agent-relay 3.2.22 → 4.0.0

package/dist/src/cli/commands/on/dotfiles.js

@@ -0,0 +1,157 @@
+import ignore from 'ignore';
+import * as relayauthCore from '@relayauth/core';
+import { existsSync, readFileSync, readdirSync } from 'node:fs';
+import path from 'node:path';
+function cleanPatterns(content) {
+    return content
+        .split(/\r?\n/)
+        .map((line) => line.trim())
+        .filter((line) => line !== '' && !line.startsWith('#'));
+}
+function loadPatterns(matcher, filePath) {
+    if (!existsSync(filePath)) {
+        return [];
+    }
+    const content = readFileSync(filePath, 'utf8');
+    matcher.add(content);
+    return cleanPatterns(content);
+}
+function parseDotfilesSource(projectDir, agentName) {
+    const resolvedProjectDir = path.resolve(projectDir);
+    const ignored = ignore();
+    const readonly = ignore();
+    const ignoredPatterns = [
+        ...loadPatterns(ignored, path.join(resolvedProjectDir, '.agentignore')),
+        ...loadPatterns(ignored, path.join(resolvedProjectDir, `.${agentName}.agentignore`)),
+    ];
+    const readonlyPatterns = [
+        ...loadPatterns(readonly, path.join(resolvedProjectDir, '.agentreadonly')),
+        ...loadPatterns(readonly, path.join(resolvedProjectDir, `.${agentName}.agentreadonly`)),
+    ];
+    return {
+        agentName,
+        projectDir: resolvedProjectDir,
+        ignored,
+        readonly,
+        ignoredPatterns,
+        readonlyPatterns,
+    };
+}
+function isIgnored(relativePath, perms) {
+    return perms.ignored.ignores(relativePath);
+}
+function isReadonly(relativePath, perms) {
+    if (isIgnored(relativePath, perms)) {
+        return false;
+    }
+    return perms.readonly.ignores(relativePath);
+}
+function hasDotfilesSource(projectDir) {
+    return readdirSync(projectDir).some((entry) => entry === '.agentignore' ||
+        entry === '.agentreadonly' ||
+        /^\.[^.].*\.agentignore$/.test(entry) ||
+        /^\.[^.].*\.agentreadonly$/.test(entry));
+}
+function discoverAgentsSource(projectDir) {
+    const agents = new Set();
+    for (const entry of readdirSync(projectDir)) {
+        const match = entry.match(/^\.(.+)\.(agentignore|agentreadonly)$/);
+        if (match) {
+            agents.add(match[1]);
+        }
+    }
+    return [...agents].sort((a, b) => a.localeCompare(b));
+}
+function normalizeAclDir(relativeDir) {
+    if (relativeDir === '.' || relativeDir === '') {
+        return '/';
+    }
+    const normalized = `/${relativeDir}`.replace(/\/+/g, '/');
+    return normalized.length > 1 && normalized.endsWith('/') ? normalized.slice(0, -1) : normalized;
+}
+function addRule(map, aclDir, rule) {
+    const existing = map.get(aclDir) ?? new Set();
+    existing.add(rule);
+    map.set(aclDir, existing);
+}
+function addScope(scopes, action, relativePath) {
+    const normalized = `/${relativePath.replace(/\\/g, '/')}`;
+    scopes.add(`relayfile:fs:${action}:${normalized}`);
+}
+function walkProjectFiles(projectDir, callback, currentDir = projectDir) {
+    const entries = readdirSync(currentDir, { withFileTypes: true });
+    for (const entry of entries) {
+        if (entry.name === '.git' || entry.name === '.relay' || entry.name === 'node_modules') {
+            continue;
+        }
+        const fullPath = path.join(currentDir, entry.name);
+        const relativePath = path.relative(projectDir, fullPath).replace(/\\/g, '/');
+        callback(relativePath, entry.isDirectory());
+        if (entry.isDirectory()) {
+            walkProjectFiles(projectDir, callback, fullPath);
+        }
+    }
+}
+function compileDotfilesSource(projectDir, agentName, workspace) {
+    const perms = parseDotfilesSource(projectDir, agentName);
+    const aclMap = new Map();
+    const scopes = new Set();
+    const ignoredPaths = [];
+    const readonlyPaths = [];
+    const readwritePaths = [];
+    const dirFiles = new Map();
+    walkProjectFiles(path.resolve(projectDir), (relativePath, isDirectory) => {
+        if (isDirectory) {
+            return;
+        }
+        const dir = normalizeAclDir(path.dirname(relativePath));
+        const entry = dirFiles.get(dir) ?? { ignored: [], allowed: [] };
+        if (isIgnored(relativePath, perms)) {
+            ignoredPaths.push(relativePath);
+            entry.ignored.push(relativePath);
+        }
+        else {
+            entry.allowed.push(relativePath);
+            addScope(scopes, 'read', relativePath);
+            if (isReadonly(relativePath, perms)) {
+                readonlyPaths.push(relativePath);
+            }
+            else {
+                readwritePaths.push(relativePath);
+                addScope(scopes, 'write', relativePath);
+            }
+        }
+        dirFiles.set(dir, entry);
+    });
+    for (const [dir, { ignored, allowed }] of dirFiles.entries()) {
+        if (ignored.length > 0 && allowed.length === 0) {
+            addRule(aclMap, dir, `deny:agent:${agentName}`);
+        }
+    }
+    const acl = {};
+    for (const [aclDir, rules] of aclMap.entries()) {
+        acl[aclDir] = [...rules].sort();
+    }
+    return {
+        workspace,
+        agentName,
+        ignoredPatterns: perms.ignoredPatterns,
+        readonlyPatterns: perms.readonlyPatterns,
+        ignoredPaths: ignoredPaths.sort(),
+        readonlyPaths: readonlyPaths.sort(),
+        readwritePaths: readwritePaths.sort(),
+        acl,
+        scopes: [...scopes].sort(),
+        summary: {
+            ignored: ignoredPaths.length,
+            readonly: readonlyPaths.length,
+            readwrite: readwritePaths.length,
+        },
+    };
+}
+const relayauthDotfiles = relayauthCore;
+export const parseDotfiles = relayauthDotfiles.parseDotfiles ?? parseDotfilesSource;
+export const compileDotfiles = relayauthDotfiles.compileDotfiles ?? compileDotfilesSource;
+export const discoverAgents = relayauthDotfiles.discoverAgents ?? discoverAgentsSource;
+export const hasDotfiles = relayauthDotfiles.hasDotfiles ?? hasDotfilesSource;
+//# sourceMappingURL=dotfiles.js.map

