@axiom-lattice/gateway 2.1.100 → 2.1.102

package/dist/index.js

@@ -30,6 +30,53 @@ var __toESM = (mod, isNodeMode, target) => (target = mod != null ? __create(__ge
 ));
 var __toCommonJS = (mod) => __copyProps(__defProp({}, "__esModule", { value: true }), mod);
 
+// src/utils/mime.ts
+function getContentTypeFromFilename(filename) {
+  const ext = filename.includes(".") ? filename.slice(filename.lastIndexOf(".")).toLowerCase() : "";
+  return EXT_TO_MIME[ext] ?? "application/octet-stream";
+}
+function getFilenameFromPath(path3) {
+  const segments = path3.replace(/\/+$/, "").split("/");
+  return segments[segments.length - 1] || "download";
+}
+var EXT_TO_MIME;
+var init_mime = __esm({
+  "src/utils/mime.ts"() {
+    "use strict";
+    EXT_TO_MIME = {
+      ".txt": "text/plain",
+      ".html": "text/html",
+      ".htm": "text/html",
+      ".css": "text/css",
+      ".js": "application/javascript",
+      ".mjs": "application/javascript",
+      ".json": "application/json",
+      ".pdf": "application/pdf",
+      ".png": "image/png",
+      ".jpg": "image/jpeg",
+      ".jpeg": "image/jpeg",
+      ".gif": "image/gif",
+      ".webp": "image/webp",
+      ".svg": "image/svg+xml",
+      ".ico": "image/x-icon",
+      ".zip": "application/zip",
+      ".csv": "text/csv",
+      ".xml": "application/xml",
+      ".xlsx": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet",
+      ".xls": "application/vnd.ms-excel",
+      ".pptx": "application/vnd.openxmlformats-officedocument.presentationml.presentation",
+      ".ppt": "application/vnd.ms-powerpoint",
+      ".docx": "application/vnd.openxmlformats-officedocument.wordprocessingml.document",
+      ".doc": "application/msword",
+      ".mp4": "video/mp4",
+      ".webm": "video/webm",
+      ".mp3": "audio/mpeg",
+      ".wav": "audio/wav",
+      ".ogg": "audio/ogg"
+    };
+  }
+});
+
 // src/logger/Logger.ts
 var import_pino, import_pino_pretty, import_pino_roll, PinoLoggerFactory, Logger;
 var init_Logger = __esm({
@@ -311,31 +358,37 @@ var init_wechat_client = __esm({
 });
 
 // src/channels/wechat/context-store.ts
-function getContextToken(senderId) {
-  const entry = store.get(senderId);
+function makeKey(installationId, senderId) {
+  return `${installationId}::${senderId}`;
+}
+function getContextToken(installationId, senderId) {
+  const key = makeKey(installationId, senderId);
+  const entry = store.get(key);
   if (!entry) return void 0;
   if (Date.now() - entry.updatedAt > TOKEN_TTL_MS) {
-    deleteContextToken(senderId);
+    deleteContextToken(installationId, senderId);
     return void 0;
   }
   return entry.token;
 }
-function setContextToken(senderId, token) {
-  const existingTimer = timers.get(senderId);
+function setContextToken(installationId, senderId, token) {
+  const key = makeKey(installationId, senderId);
+  const existingTimer = timers.get(key);
   if (existingTimer) clearTimeout(existingTimer);
-  store.set(senderId, { token, senderId, updatedAt: Date.now() });
+  store.set(key, { token, installationId, senderId, updatedAt: Date.now() });
   const timer = setTimeout(() => {
-    store.delete(senderId);
-    timers.delete(senderId);
+    store.delete(key);
+    timers.delete(key);
   }, TOKEN_TTL_MS);
-  timers.set(senderId, timer);
+  timers.set(key, timer);
 }
-function deleteContextToken(senderId) {
-  store.delete(senderId);
-  const timer = timers.get(senderId);
+function deleteContextToken(installationId, senderId) {
+  const key = makeKey(installationId, senderId);
+  store.delete(key);
+  const timer = timers.get(key);
   if (timer) {
     clearTimeout(timer);
-    timers.delete(senderId);
+    timers.delete(key);
   }
 }
 var TOKEN_TTL_MS, store, timers;
@@ -402,7 +455,7 @@ var init_WechatChannelAdapter = __esm({
         const text = extractText(msg);
         if (!text) return null;
         if (msg.context_token) {
-          setContextToken(senderId, msg.context_token);
