@tokenbuddy/tb-admin 1.0.35 → 1.0.37

package/dist/src/cli.js

@@ -4,6 +4,8 @@ import { AdminClient } from "./client.js";
 import { FlyProvider } from "./server-cmd.js";
 import { SellerCommandRunner } from "./seller.js";
 import { bindAdminUiCommand } from "./ui-command.js";
+import { formatAdminInitResult, formatWorkdirDoctorResult, runAdminInitCommand, runWorkdirDoctor } from "./init-command.js";
+import { resolveAdminWorkdir } from "./workdir.js";
 import { loadRegistryFile, validateRegistryDocument } from "./bootstrap-registry.js";
 import Table from "cli-table3";
 import * as fs from "fs";
@@ -200,13 +202,91 @@ export function buildAdminCli(configManager) {
         .option("--url <url>", "Remote seller core API url")
         .option("--token <token>", "Operator Bearer token")
         .option("--profile <profile>", "Use custom profile instead of default")
-        .option("--config <path>", "Use custom config file path");
+        .option("--config <path>", "Use custom config file path")
+        .option("--workdir <path>", "Admin workdir path (default: $TB_ADMIN_WORKDIR or ~/.config/tokenbuddy)");
     bindAdminUiCommand(program, configManager);
+    function getRootConfigManager() {
+        const opts = program.opts();
+        if (opts.config || opts.workdir) {
+            return new ConfigManager(opts.config, { cliWorkdir: opts.workdir });
+        }
+        return configManager;
+    }
+    program
+        .command("init")
+        .description("Initialize an admin workdir for provider-specific deployment assets")
+        .option("--provider <provider>", "Deployment provider (default: fly.io)", "fly.io")
+        .option("--workdir <path>", "Admin workdir path (default: root --workdir, $TB_ADMIN_WORKDIR, or ~/.config/tokenbuddy)")
+        .option("--check-only", "Only check provider requirements; do not write files")
+        .option("--force", "Refresh regenerable templates without overwriting runtime secret files")
+        .option("--install-tools", "Install missing provider CLI tools when supported")
+        .option("--json", "Output structured JSON")
+        .action((options) => {
+        try {
+            const rootOptions = program.opts();
+            const result = runAdminInitCommand({
+                provider: options.provider,
+                cliWorkdir: options.workdir || rootOptions.workdir,
+                checkOnly: Boolean(options.checkOnly),
+                force: Boolean(options.force),
+                installTools: Boolean(options.installTools)
+            });
+            if (options.json) {
+                console.log(JSON.stringify(result, null, 2));
+            }
+            else {
+                console.log(formatAdminInitResult(result));
+            }
+        }
+        catch (err) {
+            console.error("Error:", err.message);
+            process.exit(1);
+        }
+    });
+    const workdirCmd = program.command("workdir").description("Inspect the resolved admin workdir");
+    workdirCmd
+        .command("path")
+        .description("Print the resolved admin workdir path")
+        .option("--workdir <path>", "Admin workdir path")
+        .action((options) => {
+        try {
+            const rootOptions = program.opts();
+            console.log(resolveAdminWorkdir({ cliWorkdir: options.workdir || rootOptions.workdir }));
+        }
+        catch (err) {
+            console.error("Error:", err.message);
+            process.exit(1);
+        }
+    });
+    workdirCmd
+        .command("doctor")
+        .description("Check admin workdir files and provider tooling")
+        .option("--provider <provider>", "Deployment provider (default: fly.io)", "fly.io")
+        .option("--workdir <path>", "Admin workdir path")
+        .option("--json", "Output structured JSON")
+        .action((options) => {
+        try {
+            const rootOptions = program.opts();
+            const result = runWorkdirDoctor({
+                provider: options.provider,
+                cliWorkdir: options.workdir || rootOptions.workdir
+            });
