@@ -0,0 +1,14 @@
+---
+'@objectstack/cli': patch
+'@objectstack/service-storage': patch
+---
+
+fix(cli,service-storage): the Console document's `connect-src` names the store the server presigns browser uploads to
+
+Clause-②: yes (widening)
+Metadata-protocol: none
+
+With S3 or an S3-compatible store (R2, MinIO), the Console uploads a file by `PUT`ting it straight to the URL `POST /api/v1/storage/upload/presigned` answers, on the store's host. The Console document's content-security-policy did not name that host, so the browser refused every such upload with `TypeError: Failed to fetch`.
+
+- **`@objectstack/service-storage`.** `S3StorageAdapter.getPresignedUploadOrigin()` answers the origin every presigned upload URL carries. It signs a probe upload with the same client options as every real presign, so a virtual-hosted bucket (`BUCKET.ENDPOINT-HOST`), a region-templated AWS host and a path-style endpoint come out exactly as the upload URL carries them. Signing is local and uses fixed probe credentials, so it never reaches the network or the AWS credential chain. `SwappableStorageService.getPresignedUploadOrigin()` answers the active adapter's origin, or `undefined` for an adapter without one (the local adapter's uploads go to the server itself).
+- **`@objectstack/cli`.** The Console mount reads that origin off the kernel's `storage` service on every document and adds it to `connect-src`, after the error-reporting origin and before `OS_CONSOLE_CSP_CONNECT_SRC`. A storage settings change that swaps the adapter is followed on the next document, with no restart. Local storage, no storage service, or a store whose endpoint the presigner refuses adds nothing. The last case logs one `warn` that names the remedy. `OS_CONSOLE_CSP_CONNECT_SRC` still adds an operator's extra sources, and a deployment that named its store there as a stop-gap can drop it.
@@ -9,7 +9,8 @@
  * document carries. These cases run the REAL plugin on a REAL Hono app (the
  * `HonoHttpServer` production resolves as `http.server`); the error-reporting
  * case adds the REAL `RuntimeConfigPlugin`, so the `connect-src` follows what
- * that door serves.
+ * that door serves; the storage cases add the REAL `StorageServicePlugin`, so
+ * the `connect-src` follows the adapter it builds.
  */
 
 import { describe, it, expect, beforeAll, afterAll, beforeEach, afterEach } from 'vitest';
@@ -18,6 +19,7 @@ import os from 'node:os';
 import path from 'node:path';
 import { HonoHttpServer } from '@objectstack/plugin-hono-server';
 import { RuntimeConfigPlugin } from '@objectstack/cloud-connection';
+import { S3StorageAdapter, StorageServicePlugin, type StorageServicePluginOptions } from '@objectstack/service-storage';
 
 import { createConsoleStaticPlugin } from './console.js';
 
@@ -45,6 +47,8 @@ const ENV = [
   'OS_CONSOLE_MAP_STYLE_URL',
   'OS_CLOUD_URL',
   'OS_TELEMETRY_CLIENT_ERROR_REPORTING_DSN',
+  'AWS_ACCESS_KEY_ID',
+  'AWS_SECRET_ACCESS_KEY',
 ];
 
 let saved: Record<string, string | undefined>;
@@ -77,6 +81,8 @@ afterEach(() => {
 
 async function mount(opts: {
   runtimeConfig?: ConstructorParameters<typeof RuntimeConfigPlugin>[0];
+  /** The kernel services the console plugin's context resolves by name. */
+  services?: Map<string, unknown>;
   warnings?: string[];
 } = {}) {
   const server = new HonoHttpServer(0);
@@ -99,7 +105,14 @@ async function mount(opts: {
     } as any);
     for (const fn of hooks) await fn();
   }
-  await createConsoleStaticPlugin(distPath).start({ getServiceAsync: async () => server, logger });
+  await createConsoleStaticPlugin(distPath).start({
+    getServiceAsync: async () => server,
+    getService: (name: string) => {
+      if (opts.services?.has(name)) return opts.services.get(name);
+      throw new Error(`no service ${name}`);
+    },
+    logger,
+  });
   const app = server.getRawApp();
   return async (p: string, init?: RequestInit): Promise<Response> => app.request(`${ORIGIN}${p}`, init);
 }
@@ -388,3 +401,118 @@ describe('connect-src', () => {
     expect(await verdict(() => mount())).toBe(runtimeConfig);
   });
 });
+
+/**
+ * The kernel services a REAL `StorageServicePlugin` registers when it is
+ * initialised with `options`: the `storage` service the upload doors presign
+ * through, built from the same options.