+          setContextToken(installation.id, senderId, msg.context_token);
         }
         return {
           channel: "wechat",
@@ -428,13 +481,13 @@ var init_WechatChannelAdapter = __esm({
       },
       async sendReply(replyTarget, message, installation) {
         const senderId = replyTarget.rawTarget.senderId;
-        const contextToken = getContextToken(senderId);
+        const contextToken = getContextToken(installation.id, senderId);
         if (!contextToken) {
           logger4.warn("WeChat context token expired, cannot send reply", {
             installationId: installation.id,
             senderId
           });
-          deleteContextToken(senderId);
+          deleteContextToken(installation.id, senderId);
           return;
         }
         const { botToken } = installation.config;
@@ -1139,6 +1192,190 @@ var init_a2a = __esm({
   }
 });
 
+// src/controllers/resources.ts
+var resources_exports = {};
+__export(resources_exports, {
+  ResourceController: () => ResourceController
+});
+var import_core35, ResourceController;
+var init_resources = __esm({
+  "src/controllers/resources.ts"() {
+    "use strict";
+    import_core35 = require("@axiom-lattice/core");
+    init_mime();
+    ResourceController = class {
+      constructor(deps) {
+        this.deps = deps;
+      }
+      async createShare(request, reply) {
+        const userId = request.user ? request.user.id ?? "unknown" : "unknown";
+        const tenantId = request.headers["x-tenant-id"] || "default";
+        const workspaceId = request.headers["x-workspace-id"];
+        const projectId = request.headers["x-project-id"];
+        const body = request.body;
+        if (!workspaceId || !projectId) {
+          return reply.status(400).send({ error: "x-workspace-id and x-project-id headers required" });
+        }
+        const payload = (0, import_core35.createSharePayload)(
+          tenantId,
+          workspaceId,
+          projectId,
+          userId,
+          body
+        );
+        const token = (0, import_core35.generateToken)();
+        try {
+          await this.deps.store.create({ ...payload, token });
+          this.deps.logger.info(
+            "Share created",
+            { token, resourcePath: body.resourcePath, userId }
+          );
+        } catch {
+          return reply.status(500).send({ error: "Failed to create share" });
+        }
+        return reply.status(201).send({ token, url: `/s/${token}` });
+      }
+      async listShares(request, reply) {
+        const userId = request.user ? request.user.id ?? "unknown" : "unknown";
+        const tenantId = request.headers["x-tenant-id"] || "default";
+        const shares = await this.deps.store.listByUser(tenantId, userId);
+        return reply.send(shares);
+      }
+      async updateShare(request, reply) {
+        const { token } = request.params;
+        const userId = request.user ? request.user.id : void 0;
+        const patch = request.body;
+        const record = await this.deps.store.findByToken(token);
+        if (!record || record.createdBy !== userId) {
+          return reply.status(404).send({ error: "Share not found" });
+        }
+        await this.deps.store.update(token, patch);
+        if (patch.revoked) {
+          this.deps.cache.invalidate(token);
+        }
+        return reply.send({ ok: true });
+      }
+      async revokeShare(request, reply) {
+        const { token } = request.params;
+        const userId = request.user ? request.user.id : void 0;
+        const record = await this.deps.store.findByToken(token);
+        if (!record || record.createdBy !== userId) {
+          return reply.status(404).send({ error: "Share not found" });
+        }
+        await this.deps.store.update(token, { revoked: true });
+        this.deps.cache.invalidate(token);
+        return reply.send({ ok: true });
+      }