package/dist/src/cli/commands/on/dotfiles.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"dotfiles.js","sourceRoot":"","sources":["../../../../../src/cli/commands/on/dotfiles.ts"],"names":[],"mappings":"AAAA,OAAO,MAAuB,MAAM,QAAQ,CAAC;AAC7C,OAAO,KAAK,aAAa,MAAM,iBAAiB,CAAC;AACjD,OAAO,EAAE,UAAU,EAAE,YAAY,EAAE,WAAW,EAAE,MAAM,SAAS,CAAC;AAChE,OAAO,IAAI,MAAM,WAAW,CAAC;AA4B7B,SAAS,aAAa,CAAC,OAAe;IACpC,OAAO,OAAO;SACX,KAAK,CAAC,OAAO,CAAC;SACd,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,IAAI,EAAE,CAAC;SAC1B,MAAM,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,KAAK,EAAE,IAAI,CAAC,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,CAAC,CAAC;AAC5D,CAAC;AAED,SAAS,YAAY,CAAC,OAAe,EAAE,QAAgB;IACrD,IAAI,CAAC,UAAU,CAAC,QAAQ,CAAC,EAAE,CAAC;QAC1B,OAAO,EAAE,CAAC;IACZ,CAAC;IAED,MAAM,OAAO,GAAG,YAAY,CAAC,QAAQ,EAAE,MAAM,CAAC,CAAC;IAC/C,OAAO,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC;IACrB,OAAO,aAAa,CAAC,OAAO,CAAC,CAAC;AAChC,CAAC;AAED,SAAS,mBAAmB,CAAC,UAAkB,EAAE,SAAiB;IAChE,MAAM,kBAAkB,GAAG,IAAI,CAAC,OAAO,CAAC,UAAU,CAAC,CAAC;IACpD,MAAM,OAAO,GAAG,MAAM,EAAE,CAAC;IACzB,MAAM,QAAQ,GAAG,MAAM,EAAE,CAAC;IAE1B,MAAM,eAAe,GAAG;QACtB,GAAG,YAAY,CAAC,OAAO,EAAE,IAAI,CAAC,IAAI,CAAC,kBAAkB,EAAE,cAAc,CAAC,CAAC;QACvE,GAAG,YAAY,CAAC,OAAO,EAAE,IAAI,CAAC,IAAI,CAAC,kBAAkB,EAAE,IAAI,SAAS,cAAc,CAAC,CAAC;KACrF,CAAC;IACF,MAAM,gBAAgB,GAAG;QACvB,GAAG,YAAY,CAAC,QAAQ,EAAE,IAAI,CAAC,IAAI,CAAC,kBAAkB,EAAE,gBAAgB,CAAC,CAAC;QAC1E,GAAG,YAAY,CAAC,QAAQ,EAAE,IAAI,CAAC,IAAI,CAAC,kBAAkB,EAAE,IAAI,SAAS,gBAAgB,CAAC,CAAC;KACxF,CAAC;IAEF,OAAO;QACL,SAAS;QACT,UAAU,EAAE,kBAAkB;QAC9B,OAAO;QACP,QAAQ;QACR,eAAe;QACf,gBAAgB;KACjB,CAAC;AACJ,CAAC;AAED,SAAS,SAAS,CAAC,YAAoB,EAAE,KAAyB;IAChE,OAAO,KAAK,CAAC,OAAO,CAAC,OAAO,CAAC,YAAY,CAAC,CAAC;AAC7C,CAAC;AAED,SAAS,UAAU,CAAC,YAAoB,EAAE,KAAyB;IACjE,IAAI,SAAS,CAAC,YAAY,EAAE,KAAK,CAAC,EAAE,CAAC;QACnC,OAAO,KAAK,CAAC;IACf,CAAC;IACD,OAAO,KAAK,CAAC,QAAQ,CAAC,OAAO,CAAC,YAAY,CAAC,CAAC;AAC9C,CAAC;AAED,SAAS,iBAAiB,CAAC,UAAkB;IAC3C,OAAO,WAAW,CAAC,UAAU,CAAC,CAAC,IAAI,CAAC,CAAC,KAAK,EAAE,EAAE,CAC5C,KAAK,KAAK,cAAc;QACxB,KAAK,KAAK,gBAAgB;QAC1B,yBAAyB,CAAC,IAAI,CAAC,KAAK,CAAC;QACrC,2BAA2B,CAAC,IAAI,CAAC,KAAK,CAAC,CACxC,CAAC;AACJ,CAAC;AAED,SAAS,oBAAoB,CAAC,UAAkB;IAC9C,MAAM,MAAM,GAAG,IAAI,GAAG,EAAU,CAAC;IACjC,KAAK,MAAM,KAAK,IAAI,WAAW,CAAC,UAAU,CAAC,EAAE,CAAC;QAC5C,MAAM,KAAK,GAAG,KAAK,CAAC,KAAK,CAAC,uCAAuC,CAAC,CAAC;QACnE,IAAI,KAAK,EAAE,CAAC;YACV,MAAM,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC;QACvB,CAAC;IACH,CAAC;IACD,OAAO,CAAC,GAAG,MAAM,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,aAAa,CAAC,CAAC,CAAC,CAAC,CAAC;AACxD,CAAC;AAED,SAAS,eAAe,CAAC,WAAmB;IAC1C,IAAI,WAAW,KAAK,GAAG,IAAI,WAAW,KAAK,EAAE,EAAE,CAAC;QAC9C,OAAO,GAAG,CAAC;IACb,CAAC;IACD,MAAM,UAAU,GAAG,IAAI,WAAW,EAAE,CAAC,OAAO,CAAC,MAAM,EAAE,GAAG,CAAC,CAAC;IAC1D,OAAO,UAAU,CAAC,MAAM,GAAG,CAAC,IAAI,UAAU,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,UAAU,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,UAAU,CAAC;AAClG,CAAC;AAED,SAAS,OAAO,CAAC,GAA6B,EAAE,MAAc,EAAE,IAAY;IAC1E,MAAM,QAAQ,GAAG,GAAG,CAAC,GAAG,CAAC,MAAM,CAAC,IAAI,IAAI,GAAG,EAAU,CAAC;IACtD,QAAQ,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;IACnB,GAAG,CAAC,GAAG,CAAC,MAAM,EAAE,QAAQ,CAAC,CAAC;AAC5B,CAAC;AAED,SAAS,QAAQ,CAAC,MAAmB,EAAE,MAAwB,EAAE,YAAoB;IACnF,MAAM,UAAU,GAAG,IAAI,YAAY,CAAC,OAAO,CAAC,KAAK,EAAE,GAAG,CAAC,EAAE,CAAC;IAC1D,MAAM,CAAC,GAAG,CAAC,gBAAgB,MAAM,IAAI,UAAU,EAAE,CAAC,CAAC;AACrD,CAAC;AAED,SAAS,gBAAgB,CACvB,UAAkB,EAClB,QAA8D,EAC9D,UAAU,GAAG,UAAU;IAEvB,MAAM,OAAO,GAAG,WAAW,CAAC,UAAU,EAAE,EAAE,aAAa,EAAE,IAAI,EAAE,CAAC,CAAC;IACjE,KAAK,MAAM,KAAK,IAAI,OAAO,EAAE,CAAC;QAC5B,IAAI,KAAK,CAAC,IAAI,KAAK,MAAM,IAAI,KAAK,CAAC,IAAI,KAAK,QAAQ,IAAI,KAAK,CAAC,IAAI,KAAK,cAAc,EAAE,CAAC;YACtF,SAAS;QACX,CAAC;QAED,MAAM,QAAQ,GAAG,IAAI,CAAC,IAAI,CAAC,UAAU,EAAE,KAAK,CAAC,IAAI,CAAC,CAAC;QACnD,MAAM,YAAY,GAAG,IAAI,CAAC,QAAQ,CAAC,UAAU,EAAE,QAAQ,CAAC,CAAC,OAAO,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC;QAC7E,QAAQ,CAAC,YAAY,EAAE,KAAK,CAAC,WAAW,EAAE,CAAC,CAAC;QAC5C,IAAI,KAAK,CAAC,WAAW,EAAE,EAAE,CAAC;YACxB,gBAAgB,CAAC,UAAU,EAAE,QAAQ,EAAE,QAAQ,CAAC,CAAC;QACnD,CAAC;IACH,CAAC;AACH,CAAC;AAED,SAAS,qBAAqB,CAAC,UAAkB,EAAE,SAAiB,EAAE,SAAiB;IACrF,MAAM,KAAK,GAAG,mBAAmB,CAAC,UAAU,EAAE,SAAS,CAAC,CAAC;IACzD,MAAM,MAAM,GAAG,IAAI,GAAG,EAAuB,CAAC;IAC9C,MAAM,MAAM,GAAG,IAAI,GAAG,EAAU,CAAC;IACjC,MAAM,YAAY,GAAa,EAAE,CAAC;IAClC,MAAM,aAAa,GAAa,EAAE,CAAC;IACnC,MAAM,cAAc,GAAa,EAAE,CAAC;IAEpC,MAAM,QAAQ,GAAG,IAAI,GAAG,EAAoD,CAAC;IAE7E,gBAAgB,CAAC,IAAI,CAAC,OAAO,CAAC,UAAU,CAAC,EAAE,CAAC,YAAY,EAAE,WAAW,EAAE,EAAE;QACvE,IAAI,WAAW,EAAE,CAAC;YAChB,OAAO;QACT,CAAC;QAED,MAAM,GAAG,GAAG,eAAe,CAAC,IAAI,CAAC,OAAO,CAAC,YAAY,CAAC,CAAC,CAAC;QACxD,MAAM,KAAK,GAAG,QAAQ,CAAC,GAAG,CAAC,GAAG,CAAC,IAAI,EAAE,OAAO,EAAE,EAAE,EAAE,OAAO,EAAE,EAAE,EAAE,CAAC;QAEhE,IAAI,SAAS,CAAC,YAAY,EAAE,KAAK,CAAC,EAAE,CAAC;YACnC,YAAY,CAAC,IAAI,CAAC,YAAY,CAAC,CAAC;YAChC,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,YAAY,CAAC,CAAC;QACnC,CAAC;aAAM,CAAC;YACN,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,YAAY,CAAC,CAAC;YACjC,QAAQ,CAAC,MAAM,EAAE,MAAM,EAAE,YAAY,CAAC,CAAC;YACvC,IAAI,UAAU,CAAC,YAAY,EAAE,KAAK,CAAC,EAAE,CAAC;gBACpC,aAAa,CAAC,IAAI,CAAC,YAAY,CAAC,CAAC;YACnC,CAAC;iBAAM,CAAC;gBACN,cAAc,CAAC,IAAI,CAAC,YAAY,CAAC,CAAC;gBAClC,QAAQ,CAAC,MAAM,EAAE,OAAO,EAAE,YAAY,CAAC,CAAC;YAC1C,CAAC;QACH,CAAC;QAED,QAAQ,CAAC,GAAG,CAAC,GAAG,EAAE,KAAK,CAAC,CAAC;IAC3B,CAAC,CAAC,CAAC;IAEH,KAAK,MAAM,CAAC,GAAG,EAAE,EAAE,OAAO,EAAE,OAAO,EAAE,CAAC,IAAI,QAAQ,CAAC,OAAO,EAAE,EAAE,CAAC;QAC7D,IAAI,OAAO,CAAC,MAAM,GAAG,CAAC,IAAI,OAAO,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YAC/C,OAAO,CAAC,MAAM,EAAE,GAAG,EAAE,cAAc,SAAS,EAAE,CAAC,CAAC;QAClD,CAAC;IACH,CAAC;IAED,MAAM,GAAG,GAA6B,EAAE,CAAC;IACzC,KAAK,MAAM,CAAC,MAAM,EAAE,KAAK,CAAC,IAAI,MAAM,CAAC,OAAO,EAAE,EAAE,CAAC;QAC/C,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,GAAG,KAAK,CAAC,CAAC,IAAI,EAAE,CAAC;IAClC,CAAC;IAED,OAAO;QACL,SAAS;QACT,SAAS;QACT,eAAe,EAAE,KAAK,CAAC,eAAe;QACtC,gBAAgB,EAAE,KAAK,CAAC,gBAAgB;QACxC,YAAY,EAAE,YAAY,CAAC,IAAI,EAAE;QACjC,aAAa,EAAE,aAAa,CAAC,IAAI,EAAE;QACnC,cAAc,EAAE,cAAc,CAAC,IAAI,EAAE;QACrC,GAAG;QACH,MAAM,EAAE,CAAC,GAAG,MAAM,CAAC,CAAC,IAAI,EAAE;QAC1B,OAAO,EAAE;YACP,OAAO,EAAE,YAAY,CAAC,MAAM;YAC5B,QAAQ,EAAE,aAAa,CAAC,MAAM;YAC9B,SAAS,EAAE,cAAc,CAAC,MAAM;SACjC;KACF,CAAC;AACJ,CAAC;AASD,MAAM,iBAAiB,GAAG,aAA4D,CAAC;AAEvF,MAAM,CAAC,MAAM,aAAa,GAAG,iBAAiB,CAAC,aAAa,IAAI,mBAAmB,CAAC;AACpF,MAAM,CAAC,MAAM,eAAe,GAAG,iBAAiB,CAAC,eAAe,IAAI,qBAAqB,CAAC;AAC1F,MAAM,CAAC,MAAM,cAAc,GAAG,iBAAiB,CAAC,cAAc,IAAI,oBAAoB,CAAC;AACvF,MAAM,CAAC,MAAM,WAAW,GAAG,iBAAiB,CAAC,WAAW,IAAI,iBAAiB,CAAC"}

