@hotmeshio/long-tail 0.1.13 → 0.1.15

package/build/lib/storage/local.js

@@ -32,10 +32,15 @@ var __importStar = (this && this.__importStar) || (function () {
         return result;
     };
 })();
+var __importDefault = (this && this.__importDefault) || function (mod) {
+    return (mod && mod.__esModule) ? mod : { "default": mod };
+};
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.LocalStorageBackend = void 0;
 const fs = __importStar(require("fs"));
 const path = __importStar(require("path"));
+const jsonwebtoken_1 = __importDefault(require("jsonwebtoken"));
+const mime_1 = require("./mime");
 const BASE_DIR = process.env.LT_FILE_STORAGE_DIR || './data/files';
 function resolveAndValidate(filePath) {
     const relative = filePath.replace(/^\/+/, '');
@@ -125,5 +130,63 @@ class LocalStorageBackend {
         }
         return fs.createReadStream(resolved);
     }
+    async listWithPrefixes(prefix, pageSize, continuationToken) {
+        ensureBaseDir();
+        const dir = prefix ? resolveAndValidate(prefix) : path.resolve(BASE_DIR);
+        if (!fs.existsSync(dir)) {
+            return { files: [], directories: [] };
+        }
+        const entries = fs.readdirSync(dir, { withFileTypes: true });
+        const limit = pageSize || 100;
+        const offset = continuationToken ? parseInt(continuationToken, 10) : 0;
+        const allDirs = [];
+        const allFiles = [];
+        for (const entry of entries) {
+            const relativePath = path.relative(path.resolve(BASE_DIR), path.join(dir, entry.name));
+            if (entry.isDirectory()) {
+                allDirs.push(relativePath + '/');
+            }
+            else if (entry.isFile()) {
+                const stat = fs.statSync(path.join(dir, entry.name));
+                allFiles.push({
+                    path: relativePath,
+                    size: stat.size,
+                    modified_at: stat.mtime.toISOString(),
+                });
+            }
+        }
+        // Directories first, then files — paginate the combined list
+        const combined = [...allDirs.map((d) => ({ type: 'dir', value: d })),
+            ...allFiles.map((f) => ({ type: 'file', value: f }))];
+        const page = combined.slice(offset, offset + limit);
+        const hasMore = offset + limit < combined.length;
+        const directories = page.filter((e) => e.type === 'dir').map((e) => e.value);
+        const files = page.filter((e) => e.type === 'file').map((e) => e.value);
+        return {
+            files,
+            directories,
+            nextToken: hasMore ? String(offset + limit) : undefined,
+        };
+    }
+    async getMetadata(key) {
+        const resolved = resolveAndValidate(key);
+        if (!fs.existsSync(resolved)) {
+            throw new Error(`File not found: ${key}`);
+        }
+        const stat = fs.statSync(resolved);
+        return {
+            size: stat.size,
+            modified_at: stat.mtime.toISOString(),
+            content_type: (0, mime_1.mimeFromPath)(key),
+        };
+    }
+    async getSignedUrl(key, expiresInSeconds) {
+        const secret = process.env.JWT_SECRET;
+        if (!secret) {
+            throw new Error('JWT_SECRET not configured — cannot generate signed URLs');
+        }
+        const token = jsonwebtoken_1.default.sign({ filePath: key.replace(/^\/+/, ''), purpose: 'file-download' }, secret, { expiresIn: expiresInSeconds });
+        return `/api/files/${key.replace(/^\/+/, '')}?token=${token}`;
+    }
 }
 exports.LocalStorageBackend = LocalStorageBackend;

package/build/lib/storage/mime.d.ts

@@ -0,0 +1,4 @@
+/** Shared MIME type map used by file serving routes and storage backends. */
+export declare const MIME_TYPES: Record<string, string>;
+/** Resolve MIME type from file extension. */
+export declare function mimeFromPath(filePath: string): string;

