@axiom-lattice/gateway 2.1.101 → 2.1.103

package/dist/index.js

@@ -30,6 +30,53 @@ var __toESM = (mod, isNodeMode, target) => (target = mod != null ? __create(__ge
 ));
 var __toCommonJS = (mod) => __copyProps(__defProp({}, "__esModule", { value: true }), mod);
 
+// src/utils/mime.ts
+function getContentTypeFromFilename(filename) {
+  const ext = filename.includes(".") ? filename.slice(filename.lastIndexOf(".")).toLowerCase() : "";
+  return EXT_TO_MIME[ext] ?? "application/octet-stream";
+}
+function getFilenameFromPath(path3) {
+  const segments = path3.replace(/\/+$/, "").split("/");
+  return segments[segments.length - 1] || "download";
+}
+var EXT_TO_MIME;
+var init_mime = __esm({
+  "src/utils/mime.ts"() {
+    "use strict";
+    EXT_TO_MIME = {
+      ".txt": "text/plain",
+      ".html": "text/html",
+      ".htm": "text/html",
+      ".css": "text/css",
+      ".js": "application/javascript",
+      ".mjs": "application/javascript",
+      ".json": "application/json",
+      ".pdf": "application/pdf",
+      ".png": "image/png",
+      ".jpg": "image/jpeg",
+      ".jpeg": "image/jpeg",
+      ".gif": "image/gif",
+      ".webp": "image/webp",
+      ".svg": "image/svg+xml",
+      ".ico": "image/x-icon",
+      ".zip": "application/zip",
+      ".csv": "text/csv",
+      ".xml": "application/xml",
+      ".xlsx": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet",
+      ".xls": "application/vnd.ms-excel",
+      ".pptx": "application/vnd.openxmlformats-officedocument.presentationml.presentation",
+      ".ppt": "application/vnd.ms-powerpoint",
+      ".docx": "application/vnd.openxmlformats-officedocument.wordprocessingml.document",
+      ".doc": "application/msword",
+      ".mp4": "video/mp4",
+      ".webm": "video/webm",
+      ".mp3": "audio/mpeg",
+      ".wav": "audio/wav",
+      ".ogg": "audio/ogg"
+    };
+  }
+});
+
 // src/logger/Logger.ts
 var import_pino, import_pino_pretty, import_pino_roll, PinoLoggerFactory, Logger;
 var init_Logger = __esm({
@@ -1145,6 +1192,240 @@ var init_a2a = __esm({
   }
 });
 
+// src/controllers/resources.ts
+var resources_exports = {};
+__export(resources_exports, {
+  ResourceController: () => ResourceController
+});
+var import_bcryptjs, import_core35, ResourceController;
+var init_resources = __esm({
+  "src/controllers/resources.ts"() {
+    "use strict";
+    import_bcryptjs = __toESM(require("bcryptjs"));
+    import_core35 = require("@axiom-lattice/core");
+    init_mime();
+    ResourceController = class {
+      constructor(deps) {
+        this.deps = deps;
+      }
+      async createShare(request, reply) {
+        const userId = request.user ? request.user.id ?? "unknown" : "unknown";
+        const tenantId = request.headers["x-tenant-id"] || "default";
+        const workspaceId = request.headers["x-workspace-id"];
+        const projectId = request.headers["x-project-id"];
+        const body = request.body;
+        if (!workspaceId || !projectId) {
+          return reply.status(400).send({ error: "x-workspace-id and x-project-id headers required" });
+        }
+        const payload = (0, import_core35.createSharePayload)(
+          tenantId,
+          workspaceId,
+          projectId,
+          userId,
+          body
+        );
+        const token = (0, import_core35.generateToken)();
+        try {
+          await this.deps.store.create({ ...payload, token });
+          this.deps.logger.info(
+            "[share] created",
+            { token, originalPath: body.resourcePath, normalizedPath: payload.address.resourcePath, volume: payload.address.volume, userId }
+          );
+        } catch {
+          return reply.status(500).send({ error: "Failed to create share" });
+        }
+        return reply.status(201).send({ token, url: `/s/${token}` });
+      }
