graphile-settings 6.13.8 → 6.14.0

package/esm/presigned-url-resolver.d.ts

@@ -19,9 +19,10 @@ import type { BucketNameResolver, EnsureBucketProvisioned, S3Config } from 'grap
  * pgpmDefaults → config file → env vars), creates an S3Client, and caches
  * the result. Same CDN config as upload-resolver.ts.
  *
- * NOTE: The `bucket` field here is the global fallback bucket name
- * (from BUCKET_NAME env var). When `resolveBucketName` is provided,
- * per-database bucket names take precedence for all S3 operations.
+ * NOTE: The `bucket` field here is only the connection's default and is never
+ * uploaded to. Every managed upload names its bucket explicitly, resolved from
+ * the tenant's logical bucket row via `resolveBucketName`; there is no
+ * environment-global upload bucket.
  */
 export declare function getPresignedUrlS3Config(): S3Config;
 /**

package/esm/presigned-url-resolver.js

@@ -24,9 +24,10 @@ let s3Config = null;
  * pgpmDefaults → config file → env vars), creates an S3Client, and caches
  * the result. Same CDN config as upload-resolver.ts.
  *
- * NOTE: The `bucket` field here is the global fallback bucket name
- * (from BUCKET_NAME env var). When `resolveBucketName` is provided,
- * per-database bucket names take precedence for all S3 operations.
+ * NOTE: The `bucket` field here is only the connection's default and is never
+ * uploaded to. Every managed upload names its bucket explicitly, resolved from
+ * the tenant's logical bucket row via `resolveBucketName`; there is no
+ * environment-global upload bucket.
  */
 export function getPresignedUrlS3Config() {
     if (s3Config)

package/esm/upload-resolver.d.ts

@@ -1,15 +1,24 @@
 /**
- * Upload resolver for the Constructive upload plugin.
+ * Upload resolver for the Constructive upload plugin (multipart `Upload` scalar).
  *
- * Reads CDN/S3/MinIO configuration from environment variables (via getEnvOptions)
- * and streams uploaded files to the configured storage backend.
+ * This is the streaming transport into the *managed* storage lane: bytes arrive
+ * on the mutation, and the file they carry gets the same treatment a presigned
+ * upload gets — a bucket resolved inside the tenant, a content-addressed key, a
+ * files row, and a projection document naming that row.
  *
- * Lazily initializes the S3 streamer on first upload to avoid requiring
- * env vars at module load time.
+ * It used to be a second storage model: stream to `BUCKET_NAME` under a random
+ * key, hand back a URL, record nothing. Objects written that way belonged to no
+ * database, could not be deduplicated, listed, or access-controlled, and storage
+ * GC could not see that a document still pointed at them. There is no
+ * environment bucket in this path any more; `cdn.*` supplies S3 credentials and
+ * an endpoint only.
  *
- * ENV VARS:
+ * Compatibility: `image`/`upload` columns still receive `url` alongside the new
+ * `id`/`key`/`bucket_id`/`size` fields, so existing readers of `photo.url` keep
+ * working while they migrate to `id` + the files row's late-bound `downloadUrl`.
+ *
+ * ENV VARS (S3 connection only):
  *   BUCKET_PROVIDER  - 'minio' | 's3' (default: 'minio')
- *   BUCKET_NAME      - bucket name (default: 'test-bucket')
  *   AWS_REGION       - AWS region (default: 'us-east-1')
  *   AWS_ACCESS_KEY   - access key (default: 'minioadmin')
  *   AWS_SECRET_KEY   - secret key (default: 'minioadmin')

