wiki-viewer 1.14.1 → 1.14.2

package/.next/standalone/src/app/api/system/browse/route.ts

@@ -1,82 +0,0 @@
-import { readdir, stat } from "node:fs/promises";
-import os from "node:os";
-import path from "node:path";
-import { NextResponse } from "next/server";
-import { requireUser } from "@/lib/auth/server";
-
-interface BrowseEntry {
-	name: string;
-	path: string;
-	accessible: boolean;
-}
-
-export async function GET(request: Request) {
-	const auth = await requireUser(request);
-	if (!auth.ok) return NextResponse.json({ error: "UNAUTHORIZED" }, { status: 401 });
-
-	const { searchParams } = new URL(request.url);
-	const rawPath = searchParams.get("path");
-
-	// Default to home dir
-	const target = rawPath ? path.resolve(rawPath) : os.homedir();
-
-	// Verify it's a directory
-	try {
-		const info = await stat(target);
-		if (!info.isDirectory()) {
-			return NextResponse.json({ error: "Not a directory" }, { status: 400 });
-		}
-	} catch {
-		return NextResponse.json({ error: "Path not found" }, { status: 404 });
-	}
-
-	// List entries — only directories
-	let entries: BrowseEntry[] = [];
-	try {
-		const names = await readdir(target);
-		const infos = await Promise.allSettled(
-			names.map(async (name) => {
-				const full = path.join(target, name);
-				const info = await stat(full);
-				return { name, full, isDir: info.isDirectory() };
-			}),
-		);
-		entries = infos
-			.filter(
-				(r): r is PromiseFulfilledResult<{ name: string; full: string; isDir: boolean }> =>
-					r.status === "fulfilled" && r.value.isDir,
-			)
-			.map((r) => ({ name: r.value.name, path: r.value.full, accessible: true }))
-			.sort((a, b) => a.name.localeCompare(b.name));
-	} catch {
-		// Permission denied or similar — return empty list but still allow selection
-	}
-
-	// Parent path (null at filesystem root)
-	const parent = target === path.parse(target).root ? null : path.dirname(target);
-
-	// Quick-access shortcuts
-	const home = os.homedir();
-	const shortcuts = [
-		{ label: "Home", path: home },
-		{ label: "Root", path: "/" },
-	];
-	// Add common paths that exist
-	for (const [label, p] of [
-		["Desktop", path.join(home, "Desktop")],
-		["Documents", path.join(home, "Documents")],
-		["Downloads", path.join(home, "Downloads")],
-	] as [string, string][]) {
-		try {
-			await stat(p);
-			shortcuts.push({ label, path: p });
-		} catch {}
-	}
-
-	return NextResponse.json({
-		path: target,
-		parent,
-		entries,
-		shortcuts,
-	});
-}

package/.next/standalone/src/app/api/system/clear-root/route.ts

@@ -1,16 +0,0 @@
-import { NextResponse } from "next/server";
-import { checkOrigin } from "@/lib/auth/csrf";
-import { requireUser } from "@/lib/auth/server";
-import { writeConfig } from "@/lib/config";
-import { clearRootDir } from "@/lib/root-dir";
-
-export async function POST(request: Request) {
-	const csrf = checkOrigin(request);
-	if (csrf) return csrf;
-	const auth = await requireUser(request);
-	if (!auth.ok) return NextResponse.json({ error: "UNAUTHORIZED" }, { status: 401 });
-
-	clearRootDir();
-	await writeConfig({ lastOpenedPath: undefined });
-	return NextResponse.json({ ok: true });
-}

package/.next/standalone/src/app/api/system/config/route.ts

@@ -1,14 +0,0 @@
-import { NextResponse } from "next/server";
-import { requireUser } from "@/lib/auth/server";
-import { readConfig } from "@/lib/config";
-
-export async function GET(request: Request) {
-	const auth = await requireUser(request);
-	if (!auth.ok) return NextResponse.json({ error: "UNAUTHORIZED" }, { status: 401 });
-
-	const config = await readConfig();
-	return NextResponse.json({
-		pinnedPaths: config.pinnedPaths ?? [],
-		lastOpenedPath: config.lastOpenedPath ?? null,
-	});
-}

