@lowdefy/plugin-aws 6.1.0 → 7.1.0

package/dist/blocks/S3UploadButton/gallery.yaml

@@ -23,7 +23,7 @@
       properties:
         s3PostPolicyRequestId: s3_upload_policy_request
         button:
-          icon: UploadOutlined
+          icon: upload
           title: Choose File
           type: default
     - id: basic_custom_icon
@@ -31,7 +31,7 @@
       properties:
         s3PostPolicyRequestId: s3_upload_policy_request
         button:
-          icon: AiOutlineCloudUpload
+          icon: CloudUpload
           title: Upload to Cloud
           type: default
 
@@ -43,7 +43,7 @@
         s3PostPolicyRequestId: s3_upload_policy_request
         accept: 'image/*'
         button:
-          icon: AiOutlinePicture
+          icon: image
           title: Upload Image
           type: default
     - id: accept_pdf
@@ -52,7 +52,7 @@
         s3PostPolicyRequestId: s3_upload_policy_request
         accept: '.pdf'
         button:
-          icon: AiOutlineFilePdf
+          icon: FileText
           title: Upload PDF
           type: default
     - id: accept_specific
@@ -61,7 +61,7 @@
         s3PostPolicyRequestId: s3_upload_policy_request
         accept: '.jpg,.png,.gif'
         button:
-          icon: AiOutlinePicture
+          icon: image
           title: Upload JPG, PNG, or GIF
           type: default
 
@@ -73,7 +73,7 @@
         s3PostPolicyRequestId: s3_upload_policy_request
         singleFile: true
         button:
-          icon: UploadOutlined
+          icon: upload
           title: Upload Single File
           type: default
     - id: limit_max_three
@@ -82,7 +82,7 @@
         s3PostPolicyRequestId: s3_upload_policy_request
         maxCount: 3
         button:
-          icon: UploadOutlined
+          icon: upload
           title: Upload (Max 3)
           type: default
     - id: limit_single_images
@@ -92,7 +92,7 @@
         singleFile: true
         accept: 'image/*'
         button:
-          icon: AiOutlinePicture
+          icon: image
           title: Upload One Image
           type: default
 
@@ -103,7 +103,7 @@
       properties:
         s3PostPolicyRequestId: s3_upload_policy_request
         button:
-          icon: UploadOutlined
+          icon: upload
           title: Upload
           type: primary
     - id: button_large
@@ -111,7 +111,7 @@
       properties:
         s3PostPolicyRequestId: s3_upload_policy_request
         button:
-          icon: UploadOutlined
+          icon: upload
           title: Upload Files
           type: default
           size: large
@@ -120,7 +120,7 @@
       properties:
         s3PostPolicyRequestId: s3_upload_policy_request
         button:
-          icon: AiOutlinePaperClip
+          icon: attach
           title: Attach Files
           type: default
 
@@ -137,7 +137,7 @@
         s3PostPolicyRequestId: s3_upload_policy_request
         disabled: true
         button:
-          icon: UploadOutlined
+          icon: upload
           title: Upload
           type: primary
     - id: disabled_hidden_list
@@ -155,7 +155,7 @@
         s3PostPolicyRequestId: s3_upload_policy_request
         showUploadList: true
         button:
-          icon: UploadOutlined
+          icon: upload
           title: Upload (List Visible)
           type: default
     - id: list_hidden
@@ -164,7 +164,7 @@
         s3PostPolicyRequestId: s3_upload_policy_request
         showUploadList: false
         button:
-          icon: UploadOutlined
+          icon: upload
           title: Upload (No List)
           type: default
     - id: list_single_hidden
@@ -174,7 +174,7 @@
         singleFile: true
         showUploadList: false
         button:
-          icon: UploadOutlined
+          icon: upload
           title: Upload Single (No List)
           type: default
 
@@ -214,7 +214,7 @@
       properties:
         s3PostPolicyRequestId: s3_upload_policy_request
         button:
-          icon: UploadOutlined
+          icon: upload
           title: Upload
           type: default
     - id: style_label
@@ -232,7 +232,7 @@
       properties:
         s3PostPolicyRequestId: s3_upload_policy_request
         button:
-          icon: UploadOutlined
+          icon: upload
           title: Upload
           type: default
 
