wiki-viewer 1.14.1 → 2.0.0

package/.next/standalone/src/tests/proof/suggestion-ops.test.ts

@@ -1,280 +0,0 @@
-import { test, before, after } from "node:test";
-import assert from "node:assert/strict";
-import { mkdtemp, writeFile, rm } from "node:fs/promises";
-import { tmpdir } from "node:os";
-import path from "node:path";
-import { applyOps, readSnapshot } from "../../lib/proof/ops-applier.js";
-import { setRootDir } from "../../lib/root-dir.js";
-
-let tmpRoot: string;
-
-before(async () => {
-	tmpRoot = await mkdtemp(path.join(tmpdir(), "wiki-suggestion-ops-test-"));
-	setRootDir(tmpRoot);
-});
-
-after(async () => {
-	await rm(tmpRoot, { recursive: true, force: true });
-});
-
-async function writeDoc(name: string, content: string): Promise<void> {
-	await writeFile(path.join(tmpRoot, name), content, "utf-8");
-}
-
-// ── suggestion.add (pending) ─────────────────────────────────────────────────
-
-test("suggestion.add with status=pending → sidecar has pending suggestion + event suggestion.added", async () => {
-	await writeDoc("sug-add-pending.md", "# Title\n\nOriginal paragraph.\n");
-	const snap = await readSnapshot(tmpRoot, "sug-add-pending.md");
-	assert.ok(snap !== null);
-	const paraRef = snap!.blocks[1].ref;
-
-	const result = await applyOps({
-		rootDir: tmpRoot,
-		mdPath: "sug-add-pending.md",
-		baseRevision: 0,
-		by: "ai:claude",
-		ops: [{
-			type: "suggestion.add",
-			ref: paraRef,
-			kind: "replace",
-			markdown: "Proposed replacement.",
-			basis: "described",
-			basisDetail: "user mentioned slippage",
-		}],
-	});
-
-	assert.ok(result.ok, `expected ok: ${JSON.stringify(result)}`);
-	const sug = result.ok ? result.snapshot.suggestions[0] : null;
-	assert.ok(sug, "pending suggestion should be present in snapshot");
-	assert.equal(sug!.status, "pending");
-	assert.equal(sug!.kind, "replace");
-	assert.equal(sug!.markdown, "Proposed replacement.");
-	assert.equal(sug!.by, "ai:claude");
-	assert.equal(sug!.basisDetail, "user mentioned slippage");
-
-	// Event: suggestion.added emitted
-	assert.ok(result.ok);
-	const addedEvt = result.ok
-		? result.emittedEvents.find((e) => e.type === "suggestion.added")
-		: null;
-	assert.ok(addedEvt, "suggestion.added event should be emitted");
-	assert.equal((addedEvt as unknown as { type: string; suggestionId: string }).suggestionId, sug!.id);
-
-	// File content should NOT change (still pending)
-	const snap2 = await readSnapshot(tmpRoot, "sug-add-pending.md");
-	assert.ok(snap2!.blocks.some((b) => b.markdown.includes("Original paragraph.")), "original should remain");
-});
-
-// ── suggestion.add (pre-accepted) ────────────────────────────────────────────
-
-test("suggestion.add with status=accepted → block replaced + 2 events", async () => {
-	await writeDoc("sug-add-accepted.md", "# Title\n\nOriginal paragraph.\n");
-	const snap = await readSnapshot(tmpRoot, "sug-add-accepted.md");
-	const paraRef = snap!.blocks[1].ref;
-
-	const result = await applyOps({
-		rootDir: tmpRoot,
-		mdPath: "sug-add-accepted.md",
-		baseRevision: 0,
-		by: "ai:claude",
-		ops: [{
-			type: "suggestion.add",
-			ref: paraRef,
-			kind: "replace",
-			markdown: "Auto-accepted replacement.",
-			status: "accepted",
-		}],
-	});
-
-	assert.ok(result.ok, `expected ok: ${JSON.stringify(result)}`);
-
-	// Suggestion should NOT be in pending list (it's archived)
