wiki-viewer 1.0.0 → 1.1.0

package/.next/standalone/src/app/api/system/browse/route.ts

@@ -2,6 +2,7 @@ import { readdir, stat } from "node:fs/promises";
 import os from "node:os";
 import path from "node:path";
 import { NextResponse } from "next/server";
+import { requireUser } from "@/lib/auth/server";
 
 interface BrowseEntry {
 	name: string;
@@ -10,6 +11,9 @@ interface BrowseEntry {
 }
 
 export async function GET(request: Request) {
+	const auth = await requireUser(request);
+	if (!auth.ok) return NextResponse.json({ error: "UNAUTHORIZED" }, { status: 401 });
+
 	const { searchParams } = new URL(request.url);
 	const rawPath = searchParams.get("path");
 

package/.next/standalone/src/app/api/system/clear-root/route.ts

@@ -1,8 +1,15 @@
 import { NextResponse } from "next/server";
+import { checkOrigin } from "@/lib/auth/csrf";
+import { requireUser } from "@/lib/auth/server";
 import { writeConfig } from "@/lib/config";
 import { clearRootDir } from "@/lib/root-dir";
 
-export async function POST() {
+export async function POST(request: Request) {
+	const csrf = checkOrigin(request);
+	if (csrf) return csrf;
+	const auth = await requireUser(request);
+	if (!auth.ok) return NextResponse.json({ error: "UNAUTHORIZED" }, { status: 401 });
+
 	clearRootDir();
 	await writeConfig({ lastOpenedPath: undefined });
 	return NextResponse.json({ ok: true });

package/.next/standalone/src/app/api/system/config/route.ts

@@ -1,7 +1,11 @@
 import { NextResponse } from "next/server";
+import { requireUser } from "@/lib/auth/server";
 import { readConfig } from "@/lib/config";
 
-export async function GET() {
+export async function GET(request: Request) {
+	const auth = await requireUser(request);
+	if (!auth.ok) return NextResponse.json({ error: "UNAUTHORIZED" }, { status: 401 });
+
 	const config = await readConfig();
 	return NextResponse.json({
 		pinnedPaths: config.pinnedPaths ?? [],

package/.next/standalone/src/app/api/system/pins/route.ts

@@ -1,8 +1,15 @@
 import { stat } from "node:fs/promises";
 import { NextResponse } from "next/server";
+import { checkOrigin } from "@/lib/auth/csrf";
+import { requireUser } from "@/lib/auth/server";
 import { readConfig, writeConfig } from "@/lib/config";
 
 export async function POST(request: Request) {
+	const csrf = checkOrigin(request);
+	if (csrf) return csrf;
+	const auth = await requireUser(request);
+	if (!auth.ok) return NextResponse.json({ error: "UNAUTHORIZED" }, { status: 401 });
+
 	const body: { path?: string; action?: "pin" | "unpin" } = await request.json();
 	const p = body.path?.trim();
 	const action = body.action ?? "pin";

package/.next/standalone/src/app/api/system/reveal/route.ts

@@ -1,9 +1,16 @@
 import { exec } from "node:child_process";
 import path from "node:path";
 import { NextResponse } from "next/server";
+import { checkOrigin } from "@/lib/auth/csrf";
+import { requireUser } from "@/lib/auth/server";
 import { getRootDir } from "@/lib/root-dir";
 
 export async function POST(request: Request) {
+	const csrf = checkOrigin(request);
+	if (csrf) return csrf;
+	const auth = await requireUser(request);
+	if (!auth.ok) return NextResponse.json({ error: "UNAUTHORIZED" }, { status: 401 });
+
 	const body: { path?: string } = await request.json();
 	const rel = body.path;
 	if (!rel || typeof rel !== "string")

package/.next/standalone/src/app/api/system/root-status/route.ts

@@ -1,7 +1,11 @@
 import { NextResponse } from "next/server";
+import { requireUser } from "@/lib/auth/server";
 import { getRootDir, isRootDirSet } from "@/lib/root-dir";
 