+            if (options.json) {
+                console.log(JSON.stringify(result, null, 2));
+            }
+            else {
+                console.log(formatWorkdirDoctorResult(result));
+            }
+        }
+        catch (err) {
+            console.error("Error:", err.message);
+            process.exit(1);
+        }
+    });
     // Helper to resolve client
     function getClient() {
         const opts = program.opts();
-        const configPath = opts.config;
-        const mgr = configPath ? new ConfigManager(configPath) : configManager;
+        const mgr = getRootConfigManager();
         const url = opts.url || process.env.TOKENBUDDY_ADMIN_URL;
         const token = opts.token || process.env.TOKENBUDDY_ADMIN_TOKEN;
         const profileName = opts.profile || process.env.TOKENBUDDY_ADMIN_PROFILE;
@@ -221,8 +301,7 @@ export function buildAdminCli(configManager) {
     }
     function getBaseUrl() {
         const opts = program.opts();
-        const configPath = opts.config;
-        const mgr = configPath ? new ConfigManager(configPath) : configManager;
+        const mgr = getRootConfigManager();
         const url = opts.url || process.env.TOKENBUDDY_ADMIN_URL;
         const profileName = opts.profile || process.env.TOKENBUDDY_ADMIN_PROFILE;
         if (url) {
@@ -1039,8 +1118,7 @@ export function buildAdminCli(configManager) {
         .option("--token <token>", "Bearer Operator secret token")
         .action((profileName, options) => {
         const opts = program.opts();
-        const configPath = opts.config;
-        const mgr = configPath ? new ConfigManager(configPath) : configManager;
+        const mgr = getRootConfigManager();
         const url = options.url || opts.url || process.env.TOKENBUDDY_ADMIN_URL;
         const token = options.token || opts.token || process.env.TOKENBUDDY_ADMIN_TOKEN;
         if (!url || !token) {
@@ -1055,8 +1133,7 @@ export function buildAdminCli(configManager) {
         .description("Switch default profile to select")
         .action((profileName) => {
         const opts = program.opts();
-        const configPath = opts.config;
-        const mgr = configPath ? new ConfigManager(configPath) : configManager;
+        const mgr = getRootConfigManager();
         try {
             mgr.useProfile(profileName);
             console.log(`Now using profile \`${profileName}\` by default.`);
@@ -1070,8 +1147,7 @@ export function buildAdminCli(configManager) {
         .description("List all configured profiles in the active config file")
         .action(() => {
         const opts = program.opts();
-        const configPath = opts.config;
-        const mgr = configPath ? new ConfigManager(configPath) : configManager;
+        const mgr = getRootConfigManager();
         const profiles = mgr.listProfiles();
         const config = mgr.load();
         console.log(`=== Configured Local Profiles (config: ${mgr.getConfigPath() || "default"}) ===`);
@@ -1117,20 +1193,17 @@ export function buildAdminCli(configManager) {
         .description("Print the config file path in use (resolves --config, env, or default)")
         .action(() => {
         const opts = program.opts();
-        const configPath = opts.config || process.env.TOKENBUDDY_ADMIN_CONFIG;
-        const resolved = configPath || `${process.env.HOME || ""}/.config/tokenbuddy/admin.toml`;
-        console.log(resolved);
+        const mgr = getRootConfigManager();
+        console.log(mgr.getConfigPath());
     });
     // 8. Seller Command (Fly.io)
     const sellerCmd = program.command("seller").description("Deploy and manage seller containers on Fly.io");
     function getFlyProvider() {
-        const opts = program.opts();
-        const mgr = opts.config ? new ConfigManager(opts.config) : configManager;
+        const mgr = getRootConfigManager();
         return new FlyProvider(mgr.getSellerProvider("fly"));
     }
     function getSellerRunner() {
-        const opts = program.opts();
-        const mgr = opts.config ? new ConfigManager(opts.config) : configManager;
