@ossy/platform 1.39.2 → 1.39.3

package/src/server.js

@@ -10,9 +10,9 @@ import { SDK, resolveActionId } from '@ossy/sdk'
 import { AggregateRebuild, resolveMongoUrl } from '@ossy/event-store'
 import { TaskService } from './tasks/task-service.js'
 import { ChangeStream } from './tasks/change-stream.js'
-import { CONTENT_SLOT_NAME } from '@ossy/app/runtime/resolve-shell-slots'
 import { buildManifestSummary } from '@ossy/app/manifest/build-manifest-summary'
-import { registerResourceTemplate } from './resources/resource-template.registry.js'
+import { registerSchema } from './resources/schema.registry.js'
+import { initPlatformSchema } from './resources/schema.service.js'
 import { IntegrationService } from './integration.service.js'
 import { ActionService } from './actions/action.service.js'
 import { createLogger } from '@ossy/observability'
@@ -20,6 +20,18 @@ import { ConfigService } from './config.service.js'
 import { UsersMiddleware } from './users.middleware.js'
 import { WorkspacesMiddleware } from './workspaces.middleware.js'
 import { resolveRequestLocale } from './locale.js'
+import { mountPlatformMcp } from './mcp/mount-platform-mcp.js'
+import {
+  assertActionEntitled,
+  buildActionEntitlementIndex,
+  createWorkspaceLoader,
+} from './entitlements/action-entitlement.js'
+import { mountPushSse } from './push/mount-push-sse.js'
+import { mergeWorkspaceSchemas } from '@ossy/workspaces/merge-workspace-schemas'
+import {
+  buildEnableablePackageSet,
+  setEnableablePackages,
+} from '@ossy/workspaces/entitlements'
 const log = createLogger('@ossy/platform')
 
 const DEFAULT_PORT = 3000
@@ -58,7 +70,7 @@ export function loadManifest (buildDir) {
   const apis = entries.filter((e) => e.type === 'api' && validRoutable(e))
   const tasks = entries.filter((e) => e.type === 'task')
   const components = Array.isArray(manifest.components) ? manifest.components : []
-  const resourceTemplates = Array.isArray(manifest.resourceTemplates) ? manifest.resourceTemplates : []
+  const schemas = Array.isArray(manifest.schemas) ? manifest.schemas : []
   const aggregates = Array.isArray(manifest.aggregates) ? manifest.aggregates : []
   const integrations = Array.isArray(manifest.integrations) ? manifest.integrations : []
   const startups = Array.isArray(manifest.startups) ? manifest.startups : []
@@ -75,7 +87,7 @@ export function loadManifest (buildDir) {
     apis,
     tasks,
     components,
-    resourceTemplates,
+    schemas,
     aggregates,
     integrations,
     startups,
@@ -85,6 +97,9 @@ export function loadManifest (buildDir) {
     config: manifest.config || {},
     definitions: manifest.definitions || {},
     translations: manifest.translations || {},
+    actionRoutes: manifest.actionRoutes || {},
+    taskCatalog: Array.isArray(manifest.taskCatalog) ? manifest.taskCatalog : [],
+    taskGraphEdges: Array.isArray(manifest.taskGraphEdges) ? manifest.taskGraphEdges : [],
   }
 }
 
@@ -114,12 +129,18 @@ export async function startServer (options = {}) {
 
   const manifest = loadManifest(buildDir)
   const manifestSummary = buildManifestSummary(manifest)
+  setEnableablePackages(buildEnableablePackageSet(manifest))
+  initPlatformSchema(manifest)
+  const capabilitiesPath = path.join(buildDir, 'capabilities.json')
+  const capabilities = fs.existsSync(capabilitiesPath)
+    ? JSON.parse(fs.readFileSync(capabilitiesPath, 'utf8'))
+    : null
   const config = manifest.config
   const supportedLanguages = Array.isArray(config.supportedLanguages) ? config.supportedLanguages : []
   const defaultLanguage = config.defaultLanguage
   for (const task of manifest.tasks ?? []) {
     try {
-      const mod = await import(resolveEntryUrl(task.entry, buildDir))
+      const mod = await import(/* @vite-ignore */ resolveEntryUrl(task.entry, buildDir))
       if (mod.metadata) {
         TaskService.registerTask(mod)
       }
@@ -128,8 +149,8 @@ export async function startServer (options = {}) {
     }
   }
 
