` column (per-database default)
- *   3. Plugin config `allowedOrigins` (global fallback)
- * Supports `['*']` for open/CDN mode (wildcard CORS).
- *
- * Both pathways use `@constructive-io/bucket-provisioner` for the actual
+ * This plugin uses `@constructive-io/bucket-provisioner` for the actual
  * S3 operations (bucket creation, Block Public Access, CORS, policies,
  * versioning, lifecycle rules).
  *
@@ -38,33 +24,10 @@ const bucket_provisioner_1 = require("@constructive-io/bucket-provisioner");
 const logger_1 = require("@pgpmjs/logger");
 const quotes_1 = require("@pgsql/quotes");
 const grafast_1 = require("grafast");
+const graphile_storage_registry_1 = require("graphile-storage-registry");
 const graphile_utils_1 = require("graphile-utils");
 const log = new logger_1.Logger('graphile-bucket-provisioner:plugin');
 // --- Storage module queries ---
-/**
- * Resolve the storage module whose buckets table is the one being addressed.
- *
- * The buckets table's identity (schema + table, from the codec being mutated or
- * the module row) is the fact that names the plane — never a scope literal.
- */
-const STORAGE_MODULE_BY_BUCKETS_TABLE_QUERY = `
-  SELECT
-    sm.id,
-    sm.scope,
-    sm.entity_table_id,
-    bs.schema_name AS buckets_schema,
-    bt.name AS buckets_table,
-    sm.endpoint,
-    sm.public_url_prefix,
-    sm.provider,
-    sm.allowed_origins
-  FROM metaschema_modules_public.storage_module sm
-  JOIN metaschema_public.table bt ON bt.id = sm.buckets_table_id
-  JOIN metaschema_public.schema bs ON bs.id = bt.schema_id
-  WHERE sm.database_id = $1
-    AND bs.schema_name = $2
-    AND bt.name = $3
-`;
 /**
  * Resolve ALL storage modules for a database (for bucket-key and ownerId-based
  * resolution in the explicit provisionBucket mutation).
@@ -100,30 +63,6 @@ const ALL_STORAGE_MODULES_QUERY = `
 function runQuery(pgClient, text, values) {
     return pgClient.query(values === undefined ? { text } : { text, values });
 }
-/**
- * Resolve the storage module whose buckets table is the one being addressed.
- *
- * This is the resolution the auto-provision/CORS hooks use: the codec being
- * mutated names its table, and the table names its module. A `@storageBuckets`
- * table with no module row (or with several) is a provisioning bug and throws.
- */
-async function resolveStorageModuleByBucketsTable(pgClient, databaseId, schemaName, tableName) {
-    const result = await runQuery(pgClient, STORAGE_MODULE_BY_BUCKETS_TABLE_QUERY, [
-        databaseId,
-        schemaName,
-        tableName,
-    ]);
-    const rows = result.rows;
-    if (rows.length === 0) {
-        throw new Error(`STORAGE_MODULE_NOT_FOUND: no storage module in database ${databaseId} records ` +
-            `${schemaName}.${tableName} as its buckets table`);
-    }
-    if (rows.length > 1) {
-        throw new Error(`STORAGE_MODULE_AMBIGUOUS: ${rows.length} storage modules in database ${databaseId} record ` +
-            `${schemaName}.${tableName} as their buckets table`);
-    }
-    return rows[0];
-}
 /**
  * The explicit provisionBucket mutation's resolution: find the plane that
  * actually holds the named bucket row.
@@ -189,17 +128,6 @@ async function resolveBucketByKey(pgClient, databaseId, bucketKey, ownerId) {
 function storedPhysicalName(row) {
     return row.physical_name == null ? null : row.physical_name;
 }
-/**
- * Record the physical S3 bucket name on the source bucket row.
- *
- * Runs in the system lane (`withPgClient(null, ...)`) — server bookkeeping,
- * RLS-independent. Idempotent via the `physical_name IS NULL` guard so a
- * re-provision never clobbers an already-recorded coordinate.
- */
-async function recordPhysicalName(withPgClient, bucketsTable, bucketId, physicalName) {
-    await withPgClient(null, (client) => runQuery(client, `UPDATE ${bucketsTable} SET physical_name = $1 WHERE id = $2 AND physical_name IS NULL`, [physicalName, bucketId]));
-    log.info(`Recorded physical_name="${physicalName}" on bucket ${bucketId}`);
-}
 // --- Helpers ---
 /**
  * Resolve the connection config from the options. If the option is a lazy
@@ -217,14 +145,14 @@ function resolveConnection(options) {
 /**
  * Resolve the S3 bucket name from a logical bucket key.
