agent-relay 4.0.2 → 4.0.4

package/packages/sdk/dist/provisioner/__tests__/compiler.test.js

@@ -0,0 +1,345 @@
+import assert from 'node:assert/strict';
+import { mkdtemp, mkdir, rm, writeFile } from 'node:fs/promises';
+import { tmpdir } from 'node:os';
+import path from 'node:path';
+import test from 'node:test';
+import { compileAgentScopes, globToScopes } from '../compiler.js';
+async function createWorkspace(files) {
+    const dir = await mkdtemp(path.join(tmpdir(), 'relay-provisioner-compiler-'));
+    for (const [relativePath, content] of Object.entries(files)) {
+        const filePath = path.join(dir, relativePath);
+        await mkdir(path.dirname(filePath), { recursive: true });
+        await writeFile(filePath, content);
+    }
+    return {
+        dir,
+        cleanup: () => rm(dir, { recursive: true, force: true }),
+    };
+}
+test('compileAgentScopes applies explicit file permissions', async () => {
+    const workspace = await createWorkspace({
+        'docs/guide.md': '# guide\n',
+        'src/index.ts': 'export const value = 1;\n',
+        'secrets.env': 'TOP_SECRET=1\n',
+    });
+    try {
+        const compiled = compileAgentScopes({
+            agentName: 'builder',
+            workspace: 'relay-test',
+            projectDir: workspace.dir,
+            permissions: {
+                access: 'restricted',
+                inherit: false,
+                files: {
+                    read: ['docs/**'],
+                    write: ['src/**'],
+                    deny: ['secrets.env'],
+                },
+            },
+        });
+        assert.deepEqual(compiled.readonlyPaths, ['docs/guide.md']);
+        assert.deepEqual(compiled.readwritePaths, ['src/index.ts']);
+        assert.deepEqual(compiled.deniedPaths, ['secrets.env']);
+        assert.deepEqual(compiled.scopes, [
+            'relayfile:fs:read:/docs/guide.md',
+            'relayfile:fs:read:/src/index.ts',
+            'relayfile:fs:write:/src/index.ts',
+        ]);
+        assert.deepEqual(compiled.sources, [
+            {
+                type: 'yaml',
+                label: 'permissions.files',
+                ruleCount: 3,
+            },
+        ]);
+    }
+    finally {
+        await workspace.cleanup();
+    }
+});
+test('compileAgentScopes honors the readonly preset', async () => {
+    const workspace = await createWorkspace({
+        'docs/guide.md': '# guide\n',
+        'src/index.ts': 'export const value = 1;\n',
+    });
+    try {
+        const compiled = compileAgentScopes({
+            agentName: 'reader',
+            workspace: 'relay-test',
+            projectDir: workspace.dir,
+            permissions: {
+                access: 'readonly',
+            },
+        });
+        assert.equal(compiled.effectiveAccess, 'readonly');
+        assert.deepEqual(compiled.readonlyPaths, ['docs/guide.md', 'src/index.ts']);
+        assert.deepEqual(compiled.readwritePaths, []);
+        assert.deepEqual(compiled.deniedPaths, []);
+        assert.deepEqual(compiled.readonlyPatterns, ['**']);
+        assert.deepEqual(compiled.readwritePatterns, []);
+        assert.deepEqual(compiled.scopes, [
+            'relayfile:fs:read:/docs/guide.md',
+            'relayfile:fs:read:/src/index.ts',
+        ]);
+    }
+    finally {
+        await workspace.cleanup();
+    }
+});
+test('compileAgentScopes honors the readwrite preset', async () => {
+    const workspace = await createWorkspace({
+        'docs/guide.md': '# guide\n',
+        'src/index.ts': 'export const value = 1;\n',
+    });
+    try {
+        const compiled = compileAgentScopes({
+            agentName: 'writer',
+            workspace: 'relay-test',
+            projectDir: workspace.dir,
+            permissions: {
+                access: 'readwrite',
+            },
+        });
+        assert.equal(compiled.effectiveAccess, 'readwrite');
+        assert.deepEqual(compiled.readonlyPaths, []);
+        assert.deepEqual(compiled.readwritePaths, ['docs/guide.md', 'src/index.ts']);
+        assert.deepEqual(compiled.deniedPaths, []);
+        assert.deepEqual(compiled.readwritePatterns, ['**']);
+        assert.deepEqual(compiled.scopes, [
+            'relayfile:fs:read:/docs/guide.md',
+            'relayfile:fs:read:/src/index.ts',
+            'relayfile:fs:write:/docs/guide.md',
+            'relayfile:fs:write:/src/index.ts',
+        ]);
+    }
+    finally {
+        await workspace.cleanup();
+    }
+});
+test('compileAgentScopes applies deny patterns last', async () => {
+    const workspace = await createWorkspace({
+        'docs/private.md': '# private\n',
+        'docs/public.md': '# public\n',
+        'secrets.env': 'TOP_SECRET=1\n',
+    });
+    try {
+        const compiled = compileAgentScopes({
+            agentName: 'writer',
+            workspace: 'relay-test',
+            projectDir: workspace.dir,
+            permissions: {
+                access: 'full',
+                files: {
+                    deny: ['docs/private.md', 'secrets.env'],
+                },
+            },
+        });
+        assert.equal(compiled.inherited, false);
+        assert.deepEqual(compiled.readonlyPaths, []);
+        assert.deepEqual(compiled.readwritePaths, ['docs/public.md']);
+        assert.deepEqual(compiled.deniedPaths, ['docs/private.md', 'secrets.env']);
+        assert.deepEqual(compiled.deniedPatterns, ['docs/private.md', 'secrets.env']);
+    }
+    finally {
+        await workspace.cleanup();
+    }
+});
+test('compileAgentScopes ignores dotfiles when inherit is false', async () => {
+    const workspace = await createWorkspace({
+        '.agentignore': 'blocked.txt\n',
+        '.agentreadonly': 'locked.txt\n',
+        'blocked.txt': 'blocked\n',
+        'locked.txt': 'locked\n',
+        'open.txt': 'open\n',
+    });
+    try {
+        const compiled = compileAgentScopes({
+            agentName: 'writer',
+            workspace: 'relay-test',
+            projectDir: workspace.dir,
+            permissions: {
+                access: 'readwrite',
+                inherit: false,
+            },
+        });
+        assert.equal(compiled.inherited, false);
+        assert.deepEqual(compiled.sources, [
+            {
+                type: 'preset',
+                label: 'access: readwrite',
+                ruleCount: 2,
+            },
+        ]);
+        assert.deepEqual(compiled.readonlyPaths, []);
+        assert.deepEqual(compiled.readwritePaths, [
+            '.agentignore',
+            '.agentreadonly',
+            'blocked.txt',
+            'locked.txt',
+            'open.txt',
+        ]);
+        assert.deepEqual(compiled.deniedPaths, []);
+    }
+    finally {
+        await workspace.cleanup();
+    }
+});
+test('compileAgentScopes loads dotfiles when inherit is true', async () => {
+    const workspace = await createWorkspace({
+        '.agentignore': 'blocked.txt\n',
+        '.agentreadonly': 'locked.txt\n',
+        'blocked.txt': 'blocked\n',
+        'locked.txt': 'locked\n',
+        'open.txt': 'open\n',
+    });
+    try {
+        const compiled = compileAgentScopes({
+            agentName: 'writer',
+            workspace: 'relay-test',
+            projectDir: workspace.dir,
+            permissions: {
+                access: 'readwrite',
+            },
+        });
+        assert.equal(compiled.inherited, true);
+        assert.deepEqual(compiled.sources, [
+            {
+                type: 'dotfile',
+                label: 'dotfiles',
+                ruleCount: 2,
+            },
+            {
+                type: 'preset',
+                label: 'access: readwrite',
+                ruleCount: 2,
+            },
+        ]);
+        assert.deepEqual(compiled.readonlyPaths, ['locked.txt']);
+        assert.deepEqual(compiled.readwritePaths, ['.agentignore', '.agentreadonly', 'open.txt']);
+        assert.deepEqual(compiled.deniedPaths, ['blocked.txt']);
+        assert.deepEqual(compiled.readonlyPatterns, ['locked.txt']);
+        assert.deepEqual(compiled.deniedPatterns, ['blocked.txt']);
+    }
+    finally {
+        await workspace.cleanup();
+    }
+});
+test('compileAgentScopes appends raw scopes', async () => {
+    const workspace = await createWorkspace({
+        'src/index.ts': 'export const value = 1;\n',
+    });
+    try {
+        const compiled = compileAgentScopes({
+            agentName: 'scoped',
+            workspace: 'relay-test',
+            projectDir: workspace.dir,
+            permissions: {
+                access: 'restricted',
+                inherit: false,
+                scopes: ['relay:custom:deploy', 'relay:custom:audit', 'relay:custom:deploy'],
+            },
+        });
+        assert.deepEqual(compiled.readonlyPaths, []);
+        assert.deepEqual(compiled.readwritePaths, []);
+        assert.deepEqual(compiled.deniedPaths, ['src/index.ts']);
+        assert.deepEqual(compiled.scopes, ['relay:custom:deploy', 'relay:custom:audit']);
+        assert.deepEqual(compiled.summary, {
+            readonly: 0,
+            readwrite: 0,
+            denied: 1,
+            customScopes: 2,
+        });
+        assert.deepEqual(compiled.sources, [
+            {
+                type: 'scope',
+                label: 'permissions.scopes',
+                ruleCount: 2,
+            },
+        ]);
+    }
+    finally {
+        await workspace.cleanup();
+    }
+});
+test('compileAgentScopes lets YAML rules override dotfiles', async () => {
+    const workspace = await createWorkspace({
+        '.agentignore': 'blocked.txt\n',
+        '.agentreadonly': 'locked.txt\n',
+        'blocked.txt': 'blocked\n',
+        'locked.txt': 'locked\n',
+        'plain.txt': 'plain\n',
+    });
+    try {
+        const compiled = compileAgentScopes({
+            agentName: 'override-agent',
+            workspace: 'relay-test',
+            projectDir: workspace.dir,
+            permissions: {
+                access: 'restricted',
+                files: {
+                    read: ['blocked.txt'],
+                    write: ['locked.txt'],
+                },
+            },
+        });
+        assert.deepEqual(compiled.readonlyPaths, ['blocked.txt']);
+        assert.deepEqual(compiled.readwritePaths, ['locked.txt']);
+        assert.deepEqual(compiled.deniedPaths, ['.agentignore', '.agentreadonly', 'plain.txt']);
+        assert.deepEqual(compiled.scopes, [
+            'relayfile:fs:read:/blocked.txt',
+            'relayfile:fs:read:/locked.txt',
+            'relayfile:fs:write:/locked.txt',
+        ]);
+        assert.deepEqual(compiled.sources, [
+            {
+                type: 'dotfile',
+                label: 'dotfiles',
+                ruleCount: 2,
+            },
+            {
+                type: 'yaml',
+                label: 'permissions.files',
+                ruleCount: 2,
+            },
+        ]);
+    }
+    finally {
+        await workspace.cleanup();
+    }
+});
+test('compileAgentScopes defaults empty permissions to inherited readwrite access', async () => {
+    const workspace = await createWorkspace({
+        'docs/guide.md': '# guide\n',
+        'src/index.ts': 'export const value = 1;\n',
+    });
+    try {
+        const compiled = compileAgentScopes({
+            agentName: 'defaulted',
+            workspace: 'relay-test',
+            projectDir: workspace.dir,
+            permissions: {},
+        });
+        assert.equal(compiled.effectiveAccess, 'readwrite');
+        assert.equal(compiled.inherited, true);
+        assert.deepEqual(compiled.readonlyPaths, []);
+        assert.deepEqual(compiled.readwritePaths, ['docs/guide.md', 'src/index.ts']);
+        assert.deepEqual(compiled.deniedPaths, []);
+        assert.deepEqual(compiled.sources, [
+            {
+                type: 'preset',
+                label: 'access: readwrite',
+                ruleCount: 2,
+            },
+        ]);
+    }
+    finally {
+        await workspace.cleanup();
+    }
+});
+test('globToScopes normalizes and de-duplicates globs', () => {
+    assert.deepEqual(globToScopes(['src\\index.ts', './docs/**', '/docs/**', '', ' src/index.ts '], 'write'), [
+        'relayfile:fs:write:/src/index.ts',
+        'relayfile:fs:write:/docs/**',
+    ]);
+});
+//# sourceMappingURL=compiler.test.js.map

