wiki-viewer 1.14.1 → 2.0.0

package/.next/standalone/src/lib/proof/owner-auth.ts

@@ -1,2 +0,0 @@
-// Removed: owner auth now handled by Better Auth (src/lib/auth/server.ts).
-export {};

package/.next/standalone/src/lib/proof/pending.ts

@@ -1,97 +0,0 @@
-/**
- * In-memory store for pending agent registration requests.
- *
- * Cleared on server restart. The registrationId itself acts as the
- * agent's secret for polling (no separate PIN needed).
- */
-import { randomBytes } from "node:crypto";
-import type { AgentScope } from "./registry";
-
-export type RegistrationStatus =
-	| "pending"
-	| "approved" // token has been minted but not yet picked up
-	| "consumed" // token was picked up (one-shot)
-	| "denied";
-
-export interface PendingRegistration {
-	registrationId: string;
-	agentId: string;
-	displayName: string;
-	requestedScope: AgentScope;
-	requestedAt: string; // ISO-8601
-	status: RegistrationStatus;
-	/** Plaintext token, present only after approval and before pickup. */
-	tokenPlaintext?: string;
-	/** ISO-8601 timestamp of approval/denial */
-	resolvedAt?: string;
-}
-
-// Module-level singleton (survives Next.js HMR via globalThis)
-const g = globalThis as typeof globalThis & {
-	__wvPendingRegs?: Map<string, PendingRegistration>;
-};
-if (!g.__wvPendingRegs) {
-	g.__wvPendingRegs = new Map();
-}
-const store: Map<string, PendingRegistration> = g.__wvPendingRegs;
-
-export function createRegistration(opts: {
-	agentId: string;
-	displayName: string;
-	requestedScope?: AgentScope;
-}): PendingRegistration {
-	const registrationId = `reg_${randomBytes(16).toString("hex")}`;
-	const reg: PendingRegistration = {
-		registrationId,
-		agentId: opts.agentId,
-		displayName: opts.displayName,
-		requestedScope: opts.requestedScope ?? {
-			paths: ["**/*"],
-			ops: ["read", "mutate"],
-		},
-		requestedAt: new Date().toISOString(),
-		status: "pending",
-	};
-	store.set(registrationId, reg);
-	return reg;
-}
-
-export function getRegistration(id: string): PendingRegistration | undefined {
-	return store.get(id);
-}
-
-export function listPendingRegistrations(): PendingRegistration[] {
-	return [...store.values()].filter((r) => r.status === "pending");
-}
-
-export function listAllRegistrations(): PendingRegistration[] {
-	return [...store.values()];
-}
-
-/** Mark as approved and stash one-shot token. */
-export function approveRegistration(id: string, tokenPlaintext: string): boolean {
-	const reg = store.get(id);
-	if (!reg || reg.status !== "pending") return false;
-	reg.status = "approved";
-	reg.tokenPlaintext = tokenPlaintext;
-	reg.resolvedAt = new Date().toISOString();
-	return true;
-}
-
-/** Consume (pick up) the one-shot token. Returns plaintext then clears it. */
-export function consumeRegistration(id: string): string | null {
-	const reg = store.get(id);
-	if (!reg || reg.status !== "approved" || !reg.tokenPlaintext) return null;
-	const token = reg.tokenPlaintext;
-	reg.status = "consumed";
-	reg.tokenPlaintext = undefined;
-	return token;
-}
-
-export function denyRegistration(id: string): boolean {
-	const reg = store.get(id);
-	if (!reg || reg.status !== "pending") return false;
-	reg.status = "denied";
-	reg.resolvedAt = new Date().toISOString();
-	return true;
-}

