@swarmclawai/swarmclaw 0.2.0

package/src/app/api/knowledge/route.ts

@@ -0,0 +1,48 @@
+import { NextResponse } from 'next/server'
+import { addKnowledge, searchKnowledge, listKnowledge } from '@/lib/server/memory-db'
+
+export async function GET(req: Request) {
+  const { searchParams } = new URL(req.url)
+  const q = searchParams.get('q')
+  const tagsParam = searchParams.get('tags')
+  const limitParam = searchParams.get('limit')
+
+  const tags = tagsParam ? tagsParam.split(',').map((t) => t.trim()).filter(Boolean) : undefined
+  const limit = limitParam ? Math.max(1, Math.min(500, Number.parseInt(limitParam, 10) || 50)) : undefined
+
+  if (q) {
+    const results = searchKnowledge(q, tags, limit)
+    return NextResponse.json(results)
+  }
+
+  const entries = listKnowledge(tags, limit)
+  return NextResponse.json(entries)
+}
+
+export async function POST(req: Request) {
+  const body = await req.json().catch(() => null)
+  if (!body || typeof body !== 'object' || Array.isArray(body)) {
+    return NextResponse.json({ error: 'Invalid JSON body.' }, { status: 400 })
+  }
+
+  const { title, content, tags } = body as Record<string, unknown>
+
+  if (typeof title !== 'string' || !title.trim()) {
+    return NextResponse.json({ error: 'title is required.' }, { status: 400 })
+  }
+  if (typeof content !== 'string') {
+    return NextResponse.json({ error: 'content is required.' }, { status: 400 })
+  }
+
+  const normalizedTags = Array.isArray(tags)
+    ? (tags as unknown[]).filter((t): t is string => typeof t === 'string' && t.trim().length > 0)
+    : undefined
+
+  const entry = addKnowledge({
+    title: title.trim(),
+    content,
+    tags: normalizedTags,
+  })
+
+  return NextResponse.json(entry)
+}

package/src/app/api/knowledge/upload/route.ts

@@ -0,0 +1,86 @@
+import { NextResponse } from 'next/server'
+import fs from 'fs'
+import path from 'path'
+import crypto from 'crypto'
+import { UPLOAD_DIR } from '@/lib/server/storage'
+
+const TEXT_EXTS = new Set([
+  '.txt', '.md', '.markdown', '.csv', '.tsv', '.json', '.jsonl',
+  '.html', '.htm', '.xml', '.yaml', '.yml', '.toml', '.ini', '.cfg',
+  '.js', '.ts', '.tsx', '.jsx', '.py', '.go', '.rs', '.java', '.c', '.cpp', '.h',
+  '.rb', '.php', '.sh', '.bash', '.zsh', '.sql', '.r', '.swift', '.kt',
+  '.env', '.log', '.conf', '.properties', '.gitignore', '.dockerignore',
+])
+
+function isTextFile(filename: string): boolean {
+  const ext = path.extname(filename).toLowerCase()
+  return TEXT_EXTS.has(ext) || ext === ''
+}
+
+function deriveTitle(filename: string): string {
+  const name = path.basename(filename, path.extname(filename))
+  return name
+    .replace(/[-_]+/g, ' ')
+    .replace(/([a-z])([A-Z])/g, '$1 $2')
+    .replace(/\b\w/g, (c) => c.toUpperCase())
+    .trim() || 'Uploaded Document'
+}
+
+export async function POST(req: Request) {
+  const filename = req.headers.get('x-filename') || 'document.txt'
+  const buf = Buffer.from(await req.arrayBuffer())
+
+  if (buf.length === 0) {
+    return NextResponse.json({ error: 'Empty file.' }, { status: 400 })
+  }
+
+  if (buf.length > 10 * 1024 * 1024) {
+    return NextResponse.json({ error: 'File too large. Maximum 10MB.' }, { status: 400 })
+  }
+
+  // Save file to uploads
+  if (!fs.existsSync(UPLOAD_DIR)) fs.mkdirSync(UPLOAD_DIR, { recursive: true })
+  const safeName = crypto.randomBytes(4).toString('hex') + '-' + filename.replace(/[^a-zA-Z0-9._-]/g, '_')
+  const filePath = path.join(UPLOAD_DIR, safeName)
+  fs.writeFileSync(filePath, buf)
+
+  // Extract text content
+  let content = ''
+  const ext = path.extname(filename).toLowerCase()
+
+  if (ext === '.pdf') {
+    // Try dynamic import of pdf-parse if available
+    try {
+      // @ts-ignore — pdf-parse is an optional dependency
+      const pdfParse = (await import(/* webpackIgnore: true */ 'pdf-parse')).default
+      const result = await pdfParse(buf)
+      content = result.text || ''
+    } catch {
+      // pdf-parse not installed — read as raw text fallback
+      content = '[PDF document — install pdf-parse for text extraction]\n\nFile saved at: ' + filePath
+    }
+  } else if (isTextFile(filename)) {
+    content = buf.toString('utf-8')
+  } else {
+    // Binary file — can't extract text
+    content = `[Binary file: ${filename}]\n\nFile saved at: ${filePath}`
+  }
+
+  // Truncate very long content to prevent memory issues
+  const MAX_CONTENT = 500_000
+  if (content.length > MAX_CONTENT) {
+    content = content.slice(0, MAX_CONTENT) + '\n\n[... truncated at 500k characters]'
+  }
+
+  const title = deriveTitle(filename)
+  const url = `/api/uploads/${safeName}`
+
+  return NextResponse.json({
+    title,
+    content,
+    filePath,
+    url,
+    filename,
+    size: buf.length,
+  })
+}

