Fetch a single file from a template version's file tree.

path must match a row in the template's file manifest (use get_template to see the manifest). SKILL.md returns the template body. Text files return the decoded string in content. Small binary files return base64-encoded bytes in content_base64. Binary files over the size limit return metadata and an error field with no inline bytes.

Pass format=raw to receive the file's raw bytes instead of the JSON envelope. This is the path public template pages use to render demo images: a validated image is served with its pinned image type, anything else is served as a generic download attachment, and every raw response carries hardening headers so a file can never execute as an active document in a browser. Pair format=raw with sha256 so the URL is content addressed: a republished or removed file no longer resolves at a stale address. The default (no format) JSON response is unchanged.

Anonymous callers may fetch files from live (published) template versions. Once a version is unpublished, anonymous reads are denied immediately; the liveness check is evaluated per read inside the same transaction, including for format=raw.

When path is omitted this is not a file request: the greedy :path segment swallowed a template whose slug is literally files (an @handle/files URL), so fall through to ordinary template resolution on the reconstructed identifier. Publishing a new template with that slug is rejected up front, but legacy templates created before this route existed must still resolve here. (Per-file fetches against such a legacy template cannot be disambiguated from this route and are not supported, but those rows predate sibling files so their only file is the synthesized SKILL.md, which the no-path body resolution already returns.)