+      async resolveResource(request, reply) {
+        const params = request.params;
+        const { token } = params;
+        const subPath = params["*"] ?? "";
+        const cached = this.deps.cache.get(token);
+        if (cached && !cached.requiresUnlock) {
+          return this._serveFile(cached.address, token, subPath, reply);
+        }
+        const record = await this.deps.store.findByToken(token);
+        if (!record || record.revoked) return reply.status(404).send("Not found");
+        if (record.expiresAt && new Date(record.expiresAt) < /* @__PURE__ */ new Date()) {
+          return reply.status(410).send("Expired");
+        }
+        if (!this._isInternalRequest(request)) {
+          if (record.visibility === "password") {
+            const unlocked = this._isUnlocked(request, token);
+            if (!unlocked) {
+              this.deps.cache.set(token, { address: record.address, requiresUnlock: true });
+              return reply.type("text/html").send(this._passwordPage(token));
+            }
+          }
+        }
+        if (record.maxAccess !== null) {
+          const ok = await this.deps.store.atomicIncrementAccess(token);
+          if (!ok) return reply.status(410).send("Access limit reached");
+        } else {
+          this.deps.store.incrementAccess(token).catch(() => {
+          });
+        }
+        this.deps.cache.set(token, {
+          address: record.address,
+          requiresUnlock: record.visibility === "password" && !this._isInternalRequest(request)
+        });
+        return this._serveFile(record.address, token, subPath, reply);
+      }
+      async unlockShare(request, reply) {
+        const { token } = request.params;
+        const { password } = request.body;
+        const record = await this.deps.store.findByToken(token);
+        if (!record || !record.passwordHash) {
+          return reply.status(404).send({ error: "Invalid request" });
+        }
+        const valid = password === record.passwordHash;
+        if (!valid) {
+          return reply.status(401).send({ error: "Incorrect password" });
+        }
+        reply.header(
+          "Set-Cookie",
+          `share_unlock_${token}=1; Max-Age=86400; Path=/s/${token}; SameSite=Lax; HttpOnly; Secure`
+        );
+        return reply.send({ ok: true });
+      }
+      _isInternalRequest(request) {
+        const user = request.user;
+        return !!user && !!user.id;
+      }
+      _isUnlocked(request, token) {
+        const cookie = request.headers.cookie ?? "";
+        return cookie.includes(`share_unlock_${token}=1`);
+      }
+      async _serveFile(address, token, subPath, reply) {
+        const provider = this.deps.sandboxManager.getDefaultProvider();
+        const resolver = provider.getResourceResolver();
+        const fullPath = subPath ? this._resolveSafeSubPath(address.resourcePath, subPath) : address.resourcePath;
+        let buf;
+        try {
+          buf = await resolver.resolve({ ...address, resourcePath: fullPath });
+        } catch (err) {
+          this.deps.logger.warn(
+            "Resource resolution failed",
+            { token, resourcePath: fullPath, error: err.message }
+          );
+          return reply.status(404).send("File not found");
+        }
+        const filename = fullPath.split("/").pop() || "download";
+        const isHtml = !subPath && /\.(html|htm)$/i.test(filename);
+        if (isHtml) {
+          buf = this._injectBaseTag(buf, token);
+        }
+        const contentType = getContentTypeFromFilename(filename);
+        return reply.status(200).type(contentType).header("Content-Disposition", `inline; filename="${filename}"`).header("Access-Control-Allow-Origin", "*").send(buf);
+      }
+      _resolveSafeSubPath(entryFile, subPath) {
+        if (!subPath) return entryFile;
+        if (subPath.includes("..")) throw new Error("Path traversal denied");
+        const entryDir = entryFile.replace(/[^/]+$/, "");