+        const mgr = getRootConfigManager();
         return new SellerCommandRunner(mgr);
     }
     function printResult(res, json) {
@@ -1183,7 +1256,7 @@ export function buildAdminCli(configManager) {
         .option("--app <app>", "Fly.io app name (bypasses tb-seller- prefix; use tbs-<random> format)")
         .option("--region <region>", "Fly region (default: sin)", "sin")
         .requiredOption("--image <image>", "Published Docker image, for example registry.fly.io/tb-seller:<v>")
-        .requiredOption("--fly-config <path>", "Fly.io config file path, for example deploy/fly.io/fly.tb-seller.toml")
+        .option("--fly-config <path>", "Fly.io config file path (default: $TB_ADMIN_WORKDIR/fly/fly.tb-seller.toml)")
         .option("--volume-name <name>", "Persistent volume name")
         .option("--volume-size-gb <gb>", "Persistent volume size in GB", (v) => parseInt(v, 10))
         .option("--volume-id <id>", "Attach existing volume by ID (skips volume creation)")

package/dist/src/config.d.ts

@@ -1,3 +1,4 @@
+import { type AdminWorkdirOptions } from "./workdir.js";
 /**
  * admin CLI 单个 profile：远程 wallet-bootstrap / seller 服务的 URL + 鉴权 token。
  */
@@ -55,14 +56,19 @@ export interface AdminConfig {
  * @returns 配置文件绝对路径
  */
 export declare function getDefaultConfigPath(): string;
+export interface ConfigManagerOptions extends AdminWorkdirOptions {
+    workdir?: string;
+}
 /**
  * admin CLI 配置的读写管理器（TOML 优先，legacy JSON 兼容）。
  * 写盘时自动 chmod 0600（best effort）保护含 token 的配置文件。
  */
 export declare class ConfigManager {
     private configPath;
-    constructor(customPath?: string);
+    private workdir;
+    constructor(customPath?: string, options?: ConfigManagerOptions);
     getConfigPath(): string;
+    getWorkdir(): string;
     load(): AdminConfig;
     save(config: AdminConfig): void;
     getProfile(name?: string): AdminProfile | undefined;

package/dist/src/config.js

@@ -2,6 +2,7 @@ import * as fs from "fs";
 import * as path from "path";
 import * as os from "os";
 import TOML from "@iarna/toml";
+import { defaultAdminConfigPath, defaultAdminWorkdir, resolveAdminConfigPath, resolveAdminWorkdir } from "./workdir.js";
 /**
  * 解析 admin CLI 的默认配置路径：`~/.config/tokenbuddy/admin.toml`。
  * 兼容旧版 `~/.tokenbuddy/admin.json`（legacy JSON），由 `ConfigManager` 自动识别。
@@ -9,8 +10,7 @@ import TOML from "@iarna/toml";
  * @returns 配置文件绝对路径
  */
 export function getDefaultConfigPath() {
-    const home = os.homedir();
-    return path.join(home, ".config", "tokenbuddy", "admin.toml");
+    return defaultAdminConfigPath(defaultAdminWorkdir(os.homedir()));
 }
 /**
  * admin CLI 配置的读写管理器（TOML 优先，legacy JSON 兼容）。
@@ -18,12 +18,24 @@ export function getDefaultConfigPath() {
  */
 export class ConfigManager {
     configPath;
-    constructor(customPath) {
-        this.configPath = customPath || getDefaultConfigPath();
+    workdir;
+    constructor(customPath, options = {}) {
+        this.workdir = options.workdir
+            ? path.resolve(options.workdir)
+            : resolveAdminWorkdir(options);
+        this.configPath = resolveAdminConfigPath({
+            workdir: this.workdir,
+            cliConfig: customPath,
+            env: options.env,
+            homeDir: options.homeDir
+        });
     }
     getConfigPath() {
         return this.configPath;
     }
+    getWorkdir() {
+        return this.workdir;
+    }
     load() {
         if (!fs.existsSync(this.configPath)) {
             return { profiles: {} };

package/dist/src/display-format.js

@@ -68,11 +68,7 @@ export function formatDiscountRatio(discountRatio) {
     if (!Number.isFinite(discountRatio))
         return UNKNOWN_VALUE;
     const ratio = Math.max(0, discountRatio);
-    if (ratio === 0)
-        return "免费";
-    if (Math.abs(ratio - 1) < 0.0001)
-        return "原价";
-    return `${formatSignificantDiscount(ratio * 10)}折`;
+    return formatRatioValue(ratio);
 }
 export function formatPriceMicrosPerMillion(value) {
     return formatMoney(value, { digits: 4 });
@@ -80,9 +76,8 @@ export function formatPriceMicrosPerMillion(value) {