-export async function GET() {
+export async function GET(request: Request) {
+	const auth = await requireUser(request);
+	if (!auth.ok) return NextResponse.json({ error: "UNAUTHORIZED" }, { status: 401 });
+
 	return NextResponse.json({
 		configured: isRootDirSet(),
 		path: isRootDirSet() ? getRootDir() : null,

package/.next/standalone/src/app/api/system/set-root/route.ts

@@ -1,9 +1,16 @@
 import { stat } from "node:fs/promises";
 import { NextResponse } from "next/server";
+import { checkOrigin } from "@/lib/auth/csrf";
+import { requireUser } from "@/lib/auth/server";
 import { writeConfig } from "@/lib/config";
 import { setRootDir } from "@/lib/root-dir";
 
 export async function POST(request: Request) {
+	const csrf = checkOrigin(request);
+	if (csrf) return csrf;
+	const auth = await requireUser(request);
+	if (!auth.ok) return NextResponse.json({ error: "UNAUTHORIZED" }, { status: 401 });
+
 	const body: { path?: string } = await request.json();
 	const dir = body.path?.trim();
 	if (!dir) return NextResponse.json({ error: "Missing path" }, { status: 400 });

package/.next/standalone/src/app/api/wiki/app/route.ts

@@ -1,10 +1,15 @@
 import path from "node:path";
 import { NextResponse } from "next/server";
+import { checkOrigin } from "@/lib/auth/csrf";
+import { requireUser } from "@/lib/auth/server";
 import { getStatus, startApp, stopApp } from "@/lib/app-runner";
 import { getRootDir, safeRootPath } from "@/lib/root-dir";
 
 // GET /api/wiki/app?path=relative/path
 export async function GET(request: Request) {
+	const auth = await requireUser(request);
+	if (!auth.ok) return NextResponse.json({ error: "UNAUTHORIZED" }, { status: 401 });
+
 	const { searchParams } = new URL(request.url);
 	const rel = searchParams.get("path") ?? "";
 	return NextResponse.json(getStatus(rel));
@@ -12,6 +17,11 @@ export async function GET(request: Request) {
 
 // POST /api/wiki/app  { path: "relative/path" }
 export async function POST(request: Request) {
+	const csrf = checkOrigin(request);
+	if (csrf) return csrf;
+	const auth = await requireUser(request);
+	if (!auth.ok) return NextResponse.json({ error: "UNAUTHORIZED" }, { status: 401 });
+
 	const body: { path?: string } = await request.json();
 	const rel = body.path;
 	if (!rel || typeof rel !== "string")
@@ -31,6 +41,11 @@ export async function POST(request: Request) {
 
 // DELETE /api/wiki/app  { path: "relative/path" }
 export async function DELETE(request: Request) {
+	const csrf = checkOrigin(request);
+	if (csrf) return csrf;
+	const auth = await requireUser(request);
+	if (!auth.ok) return NextResponse.json({ error: "UNAUTHORIZED" }, { status: 401 });
+
 	const body: { path?: string } = await request.json();
 	const rel = body.path;
 	if (!rel || typeof rel !== "string")

package/.next/standalone/src/app/api/wiki/content/route.ts

@@ -1,14 +1,23 @@
+import { createHash } from "node:crypto";
 import { mkdir, readFile, writeFile } from "node:fs/promises";
 import path from "node:path";
 import { NextResponse } from "next/server";
-import { safeRootPath } from "@/lib/root-dir";
+import { checkOrigin } from "@/lib/auth/csrf";
+import { requireUser } from "@/lib/auth/server";
+import { emitEvents, trimEvents } from "@/lib/proof/event-bus";
+import { withFileMutex } from "@/lib/proof/mutex";
+import { emptySidecar, readSidecar, writeSidecar } from "@/lib/proof/sidecar";
+import { SIDECAR_EVENT_TRIM_SIZE } from "@/lib/proof-config";
+import { getRootDir, safeRootPath } from "@/lib/root-dir";
 