package/src/app/api/logs/route.ts

@@ -0,0 +1,65 @@
+import { NextResponse } from 'next/server'
+import fs from 'fs'
+import path from 'path'
+
+const LOG_FILE = path.join(process.cwd(), 'data', 'app.log')
+
+export async function GET(req: Request) {
+  const { searchParams } = new URL(req.url)
+  const lines = parseInt(searchParams.get('lines') || '200', 10)
+  const level = searchParams.get('level') || '' // INFO, WARN, ERROR, DEBUG
+  const search = searchParams.get('search') || ''
+
+  try {
+    if (!fs.existsSync(LOG_FILE)) {
+      return NextResponse.json({ entries: [], total: 0 })
+    }
+
+    const content = fs.readFileSync(LOG_FILE, 'utf8')
+    let allLines = content.split('\n').filter(Boolean)
+
+    // Filter by level
+    if (level) {
+      const levels = level.split(',')
+      allLines = allLines.filter((l) => levels.some((lv) => l.includes(`[${lv}]`)))
+    }
+
+    // Filter by search term
+    if (search) {
+      const lower = search.toLowerCase()
+      allLines = allLines.filter((l) => l.toLowerCase().includes(lower))
+    }
+
+    const total = allLines.length
+    // Return most recent lines
+    const entries = allLines.slice(-lines).reverse().map(parseLine)
+
+    return NextResponse.json({ entries, total })
+  } catch (err: any) {
+    return NextResponse.json({ error: err.message }, { status: 500 })
+  }
+}
+
+export async function DELETE() {
+  try {
+    if (fs.existsSync(LOG_FILE)) {
+      fs.writeFileSync(LOG_FILE, '')
+    }
+    return NextResponse.json({ ok: true })
+  } catch (err: any) {
+    return NextResponse.json({ error: err.message }, { status: 500 })
+  }
+}
+
+function parseLine(line: string) {
+  // Format: [2026-02-19T17:06:00.000Z] [INFO] [tag] message | data
+  const match = line.match(/^\[([^\]]+)\]\s+\[(\w+)\]\s+\[([^\]]+)\]\s+(.*)$/)
+  if (!match) return { time: '', level: 'INFO', tag: '', message: line }
+
+  const [, time, level, tag, rest] = match
+  const pipeIdx = rest.indexOf(' | ')
+  const message = pipeIdx >= 0 ? rest.slice(0, pipeIdx) : rest
+  const data = pipeIdx >= 0 ? rest.slice(pipeIdx + 3) : undefined
+
+  return { time, level, tag, message, data }
+}

package/src/app/api/mcp-servers/[id]/route.ts

@@ -0,0 +1,32 @@
+import { NextResponse } from 'next/server'
+import { loadMcpServers, saveMcpServers, deleteMcpServer } from '@/lib/server/storage'
+
+export async function GET(_req: Request, { params }: { params: Promise<{ id: string }> }) {
+  const { id } = await params
+  const servers = loadMcpServers()
+  if (!servers[id]) return new NextResponse(null, { status: 404 })
+  return NextResponse.json(servers[id])
+}
+
+export async function PUT(req: Request, { params }: { params: Promise<{ id: string }> }) {
+  const { id } = await params
+  const body = await req.json()
+  const servers = loadMcpServers()
+  if (!servers[id]) return new NextResponse(null, { status: 404 })
+  servers[id] = {
+    ...servers[id],
+    ...body,
+    id,
+    updatedAt: Date.now(),
+  }
+  saveMcpServers(servers)
+  return NextResponse.json(servers[id])
+}
+
+export async function DELETE(_req: Request, { params }: { params: Promise<{ id: string }> }) {
+  const { id } = await params
+  const servers = loadMcpServers()
+  if (!servers[id]) return new NextResponse(null, { status: 404 })
+  deleteMcpServer(id)
+  return NextResponse.json({ deleted: id })
+}

