@axiom-lattice/gateway 2.1.101 → 2.1.102

package/.turbo/turbo-build.log

@@ -1,5 +1,5 @@
 
-> @axiom-lattice/gateway@2.1.101 build /home/runner/work/agentic/agentic/packages/gateway
+> @axiom-lattice/gateway@2.1.102 build /home/runner/work/agentic/agentic/packages/gateway
 > tsup src/index.ts --format cjs,esm --dts --clean --sourcemap
 
 CLI Building entry: src/index.ts
@@ -9,30 +9,34 @@
 CLI Cleaning output folder
 CJS Build start
 ESM Build start
-ESM dist/index.mjs                             271.22 KB
+[warn] ▲ [WARNING] "import.meta" is not available with the "cjs" output format and will be empty [empty-import-meta]
+
+    src/index.ts:194:33:
+      194 │ const __filename = fileURLToPath(import.meta.url);
+          ╵                                  ~~~~~~~~~~~
+
+  You need to set the output format to "esm" for "import.meta" to work correctly.
+
+
+ESM dist/index.mjs                             271.42 KB
 ESM dist/sender-PX32VSHB.mjs                   873.00 B
 ESM dist/WechatChannelAdapter-WSDKR4OA.mjs     8.27 KB
 ESM dist/chunk-6CUQGDJI.mjs                    6.42 KB
 ESM dist/a2a-ERG5RMUW.mjs                      15.95 KB
-ESM dist/index.mjs.map                         575.35 KB
+ESM dist/resources-3DGHISBZ.mjs                8.12 KB
+ESM dist/chunk-R4ZO3HZ3.mjs                    1.44 KB
+ESM dist/index.mjs.map                         575.75 KB
 ESM dist/sender-PX32VSHB.mjs.map               2.07 KB
 ESM dist/WechatChannelAdapter-WSDKR4OA.mjs.map 16.28 KB
 ESM dist/chunk-6CUQGDJI.mjs.map                14.04 KB
 ESM dist/a2a-ERG5RMUW.mjs.map                  32.14 KB
-ESM ⚡️ Build success in 475ms
-[warn] ▲ [WARNING] "import.meta" is not available with the "cjs" output format and will be empty [empty-import-meta]
-
-    src/index.ts:189:33:
-      189 │ const __filename = fileURLToPath(import.meta.url);
-          ╵                                  ~~~~~~~~~~~
-
-  You need to set the output format to "esm" for "import.meta" to work correctly.
-
-
-CJS dist/index.js     309.50 KB
-CJS dist/index.js.map 640.11 KB
-CJS ⚡️ Build success in 507ms
+ESM dist/resources-3DGHISBZ.mjs.map            15.35 KB
+ESM dist/chunk-R4ZO3HZ3.mjs.map                2.35 KB
+ESM ⚡️ Build success in 520ms
+CJS dist/index.js     320.15 KB
+CJS dist/index.js.map 658.17 KB
+CJS ⚡️ Build success in 535ms
 DTS Build start
-DTS ⚡️ Build success in 19468ms
+DTS ⚡️ Build success in 18706ms
 DTS dist/index.d.ts  7.57 KB
 DTS dist/index.d.mts 7.57 KB

package/CHANGELOG.md

@@ -1,5 +1,17 @@
 # @axiom-lattice/gateway
 
+## 2.1.102
+
+### Patch Changes
+
+- f2dce99: fix bugs
+- Updated dependencies [f2dce99]
+  - @axiom-lattice/agent-eval@2.1.84
+  - @axiom-lattice/core@2.1.90
+  - @axiom-lattice/pg-stores@1.0.81
+  - @axiom-lattice/protocols@2.1.45
+  - @axiom-lattice/queue-redis@1.0.44
+
 ## 2.1.101
 
