@ship-et/buildatlas-cli 0.0.0-stage → 0.11.0

package/LICENSE

@@ -0,0 +1,21 @@
+MIT License
+
+Copyright (c) 2026 Digicom
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+SOFTWARE.

package/README.md

@@ -1,3 +1,82 @@
-# Temporary Holding Version
+# buildatlas
 
-This version is a temporary placeholder for this package. An operational version to replace this has been submitted for review and is awaiting a staged release.
+CLI for [BuildAtlas](https://github.com/YohannesTz/BuildAtlas) — a self-hosted
+replacement for EAS Build and EAS Update that runs on a Mac you own.
+
+This package is the client. It talks to a BuildAtlas server that you host; it is
+not useful on its own. If nobody has set one up yet, start with
+[self-hosting](https://github.com/YohannesTz/BuildAtlas/blob/main/docs/self-hosting.md).
+
+```bash
+npm install -g buildatlas
+```
+
+Installs two commands: `buildatlas`, and `ba` as a shorter alias.
+
+## Use
+
+```bash
+buildatlas login --api https://builds.yourcompany.com
+export BUILDATLAS_PROJECT=my-app
+
+buildatlas build --platform android --profile production   # → signed .aab
+buildatlas build --platform ios --profile production       # → signed .ipa
+buildatlas update --branch production                      # → OTA, no rebuild
+```
+
+Your existing `eas.json` profiles work unchanged — BuildAtlas reads the same
+file, because each build runs `eas build --local` under the hood. Builds happen
+on your hardware, artifacts land in your object storage, and signing
+certificates never leave your network.
+
+## Commands
+
+| | |
+|---|---|
+| `login` / `logout` / `whoami` | Authentication for this machine |
+| `build` | Queue a build and follow the log |
+| `builds` / `logs` / `cancel` | Inspect and manage builds |
+| `credentials` | Signing material and build-time environment variables |
+| `expo-tokens` | Expo access tokens, which every build needs |
+| `update` | Publish an OTA update |
+
+Full reference: [docs/cli.md](https://github.com/YohannesTz/BuildAtlas/blob/main/docs/cli.md).
+
+New to Expo? [Getting started](https://github.com/YohannesTz/BuildAtlas/blob/main/docs/getting-started.md)
+walks from an empty folder to an app on a phone.
+
+## Configuration
+
+| | Env var | Falls back to |
+|---|---|---|
+| API URL | `BUILDATLAS_API_URL` | `~/.buildatlas/auth.json`, then `--api` |
+| Token | `BUILDATLAS_TOKEN` | `~/.buildatlas/auth.json` |
+| Project | `BUILDATLAS_PROJECT` | `--project` |
+
+Env vars win over the file, so CI can inject a token without writing to disk.
+The config file is created at mode 0600.
+
+Requires Node 20.11 or newer.
+
+## Developing against a local checkout
+
+```bash
+npm link -w buildatlas     # from the repo root
+```
+
+Prefer `npm link` over `npm install -g ./packages/cli` while iterating. A global
+install is keyed on the version number, so npm reports "up to date" and silently
+skips the copy when you rebuild without bumping it — leaving an old binary on your
+PATH while the source looks correct. `npm link` symlinks instead, so a rebuild is
+picked up immediately.
+
+If you do use a global install, `npm rm -g buildatlas` first.
+
+The build script sets the executable bit explicitly. `tsc` emits mode 0644, and a
+bin symlinked into `dist/` stops being runnable after every rebuild — npm sets the
+bit when installing from a tarball, but not for a linked workspace, which is exactly
+how you develop against it. The symptom is `permission denied: buildatlas`.
+
+## License
+
+MIT

package/dist/browser-login.d.ts

@@ -0,0 +1,12 @@
+export interface BrowserLogin {
+    /** Resolves with the token, or null if it timed out / was aborted. */
+    readonly done: Promise<string | null>;
+    /** The URL the user can open by hand if the browser did not launch. */
+    readonly url: string;
+    /** Stop the local server (used when a pasted token wins the race instead). */
+    abort(): void;
+}
+export declare function startBrowserLogin(apiUrl: string, tokenName: string, timeoutMs?: number): BrowserLogin;
+/** Default token name for a machine: the hostname, trimmed to something sane. */
+export declare function defaultTokenName(): string;
+//# sourceMappingURL=browser-login.d.ts.map