+ */
+async function storageServices(options: StorageServicePluginOptions): Promise<Map<string, unknown>> {
+  const services = new Map<string, unknown>();
+  await new StorageServicePlugin(options).init({
+    registerService: (name: string, service: unknown) => { services.set(name, service); },
+    getService: (name: string) => {
+      if (services.has(name)) return services.get(name);
+      throw new Error(`no service ${name}`);
+    },
+    logger: { warn: () => {}, info: () => {}, debug: () => {}, error: () => {} },
+  } as any);
+  return services;
+}
+
+/** An S3-compatible store whose presigned URLs are virtual-hosted: the bucket is in the host name. */
+const R2_STORAGE: StorageServicePluginOptions = {
+  adapter: 's3',
+  s3: { bucket: 'csp-uploads', region: 'auto', endpoint: 'https://acct123.r2.cloudflarestorage.com', keyPrefix: 'projects/env_1' },
+};
+
+describe('connect-src names the host the storage service presigns browser uploads to', () => {
+  it('adds the origin of the presigned upload URL when the deployment stores files in S3', async () => {
+    const request = await mount({ services: await storageServices(R2_STORAGE) });
+    const res = await request('/_console/');
+    expect(directives(res.headers.get('content-security-policy')).get('connect-src')).toEqual([
+      "'self'",
+      'https://demotiles.maplibre.org',
+      'https://csp-uploads.acct123.r2.cloudflarestorage.com',
+    ]);
+  });
+
+  it('allows exactly the origin of a real presigned upload URL from the same storage service', async () => {
+    // The presign itself signs with whatever credentials the adapter resolves.
+    process.env.AWS_ACCESS_KEY_ID = 'AKIAFAKEFAKEFAKEFAKE';
+    process.env.AWS_SECRET_ACCESS_KEY = 'fake-secret-access-key';
+    for (const options of [
+      R2_STORAGE,
+      { adapter: 's3', s3: { bucket: 'csp-uploads', region: 'eu-west-2', keyPrefix: null } },
+      { adapter: 's3', s3: { bucket: 'csp.uploads.example', region: 'us-east-1', keyPrefix: null } },
+      { adapter: 's3', s3: { bucket: 'csp-uploads', region: 'us-east-1', endpoint: 'http://127.0.0.1:9000', keyPrefix: null } },
+    ] satisfies StorageServicePluginOptions[]) {
+      const services = await storageServices(options);
+      const presigned = await (services.get('storage') as S3StorageAdapter).getPresignedUpload('a/b.txt', 60, { contentType: 'text/plain' });
+      const request = await mount({ services });
+      const res = await request('/_console/');
+      const connectSrc = directives(res.headers.get('content-security-policy')).get('connect-src')!;
+      expect(connectSrc, options.s3?.endpoint ?? options.s3?.region).toEqual([
+        "'self'",
+        'https://demotiles.maplibre.org',
+        new URL(presigned.uploadUrl).origin,
+      ]);
+    }
+  });
+
+  it('follows the adapter a storage settings change swaps in, on the next document', async () => {
+    const services = await storageServices(R2_STORAGE);
+    const request = await mount({ services });
+    const storage = services.get('storage') as { swap(next: unknown): void };
+    storage.swap(new S3StorageAdapter({
+      bucket: 'moved', region: 'auto', endpoint: 'https://acct456.r2.cloudflarestorage.com', keyPrefix: null, forcePathStyle: true,
+    }));
+    const res = await request('/_console/');
+    expect(directives(res.headers.get('content-security-policy')).get('connect-src')).toEqual([
+      "'self'",
+      'https://demotiles.maplibre.org',
+      'https://acct456.r2.cloudflarestorage.com',
+    ]);
+  });
+
+  it('adds nothing when the deployment stores files on the local disk, whose uploads go to the server itself', async () => {
+    const rootDir = fs.mkdtempSync(path.join(os.tmpdir(), 'os-test-console-csp-storage-'));
+    try {
