wiki-viewer 1.4.2 → 1.5.0

package/.next/standalone/src/app/signin/page.tsx

@@ -1,231 +1,16 @@
-"use client";
+import SignInForm from "./signin-form";
+import { passwordAuthEnabled } from "@/lib/auth/server";
 
-import { useState, useEffect, type FormEvent } from "react";
-import { authClient } from "@/lib/auth/client";
+// Server component: resolve the available auth methods at render time so the
+// initial HTML already reflects the configuration. This prevents the password
+// form from flashing on load when it is disabled (AUTH_DISABLE_PASSWORD=1).
+export const dynamic = "force-dynamic";
 
 export default function SignInPage() {
-	const [mode, setMode] = useState<"signin" | "signup">("signin");
-	const [email, setEmail] = useState("");
-	const [password, setPassword] = useState("");
-	const [name, setName] = useState("");
-	const [error, setError] = useState<string | null>(null);
-	const [loading, setLoading] = useState(false);
-	const [hasGoogle, setHasGoogle] = useState(false);
-	const [passwordAuth, setPasswordAuth] = useState(true);
-	const [callbackURL, setCallbackURL] = useState("/");
-
-	useEffect(() => {
-		// Learn which auth methods to show. Public endpoint, no session needed.
-		fetch("/api/system/auth-config", { credentials: "include" })
-			.then((r) => r.json())
-			.then((data: unknown) => {
-				if (data && typeof data === "object") {
-					const cfg = data as { google?: boolean; passwordAuth?: boolean };
-					setHasGoogle(Boolean(cfg.google));
-					// Default to showing the password form unless told otherwise, so a
-					// failed fetch never leaves the user with no way to sign in.
-					setPasswordAuth(cfg.passwordAuth !== false);
-				}
-			})
-			.catch(() => {});
-
-		// Honour ?next= redirect param
-		const params = new URLSearchParams(window.location.search);
-		const next = params.get("next");
-		if (next && next.startsWith("/")) setCallbackURL(next);
-	}, []);
-
-	async function handleSubmit(e: FormEvent) {
-		e.preventDefault();
-		setError(null);
-		setLoading(true);
-		try {
-			if (mode === "signup") {
-				const res = await authClient.signUp.email({
-					email,
-					password,
-					name,
-					callbackURL,
-				});
-				if (res.error) {
-					setError(res.error.message ?? "Sign-up failed");
-				} else {
-					window.location.href = callbackURL;
-				}
-			} else {
-				const res = await authClient.signIn.email({
-					email,
-					password,
-					callbackURL,
-				});
-				if (res.error) {
-					const status = res.error.status;
-					if (status === 429) {
-						setError("Too many sign-in attempts. Wait a minute and try again.");
-					} else {
-						setError(res.error.message ?? "Sign-in failed");
-					}
-				} else {
-					window.location.href = callbackURL;
-				}
-			}
-		} catch (err: unknown) {
-			setError(err instanceof Error ? err.message : "Unexpected error");
-		} finally {
-			setLoading(false);
-		}
-	}
-
-	async function handleGoogle() {
-		setError(null);
-		setLoading(true);
-		try {
-			await authClient.signIn.social({ provider: "google", callbackURL });
-		} catch (err: unknown) {
-			setError(err instanceof Error ? err.message : "Google sign-in failed");
-			setLoading(false);
-		}
-	}
-
+	const google = Boolean(
+		process.env.GOOGLE_CLIENT_ID && process.env.GOOGLE_CLIENT_SECRET,
+	);
 	return (
-		<div className="min-h-screen flex items-center justify-center bg-background">
-			<div className="w-full max-w-sm rounded-lg border border-border bg-card p-8 shadow-sm">
-				<h1 className="mb-6 text-xl font-semibold text-foreground">Sign in to wiki-viewer</h1>
-
-				{hasGoogle && (
-					<>
-						<button
-							type="button"
-							onClick={handleGoogle}
-							disabled={loading}
-							className="flex w-full items-center justify-center gap-2 rounded-md border border-border px-4 py-2 text-sm font-medium hover:bg-accent disabled:opacity-50"
-						>
-							<svg viewBox="0 0 24 24" className="h-4 w-4" aria-hidden="true">
-								<path
-									fill="#4285F4"
-									d="M22.56 12.25c0-.78-.07-1.53-.2-2.25H12v4.26h5.92c-.26 1.37-1.04 2.53-2.21 3.31v2.77h3.57c2.08-1.92 3.28-4.74 3.28-8.09z"
