wiki-viewer 1.14.1 → 2.0.0

package/.next/standalone/src/app/api/agent/fs/move/route.ts

@@ -1,130 +0,0 @@
-/**
- * Tier-1 Raw FS — atomic move/rename.
- *
- * POST /api/agent/fs/move
- * Body: { from: string, to: string, ifMatch?: string }
- *
- * Moves sidecar for .md files (R3).
- * Locks source + dest in sorted order to avoid deadlock.
- * Requires source read+mutate, dest mutate.
- */
-export const runtime = "nodejs";
-
-import { rename, stat } from "node:fs/promises";
-import path from "node:path";
-import { NextResponse } from "next/server";
-import { checkAuth, enforceScope } from "@/lib/proof/auth";
-import { resolveWorkspaceForAgent } from "@/lib/workspace-context";
-import { safeWorkspacePath } from "@/lib/workspaces";
-import { withFileMutex } from "@/lib/proof/mutex";
-import { moveSidecar } from "@/lib/proof/sidecar";
-import { writeAuditRow } from "@/lib/proof/audit";
-import { safeAbsPath, sha256ofBuf, extractShaHex, isMarkdown } from "@/lib/proof/raw-fs";
-import { readFile } from "node:fs/promises";
-
-function errJson(code: string, message: string, status: number): NextResponse {
-	return NextResponse.json({ error: code, message }, { status });
-}
-
-export async function POST(req: Request): Promise<NextResponse> {
-	const auth = await checkAuth(req);
-	if (!auth.ok) return errJson("UNAUTHORIZED", auth.message ?? "Unauthorized", 401);
-
-	let body: { from?: unknown; to?: unknown; ifMatch?: unknown };
-	try {
-		body = (await req.json()) as typeof body;
-	} catch {
-		return errJson("INVALID_PAYLOAD", "Invalid JSON body", 400);
-	}
-
-	if (typeof body.from !== "string" || !body.from) {
-		return errJson("INVALID_PAYLOAD", "from (string) required", 400);
-	}
-	if (typeof body.to !== "string" || !body.to) {
-		return errJson("INVALID_PAYLOAD", "to (string) required", 400);
-	}
-
-	const fromRel = body.from;
-	const toRel = body.to;
-	const ifMatch = typeof body.ifMatch === "string" ? body.ifMatch : undefined;
-
-	const wsx = await resolveWorkspaceForAgent(req, "write");
-	if (!wsx.ok) return errJson(wsx.code, wsx.code, wsx.status);
-	const { ws, rootDir } = wsx;
-
-	// Basic traversal
-	if (!safeWorkspacePath(rootDir, fromRel)) return errJson("INVALID_PATH", "from: path traversal rejected", 400);
-	if (!safeWorkspacePath(rootDir, toRel)) return errJson("INVALID_PATH", "to: path traversal rejected", 400);
-
-	const fromAbs = await safeAbsPath(rootDir, fromRel);
-	if (!fromAbs) return errJson("INVALID_PATH", "from: path rejected (symlink escape or denied)", 400);
-	const toAbs = await safeAbsPath(rootDir, toRel);
-	if (!toAbs) return errJson("INVALID_PATH", "to: path rejected (symlink escape or denied)", 400);
-
-	// Self-move guard
-	if (fromAbs === toAbs) return errJson("INVALID_PATH", "from and to are the same path", 400);
-	if (toAbs.startsWith(fromAbs + path.sep)) {
-		return errJson("INVALID_PATH", "Cannot move a directory into itself", 400);
-	}
-
-	// Scope: source requires read+mutate; dest requires mutate
-	const sc1 = enforceScope(auth.agent, { filePath: fromRel, op: "read", workspaceId: ws.id });
-	if (!sc1.ok) return errJson(sc1.code, sc1.message, 403);
-	const sc2 = enforceScope(auth.agent, { filePath: fromRel, op: "mutate", workspaceId: ws.id });
-	if (!sc2.ok) return errJson(sc2.code, sc2.message, 403);
