graphile-presigned-url-plugin 0.15.0 → 0.15.1

package/plugin.js

@@ -4,22 +4,15 @@
  *
  * Hooks into PostGraphile's auto-generated CRUD mutations to add S3 operations:
  *
- * 1. Delete middleware — wraps `delete*` mutations on `@storageFiles`-tagged tables
- *    with S3 object cleanup (sync + async GC fallback via AFTER DELETE trigger).
- *
- * 2. Upload fields — adds `requestUploadUrl` and `requestBulkUploadUrls` fields
- *    on `@storageBuckets`-tagged types, so clients upload via the typed bucket API.
- *
- * 3. Mutation entry points — adds per-bucket mutation fields on the root Mutation
- *    type (e.g., `appBucket(key: "public"): AppBucket`), so upload operations
- *    can be accessed as proper GraphQL mutations instead of queries.
- *
- * 4. File upload mutations — adds `upload<FileType>(input: {...})` mutations
+ * 1. File upload mutations — adds `upload<FileType>(input: {...})` mutations
  *    on root Mutation for each @storageFiles/@storageBuckets pair. These combine
  *    bucket resolution + file INSERT + presigned URL generation in one step.
  *    E.g., `uploadAppFile(input: { bucketKey: "public", contentHash: "...", ... })`
  *
- * 5. downloadUrl — handled by download-url-field.ts (separate plugin).
+ * 2. Delete middleware — wraps `delete*` mutations on `@storageFiles`-tagged tables
+ *    with S3 object cleanup (sync + async GC fallback via AFTER DELETE trigger).
+ *
+ * 3. downloadUrl — handled by download-url-field.ts (separate plugin).
  *
  * Scope resolution uses the codec's schema/table name matched against
  * cached storage module configs.
@@ -120,347 +113,90 @@ function createPresignedUrlPlugin(options) {
         schema: {
             hooks: {
                 /**
-                 * Add requestUploadUrl and requestBulkUploadUrls fields on @storageBuckets types.
+                 * Add file upload mutations (uploadAppFile, uploadDataRoomFile, etc.) on root Mutation.
                  */
                 GraphQLObjectType_fields(fields, build, context) {
-                    const { scope: { pgCodec, isPgClassType, isRootMutation }, } = context;
-                    // --- Path 1: Add per-bucket mutation entry points + file creation mutations on root Mutation ---
-                    if (isRootMutation) {
-                        const { graphql: { GraphQLString, GraphQLNonNull, GraphQLInt, GraphQLBoolean, GraphQLObjectType, GraphQLInputObjectType, GraphQLList, }, } = build;
-                        const bucketCodecs = Object.values(build.input.pgRegistry.pgCodecs).filter((codec) => codec.attributes && codec.extensions?.tags?.storageBuckets);
-                        if (bucketCodecs.length === 0)
-                            return fields;
-                        const newFields = {};
-                        // --- 1a: Per-bucket entry points (appBucket, dataRoomBucket, etc.) ---
-                        for (const codec of bucketCodecs) {
-                            const typeName = build.inflection.tableType(codec);
-                            const bucketType = build.getTypeByName(typeName);
-                            if (!bucketType) {
-                                log.debug(`Skipping mutation entry point for ${codec.name}: type ${typeName} not found`);
-                                continue;
-                            }
-                            const fieldName = typeName.charAt(0).toLowerCase() + typeName.slice(1);
-                            const hasOwnerId = !!codec.attributes.owner_id;
-                            const bucketResource = Object.values(build.input.pgRegistry.pgResources).find((r) => r.codec === codec && !r.isUnique && !r.isVirtual && !r.parameters);
-                            if (!bucketResource) {
-                                log.debug(`Skipping mutation entry point for ${codec.name}: no PgResource found`);
-                                continue;
-                            }
-                            const ownerIdType = hasOwnerId
-                                ? build.getGraphQLTypeByPgCodec(codec.attributes.owner_id.codec, 'input')
-                                : null;
-                            log.debug(`Adding mutation entry point "${fieldName}" for bucket type ${typeName} (entity-scoped=${hasOwnerId})`);
-                            newFields[fieldName] = context.fieldWithHooks({ fieldName }, {
-                                description: `Look up a ${typeName} by key for mutation operations (upload, etc.).`,
-                                type: bucketType,
-                                args: {
-                                    key: { type: new GraphQLNonNull(GraphQLString), description: 'Bucket key (e.g., "public", "private")' },
-                                    ...(hasOwnerId
-                                        ? { ownerId: { type: new GraphQLNonNull(ownerIdType || GraphQLString), description: 'Owner entity ID (required for entity-scoped buckets)' } }
-                                        : {}),
-                                },
-                                plan(_$mutation, fieldArgs) {
-                                    const spec = {
-                                        key: fieldArgs.getRaw('key'),
-                                    };
-                                    if (hasOwnerId) {
-                                        spec.owner_id = fieldArgs.getRaw('ownerId');
-                                    }
-                                    return bucketResource.find(spec).single();
-                                },
-                            });
-                        }
-                        // --- 1b: File upload mutations (uploadAppFile, uploadDataRoomFile, etc.) ---
-                        const fileCodecs = Object.values(build.input.pgRegistry.pgCodecs).filter((codec) => codec.attributes && codec.extensions?.tags?.storageFiles);
-                        for (const filesCodec of fileCodecs) {
-                            const filesTypeName = build.inflection.tableType(filesCodec);
-                            const filesSchemaName = filesCodec.extensions?.pg?.schemaName;
-                            // Find the matching bucket codec by table name prefix.
