@opengeni/api-router 2.10.0-canary.0 → 2.10.0-canary.2

package/src/routes/sessions.ts

@@ -1,3 +1,4 @@
+import { scheduledSessionIds } from "@opengeni/db";
 import {
   AcknowledgeStreamRequest,
   ApplySessionGoalRevisionRequest,
@@ -335,6 +336,7 @@ export function registerSessionRoutes(app: Hono, deps: SessionRouteDeps): void {
     db,
     settings,
     bus,
+    objectStorage,
     observability: deps.observability,
   };
   const workspaceCaptureManifestCache = new WorkspaceCaptureManifestCache();
@@ -516,6 +518,7 @@ export function registerSessionRoutes(app: Hono, deps: SessionRouteDeps): void {
     db,
     settings,
     bus,
+    objectStorage,
     ...(deps.establishSandboxSession
       ? { establishSandboxSession: deps.establishSandboxSession }
       : {}),
@@ -666,6 +669,12 @@ export function registerSessionRoutes(app: Hono, deps: SessionRouteDeps): void {
         ...(query.pinsOnly ? { pinsOnly: true } : {}),
         ...(query.archivedOnly ? { archivedOnly: true } : {}),
         ...(query.parentSessionId !== undefined ? { parentSessionId: query.parentSessionId } : {}),
+        ...(query.channelId !== undefined ? { channelId: query.channelId } : {}),
+        ...(query.createdBy ? { createdBy: query.createdBy } : {}),
+        ...(query.updatedFrom ? { updatedFrom: query.updatedFrom } : {}),
+        ...(query.updatedBefore ? { updatedBefore: query.updatedBefore } : {}),
+        ...(query.createdFrom ? { createdFrom: query.createdFrom } : {}),
+        ...(query.createdBefore ? { createdBefore: query.createdBefore } : {}),
         ...(authorizationScope ? { authorizationScope } : {}),
         // A managed human's own personal workspace has no membership row, so
         // the list's removal fence must fall back to the organization-membership
@@ -698,10 +707,23 @@ export function registerSessionRoutes(app: Hono, deps: SessionRouteDeps): void {
       workspaceId,
       sessionIds: [...page.pinned, ...page.sessions].map((session) => session.id),
     });
+    const scheduleTargets =
+      hasPermission(grant.permissions, "scheduled_tasks:run") &&
+      hasPermission(grant.permissions, "sessions:control")
+        ? await scheduledSessionIds(
+            db,
+            workspaceId,
+            [...page.pinned, ...page.sessions].map((session) => session.id),
+          )
+        : new Set<string>();
     const decorate = (session: Session): Session => {
       const activity = commandActivity.get(session.id);
       return sessionWithEffectiveToolPolicy(
-        { ...session, ...(activity ? { backgroundCommandActivity: activity } : {}) },
+        {
+          ...session,
+          hasSchedules: scheduleTargets.has(session.id),
+          ...(activity ? { backgroundCommandActivity: activity } : {}),
+        },
         policy.workspaceServerIds,
         policy.workspaceDefaultServerIds,
       );
@@ -709,6 +731,7 @@ export function registerSessionRoutes(app: Hono, deps: SessionRouteDeps): void {
     if (pageView) {
       return c.json({
         ...page,
+        ...(query.hasPageFilters ? { filtersApplied: true as const } : {}),
         pinned: page.pinned.map(decorate),
         sessions: page.sessions.map(decorate),
       });
@@ -888,7 +911,23 @@ export function registerSessionRoutes(app: Hono, deps: SessionRouteDeps): void {
     if (!session) {
       throw new HTTPException(404, { message: "session not found" });
     }
-    return c.json(await withEffectivePolicy(deps, workspaceId, grant.subjectId, session));
+    const activity = await backgroundCommandActivityForSessions(db, {
+      accountId: grant.accountId,
+      workspaceId,
+      sessionIds: [sessionId],
+    });
+    const scheduleTargets =
+      hasPermission(grant.permissions, "scheduled_tasks:run") &&
+      hasPermission(grant.permissions, "sessions:control")
+        ? await scheduledSessionIds(db, workspaceId, [sessionId])
+        : new Set<string>();
+    return c.json(
+      await withEffectivePolicy(deps, workspaceId, grant.subjectId, {
+        ...session,
+        hasSchedules: scheduleTargets.has(sessionId),
+        ...(activity.get(sessionId) ? { backgroundCommandActivity: activity.get(sessionId) } : {}),
+      }),
+    );
   });
 