package/build/lib/storage/mime.js

@@ -0,0 +1,31 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.MIME_TYPES = void 0;
+exports.mimeFromPath = mimeFromPath;
+/** Shared MIME type map used by file serving routes and storage backends. */
+exports.MIME_TYPES = {
+    '.png': 'image/png',
+    '.jpg': 'image/jpeg',
+    '.jpeg': 'image/jpeg',
+    '.gif': 'image/gif',
+    '.svg': 'image/svg+xml',
+    '.webp': 'image/webp',
+    '.pdf': 'application/pdf',
+    '.json': 'application/json',
+    '.txt': 'text/plain',
+    '.html': 'text/html',
+    '.css': 'text/css',
+    '.js': 'application/javascript',
+    '.csv': 'text/csv',
+    '.xml': 'application/xml',
+    '.yaml': 'text/yaml',
+    '.yml': 'text/yaml',
+    '.md': 'text/markdown',
+    '.zip': 'application/zip',
+    '.gz': 'application/gzip',
+};
+/** Resolve MIME type from file extension. */
+function mimeFromPath(filePath) {
+    const ext = filePath.includes('.') ? '.' + filePath.split('.').pop().toLowerCase() : '';
+    return exports.MIME_TYPES[ext] || 'application/octet-stream';
+}

package/build/lib/storage/s3.d.ts

@@ -1,6 +1,7 @@
 import type { StorageBackend } from './types';
 export declare class S3StorageBackend implements StorageBackend {
     private client;
+    private signingClient;
     private bucket;
     private bucketReady;
     constructor();
@@ -28,4 +29,19 @@ export declare class S3StorageBackend implements StorageBackend {
         size: number;
     }>;
     createReadStream(key: string): Promise<NodeJS.ReadableStream>;
+    listWithPrefixes(prefix?: string, pageSize?: number, continuationToken?: string): Promise<{
+        files: Array<{
+            path: string;
+            size: number;
+            modified_at: string;
+        }>;
+        directories: string[];
+        nextToken?: string;
+    }>;
+    getMetadata(key: string): Promise<{
+        size: number;
+        modified_at: string;
+        content_type: string;
+    }>;
+    getSignedUrl(key: string, expiresInSeconds: number): Promise<string>;
 }