package/esm/upload-resolver.js

@@ -1,15 +1,24 @@
 /**
- * Upload resolver for the Constructive upload plugin.
+ * Upload resolver for the Constructive upload plugin (multipart `Upload` scalar).
  *
- * Reads CDN/S3/MinIO configuration from environment variables (via getEnvOptions)
- * and streams uploaded files to the configured storage backend.
+ * This is the streaming transport into the *managed* storage lane: bytes arrive
+ * on the mutation, and the file they carry gets the same treatment a presigned
+ * upload gets — a bucket resolved inside the tenant, a content-addressed key, a
+ * files row, and a projection document naming that row.
  *
- * Lazily initializes the S3 streamer on first upload to avoid requiring
- * env vars at module load time.
+ * It used to be a second storage model: stream to `BUCKET_NAME` under a random
+ * key, hand back a URL, record nothing. Objects written that way belonged to no
+ * database, could not be deduplicated, listed, or access-controlled, and storage
+ * GC could not see that a document still pointed at them. There is no
+ * environment bucket in this path any more; `cdn.*` supplies S3 credentials and
+ * an endpoint only.
  *
- * ENV VARS:
+ * Compatibility: `image`/`upload` columns still receive `url` alongside the new
+ * `id`/`key`/`bucket_id`/`size` fields, so existing readers of `photo.url` keep
+ * working while they migrate to `id` + the files row's late-bound `downloadUrl`.
+ *
+ * ENV VARS (S3 connection only):
  *   BUCKET_PROVIDER  - 'minio' | 's3' (default: 'minio')
- *   BUCKET_NAME      - bucket name (default: 'test-bucket')
  *   AWS_REGION       - AWS region (default: 'us-east-1')
  *   AWS_ACCESS_KEY   - access key (default: 'minioadmin')
  *   AWS_SECRET_KEY   - secret key (default: 'minioadmin')
@@ -17,100 +26,199 @@
  */
 import { getEnvOptions } from '@constructive-io/graphql-env';
 import Streamer from '@constructive-io/s3-streamer';
-import uploadNames from '@constructive-io/upload-names';
 import { Logger } from '@pgpmjs/logger';
-import { randomBytes } from 'crypto';
+import { createHash, randomUUID } from 'crypto';
+import { finalizeStagedUpload, resolveManagedUploadTarget, withRequestPgClient, } from 'graphile-presigned-url-plugin';
+import { Transform } from 'stream';
+import { createBucketNameResolver, createEnsureBucketProvisioned, getPresignedUrlS3Config, } from './presigned-url-resolver';
 const log = new Logger('upload-resolver');
 const DEFAULT_IMAGE_MIME_TYPES = ['image/jpeg', 'image/png', 'image/svg+xml'];
 let streamer = null;
-let bucketName;
+/**
+ * The S3 streamer, built from the CDN connection settings.
+ *
+ * Deliberately constructed with no `defaultBucket`: every upload names the
+ * bucket it resolved, and a default here would be an environment-owned bucket
+ * standing in for a tenant's.
+ */
 function getStreamer() {
     if (streamer)
         return streamer;
-    const opts = getEnvOptions();
-    const cdn = opts.cdn || {};
-    const provider = cdn.provider || 'minio';
-    bucketName = cdn.bucketName || 'test-bucket';
-    const awsRegion = cdn.awsRegion || 'us-east-1';
-    const awsAccessKey = cdn.awsAccessKey || 'minioadmin';
-    const awsSecretKey = cdn.awsSecretKey || 'minioadmin';
-    const endpoint = cdn.endpoint || 'http://localhost:9000';
-    if (process.env.NODE_ENV === 'production') {
-        if (!cdn.awsAccessKey || !cdn.awsSecretKey) {
-            log.warn('[upload-resolver] WARNING: Using default credentials in production.');
-        }
+    const { cdn = {} } = getEnvOptions();
+    if (process.env.NODE_ENV === 'production' && (!cdn.awsAccessKey || !cdn.awsSecretKey)) {
+        log.warn('[upload-resolver] WARNING: Using default credentials in production.');
     }
-    log.info(`[upload-resolver] Initializing: provider=${provider} bucket=${bucketName}`);
+    const provider = cdn.provider || 'minio';
+    log.info(`[upload-resolver] Initializing: provider=${provider}`);
     streamer = new Streamer({
-        defaultBucket: bucketName,
-        awsRegion,
-        awsSecretKey,
-        awsAccessKey,
-        endpoint,
         provider,
+        awsRegion: cdn.awsRegion || 'us-east-1',
+        awsAccessKey: cdn.awsAccessKey || 'minioadmin',
+        awsSecretKey: cdn.awsSecretKey || 'minioadmin',
+        endpoint: cdn.endpoint || 'http://localhost:9000',
     });
     return streamer;
 }
 /**
- * Generates a randomized storage key from a filename.
- * Format: {random10chars}-{sanitized-filename}
+ * The upload lane's view of the presigned plugin's options: the same S3
+ * connection, physical-name policy, and provisioning hook the presigned lane
+ * uses, so both transports resolve identical coordinates for a bucket.
+ *
+ * Built on first upload rather than at import time — `createBucketNameResolver`
+ * throws on a missing name prefix, and that must surface as a failed upload, not
+ * as a server that will not boot.
  */
-function generateKey(filename) {
-    const rand = randomBytes(12).toString('hex');
-    return `${rand}-${uploadNames(filename)}`;
+let managedOptions = null;
+function getManagedOptions() {
+    if (!managedOptions) {
+        managedOptions = {
+            s3: getPresignedUrlS3Config,
+            resolveBucketName: createBucketNameResolver(),
+            ensureBucketProvisioned: createEnsureBucketProvisioned(),
+        };
+    }
+    return managedOptions;
+}
+/** A staging key: transient, and never what the object ends up under. */
+function stagingKey() {
+    return `.staging/${randomUUID()}`;
+}
+async function resolveDatabaseId(pgClient) {
+    const result = await pgClient.query({ text: `SELECT jwt_private.current_database_id() AS id` });
+    return result.rows[0]?.id ?? null;
 }
 /**
- * Upload resolver that streams files to S3/MinIO.
- *
- * Returns different shapes based on the column's type hint:
- * - 'image' / 'upload' → { filename, mime, url } (for jsonb domain columns)
- * - 'attachment' / default → url string (for text domain columns)
+ * Which default bucket an *unregistered* column resolves to.
  *
- * MIME validation happens before persistence: content type is detected from
- * stream bytes, validated against smart-tag/type rules, and only then uploaded.
+ * Columns written by the pre-managed resolver held a directly-embedded URL, so
+ * their readers assume a publicly addressable object; resolving them to the