+      async listShares(request, reply) {
+        const userId = request.user ? request.user.id ?? "unknown" : "unknown";
+        const tenantId = request.headers["x-tenant-id"] || "default";
+        const shares = await this.deps.store.listByUser(tenantId, userId);
+        return reply.send(shares);
+      }
+      async updateShare(request, reply) {
+        const { token } = request.params;
+        const userId = request.user ? request.user.id : void 0;
+        const patch = request.body;
+        const record = await this.deps.store.findByToken(token);
+        if (!record || record.createdBy !== userId) {
+          return reply.status(404).send({ error: "Share not found" });
+        }
+        await this.deps.store.update(token, patch);
+        if (patch.revoked) {
+          this.deps.cache.invalidate(token);
+        }
+        return reply.send({ ok: true });
+      }
+      async revokeShare(request, reply) {
+        const { token } = request.params;
+        const userId = request.user ? request.user.id : void 0;
+        const record = await this.deps.store.findByToken(token);
+        if (!record || record.createdBy !== userId) {
+          return reply.status(404).send({ error: "Share not found" });
+        }
+        await this.deps.store.update(token, { revoked: true });
+        this.deps.cache.invalidate(token);
+        return reply.send({ ok: true });
+      }
+      async resolveResource(request, reply) {
+        const params = request.params;
+        const { token } = params;
+        const subPath = params["*"] ?? "";
+        this.deps.logger.info("[share] resolve start", { token, subPath });
+        const cached = this.deps.cache.get(token);
+        if (cached && !cached.requiresUnlock) {
+          this.deps.logger.info("[share] cache hit", { token, volume: cached.address.volume, resourcePath: cached.address.resourcePath });
+          return this._serveFile(cached.address, token, subPath, cached.sandboxConfig ?? { tenantId: "default", workspaceId: "", projectId: "", assistantId: null }, reply);
+        }
+        this.deps.logger.info("[share] cache miss, querying DB", { token });
+        const record = await this.deps.store.findByToken(token);
+        if (!record || record.revoked) {
+          this.deps.logger.warn("[share] token not found or revoked", { token, found: !!record, revoked: record?.revoked });
+          return reply.status(404).send("Not found");
+        }
+        if (record.expiresAt && new Date(record.expiresAt) < /* @__PURE__ */ new Date()) {
+          this.deps.logger.info("[share] token expired", { token, expiresAt: record.expiresAt });
+          return reply.status(410).send("Expired");
+        }
+        this.deps.logger.info("[share] record found", {
+          token,
+          volume: record.address.volume,
+          resourcePath: record.address.resourcePath,
+          visibility: record.visibility,
+          workspaceId: record.workspaceId,
+          projectId: record.projectId
+        });
+        const isInternal = this._isInternalRequest(request);
+        if (!isInternal) {
+          if (record.visibility === "password") {
+            const unlocked = this._isUnlocked(request, token);
+            if (!unlocked) {
+              this.deps.logger.info("[share] password protected, returning password page", { token });
+              this.deps.cache.set(token, {
+                address: record.address,
+                requiresUnlock: true,
+                sandboxConfig: { tenantId: record.tenantId, workspaceId: record.workspaceId, projectId: record.projectId, assistantId: record.assistantId }
+              });
+              return reply.type("text/html").send(this._passwordPage(token));
+            }
+            this.deps.logger.info("[share] password unlocked", { token });
+          }