+      const request = await mount({ services: await storageServices({ adapter: 'local', local: { rootDir } }) });
+      const res = await request('/_console/');
+      expect(directives(res.headers.get('content-security-policy')).get('connect-src')).toEqual([
+        "'self'",
+        'https://demotiles.maplibre.org',
+      ]);
+    } finally {
+      fs.rmSync(rootDir, { recursive: true, force: true });
+    }
+  });
+
+  it('adds nothing, and says so once, when the store\'s endpoint is one the presigner refuses', async () => {
+    const warnings: string[] = [];
+    const services = await storageServices({ adapter: 's3', s3: { bucket: 'csp-uploads', region: 'auto', endpoint: 'not a url', keyPrefix: null } });
+    const request = await mount({ services, warnings });
+    for (let i = 0; i < 2; i += 1) {
+      const res = await request('/_console/');
+      expect(res.status).toBe(200);
+      expect(directives(res.headers.get('content-security-policy')).get('connect-src')).toEqual([
+        "'self'",
+        'https://demotiles.maplibre.org',
+      ]);
+    }
+    expect(warnings.filter((w) => w.includes('presigns uploads to'))).toHaveLength(1);
+  });
+
+  it('keeps OS_CONSOLE_CSP_CONNECT_SRC working beside it, after the storage origin', async () => {
+    process.env.OS_CONSOLE_CSP_CONNECT_SRC = 'https://glyphs.example.com';
+    const request = await mount({ services: await storageServices(R2_STORAGE) });
+    const res = await request('/_console/');
+    expect(directives(res.headers.get('content-security-policy')).get('connect-src')).toEqual([
+      "'self'",
+      'https://demotiles.maplibre.org',
+      'https://csp-uploads.acct123.r2.cloudflarestorage.com',
+      'https://glyphs.example.com',
+    ]);
+  });
+});
@@ -826,8 +826,10 @@ const DEFAULT_MAP_STYLE_ORIGIN = 'https://demotiles.maplibre.org';
  *   when the operator names one in `OS_CONSOLE_MAP_STYLE_URL` (the URL
  *   `GET /api/v1/runtime/config` serves as `mapStyleUrl`), the
  *   error-reporting endpoint when the runtime serves a DSN
- *   (`telemetry.errorReporting.dsn` from the same door), and the hosts an
- *   operator names in `OS_CONSOLE_CSP_CONNECT_SRC`.
+ *   (`telemetry.errorReporting.dsn` from the same door), the store the
+ *   deployment's storage presigns browser uploads to (S3 and S3-compatible
+ *   stores; `readStorageUploadOrigin`), and the hosts an operator names in
+ *   `OS_CONSOLE_CSP_CONNECT_SRC`.
  * - `default-src 'self'` covers the rest the Console uses: the module workers
  *   maplibre starts from its own file, the PWA manifest, and the same-origin
  *   frames (the Studio's live canvas). The build ships no web fonts.
@@ -842,6 +844,7 @@ function consoleContentSecurityPolicy(input: {
   reactPages: boolean;
   errorReportingOrigin: string | undefined;
   mapStyleOrigin: string | undefined;
+  storageUploadOrigin: string | undefined;
   extraConnectSources: readonly string[];
   embeddable: boolean;
 }): string {
@@ -850,6 +853,7 @@ function consoleContentSecurityPolicy(input: {
   const connectSrc = ["'self'", DEFAULT_MAP_STYLE_ORIGIN];
   if (input.mapStyleOrigin !== undefined) connectSrc.push(input.mapStyleOrigin);
   if (input.errorReportingOrigin !== undefined) connectSrc.push(input.errorReportingOrigin);
+  if (input.storageUploadOrigin !== undefined) connectSrc.push(input.storageUploadOrigin);
   connectSrc.push(...input.extraConnectSources);
   const directives: string[][] = [
     ['default-src', "'self'"],
@@ -1030,6 +1034,21 @@ export function createConsoleStaticPlugin(distPath: string, options?: { isDev?:
         );
       };
 
+      // A storage service that cannot say where its presigned uploads go leaves
+      // the store out of the policy, so browser uploads to it are refused while
+      // every other part of the page works: said once, at `warn`.