package/.next/standalone/src/app/api/system/pins/route.ts

@@ -1,38 +0,0 @@
-import { stat } from "node:fs/promises";
-import { NextResponse } from "next/server";
-import { checkOrigin } from "@/lib/auth/csrf";
-import { requireUser } from "@/lib/auth/server";
-import { readConfig, writeConfig } from "@/lib/config";
-
-export async function POST(request: Request) {
-	const csrf = checkOrigin(request);
-	if (csrf) return csrf;
-	const auth = await requireUser(request);
-	if (!auth.ok) return NextResponse.json({ error: "UNAUTHORIZED" }, { status: 401 });
-
-	const body: { path?: string; action?: "pin" | "unpin" } = await request.json();
-	const p = body.path?.trim();
-	const action = body.action ?? "pin";
-	if (!p) return NextResponse.json({ error: "Missing path" }, { status: 400 });
-
-	if (action === "pin") {
-		try {
-			const info = await stat(p);
-			if (!info.isDirectory())
-				return NextResponse.json({ error: "Not a directory" }, { status: 400 });
-		} catch {
-			return NextResponse.json({ error: "Path not found" }, { status: 404 });
-		}
-		const config = await readConfig();
-		const pins = config.pinnedPaths ?? [];
-		if (!pins.includes(p)) {
-			await writeConfig({ pinnedPaths: [...pins, p] });
-		}
-	} else {
-		const config = await readConfig();
-		const pins = (config.pinnedPaths ?? []).filter((x) => x !== p);
-		await writeConfig({ pinnedPaths: pins });
-	}
-
-	return NextResponse.json({ ok: true });
-}

package/.next/standalone/src/app/api/system/reveal/route.ts

@@ -1,36 +0,0 @@
-import { exec } from "node:child_process";
-import path from "node:path";
-import { NextResponse } from "next/server";
-import { checkOrigin } from "@/lib/auth/csrf";
-import { resolveWorkspaceForUser } from "@/lib/workspace-context";
-import { safeWorkspacePath } from "@/lib/workspaces";
-
-export async function POST(request: Request) {
-	const csrf = checkOrigin(request);
-	if (csrf) return csrf;
-	const ctx = await resolveWorkspaceForUser(request);
-	if (!ctx.ok) return NextResponse.json({ error: ctx.code }, { status: ctx.status });
-	const { rootDir } = ctx;
-
-	const body: { path?: string } = await request.json();
-	const rel = body.path;
-	if (!rel || typeof rel !== "string")
-		return NextResponse.json({ error: "Invalid path" }, { status: 400 });
-
-	// Path traversal guard
-	const resolved = safeWorkspacePath(rootDir, rel);
-	if (!resolved)
-		return NextResponse.json({ error: "Invalid path" }, { status: 400 });
-
-	// Open in system file manager
-	const platform = process.platform;
-	const cmd =
-		platform === "darwin"
-			? `open -R "${resolved}"`
-			: platform === "win32"
-				? `explorer /select,"${resolved}"`
-				: `xdg-open "${path.dirname(resolved)}"`;
-
-	exec(cmd, () => {});
-	return NextResponse.json({ ok: true });
-}

package/.next/standalone/src/app/api/system/root-status/route.ts

@@ -1,13 +0,0 @@
-import { NextResponse } from "next/server";
-import { requireUser } from "@/lib/auth/server";
-import { getRootDir, isRootDirSet } from "@/lib/root-dir";
-
-export async function GET(request: Request) {
-	const auth = await requireUser(request);
-	if (!auth.ok) return NextResponse.json({ error: "UNAUTHORIZED" }, { status: 401 });
-
-	return NextResponse.json({
-		configured: isRootDirSet(),
-		path: isRootDirSet() ? getRootDir() : null,
-	});
-}

