@roj-ai/sdk 0.1.35 → 0.2.1

package/dist/transport/http/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../src/transport/http/index.ts"],"names":[],"mappings":"AAAA;;GAEG;AAEH,OAAO,EAAE,SAAS,EAAE,MAAM,UAAU,CAAA;AACpC,YAAY,EAAE,MAAM,EAAE,MAAM,UAAU,CAAA;AACtC,OAAO,EAAE,YAAY,EAAE,MAAM,+BAA+B,CAAA"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../src/transport/http/index.ts"],"names":[],"mappings":"AAAA;;GAEG;AAEH,OAAO,EAAE,SAAS,EAAE,MAAM,UAAU,CAAA;AACpC,YAAY,EAAE,MAAM,EAAE,MAAM,cAAc,CAAA;AAC1C,OAAO,EAAE,YAAY,EAAE,MAAM,+BAA+B,CAAA"}

package/dist/transport/http/middleware/bearer-auth.d.ts

@@ -5,7 +5,7 @@
  * Only active when agentToken is configured (worker mode).
  */
 import type { MiddlewareHandler } from 'hono';
-import type { AppEnv } from '../app.js';
+import type { AppEnv } from '../context.js';
 /**
  * Creates bearer auth middleware.
  * Returns 401 if token is invalid or missing (when required).

package/dist/transport/http/middleware/bearer-auth.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"bearer-auth.d.ts","sourceRoot":"","sources":["../../../../src/transport/http/middleware/bearer-auth.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAEH,OAAO,KAAK,EAAE,iBAAiB,EAAE,MAAM,MAAM,CAAA;AAC7C,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,WAAW,CAAA;AAEvC;;;;;GAKG;AACH,wBAAgB,gBAAgB,CAAC,aAAa,EAAE,MAAM,GAAG,SAAS,GAAG,iBAAiB,CAAC,MAAM,CAAC,CAuB7F"}
+{"version":3,"file":"bearer-auth.d.ts","sourceRoot":"","sources":["../../../../src/transport/http/middleware/bearer-auth.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAEH,OAAO,KAAK,EAAE,iBAAiB,EAAE,MAAM,MAAM,CAAA;AAC7C,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,eAAe,CAAA;AAE3C;;;;;GAKG;AACH,wBAAgB,gBAAgB,CAAC,aAAa,EAAE,MAAM,GAAG,SAAS,GAAG,iBAAiB,CAAC,MAAM,CAAC,CAuB7F"}

package/dist/transport/http/middleware/error-handler.d.ts

@@ -8,7 +8,7 @@
  * - Unknown errors (logged and returned as 500)
  */
 import type { Context } from 'hono';
-import type { AppEnv } from '../app.js';
+import type { AppEnv } from '../context.js';
 /**
  * Global error handler for Hono app.
  */
@@ -17,5 +17,5 @@ export declare const errorHandler: (error: Error, c: Context<AppEnv>) => Respons
         type: string;
         message: string;
     };
-}, 100 | 500 | 404 | 409 | 400 | 403 | -1 | 200 | 429 | 401 | 300 | 501 | 201 | 510 | 102 | 103 | 202 | 203 | 206 | 207 | 208 | 226 | 301 | 302 | 303 | 305 | 306 | 307 | 308 | 402 | 405 | 406 | 407 | 408 | 410 | 411 | 412 | 413 | 414 | 415 | 416 | 417 | 418 | 421 | 422 | 423 | 424 | 425 | 426 | 428 | 431 | 451 | 502 | 503 | 504 | 505 | 506 | 507 | 508 | 511, "json">;
+}, 404 | 409 | 400 | 403 | 100 | -1 | 500 | 200 | 429 | 401 | 300 | 102 | 103 | 201 | 202 | 203 | 206 | 207 | 208 | 226 | 301 | 302 | 303 | 305 | 306 | 307 | 308 | 402 | 405 | 406 | 407 | 408 | 410 | 411 | 412 | 413 | 414 | 415 | 416 | 417 | 418 | 421 | 422 | 423 | 424 | 425 | 426 | 428 | 431 | 451 | 501 | 502 | 503 | 504 | 505 | 506 | 507 | 508 | 510 | 511, "json">;
 //# sourceMappingURL=error-handler.d.ts.map

package/dist/transport/http/middleware/error-handler.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"error-handler.d.ts","sourceRoot":"","sources":["../../../../src/transport/http/middleware/error-handler.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AAEH,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,MAAM,CAAA;AAInC,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,WAAW,CAAA;AAEvC;;GAEG;AACH,eAAO,MAAM,YAAY,GAAI,OAAO,KAAK,EAAE,GAAG,OAAO,CAAC,MAAM,CAAC;;;;;gXAwD5D,CAAA"}
+{"version":3,"file":"error-handler.d.ts","sourceRoot":"","sources":["../../../../src/transport/http/middleware/error-handler.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AAEH,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,MAAM,CAAA;AAInC,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,eAAe,CAAA;AAE3C;;GAEG;AACH,eAAO,MAAM,YAAY,GAAI,OAAO,KAAK,EAAE,GAAG,OAAO,CAAC,MAAM,CAAC;;;;;gXAwD5D,CAAA"}

package/dist/transport/http/path-containment.d.ts

@@ -0,0 +1,20 @@
+/**
+ * Containment check shared by every route that serves a file off disk.
+ *
+ * A lexical check (`resolve()` then a prefix compare) only sees the path string.
+ * The agent can write inside the session directory — the shell plugin binds it
+ * into the sandbox read-write — so it can leave a symlink there pointing at any
+ * file the process can read. Only realpath-ing both ends catches that, and it
+ * has to happen after the path is resolved, not before.
+ */
+import { type AppContext } from './context.js';
+export type CanonicalPathResult = {
+    status: 'ok';
+    path: string;
+} | {
+    status: 'not_found';
+} | {
+    status: 'forbidden';
+};
+export declare function resolveCanonicalPath(c: AppContext, rootPath: string, targetPath: string): Promise<CanonicalPathResult>;
+//# sourceMappingURL=path-containment.d.ts.map