package/dist/browser-login.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"browser-login.d.ts","sourceRoot":"","sources":["../src/browser-login.ts"],"names":[],"mappings":"AAmCA,MAAM,WAAW,YAAY;IAC3B,sEAAsE;IACtE,QAAQ,CAAC,IAAI,EAAE,OAAO,CAAC,MAAM,GAAG,IAAI,CAAC,CAAC;IACtC,uEAAuE;IACvE,QAAQ,CAAC,GAAG,EAAE,MAAM,CAAC;IACrB,8EAA8E;IAC9E,KAAK,IAAI,IAAI,CAAC;CACf;AAQD,wBAAgB,iBAAiB,CAAC,MAAM,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,EAAE,SAAS,SAAU,GAAG,YAAY,CAsDtG;AAED,iFAAiF;AACjF,wBAAgB,gBAAgB,IAAI,MAAM,CAGzC"}

package/dist/browser-login.js

@@ -0,0 +1,94 @@
+import { spawn } from 'node:child_process';
+import { randomBytes } from 'node:crypto';
+import { createServer } from 'node:http';
+import { hostname } from 'node:os';
+import pc from 'picocolors';
+/**
+ * Browser login over a localhost callback — the "gh auth login" pattern.
+ *
+ * The CLI starts a one-shot HTTP server on 127.0.0.1, opens the dashboard's
+ * `/cli-auth` page, and waits. The page mints a token (as the logged-in user) and
+ * redirects the browser to `http://127.0.0.1:<port>/cb?token=…&state=…`; this server
+ * catches it. No copy-paste, and the token never travels anywhere but loopback.
+ *
+ * A random `state` ties the browser round-trip to this exact invocation, so a stray
+ * request to the port cannot inject a token. The callback host is loopback by
+ * construction — the page is only ever told a port, never a full URL — so a token
+ * cannot be redirected off the machine.
+ */
+/** Opens a URL in the default browser, best-effort. A headless box just gets the printed URL. */
+function openBrowser(url) {
+    const [cmd, args] = process.platform === 'darwin'
+        ? ['open', [url]]
+        : process.platform === 'win32'
+            ? ['cmd', ['/c', 'start', '', url]]
+            : ['xdg-open', [url]];
+    try {
+        spawn(cmd, args, { stdio: 'ignore', detached: true }).unref();
+    }
+    catch {
+        // No browser launcher (SSH, minimal box). The URL is printed; open it elsewhere.
+    }
+}
+const DONE_PAGE = '<!doctype html><meta charset="utf-8"><title>BuildAtlas</title>' +
+    '<body style="font-family:system-ui,-apple-system,sans-serif;text-align:center;padding:64px 24px;color:#15122b">' +
+    '<div style="font-size:40px">✓</div><h1 style="margin:.3em 0">Connected</h1>' +
+    '<p style="color:#6f6890">You can close this tab and return to the terminal.</p></body>';
+export function startBrowserLogin(apiUrl, tokenName, timeoutMs = 180_000) {
+    const state = randomBytes(16).toString('hex');
+    let settle;
+    const done = new Promise((r) => {
+        settle = r;
+    });
+    const server = createServer((req, res) => {
+        const reqUrl = new URL(req.url ?? '/', 'http://127.0.0.1');
+        if (reqUrl.pathname !== '/cb') {
+            res.writeHead(404).end();
+            return;
+        }
+        const token = reqUrl.searchParams.get('token');
+        const returned = reqUrl.searchParams.get('state');
+        if (!token || returned !== state) {
+            res
+                .writeHead(400, { 'content-type': 'text/html' })
+                .end('<!doctype html><meta charset="utf-8"><body>Login failed — you can close this tab.</body>');
+            return;
+        }
+        res.writeHead(200, { 'content-type': 'text/html' }).end(DONE_PAGE);
+        finish(token);
+    });
+    let finished = false;
+    const finish = (token) => {
+        if (finished)
+            return;
+        finished = true;
+        clearTimeout(timer);
+        server.close();
+        settle(token);
+    };
+    const timer = setTimeout(() => finish(null), timeoutMs);
+    server.on('error', () => finish(null));
+    // Bind synchronously-ish: listen then compute the URL in the callback.
+    let url = '';
+    server.listen(0, '127.0.0.1', () => {
+        const addr = server.address();
+        const port = typeof addr === 'object' && addr ? addr.port : 0;
+        url = `${apiUrl.replace(/\/+$/, '')}/cli-auth?port=${port}&state=${state}&name=${encodeURIComponent(tokenName)}`;
+        console.log(`\n→ Opening ${pc.cyan(url)}`);
+        console.log(pc.dim('  Approve in the browser and the token returns here automatically.'));
+        openBrowser(url);
+    });
+    return {
+        done,
+        get url() {
+            return url;
+        },
+        abort: () => finish(null),
+    };
+}
+/** Default token name for a machine: the hostname, trimmed to something sane. */
+export function defaultTokenName() {
+    const host = hostname().split('.')[0] || 'cli';
+    return `cli-${host}`;
+}
+//# sourceMappingURL=browser-login.js.map