-                            // Schema-name matching is ambiguous when multiple storage modules share
-                            // the same PG schema (e.g. app_files + data_room_files both in storage_public).
-                            // Instead, derive the prefix from the raw SQL table name:
-                            //   "data_room_files" → prefix "data_room" → matches "data_room_buckets"
-                            //   "app_files"       → prefix "app"       → matches "app_buckets"
-                            const filesRawName = filesCodec.extensions?.pg?.name;
-                            const filesPrefix = filesRawName?.replace(/_files$/, '');
-                            const matchingBucketCodec = bucketCodecs.find((bc) => {
-                                const bucketRawName = bc.extensions?.pg?.name;
-                                const bucketPrefix = bucketRawName?.replace(/_buckets$/, '');
-                                return bucketPrefix === filesPrefix;
-                            });
-                            if (!matchingBucketCodec) {
-                                log.debug(`Skipping upload mutation for ${filesCodec.name}: no matching bucket codec with prefix "${filesPrefix}"`);
-                                continue;
-                            }
-                            const hasOwnerId = !!matchingBucketCodec.attributes.owner_id;
-                            const mutationName = `upload${filesTypeName}`;
-                            const ownerIdGqlType = hasOwnerId
-                                ? build.getGraphQLTypeByPgCodec(matchingBucketCodec.attributes.owner_id.codec, 'input')
-                                : null;
-                            const InputType = new GraphQLInputObjectType({
-                                name: `Upload${filesTypeName}Input`,
-                                fields: {
-                                    bucketKey: { type: new GraphQLNonNull(GraphQLString), description: 'Bucket key (e.g., "public", "private")' },
-                                    ...(hasOwnerId
-                                        ? { ownerId: { type: new GraphQLNonNull(ownerIdGqlType || GraphQLString), description: 'Owner entity ID (required for entity-scoped buckets)' } }
-                                        : {}),
-                                    contentHash: { type: new GraphQLNonNull(GraphQLString), description: 'SHA-256 content hash (hex-encoded, 64 chars)' },
-                                    contentType: { type: new GraphQLNonNull(GraphQLString), description: 'MIME type of the file' },
-                                    size: { type: new GraphQLNonNull(GraphQLInt), description: 'File size in bytes' },
-                                    filename: { type: GraphQLString, description: 'Original filename (optional)' },
-                                    key: { type: GraphQLString, description: 'Custom S3 key (only when bucket has allow_custom_keys=true)' },
-                                },
-                            });
-                            const PayloadType = new GraphQLObjectType({
-                                name: `Upload${filesTypeName}Payload`,
-                                fields: {
-                                    uploadUrl: { type: GraphQLString, description: 'Presigned PUT URL (null if deduplicated)' },
-                                    fileId: { type: new GraphQLNonNull(GraphQLString), description: 'The file ID (UUID)' },
-                                    key: { type: new GraphQLNonNull(GraphQLString), description: 'The S3 object key' },
-                                    deduplicated: { type: new GraphQLNonNull(GraphQLBoolean), description: 'Whether this file was deduplicated (content already exists)' },
-                                    expiresAt: { type: GraphQLString, description: 'Presigned URL expiry time (null if deduplicated)' },
-                                    previousVersionId: { type: GraphQLString, description: 'ID of the previous version (when using custom keys)' },
-                                },
-                            });
-                            const capturedFilesCodec = filesCodec;
-                            log.debug(`Adding file upload mutation "${mutationName}" for ${filesTypeName} (entity-scoped=${hasOwnerId})`);
-                            newFields[mutationName] = context.fieldWithHooks({ fieldName: mutationName }, {
-                                description: `Upload a file: resolves the bucket by key, creates the file row, and returns a presigned PUT URL.`,
-                                type: PayloadType,
-                                args: {
-                                    input: { type: new GraphQLNonNull(InputType) },
-                                },
-                                plan(_$mutation, fieldArgs) {
-                                    const $input = fieldArgs.getRaw('input');
-                                    const $bucketKey = (0, grafast_1.access)($input, 'bucketKey');
-                                    const $contentHash = (0, grafast_1.access)($input, 'contentHash');
-                                    const $contentType = (0, grafast_1.access)($input, 'contentType');
-                                    const $size = (0, grafast_1.access)($input, 'size');
-                                    const $filename = (0, grafast_1.access)($input, 'filename');
-                                    const $customKey = (0, grafast_1.access)($input, 'key');
-                                    const $ownerId = hasOwnerId ? (0, grafast_1.access)($input, 'ownerId') : (0, grafast_1.lambda)(null, () => null);
-                                    const $withPgClient = (0, grafast_1.context)().get('withPgClient');
-                                    const $pgSettings = (0, grafast_1.context)().get('pgSettings');
-                                    const $combined = (0, grafast_1.object)({
-                                        bucketKey: $bucketKey,
-                                        ownerId: $ownerId,
-                                        contentHash: $contentHash,
-                                        contentType: $contentType,
-                                        size: $size,