 const TEXT_EXTS = new Set([
-	"txt", "md", "markdown", "json", "yaml", "yml", "toml", "csv",
+	"txt", "md", "markdown", "json", "yaml", "yml", "toml", "csv", "tsv",
 	"xml", "html", "css", "js", "ts", "tsx", "jsx", "sh", "bash",
 	"zsh", "rb", "py", "go", "rs", "java", "c", "cpp", "h", "php",
-	"swift", "kt", "lua", "sql", "scss",
+	"swift", "kt", "lua", "sql", "scss", "mmd", "mermaid", "ini",
+	"env", "log", "conf",
 ]);
+const MARKDOWN_EXTS = new Set(["md", "markdown"]);
 const MAX_EDIT_SIZE = 1 * 1024 * 1024; // 1MB
 
 function isTextFile(filename: string): boolean {
@@ -16,7 +25,19 @@ function isTextFile(filename: string): boolean {
 	return TEXT_EXTS.has(ext);
 }
 
+function isMarkdownFile(filename: string): boolean {
+	const ext = filename.split(".").pop()?.toLowerCase() ?? "";
+	return MARKDOWN_EXTS.has(ext);
+}
+
+function sha256content(content: string): string {
+	return "sha256:" + createHash("sha256").update(content, "utf8").digest("hex");
+}
+
 export async function GET(request: Request) {
+	const sessionAuth = await requireUser(request);
+	if (!sessionAuth.ok) return NextResponse.json({ error: "UNAUTHORIZED" }, { status: 401 });
+
 	const { searchParams } = new URL(request.url);
 	const rel = searchParams.get("path") ?? "";
 	const filePath = safeRootPath(rel);
@@ -31,14 +52,32 @@ export async function GET(request: Request) {
 				{ error: "File too large (max 1MB)" },
 				{ status: 413 },
 			);
-		return NextResponse.json({ content: buffer.toString("utf-8") });
+		const content = buffer.toString("utf-8");
+		const headers: Record<string, string> = {};
+		if (isMarkdownFile(path.basename(filePath))) {
+			const rootDir = getRootDir();
+			const sc = await readSidecar(rootDir, rel);
+			if (sc) {
+				headers["X-Wiki-Revision"] = String(sc.revision);
+				headers["X-Wiki-Fingerprint"] = sc.fingerprint;
+			}
+		}
+		return NextResponse.json({ content }, { headers });
 	} catch {
 		return NextResponse.json({ error: "File not found" }, { status: 404 });
 	}
 }
 
 export async function PUT(request: Request) {
-	const body: { path?: string; content?: string } = await request.json();
+	const csrf = checkOrigin(request);
+	if (csrf) return csrf;
+	const user = await requireUser(request);
+	if (!user.ok) {
+		return NextResponse.json({ error: "UNAUTHORIZED" }, { status: 401 });
+	}
+
+	const body: { path?: string; content?: string; baseRevision?: number } =
+		await request.json();
 	const rel = body.path;
 	const content = body.content;
 	if (!rel || typeof rel !== "string")
@@ -50,11 +89,71 @@ export async function PUT(request: Request) {
 		return NextResponse.json({ error: "Invalid path" }, { status: 400 });
 	if (!isTextFile(path.basename(filePath)))
 		return NextResponse.json({ error: "Not a text file" }, { status: 400 });
-	try {
-		await mkdir(path.dirname(filePath), { recursive: true });
-		await writeFile(filePath, content, "utf-8");
-		return NextResponse.json({ ok: true });
-	} catch {
-		return NextResponse.json({ error: "Failed to save" }, { status: 500 });
+
+	// Non-markdown files: plain write, no revision tracking.
+	if (!isMarkdownFile(path.basename(filePath))) {
+		try {
+			await mkdir(path.dirname(filePath), { recursive: true });
+			await writeFile(filePath, content, "utf-8");
+			return NextResponse.json({ ok: true });
+		} catch {
+			return NextResponse.json({ error: "Failed to save" }, { status: 500 });
+		}
 	}
+
+	// Markdown files: mutex + sidecar revision check + fingerprint update + event.
+	return withFileMutex(filePath, async () => {
+		const rootDir = getRootDir();
+		const sc = (await readSidecar(rootDir, rel)) ?? emptySidecar(rel);
+
+		// baseRevision is required for markdown to prevent lost writes.
+		if (body.baseRevision === undefined || typeof body.baseRevision !== "number") {
+			return NextResponse.json(
+				{ error: "BASE_REVISION_REQUIRED", message: "baseRevision is required when saving markdown files." },
+				{ status: 400 },
+			);
+		}
+
+		// Enforce staleness check.
+		if (
+			body.baseRevision !== sc.revision
+		) {
+			return NextResponse.json(
+				{
+					error: "STALE_REVISION",
+					currentRevision: sc.revision,
+					message: "File was modified since your last read. Reload and retry.",
+				},
+				{ status: 409 },
+			);
+		}
+
+		try {
+			await mkdir(path.dirname(filePath), { recursive: true });
+			await writeFile(filePath, content, "utf-8");
+		} catch {
+			return NextResponse.json({ error: "Failed to save" }, { status: 500 });
+		}
+
+		// Update sidecar metadata.
+		const newRevision = sc.revision + 1;
+		sc.revision = newRevision;
+		sc.fingerprint = sha256content(content);
+		sc.updatedAt = new Date().toISOString();
+
+		// Emit a human-edit event so agents can see the change.
+		emitEvents(sc, [
+			{
+				type: "file.edited",
+				at: new Date().toISOString(),
+				by: `user:${user.user.id}`,
+				revision: newRevision,
+			},
+		]);
+		trimEvents(sc, SIDECAR_EVENT_TRIM_SIZE);
+
+		await writeSidecar(rootDir, rel, sc);
+
+		return NextResponse.json({ ok: true, revision: newRevision });
+	});
 }