+        }
+        if (record.maxAccess !== null) {
+          const ok = await this.deps.store.atomicIncrementAccess(token);
+          if (!ok) return reply.status(410).send("Access limit reached");
+        } else {
+          this.deps.store.incrementAccess(token).catch(() => {
+          });
+        }
+        const sandboxConfig = { tenantId: record.tenantId, workspaceId: record.workspaceId, projectId: record.projectId, assistantId: record.assistantId };
+        this.deps.cache.set(token, {
+          address: record.address,
+          requiresUnlock: record.visibility === "password" && !isInternal,
+          sandboxConfig
+        });
+        return this._serveFile(record.address, token, subPath, sandboxConfig, reply);
+      }
+      async unlockShare(request, reply) {
+        const { token } = request.params;
+        const { password } = request.body;
+        const record = await this.deps.store.findByToken(token);
+        if (!record || !record.passwordHash) {
+          return reply.status(404).send({ error: "Invalid request" });
+        }
+        const valid = await import_bcryptjs.default.compare(password, record.passwordHash);
+        if (!valid) {
+          return reply.status(401).send({ error: "Incorrect password" });
+        }
+        reply.header(
+          "Set-Cookie",
+          `share_unlock_${token}=1; Max-Age=86400; Path=/s/${token}; SameSite=Lax; HttpOnly; Secure`
+        );
+        return reply.send({ ok: true });
+      }
+      _isInternalRequest(request) {
+        const user = request.user;
+        return !!user && !!user.id;
+      }
+      _isUnlocked(request, token) {
+        const cookie = request.headers.cookie ?? "";
+        return cookie.includes(`share_unlock_${token}=1`);
+      }
+      async _serveFile(address, token, subPath, sandboxConfig, reply) {
+        const provider = this.deps.sandboxManager.getDefaultProvider();
+        const resolver = provider.getResourceResolver();
+        const sandboxPath = subPath ? this._resolveSafeSubPath(address.resourcePath, subPath) : address.resourcePath;
+        this.deps.logger.info("[share] serving file", {
+          token,
+          volume: address.volume,
+          sandboxPath,
+          subPath: subPath || "(none)",
+          tenantId: sandboxConfig.tenantId,
+          workspaceId: sandboxConfig.workspaceId,
+          projectId: sandboxConfig.projectId
+        });
+        let buf;
+        try {
+          buf = await resolver.resolve({ ...address, resourcePath: sandboxPath });
+          this.deps.logger.info("[share] resolved via volume FS", { token, size: buf.length });
+        } catch (err) {
+          this.deps.logger.warn("[share] volume FS failed, trying sandbox fallback", {
+            token,
+            path: sandboxPath,
+            error: err.message
+          });
+          try {
+            const sandbox = await this.deps.sandboxManager.getSandboxFromConfig({
+              assistant_id: sandboxConfig.assistantId ?? "",
+              thread_id: "",
+              tenantId: sandboxConfig.tenantId,
+              workspaceId: sandboxConfig.workspaceId,
+              projectId: sandboxConfig.projectId
+            });
+            buf = await sandbox.file.downloadFile({ file: `/project/${sandboxPath}` });
+            this.deps.logger.info("[share] resolved via sandbox fallback", { token, size: buf.length });
+          } catch (err2) {
+            this.deps.logger.warn("[share] all resolution attempts failed", { token, resourcePath: sandboxPath, error: err2.message });
+            return reply.status(404).send("File not found");
+          }
+        }
+        const fullPath = sandboxPath;
+        const filename = fullPath.split("/").pop() || "download";
+        const isHtml = !subPath && /\.(html|htm)$/i.test(filename);