 ### Patch Changes

package/dist/chunk-R4ZO3HZ3.mjs

@@ -0,0 +1,46 @@
+// src/utils/mime.ts
+var EXT_TO_MIME = {
+  ".txt": "text/plain",
+  ".html": "text/html",
+  ".htm": "text/html",
+  ".css": "text/css",
+  ".js": "application/javascript",
+  ".mjs": "application/javascript",
+  ".json": "application/json",
+  ".pdf": "application/pdf",
+  ".png": "image/png",
+  ".jpg": "image/jpeg",
+  ".jpeg": "image/jpeg",
+  ".gif": "image/gif",
+  ".webp": "image/webp",
+  ".svg": "image/svg+xml",
+  ".ico": "image/x-icon",
+  ".zip": "application/zip",
+  ".csv": "text/csv",
+  ".xml": "application/xml",
+  ".xlsx": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet",
+  ".xls": "application/vnd.ms-excel",
+  ".pptx": "application/vnd.openxmlformats-officedocument.presentationml.presentation",
+  ".ppt": "application/vnd.ms-powerpoint",
+  ".docx": "application/vnd.openxmlformats-officedocument.wordprocessingml.document",
+  ".doc": "application/msword",
+  ".mp4": "video/mp4",
+  ".webm": "video/webm",
+  ".mp3": "audio/mpeg",
+  ".wav": "audio/wav",
+  ".ogg": "audio/ogg"
+};
+function getContentTypeFromFilename(filename) {
+  const ext = filename.includes(".") ? filename.slice(filename.lastIndexOf(".")).toLowerCase() : "";
+  return EXT_TO_MIME[ext] ?? "application/octet-stream";
+}
+function getFilenameFromPath(path) {
+  const segments = path.replace(/\/+$/, "").split("/");
+  return segments[segments.length - 1] || "download";
+}
+
+export {
+  getContentTypeFromFilename,
+  getFilenameFromPath
+};
+//# sourceMappingURL=chunk-R4ZO3HZ3.mjs.map

package/dist/chunk-R4ZO3HZ3.mjs.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../src/utils/mime.ts"],"sourcesContent":["const EXT_TO_MIME: Record<string, string> = {\n  \".txt\": \"text/plain\",\n  \".html\": \"text/html\",\n  \".htm\": \"text/html\",\n  \".css\": \"text/css\",\n  \".js\": \"application/javascript\",\n  \".mjs\": \"application/javascript\",\n  \".json\": \"application/json\",\n  \".pdf\": \"application/pdf\",\n  \".png\": \"image/png\",\n  \".jpg\": \"image/jpeg\",\n  \".jpeg\": \"image/jpeg\",\n  \".gif\": \"image/gif\",\n  \".webp\": \"image/webp\",\n  \".svg\": \"image/svg+xml\",\n  \".ico\": \"image/x-icon\",\n  \".zip\": \"application/zip\",\n  \".csv\": \"text/csv\",\n  \".xml\": \"application/xml\",\n  \".xlsx\": \"application/vnd.openxmlformats-officedocument.spreadsheetml.sheet\",\n  \".xls\": \"application/vnd.ms-excel\",\n  \".pptx\": \"application/vnd.openxmlformats-officedocument.presentationml.presentation\",\n  \".ppt\": \"application/vnd.ms-powerpoint\",\n  \".docx\": \"application/vnd.openxmlformats-officedocument.wordprocessingml.document\",\n  \".doc\": \"application/msword\",\n  \".mp4\": \"video/mp4\",\n  \".webm\": \"video/webm\",\n  \".mp3\": \"audio/mpeg\",\n  \".wav\": \"audio/wav\",\n  \".ogg\": \"audio/ogg\",\n};\n\nexport function getContentTypeFromFilename(filename: string): string {\n  const ext = filename.includes(\".\")\n    ? filename.slice(filename.lastIndexOf(\".\")).toLowerCase()\n    : \"\";\n  return EXT_TO_MIME[ext] ?? \"application/octet-stream\";\n}\n\nexport function getFilenameFromPath(path: string): string {\n  const segments = path.replace(/\\/+$/, \"\").split(\"/\");\n  return segments[segments.length - 1] || \"download\";\n}\n"],"mappings":";AAAA,IAAM,cAAsC;AAAA,EAC1C,QAAQ;AAAA,EACR,SAAS;AAAA,EACT,QAAQ;AAAA,EACR,QAAQ;AAAA,EACR,OAAO;AAAA,EACP,QAAQ;AAAA,EACR,SAAS;AAAA,EACT,QAAQ;AAAA,EACR,QAAQ;AAAA,EACR,QAAQ;AAAA,EACR,SAAS;AAAA,EACT,QAAQ;AAAA,EACR,SAAS;AAAA,EACT,QAAQ;AAAA,EACR,QAAQ;AAAA,EACR,QAAQ;AAAA,EACR,QAAQ;AAAA,EACR,QAAQ;AAAA,EACR,SAAS;AAAA,EACT,QAAQ;AAAA,EACR,SAAS;AAAA,EACT,QAAQ;AAAA,EACR,SAAS;AAAA,EACT,QAAQ;AAAA,EACR,QAAQ;AAAA,EACR,SAAS;AAAA,EACT,QAAQ;AAAA,EACR,QAAQ;AAAA,EACR,QAAQ;AACV;AAEO,SAAS,2BAA2B,UAA0B;AACnE,QAAM,MAAM,SAAS,SAAS,GAAG,IAC7B,SAAS,MAAM,SAAS,YAAY,GAAG,CAAC,EAAE,YAAY,IACtD;AACJ,SAAO,YAAY,GAAG,KAAK;AAC7B;AAEO,SAAS,oBAAoB,MAAsB;AACxD,QAAM,WAAW,KAAK,QAAQ,QAAQ,EAAE,EAAE,MAAM,GAAG;AACnD,SAAO,SAAS,SAAS,SAAS,CAAC,KAAK;AAC1C;","names":[]}