   app.get("/v1/workspaces/:workspaceId/sessions/:sessionId/model-context", async (c) => {
@@ -925,6 +964,7 @@ export function registerSessionRoutes(app: Hono, deps: SessionRouteDeps): void {
       accountId: grant.accountId,
       workspaceId,
       sessionId,
+      activeOnly: true,
     });
     return c.json({ commands });
   });
@@ -1803,17 +1843,40 @@ export function registerSessionRoutes(app: Hono, deps: SessionRouteDeps): void {
     const workspaceId = c.req.param("workspaceId");
     const grant = await requireAccessGrant(c, deps, workspaceId, "sessions:read");
     const lineage = await readSessionLineage(deps, grant, c.req.param("sessionId"));
+    const sessionIds = [
+      c.req.param("sessionId"),
+      ...lineage.ancestors.map((session) => session.id),
+    ];
+    const collect = (nodes: LineageNode[]) => {
+      for (const node of nodes) {
+        sessionIds.push(node.session.id);
+        collect(node.children);
+      }
+    };
+    collect(lineage.children);
+    const targets =
+      hasPermission(grant.permissions, "scheduled_tasks:run") &&
+      hasPermission(grant.permissions, "sessions:control")
+        ? await scheduledSessionIds(db, workspaceId, sessionIds)
+        : new Set<string>();
+    const decorateNodes = (nodes: LineageNode[]): LineageNode[] =>
+      nodes.map((node) => ({
+        ...node,
+        session: { ...node.session, hasSchedules: targets.has(node.session.id) },
+        children: decorateNodes(node.children),
+      }));
     const policy = await loadEffectivePolicyContext(deps, workspaceId, grant.subjectId);
     return c.json({
       ...lineage,
+      sessionHasSchedules: targets.has(c.req.param("sessionId")),
       ancestors: lineage.ancestors.map((session) =>
         sessionWithEffectiveToolPolicy(
-          session,
+          { ...session, hasSchedules: targets.has(session.id) },
           policy.workspaceServerIds,
           policy.workspaceDefaultServerIds,
         ),
       ),
-      children: mapLineageNodes(lineage.children, policy),
+      children: decorateNodes(mapLineageNodes(lineage.children, policy)),
     });
   });
 