-								/>
-								<path
-									fill="#34A853"
-									d="M12 23c2.97 0 5.46-.98 7.28-2.66l-3.57-2.77c-.98.66-2.23 1.06-3.71 1.06-2.86 0-5.29-1.93-6.16-4.53H2.18v2.84C3.99 20.53 7.7 23 12 23z"
-								/>
-								<path
-									fill="#FBBC05"
-									d="M5.84 14.09c-.22-.66-.35-1.36-.35-2.09s.13-1.43.35-2.09V7.07H2.18C1.43 8.55 1 10.22 1 12s.43 3.45 1.18 4.93l3.66-2.84z"
-								/>
-								<path
-									fill="#EA4335"
-									d="M12 5.38c1.62 0 3.06.56 4.21 1.64l3.15-3.15C17.45 2.09 14.97 1 12 1 7.7 1 3.99 3.47 2.18 7.07l3.66 2.84c.87-2.6 3.3-4.53 6.16-4.53z"
-								/>
-							</svg>
-							Continue with Google
-						</button>
-						{passwordAuth && (
-							<div className="my-4 flex items-center gap-3">
-								<hr className="flex-1 border-border" />
-								<span className="text-xs text-muted-foreground">or</span>
-								<hr className="flex-1 border-border" />
-							</div>
-						)}
-					</>
-				)}
-
-				{!passwordAuth && !hasGoogle && (
-					<p className="rounded-md bg-destructive/10 px-3 py-2 text-sm text-destructive">
-						No sign-in method is configured. Set GOOGLE_CLIENT_ID and
-						GOOGLE_CLIENT_SECRET, or enable email/password auth.
-					</p>
-				)}
-
-				{passwordAuth && (
-				<form onSubmit={handleSubmit} className="space-y-4">
-					{mode === "signup" && (
-						<div>
-							<label className="mb-1 block text-sm font-medium text-foreground" htmlFor="name">
-								Name
-							</label>
-							<input
-								id="name"
-								type="text"
-								autoComplete="name"
-								value={name}
-								onChange={(e) => setName(e.target.value)}
-								required
-								className="w-full rounded-md border border-border bg-background px-3 py-2 text-sm focus:outline-none focus:ring-2 focus:ring-ring"
-							/>
-						</div>
-					)}
-					<div>
-						<label className="mb-1 block text-sm font-medium text-foreground" htmlFor="email">
-							Email
-						</label>
-						<input
-							id="email"
-							type="email"
-							autoComplete="email"
-							value={email}
-							onChange={(e) => setEmail(e.target.value)}
-							required
-							className="w-full rounded-md border border-border bg-background px-3 py-2 text-sm focus:outline-none focus:ring-2 focus:ring-ring"
-						/>
-					</div>
-					<div>
-						<label
-							className="mb-1 block text-sm font-medium text-foreground"
-							htmlFor="password"
-						>
-							Password
-						</label>
-						<input
-							id="password"
-							type="password"
-							autoComplete={mode === "signup" ? "new-password" : "current-password"}
-							value={password}
-							onChange={(e) => setPassword(e.target.value)}
-							required
-							minLength={8}
-							className="w-full rounded-md border border-border bg-background px-3 py-2 text-sm focus:outline-none focus:ring-2 focus:ring-ring"
-						/>
-					</div>
-
-					{error && (
-						<p className="rounded-md bg-destructive/10 px-3 py-2 text-sm text-destructive">
-							{error}
-						</p>
-					)}
-
-					<button
-						type="submit"
-						disabled={loading}
-						className="w-full rounded-md bg-primary px-4 py-2 text-sm font-medium text-primary-foreground hover:bg-primary/90 disabled:opacity-50"
-					>
-						{loading
-							? mode === "signup"
-								? "Creating account..."
-								: "Signing in..."
-							: mode === "signup"
-								? "Create account"
-								: "Sign in"}
-					</button>
-				</form>
-				)}
-
-				{passwordAuth && (
-				<p className="mt-4 text-center text-sm text-muted-foreground">
-					{mode === "signin" ? "No account?" : "Already have an account?"}{" "}
-					<button
-						type="button"
-						onClick={() => {
-							setMode(mode === "signin" ? "signup" : "signin");
-							setError(null);
-						}}
-						className="font-medium text-foreground underline-offset-4 hover:underline"
-					>
-						{mode === "signin" ? "Sign up" : "Sign in"}
-					</button>
-				</p>
-				)}
-			</div>
-		</div>
+		<SignInForm initialPasswordAuth={passwordAuthEnabled} initialGoogle={google} />
 	);
 }

