wiki-viewer 1.14.1 → 2.0.0

package/.next/standalone/src/tests/proof/agent-ownership.test.ts

@@ -1,140 +0,0 @@
-/**
- * Per-user agent ownership tests.
- *
- * User A approves an agent → only user A sees it / can revoke it.
- * User B cannot see or revoke user A's agents.
- */
-import { test, before, after, beforeEach } from "node:test";
-import assert from "node:assert/strict";
-import { mkdtemp, rm } from "node:fs/promises";
-import { tmpdir } from "node:os";
-import path from "node:path";
-
-let tmpHome: string;
-
-before(async () => {
-	tmpHome = await mkdtemp(path.join(tmpdir(), "agent-ownership-test-"));
-	process.env.HOME = tmpHome;
-});
-
-after(async () => {
-	await rm(tmpHome, { recursive: true, force: true });
-});
-
-import { POST as registerPOST } from "../../app/api/agent/register/route.js";
-import { POST as approvePOST } from "../../app/api/agent/admin/registrations/[regId]/approve/route.js";
-import { GET as listAgentsGET } from "../../app/api/agent/admin/agents/route.js";
-import { POST as revokeAgentPOST } from "../../app/api/agent/admin/agents/[agentId]/revoke/route.js";
-import { ensureRegistry } from "../../lib/proof/registry.js";
-
-beforeEach(async () => {
-	const { _resetRegisterBuckets } = await import("../../lib/proof/register-rate-limit");
-	_resetRegisterBuckets();
-});
-
-async function makeUserCookie(tag: string): Promise<string> {
-	await ensureRegistry();
-	const { auth, authReady } = await import("../../lib/auth/server.js");
-	await authReady();
-	const res = await auth.api.signUpEmail({
-		body: {
-			email: `${tag}${Date.now()}@test.local`,
-			password: "test1234!",
-			name: tag,
-		},
-		asResponse: true,
-	});
-	if (!res.ok) throw new Error("signUpEmail failed: " + res.status);
-	const setCookie = res.headers.get("set-cookie") ?? "";
-	return setCookie
-		.split(/,(?=[^ ])/)
-		.map((c) => c.split(";")[0].trim())
-		.join("; ");
-}
-
-async function registerAgent(agentId: string): Promise<string> {
-	const req = new Request("http://localhost:3000/api/agent/register", {
-		method: "POST",
-		headers: { "Content-Type": "application/json" },
-		body: JSON.stringify({
-			id: agentId,
-			displayName: `Agent ${agentId}`,
-			scope: { paths: ["**/*"], ops: ["read"] },
-		}),
-	});
-	const res = await registerPOST(req);
-	const data = (await res.json()) as { registrationId: string };
-	return data.registrationId;
-}
-
-async function approveAgent(regId: string, cookie: string): Promise<void> {
-	const req = new Request(
-		`http://localhost:3000/api/agent/admin/registrations/${regId}/approve`,
-		{ method: "POST", headers: { Cookie: cookie } },
-	);
-	const res = await approvePOST(req, { params: Promise.resolve({ regId }) });
-	assert.equal(res.status, 200, `approve failed: ${await res.text()}`);
-}
-
-test("User A approves agent → appears in user A's agent list", async () => {
-	const cookieA = await makeUserCookie("usera");
-	const regId = await registerAgent("ai:agent-a1");
-	await approveAgent(regId, cookieA);
-
-	const listReq = new Request("http://localhost:3000/api/agent/admin/agents", {
-		headers: { Cookie: cookieA },
-	});
-	const res = await listAgentsGET(listReq);
-	assert.equal(res.status, 200);
-	const data = (await res.json()) as { agents: Array<{ id: string }> };
-	assert.ok(data.agents.some((a) => a.id === "ai:agent-a1"));
-});
-
-test("User B cannot see user A's agent", async () => {
-	const cookieA = await makeUserCookie("usera2");
-	const cookieB = await makeUserCookie("userb2");
-
-	const regId = await registerAgent("ai:agent-a2");
-	await approveAgent(regId, cookieA);
-
-	const listReq = new Request("http://localhost:3000/api/agent/admin/agents", {