  */
-function resolveBucketName(bucketKey, databaseId, options) {
-    if (options.resolveBucketName) {
-        return options.resolveBucketName(bucketKey, databaseId);
+function resolveBucketName(databaseId, bucketKey, options) {
+    if (!options.resolveBucketName) {
+        throw new Error('STORAGE_BUCKET_NAME_POLICY_MISSING: no resolveBucketName was configured, so there is ' +
+            `no name to provision for bucket "${bucketKey}" of database ${databaseId}. ` +
+            'Physical bucket naming is a deployment policy; the configured s3.bucket is a ' +
+            'connection default and is never a tenant bucket.');
     }
-    if (options.bucketNamePrefix) {
-        return `${options.bucketNamePrefix}-${bucketKey}`;
-    }
-    return bucketKey;
+    return options.resolveBucketName(databaseId, bucketKey);
 }
 /**
  * Resolve the database_id from the JWT context.
@@ -266,8 +194,7 @@ function buildProvisioner(options, storageModule, effectiveOrigins) {
     });
 }
 /**
- * Core provisioning logic shared by both the explicit mutation and the
- * auto-provisioning hook.
+ * Core provisioning logic for the explicit mutation.
  */
 async function provisionBucketForRow(storageModule, databaseId, bucketKey, bucketType, bucketAllowedOrigins, options, s3BucketName) {
     const accessType = bucketType;
@@ -287,40 +214,19 @@ async function provisionBucketForRow(storageModule, databaseId, bucketKey, bucke
         `(provider=${result.provider}, blockPublicAccess=${result.blockPublicAccess})`);
     return result;
 }
-/**
- * Update CORS on an existing S3 bucket when allowed_origins changes.
- */
-async function updateBucketCors(storageModule, databaseId, bucketKey, bucketType, bucketAllowedOrigins, options, s3BucketName) {
-    const accessType = bucketType;
-    const effectiveOrigins = resolveAllowedOrigins(bucketAllowedOrigins, storageModule?.allowed_origins, options.allowedOrigins);
-    const provisioner = buildProvisioner(options, storageModule, effectiveOrigins);
-    log.info(`Updating CORS on S3 bucket "${s3BucketName}" ` +
-        `(origins=${JSON.stringify(effectiveOrigins)}) for database ${databaseId}`);
-    await provisioner.updateCors({
-        bucketName: s3BucketName,
-        accessType,
-        allowedOrigins: effectiveOrigins,
-    });
-    log.info(`Successfully updated CORS on S3 bucket "${s3BucketName}"`);
-}
 // --- Plugin factory ---
 /**
  * Creates the bucket provisioner plugin.
  *
- * This plugin provides two provisioning pathways:
+ * This plugin provides one provisioning pathway:
  *
  * 1. **Explicit `provisionBucket` mutation** — Call this mutation with a
  *    bucket key to provision (or re-provision) the S3 bucket. Protected
  *    by RLS on the buckets table.
  *
- * 2. **Auto-provisioning hook** — When `autoProvision` is true (default),
- *    wraps `create*` mutation resolvers on tables tagged with `@storageBuckets`
- *    to automatically provision the S3 bucket after the row is created.
- *
  * @param options - Plugin configuration (S3 credentials, CORS origins, naming)
  */
 function createBucketProvisionerPlugin(options) {
-    const autoProvision = options.autoProvision ?? true;
     // The extendSchema plugin adds the explicit provisionBucket mutation
     const mutationPlugin = (0, graphile_utils_1.extendSchema)(() => ({
         typeDefs: (0, graphile_utils_1.gql) `
@@ -395,12 +301,13 @@ function createBucketProvisionerPlugin(options) {
                             // is authoritative and the naming hook is never consulted again.
                             const recorded = storedPhysicalName(bucket);
                             const s3BucketName = recorded === null
-                                ? resolveBucketName(bucket.key, databaseId, options)
+                                ? resolveBucketName(databaseId, bucket.key, options)
                                 : recorded;
                             try {
                                 const result = await provisionBucketForRow(storageModule, databaseId, bucket.key, bucket.type, bucket.allowed_origins, options, s3BucketName);
                                 // Record the exact provisioned name on the source row.