-  for (const template of manifest.resourceTemplates ?? []) {
-    registerResourceTemplate(template)
+  for (const template of manifest.schemas ?? []) {
+    registerSchema(template)
   }
 
   // Integration loading — import each bundled integration module, check its
@@ -139,19 +160,19 @@ export async function startServer (options = {}) {
   const integrationModules = []
   for (const intEntry of manifest.integrations ?? []) {
     try {
-      integrationModules.push(await import(resolveEntryUrl(intEntry.entry, buildDir)))
+      integrationModules.push(await import(/* @vite-ignore */ resolveEntryUrl(intEntry.entry, buildDir)))
     } catch (err) {
       log.warn(`Failed to import integration "${intEntry.id}"`, undefined, err)
     }
   }
   await IntegrationService.load(integrationModules, process.env)
 
-  // Aggregate registration — mirrors task and resource-template registration above.
+  // Aggregate registration — mirrors task and schema registration above.
   // AggregateRebuild is provided by @ossy/event-store.
   if (AggregateRebuild) {
     for (const agg of manifest.aggregates ?? []) {
       try {
-        const mod = await import(resolveEntryUrl(agg.entry, buildDir))
+        const mod = await import(/* @vite-ignore */ resolveEntryUrl(agg.entry, buildDir))
         AggregateRebuild.registerAggregate(mod)
       } catch (err) {
         log.error(`Failed to load aggregate "${agg.id}"`, undefined, err)
@@ -165,7 +186,7 @@ export async function startServer (options = {}) {
 
   for (const startup of manifest.startups ?? []) {
     try {
-      const mod = await import(resolveEntryUrl(startup.entry, buildDir))
+      const mod = await import(/* @vite-ignore */ resolveEntryUrl(startup.entry, buildDir))
       if (typeof mod.run === 'function') {
         await mod.run({ env: process.env })
       }
@@ -178,7 +199,7 @@ export async function startServer (options = {}) {
   // with ActionService so it can be looked up and invoked at runtime.
   for (const actionEntry of manifest.actions ?? []) {
     try {
-      const mod = await import(resolveEntryUrl(actionEntry.entry, buildDir))
+      const mod = await import(/* @vite-ignore */ resolveEntryUrl(actionEntry.entry, buildDir))
       ActionService.register(mod)
     } catch (err) {
       log.error(`Failed to load action "${actionEntry.id}"`, undefined, err)
@@ -198,7 +219,7 @@ export async function startServer (options = {}) {
   const layoutEntry = layoutManifest[0]
   if (layoutEntry) {
     try {
-      const mod = await import(resolveEntryUrl(layoutEntry.entry, buildDir))
+      const mod = await import(/* @vite-ignore */ resolveEntryUrl(layoutEntry.entry, buildDir))
       if (typeof mod.default === 'function') {
         appLayout = { component: mod.default, entry: layoutEntry.entry }
       }
@@ -237,11 +258,20 @@ export async function startServer (options = {}) {
   const moduleCache = new Map()
   async function loadEntry (entryUrl) {
     if (moduleCache.has(entryUrl)) return moduleCache.get(entryUrl)
-    const promise = import(resolveEntryUrl(entryUrl, buildDir))
+    const promise = import(/* @vite-ignore */ resolveEntryUrl(entryUrl, buildDir))
     moduleCache.set(entryUrl, promise)
     return promise
   }
 