+ * private default would break every page rendering one. A registered column
+ * states its own intent and this is not consulted.
  */
-async function uploadResolver(upload, _args, _context, info) {
-    const { tags, type } = info.uploadPlugin;
-    const s3 = getStreamer();
-    const { filename } = upload;
-    const key = generateKey(filename);
-    // MIME type validation from smart tags
-    const typ = type || tags?.type;
+const LEGACY_DEFAULT_PUBLIC_ACCESS = true;
+/** The mime allowlist for a column, from its smart tags or its type. */
+function allowedMimeTypes(tags, typ) {
     const VALID_MIME = /^[a-z]+\/[a-z0-9][a-z0-9!#$&\-.^_+]*$/i;
-    const mim = tags?.mime
-        ? String(tags.mime)
+    if (tags?.mime) {
+        return String(tags.mime)
             .trim()
             .split(',')
             .map((a) => a.trim())
-            .filter((m) => VALID_MIME.test(m))
-        : typ === 'image'
-            ? DEFAULT_IMAGE_MIME_TYPES
-            : [];
+            .filter((m) => VALID_MIME.test(m));
+    }
+    return typ === 'image' ? DEFAULT_IMAGE_MIME_TYPES : [];
+}
+/**
+ * Hash and measure bytes as they stream past, without buffering them.
+ *
+ * The final key is the content hash, which is only known once the last byte has
+ * gone by — so the object is staged first and promoted after. Nothing is held in
+ * memory: a 2GB upload streams through this the same as a 2KB one.
+ */
+function hashingPassThrough() {
+    const hash = createHash('sha256');
+    let bytes = 0;
+    const stream = new Transform({
+        transform(chunk, _encoding, callback) {
+            hash.update(chunk);
+            bytes += chunk.length;
+            callback(null, chunk);
+        },
+    });
+    return Object.assign(stream, {
+        digest: () => hash.digest('hex'),
+        bytes: () => bytes,
+    });
+}
+/**
+ * Stream an upload into managed storage and return the value the column stores.
+ *
+ * Shape by column type hint:
+ *   * `image` / `upload` (jsonb domains) → the projection document, including a
+ *     compatibility `url` for public buckets.
+ *   * `attachment` (text domain) → the object's public URL. A text column cannot
+ *     hold a projection, so the files row is still authoritative but the column
+ *     itself carries no id; the row keeps the object alive. A private bucket
+ *     raises rather than storing an expiring presigned URL in a column.
+ */
+async function uploadResolver(upload, _args, context, info) {
+    const { tags, type, field } = info.uploadPlugin;
+    const typ = type || tags?.type;
+    const withPgClient = context?.withPgClient;
+    const pgSettings = context?.pgSettings ?? null;
+    if (!withPgClient) {
+        throw new Error('UPLOAD_NO_PG_CLIENT: a managed upload resolves its bucket in the database, so the ' +
+            'GraphQL context must carry withPgClient');
+    }
+    if (!field) {
+        throw new Error('UPLOAD_FIELD_UNKNOWN: the upload plugin did not report which column is being written, ' +
+            'so the storage module and bucket backing it cannot be resolved');
+    }
+    const databaseId = await withRequestPgClient(withPgClient, pgSettings, (pgClient) => resolveDatabaseId(pgClient));
+    if (!databaseId)
+        throw new Error('DATABASE_NOT_FOUND');
+    const target = await resolveManagedUploadTarget({
+        options: getManagedOptions(),
+        withPgClient,
+        pgSettings,
+        databaseId,
+        field: field,
+        defaultPublicAccess: LEGACY_DEFAULT_PUBLIC_ACCESS,
+    });
+    if (typ === 'attachment' && !target.bucket.is_public) {
+        throw new Error('ATTACHMENT_BUCKET_NOT_PUBLIC: an attachment column stores a plain URL, and the resolved ' +
+            `bucket "${target.bucket.key}" is private, whose only URLs expire. Use an upload column, ` +
+            'which stores the file id and resolves a fresh download URL on read.');
+    }
+    const s3 = getStreamer();
+    const { filename } = upload;
+    // Validate before persisting: content type comes from the leading bytes, not
+    // from the client's claim about them.
     const detected = await s3.detectContentType({
         readStream: upload.createReadStream(),
         filename,
     });
-    const detectedContentType = detected.contentType;
-    if (mim.length && !mim.includes(detectedContentType)) {
+    const allowed = allowedMimeTypes(tags, typ);
+    if (allowed.length && !allowed.includes(detected.contentType)) {
         detected.stream.destroy();
         throw new Error('UPLOAD_MIMETYPE');
     }
-    const result = await s3.uploadWithContentType({
-        readStream: detected.stream,
-        contentType: detectedContentType,
+    const staged = stagingKey();
+    const hashing = hashingPassThrough();
+    const uploadResult = await s3.uploadWithContentType({
+        readStream: detected.stream.pipe(hashing),
+        contentType: detected.contentType,
         magic: detected.magic,
-        key,
-        bucket: bucketName,
+        key: staged,
+        bucket: target.physicalName,
+    });
+    // Owns the staged key from here: it either promotes it into a files row or
+    // removes it, so a failed upload leaves nothing behind in S3.
+    const { projection } = await finalizeStagedUpload({
+        target,
+        withPgClient,
+        pgSettings,
+        staged: {
+            stagingKey: staged,
+            contentHash: hashing.digest(),
+            contentType: uploadResult.contentType,
+            size: hashing.bytes(),
+            filename,
+        },
     });
-    const url = result.upload.Location;
-    const { contentType } = result;
     switch (typ) {
         case 'image':
         case 'upload':
-            return { filename, mime: contentType, url };
+            // `filename` and `mime` were in the pre-managed shape and stay in it;
+            // `url` is populated for public buckets and deprecated in favour of `id`.
+            return { ...projection, filename, mime: uploadResult.contentType };
         case 'attachment':
         default:
-            return url;
+            if (!projection.url) {
+                throw new Error(`ATTACHMENT_NO_PUBLIC_URL: bucket "${target.bucket.key}" has no public URL prefix ` +
+                    'configured, so there is no durable URL to store in a text column');
+            }
+            return projection.url;
     }
 }
 /**