package/dist/transport/http/path-containment.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"path-containment.d.ts","sourceRoot":"","sources":["../../../src/transport/http/path-containment.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AAGH,OAAO,EAAE,KAAK,UAAU,EAAe,MAAM,cAAc,CAAA;AAE3D,MAAM,MAAM,mBAAmB,GAC5B;IAAE,MAAM,EAAE,IAAI,CAAC;IAAC,IAAI,EAAE,MAAM,CAAA;CAAE,GAC9B;IAAE,MAAM,EAAE,WAAW,CAAA;CAAE,GACvB;IAAE,MAAM,EAAE,WAAW,CAAA;CAAE,CAAA;AAE1B,wBAAsB,oBAAoB,CACzC,CAAC,EAAE,UAAU,EACb,QAAQ,EAAE,MAAM,EAChB,UAAU,EAAE,MAAM,GAChB,OAAO,CAAC,mBAAmB,CAAC,CAqB9B"}

package/dist/transport/http/path-containment.js

@@ -0,0 +1,31 @@
+/**
+ * Containment check shared by every route that serves a file off disk.
+ *
+ * A lexical check (`resolve()` then a prefix compare) only sees the path string.
+ * The agent can write inside the session directory — the shell plugin binds it
+ * into the sandbox read-write — so it can leave a symlink there pointing at any
+ * file the process can read. Only realpath-ing both ends catches that, and it
+ * has to happen after the path is resolved, not before.
+ */
+import { isAbsolute, relative, sep } from 'node:path';
+import { getServices } from './context.js';
+export async function resolveCanonicalPath(c, rootPath, targetPath) {
+    const { platform } = getServices(c);
+    let canonicalRoot;
+    let canonicalTarget;
+    try {
+        canonicalRoot = await platform.fs.realpath(rootPath);
+        canonicalTarget = await platform.fs.realpath(targetPath);
+    }
+    catch {
+        return { status: 'not_found' };
+    }
+    const relativeTarget = relative(canonicalRoot, canonicalTarget);
+    const isContained = relativeTarget === '' || (!isAbsolute(relativeTarget)
+        && relativeTarget !== '..'
+        && !relativeTarget.startsWith(`..${sep}`));
+    return isContained
+        ? { status: 'ok', path: canonicalTarget }
+        : { status: 'forbidden' };
+}
+//# sourceMappingURL=path-containment.js.map

package/dist/transport/http/path-containment.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"path-containment.js","sourceRoot":"","sources":["../../../src/transport/http/path-containment.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AAEH,OAAO,EAAE,UAAU,EAAE,QAAQ,EAAE,GAAG,EAAE,MAAM,WAAW,CAAA;AACrD,OAAO,EAAmB,WAAW,EAAE,MAAM,cAAc,CAAA;AAO3D,MAAM,CAAC,KAAK,UAAU,oBAAoB,CACzC,CAAa,EACb,QAAgB,EAChB,UAAkB;IAElB,MAAM,EAAE,QAAQ,EAAE,GAAG,WAAW,CAAC,CAAC,CAAC,CAAA;IACnC,IAAI,aAAqB,CAAA;IACzB,IAAI,eAAuB,CAAA;IAC3B,IAAI,CAAC;QACJ,aAAa,GAAG,MAAM,QAAQ,CAAC,EAAE,CAAC,QAAQ,CAAC,QAAQ,CAAC,CAAA;QACpD,eAAe,GAAG,MAAM,QAAQ,CAAC,EAAE,CAAC,QAAQ,CAAC,UAAU,CAAC,CAAA;IACzD,CAAC;IAAC,MAAM,CAAC;QACR,OAAO,EAAE,MAAM,EAAE,WAAW,EAAE,CAAA;IAC/B,CAAC;IAED,MAAM,cAAc,GAAG,QAAQ,CAAC,aAAa,EAAE,eAAe,CAAC,CAAA;IAC/D,MAAM,WAAW,GAAG,cAAc,KAAK,EAAE,IAAI,CAC5C,CAAC,UAAU,CAAC,cAAc,CAAC;WACxB,cAAc,KAAK,IAAI;WACvB,CAAC,cAAc,CAAC,UAAU,CAAC,KAAK,GAAG,EAAE,CAAC,CACzC,CAAA;IAED,OAAO,WAAW;QACjB,CAAC,CAAC,EAAE,MAAM,EAAE,IAAI,EAAE,IAAI,EAAE,eAAe,EAAE;QACzC,CAAC,CAAC,EAAE,MAAM,EAAE,WAAW,EAAE,CAAA;AAC3B,CAAC"}

package/dist/transport/http/responses.d.ts

@@ -0,0 +1,30 @@
+/**
+ * Error responses shared by the HTTP routes.
+ *
+ * Every route used to hand-write `{ error: { type, message } }` inline — four
+ * copies of the session 404 and four of the parse 400 — so nothing enforced the
+ * envelope and a client parsing errors had no single contract to code against.
+ * The status codes and the `type` strings are the wire contract; keep them here.
+ */
+import type { DomainError } from '../../core/errors.js';
+import type { AppContext } from './context.js';
+export declare const sessionNotFound: (c: AppContext, sessionId: string) => Response & import("hono").TypedResponse<{
+    error: {
+        type: string;
+        message: string;
+    };
+}, 404, "json">;
+/** 400 is the checked id constructor's own status; the rejected value is deliberately not echoed back. */
+export declare const invalidSessionId: (c: AppContext, error: DomainError) => Response & import("hono").TypedResponse<{
+    error: {
+        type: string;
+        message: string;
+    };
+}, 400, "json">;
+export declare const parseError: (c: AppContext, message: string) => Response & import("hono").TypedResponse<{
+    error: {
+        type: string;
+        message: string;
+    };
+}, 400, "json">;
+//# sourceMappingURL=responses.d.ts.map

package/dist/transport/http/responses.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"responses.d.ts","sourceRoot":"","sources":["../../../src/transport/http/responses.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AACH,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,kBAAkB,CAAA;AACnD,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,cAAc,CAAA;AAE9C,eAAO,MAAM,eAAe,GAAI,GAAG,UAAU,EAAE,WAAW,MAAM;;;;;eACkC,CAAA;AAElG,0GAA0G;AAC1G,eAAO,MAAM,gBAAgB,GAAI,GAAG,UAAU,EAAE,OAAO,WAAW;;;;;eACG,CAAA;AAErE,eAAO,MAAM,UAAU,GAAI,GAAG,UAAU,EAAE,SAAS,MAAM;;;;;eACA,CAAA"}

package/dist/transport/http/responses.js

@@ -0,0 +1,5 @@
+export const sessionNotFound = (c, sessionId) => c.json({ error: { type: 'session_not_found', message: `Session not found: ${sessionId}` } }, 404);
+/** 400 is the checked id constructor's own status; the rejected value is deliberately not echoed back. */
+export const invalidSessionId = (c, error) => c.json({ error: { type: error.type, message: error.message } }, 400);
+export const parseError = (c, message) => c.json({ error: { type: 'parse_error', message } }, 400);
+//# sourceMappingURL=responses.js.map

