wiki-viewer 1.14.1 → 2.0.0

package/.next/standalone/src/app/api/agent/settings/route.ts

@@ -1,34 +0,0 @@
-import { NextResponse } from "next/server";
-import { checkAuth, enforceScope } from "@/lib/proof/auth";
-import { resolveWorkspaceForAgent } from "@/lib/workspace-context";
-import { readRegistry } from "@/lib/proof/registry";
-import { listPendingRegistrations } from "@/lib/proof/pending";
-
-export const runtime = "nodejs";
-
-export async function GET(req: Request): Promise<NextResponse> {
-	const auth = await checkAuth(req);
-	if (!auth.ok) {
-		return NextResponse.json({ error: "UNAUTHORIZED" }, { status: 401 });
-	}
-
-	const wsx = await resolveWorkspaceForAgent(req);
-	if (!wsx.ok) return NextResponse.json({ error: wsx.code }, { status: wsx.status });
-	const { ws, rootDir } = wsx;
-
-	const scopeCheck = enforceScope(auth.agent, { op: "read", workspaceId: ws.id });
-	if (!scopeCheck.ok) {
-		return NextResponse.json({ error: scopeCheck.code, message: scopeCheck.message }, { status: 403 });
-	}
-
-	const registry = await readRegistry();
-	const registeredAgents = registry?.agents.length ?? 0;
-	const pendingRegistrations = listPendingRegistrations().length;
-
-	return NextResponse.json({
-		rateLimit: Number(process.env.AGENT_RATE_LIMIT) || 60,
-		root: rootDir,
-		registeredAgents,
-		pendingRegistrations,
-	});
-}

package/.next/standalone/src/app/api/agent/settings/token/regenerate/route.ts

@@ -1,20 +0,0 @@
-/**
- * Token regeneration — deprecated and removed.
- *
- * Auth is now managed via TOFU registration flow. Use the AI Panel or
- * /api/agent/admin/* endpoints to manage agents.
- */
-import { NextResponse } from "next/server";
-
-export const runtime = "nodejs";
-
-export async function POST(_req: Request): Promise<NextResponse> {
-	return NextResponse.json(
-		{
-			error: "GONE",
-			message:
-				"Token regeneration is deprecated. Manage agents via /api/agent/admin/* or the AI Panel.",
-		},
-		{ status: 410 },
-	);
-}

package/.next/standalone/src/app/api/agent/sidecar/[...path]/route.ts

@@ -1,53 +0,0 @@
-import { NextResponse } from "next/server";
-import { checkAuth, enforceScope } from "@/lib/proof/auth";
-import { readSidecar, emptySidecar } from "@/lib/proof/sidecar";
-import { resolveWorkspaceForAgent } from "@/lib/workspace-context";
-import { safeWorkspacePath } from "@/lib/workspaces";
-
-export const runtime = "nodejs";
-
-function isMarkdown(p: string): boolean {
-	return p.endsWith(".md") || p.endsWith(".markdown");
-}
-
-function mdPath(segments: string[]): string {
-	return segments.join("/");
-}
-
-export async function GET(
-	req: Request,
-	{ params }: { params: Promise<{ path: string[] }> },
-): Promise<NextResponse> {
-	const auth = await checkAuth(req);
-	if (!auth.ok) {
-		return NextResponse.json({ error: "UNAUTHORIZED" }, { status: 401 });
-	}
-
-	const { path: segments } = await params;
-	const rel = mdPath(segments);
-
-	if (rel.startsWith(".proof")) {
-		return NextResponse.json({ error: "INVALID_PATH", message: "Path must not be under .proof" }, { status: 400 });
-	}
-	if (!isMarkdown(rel)) {
-		return NextResponse.json({ error: "INVALID_PATH", message: "Path must be .md or .markdown" }, { status: 400 });
-	}
-
-	const wsx = await resolveWorkspaceForAgent(req);
-	if (!wsx.ok) return NextResponse.json({ error: wsx.code }, { status: wsx.status });
-	const { ws, rootDir } = wsx;
-
-	const absPath = safeWorkspacePath(rootDir, rel);
-	if (!absPath) {
-		return NextResponse.json({ error: "INVALID_PATH", message: "Path traversal rejected" }, { status: 400 });
-	}
-
-	const scopeCheck = enforceScope(auth.agent, { filePath: rel, op: "read", workspaceId: ws.id });
-	if (!scopeCheck.ok) {
-		return NextResponse.json({ error: scopeCheck.code, message: scopeCheck.message }, { status: 403 });
-	}
-
-	const sidecar = (await readSidecar(rootDir, rel)) ?? emptySidecar(rel);
-
-	return NextResponse.json(sidecar);
-}