package/src/app/api/mcp-servers/[id]/test/route.ts

@@ -0,0 +1,23 @@
+import { NextResponse } from 'next/server'
+import { loadMcpServers } from '@/lib/server/storage'
+import { connectMcpServer, mcpToolsToLangChain, disconnectMcpServer } from '@/lib/server/mcp-client'
+
+export async function POST(_req: Request, { params }: { params: Promise<{ id: string }> }) {
+  const { id } = await params
+  const servers = loadMcpServers()
+  const server = servers[id]
+  if (!server) return new NextResponse(null, { status: 404 })
+
+  try {
+    const { client, transport } = await connectMcpServer(server)
+    const tools = await mcpToolsToLangChain(client, server.name)
+    const toolNames = tools.map((t: any) => t.name)
+    await disconnectMcpServer(client, transport)
+    return NextResponse.json({ ok: true, tools: toolNames })
+  } catch (err: any) {
+    return NextResponse.json(
+      { ok: false, error: err.message || 'Connection failed' },
+      { status: 500 }
+    )
+  }
+}

package/src/app/api/mcp-servers/[id]/tools/route.ts

@@ -0,0 +1,32 @@
+import { NextResponse } from 'next/server'
+import { loadMcpServers } from '@/lib/server/storage'
+import { connectMcpServer, disconnectMcpServer } from '@/lib/server/mcp-client'
+
+export async function GET(_req: Request, { params }: { params: Promise<{ id: string }> }) {
+  const { id } = await params
+  const servers = loadMcpServers()
+  const config = servers[id]
+  if (!config) return new NextResponse(null, { status: 404 })
+
+  let client: any
+  let transport: any
+  try {
+    const conn = await connectMcpServer(config)
+    client = conn.client
+    transport = conn.transport
+    const { tools } = await client.listTools()
+    return NextResponse.json(
+      tools.map((t: any) => ({
+        name: t.name,
+        description: t.description ?? '',
+        inputSchema: t.inputSchema ?? {},
+      }))
+    )
+  } catch (err: any) {
+    return NextResponse.json({ error: err.message }, { status: 502 })
+  } finally {
+    if (client && transport) {
+      await disconnectMcpServer(client, transport)
+    }
+  }
+}

package/src/app/api/mcp-servers/route.ts

@@ -0,0 +1,27 @@
+import { NextResponse } from 'next/server'
+import crypto from 'crypto'
+import { loadMcpServers, saveMcpServers } from '@/lib/server/storage'
+
+export async function GET() {
+  return NextResponse.json(loadMcpServers())
+}
+
+export async function POST(req: Request) {
+  const body = await req.json()
+  const servers = loadMcpServers()
+  const id = crypto.randomBytes(4).toString('hex')
+  servers[id] = {
+    id,
+    name: body.name,
+    transport: body.transport,
+    command: body.command,
+    args: body.args,
+    url: body.url,
+    env: body.env,
+    headers: body.headers,
+    createdAt: Date.now(),
+    updatedAt: Date.now(),
+  }
+  saveMcpServers(servers)
+  return NextResponse.json(servers[id])
+}