-                                        filename: $filename,
-                                        customKey: $customKey,
-                                        withPgClient: $withPgClient,
-                                        pgSettings: $pgSettings,
-                                    });
-                                    return (0, grafast_1.lambda)($combined, async (vals) => {
-                                        return vals.withPgClient(vals.pgSettings, async (pgClient) => {
-                                            return pgClient.withTransaction(async (txClient) => {
-                                                const databaseId = await resolveDatabaseId(txClient);
-                                                if (!databaseId)
-                                                    throw new Error('DATABASE_NOT_FOUND');
-                                                const allConfigs = await (0, storage_module_cache_1.loadAllStorageModules)(txClient, databaseId);
-                                                const storageConfig = (0, storage_module_cache_1.resolveStorageConfigFromCodec)(capturedFilesCodec, allConfigs);
-                                                if (!storageConfig)
-                                                    throw new Error('STORAGE_MODULE_NOT_FOUND');
-                                                const bucket = await (0, storage_module_cache_1.getBucketConfig)(txClient, storageConfig, databaseId, vals.bucketKey, vals.ownerId || undefined);
-                                                if (!bucket)
-                                                    throw new Error('BUCKET_NOT_FOUND');
-                                                const s3ForDb = resolveS3ForDatabase(options, storageConfig, databaseId);
-                                                await ensureS3BucketExists(options, s3ForDb.bucket, bucket, databaseId, storageConfig.allowedOrigins);
-                                                return processSingleFile(options, txClient, storageConfig, databaseId, bucket, s3ForDb, {
-                                                    contentHash: vals.contentHash,
-                                                    contentType: vals.contentType,
-                                                    size: vals.size,
-                                                    filename: vals.filename,
-                                                    key: vals.customKey,
-                                                });
-                                            });
-                                        });
-                                    });
-                                },
-                            });
-                            // --- Bulk file upload mutation ---
-                            const BulkFileInputType = new GraphQLInputObjectType({
-                                name: `Upload${filesTypeName}BulkFileInput`,
-                                fields: {
-                                    contentHash: { type: new GraphQLNonNull(GraphQLString), description: 'SHA-256 content hash (hex-encoded, 64 chars)' },
-                                    contentType: { type: new GraphQLNonNull(GraphQLString), description: 'MIME type of the file' },
-                                    size: { type: new GraphQLNonNull(GraphQLInt), description: 'File size in bytes' },
-                                    filename: { type: GraphQLString, description: 'Original filename (optional)' },
-                                    key: { type: GraphQLString, description: 'Custom S3 key (only when bucket has allow_custom_keys=true)' },
-                                },
-                            });
-                            const BulkFilePayloadType = new GraphQLObjectType({
-                                name: `Upload${filesTypeName}BulkFilePayload`,
-                                fields: {
-                                    uploadUrl: { type: GraphQLString },
-                                    fileId: { type: new GraphQLNonNull(GraphQLString) },
-                                    key: { type: new GraphQLNonNull(GraphQLString) },
-                                    deduplicated: { type: new GraphQLNonNull(GraphQLBoolean) },
-                                    expiresAt: { type: GraphQLString },
-                                    previousVersionId: { type: GraphQLString },
-                                },
-                            });
-                            const BulkInputType = new GraphQLInputObjectType({
-                                name: `Upload${filesTypeName}BulkInput`,
-                                fields: {
-                                    bucketKey: { type: new GraphQLNonNull(GraphQLString), description: 'Bucket key (e.g., "public", "private")' },
-                                    ...(hasOwnerId
-                                        ? { ownerId: { type: new GraphQLNonNull(ownerIdGqlType || GraphQLString), description: 'Owner entity ID (required for entity-scoped buckets)' } }
-                                        : {}),
-                                    files: { type: new GraphQLNonNull(new GraphQLList(new GraphQLNonNull(BulkFileInputType))), description: 'Array of files to upload' },
-                                },
-                            });
-                            const BulkPayloadType = new GraphQLObjectType({
-                                name: `Upload${filesTypeName}BulkPayload`,
-                                fields: {
-                                    files: { type: new GraphQLNonNull(new GraphQLList(new GraphQLNonNull(BulkFilePayloadType))) },
-                                },
-                            });
-                            const bulkMutationName = `upload${filesTypeName}s`;
-                            log.debug(`Adding bulk file upload mutation "${bulkMutationName}" for ${filesTypeName}`);
-                            newFields[bulkMutationName] = context.fieldWithHooks({ fieldName: bulkMutationName }, {
-                                description: `Upload multiple files: resolves the bucket by key, creates file rows, and returns presigned PUT URLs for each.`,
-                                type: BulkPayloadType,