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "graphile-settings",
-  "version": "6.13.8",
+  "version": "6.14.0",
   "author": "Constructive <developers@constructive.io>",
   "description": "graphile settings",
   "main": "index.js",
@@ -33,7 +33,7 @@
     "@constructive-io/bucket-provisioner": "^0.24.0",
     "@constructive-io/graphql-env": "^3.29.3",
     "@constructive-io/graphql-types": "^3.28.3",
-    "@constructive-io/s3-streamer": "^2.39.3",
+    "@constructive-io/s3-streamer": "^2.40.0",
     "@constructive-io/s3-utils": "^2.30.0",
     "@constructive-io/upload-names": "^2.29.0",
     "@dataplan/json": "1.0.1",
@@ -59,10 +59,10 @@
     "graphile-meta": "^1.7.1",
     "graphile-pg-aggregates": "^2.11.7",
     "graphile-postgis": "^3.11.7",
-    "graphile-presigned-url-plugin": "^1.11.4",
+    "graphile-presigned-url-plugin": "^1.12.0",
     "graphile-realtime-subscriptions": "^1.10.5",
     "graphile-search": "^2.11.7",
-    "graphile-upload-plugin": "^2.24.2",
+    "graphile-upload-plugin": "^2.25.0",
     "graphile-utils": "5.0.3",
     "graphql": "16.13.0",
     "inflekt": "^0.8.1",
@@ -91,5 +91,5 @@
     "constructive",
     "graphql"
   ],
-  "gitHead": "d6afee66ac3400e78864b9e259cdd6ab9184b251"
+  "gitHead": "44f56ee80a348f649a22e5bd32b35f2822726509"
 }