package/packages/sdk/dist/provisioner/__tests__/compiler.test.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"compiler.test.js","sourceRoot":"","sources":["../../../src/provisioner/__tests__/compiler.test.ts"],"names":[],"mappings":"AAAA,OAAO,MAAM,MAAM,oBAAoB,CAAC;AACxC,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,EAAE,EAAE,SAAS,EAAE,MAAM,kBAAkB,CAAC;AACjE,OAAO,EAAE,MAAM,EAAE,MAAM,SAAS,CAAC;AACjC,OAAO,IAAI,MAAM,WAAW,CAAC;AAC7B,OAAO,IAAI,MAAM,WAAW,CAAC;AAE7B,OAAO,EAAE,kBAAkB,EAAE,YAAY,EAAE,MAAM,gBAAgB,CAAC;AAElE,KAAK,UAAU,eAAe,CAC5B,KAA6B;IAE7B,MAAM,GAAG,GAAG,MAAM,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,MAAM,EAAE,EAAE,6BAA6B,CAAC,CAAC,CAAC;IAE9E,KAAK,MAAM,CAAC,YAAY,EAAE,OAAO,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,KAAK,CAAC,EAAE,CAAC;QAC5D,MAAM,QAAQ,GAAG,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,YAAY,CAAC,CAAC;QAC9C,MAAM,KAAK,CAAC,IAAI,CAAC,OAAO,CAAC,QAAQ,CAAC,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;QACzD,MAAM,SAAS,CAAC,QAAQ,EAAE,OAAO,CAAC,CAAC;IACrC,CAAC;IAED,OAAO;QACL,GAAG;QACH,OAAO,EAAE,GAAG,EAAE,CAAC,EAAE,CAAC,GAAG,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC;KACzD,CAAC;AACJ,CAAC;AAED,IAAI,CAAC,sDAAsD,EAAE,KAAK,IAAI,EAAE;IACtE,MAAM,SAAS,GAAG,MAAM,eAAe,CAAC;QACtC,eAAe,EAAE,WAAW;QAC5B,cAAc,EAAE,2BAA2B;QAC3C,aAAa,EAAE,gBAAgB;KAChC,CAAC,CAAC;IAEH,IAAI,CAAC;QACH,MAAM,QAAQ,GAAG,kBAAkB,CAAC;YAClC,SAAS,EAAE,SAAS;YACpB,SAAS,EAAE,YAAY;YACvB,UAAU,EAAE,SAAS,CAAC,GAAG;YACzB,WAAW,EAAE;gBACX,MAAM,EAAE,YAAY;gBACpB,OAAO,EAAE,KAAK;gBACd,KAAK,EAAE;oBACL,IAAI,EAAE,CAAC,SAAS,CAAC;oBACjB,KAAK,EAAE,CAAC,QAAQ,CAAC;oBACjB,IAAI,EAAE,CAAC,aAAa,CAAC;iBACtB;aACF;SACF,CAAC,CAAC;QAEH,MAAM,CAAC,SAAS,CAAC,QAAQ,CAAC,aAAa,EAAE,CAAC,eAAe,CAAC,CAAC,CAAC;QAC5D,MAAM,CAAC,SAAS,CAAC,QAAQ,CAAC,cAAc,EAAE,CAAC,cAAc,CAAC,CAAC,CAAC;QAC5D,MAAM,CAAC,SAAS,CAAC,QAAQ,CAAC,WAAW,EAAE,CAAC,aAAa,CAAC,CAAC,CAAC;QACxD,MAAM,CAAC,SAAS,CAAC,QAAQ,CAAC,MAAM,EAAE;YAChC,kCAAkC;YAClC,iCAAiC;YACjC,kCAAkC;SACnC,CAAC,CAAC;QACH,MAAM,CAAC,SAAS,CAAC,QAAQ,CAAC,OAAO,EAAE;YACjC;gBACE,IAAI,EAAE,MAAM;gBACZ,KAAK,EAAE,mBAAmB;gBAC1B,SAAS,EAAE,CAAC;aACb;SACF,CAAC,CAAC;IACL,CAAC;YAAS,CAAC;QACT,MAAM,SAAS,CAAC,OAAO,EAAE,CAAC;IAC5B,CAAC;AACH,CAAC,CAAC,CAAC;AAEH,IAAI,CAAC,+CAA+C,EAAE,KAAK,IAAI,EAAE;IAC/D,MAAM,SAAS,GAAG,MAAM,eAAe,CAAC;QACtC,eAAe,EAAE,WAAW;QAC5B,cAAc,EAAE,2BAA2B;KAC5C,CAAC,CAAC;IAEH,IAAI,CAAC;QACH,MAAM,QAAQ,GAAG,kBAAkB,CAAC;YAClC,SAAS,EAAE,QAAQ;YACnB,SAAS,EAAE,YAAY;YACvB,UAAU,EAAE,SAAS,CAAC,GAAG;YACzB,WAAW,EAAE;gBACX,MAAM,EAAE,UAAU;aACnB;SACF,CAAC,CAAC;QAEH,MAAM,CAAC,KAAK,CAAC,QAAQ,CAAC,eAAe,EAAE,UAAU,CAAC,CAAC;QACnD,MAAM,CAAC,SAAS,CAAC,QAAQ,CAAC,aAAa,EAAE,CAAC,eAAe,EAAE,cAAc,CAAC,CAAC,CAAC;QAC5E,MAAM,CAAC,SAAS,CAAC,QAAQ,CAAC,cAAc,EAAE,EAAE,CAAC,CAAC;QAC9C,MAAM,CAAC,SAAS,CAAC,QAAQ,CAAC,WAAW,EAAE,EAAE,CAAC,CAAC;QAC3C,MAAM,CAAC,SAAS,CAAC,QAAQ,CAAC,gBAAgB,EAAE,CAAC,IAAI,CAAC,CAAC,CAAC;QACpD,MAAM,CAAC,SAAS,CAAC,QAAQ,CAAC,iBAAiB,EAAE,EAAE,CAAC,CAAC;QACjD,MAAM,CAAC,SAAS,CAAC,QAAQ,CAAC,MAAM,EAAE;YAChC,kCAAkC;YAClC,iCAAiC;SAClC,CAAC,CAAC;IACL,CAAC;YAAS,CAAC;QACT,MAAM,SAAS,CAAC,OAAO,EAAE,CAAC;IAC5B,CAAC;AACH,CAAC,CAAC,CAAC;AAEH,IAAI,CAAC,gDAAgD,EAAE,KAAK,IAAI,EAAE;IAChE,MAAM,SAAS,GAAG,MAAM,eAAe,CAAC;QACtC,eAAe,EAAE,WAAW;QAC5B,cAAc,EAAE,2BAA2B;KAC5C,CAAC,CAAC;IAEH,IAAI,CAAC;QACH,MAAM,QAAQ,GAAG,kBAAkB,CAAC;YAClC,SAAS,EAAE,QAAQ;YACnB,SAAS,EAAE,YAAY;YACvB,UAAU,EAAE,SAAS,CAAC,GAAG;YACzB,WAAW,EAAE;gBACX,MAAM,EAAE,WAAW;aACpB;SACF,CAAC,CAAC;QAEH,MAAM,CAAC,KAAK,CAAC,QAAQ,CAAC,eAAe,EAAE,WAAW,CAAC,CAAC;QACpD,MAAM,CAAC,SAAS,CAAC,QAAQ,CAAC,aAAa,EAAE,EAAE,CAAC,CAAC;QAC7C,MAAM,CAAC,SAAS,CAAC,QAAQ,CAAC,cAAc,EAAE,CAAC,eAAe,EAAE,cAAc,CAAC,CAAC,CAAC;QAC7E,MAAM,CAAC,SAAS,CAAC,QAAQ,CAAC,WAAW,EAAE,EAAE,CAAC,CAAC;QAC3C,MAAM,CAAC,SAAS,CAAC,QAAQ,CAAC,iBAAiB,EAAE,CAAC,IAAI,CAAC,CAAC,CAAC;QACrD,MAAM,CAAC,SAAS,CAAC,QAAQ,CAAC,MAAM,EAAE;YAChC,kCAAkC;YAClC,iCAAiC;YACjC,mCAAmC;YACnC,kCAAkC;SACnC,CAAC,CAAC;IACL,CAAC;YAAS,CAAC;QACT,MAAM,SAAS,CAAC,OAAO,EAAE,CAAC;IAC5B,CAAC;AACH,CAAC,CAAC,CAAC;AAEH,IAAI,CAAC,+CAA+C,EAAE,KAAK,IAAI,EAAE;IAC/D,MAAM,SAAS,GAAG,MAAM,eAAe,CAAC;QACtC,iBAAiB,EAAE,aAAa;QAChC,gBAAgB,EAAE,YAAY;QAC9B,aAAa,EAAE,gBAAgB;KAChC,CAAC,CAAC;IAEH,IAAI,CAAC;QACH,MAAM,QAAQ,GAAG,kBAAkB,CAAC;YAClC,SAAS,EAAE,QAAQ;YACnB,SAAS,EAAE,YAAY;YACvB,UAAU,EAAE,SAAS,CAAC,GAAG;YACzB,WAAW,EAAE;gBACX,MAAM,EAAE,MAAM;gBACd,KAAK,EAAE;oBACL,IAAI,EAAE,CAAC,iBAAiB,EAAE,aAAa,CAAC;iBACzC;aACF;SACF,CAAC,CAAC;QAEH,MAAM,CAAC,KAAK,CAAC,QAAQ,CAAC,SAAS,EAAE,KAAK,CAAC,CAAC;QACxC,MAAM,CAAC,SAAS,CAAC,QAAQ,CAAC,aAAa,EAAE,EAAE,CAAC,CAAC;QAC7C,MAAM,CAAC,SAAS,CAAC,QAAQ,CAAC,cAAc,EAAE,CAAC,gBAAgB,CAAC,CAAC,CAAC;QAC9D,MAAM,CAAC,SAAS,CAAC,QAAQ,CAAC,WAAW,EAAE,CAAC,iBAAiB,EAAE,aAAa,CAAC,CAAC,CAAC;QAC3E,MAAM,CAAC,SAAS,CAAC,QAAQ,CAAC,cAAc,EAAE,CAAC,iBAAiB,EAAE,aAAa,CAAC,CAAC,CAAC;IAChF,CAAC;YAAS,CAAC;QACT,MAAM,SAAS,CAAC,OAAO,EAAE,CAAC;IAC5B,CAAC;AACH,CAAC,CAAC,CAAC;AAEH,IAAI,CAAC,2DAA2D,EAAE,KAAK,IAAI,EAAE;IAC3E,MAAM,SAAS,GAAG,MAAM,eAAe,CAAC;QACtC,cAAc,EAAE,eAAe;QAC/B,gBAAgB,EAAE,cAAc;QAChC,aAAa,EAAE,WAAW;QAC1B,YAAY,EAAE,UAAU;QACxB,UAAU,EAAE,QAAQ;KACrB,CAAC,CAAC;IAEH,IAAI,CAAC;QACH,MAAM,QAAQ,GAAG,kBAAkB,CAAC;YAClC,SAAS,EAAE,QAAQ;YACnB,SAAS,EAAE,YAAY;YACvB,UAAU,EAAE,SAAS,CAAC,GAAG;YACzB,WAAW,EAAE;gBACX,MAAM,EAAE,WAAW;gBACnB,OAAO,EAAE,KAAK;aACf;SACF,CAAC,CAAC;QAEH,MAAM,CAAC,KAAK,CAAC,QAAQ,CAAC,SAAS,EAAE,KAAK,CAAC,CAAC;QACxC,MAAM,CAAC,SAAS,CAAC,QAAQ,CAAC,OAAO,EAAE;YACjC;gBACE,IAAI,EAAE,QAAQ;gBACd,KAAK,EAAE,mBAAmB;gBAC1B,SAAS,EAAE,CAAC;aACb;SACF,CAAC,CAAC;QACH,MAAM,CAAC,SAAS,CAAC,QAAQ,CAAC,aAAa,EAAE,EAAE,CAAC,CAAC;QAC7C,MAAM,CAAC,SAAS,CAAC,QAAQ,CAAC,cAAc,EAAE;YACxC,cAAc;YACd,gBAAgB;YAChB,aAAa;YACb,YAAY;YACZ,UAAU;SACX,CAAC,CAAC;QACH,MAAM,CAAC,SAAS,CAAC,QAAQ,CAAC,WAAW,EAAE,EAAE,CAAC,CAAC;IAC7C,CAAC;YAAS,CAAC;QACT,MAAM,SAAS,CAAC,OAAO,EAAE,CAAC;IAC5B,CAAC;AACH,CAAC,CAAC,CAAC;AAEH,IAAI,CAAC,wDAAwD,EAAE,KAAK,IAAI,EAAE;IACxE,MAAM,SAAS,GAAG,MAAM,eAAe,CAAC;QACtC,cAAc,EAAE,eAAe;QAC/B,gBAAgB,EAAE,cAAc;QAChC,aAAa,EAAE,WAAW;QAC1B,YAAY,EAAE,UAAU;QACxB,UAAU,EAAE,QAAQ;KACrB,CAAC,CAAC;IAEH,IAAI,CAAC;QACH,MAAM,QAAQ,GAAG,kBAAkB,CAAC;YAClC,SAAS,EAAE,QAAQ;YACnB,SAAS,EAAE,YAAY;YACvB,UAAU,EAAE,SAAS,CAAC,GAAG;YACzB,WAAW,EAAE;gBACX,MAAM,EAAE,WAAW;aACpB;SACF,CAAC,CAAC;QAEH,MAAM,CAAC,KAAK,CAAC,QAAQ,CAAC,SAAS,EAAE,IAAI,CAAC,CAAC;QACvC,MAAM,CAAC,SAAS,CAAC,QAAQ,CAAC,OAAO,EAAE;YACjC;gBACE,IAAI,EAAE,SAAS;gBACf,KAAK,EAAE,UAAU;gBACjB,SAAS,EAAE,CAAC;aACb;YACD;gBACE,IAAI,EAAE,QAAQ;gBACd,KAAK,EAAE,mBAAmB;gBAC1B,SAAS,EAAE,CAAC;aACb;SACF,CAAC,CAAC;QACH,MAAM,CAAC,SAAS,CAAC,QAAQ,CAAC,aAAa,EAAE,CAAC,YAAY,CAAC,CAAC,CAAC;QACzD,MAAM,CAAC,SAAS,CAAC,QAAQ,CAAC,cAAc,EAAE,CAAC,cAAc,EAAE,gBAAgB,EAAE,UAAU,CAAC,CAAC,CAAC;QAC1F,MAAM,CAAC,SAAS,CAAC,QAAQ,CAAC,WAAW,EAAE,CAAC,aAAa,CAAC,CAAC,CAAC;QACxD,MAAM,CAAC,SAAS,CAAC,QAAQ,CAAC,gBAAgB,EAAE,CAAC,YAAY,CAAC,CAAC,CAAC;