package/dist/index.js

@@ -30,6 +30,53 @@ var __toESM = (mod, isNodeMode, target) => (target = mod != null ? __create(__ge
 ));
 var __toCommonJS = (mod) => __copyProps(__defProp({}, "__esModule", { value: true }), mod);
 
+// src/utils/mime.ts
+function getContentTypeFromFilename(filename) {
+  const ext = filename.includes(".") ? filename.slice(filename.lastIndexOf(".")).toLowerCase() : "";
+  return EXT_TO_MIME[ext] ?? "application/octet-stream";
+}
+function getFilenameFromPath(path3) {
+  const segments = path3.replace(/\/+$/, "").split("/");
+  return segments[segments.length - 1] || "download";
+}
+var EXT_TO_MIME;
+var init_mime = __esm({
+  "src/utils/mime.ts"() {
+    "use strict";
+    EXT_TO_MIME = {
+      ".txt": "text/plain",
+      ".html": "text/html",
+      ".htm": "text/html",
+      ".css": "text/css",
+      ".js": "application/javascript",
+      ".mjs": "application/javascript",
+      ".json": "application/json",
+      ".pdf": "application/pdf",
+      ".png": "image/png",
+      ".jpg": "image/jpeg",
+      ".jpeg": "image/jpeg",
+      ".gif": "image/gif",
+      ".webp": "image/webp",
+      ".svg": "image/svg+xml",
+      ".ico": "image/x-icon",
+      ".zip": "application/zip",
+      ".csv": "text/csv",
+      ".xml": "application/xml",
+      ".xlsx": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet",
+      ".xls": "application/vnd.ms-excel",
+      ".pptx": "application/vnd.openxmlformats-officedocument.presentationml.presentation",
+      ".ppt": "application/vnd.ms-powerpoint",
+      ".docx": "application/vnd.openxmlformats-officedocument.wordprocessingml.document",
+      ".doc": "application/msword",
+      ".mp4": "video/mp4",
+      ".webm": "video/webm",
+      ".mp3": "audio/mpeg",
+      ".wav": "audio/wav",
+      ".ogg": "audio/ogg"
+    };
+  }
+});
+
 // src/logger/Logger.ts
 var import_pino, import_pino_pretty, import_pino_roll, PinoLoggerFactory, Logger;
 var init_Logger = __esm({
@@ -1145,6 +1192,190 @@ var init_a2a = __esm({
   }
 });
 