package/dist/src/cli/commands/on/prereqs.d.ts

@@ -0,0 +1,15 @@
+interface CheckPrereqConfig {
+    relayauthRoot?: string;
+    relayfileRoot?: string;
+}
+interface CheckPrereqsResult {
+    ok: boolean;
+    missing: string[];
+}
+export declare function resolvePrereqPaths(config?: CheckPrereqConfig): {
+    relayauthRoot: string;
+    relayfileRoot: string;
+};
+export declare function checkPrereqs(_deps?: unknown, options?: CheckPrereqConfig): Promise<CheckPrereqsResult>;
+export {};
+//# sourceMappingURL=prereqs.d.ts.map

package/dist/src/cli/commands/on/prereqs.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"prereqs.d.ts","sourceRoot":"","sources":["../../../../../src/cli/commands/on/prereqs.ts"],"names":[],"mappings":"AAIA,UAAU,iBAAiB;IACzB,aAAa,CAAC,EAAE,MAAM,CAAC;IACvB,aAAa,CAAC,EAAE,MAAM,CAAC;CACxB;AAED,UAAU,kBAAkB;IAC1B,EAAE,EAAE,OAAO,CAAC;IACZ,OAAO,EAAE,MAAM,EAAE,CAAC;CACnB;AA0DD,wBAAgB,kBAAkB,CAAC,MAAM,GAAE,iBAAsB,GAAG;IAClE,aAAa,EAAE,MAAM,CAAC;IACtB,aAAa,EAAE,MAAM,CAAC;CACvB,CA0BA;AAaD,wBAAsB,YAAY,CAChC,KAAK,GAAE,OAAY,EACnB,OAAO,CAAC,EAAE,iBAAiB,GAC1B,OAAO,CAAC,kBAAkB,CAAC,CAkC7B"}

package/dist/src/cli/commands/on/prereqs.js

@@ -0,0 +1,103 @@
+import { spawnSync } from 'node:child_process';
+import { existsSync, mkdirSync, readFileSync } from 'node:fs';
+import path from 'node:path';
+const REQUIRED_TOOLS = [
+    { command: 'node', args: ['--version'], label: 'node' },
+    { command: 'npx', args: ['--version'], label: 'npx' },
+    { command: 'go', args: ['version'], label: 'go' },
+];
+function isPathConfig(value) {
+    if (!value || typeof value !== 'object') {
+        return false;
+    }
+    const candidate = value;
+    return (typeof candidate.relayauthRoot === 'string' ||
+        typeof candidate.relayfileRoot === 'string');
+}
+function readCachedConfig() {
+    const configPath = path.resolve('.relay', 'config.json');
+    if (!existsSync(configPath)) {
+        return {};
+    }
+    try {
+        const raw = readFileSync(configPath, 'utf-8');
+        const parsed = JSON.parse(raw);
+        const data = parsed && typeof parsed === 'object' && 'data' in parsed && typeof parsed.data === 'object'
+            ? parsed.data
+            : parsed;
+        return {
+            relayauthRoot: typeof data.RELAYAUTH_ROOT === 'string'
+                ? data.RELAYAUTH_ROOT
+                : typeof data.relayauthRoot === 'string'
+                    ? data.relayauthRoot
+                    : undefined,
+            relayfileRoot: typeof data.RELAYFILE_ROOT === 'string'
+                ? data.RELAYFILE_ROOT
+                : typeof data.relayfileRoot === 'string'
+                    ? data.relayfileRoot
+                    : undefined,
+        };
+    }
+    catch {
+        return {};
+    }
+}
+export function resolvePrereqPaths(config = {}) {
+    const cache = readCachedConfig();
+    const cwd = process.cwd();
+    const relayauthCandidates = [
+        config.relayauthRoot,
+        process.env.RELAYAUTH_ROOT,
+        cache.relayauthRoot,
+        path.join(cwd, 'relayauth'),
+        path.join(cwd, '..', 'relayauth'),
+        path.join(cwd, '..', '..', 'relayauth'),
+    ].filter((candidate) => typeof candidate === 'string' && candidate.length > 0);
+    const relayauthRoot = path.resolve(relayauthCandidates.find((candidate) => existsSync(candidate)) ?? relayauthCandidates[0] ?? path.join(cwd, 'relayauth'));
+    return {
+        relayauthRoot,
+        relayfileRoot: path.resolve(config.relayfileRoot ??
+            process.env.RELAYFILE_ROOT ??
+            cache.relayfileRoot ??
+            path.join(path.dirname(relayauthRoot), 'relayfile')),
+    };
+}
+function commandAvailable(command, args) {
+    const result = spawnSync(command, args, {
+        stdio: 'ignore',
+    });
+    return result.status === 0;
+}
+function maybeCreateDirectory(target) {
+    mkdirSync(target, { recursive: true });
+}
+export async function checkPrereqs(_deps = {}, options) {
+    const config = isPathConfig(_deps) ? _deps : isPathConfig(options) ? options : {};
+    const { relayauthRoot, relayfileRoot } = resolvePrereqPaths(config);
+    const missing = [];
+    for (const tool of REQUIRED_TOOLS) {
+        if (!commandAvailable(tool.command, tool.args)) {
+            missing.push(tool.label);
+        }
+    }
+    if (!commandAvailable('npx', ['wrangler', '--version'])) {
+        missing.push('wrangler');
+    }
+    const relayfileBinary = path.join(relayfileRoot, 'bin', 'relayfile');
+    if (!existsSync(relayfileBinary)) {
+        missing.push('relayfile binary');
+    }
+    const d1StatePath = path.join(relayauthRoot, '.wrangler', 'state', 'v3', 'd1');
+    if (!existsSync(d1StatePath)) {
+        missing.push('D1 database');
+    }
+    const distPath = path.join(relayauthRoot, 'packages', 'sdk', 'dist', 'index.js');
+    if (!existsSync(distPath)) {
+        missing.push('relayauth SDK build (run `npx turbo build` in relayauth root)');
+    }
+    return {
+        ok: missing.length === 0,
+        missing,
+    };
+}
+//# sourceMappingURL=prereqs.js.map