QAC5D,MAAM,CAAC,SAAS,CAAC,QAAQ,CAAC,cAAc,EAAE,CAAC,aAAa,CAAC,CAAC,CAAC;IAC7D,CAAC;YAAS,CAAC;QACT,MAAM,SAAS,CAAC,OAAO,EAAE,CAAC;IAC5B,CAAC;AACH,CAAC,CAAC,CAAC;AAEH,IAAI,CAAC,uCAAuC,EAAE,KAAK,IAAI,EAAE;IACvD,MAAM,SAAS,GAAG,MAAM,eAAe,CAAC;QACtC,cAAc,EAAE,2BAA2B;KAC5C,CAAC,CAAC;IAEH,IAAI,CAAC;QACH,MAAM,QAAQ,GAAG,kBAAkB,CAAC;YAClC,SAAS,EAAE,QAAQ;YACnB,SAAS,EAAE,YAAY;YACvB,UAAU,EAAE,SAAS,CAAC,GAAG;YACzB,WAAW,EAAE;gBACX,MAAM,EAAE,YAAY;gBACpB,OAAO,EAAE,KAAK;gBACd,MAAM,EAAE,CAAC,qBAAqB,EAAE,oBAAoB,EAAE,qBAAqB,CAAC;aAC7E;SACF,CAAC,CAAC;QAEH,MAAM,CAAC,SAAS,CAAC,QAAQ,CAAC,aAAa,EAAE,EAAE,CAAC,CAAC;QAC7C,MAAM,CAAC,SAAS,CAAC,QAAQ,CAAC,cAAc,EAAE,EAAE,CAAC,CAAC;QAC9C,MAAM,CAAC,SAAS,CAAC,QAAQ,CAAC,WAAW,EAAE,CAAC,cAAc,CAAC,CAAC,CAAC;QACzD,MAAM,CAAC,SAAS,CAAC,QAAQ,CAAC,MAAM,EAAE,CAAC,qBAAqB,EAAE,oBAAoB,CAAC,CAAC,CAAC;QACjF,MAAM,CAAC,SAAS,CAAC,QAAQ,CAAC,OAAO,EAAE;YACjC,QAAQ,EAAE,CAAC;YACX,SAAS,EAAE,CAAC;YACZ,MAAM,EAAE,CAAC;YACT,YAAY,EAAE,CAAC;SAChB,CAAC,CAAC;QACH,MAAM,CAAC,SAAS,CAAC,QAAQ,CAAC,OAAO,EAAE;YACjC;gBACE,IAAI,EAAE,OAAO;gBACb,KAAK,EAAE,oBAAoB;gBAC3B,SAAS,EAAE,CAAC;aACb;SACF,CAAC,CAAC;IACL,CAAC;YAAS,CAAC;QACT,MAAM,SAAS,CAAC,OAAO,EAAE,CAAC;IAC5B,CAAC;AACH,CAAC,CAAC,CAAC;AAEH,IAAI,CAAC,sDAAsD,EAAE,KAAK,IAAI,EAAE;IACtE,MAAM,SAAS,GAAG,MAAM,eAAe,CAAC;QACtC,cAAc,EAAE,eAAe;QAC/B,gBAAgB,EAAE,cAAc;QAChC,aAAa,EAAE,WAAW;QAC1B,YAAY,EAAE,UAAU;QACxB,WAAW,EAAE,SAAS;KACvB,CAAC,CAAC;IAEH,IAAI,CAAC;QACH,MAAM,QAAQ,GAAG,kBAAkB,CAAC;YAClC,SAAS,EAAE,gBAAgB;YAC3B,SAAS,EAAE,YAAY;YACvB,UAAU,EAAE,SAAS,CAAC,GAAG;YACzB,WAAW,EAAE;gBACX,MAAM,EAAE,YAAY;gBACpB,KAAK,EAAE;oBACL,IAAI,EAAE,CAAC,aAAa,CAAC;oBACrB,KAAK,EAAE,CAAC,YAAY,CAAC;iBACtB;aACF;SACF,CAAC,CAAC;QAEH,MAAM,CAAC,SAAS,CAAC,QAAQ,CAAC,aAAa,EAAE,CAAC,aAAa,CAAC,CAAC,CAAC;QAC1D,MAAM,CAAC,SAAS,CAAC,QAAQ,CAAC,cAAc,EAAE,CAAC,YAAY,CAAC,CAAC,CAAC;QAC1D,MAAM,CAAC,SAAS,CAAC,QAAQ,CAAC,WAAW,EAAE,CAAC,cAAc,EAAE,gBAAgB,EAAE,WAAW,CAAC,CAAC,CAAC;QACxF,MAAM,CAAC,SAAS,CAAC,QAAQ,CAAC,MAAM,EAAE;YAChC,gCAAgC;YAChC,+BAA+B;YAC/B,gCAAgC;SACjC,CAAC,CAAC;QACH,MAAM,CAAC,SAAS,CAAC,QAAQ,CAAC,OAAO,EAAE;YACjC;gBACE,IAAI,EAAE,SAAS;gBACf,KAAK,EAAE,UAAU;gBACjB,SAAS,EAAE,CAAC;aACb;YACD;gBACE,IAAI,EAAE,MAAM;gBACZ,KAAK,EAAE,mBAAmB;gBAC1B,SAAS,EAAE,CAAC;aACb;SACF,CAAC,CAAC;IACL,CAAC;YAAS,CAAC;QACT,MAAM,SAAS,CAAC,OAAO,EAAE,CAAC;IAC5B,CAAC;AACH,CAAC,CAAC,CAAC;AAEH,IAAI,CAAC,6EAA6E,EAAE,KAAK,IAAI,EAAE;IAC7F,MAAM,SAAS,GAAG,MAAM,eAAe,CAAC;QACtC,eAAe,EAAE,WAAW;QAC5B,cAAc,EAAE,2BAA2B;KAC5C,CAAC,CAAC;IAEH,IAAI,CAAC;QACH,MAAM,QAAQ,GAAG,kBAAkB,CAAC;YAClC,SAAS,EAAE,WAAW;YACtB,SAAS,EAAE,YAAY;YACvB,UAAU,EAAE,SAAS,CAAC,GAAG;YACzB,WAAW,EAAE,EAAE;SAChB,CAAC,CAAC;QAEH,MAAM,CAAC,KAAK,CAAC,QAAQ,CAAC,eAAe,EAAE,WAAW,CAAC,CAAC;QACpD,MAAM,CAAC,KAAK,CAAC,QAAQ,CAAC,SAAS,EAAE,IAAI,CAAC,CAAC;QACvC,MAAM,CAAC,SAAS,CAAC,QAAQ,CAAC,aAAa,EAAE,EAAE,CAAC,CAAC;QAC7C,MAAM,CAAC,SAAS,CAAC,QAAQ,CAAC,cAAc,EAAE,CAAC,eAAe,EAAE,cAAc,CAAC,CAAC,CAAC;QAC7E,MAAM,CAAC,SAAS,CAAC,QAAQ,CAAC,WAAW,EAAE,EAAE,CAAC,CAAC;QAC3C,MAAM,CAAC,SAAS,CAAC,QAAQ,CAAC,OAAO,EAAE;YACjC;gBACE,IAAI,EAAE,QAAQ;gBACd,KAAK,EAAE,mBAAmB;gBAC1B,SAAS,EAAE,CAAC;aACb;SACF,CAAC,CAAC;IACL,CAAC;YAAS,CAAC;QACT,MAAM,SAAS,CAAC,OAAO,EAAE,CAAC;IAC5B,CAAC;AACH,CAAC,CAAC,CAAC;AAEH,IAAI,CAAC,iDAAiD,EAAE,GAAG,EAAE;IAC3D,MAAM,CAAC,SAAS,CAAC,YAAY,CAAC,CAAC,eAAe,EAAE,WAAW,EAAE,UAAU,EAAE,EAAE,EAAE,gBAAgB,CAAC,EAAE,OAAO,CAAC,EAAE;QACxG,kCAAkC;QAClC,6BAA6B;KAC9B,CAAC,CAAC;AACL,CAAC,CAAC,CAAC"}