package/dist/transport/http/responses.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"responses.js","sourceRoot":"","sources":["../../../src/transport/http/responses.ts"],"names":[],"mappings":"AAWA,MAAM,CAAC,MAAM,eAAe,GAAG,CAAC,CAAa,EAAE,SAAiB,EAAE,EAAE,CACnE,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,EAAE,IAAI,EAAE,mBAAmB,EAAE,OAAO,EAAE,sBAAsB,SAAS,EAAE,EAAE,EAAE,EAAE,GAAG,CAAC,CAAA;AAElG,0GAA0G;AAC1G,MAAM,CAAC,MAAM,gBAAgB,GAAG,CAAC,CAAa,EAAE,KAAkB,EAAE,EAAE,CACrE,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,EAAE,IAAI,EAAE,KAAK,CAAC,IAAI,EAAE,OAAO,EAAE,KAAK,CAAC,OAAO,EAAE,EAAE,EAAE,GAAG,CAAC,CAAA;AAErE,MAAM,CAAC,MAAM,UAAU,GAAG,CAAC,CAAa,EAAE,OAAe,EAAE,EAAE,CAC5D,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,EAAE,IAAI,EAAE,aAAa,EAAE,OAAO,EAAE,EAAE,EAAE,GAAG,CAAC,CAAA"}

package/dist/transport/http/routes/files.d.ts

@@ -5,7 +5,7 @@
  * Used by the debug UI to display images from LLM call logs.
  */
 import { Hono } from 'hono';
-import { type AppEnv } from '../app.js';
+import { type AppEnv } from '../context.js';
 /**
  * Creates file proxy routes.
  *

package/dist/transport/http/routes/files.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"files.d.ts","sourceRoot":"","sources":["../../../../src/transport/http/routes/files.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAEH,OAAO,EAAE,IAAI,EAAE,MAAM,MAAM,CAAA;AAG3B,OAAO,EAAmB,KAAK,MAAM,EAAe,MAAM,WAAW,CAAA;AAoMrE;;;;;GAKG;AACH,wBAAgB,gBAAgB,IAAI,IAAI,CAAC,MAAM,CAAC,CA6D/C"}
+{"version":3,"file":"files.d.ts","sourceRoot":"","sources":["../../../../src/transport/http/routes/files.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAEH,OAAO,EAAE,IAAI,EAAE,MAAM,MAAM,CAAA;AAI3B,OAAO,EAAmB,KAAK,MAAM,EAAe,MAAM,eAAe,CAAA;AAiEzE;;;;;GAKG;AACH,wBAAgB,gBAAgB,IAAI,IAAI,CAAC,MAAM,CAAC,CAqG/C"}