package/.next/standalone/src/lib/proof/proof-span.ts

@@ -1,141 +0,0 @@
-import type { SpanAttrs } from "./types";
-
-export type { SpanAttrs };
-
-function escapeAttr(value: string): string {
-	return value.replace(/&/g, "&").replace(/"/g, """);
-}
-
-function buildAttrs(attrs: SpanAttrs): string {
-	const parts: string[] = [
-		`id="${escapeAttr(attrs.spanId)}"`,
-		`origin="${attrs.origin}"`,
-	];
-	if (attrs.basis) parts.push(`basis="${escapeAttr(attrs.basis)}"`);
-	if (attrs.basisDetail) parts.push(`basis-detail="${escapeAttr(attrs.basisDetail)}"`);
-	parts.push(`by="${escapeAttr(attrs.by)}"`);
-	parts.push(`at="${escapeAttr(attrs.at)}"`);
-	if (attrs.inResponseTo) parts.push(`in-response-to="${escapeAttr(attrs.inResponseTo)}"`);
-	return parts.join(" ");
-}
-
-/**
- * Wrap the text content of a markdown block in a <proof-span>.
- *
- * Wrap rules:
- *   paragraph    -> wrap full markdown text
- *   heading      -> wrap text after the leading "#"s
- *   bulletList / orderedList / taskList -> wrap each list item's text line
- *   blockquote   -> wrap text content (after "> " prefix)
- *   codeBlock / table / hr / html -> return null (caller records in sidecar.blockProvenance)
- */
-export function wrapAsProofSpan(
-	markdown: string,
-	attrs: SpanAttrs,
-): string | null {
-	const a = buildAttrs(attrs);
-
-	// Detect block type from markdown shape
-	const trimmed = markdown.trim();
-
-	// code block
-	if (trimmed.startsWith("```") || trimmed.startsWith("~~~")) return null;
-
-	// html block
-	if (trimmed.startsWith("<") && !trimmed.startsWith("<proof-span")) return null;
-
-	// hr
-	if (/^[-*_]{3,}\s*$/.test(trimmed)) return null;
-
-	// table (contains | pipes in first line)
-	const firstLine = trimmed.split("\n")[0];
-	if (firstLine.includes("|") && /^\|.*\|/.test(firstLine)) return null;
-
-	// heading: "# text" -> "# <proof-span ...>text</proof-span>"
-	const headingMatch = trimmed.match(/^(#{1,6})\s+(.+)$/);
-	if (headingMatch) {
-		const hashes = headingMatch[1];
-		const text = headingMatch[2].trimEnd();
-		return `${hashes} <proof-span ${a}>${text}</proof-span>`;
-	}
-
-	// blockquote: each line starts with "> "
-	if (trimmed.startsWith(">")) {
-		return trimmed
-			.split("\n")
-			.map((line) => {
-				const bqMatch = line.match(/^(>\s?)(.*)/);
-				if (!bqMatch) return line;
-				const prefix = bqMatch[1];
-				const content = bqMatch[2];
-				if (!content.trim()) return line;
-				return `${prefix}<proof-span ${a}>${content}</proof-span>`;
-			})
-			.join("\n");
-	}
-
-	// list items (bullet/ordered/task)
-	// Each item starts with "- ", "* ", "+ ", or "N. "
-	// Task items: "- [ ] " or "- [x] "
-	const listItemRe = /^(\s*(?:[-*+]|\d+\.)\s+(?:\[[ xX]\]\s+)?)(.*)/;
-	if (listItemRe.test(trimmed.split("\n")[0])) {
-		return trimmed
-			.split("\n")
-			.map((line) => {
-				const m = line.match(/^(\s*(?:[-*+]|\d+\.)\s+(?:\[[ xX]\]\s+)?)(.*)/);
-				if (!m) return line;
-				const prefix = m[1];
-				const content = m[2];
-				if (!content.trim()) return line;
-				return `${prefix}<proof-span ${a}>${content}</proof-span>`;
-			})
-			.join("\n");
-	}
-
-	// paragraph: wrap the whole thing
-	return `<proof-span ${a}>${trimmed}</proof-span>`;
-}
-
-/**
- * Remove all <proof-span ...>...</proof-span> wrappers, keeping inner content.
- * Used for "Accept" (keep text, drop attribution).
- */
-export function unwrapProofSpans(markdown: string): string {
-	return markdown.replace(/<proof-span\b[^>]*>([\s\S]*?)<\/proof-span>/g, "$1");
-}
-
-/**
- * Remove a specific <proof-span id="spanId">...</proof-span>, discarding content.
- * Used for "Revert" (delete AI-authored text).
- */
-export function revertProofSpan(markdown: string, spanId: string): string {
-	const escapedId = spanId.replace(/[.*+?^${}()|[\]\\]/g, "\\$&");
-	const re = new RegExp(
-		`<proof-span\\b[^>]*\\bid="${escapedId}"[^>]*>[\\s\\S]*?<\\/proof-span>`,
-		"g",
-	);
-	return markdown.replace(re, "");
-}
-
-/**
- * Extract all span IDs from a markdown string.
- */
-export function extractSpanIds(markdown: string): string[] {
-	const ids: string[] = [];
-	const re = /<proof-span\b[^>]*\bid="([^"]+)"/g;
-	let m: RegExpExecArray | null;
-	while ((m = re.exec(markdown)) !== null) {
-		ids.push(m[1]);
-	}
-	return ids;
-}
-
-/**
- * Generate a unique span ID "p" + 4-hex.
- */
-export function newSpanId(): string {
-	const hex = Math.floor(Math.random() * 0xffff)
-		.toString(16)
-		.padStart(4, "0");
-	return `p${hex}`;
-}

