@opengeni/api-router 0.30.1 → 1.0.0

package/src/routes/files.ts

@@ -1,8 +1,12 @@
+import { readSessionAttachmentFiles } from "@opengeni/core";
+import { ZodError } from "zod";
 import {
   CompleteFileUploadResponse,
   CreateFileUploadRequest,
   CreateFileUploadResponse,
   FileAsset,
+  FileListRequest,
+  FileListResponse,
   FileDownloadUrlResponse,
   RETAINED_OUTPUT_DEFAULT_PAGE_BYTES,
   RETAINED_OUTPUT_MAX_PAGE_BYTES,
@@ -11,22 +15,27 @@ import {
   retainedGeneratedImageReferenceFromFile,
   retainedGeneratedVideoReferenceFromFile,
   retainedScreenshotReferenceFromFile,
+  retainedSessionScreenshotKindFromObjectKey,
   VideoArtifactPlaybackSource,
   resolveRetainedOutputRange,
   type RetainedArtifactMetadata,
   type RetainedOutputUnavailableReason,
 } from "@opengeni/contracts";
 import {
+  withSessionRlsActorContext,
   claimFileUploadCleanup,
   completeFileUploadCleanup,
   completeFileUpload,
   createFileUpload,
   getFileUpload,
   getGeneratedImageArtifact,
+  recordAuditEvent,
   getGeneratedVideoArtifact,
+  getFilesForSubject,
+  listFilesForSubject,
   getRetainedFileArtifact,
   getRetainedScreenshotArtifact,
-  requireFile,
+  requireFileForSubject,
   type RetainedFileArtifact,
   type GeneratedImageArtifact,
   type GeneratedVideoArtifact,
@@ -34,24 +43,111 @@ import {
 } from "@opengeni/db";
 import type { Context, Hono } from "hono";
 import { HTTPException } from "hono/http-exception";
-import { requireAccessGrant } from "@opengeni/core";
+import {
+  fileOwnerContextForAccess,
+  requireAccessGrantAuthorization,
+  grantHasAgentAttemptAuthority,
+  requireAccessGrant,
+  requireLiveAgentAttemptAuthorization,
+  requireSessionAuthorization,
+  SessionAuthorizationDeniedError,
+  SessionAuthorizationUnavailableError,
+} from "@opengeni/core";
 import { recordWorkspaceUsage, requireLimit } from "@opengeni/core";
 import type { ApiRouteDeps } from "@opengeni/core";
+import { retryWhileMissing } from "@opengeni/storage";
 import { WebStandardStreamableHTTPServerTransport } from "@modelcontextprotocol/sdk/server/webStandardStreamableHttp.js";
 import { buildFilesMcpServer } from "../mcp/files";
+import { userContentResponseHeaders, userContentSignedGetUrlOptions } from "../http/user-content";
+import { mcpOAuthAuthenticateHeader, resolveMcpOAuthRouteAccess } from "../mcp-oauth";
+import { withAccessGrantSessionRlsContext } from "../access-grant-rls";
+import {
+  buildWorkspaceToolGatewayMcpServer,
+  prepareMcpOAuthWorkspaceToolGateway,
+} from "../workspace-tool-gateway";
+import { parseRequestJson } from "../http/request-body";
 
 export function registerFileRoutes(app: Hono, deps: ApiRouteDeps): void {
   const { db, objectStorage } = deps;
 