-		headers: { Cookie: cookieB },
-	});
-	const res = await listAgentsGET(listReq);
-	assert.equal(res.status, 200);
-	const data = (await res.json()) as { agents: Array<{ id: string }> };
-	assert.ok(!data.agents.some((a) => a.id === "ai:agent-a2"), "User B should not see user A's agent");
-});
-
-test("User B cannot revoke user A's agent → 403", async () => {
-	const cookieA = await makeUserCookie("usera3");
-	const cookieB = await makeUserCookie("userb3");
-
-	const regId = await registerAgent("ai:agent-a3");
-	await approveAgent(regId, cookieA);
-
-	const revokeReq = new Request(
-		"http://localhost:3000/api/agent/admin/agents/ai:agent-a3/revoke",
-		{ method: "POST", headers: { Cookie: cookieB } },
-	);
-	const res = await revokeAgentPOST(revokeReq, {
-		params: Promise.resolve({ agentId: "ai:agent-a3" }),
-	});
-	assert.equal(res.status, 403);
-});
-
-test("User A can revoke their own agent", async () => {
-	const cookieA = await makeUserCookie("usera4");
-
-	const regId = await registerAgent("ai:agent-a4");
-	await approveAgent(regId, cookieA);
-
-	const revokeReq = new Request(
-		"http://localhost:3000/api/agent/admin/agents/ai:agent-a4/revoke",
-		{ method: "POST", headers: { Cookie: cookieA } },
-	);
-	const res = await revokeAgentPOST(revokeReq, {
-		params: Promise.resolve({ agentId: "ai:agent-a4" }),
-	});
-	assert.equal(res.status, 200);
-});

package/.next/standalone/src/tests/proof/agent-workspace-scope.test.ts

@@ -1,134 +0,0 @@
-/**
- * Phase C — Agent workspace scoping.
- *
- * Proves an agent whose scope.workspaceId is pinned to one workspace is
- * rejected (403) when a request resolves to a DIFFERENT workspace, and
- * allowed (200) when it matches. An agent with no workspaceId (wildcard)
- * works in any workspace.
- */
-import { test, before, after } from "node:test";
-import assert from "node:assert/strict";
-import { mkdtemp, rm, writeFile, mkdir } from "node:fs/promises";
-import { tmpdir } from "node:os";
-import path from "node:path";
-import { randomBytes } from "node:crypto";
-
-import { setRootDir } from "../../lib/root-dir.js";
-import { ensureRegistry, addAgent, hashToken } from "../../lib/proof/registry.js";
-import { writeConfig } from "../../lib/config.js";
-import type { Workspace } from "../../lib/workspaces.js";
-
-let tmpHome: string;
-let rootA: string;
-let rootB: string;
-let wsA: Workspace;
-let wsB: Workspace;
-
-let fileGET: (req: Request, ctx: { params: Promise<{ path: string[] }> }) => Promise<Response>;
-
-const PINNED_TOKEN = randomBytes(32).toString("hex");
-const WILDCARD_TOKEN = randomBytes(32).toString("hex");
-
-function headers(token: string, id: string): Record<string, string> {
-	return { Authorization: `Bearer ${token}`, "X-Agent-Id": id };
-}
-
-function makeCtx(segments: string[]): { params: Promise<{ path: string[] }> } {
-	return { params: Promise.resolve({ path: segments }) };
-}
-
-before(async () => {
-	tmpHome = await mkdtemp(path.join(tmpdir(), "ws-scope-home-"));
-	rootA = await mkdtemp(path.join(tmpdir(), "ws-scope-A-"));
-	rootB = await mkdtemp(path.join(tmpdir(), "ws-scope-B-"));
-	process.env.HOME = tmpHome;
-	setRootDir(rootA); // fallback (unused once registry has workspaces)
-
-	wsA = {
-		id: "ws_AAAAAA",
-		name: "A",
-		rootDir: rootA,
-		createdAt: new Date().toISOString(),
-		lastOpenedAt: new Date().toISOString(),
-	};
-	wsB = {
-		id: "ws_BBBBBB",
-		name: "B",
-		rootDir: rootB,
-		createdAt: new Date().toISOString(),
-		lastOpenedAt: new Date().toISOString(),
-	};
-	// Seed registry so resolveWorkspaceForAgent picks by ?ws= instead of fallback.