package/dist/browser-login.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"browser-login.js","sourceRoot":"","sources":["../src/browser-login.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,KAAK,EAAE,MAAM,oBAAoB,CAAC;AAC3C,OAAO,EAAE,WAAW,EAAE,MAAM,aAAa,CAAC;AAC1C,OAAO,EAAE,YAAY,EAAE,MAAM,WAAW,CAAC;AACzC,OAAO,EAAE,QAAQ,EAAE,MAAM,SAAS,CAAC;AACnC,OAAO,EAAE,MAAM,YAAY,CAAC;AAE5B;;;;;;;;;;;;GAYG;AAEH,iGAAiG;AACjG,SAAS,WAAW,CAAC,GAAW;IAC9B,MAAM,CAAC,GAAG,EAAE,IAAI,CAAC,GACf,OAAO,CAAC,QAAQ,KAAK,QAAQ;QAC3B,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC;QACjB,CAAC,CAAC,OAAO,CAAC,QAAQ,KAAK,OAAO;YAC5B,CAAC,CAAC,CAAC,KAAK,EAAE,CAAC,IAAI,EAAE,OAAO,EAAE,EAAE,EAAE,GAAG,CAAC,CAAC;YACnC,CAAC,CAAC,CAAC,UAAU,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IAC5B,IAAI,CAAC;QACH,KAAK,CAAC,GAAG,EAAE,IAAgB,EAAE,EAAE,KAAK,EAAE,QAAQ,EAAE,QAAQ,EAAE,IAAI,EAAE,CAAC,CAAC,KAAK,EAAE,CAAC;IAC5E,CAAC;IAAC,MAAM,CAAC;QACP,iFAAiF;IACnF,CAAC;AACH,CAAC;AAWD,MAAM,SAAS,GACb,gEAAgE;IAChE,iHAAiH;IACjH,6EAA6E;IAC7E,wFAAwF,CAAC;AAE3F,MAAM,UAAU,iBAAiB,CAAC,MAAc,EAAE,SAAiB,EAAE,SAAS,GAAG,OAAO;IACtF,MAAM,KAAK,GAAG,WAAW,CAAC,EAAE,CAAC,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC;IAC9C,IAAI,MAAsC,CAAC;IAC3C,MAAM,IAAI,GAAG,IAAI,OAAO,CAAgB,CAAC,CAAC,EAAE,EAAE;QAC5C,MAAM,GAAG,CAAC,CAAC;IACb,CAAC,CAAC,CAAC;IAEH,MAAM,MAAM,GAAG,YAAY,CAAC,CAAC,GAAG,EAAE,GAAG,EAAE,EAAE;QACvC,MAAM,MAAM,GAAG,IAAI,GAAG,CAAC,GAAG,CAAC,GAAG,IAAI,GAAG,EAAE,kBAAkB,CAAC,CAAC;QAC3D,IAAI,MAAM,CAAC,QAAQ,KAAK,KAAK,EAAE,CAAC;YAC9B,GAAG,CAAC,SAAS,CAAC,GAAG,CAAC,CAAC,GAAG,EAAE,CAAC;YACzB,OAAO;QACT,CAAC;QACD,MAAM,KAAK,GAAG,MAAM,CAAC,YAAY,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC;QAC/C,MAAM,QAAQ,GAAG,MAAM,CAAC,YAAY,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC;QAClD,IAAI,CAAC,KAAK,IAAI,QAAQ,KAAK,KAAK,EAAE,CAAC;YACjC,GAAG;iBACA,SAAS,CAAC,GAAG,EAAE,EAAE,cAAc,EAAE,WAAW,EAAE,CAAC;iBAC/C,GAAG,CAAC,0FAA0F,CAAC,CAAC;YACnG,OAAO;QACT,CAAC;QACD,GAAG,CAAC,SAAS,CAAC,GAAG,EAAE,EAAE,cAAc,EAAE,WAAW,EAAE,CAAC,CAAC,GAAG,CAAC,SAAS,CAAC,CAAC;QACnE,MAAM,CAAC,KAAK,CAAC,CAAC;IAChB,CAAC,CAAC,CAAC;IAEH,IAAI,QAAQ,GAAG,KAAK,CAAC;IACrB,MAAM,MAAM,GAAG,CAAC,KAAoB,EAAE,EAAE;QACtC,IAAI,QAAQ;YAAE,OAAO;QACrB,QAAQ,GAAG,IAAI,CAAC;QAChB,YAAY,CAAC,KAAK,CAAC,CAAC;QACpB,MAAM,CAAC,KAAK,EAAE,CAAC;QACf,MAAM,CAAC,KAAK,CAAC,CAAC;IAChB,CAAC,CAAC;IACF,MAAM,KAAK,GAAG,UAAU,CAAC,GAAG,EAAE,CAAC,MAAM,CAAC,IAAI,CAAC,EAAE,SAAS,CAAC,CAAC;IACxD,MAAM,CAAC,EAAE,CAAC,OAAO,EAAE,GAAG,EAAE,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC;IAEvC,uEAAuE;IACvE,IAAI,GAAG,GAAG,EAAE,CAAC;IACb,MAAM,CAAC,MAAM,CAAC,CAAC,EAAE,WAAW,EAAE,GAAG,EAAE;QACjC,MAAM,IAAI,GAAG,MAAM,CAAC,OAAO,EAAE,CAAC;QAC9B,MAAM,IAAI,GAAG,OAAO,IAAI,KAAK,QAAQ,IAAI,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC;QAC9D,GAAG,GAAG,GAAG,MAAM,CAAC,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC,kBAAkB,IAAI,UAAU,KAAK,SAAS,kBAAkB,CAAC,SAAS,CAAC,EAAE,CAAC;QACjH,OAAO,CAAC,GAAG,CAAC,eAAe,EAAE,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;QAC3C,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,CAAC,oEAAoE,CAAC,CAAC,CAAC;QAC1F,WAAW,CAAC,GAAG,CAAC,CAAC;IACnB,CAAC,CAAC,CAAC;IAEH,OAAO;QACL,IAAI;QACJ,IAAI,GAAG;YACL,OAAO,GAAG,CAAC;QACb,CAAC;QACD,KAAK,EAAE,GAAG,EAAE,CAAC,MAAM,CAAC,IAAI,CAAC;KAC1B,CAAC;AACJ,CAAC;AAED,iFAAiF;AACjF,MAAM,UAAU,gBAAgB;IAC9B,MAAM,IAAI,GAAG,QAAQ,EAAE,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,IAAI,KAAK,CAAC;IAC/C,OAAO,OAAO,IAAI,EAAE,CAAC;AACvB,CAAC"}