-	const sc3 = enforceScope(auth.agent, { filePath: toRel, op: "mutate", workspaceId: ws.id });
-	if (!sc3.ok) return errJson(sc3.code, sc3.message, 403);
-
-	// Verify source exists
-	try {
-		await stat(fromAbs);
-	} catch (e) {
-		if ((e as NodeJS.ErrnoException).code === "ENOENT") {
-			return errJson("NOT_FOUND", "Source file not found", 404);
-		}
-		throw e;
-	}
-
-	// If-Match guard (R4)
-	let existingSha: string | undefined;
-	if (ifMatch) {
-		let buf: Buffer;
-		try {
-			buf = await readFile(fromAbs);
-		} catch {
-			return errJson("NOT_FOUND", "Source file not found", 404);
-		}
-		existingSha = sha256ofBuf(buf);
-		if (extractShaHex(ifMatch) !== extractShaHex(existingSha)) {
-			return errJson("PRECONDITION_FAILED", "If-Match sha256 mismatch", 412);
-		}
-	}
-
-	const isMd = isMarkdown(fromRel);
-
-	// Lock source + dest in sorted order to avoid deadlock
-	const [first, second] = [fromRel, toRel].sort();
-
-	const doMove = async () => {
-		await rename(fromAbs, toAbs);
-		if (isMd) {
-			await moveSidecar(rootDir, fromRel, toRel);
-		}
-		writeAuditRow({
-			agentId: auth.agent.id,
-			op: "move",
-			path: fromRel,
-			newSha: toRel, // store destination in newSha field for audit trail
-			forced: false,
-			workspaceId: ws.id,
-		});
-	};
-
-	if (first === fromRel) {
-		await withFileMutex(`${rootDir}\u0000${first}`, () => withFileMutex(`${rootDir}\u0000${second}`, doMove));
-	} else {
-		await withFileMutex(`${rootDir}\u0000${first}`, () => withFileMutex(`${rootDir}\u0000${second}`, doMove));
-	}
-
-	return NextResponse.json({ from: fromRel, to: toRel });
-}

package/.next/standalone/src/app/api/agent/fs/search/route.ts

@@ -1,272 +0,0 @@
-/**
- * Tier-1 Raw FS — server-side search.
- *
- * POST /api/agent/fs/search
- * Body: {
- *   kind: "grep" | "glob",
- *   query: string,          // grep: regex string; glob: glob pattern
- *   path?: string,          // root-relative start path (default: root)
- *   limit?: number,         // max matches (default 200, hard cap 2000)
- * }
- *
- * Returns { kind, query, matches: [{path, line?, col?, text?}], truncated }.
- *
- * - Pure JS (no shell interpolation, no rg dependency)
- * - Skips binary files (null-byte heuristic) for grep
- * - Skips .proof/ and .git/
- * - Re-checks scope on every matched path
- */
-export const runtime = "nodejs";
-
-import { readdir, readFile, stat } from "node:fs/promises";
-import { ensureIndexer, ftsSearch } from "@/lib/search/indexer";
-import path from "node:path";
-import { NextResponse } from "next/server";
-import { checkAuth, enforceScope } from "@/lib/proof/auth";
-import { resolveWorkspaceForAgent } from "@/lib/workspace-context";
-import { safeWorkspacePath } from "@/lib/workspaces";
-import { safeAbsPath, looksLikeBinary } from "@/lib/proof/raw-fs";
-import { matchGlob } from "@/lib/proof/glob";
-import type { Agent } from "@/lib/proof/registry";
-
-const HARD_MAX_MATCHES = 2_000;
-const HARD_MAX_SCAN_BYTES = 50 * 1024 * 1024; // 50 MB total
-const SEARCH_TIMEOUT_MS = 10_000;
-
-export interface SearchMatch {
-	path: string;
-	line?: number;
-	col?: number;
-	text?: string;
-	score?: number;
-	snippet?: string;
-}
-
-function errJson(code: string, message: string, status: number): NextResponse {
-	return NextResponse.json({ error: code, message }, { status });