package/.next/standalone/src/app/api/system/set-root/route.ts

@@ -1,53 +0,0 @@
-/**
- * Legacy set-root endpoint — back-compat shim for D1.
- *
- * Behaviour:
- *  1. Validate dir (same as before).
- *  2. Create (or find) a workspace for rootDir in the registry.
- *  3. Keep setting the process-global rootDir + writing lastOpenedPath to config
- *     so the legacy fallback path still works for the existing client.
- *  4. Return { ok, path, workspaceId } — added workspaceId for D2 migration.
- *
- * NOTE: NOT admin-gated here so the current single-user flow is unaffected.
- * The new POST /api/system/workspaces route is admin-gated; D2 will switch the
- * UI to use that endpoint.
- */
-import { stat } from "node:fs/promises";
-import { NextResponse } from "next/server";
-import { checkOrigin } from "@/lib/auth/csrf";
-import { requireUser } from "@/lib/auth/server";
-import { writeConfig } from "@/lib/config";
-import { setRootDir } from "@/lib/root-dir";
-import { listWorkspaces, createWorkspace } from "@/lib/workspaces";
-import path from "node:path";
-
-export async function POST(request: Request) {
-	const csrf = checkOrigin(request);
-	if (csrf) return csrf;
-	const auth = await requireUser(request);
-	if (!auth.ok) return NextResponse.json({ error: "UNAUTHORIZED" }, { status: 401 });
-
-	const body: { path?: string } = await request.json();
-	const dir = body.path?.trim();
-	if (!dir) return NextResponse.json({ error: "Missing path" }, { status: 400 });
-
-	// Verify it exists and is a directory
-	try {
-		const info = await stat(dir);
-		if (!info.isDirectory())
-			return NextResponse.json({ error: "Not a directory" }, { status: 400 });
-	} catch {
-		return NextResponse.json({ error: "Directory not found" }, { status: 404 });
-	}
-
-	// Legacy: keep the global + config in sync for the fallback resolver.
-	setRootDir(dir);
-	await writeConfig({ lastOpenedPath: dir });
-
-	// Find or create a workspace for this rootDir so the registry is populated.
-	const resolved = path.resolve(dir);
-	const existing = (await listWorkspaces()).find((w) => w.rootDir === resolved);
-	const ws = existing ?? (await createWorkspace({ rootDir: dir, createdBy: auth.user.id }));
-
-	return NextResponse.json({ ok: true, path: dir, workspaceId: ws.id });
-}

package/.next/standalone/src/app/api/system/users/route.ts

@@ -1,120 +0,0 @@
-/**
- * POST /api/system/users  (admin only)
- *
- * Admin creates a new account with a generated temporary password, returned
- * once in the response. The new user signs in and changes it. The signup
- * allowlist is bypassed for admin-initiated creation (the admin is the gate).
- *
- * This calls auth.api.signUpEmail server-side; the session it would mint for
- * the new user is discarded (we never forward those Set-Cookie headers), so
- * the admin's own session is untouched.
- */
-export const runtime = "nodejs";
-
-import { NextResponse } from "next/server";
-import { randomBytes } from "node:crypto";
-import { checkOrigin } from "@/lib/auth/csrf";
-import { requireAdmin } from "@/lib/auth/admin";
-import { auth, authReady, withAdminUserCreate, passwordAuthEnabled, db } from "@/lib/auth/server";
-
-const EMAIL_RE = /^[^@\s]+@[^@\s]+\.[^@\s]+$/;
-
-/** Readable temp password: 4 groups, mixed case + digits, no ambiguous chars. */
-function generateTempPassword(): string {
-	const alphabet = "ABCDEFGHJKLMNPQRSTUVWXYZabcdefghijkmnopqrstuvwxyz23456789";
-	const bytes = randomBytes(16);
-	let out = "";
-	for (let i = 0; i < 16; i++) {
-		out += alphabet[bytes[i] % alphabet.length];
-		if (i % 4 === 3 && i < 15) out += "-";
-	}
-	return out; // e.g. "k7Pm-9QrT-x2Vn-bL4w"
-}
-
-export async function POST(req: Request): Promise<NextResponse> {
-	const csrf = checkOrigin(req);
-	if (csrf) return csrf;
-
-	const admin = await requireAdmin(req);
-	if (!admin.ok) {
-		return NextResponse.json({ error: admin.code }, { status: admin.status });
-	}
-
-	if (!passwordAuthEnabled) {
-		return NextResponse.json(
-			{ error: "PASSWORD_AUTH_DISABLED", message: "Email/password sign-in is disabled; cannot create password accounts." },
-			{ status: 400 },
-		);
-	}
-
-	let body: { email?: unknown; name?: unknown };
-	try {
-		body = (await req.json()) as { email?: unknown; name?: unknown };
-	} catch {
-		return NextResponse.json({ error: "INVALID_PAYLOAD", message: "Invalid JSON" }, { status: 400 });
-	}
-
-	const email = typeof body.email === "string" ? body.email.trim().toLowerCase() : "";
-	const name = typeof body.name === "string" && body.name.trim() ? body.name.trim() : email.split("@")[0];
-
-	if (!EMAIL_RE.test(email)) {
-		return NextResponse.json({ error: "INVALID_EMAIL", message: "A valid email is required" }, { status: 400 });
-	}
-
-	const tempPassword = generateTempPassword();
-
-	await authReady();
-	// Reject duplicates up front (signUpEmail may otherwise create a second
-	// credential row or silently succeed depending on Better Auth internals).
-	try {
-		const existing = db
-			.prepare("SELECT 1 FROM user WHERE lower(email) = ? LIMIT 1")
-			.get(email);
-		if (existing) {
-			return NextResponse.json(
-				{ error: "USER_EXISTS", message: "A user with that email already exists." },
-				{ status: 409 },
-			);
-		}
-	} catch {
-		// If the lookup fails, fall through and let signUpEmail decide.
-	}
-
-	try {
-		// Bypass the signup allowlist for this admin-initiated creation. The
-		// returned response (and any session cookie) is intentionally discarded.
-		const result = await withAdminUserCreate(() =>
-			auth.api.signUpEmail({
-				body: { email, password: tempPassword, name },
-				asResponse: true,
-			}),
-		);
-		if (!result.ok) {
-			const text = await result.text().catch(() => "");
-			if (/exist|unique|already/i.test(text)) {
-				return NextResponse.json(
-					{ error: "USER_EXISTS", message: "A user with that email already exists." },
-					{ status: 409 },
-				);
-			}
-			return NextResponse.json(
-				{ error: "CREATE_FAILED", message: text || "Failed to create user" },
-				{ status: 500 },
-			);
-		}
-	} catch (e) {
-		const msg = e instanceof Error ? e.message : "";
-		if (/exist|unique|already/i.test(msg)) {
-			return NextResponse.json(
-				{ error: "USER_EXISTS", message: "A user with that email already exists." },
-				{ status: 409 },
-			);
-		}
-		return NextResponse.json(
-			{ error: "CREATE_FAILED", message: msg || "Failed to create user" },
-			{ status: 500 },
-		);
-	}
-
-	return NextResponse.json({ ok: true, email, name, tempPassword });
-}