package/.next/standalone/src/app/api/agents/install/route.ts

@@ -1,143 +0,0 @@
-export const runtime = "nodejs";
-
-import { NextRequest, NextResponse } from "next/server";
-import { readFile } from "node:fs/promises";
-import path from "node:path";
-
-const MAX_FILE_BYTES = 50_000_000; // 50 MB
-
-async function readVersion(): Promise<string> {
-	try {
-		const raw = await readFile(path.resolve(process.cwd(), "package.json"), "utf-8");
-		const p = JSON.parse(raw) as { version?: string };
-		return p.version ?? "0.0.0";
-	} catch {
-		return "0.0.0";
-	}
-}
-
-function deriveEndpoint(req: NextRequest): string {
-	const proto =
-		req.headers.get("x-forwarded-proto") ??
-		(req.url.startsWith("https") ? "https" : "http");
-	const host =
-		req.headers.get("x-forwarded-host") ??
-		req.headers.get("host") ??
-		new URL(req.url).host;
-	return `${proto}://${host}`;
-}
-
-export async function GET(req: NextRequest): Promise<NextResponse> {
-	const [bootstrapPrompt, version] = await Promise.all([
-		readFile(path.resolve(process.cwd(), "agents/bootstrap-prompt.md"), "utf-8").catch(() => ""),
-		readVersion(),
-	]);
-
-	const endpoint = deriveEndpoint(req);
-	const hostHeader = req.headers.get("host") ?? "";
-	const hostname = hostHeader.replace(/:[0-9]+$/, "").replace(/^\[(.*)\]$/, "$1").toLowerCase();
-	const loopback = hostname === "localhost" || hostname === "127.0.0.1" || hostname === "::1";
-	const extraHosts = (process.env.WIKI_OWNER_HOSTS ?? "")
-		.split(",").map((h) => h.trim().toLowerCase()).filter(Boolean);
-	const ownerHostTrusted = loopback || extraHosts.includes(hostname);
-
-	return NextResponse.json({
-		name: "wiki-viewer",
-		version,
-		endpoint,
-		humanInstructions:
-			"Open the wiki-viewer AI Panel (Bot icon in header). Register the agent, then approve it in the Pending Registrations list. The agent receives a one-shot token.",
-		ownerBootstrap: {
-			hostnameSeen: hostname,
-			ownerHostTrusted,
-			hint: ownerHostTrusted
-				? "This host is trusted for owner cookie issuance. Open the AI Panel in a browser and approve pending registrations."
-				: `This host (${hostname}) is not in the owner-trust allowlist, so the AI Panel cannot bootstrap an owner cookie. Restart the server with WIKI_OWNER_HOSTS=${hostname} or access via localhost.`,
-		},
-		bootstrapPrompt,
-		skillTarball: "/api/agents/skill.tar.gz",
-		skillRaw: "/api/agents/skill",
-		skillCli: "npx skills add anh-chu/wiki-viewer/agents/wiki-viewer-skill",
-		routes: [
-			// Registration
-			{ method: "POST", path: "/api/agent/register", auth: "none", purpose: "Register an agent" },
-			{ method: "GET", path: "/api/agent/register/<regId>", auth: "none", purpose: "Poll registration status" },
-			// Tier 2 — Collab (markdown block-ops + provenance)
-			{ method: "GET", path: "/api/agent/files/<path>.md", auth: "bearer+agent-id", purpose: "Read markdown snapshot (block-ops tier)" },
-			{ method: "POST", path: "/api/agent/files/<path>.md", auth: "bearer+agent-id", purpose: "Apply block-ops" },
-			{ method: "GET", path: "/api/agent/events/<path>.md", auth: "bearer+agent-id", purpose: "Poll events" },
-			{ method: "POST", path: "/api/agent/events/<path>.md", auth: "bearer+agent-id", purpose: "Ack events" },
-			// Tier 1 — Raw FS (all file types)
-			{ method: "GET",    path: "/api/agent/fs/file/<path>",  auth: "bearer+agent-id", purpose: "Read file bytes. Supports Range. Returns ETag (sha256), X-File-Size, X-File-Mtime, X-Collab-State." },
-			{ method: "PUT",    path: "/api/agent/fs/file/<path>",  auth: "bearer+agent-id", purpose: "Atomic whole-file write. If-Match required for overwrites; omit for creates. ?mkdirs=true creates parents. ?force=true bypasses If-Match (audited)." },
-			{ method: "DELETE", path: "/api/agent/fs/file/<path>",  auth: "bearer+agent-id", purpose: "Delete file (+ sidecar for .md). Requires If-Match + delete scope op. ?recursive=true for directories." },
-			{ method: "GET",    path: "/api/agent/fs/ls/<path>",    auth: "bearer+agent-id", purpose: "Directory listing. ?recursive&limit&depth. Scope-filtered. Excludes .proof/." },