 export function formatPricePair(inputMicros, outputMicros) {
     return formatMoneyPair(inputMicros, outputMicros, { digits: 4 });
 }
-function formatSignificantDiscount(value) {
-    const rounded = Math.round(value * 10) / 10;
-    return Number.isInteger(rounded) ? String(rounded) : rounded.toFixed(1);
+function formatRatioValue(value) {
+    return String(value);
 }
 export function normalizeStatusLabel(status) {
     if (!status)
@@ -272,15 +267,12 @@ function formatPercent(value) {
 function formatDiscountRatio(discountRatio) {
   if (!Number.isFinite(discountRatio)) return UNKNOWN_VALUE;
   const ratio = Math.max(0, discountRatio);
-  if (ratio === 0) return "免费";
-  if (Math.abs(ratio - 1) < 0.0001) return "原价";
-  return formatSignificantDiscount(ratio * 10) + "折";
+  return formatRatioValue(ratio);
 }
 function formatPriceMicrosPerMillion(value) { return formatMoney(value, { digits: 4 }); }
 function formatPricePair(inputMicros, outputMicros) { return formatMoneyPair(inputMicros, outputMicros, { digits: 4 }); }
-function formatSignificantDiscount(value) {
-  const rounded = Math.round(value * 10) / 10;
-  return Number.isInteger(rounded) ? String(rounded) : rounded.toFixed(1);
+function formatRatioValue(value) {
+  return String(value);
 }
 function normalizeStatusLabel(status) {
   if (!status) return UNKNOWN_VALUE;

package/dist/src/init-command.d.ts

@@ -0,0 +1,50 @@
+import type { AdminProviderId, ProviderCheckResult, SpawnSyncRunner } from "./providers/provider-definition.js";
+export interface AdminInitOptions {
+    provider?: string;
+    cliWorkdir?: string;
+    checkOnly?: boolean;
+    force?: boolean;
+    installTools?: boolean;
+    json?: boolean;
+    env?: NodeJS.ProcessEnv;
+    now?: Date;
+    templateRoot?: string;
+    packageRoot?: string;
+    packageVersion?: string;
+    spawnSync?: SpawnSyncRunner;
+}
+export interface WorkdirDoctorOptions {
+    provider?: string;
+    cliWorkdir?: string;
+    json?: boolean;
+    env?: NodeJS.ProcessEnv;
+    spawnSync?: SpawnSyncRunner;
+}
+export interface InitFileResult {
+    path: string;
+    status: "created" | "updated" | "skipped";
+}
+export interface AdminInitResult {
+    provider: AdminProviderId;
+    workdir: string;
+    templateVersion: string;
+    checkOnly: boolean;
+    checks: ProviderCheckResult[];
+    files: InitFileResult[];
+    install?: {
+        attempted: boolean;
+        ok: boolean;
+        message: string;
+    };
+    next: string[];
+}
+export interface WorkdirDoctorResult {
+    provider: AdminProviderId;
+    workdir: string;
+    checks: ProviderCheckResult[];
+}
+export declare function runAdminInitCommand(options?: AdminInitOptions): AdminInitResult;
+export declare function runWorkdirDoctor(options?: WorkdirDoctorOptions): WorkdirDoctorResult;
+export declare function formatAdminInitResult(result: AdminInitResult): string;
+export declare function formatWorkdirDoctorResult(result: WorkdirDoctorResult): string;
+//# sourceMappingURL=init-command.d.ts.map

package/dist/src/init-command.js

@@ -0,0 +1,347 @@
+import { spawnSync } from "child_process";
+import * as fs from "fs";
+import * as path from "path";
+import { fileURLToPath } from "url";
+import { resolveAdminWorkdir, resolveWorkdirPath } from "./workdir.js";
+import { flyIoProviderDefinition } from "./providers/fly-io.js";
+const providerDefinitions = {
+    "fly.io": flyIoProviderDefinition
+};
+const requiredWorkdirFiles = [
+    "tokenbuddy-admin-workdir.json",
+    "admin.toml",
+    "providers/fly.io.toml",
+    "env/deploy.env",
+    "fly/fly.tb-seller.toml",
+    "fly/fly.tb-registry.toml",
+    "deploy-secrets/seller-configs/seller.example.yaml",
+    "deploy-secrets/bootstrap/tb-registry.example.yaml"
+];
+function currentModuleDir() {
+    if (typeof __dirname !== "undefined") {
+        return __dirname;
+    }
+    const stack = new Error().stack || "";
+    const fileUrlMatch = stack.match(/(file:\/\/\/[^)\n]+\/init-command\.js):\d+:\d+/);
+    if (fileUrlMatch) {
+        return path.dirname(fileURLToPath(fileUrlMatch[1]));
