feat: add graphile-bulk-mutations plugin

[pyramation]

Summary

Adds graphile-bulk-mutations — a PostGraphile v5 plugin for bulk insert, upsert, update, and delete mutations with ON CONFLICT handling and column-level grant safety.

Features:

• Bulk insert with optional ON CONFLICT DO NOTHING
• Bulk upsert with ON CONFLICT DO UPDATE SET (selective column updates via updateColumns)
• Bulk update/delete with condition-based WHERE clauses (supports both Condition and Filter types)
• Column-level SELECT grant safety — RETURNING <pk_columns> + follow-up SELECT instead of RETURNING *
• PG parameter batching (auto-split at 32K limit)
• Opt-in via smart tags (@behavior +bulkInsert +bulkUpsert +bulkUpdate +bulkDelete)
• Column-based conflict targeting (ON CONFLICT (col1, col2))
• Configurable: bulkMaxRows, bulkRequireWhere, bulkNaming

Architecture: 6 plugins (BulkInflectionPlugin, BulkTypesPlugin, BulkInsertPlugin, BulkUpsertPlugin, BulkUpdatePlugin, BulkDeletePlugin) using sideEffectWithPgClient for raw SQL execution.

Tests: 10 integration tests via graphile-test — 4 schema generation, 3 insert, 1 upsert, 1 update, 1 delete.

Related: Planning issue #844

Review & Testing Checklist for Human

• Verify ON CONFLICT behavior with real tables that have column-level SELECT grants (the RETURNING <pk> + follow-up SELECT pattern should handle this, but hasn't been tested with restricted roles)
• Test with graphile-connection-filter preset to verify operator-based WHERE conditions work (current tests only cover simple equality via Condition type)
• Verify upsert updateColumns option works correctly (selectively updating specific columns on conflict)
• Consider edge cases: multi-column unique constraints, tables with no primary key, composite PKs

Recommended test plan

1. Add @behavior +bulkInsert +bulkUpsert to a test table with column-level SELECT grants
2. Run a bulk insert with onConflict: { constraint: <ENUM>, action: IGNORE }
3. Verify that restricted columns are not leaked in the response
4. Test with connection-filter enabled: where: { name: { startsWith: "A" } } on bulk update/delete

Notes

• The plugin uses column-based conflict targeting (ON CONFLICT ("col1", "col2")) instead of constraint names because PgResourceUnique doesn't store the actual PostgreSQL constraint name
• WHERE clause builder supports both simple equality (PostGraphile's built-in Condition type) and operator-based filtering (Filter type from graphile-connection-filter)
• ESLint v9 config migration issue is pre-existing across the monorepo (not caused by this PR)

Link to Devin session: https://app.devin.ai/sessions/b5701e74c8b44bbf89db370f3323acf2
Requested by: @pyramation

[devin-ai-integration]

🤖 Devin AI Engineer

I'll be helping with this pull request! Here's what you should know:

✅ I will automatically:

• Address comments on this PR. Add '(aside)' to your comment to have me ignore it.
• Look at CI failures and help fix them

Note: I can only respond to comments from users who have write access to this repository.

⚙️ Control Options:

• Disable automatic comment and CI monitoring

[socket-security]

No dependency changes detected. Learn more about Socket for GitHub.

👍 No dependency changes detected in pull request