package/build/lib/storage/s3.js

@@ -38,10 +38,14 @@ const fs = __importStar(require("fs"));
 const os = __importStar(require("os"));
 const path = __importStar(require("path"));
 const client_s3_1 = require("@aws-sdk/client-s3");
+const s3_request_presigner_1 = require("@aws-sdk/s3-request-presigner");
+const mime_1 = require("./mime");
 const STAGING_DIR = path.join(os.tmpdir(), 'lt-staging');
 class S3StorageBackend {
     constructor() {
+        this.signingClient = null;
         const endpoint = process.env.LT_S3_ENDPOINT;
+        const publicEndpoint = process.env.LT_S3_PUBLIC_ENDPOINT;
         const region = process.env.LT_S3_REGION || 'us-east-1';
         const forcePathStyle = process.env.LT_S3_FORCE_PATH_STYLE === 'true';
         this.bucket = process.env.LT_S3_BUCKET || 'long-tail-files';
@@ -63,6 +67,12 @@ class S3StorageBackend {
             };
         }
         this.client = new client_s3_1.S3Client(clientConfig);
+        // Signed URLs need the public-facing endpoint so browsers can reach them.
+        // In Docker, LT_S3_ENDPOINT is the internal hostname (e.g. http://minio:9000)
+        // while LT_S3_PUBLIC_ENDPOINT is the host-accessible URL (e.g. http://localhost:9000).
+        if (publicEndpoint && publicEndpoint !== endpoint) {
+            this.signingClient = new client_s3_1.S3Client({ ...clientConfig, endpoint: publicEndpoint });
+        }
         this.bucketReady = this.ensureBucket();
     }
     async ensureBucket() {
@@ -168,6 +178,66 @@ class S3StorageBackend {
         }));
         return resp.Body;
     }
+    async listWithPrefixes(prefix, pageSize, continuationToken) {
+        await this.bucketReady;
+        const normalizedPrefix = prefix ? normalizeKey(prefix) : undefined;
+        const listPrefix = normalizedPrefix
+            ? (normalizedPrefix.endsWith('/') ? normalizedPrefix : normalizedPrefix + '/')
+            : undefined;
+        const resp = await this.client.send(new client_s3_1.ListObjectsV2Command({
+            Bucket: this.bucket,
+            Prefix: listPrefix,
+            Delimiter: '/',
+            MaxKeys: pageSize || 100,
+            ContinuationToken: continuationToken || undefined,
+        }));
+        const files = [];
+        for (const obj of resp.Contents || []) {
+            if (!obj.Key)
+                continue;
+            // Skip the prefix itself if it appears as a "file"
+            if (obj.Key === listPrefix)
+                continue;
+            files.push({
+                path: obj.Key,
+                size: obj.Size || 0,
+                modified_at: obj.LastModified?.toISOString() || new Date().toISOString(),
+            });
+        }
+        const directories = [];
+        for (const cp of resp.CommonPrefixes || []) {
+            if (cp.Prefix) {
+                directories.push(cp.Prefix);
+            }
+        }
+        return {
+            files,
+            directories,
+            nextToken: resp.NextContinuationToken || undefined,
+        };
+    }
+    async getMetadata(key) {
+        await this.bucketReady;
+        const resp = await this.client.send(new client_s3_1.HeadObjectCommand({
+            Bucket: this.bucket,
+            Key: normalizeKey(key),
+        }));
+        return {
+            size: resp.ContentLength || 0,
+            modified_at: resp.LastModified?.toISOString() || new Date().toISOString(),
+            content_type: resp.ContentType || (0, mime_1.mimeFromPath)(key),
+        };
+    }
+    async getSignedUrl(key, expiresInSeconds) {
+        await this.bucketReady;
+        const command = new client_s3_1.GetObjectCommand({
+            Bucket: this.bucket,
+            Key: normalizeKey(key),
+        });
+        // Use the public-facing client so the signed URL hostname is reachable from browsers
+        const client = this.signingClient || this.client;
+        return (0, s3_request_presigner_1.getSignedUrl)(client, command, { expiresIn: expiresInSeconds });
+    }
 }
 exports.S3StorageBackend = S3StorageBackend;
 /** Strip leading slashes to create a valid S3 key; reject traversal. */

package/build/lib/storage/types.d.ts

@@ -38,4 +38,22 @@ export interface StorageBackend {
     }>;
     /** Create a readable stream for HTTP serving. */
     createReadStream(key: string): Promise<NodeJS.ReadableStream>;
+    /** List files and directory prefixes under a path (for directory browsing). */
+    listWithPrefixes(prefix?: string, pageSize?: number, continuationToken?: string): Promise<{
+        files: Array<{
+            path: string;
+            size: number;
+            modified_at: string;
+        }>;
+        directories: string[];
+        nextToken?: string;
+    }>;
+    /** Get file metadata without reading content. */
+    getMetadata(key: string): Promise<{
+        size: number;
+        modified_at: string;
+        content_type: string;
+    }>;
+    /** Generate a time-limited signed URL for unauthenticated file access. */
+    getSignedUrl(key: string, expiresInSeconds: number): Promise<string>;
 }