-                                args: {
-                                    input: { type: new GraphQLNonNull(BulkInputType) },
-                                },
-                                plan(_$mutation, fieldArgs) {
-                                    const $input = fieldArgs.getRaw('input');
-                                    const $bucketKey = (0, grafast_1.access)($input, 'bucketKey');
-                                    const $ownerId = hasOwnerId ? (0, grafast_1.access)($input, 'ownerId') : (0, grafast_1.lambda)(null, () => null);
-                                    const $files = (0, grafast_1.access)($input, 'files');
-                                    const $withPgClient = (0, grafast_1.context)().get('withPgClient');
-                                    const $pgSettings = (0, grafast_1.context)().get('pgSettings');
-                                    const $combined = (0, grafast_1.object)({
-                                        bucketKey: $bucketKey,
-                                        ownerId: $ownerId,
-                                        files: $files,
-                                        withPgClient: $withPgClient,
-                                        pgSettings: $pgSettings,
-                                    });
-                                    return (0, grafast_1.lambda)($combined, async (vals) => {
-                                        return vals.withPgClient(vals.pgSettings, async (pgClient) => {
-                                            return pgClient.withTransaction(async (txClient) => {
-                                                const databaseId = await resolveDatabaseId(txClient);
-                                                if (!databaseId)
-                                                    throw new Error('DATABASE_NOT_FOUND');
-                                                const allConfigs = await (0, storage_module_cache_1.loadAllStorageModules)(txClient, databaseId);
-                                                const storageConfig = (0, storage_module_cache_1.resolveStorageConfigFromCodec)(capturedFilesCodec, allConfigs);
-                                                if (!storageConfig)
-                                                    throw new Error('STORAGE_MODULE_NOT_FOUND');
-                                                const bucket = await (0, storage_module_cache_1.getBucketConfig)(txClient, storageConfig, databaseId, vals.bucketKey, vals.ownerId || undefined);
-                                                if (!bucket)
-                                                    throw new Error('BUCKET_NOT_FOUND');
-                                                const s3ForDb = resolveS3ForDatabase(options, storageConfig, databaseId);
-                                                await ensureS3BucketExists(options, s3ForDb.bucket, bucket, databaseId, storageConfig.allowedOrigins);
-                                                const results = [];
-                                                for (const file of vals.files) {
-                                                    results.push(await processSingleFile(options, txClient, storageConfig, databaseId, bucket, s3ForDb, {
-                                                        contentHash: file.contentHash,
-                                                        contentType: file.contentType,
-                                                        size: file.size,
-                                                        filename: file.filename,
-                                                        key: file.key,
-                                                    }));
-                                                }
-                                                return { files: results };
-                                            });
-                                        });
-                                    });
-                                },
-                            });
-                        }
-                        return build.extend(fields, newFields, 'PresignedUrlPlugin adding per-bucket mutation entry points and file upload mutations');
-                    }
-                    // --- Path 2: Add upload fields on @storageBuckets types ---
-                    if (!isPgClassType || !pgCodec || !pgCodec.attributes) {
+                    const { scope: { isRootMutation }, } = context;
+                    if (!isRootMutation)
                         return fields;
-                    }
-                    const tags = pgCodec.extensions?.tags;
-                    if (!tags?.storageBuckets) {
+                    const { graphql: { GraphQLString, GraphQLNonNull, GraphQLInt, GraphQLBoolean, GraphQLObjectType, GraphQLInputObjectType, GraphQLList, }, } = build;
+                    const bucketCodecs = Object.values(build.input.pgRegistry.pgCodecs).filter((codec) => codec.attributes && codec.extensions?.tags?.storageBuckets);
+                    if (bucketCodecs.length === 0)
                         return fields;
-                    }
-                    log.debug(`Adding upload fields to bucket type: ${pgCodec.name} (has @storageBuckets tag)`);
-                    const { graphql: { GraphQLString, GraphQLNonNull, GraphQLInt, GraphQLBoolean, GraphQLObjectType, GraphQLList, GraphQLInputObjectType, }, } = build;
-                    // --- Shared output types ---
-                    const UploadUrlPayloadType = new GraphQLObjectType({
-                        name: `${build.inflection.upperCamelCase(pgCodec.name)}RequestUploadUrlPayload`,
-                        fields: {
-                            uploadUrl: { type: GraphQLString, description: 'Presigned PUT URL (null if deduplicated)' },
-                            fileId: { type: new GraphQLNonNull(GraphQLString), description: 'The file ID' },
-                            key: { type: new GraphQLNonNull(GraphQLString), description: 'The S3 object key' },
-                            deduplicated: { type: new GraphQLNonNull(GraphQLBoolean), description: 'Whether this file was deduplicated' },
-                            expiresAt: { type: GraphQLString, description: 'Presigned URL expiry time (null if deduplicated)' },