@@ -274,7 +274,7 @@
             s3PostPolicyRequestId: s3_upload_policy_request
             accept: '.pdf,.docx,.xlsx'
             button:
-              icon: AiOutlineFilePdf
+              icon: FileText
               title: Choose Document
               type: default
             label:
@@ -288,7 +288,7 @@
             title: Save Document
             color: primary
             variant: solid
-            icon: AiOutlineSave
+            icon: save
           events:
             onClick:
               - id: save_validate
@@ -314,7 +314,7 @@
             singleFile: true
             accept: 'image/*'
             button:
-              icon: AiOutlineCamera
+              icon: camera
               title: Choose Photo
               type: default
             label:
@@ -325,7 +325,7 @@
           required: true
           properties:
             title: Display Name
-            prefixIcon: AiOutlineUser
+            prefixIcon: user
             placeholder: Enter your display name
             label:
               colon: false
@@ -337,7 +337,7 @@
             title: Update Profile
             color: primary
             variant: solid
-            icon: AiOutlineCheck
+            icon: check
           events:
             onClick:
               - id: update_validate

package/dist/blocks/S3UploadButton/meta.js

@@ -16,7 +16,7 @@
 export default {
     category: 'input',
     icons: [
-        'AiOutlineUpload'
+        'upload'
     ],
     valueType: 'object',
     cssKeys: {
@@ -77,7 +77,7 @@ export default {
                 type: 'object',
                 description: 'Button block properties. See <a href="/Button">Button</a> for all properties.',
                 default: {
-                    icon: 'UploadOutlined',
+                    icon: 'upload',
                     title: 'Upload',
                     type: 'default'
                 },

package/dist/blocks/S3UploadDragger/gallery.yaml

@@ -219,7 +219,7 @@
                 title: Submit
                 color: primary
                 variant: solid
-                icon: AiOutlineUpload
+                icon: upload
               events:
                 onClick:
                   - id: submit_validate
@@ -265,7 +265,7 @@
                 title: Upload Photos
                 color: primary
                 variant: solid
-                icon: AiOutlineCloudUpload
+                icon: CloudUpload
               events:
                 onClick:
                   - id: gallery_msg

package/dist/blocks/S3UploadPhoto/gallery.yaml

@@ -169,20 +169,20 @@
           properties:
             title: Full Name
             placeholder: Enter your name
-            prefixIcon: AiOutlineUser
+            prefixIcon: user
         - id: profile_email
           type: TextInput
           properties:
             title: Email
             placeholder: you@example.com
-            prefixIcon: AiOutlineMail
+            prefixIcon: mail
         - id: profile_save
           type: Button
           properties:
             title: Save Profile
             color: primary
             variant: solid
-            icon: AiOutlineSave
+            icon: save
           events:
             onClick:
               - id: validate_profile
@@ -246,7 +246,7 @@
             title: List Product
             color: primary
             variant: solid
-            icon: AiOutlineCheck
+            icon: check
             block: true
           events:
             onClick:

package/dist/blocks/S3UploadPhoto/meta.js

@@ -16,8 +16,8 @@
 export default {
     category: 'input',
     icons: [
-        'AiOutlineLoading',
-        'AiOutlineCamera'
+        'loading',
+        'camera'
     ],
     valueType: 'object',
     cssKeys: {

package/dist/connections/AwsS3Bucket/AwsS3Bucket.js

@@ -12,15 +12,23 @@
   WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
   See the License for the specific language governing permissions and
   limitations under the License.
-*/ import AwsS3GetObject from './AwsS3GetObject/AwsS3GetObject.js';
+*/ import AwsS3DeleteObject from './AwsS3DeleteObject/AwsS3DeleteObject.js';
+import AwsS3GetObject from './AwsS3GetObject/AwsS3GetObject.js';
+import AwsS3HeadObject from './AwsS3HeadObject/AwsS3HeadObject.js';
 import AwsS3PresignedGetObject from './AwsS3PresignedGetObject/AwsS3PresignedGetObject.js';
 import AwsS3PresignedPostPolicy from './AwsS3PresignedPostPolicy/AwsS3PresignedPostPolicy.js';
 import AwsS3PutObject from './AwsS3PutObject/AwsS3PutObject.js';
 import schema from './schema.js';
 export default {
     schema,
+    // Object storage outside the app's database: a journey on a data set keeps its real target.
+    meta: {
+        dataSet: 'external'
+    },
     requests: {
+        AwsS3DeleteObject,
         AwsS3GetObject,
+        AwsS3HeadObject,
         AwsS3PresignedGetObject,
         AwsS3PresignedPostPolicy,
         AwsS3PutObject