package/.next/standalone/src/lib/proof/rate-limit.ts

@@ -1,53 +0,0 @@
-import { OPS_PER_MINUTE } from "../proof-config";
-
-interface Bucket {
-	tokens: number;
-	lastRefill: number; // ms epoch
-}
-
-const buckets = new Map<string, Bucket>();
-
-/**
- * Token-bucket rate limiter per `by` identity.
- * Bucket size = OPS_PER_MINUTE (default 60).
- * Refill rate: 1 token/sec (continuous approximation).
- *
- * Returns { ok: true } when tokens consumed, or
- * { ok: false, retryAfterMs } when exhausted.
- */
-export function checkAndConsume(
-	by: string,
-	n: number = 1,
-): { ok: true } | { ok: false; retryAfterMs: number } {
-	const now = Date.now();
-	const bucketSize = OPS_PER_MINUTE;
-
-	let bucket = buckets.get(by);
-	if (!bucket) {
-		bucket = { tokens: bucketSize, lastRefill: now };
-		buckets.set(by, bucket);
-	}
-
-	// Refill: 1 token per 1000 ms elapsed
-	const elapsed = now - bucket.lastRefill;
-	const refill = Math.floor(elapsed / 1000);
-	if (refill > 0) {
-		bucket.tokens = Math.min(bucketSize, bucket.tokens + refill);
-		bucket.lastRefill = bucket.lastRefill + refill * 1000;
-	}
-
-	if (bucket.tokens < n) {
-		// How long until we have n tokens?
-		const needed = n - bucket.tokens;
-		const retryAfterMs = needed * 1000 - (now - bucket.lastRefill);
-		return { ok: false, retryAfterMs: Math.max(1, retryAfterMs) };
-	}
-
-	bucket.tokens -= n;
-	return { ok: true };
-}
-
-/** Exposed for tests only — reset all buckets. */
-export function _resetBuckets(): void {
-	buckets.clear();
-}