package/dist/transport/http/routes/files.js

@@ -5,146 +5,15 @@
  * Used by the debug UI to display images from LLM call logs.
  */
 import { Hono } from 'hono';
-import { extname, resolve } from 'node:path';
-import { SessionId } from '../../../core/sessions/schema.js';
-import { getServices } from '../app.js';
-// ============================================================================
-// Constants
-// ============================================================================
-/** Known MIME types for specific extensions. */
-const MIME_TYPES = {
-    // Images
-    '.jpg': 'image/jpeg',
-    '.jpeg': 'image/jpeg',
-    '.png': 'image/png',
-    '.gif': 'image/gif',
-    '.webp': 'image/webp',
-    '.svg': 'image/svg+xml',
-    '.ico': 'image/x-icon',
-    '.bmp': 'image/bmp',
-    '.avif': 'image/avif',
-    // Video
-    '.mp4': 'video/mp4',
-    '.webm': 'video/webm',
-    '.mov': 'video/quicktime',
-    // Audio
-    '.mp3': 'audio/mpeg',
-    '.wav': 'audio/wav',
-    '.ogg': 'audio/ogg',
-    // Documents
-    '.pdf': 'application/pdf',
-    // Data/markup
-    '.json': 'application/json',
-    '.html': 'text/html',
-    '.css': 'text/css',
-    '.js': 'application/javascript',
-    '.mjs': 'application/javascript',
-    '.xml': 'text/xml',
-    '.yaml': 'text/yaml',
-    '.yml': 'text/yaml',
-    '.md': 'text/markdown',
-    // Archives
-    '.zip': 'application/zip',
-    '.tar': 'application/x-tar',
-    '.gz': 'application/gzip',
-    // Fonts
-    '.woff': 'font/woff',
-    '.woff2': 'font/woff2',
-    '.ttf': 'font/ttf',
-    '.otf': 'font/otf',
-    // Binary
-    '.wasm': 'application/wasm',
-};
-/** Extensions known to be binary — files that cannot be displayed as text. */
-const BINARY_EXTENSIONS = new Set([
-    // Images
-    '.jpg',
-    '.jpeg',
-    '.png',
-    '.gif',
-    '.webp',
-    '.bmp',
-    '.ico',
-    '.tiff',
-    '.tif',
-    '.avif',
-    // Video
-    '.mp4',
-    '.webm',
-    '.avi',
-    '.mov',
-    '.mkv',
-    '.flv',
-    '.wmv',
-    // Audio
-    '.mp3',
-    '.wav',
-    '.ogg',
-    '.flac',
-    '.aac',
-    '.wma',
-    '.m4a',
-    // Archives
-    '.zip',
-    '.tar',
-    '.gz',
-    '.bz2',
-    '.xz',
-    '.7z',
-    '.rar',
-    '.zst',
-    // Documents (binary)
-    '.pdf',
-    '.doc',
-    '.docx',
-    '.xls',
-    '.xlsx',
-    '.ppt',
-    '.pptx',
-    '.odt',
-    // Fonts
-    '.woff',
-    '.woff2',
-    '.ttf',
-    '.otf',
-    '.eot',
-    // Compiled/binary
-    '.wasm',
-    '.exe',
-    '.dll',
-    '.so',
-    '.dylib',
-    '.o',
-    '.a',
-    '.class',
-    '.pyc',
-    '.pyo',
-    // Database
-    '.sqlite',
-    '.db',
-    '.sqlite3',
-    // Other
-    '.bin',
-    '.dat',
-]);
+import { resolve } from 'node:path';
+import { getMimeType, preventTraversal } from '../../../plugins/filesystem/listing.js';
+import { parseSessionId } from '../../../core/sessions/schema.js';
+import { getServices } from '../context.js';
+import { resolveCanonicalPath } from '../path-containment.js';
+import { invalidSessionId } from '../responses.js';
 // ============================================================================
 // Helpers
 // ============================================================================
-/**
- * Determine MIME type for a file.
- * Known extensions get their specific MIME type, known binary extensions
- * get `application/octet-stream`, everything else defaults to `text/plain`
- * so that code/config files (.astro, .vue, .svelte, .go, .rs, etc.)
- * are previewable as text.
- */
-function getMimeType(filePath) {
-    const ext = extname(filePath).toLowerCase();
-    if (MIME_TYPES[ext])
-        return MIME_TYPES[ext];
-    if (BINARY_EXTENSIONS.has(ext))
-        return 'application/octet-stream';
-    return 'text/plain';
-}
 /**
  * Extract the wildcard path suffix from a request.
  *
@@ -155,16 +24,14 @@ function extractWildcardPath(c, marker) {
     const idx = c.req.path.indexOf(`/${marker}/`);
     if (idx === -1)
         return '';
-    return c.req.path.slice(idx + marker.length + 2);
-}
-function preventTraversal(baseDir, requestedPath) {
-    const resolved = resolve(baseDir, requestedPath);
-    if (!resolved.startsWith(baseDir + '/') && resolved !== baseDir) {
-        return null;
+    try {
+        return decodeURIComponent(c.req.path.slice(idx + marker.length + 2));
+    }
+    catch {
+        return '';
     }
-    return resolved;
 }
-async function serveFile(c, filePath) {
+async function serveFile(c, filePath, mimePath) {
     const { platform } = getServices(c);
     let data;
     try {
@@ -173,21 +40,29 @@ async function serveFile(c, filePath) {
     catch {
         return c.json({ error: { type: 'not_found', message: 'File not found' } }, 404);
     }
-    const contentType = getMimeType(filePath);
+    const contentType = getMimeType(mimePath);
     return new Response(data, {
         headers: {
             'Content-Type': contentType,
             'Content-Length': data.length.toString(),
             'Cache-Control': 'public, max-age=3600',
+            // Bodies here are attacker-influenced (uploads, injected resources, anything the agent writes).
+            'X-Content-Type-Options': 'nosniff',
+            'Content-Security-Policy': "default-src 'none'; sandbox",
         },
     });
 }
 async function resolveWorkspaceDir(c, sessionId) {
     const { sessionRuntime } = getServices(c);
-    const result = await sessionRuntime.getSession(SessionId(sessionId));
+    const result = await sessionRuntime.acquireSessionLease(sessionId, 'http:files');
     if (!result.ok)
         return null;
-    return result.value.state.workspaceDir ?? null;
+    try {
+        return result.value.session.state.workspaceDir ?? null;
+    }
+    finally {
+        result.value.release();
+    }
 }
 // ============================================================================
 // Routes
@@ -202,27 +77,44 @@ export function createFileRoutes() {
     const app = new Hono();
     // --- Serve session file ---
     app.get('/:sessionId/files/*', async (c) => {
-        const { config } = getServices(c);
-        const sessionId = c.req.param('sessionId');
+        const { dataFileStore } = getServices(c);
+        const sessionIdResult = parseSessionId(c.req.param('sessionId'));
+        if (!sessionIdResult.ok)
+            return invalidSessionId(c, sessionIdResult.error);
         const filePath = extractWildcardPath(c, 'files');
         if (!filePath) {
             return c.json({ error: { type: 'validation_error', message: 'File path is required' } }, 400);
         }
-        const sessionDir = resolve(config.dataPath, 'sessions', sessionId);
+        // Build the root through the store's guard: `resolve(dataPath, ...)` would happily
+        // escape the data root on an id Hono decoded from `%2F`.
+        const sessionDirResult = dataFileStore.realPath(`sessions/${sessionIdResult.value}`);
+        if (!sessionDirResult.ok) {
+            return c.json({ error: { type: 'forbidden', message: 'Path traversal not allowed' } }, 403);
+        }
+        const sessionDir = sessionDirResult.value;
         const resolvedPath = preventTraversal(sessionDir, filePath);
         if (!resolvedPath) {
             return c.json({ error: { type: 'forbidden', message: 'Path traversal not allowed' } }, 403);
         }
-        return serveFile(c, resolvedPath);
+        const canonicalPath = await resolveCanonicalPath(c, sessionDir, resolvedPath);
+        if (canonicalPath.status === 'forbidden') {
+            return c.json({ error: { type: 'forbidden', message: 'Symlink traversal not allowed' } }, 403);
+        }
+        if (canonicalPath.status === 'not_found') {
+            return c.json({ error: { type: 'not_found', message: 'File not found' } }, 404);
+        }
+        return serveFile(c, canonicalPath.path, resolvedPath);
     });
     // --- Serve workspace file ---
     app.get('/:sessionId/workspace/*', async (c) => {
-        const sessionId = c.req.param('sessionId');
+        const sessionIdResult = parseSessionId(c.req.param('sessionId'));
+        if (!sessionIdResult.ok)
+            return invalidSessionId(c, sessionIdResult.error);
         const filePath = extractWildcardPath(c, 'workspace');
         if (!filePath) {
             return c.json({ error: { type: 'validation_error', message: 'File path is required' } }, 400);
         }
-        const workspaceDir = await resolveWorkspaceDir(c, sessionId);
+        const workspaceDir = await resolveWorkspaceDir(c, sessionIdResult.value);
         if (!workspaceDir) {
             return c.json({ error: { type: 'not_found', message: 'No workspace configured for this session' } }, 404);
         }
@@ -230,7 +122,14 @@ export function createFileRoutes() {
         if (!resolvedPath) {
             return c.json({ error: { type: 'forbidden', message: 'Path traversal not allowed' } }, 403);
         }
-        return serveFile(c, resolvedPath);
+        const canonicalPath = await resolveCanonicalPath(c, workspaceDir, resolvedPath);
+        if (canonicalPath.status === 'forbidden') {
+            return c.json({ error: { type: 'forbidden', message: 'Symlink traversal not allowed' } }, 403);
+        }
+        if (canonicalPath.status === 'not_found') {
+            return c.json({ error: { type: 'not_found', message: 'File not found' } }, 404);
+        }
+        return serveFile(c, canonicalPath.path, resolvedPath);
     });
     return app;
 }