-                            previousVersionId: { type: GraphQLString, description: 'ID of the previous version' },
-                        },
-                    });
-                    const BulkUploadFilePayloadType = new GraphQLObjectType({
-                        name: `${build.inflection.upperCamelCase(pgCodec.name)}BulkUploadFilePayload`,
-                        fields: {
-                            uploadUrl: { type: GraphQLString },
-                            fileId: { type: new GraphQLNonNull(GraphQLString) },
-                            key: { type: new GraphQLNonNull(GraphQLString) },
-                            deduplicated: { type: new GraphQLNonNull(GraphQLBoolean) },
-                            expiresAt: { type: GraphQLString },
-                            previousVersionId: { type: GraphQLString },
-                            index: { type: new GraphQLNonNull(GraphQLInt), description: 'Index in the input array' },
-                        },
-                    });
-                    const BulkUploadUrlsPayloadType = new GraphQLObjectType({
-                        name: `${build.inflection.upperCamelCase(pgCodec.name)}RequestBulkUploadUrlsPayload`,
-                        fields: {
-                            files: { type: new GraphQLNonNull(new GraphQLList(new GraphQLNonNull(BulkUploadFilePayloadType))) },
-                        },
-                    });
-                    const BulkUploadFileInputType = new GraphQLInputObjectType({
-                        name: `${build.inflection.upperCamelCase(pgCodec.name)}BulkUploadFileInput`,
-                        fields: {
-                            contentHash: { type: new GraphQLNonNull(GraphQLString) },
-                            contentType: { type: new GraphQLNonNull(GraphQLString) },
-                            size: { type: new GraphQLNonNull(GraphQLInt) },
-                            filename: { type: GraphQLString },
-                            key: { type: GraphQLString },
-                        },
-                    });
-                    // Capture codec for closure
-                    const capturedCodec = pgCodec;
-                    return build.extend(fields, {
-                        requestUploadUrl: context.fieldWithHooks({ fieldName: 'requestUploadUrl' }, {
-                            description: 'Request a presigned URL for uploading a file to this bucket.',
-                            type: UploadUrlPayloadType,
-                            args: {
+                    const newFields = {};
+                    // --- File upload mutations (uploadAppFile, uploadDataRoomFile, etc.) ---
+                    const fileCodecs = Object.values(build.input.pgRegistry.pgCodecs).filter((codec) => codec.attributes && codec.extensions?.tags?.storageFiles);
+                    for (const filesCodec of fileCodecs) {
+                        const filesTypeName = build.inflection.tableType(filesCodec);
+                        // Find the matching bucket codec by table name prefix.
+                        // Schema-name matching is ambiguous when multiple storage modules share
+                        // the same PG schema (e.g. app_files + data_room_files both in storage_public).
+                        // Instead, derive the prefix from the raw SQL table name:
+                        //   "data_room_files" → prefix "data_room" → matches "data_room_buckets"
+                        //   "app_files"       → prefix "app"       → matches "app_buckets"
+                        const filesRawName = filesCodec.extensions?.pg?.name;
+                        const filesPrefix = filesRawName?.replace(/_files$/, '');
+                        const matchingBucketCodec = bucketCodecs.find((bc) => {
+                            const bucketRawName = bc.extensions?.pg?.name;
+                            const bucketPrefix = bucketRawName?.replace(/_buckets$/, '');
+                            return bucketPrefix === filesPrefix;
+                        });
+                        if (!matchingBucketCodec) {
+                            log.debug(`Skipping upload mutation for ${filesCodec.name}: no matching bucket codec with prefix "${filesPrefix}"`);
+                            continue;
+                        }
+                        const hasOwnerId = !!matchingBucketCodec.attributes.owner_id;
+                        const mutationName = `upload${filesTypeName}`;
+                        const ownerIdGqlType = hasOwnerId
+                            ? build.getGraphQLTypeByPgCodec(matchingBucketCodec.attributes.owner_id.codec, 'input')
+                            : null;
+                        const InputType = new GraphQLInputObjectType({
+                            name: `Upload${filesTypeName}Input`,
+                            fields: {
+                                bucketKey: { type: new GraphQLNonNull(GraphQLString), description: 'Bucket key (e.g., "public", "private")' },
+                                ...(hasOwnerId
+                                    ? { ownerId: { type: new GraphQLNonNull(ownerIdGqlType || GraphQLString), description: 'Owner entity ID (required for entity-scoped buckets)' } }
+                                    : {}),
                                 contentHash: { type: new GraphQLNonNull(GraphQLString), description: 'SHA-256 content hash (hex-encoded, 64 chars)' },
                                 contentType: { type: new GraphQLNonNull(GraphQLString), description: 'MIME type of the file' },
                                 size: { type: new GraphQLNonNull(GraphQLInt), description: 'File size in bytes' },
                                 filename: { type: GraphQLString, description: 'Original filename (optional)' },
                                 key: { type: GraphQLString, description: 'Custom S3 key (only when bucket has allow_custom_keys=true)' },
                             },
-                            plan($parent, fieldArgs) {
-                                const $bucketId = $parent.get('id');
-                                const $bucketKey = $parent.get('key');
-                                const $bucketType = $parent.get('type');
-                                const $bucketIsPublic = $parent.get('is_public');