+  const actionEntitlementIndex = buildActionEntitlementIndex(manifest)
+  let loadWorkspaceForEntitlements = null
+  try {
+    const { Workspace } = await import('@ossy/workspaces/server')
+    loadWorkspaceForEntitlements = createWorkspaceLoader(Workspace)
+  } catch (err) {
+    log.warn('[@ossy/platform] Workspace aggregate unavailable — action entitlements disabled', err)
+  }
+
   const app = express()
   app.use(morgan('tiny'))
   app.use(express.json({ strict: false }))
@@ -261,11 +291,15 @@ export async function startServer (options = {}) {
   if (fs.existsSync(publicDir)) app.use(express.static(publicDir))
   app.use(ProxyInternal())
 
+  mountPushSse(app)
+
   // Actions endpoint — POST /actions with body { action, payload }.
   app.post('/actions', async (req, res) => {
     const actionId = resolveActionId(req.body?.action)
     if (!actionId) return res.status(400).json({ error: 'Missing action' })
 
+    const payload = req.body?.payload ?? {}
+
     const action = ActionService.get(actionId)
     if (!action) return res.status(404).json({ error: 'Action not found' })
 
@@ -276,7 +310,38 @@ export async function startServer (options = {}) {
       return res.status(403).json({ error: 'Forbidden' })
     }
 
-    const payload = req.body?.payload ?? {}
+    if (!ActionService.hasHandler(actionId)) {
+      return res.status(405).json({ error: 'Action has no server handler' })
+    }
+
+    if (loadWorkspaceForEntitlements) {
+      try {
+        await assertActionEntitled({
+          actionId,
+          access: action.access,
+          workspaceId: req.workspaceId,
+          entitlementIndex: actionEntitlementIndex,
+          loadWorkspace: loadWorkspaceForEntitlements,
+        })
+      } catch (err) {
+        if (err?.code === 'SERVICE_NOT_ENTITLED') {
+          return res.status(403).json({
+            error: err.message,
+            code: err.code,
+            package: err.package,
+          })
+        }
+        if (err?.code === 'ACTION_NOT_PERMITTED') {
+          return res.status(403).json({
+            error: err.message,
+            code: err.code,
+          })
+        }
+        const status = err?.status ?? 500
+        return res.status(status).json({ error: err.message ?? 'Forbidden' })
+      }
+    }
+
     const actionLog = createLogger(actionId)
     try {
       const result = await ActionService.invoke(actionId, {
@@ -294,6 +359,13 @@ export async function startServer (options = {}) {
     }
   })
 