package/packages/sdk/dist/provisioner/__tests__/presets.test.d.ts

@@ -0,0 +1,2 @@
+export {};
+//# sourceMappingURL=presets.test.d.ts.map

package/packages/sdk/dist/provisioner/__tests__/presets.test.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"presets.test.d.ts","sourceRoot":"","sources":["../../../src/provisioner/__tests__/presets.test.ts"],"names":[],"mappings":""}

package/packages/sdk/dist/provisioner/__tests__/presets.test.js

@@ -0,0 +1,23 @@
+import { describe, expect, it } from 'vitest';
+import { defaultPermissionsForPreset, expandAccessPreset } from '../compiler.js';
+describe('expandAccessPreset', () => {
+    it.each([
+        ['readonly', { read: ['**'], write: [], deny: [] }],
+        ['restricted', { read: [], write: [], deny: [] }],
+        ['full', { read: ['**'], write: ['**'], deny: [] }],
+        ['readwrite', { read: ['**'], write: ['**'], deny: [] }],
+    ])('expands %s', (preset, expected) => {
+        expect(expandAccessPreset(preset)).toEqual(expected);
+    });
+});
+describe('defaultPermissionsForPreset', () => {
+    it.each([
+        ['lead', { access: 'full' }],
+        ['worker', { access: 'readwrite' }],
+        ['reviewer', { access: 'readonly' }],
+        ['analyst', { access: 'readonly' }],
+    ])('maps %s to the expected default permissions', (preset, expected) => {
+        expect(defaultPermissionsForPreset(preset)).toEqual(expected);
+    });
+});
+//# sourceMappingURL=presets.test.js.map

package/packages/sdk/dist/provisioner/__tests__/presets.test.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"presets.test.js","sourceRoot":"","sources":["../../../src/provisioner/__tests__/presets.test.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,QAAQ,EAAE,MAAM,EAAE,EAAE,EAAE,MAAM,QAAQ,CAAC;AAE9C,OAAO,EAAE,2BAA2B,EAAE,kBAAkB,EAAE,MAAM,gBAAgB,CAAC;AAEjF,QAAQ,CAAC,oBAAoB,EAAE,GAAG,EAAE;IAClC,EAAE,CAAC,IAAI,CAAC;QACN,CAAC,UAAU,EAAE,EAAE,IAAI,EAAE,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,EAAE,EAAE,IAAI,EAAE,EAAE,EAAE,CAAC;QACnD,CAAC,YAAY,EAAE,EAAE,IAAI,EAAE,EAAE,EAAE,KAAK,EAAE,EAAE,EAAE,IAAI,EAAE,EAAE,EAAE,CAAC;QACjD,CAAC,MAAM,EAAE,EAAE,IAAI,EAAE,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,EAAE,EAAE,CAAC;QACnD,CAAC,WAAW,EAAE,EAAE,IAAI,EAAE,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,EAAE,EAAE,CAAC;KAChD,CAAC,CAAC,YAAY,EAAE,CAAC,MAAM,EAAE,QAAQ,EAAE,EAAE;QAC7C,MAAM,CAAC,kBAAkB,CAAC,MAAM,CAAC,CAAC,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAC;IACvD,CAAC,CAAC,CAAC;AACL,CAAC,CAAC,CAAC;AAEH,QAAQ,CAAC,6BAA6B,EAAE,GAAG,EAAE;IAC3C,EAAE,CAAC,IAAI,CAAC;QACN,CAAC,MAAM,EAAE,EAAE,MAAM,EAAE,MAAM,EAAE,CAAC;QAC5B,CAAC,QAAQ,EAAE,EAAE,MAAM,EAAE,WAAW,EAAE,CAAC;QACnC,CAAC,UAAU,EAAE,EAAE,MAAM,EAAE,UAAU,EAAE,CAAC;QACpC,CAAC,SAAS,EAAE,EAAE,MAAM,EAAE,UAAU,EAAE,CAAC;KAC3B,CAAC,CAAC,6CAA6C,EAAE,CAAC,MAAM,EAAE,QAAQ,EAAE,EAAE;QAC9E,MAAM,CAAC,2BAA2B,CAAC,MAAM,CAAC,CAAC,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAC;IAChE,CAAC,CAAC,CAAC;AACL,CAAC,CAAC,CAAC"}

package/packages/sdk/dist/provisioner/__tests__/seeder.test.d.ts

@@ -0,0 +1,2 @@
+export {};
+//# sourceMappingURL=seeder.test.d.ts.map

package/packages/sdk/dist/provisioner/__tests__/seeder.test.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"seeder.test.d.ts","sourceRoot":"","sources":["../../../src/provisioner/__tests__/seeder.test.ts"],"names":[],"mappings":""}

