fix: ACL seeding via bulk write endpoint, always seed dotfile ACLs

- seedAclEntries now uses POST /fs/bulk instead of PUT /fs/file
  (bulk write doesn't require If-Match for new files)
- Always seed compiled ACLs in dotfile mode (was only seeding for relay.yaml)
- ACL markers (.relayfile.acl) now created in relayfile workspace

Note: relayfile Go server doesn't yet enforce .relayfile.acl markers —
ACL eval logic exists in @relayfile/core (TypeScript) but isn't wired
into Go HTTP handlers. Separate PR needed in relayfile repo.

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

Author: khaliqgant

packages/core/src/acl.ts

@@ -8,29 +8,34 @@ export async function seedAclEntries(
 ): Promise<void> {
   const normalizedBaseUrl = baseUrl.replace(/\/+$/, "");
 
-  for (const [dirPath, rules] of Object.entries(acl)) {
-    const aclPath = dirPath === "/" ? "/.relayfile.acl" : `${dirPath}/.relayfile.acl`;
-    const url = new URL(
-      `${normalizedBaseUrl}/v1/workspaces/${encodeURIComponent(workspace)}/fs/file`,
-    );
-    url.searchParams.set("path", aclPath);
+  // Build all ACL files and write via bulk endpoint (no If-Match required)
+  const files = Object.entries(acl).map(([dirPath, rules]) => ({
+    path: dirPath === "/" ? "/.relayfile.acl" : `${dirPath}/.relayfile.acl`,
+    content: JSON.stringify({ semantics: { permissions: rules } }),
+    encoding: "utf-8" as const,
+  }));
 
-    const response = await fetch(url, {
-      method: "PUT",
-      headers: {
-        authorization: `Bearer ${token}`,
-        "content-type": "application/json",
-      },
-      body: JSON.stringify({
-        content: JSON.stringify({ semantics: { permissions: rules } }),
-        encoding: "utf-8",
-      }),
-    });
+  if (files.length === 0) return;
 
-    if (!response.ok) {
-      const body = await response.text().catch(() => "");
-      throw new Error(`failed to seed ACL for ${dirPath}: HTTP ${response.status} ${body}`.trim());
-    }
+  const url = `${normalizedBaseUrl}/v1/workspaces/${encodeURIComponent(workspace)}/fs/bulk`;
+  const response = await fetch(url, {
+    method: "POST",
+    headers: {
+      authorization: `Bearer ${token}`,
+      "content-type": "application/json",
+      "x-correlation-id": `seed-acl-${Date.now()}`,
+    },
+    body: JSON.stringify({ files }),
+  });
+
+  if (!response.ok) {
+    const body = await response.text().catch(() => "");
+    throw new Error(`failed to seed ACLs: HTTP ${response.status} ${body}`.trim());
+  }
+
+  const result = await response.json() as { errorCount: number; errors: any[] };
+  if (result.errorCount > 0) {
+    throw new Error(`ACL seeding had ${result.errorCount} error(s): ${JSON.stringify(result.errors)}`);
   }
 }
 

scripts/relay/relay.sh

@@ -656,9 +656,7 @@ cmd_provision() {
   if dotfiles_exist; then
     local compiled_bundle summary_json ignored_count readonly_count
     compiled_bundle="$(build_compiled_acl_bundle "${config_json}" "${workspace}")"
-    if [[ "${EFFECTIVE_CONFIG_PATH}" == "relay.yaml" ]]; then
-      npx tsx "${SEED_ACL_TS}" --compiled-json "${compiled_bundle}" --base-url "${DEFAULT_RELAYFILE_URL}" --token "${admin_token}"
-    fi
+    npx tsx "${SEED_ACL_TS}" --compiled-json "${compiled_bundle}" --base-url "${DEFAULT_RELAYFILE_URL}" --token "${admin_token}"
     summary_json="$(<"${compiled_bundle}")"
     ignored_count="$(config_value "${summary_json}" 'data.summary.ignored')"
     readonly_count="$(config_value "${summary_json}" 'data.summary.readonly')"