-			{ method: "POST",   path: "/api/agent/fs/move",         auth: "bearer+agent-id", purpose: "Move/rename. Body: {from, to, ifMatch?}. Moves .md sidecar too." },
-			{ method: "POST",   path: "/api/agent/fs/search",       auth: "bearer+agent-id", purpose: "Server-side grep or glob. Body: {kind:'grep'|'glob', query, path?, glob?, limit?}." },
-			// Settings (resolved workspace root, rate limit)
-			{ method: "GET",    path: "/api/agent/settings",        auth: "bearer+agent-id", purpose: "Returns rateLimit + resolved 'root' (the active workspace's directory for the X-Workspace you send)." },
-			// Human presence (for editor lease — drives active collab-state)
-			{ method: "POST",   path: "/api/wiki/presence",         auth: "session",          purpose: "Human editor lease heartbeat. Body: {path, action:'open'|'heartbeat'|'close'}." },
-		],
-		workspaces: {
-			description:
-				"This instance can serve multiple root directories ('workspaces'). Every agent path is relative to ONE workspace root.",
-			header: "X-Workspace: <workspaceId>",
-			queryParam: "ws=<workspaceId>",
-			default:
-				"If omitted, the server resolves to the most-recently-opened workspace. Correct for single-workspace instances; be explicit when several exist.",
-			discoverId:
-				"Ask the human for the workspace id, read it from the ?ws= param of a pasted wiki-viewer URL, or call GET /api/agent/settings (with X-Workspace) to confirm the resolved 'root'.",
-			scoped:
-				"A token may be pinned to one workspace (scope.workspaceId at approval). Requests resolving to a different workspace return 403 FORBIDDEN. A token with no pin is wildcard (any workspace).",
-			isolation:
-				"Paths in one workspace never touch another, even with identical relative paths.",
-		},
-		capabilities: {
-			maxFileBytes: MAX_FILE_BYTES,
-			supportsRange: true,
-			ifMatchRequired: true,
-			forceBypass: true,
-			search: ["grep", "glob"],
-			globDialect: "**,*,?",
-			scopeOps: ["read", "mutate", "delete"],
-			scopeWorkspaceId: true,
-			workspaceHeader: "X-Workspace",
-			collabStates: ["active", "tracked", "untracked", "not-markdown"],
-			collabPrecondition: "If-Collab-Match",
-		},
-		modes: {
-			rule: "Before editing a .md file, read it and check the X-Collab-State response header. If 'active', use block-ops (Tier 2) at the X-Collab-Snapshot URL so a human can review your changes. If 'tracked', prefer block-ops for semantic/prose edits; use raw fs only for mechanical/whole-file ops (reformat, regenerate). If 'untracked', raw fs is fine (a Tier-2 edit would create a sidecar). For non-markdown files, always use raw fs (Tier 2 does not apply). A raw PUT to an active .md is rejected 409 COLLAB_ACTIVE with the Tier-2 URL — switch to block-ops.",
-			collabStateHeaders: [
-				"X-Collab-State: active|tracked|untracked|not-markdown",
-				"X-Collab-Revision: <n>",
-				"X-Collab-Snapshot: /api/agent/files/<path>.md",
-			],
-			tiers: {
-				tier1: "Raw FS — /api/agent/fs/* — all file types, fast, light audit (ETag/sha256, file.rawWritten event, audit table). No proof-spans.",
-				tier2: "Collab — /api/agent/files/*.md — markdown only, reviewable proof-spans, comments, suggestions. Human can accept/revert.",
-			},
-		},
-		mcpAdapter: {
-			package: "wiki-viewer-mcp",
-			invoke: "npx wiki-viewer-mcp",
-			env: ["WIKI_VIEWER_URL", "WIKI_VIEWER_TOKEN", "WIKI_VIEWER_AGENT_ID", "WIKI_VIEWER_WORKSPACE"],
-			description: "Thin MCP adapter mapping standard MCP filesystem tools onto these endpoints. Set WIKI_VIEWER_WORKSPACE to target a specific workspace (sends X-Workspace on every call). Reads X-Collab-State and blocks or warns on raw writes to active .md files.",
-		},
-		ops: [
-			"block.replace",
-			"block.insertAfter",
-			"block.insertBefore",
-			"block.delete",
-			"block.append",
-			"block.prepend",
-			"comment.add",
-			"comment.reply",
-			"comment.resolve",
-			"comment.reopen",
-			"suggestion.add",
-			"suggestion.accept",
-			"suggestion.reject",
-		],
-	});
-}