package/dist/src/cli/commands/on/prereqs.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"prereqs.js","sourceRoot":"","sources":["../../../../../src/cli/commands/on/prereqs.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,SAAS,EAAE,MAAM,oBAAoB,CAAC;AAC/C,OAAO,EAAE,UAAU,EAAE,SAAS,EAAE,YAAY,EAAE,MAAM,SAAS,CAAC;AAC9D,OAAO,IAAI,MAAM,WAAW,CAAC;AAiB7B,MAAM,cAAc,GAA8D;IAChF,EAAE,OAAO,EAAE,MAAM,EAAE,IAAI,EAAE,CAAC,WAAW,CAAC,EAAE,KAAK,EAAE,MAAM,EAAE;IACvD,EAAE,OAAO,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,WAAW,CAAC,EAAE,KAAK,EAAE,KAAK,EAAE;IACrD,EAAE,OAAO,EAAE,IAAI,EAAE,IAAI,EAAE,CAAC,SAAS,CAAC,EAAE,KAAK,EAAE,IAAI,EAAE;CAClD,CAAC;AAEF,SAAS,YAAY,CAAC,KAAc;IAClC,IAAI,CAAC,KAAK,IAAI,OAAO,KAAK,KAAK,QAAQ,EAAE,CAAC;QACxC,OAAO,KAAK,CAAC;IACf,CAAC;IAED,MAAM,SAAS,GAAG,KAAgC,CAAC;IACnD,OAAO,CACL,OAAO,SAAS,CAAC,aAAa,KAAK,QAAQ;QAC3C,OAAO,SAAS,CAAC,aAAa,KAAK,QAAQ,CAC5C,CAAC;AACJ,CAAC;AAED,SAAS,gBAAgB;IACvB,MAAM,UAAU,GAAG,IAAI,CAAC,OAAO,CAAC,QAAQ,EAAE,aAAa,CAAC,CAAC;IACzD,IAAI,CAAC,UAAU,CAAC,UAAU,CAAC,EAAE,CAAC;QAC5B,OAAO,EAAE,CAAC;IACZ,CAAC;IAED,IAAI,CAAC;QACH,MAAM,GAAG,GAAG,YAAY,CAAC,UAAU,EAAE,OAAO,CAAC,CAAC;QAC9C,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAA4B,CAAC;QAC1D,MAAM,IAAI,GACR,MAAM,IAAI,OAAO,MAAM,KAAK,QAAQ,IAAI,MAAM,IAAI,MAAM,IAAI,OAAO,MAAM,CAAC,IAAI,KAAK,QAAQ;YACzF,CAAC,CAAE,MAAM,CAAC,IAAgC;YAC1C,CAAC,CAAC,MAAM,CAAC;QAEb,OAAO;YACL,aAAa,EACX,OAAO,IAAI,CAAC,cAAc,KAAK,QAAQ;gBACrC,CAAC,CAAC,IAAI,CAAC,cAAc;gBACrB,CAAC,CAAC,OAAO,IAAI,CAAC,aAAa,KAAK,QAAQ;oBACtC,CAAC,CAAC,IAAI,CAAC,aAAa;oBACpB,CAAC,CAAC,SAAS;YACjB,aAAa,EACX,OAAO,IAAI,CAAC,cAAc,KAAK,QAAQ;gBACrC,CAAC,CAAC,IAAI,CAAC,cAAc;gBACrB,CAAC,CAAC,OAAO,IAAI,CAAC,aAAa,KAAK,QAAQ;oBACtC,CAAC,CAAC,IAAI,CAAC,aAAa;oBACpB,CAAC,CAAC,SAAS;SAClB,CAAC;IACJ,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,EAAE,CAAC;IACZ,CAAC;AACH,CAAC;AAED,MAAM,UAAU,kBAAkB,CAAC,SAA4B,EAAE;IAI/D,MAAM,KAAK,GAAG,gBAAgB,EAAE,CAAC;IACjC,MAAM,GAAG,GAAG,OAAO,CAAC,GAAG,EAAE,CAAC;IAE1B,MAAM,mBAAmB,GAAG;QAC1B,MAAM,CAAC,aAAa;QACpB,OAAO,CAAC,GAAG,CAAC,cAAc;QAC1B,KAAK,CAAC,aAAa;QACnB,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,WAAW,CAAC;QAC3B,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,IAAI,EAAE,WAAW,CAAC;QACjC,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,IAAI,EAAE,IAAI,EAAE,WAAW,CAAC;KACxC,CAAC,MAAM,CAAC,CAAC,SAAS,EAAuB,EAAE,CAAC,OAAO,SAAS,KAAK,QAAQ,IAAI,SAAS,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC;IAEpG,MAAM,aAAa,GAAG,IAAI,CAAC,OAAO,CAChC,mBAAmB,CAAC,IAAI,CAAC,CAAC,SAAS,EAAE,EAAE,CAAC,UAAU,CAAC,SAAS,CAAC,CAAC,IAAI,mBAAmB,CAAC,CAAC,CAAC,IAAI,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,WAAW,CAAC,CACxH,CAAC;IAEF,OAAO;QACL,aAAa;QACb,aAAa,EAAE,IAAI,CAAC,OAAO,CACzB,MAAM,CAAC,aAAa;YAClB,OAAO,CAAC,GAAG,CAAC,cAAc;YAC1B,KAAK,CAAC,aAAa;YACnB,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,OAAO,CAAC,aAAa,CAAC,EAAE,WAAW,CAAC,CACtD;KACF,CAAC;AACJ,CAAC;AAED,SAAS,gBAAgB,CAAC,OAAe,EAAE,IAAc;IACvD,MAAM,MAAM,GAAG,SAAS,CAAC,OAAO,EAAE,IAAI,EAAE;QACtC,KAAK,EAAE,QAAQ;KAChB,CAAC,CAAC;IACH,OAAO,MAAM,CAAC,MAAM,KAAK,CAAC,CAAC;AAC7B,CAAC;AAED,SAAS,oBAAoB,CAAC,MAAc;IAC1C,SAAS,CAAC,MAAM,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;AACzC,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,YAAY,CAChC,QAAiB,EAAE,EACnB,OAA2B;IAE3B,MAAM,MAAM,GAAG,YAAY,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,YAAY,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,CAAC;IAClF,MAAM,EAAE,aAAa,EAAE,aAAa,EAAE,GAAG,kBAAkB,CAAC,MAAM,CAAC,CAAC;IACpE,MAAM,OAAO,GAAa,EAAE,CAAC;IAE7B,KAAK,MAAM,IAAI,IAAI,cAAc,EAAE,CAAC;QAClC,IAAI,CAAC,gBAAgB,CAAC,IAAI,CAAC,OAAO,EAAE,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC;YAC/C,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;QAC3B,CAAC;IACH,CAAC;IAED,IAAI,CAAC,gBAAgB,CAAC,KAAK,EAAE,CAAC,UAAU,EAAE,WAAW,CAAC,CAAC,EAAE,CAAC;QACxD,OAAO,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC;IAC3B,CAAC;IAED,MAAM,eAAe,GAAG,IAAI,CAAC,IAAI,CAAC,aAAa,EAAE,KAAK,EAAE,WAAW,CAAC,CAAC;IACrE,IAAI,CAAC,UAAU,CAAC,eAAe,CAAC,EAAE,CAAC;QACjC,OAAO,CAAC,IAAI,CAAC,kBAAkB,CAAC,CAAC;IACnC,CAAC;IAED,MAAM,WAAW,GAAG,IAAI,CAAC,IAAI,CAAC,aAAa,EAAE,WAAW,EAAE,OAAO,EAAE,IAAI,EAAE,IAAI,CAAC,CAAC;IAC/E,IAAI,CAAC,UAAU,CAAC,WAAW,CAAC,EAAE,CAAC;QAC7B,OAAO,CAAC,IAAI,CAAC,aAAa,CAAC,CAAC;IAC9B,CAAC;IAED,MAAM,QAAQ,GAAG,IAAI,CAAC,IAAI,CAAC,aAAa,EAAE,UAAU,EAAE,KAAK,EAAE,MAAM,EAAE,UAAU,CAAC,CAAC;IACjF,IAAI,CAAC,UAAU,CAAC,QAAQ,CAAC,EAAE,CAAC;QAC1B,OAAO,CAAC,IAAI,CAAC,+DAA+D,CAAC,CAAC;IAChF,CAAC;IAED,OAAO;QACL,EAAE,EAAE,OAAO,CAAC,MAAM,KAAK,CAAC;QACxB,OAAO;KACR,CAAC;AACJ,CAAC"}