-	await writeConfig({ workspaces: [wsA, wsB] });
-
-	await ensureRegistry();
-	await addAgent({
-		id: "ai:pinned",
-		displayName: "Pinned to A",
-		tokenHash: hashToken(PINNED_TOKEN),
-		scope: { paths: ["**/*"], ops: ["read", "mutate"], workspaceId: wsA.id },
-		createdAt: new Date().toISOString(),
-		lastSeen: new Date().toISOString(),
-	});
-	await addAgent({
-		id: "ai:wildcard",
-		displayName: "Wildcard",
-		tokenHash: hashToken(WILDCARD_TOKEN),
-		scope: { paths: ["**/*"], ops: ["read", "mutate"] }, // no workspaceId
-		createdAt: new Date().toISOString(),
-		lastSeen: new Date().toISOString(),
-	});
-
-	await writeFile(path.join(rootA, "a.txt"), "in A");
-	await writeFile(path.join(rootB, "b.txt"), "in B");
-
-	const fileRoute = await import("../../app/api/agent/fs/file/[...path]/route.js");
-	fileGET = fileRoute.GET;
-});
-
-async function rmQuiet(p: string): Promise<void> {
-	// File-lock sentinels may be written concurrently during teardown → retry.
-	for (let i = 0; i < 3; i++) {
-		try {
-			await rm(p, { recursive: true, force: true });
-			return;
-		} catch {
-			await new Promise((r) => setTimeout(r, 50));
-		}
-	}
-}
-
-after(async () => {
-	await rmQuiet(tmpHome);
-	await rmQuiet(rootA);
-	await rmQuiet(rootB);
-});
-
-test("pinned agent: 200 in its own workspace", async () => {
-	const req = new Request(`http://localhost/api/agent/fs/file/a.txt?ws=${wsA.id}`, {
-		headers: headers(PINNED_TOKEN, "ai:pinned"),
-	});
-	const res = await fileGET(req, makeCtx(["a.txt"]));
-	assert.equal(res.status, 200);
-	assert.equal(await res.text(), "in A");
-});
-
-test("pinned agent: 403 when request resolves to a different workspace", async () => {
-	const req = new Request(`http://localhost/api/agent/fs/file/b.txt?ws=${wsB.id}`, {
-		headers: headers(PINNED_TOKEN, "ai:pinned"),
-	});
-	const res = await fileGET(req, makeCtx(["b.txt"]));
-	assert.equal(res.status, 403);
-});
-
-test("wildcard agent: 200 in either workspace", async () => {
-	const reqA = new Request(`http://localhost/api/agent/fs/file/a.txt?ws=${wsA.id}`, {
-		headers: headers(WILDCARD_TOKEN, "ai:wildcard"),
-	});
-	assert.equal((await fileGET(reqA, makeCtx(["a.txt"]))).status, 200);
-
-	const reqB = new Request(`http://localhost/api/agent/fs/file/b.txt?ws=${wsB.id}`, {
-		headers: headers(WILDCARD_TOKEN, "ai:wildcard"),
-	});
-	assert.equal((await fileGET(reqB, makeCtx(["b.txt"]))).status, 200);
-});

package/.next/standalone/src/tests/proof/agents-install.test.ts

@@ -1,110 +0,0 @@
-/**
- * Tests for /api/agents/install, /api/agents/skill, /api/agents/skill.tar.gz
- */
-import { test } from "node:test";
-import assert from "node:assert/strict";
-
-function makeMockRequest(url: string): Request {
-	return new Request(url, { method: "GET" });
-}
-
-// Import routes
-import { GET as installGET } from "../../app/api/agents/install/route.js";
-import { GET as skillGET } from "../../app/api/agents/skill/route.js";
-import { GET as tarGET } from "../../app/api/agents/skill.tar.gz/route.js";
-
-test("GET /api/agents/install returns 200 with expected shape", async () => {
-	const req = makeMockRequest("http://localhost:3000/api/agents/install");
-	const res = await installGET(req as Parameters<typeof installGET>[0]);
-	assert.equal(res.status, 200);
-
-	const body = await res.json() as Record<string, unknown>;