-	const pending = result.ok ? result.snapshot.suggestions : [];
-	assert.equal(pending.length, 0, "no pending suggestions after auto-accept");
-
-	// Two events: suggestion.added + suggestion.accepted
-	assert.ok(result.ok);
-	const events = result.ok ? result.emittedEvents : [];
-	const addedEvt = events.find((e) => e.type === "suggestion.added");
-	const acceptedEvt = events.find((e) => e.type === "suggestion.accepted");
-	assert.ok(addedEvt, "suggestion.added event should be emitted");
-	assert.ok(acceptedEvt, "suggestion.accepted event should be emitted");
-});
-
-// ── suggestion.accept ────────────────────────────────────────────────────────
-
-test("suggestion.accept → pending becomes accepted, block edit applied, event emitted", async () => {
-	await writeDoc("sug-accept.md", "# Title\n\nOriginal paragraph.\n");
-	const snap = await readSnapshot(tmpRoot, "sug-accept.md");
-	const paraRef = snap!.blocks[1].ref;
-
-	// Add suggestion
-	const addResult = await applyOps({
-		rootDir: tmpRoot,
-		mdPath: "sug-accept.md",
-		baseRevision: 0,
-		by: "ai:claude",
-		ops: [{
-			type: "suggestion.add",
-			ref: paraRef,
-			kind: "replace",
-			markdown: "Accepted replacement.",
-		}],
-	});
-	assert.ok(addResult.ok, `add: ${JSON.stringify(addResult)}`);
-	const sugId = addResult.ok ? addResult.snapshot.suggestions[0]?.id : null;
-	assert.ok(sugId, "suggestion id must exist");
-
-	// Accept suggestion
-	const acceptResult = await applyOps({
-		rootDir: tmpRoot,
-		mdPath: "sug-accept.md",
-		baseRevision: 1,
-		by: "human",
-		ops: [{ type: "suggestion.accept", suggestionId: sugId! }],
-	});
-	assert.ok(acceptResult.ok, `accept: ${JSON.stringify(acceptResult)}`);
-
-	// No more pending suggestions
-	const pending = acceptResult.ok ? acceptResult.snapshot.suggestions : [];
-	assert.equal(pending.length, 0, "no pending after accept");
-
-	// suggestion.accepted event emitted
-	assert.ok(acceptResult.ok);
-	const evt = acceptResult.ok
-		? acceptResult.emittedEvents.find((e) => e.type === "suggestion.accepted")
-		: null;
-	assert.ok(evt, "suggestion.accepted event emitted");
-
-	// File content updated
-	const snap2 = await readSnapshot(tmpRoot, "sug-accept.md");
-	assert.ok(snap2!.blocks.some((b) => b.markdown.includes("Accepted replacement.")), "block replaced");
-	assert.ok(!snap2!.blocks.some((b) => b.markdown.includes("Original paragraph.")), "old block gone");
-});
-
-// ── suggestion.reject ────────────────────────────────────────────────────────
-
-test("suggestion.reject → moved to archivedSuggestions + event, file unchanged", async () => {
-	await writeDoc("sug-reject.md", "# Title\n\nOriginal paragraph.\n");
-	const snap = await readSnapshot(tmpRoot, "sug-reject.md");
-	const paraRef = snap!.blocks[1].ref;
-
-	const addResult = await applyOps({
-		rootDir: tmpRoot,
-		mdPath: "sug-reject.md",
-		baseRevision: 0,
-		by: "ai:claude",
-		ops: [{
-			type: "suggestion.add",
-			ref: paraRef,
-			kind: "replace",
-			markdown: "Rejected replacement.",
-		}],
-	});
-	assert.ok(addResult.ok);
-	const sugId = addResult.ok ? addResult.snapshot.suggestions[0]?.id : null;
-	assert.ok(sugId);
-
-	const rejectResult = await applyOps({
-		rootDir: tmpRoot,
-		mdPath: "sug-reject.md",
-		baseRevision: 1,
-		by: "human",
-		ops: [{ type: "suggestion.reject", suggestionId: sugId! }],
-	});
-	assert.ok(rejectResult.ok, `reject: ${JSON.stringify(rejectResult)}`);