package/dist/connections/AwsS3Bucket/AwsS3DeleteObject/AwsS3DeleteObject.js

@@ -0,0 +1,65 @@
+/*
+  Copyright 2020-2026 Lowdefy, Inc
+
+  Licensed under the Apache License, Version 2.0 (the "License");
+  you may not use this file except in compliance with the License.
+  You may obtain a copy of the License at
+
+      http://www.apache.org/licenses/LICENSE-2.0
+
+  Unless required by applicable law or agreed to in writing, software
+  distributed under the License is distributed on an "AS IS" BASIS,
+  WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+  See the License for the specific language governing permissions and
+  limitations under the License.
+*/ import { DeleteObjectCommand, DeleteObjectsCommand } from '@aws-sdk/client-s3';
+import { type } from '@lowdefy/helpers';
+import createS3Client from '../createS3Client.js';
+import schema from './schema.js';
+// Deletes only from the connection's bucket. S3 answers a delete of a key that does not exist as
+// a success, so such a key is returned as deleted. With several keys, S3 reports each key it could
+// not delete in the response instead of failing the call, so those come back as errors.
+async function AwsS3DeleteObject({ request, connection }) {
+    const { bucket } = connection;
+    const { key, keys } = request;
+    const s3 = createS3Client({
+        connection
+    });
+    if (!type.isNone(key)) {
+        await s3.send(new DeleteObjectCommand({
+            Bucket: bucket,
+            Key: key
+        }));
+        return {
+            bucket,
+            deleted: [
+                key
+            ],
+            errors: []
+        };
+    }
+    const response = await s3.send(new DeleteObjectsCommand({
+        Bucket: bucket,
+        Delete: {
+            Objects: keys.map((objectKey)=>({
+                    Key: objectKey
+                })),
+            Quiet: false
+        }
+    }));
+    return {
+        bucket,
+        deleted: (response.Deleted ?? []).map((deleted)=>deleted.Key),
+        errors: (response.Errors ?? []).map((error)=>({
+                key: error.Key,
+                code: error.Code,
+                message: error.Message
+            }))
+    };
+}
+AwsS3DeleteObject.schema = schema;
+AwsS3DeleteObject.meta = {
+    checkRead: false,
+    checkWrite: true
+};
+export default AwsS3DeleteObject;

package/dist/connections/AwsS3Bucket/AwsS3DeleteObject/schema.js

@@ -0,0 +1,86 @@
+/*
+  Copyright 2020-2026 Lowdefy, Inc
+
+  Licensed under the Apache License, Version 2.0 (the "License");
+  you may not use this file except in compliance with the License.
+  You may obtain a copy of the License at
+
+      http://www.apache.org/licenses/LICENSE-2.0
+
+  Unless required by applicable law or agreed to in writing, software
+  distributed under the License is distributed on an "AS IS" BASIS,
+  WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+  See the License for the specific language governing permissions and
+  limitations under the License.
+*/ export default {
+    $schema: 'http://json-schema.org/draft-07/schema#',
+    title: 'Lowdefy Request Schema - AwsS3DeleteObject',
+    type: 'object',
+    // An empty key makes the SDK send DELETE to the bucket itself, which S3 reads as DeleteBucket.
+    properties: {
+        key: {
+            type: 'string',
+            minLength: 1,
+            description: 'Key of the object to delete. Give either key or keys.',
+            errorMessage: {
+                type: 'AwsS3DeleteObject request property "key" should be a string.',
+                minLength: 'AwsS3DeleteObject request property "key" should not be empty.'
+            }
+        },
+        keys: {
+            type: 'array',
+            minItems: 1,
+            maxItems: 1000,
+            items: {
+                type: 'string',
+                minLength: 1,
+                errorMessage: {
+                    type: 'AwsS3DeleteObject request property "keys" should be an array of strings.',
+                    minLength: 'AwsS3DeleteObject request property "keys" should not hold an empty key.'
+                }
+            },
+            description: 'Keys of the objects to delete, 1 to 1000. Give either key or keys.',
+            errorMessage: {
+                type: 'AwsS3DeleteObject request property "keys" should be an array of strings.',
+                minItems: 'AwsS3DeleteObject request property "keys" should have at least 1 key.',
+                maxItems: 'AwsS3DeleteObject request property "keys" should have at most 1000 keys.'
+            }
+        }
+    },
+    // The bucket always comes from the connection, so a stray "bucket" is refused rather than
+    // ignored: ignoring it would delete the same key in the connection's bucket.
+    additionalProperties: false,
+    if: {
+        type: 'object'
+    },
+    then: {
+        oneOf: [
+            {
+                required: [
+                    'key'
+                ],
+                not: {
+                    required: [
+                        'keys'
+                    ]
+                }
+            },
+            {
+                required: [
+                    'keys'
+                ],
+                not: {
+                    required: [
+                        'key'
+                    ]
+                }
+            }
+        ]
+    },
+    errorMessage: {
+        type: 'AwsS3DeleteObject request properties should be an object.',
+        additionalProperties: 'AwsS3DeleteObject request should only have "key" or "keys".',
+        // The `then` above is the only check without a message of its own.
+        _: 'AwsS3DeleteObject request should have either "key" or "keys", not both.'
+    }
+};