-	assert.equal(body.name, "wiki-viewer");
-	assert.ok(typeof body.version === "string" && body.version.length > 0);
-	assert.ok(typeof body.endpoint === "string" && body.endpoint.startsWith("http"));
-	assert.ok(Array.isArray(body.routes) && (body.routes as unknown[]).length > 0);
-	assert.ok(typeof body.skillTarball === "string");
-	assert.ok(typeof body.bootstrapPrompt === "string" && body.bootstrapPrompt.length > 0);
-	assert.ok(typeof body.humanInstructions === "string" && body.humanInstructions.length > 0);
-	assert.ok(Array.isArray(body.ops) && (body.ops as unknown[]).length > 0);
-});
-
-test("GET /api/agents/install manifest includes fs/* routes, capabilities, scopeOps, modes, mcpAdapter", async () => {
-	const req = makeMockRequest("http://localhost:3000/api/agents/install");
-	const res = await installGET(req as Parameters<typeof installGET>[0]);
-	const body = await res.json() as Record<string, unknown>;
-
-	// fs routes present
-	const routes = body.routes as Array<Record<string, string>>;
-	const fsPaths = routes.map((r) => r.path);
-	assert.ok(fsPaths.some((p) => p.includes("/api/agent/fs/file")), "missing GET/PUT/DELETE fs/file route");
-	assert.ok(fsPaths.some((p) => p.includes("/api/agent/fs/ls")), "missing fs/ls route");
-	assert.ok(fsPaths.some((p) => p.includes("/api/agent/fs/move")), "missing fs/move route");
-	assert.ok(fsPaths.some((p) => p.includes("/api/agent/fs/search")), "missing fs/search route");
-
-	// capabilities block
-	const caps = body.capabilities as Record<string, unknown>;
-	assert.ok(caps, "capabilities block missing");
-	assert.ok(typeof caps.maxFileBytes === "number" && caps.maxFileBytes > 0, "maxFileBytes missing");
-	assert.equal(caps.supportsRange, true);
-	assert.equal(caps.ifMatchRequired, true);
-	assert.equal(caps.forceBypass, true);
-	assert.deepEqual(caps.search, ["grep", "glob"]);
-	assert.equal(caps.collabPrecondition, "If-Collab-Match");
-
-	// scopeOps includes delete
-	const scopeOps = caps.scopeOps as string[];
-	assert.ok(Array.isArray(scopeOps), "scopeOps missing");
-	assert.ok(scopeOps.includes("read"), "scopeOps missing read");
-	assert.ok(scopeOps.includes("mutate"), "scopeOps missing mutate");
-	assert.ok(scopeOps.includes("delete"), "scopeOps missing delete");
-
-	// collabStates
-	const collabStates = caps.collabStates as string[];
-	assert.ok(Array.isArray(collabStates));
-	assert.ok(collabStates.includes("active"));
-	assert.ok(collabStates.includes("not-markdown"));
-
-	// modes block
-	const modes = body.modes as Record<string, unknown>;
-	assert.ok(modes, "modes block missing");
-	assert.ok(typeof modes.rule === "string" && modes.rule.includes("X-Collab-State"), "modes.rule missing mode distinction");
-	const tiers = modes.tiers as Record<string, string>;
-	assert.ok(tiers && tiers.tier1 && tiers.tier2, "modes.tiers missing");
-
-	// mcpAdapter
-	const mcp = body.mcpAdapter as Record<string, unknown>;
-	assert.ok(mcp, "mcpAdapter missing");
-	assert.equal(mcp.package, "wiki-viewer-mcp");
-	assert.ok(typeof mcp.invoke === "string" && mcp.invoke.includes("npx"));
-	const env = mcp.env as string[];
-	assert.ok(env.includes("WIKI_VIEWER_URL"));
-	assert.ok(env.includes("WIKI_VIEWER_TOKEN"));
-});
-
-test("GET /api/agents/skill returns 200 text/markdown with SKILL.md content", async () => {
-	const req = makeMockRequest("http://localhost:3000/api/agents/skill");