-
-	// No pending suggestions
-	const pending = rejectResult.ok ? rejectResult.snapshot.suggestions : [];
-	assert.equal(pending.length, 0, "no pending after reject");
-
-	// suggestion.rejected event
-	assert.ok(rejectResult.ok);
-	const evt = rejectResult.ok
-		? rejectResult.emittedEvents.find((e) => e.type === "suggestion.rejected")
-		: null;
-	assert.ok(evt, "suggestion.rejected event emitted");
-
-	// File NOT changed
-	const snap2 = await readSnapshot(tmpRoot, "sug-reject.md");
-	assert.ok(snap2!.blocks.some((b) => b.markdown.includes("Original paragraph.")), "original preserved");
-	assert.ok(!snap2!.blocks.some((b) => b.markdown.includes("Rejected replacement.")), "rejected text absent");
-});
-
-// ── two pending on same ref, accept one → other auto-rejected (§6.8) ─────────
-
-test("two pending suggestions on same ref: accept one → other auto-rejected (resolvedBy: system)", async () => {
-	await writeDoc("sug-conflict.md", "# Title\n\nOriginal paragraph.\n");
-	const snap = await readSnapshot(tmpRoot, "sug-conflict.md");
-	const paraRef = snap!.blocks[1].ref;
-
-	// Add first suggestion
-	const add1 = await applyOps({
-		rootDir: tmpRoot,
-		mdPath: "sug-conflict.md",
-		baseRevision: 0,
-		by: "ai:claude",
-		ops: [{ type: "suggestion.add", ref: paraRef, kind: "replace", markdown: "Suggestion A." }],
-	});
-	assert.ok(add1.ok);
-	const sugId1 = add1.ok ? add1.snapshot.suggestions[0]?.id : null;
-	assert.ok(sugId1);
-
-	// Add second suggestion (same ref)
-	const add2 = await applyOps({
-		rootDir: tmpRoot,
-		mdPath: "sug-conflict.md",
-		baseRevision: 1,
-		by: "ai:cursor",
-		ops: [{ type: "suggestion.add", ref: paraRef, kind: "replace", markdown: "Suggestion B." }],
-	});
-	assert.ok(add2.ok);
-	const sugId2 = add2.ok ? add2.snapshot.suggestions[1]?.id : null;
-	assert.ok(sugId2, "second suggestion should exist");
-
-	// Both pending
-	assert.equal(add2.ok ? add2.snapshot.suggestions.length : -1, 2, "two pending");
-
-	// Accept first
-	const acceptResult = await applyOps({
-		rootDir: tmpRoot,
-		mdPath: "sug-conflict.md",
-		baseRevision: 2,
-		by: "human",
-		ops: [{ type: "suggestion.accept", suggestionId: sugId1! }],
-	});
-	assert.ok(acceptResult.ok, `accept: ${JSON.stringify(acceptResult)}`);
-
-	// No pending left
-	const pending = acceptResult.ok ? acceptResult.snapshot.suggestions : [];
-	assert.equal(pending.length, 0, "no pending after accepting one");
-
-	// suggestion.rejected event with reason=superseded for the second
-	assert.ok(acceptResult.ok);
-	const events = acceptResult.ok ? acceptResult.emittedEvents : [];
-	const rejectedEvt = events.find(
-		(e) => e.type === "suggestion.rejected" && (e as unknown as { suggestionId: string }).suggestionId === sugId2,
-	) as { type: string; by: string; reason: string } | undefined;
-	assert.ok(rejectedEvt, "rejected event for second suggestion");
-	assert.equal(rejectedEvt!.by, "system", "resolvedBy should be system");
-	assert.equal(rejectedEvt!.reason, "superseded");
-});
-
-// ── suggestion.accept on nonexistent ID → 409 SUGGESTION_NOT_FOUND ──────────
-
-test("suggestion.accept on nonexistent ID → 409 SUGGESTION_NOT_FOUND", async () => {
-	await writeDoc("sug-notfound.md", "# Title\n\nParagraph.\n");
-
-	const result = await applyOps({
-		rootDir: tmpRoot,
-		mdPath: "sug-notfound.md",
-		baseRevision: 0,
-		by: "human",