package/.next/standalone/src/app/api/agents/skill/route.ts

@@ -1,20 +0,0 @@
-export const runtime = "nodejs";
-
-import { NextRequest, NextResponse } from "next/server";
-import { readFile } from "node:fs/promises";
-import path from "node:path";
-
-export async function GET(_req: NextRequest): Promise<NextResponse> {
-	const skillPath = path.resolve(
-		process.cwd(),
-		"agents/wiki-viewer-skill/SKILL.md"
-	);
-	const content = await readFile(skillPath, "utf-8");
-	return new NextResponse(content, {
-		status: 200,
-		headers: {
-			"Content-Type": "text/markdown; charset=utf-8",
-			"Cache-Control": "no-store",
-		},
-	});
-}

package/.next/standalone/src/app/api/agents/skill.tar.gz/route.ts

@@ -1,87 +0,0 @@
-export const runtime = "nodejs";
-
-import { NextRequest, NextResponse } from "next/server";
-import { readdir, readFile } from "node:fs/promises";
-import { gzipSync } from "node:zlib";
-import path from "node:path";
-
-function encodeOctal(n: number, length: number): string {
-	return n.toString(8).padStart(length - 1, "0") + "\0";
-}
-
-function writePaddedString(buf: Buffer, offset: number, str: string, len: number): void {
-	const bytes = Buffer.from(str, "utf-8").subarray(0, len);
-	bytes.copy(buf, offset);
-}
-
-function tarHeader(name: string, size: number, mtime: number): Buffer {
-	const header = Buffer.alloc(512, 0);
-
-	writePaddedString(header, 0, name, 100);          // name
-	writePaddedString(header, 100, "0000644\0", 8);   // mode
-	writePaddedString(header, 108, "0000000\0", 8);   // uid
-	writePaddedString(header, 116, "0000000\0", 8);   // gid
-	writePaddedString(header, 124, encodeOctal(size, 12), 12); // size
-	writePaddedString(header, 136, encodeOctal(mtime, 12), 12); // mtime
-	header[156] = 0x30;                                // typeflag '0' = regular
-	// linkname: 157-256, all zero
-	writePaddedString(header, 257, "ustar\0", 6);     // magic
-	writePaddedString(header, 263, "00", 2);           // version
-	// uname, gname, devmajor, devminor, prefix: zeros
-
-	// checksum
-	let sum = 0;
-	for (let i = 0; i < 512; i++) {
-		// treat checksum field (148..155) as spaces while computing
-		sum += i >= 148 && i < 156 ? 32 : header[i];
-	}
-	writePaddedString(header, 148, encodeOctal(sum, 7) + " ", 8);
-
-	return header;
-}
-
-function buildTar(entries: Array<{ name: string; content: Buffer; mtime: number }>): Buffer {
-	const parts: Buffer[] = [];
-
-	for (const entry of entries) {
-		const hdr = tarHeader(entry.name, entry.content.length, entry.mtime);
-		parts.push(hdr);
-		parts.push(entry.content);
-		// pad content to 512-byte boundary
-		const rem = entry.content.length % 512;
-		if (rem !== 0) {
-			parts.push(Buffer.alloc(512 - rem, 0));
-		}
-	}
-
-	// two zero blocks = end-of-archive
-	parts.push(Buffer.alloc(1024, 0));
-
-	return Buffer.concat(parts);
-}
-
-export async function GET(_req: NextRequest): Promise<NextResponse> {
-	const skillDir = path.resolve(process.cwd(), "agents/wiki-viewer-skill");
-	const files = await readdir(skillDir, { withFileTypes: true });
-	const mtime = Math.floor(Date.now() / 1000);
-
-	const entries: Array<{ name: string; content: Buffer; mtime: number }> = [];
-
-	for (const f of files) {
-		if (!f.isFile()) continue;
-		const content = await readFile(path.join(skillDir, f.name));
-		entries.push({ name: `wiki-viewer-skill/${f.name}`, content, mtime });
-	}
-
-	const tar = buildTar(entries);
-	const gz = gzipSync(tar);
-
-	return new NextResponse(gz, {
-		status: 200,
-		headers: {
-			"Content-Type": "application/gzip",
-			"Content-Disposition": `attachment; filename="wiki-viewer-skill.tar.gz"`,
-			"Cache-Control": "no-store",
-		},
-	});
-}