package/src/app/api/memory/[id]/route.ts

@@ -0,0 +1,126 @@
+import crypto from 'crypto'
+import fs from 'fs'
+import { NextResponse } from 'next/server'
+import { getMemoryDb, getMemoryLookupLimits, storeMemoryImageAsset, storeMemoryImageFromDataUrl } from '@/lib/server/memory-db'
+import { resolveLookupRequest } from '@/lib/server/memory-graph'
+import type { MemoryImage } from '@/types'
+
+function parseOptionalInt(raw: string | null): number | undefined {
+  if (!raw) return undefined
+  const parsed = Number.parseInt(raw, 10)
+  return Number.isFinite(parsed) ? parsed : undefined
+}
+
+async function parseJsonBody(req: Request): Promise<Record<string, unknown> | null> {
+  const body = await req.json().catch(() => null)
+  if (!body || typeof body !== 'object' || Array.isArray(body)) return null
+  return body as Record<string, unknown>
+}
+
+function parseTargetIds(value: unknown): string[] {
+  if (!Array.isArray(value)) return []
+  return value
+    .filter((item): item is string => typeof item === 'string')
+    .map((item) => item.trim())
+    .filter(Boolean)
+}
+
+export async function GET(req: Request, { params }: { params: Promise<{ id: string }> }) {
+  const { id } = await params
+  const { searchParams } = new URL(req.url)
+  const envelope = searchParams.get('envelope') === 'true'
+  const requestedDepth = parseOptionalInt(searchParams.get('depth'))
+  const requestedLimit = parseOptionalInt(searchParams.get('limit'))
+  const requestedLinkedLimit = parseOptionalInt(searchParams.get('linkedLimit'))
+  const db = getMemoryDb()
+  const defaults = getMemoryLookupLimits()
+  const limits = resolveLookupRequest(defaults, {
+    depth: requestedDepth,
+    limit: requestedLimit,
+    linkedLimit: requestedLinkedLimit,
+  })
+
+  if (limits.maxDepth <= 0) {
+    const entry = db.get(id)
+    if (!entry) return new NextResponse(null, { status: 404 })
+    if (envelope) {
+      return NextResponse.json({
+        entries: [entry],
+        truncated: false,
+        expandedLinkedCount: 0,
+        limits,
+      })
+    }
+    return NextResponse.json(entry)
+  }
+
+  const result = db.getWithLinked(id, limits.maxDepth, limits.maxPerLookup, limits.maxLinkedExpansion)
+  if (!result) return new NextResponse(null, { status: 404 })
+  if (envelope) return NextResponse.json(result)
+  return NextResponse.json(result.entries)
+}
+
+export async function PUT(req: Request, { params }: { params: Promise<{ id: string }> }) {
+  const { id } = await params
+  const body = await parseJsonBody(req)
+  if (!body) {
+    return NextResponse.json({ error: 'Invalid JSON body.' }, { status: 400 })
+  }
+
+  const db = getMemoryDb()
+  const linkAction = typeof body.linkAction === 'string' ? body.linkAction.trim().toLowerCase() : ''
+
+  if (linkAction === 'link' || linkAction === 'unlink') {
+    const targetIds = parseTargetIds(body.targetIds)
+    if (!targetIds.length) {
+      return NextResponse.json({ error: 'targetIds is required for linkAction.' }, { status: 400 })
+    }
+    const updated = linkAction === 'link'
+      ? db.link(id, targetIds, true)
+      : db.unlink(id, targetIds, true)
+    if (!updated) return new NextResponse(null, { status: 404 })
+    return NextResponse.json(updated)
+  }
+
+  let image = body.image
+  const inputImagePath = typeof body.imagePath === 'string' ? body.imagePath.trim() : ''
+  const inputImageDataUrl = typeof body.imageDataUrl === 'string' ? body.imageDataUrl.trim() : ''
+  const clearImage = body.clearImage === true || body.image === null
+  if (clearImage) {
+    image = null
+  } else if (inputImageDataUrl) {
+    try {
+      image = await storeMemoryImageFromDataUrl(inputImageDataUrl, `${id}-${crypto.randomBytes(2).toString('hex')}`)
+    } catch (err) {
+      return NextResponse.json({ error: err instanceof Error ? err.message : 'Invalid image data URL' }, { status: 400 })
+    }
+  } else if (inputImagePath) {
+    if (!fs.existsSync(inputImagePath)) {
+      return NextResponse.json({ error: `Image file not found: ${inputImagePath}` }, { status: 400 })
+    }
+    try {
+      image = await storeMemoryImageAsset(inputImagePath, `${id}-${crypto.randomBytes(2).toString('hex')}`)
+    } catch (err) {
+      return NextResponse.json({ error: err instanceof Error ? err.message : 'Failed to store memory image' }, { status: 400 })
+    }
+  }
+
+  const entry = db.update(id, {
+    ...body,
+    image: image as MemoryImage | null | undefined,
+    imagePath: clearImage
+      ? null
+      : image && typeof image === 'object' && 'path' in image
+        ? String((image as { path: string }).path)
+        : (typeof body.imagePath === 'string' ? body.imagePath : undefined),
+  })
+  if (!entry) return new NextResponse(null, { status: 404 })
+  return NextResponse.json(entry)
+}
+
+export async function DELETE(_req: Request, { params }: { params: Promise<{ id: string }> }) {
+  const { id } = await params
+  const db = getMemoryDb()
+  db.delete(id)
+  return NextResponse.json('ok')
+}