+  const fileRequestAuthority = new WeakMap<Request, { owner: string | null; agent: boolean }>();
+  // This scope covers metadata, original bytes, range reads and finalization.
+  // A service/agent subject string alone cannot unlock a personal attachment.
+  for (const path of [
+    "/v1/workspaces/:workspaceId/files",
+    "/v1/workspaces/:workspaceId/files/*",
+    "/v1/workspaces/:workspaceId/artifacts/*",
+    "/v1/workspaces/:workspaceId/sessions/:sessionId/artifacts/*",
+  ]) {
+    app.use(path, async (c, next) => {
+      const permission = c.req.path.includes("/files/uploads") ? "files:upload" : "files:read";
+      const access = await requireAccessGrantAuthorization(
+        c,
+        deps,
+        c.req.param("workspaceId") ?? "",
+        permission,
+      );
+      const actor = await fileOwnerContextForAccess(deps, access, permission);
+      fileRequestAuthority.set(c.req.raw, {
+        owner: actor.privateFileOwnerSubjectId ?? null,
+        agent: access.grant.principalKind === "agent_attempt",
+      });
+      return withSessionRlsActorContext(actor, next);
+    });
+  }
+
   app.all("/v1/workspaces/:workspaceId/mcp/files", async (c) => {
     const workspaceId = c.req.param("workspaceId");
-    const grant = await requireAccessGrant(c, deps, workspaceId, "files:read");
-    const transport = new WebStandardStreamableHTTPServerTransport({
-      enableJsonResponse: true,
+    let oauthAccess: Awaited<ReturnType<typeof resolveMcpOAuthRouteAccess>>;
+    try {
+      oauthAccess = await resolveMcpOAuthRouteAccess(deps, c.req.raw, workspaceId);
+    } catch (error) {
+      if (error instanceof HTTPException && error.status === 401) {
+        c.header("www-authenticate", mcpOAuthAuthenticateHeader(deps, new URL(c.req.url).pathname));
+      }
+      throw error;
+    }
+    if (oauthAccess) {
+      return await withAccessGrantSessionRlsContext(deps, oauthAccess.grant, async () => {
+        const prepared = await prepareMcpOAuthWorkspaceToolGateway(
+          deps,
+          oauthAccess.grant,
+          oauthAccess.allowedToolIdentities,
+        );
+        const transport = new WebStandardStreamableHTTPServerTransport({
+          enableJsonResponse: true,
+        });
+        const server = buildWorkspaceToolGatewayMcpServer(
+          prepared,
+          oauthAccess.grant,
+          deps.observability,
+        );
+        try {
+          await server.connect(transport);
+          return await transport.handleRequest(c.req.raw);
+        } finally {
+          await Promise.allSettled([server.close(), prepared.close()]);
+        }
+      });
+    }
+    let access: Awaited<ReturnType<typeof requireAccessGrantAuthorization>>;
+    try {
+      access = await requireAccessGrantAuthorization(c, deps, workspaceId, "files:read");
+    } catch (error) {
+      if (deps.settings.mcpOauthEnabled && error instanceof HTTPException && error.status === 401) {
+        c.header("www-authenticate", mcpOAuthAuthenticateHeader(deps, new URL(c.req.url).pathname));
+      }
+      throw error;
+    }
+    const { grant } = access;
+    return await withAccessGrantSessionRlsContext(deps, grant, async () => {
+      const transport = new WebStandardStreamableHTTPServerTransport({
+        enableJsonResponse: true,
+      });
+      const server = buildFilesMcpServer(deps, access);
+      await server.connect(transport);
+      return await transport.handleRequest(c.req.raw);
     });
-    const server = buildFilesMcpServer(deps, grant);
-    await server.connect(transport);
-    return await transport.handleRequest(c.req.raw);
   });
 