-                                const $bucketAllowCustomKeys = $parent.get('allow_custom_keys');
-                                const $bucketAllowedMimeTypes = $parent.get('allowed_mime_types');
-                                const $bucketMaxFileSize = $parent.get('max_file_size');
-                                const $bucketOwnerId = capturedCodec.attributes.owner_id ? $parent.get('owner_id') : (0, grafast_1.lambda)(null, () => null);
-                                const $contentHash = fieldArgs.getRaw('contentHash');
-                                const $contentType = fieldArgs.getRaw('contentType');
-                                const $size = fieldArgs.getRaw('size');
-                                const $filename = fieldArgs.getRaw('filename');
-                                const $customKey = fieldArgs.getRaw('key');
+                        });
+                        const PayloadType = new GraphQLObjectType({
+                            name: `Upload${filesTypeName}Payload`,
+                            fields: {
+                                uploadUrl: { type: GraphQLString, description: 'Presigned PUT URL (null if deduplicated)' },
+                                fileId: { type: new GraphQLNonNull(GraphQLString), description: 'The file ID (UUID)' },
+                                key: { type: new GraphQLNonNull(GraphQLString), description: 'The S3 object key' },
+                                deduplicated: { type: new GraphQLNonNull(GraphQLBoolean), description: 'Whether this file was deduplicated (content already exists)' },
+                                expiresAt: { type: GraphQLString, description: 'Presigned URL expiry time (null if deduplicated)' },
+                                previousVersionId: { type: GraphQLString, description: 'ID of the previous version (when using custom keys)' },
+                            },
+                        });
+                        const capturedFilesCodec = filesCodec;
+                        log.debug(`Adding file upload mutation "${mutationName}" for ${filesTypeName} (entity-scoped=${hasOwnerId})`);
+                        newFields[mutationName] = context.fieldWithHooks({ fieldName: mutationName }, {
+                            description: `Upload a file: resolves the bucket by key, creates the file row, and returns a presigned PUT URL.`,
+                            type: PayloadType,
+                            args: {
+                                input: { type: new GraphQLNonNull(InputType) },
+                            },
+                            plan(_$mutation, fieldArgs) {
+                                const $input = fieldArgs.getRaw('input');
+                                const $bucketKey = (0, grafast_1.access)($input, 'bucketKey');
+                                const $contentHash = (0, grafast_1.access)($input, 'contentHash');
+                                const $contentType = (0, grafast_1.access)($input, 'contentType');
+                                const $size = (0, grafast_1.access)($input, 'size');
+                                const $filename = (0, grafast_1.access)($input, 'filename');
+                                const $customKey = (0, grafast_1.access)($input, 'key');
+                                const $ownerId = hasOwnerId ? (0, grafast_1.access)($input, 'ownerId') : (0, grafast_1.lambda)(null, () => null);
                                 const $withPgClient = (0, grafast_1.context)().get('withPgClient');
                                 const $pgSettings = (0, grafast_1.context)().get('pgSettings');
                                 const $combined = (0, grafast_1.object)({
-                                    bucketId: $bucketId,
                                     bucketKey: $bucketKey,
-                                    bucketType: $bucketType,
-                                    bucketIsPublic: $bucketIsPublic,
-                                    bucketAllowCustomKeys: $bucketAllowCustomKeys,
-                                    bucketAllowedMimeTypes: $bucketAllowedMimeTypes,
-                                    bucketMaxFileSize: $bucketMaxFileSize,
-                                    bucketOwnerId: $bucketOwnerId,
+                                    ownerId: $ownerId,
                                     contentHash: $contentHash,
                                     contentType: $contentType,
                                     size: $size,
@@ -476,19 +212,12 @@ function createPresignedUrlPlugin(options) {
                                             if (!databaseId)
                                                 throw new Error('DATABASE_NOT_FOUND');
                                             const allConfigs = await (0, storage_module_cache_1.loadAllStorageModules)(txClient, databaseId);
-                                            const storageConfig = (0, storage_module_cache_1.resolveStorageConfigFromCodec)(capturedCodec, allConfigs);
+                                            const storageConfig = (0, storage_module_cache_1.resolveStorageConfigFromCodec)(capturedFilesCodec, allConfigs);
                                             if (!storageConfig)
                                                 throw new Error('STORAGE_MODULE_NOT_FOUND');
-                                            const bucket = {
-                                                id: vals.bucketId,
-                                                key: vals.bucketKey,
-                                                type: vals.bucketType,
-                                                is_public: vals.bucketIsPublic,
-                                                owner_id: vals.bucketOwnerId,
-                                                allowed_mime_types: vals.bucketAllowedMimeTypes,
-                                                max_file_size: vals.bucketMaxFileSize,
-                                                allow_custom_keys: vals.bucketAllowCustomKeys ?? false,
-                                            };
+                                            const bucket = await (0, storage_module_cache_1.getBucketConfig)(txClient, storageConfig, databaseId, vals.bucketKey, vals.ownerId || undefined);