package/dist/transport/http/routes/files.js.map

@@ -1 +1 @@
-{"version":3,"file":"files.js","sourceRoot":"","sources":["../../../../src/transport/http/routes/files.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAEH,OAAO,EAAE,IAAI,EAAE,MAAM,MAAM,CAAA;AAC3B,OAAO,EAAE,OAAO,EAAE,OAAO,EAAE,MAAM,WAAW,CAAA;AAC5C,OAAO,EAAE,SAAS,EAAE,MAAM,2BAA2B,CAAA;AACrD,OAAO,EAAgC,WAAW,EAAE,MAAM,WAAW,CAAA;AAErE,+EAA+E;AAC/E,YAAY;AACZ,+EAA+E;AAE/E,gDAAgD;AAChD,MAAM,UAAU,GAA2B;IAC1C,SAAS;IACT,MAAM,EAAE,YAAY;IACpB,OAAO,EAAE,YAAY;IACrB,MAAM,EAAE,WAAW;IACnB,MAAM,EAAE,WAAW;IACnB,OAAO,EAAE,YAAY;IACrB,MAAM,EAAE,eAAe;IACvB,MAAM,EAAE,cAAc;IACtB,MAAM,EAAE,WAAW;IACnB,OAAO,EAAE,YAAY;IACrB,QAAQ;IACR,MAAM,EAAE,WAAW;IACnB,OAAO,EAAE,YAAY;IACrB,MAAM,EAAE,iBAAiB;IACzB,QAAQ;IACR,MAAM,EAAE,YAAY;IACpB,MAAM,EAAE,WAAW;IACnB,MAAM,EAAE,WAAW;IACnB,YAAY;IACZ,MAAM,EAAE,iBAAiB;IACzB,cAAc;IACd,OAAO,EAAE,kBAAkB;IAC3B,OAAO,EAAE,WAAW;IACpB,MAAM,EAAE,UAAU;IAClB,KAAK,EAAE,wBAAwB;IAC/B,MAAM,EAAE,wBAAwB;IAChC,MAAM,EAAE,UAAU;IAClB,OAAO,EAAE,WAAW;IACpB,MAAM,EAAE,WAAW;IACnB,KAAK,EAAE,eAAe;IACtB,WAAW;IACX,MAAM,EAAE,iBAAiB;IACzB,MAAM,EAAE,mBAAmB;IAC3B,KAAK,EAAE,kBAAkB;IACzB,QAAQ;IACR,OAAO,EAAE,WAAW;IACpB,QAAQ,EAAE,YAAY;IACtB,MAAM,EAAE,UAAU;IAClB,MAAM,EAAE,UAAU;IAClB,SAAS;IACT,OAAO,EAAE,kBAAkB;CAC3B,CAAA;AAED,8EAA8E;AAC9E,MAAM,iBAAiB,GAAG,IAAI,GAAG,CAAC;IACjC,SAAS;IACT,MAAM;IACN,OAAO;IACP,MAAM;IACN,MAAM;IACN,OAAO;IACP,MAAM;IACN,MAAM;IACN,OAAO;IACP,MAAM;IACN,OAAO;IACP,QAAQ;IACR,MAAM;IACN,OAAO;IACP,MAAM;IACN,MAAM;IACN,MAAM;IACN,MAAM;IACN,MAAM;IACN,QAAQ;IACR,MAAM;IACN,MAAM;IACN,MAAM;IACN,OAAO;IACP,MAAM;IACN,MAAM;IACN,MAAM;IACN,WAAW;IACX,MAAM;IACN,MAAM;IACN,KAAK;IACL,MAAM;IACN,KAAK;IACL,KAAK;IACL,MAAM;IACN,MAAM;IACN,qBAAqB;IACrB,MAAM;IACN,MAAM;IACN,OAAO;IACP,MAAM;IACN,OAAO;IACP,MAAM;IACN,OAAO;IACP,MAAM;IACN,QAAQ;IACR,OAAO;IACP,QAAQ;IACR,MAAM;IACN,MAAM;IACN,MAAM;IACN,kBAAkB;IAClB,OAAO;IACP,MAAM;IACN,MAAM;IACN,KAAK;IACL,QAAQ;IACR,IAAI;IACJ,IAAI;IACJ,QAAQ;IACR,MAAM;IACN,MAAM;IACN,WAAW;IACX,SAAS;IACT,KAAK;IACL,UAAU;IACV,QAAQ;IACR,MAAM;IACN,MAAM;CACN,CAAC,CAAA;AAEF,+EAA+E;AAC/E,UAAU;AACV,+EAA+E;AAE/E;;;;;;GAMG;AACH,SAAS,WAAW,CAAC,QAAgB;IACpC,MAAM,GAAG,GAAG,OAAO,CAAC,QAAQ,CAAC,CAAC,WAAW,EAAE,CAAA;IAC3C,IAAI,UAAU,CAAC,GAAG,CAAC;QAAE,OAAO,UAAU,CAAC,GAAG,CAAC,CAAA;IAC3C,IAAI,iBAAiB,CAAC,GAAG,CAAC,GAAG,CAAC;QAAE,OAAO,0BAA0B,CAAA;IACjE,OAAO,YAAY,CAAA;AACpB,CAAC;AAED;;;;;GAKG;AACH,SAAS,mBAAmB,CAAC,CAAa,EAAE,MAAc;IACzD,MAAM,GAAG,GAAG,CAAC,CAAC,GAAG,CAAC,IAAI,CAAC,OAAO,CAAC,IAAI,MAAM,GAAG,CAAC,CAAA;IAC7C,IAAI,GAAG,KAAK,CAAC,CAAC;QAAE,OAAO,EAAE,CAAA;IACzB,OAAO,CAAC,CAAC,GAAG,CAAC,IAAI,CAAC,KAAK,CAAC,GAAG,GAAG,MAAM,CAAC,MAAM,GAAG,CAAC,CAAC,CAAA;AACjD,CAAC;AAED,SAAS,gBAAgB,CAAC,OAAe,EAAE,aAAqB;IAC/D,MAAM,QAAQ,GAAG,OAAO,CAAC,OAAO,EAAE,aAAa,CAAC,CAAA;IAChD,IAAI,CAAC,QAAQ,CAAC,UAAU,CAAC,OAAO,GAAG,GAAG,CAAC,IAAI,QAAQ,KAAK,OAAO,EAAE,CAAC;QACjE,OAAO,IAAI,CAAA;IACZ,CAAC;IACD,OAAO,QAAQ,CAAA;AAChB,CAAC;AAED,KAAK,UAAU,SAAS,CAAC,CAAa,EAAE,QAAgB;IACvD,MAAM,EAAE,QAAQ,EAAE,GAAG,WAAW,CAAC,CAAC,CAAC,CAAA;IACnC,IAAI,IAAY,CAAA;IAChB,IAAI,CAAC;QACJ,IAAI,GAAG,MAAM,QAAQ,CAAC,EAAE,CAAC,QAAQ,CAAC,QAAQ,CAAC,CAAA;IAC5C,CAAC;IAAC,MAAM,CAAC;QACR,OAAO,CAAC,CAAC,IAAI,CACZ,EAAE,KAAK,EAAE,EAAE,IAAI,EAAE,WAAW,EAAE,OAAO,EAAE,gBAAgB,EAAE,EAAE,EAC3D,GAAG,CACH,CAAA;IACF,CAAC;IAED,MAAM,WAAW,GAAG,WAAW,CAAC,QAAQ,CAAC,CAAA;IAEzC,OAAO,IAAI,QAAQ,CAAC,IAAI,EAAE;QACzB,OAAO,EAAE;YACR,cAAc,EAAE,WAAW;YAC3B,gBAAgB,EAAE,IAAI,CAAC,MAAM,CAAC,QAAQ,EAAE;YACxC,eAAe,EAAE,sBAAsB;SACvC;KACD,CAAC,CAAA;AACH,CAAC;AAED,KAAK,UAAU,mBAAmB,CAAC,CAAa,EAAE,SAAiB;IAClE,MAAM,EAAE,cAAc,EAAE,GAAG,WAAW,CAAC,CAAC,CAAC,CAAA;IACzC,MAAM,MAAM,GAAG,MAAM,cAAc,CAAC,UAAU,CAAC