+// src/controllers/resources.ts
+var resources_exports = {};
+__export(resources_exports, {
+  ResourceController: () => ResourceController
+});
+var import_core35, ResourceController;
+var init_resources = __esm({
+  "src/controllers/resources.ts"() {
+    "use strict";
+    import_core35 = require("@axiom-lattice/core");
+    init_mime();
+    ResourceController = class {
+      constructor(deps) {
+        this.deps = deps;
+      }
+      async createShare(request, reply) {
+        const userId = request.user ? request.user.id ?? "unknown" : "unknown";
+        const tenantId = request.headers["x-tenant-id"] || "default";
+        const workspaceId = request.headers["x-workspace-id"];
+        const projectId = request.headers["x-project-id"];
+        const body = request.body;
+        if (!workspaceId || !projectId) {
+          return reply.status(400).send({ error: "x-workspace-id and x-project-id headers required" });
+        }
+        const payload = (0, import_core35.createSharePayload)(
+          tenantId,
+          workspaceId,
+          projectId,
+          userId,
+          body
+        );
+        const token = (0, import_core35.generateToken)();
+        try {
+          await this.deps.store.create({ ...payload, token });
+          this.deps.logger.info(
+            "Share created",
+            { token, resourcePath: body.resourcePath, userId }
+          );
+        } catch {
+          return reply.status(500).send({ error: "Failed to create share" });
+        }
+        return reply.status(201).send({ token, url: `/s/${token}` });
+      }
+      async listShares(request, reply) {
+        const userId = request.user ? request.user.id ?? "unknown" : "unknown";
+        const tenantId = request.headers["x-tenant-id"] || "default";
+        const shares = await this.deps.store.listByUser(tenantId, userId);
+        return reply.send(shares);
+      }
+      async updateShare(request, reply) {
+        const { token } = request.params;
+        const userId = request.user ? request.user.id : void 0;
+        const patch = request.body;
+        const record = await this.deps.store.findByToken(token);
+        if (!record || record.createdBy !== userId) {
+          return reply.status(404).send({ error: "Share not found" });
+        }
+        await this.deps.store.update(token, patch);
+        if (patch.revoked) {
+          this.deps.cache.invalidate(token);
+        }
+        return reply.send({ ok: true });
+      }
+      async revokeShare(request, reply) {
+        const { token } = request.params;
+        const userId = request.user ? request.user.id : void 0;
+        const record = await this.deps.store.findByToken(token);
+        if (!record || record.createdBy !== userId) {
+          return reply.status(404).send({ error: "Share not found" });
+        }
+        await this.deps.store.update(token, { revoked: true });
+        this.deps.cache.invalidate(token);
+        return reply.send({ ok: true });
+      }
+      async resolveResource(request, reply) {
+        const params = request.params;
+        const { token } = params;
+        const subPath = params["*"] ?? "";
+        const cached = this.deps.cache.get(token);
+        if (cached && !cached.requiresUnlock) {
+          return this._serveFile(cached.address, token, subPath, reply);
+        }
+        const record = await this.deps.store.findByToken(token);
+        if (!record || record.revoked) return reply.status(404).send("Not found");
+        if (record.expiresAt && new Date(record.expiresAt) < /* @__PURE__ */ new Date()) {
+          return reply.status(410).send("Expired");
+        }
+        if (!this._isInternalRequest(request)) {
+          if (record.visibility === "password") {
+            const unlocked = this._isUnlocked(request, token);
+            if (!unlocked) {
+              this.deps.cache.set(token, { address: record.address, requiresUnlock: true });
+              return reply.type("text/html").send(this._passwordPage(token));
+            }
+          }
+        }
+        if (record.maxAccess !== null) {
+          const ok = await this.deps.store.atomicIncrementAccess(token);
+          if (!ok) return reply.status(410).send("Access limit reached");
+        } else {
+          this.deps.store.incrementAccess(token).catch(() => {
+          });
+        }
+        this.deps.cache.set(token, {
+          address: record.address,
+          requiresUnlock: record.visibility === "password" && !this._isInternalRequest(request)
+        });
+        return this._serveFile(record.address, token, subPath, reply);
+      }
+      async unlockShare(request, reply) {
+        const { token } = request.params;