+      let reportedStorageUploadOriginFailure = false;
+      const reportStorageUploadOriginFailure = (cause: string) => {
+        if (reportedStorageUploadOriginFailure) return;
+        reportedStorageUploadOriginFailure = true;
+        ctx.logger?.warn?.(
+          `Console static: the storage service could not name the host it presigns uploads to (${cause}), so the `
+          + "console document's content-security-policy does not allow it and browser file uploads to that store "
+          + `are blocked. Check the storage settings, or name the store's origin in ${CONSOLE_CSP_CONNECT_SRC_ENV}. `
+          + 'Reported once; every later console document reads it again.',
+        );
+      };
+
       const readIndexHtml = (reactPages: boolean, nonce: string): string => {
         const raw = fs.readFileSync(indexPath, 'utf-8');
         // Inject <base href="${CONSOLE_PATH}/"> so:
@@ -1068,6 +1087,7 @@ export function createConsoleStaticPlugin(distPath: string, options?: { isDev?:
           reactPages,
           errorReportingOrigin: shell?.errorReportingOrigin,
           mapStyleOrigin,
+          storageUploadOrigin: await readStorageUploadOrigin(ctx, reportStorageUploadOriginFailure),
           extraConnectSources,
           embeddable: reqPath.startsWith(`${PUBLIC_FORM_PAGE}/`),
         });
@@ -1498,6 +1518,53 @@ async function anonymousFormDoorServes(app: any, c: any, slug: string): Promise<
   return res.status === 200;
 }
 
+/**
+ * The origin the kernel's `storage` service presigns browser uploads to, for
+ * the console document's `connect-src`; `undefined` when there is none.
+ *
+ * With S3 or an S3-compatible store (R2, MinIO) the Console uploads a file by
+ * `PUT`ting it straight to the URL `POST /api/v1/storage/upload/presigned`
+ * answers, on the store's host. The service names that host itself
+ * (`getPresignedUploadOrigin` on `@objectstack/service-storage`'s
+ * `SwappableStorageService`, which asks the active adapter's presigner), so
+ * the policy allows exactly the origin the upload URL carries, and the rule
+ * for building it lives in one place. The service is read off the kernel by
+ * name, not imported, because this module imports Node built-ins only
+ * (`test/published-subpath-console.pin.test.ts`).
+ *
+ * Read per document, as the shell config is: a storage settings change swaps
+ * the adapter without a restart, and the next document follows it. A
+ * deployment without the service, or whose adapter answers no origin (the
+ * local adapter's uploads go to this server, which `'self'` covers), adds
+ * nothing. An answer that is not a `connect-src` source, or a failure to
+ * answer, adds nothing either and is reported through `onFailure`.
+ */
+async function readStorageUploadOrigin(
+  ctx: any,
+  onFailure: (cause: string) => void,
+): Promise<string | undefined> {
+  let storage: { getPresignedUploadOrigin?: () => Promise<unknown> } | undefined;
+  try {
+    storage = ctx.getService?.('storage');
+  } catch {
+    return undefined;
+  }
+  if (typeof storage?.getPresignedUploadOrigin !== 'function') return undefined;
+  let origin: unknown;
+  try {
+    origin = await storage.getPresignedUploadOrigin();
+  } catch (e: any) {
+    onFailure(e?.message ?? String(e));
+    return undefined;
+  }
+  if (origin === undefined) return undefined;
+  if (typeof origin !== 'string' || !CONNECT_SOURCE.test(origin)) {
+    onFailure(`it answered ${JSON.stringify(origin)}, which is not a connect-src source`);
+    return undefined;
+  }
+  return origin;
+}
+
 /** What the console document is written from, read from {@link RUNTIME_CONFIG_DOOR}. */
 interface ConsoleShellConfig {
   branding?: ConsoleShellBranding;
 
@@ -0,0 +1,90 @@
+// Copyright (c) 2026 ObjectStack. Licensed under the Apache-2.0 license.
+
+/**
+ * `getPresignedUploadOrigin()` answers the origin every presigned upload URL
+ * carries.
+ *
+ * The Console document's `connect-src` names this origin so the browser may
+ * `PUT` a file straight to the store. An origin assembled beside the presigner
+ * would drift from it: S3 puts a DNS-compatible bucket in the host name
+ * (virtual-hosted), templates the region into the AWS host, and falls back to
+ * the path for a bucket a host name cannot carry. So every case below compares
+ * the answer with the origin of a REAL presigned upload URL from the same
+ * adapter, through the REAL SDK, fully offline: presigning is local
+ * computation over the fake credentials, and nothing here opens a socket.