-		ops: [{ type: "suggestion.accept", suggestionId: "sdeadbeef" }],
-	});
-
-	assert.ok(!result.ok);
-	assert.equal(result.ok ? "" : result.code, "SUGGESTION_NOT_FOUND");
-	assert.equal(result.ok ? 0 : result.status, 409);
-});

package/.next/standalone/src/tests/proof/wiki-content-put.test.ts

@@ -1,140 +0,0 @@
-/**
- * Tests for PUT /api/wiki/content:
- * - auth required
- * - non-markdown plain write
- * - markdown with revision tracking
- * - stale revision → 409
- * - agent sees bumped revision after PUT
- */
-import { test, before, after } from "node:test";
-import assert from "node:assert/strict";
-import { mkdtemp, rm, writeFile, mkdir } from "node:fs/promises";
-import { tmpdir } from "node:os";
-import path from "node:path";
-
-let tmpHome: string;
-let tmpRoot: string;
-
-before(async () => {
-	tmpHome = await mkdtemp(path.join(tmpdir(), "wiki-put-test-"));
-	tmpRoot = await mkdtemp(path.join(tmpdir(), "wiki-put-root-"));
-	process.env.HOME = tmpHome;
-	process.env.ROOT_DIR = tmpRoot;
-	// Force root-dir module to pick up new ROOT_DIR
-	const { setRootDir } = await import("../../lib/root-dir.js");
-	setRootDir(tmpRoot);
-});
-
-after(async () => {
-	await rm(tmpHome, { recursive: true, force: true });
-	await rm(tmpRoot, { recursive: true, force: true });
-});
-
-import { PUT, GET } from "../../app/api/wiki/content/route.js";
-
-async function makeUserCookie(): Promise<string> {
-	const { auth, authReady } = await import("../../lib/auth/server.js");
-	await authReady();
-	const res = await auth.api.signUpEmail({
-		body: {
-			email: `put${Date.now()}${Math.random().toString(36).slice(2, 5)}@test.local`,
-			password: "test1234!",
-			name: "Put Test User",
-		},
-		asResponse: true,
-	});
-	if (!res.ok) throw new Error("signUpEmail failed: " + res.status);
-	const setCookie = res.headers.get("set-cookie") ?? "";
-	return setCookie
-		.split(/,(?=[^ ])/)
-		.map((c) => c.split(";")[0].trim())
-		.join("; ");
-}
-
-function makePutReq(
-	body: Record<string, unknown>,
-	cookie: string,
-): Request {
-	return new Request("http://localhost:3000/api/wiki/content", {
-		method: "PUT",
-		headers: { "Content-Type": "application/json", Cookie: cookie },
-		body: JSON.stringify(body),
-	});
-}
-
-test("PUT without session → 401", async () => {
-	const req = new Request("http://localhost:3000/api/wiki/content", {
-		method: "PUT",
-		headers: { "Content-Type": "application/json" },
-		body: JSON.stringify({ path: "test.md", content: "hi" }),
-	});
-	const res = await PUT(req);
-	assert.equal(res.status, 401);
-});
-
-test("PUT markdown with session + baseRevision:0 on new file → 200, revision 1", async () => {
-	const cookie = await makeUserCookie();
-	const filePath = path.join(tmpRoot, "new.md");
-	await writeFile(filePath, "# Hello\n", "utf-8");
-
-	const req = makePutReq({ path: "new.md", content: "# Updated\n", baseRevision: 0 }, cookie);
-	const res = await PUT(req);
-	assert.equal(res.status, 200);
-	const data = (await res.json()) as { ok: boolean; revision: number };
-	assert.equal(data.ok, true);
-	assert.equal(typeof data.revision, "number");
-	assert.ok(data.revision >= 1);
-});
-
-test("PUT markdown with matching baseRevision → 200", async () => {
-	const cookie = await makeUserCookie();
-	const filePath = path.join(tmpRoot, "rev.md");
-	await writeFile(filePath, "# Rev\n", "utf-8");
-