+        const { password } = request.body;
+        const record = await this.deps.store.findByToken(token);
+        if (!record || !record.passwordHash) {
+          return reply.status(404).send({ error: "Invalid request" });
+        }
+        const valid = password === record.passwordHash;
+        if (!valid) {
+          return reply.status(401).send({ error: "Incorrect password" });
+        }
+        reply.header(
+          "Set-Cookie",
+          `share_unlock_${token}=1; Max-Age=86400; Path=/s/${token}; SameSite=Lax; HttpOnly; Secure`
+        );
+        return reply.send({ ok: true });
+      }
+      _isInternalRequest(request) {
+        const user = request.user;
+        return !!user && !!user.id;
+      }
+      _isUnlocked(request, token) {
+        const cookie = request.headers.cookie ?? "";
+        return cookie.includes(`share_unlock_${token}=1`);
+      }
+      async _serveFile(address, token, subPath, reply) {
+        const provider = this.deps.sandboxManager.getDefaultProvider();
+        const resolver = provider.getResourceResolver();
+        const fullPath = subPath ? this._resolveSafeSubPath(address.resourcePath, subPath) : address.resourcePath;
+        let buf;
+        try {
+          buf = await resolver.resolve({ ...address, resourcePath: fullPath });
+        } catch (err) {
+          this.deps.logger.warn(
+            "Resource resolution failed",
+            { token, resourcePath: fullPath, error: err.message }
+          );
+          return reply.status(404).send("File not found");
+        }
+        const filename = fullPath.split("/").pop() || "download";
+        const isHtml = !subPath && /\.(html|htm)$/i.test(filename);
+        if (isHtml) {
+          buf = this._injectBaseTag(buf, token);
+        }
+        const contentType = getContentTypeFromFilename(filename);
+        return reply.status(200).type(contentType).header("Content-Disposition", `inline; filename="${filename}"`).header("Access-Control-Allow-Origin", "*").send(buf);
+      }
+      _resolveSafeSubPath(entryFile, subPath) {
+        if (!subPath) return entryFile;
+        if (subPath.includes("..")) throw new Error("Path traversal denied");
+        const entryDir = entryFile.replace(/[^/]+$/, "");
+        return (entryDir + subPath).replace(/\/+/g, "/");
+      }
+      _injectBaseTag(buf, token) {
+        const html = buf.toString("utf-8");
+        if (/<base\b/i.test(html)) return buf;
+        const baseTag = `<base href="/s/${token}/">`;
+        if (html.includes("</head>")) {
+          return Buffer.from(html.replace("</head>", `${baseTag}</head>`), "utf-8");
+        }
+        if (html.includes("<head>")) {
+          return Buffer.from(html.replace("<head>", `<head>${baseTag}`), "utf-8");
+        }
+        if (html.includes("<html>")) {
+          return Buffer.from(html.replace("<html>", `<html>${baseTag}`), "utf-8");
+        }
+        return Buffer.from(baseTag + html, "utf-8");
+      }
+      _passwordPage(token) {
+        return `<!DOCTYPE html><html><head><meta charset="utf-8"><meta name="viewport" content="width=device-width,initial-scale=1"><title>Password Protected</title><style>body{font-family:-apple-system,BlinkMacSystemFont,sans-serif;display:flex;align-items:center;justify-content:center;min-height:100vh;margin:0;background:#f5f5f5}.card{background:#fff;padding:32px;border-radius:12px;box-shadow:0 2px 8px rgba(0,0,0,.1);width:100%;max-width:360px;text-align:center}h2{margin:0 0 8px;font-size:20px}p{margin:0 0 20px;color:#666;font-size:14px}input{width:100%;padding:10px 12px;border:1px solid #d9d9d9;border-radius:8px;font-size:14px;box-sizing:border-box;margin-bottom:12px}button{width:100%;padding:10px;background:#6366f1;color:#fff;border:none;border-radius:8px;font-size:14px;cursor:pointer}.error{color:#ef4444;font-size:13px;margin-top:8px;display:none}</style></head><body><div class="card"><h2>Password Protected</h2><p>This share requires a password to access.</p><form id="f"><input type="password" id="p" placeholder="Enter password" required><button type="submit">Unlock</button><div class="error" id="e">Incorrect password</div></form></div><script>document.getElementById('f').onsubmit=async(e)=>{e.preventDefault();const r=await fetch('/s/${token}/unlock',{method:'POST',headers:{'Content-Type':'application/json'},body:JSON.stringify({password:document.getElementById('p').value})});if(r.ok)location.reload();else document.getElementById('e').style.display='block'}</script></body></html>`;
+      }
+    };
+  }
+});
+
 // src/index.ts
 var index_exports = {};
 __export(index_exports, {
@@ -4195,31 +4426,7 @@ var sandboxService = new SandboxService();
 