,SAAS,CAAC,SAAS,CAAC,CAAC,CAAA;IACpE,IAAI,CAAC,MAAM,CAAC,EAAE;QAAE,OAAO,IAAI,CAAA;IAC3B,OAAO,MAAM,CAAC,KAAK,CAAC,KAAK,CAAC,YAAY,IAAI,IAAI,CAAA;AAC/C,CAAC;AAED,+EAA+E;AAC/E,SAAS;AACT,+EAA+E;AAE/E;;;;;GAKG;AACH,MAAM,UAAU,gBAAgB;IAC/B,MAAM,GAAG,GAAG,IAAI,IAAI,EAAU,CAAA;IAE9B,6BAA6B;IAC7B,GAAG,CAAC,GAAG,CAAC,qBAAqB,EAAE,KAAK,EAAE,CAAa,EAAE,EAAE;QACtD,MAAM,EAAE,MAAM,EAAE,GAAG,WAAW,CAAC,CAAC,CAAC,CAAA;QACjC,MAAM,SAAS,GAAG,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC,WAAW,CAAE,CAAA;QAC3C,MAAM,QAAQ,GAAG,mBAAmB,CAAC,CAAC,EAAE,OAAO,CAAC,CAAA;QAEhD,IAAI,CAAC,QAAQ,EAAE,CAAC;YACf,OAAO,CAAC,CAAC,IAAI,CACZ,EAAE,KAAK,EAAE,EAAE,IAAI,EAAE,kBAAkB,EAAE,OAAO,EAAE,uBAAuB,EAAE,EAAE,EACzE,GAAG,CACH,CAAA;QACF,CAAC;QAED,MAAM,UAAU,GAAG,OAAO,CAAC,MAAM,CAAC,QAAQ,EAAE,UAAU,EAAE,SAAS,CAAC,CAAA;QAClE,MAAM,YAAY,GAAG,gBAAgB,CAAC,UAAU,EAAE,QAAQ,CAAC,CAAA;QAE3D,IAAI,CAAC,YAAY,EAAE,CAAC;YACnB,OAAO,CAAC,CAAC,IAAI,CACZ,EAAE,KAAK,EAAE,EAAE,IAAI,EAAE,WAAW,EAAE,OAAO,EAAE,4BAA4B,EAAE,EAAE,EACvE,GAAG,CACH,CAAA;QACF,CAAC;QAED,OAAO,SAAS,CAAC,CAAC,EAAE,YAAY,CAAC,CAAA;IAClC,CAAC,CAAC,CAAA;IAEF,+BAA+B;IAC/B,GAAG,CAAC,GAAG,CAAC,yBAAyB,EAAE,KAAK,EAAE,CAAa,EAAE,EAAE;QAC1D,MAAM,SAAS,GAAG,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC,WAAW,CAAE,CAAA;QAC3C,MAAM,QAAQ,GAAG,mBAAmB,CAAC,CAAC,EAAE,WAAW,CAAC,CAAA;QAEpD,IAAI,CAAC,QAAQ,EAAE,CAAC;YACf,OAAO,CAAC,CAAC,IAAI,CACZ,EAAE,KAAK,EAAE,EAAE,IAAI,EAAE,kBAAkB,EAAE,OAAO,EAAE,uBAAuB,EAAE,EAAE,EACzE,GAAG,CACH,CAAA;QACF,CAAC;QAED,MAAM,YAAY,GAAG,MAAM,mBAAmB,CAAC,CAAC,EAAE,SAAS,CAAC,CAAA;QAC5D,IAAI,CAAC,YAAY,EAAE,CAAC;YACnB,OAAO,CAAC,CAAC,IAAI,CACZ,EAAE,KAAK,EAAE,EAAE,IAAI,EAAE,WAAW,EAAE,OAAO,EAAE,0CAA0C,EAAE,EAAE,EACrF,GAAG,CACH,CAAA;QACF,CAAC;QAED,MAAM,YAAY,GAAG,gBAAgB,CAAC,OAAO,CAAC,YAAY,CAAC,EAAE,QAAQ,CAAC,CAAA;QACtE,IAAI,CAAC,YAAY,EAAE,CAAC;YACnB,OAAO,CAAC,CAAC,IAAI,CACZ,EAAE,KAAK,EAAE,EAAE,IAAI,EAAE,WAAW,EAAE,OAAO,EAAE,4BAA4B,EAAE,EAAE,EACvE,GAAG,CACH,CAAA;QACF,CAAC;QAED,OAAO,SAAS,CAAC,CAAC,EAAE,YAAY,CAAC,CAAA;IAClC,CAAC,CAAC,CAAA;IAEF,OAAO,GAAG,CAAA;AACX,CAAC"}
+{"version":3,"file":"files.js","sourceRoot":"","sources":["../../../../src/transport/http/routes/files.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAEH,OAAO,EAAE,IAAI,EAAE,MAAM,MAAM,CAAA;AAC3B,OAAO,EAAE,OAAO,EAAE,MAAM,WAAW,CAAA;AACnC,OAAO,EAAE,WAAW,EAAE,gBAAgB,EAAE,MAAM,iCAAiC,CAAA;AAC/E,OAAO,EAAE,cAAc,EAAkB,MAAM,2BAA2B,CAAA;AAC1E,OAAO,EAAgC,WAAW,EAAE,MAAM,eAAe,CAAA;AACzE,OAAO,EAAE,oBAAoB,EAAE,MAAM,wBAAwB,CAAA;AAC7D,OAAO,EAAE,gBAAgB,EAAE,MAAM,iBAAiB,CAAA;AAElD,+EAA+E;AAC/E,UAAU;AACV,+EAA+E;AAE/E;;;;;GAKG;AACH,SAAS,mBAAmB,CAAC,CAAa,EAAE,MAAc;IACzD,MAAM,GAAG,GAAG,CAAC,CAAC,GAAG,CAAC,IAAI,CAAC,OAAO,CAAC,IAAI,MAAM,GAAG,CAAC,CAAA;IAC7C,IAAI,GAAG,KAAK,CAAC,CAAC;QAAE,OAAO,EAAE,CAAA;IACzB,IAAI,CAAC;QACJ,OAAO,kBAAkB,CAAC,CAAC,CAAC,GAAG,CAAC,IAAI,CAAC,KAAK,CAAC,GAAG,GAAG,MAAM,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAA;IACrE,CAAC;IAAC,MAAM,CAAC;QACR,OAAO,EAAE,CAAA;IACV,CAAC;AACF,CAAC;AAED,KAAK,UAAU,SAAS,CAAC,CAAa,EAAE,QAAgB,EAAE,QAAgB;IACzE,MAAM,EAAE,QAAQ,EAAE,GAAG,WAAW,CAAC,CAAC,CAAC,CAAA;IACnC,IAAI,IAAY,CAAA;IAChB,IAAI,CAAC;QACJ,IAAI,GAAG,MAAM,QAAQ,CAAC,EAAE,CAAC,QAAQ,CAAC,QAAQ,CAAC,CAAA;IAC5C,CAAC;IAAC,MAAM,CAAC;QACR,OAAO,CAAC,CAAC,IAAI,CACZ,EAAE,KAAK,EAAE,EAAE,IAAI,EAAE,WAAW,EAAE,OAAO,EAAE,gBAAgB,EAAE,EAAE,EAC3D,GAAG,CACH,CAAA;IACF,CAAC;IAED,MAAM,WAAW,GAAG,WAAW,CAAC,QAAQ,CAAC,CAAA;IAEzC,OAAO,IAAI,QAAQ,CAAC,IAAI,EAAE;QACzB,OAAO,EAAE;YACR,cAAc,EAAE,WAAW;YAC3B,gBAAgB,EAAE,IAAI,CAAC,MAAM,CAAC,QAAQ,EAAE;YACxC,eAAe,EAAE,sBAAsB;YACvC,gGAAgG;YAChG,wBAAwB,EAAE,SAAS;YACnC,yBAAyB,EAAE,6BAA6B;SACxD;KACD,CAAC,CAAA;AACH,CAAC;AAED,KAAK,UAAU,mBAAmB,CAAC,CAAa,EAAE,SAAoB;IACrE,MAAM,EAAE,cAAc,EAAE,GAAG,WAAW,CAAC,CAAC,CAAC,CAAA;IACzC,MAAM,MAAM,GAAG,MAAM,cAAc,CAAC,mBAAmB,CAAC,SAAS,EAAE,YAAY,CAAC,CAAA;IAChF,IAAI,CAAC,MAAM,CAAC,EAAE;QAAE,OAAO,IAAI,CAAA;IAC3B,IAAI,CAAC;QACJ,OAAO,MAAM,CAAC,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,YAAY,IAAI,IAAI,CAAA;IACvD,CAAC;YAAS,CAAC;QACV,MAAM,CAAC,KAAK,CAAC,OAAO,EAAE,CAAA;IACvB,CAAC;AACF,CAAC;AAED,+EAA+E;AAC/E,SAAS;AACT,+EAA+E;AAE/E;;;;;GAKG;AACH,MAAM,UAAU,gBAAgB;IAC/B,MAAM,GAAG,GAAG,IAAI,IAAI,EAAU,CAAA;IAE9B,6BAA6B;IAC7B,GAAG,CAAC,GAAG,CAAC,qBAAqB,EAAE,KAAK,EAAE,CAAa,EAAE,EAAE;QACtD,MAAM,EAAE,aAAa,EAAE,GAAG,WAAW,CAAC,CAAC,CAAC,CAAA;QACxC,MAAM,eAAe,GAAG,cAAc,CAAC,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC,WAAW,CAAE,CAAC,CAAA;QACjE,IAAI,CAAC,eAAe,CAAC,EAAE;YAAE,OAAO,gBAAgB,CAAC,CAAC,EAAE,eAAe,CAAC,KAAK,CAAC,CAAA;QAC1E,MAAM,QAAQ,GAAG,mBAAmB,CAAC,CAAC,EAAE,OAAO,CAAC,CAAA;QAEhD,IAAI,CAAC,QAAQ,EAAE,CAAC;YACf,OAAO,CAAC,CAAC,IAAI,CACZ,EAAE,KAAK,EAAE,EAAE,IAAI,EAAE,kBAAkB,EAAE,OAAO,EAAE,uBAAuB,EAAE,EAAE,EACzE,GAAG,CACH,CAAA;QACF,CAAC;QAED,mFAAmF;QACnF,yDAAyD;QACzD,MAAM,gBAAgB,GAAG,aAAa,CAAC,QAAQ,CAAC,YAAY,eAAe,CAAC,KAAK,EAAE,CAAC,CAAA;QACpF,IAAI,CAAC,gBAAgB,CAAC,EAAE,EAAE,CAAC;YAC1B,OAAO,CAAC,CAAC,IAAI,CACZ,EAAE,KAAK,EAAE,EAAE,IAAI,EAAE,WAAW,EAAE,OAAO,EAAE,4BAA4B,EAAE,EAAE,EACvE,GAAG,CACH,CAAA;QACF,CAAC;QAED,MAAM,UAAU,GAAG,gBAAgB,CAAC,KAAK,CAAA;QACzC,MAAM,YAAY,GAAG,gBAAgB,CAAC,UAAU,EAAE,QAAQ,CAAC,CAAA;QAE3D,IAAI,CAAC,YAAY,EAAE,CAAC;YACnB,OAAO,CAAC,CAAC,IAAI,CACZ,EAAE,KAAK,EAAE,EAAE,IAAI,EAAE,WAAW,EAAE,OAAO,EAAE,4BAA4B,EAAE,EAAE,EACvE,GAAG,CACH,CAAA;QACF,CAAC;QAED,MAAM,aAAa,GAAG,MAAM,oBAAoB,CAAC,CAAC,EAAE,UAAU,EAAE,YAAY,CAAC,CAAA;QAC7E,IAAI,aAAa,CAAC,MAAM,KAAK,WAAW,EAAE,CAAC;YAC1C,OAAO,CAAC,CAAC,IAAI,CACZ,EAAE,KAAK,EAAE,EAAE,IAAI,EAAE,WAAW,EAAE,OAAO,EAAE,+BAA+B,EAAE,EAAE,EAC1E,GAAG,CACH,CAAA;QACF,CAAC;QACD,IAAI,aAAa,CAAC,MAAM,KAAK,WAAW,EAAE,CAAC;YAC1C,OAAO,CAAC,CAAC,IAAI,CACZ,EAAE,KAAK,EAAE,EAAE,IAAI,EAAE,WAAW,EAAE,OAAO,EAAE,gBAAgB,EAAE,EAAE,EAC3D,GAAG,CACH,CAAA;QACF,CAAC;QAED,OAAO,SAAS,CAAC,CAAC,EAAE,aAAa,CAAC,IAAI,EAAE,YAAY,CAAC,CAAA;IACtD,CAAC,CAAC,CAAA;IAEF,+BAA+B;IAC/B,GAAG,CAAC,GAAG,CAAC,yBAAyB,EAAE,KAAK,EAAE,CAAa,EAAE,EAAE;QAC1D,MAAM,eAAe,GAAG,cAAc,CAAC,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC,WAAW,CAAE,CAAC,CAAA;QACjE,IAAI,CAAC,eAAe,CAAC,EAAE;YAAE,OAAO,gBAAgB,CAAC,CAAC,EAAE,eAAe,CAAC,KAAK,CAAC,CAAA;QAC1E,MAAM,QAAQ,GAAG,mBAAmB,CAAC,CAAC,EAAE,WAAW,CAAC,CAAA;QAEpD,IAAI,CAAC,QAAQ,EAAE,CAAC;YACf,OAAO,CAAC,CAAC,IAAI,CACZ,EAAE,KAAK,EAAE,EAAE,IAAI,EAAE,kBAAkB,EAAE,OAAO,EAAE,uBAAuB,EAAE,EAAE,EACzE,GAAG,CACH,CAAA;QACF,CAAC;QAED,MAAM,YAAY,GAAG,MAAM,mBAAmB,CAAC,CAAC,EAAE,eAAe,CAAC,KAAK,CAAC,CAAA;QACxE,IAAI,CAAC,YAAY,EAAE,CAAC;YACnB,OAAO,CAAC,CAAC,IAAI,CACZ,EAAE,KAAK,EAAE,EAAE,IAAI,EAAE,WAAW,EAAE,OAAO,EAAE,0CAA0C,EAAE,EAAE,EACrF,GAAG,CACH,CAAA;QACF,CAAC;QAED,MAAM,YAAY,GAAG,gBAAgB,CAAC,OAAO,CAAC,YAAY,CAAC,EAAE,QAAQ,CAAC,CAAA;QACtE,IAAI,CAAC,YAAY,EAAE,CAAC;YACnB,OAAO,CAAC,CAAC,IAAI,CACZ,EAAE,KAAK,EAAE,EAAE,IAAI,EAAE,WAAW,EAAE,OAAO,EAAE,4BAA4B,EAAE,EAAE,EACvE,GAAG,CACH,CAAA;QACF,CAAC;QAED,MAAM,aAAa,GAAG,MAAM,oBAAoB,CAAC,CAAC,EAAE,YAAY,EAAE,YAAY,CAAC,CAAA;QAC/E,IAAI,aAAa,CAAC,MAAM,KAAK,WAAW,EAAE,CAAC;YAC1C,OAAO,CAAC,CAAC,IAAI,CACZ,EAAE,KAAK,EAAE,EAAE,IAAI,EAAE,WAAW,EAAE,OAAO,EAAE,+BAA+B,EAAE,EAAE,EAC1E,GAAG,CACH,CAAA;QACF,CAAC;QACD,IAAI,aAAa,CAAC,MAAM,KAAK,WAAW,EAAE,CAAC;YAC1C,OAAO,CAAC,CAAC,IAAI,CACZ,EAAE,KAAK,EAAE,EAAE,IAAI,EAAE,WAAW,EAAE,OAAO,EAAE,gBAAgB,EAAE,EAAE,EAC3D,GAAG,CACH,CAAA;QACF,CAAC;QAED,OAAO,SAAS,CAAC,CAAC,EAAE,aAAa,CAAC,IAAI,EAAE,YAAY,CAAC,CAAA;IACtD,CAAC,CAAC,CAAA;IAEF,OAAO,GAAG,CAAA;AACX,CAAC"}