+        if (isHtml) {
+          buf = this._injectBaseTag(buf, token);
+        }
+        const contentType = getContentTypeFromFilename(filename);
+        return reply.status(200).type(contentType).header("Content-Disposition", `inline; filename="${filename}"`).header("Access-Control-Allow-Origin", "*").send(buf);
+      }
+      _resolveSafeSubPath(entryFile, subPath) {
+        if (!subPath) return entryFile;
+        if (subPath.includes("..")) throw new Error("Path traversal denied");
+        const entryDir = entryFile.replace(/[^/]+$/, "");
+        return (entryDir + subPath).replace(/\/+/g, "/");
+      }
+      _injectBaseTag(buf, token) {
+        const html = buf.toString("utf-8");
+        if (/<base\b/i.test(html)) return buf;
+        const baseTag = `<base href="/s/${token}/">`;
+        if (html.includes("</head>")) {
+          return Buffer.from(html.replace("</head>", `${baseTag}</head>`), "utf-8");
+        }
+        if (html.includes("<head>")) {
+          return Buffer.from(html.replace("<head>", `<head>${baseTag}`), "utf-8");
+        }
+        if (html.includes("<html>")) {
+          return Buffer.from(html.replace("<html>", `<html>${baseTag}`), "utf-8");
+        }
+        return Buffer.from(baseTag + html, "utf-8");
+      }
+      _passwordPage(token) {
+        return `<!DOCTYPE html><html><head><meta charset="utf-8"><meta name="viewport" content="width=device-width,initial-scale=1"><title>Password Protected</title><style>body{font-family:-apple-system,BlinkMacSystemFont,sans-serif;display:flex;align-items:center;justify-content:center;min-height:100vh;margin:0;background:#f5f5f5}.card{background:#fff;padding:32px;border-radius:12px;box-shadow:0 2px 8px rgba(0,0,0,.1);width:100%;max-width:360px;text-align:center}h2{margin:0 0 8px;font-size:20px}p{margin:0 0 20px;color:#666;font-size:14px}input{width:100%;padding:10px 12px;border:1px solid #d9d9d9;border-radius:8px;font-size:14px;box-sizing:border-box;margin-bottom:12px}button{width:100%;padding:10px;background:#6366f1;color:#fff;border:none;border-radius:8px;font-size:14px;cursor:pointer}.error{color:#ef4444;font-size:13px;margin-top:8px;display:none}</style></head><body><div class="card"><h2>Password Protected</h2><p>This share requires a password to access.</p><form id="f"><input type="password" id="p" placeholder="Enter password" required><button type="submit">Unlock</button><div class="error" id="e">Incorrect password</div></form></div><script>document.getElementById('f').onsubmit=async(e)=>{e.preventDefault();const r=await fetch('/s/${token}/unlock',{method:'POST',headers:{'Content-Type':'application/json'},body:JSON.stringify({password:document.getElementById('p').value})});if(r.ok)location.reload();else document.getElementById('e').style.display='block'}</script></body></html>`;
+      }
+    };
+  }
+});
+
 // src/index.ts
 var index_exports = {};
 __export(index_exports, {
@@ -4195,31 +4476,7 @@ var sandboxService = new SandboxService();
 
 // src/controllers/sandbox.ts
 var import_core18 = require("@axiom-lattice/core");
-function getFilenameFromPath(path3) {
-  const segments = path3.replace(/\/+$/, "").split("/");
-  return segments[segments.length - 1] || "download";
-}
-var EXT_TO_MIME = {
-  ".txt": "text/plain",
-  ".html": "text/html",
-  ".css": "text/css",
-  ".js": "application/javascript",
-  ".json": "application/json",
-  ".pdf": "application/pdf",
-  ".png": "image/png",
-  ".jpg": "image/jpeg",
-  ".jpeg": "image/jpeg",
-  ".gif": "image/gif",
-  ".webp": "image/webp",
-  ".svg": "image/svg+xml",
-  ".zip": "application/zip",
-  ".csv": "text/csv",
-  ".xml": "application/xml"
-};
-function getContentTypeFromFilename(filename) {
-  const ext = filename.includes(".") ? filename.slice(filename.lastIndexOf(".")).toLowerCase() : "";