+        return (entryDir + subPath).replace(/\/+/g, "/");
+      }
+      _injectBaseTag(buf, token) {
+        const html = buf.toString("utf-8");
+        if (/<base\b/i.test(html)) return buf;
+        const baseTag = `<base href="/s/${token}/">`;
+        if (html.includes("</head>")) {
+          return Buffer.from(html.replace("</head>", `${baseTag}</head>`), "utf-8");
+        }
+        if (html.includes("<head>")) {
+          return Buffer.from(html.replace("<head>", `<head>${baseTag}`), "utf-8");
+        }
+        if (html.includes("<html>")) {
+          return Buffer.from(html.replace("<html>", `<html>${baseTag}`), "utf-8");
+        }
+        return Buffer.from(baseTag + html, "utf-8");
+      }
+      _passwordPage(token) {
+        return `<!DOCTYPE html><html><head><meta charset="utf-8"><meta name="viewport" content="width=device-width,initial-scale=1"><title>Password Protected</title><style>body{font-family:-apple-system,BlinkMacSystemFont,sans-serif;display:flex;align-items:center;justify-content:center;min-height:100vh;margin:0;background:#f5f5f5}.card{background:#fff;padding:32px;border-radius:12px;box-shadow:0 2px 8px rgba(0,0,0,.1);width:100%;max-width:360px;text-align:center}h2{margin:0 0 8px;font-size:20px}p{margin:0 0 20px;color:#666;font-size:14px}input{width:100%;padding:10px 12px;border:1px solid #d9d9d9;border-radius:8px;font-size:14px;box-sizing:border-box;margin-bottom:12px}button{width:100%;padding:10px;background:#6366f1;color:#fff;border:none;border-radius:8px;font-size:14px;cursor:pointer}.error{color:#ef4444;font-size:13px;margin-top:8px;display:none}</style></head><body><div class="card"><h2>Password Protected</h2><p>This share requires a password to access.</p><form id="f"><input type="password" id="p" placeholder="Enter password" required><button type="submit">Unlock</button><div class="error" id="e">Incorrect password</div></form></div><script>document.getElementById('f').onsubmit=async(e)=>{e.preventDefault();const r=await fetch('/s/${token}/unlock',{method:'POST',headers:{'Content-Type':'application/json'},body:JSON.stringify({password:document.getElementById('p').value})});if(r.ok)location.reload();else document.getElementById('e').style.display='block'}</script></body></html>`;
+      }
+    };
+  }
+});
+
 // src/index.ts
 var index_exports = {};
 __export(index_exports, {
@@ -4189,31 +4426,7 @@ var sandboxService = new SandboxService();
 
 // src/controllers/sandbox.ts
 var import_core18 = require("@axiom-lattice/core");
-function getFilenameFromPath(path3) {
-  const segments = path3.replace(/\/+$/, "").split("/");
-  return segments[segments.length - 1] || "download";
-}
-var EXT_TO_MIME = {
-  ".txt": "text/plain",
-  ".html": "text/html",
-  ".css": "text/css",
-  ".js": "application/javascript",
-  ".json": "application/json",
-  ".pdf": "application/pdf",
-  ".png": "image/png",
-  ".jpg": "image/jpeg",
-  ".jpeg": "image/jpeg",
-  ".gif": "image/gif",
-  ".webp": "image/webp",
-  ".svg": "image/svg+xml",
-  ".zip": "application/zip",
-  ".csv": "text/csv",
-  ".xml": "application/xml"
-};
-function getContentTypeFromFilename(filename) {
-  const ext = filename.includes(".") ? filename.slice(filename.lastIndexOf(".")).toLowerCase() : "";
-  return EXT_TO_MIME[ext] ?? "application/octet-stream";
-}
+init_mime();
 function registerSandboxProxyRoutes(app2) {
   app2.post(
     "/api/assistants/:assistantId/threads/:threadId/sandbox/uploadfile",
@@ -4312,6 +4525,7 @@ var import_core19 = require("@axiom-lattice/core");
 var import_core20 = require("@axiom-lattice/core");
 var import_core21 = require("@axiom-lattice/core");
 var import_uuid2 = require("uuid");
+init_mime();
 var WorkspaceController = class {
   constructor() {
     this.workspaceStore = (0, import_core19.getStoreLattice)("default", "workspace").store;
@@ -4483,32 +4697,6 @@ var WorkspaceController = class {
       };