package/presigned-url-resolver.d.ts

@@ -19,9 +19,10 @@ import type { BucketNameResolver, EnsureBucketProvisioned, S3Config } from 'grap
  * pgpmDefaults → config file → env vars), creates an S3Client, and caches
  * the result. Same CDN config as upload-resolver.ts.
  *
- * NOTE: The `bucket` field here is the global fallback bucket name
- * (from BUCKET_NAME env var). When `resolveBucketName` is provided,
- * per-database bucket names take precedence for all S3 operations.
+ * NOTE: The `bucket` field here is only the connection's default and is never
+ * uploaded to. Every managed upload names its bucket explicitly, resolved from
+ * the tenant's logical bucket row via `resolveBucketName`; there is no
+ * environment-global upload bucket.
  */
 export declare function getPresignedUrlS3Config(): S3Config;
 /**

package/presigned-url-resolver.js

@@ -31,9 +31,10 @@ let s3Config = null;
  * pgpmDefaults → config file → env vars), creates an S3Client, and caches
  * the result. Same CDN config as upload-resolver.ts.
  *
- * NOTE: The `bucket` field here is the global fallback bucket name
- * (from BUCKET_NAME env var). When `resolveBucketName` is provided,
- * per-database bucket names take precedence for all S3 operations.
+ * NOTE: The `bucket` field here is only the connection's default and is never
+ * uploaded to. Every managed upload names its bucket explicitly, resolved from
+ * the tenant's logical bucket row via `resolveBucketName`; there is no
+ * environment-global upload bucket.
  */
 function getPresignedUrlS3Config() {
     if (s3Config)

package/upload-resolver.d.ts

@@ -1,15 +1,24 @@
 /**
- * Upload resolver for the Constructive upload plugin.
+ * Upload resolver for the Constructive upload plugin (multipart `Upload` scalar).
  *
- * Reads CDN/S3/MinIO configuration from environment variables (via getEnvOptions)
- * and streams uploaded files to the configured storage backend.
+ * This is the streaming transport into the *managed* storage lane: bytes arrive
+ * on the mutation, and the file they carry gets the same treatment a presigned
+ * upload gets — a bucket resolved inside the tenant, a content-addressed key, a
+ * files row, and a projection document naming that row.
  *
- * Lazily initializes the S3 streamer on first upload to avoid requiring
- * env vars at module load time.
+ * It used to be a second storage model: stream to `BUCKET_NAME` under a random
+ * key, hand back a URL, record nothing. Objects written that way belonged to no
+ * database, could not be deduplicated, listed, or access-controlled, and storage
+ * GC could not see that a document still pointed at them. There is no
+ * environment bucket in this path any more; `cdn.*` supplies S3 credentials and
+ * an endpoint only.
  *
- * ENV VARS:
+ * Compatibility: `image`/`upload` columns still receive `url` alongside the new
+ * `id`/`key`/`bucket_id`/`size` fields, so existing readers of `photo.url` keep
+ * working while they migrate to `id` + the files row's late-bound `downloadUrl`.
+ *
+ * ENV VARS (S3 connection only):
  *   BUCKET_PROVIDER  - 'minio' | 's3' (default: 'minio')
- *   BUCKET_NAME      - bucket name (default: 'test-bucket')
  *   AWS_REGION       - AWS region (default: 'us-east-1')
  *   AWS_ACCESS_KEY   - access key (default: 'minioadmin')
  *   AWS_SECRET_KEY   - secret key (default: 'minioadmin')