package/dist/src/cli/commands/on/provision.d.ts

@@ -0,0 +1,22 @@
+interface ProvisionConfig {
+    relayauthRoot: string;
+    relayfileRoot: string;
+    secret: string;
+    workspace: string;
+    projectDir: string;
+    portAuth: number;
+    portFile: number;
+}
+interface ProvisionResult {
+    agents: Array<{
+        name: string;
+        tokenPath: string;
+        scopes: string[];
+    }>;
+    ignoredCount: number;
+    readonlyCount: number;
+    seededCount: number;
+}
+export declare function provision(config: ProvisionConfig): Promise<ProvisionResult>;
+export {};
+//# sourceMappingURL=provision.d.ts.map

package/dist/src/cli/commands/on/provision.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"provision.d.ts","sourceRoot":"","sources":["../../../../../src/cli/commands/on/provision.ts"],"names":[],"mappings":"AAOA,UAAU,eAAe;IACvB,aAAa,EAAE,MAAM,CAAC;IACtB,aAAa,EAAE,MAAM,CAAC;IACtB,MAAM,EAAE,MAAM,CAAC;IACf,SAAS,EAAE,MAAM,CAAC;IAClB,UAAU,EAAE,MAAM,CAAC;IACnB,QAAQ,EAAE,MAAM,CAAC;IACjB,QAAQ,EAAE,MAAM,CAAC;CAClB;AAED,UAAU,eAAe;IACvB,MAAM,EAAE,KAAK,CAAC;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,SAAS,EAAE,MAAM,CAAC;QAAC,MAAM,EAAE,MAAM,EAAE,CAAA;KAAE,CAAC,CAAC;IACrE,YAAY,EAAE,MAAM,CAAC;IACrB,aAAa,EAAE,MAAM,CAAC;IACtB,WAAW,EAAE,MAAM,CAAC;CACrB;AA4FD,wBAAsB,SAAS,CAAC,MAAM,EAAE,eAAe,GAAG,OAAO,CAAC,eAAe,CAAC,CA4HjF"}

package/dist/src/cli/commands/on/provision.js

@@ -0,0 +1,157 @@
+import fs from 'node:fs';
+import path from 'node:path';
+import { parse as parseYaml } from 'yaml';
+import { createWorkspace, seedAclRules, seedWorkspace as seedWorkspaceFiles } from './workspace.js';
+import { compileDotfiles, discoverAgents as discoverAgentsFromCore, hasDotfiles as hasDotfilesFromCore } from './dotfiles.js';
+import { mintToken } from './token.js';
+const DEFAULT_ADMIN_SCOPES = [
+    'relayauth:*:manage:*',
+    'relayauth:*:read:*',
+    'relayfile:*:*:*',
+    'fs:read',
+    'fs:write',
+    'sync:trigger',
+    'ops:read',
+    'admin:read',
+];
+function normalizeRoot(dir) {
+    return path.resolve(dir);
+}
+function ensureDir(dirPath) {
+    fs.mkdirSync(dirPath, { recursive: true });
+}
+function discoverAgents(projectDir) {
+    const discovered = discoverAgentsFromCore(projectDir);
+    return discovered.length > 0 ? discovered : ['default-agent'];
+}
+function hasDotfiles(projectDir) {
+    return hasDotfilesFromCore(projectDir);
+}
+function compileAgent(projectDir, workspace, agentName) {
+    return compileDotfiles(projectDir, agentName, workspace);
+}
+function parseConfigPayload(configPath) {
+    const raw = fs.readFileSync(configPath, 'utf8');
+    try {
+        const parsed = path.extname(configPath).toLowerCase() === '.json'
+            ? JSON.parse(raw)
+            : parseYaml(raw);
+        if (!parsed || typeof parsed !== 'object' || Array.isArray(parsed)) {
+            return {};
+        }
+        return parsed;
+    }
+    catch (error) {
+        throw new Error(`Failed to parse relay config at ${configPath}: ${String(error)}`);
+    }
+}
+function parseConfigAclCount(configPath) {
+    const parsed = parseConfigPayload(configPath);
+    return Object.keys(parsed.acl ?? {}).length;
+}
+function mergeAcl(target, source) {
+    for (const [directory, rules] of Object.entries(source)) {
+        const current = new Set(target[directory] ?? []);
+        for (const rule of rules) {
+            current.add(rule);
+        }
+        target[directory] = [...current].sort();
+    }
+}
+function tokenForScope(secret, subject, agentName, workspace, scopes) {
+    const token = mintToken({
+        secret,
+        agentName,
+        workspace,
+        scopes,
+    });
+    if (!token) {
+        throw new Error(`failed to mint token for ${subject}`);
+    }
+    return token;
+}
+export async function provision(config) {
+    const projectDir = normalizeRoot(config.projectDir);
+    const relayfileBaseUrl = `http://127.0.0.1:${config.portFile}`;
+    ensureDir(path.join(projectDir, '.relay'));
+    ensureDir(path.join(projectDir, '.relay', 'tokens'));
+    ensureDir(path.join(projectDir, '.relay', 'generated'));
+    const discoveredAgents = discoverAgents(projectDir);
+    const discoveredHasDotfiles = hasDotfiles(projectDir);
+    const mergedAcl = {};
+    const agentSummaries = [];
+    const agentResults = [];
+    let ignoredCount = 0;
+    let readonlyCount = 0;
+    let readwriteCount = 0;
+    const adminToken = tokenForScope(config.secret, 'relay-admin', 'relay-admin', config.workspace, DEFAULT_ADMIN_SCOPES);
+    for (const agentName of discoveredAgents) {
+        const compiled = compileAgent(projectDir, config.workspace, agentName);
+        const agentToken = tokenForScope(config.secret, `agent_${agentName}`, agentName, config.workspace, compiled.scopes);
+        const tokenPath = path.join(projectDir, '.relay', 'tokens', `${agentName}.jwt`);
+        fs.writeFileSync(tokenPath, `${agentToken}\n`, { encoding: 'utf8', mode: 0o600 });
+        agentResults.push({
+            name: agentName,
+            tokenPath,
+            scopes: compiled.scopes,
+        });
+        ignoredCount += compiled.summary.ignored;
+        readonlyCount += compiled.summary.readonly;
+        readwriteCount += compiled.summary.readwrite;
+        agentSummaries.push({
+            name: agentName,
+            summary: {
+                ignored: compiled.summary.ignored,
+                readonly: compiled.summary.readonly,
+                readwrite: compiled.summary.readwrite,
+            },
+        });
+        mergeAcl(mergedAcl, compiled.acl);
+    }
+    try {
+        await createWorkspace(relayfileBaseUrl, adminToken, config.workspace);
+    }
+    catch (error) {
+        // Workspace creation is optional for local seeding, but log auth failures
+        // to prevent silent token leaks in subsequent seedWorkspaceFiles calls.
+        const status = error.status;
+        if (status === 401 || status === 403) {
+            throw new Error(`Workspace creation failed with auth error (HTTP ${status}). Aborting to prevent token misuse.`);
+        }
+    }
+    const seededCount = await seedWorkspaceFiles(relayfileBaseUrl, adminToken, config.workspace, projectDir, ['.relay', '.git', 'node_modules']);
+    if (discoveredHasDotfiles) {
+        const mergedPayload = {
+            workspace: config.workspace,
+            acl: mergedAcl,
+            summary: {
+                ignored: ignoredCount,
+                readonly: readonlyCount,
+                readwrite: readwriteCount,
+            },
+            agents: agentSummaries,
+        };
+        const bundlePath = path.join(projectDir, '.relay', 'compiled-acl.json');
+        fs.writeFileSync(bundlePath, `${JSON.stringify(mergedPayload, null, 2)}\n`, { encoding: 'utf8' });
+        await seedAclRules(relayfileBaseUrl, adminToken, config.workspace, mergedAcl);
+        const aclSeededCount = Object.keys(mergedAcl).length;
+        return {
+            agents: agentResults,
+            ignoredCount,
+            readonlyCount,
+            seededCount: Math.max(seededCount, aclSeededCount),
+        };
+    }
+    let configSeededCount = seededCount;
+    const relayConfigPath = path.join(projectDir, 'relay.yaml');
+    if (fs.existsSync(relayConfigPath)) {
+        configSeededCount += parseConfigAclCount(relayConfigPath);
+    }
+    return {
+        agents: agentResults,
+        ignoredCount,
+        readonlyCount,
+        seededCount: configSeededCount,
+    };
+}
+//# sourceMappingURL=provision.js.map