package/dist/client.d.ts

@@ -0,0 +1,33 @@
+import type { AtlasConfig } from './config.ts';
+export declare class AtlasApiError extends Error {
+    readonly status: number;
+    readonly code: string;
+    constructor(status: number, code: string, message: string);
+}
+/**
+ * Whether this request may be sent twice.
+ *
+ * It matters because the link between a developer and a self-hosted server is not the
+ * one in the demo. Measured against a server in Germany from an office in Addis Ababa,
+ * roughly one request in thirty either never connects or gets a 504 out of the reverse
+ * proxy — and with no retry at all that is one `buildatlas build` in thirty dying after
+ * the source archive has already been packed, and one `cancel` in thirty reporting
+ * "Gateway Time-out" at a person who then has no idea whether the build was cancelled.
+ *
+ * `safe` is the default for GET, and is also right for the calls that state a fact
+ * rather than add one — enqueue a build that exists, cancel a build. `once` is for
+ * creating things: a repeated POST /builds is a second build, a second queue slot and a
+ * second set of build minutes, which is worse than an error message.
+ */
+export type Retry = 'safe' | 'once';
+/**
+ * Minimal API client over the platform fetch. Takes an explicit token rather
+ * than reading config itself, so `buildatlas login` can validate a token before it
+ * is ever written to disk.
+ */
+export declare function apiRequest<T>(config: Pick<AtlasConfig, 'apiUrl'>, path: string, init?: RequestInit & {
+    token?: string;
+    raw?: boolean;
+    retry?: Retry;
+}): Promise<T>;
+//# sourceMappingURL=client.d.ts.map

package/dist/client.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"client.d.ts","sourceRoot":"","sources":["../src/client.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,aAAa,CAAC;AAE/C,qBAAa,aAAc,SAAQ,KAAK;IAGtC,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IACxB,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IAEtB,YAAY,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,EAIxD;CACF;AAID;;;;;;;;;;;;;;GAcG;AACH,MAAM,MAAM,KAAK,GAAG,MAAM,GAAG,MAAM,CAAC;AAYpC;;;;GAIG;AACH,wBAAsB,UAAU,CAAC,CAAC,EAChC,MAAM,EAAE,IAAI,CAAC,WAAW,EAAE,QAAQ,CAAC,EACnC,IAAI,EAAE,MAAM,EACZ,IAAI,GAAE,WAAW,GAAG;IAAE,KAAK,CAAC,EAAE,MAAM,CAAC;IAAC,GAAG,CAAC,EAAE,OAAO,CAAC;IAAC,KAAK,CAAC,EAAE,KAAK,CAAA;CAAO,GACxE,OAAO,CAAC,CAAC,CAAC,CAiEZ"}