+    }
+    const filePathMatch = stack.match(/(\/[^)\n]+\/init-command\.(?:js|ts)):\d+:\d+/);
+    if (filePathMatch) {
+        return path.dirname(filePathMatch[1]);
+    }
+    return process.cwd();
+}
+function readPackageJson(packageRoot) {
+    return JSON.parse(fs.readFileSync(path.join(packageRoot, "package.json"), "utf8"));
+}
+function findAdminPackageRoot(startDir = currentModuleDir()) {
+    let current = path.resolve(startDir);
+    const seen = new Set();
+    while (!seen.has(current)) {
+        seen.add(current);
+        const packageJsonPath = path.join(current, "package.json");
+        if (fs.existsSync(packageJsonPath)) {
+            const packageJson = readPackageJson(current);
+            if (packageJson.name === "@tokenbuddy/tb-admin") {
+                return current;
+            }
+        }
+        const parent = path.dirname(current);
+        if (parent === current) {
+            break;
+        }
+        current = parent;
+    }
+    throw new Error("Could not locate @tokenbuddy/tb-admin package root for templates");
+}
+function getProviderDefinition(provider) {
+    const id = (provider || "fly.io");
+    const definition = providerDefinitions[id];
+    if (!definition) {
+        throw new Error(`Unknown provider: ${provider}. Supported providers: ${Object.keys(providerDefinitions).join(", ")}`);
+    }
+    return definition;
+}
+function packageTemplateContext(definition, options) {
+    const packageRoot = options.packageRoot || findAdminPackageRoot();
+    const packageJson = readPackageJson(packageRoot);
+    const templateRoot = options.templateRoot || path.join(packageRoot, definition.templateRelativeRoot);
+    if (!fs.existsSync(templateRoot)) {
+        throw new Error(`Provider template directory not found: ${templateRoot}`);
+    }
+    return {
+        packageRoot,
+        packageVersion: options.packageVersion || String(packageJson.version || "0.0.0"),
+        templateRoot
+    };
+}
+function listTemplateFiles(root) {
+    const entries = fs.readdirSync(root, { withFileTypes: true });
+    const files = [];
+    for (const entry of entries) {
+        const fullPath = path.join(root, entry.name);
+        if (entry.isDirectory()) {
+            for (const child of listTemplateFiles(fullPath)) {
+                files.push(path.join(entry.name, child));
+            }
+            continue;
+        }
+        if (entry.isFile()) {
+            files.push(entry.name);
+        }
+    }
+    return files.sort();
+}
+function targetForTemplate(relativePath) {
+    if (relativePath === "admin.toml.example") {
+        return "admin.toml";
+    }
+    if (relativePath === "provider.toml.example") {
+        return "providers/fly.io.toml";
+    }
+    if (relativePath === "env/deploy.env.example") {
+        return "env/deploy.env";
+    }
+    return relativePath;
+}
+function isForceOverwritable(relativeTarget) {
+    return (relativeTarget.startsWith("fly/") ||
+        relativeTarget.endsWith(".example.yaml") ||
+        relativeTarget.endsWith(".example.json") ||
+        relativeTarget.endsWith(".example.env") ||
+        path.basename(relativeTarget) === "README.md");
+}
+function isPrivateTarget(relativeTarget) {
+    return (relativeTarget === "admin.toml" ||
+        relativeTarget === "env/deploy.env" ||
+        relativeTarget.startsWith("deploy-secrets/"));
+}
+function templateCopyPlans(templateRoot, workdir) {
+    return listTemplateFiles(templateRoot).map((relativeSource) => {
+        const relativeTarget = targetForTemplate(relativeSource);
+        return {
+            source: path.join(templateRoot, relativeSource),
+            target: resolveWorkdirPath(workdir, relativeTarget),
+            overwriteWithForce: isForceOverwritable(relativeTarget),
+            chmodPrivate: isPrivateTarget(relativeTarget)
+        };
+    });
+}
+function chmodPrivate(filePath) {
+    try {
+        fs.chmodSync(filePath, 0o600);
+    }
+    catch {
+        // Best effort only; chmod is not available on every platform.