-	// First save — baseRevision:0 for fresh file
-	const r1 = await PUT(makePutReq({ path: "rev.md", content: "# Rev v1\n", baseRevision: 0 }, cookie));
-	assert.equal(r1.status, 200);
-	const d1 = (await r1.json()) as { revision: number };
-
-	// Second save — matching baseRevision
-	const r2 = await PUT(makePutReq({ path: "rev.md", content: "# Rev v2\n", baseRevision: d1.revision }, cookie));
-	assert.equal(r2.status, 200);
-	const d2 = (await r2.json()) as { revision: number };
-	assert.equal(d2.revision, d1.revision + 1);
-});
-
-test("PUT markdown with stale baseRevision → 409", async () => {
-	const cookie = await makeUserCookie();
-	const filePath = path.join(tmpRoot, "stale.md");
-	await writeFile(filePath, "# Stale\n", "utf-8");
-
-	// First save to bump revision
-	const r1 = await PUT(makePutReq({ path: "stale.md", content: "# v1\n", baseRevision: 0 }, cookie));
-	assert.equal(r1.status, 200);
-
-	// Second save with stale revision 0
-	const r2 = await PUT(makePutReq({ path: "stale.md", content: "# v2\n", baseRevision: 0 }, cookie));
-	assert.equal(r2.status, 409);
-	const body = (await r2.json()) as { error: string; currentRevision: number };
-	assert.equal(body.error, "STALE_REVISION");
-	assert.ok(body.currentRevision >= 1);
-});
-
-test("PUT non-markdown file → 200, no revision field", async () => {
-	const cookie = await makeUserCookie();
-	const filePath = path.join(tmpRoot, "data.json");
-	await writeFile(filePath, "{}", "utf-8");
-
-	const req = makePutReq({ path: "data.json", content: '{"a":1}' }, cookie);
-	const res = await PUT(req);
-	assert.equal(res.status, 200);
-	const data = (await res.json()) as { ok: boolean; revision?: number };
-	assert.equal(data.ok, true);
-	assert.equal(data.revision, undefined);
-});
-
-test("GET without auth → 401", async () => {
-	const req = new Request("http://localhost:3000/api/wiki/content?path=read.md");
-	const res = await GET(req);
-	assert.equal(res.status, 401);
-});

package/.next/standalone/src/tests/proof/wiki-routes-auth.test.ts

@@ -1,208 +0,0 @@
-/**
- * Auth and CSRF enforcement tests for /api/wiki/* routes.
- *
- * Verifies:
- * - Unauthenticated requests to protected endpoints → 401
- * - Cross-origin state-changing requests → 403
- * - Same-origin state-changing requests pass the CSRF check
- * - baseRevision required for markdown PUT → 400 BASE_REVISION_REQUIRED
- * - Stale baseRevision → 409 STALE_REVISION
- * - Happy-path markdown PUT → 200 with revision header
- * - GET with auth returns X-Wiki-Revision + X-Wiki-Fingerprint for markdown
- */
-import { test, before, after } from "node:test";
-import assert from "node:assert/strict";
-import { mkdtemp, rm, writeFile, mkdir } from "node:fs/promises";
-import { tmpdir } from "node:os";
-import path from "node:path";
-
-let tmpHome: string;
-let tmpRoot: string;
-
-before(async () => {
-	tmpHome = await mkdtemp(path.join(tmpdir(), "wiki-auth-routes-test-"));
-	process.env.HOME = tmpHome;
-	process.env.AUTH_ALLOWED_DOMAIN = "test.local";
-
-	tmpRoot = await mkdtemp(path.join(tmpdir(), "wiki-auth-routes-root-"));
-	process.env.ROOT_DIR = tmpRoot;
-
-	const { setRootDir } = await import("../../lib/root-dir.js");
-	setRootDir(tmpRoot);
-
-	// Pre-create test files so routes can operate
-	await mkdir(path.join(tmpRoot, "sub"), { recursive: true });
-	await writeFile(path.join(tmpRoot, "auth-test.md"), "# Auth Test\n", "utf-8");