package/build/modules/utils.d.ts

@@ -0,0 +1,73 @@
+/**
+ * Sanitize a value for use as an MCP tool name or HotMesh graph topic
+ * (the `subscribes` field in a YAML DAG).
+ *
+ * ## Why snake_case
+ *
+ * MCP tool names become the `subscribes` topic in a HotMesh YAML DAG.
+ * That topic is how the system routes incoming messages to the correct
+ * workflow. The same value also appears in `worker` activity `topic`
+ * fields and in the `mcp_<server>_<tool>` activity type encoding.
+ *
+ * Because the activity type uses underscores to delimit server from tool
+ * (`mcp_longtail_take_screenshot`), both the server name (letters only)
+ * and the tool name (snake_case) must avoid dashes, dots, or other
+ * separators that would create ambiguity when parsing activity types.
+ *
+ * ## Risks if violated
+ *
+ * - Dashes in tool names cause `parseMcpActivityType()` to mis-split
+ *   the server/tool boundary in activity type strings.
+ * - Dots or special chars can produce invalid HotMesh topic subscriptions
+ *   that silently fail to route.
+ * - Mixed conventions across entry points (builder, planner, discovery)
+ *   cause topic collisions or deployment failures when merging workflows
+ *   into a single app namespace.
+ *
+ * ## Contract
+ *
+ * Input:  any string (LLM output, user input, URL slug, etc.)
+ * Output: lowercase letters, digits, and underscores only.
+ *         Runs of non-alphanumeric chars become a single underscore.
+ *         No leading or trailing underscores.
+ *
+ * This is the ONE canonical backend implementation. The dashboard has an
+ * identical copy at `dashboard/src/lib/sanitize.ts`. No other file in
+ * the platform may inline this logic.
+ */
+export declare function sanitizeToolName(value: string): string;
+/**
+ * Sanitize a value for use as an MCP server name (the HotMesh `app.id`
+ * and Postgres schema name that isolates one server's workflows from another).
+ *
+ * ## Why lowercase alphanumeric, leading letter
+ *
+ * The server name becomes:
+ *   1. A Postgres schema name — must start with a letter; letters and digits
+ *      are safe without quoting.
+ *   2. The first segment in the `mcp_<server>_<tool>` activity type encoding.
+ *      Because underscores delimit server from tool, the server name itself
+ *      must never contain underscores (or dashes, dots, etc.).
+ *
+ * ## Risks if violated
+ *
+ * - Underscores or dashes in the server name make `parseMcpActivityType()`
+ *   split incorrectly — it uses the first `_` after `mcp_` as the boundary.
+ * - A leading digit produces an invalid Postgres schema name that requires
+ *   quoting and breaks HotMesh's unquoted SQL paths.
+ * - Special characters can cause silent deployment failures or schema
+ *   creation errors.
+ *
+ * ## Contract
+ *
+ * Input:  any string (LLM suggestion, user input, etc.)
+ * Output: lowercase letters and digits only, guaranteed to start with a letter.
+ *         All non-alphanumeric chars are stripped (not replaced).
+ *         Leading digits are stripped so the result starts with a letter.
+ *         Default: 'longtail' if the result is empty after sanitization.
+ *
+ * This is the ONE canonical backend implementation. The dashboard has an
+ * identical copy at `dashboard/src/lib/sanitize.ts`. No other file in
+ * the platform may inline this logic.
+ */
+export declare function sanitizeServerName(value: string): string;