@@ -4617,6 +4680,13 @@ function sessionListQuery(
   search: string | undefined;
   pinsOnly: boolean;
   archivedOnly: boolean;
+  channelId: string | null | undefined;
+  createdBy: { kind: "subject" | "service"; subjectId: string } | undefined;
+  updatedFrom: Date | undefined;
+  updatedBefore: Date | undefined;
+  createdFrom: Date | undefined;
+  createdBefore: Date | undefined;
+  hasPageFilters: boolean;
 } {
   const parentSessionId = query.parentSessionId;
   // "null" = roots only; a uuid = children of that session; anything else is
@@ -4652,12 +4722,73 @@ function sessionListQuery(
     throw new HTTPException(400, { message: 'archivedOnly must be the literal "true"' });
   }
   const archivedOnly = query.archivedOnly === "true";
+  const channelId = query.channelId;
+  if (
+    channelId !== undefined &&
+    channelId !== "null" &&
+    !z.string().uuid().safeParse(channelId).success
+  ) {
+    throw new HTTPException(400, {
+      message: 'channelId must be a channel id or the literal "null"',
+    });
+  }
+  const createdByKind = query.createdByKind;
+  const createdBySubjectId = query.createdBySubjectId;
+  if ((createdByKind === undefined) !== (createdBySubjectId === undefined)) {
+    throw new HTTPException(400, {
+      message: "createdByKind and createdBySubjectId must be supplied together",
+    });
+  }
+  if (createdByKind !== undefined && createdByKind !== "subject" && createdByKind !== "service") {
+    throw new HTTPException(400, {
+      message: 'createdByKind must be "subject" or "service"',
+    });
+  }
+  if (
+    createdBySubjectId !== undefined &&
+    (createdBySubjectId.trim().length < 1 || createdBySubjectId.length > 1_024)
+  ) {
+    throw new HTTPException(400, {
+      message: "createdBySubjectId must be between 1 and 1024 characters",
+    });
+  }
+  const parseDateBound = (name: string): Date | undefined => {
+    const raw = query[name];
+    if (raw === undefined) return undefined;
+    const parsed = z.string().datetime({ offset: true }).safeParse(raw);
+    if (!parsed.success) {
+      throw new HTTPException(400, { message: `${name} must be an ISO-8601 timestamp` });
+    }
+    // Date-backed filters must not silently round accepted microseconds to an
+    // earlier boundary. Clients can use any ISO offset with at most 3 decimals.
+    if (/\.\d{4,}/.test(parsed.data)) {
+      throw new HTTPException(400, { message: `${name} supports at most millisecond precision` });
+    }
+    return new Date(parsed.data);
+  };
+  const updatedFrom = parseDateBound("updatedFrom");
+  const updatedBefore = parseDateBound("updatedBefore");
+  const createdFrom = parseDateBound("createdFrom");
+  const createdBefore = parseDateBound("createdBefore");
+  if (updatedFrom && updatedBefore && updatedFrom >= updatedBefore) {
+    throw new HTTPException(400, { message: "updatedFrom must be earlier than updatedBefore" });
+  }
+  if (createdFrom && createdBefore && createdFrom >= createdBefore) {
+    throw new HTTPException(400, { message: "createdFrom must be earlier than createdBefore" });
+  }
+  const hasPageFilters =
+    channelId !== undefined ||
+    createdByKind !== undefined ||
+    updatedFrom !== undefined ||
+    updatedBefore !== undefined ||
+    createdFrom !== undefined ||
+    createdBefore !== undefined;
   if (pinsOnly && !allowCursor) {
     throw new HTTPException(400, { message: 'pinsOnly requires view="page"' });
   }
-  if (pinsOnly && (rawCursor || parentSessionId !== undefined || search)) {
+  if (pinsOnly && (rawCursor || parentSessionId !== undefined || search || hasPageFilters)) {
     throw new HTTPException(400, {
-      message: "pinsOnly cannot be combined with cursor, parentSessionId, or search",
+      message: "pinsOnly cannot be combined with cursor, parentSessionId, search, or filters",
     });
   }
   if (pinsOnly && archivedOnly) {
@@ -4675,6 +4806,16 @@ function sessionListQuery(
     search: search || undefined,
     pinsOnly,
     archivedOnly,
+    channelId: channelId === undefined ? undefined : channelId === "null" ? null : channelId,
+    createdBy:
+      createdByKind && createdBySubjectId
+        ? { kind: createdByKind, subjectId: createdBySubjectId }
+        : undefined,
+    updatedFrom,
+    updatedBefore,
+    createdFrom,
+    createdBefore,
+    hasPageFilters,
   };
 }
 
@@ -4934,9 +5075,11 @@ export function agentTopologyQuery(query: Record<string, string>): {
     throw new HTTPException(400, { message: "query cannot be combined with an exact subject" });
   }
   const relevanceRequested = Boolean(searchQuery || subject);
+  // An explicit root scopes the whole workstream; only an explicit parent
+  // narrows it to one level. Ordinary browse still defaults to root sessions.
   const parentSessionId =
     rawParent === undefined
-      ? relevanceRequested
+      ? relevanceRequested || Boolean(rootSessionId)
         ? undefined
         : null
       : rawParent === "null"

package/src/routes/workspace-artifacts.ts

@@ -36,16 +36,20 @@ import {
 import type { Context, Hono } from "hono";
 import { HTTPException } from "hono/http-exception";
 import { z } from "zod";
-import {
-  prepareWorkspaceArtifactContent,
-  readWorkspaceArtifactContent,
-} from "../workspace-artifact-content";
+import { readWorkspaceArtifactContent } from "../workspace-artifact-content";
 import {
   projectWorkspaceArtifactDetailProvenance,
   projectWorkspaceArtifactMutationProvenance,
   redactWorkspaceArtifactListProvenance,
 } from "../workspace-artifact-provenance";
 
+import {
+  prepareWorkspaceArtifactPublication,
+  prepareWorkspaceArtifactUpload,
+  workspaceArtifactDownloads,
+  readArtifactObject,
+} from "../site-uploads";
+
 const ArtifactId = z.string().uuid();
 
 async function body<S extends z.ZodType>(context: Context, schema: S): Promise<z.infer<S>> {
@@ -54,6 +58,13 @@ async function body<S extends z.ZodType>(context: Context, schema: S): Promise<z
   return parsed.data;
 }
 