-	await writeFile(path.join(tmpRoot, "stale.md"), "# Stale\n", "utf-8");
-	await writeFile(path.join(tmpRoot, "happy.md"), "# Happy\n", "utf-8");
-	await writeFile(path.join(tmpRoot, "rev-check.md"), "# Rev\n", "utf-8");
-});
-
-after(async () => {
-	delete process.env.AUTH_ALLOWED_DOMAIN;
-	await rm(tmpHome, { recursive: true, force: true });
-	await rm(tmpRoot, { recursive: true, force: true });
-});
-
-import { GET as wikiContentGET, PUT as wikiContentPUT } from "../../app/api/wiki/content/route.js";
-import { POST as wikiMovePOST } from "../../app/api/wiki/move/route.js";
-import { POST as wikiUploadPOST } from "../../app/api/wiki/upload/route.js";
-import { DELETE as wikiRootDELETE } from "../../app/api/wiki/route.js";
-import { makeUserSession } from "./helpers/auth-session.js";
-
-// ─── Unauthenticated → 401 ───────────────────────────────────────────────────
-
-test("GET /api/wiki/content without cookie → 401", async () => {
-	const req = new Request("http://localhost:3000/api/wiki/content?path=auth-test.md");
-	const res = await wikiContentGET(req);
-	assert.equal(res.status, 401);
-});
-
-test("POST /api/wiki/upload without cookie → 401", async () => {
-	const formData = new FormData();
-	formData.append("file", new Blob(["hello"], { type: "text/plain" }), "test.txt");
-	formData.append("path", "test.txt");
-	const req = new Request("http://localhost:3000/api/wiki/upload", {
-		method: "POST",
-		body: formData,
-	});
-	const res = await wikiUploadPOST(req);
-	assert.equal(res.status, 401);
-});
-
-test("POST /api/wiki/move without cookie → 401", async () => {
-	const req = new Request("http://localhost:3000/api/wiki/move", {
-		method: "POST",
-		headers: { "Content-Type": "application/json" },
-		body: JSON.stringify({ from: "auth-test.md", to: "renamed.md" }),
-	});
-	const res = await wikiMovePOST(req);
-	assert.equal(res.status, 401);
-});
-
-test("DELETE /api/wiki without cookie → 401", async () => {
-	const req = new Request("http://localhost:3000/api/wiki?path=auth-test.md", {
-		method: "DELETE",
-	});
-	const res = await wikiRootDELETE(req);
-	assert.equal(res.status, 401);
-});
-
-// ─── CSRF origin checks ───────────────────────────────────────────────────────
-
-test("POST /api/wiki/move with valid session + bad origin → 403", async () => {
-	const cookie = await makeUserSession();
-	const req = new Request("http://localhost:3000/api/wiki/move", {
-		method: "POST",
-		headers: {
-			"Content-Type": "application/json",
-			Cookie: cookie,
-			Origin: "https://evil.com",
-		},
-		body: JSON.stringify({ from: "auth-test.md", to: "hacked.md" }),
-	});
-	const res = await wikiMovePOST(req);
-	assert.equal(res.status, 403);
-});
-
-test("POST /api/wiki/move with valid session + matching origin → not 403/401", async () => {
-	const cookie = await makeUserSession();
-	const req = new Request("http://localhost:3000/api/wiki/move", {
-		method: "POST",
-		headers: {
-			"Content-Type": "application/json",
-			Cookie: cookie,
-			Origin: "http://localhost:3000",
-		},
-		body: JSON.stringify({ from: "nonexistent-file.md", to: "also-nonexistent.md" }),
-	});
-	const res = await wikiMovePOST(req);
-	// CSRF and auth passed — will fail at file-system level (404 or 400), not 403/401
-	assert.notEqual(res.status, 403);
-	assert.notEqual(res.status, 401);
-});
-
-// ─── baseRevision enforcement ─────────────────────────────────────────────────