package/build/modules/utils.js

@@ -0,0 +1,84 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.sanitizeToolName = sanitizeToolName;
+exports.sanitizeServerName = sanitizeServerName;
+/**
+ * Sanitize a value for use as an MCP tool name or HotMesh graph topic
+ * (the `subscribes` field in a YAML DAG).
+ *
+ * ## Why snake_case
+ *
+ * MCP tool names become the `subscribes` topic in a HotMesh YAML DAG.
+ * That topic is how the system routes incoming messages to the correct
+ * workflow. The same value also appears in `worker` activity `topic`
+ * fields and in the `mcp_<server>_<tool>` activity type encoding.
+ *
+ * Because the activity type uses underscores to delimit server from tool
+ * (`mcp_longtail_take_screenshot`), both the server name (letters only)
+ * and the tool name (snake_case) must avoid dashes, dots, or other
+ * separators that would create ambiguity when parsing activity types.
+ *
+ * ## Risks if violated
+ *
+ * - Dashes in tool names cause `parseMcpActivityType()` to mis-split
+ *   the server/tool boundary in activity type strings.
+ * - Dots or special chars can produce invalid HotMesh topic subscriptions
+ *   that silently fail to route.
+ * - Mixed conventions across entry points (builder, planner, discovery)
+ *   cause topic collisions or deployment failures when merging workflows
+ *   into a single app namespace.
+ *
+ * ## Contract
+ *
+ * Input:  any string (LLM output, user input, URL slug, etc.)
+ * Output: lowercase letters, digits, and underscores only.
+ *         Runs of non-alphanumeric chars become a single underscore.
+ *         No leading or trailing underscores.
+ *
+ * This is the ONE canonical backend implementation. The dashboard has an
+ * identical copy at `dashboard/src/lib/sanitize.ts`. No other file in
+ * the platform may inline this logic.
+ */
+function sanitizeToolName(value) {
+    return value
+        .toLowerCase()
+        .replace(/[^a-z0-9]+/g, '_')
+        .replace(/^_|_$/g, '');
+}
+/**
+ * Sanitize a value for use as an MCP server name (the HotMesh `app.id`
+ * and Postgres schema name that isolates one server's workflows from another).
+ *
+ * ## Why lowercase alphanumeric, leading letter
+ *
+ * The server name becomes:
+ *   1. A Postgres schema name — must start with a letter; letters and digits
+ *      are safe without quoting.
+ *   2. The first segment in the `mcp_<server>_<tool>` activity type encoding.
+ *      Because underscores delimit server from tool, the server name itself
+ *      must never contain underscores (or dashes, dots, etc.).
+ *
+ * ## Risks if violated
+ *
+ * - Underscores or dashes in the server name make `parseMcpActivityType()`
+ *   split incorrectly — it uses the first `_` after `mcp_` as the boundary.
+ * - A leading digit produces an invalid Postgres schema name that requires
+ *   quoting and breaks HotMesh's unquoted SQL paths.
+ * - Special characters can cause silent deployment failures or schema
+ *   creation errors.
+ *
+ * ## Contract
+ *
+ * Input:  any string (LLM suggestion, user input, etc.)
+ * Output: lowercase letters and digits only, guaranteed to start with a letter.
+ *         All non-alphanumeric chars are stripped (not replaced).
+ *         Leading digits are stripped so the result starts with a letter.
+ *         Default: 'longtail' if the result is empty after sanitization.
+ *
+ * This is the ONE canonical backend implementation. The dashboard has an
+ * identical copy at `dashboard/src/lib/sanitize.ts`. No other file in
+ * the platform may inline this logic.
+ */
+function sanitizeServerName(value) {
+    return value.toLowerCase().replace(/[^a-z0-9]/g, '').replace(/^[0-9]+/, '');
+}

package/build/routes/file-browser.d.ts

@@ -0,0 +1,2 @@
+declare const router: import("express-serve-static-core").Router;
+export default router;

