@rigxyz/tapd 0.6.5 → 0.6.7

package/dist/index.d.ts

@@ -9,19 +9,28 @@ import { GetBindingResponse, PrepareUploadRequest, PrepareUploadResponse, Comple
  *      bulky generated artifacts (per design doc § "Large File Policy").
  *      Bulky media/archives are re-included under the top-level
  *      `attachments/` folder (chat attachments must sync).
- *      A user CAN override these via `!pattern` in their .tapignore.
+ *      A user CAN override the non-secret ones (dependencies, media, …)
+ *      via `!pattern` in their .tapignore.
  *   2. Project .tapignore.
- *   3. Always-excluded paths — Tap's own local metadata. These cannot be
- *      re-enabled by `!pattern`; the relay would reject the upload anyway
- *      (validateRigPath rejects reserved paths).
+ *   3. Secrets + conflict sidecars (NON_OVERRIDABLE_IGNORE_LINES), added
+ *      again after the project file. The .tapignore itself syncs from
+ *      other members, so a `!.env` there would otherwise make every
+ *      member's daemon upload their own .env.
+ *   4. Always-excluded paths — Tap's own local metadata, plus the paths
+ *      that never sync between members (core isNeverSyncPath: .git,
+ *      agent/MCP config). Matched case-insensitively, never re-enabled by
+ *      `!pattern`; the relay refuses them anyway (validateRigPath rejects
+ *      reserved paths, the change route refuses never-sync ones).
  */
 
 declare const BUILTIN_IGNORE_LINES: ReadonlyArray<string>;
 declare function loadIgnore(rootDir: string): Ignore;
 /**
  * Hard-exclude check that runs in addition to .tapignore. Tap's own
- * local metadata is invisible to sync no matter what the user puts in
- * their .tapignore — including `!pattern` overrides.
+ * local metadata and the never-sync paths (.git, agent/MCP config) are
+ * invisible to sync no matter what the user puts in their .tapignore —
+ * including `!pattern` overrides. Case-insensitive: on APFS `.RIG/` is
+ * `.rig/`.
  */
 declare function isAlwaysExcluded(posixPath: string): boolean;
 
@@ -287,6 +296,10 @@ declare function hashFile(absPath: string): Promise<string>;
  *   7. Populate .rig/tap/state.local.db with last_applied_change_id
  *      per path, and the resulting cursor.
  *
+ * `deferUpload` stops after step 3a (plus an empty state DB): the binding
+ * exists and the config is on disk, and the daemon's first scan uploads
+ * everything (`tapd start` pushes whatever the relay doesn't know yet).
+ *
  * Returns a summary with the binding, the owner token (so the caller
  * CLI can print it once), upload + change counts, and any walker
  * warnings (oversized files / symlinks / invalid paths). Caller is
@@ -302,6 +315,15 @@ type InitOptions = {
     deviceLabel?: string;
     /** Org slug to scope the new binding to. Caller must already be a member. */
     org?: string;
+    /** Create the binding as this kind (the relay defaults to `'rig'`). */
+    kind?: "rig" | "space";
+    /**
+     * Create the binding and write the local config, but leave the initial
+     * upload to the daemon's first scan (`tapd start` pushes every file the
+     * relay doesn't know yet). For a brand-new folder that should be usable
+     * the moment its binding exists — a new space in the desktop app.
+     */
+    deferUpload?: boolean;
     /** Test seam: override fetch (used to drive the in-process relay). */
     fetch?: typeof fetch;
 };
@@ -316,6 +338,8 @@ type InitResult = {
     warnings: WalkResult["warnings"];
     /** Cursor written to state.local.db after the initial submit. */
     cursor: string;
+    /** True when the upload was left to the daemon's first scan (`deferUpload`). */
+    deferredUpload: boolean;
 };
 declare class AlreadyInitializedError extends Error {
     readonly path: string;
@@ -428,6 +452,11 @@ declare function revoke(opts: {
  * Materialization is atomic: download to `<file>.tap-tmp.<rand>` then
  * `rename` into place. Atomic on POSIX; on Windows, `fs.rename` falls
  * back to MoveFileEx-style replace.
+ *
+ * Files from other members are treated like downloads: never executable
+ * (the event's `executable` bit is ignored), quarantined on macOS so
+ * Gatekeeper checks them before they run, and never-sync paths (.git,
+ * agent/MCP config — core isNeverSyncPath) are not applied at all.
  */
 
 /** State-DB meta key — running count of conflicts surfaced by `tapd status`. */
@@ -557,8 +586,11 @@ type IntentAssignment = {
 
 type NotSyncedFile = {
     path: string;
-    reason: "quota_exceeded" | "file_too_large";
-    /** Hash of the refused bytes; absent for walker-level oversize skips. */
+    reason: "quota_exceeded" | "file_too_large" | "owner_only" | "protected";
+    /**
+     * Hash of the refused bytes; absent for walker-level oversize skips and
+     * for refused deletes/mkdirs/rmdirs.
+     */
     hash?: string;
     size?: number;
     /** The space's byte limit, for quota_exceeded. */

package/dist/index.js

@@ -46,7 +46,7 @@ import {
   walk,
   writeBindingConfig,
   writeImportMount
-} from "./chunk-7RKYNS5V.js";
+} from "./chunk-32K6ANXS.js";
 export {
   AlreadyInitializedError,
   AlreadyJoinedError,

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@rigxyz/tapd",
-  "version": "0.6.5",
+  "version": "0.6.7",
   "description": "Local daemon for the hosted Tap relay — watches files, hashes content, uploads/downloads objects, applies remote changes. Pairs with @rigxyz/cli for shared-rig sync.",
   "license": "MIT",
   "author": "Dylan Bourgeois <dtsbourg@gmail.com>",