package/dist/connections/AwsS3Bucket/AwsS3HeadObject/AwsS3HeadObject.js

@@ -0,0 +1,69 @@
+/*
+  Copyright 2020-2026 Lowdefy, Inc
+
+  Licensed under the Apache License, Version 2.0 (the "License");
+  you may not use this file except in compliance with the License.
+  You may obtain a copy of the License at
+
+      http://www.apache.org/licenses/LICENSE-2.0
+
+  Unless required by applicable law or agreed to in writing, software
+  distributed under the License is distributed on an "AS IS" BASIS,
+  WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+  See the License for the specific language governing permissions and
+  limitations under the License.
+*/ import { HeadObjectCommand } from '@aws-sdk/client-s3';
+import { type } from '@lowdefy/helpers';
+import createS3Client from '../createS3Client.js';
+import schema from './schema.js';
+// A missing object is an expected answer (e.g. checking a browser upload arrived), so it is
+// returned as data for the routine to act on rather than thrown. A HEAD response has no body,
+// so S3 reports a missing object only through the 404 status.
+async function AwsS3HeadObject({ request, connection }) {
+    const { bucket } = connection;
+    const { key, versionId } = request;
+    const params = {
+        Bucket: bucket,
+        Key: key
+    };
+    if (versionId) {
+        params.VersionId = versionId;
+    }
+    const s3 = createS3Client({
+        connection
+    });
+    let response;
+    try {
+        response = await s3.send(new HeadObjectCommand(params));
+    } catch (error) {
+        if (error.$metadata?.httpStatusCode === 404) {
+            return {
+                exists: false,
+                bucket,
+                key
+            };
+        }
+        throw error;
+    }
+    const result = {
+        exists: true,
+        bucket,
+        key,
+        size: response.ContentLength,
+        etag: response.ETag,
+        lastModified: response.LastModified
+    };
+    if (!type.isNone(response.ContentType)) {
+        result.contentType = response.ContentType;
+    }
+    if (!type.isNone(response.VersionId)) {
+        result.versionId = response.VersionId;
+    }
+    return result;
+}
+AwsS3HeadObject.schema = schema;
+AwsS3HeadObject.meta = {
+    checkRead: true,
+    checkWrite: false
+};
+export default AwsS3HeadObject;

package/dist/connections/AwsS3Bucket/AwsS3HeadObject/schema.js

@@ -0,0 +1,42 @@
+/*
+  Copyright 2020-2026 Lowdefy, Inc
+
+  Licensed under the Apache License, Version 2.0 (the "License");
+  you may not use this file except in compliance with the License.
+  You may obtain a copy of the License at
+
+      http://www.apache.org/licenses/LICENSE-2.0
+
+  Unless required by applicable law or agreed to in writing, software
+  distributed under the License is distributed on an "AS IS" BASIS,
+  WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+  See the License for the specific language governing permissions and
+  limitations under the License.
+*/ export default {
+    $schema: 'http://json-schema.org/draft-07/schema#',
+    title: 'Lowdefy Request Schema - AwsS3HeadObject',
+    type: 'object',
+    required: [
+        'key'
+    ],
+    properties: {
+        key: {
+            type: 'string',
+            description: 'Key under which the object is stored.',
+            errorMessage: {
+                type: 'AwsS3HeadObject request property "key" should be a string.'
+            }
+        },
+        versionId: {
+            type: 'string',
+            description: 'VersionId used to reference a specific version of the object.',
+            errorMessage: {
+                type: 'AwsS3HeadObject request property "versionId" should be a string.'
+            }
+        }
+    },
+    errorMessage: {
+        type: 'AwsS3HeadObject request properties should be an object.',
+        required: 'AwsS3HeadObject request should have required property "key".'
+    }
+};

package/dist/connections/AwsS3Bucket/AwsS3PresignedPostPolicy/AwsS3PresignedPostPolicy.js

@@ -13,6 +13,7 @@
   See the License for the specific language governing permissions and
   limitations under the License.
 */ import { createPresignedPost } from '@aws-sdk/s3-presigned-post';
+import { ConfigError } from '@lowdefy/errors';
 import { type } from '@lowdefy/helpers';
 import createS3Client from '../createS3Client.js';
 import schema from './schema.js';
@@ -34,7 +35,7 @@ async function AwsS3PresignedPostPolicy({ request, connection }) {
         params.Fields.acl = acl;
     }
     if (type.isObject(fields) === false) {
-        throw new Error(`properties.fields must be an object. Received ${JSON.stringify(fields)}.`);
+        throw new ConfigError('AwsS3PresignedPostPolicy request "fields" must be an object.');
     }
     Object.keys(fields).forEach((field)=>{
         if (fields[field]) {