package/build/routes/file-browser.js

@@ -0,0 +1,126 @@
+"use strict";
+var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    var desc = Object.getOwnPropertyDescriptor(m, k);
+    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
+      desc = { enumerable: true, get: function() { return m[k]; } };
+    }
+    Object.defineProperty(o, k2, desc);
+}) : (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    o[k2] = m[k];
+}));
+var __setModuleDefault = (this && this.__setModuleDefault) || (Object.create ? (function(o, v) {
+    Object.defineProperty(o, "default", { enumerable: true, value: v });
+}) : function(o, v) {
+    o["default"] = v;
+});
+var __importStar = (this && this.__importStar) || (function () {
+    var ownKeys = function(o) {
+        ownKeys = Object.getOwnPropertyNames || function (o) {
+            var ar = [];
+            for (var k in o) if (Object.prototype.hasOwnProperty.call(o, k)) ar[ar.length] = k;
+            return ar;
+        };
+        return ownKeys(o);
+    };
+    return function (mod) {
+        if (mod && mod.__esModule) return mod;
+        var result = {};
+        if (mod != null) for (var k = ownKeys(mod), i = 0; i < k.length; i++) if (k[i] !== "default") __createBinding(result, mod, k[i]);
+        __setModuleDefault(result, mod);
+        return result;
+    };
+})();
+var __importDefault = (this && this.__importDefault) || function (mod) {
+    return (mod && mod.__esModule) ? mod : { "default": mod };
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+const express_1 = require("express");
+const path_1 = __importDefault(require("path"));
+const api = __importStar(require("../api/files"));
+const storage_1 = require("../lib/storage");
+const mime_1 = require("../lib/storage/mime");
+const router = (0, express_1.Router)();
+/**
+ * GET /api/file-browser/browse
+ * List files and directories at a given prefix.
+ * Query: ?prefix=screenshots/&pageSize=100&continuationToken=...
+ */
+router.get('/browse', async (req, res) => {
+    const result = await api.browseFiles({
+        prefix: req.query.prefix,
+        pageSize: req.query.pageSize ? parseInt(req.query.pageSize, 10) : undefined,
+        continuationToken: req.query.continuationToken,
+    });
+    res.status(result.status).json(result.data ?? { error: result.error });
+});
+/**
+ * GET /api/file-browser/metadata/*
+ * Get metadata for a single file.
+ */
+router.get('/metadata/{*filePath}', async (req, res) => {
+    const raw = req.params.filePath;
+    const filePath = Array.isArray(raw) ? raw.join('/') : raw;
+    if (!filePath) {
+        res.status(400).json({ error: 'File path required' });
+        return;
+    }
+    const result = await api.getFileMetadata({ filePath });
+    res.status(result.status).json(result.data ?? { error: result.error });
+});
+/**
+ * POST /api/file-browser/signed-url
+ * Generate a time-limited signed URL for sharing.
+ * Body: { path, expiresIn } — expiresIn in seconds (3600, 21600, 86400, 604800, 2592000)
+ */
+router.post('/signed-url', async (req, res) => {
+    const { path: filePath, expiresIn } = req.body;
+    if (!filePath || !expiresIn) {
+        res.status(400).json({ error: 'path and expiresIn are required' });
+        return;
+    }
+    const result = await api.generateSignedUrl({
+        filePath,
+        expiresIn: typeof expiresIn === 'number' ? expiresIn : parseInt(expiresIn, 10),
+    });
+    res.status(result.status).json(result.data ?? { error: result.error });
+});
+/**
+ * DELETE /api/file-browser/delete/*
+ * Permanently delete a file.
+ */
+router.delete('/delete/{*filePath}', async (req, res) => {
+    const raw = req.params.filePath;
+    const filePath = Array.isArray(raw) ? raw.join('/') : raw;
+    if (!filePath) {
+        res.status(400).json({ error: 'File path required' });
+        return;
+    }
+    const result = await api.deleteFile({ filePath });
+    res.status(result.status).json(result.data ?? { error: result.error });
+});
+/**
+ * GET /api/file-browser/download/*
+ * Download a file with Content-Disposition: attachment.
+ */
+router.get('/download/{*filePath}', async (req, res) => {
+    const raw = req.params.filePath;
+    const filePath = Array.isArray(raw) ? raw.join('/') : raw;
+    if (!filePath) {
+        res.status(400).json({ error: 'File path required' });
+        return;
+    }
+    try {
+        const stream = await (0, storage_1.getStorageBackend)().createReadStream(filePath);
+        const fileName = path_1.default.basename(filePath);
+        const contentType = (0, mime_1.mimeFromPath)(filePath);
+        res.setHeader('Content-Type', contentType);
+        res.setHeader('Content-Disposition', `attachment; filename="${fileName}"`);
+        stream.pipe(res);
+    }
+    catch {
+        res.status(404).json({ error: 'File not found' });
+    }
+});
+exports.default = router;