package/.next/standalone/src/app/signin/signin-form.tsx

@@ -0,0 +1,238 @@
+"use client";
+
+import { useState, useEffect, type FormEvent } from "react";
+import { authClient } from "@/lib/auth/client";
+
+export default function SignInForm({
+	initialPasswordAuth,
+	initialGoogle,
+}: {
+	initialPasswordAuth: boolean;
+	initialGoogle: boolean;
+}) {
+	const [mode, setMode] = useState<"signin" | "signup">("signin");
+	const [email, setEmail] = useState("");
+	const [password, setPassword] = useState("");
+	const [name, setName] = useState("");
+	const [error, setError] = useState<string | null>(null);
+	const [loading, setLoading] = useState(false);
+	// Seed from server-rendered values so the first paint already matches the
+	// configured auth methods. This avoids a flash of the password form when it
+	// is disabled. The fetch below only refreshes in case config changed.
+	const [hasGoogle, setHasGoogle] = useState(initialGoogle);
+	const [passwordAuth, setPasswordAuth] = useState(initialPasswordAuth);
+	const [callbackURL, setCallbackURL] = useState("/");
+
+	useEffect(() => {
+		// Refresh which auth methods to show. Public endpoint, no session needed.
+		fetch("/api/system/auth-config", { credentials: "include" })
+			.then((r) => r.json())
+			.then((data: unknown) => {
+				if (data && typeof data === "object") {
+					const cfg = data as { google?: boolean; passwordAuth?: boolean };
+					setHasGoogle(Boolean(cfg.google));
+					setPasswordAuth(cfg.passwordAuth !== false);
+				}
+			})
+			.catch(() => {});
+
+		// Honour ?next= redirect param
+		const params = new URLSearchParams(window.location.search);
+		const next = params.get("next");
+		if (next && next.startsWith("/")) setCallbackURL(next);
+	}, []);
+
+	async function handleSubmit(e: FormEvent) {
+		e.preventDefault();
+		setError(null);
+		setLoading(true);
+		try {
+			if (mode === "signup") {
+				const res = await authClient.signUp.email({
+					email,
+					password,
+					name,
+					callbackURL,
+				});
+				if (res.error) {
+					setError(res.error.message ?? "Sign-up failed");
+				} else {
+					window.location.href = callbackURL;
+				}
+			} else {
+				const res = await authClient.signIn.email({
+					email,
+					password,
+					callbackURL,
+				});
+				if (res.error) {
+					const status = res.error.status;
+					if (status === 429) {
+						setError("Too many sign-in attempts. Wait a minute and try again.");
+					} else {
+						setError(res.error.message ?? "Sign-in failed");
+					}
+				} else {
+					window.location.href = callbackURL;
+				}
+			}
+		} catch (err: unknown) {
+			setError(err instanceof Error ? err.message : "Unexpected error");
+		} finally {
+			setLoading(false);
+		}
+	}
+
+	async function handleGoogle() {
+		setError(null);
+		setLoading(true);
+		try {
+			await authClient.signIn.social({ provider: "google", callbackURL });
+		} catch (err: unknown) {
+			setError(err instanceof Error ? err.message : "Google sign-in failed");
+			setLoading(false);
+		}
+	}
+
+	return (
+		<div className="min-h-screen flex items-center justify-center bg-background">
+			<div className="w-full max-w-sm rounded-lg border border-border bg-card p-8 shadow-sm">
+				<h1 className="mb-6 text-xl font-semibold text-foreground">Sign in to wiki-viewer</h1>
+
+				{hasGoogle && (
+					<>
+						<button
+							type="button"
+							onClick={handleGoogle}
+							disabled={loading}
+							className="flex w-full items-center justify-center gap-2 rounded-md border border-border px-4 py-2 text-sm font-medium hover:bg-accent disabled:opacity-50"
+						>
+							<svg viewBox="0 0 24 24" className="h-4 w-4" aria-hidden="true">
+								<path
+									fill="#4285F4"
+									d="M22.56 12.25c0-.78-.07-1.53-.2-2.25H12v4.26h5.92c-.26 1.37-1.04 2.53-2.21 3.31v2.77h3.57c2.08-1.92 3.28-4.74 3.28-8.09z"
+								/>
+								<path
+									fill="#34A853"