package/dist/connections/AwsS3Bucket/AwsS3PutObject/AwsS3PutObject.js

@@ -13,36 +13,53 @@
   See the License for the specific language governing permissions and
   limitations under the License.
 */ import { PutObjectCommand } from '@aws-sdk/client-s3';
+import { type } from '@lowdefy/helpers';
+import copyFromUrl from './copyFromUrl.js';
 import createS3Client from '../createS3Client.js';
 import schema from './schema.js';
-// Server-side write: stores base64 content as an object. Used by API endpoint
-// routines that receive files as endpoint payloads (emitFileContent + CallAPI).
+// Server-side write. With `content`, stores base64 content as an object: used by API endpoint
+// routines that receive files as endpoint payloads (emitFileContent + CallAPI). With `url`,
+// streams what an https link answers into the bucket, so a file handed over as a presigned link
+// never passes through the routine.
 async function AwsS3PutObject({ request, connection }) {
     const { bucket } = connection;
-    const { acl, content, contentType, key } = request;
+    const { acl, content, contentType, key, url } = request;
     const params = {
         Bucket: bucket,
-        Key: key,
-        Body: Buffer.from(content, 'base64')
+        Key: key
     };
-    if (contentType) {
-        params.ContentType = contentType;
-    }
     if (acl) {
         params.ACL = acl;
     }
     const s3 = createS3Client({
         connection
     });
+    if (!type.isNone(url)) {
+        return copyFromUrl({
+            s3,
+            params,
+            request
+        });
+    }
+    params.Body = Buffer.from(content, 'base64');
+    if (contentType) {
+        params.ContentType = contentType;
+    }
     await s3.send(new PutObjectCommand(params));
     return {
         bucket,
-        key
+        key,
+        size: params.Body.length,
+        contentType: contentType ?? null
     };
 }
 AwsS3PutObject.schema = schema;
 AwsS3PutObject.meta = {
     checkRead: false,
-    checkWrite: true
+    checkWrite: true,
+    // A presigned url carries its signature.
+    credentialProperties: [
+        'url'
+    ]
 };
 export default AwsS3PutObject;

package/dist/connections/AwsS3Bucket/AwsS3PutObject/copyFromUrl.js

@@ -0,0 +1,190 @@
+/*
+  Copyright 2020-2026 Lowdefy, Inc
+
+  Licensed under the Apache License, Version 2.0 (the "License");
+  you may not use this file except in compliance with the License.
+  You may obtain a copy of the License at
+
+      http://www.apache.org/licenses/LICENSE-2.0
+
+  Unless required by applicable law or agreed to in writing, software
+  distributed under the License is distributed on an "AS IS" BASIS,
+  WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+  See the License for the specific language governing permissions and
+  limitations under the License.
+*/ import { Readable } from 'node:stream';
+import { PutObjectCommand } from '@aws-sdk/client-s3';
+import { type } from '@lowdefy/helpers';
+import createConnectPublic from '@lowdefy/node-utils/createConnectPublic.js';
+import { Agent, fetch } from 'undici';
+import createCopyError from './createCopyError.js';
+import limitBody from './limitBody.js';
+import matchesContentType from './matchesContentType.js';
+async function collect(chunks) {
+    const buffers = [];
+    for await (const chunk of chunks){
+        buffers.push(chunk);
+    }
+    return Buffer.concat(buffers);
+}
+const REDIRECT_STATUSES = new Set([
+    301,
+    302,
+    303,
+    307,
+    308
+]);
+const MAX_REDIRECTS = 20;
+const dispatcher = new Agent({
+    connect: createConnectPublic({
+        createNotPublicError: ()=>createCopyError({
+                code: 'url_not_public',
+                message: 'AwsS3PutObject "url" leads to an address that is not public.'
+            })
+    })
+});
+function isHttps(link) {
+    return URL.parse(link)?.protocol === 'https:';
+}
+async function fetchOnce({ url, signal }) {
+    try {
+        // Asks for the body uncompressed: fetch decodes a compressed body, whose length then no longer
+        // matches the Content-Length checked against maxBytes.
+        return await fetch(url, {
+            headers: {
+                'accept-encoding': 'identity'
+            },
+            dispatcher,
+            redirect: 'manual',
+            signal
+        });
+    } catch (error) {
+        if (signal.aborted) throw error;
+        if (error.cause?.code === 'url_not_public') throw error.cause;
+        // The url is left out of the message: a presigned link carries its signature.
+        throw createCopyError({
+            code: 'fetch_failed',
+            message: `AwsS3PutObject could not fetch the url: ${error.message}`,