     }
   }
-  getFilenameFromPath(filePath) {
-    const segments = filePath.split("/");
-    return segments[segments.length - 1] || "download";
-  }
-  getMimeType(filename) {
-    const ext = filename.split(".").pop()?.toLowerCase() || "";
-    const mimeTypes = {
-      pdf: "application/pdf",
-      csv: "text/csv",
-      xlsx: "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet",
-      xls: "application/vnd.ms-excel",
-      txt: "text/plain",
-      json: "application/json",
-      png: "image/png",
-      jpg: "image/jpeg",
-      jpeg: "image/jpeg",
-      gif: "image/gif",
-      svg: "image/svg+xml",
-      html: "text/html",
-      htm: "text/html",
-      mp3: "audio/mpeg",
-      mp4: "video/mp4",
-      webm: "video/webm"
-    };
-    return mimeTypes[ext] || "application/octet-stream";
-  }
   isBinaryContentType(filename) {
     const ext = filename.split(".").pop()?.toLowerCase() || "";
     const binaryExtensions = /* @__PURE__ */ new Set([
@@ -4561,25 +4749,29 @@ var WorkspaceController = class {
           workspaceId,
           projectId
         };
-        const filename2 = this.getFilenameFromPath(resolvedPath);
+        const filename2 = getFilenameFromPath(resolvedPath);
         const isBinary = this.isBinaryContentType(filename2);
         const volumeBackend = await sandboxManager.getVolumeBackendForPath(volumeConfig, resolvedPath);
         let buf;
-        if (volumeBackend && !isBinary) {
-          const fileData = await volumeBackend.readRaw(resolvedPath);
-          buf = Buffer.from(fileData.content.join("\n"), "utf-8");
+        if (volumeBackend) {
+          if (isBinary && volumeBackend.readBinary) {
+            buf = await volumeBackend.readBinary(resolvedPath);
+          } else {
+            const fileData = await volumeBackend.readRaw(resolvedPath);
+            buf = Buffer.from(fileData.content.join("\n"), "utf-8");
+          }
         } else {
           const sandbox = await sandboxManager.getSandboxFromConfig(volumeConfig);
           buf = await sandbox.file.downloadFile({ file: resolvedPath });
         }
-        const inferredContentType = this.getMimeType(filename2);
+        const inferredContentType = getContentTypeFromFilename(filename2);
         const contentDisposition = `attachment; filename*=UTF-8''${encodeURIComponent(filename2)}`;
         return reply.status(200).type(inferredContentType).header("Content-Disposition", contentDisposition).send(buf);
       }
       const { backend } = await this.getBackend(tenantId, workspaceId, projectId, assistantId, resolvedPath);
       const content = await backend.read(resolvedPath, 0, Infinity);
-      const filename = this.getFilenameFromPath(resolvedPath);
-      const mimeType = this.getMimeType(filename);
+      const filename = getFilenameFromPath(resolvedPath);
+      const mimeType = getContentTypeFromFilename(filename);
       const buffer = Buffer.from(content, "utf-8");
       return reply.status(200).type(mimeType).header("Content-Disposition", `attachment; filename*=UTF-8''${encodeURIComponent(filename)}`).send(buffer);
     } catch (error) {
@@ -4611,18 +4803,22 @@ var WorkspaceController = class {
           workspaceId,
           projectId
         };
-        const filename2 = this.getFilenameFromPath(resolvedPath);
+        const filename2 = getFilenameFromPath(resolvedPath);
         const isBinary = this.isBinaryContentType(filename2);
         const volumeBackend = await sandboxManager.getVolumeBackendForPath(volumeConfig, resolvedPath);
         let buf;
-        if (volumeBackend && !isBinary) {
-          const fileData = await volumeBackend.readRaw(resolvedPath);
-          buf = Buffer.from(fileData.content.join("\n"), "utf-8");
+        if (volumeBackend) {
+          if (isBinary && volumeBackend.readBinary) {
+            buf = await volumeBackend.readBinary(resolvedPath);
+          } else {