+  const resolvedCapabilities = mountPlatformMcp(app, {
+    manifest,
+    capabilities,
+    actionEntitlementIndex,
+    loadWorkspaceForEntitlements,
+  })
+
   app.all('*all', async (req, res) => {
     const requestUrl = req.originalUrl || '/'
     try {
@@ -329,14 +401,32 @@ export async function startServer (options = {}) {
         const Layout = appLayout?.component ?? null
         const layoutEntry = appLayout?.entry ?? null
         const { language, messages, fallbackMessages } = resolveRequestLocale(pageRouter, requestUrl, buildDir, config)
-        // Page component → `shell:content` is resolved in page-runtime (SSR + hydrate).
+        let schemasForPage = cloneSerializable(manifest.schemas || [])
+        if (req.workspaceId && loadWorkspaceForEntitlements) {
+          try {
+            const workspace = await loadWorkspaceForEntitlements(req.workspaceId)
+            if (workspace?.schemas?.length) {
+              schemasForPage = mergeWorkspaceSchemas(
+                schemasForPage,
+                cloneSerializable(workspace.schemas),
+              )
+            }
+          } catch (err) {
+            log.warn('[@ossy/platform] Failed to merge workspace schemas for SSR', err)
+          }
+        }
+        // Page component → `app:content` is resolved in page-runtime (SSR + hydrate).
         const props = {
           ...config,
           ...(req.userAppSettings || {}),
           theme: req.userAppSettings?.theme || cloneSerializable(config?.theme),
           themes: cloneSerializable(config?.themes),
-          resourceTemplates: cloneSerializable(manifest.resourceTemplates),
+          schemas: schemasForPage,
           manifestSummary: cloneSerializable(manifestSummary),
+          capabilities: cloneSerializable(resolvedCapabilities),
+          actionRoutes: cloneSerializable(manifest.actionRoutes || {}),
+          taskCatalog: cloneSerializable(manifest.taskCatalog || []),
+          taskGraphEdges: cloneSerializable(manifest.taskGraphEdges || []),
           url: requestUrl,
           isAuthenticated: !!req.isAuthenticated,
           language,
@@ -350,7 +440,6 @@ export async function startServer (options = {}) {
           pageId: pageRoute.id,
           componentEntries: manifest.components,
           layoutSlots,
-          contentSlotName: CONTENT_SLOT_NAME,
           Layout,
           layoutEntry,
         }
@@ -403,7 +492,19 @@ export { ConfigService } from './config.service.js'
 export { ActionService } from './actions/action.service.js'
 export { IntegrationService } from './integration.service.js'
 export { StorageClient } from './storage/storage.client.js'
+export { originalObjectKey, derivativeObjectKey, assertStorageKey } from './storage/storage-keys.js'
 export { S3Client } from './storage/s3.client.js'
 export { LocalStorageClient } from './storage/local-storage.client.js'
-export { getSystemResourceTemplates } from './resources/resource-template.registry.js'
-export { normalizeAndValidateDocumentContent, validateResourceTemplatesForImport } from './resources/resource-template.validation.js'
+export { getSystemSchemas } from './resources/schema.registry.js'
+export { PlatformSchema } from './schema-ids.js'
+export { getPlatformSchema, initPlatformSchema, createSchemaEngine, schemaForWorkspace } from './resources/schema.service.js'
+export { validateSchemasForImport } from './resources/schema.validation.js'
+export {
+  USER_SETTINGS_COOKIE,
+  AUTH_COOKIE,
+  readUserAppSettings,
+  mergeUserAppSettingsCookie,
+  clearWorkspaceFromUserAppSettings,
+  setAuthCookie,
+  clearAuthCookie,
+} from './user-app-settings.js'