-  return EXT_TO_MIME[ext] ?? "application/octet-stream";
-}
+init_mime();
 function registerSandboxProxyRoutes(app2) {
   app2.post(
     "/api/assistants/:assistantId/threads/:threadId/sandbox/uploadfile",
@@ -4318,6 +4575,7 @@ var import_core19 = require("@axiom-lattice/core");
 var import_core20 = require("@axiom-lattice/core");
 var import_core21 = require("@axiom-lattice/core");
 var import_uuid2 = require("uuid");
+init_mime();
 var WorkspaceController = class {
   constructor() {
     this.workspaceStore = (0, import_core19.getStoreLattice)("default", "workspace").store;
@@ -4489,32 +4747,6 @@ var WorkspaceController = class {
       };
     }
   }
-  getFilenameFromPath(filePath) {
-    const segments = filePath.split("/");
-    return segments[segments.length - 1] || "download";
-  }
-  getMimeType(filename) {
-    const ext = filename.split(".").pop()?.toLowerCase() || "";
-    const mimeTypes = {
-      pdf: "application/pdf",
-      csv: "text/csv",
-      xlsx: "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet",
-      xls: "application/vnd.ms-excel",
-      txt: "text/plain",
-      json: "application/json",
-      png: "image/png",
-      jpg: "image/jpeg",
-      jpeg: "image/jpeg",
-      gif: "image/gif",
-      svg: "image/svg+xml",
-      html: "text/html",
-      htm: "text/html",
-      mp3: "audio/mpeg",
-      mp4: "video/mp4",
-      webm: "video/webm"
-    };
-    return mimeTypes[ext] || "application/octet-stream";
-  }
   isBinaryContentType(filename) {
     const ext = filename.split(".").pop()?.toLowerCase() || "";
     const binaryExtensions = /* @__PURE__ */ new Set([
@@ -4567,7 +4799,7 @@ var WorkspaceController = class {
           workspaceId,
           projectId
         };
-        const filename2 = this.getFilenameFromPath(resolvedPath);
+        const filename2 = getFilenameFromPath(resolvedPath);
         const isBinary = this.isBinaryContentType(filename2);
         const volumeBackend = await sandboxManager.getVolumeBackendForPath(volumeConfig, resolvedPath);
         let buf;
@@ -4582,14 +4814,14 @@ var WorkspaceController = class {
           const sandbox = await sandboxManager.getSandboxFromConfig(volumeConfig);
           buf = await sandbox.file.downloadFile({ file: resolvedPath });
         }
-        const inferredContentType = this.getMimeType(filename2);
+        const inferredContentType = getContentTypeFromFilename(filename2);
         const contentDisposition = `attachment; filename*=UTF-8''${encodeURIComponent(filename2)}`;
         return reply.status(200).type(inferredContentType).header("Content-Disposition", contentDisposition).send(buf);
       }
       const { backend } = await this.getBackend(tenantId, workspaceId, projectId, assistantId, resolvedPath);
       const content = await backend.read(resolvedPath, 0, Infinity);
-      const filename = this.getFilenameFromPath(resolvedPath);
-      const mimeType = this.getMimeType(filename);
+      const filename = getFilenameFromPath(resolvedPath);
+      const mimeType = getContentTypeFromFilename(filename);
       const buffer = Buffer.from(content, "utf-8");
       return reply.status(200).type(mimeType).header("Content-Disposition", `attachment; filename*=UTF-8''${encodeURIComponent(filename)}`).send(buffer);
     } catch (error) {
@@ -4621,7 +4853,7 @@ var WorkspaceController = class {
           workspaceId,
           projectId
         };
-        const filename2 = this.getFilenameFromPath(resolvedPath);
+        const filename2 = getFilenameFromPath(resolvedPath);
         const isBinary = this.isBinaryContentType(filename2);
         const volumeBackend = await sandboxManager.getVolumeBackendForPath(volumeConfig, resolvedPath);
         let buf;
@@ -4636,7 +4868,7 @@ var WorkspaceController = class {
           const sandbox = await sandboxManager.getSandboxFromConfig(volumeConfig);