package/.next/standalone/src/app/api/system/workspaces/[id]/open/route.ts

@@ -1,34 +0,0 @@
-/**
- * POST /api/system/workspaces/[id]/open
- *
- * Client calls this when switching to a workspace.  Records lastOpenedAt so
- * the most-recently-used workspace can be selected on next load.
- */
-import { NextResponse } from "next/server";
-import { checkOrigin } from "@/lib/auth/csrf";
-import { requireUser } from "@/lib/auth/server";
-import { isAdmin } from "@/lib/auth/admin";
-import { getWorkspace, touchWorkspace, userCanAccess } from "@/lib/workspaces";
-
-export const runtime = "nodejs";
-
-type Params = { params: Promise<{ id: string }> };
-
-export async function POST(request: Request, { params }: Params) {
-	const csrf = checkOrigin(request);
-	if (csrf) return csrf;
-
-	const auth = await requireUser(request);
-	if (!auth.ok) return NextResponse.json({ error: "UNAUTHORIZED" }, { status: 401 });
-
-	const { id } = await params;
-	const ws = await getWorkspace(id);
-	if (!ws) return NextResponse.json({ error: "WORKSPACE_NOT_FOUND" }, { status: 404 });
-
-	const admin = await isAdmin(auth.user.id, auth.user.email);
-	if (!userCanAccess(ws, auth.user.id, admin))
-		return NextResponse.json({ error: "WORKSPACE_FORBIDDEN" }, { status: 403 });
-
-	await touchWorkspace(id);
-	return NextResponse.json({ ok: true });
-}

package/.next/standalone/src/app/api/system/workspaces/[id]/refresh/route.ts

@@ -1,32 +0,0 @@
-/**
- * POST /api/system/workspaces/[id]/refresh
- *
- * Admin-only: pull the latest commit for a git-backed workspace (ff-only).
- * Returns the new HEAD sha and pull time. Never returns any token.
- */
-import { NextResponse } from "next/server";
-import { checkOrigin } from "@/lib/auth/csrf";
-import { requireAdmin } from "@/lib/auth/admin";
-import { refreshGitWorkspace } from "@/lib/workspaces";
-
-export const runtime = "nodejs";
-
-type Params = { params: Promise<{ id: string }> };
-
-export async function POST(request: Request, { params }: Params) {
-	const csrf = checkOrigin(request);
-	if (csrf) return csrf;
-
-	const authResult = await requireAdmin(request);
-	if (!authResult.ok)
-		return NextResponse.json({ error: authResult.code }, { status: authResult.status });
-
-	const { id } = await params;
-	try {
-		const result = await refreshGitWorkspace(id);
-		return NextResponse.json({ ok: true, ...result });
-	} catch (err) {
-		const msg = err instanceof Error ? err.message : String(err);
-		return NextResponse.json({ error: msg }, { status: 400 });
-	}
-}