+                                            if (!bucket)
+                                                throw new Error('BUCKET_NOT_FOUND');
                                             const s3ForDb = resolveS3ForDatabase(options, storageConfig, databaseId);
                                             await ensureS3BucketExists(options, s3ForDb.bucket, bucket, databaseId, storageConfig.allowedOrigins);
                                             return processSingleFile(options, txClient, storageConfig, databaseId, bucket, s3ForDb, {
@@ -502,86 +231,100 @@ function createPresignedUrlPlugin(options) {
                                     });
                                 });
                             },
-                        }),
-                        requestBulkUploadUrls: context.fieldWithHooks({ fieldName: 'requestBulkUploadUrls' }, {
-                            description: 'Request presigned URLs for uploading multiple files to this bucket.',
-                            type: BulkUploadUrlsPayloadType,
+                        });
+                        // --- Bulk file upload mutation ---
+                        const BulkFileInputType = new GraphQLInputObjectType({
+                            name: `Upload${filesTypeName}BulkFileInput`,
+                            fields: {
+                                contentHash: { type: new GraphQLNonNull(GraphQLString), description: 'SHA-256 content hash (hex-encoded, 64 chars)' },
+                                contentType: { type: new GraphQLNonNull(GraphQLString), description: 'MIME type of the file' },
+                                size: { type: new GraphQLNonNull(GraphQLInt), description: 'File size in bytes' },
+                                filename: { type: GraphQLString, description: 'Original filename (optional)' },
+                                key: { type: GraphQLString, description: 'Custom S3 key (only when bucket has allow_custom_keys=true)' },
+                            },
+                        });
+                        const BulkFilePayloadType = new GraphQLObjectType({
+                            name: `Upload${filesTypeName}BulkFilePayload`,
+                            fields: {
+                                uploadUrl: { type: GraphQLString },
+                                fileId: { type: new GraphQLNonNull(GraphQLString) },
+                                key: { type: new GraphQLNonNull(GraphQLString) },
+                                deduplicated: { type: new GraphQLNonNull(GraphQLBoolean) },
+                                expiresAt: { type: GraphQLString },
+                                previousVersionId: { type: GraphQLString },
+                            },
+                        });
+                        const BulkInputType = new GraphQLInputObjectType({
+                            name: `Upload${filesTypeName}BulkInput`,
+                            fields: {
+                                bucketKey: { type: new GraphQLNonNull(GraphQLString), description: 'Bucket key (e.g., "public", "private")' },
+                                ...(hasOwnerId
+                                    ? { ownerId: { type: new GraphQLNonNull(ownerIdGqlType || GraphQLString), description: 'Owner entity ID (required for entity-scoped buckets)' } }
+                                    : {}),
+                                files: { type: new GraphQLNonNull(new GraphQLList(new GraphQLNonNull(BulkFileInputType))), description: 'Array of files to upload' },
+                            },
+                        });
+                        const BulkPayloadType = new GraphQLObjectType({
+                            name: `Upload${filesTypeName}BulkPayload`,
+                            fields: {
+                                files: { type: new GraphQLNonNull(new GraphQLList(new GraphQLNonNull(BulkFilePayloadType))) },
+                            },
+                        });
+                        const bulkMutationName = `upload${filesTypeName}s`;
+                        log.debug(`Adding bulk file upload mutation "${bulkMutationName}" for ${filesTypeName}`);
+                        newFields[bulkMutationName] = context.fieldWithHooks({ fieldName: bulkMutationName }, {
+                            description: `Upload multiple files: resolves the bucket by key, creates file rows, and returns presigned PUT URLs for each.`,
+                            type: BulkPayloadType,
                             args: {
-                                files: {
-                                    type: new GraphQLNonNull(new GraphQLList(new GraphQLNonNull(BulkUploadFileInputType))),
-                                    description: 'Array of files to upload',
-                                },
+                                input: { type: new GraphQLNonNull(BulkInputType) },
                             },
-                            plan($parent, fieldArgs) {
-                                const $bucketId = $parent.get('id');
-                                const $bucketKey = $parent.get('key');
-                                const $bucketType = $parent.get('type');
-                                const $bucketIsPublic = $parent.get('is_public');
-                                const $bucketAllowCustomKeys = $parent.get('allow_custom_keys');
-                                const $bucketAllowedMimeTypes = $parent.get('allowed_mime_types');
-                                const $bucketMaxFileSize = $parent.get('max_file_size');
-                                const $bucketOwnerId = capturedCodec.attributes.owner_id ? $parent.get('owner_id') : (0, grafast_1.lambda)(null, () => null);
-                                const $files = fieldArgs.getRaw('files');
+                            plan(_$mutation, fieldArgs) {
+                                const $input = fieldArgs.getRaw('input');
+                                const $bucketKey = (0, grafast_1.access)($input, 'bucketKey');
+                                const $ownerId = hasOwnerId ? (0, grafast_1.access)($input, 'ownerId') : (0, grafast_1.lambda)(null, () => null);
+                                const $files = (0, grafast_1.access)($input, 'files');
                                 const $withPgClient = (0, grafast_1.context)().get('withPgClient');