+            const fileData = await volumeBackend.readRaw(resolvedPath);
+            buf = Buffer.from(fileData.content.join("\n"), "utf-8");
+          }
         } else {
           const sandbox = await sandboxManager.getSandboxFromConfig(volumeConfig);
           buf = await sandbox.file.downloadFile({ file: resolvedPath });
         }
-        const inferredContentType = this.getMimeType(filename2);
+        const inferredContentType = getContentTypeFromFilename(filename2);
         try {
           const contentType = inferredContentType;
           const isHtml = contentType?.toLowerCase().includes("text/html") || filename2.toLowerCase().endsWith(".html") || filename2.toLowerCase().endsWith(".htm");
@@ -4655,8 +4851,8 @@ var WorkspaceController = class {
       }
       const { backend } = await this.getBackend(tenantId, workspaceId, projectId, assistantId, resolvedPath);
       const content = await backend.read(resolvedPath, 0, Infinity);
-      const filename = this.getFilenameFromPath(resolvedPath);
-      const mimeType = this.getMimeType(filename);
+      const filename = getFilenameFromPath(resolvedPath);
+      const mimeType = getContentTypeFromFilename(filename);
       let finalContent = content;
       const isHtmlFs = mimeType?.toLowerCase().includes("text/html") || filename.toLowerCase().endsWith(".html") || filename.toLowerCase().endsWith(".htm");
       if (isHtmlFs) {
@@ -8460,6 +8656,23 @@ var registerLatticeRoutes = (app2, channelDeps) => {
   );
 };
 
+// src/routes/resource-routes.ts
+function registerResourceRoutes(app2, controller) {
+  app2.get("/s/:token", controller.resolveResource.bind(controller));
+  app2.get("/s/:token/*", controller.resolveResource.bind(controller));
+  app2.post("/s/:token/unlock", controller.unlockShare.bind(controller));
+  app2.options("/s/:token", async (_req, reply) => {
+    reply.header("Access-Control-Allow-Origin", "*");
+    reply.header("Access-Control-Allow-Methods", "GET, OPTIONS, POST");
+    reply.header("Access-Control-Allow-Headers", "Content-Type");
+    return reply.status(204).send();
+  });
+  app2.post("/api/resources/share", controller.createShare.bind(controller));
+  app2.get("/api/resources/shares", controller.listShares.bind(controller));
+  app2.patch("/api/resources/share/:token", controller.updateShare.bind(controller));
+  app2.delete("/api/resources/share/:token", controller.revokeShare.bind(controller));
+}
+
 // src/router/MessageRouter.ts
 var import_core32 = require("@axiom-lattice/core");
 var import_crypto9 = require("crypto");
@@ -8944,7 +9157,7 @@ function createAuditLoggerMiddleware() {
 }
 
 // src/index.ts
-var import_core35 = require("@axiom-lattice/core");
+var import_core36 = require("@axiom-lattice/core");
 
 // src/swagger.ts
 var import_swagger = __toESM(require("@fastify/swagger"));
@@ -9261,7 +9474,7 @@ _AgentTaskConsumer.agent_run_endpoint = "http://localhost:4001/api/runs";
 var AgentTaskConsumer = _AgentTaskConsumer;
 
 // src/index.ts
-var import_core36 = require("@axiom-lattice/core");
+var import_core37 = require("@axiom-lattice/core");
 var import_protocols5 = require("@axiom-lattice/protocols");
 var import_meta = {};
 process.on("unhandledRejection", (reason, promise) => {
@@ -9277,11 +9490,11 @@ var DEFAULT_LOGGER_CONFIG = {
 var loggerLattice = initializeLogger(DEFAULT_LOGGER_CONFIG);
 var logger5 = loggerLattice.client;
 function initializeLogger(config) {
-  if (import_core36.loggerLatticeManager.hasLattice("default")) {
-    import_core36.loggerLatticeManager.removeLattice("default");
+  if (import_core37.loggerLatticeManager.hasLattice("default")) {
+    import_core37.loggerLatticeManager.removeLattice("default");
   }
-  (0, import_core36.registerLoggerLattice)("default", config);
-  return (0, import_core36.getLoggerLattice)("default");
+  (0, import_core37.registerLoggerLattice)("default", config);
+  return (0, import_core37.getLoggerLattice)("default");
 }