+            cause: error
+        });
+    }
+}
+// Follows redirects by hand, so each link is checked to be https: before it is requested. The
+// dispatcher checks each link's address as it connects.
+async function fetchUrl({ url, signal }) {
+    let link = url;
+    for(let redirects = 0; redirects <= MAX_REDIRECTS; redirects += 1){
+        const response = await fetchOnce({
+            url: link,
+            signal
+        });
+        const location = response.headers.get('location');
+        if (!REDIRECT_STATUSES.has(response.status) || location === null) {
+            return response;
+        }
+        await response.body?.cancel();
+        link = URL.parse(location, link)?.href ?? location;
+        if (!isHttps(link)) {
+            throw createCopyError({
+                code: 'url_not_https',
+                message: 'AwsS3PutObject "url" redirected to a link that is not https:.'
+            });
+        }
+    }
+    throw createCopyError({
+        code: 'fetch_failed',
+        message: `AwsS3PutObject url redirected more than ${MAX_REDIRECTS} times.`
+    });
+}
+// Streams what an https url answers into the bucket, capped at maxBytes. A body with a
+// Content-Length streams straight into one PutObject; one without is read into memory, still
+// capped at maxBytes, since PutObject needs the length up front.
+async function copyFromUrl({ s3, params, request }) {
+    const { contentType, contentTypes, maxBytes, timeout = 20000, url } = request;
+    if (!isHttps(url)) {
+        throw createCopyError({
+            code: 'url_not_https',
+            message: 'AwsS3PutObject "url" must be an https: link.'
+        });
+    }
+    const signal = AbortSignal.timeout(timeout);
+    let refusal = null;
+    try {
+        const response = await fetchUrl({
+            url,
+            signal
+        });
+        if (!response.ok) {
+            await response.body?.cancel();
+            throw createCopyError({
+                code: 'fetch_failed',
+                message: `AwsS3PutObject url answered ${response.status}.`,
+                status: response.status
+            });
+        }
+        const responseType = response.headers.get('content-type');
+        const mediaType = responseType?.split(';')[0].trim().toLowerCase() ?? null;
+        if (!type.isNone(contentTypes) && (mediaType === null || !contentTypes.some((pattern)=>matchesContentType({
+                pattern,
+                mediaType
+            })))) {
+            await response.body?.cancel();
+            throw createCopyError({
+                code: 'content_type',
+                message: `AwsS3PutObject url content type ${JSON.stringify(mediaType)} is not one of ${contentTypes.join(', ')}.`
+            });
+        }
+        const lengthHeader = response.headers.get('content-length');
+        const declaredLength = lengthHeader === null ? null : Number(lengthHeader);
+        if (declaredLength !== null && declaredLength > maxBytes) {
+            await response.body?.cancel();
+            throw createCopyError({
+                code: 'too_large',
+                message: `AwsS3PutObject url content of ${declaredLength} bytes is larger than maxBytes (${maxBytes}).`
+            });
+        }
+        const chunks = limitBody({
+            body: response.body ?? [],
+            declaredLength,
+            maxBytes,
+            onRefuse: (error)=>{
+                refusal = error;
+            }
+        });
+        let size;
+        if (declaredLength === null) {
+            params.Body = await collect(chunks);
+            size = params.Body.length;
+        } else {
+            params.Body = Readable.from(chunks, {
+                objectMode: false
+            });
+            params.ContentLength = declaredLength;
+            size = declaredLength;
+        }
+        const storedType = contentType ?? responseType ?? null;
+        if (!type.isNone(storedType)) {
+            params.ContentType = storedType;
+        }
+        await s3.send(new PutObjectCommand(params), {
+            abortSignal: signal
+        });
+        return {
+            bucket: params.Bucket,
+            key: params.Key,
+            size,
+            contentType: storedType
+        };
+    } catch (error) {
+        if (refusal !== null) throw refusal;
+        if (signal.aborted) {
+            throw createCopyError({
+                code: 'timeout',
+                message: `AwsS3PutObject did not copy the url within the ${timeout} ms timeout.`,
+                cause: error
+            });
+        }
+        throw error;
+    }
+}
+export default copyFromUrl;