package/upload-resolver.js

@@ -1,16 +1,25 @@
 "use strict";
 /**
- * Upload resolver for the Constructive upload plugin.
+ * Upload resolver for the Constructive upload plugin (multipart `Upload` scalar).
  *
- * Reads CDN/S3/MinIO configuration from environment variables (via getEnvOptions)
- * and streams uploaded files to the configured storage backend.
+ * This is the streaming transport into the *managed* storage lane: bytes arrive
+ * on the mutation, and the file they carry gets the same treatment a presigned
+ * upload gets — a bucket resolved inside the tenant, a content-addressed key, a
+ * files row, and a projection document naming that row.
  *
- * Lazily initializes the S3 streamer on first upload to avoid requiring
- * env vars at module load time.
+ * It used to be a second storage model: stream to `BUCKET_NAME` under a random
+ * key, hand back a URL, record nothing. Objects written that way belonged to no
+ * database, could not be deduplicated, listed, or access-controlled, and storage
+ * GC could not see that a document still pointed at them. There is no
+ * environment bucket in this path any more; `cdn.*` supplies S3 credentials and
+ * an endpoint only.
  *
- * ENV VARS:
+ * Compatibility: `image`/`upload` columns still receive `url` alongside the new
+ * `id`/`key`/`bucket_id`/`size` fields, so existing readers of `photo.url` keep
+ * working while they migrate to `id` + the files row's late-bound `downloadUrl`.
+ *
+ * ENV VARS (S3 connection only):
  *   BUCKET_PROVIDER  - 'minio' | 's3' (default: 'minio')
- *   BUCKET_NAME      - bucket name (default: 'test-bucket')
  *   AWS_REGION       - AWS region (default: 'us-east-1')
  *   AWS_ACCESS_KEY   - access key (default: 'minioadmin')
  *   AWS_SECRET_KEY   - secret key (default: 'minioadmin')
@@ -23,100 +32,199 @@ Object.defineProperty(exports, "__esModule", { value: true });
 exports.constructiveUploadFieldDefinitions = void 0;
 const graphql_env_1 = require("@constructive-io/graphql-env");
 const s3_streamer_1 = __importDefault(require("@constructive-io/s3-streamer"));
-const upload_names_1 = __importDefault(require("@constructive-io/upload-names"));
 const logger_1 = require("@pgpmjs/logger");
 const crypto_1 = require("crypto");
+const graphile_presigned_url_plugin_1 = require("graphile-presigned-url-plugin");
+const stream_1 = require("stream");
+const presigned_url_resolver_1 = require("./presigned-url-resolver");
 const log = new logger_1.Logger('upload-resolver');
 const DEFAULT_IMAGE_MIME_TYPES = ['image/jpeg', 'image/png', 'image/svg+xml'];
 let streamer = null;
-let bucketName;
+/**
+ * The S3 streamer, built from the CDN connection settings.
+ *
+ * Deliberately constructed with no `defaultBucket`: every upload names the
+ * bucket it resolved, and a default here would be an environment-owned bucket
+ * standing in for a tenant's.
+ */
 function getStreamer() {
     if (streamer)
         return streamer;
-    const opts = (0, graphql_env_1.getEnvOptions)();
-    const cdn = opts.cdn || {};
-    const provider = cdn.provider || 'minio';
-    bucketName = cdn.bucketName || 'test-bucket';
-    const awsRegion = cdn.awsRegion || 'us-east-1';
-    const awsAccessKey = cdn.awsAccessKey || 'minioadmin';
-    const awsSecretKey = cdn.awsSecretKey || 'minioadmin';
-    const endpoint = cdn.endpoint || 'http://localhost:9000';
-    if (process.env.NODE_ENV === 'production') {
-        if (!cdn.awsAccessKey || !cdn.awsSecretKey) {
-            log.warn('[upload-resolver] WARNING: Using default credentials in production.');
-        }
+    const { cdn = {} } = (0, graphql_env_1.getEnvOptions)();
+    if (process.env.NODE_ENV === 'production' && (!cdn.awsAccessKey || !cdn.awsSecretKey)) {
+        log.warn('[upload-resolver] WARNING: Using default credentials in production.');
     }
-    log.info(`[upload-resolver] Initializing: provider=${provider} bucket=${bucketName}`);
+    const provider = cdn.provider || 'minio';
+    log.info(`[upload-resolver] Initializing: provider=${provider}`);
     streamer = new s3_streamer_1.default({
-        defaultBucket: bucketName,
-        awsRegion,
-        awsSecretKey,
-        awsAccessKey,
-        endpoint,
         provider,
+        awsRegion: cdn.awsRegion || 'us-east-1',
+        awsAccessKey: cdn.awsAccessKey || 'minioadmin',
+        awsSecretKey: cdn.awsSecretKey || 'minioadmin',