 // src/controllers/sandbox.ts
 var import_core18 = require("@axiom-lattice/core");
-function getFilenameFromPath(path3) {
-  const segments = path3.replace(/\/+$/, "").split("/");
-  return segments[segments.length - 1] || "download";
-}
-var EXT_TO_MIME = {
-  ".txt": "text/plain",
-  ".html": "text/html",
-  ".css": "text/css",
-  ".js": "application/javascript",
-  ".json": "application/json",
-  ".pdf": "application/pdf",
-  ".png": "image/png",
-  ".jpg": "image/jpeg",
-  ".jpeg": "image/jpeg",
-  ".gif": "image/gif",
-  ".webp": "image/webp",
-  ".svg": "image/svg+xml",
-  ".zip": "application/zip",
-  ".csv": "text/csv",
-  ".xml": "application/xml"
-};
-function getContentTypeFromFilename(filename) {
-  const ext = filename.includes(".") ? filename.slice(filename.lastIndexOf(".")).toLowerCase() : "";
-  return EXT_TO_MIME[ext] ?? "application/octet-stream";
-}
+init_mime();
 function registerSandboxProxyRoutes(app2) {
   app2.post(
     "/api/assistants/:assistantId/threads/:threadId/sandbox/uploadfile",
@@ -4318,6 +4525,7 @@ var import_core19 = require("@axiom-lattice/core");
 var import_core20 = require("@axiom-lattice/core");
 var import_core21 = require("@axiom-lattice/core");
 var import_uuid2 = require("uuid");
+init_mime();
 var WorkspaceController = class {
   constructor() {
     this.workspaceStore = (0, import_core19.getStoreLattice)("default", "workspace").store;
@@ -4489,32 +4697,6 @@ var WorkspaceController = class {
       };
     }
   }
-  getFilenameFromPath(filePath) {
-    const segments = filePath.split("/");
-    return segments[segments.length - 1] || "download";
-  }
-  getMimeType(filename) {
-    const ext = filename.split(".").pop()?.toLowerCase() || "";
-    const mimeTypes = {
-      pdf: "application/pdf",
-      csv: "text/csv",
-      xlsx: "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet",
-      xls: "application/vnd.ms-excel",
-      txt: "text/plain",
-      json: "application/json",
-      png: "image/png",
-      jpg: "image/jpeg",
-      jpeg: "image/jpeg",
-      gif: "image/gif",
-      svg: "image/svg+xml",
-      html: "text/html",
-      htm: "text/html",
-      mp3: "audio/mpeg",
-      mp4: "video/mp4",
-      webm: "video/webm"
-    };
-    return mimeTypes[ext] || "application/octet-stream";
-  }
   isBinaryContentType(filename) {
     const ext = filename.split(".").pop()?.toLowerCase() || "";
     const binaryExtensions = /* @__PURE__ */ new Set([
@@ -4567,7 +4749,7 @@ var WorkspaceController = class {
           workspaceId,
           projectId
         };
-        const filename2 = this.getFilenameFromPath(resolvedPath);
+        const filename2 = getFilenameFromPath(resolvedPath);
         const isBinary = this.isBinaryContentType(filename2);
         const volumeBackend = await sandboxManager.getVolumeBackendForPath(volumeConfig, resolvedPath);
         let buf;
@@ -4582,14 +4764,14 @@ var WorkspaceController = class {
           const sandbox = await sandboxManager.getSandboxFromConfig(volumeConfig);
           buf = await sandbox.file.downloadFile({ file: resolvedPath });
         }
-        const inferredContentType = this.getMimeType(filename2);
+        const inferredContentType = getContentTypeFromFilename(filename2);
         const contentDisposition = `attachment; filename*=UTF-8''${encodeURIComponent(filename2)}`;
         return reply.status(200).type(inferredContentType).header("Content-Disposition", contentDisposition).send(buf);
       }
       const { backend } = await this.getBackend(tenantId, workspaceId, projectId, assistantId, resolvedPath);
       const content = await backend.read(resolvedPath, 0, Infinity);
-      const filename = this.getFilenameFromPath(resolvedPath);
-      const mimeType = this.getMimeType(filename);
+      const filename = getFilenameFromPath(resolvedPath);
+      const mimeType = getContentTypeFromFilename(filename);
       const buffer = Buffer.from(content, "utf-8");
       return reply.status(200).type(mimeType).header("Content-Disposition", `attachment; filename*=UTF-8''${encodeURIComponent(filename)}`).send(buffer);
     } catch (error) {
@@ -4621,7 +4803,7 @@ var WorkspaceController = class {
           workspaceId,
           projectId
         };
-        const filename2 = this.getFilenameFromPath(resolvedPath);
+        const filename2 = getFilenameFromPath(resolvedPath);
         const isBinary = this.isBinaryContentType(filename2);
         const volumeBackend = await sandboxManager.getVolumeBackendForPath(volumeConfig, resolvedPath);
         let buf;
@@ -4636,7 +4818,7 @@ var WorkspaceController = class {
           const sandbox = await sandboxManager.getSandboxFromConfig(volumeConfig);
           buf = await sandbox.file.downloadFile({ file: resolvedPath });
         }
-        const inferredContentType = this.getMimeType(filename2);
+        const inferredContentType = getContentTypeFromFilename(filename2);
         try {
           const contentType = inferredContentType;
           const isHtml = contentType?.toLowerCase().includes("text/html") || filename2.toLowerCase().endsWith(".html") || filename2.toLowerCase().endsWith(".htm");
@@ -4669,8 +4851,8 @@ var WorkspaceController = class {
       }
       const { backend } = await this.getBackend(tenantId, workspaceId, projectId, assistantId, resolvedPath);
       const content = await backend.read(resolvedPath, 0, Infinity);
-      const filename = this.getFilenameFromPath(resolvedPath);
-      const mimeType = this.getMimeType(filename);
+      const filename = getFilenameFromPath(resolvedPath);
+      const mimeType = getContentTypeFromFilename(filename);
       let finalContent = content;
       const isHtmlFs = mimeType?.toLowerCase().includes("text/html") || filename.toLowerCase().endsWith(".html") || filename.toLowerCase().endsWith(".htm");
       if (isHtmlFs) {
@@ -8474,6 +8656,23 @@ var registerLatticeRoutes = (app2, channelDeps) => {
   );
 };
 