-                                await recordPhysicalName(withPgClient, bucketsTable, bucket.id, result.bucketName);
+                                await withPgClient(null, (client) => (0, graphile_storage_registry_1.recordPhysicalName)((query) => runQuery(client, query.text, query.values), bucketsTable, bucket.id, result.bucketName));
+                                log.info(`Recorded physical_name="${result.bucketName}" on bucket ${bucket.id}`);
                                 return {
                                     success: true,
                                     bucketName: result.bucketName,
@@ -427,165 +334,7 @@ function createBucketProvisionerPlugin(options) {
             },
         },
     }));
-    // If autoProvision is disabled, return only the mutation plugin
-    if (!autoProvision) {
-        return mutationPlugin;
-    }
-    // Build a composite plugin that includes both the mutation and the hook
-    return {
-        ...mutationPlugin,
-        name: 'BucketProvisionerPlugin',
-        version: '0.1.0',
-        description: 'Auto-provisions S3 buckets when bucket rows are created, ' +
-            'updates CORS when allowed_origins changes on update, ' +
-            'and provides a provisionBucket mutation for explicit provisioning',
-        after: ['PgAttributesPlugin', 'PgMutationCreatePlugin', 'PgMutationUpdateDeletePlugin'],
-        schema: {
-            ...mutationPlugin.schema,
-            hooks: {
-                ...(mutationPlugin.schema?.hooks ?? {}),
-                /**
-                 * Wrap create and update mutation resolvers on tables tagged with @storageBuckets.
-                 *
-                 * - create*: After the row is created, provision the S3 bucket.
-                 * - update*: After the row is updated, re-apply CORS if allowed_origins changed.
-                 *
-                 * If provisioning/CORS update fails, the DB row still exists (the mutation
-                 * already committed), and the error is logged. Admin can retry via provisionBucket.
-                 */
-                GraphQLObjectType_fields_field(field, build, context) {
-                    const { scope: { isRootMutation, fieldName, pgCodec }, } = context;
-                    // Only wrap root mutation fields
-                    if (!isRootMutation || !pgCodec || !pgCodec.attributes) {
-                        return field;
-                    }
-                    // Check for @storageBuckets smart tag
-                    const tags = pgCodec.extensions?.tags;
-                    if (!tags?.storageBuckets) {
-                        return field;
-                    }
-                    const isCreate = fieldName.startsWith('create');
-                    const isUpdate = fieldName.startsWith('update');
-                    // Only wrap create and update mutations (not delete)
-                    if (!isCreate && !isUpdate) {
-                        return field;
-                    }
-                    log.debug(`Wrapping mutation "${fieldName}" for ${isCreate ? 'auto-provisioning' : 'CORS update'} (codec: ${pgCodec.name})`);
-                    // The codec being mutated names the buckets table — the hook always
-                    // operates on the plane that table belongs to, never a guessed scope.
-                    const codecSchemaName = pgCodec.extensions?.pg?.schemaName;
-                    const codecTableName = pgCodec.extensions?.pg?.name;
-                    const defaultResolver = (obj) => obj[fieldName];
-                    const { resolve: oldResolve = defaultResolver, ...rest } = field;
-                    return {
-                        ...rest,
-                        async resolve(source, args, graphqlContext, info) {
-                            // Call the original resolver first (creates/updates the DB row)
-                            const result = await oldResolve(source, args, graphqlContext, info);
-                            try {
-                                const inputKey = Object.keys(args.input || {}).find((k) => k !== 'clientMutationId');
-                                const bucketInput = inputKey ? args.input[inputKey] : null;
-                                const withPgClient = graphqlContext.withPgClient;
-                                const pgSettings = graphqlContext.pgSettings;
-                                if (!withPgClient) {
-                                    log.warn(`${isCreate ? 'Auto-provision' : 'CORS update'} skipped: withPgClient not available in context`);
-                                    return result;
-                                }
-                                if (isCreate) {
-                                    // --- CREATE: full provisioning ---
-                                    if (!bucketInput?.key || !bucketInput?.type) {
-                                        log.warn(`Auto-provision skipped for "${fieldName}": ` +
-                                            `could not extract key/type from mutation input`);
-                                        return result;
-                                    }
-                                    if (!codecSchemaName || !codecTableName) {
-                                        throw new Error(`Auto-provision failed for "${fieldName}": codec ${pgCodec.name} carries no pg schema/table identity`);
-                                    }
-                                    await withPgClient(pgSettings, async (pgClient) => {
-                                        const databaseId = await resolveDatabaseId(pgClient);
-                                        if (!databaseId) {
-                                            log.warn('Auto-provision skipped: could not resolve database_id');
-                                            return;
-                                        }
-                                        // The mutated table names its module — the plane being written
-                                        // is the plane that gets provisioned.