+        endpoint: cdn.endpoint || 'http://localhost:9000',
     });
     return streamer;
 }
 /**
- * Generates a randomized storage key from a filename.
- * Format: {random10chars}-{sanitized-filename}
+ * The upload lane's view of the presigned plugin's options: the same S3
+ * connection, physical-name policy, and provisioning hook the presigned lane
+ * uses, so both transports resolve identical coordinates for a bucket.
+ *
+ * Built on first upload rather than at import time — `createBucketNameResolver`
+ * throws on a missing name prefix, and that must surface as a failed upload, not
+ * as a server that will not boot.
  */
-function generateKey(filename) {
-    const rand = (0, crypto_1.randomBytes)(12).toString('hex');
-    return `${rand}-${(0, upload_names_1.default)(filename)}`;
+let managedOptions = null;
+function getManagedOptions() {
+    if (!managedOptions) {
+        managedOptions = {
+            s3: presigned_url_resolver_1.getPresignedUrlS3Config,
+            resolveBucketName: (0, presigned_url_resolver_1.createBucketNameResolver)(),
+            ensureBucketProvisioned: (0, presigned_url_resolver_1.createEnsureBucketProvisioned)(),
+        };
+    }
+    return managedOptions;
+}
+/** A staging key: transient, and never what the object ends up under. */
+function stagingKey() {
+    return `.staging/${(0, crypto_1.randomUUID)()}`;
+}
+async function resolveDatabaseId(pgClient) {
+    const result = await pgClient.query({ text: `SELECT jwt_private.current_database_id() AS id` });
+    return result.rows[0]?.id ?? null;
 }
 /**
- * Upload resolver that streams files to S3/MinIO.
- *
- * Returns different shapes based on the column's type hint:
- * - 'image' / 'upload' → { filename, mime, url } (for jsonb domain columns)
- * - 'attachment' / default → url string (for text domain columns)
+ * Which default bucket an *unregistered* column resolves to.
  *
- * MIME validation happens before persistence: content type is detected from
- * stream bytes, validated against smart-tag/type rules, and only then uploaded.
+ * Columns written by the pre-managed resolver held a directly-embedded URL, so
+ * their readers assume a publicly addressable object; resolving them to the
+ * private default would break every page rendering one. A registered column
+ * states its own intent and this is not consulted.
  */
-async function uploadResolver(upload, _args, _context, info) {
-    const { tags, type } = info.uploadPlugin;
-    const s3 = getStreamer();
-    const { filename } = upload;
-    const key = generateKey(filename);
-    // MIME type validation from smart tags
-    const typ = type || tags?.type;
+const LEGACY_DEFAULT_PUBLIC_ACCESS = true;
+/** The mime allowlist for a column, from its smart tags or its type. */
+function allowedMimeTypes(tags, typ) {
     const VALID_MIME = /^[a-z]+\/[a-z0-9][a-z0-9!#$&\-.^_+]*$/i;
-    const mim = tags?.mime
-        ? String(tags.mime)
+    if (tags?.mime) {
+        return String(tags.mime)
             .trim()
             .split(',')
             .map((a) => a.trim())
-            .filter((m) => VALID_MIME.test(m))
-        : typ === 'image'
-            ? DEFAULT_IMAGE_MIME_TYPES
-            : [];
+            .filter((m) => VALID_MIME.test(m));
+    }
+    return typ === 'image' ? DEFAULT_IMAGE_MIME_TYPES : [];
+}
+/**
+ * Hash and measure bytes as they stream past, without buffering them.
+ *
+ * The final key is the content hash, which is only known once the last byte has
+ * gone by — so the object is staged first and promoted after. Nothing is held in
+ * memory: a 2GB upload streams through this the same as a 2KB one.
+ */
+function hashingPassThrough() {
+    const hash = (0, crypto_1.createHash)('sha256');
+    let bytes = 0;
+    const stream = new stream_1.Transform({
+        transform(chunk, _encoding, callback) {
+            hash.update(chunk);
+            bytes += chunk.length;
+            callback(null, chunk);
+        },
+    });
+    return Object.assign(stream, {
+        digest: () => hash.digest('hex'),
+        bytes: () => bytes,
+    });
+}
+/**
+ * Stream an upload into managed storage and return the value the column stores.
+ *
+ * Shape by column type hint:
+ *   * `image` / `upload` (jsonb domains) → the projection document, including a
+ *     compatibility `url` for public buckets.