+    }
+}
+function copyTemplates(templateRoot, workdir, force) {
+    const results = [];
+    for (const plan of templateCopyPlans(templateRoot, workdir)) {
+        const exists = fs.existsSync(plan.target);
+        if (exists && !(force && plan.overwriteWithForce)) {
+            results.push({ path: plan.target, status: "skipped" });
+            continue;
+        }
+        fs.mkdirSync(path.dirname(plan.target), { recursive: true });
+        fs.copyFileSync(plan.source, plan.target);
+        if (plan.chmodPrivate) {
+            chmodPrivate(plan.target);
+        }
+        results.push({ path: plan.target, status: exists ? "updated" : "created" });
+    }
+    return results;
+}
+function writeManifest(workdir, provider, templateVersion, now) {
+    const manifestPath = path.join(workdir, "tokenbuddy-admin-workdir.json");
+    const existed = fs.existsSync(manifestPath);
+    fs.mkdirSync(path.dirname(manifestPath), { recursive: true });
+    fs.writeFileSync(manifestPath, `${JSON.stringify({
+        schemaVersion: 1,
+        provider,
+        templateVersion,
+        createdBy: "@tokenbuddy/tb-admin",
+        createdAt: now.toISOString()
+    }, null, 2)}\n`, "utf8");
+    return {
+        path: manifestPath,
+        status: existed ? "updated" : "created"
+    };
+}
+function ensureWorkdirDirectories(workdir) {
+    for (const relative of ["providers", "env", "fly", "deploy-secrets/seller-configs", "deploy-secrets/bootstrap", "artifacts"]) {
+        fs.mkdirSync(path.join(workdir, relative), { recursive: true });
+    }
+}
+function checkContext(options) {
+    return {
+        env: options.env || process.env,
+        spawnSync: options.spawnSync || spawnSync
+    };
+}
+export function runAdminInitCommand(options = {}) {
+    const definition = getProviderDefinition(options.provider);
+    const workdir = resolveAdminWorkdir({
+        cliWorkdir: options.cliWorkdir,
+        env: options.env || process.env
+    });
+    const template = packageTemplateContext(definition, options);
+    const checks = definition.check(checkContext(options));
+    const files = [];
+    let install;
+    const flyMissing = checks.some((check) => check.id === "fly" && check.status === "missing");
+    if (options.installTools && flyMissing && definition.install) {
+        const installResult = definition.install({
+            ...checkContext(options),
+            dryRun: false
+        });
+        install = {
+            attempted: true,
+            ok: installResult.ok,
+            message: installResult.message
+        };
+    }
+    if (!options.checkOnly) {
+        ensureWorkdirDirectories(workdir);
+        files.push(...copyTemplates(template.templateRoot, workdir, Boolean(options.force)));
+        files.push(writeManifest(workdir, definition.id, template.packageVersion, options.now || new Date()));
+    }
+    return {
+        provider: definition.id,
+        workdir,
+        templateVersion: template.packageVersion,
+        checkOnly: Boolean(options.checkOnly),
+        checks,
+        files,
+        install,
+        next: [
+            `export TB_ADMIN_WORKDIR=${workdir}`,
+            `edit ${path.join(workdir, definition.defaultPaths.deployEnv)}`,
+            `edit ${path.join(workdir, "admin.toml")}`
+        ]
+    };
+}
+function fileCheck(id, label, filePath) {
+    return {
+        id,
+        label,
+        status: fs.existsSync(filePath) ? "ok" : "missing",
+        message: fs.existsSync(filePath) ? `${label} exists` : `${label} missing: ${filePath}`
+    };
+}
+function deploySecretsGitCheck(workdir, runner) {
+    const deploySecretsPath = path.join(workdir, "deploy-secrets");
+    if (!fs.existsSync(deploySecretsPath)) {
+        return {
+            id: "deploy-secrets-git",
+            label: "deploy-secrets git",
+            status: "missing",