package/.next/standalone/src/app/api/app-proxy/[...path]/route.ts

@@ -1,247 +0,0 @@
-/**
- * Reverse proxy for node-app directories — built on undici.request()
- *
- * Unlike fetch(), undici.request() does NOT auto-decompress, so compressed
- * assets (gzip/br) stream through with their Content-Encoding intact and the
- * browser handles decompression itself. No ERR_CONTENT_DECODING_FAILED.
- *
- * For HTML/CSS (which we rewrite) we force accept-encoding:identity upstream
- * so we always receive plain text we can safely manipulate.
- */
-import { Readable } from "node:stream";
-import { request as undiciRequest } from "undici";
-import type { Dispatcher } from "undici";
-import { NextResponse } from "next/server";
-import { resolveByPrefix } from "@/lib/app-runner";
-
-const HOP_BY_HOP = new Set([
-	"connection", "keep-alive", "proxy-authenticate", "proxy-authorization",
-	"te", "trailers", "transfer-encoding", "upgrade",
-]);
-
-// ── service worker ────────────────────────────────────────────────────────────
-
-function makeServiceWorker(proxyBase: string): string {
-	return `
-/* wiki-viewer injected service worker */
-const BASE = ${JSON.stringify(proxyBase)};
-self.addEventListener("install", () => self.skipWaiting());
-self.addEventListener("activate", (e) => e.waitUntil(self.clients.claim()));
-self.addEventListener("fetch", (event) => {
-  const url = new URL(event.request.url);
-  if (url.origin !== self.location.origin) return;
-  if (url.pathname.startsWith(BASE + "/")) return;
-  if (url.pathname === BASE + "/sw-proxy.js") return;
-  event.respondWith(fetch(BASE + url.pathname + url.search, {
-    method: event.request.method,
-    headers: event.request.headers,
-    body: ["GET","HEAD"].includes(event.request.method) ? undefined : event.request.body,
-    credentials: event.request.credentials,
-  }));
-});`.trim();
-}
-
-// ── rewriters ─────────────────────────────────────────────────────────────────
-
-function rewriteHtml(html: string, proxyBase: string): string {
-	let out = html;
-	out = out.replace(/((?:src|href|action|data-src|data-href|content)=")\/(?!\/)/g, `$1${proxyBase}/`);
-	out = out.replace(/(srcset="[^"]*)\/(?!\/)/g, `$1${proxyBase}/`);
-	out = out.replace(/(<head(?:\s[^>]*)?>)/i, `$1\n<base href="${proxyBase}/">`);
-	// Inject before </head>. Works without service workers (non-localhost HTTP):
-	//
-	// 1. replaceState — strips the proxy prefix from the initial URL so
-	//    BrowserRouter sees "/" instead of "/api/app-proxy/apps/X"
-	// 2. fetch/XHR overrides — rewrite absolute-path calls (/api/...) through
-	//    the proxy so they reach the upstream app, not wiki-viewer
-	// 3. SW — best-effort (only works on localhost/HTTPS), provides navigation
-	//    interception for hard-refreshes on sub-routes
-	const patches = `<script>
-(function(){
-  var BASE = ${JSON.stringify(proxyBase)};
-  // 1. Normalize initial URL: BrowserRouter will see "/" not "/api/app-proxy/apps/X"
-  var _loc = location.pathname;
-  if (_loc.startsWith(BASE)) {
-    history.replaceState(history.state, '', _loc.slice(BASE.length) || '/');
-  }
-  // 2. Rewrite fetch() absolute paths through proxy (works on non-localhost HTTP)
-  var _fetch = window.fetch;
-  window.fetch = function(input, init) {