-                                        const storageModule = await resolveStorageModuleByBucketsTable(pgClient, databaseId, codecSchemaName, codecTableName);
-                                        // Newly-created row has no stored coordinate yet — mint on first provision.
-                                        const result = await provisionBucketForRow(storageModule, databaseId, bucketInput.key, bucketInput.type, bucketInput.allowedOrigins ?? bucketInput.allowed_origins ?? null, options, resolveBucketName(bucketInput.key, databaseId, options));
-                                        // Record the provisioned name on the just-created row.
-                                        const bucketsTable = quotes_1.QuoteUtils.quoteQualifiedIdentifier(storageModule.buckets_schema, storageModule.buckets_table);
-                                        const ownerId = bucketInput.ownerId ?? bucketInput.owner_id ?? null;
-                                        const idResult = await runQuery(pgClient, ownerId
-                                            ? `SELECT id FROM ${bucketsTable} WHERE key = $1 AND owner_id = $2 LIMIT 1`
-                                            : `SELECT id FROM ${bucketsTable} WHERE key = $1 LIMIT 1`, ownerId ? [bucketInput.key, ownerId] : [bucketInput.key]);
-                                        const bucketId = idResult.rows[0]?.id;
-                                        if (bucketId)
-                                            await recordPhysicalName(withPgClient, bucketsTable, bucketId, result.bucketName);
-                                    });
-                                }
-                                else {
-                                    // --- UPDATE: re-apply CORS if allowed_origins is in the patch ---
-                                    const hasOriginsUpdate = bucketInput &&
-                                        ('allowedOrigins' in bucketInput || 'allowed_origins' in bucketInput);
-                                    if (!hasOriginsUpdate) {
-                                        // allowed_origins not being changed, nothing to do
-                                        return result;
-                                    }
-                                    if (!codecSchemaName || !codecTableName) {
-                                        throw new Error(`CORS update failed for "${fieldName}": codec ${pgCodec.name} carries no pg schema/table identity`);
-                                    }
-                                    await withPgClient(pgSettings, async (pgClient) => {
-                                        const databaseId = await resolveDatabaseId(pgClient);
-                                        if (!databaseId) {
-                                            log.warn('CORS update skipped: could not resolve database_id');
-                                            return;
-                                        }
-                                        // The mutated table names its module — CORS applies to the
-                                        // plane whose row was updated.
-                                        const storageModule = await resolveStorageModuleByBucketsTable(pgClient, databaseId, codecSchemaName, codecTableName);
-                                        // We need the bucket key — it may come from input or patch
-                                        // For updates, PostGraphile uses nodeId or the row's PK, so
-                                        // we read the bucket from the patch's key or from the nodeId
-                                        const patchKey = bucketInput?.key;
-                                        if (!patchKey) {
-                                            log.warn(`CORS update skipped for "${fieldName}": ` +
-                                                `could not determine bucket key from mutation input`);
-                                            return;
-                                        }
-                                        // Read the full bucket row (post-update) to get type + origins
-                                        const bucketsTable = quotes_1.QuoteUtils.quoteQualifiedIdentifier(storageModule.buckets_schema, storageModule.buckets_table);
-                                        const bucketResult = await runQuery(pgClient, `SELECT id, key, type, is_public, allowed_origins, physical_name
-                       FROM ${bucketsTable}
-                       WHERE key = $1
-                       LIMIT 1`, [patchKey]);
-                                        if (bucketResult.rows.length === 0) {
-                                            log.warn(`CORS update skipped: bucket "${patchKey}" not found`);
-                                            return;
-                                        }
-                                        const bucket = bucketResult.rows[0];
-                                        // CORS applies to the recorded physical bucket; if the row was
-                                        // never provisioned there is nothing to update yet, so mint the
-                                        // conventional name the first provision would use.
