feat: add graphile-bucket-provisioner-plugin + wire into ConstructivePreset

[pyramation]

Summary

New PostGraphile v5 plugin that hooks into bucket creation mutations to automatically provision S3-compatible buckets using @constructive-io/bucket-provisioner.

Two provisioning pathways:

1. Auto-provisioning hook — wraps create* mutations on tables tagged with @storageBuckets to provision S3 buckets after the DB row is created
2. Explicit provisionBucket mutation — GraphQL mutation for manual/retry provisioning

Also adds packages/bucket-provisioner, packages/upload-client, and the new plugin to the CI test matrix.

Preset Integration (latest)

Wires BucketProvisionerPreset into ConstructivePreset following the same lazy-init pattern as the presigned URL plugin:

• bucket-provisioner-resolver.ts — reads CDN config via getEnvOptions() from @constructive-io/graphql-env, lazily creates and caches a StorageConnectionConfig on first use
• constructive-preset.ts — passes getBucketProvisionerConnection as a function ref (not called), so env vars are only read when the first provisioning operation runs
• JSDoc examples updated to show getEnvOptions() pattern instead of raw process.env

Updates since last revision

• Schema snapshot updated — schema-snapshot.test.ts.snap now includes the new provisionBucket mutation, ProvisionBucketInput, and ProvisionBucketPayload types added by the preset wiring. This confirms the plugin correctly extends the GraphQL schema when included in ConstructivePreset.

Review & Testing Checklist for Human

• allowedOrigins: ['http://localhost:3000'] hardcoded in preset (constructive-preset.ts:94) — this is a dev default. Verify this is acceptable for production or if it should come from getEnvOptions() / a config value instead.
• SQL interpolation in plugin.ts:264-268 — bucket schema/table names are interpolated into a query string via "${storageModule.buckets_schema}"."${storageModule.buckets_table}". Values come from the trusted storage_module table, but verify this is acceptable vs. parameterized queries.
• resolveConnection() mutates the passed-in options object (plugin.ts:82-86) — it replaces options.connection (the lazy getter function) with the resolved value for caching. This is a side effect on the caller's object. Confirm this is intentional.
• Tests are entirely mock-based — grafast, graphile-utils, bucket-provisioner, and logger are all mocked. No integration tests against a real PostGraphile instance. Consider whether this gives sufficient confidence for the plugin's hook-based behavior.
• Verify the schema snapshot diff looks correct — the updated snapshot adds provisionBucket mutation, ProvisionBucketInput, and ProvisionBucketPayload. Spot-check that no existing types were accidentally removed or altered.

Recommended test plan: Deploy with a local PostGraphile + MinIO setup, run a createBucket mutation on a @storageBuckets-tagged table, and verify both the DB row and S3 bucket are created. Then test the failure case (e.g., bad S3 credentials) to confirm the mutation still succeeds and the error is logged.

Notes

• Lock file changes are AWS SDK dependency deduplication from merging the bucket-provisioner branch — not new dependency additions.
• The provisionBucketForRow helper queries STORAGE_MODULE_QUERY for endpoint/provider overrides, but in the explicit mutation path this same query is also run earlier to find the bucket table. Minor redundancy, not a bug.
• bucket-provisioner-resolver.ts follows the exact same pattern as presigned-url-resolver.ts (module-level cache, lazy init on first call via getEnvOptions()).
• The CDNOptions.provider type ('s3' | 'minio' | 'gcs') is a subset of StorageConnectionConfig.provider ('s3' | 'minio' | 'r2' | 'gcs' | 'spaces'), so the cast in the resolver is safe.
• Schema snapshot changes are purely additive — existing types are unchanged, only new bucket provisioner types were appended.

Link to Devin session: https://app.devin.ai/sessions/4c882ba2dfbf4045adf85fb83cde6f77
Requested by: @pyramation

---

[devin-ai-integration]

🤖 Devin AI Engineer

I'll be helping with this pull request! Here's what you should know:

✅ I will automatically:

• Address comments on this PR. Add '(aside)' to your comment to have me ignore it.
• Look at CI failures and help fix them

Note: I can only respond to comments from users who have write access to this repository.

⚙️ Control Options:

• Disable automatic comment and CI monitoring

[socket-security]

All alerts resolved. Learn more about Socket for GitHub.

This PR previously contained dependency changes with security issues that have been resolved, removed, or ignored.

View full report

[devin-ai-integration]

✅ Devin Review: No Issues Found

Devin Review analyzed this PR and found no potential bugs to report.

View in Devin Review to see 6 additional findings.