package/build/routes/files.js

@@ -4,26 +4,15 @@ var __importDefault = (this && this.__importDefault) || function (mod) {
 };
 Object.defineProperty(exports, "__esModule", { value: true });
 const express_1 = require("express");
-const path_1 = __importDefault(require("path"));
+const jsonwebtoken_1 = __importDefault(require("jsonwebtoken"));
 const storage_1 = require("../lib/storage");
+const mime_1 = require("../lib/storage/mime");
 const router = (0, express_1.Router)();
-const MIME_TYPES = {
-    '.png': 'image/png',
-    '.jpg': 'image/jpeg',
-    '.jpeg': 'image/jpeg',
-    '.gif': 'image/gif',
-    '.svg': 'image/svg+xml',
-    '.webp': 'image/webp',
-    '.pdf': 'application/pdf',
-    '.json': 'application/json',
-    '.txt': 'text/plain',
-    '.html': 'text/html',
-    '.csv': 'text/csv',
-    '.xml': 'application/xml',
-};
 /**
  * GET /api/files/*
  * Serve files from managed file storage.
+ * Supports optional signed token (?token=<jwt>) for authenticated access
+ * to locally-generated signed URLs.
  */
 router.get('/{*filePath}', async (req, res) => {
     const raw = req.params.filePath;
@@ -32,10 +21,29 @@ router.get('/{*filePath}', async (req, res) => {
         res.status(400).json({ error: 'File path required' });
         return;
     }
+    // Validate signed token if provided
+    const token = req.query.token;
+    if (token) {
+        const secret = process.env.JWT_SECRET;
+        if (!secret) {
+            res.status(500).json({ error: 'Server not configured for signed URLs' });
+            return;
+        }
+        try {
+            const decoded = jsonwebtoken_1.default.verify(token, secret);
+            if (decoded.purpose !== 'file-download' || decoded.filePath !== filePath.replace(/^\/+/, '')) {
+                res.status(403).json({ error: 'Token does not match requested file' });
+                return;
+            }
+        }
+        catch {
+            res.status(403).json({ error: 'Invalid or expired token' });
+            return;
+        }
+    }
     try {
         const stream = await (0, storage_1.getStorageBackend)().createReadStream(filePath);
-        const ext = path_1.default.extname(filePath).toLowerCase();
-        const contentType = MIME_TYPES[ext] || 'application/octet-stream';
+        const contentType = (0, mime_1.mimeFromPath)(filePath);
         res.setHeader('Content-Type', contentType);
         res.setHeader('Cache-Control', 'public, max-age=300');
         stream.pipe(res);

package/build/routes/index.js

@@ -23,10 +23,12 @@ const settings_1 = __importDefault(require("./settings"));
 const mcp_runs_1 = __importDefault(require("./mcp-runs"));
 const namespaces_1 = __importDefault(require("./namespaces"));
 const files_1 = __importDefault(require("./files"));
+const file_browser_1 = __importDefault(require("./file-browser"));
 const controlplane_1 = __importDefault(require("./controlplane"));
 const bot_accounts_1 = __importDefault(require("./bot-accounts"));
 const docs_1 = __importDefault(require("./docs"));
 const workflow_sets_1 = __importDefault(require("./workflow-sets"));
+const knowledge_1 = __importDefault(require("./knowledge"));
 const router = (0, express_1.Router)();
 // Public routes (no auth required — they handle their own auth)
 router.use('/auth', auth_2.default);
@@ -49,8 +51,10 @@ router.use('/insight', insight_1.default);
 router.use('/yaml-workflows', yaml_workflows_1.default);
 router.use('/mcp-runs', mcp_runs_1.default);
 router.use('/namespaces', namespaces_1.default);
+router.use('/file-browser', file_browser_1.default);
 router.use('/controlplane', controlplane_1.default);
 router.use('/bot-accounts', bot_accounts_1.default);
 router.use('/docs', docs_1.default);
 router.use('/workflow-sets', workflow_sets_1.default);
+router.use('/knowledge', knowledge_1.default);
 exports.default = router;

package/build/routes/knowledge.d.ts

@@ -0,0 +1,2 @@
+declare const router: import("express-serve-static-core").Router;
+export default router;