+// src/routes/resource-routes.ts
+function registerResourceRoutes(app2, controller) {
+  app2.get("/s/:token", controller.resolveResource.bind(controller));
+  app2.get("/s/:token/*", controller.resolveResource.bind(controller));
+  app2.post("/s/:token/unlock", controller.unlockShare.bind(controller));
+  app2.options("/s/:token", async (_req, reply) => {
+    reply.header("Access-Control-Allow-Origin", "*");
+    reply.header("Access-Control-Allow-Methods", "GET, OPTIONS, POST");
+    reply.header("Access-Control-Allow-Headers", "Content-Type");
+    return reply.status(204).send();
+  });
+  app2.post("/api/resources/share", controller.createShare.bind(controller));
+  app2.get("/api/resources/shares", controller.listShares.bind(controller));
+  app2.patch("/api/resources/share/:token", controller.updateShare.bind(controller));
+  app2.delete("/api/resources/share/:token", controller.revokeShare.bind(controller));
+}
+
 // src/router/MessageRouter.ts
 var import_core32 = require("@axiom-lattice/core");
 var import_crypto9 = require("crypto");
@@ -8958,7 +9157,7 @@ function createAuditLoggerMiddleware() {
 }
 
 // src/index.ts
-var import_core35 = require("@axiom-lattice/core");
+var import_core36 = require("@axiom-lattice/core");
 
 // src/swagger.ts
 var import_swagger = __toESM(require("@fastify/swagger"));
@@ -9275,7 +9474,7 @@ _AgentTaskConsumer.agent_run_endpoint = "http://localhost:4001/api/runs";
 var AgentTaskConsumer = _AgentTaskConsumer;
 
