Add batch plot image upload endpoint

[realproject7]

Summary

• New POST /api/upload-plot-images endpoint for multi-image batch uploads
• Single wallet signature covers entire batch (message: PlotLink: Upload plot images\nTimestamp: ...)
• Per-file validation: WebP/JPEG only, max 1MB, magic byte verification
• Returns ordered array of results: { index, cid, url, mimeType, sizeBytes } per success, { index, error } per failure
• Enforces max 20 files per batch, 3 batch requests/minute per wallet
• Does not modify existing /api/upload-plot-image single-file endpoint

Closes #1213

Test plan

• TypeScript typecheck passes
• ESLint passes (no new errors)
• Unit tests pass (7 tests: auth, validation, batch limits, rate limiting, ordered results)
• RE1/RE2 review
• Integration test: upload 2-3 valid images, verify CIDs returned
• Test invalid file rejection (PNG, oversized, bad magic bytes)
• Test rate limit (4th batch in <1 min returns 429)

🤖 Generated with Claude Code

[vercel]

The latest updates on your projects. Learn more about Vercel for GitHub.

1 Skipped Deployment

Project	Deployment	Actions	Updated (UTC)
plotlink	Ignored		May 16, 2026 11:22pm

[realproject7]

RE2 Review: ✅ Approve

Well-structured endpoint. Auth, validation, rate limiting, and ordered results all look correct.

Highlights:

• Wallet signature with timestamp expiry (5 min) — solid
• Magic byte verification prevents type spoofing
• Per-file error reporting without aborting the batch — good UX
• Parallel uploads via Promise.all is appropriate for ≤20 files
• Existing single-file endpoint untouched

Minor non-blocking note:

• walletBatchLog Map grows unbounded — old entries are filtered on read but stale wallet keys are never evicted. In a serverless/short-lived environment (Vercel) this is fine since instances recycle frequently, but in a long-running server it would be a slow memory leak. Not a blocker for MVP.

CI: lint-and-typecheck and e2e still pending at review time.

[project7-interns]

Verdict: REQUEST CHANGES

Summary

The endpoint covers the main auth, validation, upload, ordered result, and rate-limit behavior, but it only recognizes one FormData field shape. #1213 explicitly calls out batch files such as file_0, file_1, or files[], so PlotToon-compatible clients using those common names would be rejected as empty uploads.

Findings

• [medium] Batch file extraction only accepts fields named exactly files, so files[] and file_0/file_1 requests are rejected with No files provided.
  • File: src/app/api/upload-plot-images/route.ts:101
  • Suggestion: Accept the documented/common batch field forms while preserving upload order, e.g. repeated files, repeated files[], and numeric file_<index> entries sorted by their index. Add tests for at least one non-files shape.

Decision

Requesting changes because this is an API compatibility issue against the ticket behavior, not just an implementation detail. CI was still pending at review time.

[project7-interns]

Verdict: APPROVE

Summary

The requested FormData compatibility fix is in place. The endpoint now accepts repeated files, repeated files[], and indexed file_0/file[0] forms while preserving numeric order for indexed fields, with tests covering the previously missing shapes.

Findings

• None blocking.

Decision

Approved. The prior RE1 finding is resolved. lint-and-typecheck is green on the updated commit; e2e was still pending at approval time and should be verified before merge.