+ */
+
+import { describe, it, expect } from 'vitest';
+import { S3StorageAdapter, type S3StorageAdapterOptions } from './s3-storage-adapter.js';
+import { SwappableStorageService } from './swappable-storage-service.js';
+import { LocalStorageAdapter } from './local-storage-adapter.js';
+
+const CREDENTIALS = { accessKeyId: 'AKIAFAKEFAKEFAKEFAKE', secretAccessKey: 'fake-secret-access-key' };
+
+async function presignedUploadOrigin(options: S3StorageAdapterOptions): Promise<string> {
+  const adapter = new S3StorageAdapter({ ...CREDENTIALS, ...options });
+  const presigned = await adapter.getPresignedUpload('dir/file.txt', 60, { contentType: 'text/plain' });
+  return new URL(presigned.uploadUrl).origin;
+}
+
+describe('S3StorageAdapter.getPresignedUploadOrigin', () => {
+  it.each<[string, S3StorageAdapterOptions, string]>([
+    [
+      'an S3-compatible endpoint, virtual-hosted',
+      { bucket: 'uploads', region: 'auto', endpoint: 'https://acct123.r2.cloudflarestorage.com', keyPrefix: 'projects/env_1' },
+      'https://uploads.acct123.r2.cloudflarestorage.com',
+    ],
+    [
+      'an S3-compatible endpoint, path-style',
+      { bucket: 'uploads', region: 'auto', endpoint: 'https://acct123.r2.cloudflarestorage.com', keyPrefix: null, forcePathStyle: true },
+      'https://acct123.r2.cloudflarestorage.com',
+    ],
+    [
+      'a self-hosted endpoint on a port',
+      { bucket: 'uploads', region: 'us-east-1', endpoint: 'http://127.0.0.1:9000', keyPrefix: null, forcePathStyle: true },
+      'http://127.0.0.1:9000',
+    ],
+    [
+      'AWS, region-templated',
+      { bucket: 'uploads', region: 'eu-west-2', keyPrefix: null },
+      'https://uploads.s3.eu-west-2.amazonaws.com',
+    ],
+    [
+      'AWS, a bucket a host name cannot carry',
+      { bucket: 'uploads.example.com', region: 'us-east-1', keyPrefix: null },
+      'https://s3.us-east-1.amazonaws.com',
+    ],
+  ])('answers the origin of a real presigned upload URL: %s', async (_name, options, expected) => {
+    const adapter = new S3StorageAdapter(options);
+    expect(await adapter.getPresignedUploadOrigin()).toBe(await presignedUploadOrigin(options));
+    expect(await adapter.getPresignedUploadOrigin()).toBe(expected);
+  });
+
+  it('needs no credentials, so it never consults the SDK credential chain', async () => {
+    const adapter = new S3StorageAdapter({ bucket: 'uploads', region: 'eu-west-2', keyPrefix: null });
+    expect(await adapter.getPresignedUploadOrigin()).toBe('https://uploads.s3.eu-west-2.amazonaws.com');
+  });
+
+  it.each([['not a url'], ['ftp://store.example.com']])('rejects on an endpoint the SDK refuses: %j', async (endpoint) => {
+    const adapter = new S3StorageAdapter({ bucket: 'uploads', region: 'us-east-1', endpoint, keyPrefix: null });
+    await expect(adapter.getPresignedUploadOrigin()).rejects.toThrow();
+  });
+});
+
+describe('SwappableStorageService.getPresignedUploadOrigin', () => {
+  it('answers the active adapter\'s origin, and follows a swap', async () => {
+    const storage = new SwappableStorageService(
+      new S3StorageAdapter({ bucket: 'uploads', region: 'eu-west-2', keyPrefix: null }),
+    );
+    expect(await storage.getPresignedUploadOrigin()).toBe('https://uploads.s3.eu-west-2.amazonaws.com');
+    storage.swap(new S3StorageAdapter({
+      bucket: 'moved', region: 'auto', endpoint: 'https://acct456.r2.cloudflarestorage.com', keyPrefix: null, forcePathStyle: true,
+    }));
+    expect(await storage.getPresignedUploadOrigin()).toBe('https://acct456.r2.cloudflarestorage.com');
+  });
+
+  it('answers undefined for the local adapter, whose uploads go to the server itself', async () => {
+    const storage = new SwappableStorageService(new LocalStorageAdapter({ rootDir: '/nonexistent-never-written' }));
+    expect(await storage.getPresignedUploadOrigin()).toBeUndefined();
+  });
+});