package/dist/transport/http/routes/resources.d.ts

@@ -7,6 +7,6 @@
  * organization resources into sessions, bypassing the uploads/attachment pipeline.
  */
 import { Hono } from 'hono';
-import type { AppEnv } from '../app.js';
+import type { AppEnv } from '../context.js';
 export declare function createResourceRoutes(): Hono<AppEnv>;
 //# sourceMappingURL=resources.d.ts.map

package/dist/transport/http/routes/resources.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"resources.d.ts","sourceRoot":"","sources":["../../../../src/transport/http/routes/resources.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AAEH,OAAO,EAAE,IAAI,EAAE,MAAM,MAAM,CAAA;AAC3B,OAAO,KAAK,EAAc,MAAM,EAAE,MAAM,WAAW,CAAA;AAInD,wBAAgB,oBAAoB,IAAI,IAAI,CAAC,MAAM,CAAC,CAoGnD"}
+{"version":3,"file":"resources.d.ts","sourceRoot":"","sources":["../../../../src/transport/http/routes/resources.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AAEH,OAAO,EAAE,IAAI,EAAE,MAAM,MAAM,CAAA;AAI3B,OAAO,KAAK,EAAc,MAAM,EAAE,MAAM,eAAe,CAAA;AA4BvD,wBAAgB,oBAAoB,IAAI,IAAI,CAAC,MAAM,CAAC,CAwGnD"}