   app.post("/v1/workspaces/:workspaceId/files/uploads", async (c) => {
@@ -62,7 +158,13 @@ export function registerFileRoutes(app: Hono, deps: ApiRouteDeps): void {
         message: "object storage is not configured",
       });
     }
-    const payload = CreateFileUploadRequest.parse(await c.req.json());
+    const payload = await parseRequestJson(c, CreateFileUploadRequest);
+    const privateOwner = fileRequestAuthority.get(c.req.raw)?.owner ?? null;
+    const personal =
+      payload.scope === "personal" ||
+      (fileRequestAuthority.get(c.req.raw)?.agent && privateOwner !== null);
+    if (personal && !privateOwner)
+      throw new HTTPException(403, { message: "Personal uploads require the authenticated owner" });
     await requireLimit(deps, {
       accountId: grant.accountId,
       workspaceId,
@@ -86,6 +188,7 @@ export function registerFileRoutes(app: Hono, deps: ApiRouteDeps): void {
       accountId: grant.accountId,
       workspaceId,
       fileId,
+      privateOwnerSubjectId: personal ? privateOwner : null,
       filename: payload.filename,
       safeFilename,
       contentType: payload.contentType,
@@ -95,6 +198,23 @@ export function registerFileRoutes(app: Hono, deps: ApiRouteDeps): void {
       objectKey,
       expiresAt: signed.expiresAt,
     });
+    // Every principal-facing signed URL issuance is a
+    // metadata-only audit fact. Awaited before the URL leaves the platform:
+    // no recorded fact, no bearer capability. Never the URL or object key.
+    await recordAuditEvent(db, {
+      accountId: grant.accountId,
+      workspaceId,
+      subjectId: grant.subjectId,
+      action: "file.signed_upload.issued",
+      targetType: "workspace_file",
+      targetId: fileId,
+      metadata: {
+        fileId,
+        contentType: payload.contentType,
+        sizeBytes: payload.sizeBytes,
+        expiresAt: signed.expiresAt.toISOString(),
+      },
+    });
     return c.json(
       CreateFileUploadResponse.parse({
         fileId: upload.file.id,
@@ -226,11 +346,13 @@ export function registerFileRoutes(app: Hono, deps: ApiRouteDeps): void {
       const file = await rejectAndCleanObject(409, "file upload has expired", "expired");
       return c.json(CompleteFileUploadResponse.parse({ file }));
     }
-    const head = await objectStorage.headFile(upload.file).catch((error) => {
-      throw new HTTPException(409, {
-        message: `uploaded object is not available: ${error instanceof Error ? error.message : String(error)}`,
-      });
+    const head = await retryWhileMissing(async () => {
+      if (!(await objectStorage.fileExists(upload.file))) return null;
+      return await objectStorage.headFile(upload.file);
     });
+    if (!head) {
+      throw new HTTPException(409, { message: "uploaded object is not available" });
+    }
     if (Number(head.ContentLength ?? -1) !== upload.file.sizeBytes) {
       const file = await rejectAndCleanObject(
         422,
@@ -263,10 +385,53 @@ export function registerFileRoutes(app: Hono, deps: ApiRouteDeps): void {
     return c.json(CompleteFileUploadResponse.parse({ file }));
   });
 
+  app.get("/v1/workspaces/:workspaceId/files", async (c) => {
+    const workspaceId = c.req.param("workspaceId");
+    const grant = await requireAccessGrant(c, deps, workspaceId, "files:read");
+    const parsed = FileListRequest.safeParse({
+      ...c.req.query(),
+      ...(c.req.query("limit") !== undefined ? { limit: Number(c.req.query("limit")) } : {}),
+    });
+    if (!parsed.success) throw new HTTPException(422, { message: "Invalid file list request" });
+    c.header("cache-control", "private, no-store");
+    return c.json(
+      FileListResponse.parse(
+        await listFilesForSubject(db, {
+          accountId: grant.accountId,
+          workspaceId,
+          subjectId: grant.subjectId,
+          ...parsed.data,
+        }).catch((error: unknown) => {
+          if (error instanceof ZodError)
+            throw new HTTPException(422, { message: "Invalid file cursor" });
+          throw error;
+        }),
+      ),
+    );
+  });
+
+  const readRequestedFile = async (
+    c: Context,
+    grant: Awaited<ReturnType<typeof requireAccessGrant>>,
+  ) => {
+    const fileId = c.req.param("fileId") ?? "";
+    const sessionId = c.req.query("sessionId");
+    if (sessionId) {
+      if (!/^[0-9a-f]{8}(?:-[0-9a-f]{4}){3}-[0-9a-f]{12}$/iu.test(sessionId)) return null;
+      return (await readSessionAttachmentFiles(deps, grant, sessionId, [fileId]))[0] ?? null;
+    }
+    return requireFileForSubject(db, {
+      accountId: grant.accountId,
+      workspaceId: grant.workspaceId,
+      subjectId: grant.subjectId,
+      fileId,
+    }).catch(() => null);
+  };
+
   app.get("/v1/workspaces/:workspaceId/files/:fileId", async (c) => {
     const workspaceId = c.req.param("workspaceId");
-    await requireAccessGrant(c, deps, workspaceId, "files:read");
-    const file = await requireFile(db, workspaceId, c.req.param("fileId")).catch(() => null);
+    const grant = await requireAccessGrant(c, deps, workspaceId, "files:read");
+    const file = await readRequestedFile(c, grant).catch(() => null);
     if (!file) {
       throw new HTTPException(404, { message: "file not found" });
     }
@@ -275,9 +440,14 @@ export function registerFileRoutes(app: Hono, deps: ApiRouteDeps): void {
 