package/dist/src/cli/commands/on/provision.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"provision.js","sourceRoot":"","sources":["../../../../../src/cli/commands/on/provision.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,MAAM,SAAS,CAAC;AACzB,OAAO,IAAI,MAAM,WAAW,CAAC;AAC7B,OAAO,EAAE,KAAK,IAAI,SAAS,EAAE,MAAM,MAAM,CAAC;AAC1C,OAAO,EAAE,eAAe,EAAE,YAAY,EAAE,aAAa,IAAI,kBAAkB,EAAE,MAAM,gBAAgB,CAAC;AACpG,OAAO,EAAE,eAAe,EAAE,cAAc,IAAI,sBAAsB,EAAE,WAAW,IAAI,mBAAmB,EAAE,MAAM,eAAe,CAAC;AAC9H,OAAO,EAAE,SAAS,EAAE,MAAM,YAAY,CAAC;AAuBvC,MAAM,oBAAoB,GAAG;IAC3B,sBAAsB;IACtB,oBAAoB;IACpB,iBAAiB;IACjB,SAAS;IACT,UAAU;IACV,cAAc;IACd,UAAU;IACV,YAAY;CACb,CAAC;AAEF,SAAS,aAAa,CAAC,GAAW;IAChC,OAAO,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;AAC3B,CAAC;AAED,SAAS,SAAS,CAAC,OAAe;IAChC,EAAE,CAAC,SAAS,CAAC,OAAO,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;AAC7C,CAAC;AAED,SAAS,cAAc,CAAC,UAAkB;IACxC,MAAM,UAAU,GAAG,sBAAsB,CAAC,UAAU,CAAC,CAAC;IACtD,OAAO,UAAU,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC,eAAe,CAAC,CAAC;AAChE,CAAC;AAED,SAAS,WAAW,CAAC,UAAkB;IACrC,OAAO,mBAAmB,CAAC,UAAU,CAAC,CAAC;AACzC,CAAC;AAED,SAAS,YAAY,CAAC,UAAkB,EAAE,SAAiB,EAAE,SAAiB;IAC5E,OAAO,eAAe,CAAC,UAAU,EAAE,SAAS,EAAE,SAAS,CAAC,CAAC;AAC3D,CAAC;AAED,SAAS,kBAAkB,CAAC,UAAkB;IAC5C,MAAM,GAAG,GAAG,EAAE,CAAC,YAAY,CAAC,UAAU,EAAE,MAAM,CAAC,CAAC;IAEhD,IAAI,CAAC;QACH,MAAM,MAAM,GACV,IAAI,CAAC,OAAO,CAAC,UAAU,CAAC,CAAC,WAAW,EAAE,KAAK,OAAO;YAChD,CAAC,CAAE,IAAI,CAAC,KAAK,CAAC,GAAG,CAAa;YAC9B,CAAC,CAAE,SAAS,CAAC,GAAG,CAAa,CAAC;QAElC,IAAI,CAAC,MAAM,IAAI,OAAO,MAAM,KAAK,QAAQ,IAAI,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC,EAAE,CAAC;YACnE,OAAO,EAAE,CAAC;QACZ,CAAC;QAED,OAAO,MAA4B,CAAC;IACtC,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,MAAM,IAAI,KAAK,CAAC,mCAAmC,UAAU,KAAK,MAAM,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC;IACrF,CAAC;AACH,CAAC;AAED,SAAS,mBAAmB,CAAC,UAAkB;IAC7C,MAAM,MAAM,GAAG,kBAAkB,CAAC,UAAU,CAAC,CAAC;IAC9C,OAAO,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,GAAG,IAAI,EAAE,CAAC,CAAC,MAAM,CAAC;AAC9C,CAAC;AAED,SAAS,QAAQ,CAAC,MAAgC,EAAE,MAAgC;IAClF,KAAK,MAAM,CAAC,SAAS,EAAE,KAAK,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,MAAM,CAAC,EAAE,CAAC;QACxD,MAAM,OAAO,GAAG,IAAI,GAAG,CAAS,MAAM,CAAC,SAAS,CAAC,IAAI,EAAE,CAAC,CAAC;QACzD,KAAK,MAAM,IAAI,IAAI,KAAK,EAAE,CAAC;YACzB,OAAO,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;QACpB,CAAC;QACD,MAAM,CAAC,SAAS,CAAC,GAAG,CAAC,GAAG,OAAO,CAAC,CAAC,IAAI,EAAE,CAAC;IAC1C,CAAC;AACH,CAAC;AAED,SAAS,aAAa,CACpB,MAAc,EACd,OAAe,EACf,SAAiB,EACjB,SAAiB,EACjB,MAAgB;IAEhB,MAAM,KAAK,GAAG,SAAS,CAAC;QACtB,MAAM;QACN,SAAS;QACT,SAAS;QACT,MAAM;KACP,CAAC,CAAC;IACH,IAAI,CAAC,KAAK,EAAE,CAAC;QACX,MAAM,IAAI,KAAK,CAAC,4BAA4B,OAAO,EAAE,CAAC,CAAC;IACzD,CAAC;IACD,OAAO,KAAK,CAAC;AACf,CAAC;AAGD,MAAM,CAAC,KAAK,UAAU,SAAS,CAAC,MAAuB;IACrD,MAAM,UAAU,GAAG,aAAa,CAAC,MAAM,CAAC,UAAU,CAAC,CAAC;IACpD,MAAM,gBAAgB,GAAG,oBAAoB,MAAM,CAAC,QAAQ,EAAE,CAAC;IAE/D,SAAS,CAAC,IAAI,CAAC,IAAI,CAAC,UAAU,EAAE,QAAQ,CAAC,CAAC,CAAC;IAC3C,SAAS,CAAC,IAAI,CAAC,IAAI,CAAC,UAAU,EAAE,QAAQ,EAAE,QAAQ,CAAC,CAAC,CAAC;IACrD,SAAS,CAAC,IAAI,CAAC,IAAI,CAAC,UAAU,EAAE,QAAQ,EAAE,WAAW,CAAC,CAAC,CAAC;IAExD,MAAM,gBAAgB,GAAG,cAAc,CAAC,UAAU,CAAC,CAAC;IACpD,MAAM,qBAAqB,GAAG,WAAW,CAAC,UAAU,CAAC,CAAC;IAEtD,MAAM,SAAS,GAA6B,EAAE,CAAC;IAC/C,MAAM,cAAc,GAOf,EAAE,CAAC;IACR,MAAM,YAAY,GAAiE,EAAE,CAAC;IACtF,IAAI,YAAY,GAAG,CAAC,CAAC;IACrB,IAAI,aAAa,GAAG,CAAC,CAAC;IACtB,IAAI,cAAc,GAAG,CAAC,CAAC;IAEvB,MAAM,UAAU,GAAG,aAAa,CAC9B,MAAM,CAAC,MAAM,EACb,aAAa,EACb,aAAa,EACb,MAAM,CAAC,SAAS,EAChB,oBAAoB,CACrB,CAAC;IAEF,KAAK,MAAM,SAAS,IAAI,gBAAgB,EAAE,CAAC;QACzC,MAAM,QAAQ,GAAG,YAAY,CAAC,UAAU,EAAE,MAAM,CAAC,SAAS,EAAE,SAAS,CAAC,CAAC;QACvE,MAAM,UAAU,GAAG,aAAa,CAC9B,MAAM,CAAC,MAAM,EACb,SAAS,SAAS,EAAE,EACpB,SAAS,EACT,MAAM,CAAC,SAAS,EAChB,QAAQ,CAAC,MAAM,CAChB,CAAC;QAEF,MAAM,SAAS,GAAG,IAAI,CAAC,IAAI,CAAC,UAAU,EAAE,QAAQ,EAAE,QAAQ,EAAE,GAAG,SAAS,MAAM,CAAC,CAAC;QAChF,EAAE,CAAC,aAAa,CAAC,SAAS,EAAE,GAAG,UAAU,IAAI,EAAE,EAAE,QAAQ,EAAE,MAAM,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC;QAElF,YAAY,CAAC,IAAI,CAAC;YAChB,IAAI,EAAE,SAAS;YACf,SAAS;YACT,MAAM,EAAE,QAAQ,CAAC,MAAM;SACxB,CAAC,CAAC;QAEH,YAAY,IAAI,QAAQ,CAAC,OAAO,CAAC,OAAO,CAAC;QACzC,aAAa,IAAI,QAAQ,CAAC,OAAO,CAAC,QAAQ,CAAC;QAC3C,cAAc,IAAI,QAAQ,CAAC,OAAO,CAAC,SAAS,CAAC;QAC7C,cAAc,CAAC,IAAI,CAAC;YAClB,IAAI,EAAE,SAAS;YACf,OAAO,EAAE;gBACP,OAAO,EAAE,QAAQ,CAAC,OAAO,CAAC,OAAO;gBACjC,QAAQ,EAAE,QAAQ,CAAC,OAAO,CAAC,QAAQ;gBACnC,SAAS,EAAE,QAAQ,CAAC,OAAO,CAAC,SAAS;aACtC;SACF,CAAC,CAAC;QACH,QAAQ,CAAC,SAAS,EAAE,QAAQ,CAAC,GAAG,CAAC,CAAC;IACpC,CAAC;IAED,IAAI,CAAC;QACH,MAAM,eAAe,CACnB,gBAAgB,EAChB,UAAU,EACV,MAAM,CAAC,SAAS,CACjB,CAAC;IACJ,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,0EAA0E;QAC1E,wEAAwE;QACxE,MAAM,MAAM,GAAI,KAA6B,CAAC,MAAM,CAAC;QACrD,IAAI,MAAM,KAAK,GAAG,IAAI,MAAM,KAAK,GAAG,EAAE,CAAC;YACrC,MAAM,IAAI,KAAK,CAAC,mDAAmD,MAAM,sCAAsC,CAAC,CAAC;QACnH,CAAC;IACH,CAAC;IACD,MAAM,WAAW,GAAG,MAAM,kBAAkB,CAC1C,gBAAgB,EAChB,UAAU,EACV,MAAM,CAAC,SAAS,EAChB,UAAU,EACV,CAAC,QAAQ,EAAE,MAAM,EAAE,cAAc,CAAC,CACnC,CAAC;IACF,IAAI,qBAAqB,EAAE,CAAC;QAC1B,MAAM,aAAa,GAAG;YACpB,SAAS,EAAE,MAAM,CAAC,SAAS;YAC3B,GAAG,EAAE,SAAS;YACd,OAAO,EAAE;gBACP,OAAO,EAAE,YAAY;gBACrB,QAAQ,EAAE,aAAa;gBACvB,SAAS,EAAE,cAAc;aAC1B;YACD,MAAM,EAAE,cAAc;SACvB,CAAC;QAEF,MAAM,UAAU,GAAG,IAAI,CAAC,IAAI,CAAC,UAAU,EAAE,QAAQ,EAAE,mBAAmB,CAAC,CAAC;QACxE,EAAE,CAAC,aAAa,CAAC,UAAU,EAAE,GAAG,IAAI,CAAC,SAAS,CAAC,aAAa,EAAE,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,EAAE,QAAQ,EAAE,MAAM,EAAE,CAAC,CAAC;QAClG,MAAM,YAAY,CAAC,gBAAgB,EAAE,UAAU,EAAE,MAAM,CAAC,SAAS,EAAE,SAAS,CAAC,CAAC;QAC9E,MAAM,cAAc,GAAG,MAAM,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC,MAAM,CAAC;QAErD,OAAO;YACL,MAAM,EAAE,YAAY;YACpB,YAAY;YACZ,aAAa;YACb,WAAW,EAAE,IAAI,CAAC,GAAG,CAAC,WAAW,EAAE,cAAc,CAAC;SACnD,CAAC;IACJ,CAAC;IAED,IAAI,iBAAiB,GAAG,WAAW,CAAC;IACpC,MAAM,eAAe,GAAG,IAAI,CAAC,IAAI,CAAC,UAAU,EAAE,YAAY,CAAC,CAAC;IAC5D,IAAI,EAAE,CAAC,UAAU,CAAC,eAAe,CAAC,EAAE,CAAC;QACnC,iBAAiB,IAAI,mBAAmB,CAAC,eAAe,CAAC,CAAC;IAC5D,CAAC;IAED,OAAO;QACL,MAAM,EAAE,YAAY;QACpB,YAAY;QACZ,aAAa;QACb,WAAW,EAAE,iBAAiB;KAC/B,CAAC;AACJ,CAAC"}