+									d="M12 23c2.97 0 5.46-.98 7.28-2.66l-3.57-2.77c-.98.66-2.23 1.06-3.71 1.06-2.86 0-5.29-1.93-6.16-4.53H2.18v2.84C3.99 20.53 7.7 23 12 23z"
+								/>
+								<path
+									fill="#FBBC05"
+									d="M5.84 14.09c-.22-.66-.35-1.36-.35-2.09s.13-1.43.35-2.09V7.07H2.18C1.43 8.55 1 10.22 1 12s.43 3.45 1.18 4.93l3.66-2.84z"
+								/>
+								<path
+									fill="#EA4335"
+									d="M12 5.38c1.62 0 3.06.56 4.21 1.64l3.15-3.15C17.45 2.09 14.97 1 12 1 7.7 1 3.99 3.47 2.18 7.07l3.66 2.84c.87-2.6 3.3-4.53 6.16-4.53z"
+								/>
+							</svg>
+							Continue with Google
+						</button>
+						{passwordAuth && (
+							<div className="my-4 flex items-center gap-3">
+								<hr className="flex-1 border-border" />
+								<span className="text-xs text-muted-foreground">or</span>
+								<hr className="flex-1 border-border" />
+							</div>
+						)}
+					</>
+				)}
+
+				{!passwordAuth && !hasGoogle && (
+					<p className="rounded-md bg-destructive/10 px-3 py-2 text-sm text-destructive">
+						No sign-in method is configured. Set GOOGLE_CLIENT_ID and
+						GOOGLE_CLIENT_SECRET, or enable email/password auth.
+					</p>
+				)}
+
+				{passwordAuth && (
+				<form onSubmit={handleSubmit} className="space-y-4">
+					{mode === "signup" && (
+						<div>
+							<label className="mb-1 block text-sm font-medium text-foreground" htmlFor="name">
+								Name
+							</label>
+							<input
+								id="name"
+								type="text"
+								autoComplete="name"
+								value={name}
+								onChange={(e) => setName(e.target.value)}
+								required
+								className="w-full rounded-md border border-border bg-background px-3 py-2 text-sm focus:outline-none focus:ring-2 focus:ring-ring"
+							/>
+						</div>
+					)}
+					<div>
+						<label className="mb-1 block text-sm font-medium text-foreground" htmlFor="email">
+							Email
+						</label>
+						<input
+							id="email"
+							type="email"
+							autoComplete="email"
+							value={email}
+							onChange={(e) => setEmail(e.target.value)}
+							required
+							className="w-full rounded-md border border-border bg-background px-3 py-2 text-sm focus:outline-none focus:ring-2 focus:ring-ring"
+						/>
+					</div>
+					<div>
+						<label
+							className="mb-1 block text-sm font-medium text-foreground"
+							htmlFor="password"
+						>
+							Password
+						</label>
+						<input
+							id="password"
+							type="password"
+							autoComplete={mode === "signup" ? "new-password" : "current-password"}
+							value={password}
+							onChange={(e) => setPassword(e.target.value)}
+							required
+							minLength={8}
+							className="w-full rounded-md border border-border bg-background px-3 py-2 text-sm focus:outline-none focus:ring-2 focus:ring-ring"
+						/>
+					</div>
+
+					{error && (
+						<p className="rounded-md bg-destructive/10 px-3 py-2 text-sm text-destructive">
+							{error}
+						</p>
+					)}
+
+					<button
+						type="submit"
+						disabled={loading}
+						className="w-full rounded-md bg-primary px-4 py-2 text-sm font-medium text-primary-foreground hover:bg-primary/90 disabled:opacity-50"
+					>
+						{loading
+							? mode === "signup"
+								? "Creating account..."
+								: "Signing in..."
+							: mode === "signup"
+								? "Create account"
+								: "Sign in"}
+					</button>
+				</form>
+				)}
+
+				{passwordAuth && (
+				<p className="mt-4 text-center text-sm text-muted-foreground">
+					{mode === "signin" ? "No account?" : "Already have an account?"}{" "}
+					<button
+						type="button"
+						onClick={() => {
+							setMode(mode === "signin" ? "signup" : "signin");
+							setError(null);
+						}}
+						className="font-medium text-foreground underline-offset-4 hover:underline"
+					>
+						{mode === "signin" ? "Sign up" : "Sign in"}
+					</button>
+				</p>
+				)}
+			</div>
+		</div>
+	);
+}