package/src/storage/filesystem-storage.client.js

@@ -0,0 +1,109 @@
+import path from 'path'
+import os from 'os'
+import { mkdir, writeFile, readFile, stat } from 'fs/promises'
+import { existsSync } from 'fs'
+import { assertStorageKey } from './storage-keys.js'
+import { createResourceReadUrl } from './resource-read-url.js'
+
+const DEV_FALLBACK_DIR = path.join(os.tmpdir(), 'ossy-local-media')
+
+export function resolveFilesystemStorageRoot (env = process.env) {
+  const dataDir = env.OSSY_DATA_DIR
+  if (dataDir) {
+    return path.join(path.resolve(dataDir), 'blobs')
+  }
+  return DEV_FALLBACK_DIR
+}
+
+function normalizeKey (keyOrShape) {
+  const Key = typeof keyOrShape === 'string' ? keyOrShape : keyOrShape?.Key
+  assertStorageKey(Key)
+  return Key
+}
+
+function keyToLocalPath (root, key) {
+  const filename = encodeURIComponent(key)
+  const resolved = path.resolve(root, filename)
+  const rootResolved = path.resolve(root)
+  if (!resolved.startsWith(`${rootResolved}${path.sep}`)) {
+    throw new Error('[FilesystemStorage] invalid key: path traversal detected')
+  }
+  return resolved
+}
+
+function buildUrl (key, env = process.env) {
+  return createResourceReadUrl(key, env)
+}
+
+export function createFilesystemStorageClient ({ root, env = process.env } = {}) {
+  const storageRoot = root ?? resolveFilesystemStorageRoot(env)
+
+  return {
+    backend: 'filesystem',
+    root: storageRoot,
+
+    createUploadUrl ({ Key }) {
+      return Promise.resolve(buildUrl(normalizeKey({ Key }), env))
+    },
+
+    createPresignedDownloadUrl (keyOrShape) {
+      const Key = normalizeKey(keyOrShape)
+      return Promise.resolve(buildUrl(Key, env))
+    },
+
+    createDownloadUrl (keyOrShape) {
+      const Key = normalizeKey(keyOrShape)
+      return buildUrl(Key, env)
+    },
+
+    async save (key, body) {
+      const Key = normalizeKey(key)
+      const localPath = keyToLocalPath(storageRoot, Key)
+      await mkdir(storageRoot, { recursive: true })
+      await writeFile(localPath, body)
+    },
+
+    async load (keyOrShape) {
+      const Key = normalizeKey(keyOrShape)
+      const localPath = keyToLocalPath(storageRoot, Key)
+      if (!existsSync(localPath)) return { buffer: null, exists: false }
+      const buffer = await readFile(localPath)
+      return { buffer, exists: true }
+    },
+
+    async headObject ({ Key }) {
+      const key = normalizeKey({ Key })
+      const localPath = keyToLocalPath(storageRoot, key)
+      const s = await stat(localPath).catch(() => null)
+      if (!s) throw Object.assign(new Error('Not Found'), { $metadata: { httpStatusCode: 404 } })
+      return { ContentLength: s.size }
+    },
+  }
+}
+
+/** @deprecated Use createFilesystemStorageClient — kept for direct imports. */
+export class LocalStorageClient {
+  static createUploadUrl (params) {
+    return createFilesystemStorageClient().createUploadUrl(params)
+  }
+
+  static createPresignedDownloadUrl (keyOrShape) {
+    return createFilesystemStorageClient().createPresignedDownloadUrl(keyOrShape)
+  }
+
+  static createDownloadUrl (keyOrShape) {
+    return createFilesystemStorageClient().createDownloadUrl(keyOrShape)
+  }
+
+  static save (key, body) {
+    return createFilesystemStorageClient().save(key, body)
+  }
+
+  static load (keyOrShape) {
+    return createFilesystemStorageClient().load(keyOrShape)
+  }
+
+  static headObject (params) {
+    return createFilesystemStorageClient().headObject(params)
+  }
+}

package/src/storage/local-storage.client.js

@@ -1,65 +1,2 @@
-import path from 'path'
-import os from 'os'
-import { mkdir, writeFile, readFile, stat } from 'fs/promises'
-import { existsSync } from 'fs'
-
-const LOCAL_STORAGE_DIR = path.join(os.tmpdir(), 'ossy-local-media')
-
-function normalizeKey(keyOrShape) {
-  const Key = typeof keyOrShape === 'string' ? keyOrShape : keyOrShape?.Key
-  if (!Key || typeof Key !== 'string') {
-    throw new Error('[LocalStorageClient] missing Key')
-  }
-  return Key
-}
-
-function keyToLocalPath(key) {
-  const resolved = path.resolve(LOCAL_STORAGE_DIR, key)
-  if (!resolved.startsWith(LOCAL_STORAGE_DIR)) {
-    throw new Error('[LocalStorageClient] invalid key: path traversal detected')
-  }
-  return resolved
-}
-
-function buildUrl(key) {
-  const base = (process.env.LOCAL_API_URL || 'http://localhost:3001').replace(/\/$/, '')
-  return `${base}/local-storage?key=${encodeURIComponent(key)}`
-}
-
-export class LocalStorageClient {
-
-  static createUploadUrl({ Key }) {
-    return Promise.resolve(buildUrl(Key))
-  }
-
-  static createPresignedDownloadUrl(keyOrShape) {
-    const Key = normalizeKey(keyOrShape)
-    return Promise.resolve(buildUrl(Key))
-  }
-
-  static createDownloadUrl(keyOrShape) {
-    const Key = normalizeKey(keyOrShape)
-    return buildUrl(Key)
-  }
-
-  static async save(key, body) {
-    const localPath = keyToLocalPath(key)
-    await mkdir(path.dirname(localPath), { recursive: true })
-    await writeFile(localPath, body)
-  }
-
-  static async load(key) {
-    const localPath = keyToLocalPath(key)
-    if (!existsSync(localPath)) return { buffer: null, exists: false }
-    const buffer = await readFile(localPath)
-    return { buffer, exists: true }
-  }
-
-  static async headObject({ Key }) {
-    const localPath = keyToLocalPath(Key)
-    const s = await stat(localPath).catch(() => null)
-    if (!s) throw Object.assign(new Error('Not Found'), { $metadata: { httpStatusCode: 404 } })
-    return { ContentLength: s.size }
-  }
-
-}
+/** @deprecated Import from filesystem-storage.client.js */
+export { LocalStorageClient, createFilesystemStorageClient, resolveFilesystemStorageRoot } from './filesystem-storage.client.js'