   app.get("/v1/workspaces/:workspaceId/artifacts/:artifactId", async (c) => {
     const workspaceId = c.req.param("workspaceId");
-    await requireAccessGrant(c, deps, workspaceId, "files:read");
+    const grant = await requireAccessGrant(c, deps, workspaceId, "files:read");
     const artifactId = retainedArtifactId(c.req.param("artifactId"));
-    const artifact = await getWorkspaceArtifact(db, workspaceId, artifactId);
+    const artifact = await getWorkspaceArtifact(db, {
+      accountId: grant.accountId,
+      workspaceId,
+      subjectId: await fileAuthoritySubjectIdForGrant(deps, grant),
+      artifactId,
+    });
     if (!artifact) {
       return c.json(retainedArtifactUnavailable(artifactId, "deleted"), 404);
     }
@@ -286,9 +456,14 @@ export function registerFileRoutes(app: Hono, deps: ApiRouteDeps): void {
 
   app.get("/v1/workspaces/:workspaceId/artifacts/:artifactId/content", async (c) => {
     const workspaceId = c.req.param("workspaceId");
-    await requireAccessGrant(c, deps, workspaceId, "files:read");
+    const grant = await requireAccessGrant(c, deps, workspaceId, "files:read");
     const artifactId = retainedArtifactId(c.req.param("artifactId"));
-    const artifact = await getWorkspaceArtifact(db, workspaceId, artifactId);
+    const artifact = await getWorkspaceArtifact(db, {
+      accountId: grant.accountId,
+      workspaceId,
+      subjectId: await fileAuthoritySubjectIdForGrant(deps, grant),
+      artifactId,
+    });
     if (!artifact) {
       return c.json(retainedArtifactUnavailable(artifactId, "deleted"), 404);
     }
@@ -304,7 +479,7 @@ export function registerFileRoutes(app: Hono, deps: ApiRouteDeps): void {
 
   app.post("/v1/workspaces/:workspaceId/artifacts/:artifactId/playback-source", async (c) => {
     const workspaceId = c.req.param("workspaceId");
-    await requireAccessGrant(c, deps, workspaceId, "files:read");
+    const grant = await requireAccessGrant(c, deps, workspaceId, "files:read");
     if (!objectStorage) {
       throw new HTTPException(503, { message: "object storage is not configured" });
     }
@@ -317,10 +492,29 @@ export function registerFileRoutes(app: Hono, deps: ApiRouteDeps): void {
       throw new HTTPException(409, { message: `generated video is ${retained.file.status}` });
     }
     const file = generatedVideoFileAsset(retained.file);
-    if (!(await objectStorage.fileExists(file))) {
+    const videoPresent = await retryWhileMissing(async () =>
+      (await objectStorage.fileExists(file)) ? true : null,
+    );
+    if (!videoPresent) {
       throw new HTTPException(410, { message: "generated video bytes are unavailable" });
     }
-    const signed = await objectStorage.createGetUrl({ key: file.objectKey });
+    const signed = await objectStorage.createGetUrl({
+      key: file.objectKey,
+      ...userContentSignedGetUrlOptions(file.contentType, file.filename),
+    });
+    await recordAuditEvent(db, {
+      accountId: grant.accountId,
+      workspaceId,
+      subjectId: grant.subjectId,
+      action: "file.signed_url.issued",
+      targetType: "retained_artifact",
+      targetId: artifactId,
+      metadata: {
+        artifactId,
+        kind: "video_playback",
+        expiresAt: signed.expiresAt.toISOString(),
+      },
+    });
     return c.json(
       VideoArtifactPlaybackSource.parse({
         schemaVersion: 1,
@@ -335,9 +529,40 @@ export function registerFileRoutes(app: Hono, deps: ApiRouteDeps): void {
     );
   });
 