package/.next/standalone/src/components/ai-panel/ai-panel.tsx

@@ -68,8 +68,36 @@ export function AIPanel({ currentPath }: { currentPath?: string | null }) {
 		() => bootstrapPrompt.replace(/\$WIKI_URL/g, origin),
 		[bootstrapPrompt, origin]
 	);
+	const getMcpRegister = useCallback(
+		() =>
+			`npx wiki-viewer-mcp register --url ${origin} --id ai:myagent --name "My Agent"`,
+		[origin]
+	);
+	const getMcpJson = useCallback(
+		() =>
+			JSON.stringify(
+				{
+					servers: {
+						"wiki-viewer": {
+							command: "npx",
+							args: ["wiki-viewer-mcp"],
+							env: {
+								WIKI_VIEWER_URL: origin,
+								WIKI_VIEWER_TOKEN: "<token from register>",
+								WIKI_VIEWER_AGENT_ID: "ai:myagent",
+							},
+						},
+					},
+				},
+				null,
+				2
+			),
+		[origin]
+	);
 	const skillCli = useCopyButton(getSkillCli);
 	const bootstrapCopy = useCopyButton(getBootstrapPrompt);
+	const mcpRegister = useCopyButton(getMcpRegister);
+	const mcpJson = useCopyButton(getMcpJson);
 
 	// Keyboard: Esc closes
 	useEffect(() => {
@@ -182,6 +210,27 @@ export function AIPanel({ currentPath }: { currentPath?: string | null }) {
 							Install for AI Agents
 						</h3>
 						<div className="rounded-md border border-border bg-muted/40 p-3 space-y-3">
+							<div className="space-y-1">
+								<p className="text-[10px] text-muted-foreground/70">
+									MCP server <span className="text-muted-foreground/50">(Claude Code, Cursor, Codex):</span>
+								</p>
+								<p className="text-[10px] text-muted-foreground/50">1. Register &amp; get a token:</p>
+								<div className="flex items-center gap-2">
+									<code className="flex-1 text-[10px] font-mono text-foreground/80 truncate bg-muted rounded px-1 py-0.5">
+										{getMcpRegister()}
+									</code>
+									<Button size="sm" variant="ghost" className="h-6 w-6 p-0 shrink-0" title="Copy register command" onClick={() => void mcpRegister.copy()}>
+										{mcpRegister.copied ? <Check className="h-3.5 w-3.5 text-green-500" /> : <Copy className="h-3.5 w-3.5" />}
+									</Button>
+								</div>
+								<p className="text-[10px] text-muted-foreground/50 pt-1">2. Approve below, then add to your <code className="bg-muted px-0.5 rounded">mcp.json</code>:</p>
+								<Button size="sm" variant="outline" className="h-7 w-full text-xs gap-1.5" onClick={() => void mcpJson.copy()}>
+									{mcpJson.copied
+										? <><Check className="h-3.5 w-3.5 text-green-500" /> Copied!</>
+										: <><Copy className="h-3.5 w-3.5" /> Copy mcp.json</>}
+								</Button>
+							</div>
+							<div className="h-px bg-border/60" />
 							<div className="space-y-1">
 								<p className="text-[10px] text-muted-foreground/70">Agent Skills standard:</p>
 								<div className="flex items-center gap-2">

package/.next/standalone/src/components/editor/editor.tsx

@@ -184,6 +184,44 @@ export function KBEditor() {
 		void useProofStore.getState().loadSidecar(currentPath);
 	}, [currentPath]);
 