package/.next/standalone/src/lib/proof/raw-fs.ts

@@ -1,197 +0,0 @@
-/**
- * Shared utilities for Tier-1 raw-fs routes.
- *
- * - Path safety (symlink escape guard, hard-denied paths)
- * - SHA-256 of Buffer
- * - Best-effort MIME by extension
- * - Atomic write (tmp → rename, preserves mode)
- */
-import { createHash } from "node:crypto";
-import { open, stat, rename, realpath, mkdir } from "node:fs/promises";
-import path from "node:path";
-
-
-// ── Denied path checks ──────────────────────────────────────────────────────
-
-/**
- * True if the root-relative path is hard-denied regardless of scope.
- * - .proof/ — sidecar storage (Tier-2 internal)
- * - .git/   — git objects (sensitive)
- */
-export function isDeniedRelPath(rel: string): boolean {
-	const norm = rel.replace(/\\/g, "/");
-	return (
-		norm === ".proof" ||
-		norm.startsWith(".proof/") ||
-		norm === ".git" ||
-		norm.startsWith(".git/")
-	);
-}
-
-export function isMarkdown(filePath: string): boolean {
-	return filePath.endsWith(".md") || filePath.endsWith(".markdown");
-}
-
-// ── Path safety ──────────────────────────────────────────────────────────────
-
-/**
- * Resolve the absolute path for `rel`, checking:
- *  1. basic traversal (path.join containment)
- *  2. hard-denied prefixes (.proof/, .git/)
- *  3. symlink escape: if file exists, realpath must still be under root
- *
- * For non-existent targets (creates), resolves parent dir instead.
- *
- * Returns absolute path on success, null on rejection.
- */
-export async function safeAbsPath(root: string, rel: string): Promise<string | null> {
-	if (!root) return null;
-
-	// Normalise and basic traversal guard
-	const normalised = path.normalize(rel);
-	if (normalised.startsWith("..") || path.isAbsolute(normalised)) return null;
-
-	if (isDeniedRelPath(normalised)) return null;
-
-	const abs = path.join(root, normalised);
-	// Re-check containment after normalize
-	if (abs !== root && !abs.startsWith(root + path.sep)) return null;
-
-	// Symlink-escape check: resolve realpath of the nearest existing ancestor
-	try {
-		const real = await realpath(abs);
-		if (real !== root && !real.startsWith(root + path.sep)) return null;
-	} catch {
-		// Target doesn't exist — check parent
-		const parent = path.dirname(abs);
-		if (parent !== abs) {
-			try {
-				const parentReal = await realpath(parent);
-				if (parentReal !== root && !parentReal.startsWith(root + path.sep)) {
-					return null;
-				}
-			} catch {
-				// Parent doesn't exist either — containment already checked above
-			}
-		}
-	}
-
-	return abs;
-}
-
-// ── Hashing ──────────────────────────────────────────────────────────────────
-
-/** Returns "sha256:<hex>" — the canonical sha format used in ETag / audit. */
-export function sha256ofBuf(buf: Buffer): string {
-	return "sha256:" + createHash("sha256").update(buf).digest("hex");
-}
-
-/**
- * Normalise an If-Match / ETag header value to bare hex.
- * Strips outer double-quotes and "sha256:" prefix.
- */
-export function extractShaHex(header: string): string {
-	return header
-		.replace(/^"/, "")
-		.replace(/"$/, "")
-		.replace(/^sha256:/, "");
-}
-
-// ── MIME ──────────────────────────────────────────────────────────────────────
-
-const MIME_MAP: Record<string, string> = {
-	".md":       "text/markdown; charset=utf-8",
-	".markdown": "text/markdown; charset=utf-8",
-	".txt":      "text/plain; charset=utf-8",
-	".json":     "application/json; charset=utf-8",
-	".jsonc":    "application/json; charset=utf-8",
-	".ts":       "text/typescript; charset=utf-8",
-	".tsx":      "text/typescript; charset=utf-8",
-	".mts":      "text/typescript; charset=utf-8",
-	".js":       "text/javascript; charset=utf-8",
-	".jsx":      "text/javascript; charset=utf-8",
-	".mjs":      "text/javascript; charset=utf-8",
-	".html":     "text/html; charset=utf-8",
-	".htm":      "text/html; charset=utf-8",
-	".css":      "text/css; charset=utf-8",
-	".yaml":     "text/yaml; charset=utf-8",
-	".yml":      "text/yaml; charset=utf-8",
-	".toml":     "text/toml; charset=utf-8",
-	".xml":      "application/xml; charset=utf-8",
-	".svg":      "image/svg+xml",
-	".png":      "image/png",
-	".jpg":      "image/jpeg",
-	".jpeg":     "image/jpeg",
-	".gif":      "image/gif",
-	".webp":     "image/webp",
-	".pdf":      "application/pdf",
-	".zip":      "application/zip",
-	".tar":      "application/x-tar",
-	".gz":       "application/gzip",
-	".py":       "text/x-python; charset=utf-8",
-	".rs":       "text/x-rustsrc; charset=utf-8",
-	".go":       "text/x-go; charset=utf-8",
-	".sh":       "text/x-shellscript; charset=utf-8",
-	".csv":      "text/csv; charset=utf-8",
-	".env":      "text/plain; charset=utf-8",
-};
-
-export function mimeByExt(filePath: string): string {
-	const ext = path.extname(filePath).toLowerCase();
-	return MIME_MAP[ext] ?? "application/octet-stream";
-}
-
-// ── Binary detection ──────────────────────────────────────────────────────────
-
-/** Heuristic: buffer contains a null byte in first 8 KB → treat as binary. */
-export function looksLikeBinary(buf: Buffer): boolean {
-	const sample = buf.slice(0, Math.min(buf.length, 8192));
-	return sample.includes(0);
-}
-
-// ── Atomic write ──────────────────────────────────────────────────────────────
-
-/**
- * Write `data` to `absPath` atomically:
- *   1. Write to a sibling .tmp file
- *   2. datasync the tmp file
- *   3. rename tmp → target
- *
- * Preserves the unix mode of the existing file.
- * Caller is responsible for creating parent dirs.
- */
-export async function atomicWrite(absPath: string, data: Buffer): Promise<void> {
-	// Preserve mode of existing file
-	let mode = 0o644;
-	try {
-		const st = await stat(absPath);
-		mode = st.mode & 0o777;
-	} catch {
-		// New file — use 0o644 default
-	}
-
-	const tmp = absPath + ".~" + process.pid + "." + Date.now() + ".tmp";
-	const fh = await open(tmp, "w", mode);
-	try {
-		await fh.write(data);
-		await fh.datasync();
-	} finally {
-		await fh.close();
-	}
-	await rename(tmp, absPath);
-}
-
-/** Ensure parent directory exists; creates intermediate dirs if mkdirs=true. */
-export async function ensureParentDir(absPath: string, mkdirs: boolean): Promise<boolean> {
-	const dir = path.dirname(absPath);
-	if (mkdirs) {
-		await mkdir(dir, { recursive: true });
-		return true;
-	}
-	try {
-		await stat(dir);
-		return true;
-	} catch {
-		return false;
-	}
-}