package/src/app/api/memory/maintenance/route.ts

@@ -0,0 +1,63 @@
+import { NextResponse } from 'next/server'
+import { getMemoryDb } from '@/lib/server/memory-db'
+import { loadSettings } from '@/lib/server/storage'
+
+function parseBool(value: unknown, fallback: boolean): boolean {
+  if (typeof value === 'boolean') return value
+  if (typeof value === 'string') {
+    const v = value.trim().toLowerCase()
+    if (v === 'true' || v === '1' || v === 'yes') return true
+    if (v === 'false' || v === '0' || v === 'no') return false
+  }
+  return fallback
+}
+
+function parseIntBounded(value: unknown, fallback: number, min: number, max: number): number {
+  const parsed = typeof value === 'number'
+    ? value
+    : typeof value === 'string'
+      ? Number.parseInt(value, 10)
+      : Number.NaN
+  if (!Number.isFinite(parsed)) return fallback
+  return Math.max(min, Math.min(max, Math.trunc(parsed)))
+}
+
+export async function GET(req: Request) {
+  const db = getMemoryDb()
+  const settings = loadSettings()
+  const { searchParams } = new URL(req.url)
+  const ttlHours = parseIntBounded(
+    searchParams.get('ttlHours') ?? settings.memoryWorkingTtlHours,
+    24,
+    1,
+    24 * 365,
+  )
+  const analyzed = db.analyzeMaintenance(ttlHours)
+  return NextResponse.json({
+    ok: true,
+    ttlHours,
+    analyzed,
+  })
+}
+
+export async function POST(req: Request) {
+  const body = await req.json().catch(() => ({}))
+  const settings = loadSettings()
+  const db = getMemoryDb()
+  const ttlHours = parseIntBounded(body?.ttlHours ?? settings.memoryWorkingTtlHours, 24, 1, 24 * 365)
+  const maxDeletes = parseIntBounded(body?.maxDeletes, 500, 1, 20_000)
+  const result = db.maintain({
+    ttlHours,
+    maxDeletes,
+    dedupe: parseBool(body?.dedupe, true),
+    canonicalDedupe: parseBool(body?.canonicalDedupe, false),
+    pruneWorking: parseBool(body?.pruneWorking, true),
+  })
+  return NextResponse.json({
+    ok: true,
+    ttlHours,
+    maxDeletes,
+    ...result,
+  })
+}
+