package/src/storage/resource-read-url.js

@@ -0,0 +1,36 @@
+import { assertStorageKey } from './storage-keys.js'
+
+function normalizeLogicalKey (keyOrShape) {
+  const Key = typeof keyOrShape === 'string' ? keyOrShape : keyOrShape?.Key
+  assertStorageKey(Key)
+  return Key
+}
+
+/**
+ * Predictable app-relative read path for a storage key.
+ * Original: `/r/{resourceId}` — derivative: `/r/{resourceId}/{variant}`.
+ *
+ * @param {string | { Key?: string }} keyOrShape
+ * @returns {string}
+ */
+export function storageKeyToReadPath (keyOrShape) {
+  const key = normalizeLogicalKey(keyOrShape)
+  const colon = key.indexOf(':')
+  if (colon === -1) return `/r/${key}`
+  const resourceId = key.slice(0, colon)
+  const variant = key.slice(colon + 1)
+  return `/r/${resourceId}/${variant}`
+}
+
+/**
+ * Absolute resource read URL (same shape for filesystem and S3 backends).
+ *
+ * @param {string | { Key?: string }} keyOrShape
+ * @param {NodeJS.ProcessEnv} [env]
+ * @returns {string}
+ */
+export function createResourceReadUrl (keyOrShape, env = process.env) {
+  const path = storageKeyToReadPath(keyOrShape)
+  const base = (env.WEB_CLIENT_DOMAIN || env.LOCAL_API_URL || '').replace(/\/$/, '')
+  return base ? `${base}${path}` : path
+}

package/src/storage/resource-read-url.spec.js

@@ -0,0 +1,22 @@
+import { describe, expect, it } from '@jest/globals'
+import { createResourceReadUrl, storageKeyToReadPath } from './resource-read-url.js'
+
+describe('resource-read-url', () => {
+  it('maps original key to /r/{resourceId}', () => {
+    expect(storageKeyToReadPath('abc123XYZ')).toBe('/r/abc123XYZ')
+  })
+
+  it('maps derivative key to /r/{resourceId}/{variant}', () => {
+    expect(storageKeyToReadPath('abc123:galleryLarge')).toBe('/r/abc123/galleryLarge')
+  })
+
+  it('builds absolute URL from WEB_CLIENT_DOMAIN', () => {
+    expect(createResourceReadUrl('abc123', { WEB_CLIENT_DOMAIN: 'https://app.example.com' }))
+      .toBe('https://app.example.com/r/abc123')
+  })
+
+  it('falls back to LOCAL_API_URL', () => {
+    expect(createResourceReadUrl('abc123', { LOCAL_API_URL: 'http://localhost:3006' }))
+      .toBe('http://localhost:3006/r/abc123')
+  })
+})