+function parseVersionId(value: string | undefined): string | undefined {
+  if (value !== undefined && !ArtifactId.safeParse(value).success) {
+    throw new HTTPException(422, { message: "Invalid artifact version id" });
+  }
+  return value;
+}
+
 function artifactId(context: Context): string {
   const parsed = ArtifactId.safeParse(context.req.param("artifactId"));
   if (!parsed.success) throw new HTTPException(422, { message: "Invalid artifact id" });
@@ -94,14 +105,14 @@ export function workspaceArtifactErrorResponse(context: Context, error: unknown)
 
 function prepareContent(
   deps: ApiRouteDeps,
-  workspaceId: string,
-  input: Parameters<typeof prepareWorkspaceArtifactContent>[2],
+  grant: AccessGrant,
+  input: Parameters<typeof prepareWorkspaceArtifactPublication>[2],
 ) {
   if (!deps.objectStorage)
     throw new HTTPException(503, {
       message: "Object storage is not configured",
     });
-  return prepareWorkspaceArtifactContent(deps.objectStorage, workspaceId, input);
+  return prepareWorkspaceArtifactPublication(deps, grant, input);
 }
 
 function provenance(subjectId: string, idempotencyKey: string) {
@@ -156,6 +167,30 @@ export function registerWorkspaceArtifactRoutes(app: Hono, deps: ApiRouteDeps):
   // retained-output API. The product route remains simply `/artifacts`.
   const base = "/v1/workspaces/:workspaceId/published-artifacts";
 
+  app.post(`${base}/uploads`, async (context) => {
+    const grant = await requireAccessGrant(
+      context,
+      deps,
+      context.req.param("workspaceId"),
+      "artifacts:publish",
+    );
+    return context.json(await prepareWorkspaceArtifactUpload(deps, grant));
+  });
+
+  app.get(`${base}/:artifactId/downloads`, async (context) => {
+    const workspaceId = context.req.param("workspaceId");
+    await requireAccessGrant(context, deps, workspaceId, "artifacts:read");
+    if (!deps.objectStorage)
+      throw new HTTPException(503, { message: "Object storage is not configured" });
+    const ref = await getWorkspaceArtifactContentRef(
+      deps.db,
+      workspaceId,
+      artifactId(context),
+      parseVersionId(context.req.query("versionId")),
+    );
+    return context.json(await workspaceArtifactDownloads(deps.objectStorage, ref, "public"));
+  });
+
   app.get(base, async (context) => {
     const workspaceId = context.req.param("workspaceId");
     await requireAccessGrant(context, deps, workspaceId, "artifacts:read");
@@ -195,12 +230,13 @@ export function registerWorkspaceArtifactRoutes(app: Hono, deps: ApiRouteDeps):
     const id = crypto.randomUUID();
     const slugBase = request.slug ?? (normalizeWorkspaceArtifactSlug(request.title) || "artifact");
     const slug = request.slug ?? `${slugBase.slice(0, 87)}-${id.slice(0, 8)}`;
-    const content = prepareContent(deps, workspaceId, {
-      html: request.html,
-      ...(request.source ? { source: request.source } : {}),
-      ...(request.requestedTools ? { requestedTools: request.requestedTools } : {}),
-    });
     try {
+      const content = await prepareContent(deps, grant, {
+        ...(request.html !== undefined ? { html: request.html } : {}),
+        ...(request.uploadId ? { uploadId: request.uploadId } : {}),
+        ...(request.source ? { source: request.source } : {}),
+        ...(request.requestedTools ? { requestedTools: request.requestedTools } : {}),
+      });
       return context.json(
         await mutationResponse(
           deps,
@@ -241,6 +277,43 @@ export function registerWorkspaceArtifactRoutes(app: Hono, deps: ApiRouteDeps):
     }
   });
 