-
-test("PUT /api/wiki/content markdown + no baseRevision → 400 BASE_REVISION_REQUIRED", async () => {
-	const cookie = await makeUserSession();
-	const req = new Request("http://localhost:3000/api/wiki/content", {
-		method: "PUT",
-		headers: { "Content-Type": "application/json", Cookie: cookie },
-		body: JSON.stringify({ path: "auth-test.md", content: "# Updated\n" }),
-	});
-	const res = await wikiContentPUT(req);
-	assert.equal(res.status, 400);
-	const body = (await res.json()) as { error: string };
-	assert.equal(body.error, "BASE_REVISION_REQUIRED");
-});
-
-test("PUT /api/wiki/content markdown + stale baseRevision → 409 STALE_REVISION", async () => {
-	const cookie = await makeUserSession();
-
-	// First: do a valid save to bump the revision to 1
-	const r1 = await wikiContentPUT(
-		new Request("http://localhost:3000/api/wiki/content", {
-			method: "PUT",
-			headers: { "Content-Type": "application/json", Cookie: cookie },
-			body: JSON.stringify({ path: "stale.md", content: "# v1\n", baseRevision: 0 }),
-		}),
-	);
-	assert.equal(r1.status, 200);
-
-	// Now try with stale baseRevision 0 again
-	const r2 = await wikiContentPUT(
-		new Request("http://localhost:3000/api/wiki/content", {
-			method: "PUT",
-			headers: { "Content-Type": "application/json", Cookie: cookie },
-			body: JSON.stringify({ path: "stale.md", content: "# v2\n", baseRevision: 0 }),
-		}),
-	);
-	assert.equal(r2.status, 409);
-	const body = (await r2.json()) as { error: string; currentRevision: number };
-	assert.equal(body.error, "STALE_REVISION");
-	assert.equal(body.currentRevision, 1);
-});
-
-test("PUT /api/wiki/content markdown happy path → 200", async () => {
-	const cookie = await makeUserSession();
-	const req = new Request("http://localhost:3000/api/wiki/content", {
-		method: "PUT",
-		headers: { "Content-Type": "application/json", Cookie: cookie },
-		body: JSON.stringify({ path: "happy.md", content: "# Updated\n", baseRevision: 0 }),
-	});
-	const res = await wikiContentPUT(req);
-	assert.equal(res.status, 200);
-	const data = (await res.json()) as { ok: boolean; revision: number };
-	assert.equal(data.ok, true);
-	assert.equal(data.revision, 1);
-});
-
-// ─── Response headers ─────────────────────────────────────────────────────────
-
-test("GET /api/wiki/content markdown with auth → X-Wiki-Revision + X-Wiki-Fingerprint", async () => {
-	const cookie = await makeUserSession();
-
-	// First write to ensure sidecar exists with revision 1
-	await wikiContentPUT(
-		new Request("http://localhost:3000/api/wiki/content", {
-			method: "PUT",
-			headers: { "Content-Type": "application/json", Cookie: cookie },
-			body: JSON.stringify({ path: "rev-check.md", content: "# Rev v1\n", baseRevision: 0 }),
-		}),
-	);
-
-	const getReq = new Request(
-		"http://localhost:3000/api/wiki/content?path=rev-check.md",
-		{ headers: { Cookie: cookie } },
-	);
-	const res = await wikiContentGET(getReq);
-	assert.equal(res.status, 200);
-
-	const revision = res.headers.get("X-Wiki-Revision");
-	const fingerprint = res.headers.get("X-Wiki-Fingerprint");
-	assert.ok(revision !== null, "X-Wiki-Revision header missing");
-	assert.ok(fingerprint !== null, "X-Wiki-Fingerprint header missing");
-	assert.equal(revision, "1");
-	assert.ok(fingerprint.startsWith("sha256:"), "fingerprint should be sha256:...");
-});