package/packages/sdk/dist/provisioner/__tests__/seeder.test.js

@@ -0,0 +1,224 @@
+import assert from 'node:assert/strict';
+import { mkdtemp, mkdir, rm, writeFile } from 'node:fs/promises';
+import { tmpdir } from 'node:os';
+import path from 'node:path';
+import test, { afterEach, mock } from 'node:test';
+import { RelayFileClient } from '@relayfile/sdk';
+import { seedAclRules, seedWorkflowAcls, seedWorkspace } from '../seeder.js';
+const originalFetch = globalThis.fetch;
+async function createWorkspace(files) {
+    const dir = await mkdtemp(path.join(tmpdir(), 'relay-seeder-'));
+    for (const [relativePath, content] of Object.entries(files)) {
+        const filePath = path.join(dir, relativePath);
+        await mkdir(path.dirname(filePath), { recursive: true });
+        await writeFile(filePath, content);
+    }
+    return {
+        dir,
+        cleanup: () => rm(dir, { recursive: true, force: true }),
+    };
+}
+function createFetchResponse(body, status = 200) {
+    return {
+        ok: status >= 200 && status < 300,
+        status,
+        async text() {
+            return body;
+        },
+    };
+}
+function parseFetchBody(fetchMock) {
+    assert.equal(fetchMock.mock.calls.length, 1);
+    const [, options] = fetchMock.mock.calls[0].arguments;
+    assert.equal(typeof options.body, 'string');
+    return JSON.parse(options.body);
+}
+afterEach(() => {
+    mock.restoreAll();
+    globalThis.fetch = originalFetch;
+});
+test('seedWorkspace posts the expected HTTP payload after SDK fallback', async () => {
+    const workspace = await createWorkspace({
+        'alpha.txt': 'alpha payload',
+        'binary.bin': Buffer.from([0xff, 0x00, 0x61]),
+        '.relay/ignored.txt': 'skip',
+        '.git/config': 'skip',
+        'node_modules/pkg/index.js': 'skip',
+        'custom-skip/ignored.txt': 'skip',
+        '.relayfile-mount-state.json': '{"skip":true}',
+    });
+    try {
+        mock.method(RelayFileClient.prototype, 'bulkWrite', async () => {
+            throw new Error('fall back to HTTP');
+        });
+        const fetchMock = mock.method(globalThis, 'fetch', async () => createFetchResponse(JSON.stringify({ written: 2, errorCount: 0, errors: [] })));
+        const seededCount = await seedWorkspace('https://relay.example///', 'admin-token', ' workspace-123 ', workspace.dir, ['custom-skip']);
+        assert.equal(seededCount, 2);
+        assert.equal(fetchMock.mock.calls.length, 1);
+        const [url, options] = fetchMock.mock.calls[0].arguments;
+        assert.equal(url, 'https://relay.example/v1/workspaces/workspace-123/fs/bulk');
+        assert.equal(options.method, 'POST');
+        assert.deepEqual(options.headers, {
+            Authorization: 'Bearer admin-token',
+            'Content-Type': 'application/json',
+            'X-Correlation-Id': options.headers && options.headers['X-Correlation-Id'],
+        });
+        assert.match(options.headers['X-Correlation-Id'], /^seed-workspace-workspace-123-\d+-0$/u);
+        const body = parseFetchBody(fetchMock);
+        assert.deepEqual(body.files, [
+            {
+                path: '/alpha.txt',
+                content: 'alpha payload',
+                encoding: 'utf-8',
+            },
+            {
+                path: '/binary.bin',
+                content: Buffer.from([0xff, 0x00, 0x61]).toString('base64'),
+                encoding: 'base64',
+            },
+        ]);
+    }
+    finally {
+        await workspace.cleanup();
+    }
+});
+test('seedAclRules formats ACL files for root and nested directories', async () => {
+    mock.method(RelayFileClient.prototype, 'bulkWrite', async () => {
+        throw new Error('fall back to HTTP');
+    });
+    const fetchMock = mock.method(globalThis, 'fetch', async () => createFetchResponse(JSON.stringify({ written: 2, errorCount: 0, errors: [] })));
+    await seedAclRules('https://relay.example/', 'acl-token', 'workspace-acl', {
+        '/': ['allow:agent:lead:read'],
+        '/docs/': ['allow:agent:writer:write', 'deny:agent:reader'],
+    });
+    const body = parseFetchBody(fetchMock);
+    assert.deepEqual(body.files, [
+        {
+            path: '/.relayfile.acl',
+            content: JSON.stringify({
+                semantics: { permissions: ['allow:agent:lead:read'] },
+            }),
+            encoding: 'utf-8',
+        },
+        {
+            path: '/docs/.relayfile.acl',
+            content: JSON.stringify({
+                semantics: {
+                    permissions: ['allow:agent:writer:write', 'deny:agent:reader'],
+                },
+            }),
+            encoding: 'utf-8',
+        },
+    ]);
+});
+test('seedWorkflowAcls merges multiple agents onto shared directories', async () => {
+    mock.method(RelayFileClient.prototype, 'bulkWrite', async () => {
+        throw new Error('fall back to HTTP');
+    });
+    const fetchMock = mock.method(globalThis, 'fetch', async () => createFetchResponse(JSON.stringify({ written: 2, errorCount: 0, errors: [] })));
+    await seedWorkflowAcls({
+        relayfileUrl: 'https://relay.example',
+        adminToken: 'workflow-token',
+        workspace: 'workflow-merge',
+        agents: [
+            { name: 'qa-reviewer', acl: { src: ['read'] } },
+            { name: 'builder', acl: { 'src\\': ['write'], '/docs/': ['read'] } },
+            { name: 'analyst', acl: { docs: ['read'] } },
+        ],
+    });
+    const body = parseFetchBody(fetchMock);
+    assert.deepEqual(body.files, [
+        {
+            path: '/docs/.relayfile.acl',
+            content: JSON.stringify({
+                semantics: {
+                    permissions: [
+                        'allow:agent:analyst:read',
+                        'allow:agent:builder:read',
+                        'allow:agent:qa-reviewer:read',
+                    ],
+                },
+            }),
+            encoding: 'utf-8',
+        },
+        {
+            path: '/src/.relayfile.acl',
+            content: JSON.stringify({
+                semantics: {
+                    permissions: [
+                        'allow:agent:builder:read',
+                        'allow:agent:builder:write',
+                        'allow:agent:qa-reviewer:read',
+                        'deny:agent:analyst',
+                    ],
+                },
+            }),
+            encoding: 'utf-8',
+        },
+    ]);
+});
+test('seedWorkflowAcls unions deny rules for agents missing directory access', async () => {
+    mock.method(RelayFileClient.prototype, 'bulkWrite', async () => {
+        throw new Error('fall back to HTTP');
+    });
+    const fetchMock = mock.method(globalThis, 'fetch', async () => createFetchResponse(JSON.stringify({ written: 2, errorCount: 0, errors: [] })));
+    await seedWorkflowAcls({
+        relayfileUrl: 'https://relay.example',
+        adminToken: 'workflow-token',
+        workspace: 'workflow-deny',
+        agents: [
+            { name: 'alpha', acl: { src: ['read'] } },
+            { name: 'beta', acl: { docs: ['write'] } },
+        ],
+    });
+    const body = parseFetchBody(fetchMock);
+    assert.deepEqual(body.files, [
+        {
+            path: '/docs/.relayfile.acl',
+            content: JSON.stringify({
+                semantics: {
+                    permissions: ['allow:agent:beta:read', 'allow:agent:beta:write', 'deny:agent:alpha'],
+                },
+            }),
+            encoding: 'utf-8',
+        },
+        {
+            path: '/src/.relayfile.acl',
+            content: JSON.stringify({
+                semantics: {
+                    permissions: ['allow:agent:alpha:read', 'deny:agent:beta'],
+                },
+            }),
+            encoding: 'utf-8',
+        },
+    ]);
+});
+test('seedWorkflowAcls is a no-op when there are no ACL directories to seed', async () => {
+    const bulkWriteMock = mock.method(RelayFileClient.prototype, 'bulkWrite', async () => {
+        throw new Error('bulkWrite should not be called');
+    });
+    const fetchMock = mock.method(globalThis, 'fetch', async () => {
+        throw new Error('fetch should not be called');
+    });
+    await seedWorkflowAcls({
+        relayfileUrl: 'https://relay.example',
+        adminToken: 'workflow-token',
+        workspace: 'workflow-empty',
+        agents: [
+            { name: 'builder', acl: {} },
+            { name: 'qa-reviewer', acl: {} },
+        ],
+    });
+    assert.equal(bulkWriteMock.mock.calls.length, 0);
+    assert.equal(fetchMock.mock.calls.length, 0);
+});
+test('seedAclRules surfaces HTTP failures from the fallback API', async () => {
+    mock.method(RelayFileClient.prototype, 'bulkWrite', async () => {
+        throw new Error('fall back to HTTP');
+    });
+    mock.method(globalThis, 'fetch', async () => createFetchResponse('relay unavailable', 503));
+    await assert.rejects(seedAclRules('https://relay.example', 'acl-token', 'workspace-http', {
+        '/': ['allow:agent:builder:read'],
+    }), new Error('failed to seed workspace workspace-http: HTTP 503 relay unavailable'));
+});
+//# sourceMappingURL=seeder.test.js.map