package/src/app/api/memory/route.ts

@@ -0,0 +1,111 @@
+import crypto from 'crypto'
+import fs from 'fs'
+import { NextResponse } from 'next/server'
+import { getMemoryDb, getMemoryLookupLimits, storeMemoryImageAsset, storeMemoryImageFromDataUrl } from '@/lib/server/memory-db'
+import { resolveLookupRequest } from '@/lib/server/memory-graph'
+import type { MemoryReference, FileReference, MemoryImage } from '@/types'
+
+function parseOptionalInt(raw: string | null): number | undefined {
+  if (!raw) return undefined
+  const parsed = Number.parseInt(raw, 10)
+  return Number.isFinite(parsed) ? parsed : undefined
+}
+
+async function parseJsonBody(req: Request): Promise<Record<string, unknown> | null> {
+  const body = await req.json().catch(() => null)
+  if (!body || typeof body !== 'object' || Array.isArray(body)) return null
+  return body as Record<string, unknown>
+}
+
+export async function GET(req: Request) {
+  const { searchParams } = new URL(req.url)
+  const q = searchParams.get('q')
+  const agentId = searchParams.get('agentId')
+  const envelope = searchParams.get('envelope') === 'true'
+  const requestedDepth = parseOptionalInt(searchParams.get('depth'))
+  const requestedLimit = parseOptionalInt(searchParams.get('limit'))
+  const requestedLinkedLimit = parseOptionalInt(searchParams.get('linkedLimit'))
+
+  const db = getMemoryDb()
+  const defaults = getMemoryLookupLimits()
+  const limits = resolveLookupRequest(defaults, {
+    depth: requestedDepth,
+    limit: requestedLimit,
+    linkedLimit: requestedLinkedLimit,
+  })
+
+  if (q) {
+    if (limits.maxDepth > 0) {
+      const result = db.searchWithLinked(q, agentId || undefined, limits.maxDepth, limits.maxPerLookup, limits.maxLinkedExpansion)
+      if (envelope) return NextResponse.json(result)
+      return NextResponse.json(result.entries)
+    }
+    const base = db.search(q, agentId || undefined)
+    const entries = base.slice(0, limits.maxPerLookup)
+    if (envelope) {
+      return NextResponse.json({
+        entries,
+        truncated: base.length > entries.length,
+        expandedLinkedCount: 0,
+        limits,
+      })
+    }
+    return NextResponse.json(entries)
+  }
+
+  const entries = db.list(agentId || undefined, limits.maxPerLookup)
+  if (envelope) {
+    return NextResponse.json({
+      entries,
+      truncated: false,
+      expandedLinkedCount: 0,
+      limits,
+    })
+  }
+  return NextResponse.json(entries)
+}
+
+export async function POST(req: Request) {
+  const body = await parseJsonBody(req)
+  if (!body) {
+    return NextResponse.json({ error: 'Invalid JSON body.' }, { status: 400 })
+  }
+
+  const db = getMemoryDb()
+  const draftId = crypto.randomBytes(6).toString('hex')
+
+  let image = body.image
+  const inputImagePath = typeof body.imagePath === 'string' ? body.imagePath.trim() : ''
+  const inputImageDataUrl = typeof body.imageDataUrl === 'string' ? body.imageDataUrl.trim() : ''
+  if (inputImageDataUrl) {
+    try {
+      image = await storeMemoryImageFromDataUrl(inputImageDataUrl, draftId)
+    } catch (err) {
+      return NextResponse.json({ error: err instanceof Error ? err.message : 'Invalid image data URL' }, { status: 400 })
+    }
+  } else if (inputImagePath) {
+    if (!fs.existsSync(inputImagePath)) {
+      return NextResponse.json({ error: `Image file not found: ${inputImagePath}` }, { status: 400 })
+    }
+    try {
+      image = await storeMemoryImageAsset(inputImagePath, draftId)
+    } catch (err) {
+      return NextResponse.json({ error: err instanceof Error ? err.message : 'Failed to store memory image' }, { status: 400 })
+    }
+  }
+
+  const entry = db.add({
+    agentId: typeof body.agentId === 'string' ? body.agentId : null,
+    sessionId: typeof body.sessionId === 'string' ? body.sessionId : null,
+    category: typeof body.category === 'string' && body.category.trim() ? body.category : 'note',
+    title: typeof body.title === 'string' && body.title.trim() ? body.title : 'Untitled',
+    content: typeof body.content === 'string' ? body.content : '',
+    metadata: body.metadata as Record<string, unknown> | undefined,
+    references: body.references as MemoryReference[] | undefined,
+    filePaths: body.filePaths as FileReference[] | undefined,
+    image: image as MemoryImage | null | undefined,
+    imagePath: image && typeof image === 'object' && 'path' in image ? String((image as { path: string }).path) : null,
+    linkedMemoryIds: body.linkedMemoryIds as string[] | undefined,
+  })
+  return NextResponse.json(entry)
+}

package/src/app/api/memory-images/[filename]/route.ts

@@ -0,0 +1,36 @@
+import { NextResponse } from 'next/server'
+import fs from 'fs'
+import path from 'path'
+
+const IMAGES_DIR = path.join(process.cwd(), 'data', 'memory-images')
+
+const MIME_TYPES: Record<string, string> = {
+  '.png': 'image/png',
+  '.jpg': 'image/jpeg',
+  '.jpeg': 'image/jpeg',
+  '.gif': 'image/gif',
+  '.webp': 'image/webp',
+  '.bmp': 'image/bmp',
+  '.tiff': 'image/tiff',
+}
+
+export async function GET(_req: Request, { params }: { params: Promise<{ filename: string }> }) {
+  const { filename } = await params
+  const safeName = filename.replace(/[^a-zA-Z0-9._-]/g, '')
+  const filePath = path.join(IMAGES_DIR, safeName)
+
+  if (!fs.existsSync(filePath)) {
+    return new NextResponse(null, { status: 404 })
+  }
+
+  const ext = path.extname(safeName).toLowerCase()
+  const contentType = MIME_TYPES[ext] || 'application/octet-stream'
+  const data = fs.readFileSync(filePath)
+
+  return new NextResponse(data, {
+    headers: {
+      'Content-Type': contentType,
+      'Cache-Control': 'public, max-age=86400',
+    },
+  })
+}