-                                        const recorded = storedPhysicalName(bucket);
-                                        await updateBucketCors(storageModule, databaseId, bucket.key, bucket.type, bucket.allowed_origins, options, recorded === null
-                                            ? resolveBucketName(bucket.key, databaseId, options)
-                                            : recorded);
-                                    });
-                                }
-                            }
-                            catch (err) {
-                                log.error(`${isCreate ? 'Auto-provision' : 'CORS update'} failed for "${fieldName}": ${err.message}. ` +
-                                    (isCreate
-                                        ? `The bucket row was created but the S3 bucket was not provisioned. Use the provisionBucket mutation to retry.`
-                                        : `The bucket row was updated but CORS was not applied to the S3 bucket. Use the provisionBucket mutation to retry.`));
-                            }
-                            return result;
-                        },
-                    };
-                },
-            },
-        },
-    };
+    return mutationPlugin;
 }
 exports.BucketProvisionerPlugin = createBucketProvisionerPlugin;
 exports.default = exports.BucketProvisionerPlugin;

package/preset.d.ts

@@ -31,7 +31,6 @@ import type { BucketProvisionerPluginOptions } from './types';
  *     BucketProvisionerPreset({
  *       connection: getConnection, // pass function ref, NOT getConnection()
  *       allowedOrigins: ['https://app.example.com'],
- *       bucketNamePrefix: 'myapp',
  *     }),
  *   ],
  * };

package/preset.js

@@ -33,7 +33,6 @@ const plugin_1 = require("./plugin");
  *     BucketProvisionerPreset({
  *       connection: getConnection, // pass function ref, NOT getConnection()
  *       allowedOrigins: ['https://app.example.com'],
- *       bucketNamePrefix: 'myapp',
  *     }),
  *   ],
  * };

package/types.d.ts

@@ -1,9 +1,5 @@
 /**
  * Types for the bucket provisioner plugin.
- *
- * Defines plugin options, connection configuration, and provisioning result
- * types used by the Graphile plugin to auto-provision S3 buckets when
- * bucket rows are created via GraphQL mutations.
  */
 import type { BucketAccessType, ProvisionResult, StorageConnectionConfig, StorageProvider } from '@constructive-io/bucket-provisioner';
 export type { BucketAccessType, ProvisionResult, StorageConnectionConfig, StorageProvider };
@@ -18,11 +14,11 @@ export type ConnectionConfigOrGetter = StorageConnectionConfig | (() => StorageC
 /**
  * Function to derive the actual S3 bucket name from a logical bucket key.
  *
- * @param bucketKey - The logical bucket key from the database (e.g., "public", "private")
  * @param databaseId - The metaschema database UUID
+ * @param bucketKey - The logical bucket key from the database (e.g., "public", "private")
  * @returns The S3 bucket name to create/configure
  */
-export type BucketNameResolver = (bucketKey: string, databaseId: string) => string;
+export type BucketNameResolver = (databaseId: string, bucketKey: string) => string;
 /**
  * Plugin options for the bucket provisioner plugin.
  */
@@ -38,15 +34,9 @@ export interface BucketProvisionerPluginOptions {
      * Required for browser-based presigned URL uploads.
      */
     allowedOrigins: string[];
-    /**
-     * Optional prefix for S3 bucket names.
-     * When set, the S3 bucket name becomes `{prefix}-{bucketKey}`.
-     * Example: prefix "myapp" + key "public" → S3 bucket "myapp-public"
-     */
-    bucketNamePrefix?: string;
     /**
      * Optional custom function to derive S3 bucket names from logical bucket keys.
-     * Takes precedence over `bucketNamePrefix` when provided.
+     * Naming is a deployment policy and must be supplied by the caller.
      */
     resolveBucketName?: BucketNameResolver;
     /**
@@ -54,15 +44,6 @@ export interface BucketProvisionerPluginOptions {
      * Default: false
      */
     versioning?: boolean;
-    /**
-     * Whether to auto-provision S3 buckets when bucket rows are created
-     * via GraphQL mutations. When true, the plugin wraps create mutations
-     * on tables tagged with `@storageBuckets` to trigger provisioning
-     * after the mutation succeeds.
-     *
-     * Default: true
-     */
-    autoProvision?: boolean;
 }
 /**
  * Input for the provisionBucket mutation.

package/types.js

@@ -1,9 +1,5 @@
 "use strict";
 /**
  * Types for the bucket provisioner plugin.
- *
- * Defines plugin options, connection configuration, and provisioning result
- * types used by the Graphile plugin to auto-provision S3 buckets when
- * bucket rows are created via GraphQL mutations.
  */
 Object.defineProperty(exports, "__esModule", { value: true });