package/.next/standalone/src/app/api/system/workspaces/[id]/route.ts

@@ -1,78 +0,0 @@
-/**
- * Per-workspace management API.
- *
- * PATCH  /api/system/workspaces/[id]  — update name, pinnedPaths (any user with
- *                                       access), or allowedUserIds (admin-only).
- * DELETE /api/system/workspaces/[id]  — admin-only: remove workspace from registry
- *                                       (never touches the filesystem directory).
- */
-import { NextResponse } from "next/server";
-import { checkOrigin } from "@/lib/auth/csrf";
-import { requireUser } from "@/lib/auth/server";
-import { isAdmin, requireAdmin } from "@/lib/auth/admin";
-import {
-	getWorkspace,
-	renameWorkspace,
-	removeWorkspace,
-	setWorkspaceAccess,
-	setWorkspacePins,
-	userCanAccess,
-	sanitizeWorkspace,
-} from "@/lib/workspaces";
-
-export const runtime = "nodejs";
-
-type Params = { params: Promise<{ id: string }> };
-
-export async function PATCH(request: Request, { params }: Params) {
-	const csrf = checkOrigin(request);
-	if (csrf) return csrf;
-
-	const auth = await requireUser(request);
-	if (!auth.ok) return NextResponse.json({ error: "UNAUTHORIZED" }, { status: 401 });
-
-	const { id } = await params;
-	const ws = await getWorkspace(id);
-	if (!ws) return NextResponse.json({ error: "WORKSPACE_NOT_FOUND" }, { status: 404 });
-
-	const admin = await isAdmin(auth.user.id, auth.user.email);
-	if (!userCanAccess(ws, auth.user.id, admin))
-		return NextResponse.json({ error: "WORKSPACE_FORBIDDEN" }, { status: 403 });
-
-	const body: {
-		name?: string;
-		pinnedPaths?: string[];
-		allowedUserIds?: string[];
-	} = await request.json();
-
-	// allowedUserIds is admin-only
-	if (body.allowedUserIds !== undefined && !admin)
-		return NextResponse.json({ error: "ADMIN_REQUIRED" }, { status: 403 });
-
-	// Apply each field
-	if (body.name !== undefined) await renameWorkspace(id, body.name.trim());
-	if (body.pinnedPaths !== undefined) await setWorkspacePins(id, body.pinnedPaths);
-	if (body.allowedUserIds !== undefined) await setWorkspaceAccess(id, body.allowedUserIds);
-
-	const updated = await getWorkspace(id);
-	return NextResponse.json({
-		ok: true,
-		workspace: updated ? sanitizeWorkspace(updated) : updated,
-	});
-}
-
-export async function DELETE(request: Request, { params }: Params) {
-	const csrf = checkOrigin(request);
-	if (csrf) return csrf;
-
-	const authResult = await requireAdmin(request);
-	if (!authResult.ok)
-		return NextResponse.json({ error: authResult.code }, { status: authResult.status });
-
-	const { id } = await params;
-	const ws = await getWorkspace(id);
-	if (!ws) return NextResponse.json({ error: "WORKSPACE_NOT_FOUND" }, { status: 404 });
-
-	await removeWorkspace(id);
-	return NextResponse.json({ ok: true });
-}