package/dist/client.js

@@ -0,0 +1,115 @@
+export class AtlasApiError extends Error {
+    // Explicit fields: Node's type-stripping mode does not support parameter
+    // properties, and the built CLI runs under plain Node.
+    status;
+    code;
+    constructor(status, code, message) {
+        super(message);
+        this.status = status;
+        this.code = code;
+    }
+}
+const delay = (ms) => new Promise((resolve) => setTimeout(resolve, ms));
+/** Backoff between attempts. Short: a person is watching a prompt, not a daemon log. */
+const BACKOFF_MS = [500, 1500, 3000];
+function retryable(status) {
+    // Gateway and transport failures only. A 4xx is the server understanding the request
+    // and refusing it, and 500 is the API itself having failed — repeating either changes
+    // nothing but the wait.
+    return status === 502 || status === 503 || status === 504;
+}
+/**
+ * Minimal API client over the platform fetch. Takes an explicit token rather
+ * than reading config itself, so `buildatlas login` can validate a token before it
+ * is ever written to disk.
+ */
+export async function apiRequest(config, path, init = {}) {
+    // `raw` returns the body as text. Used for archived logs, which are plain text
+    // rather than JSON so they can be piped straight into a pager.
+    const { token, raw, retry, ...rest } = init;
+    const method = (rest.method ?? 'GET').toUpperCase();
+    const mode = retry ?? (method === 'GET' ? 'safe' : 'once');
+    let res;
+    for (let attempt = 0;; attempt += 1) {
+        try {
+            res = await fetch(new URL(`/api${path}`, config.apiUrl), {
+                ...rest,
+                headers: {
+                    ...(token ? { authorization: `Bearer ${token}` } : {}),
+                    ...(rest.body ? { 'content-type': 'application/json' } : {}),
+                    ...rest.headers,
+                },
+            });
+            if (mode === 'safe' && retryable(res.status) && attempt < BACKOFF_MS.length) {
+                await delay(BACKOFF_MS[attempt]);
+                continue;
+            }
+        }
+        catch (err) {
+            // No response at all: the connection failed, so for a `once` request we cannot
+            // know whether the server acted on it. Reported rather than repeated.
+            if (mode !== 'safe' || attempt >= BACKOFF_MS.length) {
+                throw new AtlasApiError(0, 'network_error', `Could not reach ${new URL(config.apiUrl).host} (${err.message}).`);
+            }
+            await delay(BACKOFF_MS[attempt]);
+            continue;
+        }
+        break;
+    }
+    if (res.status === 204)
+        return undefined;
+    if (raw) {
+        const text = await res.text();
+        if (!res.ok) {
+            // An error is still JSON even when the success path is not — unless it came from
+            // a proxy, in which case it is an HTML page and JSON.parse would throw a
+            // SyntaxError over the top of the real failure.
+            let parsed;
+            try {
+                parsed = JSON.parse(text);
+            }
+            catch {
+                parsed = undefined;
+            }
+            if (!parsed?.error)
+                throw gatewayError(res, config);
+            throw new AtlasApiError(res.status, parsed.error.code, parsed.error.message);
+        }
+        return text;
+    }
+    const body = await res.json().catch(() => undefined);
+    if (!res.ok) {
+        const err = body?.error;
+        if (!err)
+            throw gatewayError(res, config);
+        throw new AtlasApiError(res.status, err.code, err.message);
+    }
+    return body;
+}
+/**
+ * An error the API did not write.
+ *
+ * Every API error is JSON with a code. A reply without one came from something in
+ * between — nginx, a load balancer, Cloudflare — and `✖ Gateway Time-out (unknown)`,
+ * which is what this used to print, tells a person nothing about who timed out or
+ * whether their build was created. Name the host and say the API may never have seen
+ * the request, because that is the question they are about to ask.
+ */
+function gatewayError(res, config) {
+    const host = (() => {
+        try {
+            return new URL(config.apiUrl).host;
+        }
+        catch {
+            return config.apiUrl;
+        }
+    })();
+    const what = res.status === 413
+        ? `${host} refused the request as too large (413). A reverse proxy in front of BuildAtlas ` +
+            'needs client_max_body_size raised — see docs/deployment.md.'
+        : `${host} answered ${res.status} ${res.statusText} without reaching BuildAtlas. ` +
+            'A proxy in front of the API timed out or is down, so the request may not have been ' +
+            'processed at all. Check and retry.';
+    return new AtlasApiError(res.status, 'gateway_error', what);
+}
+//# sourceMappingURL=client.js.map