-	const res = await skillGET(req as Parameters<typeof skillGET>[0]);
-	assert.equal(res.status, 200);
-
-	const ct = res.headers.get("content-type") ?? "";
-	assert.ok(ct.startsWith("text/markdown"), `Expected text/markdown, got: ${ct}`);
-
-	const body = await res.text();
-	assert.ok(body.startsWith("---\nname: wiki-viewer"), `Unexpected start: ${body.slice(0, 40)}`);
-});
-
-test("GET /api/agents/skill.tar.gz returns 200 gzip with magic bytes", async () => {
-	const req = makeMockRequest("http://localhost:3000/api/agents/skill.tar.gz");
-	const res = await tarGET(req as Parameters<typeof tarGET>[0]);
-	assert.equal(res.status, 200);
-
-	const ct = res.headers.get("content-type") ?? "";
-	assert.equal(ct, "application/gzip");
-
-	const buf = Buffer.from(await res.arrayBuffer());
-	assert.ok(buf.length > 0, "tarball should not be empty");
-	// gzip magic bytes
-	assert.equal(buf[0], 0x1f);
-	assert.equal(buf[1], 0x8b);
-});

package/.next/standalone/src/tests/proof/bench-write.ts

@@ -1,179 +0,0 @@
-/**
- * Isolated write-path benchmark — NOT a test, NOT touching production state.
- *
- * Drives the real Tier-1 route handlers (filePUT / fileGET) against a throwaway
- * temp rootDir + temp HOME (lock dir), exactly like agent-fs.test.ts, and
- * measures end-to-end server-side latency for the write path:
- *   - non-.md overwrite (raw, no lock/sidecar)
- *   - .md overwrite (cross-proc lock + reconcile + sidecar write + datasync)
- *   - edit_file equivalent (GET + PUT round-trip on .md)
- *
- * Run:  npx tsx src/tests/proof/bench-write.ts
- * Optional env: BENCH_ITERS (default 300), BENCH_WARMUP (default 30)
- */
-import { mkdtemp, writeFile, rm } from "node:fs/promises";
-import { tmpdir } from "node:os";
-import path from "node:path";
-import { createHash, randomBytes } from "node:crypto";
-
-import { setRootDir } from "../../lib/root-dir.js";
-import { ensureRegistry, addAgent, hashToken } from "../../lib/proof/registry.js";
-
-const ITERS = Number(process.env.BENCH_ITERS) || 300;
-const WARMUP = Number(process.env.BENCH_WARMUP) || 30;
-
-function sha256(buf: Buffer): string {
-	return "sha256:" + createHash("sha256").update(buf).digest("hex");
-}
-function hdrs(token: string, id: string): Record<string, string> {
-	return { Authorization: `Bearer ${token}`, "X-Agent-Id": id };
-}
-function fileUrl(rel: string, qs = ""): string {
-	return `http://localhost/api/agent/fs/file/${rel}${qs}`;
-}
-
-function pct(sorted: number[], p: number): number {
-	const i = Math.min(sorted.length - 1, Math.floor((p / 100) * sorted.length));
-	return sorted[i];
-}
-function stats(label: string, samples: number[]) {
-	const s = [...samples].sort((a, b) => a - b);
-	const sum = s.reduce((a, b) => a + b, 0);
-	const mean = sum / s.length;
-	return {
-		label,
-		n: s.length,
-		mean: +mean.toFixed(3),
-		p50: +pct(s, 50).toFixed(3),
-		p95: +pct(s, 95).toFixed(3),
-		p99: +pct(s, 99).toFixed(3),
-		min: +s[0].toFixed(3),
-		max: +s[s.length - 1].toFixed(3),
-	};
-}
-
-async function timeIt(fn: () => Promise<void>): Promise<number> {
-	const t0 = performance.now();
-	await fn();
-	return performance.now() - t0;
-}
-
-async function main() {
-	const tmpHome = await mkdtemp(path.join(tmpdir(), "bench-home-"));
-	const tmpRoot = await mkdtemp(path.join(tmpdir(), "bench-root-"));