-    if (typeof input === 'string' && input.startsWith('/') && !input.startsWith('/api/app-proxy/')) {
-      input = BASE + input;
-    }
-    return _fetch.call(window, input, init);
-  };
-  // 3. Rewrite XMLHttpRequest absolute paths
-  var _xhrOpen = XMLHttpRequest.prototype.open;
-  XMLHttpRequest.prototype.open = function(method, url) {
-    if (typeof url === 'string' && url.startsWith('/') && !url.startsWith('/api/app-proxy/')) {
-      url = BASE + url;
-    }
-    return _xhrOpen.apply(this, [method, url].concat(Array.prototype.slice.call(arguments, 2)));
-  };
-  // 4. SW — best-effort for localhost/HTTPS; reloads once on first activation
-  if ('serviceWorker' in navigator) {
-    if (!navigator.serviceWorker.controller) {
-      navigator.serviceWorker.addEventListener('controllerchange', function() {
-        window.location.reload();
-      }, { once: true });
-    }
-    navigator.serviceWorker.register(BASE + '/sw-proxy.js?v=2', { scope: BASE + '/' })
-      .catch(function(){});
-  }
-})();
-</script>`;
-	out = out.replace(/<\/head>/i, `${patches}\n</head>`);
-	return out;
-}
-
-function rewriteCss(css: string, proxyBase: string): string {
-	return css.replace(/url\((['"]?)\/(?!\/)/g, `url($1${proxyBase}/`);
-}
-
-// ── header helpers ────────────────────────────────────────────────────────────
-
-function upstreamHeaders(
-	src: Headers,
-	port: number,
-	reqUrl: URL,
-	forceIdentity = false,
-): Record<string, string> {
-	const out: Record<string, string> = {};
-	for (const [k, v] of src.entries()) {
-		if (HOP_BY_HOP.has(k.toLowerCase())) continue;
-		out[k] = v;
-	}
-	out["host"] = `localhost:${port}`;
-	out["x-forwarded-host"] = reqUrl.host;
-	out["x-forwarded-proto"] = reqUrl.protocol.replace(":", "");
-	if (forceIdentity) out["accept-encoding"] = "identity";
-	return out;
-}
-
-function buildResHeaders(raw: Dispatcher.ResponseData["headers"]): Headers {
-	const out = new Headers();
-	for (const [k, v] of Object.entries(raw)) {
-		if (!v || HOP_BY_HOP.has(k.toLowerCase())) continue;
-		const vals = Array.isArray(v) ? v : [v];
-		for (const val of vals) out.append(k, val);
-	}
-	return out;
-}
-
-// ── handler ───────────────────────────────────────────────────────────────────
-
-async function handleProxy(
-	request: Request,
-	{ params }: { params: Promise<{ path: string[] }> },
-): Promise<Response> {
-	const segments = (await params).path ?? [];
-	const reqUrl = new URL(request.url);
-
-	const resolved = resolveByPrefix(segments);
-	if (!resolved) {
-		return NextResponse.json(
-			{ error: "App not running — launch it first in wiki-viewer." },
-			{ status: 503 },
-		);
-	}
-
-	const { port, relPath, rest } = resolved;
-	const proxyBase = `/api/app-proxy/${relPath}`;
-
-	if (rest === "/sw-proxy.js") {
-		return new Response(makeServiceWorker(proxyBase), {
-			status: 200,
-			headers: {
-				"content-type": "application/javascript; charset=utf-8",
-				"service-worker-allowed": proxyBase + "/",
-				"cache-control": "no-store",
-			},
-		});
-	}
-
-	const upstreamUrl = `http://localhost:${port}${rest}${reqUrl.search}`;
-	const method = request.method as Dispatcher.HttpMethod;
-	const isBodyless = ["GET", "HEAD"].includes(request.method);