-}
-
-const SKIP_DIRS = new Set([".proof", ".git", "node_modules", ".next"]);
-
-// ── Walk helpers ──────────────────────────────────────────────────────────────
-
-async function* walkFiles(rootDir: string, relDir: string): AsyncGenerator<string> {
-	// eslint-disable-next-line @typescript-eslint/no-explicit-any
-	let items: any[];
-	try {
-		items = await readdir(path.join(rootDir, relDir), { withFileTypes: true }) as any[];
-	} catch {
-		return;
-	}
-	for (const item of items) {
-		if (SKIP_DIRS.has(item.name as string)) continue;
-		const childRel = relDir ? `${relDir}/${item.name as string}` : item.name as string;
-		if (item.isDirectory()) {
-			yield* walkFiles(rootDir, childRel);
-		} else if (item.isFile() || item.isSymbolicLink()) {
-			yield childRel;
-		}
-	}
-}
-
-// ── Grep ─────────────────────────────────────────────────────────────────────
-
-async function grepSearch(
-	rootDir: string,
-	startRel: string,
-	pattern: string,
-	limit: number,
-	agent: Agent,
-	deadline: number,
-	workspaceId?: string,
-): Promise<{ matches: SearchMatch[]; truncated: boolean }> {
-	let regex: RegExp;
-	try {
-		regex = new RegExp(pattern, "d");
-	} catch {
-		// fallback without indices flag
-		try {
-			regex = new RegExp(pattern);
-		} catch {
-			throw new Error("Invalid regex pattern");
-		}
-	}
-
-	const matches: SearchMatch[] = [];
-	let scannedBytes = 0;
-
-	for await (const fileRel of walkFiles(rootDir, startRel)) {
-		if (matches.length >= limit) return { matches, truncated: true };
-		if (Date.now() > deadline) return { matches, truncated: true };
-
-		const sc = enforceScope(agent, { filePath: fileRel, op: "read", workspaceId });
-		if (!sc.ok) continue;
-
-		let buf: Buffer;
-		try {
-			buf = await readFile(path.join(rootDir, fileRel));
-		} catch {
-			continue;
-		}
-
-		scannedBytes += buf.length;
-		if (scannedBytes > HARD_MAX_SCAN_BYTES) return { matches, truncated: true };
-
-		if (looksLikeBinary(buf)) continue;
-
-		const text = buf.toString("utf-8");
-		const lines = text.split("\n");
-		for (let lineIdx = 0; lineIdx < lines.length; lineIdx++) {
-			if (matches.length >= limit) return { matches, truncated: true };
-			const lineText = lines[lineIdx]!;
-			// Reset lastIndex for global regexes
-			regex.lastIndex = 0;
-			const m = regex.exec(lineText);
-			if (m) {
-				matches.push({
-					path: fileRel,
-					line: lineIdx + 1,
-					col: (m.index ?? 0) + 1,
-					text: lineText,
-				});
-			}
-		}
-	}
-
-	return { matches, truncated: false };
-}
-
-// ── Glob ─────────────────────────────────────────────────────────────────────
-
-async function globSearch(
-	rootDir: string,
-	startRel: string,
-	pattern: string,
-	limit: number,
-	agent: Agent,
-	deadline: number,
-	workspaceId?: string,
-): Promise<{ matches: SearchMatch[]; truncated: boolean }> {
-	const matches: SearchMatch[] = [];
-
-	for await (const fileRel of walkFiles(rootDir, startRel)) {
-		if (matches.length >= limit) return { matches, truncated: true };
-		if (Date.now() > deadline) return { matches, truncated: true };
-
-		// Match pattern against relative path OR just the filename
-		const baseName = path.basename(fileRel);
-		if (!matchGlob(pattern, fileRel) && !matchGlob(pattern, baseName)) continue;
-