+  app.get(`${base}/:artifactId/html`, async (context) => {
+    const workspaceId = context.req.param("workspaceId");
+    await requireAccessGrant(context, deps, workspaceId, "artifacts:read");
+    if (!deps.objectStorage)
+      throw new HTTPException(503, { message: "Object storage is not configured" });
+    const ref = await getWorkspaceArtifactContentRef(
+      deps.db,
+      workspaceId,
+      artifactId(context),
+      parseVersionId(context.req.query("versionId")),
+    );
+    const iterator = readArtifactObject(deps.objectStorage, ref.contentKey);
+    return new Response(
+      new ReadableStream({
+        async pull(controller) {
+          try {
+            const item = await iterator.next();
+            if (item.done) controller.close();
+            else controller.enqueue(item.value);
+          } catch (error) {
+            controller.error(error);
+          }
+        },
+        async cancel() {
+          await iterator.return();
+        },
+      }),
+      {
+        headers: {
+          "Content-Type": "text/html; charset=utf-8",
+          "Cache-Control": "private, no-store",
+          "Content-Security-Policy": "sandbox allow-scripts",
+        },
+      },
+    );
+  });
+
   app.get(`${base}/:artifactId/content`, async (context) => {
     const workspaceId = context.req.param("workspaceId");
     await requireAccessGrant(context, deps, workspaceId, "artifacts:read");
@@ -248,10 +321,7 @@ export function registerWorkspaceArtifactRoutes(app: Hono, deps: ApiRouteDeps):
       throw new HTTPException(503, {
         message: "Object storage is not configured",
       });
-    const parsedVersion = context.req.query("versionId");
-    if (parsedVersion && !ArtifactId.safeParse(parsedVersion).success) {
-      throw new HTTPException(422, { message: "Invalid artifact version id" });
-    }
+    const parsedVersion = parseVersionId(context.req.query("versionId"));
     try {
       const ref = await getWorkspaceArtifactContentRef(
         deps.db,
@@ -293,12 +363,13 @@ export function registerWorkspaceArtifactRoutes(app: Hono, deps: ApiRouteDeps):
     const grant = authorization.grant;
     const request = await body(context, PublishWorkspaceArtifactVersionRequest);
     const id = artifactId(context);
-    const content = prepareContent(deps, workspaceId, {
-      html: request.html,
-      ...(request.source ? { source: request.source } : {}),
-      ...(request.requestedTools ? { requestedTools: request.requestedTools } : {}),
-    });
     try {
+      const content = await prepareContent(deps, grant, {
+        ...(request.html !== undefined ? { html: request.html } : {}),
+        ...(request.uploadId ? { uploadId: request.uploadId } : {}),
+        ...(request.source ? { source: request.source } : {}),
+        ...(request.requestedTools ? { requestedTools: request.requestedTools } : {}),
+      });
       return context.json(
         await mutationResponse(
           deps,

package/src/sandbox/channel-a.ts

@@ -55,6 +55,7 @@ import {
 } from "@opengeni/observability";
 import { HTTPException } from "hono/http-exception";
 import { ApiHttpError } from "../http/api-error";
+import type { ObjectStorage } from "@opengeni/storage";
 
 import {
   buildSelfhostedBackendSession,
@@ -101,6 +102,7 @@ export type ChannelAServices = {
   db: Database;
   settings: Settings;
   bus: EventBus;
+  objectStorage?: ObjectStorage | null;
   observability?: Observability | undefined;
 };
 
@@ -1012,6 +1014,9 @@ async function withChannelAOperation<T>(
           acquiredLease: acquired.lease,
           fallbackEnvelope: envelope,
           dataPlaneUrl: acquired.lease.dataPlaneUrl,
+          ...(services.objectStorage !== undefined
+            ? { objectStorage: services.objectStorage }
+            : {}),
         });
         established = result.established;
         leaseSnapshot = result.lease;

package/src/sandbox/rematerialize.ts

@@ -1,4 +1,5 @@
 import type { Settings } from "@opengeni/config";
+import { parseWorkspaceArchiveObjectRef } from "@opengeni/contracts";
 import {
   adoptLegacyModalCheckpointArtifact,
   beginSandboxRematerialization,
@@ -13,6 +14,7 @@ import {
   type LeaseSnapshot,
 } from "@opengeni/db";
 import {
+  inlineWorkspaceArchiveForRestore,
   describeLegacyNativeSnapshotArchive,
   establishSandboxSessionFromEnvelope,
   isProviderSandboxNotFoundError,
@@ -30,17 +32,55 @@ import {
   type EstablishedSandboxSession,
   type WorkspaceArchiveDescriptor,
 } from "@opengeni/runtime/sandbox";
+import type { ObjectStorage } from "@opengeni/storage";
 