 // src/index.ts
-var import_core36 = require("@axiom-lattice/core");
+var import_core37 = require("@axiom-lattice/core");
 var import_protocols5 = require("@axiom-lattice/protocols");
 var import_meta = {};
 process.on("unhandledRejection", (reason, promise) => {
@@ -9291,11 +9490,11 @@ var DEFAULT_LOGGER_CONFIG = {
 var loggerLattice = initializeLogger(DEFAULT_LOGGER_CONFIG);
 var logger5 = loggerLattice.client;
 function initializeLogger(config) {
-  if (import_core36.loggerLatticeManager.hasLattice("default")) {
-    import_core36.loggerLatticeManager.removeLattice("default");
+  if (import_core37.loggerLatticeManager.hasLattice("default")) {
+    import_core37.loggerLatticeManager.removeLattice("default");
   }
-  (0, import_core36.registerLoggerLattice)("default", config);
-  return (0, import_core36.getLoggerLattice)("default");
+  (0, import_core37.registerLoggerLattice)("default", config);
+  return (0, import_core37.getLoggerLattice)("default");
 }
 var app = (0, import_fastify.default)({
   logger: false,
@@ -9332,6 +9531,7 @@ app.addHook("preHandler", async (request, reply) => {
   if (!authRequired) return;
   if (request.method === "OPTIONS") return;
   if (PUBLIC_ROUTES.some((r) => request.url === r)) return;
+  if (request.url.startsWith("/s/")) return;
   const urlPath = request.url.split("?")[0];
   if (urlPath.includes("/viewfile") || urlPath.includes("/downloadfile")) return;
   return reply.status(401).send({
@@ -9406,7 +9606,7 @@ app.setErrorHandler((error, request, reply) => {
 });
 function getConfiguredSandboxProvider() {
   const sandboxProviderType = process.env.SANDBOX_PROVIDER_TYPE || "microsandbox-remote";
-  return (0, import_core36.createSandboxProvider)({
+  return (0, import_core37.createSandboxProvider)({
     type: sandboxProviderType,
     remoteBaseURL: process.env.SANDBOX_BASE_URL,
     microsandboxServiceBaseURL: process.env.MICROSANDBOX_SERVICE_BASE_URL,
@@ -9442,7 +9642,7 @@ var start = async (config) => {
       const { getStoreLattice: getStore2 } = await import("@axiom-lattice/core");
       const bindingStore = getStore2("default", "channelBinding").store;
       const installationStore = getStore2("default", "channelInstallation").store;
-      (0, import_core35.setBindingRegistry)(bindingStore);
+      (0, import_core36.setBindingRegistry)(bindingStore);
       const router = new MessageRouter({
         middlewares: [
           createDeduplicationMiddleware(),
@@ -9468,8 +9668,8 @@ var start = async (config) => {
       });
     }
     try {
-      const menuStore = (0, import_core36.getStoreLattice)("default", "menu").store;
-      (0, import_core35.setMenuRegistry)(menuStore);
+      const menuStore = (0, import_core37.getStoreLattice)("default", "menu").store;
+      (0, import_core36.setMenuRegistry)(menuStore);
       logger5.info("Menu registry initialized");
     } catch {
     }
@@ -9477,10 +9677,27 @@ var start = async (config) => {
       setChannelControllerDeps({ adapterRegistry, router: channelDeps.router });
     }
     registerLatticeRoutes(app, channelDeps);
-    if (!import_core36.sandboxLatticeManager.hasLattice("default")) {
-      import_core36.sandboxLatticeManager.registerLattice("default", getConfiguredSandboxProvider());
+    if (!import_core37.sandboxLatticeManager.hasLattice("default")) {
+      import_core37.sandboxLatticeManager.registerLattice("default", getConfiguredSandboxProvider());
       logger5.info("Registered sandbox manager from env configuration");
     }
+    try {
+      const { ResourceController: ResourceController2 } = await Promise.resolve().then(() => (init_resources(), resources_exports));
+      const sharedResourceStore = (0, import_core37.getStoreLattice)("default", "sharedResource").store;
+      const cache = new import_core37.TokenCache();
+      const resourceController = new ResourceController2({
+        store: sharedResourceStore,
+        sandboxManager: import_core37.sandboxLatticeManager,
+        cache,
+        logger: logger5
+      });
+      registerResourceRoutes(app, resourceController);
+      logger5.info("Resource share routes registered");
+    } catch (err) {
+      logger5.warn("Resource share infrastructure unavailable", {
+        error: err instanceof Error ? err.message : String(err)
+      });
+    }
     if (channelDeps && process.env.CHANNELS_ENABLED !== "false") {
       const { connectAllChannels } = await import("@axiom-lattice/core");
       try {
@@ -9510,7 +9727,7 @@ var start = async (config) => {
         agentTaskConsumer.startPollingQueue();
       }
     }
-    import_core36.agentInstanceManager.restore().then((stats) => {
+    import_core37.agentInstanceManager.restore().then((stats) => {
       logger5.info(`Agent recovery complete: ${stats.restored} threads restored, ${stats.errors} errors`);
     }).catch((error) => {
       logger5.error("Agent recovery failed", { error });