package/dist/connections/AwsS3Bucket/AwsS3PutObject/createCopyError.js

@@ -0,0 +1,28 @@
+/*
+  Copyright 2020-2026 Lowdefy, Inc
+
+  Licensed under the Apache License, Version 2.0 (the "License");
+  you may not use this file except in compliance with the License.
+  You may obtain a copy of the License at
+
+      http://www.apache.org/licenses/LICENSE-2.0
+
+  Unless required by applicable law or agreed to in writing, software
+  distributed under the License is distributed on an "AS IS" BASIS,
+  WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+  See the License for the specific language governing permissions and
+  limitations under the License.
+*/ import { type } from '@lowdefy/helpers';
+// A refused copy from a url. `code` names the reason, so a routine's :catch can answer each its own
+// way; `status` is the HTTP status the url answered with, when there was one.
+function createCopyError({ code, message, status, cause }) {
+    const error = new Error(message, {
+        cause
+    });
+    error.code = code;
+    if (!type.isUndefined(status)) {
+        error.status = status;
+    }
+    return error;
+}
+export default createCopyError;

package/dist/connections/AwsS3Bucket/AwsS3PutObject/limitBody.js

@@ -0,0 +1,58 @@
+/*
+  Copyright 2020-2026 Lowdefy, Inc
+
+  Licensed under the Apache License, Version 2.0 (the "License");
+  you may not use this file except in compliance with the License.
+  You may obtain a copy of the License at
+
+      http://www.apache.org/licenses/LICENSE-2.0
+
+  Unless required by applicable law or agreed to in writing, software
+  distributed under the License is distributed on an "AS IS" BASIS,
+  WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+  See the License for the specific language governing permissions and
+  limitations under the License.
+*/ import createCopyError from './createCopyError.js';
+// Yields the response body, refusing it as soon as it passes maxBytes or the Content-Length it
+// declared. The last chunk is held back until the body has ended and its length checked, so a
+// body that turns out longer or shorter than declared never completes the upload it feeds, and
+// S3 stores nothing. Each refusal is passed to onRefuse before it is thrown, since the S3 client
+// may report a failed body stream as an error of its own.
+async function* limitBody({ body, declaredLength, maxBytes, onRefuse }) {
+    function refuse(details) {
+        const error = createCopyError(details);
+        onRefuse(error);
+        return error;
+    }
+    let size = 0;
+    let held = null;
+    for await (const chunk of body){
+        size += chunk.byteLength;
+        if (size > maxBytes) {
+            throw refuse({
+                code: 'too_large',
+                message: `AwsS3PutObject url content is larger than maxBytes (${maxBytes}).`
+            });
+        }
+        if (declaredLength !== null && size > declaredLength) {
+            throw refuse({
+                code: 'fetch_failed',
+                message: `AwsS3PutObject url sent more than the ${declaredLength} bytes its Content-Length declared.`
+            });
+        }
+        if (held !== null) {
+            yield held;
+        }
+        held = Buffer.from(chunk.buffer, chunk.byteOffset, chunk.byteLength);
+    }
+    if (declaredLength !== null && size !== declaredLength) {
+        throw refuse({
+            code: 'fetch_failed',
+            message: `AwsS3PutObject url sent ${size} of the ${declaredLength} bytes its Content-Length declared.`
+        });
+    }
+    if (held !== null) {
+        yield held;
+    }
+}
+export default limitBody;

package/dist/connections/AwsS3Bucket/AwsS3PutObject/matchesContentType.js

@@ -0,0 +1,22 @@
+/*
+  Copyright 2020-2026 Lowdefy, Inc
+
+  Licensed under the Apache License, Version 2.0 (the "License");
+  you may not use this file except in compliance with the License.
+  You may obtain a copy of the License at
+
+      http://www.apache.org/licenses/LICENSE-2.0
+
+  Unless required by applicable law or agreed to in writing, software
+  distributed under the License is distributed on an "AS IS" BASIS,
+  WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+  See the License for the specific language governing permissions and
+  limitations under the License.
+*/ // A pattern is a media type ("image/png"), a type with any subtype ("image/*") or "*/*".
+function matchesContentType({ pattern, mediaType }) {
+    const wanted = pattern.trim().toLowerCase();
+    if (wanted === '*/*') return true;
+    if (wanted.endsWith('/*')) return mediaType.startsWith(wanted.slice(0, -1));
+    return mediaType === wanted;
+}
+export default matchesContentType;

package/dist/connections/AwsS3Bucket/AwsS3PutObject/schema.js

@@ -17,8 +17,7 @@
     title: 'Lowdefy Request Schema - AwsS3PutObject',
     type: 'object',
     required: [
-        'key',
-        'content'
+        'key'
     ],
     properties: {
         acl: {
@@ -40,7 +39,7 @@
         },
         content: {
             type: 'string',
-            description: 'Object content as a base64 encoded string.',
+            description: 'Object content as a base64 encoded string. Give either content or url.',
             errorMessage: {
                 type: 'AwsS3PutObject request property "content" should be a string.'
             }
@@ -52,19 +51,98 @@
                 type: 'AwsS3PutObject request property "contentType" should be a string.'
             }
         },
+        contentTypes: {
+            type: 'array',
+            items: {
+                type: 'string'
+            },
+            description: 'With url, the content types the url may answer with, such as "image/png", "image/*" or "application/pdf". Any other is refused with code "content_type".',
+            errorMessage: {
+                type: 'AwsS3PutObject request property "contentTypes" should be an array of strings.'
+            }
+        },
         key: {
             type: 'string',
             description: 'Key under which the object will be stored.',
             errorMessage: {
                 type: 'AwsS3PutObject request property "key" should be a string.'
             }
+        },
+        maxBytes: {
+            type: 'integer',
+            minimum: 1,
+            description: 'Required with url. The most bytes the url may answer with. A larger answer is refused with code "too_large" and nothing is stored.',
+            errorMessage: {
+                type: 'AwsS3PutObject request property "maxBytes" should be a positive integer.',
+                minimum: 'AwsS3PutObject request property "maxBytes" should be a positive integer.'
+            }
+        },
+        timeout: {
+            type: 'integer',
+            minimum: 1,
+            default: 20000,
+            description: 'With url, the milliseconds the whole fetch and upload may take before it is refused with code "timeout".',
+            errorMessage: {
+                type: 'AwsS3PutObject request property "timeout" should be a positive integer.',
+                minimum: 'AwsS3PutObject request property "timeout" should be a positive integer.'
+            }
+        },
+        url: {
+            type: 'string',
+            description: 'An https: link, such as a presigned link, whose answer is streamed into the bucket in place of content. Give either content or url.',
+            errorMessage: {
+                type: 'AwsS3PutObject request property "url" should be a string.'
+            }
         }
     },
+    if: {
+        type: 'object'
+    },
+    then: {
+        oneOf: [
+            {
+                required: [
+                    'content'
+                ],
+                not: {
+                    required: [
+                        'url'
+                    ]
+                }
+            },
+            {
+                required: [
+                    'url'
+                ],
+                not: {
+                    required: [
+                        'content'
+                    ]
+                }
+            }
+        ]
+    },
+    dependencies: {
+        url: [
+            'maxBytes'
+        ],
+        maxBytes: [
+            'url'
+        ],
+        contentTypes: [
+            'url'
+        ],
+        timeout: [
+            'url'
+        ]
+    },
     errorMessage: {
         type: 'AwsS3PutObject request properties should be an object.',
         required: {
-            key: 'AwsS3PutObject request should have required property "key".',
-            content: 'AwsS3PutObject request should have required property "content".'
-        }
+            key: 'AwsS3PutObject request should have required property "key".'
+        },
+        // The `then` above is the only check without a message of its own.
+        _: 'AwsS3PutObject request should have either "content" or "url", not both.',
+        dependencies: 'AwsS3PutObject request with "url" should have "maxBytes", and "maxBytes", "contentTypes" and "timeout" apply only with "url".'
     }
 };