 function hasWorkspaceArchive(envelope: Record<string, unknown> | null): boolean {
   const sessionState =
-    envelope?.sessionState && typeof envelope.sessionState === "object"
+    envelope?.sessionState &&
+    typeof envelope.sessionState === "object" &&
+    !Array.isArray(envelope.sessionState)
       ? (envelope.sessionState as Record<string, unknown>)
       : null;
   return (
-    typeof sessionState?.workspaceArchive === "string" && sessionState.workspaceArchive.length > 0
+    (typeof sessionState?.workspaceArchive === "string" &&
+      sessionState.workspaceArchive.length > 0) ||
+    parseWorkspaceArchiveObjectRef(sessionState?.workspaceArchiveRef) !== null
   );
 }
 
+async function materializeArchiveObjectRef(
+  envelope: Record<string, unknown> | null,
+  objectStorage: ObjectStorage | null | undefined,
+): Promise<Record<string, unknown> | null> {
+  if (!envelope) return null;
+  const sessionState =
+    envelope.sessionState &&
+    typeof envelope.sessionState === "object" &&
+    !Array.isArray(envelope.sessionState)
+      ? (envelope.sessionState as Record<string, unknown>)
+      : null;
+  if (!sessionState) return envelope;
+  if (sessionState.workspaceArchiveRef == null) return envelope;
+  if (!parseWorkspaceArchiveObjectRef(sessionState.workspaceArchiveRef)) {
+    throw new WorkspaceArchiveIntegrityError(
+      "archive_metadata_invalid",
+      "workspace archive object reference is malformed",
+    );
+  }
+  if (!objectStorage) {
+    throw new WorkspaceArchiveIntegrityError(
+      "archive_base64_invalid",
+      "workspace archive object storage is not configured",
+    );
+  }
+  return {
+    ...envelope,
+    sessionState: await inlineWorkspaceArchiveForRestore(sessionState, (key) =>
+      objectStorage.getObjectBytes(key),
+    ),
+  };
+}
+
 function legacyNativeArchiveFromEnvelope(envelope: Record<string, unknown> | null) {
   const sessionState =
     envelope?.sessionState && typeof envelope.sessionState === "object"
@@ -82,6 +122,7 @@ export async function establishApiSandboxSpawner(input: {
   acquiredLease: LeaseSnapshot;
   fallbackEnvelope: Record<string, unknown> | null;
   dataPlaneUrl: string | null;
+  objectStorage?: ObjectStorage | null;
 }): Promise<{ established: EstablishedSandboxSession; lease: LeaseSnapshot }> {
   const fallbackArchiveEnvelope =
     input.acquiredLease.recovery.archive.status === "none" &&
@@ -162,8 +203,10 @@ export async function establishApiSandboxSpawner(input: {
       );
     }
 
+    const hydrateEnvelope = await materializeArchiveObjectRef(spawnEnvelope, input.objectStorage);
+
     const providerCreateStartedAt = new Date();
-    established = await establishSandboxSessionFromEnvelope(input.settings, spawnEnvelope, {
+    established = await establishSandboxSessionFromEnvelope(input.settings, hydrateEnvelope, {
       sessionId: input.sessionId,
       recovery: "create-or-restore",
       backendOverride: input.backend as never,

package/src/sandbox/viewer.ts

@@ -55,6 +55,7 @@ import {
 } from "@opengeni/db";
 import { appendAndPublishEvents, type EventBus } from "@opengeni/events";
 import { HTTPException } from "hono/http-exception";
+import type { ObjectStorage } from "@opengeni/storage";
 
 // The leaf — agent-loop-free. apps/api imports sandbox symbols ONLY from here
 // (enforced by sandbox-access-import-guard.test.ts).
@@ -98,6 +99,7 @@ export type ViewerServices = {
   db: Database;
   settings: Settings;
   bus?: EventBus;
+  objectStorage?: ObjectStorage | null;
   /** Provider-establish dependency used by API-direct readiness and stream
    *  operations. Production uses the runtime leaf; isolated tests may supply a
    *  deterministic provider without replacing a process-global module. */
@@ -381,6 +383,7 @@ export async function attachViewer(
         acquiredLease: acquired.lease,
         fallbackEnvelope: envelope,
         dataPlaneUrl: null,
+        ...(services.objectStorage !== undefined ? { objectStorage: services.objectStorage } : {}),
       });
       established = result.established;
       return {