package/.next/standalone/src/app/api/wiki/folder/route.ts

@@ -1,8 +1,15 @@
 import { mkdir } from "node:fs/promises";
 import { NextResponse } from "next/server";
+import { checkOrigin } from "@/lib/auth/csrf";
+import { requireUser } from "@/lib/auth/server";
 import { safeRootPath } from "@/lib/root-dir";
 
 export async function POST(request: Request) {
+	const csrf = checkOrigin(request);
+	if (csrf) return csrf;
+	const auth = await requireUser(request);
+	if (!auth.ok) return NextResponse.json({ error: "UNAUTHORIZED" }, { status: 401 });
+
 	const body: { path?: string } = await request.json();
 	const rel = body.path;
 

package/.next/standalone/src/app/api/wiki/move/route.ts

@@ -1,9 +1,16 @@
 import { rename, stat } from "node:fs/promises";
 import path from "node:path";
 import { NextResponse } from "next/server";
+import { checkOrigin } from "@/lib/auth/csrf";
+import { requireUser } from "@/lib/auth/server";
 import { safeRootPath } from "@/lib/root-dir";
 
 export async function POST(request: Request) {
+	const csrf = checkOrigin(request);
+	if (csrf) return csrf;
+	const auth = await requireUser(request);
+	if (!auth.ok) return NextResponse.json({ error: "UNAUTHORIZED" }, { status: 401 });
+
 	const body: { from?: string; to?: string } = await request.json();
 	if (
 		!body.from ||