package/packages/sdk/dist/provisioner/__tests__/seeder.test.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"seeder.test.js","sourceRoot":"","sources":["../../../src/provisioner/__tests__/seeder.test.ts"],"names":[],"mappings":"AAAA,OAAO,MAAM,MAAM,oBAAoB,CAAC;AACxC,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,EAAE,EAAE,SAAS,EAAE,MAAM,kBAAkB,CAAC;AACjE,OAAO,EAAE,MAAM,EAAE,MAAM,SAAS,CAAC;AACjC,OAAO,IAAI,MAAM,WAAW,CAAC;AAC7B,OAAO,IAAI,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,MAAM,WAAW,CAAC;AAElD,OAAO,EAAE,eAAe,EAAE,MAAM,gBAAgB,CAAC;AAEjD,OAAO,EAAE,YAAY,EAAE,gBAAgB,EAAE,aAAa,EAAE,MAAM,cAAc,CAAC;AAQ7E,MAAM,aAAa,GAAG,UAAU,CAAC,KAAK,CAAC;AAEvC,KAAK,UAAU,eAAe,CAC5B,KAAsC;IAEtC,MAAM,GAAG,GAAG,MAAM,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,MAAM,EAAE,EAAE,eAAe,CAAC,CAAC,CAAC;IAEhE,KAAK,MAAM,CAAC,YAAY,EAAE,OAAO,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,KAAK,CAAC,EAAE,CAAC;QAC5D,MAAM,QAAQ,GAAG,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,YAAY,CAAC,CAAC;QAC9C,MAAM,KAAK,CAAC,IAAI,CAAC,OAAO,CAAC,QAAQ,CAAC,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;QACzD,MAAM,SAAS,CAAC,QAAQ,EAAE,OAAO,CAAC,CAAC;IACrC,CAAC;IAED,OAAO;QACL,GAAG;QACH,OAAO,EAAE,GAAG,EAAE,CAAC,EAAE,CAAC,GAAG,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC;KACzD,CAAC;AACJ,CAAC;AAED,SAAS,mBAAmB,CAAC,IAAY,EAAE,MAAM,GAAG,GAAG;IACrD,OAAO;QACL,EAAE,EAAE,MAAM,IAAI,GAAG,IAAI,MAAM,GAAG,GAAG;QACjC,MAAM;QACN,KAAK,CAAC,IAAI;YACR,OAAO,IAAI,CAAC;QACd,CAAC;KACF,CAAC;AACJ,CAAC;AAED,SAAS,cAAc,CAAC,SAAyC;IAC/D,MAAM,CAAC,KAAK,CAAC,SAAS,CAAC,IAAI,CAAC,KAAK,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC;IAC7C,MAAM,CAAC,EAAE,OAAO,CAAC,GAAG,SAAS,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAE,CAAC,SAAkC,CAAC;IAChF,MAAM,CAAC,KAAK,CAAC,OAAO,OAAO,CAAC,IAAI,EAAE,QAAQ,CAAC,CAAC;IAC5C,OAAO,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,IAAc,CAAyB,CAAC;AACpE,CAAC;AAED,SAAS,CAAC,GAAG,EAAE;IACb,IAAI,CAAC,UAAU,EAAE,CAAC;IAClB,UAAU,CAAC,KAAK,GAAG,aAAa,CAAC;AACnC,CAAC,CAAC,CAAC;AAEH,IAAI,CAAC,kEAAkE,EAAE,KAAK,IAAI,EAAE;IAClF,MAAM,SAAS,GAAG,MAAM,eAAe,CAAC;QACtC,WAAW,EAAE,eAAe;QAC5B,YAAY,EAAE,MAAM,CAAC,IAAI,CAAC,CAAC,IAAI,EAAE,IAAI,EAAE,IAAI,CAAC,CAAC;QAC7C,oBAAoB,EAAE,MAAM;QAC5B,aAAa,EAAE,MAAM;QACrB,2BAA2B,EAAE,MAAM;QACnC,yBAAyB,EAAE,MAAM;QACjC,6BAA6B,EAAE,eAAe;KAC/C,CAAC,CAAC;IAEH,IAAI,CAAC;QACH,IAAI,CAAC,MAAM,CAAC,eAAe,CAAC,SAAS,EAAE,WAAW,EAAE,KAAK,IAAI,EAAE;YAC7D,MAAM,IAAI,KAAK,CAAC,mBAAmB,CAAC,CAAC;QACvC,CAAC,CAAC,CAAC;QAEH,MAAM,SAAS,GAAG,IAAI,CAAC,MAAM,CAAC,UAAU,EAAE,OAAO,EAAE,KAAK,IAAI,EAAE,CAC5D,mBAAmB,CAAC,IAAI,CAAC,SAAS,CAAC,EAAE,OAAO,EAAE,CAAC,EAAE,UAAU,EAAE,CAAC,EAAE,MAAM,EAAE,EAAE,EAAE,CAAC,CAAC,CAC/E,CAAC;QAEF,MAAM,WAAW,GAAG,MAAM,aAAa,CACrC,0BAA0B,EAC1B,aAAa,EACb,iBAAiB,EACjB,SAAS,CAAC,GAAG,EACb,CAAC,aAAa,CAAC,CAChB,CAAC;QAEF,MAAM,CAAC,KAAK,CAAC,WAAW,EAAE,CAAC,CAAC,CAAC;QAC7B,MAAM,CAAC,KAAK,CAAC,SAAS,CAAC,IAAI,CAAC,KAAK,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC;QAE7C,MAAM,CAAC,GAAG,EAAE,OAAO,CAAC,GAAG,SAAS,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAE,CAAC,SAAkC,CAAC;QACnF,MAAM,CAAC,KAAK,CAAC,GAAG,EAAE,2DAA2D,CAAC,CAAC;QAC/E,MAAM,CAAC,KAAK,CAAC,OAAO,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;QACrC,MAAM,CAAC,SAAS,CAAC,OAAO,CAAC,OAAO,EAAE;YAChC,aAAa,EAAE,oBAAoB;YACnC,cAAc,EAAE,kBAAkB;YAClC,kBAAkB,EAAE,OAAO,CAAC,OAAO,IAAK,OAAO,CAAC,OAAkC,CAAC,kBAAkB,CAAC;SACvG,CAAC,CAAC;QACH,MAAM,CAAC,KAAK,CACT,OAAO,CAAC,OAAkC,CAAC,kBAAkB,CAAC,EAC/D,uCAAuC,CACxC,CAAC;QAEF,MAAM,IAAI,GAAG,cAAc,CAAC,SAAS,CAAC,CAAC;QACvC,MAAM,CAAC,SAAS,CAAC,IAAI,CAAC,KAAK,EAAE;YAC3B;gBACE,IAAI,EAAE,YAAY;gBAClB,OAAO,EAAE,eAAe;gBACxB,QAAQ,EAAE,OAAO;aAClB;YACD;gBACE,IAAI,EAAE,aAAa;gBACnB,OAAO,EAAE,MAAM,CAAC,IAAI,CAAC,CAAC,IAAI,EAAE,IAAI,EAAE,IAAI,CAAC,CAAC,CAAC,QAAQ,CAAC,QAAQ,CAAC;gBAC3D,QAAQ,EAAE,QAAQ;aACnB;SACF,CAAC,CAAC;IACL,CAAC;YAAS,CAAC;QACT,MAAM,SAAS,CAAC,OAAO,EAAE,CAAC;IAC5B,CAAC;AACH,CAAC,CAAC,CAAC;AAEH,IAAI,CAAC,gEAAgE,EAAE,KAAK,IAAI,EAAE;IAChF,IAAI,CAAC,MAAM,CAAC,eAAe,CAAC,SAAS,EAAE,WAAW,EAAE,KAAK,IAAI,EAAE;QAC7D,MAAM,IAAI,KAAK,CAAC,mBAAmB,CAAC,CAAC;IACvC,CAAC,CAAC,CAAC;IAEH,MAAM,SAAS,GAAG,IAAI,CAAC,MAAM,CAAC,UAAU,EAAE,OAAO,EAAE,KAAK,IAAI,EAAE,CAC5D,mBAAmB,CAAC,IAAI,CAAC,SAAS,CAAC,EAAE,OAAO,EAAE,CAAC,EAAE,UAAU,EAAE,CAAC,EAAE,MAAM,EAAE,EAAE,EAAE,CAAC,CAAC,CAC/E,CAAC;IAEF,MAAM,YAAY,CAAC,wBAAwB,EAAE,WAAW,EAAE,eAAe,EAAE;QACzE,GAAG,EAAE,CAAC,uBAAuB,CAAC;QAC9B,QAAQ,EAAE,CAAC,0BAA0B,EAAE,mBAAmB,CAAC;KAC5D,CAAC,CAAC;IAEH,MAAM,IAAI,GAAG,cAAc,CAAC,SAAS,CAAC,CAAC;IACvC,MAAM,CAAC,SAAS,CAAC,IAAI,CAAC,KAAK,EAAE;QAC3B;YACE,IAAI,EAAE,iBAAiB;YACvB,OAAO,EAAE,IAAI,CAAC,SAAS,CAAC;gBACtB,SAAS,EAAE,EAAE,WAAW,EAAE,CAAC,uBAAuB,CAAC,EAAE;aACtD,CAAC;YACF,QAAQ,EAAE,OAAO;SAClB;QACD;YACE,IAAI,EAAE,sBAAsB;YAC5B,OAAO,EAAE,IAAI,CAAC,SAAS,CAAC;gBACtB,SAAS,EAAE;oBACT,WAAW,EAAE,CAAC,0BAA0B,EAAE,mBAAmB,CAAC;iBAC/D;aACF,CAAC;YACF,QAAQ,EAAE,OAAO;SAClB;KACF,CAAC,CAAC;AACL,CAAC,CAAC,CAAC;AAEH,IAAI,CAAC,iEAAiE,EAAE,KAAK,IAAI,EAAE;IACjF,IAAI,CAAC,MAAM,CAAC,eAAe,CAAC,SAAS,EAAE,WAAW,EAAE,KAAK,IAAI,EAAE;QAC7D,MAAM,IAAI,KAAK,CAAC,mBAAmB,CAAC,CAAC;IACvC,CAAC,CAAC,CAAC;IAEH,MAAM,SAAS,GAAG,IAAI,CAAC,MAAM,CAAC,UAAU,EAAE,OAAO,EAAE,KAAK,IAAI,EAAE,CAC5D,mBAAmB,CAAC,IAAI,CAAC,SAAS,CAAC,EAAE,OAAO,EAAE,CAAC,EAAE,UAAU,EAAE,CAAC,EAAE,MAAM,EAAE,EAAE,EAAE,CAAC,CAAC,CAC/E,CAAC;IAEF,MAAM,gBAAgB,CAAC;QACrB,YAAY,EAAE,uBAAuB;QACrC,UAAU,EAAE,gBAAgB;QAC5B,SAAS,EAAE,gBAAgB;QAC3B,MAAM,EAAE;YACN,EAAE,IAAI,EAAE,aAAa,EAAE,GAAG,EAAE,EAAE,GAAG,EAAE,CAAC,MAAM,CAAC,EAAE,EAAE;YAC/C,EAAE,IAAI,EAAE,SAAS,EAAE,GAAG,EAAE,EAAE,OAAO,EAAE,CAAC,OAAO,CAAC,EAAE,QAAQ,EAAE,CAAC,MAAM,CAAC,EAAE,EAAE;YACpE,EAAE,IAAI,EAAE,SAAS,EAAE,GAAG,EAAE,EAAE,IAAI,EAAE,CAAC,MAAM,CAAC,EAAE,EAAE;SAC7C;KACF,CAAC,CAAC;IAEH,MAAM,IAAI,GAAG,cAAc,CAAC,SAAS,CAAC,CAAC;IACvC,MAAM,CAAC,SAAS,CAAC,IAAI,CAAC,KAAK,EAAE;QAC3B;YACE,IAAI,EAAE,sBAAsB;YAC5B,OAAO,EAAE,IAAI,CAAC,SAAS,CAAC;gBACtB,SAAS,EAAE;oBACT,WAAW,EAAE;wBACX,0BAA0B;wBAC1B,0BAA0B;wBAC1B,8BAA8B;qBAC/B;iBACF;aACF,CAAC;YACF,QAAQ,EAAE,OAAO;SAClB;QACD;YACE,IAAI,EAAE,qBAAqB;YAC3B,OAAO,EAAE,IAAI,CAAC,SAAS,CAAC;gBACtB,SAAS,EAAE;oBACT,WAAW,EAAE;wBACX,0BAA0B;wBAC1B,2BAA2B;wBAC3B,8BAA8B;wBAC9B,oBAAoB;qBACrB;iBACF;aACF,CAAC;YACF,QAAQ,EAAE,OAAO;SAClB;KACF,CAAC,CAAC;AACL,CAAC,CAAC,CAAC;AAEH,IAAI,CAAC,wEAAwE,EAAE,KAAK,IAAI,EAAE;IACxF,IAAI,CAAC,MAAM,CAAC,eAAe,CAAC,SAAS,EAAE,WAAW,EAAE,KAAK,IAAI,EAAE;QAC7D,MAAM,IAAI,KAAK,CAAC,mBAAmB,CAAC,CAAC;IACvC,CAAC,CAAC,CAAC;IAEH,MAAM,SAAS,GAAG,IAAI,CAAC,MAAM,CAAC,UAAU,EAAE,OAAO,EAAE,KAAK,IAAI,EAAE,CAC5D,mBAAmB,CAAC,IAAI,CAAC,SAAS,CAAC,EAAE,OAAO,EAAE,CAAC,EAAE,UAAU,EAAE,CAAC,EAAE,MAAM,EAAE,EAAE,EAAE,CAAC,CAAC,CAC/E,CAAC;IAEF,MAAM,gBAAgB,CAAC;QACrB,YAAY,EAAE,uBAAuB;QACrC,UAAU,EAAE,gBAAgB;QAC5B,SAAS,EAAE,eAAe;QAC1B,MAAM,EAAE;YACN,EAAE,IAAI,EAAE,OAAO,EAAE,GAAG,EAAE,EAAE,GAAG,EAAE,CAAC,MAAM,CAAC,EAAE,EAAE;YACzC,EAAE,IAAI,EAAE,MAAM,EAAE,GAAG,EAAE,EAAE,IAAI,EAAE,CAAC,OAAO,CAAC,EAAE,EAAE;SAC3C;KACF,CAAC,CAAC;IAEH,MAAM,IAAI,GAAG,cAAc,CAAC,SAAS,CAAC,CAAC;IACvC,MAAM,CAAC,SAAS,CAAC,IAAI,CAAC,KAAK,EAAE;QAC3B;YACE,IAAI,EAAE,sBAAsB;YAC5B,OAAO,EAAE,IAAI,CAAC,SAAS,CAAC;gBACtB,SAAS,EAAE;oBACT,WAAW,EAAE,CAAC,uBAAuB,EAAE,wBAAwB,EAAE,kBAAkB,CAAC;iBACrF;aACF,CAAC;YACF,QAAQ,EAAE,OAAO;SAClB;QACD;YACE,IAAI,EAAE,qBAAqB;YAC3B,OAAO,EAAE,IAAI,CAAC,SAAS,CAAC;gBACtB,SAAS,EAAE;oBACT,WAAW,EAAE,CAAC,wBAAwB,EAAE,iBAAiB,CAAC;iBAC3D;aACF,CAAC;YACF,QAAQ,EAAE,OAAO;SAClB;KACF,CAAC,CAAC;AACL,CAAC,CAAC,CAAC;AAEH,IAAI,CAAC,uEAAuE,EAAE,KAAK,IAAI,EAAE;IACvF,MAAM,aAAa,GAAG,IAAI,CAAC,MAAM,CAAC,eAAe,CAAC,SAAS,EAAE,WAAW,EAAE,KAAK,IAAI,EAAE;QACnF,MAAM,IAAI,KAAK,CAAC,gCAAgC,CAAC,CAAC;IACpD,CAAC,CAAC,CAAC;IACH,MAAM,SAAS,GAAG,IAAI,CAAC,MAAM,CAAC,UAAU,EAAE,OAAO,EAAE,KAAK,IAAI,EAAE;QAC5D,MAAM,IAAI,KAAK,CAAC,4BAA4B,CAAC,CAAC;IAChD,CAAC,CAAC,CAAC;IAEH,MAAM,gBAAgB,CAAC;QACrB,YAAY,EAAE,uBAAuB;QACrC,UAAU,EAAE,gBAAgB;QAC5B,SAAS,EAAE,gBAAgB;QAC3B,MAAM,EAAE;YACN,EAAE,IAAI,EAAE,SAAS,EAAE,GAAG,EAAE,EAAE,EAAE;YAC5B,EAAE,IAAI,EAAE,aAAa,EAAE,GAAG,EAAE,EAAE,EAAE;SACjC;KACF,CAAC,CAAC;IAEH,MAAM,CAAC,KAAK,CAAC,aAAa,CAAC,IAAI,CAAC,KAAK,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC;IACjD,MAAM,CAAC,KAAK,CAAC,SAAS,CAAC,IAAI,CAAC,KAAK,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC;AAC/C,CAAC,CAAC,CAAC;AAEH,IAAI,CAAC,2DAA2D,EAAE,KAAK,IAAI,EAAE;IAC3E,IAAI,CAAC,MAAM,CAAC,eAAe,CAAC,SAAS,EAAE,WAAW,EAAE,KAAK,IAAI,EAAE;QAC7D,MAAM,IAAI,KAAK,CAAC,mBAAmB,CAAC,CAAC;IACvC,CAAC,CAAC,CAAC;IAEH,IAAI,CAAC,MAAM,CAAC,UAAU,EAAE,OAAO,EAAE,KAAK,IAAI,EAAE,CAAC,mBAAmB,CAAC,mBAAmB,EAAE,GAAG,CAAC,CAAC,CAAC;IAE5F,MAAM,MAAM,CAAC,OAAO,CAClB,YAAY,CAAC,uBAAuB,EAAE,WAAW,EAAE,gBAAgB,EAAE;QACnE,GAAG,EAAE,CAAC,0BAA0B,CAAC;KAClC,CAAC,EACF,IAAI,KAAK,CAAC,qEAAqE,CAAC,CACjF,CAAC;AACJ,CAAC,CAAC,CAAC"}

package/packages/sdk/dist/provisioner/__tests__/tar-seeder.test.d.ts

@@ -0,0 +1,2 @@
+export {};
+//# sourceMappingURL=tar-seeder.test.d.ts.map

package/packages/sdk/dist/provisioner/__tests__/tar-seeder.test.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"tar-seeder.test.d.ts","sourceRoot":"","sources":["../../../src/provisioner/__tests__/tar-seeder.test.ts"],"names":[],"mappings":""}