package/dist/client.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"client.js","sourceRoot":"","sources":["../src/client.ts"],"names":[],"mappings":"AAEA,MAAM,OAAO,aAAc,SAAQ,KAAK;IACtC,yEAAyE;IACzE,uDAAuD;IAC9C,MAAM,CAAS;IACf,IAAI,CAAS;IAEtB,YAAY,MAAc,EAAE,IAAY,EAAE,OAAe;QACvD,KAAK,CAAC,OAAO,CAAC,CAAC;QACf,IAAI,CAAC,MAAM,GAAG,MAAM,CAAC;QACrB,IAAI,CAAC,IAAI,GAAG,IAAI,CAAC;IACnB,CAAC;CACF;AAED,MAAM,KAAK,GAAG,CAAC,EAAU,EAAE,EAAE,CAAC,IAAI,OAAO,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC,UAAU,CAAC,OAAO,EAAE,EAAE,CAAC,CAAC,CAAC;AAmBhF,wFAAwF;AACxF,MAAM,UAAU,GAAG,CAAC,GAAG,EAAE,IAAI,EAAE,IAAI,CAAC,CAAC;AAErC,SAAS,SAAS,CAAC,MAAc;IAC/B,qFAAqF;IACrF,sFAAsF;IACtF,wBAAwB;IACxB,OAAO,MAAM,KAAK,GAAG,IAAI,MAAM,KAAK,GAAG,IAAI,MAAM,KAAK,GAAG,CAAC;AAC5D,CAAC;AAED;;;;GAIG;AACH,MAAM,CAAC,KAAK,UAAU,UAAU,CAC9B,MAAmC,EACnC,IAAY,EACZ,IAAI,GAAmE,EAAE;IAEzE,+EAA+E;IAC/E,+DAA+D;IAC/D,MAAM,EAAE,KAAK,EAAE,GAAG,EAAE,KAAK,EAAE,GAAG,IAAI,EAAE,GAAG,IAAI,CAAC;IAC5C,MAAM,MAAM,GAAG,CAAC,IAAI,CAAC,MAAM,IAAI,KAAK,CAAC,CAAC,WAAW,EAAE,CAAC;IACpD,MAAM,IAAI,GAAU,KAAK,IAAI,CAAC,MAAM,KAAK,KAAK,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC;IAElE,IAAI,GAAyB,CAAC;IAC9B,KAAK,IAAI,OAAO,GAAG,CAAC,GAAI,OAAO,IAAI,CAAC,EAAE,CAAC;QACrC,IAAI,CAAC;YACH,GAAG,GAAG,MAAM,KAAK,CAAC,IAAI,GAAG,CAAC,OAAO,IAAI,EAAE,EAAE,MAAM,CAAC,MAAM,CAAC,EAAE;gBACvD,GAAG,IAAI;gBACP,OAAO,EAAE;oBACP,GAAG,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,aAAa,EAAE,UAAU,KAAK,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;oBACtD,GAAG,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,cAAc,EAAE,kBAAkB,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;oBAC5D,GAAG,IAAI,CAAC,OAAO;iBAChB;aACF,CAAC,CAAC;YACH,IAAI,IAAI,KAAK,MAAM,IAAI,SAAS,CAAC,GAAG,CAAC,MAAM,CAAC,IAAI,OAAO,GAAG,UAAU,CAAC,MAAM,EAAE,CAAC;gBAC5E,MAAM,KAAK,CAAC,UAAU,CAAC,OAAO,CAAE,CAAC,CAAC;gBAClC,SAAS;YACX,CAAC;QACH,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,+EAA