           buf = await sandbox.file.downloadFile({ file: resolvedPath });
         }
-        const inferredContentType = this.getMimeType(filename2);
+        const inferredContentType = getContentTypeFromFilename(filename2);
         try {
           const contentType = inferredContentType;
           const isHtml = contentType?.toLowerCase().includes("text/html") || filename2.toLowerCase().endsWith(".html") || filename2.toLowerCase().endsWith(".htm");
@@ -4669,8 +4901,8 @@ var WorkspaceController = class {
       }
       const { backend } = await this.getBackend(tenantId, workspaceId, projectId, assistantId, resolvedPath);
       const content = await backend.read(resolvedPath, 0, Infinity);
-      const filename = this.getFilenameFromPath(resolvedPath);
-      const mimeType = this.getMimeType(filename);
+      const filename = getFilenameFromPath(resolvedPath);
+      const mimeType = getContentTypeFromFilename(filename);
       let finalContent = content;
       const isHtmlFs = mimeType?.toLowerCase().includes("text/html") || filename.toLowerCase().endsWith(".html") || filename.toLowerCase().endsWith(".htm");
       if (isHtmlFs) {
@@ -8474,6 +8706,23 @@ var registerLatticeRoutes = (app2, channelDeps) => {
   );
 };
 
+// src/routes/resource-routes.ts
+function registerResourceRoutes(app2, controller) {
+  app2.get("/s/:token", controller.resolveResource.bind(controller));
+  app2.get("/s/:token/*", controller.resolveResource.bind(controller));
+  app2.post("/s/:token/unlock", controller.unlockShare.bind(controller));
+  app2.options("/s/:token", async (_req, reply) => {
+    reply.header("Access-Control-Allow-Origin", "*");
+    reply.header("Access-Control-Allow-Methods", "GET, OPTIONS, POST");
+    reply.header("Access-Control-Allow-Headers", "Content-Type");
+    return reply.status(204).send();
+  });
+  app2.post("/api/resources/share", controller.createShare.bind(controller));
+  app2.get("/api/resources/shares", controller.listShares.bind(controller));
+  app2.patch("/api/resources/share/:token", controller.updateShare.bind(controller));
+  app2.delete("/api/resources/share/:token", controller.revokeShare.bind(controller));
+}
+
 // src/router/MessageRouter.ts
 var import_core32 = require("@axiom-lattice/core");
 var import_crypto9 = require("crypto");
@@ -8958,7 +9207,7 @@ function createAuditLoggerMiddleware() {
 }
 
 // src/index.ts
-var import_core35 = require("@axiom-lattice/core");
+var import_core36 = require("@axiom-lattice/core");
 
 // src/swagger.ts
 var import_swagger = __toESM(require("@fastify/swagger"));
@@ -9275,7 +9524,7 @@ _AgentTaskConsumer.agent_run_endpoint = "http://localhost:4001/api/runs";
 var AgentTaskConsumer = _AgentTaskConsumer;
 
 // src/index.ts
-var import_core36 = require("@axiom-lattice/core");
+var import_core37 = require("@axiom-lattice/core");
 var import_protocols5 = require("@axiom-lattice/protocols");
 var import_meta = {};
 process.on("unhandledRejection", (reason, promise) => {
@@ -9291,11 +9540,11 @@ var DEFAULT_LOGGER_CONFIG = {
 var loggerLattice = initializeLogger(DEFAULT_LOGGER_CONFIG);
 var logger5 = loggerLattice.client;
 function initializeLogger(config) {
-  if (import_core36.loggerLatticeManager.hasLattice("default")) {
-    import_core36.loggerLatticeManager.removeLattice("default");
+  if (import_core37.loggerLatticeManager.hasLattice("default")) {
+    import_core37.loggerLatticeManager.removeLattice("default");
   }
-  (0, import_core36.registerLoggerLattice)("default", config);
-  return (0, import_core36.getLoggerLattice)("default");
+  (0, import_core37.registerLoggerLattice)("default", config);
+  return (0, import_core37.getLoggerLattice)("default");
 }
 var app = (0, import_fastify.default)({
   logger: false,
@@ -9332,6 +9581,7 @@ app.addHook("preHandler", async (request, reply) => {