-		const sc = enforceScope(agent, { filePath: fileRel, op: "read", workspaceId });
-		if (!sc.ok) continue;
-
-		matches.push({ path: fileRel });
-	}
-
-	return { matches, truncated: false };
-}
-
-// ── Route ─────────────────────────────────────────────────────────────────────
-
-export async function POST(req: Request): Promise<NextResponse> {
-	const auth = await checkAuth(req);
-	if (!auth.ok) return errJson("UNAUTHORIZED", auth.message ?? "Unauthorized", 401);
-
-	let body: { kind?: unknown; query?: unknown; path?: unknown; limit?: unknown };
-	try {
-		body = (await req.json()) as typeof body;
-	} catch {
-		return errJson("INVALID_PAYLOAD", "Invalid JSON body", 400);
-	}
-
-	if (body.kind !== "grep" && body.kind !== "glob" && body.kind !== "fts") {
-		return errJson("INVALID_PAYLOAD", 'kind must be "grep", "glob", or "fts"', 400);
-	}
-	if (typeof body.query !== "string") {
-		return errJson("INVALID_PAYLOAD", "query (string) required", 400);
-	}
-	if (body.kind !== "fts" && !body.query) {
-		return errJson("INVALID_PAYLOAD", "query (string) required", 400);
-	}
-
-	const kind = body.kind as "grep" | "glob" | "fts";
-	const query = body.query as string;
-	const startRelRaw = typeof body.path === "string" ? body.path : "";
-	const limit = Math.min(
-		typeof body.limit === "number" ? body.limit : 200,
-		HARD_MAX_MATCHES,
-	);
-
-	const wsx = await resolveWorkspaceForAgent(req);
-	if (!wsx.ok) return errJson(wsx.code, wsx.code, wsx.status);
-	const { ws, rootDir } = wsx;
-
-	// Validate start path
-	if (startRelRaw) {
-		if (!safeWorkspacePath(rootDir, startRelRaw)) {
-			return errJson("INVALID_PATH", "path: traversal rejected", 400);
-		}
-		const safe = await safeAbsPath(rootDir, startRelRaw);
-		if (!safe) return errJson("INVALID_PATH", "path: rejected (symlink escape or denied)", 400);
-	}
-
-	// Verify start path is a directory
-	if (startRelRaw) {
-		try {
-			const st = await stat(path.join(rootDir, startRelRaw));
-			if (!st.isDirectory()) {
-				return errJson("NOT_A_DIRECTORY", "path must be a directory", 400);
-			}
-		} catch (e) {
-			if ((e as NodeJS.ErrnoException).code === "ENOENT") {
-				return errJson("NOT_FOUND", "Start path not found", 404);
-			}
-			throw e;
-		}
-	}
-
-	// FTS branch -- handled before the grep/glob path validation below.
-	if (kind === "fts") {
-		const sc = enforceScope(auth.agent, { op: "read", workspaceId: ws.id });
-		if (!sc.ok) return errJson("FORBIDDEN", sc.message ?? "Forbidden", 403);
-
-		ensureIndexer(ws.id, rootDir).catch((e) =>
-			console.error("[search] ensureIndexer failed", e),
-		);
-
-		// Over-fetch so the post-filter (path scope + start-path restriction) can
-		// still return up to `limit` results when some top-ranked hits are denied.
-		const startPrefix = startRelRaw ? `${startRelRaw.replace(/\/+$/, "")}/` : "";
-		const fts = ftsSearch(ws.id, query, Math.min(limit * 4, HARD_MAX_MATCHES));
-		const filtered = fts.matches.filter((m) => {
-			if (startPrefix && !m.path.startsWith(startPrefix)) return false;
-			return enforceScope(auth.agent, { filePath: m.path, op: "read", workspaceId: ws.id }).ok;
-		});
-		const matches = filtered
-			.slice(0, limit)
-			.map((m) => ({ path: m.path, score: m.score, snippet: m.snippet }));
-		// truncated if the DB itself capped, or the scoped set still exceeds limit.