+E;YAC/E,sEAAsE;YACtE,IAAI,IAAI,KAAK,MAAM,IAAI,OAAO,IAAI,UAAU,CAAC,MAAM,EAAE,CAAC;gBACpD,MAAM,IAAI,aAAa,CACrB,CAAC,EACD,eAAe,EACf,mBAAmB,IAAI,GAAG,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,IAAI,KAAM,GAAa,CAAC,OAAO,IAAI,CAC9E,CAAC;YACJ,CAAC;YACD,MAAM,KAAK,CAAC,UAAU,CAAC,OAAO,CAAE,CAAC,CAAC;YAClC,SAAS;QACX,CAAC;QACD,MAAM;IACR,CAAC;IAED,IAAI,GAAG,CAAC,MAAM,KAAK,GAAG;QAAE,OAAO,SAAc,CAAC;IAE9C,IAAI,GAAG,EAAE,CAAC;QACR,MAAM,IAAI,GAAG,MAAM,GAAG,CAAC,IAAI,EAAE,CAAC;QAC9B,IAAI,CAAC,GAAG,CAAC,EAAE,EAAE,CAAC;YACZ,iFAAiF;YACjF,yEAAyE;YACzE,gDAAgD;YAChD,IAAI,MAAiE,CAAC;YACtE,IAAI,CAAC;gBACH,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAkD,CAAC;YAC7E,CAAC;YAAC,MAAM,CAAC;gBACP,MAAM,GAAG,SAAS,CAAC;YACrB,CAAC;YACD,IAAI,CAAC,MAAM,EAAE,KAAK;gBAAE,MAAM,YAAY,CAAC,GAAG,EAAE,MAAM,CAAC,CAAC;YACpD,MAAM,IAAI,aAAa,CAAC,GAAG,CAAC,MAAM,EAAE,MAAM,CAAC,KAAK,CAAC,IAAI,EAAE,MAAM,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC;QAC/E,CAAC;QACD,OAAO,IAAS,CAAC;IACnB,CAAC;IAED,MAAM,IAAI,GAAY,MAAM,GAAG,CAAC,IAAI,EAAE,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,SAAS,CAAC,CAAC;IAC9D,IAAI,CAAC,GAAG,CAAC,EAAE,EAAE,CAAC;QACZ,MAAM,GAAG,GAAI,IAAkE,EAAE,KAAK,CAAC;QACvF,IAAI,CAAC,GAAG;YAAE,MAAM,YAAY,CAAC,GAAG,EAAE,MAAM,CAAC,CAAC;QAC1C,MAAM,IAAI,aAAa,CAAC,GAAG,CAAC,MAAM,EAAE,GAAG,CAAC,IAAI,EAAE,GAAG,CAAC,OAAO,CAAC,CAAC;IAC7D,CAAC;IACD,OAAO,IAAS,CAAC;AACnB,CAAC;AAED;;;;;;;;GAQG;AACH,SAAS,YAAY,CAAC,GAAa,EAAE,MAAmC;IACtE,MAAM,IAAI,GAAG,CAAC,GAAG,EAAE;QACjB,IAAI,CAAC;YACH,OAAO,IAAI,GAAG,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC;QACrC,CAAC;QAAC,MAAM,CAAC;YACP,OAAO,MAAM,CAAC,MAAM,CAAC;QACvB,CAAC;IACH,CAAC,CAAC,EAAE,CAAC;IACL,MAAM,IAAI,GACR,GAAG,CAAC,MAAM,KAAK,GAAG;QAChB,CAAC,CAAC,GAAG,IAAI,kFAAkF;YACzF,6DAA6D;QAC/D,CAAC,CAAC,GAAG,IAAI,aAAa,GAAG,CAAC,MAAM,IAAI,GAAG,CAAC,UAAU,gCAAgC;YAChF,qFAAqF;YACrF,oCAAoC,CAAC;IAC3C,OAAO,IAAI,aAAa,CAAC,GAAG,CAAC,MAAM,EAAE,eAAe,EAAE,IAAI,CAAC,CAAC;AAC9D,CAAC"}