+	// Human edit-lease heartbeat: tell the server a human has this markdown doc
+	// open so computeCollabState() reports "active" even before the first
+	// suggestion/comment. This is what makes raw-fs writes from agents defer to
+	// the collaborative (Tier-2) path while a human is editing. Only markdown
+	// files participate in the collab-state machine.
+	useEffect(() => {
+		if (typeof window === "undefined") return;
+		if (!currentPath) return;
+		if (!/\.(md|markdown)$/i.test(currentPath)) return;
+
+		const path = currentPath;
+		const ping = (action: "open" | "heartbeat" | "close") => {
+			// keepalive lets the "close" beacon survive page unload.
+			void fetch("/api/wiki/presence", {
+				method: "POST",
+				headers: { "Content-Type": "application/json" },
+				body: JSON.stringify({ path, action }),
+				keepalive: action === "close",
+			}).catch(() => {
+				/* presence is best-effort; ignore failures */
+			});
+		};
+
+		ping("open");
+		// Refresh well within the 90s server lease TTL.
+		const id = setInterval(() => ping("heartbeat"), 30_000);
+		const onHidden = () => {
+			if (document.visibilityState === "hidden") ping("heartbeat");
+		};
+		document.addEventListener("visibilitychange", onHidden);
+
+		return () => {
+			clearInterval(id);
+			document.removeEventListener("visibilitychange", onHidden);
+			ping("close");
+		};
+	}, [currentPath]);
+
 	// Subscribe to chokidar SSE: when current file changes on disk, reload sidecar.
 	useEffect(() => {
 		if (typeof window === "undefined") return;

package/.next/standalone/src/lib/proof/audit.ts

@@ -0,0 +1,79 @@
+/**
+ * Minimal durable audit log for raw-fs mutations (Tier 1).
+ *
+ * Uses the same ~/.wiki-viewer/auth.db already opened by better-auth.
+ * Table: agent_fs_audit
+ *
+ * For .md files the sidecar event covers provenance; this covers ALL types.
+ */
+import Database from "better-sqlite3";
+import path from "node:path";
+import os from "node:os";
+import { mkdirSync } from "node:fs";
+
+function dataDir(): string {
+	return path.join(process.env.HOME ?? os.homedir(), ".wiki-viewer");
+}
+
+// Lazily initialised so tests can set HOME before first import.
+let _db: InstanceType<typeof Database> | null = null;
+
+function getDb(): InstanceType<typeof Database> {
+	if (_db) return _db;
+	const dir = dataDir();
+	mkdirSync(dir, { recursive: true });
+	const dbPath = path.join(dir, "auth.db");
+	_db = new Database(dbPath);
+	_db.pragma("journal_mode = WAL");
+	_db.exec(`
+		CREATE TABLE IF NOT EXISTS agent_fs_audit (
+			id      INTEGER PRIMARY KEY AUTOINCREMENT,
+			agent_id TEXT NOT NULL,
+			op      TEXT NOT NULL,
+			path    TEXT NOT NULL,
+			old_sha TEXT,
+			new_sha TEXT,
+			forced  INTEGER NOT NULL DEFAULT 0,
+			at      TEXT NOT NULL
+		)
+	`);
+	return _db;
+}
+
+export interface AuditRow {
+	agentId: string;
+	op: string;
+	path: string;
+	oldSha?: string;
+	newSha?: string;
+	forced?: boolean;
+}
+
+/**
+ * Write one audit row synchronously (SQLite sync is fine here — it's a WAL journal append).
+ * Fire-and-forget: never throws; logs to stderr on error.
+ */
+export function writeAuditRow(row: AuditRow): void {
+	try {
+		const db = getDb();
+		db.prepare(
+			`INSERT INTO agent_fs_audit (agent_id, op, path, old_sha, new_sha, forced, at)
+			 VALUES (?, ?, ?, ?, ?, ?, ?)`,
+		).run(
+			row.agentId,
+			row.op,
+			row.path,
+			row.oldSha ?? null,
+			row.newSha ?? null,
+			row.forced ? 1 : 0,
+			new Date().toISOString(),
+		);
+	} catch (e) {
+		console.error("[agent-fs audit] write failed:", e);
+	}
+}
+
+/** Reset cached DB handle (used by tests to pick up new HOME). */
+export function _resetAuditDb(): void {
+	_db = null;
+}

package/.next/standalone/src/lib/proof/auth.ts

@@ -34,7 +34,7 @@ export async function checkAuth(req: Request): Promise<CheckAuthResult> {
 				id: `user:${u.id}`,
 				displayName: u.name,
 				tokenHash: "",
-				scope: { paths: ["**/*"], ops: ["read", "mutate"] },
+				scope: { paths: ["**/*"], ops: ["read", "mutate", "delete"] },
 				createdAt: "",
 				lastSeen: "",
 			},
@@ -71,7 +71,7 @@ export async function checkAuth(req: Request): Promise<CheckAuthResult> {
 
 export interface ScopeParams {
 	filePath?: string;
-	op: "read" | "mutate";
+	op: "read" | "mutate" | "delete";
 }
 
 export function enforceScope(