-		const truncated = fts.truncated || filtered.length > limit;
-		return NextResponse.json({ kind, query, matches, truncated });
-	}
-
-	const deadline = Date.now() + SEARCH_TIMEOUT_MS;
-	let result: { matches: SearchMatch[]; truncated: boolean };
-
-	try {
-		if (kind === "grep") {
-			result = await grepSearch(rootDir, startRelRaw, query, limit, auth.agent, deadline, ws.id);
-		} else {
-			result = await globSearch(rootDir, startRelRaw, query, limit, auth.agent, deadline, ws.id);
-		}
-	} catch (e) {
-		return errJson("SEARCH_ERROR", (e as Error).message, 400);
-	}
-
-	return NextResponse.json({
-		kind,
-		query,
-		matches: result.matches,
-		truncated: result.truncated,
-	});
-}

package/.next/standalone/src/app/api/agent/internal/span/route.ts

@@ -1,121 +0,0 @@
-/**
- * Internal span accept/revert. Callable by owner (browser cookie) or any agent
- * with mutate scope. The `by` field on emitted events is the authenticated agent id.
- */
-import { readFile, writeFile } from "node:fs/promises";
-import { NextResponse } from "next/server";
-import { revertProofSpan } from "@/lib/proof/proof-span";
-import { readSidecar, writeSidecar, emptySidecar } from "@/lib/proof/sidecar";
-import { withFileMutex } from "@/lib/proof/mutex";
-import { emitEvents } from "@/lib/proof/event-bus";
-import { resolveWorkspaceForAgent } from "@/lib/workspace-context";
-import { safeWorkspacePath } from "@/lib/workspaces";
-import { checkAuth, enforceScope } from "@/lib/proof/auth";
-
-export const runtime = "nodejs";
-
-function isMarkdown(p: string): boolean {
-	return p.endsWith(".md") || p.endsWith(".markdown");
-}
-
-/**
- * Remove the wrapper for a specific spanId while keeping inner content.
- */
-function acceptSpanById(markdown: string, spanId: string): string {
-	const escapedId = spanId.replace(/[.*+?^${}()|[\]\\]/g, "\\$&");
-	const re = new RegExp(
-		`<proof-span\\b[^>]*\\bid="${escapedId}"[^>]*>([\\s\\S]*?)<\\/proof-span>`,
-		"g",
-	);
-	return markdown.replace(re, "$1");
-}
-
-export async function POST(req: Request): Promise<NextResponse> {
-	const authResult = await checkAuth(req);
-	if (!authResult.ok) {
-		return NextResponse.json({ error: "UNAUTHORIZED" }, { status: 401 });
-	}
-
-	let body: { path?: unknown; spanId?: unknown; action?: unknown };
-	try {
-		body = (await req.json()) as { path?: unknown; spanId?: unknown; action?: unknown };
-	} catch {
-		return NextResponse.json({ error: "INVALID_PAYLOAD", message: "Invalid JSON" }, { status: 400 });
-	}
-
-	if (typeof body.path !== "string" || !body.path) {
-		return NextResponse.json({ error: "INVALID_PAYLOAD", message: "path (string) required" }, { status: 400 });
-	}
-	if (typeof body.spanId !== "string" || !body.spanId) {
-		return NextResponse.json({ error: "INVALID_PAYLOAD", message: "spanId (string) required" }, { status: 400 });
-	}
-	if (body.action !== "accept" && body.action !== "revert") {
-		return NextResponse.json({ error: "INVALID_PAYLOAD", message: "action must be 'accept' or 'revert'" }, { status: 400 });
-	}
-
-	const rel = body.path as string;
-	const spanId = body.spanId as string;
-	const action = body.action as "accept" | "revert";
-
-	if (rel.startsWith(".proof")) {
-		return NextResponse.json({ error: "INVALID_PATH", message: "Path must not be under .proof" }, { status: 400 });
-	}
-	if (!isMarkdown(rel)) {
-		return NextResponse.json({ error: "INVALID_PATH", message: "Path must be .md or .markdown" }, { status: 400 });
-	}
-
-	const wsx = await resolveWorkspaceForAgent(req, "write");