+            message: `deploy-secrets directory missing: ${deploySecretsPath}`
+        };
+    }
+    const rootResult = runner("git", ["-C", workdir, "rev-parse", "--show-toplevel"], {
+        encoding: "utf8",
+        stdio: ["ignore", "pipe", "pipe"]
+    });
+    if (rootResult.error || rootResult.status !== 0 || !rootResult.stdout) {
+        return {
+            id: "deploy-secrets-git",
+            label: "deploy-secrets git",
+            status: "ok",
+            message: "deploy-secrets is outside a git worktree"
+        };
+    }
+    const gitRoot = String(rootResult.stdout).trim();
+    const relative = path.relative(gitRoot, deploySecretsPath);
+    if (relative.startsWith("..")) {
+        return {
+            id: "deploy-secrets-git",
+            label: "deploy-secrets git",
+            status: "ok",
+            message: "deploy-secrets is outside the current git root"
+        };
+    }
+    const trackedResult = runner("git", ["-C", gitRoot, "ls-files", "--error-unmatch", relative], {
+        encoding: "utf8",
+        stdio: ["ignore", "pipe", "pipe"]
+    });
+    if (!trackedResult.error && trackedResult.status === 0) {
+        return {
+            id: "deploy-secrets-git",
+            label: "deploy-secrets git",
+            status: "warning",
+            message: `deploy-secrets appears to be tracked by git: ${deploySecretsPath}`
+        };
+    }
+    return {
+        id: "deploy-secrets-git",
+        label: "deploy-secrets git",
+        status: "ok",
+        message: "deploy-secrets is not tracked by git"
+    };
+}
+export function runWorkdirDoctor(options = {}) {
+    const definition = getProviderDefinition(options.provider);
+    const workdir = resolveAdminWorkdir({
+        cliWorkdir: options.cliWorkdir,
+        env: options.env || process.env
+    });
+    const runner = options.spawnSync || spawnSync;
+    const checks = [
+        ...requiredWorkdirFiles.map((relative) => fileCheck(`file:${relative}`, relative, path.join(workdir, relative))),
+        deploySecretsGitCheck(workdir, runner),
+        ...definition.check({
+            env: options.env || process.env,
+            spawnSync: runner
+        })
+    ];
+    return {
+        provider: definition.id,
+        workdir,
+        checks
+    };
+}
+export function formatAdminInitResult(result) {
+    const lines = [
+        result.checkOnly ? "TokenBuddy admin workdir check complete" : "TokenBuddy admin workdir initialized",
+        `  provider : ${result.provider}`,
+        `  workdir  : ${result.workdir}`,
+        `  templates: @tokenbuddy/tb-admin@${result.templateVersion}`,
+        "",
+        "Checks"
+    ];
+    for (const check of result.checks) {
+        const suffix = check.command ? ` (run: ${check.command})` : "";
+        lines.push(`  ${check.label.padEnd(10)} ${check.status}${suffix}`);
+    }
+    if (result.install) {
+        lines.push("", `Install: ${result.install.ok ? "ok" : "failed"} - ${result.install.message}`);
+    }
+    if (result.files.length > 0) {
+        lines.push("", "Files");
+        for (const file of result.files) {
+            lines.push(`  ${file.status.padEnd(7)} ${file.path}`);
+        }
+    }
+    lines.push("", "Next");
+    for (const next of result.next) {
+        lines.push(`  ${next}`);
+    }
+    return lines.join("\n");
+}
+export function formatWorkdirDoctorResult(result) {
+    const lines = [
+        "TokenBuddy admin workdir doctor",
+        `  provider : ${result.provider}`,
+        `  workdir  : ${result.workdir}`,
+        "",
+        "Checks"
+    ];
+    for (const check of result.checks) {
+        const suffix = check.command ? ` (run: ${check.command})` : "";
+        lines.push(`  ${check.label.padEnd(24)} ${check.status}${suffix}`);
+    }
+    return lines.join("\n");
+}
+//# sourceMappingURL=init-command.js.map