-	process.env.HOME = tmpHome;
-	setRootDir(tmpRoot);
-	await ensureRegistry();
-
-	const TOKEN = randomBytes(32).toString("hex");
-	await addAgent({
-		id: "ai:bench",
-		displayName: "Bench",
-		tokenHash: hashToken(TOKEN),
-		scope: { paths: ["**/*"], ops: ["read", "mutate", "delete"] },
-		createdAt: new Date().toISOString(),
-		lastSeen: new Date().toISOString(),
-	});
-
-	const fileRoute = await import("../../app/api/agent/fs/file/[...path]/route.js");
-	const filePUT = fileRoute.PUT;
-	const fileGET = fileRoute.GET;
-	const H = hdrs(TOKEN, "ai:bench");
-
-	const ctx = (rel: string) => ({ params: Promise.resolve({ path: rel.split("/") }) });
-
-	// Seed bodies (~1KB, realistic small doc)
-	const body = Buffer.from("# Doc\n\n" + "lorem ipsum dolor sit amet. ".repeat(40));
-	const txtBody = Buffer.from("config_value = " + "x".repeat(900));
-
-	async function putOnce(rel: string, data: Buffer, ifMatch?: string, ifCollab?: string): Promise<Response> {
-		const headers: Record<string, string> = { ...H, "Content-Type": "application/octet-stream" };
-		if (ifMatch) headers["If-Match"] = ifMatch;
-		if (ifCollab) headers["If-Collab-Match"] = ifCollab;
-		return filePUT(new Request(fileUrl(rel), { method: "PUT", headers, body: new Uint8Array(data) }), ctx(rel));
-	}
-	async function getSha(rel: string): Promise<{ sha: string; collabRev: string | null }> {
-		const res = await fileGET(new Request(fileUrl(rel), { headers: H }), ctx(rel));
-		const etag = (res.headers.get("ETag") ?? "").replace(/"/g, "");
-		return { sha: etag, collabRev: res.headers.get("X-Collab-Revision") };
-	}
-
-	// ── Scenario A: non-.md overwrite (lean path) ──────────────────────────────
-	await putOnce("bench.txt", txtBody, undefined); // create
-	const txtSamples: number[] = [];
-	{
-		let sha = (await getSha("bench.txt")).sha;
-		for (let i = 0; i < WARMUP + ITERS; i++) {
-			const data = Buffer.from(txtBody.toString() + i);
-			const t = await timeIt(async () => {
-				const res = await putOnce("bench.txt", data, sha);
-				if (res.status !== 200) throw new Error("txt PUT " + res.status);
-				sha = (await res.json() as { sha256: string }).sha256;
-			});
-			if (i >= WARMUP) txtSamples.push(t);
-		}
-	}
-
-	// ── Scenario B: .md overwrite (lock + reconcile + sidecar + datasync) ──────
-	await putOnce("bench.md", body, undefined); // create
-	const mdSamples: number[] = [];
-	{
-		let sha = (await getSha("bench.md")).sha;
-		for (let i = 0; i < WARMUP + ITERS; i++) {
-			const data = Buffer.from(body.toString() + "\n\nedit " + i);
-			const t = await timeIt(async () => {
-				const res = await putOnce("bench.md", data, sha);
-				if (res.status !== 200) throw new Error("md PUT " + res.status + " " + await res.text());
-				sha = (await res.json() as { sha256: string }).sha256;
-			});
-			if (i >= WARMUP) mdSamples.push(t);
-		}
-	}
-
-	// ── Scenario C: edit_file equivalent — GET + PUT round-trip on .md ─────────
-	const editSamples: number[] = [];
-	{
-		for (let i = 0; i < WARMUP + ITERS; i++) {
-			const data = Buffer.from(body.toString() + "\n\nrt " + i);
-			const t = await timeIt(async () => {
-				const { sha } = await getSha("bench.md");
-				const res = await putOnce("bench.md", data, sha);
-				if (res.status !== 200) throw new Error("edit PUT " + res.status);
-				await res.json();
-			});
-			if (i >= WARMUP) editSamples.push(t);