package/.next/standalone/src/lib/proof/register-rate-limit.ts

@@ -1,53 +0,0 @@
-/**
- * In-memory token bucket rate limiter for registration attempts.
- *
- * Bucket size: 10 requests
- * Refill rate: 1 token per 6 seconds (= 10/min)
- */
-
-interface Bucket {
-	tokens: number;
-	lastRefillAt: number;
-}
-
-const BUCKET_CAPACITY = 10;
-const REFILL_INTERVAL_MS = 6_000; // 1 token per 6s = 10/min
-
-// Module-level singleton keyed by IP (or "__global__" if no IP available)
-const g = globalThis as typeof globalThis & {
-	__wvRegBuckets?: Map<string, Bucket>;
-};
-if (!g.__wvRegBuckets) {
-	g.__wvRegBuckets = new Map();
-}
-const buckets: Map<string, Bucket> = g.__wvRegBuckets;
-
-function refill(bucket: Bucket): void {
-	const now = Date.now();
-	const elapsed = now - bucket.lastRefillAt;
-	const tokensToAdd = Math.floor(elapsed / REFILL_INTERVAL_MS);
-	if (tokensToAdd > 0) {
-		bucket.tokens = Math.min(BUCKET_CAPACITY, bucket.tokens + tokensToAdd);
-		bucket.lastRefillAt = now;
-	}
-}
-
-/** Returns true if request is allowed; false if rate limited. */
-export function checkRegisterRateLimit(key: string): boolean {
-	let bucket = buckets.get(key);
-	if (!bucket) {
-		bucket = { tokens: BUCKET_CAPACITY, lastRefillAt: Date.now() };
-		buckets.set(key, bucket);
-	}
-	refill(bucket);
-	if (bucket.tokens > 0) {
-		bucket.tokens--;
-		return true;
-	}
-	return false;
-}
-
-/** Reset all buckets — for tests only. */
-export function _resetRegisterBuckets(): void {
-	buckets.clear();
-}