   if (!authRequired) return;
   if (request.method === "OPTIONS") return;
   if (PUBLIC_ROUTES.some((r) => request.url === r)) return;
+  if (request.url.startsWith("/s/")) return;
   const urlPath = request.url.split("?")[0];
   if (urlPath.includes("/viewfile") || urlPath.includes("/downloadfile")) return;
   return reply.status(401).send({
@@ -9406,7 +9656,7 @@ app.setErrorHandler((error, request, reply) => {
 });
 function getConfiguredSandboxProvider() {
   const sandboxProviderType = process.env.SANDBOX_PROVIDER_TYPE || "microsandbox-remote";
-  return (0, import_core36.createSandboxProvider)({
+  return (0, import_core37.createSandboxProvider)({
     type: sandboxProviderType,
     remoteBaseURL: process.env.SANDBOX_BASE_URL,
     microsandboxServiceBaseURL: process.env.MICROSANDBOX_SERVICE_BASE_URL,
@@ -9442,7 +9692,7 @@ var start = async (config) => {
       const { getStoreLattice: getStore2 } = await import("@axiom-lattice/core");
       const bindingStore = getStore2("default", "channelBinding").store;
       const installationStore = getStore2("default", "channelInstallation").store;
-      (0, import_core35.setBindingRegistry)(bindingStore);
+      (0, import_core36.setBindingRegistry)(bindingStore);
       const router = new MessageRouter({
         middlewares: [
           createDeduplicationMiddleware(),
@@ -9468,8 +9718,8 @@ var start = async (config) => {
       });
     }
     try {
-      const menuStore = (0, import_core36.getStoreLattice)("default", "menu").store;
-      (0, import_core35.setMenuRegistry)(menuStore);
+      const menuStore = (0, import_core37.getStoreLattice)("default", "menu").store;
+      (0, import_core36.setMenuRegistry)(menuStore);
       logger5.info("Menu registry initialized");
     } catch {
     }
@@ -9477,10 +9727,27 @@ var start = async (config) => {
       setChannelControllerDeps({ adapterRegistry, router: channelDeps.router });
     }
     registerLatticeRoutes(app, channelDeps);
-    if (!import_core36.sandboxLatticeManager.hasLattice("default")) {
-      import_core36.sandboxLatticeManager.registerLattice("default", getConfiguredSandboxProvider());
+    if (!import_core37.sandboxLatticeManager.hasLattice("default")) {
+      import_core37.sandboxLatticeManager.registerLattice("default", getConfiguredSandboxProvider());
       logger5.info("Registered sandbox manager from env configuration");
     }
+    try {
+      const { ResourceController: ResourceController2 } = await Promise.resolve().then(() => (init_resources(), resources_exports));
+      const sharedResourceStore = (0, import_core37.getStoreLattice)("default", "sharedResource").store;
+      const cache = new import_core37.TokenCache();
+      const resourceController = new ResourceController2({
+        store: sharedResourceStore,
+        sandboxManager: import_core37.sandboxLatticeManager,
+        cache,
+        logger: logger5
+      });
+      registerResourceRoutes(app, resourceController);
+      logger5.info("Resource share routes registered");
+    } catch (err) {
+      logger5.warn("Resource share infrastructure unavailable", {
+        error: err instanceof Error ? err.message : String(err)
+      });
+    }
     if (channelDeps && process.env.CHANNELS_ENABLED !== "false") {
       const { connectAllChannels } = await import("@axiom-lattice/core");
       try {
@@ -9510,7 +9777,7 @@ var start = async (config) => {
         agentTaskConsumer.startPollingQueue();
       }
     }
-    import_core36.agentInstanceManager.restore().then((stats) => {
+    import_core37.agentInstanceManager.restore().then((stats) => {
       logger5.info(`Agent recovery complete: ${stats.restored} threads restored, ${stats.errors} errors`);
     }).catch((error) => {
       logger5.error("Agent recovery failed", { error });