package/dist/connections/AwsS3Bucket/createS3Client.js

@@ -21,7 +21,10 @@ function createS3Client({ connection }) {
             accessKeyId,
             secretAccessKey
         },
-        region
+        region,
+        // Streamed bodies (AwsS3PutObject "url") reach the SDK in the chunks the source sends. The SDK's
+        // aws-chunked upload rejects any non-final chunk under 8192 bytes unless it buffers the stream.
+        requestStreamBufferSize: 65536
     };
     if (!type.isNone(endpoint)) {
         config.endpoint = endpoint;

package/dist/types.js

@@ -19,8 +19,17 @@ export default {
     connections: [
         'AwsS3Bucket'
     ],
+    // Non-scopable: the tenant wall does not cover object storage, so its
+    // connections are never scoped and accept no tenant: declaration.
+    connectionMetas: {
+        AwsS3Bucket: {
+            tenant: false
+        }
+    },
     requests: [
+        'AwsS3DeleteObject',
         'AwsS3GetObject',
+        'AwsS3HeadObject',
         'AwsS3PresignedGetObject',
         'AwsS3PresignedPostPolicy',
         'AwsS3PutObject'

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@lowdefy/plugin-aws",
-  "version": "6.1.0",
+  "version": "7.1.0",
   "license": "Apache-2.0",
   "description": "",
   "homepage": "https://lowdefy.com",
@@ -35,6 +35,9 @@
     "url": "https://github.com/lowdefy/lowdefy.git"
   },
   "type": "module",
+  "sideEffects": [
+    "**/*.css"
+  ],
   "exports": {
     "./connections": "./dist/connections.js",
     "./blocks": "./dist/blocks.js",
@@ -47,14 +50,16 @@
     "dist/*"
   ],
   "dependencies": {
-    "@lowdefy/block-utils": "6.1.0",
-    "@lowdefy/blocks-antd": "6.1.0",
-    "@lowdefy/blocks-files": "6.1.0",
-    "@lowdefy/errors": "6.1.0",
-    "@lowdefy/helpers": "6.1.0",
-    "@aws-sdk/client-s3": "3.797.0",
-    "@aws-sdk/s3-presigned-post": "3.797.0",
-    "@aws-sdk/s3-request-presigner": "3.797.0"
+    "@lowdefy/block-utils": "7.1.0",
+    "@lowdefy/blocks-antd": "7.1.0",
+    "@lowdefy/blocks-files": "7.1.0",
+    "@lowdefy/errors": "7.1.0",
+    "@lowdefy/helpers": "7.1.0",
+    "@lowdefy/node-utils": "7.1.0",
+    "@aws-sdk/client-s3": "3.1141.0",
+    "@aws-sdk/s3-presigned-post": "3.1141.0",
+    "@aws-sdk/s3-request-presigner": "3.1141.0",
+    "undici": "7.30.0"
   },
   "peerDependencies": {
     "antd": ">=6",
@@ -62,9 +67,10 @@
     "react-dom": ">=18"
   },
   "devDependencies": {
-    "@lowdefy/ajv": "6.1.0",
-    "@lowdefy/block-dev": "6.1.0",
-    "@lowdefy/jest-yaml-transform": "6.1.0",
+    "@jest/globals": "28.1.3",
+    "@lowdefy/ajv": "7.1.0",
+    "@lowdefy/block-dev": "7.1.0",
+    "@lowdefy/jest-yaml-transform": "7.1.0",
     "@swc/cli": "0.8.1",
     "@swc/core": "1.15.32",
     "@swc/jest": "0.2.39",