+ *   * `attachment` (text domain) → the object's public URL. A text column cannot
+ *     hold a projection, so the files row is still authoritative but the column
+ *     itself carries no id; the row keeps the object alive. A private bucket
+ *     raises rather than storing an expiring presigned URL in a column.
+ */
+async function uploadResolver(upload, _args, context, info) {
+    const { tags, type, field } = info.uploadPlugin;
+    const typ = type || tags?.type;
+    const withPgClient = context?.withPgClient;
+    const pgSettings = context?.pgSettings ?? null;
+    if (!withPgClient) {
+        throw new Error('UPLOAD_NO_PG_CLIENT: a managed upload resolves its bucket in the database, so the ' +
+            'GraphQL context must carry withPgClient');
+    }
+    if (!field) {
+        throw new Error('UPLOAD_FIELD_UNKNOWN: the upload plugin did not report which column is being written, ' +
+            'so the storage module and bucket backing it cannot be resolved');
+    }
+    const databaseId = await (0, graphile_presigned_url_plugin_1.withRequestPgClient)(withPgClient, pgSettings, (pgClient) => resolveDatabaseId(pgClient));
+    if (!databaseId)
+        throw new Error('DATABASE_NOT_FOUND');
+    const target = await (0, graphile_presigned_url_plugin_1.resolveManagedUploadTarget)({
+        options: getManagedOptions(),
+        withPgClient,
+        pgSettings,
+        databaseId,
+        field: field,
+        defaultPublicAccess: LEGACY_DEFAULT_PUBLIC_ACCESS,
+    });
+    if (typ === 'attachment' && !target.bucket.is_public) {
+        throw new Error('ATTACHMENT_BUCKET_NOT_PUBLIC: an attachment column stores a plain URL, and the resolved ' +
+            `bucket "${target.bucket.key}" is private, whose only URLs expire. Use an upload column, ` +
+            'which stores the file id and resolves a fresh download URL on read.');
+    }
+    const s3 = getStreamer();
+    const { filename } = upload;
+    // Validate before persisting: content type comes from the leading bytes, not
+    // from the client's claim about them.
     const detected = await s3.detectContentType({
         readStream: upload.createReadStream(),
         filename,
     });
-    const detectedContentType = detected.contentType;
-    if (mim.length && !mim.includes(detectedContentType)) {
+    const allowed = allowedMimeTypes(tags, typ);
+    if (allowed.length && !allowed.includes(detected.contentType)) {
         detected.stream.destroy();
         throw new Error('UPLOAD_MIMETYPE');
     }
-    const result = await s3.uploadWithContentType({
-        readStream: detected.stream,
-        contentType: detectedContentType,
+    const staged = stagingKey();
+    const hashing = hashingPassThrough();
+    const uploadResult = await s3.uploadWithContentType({
+        readStream: detected.stream.pipe(hashing),
+        contentType: detected.contentType,
         magic: detected.magic,
-        key,
-        bucket: bucketName,
+        key: staged,
+        bucket: target.physicalName,
+    });
+    // Owns the staged key from here: it either promotes it into a files row or
+    // removes it, so a failed upload leaves nothing behind in S3.
+    const { projection } = await (0, graphile_presigned_url_plugin_1.finalizeStagedUpload)({
+        target,
+        withPgClient,
+        pgSettings,
+        staged: {
+            stagingKey: staged,
+            contentHash: hashing.digest(),
+            contentType: uploadResult.contentType,
+            size: hashing.bytes(),
+            filename,
+        },
     });
-    const url = result.upload.Location;
-    const { contentType } = result;
     switch (typ) {
         case 'image':
         case 'upload':
-            return { filename, mime: contentType, url };
+            // `filename` and `mime` were in the pre-managed shape and stay in it;
+            // `url` is populated for public buckets and deprecated in favour of `id`.
+            return { ...projection, filename, mime: uploadResult.contentType };
         case 'attachment':
         default:
-            return url;
+            if (!projection.url) {
+                throw new Error(`ATTACHMENT_NO_PUBLIC_URL: bucket "${target.bucket.key}" has no public URL prefix ` +
+                    'configured, so there is no durable URL to store in a text column');
+            }
+            return projection.url;
     }
 }
 /**