+  // These two retained-screenshot routes are registered before the session
+  // route module, so its `/sessions/:sessionId/*` authorization middleware
+  // does not cover them: an agent attempt must pass the same core seam here
+  // (private sessions, Slack ownership, and the 0426 agent-access scope) so a
+  // known artifact id cannot read into a tree the attempt may not reach.
+  const requireAgentSessionAccess = async (
+    c: Context,
+    grant: Awaited<ReturnType<typeof requireAccessGrant>>,
+  ): Promise<void> => {
+    if (!grantHasAgentAttemptAuthority(grant)) return;
+    try {
+      await requireSessionAuthorization(deps, grant, {
+        sessionId: c.req.param("sessionId") ?? "",
+        operation: "session.read",
+        surface: "http",
+      });
+    } catch (error) {
+      if (error instanceof SessionAuthorizationDeniedError) {
+        throw new HTTPException(404, { message: "session not found", cause: error });
+      }
+      if (error instanceof SessionAuthorizationUnavailableError) {
+        throw new HTTPException(503, {
+          message: "session authorization is unavailable",
+          cause: error,
+        });
+      }
+      throw error;
+    }
+  };
+
   app.get("/v1/workspaces/:workspaceId/sessions/:sessionId/artifacts/:artifactId", async (c) => {
     const workspaceId = c.req.param("workspaceId");
-    await requireAccessGrant(c, deps, workspaceId, "files:read");
+    const grant = await requireAccessGrant(c, deps, workspaceId, "files:read");
+    await requireAgentSessionAccess(c, grant);
     const artifactId = retainedArtifactId(c.req.param("artifactId"));
     const artifact = await getRetainedScreenshotArtifact(
       db,
@@ -355,7 +580,8 @@ export function registerFileRoutes(app: Hono, deps: ApiRouteDeps): void {
     "/v1/workspaces/:workspaceId/sessions/:sessionId/artifacts/:artifactId/content",
     async (c) => {
       const workspaceId = c.req.param("workspaceId");
-      await requireAccessGrant(c, deps, workspaceId, "files:read");
+      const grant = await requireAccessGrant(c, deps, workspaceId, "files:read");
+      await requireAgentSessionAccess(c, grant);
       const artifactId = retainedArtifactId(c.req.param("artifactId"));
       const artifact = await getRetainedScreenshotArtifact(
         db,
@@ -378,20 +604,42 @@ export function registerFileRoutes(app: Hono, deps: ApiRouteDeps): void {
 
   app.post("/v1/workspaces/:workspaceId/files/:fileId/download-url", async (c) => {
     const workspaceId = c.req.param("workspaceId");
-    await requireAccessGrant(c, deps, workspaceId, "files:read");
+    const grant = await requireAccessGrant(c, deps, workspaceId, "files:read");
     if (!objectStorage) {
       throw new HTTPException(503, {
         message: "object storage is not configured",
       });
     }
-    const file = await requireFile(db, workspaceId, c.req.param("fileId")).catch(() => null);
+    const file = await readRequestedFile(c, grant).catch(() => null);
     if (!file) {
       throw new HTTPException(404, { message: "file not found" });
     }
     if (file.status !== "ready") {
       throw new HTTPException(409, { message: `file is ${file.status}` });
     }
-    const signed = await objectStorage.createGetUrl({ key: file.objectKey });
+    const present = await retryWhileMissing(async () =>
+      (await objectStorage.fileExists(file)) ? true : null,
+    );
+    if (!present) {
+      throw new HTTPException(410, { message: "file bytes are unavailable" });
+    }
+    const signed = await objectStorage.createGetUrl({
+      key: file.objectKey,
+      ...userContentSignedGetUrlOptions(file.contentType, file.filename),
+    });
+    await recordAuditEvent(db, {
+      accountId: grant.accountId,
+      workspaceId,
+      subjectId: grant.subjectId,
+      action: "file.signed_url.issued",
+      targetType: "workspace_file",
+      targetId: file.id,
+      metadata: {
+        fileId: file.id,
+        kind: "download",
+        expiresAt: signed.expiresAt.toISOString(),
+      },
+    });
     return c.json(
       FileDownloadUrlResponse.parse({
         url: signed.url,
@@ -446,25 +694,33 @@ async function serveRetainedArtifactContent(
     );
   }
 
+  // Stored bytes and their content type are user- or agent-chosen; this origin
+  // also serves the console, so the response is a sandboxed, non-embeddable
+  // document and active markup downloads instead of rendering.
   const headers = {
     "Accept-Ranges": range.acceptRanges,
     "Cache-Control": "private, no-store",
     "Content-Length": String(range.length),
     "Content-Type": metadata.contentType,
-    "X-Content-Type-Options": "nosniff",
+    ...userContentResponseHeaders(metadata.contentType, file.filename),
     ...(range.contentRange ? { "Content-Range": range.contentRange } : {}),
   };
   if (range.kind === "empty") {
-    if (!(await objectStorage.fileExists(file))) {
+    const present = await retryWhileMissing(async () =>
+      (await objectStorage.fileExists(file)) ? true : null,
+    );
+    if (!present) {
       return c.json(retainedArtifactUnavailable(artifactId, "missing_storage"), 410);
     }
     return c.body(null, 200, headers);
   }
 