package/dist/src/cli/commands/on/scan.d.ts

@@ -0,0 +1,8 @@
+interface ScanDependencies {
+    projectDir?: string;
+    workspace?: string;
+    log?: (...args: unknown[]) => void;
+}
+export declare function scanPermissions(deps?: ScanDependencies): Promise<void>;
+export {};
+//# sourceMappingURL=scan.d.ts.map

package/dist/src/cli/commands/on/scan.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"scan.d.ts","sourceRoot":"","sources":["../../../../../src/cli/commands/on/scan.ts"],"names":[],"mappings":"AAGA,UAAU,gBAAgB;IACxB,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,GAAG,CAAC,EAAE,CAAC,GAAG,IAAI,EAAE,OAAO,EAAE,KAAK,IAAI,CAAC;CACpC;AAUD,wBAAsB,eAAe,CAAC,IAAI,GAAE,gBAAqB,GAAG,OAAO,CAAC,IAAI,CAAC,CAqDhF"}

package/dist/src/cli/commands/on/scan.js

@@ -0,0 +1,59 @@
+import path from 'node:path';
+import { compileDotfiles, discoverAgents, hasDotfiles, parseDotfiles } from './dotfiles.js';
+function defaultLog(...args) {
+    console.log(...args);
+}
+function resolveWorkspaceName(projectDir, explicit) {
+    return explicit ?? path.basename(projectDir);
+}
+export async function scanPermissions(deps = {}) {
+    const projectDir = path.resolve(deps.projectDir ?? process.cwd());
+    const workspace = resolveWorkspaceName(projectDir, deps.workspace);
+    const log = deps.log ?? defaultLog;
+    const hasDotfileConfig = hasDotfiles(projectDir);
+    const discoveredAgents = discoverAgents(projectDir);
+    const agents = discoveredAgents.length > 0 ? discoveredAgents : ['default-agent'];
+    log(`Discovered agents: ${agents.join(', ')}`);
+    if (!hasDotfileConfig && agents.length === 1 && agents[0] === 'default-agent') {
+        log('No dotfile patterns found; defaulting to full readwrite workspace visibility.');
+    }
+    if (agents.length === 0) {
+        return;
+    }
+    for (const agentName of agents) {
+        const parsed = parseDotfiles(projectDir, agentName);
+        const compiled = compileDotfiles(projectDir, agentName, workspace);
+        const ignored = parsed.ignoredPatterns;
+        const readonly = parsed.readonlyPatterns;
+        const writable = compiled.readwritePaths;
+        log(`\n[${agentName}]`);
+        log(`Ignored patterns (${ignored.length}):`);
+        if (ignored.length > 0) {
+            for (const pattern of ignored) {
+                log(`  - ${pattern}`);
+            }
+        }
+        else {
+            log('  - (none)');
+        }
+        log(`Readonly patterns (${readonly.length}):`);
+        if (readonly.length > 0) {
+            for (const pattern of readonly) {
+                log(`  - ${pattern}`);
+            }
+        }
+        else {
+            log('  - (none)');
+        }
+        log(`Writable files (${writable.length}):`);
+        if (writable.length > 0) {
+            for (const file of writable) {
+                log(`  - ${file}`);
+            }
+        }
+        else {
+            log('  - (none)');
+        }
+    }
+}
+//# sourceMappingURL=scan.js.map

package/dist/src/cli/commands/on/scan.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"scan.js","sourceRoot":"","sources":["../../../../../src/cli/commands/on/scan.ts"],"names":[],"mappings":"AAAA,OAAO,IAAI,MAAM,WAAW,CAAC;AAC7B,OAAO,EAAE,eAAe,EAAE,cAAc,EAAE,WAAW,EAAE,aAAa,EAAE,MAAM,eAAe,CAAC;AAQ5F,SAAS,UAAU,CAAC,GAAG,IAAe;IACpC,OAAO,CAAC,GAAG,CAAC,GAAG,IAAI,CAAC,CAAC;AACvB,CAAC;AAED,SAAS,oBAAoB,CAAC,UAAkB,EAAE,QAAiB;IACjE,OAAO,QAAQ,IAAI,IAAI,CAAC,QAAQ,CAAC,UAAU,CAAC,CAAC;AAC/C,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,eAAe,CAAC,OAAyB,EAAE;IAC/D,MAAM,UAAU,GAAG,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,UAAU,IAAI,OAAO,CAAC,GAAG,EAAE,CAAC,CAAC;IAClE,MAAM,SAAS,GAAG,oBAAoB,CAAC,UAAU,EAAE,IAAI,CAAC,SAAS,CAAC,CAAC;IACnE,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,IAAI,UAAU,CAAC;IAEnC,MAAM,gBAAgB,GAAG,WAAW,CAAC,UAAU,CAAC,CAAC;IACjD,MAAM,gBAAgB,GAAG,cAAc,CAAC,UAAU,CAAC,CAAC;IACpD,MAAM,MAAM,GAAG,gBAAgB,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,gBAAgB,CAAC,CAAC,CAAC,CAAC,eAAe,CAAC,CAAC;IAElF,GAAG,CAAC,sBAAsB,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;IAC/C,IAAI,CAAC,gBAAgB,IAAI,MAAM,CAAC,MAAM,KAAK,CAAC,IAAI,MAAM,CAAC,CAAC,CAAC,KAAK,eAAe,EAAE,CAAC;QAC9E,GAAG,CAAC,+EAA+E,CAAC,CAAC;IACvF,CAAC;IACD,IAAI,MAAM,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACxB,OAAO;IACT,CAAC;IAED,KAAK,MAAM,SAAS,IAAI,MAAM,EAAE,CAAC;QAC/B,MAAM,MAAM,GAAG,aAAa,CAAC,UAAU,EAAE,SAAS,CAAC,CAAC;QACpD,MAAM,QAAQ,GAAG,eAAe,CAAC,UAAU,EAAE,SAAS,EAAE,SAAS,CAAC,CAAC;QAEnE,MAAM,OAAO,GAAG,MAAM,CAAC,eAAe,CAAC;QACvC,MAAM,QAAQ,GAAG,MAAM,CAAC,gBAAgB,CAAC;QACzC,MAAM,QAAQ,GAAG,QAAQ,CAAC,cAAc,CAAC;QAEzC,GAAG,CAAC,MAAM,SAAS,GAAG,CAAC,CAAC;QACxB,GAAG,CAAC,qBAAqB,OAAO,CAAC,MAAM,IAAI,CAAC,CAAC;QAC7C,IAAI,OAAO,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YACvB,KAAK,MAAM,OAAO,IAAI,OAAO,EAAE,CAAC;gBAC9B,GAAG,CAAC,OAAO,OAAO,EAAE,CAAC,CAAC;YACxB,CAAC;QACH,CAAC;aAAM,CAAC;YACN,GAAG,CAAC,YAAY,CAAC,CAAC;QACpB,CAAC;QAED,GAAG,CAAC,sBAAsB,QAAQ,CAAC,MAAM,IAAI,CAAC,CAAC;QAC/C,IAAI,QAAQ,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YACxB,KAAK,MAAM,OAAO,IAAI,QAAQ,EAAE,CAAC;gBAC/B,GAAG,CAAC,OAAO,OAAO,EAAE,CAAC,CAAC;YACxB,CAAC;QACH,CAAC;aAAM,CAAC;YACN,GAAG,CAAC,YAAY,CAAC,CAAC;QACpB,CAAC;QAED,GAAG,CAAC,mBAAmB,QAAQ,CAAC,MAAM,IAAI,CAAC,CAAC;QAC5C,IAAI,QAAQ,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YACxB,KAAK,MAAM,IAAI,IAAI,QAAQ,EAAE,CAAC;gBAC5B,GAAG,CAAC,OAAO,IAAI,EAAE,CAAC,CAAC;YACrB,CAAC;QACH,CAAC;aAAM,CAAC;YACN,GAAG,CAAC,YAAY,CAAC,CAAC;QACpB,CAAC;IACH,CAAC;AACH,CAAC"}

package/dist/src/cli/commands/on/services.d.ts

@@ -0,0 +1,17 @@
+export interface ServiceConfig {
+    relayauthRoot: string;
+    relayfileRoot: string;
+    secret: string;
+    portAuth: number;
+    portFile: number;
+    logDir: string;
+}
+export declare function pickFirstString(values: Array<string | undefined>): string;
+export declare function resolveServiceConfig(overrides?: Partial<ServiceConfig>): ServiceConfig;
+export declare function healthCheck(port: number, timeout: number): Promise<boolean>;
+export declare function startServices(config?: Partial<ServiceConfig>): Promise<{
+    authPid: number;
+    filePid: number;
+}>;
+export declare function stopServices(): Promise<void>;
+//# sourceMappingURL=services.d.ts.map

package/dist/src/cli/commands/on/services.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"services.d.ts","sourceRoot":"","sources":["../../../../../src/cli/commands/on/services.ts"],"names":[],"mappings":"AA6BA,MAAM,WAAW,aAAa;IAC5B,aAAa,EAAE,MAAM,CAAC;IACtB,aAAa,EAAE,MAAM,CAAC;IACtB,MAAM,EAAE,MAAM,CAAC;IACf,QAAQ,EAAE,MAAM,CAAC;IACjB,QAAQ,EAAE,MAAM,CAAC;IACjB,MAAM,EAAE,MAAM,CAAC;CAChB;AAkFD,wBAAgB,eAAe,CAAC,MAAM,EAAE,KAAK,CAAC,MAAM,GAAG,SAAS,CAAC,GAAG,MAAM,CAOzE;AAOD,wBAAgB,oBAAoB,CAAC,SAAS,GAAE,OAAO,CAAC,aAAa,CAAM,GAAG,aAAa,CA6D1F;AAoKD,wBAAsB,WAAW,CAAC,IAAI,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC,CAYjF;AAED,wBAAsB,aAAa,CAAC,MAAM,GAAE,OAAO,CAAC,aAAa,CAAM,GAAG,OAAO,CAAC;IAAE,OAAO,EAAE,MAAM,CAAC;IAAC,OAAO,EAAE,MAAM,CAAA;CAAE,CAAC,CAkDtH;AAED,wBAAsB,YAAY,IAAI,OAAO,CAAC,IAAI,CAAC,CAelD"}