-		}
-	}
-
-	const results = [
-		stats("non-.md overwrite (lean)", txtSamples),
-		stats(".md overwrite (lock+reconcile+sidecar+datasync)", mdSamples),
-		stats("edit_file (GET+PUT .md round-trip)", editSamples),
-	];
-
-	console.log(`\nwrite-path benchmark  (iters=${ITERS}, warmup=${WARMUP}, ~1KB bodies)\n`);
-	console.log(
-		["scenario".padEnd(48), "p50", "p95", "p99", "mean", "max"].join("  "),
-	);
-	for (const r of results) {
-		console.log(
-			[
-				r.label.padEnd(48),
-				`${r.p50}ms`.padStart(7),
-				`${r.p95}ms`.padStart(7),
-				`${r.p99}ms`.padStart(7),
-				`${r.mean}ms`.padStart(7),
-				`${r.max}ms`.padStart(7),
-			].join("  "),
-		);
-	}
-	console.log("");
-
-	await rm(tmpHome, { recursive: true, force: true });
-	await rm(tmpRoot, { recursive: true, force: true });
-}
-
-main().catch((e) => {
-	console.error(e);
-	process.exit(1);
-});

package/.next/standalone/src/tests/proof/better-auth.test.ts

@@ -1,68 +0,0 @@
-import { test } from "node:test";
-import assert from "node:assert/strict";
-import { isEmailAllowed } from "../../lib/auth/allowlist";
-
-function resetEnv() {
-	delete process.env.AUTH_ALLOWED_EMAILS;
-	delete process.env.AUTH_ALLOWED_DOMAIN;
-}
-
-// These tests exercise the env-fallback path. They assume no allowlist is set
-// in ~/.wiki-viewer/config.json (config takes precedence over env when present).
-
-test("isEmailAllowed: no env vars allows any email", async () => {
-	resetEnv();
-	assert.equal(await isEmailAllowed("anyone@example.com"), true);
-	assert.equal(await isEmailAllowed("eve@evil.com"), true);
-});
-
-test("isEmailAllowed: explicit allowlist (case-insensitive)", async () => {
-	resetEnv();
-	process.env.AUTH_ALLOWED_EMAILS = "alice@example.com,bob@example.com";
-	try {
-		assert.equal(await isEmailAllowed("alice@example.com"), true);
-		assert.equal(await isEmailAllowed("ALICE@EXAMPLE.COM"), true);
-		assert.equal(await isEmailAllowed("bob@example.com"), true);
-		assert.equal(await isEmailAllowed("eve@example.com"), false);
-	} finally {
-		resetEnv();
-	}
-});
-
-test("isEmailAllowed: domain allowlist", async () => {
-	resetEnv();
-	process.env.AUTH_ALLOWED_DOMAIN = "example.com,trusted.org";
-	try {
-		assert.equal(await isEmailAllowed("anyone@example.com"), true);
-		assert.equal(await isEmailAllowed("user@trusted.org"), true);
-		assert.equal(await isEmailAllowed("user@TRUSTED.ORG"), true);
-		assert.equal(await isEmailAllowed("eve@evil.com"), false);
-	} finally {
-		resetEnv();
-	}
-});
-
-test("isEmailAllowed: both lists, either match wins", async () => {
-	resetEnv();
-	process.env.AUTH_ALLOWED_EMAILS = "guest@anywhere.com";
-	process.env.AUTH_ALLOWED_DOMAIN = "example.com";
-	try {
-		assert.equal(await isEmailAllowed("alice@example.com"), true);
-		assert.equal(await isEmailAllowed("guest@anywhere.com"), true);
-		assert.equal(await isEmailAllowed("eve@evil.com"), false);
-	} finally {
-		resetEnv();
-	}
-});
-
-test("isEmailAllowed: handles whitespace and empty entries", async () => {
-	resetEnv();
-	process.env.AUTH_ALLOWED_EMAILS = " alice@example.com , , bob@example.com ";
-	try {
-		assert.equal(await isEmailAllowed("alice@example.com"), true);
-		assert.equal(await isEmailAllowed("bob@example.com"), true);
-		assert.equal(await isEmailAllowed("eve@example.com"), false);
-	} finally {
-		resetEnv();
-	}
-});