-	if (!wsx.ok) return NextResponse.json({ error: wsx.code }, { status: wsx.status });
-	const { ws, rootDir } = wsx;
-
-	const absPath = safeWorkspacePath(rootDir, rel);
-	if (!absPath) {
-		return NextResponse.json({ error: "INVALID_PATH", message: "Path traversal rejected" }, { status: 400 });
-	}
-
-	const scopeCheck = enforceScope(authResult.agent, { filePath: rel, op: "mutate", workspaceId: ws.id });
-	if (!scopeCheck.ok) {
-		return NextResponse.json({ error: scopeCheck.code, message: scopeCheck.message }, { status: 403 });
-	}
-
-	const actorId = authResult.agent.id;
-
-	let notFound = false;
-	try {
-		await withFileMutex(`${rootDir}\u0000${rel}`, async () => {
-			let content: string;
-			try {
-				content = await readFile(absPath, "utf-8");
-			} catch (err) {
-				if ((err as NodeJS.ErrnoException).code === "ENOENT") {
-					notFound = true;
-					return;
-				}
-				throw err;
-			}
-
-			const newContent = action === "accept"
-				? acceptSpanById(content, spanId)
-				: revertProofSpan(content, spanId);
-
-			await writeFile(absPath, newContent, "utf-8");
-
-			const sidecar = (await readSidecar(rootDir, rel)) ?? emptySidecar(rel);
-			emitEvents(sidecar, [{
-				type: action === "accept" ? "span.accepted" : "span.reverted",
-				at: new Date().toISOString(),
-				by: actorId === "owner" ? "human" : actorId,
-				spanId,
-			}]);
-			await writeSidecar(rootDir, rel, sidecar);
-		});
-	} catch (err) {
-		return NextResponse.json({ error: "INTERNAL_ERROR", message: String(err) }, { status: 500 });
-	}
-
-	if (notFound) {
-		return NextResponse.json({ error: "NOT_FOUND", message: "File not found" }, { status: 404 });
-	}
-
-	return NextResponse.json({ ok: true });
-}

package/.next/standalone/src/app/api/agent/register/[regId]/route.ts

@@ -1,50 +0,0 @@
-/**
- * GET /api/agent/register/:regId
- *
- * Poll registration status. No auth required — regId acts as secret.
- *
- * Responses:
- *   202 { status: "pending" }
- *   200 { status: "approved", agentId, token }  — one-shot pickup, deletes token
- *   410 { status: "consumed" | "denied" }
- *   404 { status: "not_found" }
- */
-import { NextResponse } from "next/server";
-import { getRegistration, consumeRegistration } from "@/lib/proof/pending";
-
-export const runtime = "nodejs";
-
-export async function GET(
-	_req: Request,
-	{ params }: { params: Promise<{ regId: string }> },
-): Promise<NextResponse> {
-	const { regId } = await params;
-	const reg = getRegistration(regId);
-
-	if (!reg) {
-		return NextResponse.json({ status: "not_found" }, { status: 404 });
-	}
-
-	switch (reg.status) {
-		case "pending":
-			return NextResponse.json({ status: "pending" }, { status: 202 });
-
-		case "approved": {
-			const token = consumeRegistration(regId);
-			if (!token) {
-				// Already consumed between the get and consume (race) — treat as consumed
-				return NextResponse.json({ status: "consumed" }, { status: 410 });
-			}
-			return NextResponse.json(
-				{ status: "approved", agentId: reg.agentId, token },
-				{ status: 200 },
-			);
-		}
-
-		case "consumed":
-			return NextResponse.json({ status: "consumed" }, { status: 410 });
-
-		case "denied":
-			return NextResponse.json({ status: "denied" }, { status: 410 });
-	}
-}

package/.next/standalone/src/app/api/agent/register/route.ts

@@ -1,118 +0,0 @@
-/**
- * POST /api/agent/register
- *
- * Anonymous registration request. No auth required.
- * The registrationId returned acts as the agent's secret for polling.