                                 const $pgSettings = (0, grafast_1.context)().get('pgSettings');
                                 const $combined = (0, grafast_1.object)({
-                                    bucketId: $bucketId,
                                     bucketKey: $bucketKey,
-                                    bucketType: $bucketType,
-                                    bucketIsPublic: $bucketIsPublic,
-                                    bucketAllowCustomKeys: $bucketAllowCustomKeys,
-                                    bucketAllowedMimeTypes: $bucketAllowedMimeTypes,
-                                    bucketMaxFileSize: $bucketMaxFileSize,
-                                    bucketOwnerId: $bucketOwnerId,
+                                    ownerId: $ownerId,
                                     files: $files,
                                     withPgClient: $withPgClient,
                                     pgSettings: $pgSettings,
                                 });
                                 return (0, grafast_1.lambda)($combined, async (vals) => {
-                                    const { files } = vals;
-                                    if (!Array.isArray(files) || files.length === 0) {
-                                        throw new Error('INVALID_FILES: must provide at least one file');
-                                    }
                                     return vals.withPgClient(vals.pgSettings, async (pgClient) => {
                                         return pgClient.withTransaction(async (txClient) => {
                                             const databaseId = await resolveDatabaseId(txClient);
                                             if (!databaseId)
                                                 throw new Error('DATABASE_NOT_FOUND');
                                             const allConfigs = await (0, storage_module_cache_1.loadAllStorageModules)(txClient, databaseId);
-                                            const storageConfig = (0, storage_module_cache_1.resolveStorageConfigFromCodec)(capturedCodec, allConfigs);
+                                            const storageConfig = (0, storage_module_cache_1.resolveStorageConfigFromCodec)(capturedFilesCodec, allConfigs);
                                             if (!storageConfig)
                                                 throw new Error('STORAGE_MODULE_NOT_FOUND');
-                                            if (files.length > storageConfig.maxBulkFiles) {
-                                                throw new Error(`BULK_LIMIT_EXCEEDED: max ${storageConfig.maxBulkFiles} files per batch`);
-                                            }
-                                            const totalSize = files.reduce((sum, f) => sum + (f.size || 0), 0);
-                                            if (totalSize > storageConfig.maxBulkTotalSize) {
-                                                throw new Error(`BULK_SIZE_EXCEEDED: total size ${totalSize} exceeds max ${storageConfig.maxBulkTotalSize} bytes`);
-                                            }
-                                            const bucket = {
-                                                id: vals.bucketId,
-                                                key: vals.bucketKey,
-                                                type: vals.bucketType,
-                                                is_public: vals.bucketIsPublic,
-                                                owner_id: vals.bucketOwnerId,
-                                                allowed_mime_types: vals.bucketAllowedMimeTypes,
-                                                max_file_size: vals.bucketMaxFileSize,
-                                                allow_custom_keys: vals.bucketAllowCustomKeys ?? false,
-                                            };
+                                            const bucket = await (0, storage_module_cache_1.getBucketConfig)(txClient, storageConfig, databaseId, vals.bucketKey, vals.ownerId || undefined);
+                                            if (!bucket)
+                                                throw new Error('BUCKET_NOT_FOUND');
                                             const s3ForDb = resolveS3ForDatabase(options, storageConfig, databaseId);
                                             await ensureS3BucketExists(options, s3ForDb.bucket, bucket, databaseId, storageConfig.allowedOrigins);
                                             const results = [];
-                                            for (let i = 0; i < files.length; i++) {
-                                                const result = await processSingleFile(options, txClient, storageConfig, databaseId, bucket, s3ForDb, files[i]);
-                                                results.push({ ...result, index: i });
+                                            for (const file of vals.files) {
+                                                results.push(await processSingleFile(options, txClient, storageConfig, databaseId, bucket, s3ForDb, {
+                                                    contentHash: file.contentHash,
+                                                    contentType: file.contentType,
+                                                    size: file.size,
+                                                    filename: file.filename,
+                                                    key: file.key,
+                                                }));
                                             }
                                             return { files: results };
                                         });
                                     });
                                 });
                             },
-                        }),
-                    }, `PresignedUrlPlugin adding upload fields to ${pgCodec.name}`);
+                        });
+                    }
+                    return build.extend(fields, newFields, 'PresignedUrlPlugin adding file upload mutations');
                 },
                 /**
                  * Wrap delete* mutations on @storageFiles-tagged tables with S3 cleanup.