-  const bytes = await objectStorage.getFileRange(file, {
-    start: range.start,
-    end: range.end,
-  });
+  const bytes = await retryWhileMissing(async () =>
+    objectStorage.getFileRange(file, {
+      start: range.start,
+      end: range.end,
+    }),
+  );
   if (!bytes) {
     return c.json(retainedArtifactUnavailable(artifactId, "missing_storage"), 410);
   }
@@ -537,14 +793,18 @@ function retainedArtifactMetadata(artifact: RetainedFileArtifact): RetainedArtif
 
 async function getWorkspaceArtifact(
   db: ApiRouteDeps["db"],
-  workspaceId: string,
-  artifactId: string,
+  input: {
+    accountId: string;
+    workspaceId: string;
+    subjectId: string | null;
+    artifactId: string;
+  },
 ): Promise<{ file: RetainedFileArtifact["file"]; metadata: RetainedArtifactMetadata } | null> {
-  const generated = await getGeneratedImageArtifact(db, workspaceId, artifactId);
+  const generated = await getGeneratedImageArtifact(db, input.workspaceId, input.artifactId);
   if (generated) {
     return { file: generated.file, metadata: retainedGeneratedImageMetadata(generated) };
   }
-  const generatedVideo = await getGeneratedVideoArtifact(db, workspaceId, artifactId);
+  const generatedVideo = await getGeneratedVideoArtifact(db, input.workspaceId, input.artifactId);
   if (generatedVideo && !generatedVideo.artifact.deletedAt) {
     const file = generatedVideoFileAsset(generatedVideo.file);
     return {
@@ -555,8 +815,43 @@ async function getWorkspaceArtifact(
       }),
     };
   }
-  const artifact = await getRetainedFileArtifact(db, workspaceId, artifactId);
-  return artifact ? { file: artifact.file, metadata: retainedArtifactMetadata(artifact) } : null;
+  const artifact = await getRetainedFileArtifact(db, input.workspaceId, input.artifactId);
+  if (!artifact) return null;
+  const [authorizedFile] = await getFilesForSubject(db, {
+    accountId: input.accountId,
+    workspaceId: input.workspaceId,
+    subjectId: input.subjectId,
+    fileIds: [artifact.file.id],
+  });
+  if (!authorizedFile) return null;
+  const authorizedArtifact = { ...artifact, file: authorizedFile };
+  return {
+    file: authorizedFile,
+    metadata: retainedArtifactMetadata(authorizedArtifact),
+  };
+}
+
+/** Human and stable service grants already carry their immutable subject.
+ * Agent tokens carry only a technical worker subject, so resolve the exact
+ * live attempt and use the initiating human frozen on its durable turn. */
+export async function fileAuthoritySubjectIdForGrant(
+  deps: Pick<ApiRouteDeps, "db">,
+  grant: import("@opengeni/contracts").AccessGrant,
+): Promise<string | null> {
+  if (grant.principalKind !== "agent_attempt") return grant.subjectId;
+  const sessionId = grant.metadata?.["sessionId"];
+  if (typeof sessionId !== "string") {
+    throw new HTTPException(404, { message: "file not found" });
+  }
+  try {
+    const actor = await requireLiveAgentAttemptAuthorization(deps.db, grant, sessionId);
+    return actor.initiatingHumanSubjectId;
+  } catch (error) {
+    if (error instanceof SessionAuthorizationDeniedError) {
+      throw new HTTPException(404, { message: "file not found", cause: error });
+    }
+    throw error;
+  }
 }
 
 function generatedVideoFileAsset(
@@ -605,12 +900,15 @@ function retainedScreenshotMetadata(
     artifact.sessionId &&
     artifact.retentionExpiresAt.getTime() > Date.now()
   ) {
+    const kind = retainedSessionScreenshotKindFromObjectKey(artifact.file.objectKey);
+    if (!kind) return retainedArtifactUnavailable(artifact.artifactId, "invalid_content");
     const reference = retainedScreenshotReferenceFromFile({
       ...artifact.file,
       sessionId: artifact.sessionId,
       width: artifact.width,
       height: artifact.height,
       expiresAt: artifact.retentionExpiresAt.toISOString(),
+      kind,
     });
     if (reference) return reference;
   }