package/.next/standalone/src/app/api/wiki/new-file/route.ts

@@ -0,0 +1,55 @@
+import { mkdir, stat, writeFile } from "node:fs/promises";
+import path from "node:path";
+import { NextResponse } from "next/server";
+import { checkOrigin } from "@/lib/auth/csrf";
+import { requireUser } from "@/lib/auth/server";
+import { safeRootPath } from "@/lib/root-dir";
+
+export async function POST(request: Request) {
+	const csrf = checkOrigin(request);
+	if (csrf) return csrf;
+	const auth = await requireUser(request);
+	if (!auth.ok)
+		return NextResponse.json({ error: "UNAUTHORIZED" }, { status: 401 });
+
+	const body: { path?: string } = await request.json();
+	const rel = body.path;
+
+	if (!rel || typeof rel !== "string" || /[<>:"|?*]/.test(rel)) {
+		return NextResponse.json({ error: "Invalid file path" }, { status: 400 });
+	}
+	if (rel.endsWith("/")) {
+		return NextResponse.json({ error: "Invalid file path" }, { status: 400 });
+	}
+
+	const filePath = safeRootPath(rel);
+	if (!filePath)
+		return NextResponse.json({ error: "Invalid path" }, { status: 400 });
+
+	try {
+		await stat(filePath);
+		return NextResponse.json(
+			{ error: "File already exists", path: rel },
+			{ status: 409 },
+		);
+	} catch (e: unknown) {
+		const code = (e as NodeJS.ErrnoException).code;
+		if (code !== "ENOENT") {
+			return NextResponse.json(
+				{ error: "Failed to create file" },
+				{ status: 500 },
+			);
+		}
+	}
+
+	try {
+		await mkdir(path.dirname(filePath), { recursive: true });
+		await writeFile(filePath, "", "utf-8");
+		return NextResponse.json({ ok: true, path: rel });
+	} catch {
+		return NextResponse.json(
+			{ error: "Failed to create file" },
+			{ status: 500 },
+		);
+	}
+}

package/.next/standalone/src/app/api/wiki/page/route.ts

@@ -1,6 +1,8 @@
 import { mkdir, stat, writeFile } from "node:fs/promises";
 import path from "node:path";
 import { NextResponse } from "next/server";
+import { checkOrigin } from "@/lib/auth/csrf";
+import { requireUser } from "@/lib/auth/server";
 import { safeRootPath } from "@/lib/root-dir";
 
 const VALID_DIRS = new Set(["entities", "concepts", "comparisons"]);
@@ -33,6 +35,11 @@ function singularType(
 }
 
 export async function POST(request: Request) {
+	const csrf = checkOrigin(request);
+	if (csrf) return csrf;
+	const auth = await requireUser(request);
+	if (!auth.ok) return NextResponse.json({ error: "UNAUTHORIZED" }, { status: 401 });
+
 	const body: PageBody = await request.json();
 	const { dir, slug } = body;
 

package/.next/standalone/src/app/api/wiki/route.ts

@@ -1,10 +1,15 @@
 import { readdir, rmdir, stat, unlink } from "node:fs/promises";
 import path from "node:path";
 import { NextResponse } from "next/server";
+import { checkOrigin } from "@/lib/auth/csrf";
+import { requireUser } from "@/lib/auth/server";
 import { getRootDir, safeRootPath } from "@/lib/root-dir";
 import { isAppFolder, isNodeApp } from "@/lib/wiki-helpers";
 
 export async function GET(request: Request) {
+	const auth = await requireUser(request);
+	if (!auth.ok) return NextResponse.json({ error: "UNAUTHORIZED" }, { status: 401 });
+
 	const { searchParams } = new URL(request.url);
 	const dir = searchParams.get("dir") ?? "";
 
@@ -67,6 +72,11 @@ export async function GET(request: Request) {
 }
 
 export async function DELETE(request: Request) {
+	const csrf = checkOrigin(request);
+	if (csrf) return csrf;
+	const auth = await requireUser(request);
+	if (!auth.ok) return NextResponse.json({ error: "UNAUTHORIZED" }, { status: 401 });
+
 	const body: { path?: string } = await request.json();
 	const rel = body.path;
 	if (!rel || typeof rel !== "string")

package/.next/standalone/src/app/api/wiki/slugs/route.ts

@@ -1,6 +1,7 @@
 import { readdir } from "node:fs/promises";
 import path from "node:path";
 import { NextResponse } from "next/server";
+import { requireUser } from "@/lib/auth/server";
 import { getRootDir } from "@/lib/root-dir";
 
 type SlugBuckets = {
@@ -26,7 +27,10 @@ async function readMarkdownSlugsFromDir(dirPath: string): Promise<string[]> {
 	}
 }
 