-
-	try {
-		// First pass with normal headers to discover content-type
-		const first = await undiciRequest(upstreamUrl, {
-			method,
-			headers: upstreamHeaders(request.headers, port, reqUrl),
-			body: isBodyless ? null : (request.body as unknown as Readable),
-		});
-
-		const contentType = String(first.headers["content-type"] ?? "");
-		const needsRewrite = contentType.includes("text/html") || contentType.includes("text/css");
-
-		if (needsRewrite) {
-			// Drain first response and re-fetch with identity encoding for plain text
-			first.body.resume();
-			const second = await undiciRequest(upstreamUrl, {
-				method: isBodyless ? method : "GET",
-				headers: upstreamHeaders(request.headers, port, reqUrl, true),
-				body: null,
-			});
-			const text = await second.body.text();
-			const resHeaders = buildResHeaders(second.headers);
-			// Body changed size after rewriting — drop these or client truncates
-			resHeaders.delete("content-encoding");
-			resHeaders.delete("content-length");
-
-			if (contentType.includes("text/html")) {
-				resHeaders.set("content-type", "text/html; charset=utf-8");
-				return new Response(rewriteHtml(text, proxyBase), { status: second.statusCode, headers: resHeaders });
-			}
-			resHeaders.set("content-type", contentType);
-			return new Response(rewriteCss(text, proxyBase), { status: second.statusCode, headers: resHeaders });
-		}
-
-		// SPA fallback: if upstream returns 404 for a path with no file extension
-		// (i.e. a client-side route), re-fetch "/" and return index.html so the
-		// SPA's router can handle it client-side.
-		const hasExt = /\.[a-z0-9]{1,8}$/i.test(rest.split("?")[0]);
-		if (first.statusCode === 404 && !hasExt) {
-			first.body.resume();
-			const fallback = await undiciRequest(`http://localhost:${port}/`, {
-				method: "GET",
-				headers: upstreamHeaders(request.headers, port, reqUrl, true),
-				body: null,
-			});
-			const fallbackText = await fallback.body.text();
-			const fallbackHeaders = buildResHeaders(fallback.headers);
-			fallbackHeaders.delete("content-encoding");
-			fallbackHeaders.delete("content-length");
-			fallbackHeaders.set("content-type", "text/html; charset=utf-8");
-			return new Response(rewriteHtml(fallbackText, proxyBase), {
-				status: 200,
-				headers: fallbackHeaders,
-			});
-		}
-
-		// 304/204/205: null-body statuses — Response constructor rejects a stream body
-		if (new Set([101, 204, 205, 304]).has(first.statusCode)) {
-			first.body.resume();
-			return new Response(null, { status: first.statusCode, headers: buildResHeaders(first.headers) });
-		}
-
-		// Stream everything else — compressed bytes + Content-Encoding flow through intact
-		return new Response(Readable.toWeb(first.body) as ReadableStream, {
-			status: first.statusCode,
-			headers: buildResHeaders(first.headers),
-		});
-
-	} catch (e) {
-		return NextResponse.json({ error: `Upstream unreachable: ${e}` }, { status: 502 });
-	}
-}
-
-export const GET = handleProxy;
-export const POST = handleProxy;
-export const PUT = handleProxy;
-export const DELETE = handleProxy;
-export const PATCH = handleProxy;
-export const HEAD = handleProxy;
-export const OPTIONS = handleProxy;
-export const dynamic = "force-dynamic";