package/.next/standalone/src/app/api/system/workspaces/route.ts

@@ -1,128 +0,0 @@
-/**
- * Workspace management API — list and create.
- *
- * GET  /api/system/workspaces  — any signed-in user; returns workspaces the
- *                                caller can access + isAdmin flag.
- * POST { rootDir, name? }      — admin-only: create a new workspace.
- *
- * Bootstrap: first authenticated request triggers ensureBootstrapAdmin.
- */
-import { stat } from "node:fs/promises";
-import { NextResponse } from "next/server";
-import { checkOrigin } from "@/lib/auth/csrf";
-import { requireUser } from "@/lib/auth/server";
-import { isAdmin, requireAdmin, ensureBootstrapAdmin } from "@/lib/auth/admin";
-import { readConfig } from "@/lib/config";
-import {
-	listWorkspaces,
-	createWorkspace,
-	createGitWorkspace,
-	migrateConfigToWorkspaces,
-	userCanAccess,
-	sanitizeWorkspace,
-} from "@/lib/workspaces";
-
-export const runtime = "nodejs";
-
-export async function GET(request: Request) {
-	// --no-auth bypass: single-user local mode has no session. Treat the local
-	// user as admin so workspace management (add/delete) is available, matching
-	// requireAdmin and resolveWorkspaceForUser.
-	if (process.env.WIKI_NO_AUTH === "1") {
-		await migrateConfigToWorkspaces();
-		const workspaces = (await listWorkspaces()).map(sanitizeWorkspace);
-		return NextResponse.json({ workspaces, isAdmin: true });
-	}
-
-	const auth = await requireUser(request);
-	if (!auth.ok) return NextResponse.json({ error: "UNAUTHORIZED" }, { status: 401 });
-
-	// Bootstrap: first authenticated user becomes admin if no admin set yet.
-	await ensureBootstrapAdmin(auth.user.id);
-	await migrateConfigToWorkspaces();
-
-	const admin = await isAdmin(auth.user.id, auth.user.email);
-	const all = await listWorkspaces();
-	const workspaces = all
-		.filter((ws) => userCanAccess(ws, auth.user.id, admin))
-		.map(sanitizeWorkspace);
-
-	return NextResponse.json({ workspaces, isAdmin: admin });
-}
-
-export async function POST(request: Request) {
-	const csrf = checkOrigin(request);
-	if (csrf) return csrf;
-
-	const authResult = await requireAdmin(request);
-	if (!authResult.ok)
-		return NextResponse.json({ error: authResult.code }, { status: authResult.status });
-
-	const body: {
-		rootDir?: string;
-		name?: string;
-		remoteUrl?: string;
-		branch?: string;
-		token?: string;
-		username?: string;
-		subpath?: string;
-	} = await request.json();
-
-	// Git-backed workspace path
-	if (body.remoteUrl) {
-		// Fast subpath validation before hitting git.
-		if (body.subpath !== undefined && typeof body.subpath !== "string") {
-			return NextResponse.json({ error: "Invalid subpath" }, { status: 400 });
-		}
-		const rawSubpath = body.subpath?.trim() || undefined;
-		if (rawSubpath) {
-			if (
-				rawSubpath.startsWith("/") ||
-				rawSubpath.includes("..") ||
-				/[;|&$`<>(){}\n\0]/.test(rawSubpath)
-			) {
-				return NextResponse.json({ error: "Invalid subpath" }, { status: 400 });
-			}
-		}
-		const cfg = await readConfig();
-		try {
-			const workspace = await createGitWorkspace({
-				remoteUrl: body.remoteUrl,
-				branch: body.branch?.trim() || undefined,
-				token: body.token || undefined,
-				username: body.username?.trim() || undefined,
-				name: body.name?.trim() || undefined,
-				createdBy: authResult.user.id,
-				allowedHosts: cfg.git?.allowedHosts,
-				allowInsecureHttp: cfg.git?.allowInsecureHttp,
-				subpath: rawSubpath,
-			});
-			// Never echo token in response; sanitizeWorkspace strips tokenRef.
-			return NextResponse.json({ ok: true, workspace: sanitizeWorkspace(workspace) });
-		} catch (err) {
-			const msg = err instanceof Error ? err.message : String(err);
-			return NextResponse.json({ error: msg }, { status: 400 });
-		}
-	}
-
-	// Plain local workspace path
-	const rootDir = body.rootDir?.trim();
-	if (!rootDir) return NextResponse.json({ error: "Missing rootDir" }, { status: 400 });
-
-	// Validate directory
-	try {
-		const info = await stat(rootDir);
-		if (!info.isDirectory())
-			return NextResponse.json({ error: "Not a directory" }, { status: 400 });
-	} catch {
-		return NextResponse.json({ error: "Directory not found" }, { status: 404 });
-	}
-
-	const workspace = await createWorkspace({
-		rootDir,
-		name: body.name?.trim() || undefined,
-		createdBy: authResult.user.id,
-	});
-
-	return NextResponse.json({ ok: true, workspace: sanitizeWorkspace(workspace) });
-}