 var app = (0, import_fastify.default)({
   logger: false,
@@ -9318,6 +9531,7 @@ app.addHook("preHandler", async (request, reply) => {
   if (!authRequired) return;
   if (request.method === "OPTIONS") return;
   if (PUBLIC_ROUTES.some((r) => request.url === r)) return;
+  if (request.url.startsWith("/s/")) return;
   const urlPath = request.url.split("?")[0];
   if (urlPath.includes("/viewfile") || urlPath.includes("/downloadfile")) return;
   return reply.status(401).send({
@@ -9392,7 +9606,7 @@ app.setErrorHandler((error, request, reply) => {
 });
 function getConfiguredSandboxProvider() {
   const sandboxProviderType = process.env.SANDBOX_PROVIDER_TYPE || "microsandbox-remote";
-  return (0, import_core36.createSandboxProvider)({
+  return (0, import_core37.createSandboxProvider)({
     type: sandboxProviderType,
     remoteBaseURL: process.env.SANDBOX_BASE_URL,
     microsandboxServiceBaseURL: process.env.MICROSANDBOX_SERVICE_BASE_URL,
@@ -9428,7 +9642,7 @@ var start = async (config) => {
       const { getStoreLattice: getStore2 } = await import("@axiom-lattice/core");
       const bindingStore = getStore2("default", "channelBinding").store;
       const installationStore = getStore2("default", "channelInstallation").store;
-      (0, import_core35.setBindingRegistry)(bindingStore);
+      (0, import_core36.setBindingRegistry)(bindingStore);
       const router = new MessageRouter({
         middlewares: [
           createDeduplicationMiddleware(),
@@ -9454,8 +9668,8 @@ var start = async (config) => {
       });
     }
     try {
-      const menuStore = (0, import_core36.getStoreLattice)("default", "menu").store;
-      (0, import_core35.setMenuRegistry)(menuStore);
+      const menuStore = (0, import_core37.getStoreLattice)("default", "menu").store;
+      (0, import_core36.setMenuRegistry)(menuStore);
       logger5.info("Menu registry initialized");
     } catch {
     }
@@ -9463,10 +9677,27 @@ var start = async (config) => {
       setChannelControllerDeps({ adapterRegistry, router: channelDeps.router });
     }
     registerLatticeRoutes(app, channelDeps);
-    if (!import_core36.sandboxLatticeManager.hasLattice("default")) {
-      import_core36.sandboxLatticeManager.registerLattice("default", getConfiguredSandboxProvider());
+    if (!import_core37.sandboxLatticeManager.hasLattice("default")) {
+      import_core37.sandboxLatticeManager.registerLattice("default", getConfiguredSandboxProvider());
       logger5.info("Registered sandbox manager from env configuration");
     }
+    try {
+      const { ResourceController: ResourceController2 } = await Promise.resolve().then(() => (init_resources(), resources_exports));
+      const sharedResourceStore = (0, import_core37.getStoreLattice)("default", "sharedResource").store;
+      const cache = new import_core37.TokenCache();
+      const resourceController = new ResourceController2({
+        store: sharedResourceStore,
+        sandboxManager: import_core37.sandboxLatticeManager,
+        cache,
+        logger: logger5
+      });
+      registerResourceRoutes(app, resourceController);
+      logger5.info("Resource share routes registered");
+    } catch (err) {
+      logger5.warn("Resource share infrastructure unavailable", {
+        error: err instanceof Error ? err.message : String(err)
+      });
+    }
     if (channelDeps && process.env.CHANNELS_ENABLED !== "false") {
       const { connectAllChannels } = await import("@axiom-lattice/core");
       try {
@@ -9496,7 +9727,7 @@ var start = async (config) => {
         agentTaskConsumer.startPollingQueue();
       }
     }
-    import_core36.agentInstanceManager.restore().then((stats) => {
+    import_core37.agentInstanceManager.restore().then((stats) => {
       logger5.info(`Agent recovery complete: ${stats.restored} threads restored, ${stats.errors} errors`);
     }).catch((error) => {
       logger5.error("Agent recovery failed", { error });