package/src/storage/s3-storage.client.js

@@ -0,0 +1,102 @@
+import { S3, PutObjectCommand, GetObjectCommand, HeadObjectCommand } from '@aws-sdk/client-s3'
+import { S3RequestPresigner } from '@aws-sdk/s3-request-presigner'
+import { createRequest } from '@aws-sdk/util-create-request'
+import { formatUrl } from '@aws-sdk/util-format-url'
+import { createLogger } from '@ossy/observability'
+import { assertStorageKey } from './storage-keys.js'
+import { createResourceReadUrl } from './resource-read-url.js'
+
+const log = createLogger('storage')
+
+const REGION = 'eu-north-1'
+
+/** S3/CloudFront origin uses `/media` — flat keys become `media/{resourceId}`. */
+const S3_KEY_PREFIX = 'media/'
+
+function normalizeLogicalKey (keyOrShape) {
+  const Key = typeof keyOrShape === 'string' ? keyOrShape : keyOrShape?.Key
+  assertStorageKey(Key)
+  return Key
+}
+
+function toS3Key (logicalKey) {
+  return `${S3_KEY_PREFIX}${logicalKey}`
+}
+
+export function createS3StorageClient ({
+  bucket,
+  cdnDomainName,
+  accessKeyId,
+  secretAccessKey,
+  region = REGION,
+} = {}) {
+  if (!bucket) {
+    throw new Error('[S3Storage] bucket is required')
+  }
+
+  function createAwsClient () {
+    return new S3({
+      region,
+      credentials: {
+        accessKeyId,
+        secretAccessKey,
+      },
+    })
+  }
+
+  return {
+    backend: 's3',
+    bucket,
+
+    createDownloadUrl (keyOrShape) {
+      return createResourceReadUrl(normalizeLogicalKey(keyOrShape))
+    },
+
+    createPresignedDownloadUrl (keyOrShape) {
+      return Promise.resolve(createResourceReadUrl(normalizeLogicalKey(keyOrShape)))
+    },
+
+    createUploadUrl ({ ContentType, ContentLength, Key, expiresIn = 60 * 60 * 24 }) {
+      log.info('[S3Storage][createUploadUrl] Creating upload URL')
+
+      const clientParams = {
+        Bucket: bucket,
+        Key: toS3Key(normalizeLogicalKey({ Key })),
+        ContentType,
+        ContentLength,
+      }
+
+      const s3Client = createAwsClient()
+      const signedRequest = new S3RequestPresigner(s3Client.config)
+
+      return createRequest(s3Client, new PutObjectCommand(clientParams))
+        .then(request => signedRequest.presign(request, { expiresIn }))
+        .then(formatUrl)
+        .catch(error => {
+          log.error('S3Storage.createUploadUrl error', undefined, error)
+          return Promise.reject(error)
+        })
+    },
+
+    headObject ({ Key }) {
+      const s3Client = createAwsClient()
+      return s3Client.send(new HeadObjectCommand({ Bucket: bucket, Key: toS3Key(normalizeLogicalKey({ Key })) }))
+    },
+
+    async load (keyOrShape) {
+      const Key = toS3Key(normalizeLogicalKey(keyOrShape))
+      const s3Client = createAwsClient()
+      try {
+        const response = await s3Client.send(new GetObjectCommand({ Bucket: bucket, Key }))
+        const bytes = await response.Body?.transformToByteArray?.()
+        if (!bytes) return { buffer: null, exists: false }
+        return { buffer: Buffer.from(bytes), exists: true }
+      } catch (err) {
+        if (err?.$metadata?.httpStatusCode === 404 || err?.name === 'NoSuchKey') {
+          return { buffer: null, exists: false }
+        }
+        throw err
+      }
+    },
+  }
+}