-export async function GET() {
+export async function GET(request: Request) {
+	const auth = await requireUser(request);
+	if (!auth.ok) return NextResponse.json({ error: "UNAUTHORIZED" }, { status: 401 });
+
 	try {
 		// Scan root + known dirs (entities, concepts, comparisons for wiki compat)
 		// plus any other immediate subdirectories

package/.next/standalone/src/app/api/wiki/upload/route.ts

@@ -1,6 +1,8 @@
 import { mkdir, writeFile } from "node:fs/promises";
 import path from "node:path";
 import { NextResponse } from "next/server";
+import { checkOrigin } from "@/lib/auth/csrf";
+import { requireUser } from "@/lib/auth/server";
 import { safeRootPath } from "@/lib/root-dir";
 
 const ALLOWED_MIME_TYPES = new Set([
@@ -35,6 +37,11 @@ function sanitizeFilename(name: string): string {
 }
 
 export async function POST(request: Request) {
+	const csrf = checkOrigin(request);
+	if (csrf) return csrf;
+	const auth = await requireUser(request);
+	if (!auth.ok) return NextResponse.json({ error: "UNAUTHORIZED" }, { status: 401 });
+
 	let formData: FormData;
 	try {
 		formData = await request.formData();

package/.next/standalone/src/app/api/wiki/watch/route.ts

@@ -2,9 +2,14 @@ export const runtime = "nodejs";
 
 import { watch } from "chokidar";
 import path from "node:path";
+import { NextResponse } from "next/server";
+import { requireUser } from "@/lib/auth/server";
 import { getRootDir } from "@/lib/root-dir";
 
-export async function GET() {
+export async function GET(request: Request) {
+	const auth = await requireUser(request);
+	if (!auth.ok) return NextResponse.json({ error: "UNAUTHORIZED" }, { status: 401 });
+
 	const rootDir = getRootDir();
 	if (!rootDir) {
 		return new Response("Root not configured", { status: 503 });

package/.next/standalone/src/app/globals.css

@@ -714,3 +714,73 @@ nextjs-portal {
 .wiki-link[data-broken="true"]:hover {
 	background: color-mix(in srgb, var(--destructive) 10%, transparent);
 }
+
+/* Proof-span provenance marks */
+proof-span.proof-span,
+.proof-span {
+	background: linear-gradient(
+		to right,
+		rgba(165, 180, 252, 0.08),
+		rgba(165, 180, 252, 0)
+	);
+	border-left: 2px solid rgb(165, 180, 252);
+	padding-left: 4px;
+	border-radius: 2px;
+	cursor: pointer;
+	transition: background 120ms ease;
+}
+proof-span.proof-span[origin="human"],
+.proof-span[origin="human"] {
+	border-left-color: rgb(110, 231, 183);
+	background: linear-gradient(
+		to right,
+		rgba(110, 231, 183, 0.08),
+		rgba(110, 231, 183, 0)
+	);
+}
+proof-span.proof-span:hover,
+.proof-span:hover {
+	background: linear-gradient(
+		to right,
+		rgba(165, 180, 252, 0.18),
+		rgba(165, 180, 252, 0.04)
+	);
+}
+.dark proof-span.proof-span,
+.dark .proof-span {
+	background: linear-gradient(
+		to right,
+		rgba(165, 180, 252, 0.14),
+		rgba(165, 180, 252, 0)
+	);
+}
+
+/* Read-only markdown viewer code styling */
+.md-pre {
+	background: var(--muted);
+	color: var(--foreground);
+	padding: 0.75rem 0.9rem;
+	border-radius: calc(var(--radius) * 2);
+	overflow-x: auto;
+	font-size: 0.8125rem;
+	line-height: 1.55;
+	margin: 0.75rem 0;
+}
+.md-pre .md-code,
+.md-pre code {
+	background: transparent;
+	color: inherit;
+	padding: 0;
+	border-radius: 0;
+	font-size: inherit;
+	white-space: pre;
+	display: block;
+}
+.md-code {
+	background: var(--muted);
+	color: var(--foreground);
+	padding: 0.1rem 0.3rem;
+	border-radius: var(--radius);
+	font-size: 0.85em;
+	font-family: ui-monospace, SFMono-Regular, Menlo, Consolas, monospace;
+}