- */
-import { NextResponse } from "next/server";
-import { createRegistration } from "@/lib/proof/pending";
-import type { AgentScope } from "@/lib/proof/registry";
-import { checkRegisterRateLimit } from "@/lib/proof/register-rate-limit";
-
-export const runtime = "nodejs";
-
-const AGENT_ID_RE = /^ai:[a-z][a-z0-9-]{0,30}$/i;
-const VALID_OPS = new Set(["read", "mutate", "delete"]);
-
-function validateScope(s: Record<string, unknown>): AgentScope | { error: string } {
-	if (!Array.isArray(s.paths) || s.paths.length === 0 || s.paths.length > 20) {
-		return { error: "scope.paths must be an array of 1\u201320 glob pattern strings" };
-	}
-	for (const p of s.paths) {
-		if (typeof p !== "string" || p.length < 1 || p.length > 200) {
-			return { error: "Each scope.paths entry must be a string of 1\u2013200 characters" };
-		}
-	}
-	if (!Array.isArray(s.ops) || s.ops.length === 0) {
-		return { error: "scope.ops must be a non-empty array" };
-	}
-	for (const op of s.ops) {
-		if (!VALID_OPS.has(op as string)) {
-			return { error: `scope.ops values must be "read", "mutate", or "delete"` };
-		}
-	}
-	// Optional workspaceId: if present must be a non-empty string ≤ 64 chars.
-	let workspaceId: string | undefined;
-	if (s.workspaceId !== undefined) {
-		if (typeof s.workspaceId !== "string" || s.workspaceId.length < 1 || s.workspaceId.length > 64) {
-			return { error: "scope.workspaceId must be a string of 1\u201364 characters" };
-		}
-		workspaceId = s.workspaceId;
-	}
-	return { paths: s.paths as string[], ops: s.ops as Array<"read" | "mutate" | "delete">, ...(workspaceId !== undefined ? { workspaceId } : {}) };
-}
-
-/** Exported for reuse in approve route. */
-export { validateScope };
-
-export async function POST(req: Request): Promise<NextResponse> {
-	// Rate limit by remote IP (best-effort; fall back to global key)
-	const ip =
-		(req.headers.get("x-forwarded-for") ?? "").split(",")[0]?.trim() ||
-		"__global__";
-	if (!checkRegisterRateLimit(ip)) {
-		return NextResponse.json(
-			{ error: "RATE_LIMITED", message: "Too many registration attempts" },
-			{ status: 429 },
-		);
-	}
-
-	let body: { id?: unknown; displayName?: unknown; scope?: unknown };
-	try {
-		body = (await req.json()) as { id?: unknown; displayName?: unknown; scope?: unknown };
-	} catch {
-		return NextResponse.json({ error: "INVALID_PAYLOAD", message: "Invalid JSON" }, { status: 400 });
-	}
-
-	if (typeof body.id !== "string" || !AGENT_ID_RE.test(body.id)) {
-		return NextResponse.json(
-			{
-				error: "INVALID_PAYLOAD",
-				message: "id must match /^ai:[a-z][a-z0-9-]{0,30}$/i (e.g. ai:claude)",
-			},
-			{ status: 400 },
-		);
-	}
-
-	// displayName: required, 1–80 chars
-	if (
-		typeof body.displayName !== "string" ||
-		body.displayName.trim().length < 1 ||
-		body.displayName.trim().length > 80
-	) {
-		return NextResponse.json(
-			{ error: "INVALID_PAYLOAD", message: "displayName must be a string of 1\u201380 characters" },
-			{ status: 400 },
-		);
-	}
-	const displayName = body.displayName.trim();
-
-	// scope: required, must pass validation
-	if (
-		body.scope === undefined ||
-		body.scope === null ||
-		typeof body.scope !== "object" ||
-		Array.isArray(body.scope)
-	) {
-		return NextResponse.json(
-			{ error: "INVALID_PAYLOAD", message: "scope is required" },
-			{ status: 400 },
-		);
-	}
-	const scopeResult = validateScope(body.scope as Record<string, unknown>);
-	if ("error" in scopeResult) {
-		return NextResponse.json({ error: "INVALID_PAYLOAD", message: scopeResult.error }, { status: 400 });
-	}
-	const requestedScope: AgentScope = scopeResult;
-
-	const reg = createRegistration({ agentId: body.id, displayName, requestedScope });
-
-	return NextResponse.json(
-		{
-			registrationId: reg.registrationId,
-			pollUrl: `/api/agent/register/${reg.registrationId}`,
-			status: "pending",
-		},
-		{ status: 202 },
-	);
-}