package/dist/client.test.d.ts

@@ -0,0 +1,2 @@
+export {};
+//# sourceMappingURL=client.test.d.ts.map

package/dist/client.test.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"client.test.d.ts","sourceRoot":"","sources":["../src/client.test.ts"],"names":[],"mappings":""}

package/dist/client.test.js

@@ -0,0 +1,102 @@
+import assert from 'node:assert/strict';
+import { createServer } from 'node:http';
+import { afterEach, describe, it } from 'node:test';
+import { AtlasApiError, apiRequest } from './client.js';
+/**
+ * How the CLI behaves when the network between a developer and their server is the
+ * real one.
+ *
+ * Measured from Addis Ababa against a server in Germany, roughly one request in thirty
+ * either never connects or comes back as a 504 from the reverse proxy. With no retries
+ * that was a `buildatlas build` dying after the source archive was packed, and a
+ * `cancel` printing "Gateway Time-out (unknown)" — which does not say whether the build
+ * was cancelled, who timed out, or what to do next.
+ */
+let server;
+async function serve(handler) {
+    let calls = 0;
+    server = createServer((req, res) => {
+        calls += 1;
+        const { status, body, type } = handler(calls);
+        res.writeHead(status, { 'content-type': type ?? 'application/json' });
+        res.end(body);
+    });
+    await new Promise((resolve) => server.listen(0, '127.0.0.1', resolve));
+    const { port } = server.address();
+    return { apiUrl: `http://127.0.0.1:${port}`, calls: () => calls };
+}
+afterEach(() => {
+    server?.close();
+    server = undefined;
+});
+describe('apiRequest', () => {
+    it('retries a GET through a gateway failure', async () => {
+        const { apiUrl, calls } = await serve((n) => n < 3
+            ? { status: 504, body: '<html><head><title>504 Gateway Time-out</title></head></html>', type: 'text/html' }
+            : { status: 200, body: JSON.stringify({ builds: [] }) });
+        const result = await apiRequest({ apiUrl }, '/projects/x/builds');
+        assert.deepEqual(result, { builds: [] });
+        assert.equal(calls(), 3);
+    });
+    it('does not retry a POST that creates something', async () => {
+        const { apiUrl, calls } = await serve(() => ({
+            status: 504,
+            body: '<html><title>504</title></html>',
+            type: 'text/html',
+        }));
+        await assert.rejects(apiRequest({ apiUrl }, '/projects/x/builds', { method: 'POST', body: '{}' }), (err) => err.code === 'gateway_error');
+        // One build requested, one build created. A retry here is a second set of build
+        // minutes for an app nobody asked to build twice.
+        assert.equal(calls(), 1);
+    });
+    it('retries a POST that only restates a fact', async () => {
+        const { apiUrl, calls } = await serve((n) => n < 2 ? { status: 502, body: 'nope', type: 'text/html' } : { status: 200, body: '{"ok":true}' });
+        await apiRequest({ apiUrl }, '/builds/b1/enqueue', { method: 'POST', retry: 'safe' });
+        assert.equal(calls(), 2);
+    });
+    it('names the host and says the API may not have seen it', async () => {
+        const { apiUrl } = await serve(() => ({
+            status: 504,
+            body: '<html><title>504 Gateway Time-out</title></html>',
+            type: 'text/html',
+        }));
+        await assert.rejects(apiRequest({ apiUrl }, '/builds/b1/cancel', { method: 'POST' }), (err) => {
+            assert.equal(err.code, 'gateway_error');
+            assert.match(err.message, /127\.0\.0\.1/);
+            assert.match(err.message, /may not have been/);
+            // The old message. It told a person nothing.
+            assert.doesNotMatch(err.message, /\(unknown\)/);
+            return true;
+        });
+    });
+    it('points a 413 at the proxy setting that causes it', async () => {
+        const { apiUrl } = await serve(() => ({ status: 413, body: '<html>too big</html>', type: 'text/html' }));
+        await assert.rejects(apiRequest({ apiUrl }, '/x', { method: 'POST' }), (err) => {
+            assert.match(err.message, /client_max_body_size/);
+            return true;
+        });
+    });
+    it('keeps the API’s own error when there is one', async () => {
+        const { apiUrl, calls } = await serve(() => ({
+            status: 404,
+            body: JSON.stringify({ error: { code: 'not_found', message: 'No such build' } }),
+        }));
+        await assert.rejects(apiRequest({ apiUrl }, '/builds/nope'), (err) => {
+            assert.equal(err.code, 'not_found');
+            assert.equal(err.message, 'No such build');
+            return true;
+        });
+        // A 404 is an answer, not a blip.
+        assert.equal(calls(), 1);
+    });
+    it('reports an unreachable host rather than a bare "fetch failed"', async () => {
+        await assert.rejects(
+        // Port 1 on the loopback: nothing listens, and the connection is refused at once.
+        apiRequest({ apiUrl: 'http://127.0.0.1:1' }, '/projects', { method: 'POST' }), (err) => {
+            assert.equal(err.code, 'network_error');
+            assert.match(err.message, /Could not reach 127\.0\.0\.1:1/);
+            return true;
+        });
+    });
+});
+//# sourceMappingURL=client.test.js.map

package/dist/client.test.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"client.test.js","sourceRoot":"","sources":["../src/client.test.ts"],"names":[],"mappings":"AAAA,OAAO,MAAM,MAAM,oBAAoB,CAAC;AACxC,OAAO,EAAE,YAAY,EAAe,MAAM,WAAW,CAAC;AACtD,OAAO,EAAE,SAAS,EAAE,QAAQ,EAAE,EAAE,EAAE,MAAM,WAAW,CAAC;AAEpD,OAAO,EAAE,aAAa,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AAExD;;;;;;;;;GASG;AAEH,IAAI,MAA0B,CAAC;AAE/B,KAAK,UAAU,KAAK,CAAC,OAAuE;IAC1F,IAAI,KAAK,GAAG,CAAC,CAAC;IACd,MAAM,GAAG,YAAY,CAAC,CAAC,GAAG,EAAE,GAAG,EAAE,EAAE;QACjC,KAAK,IAAI,CAAC,CAAC;QACX,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,IAAI,EAAE,GAAG,OAAO,CAAC,KAAK,CAAC,CAAC;QAC9C,GAAG,CAAC,SAAS,CAAC,MAAM,EAAE,EAAE,cAAc,EAAE,IAAI,IAAI,kBAAkB,EAAE,CAAC,CAAC;QACtE,GAAG,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;IAChB,CAAC,CAAC,CAAC;IACH,MAAM,IAAI,OAAO,CAAO,CAAC,OAAO,EAAE,EAAE,CAAC,MAAO,CAAC,MAAM,CAAC,CAAC,EAAE,WAAW,EAAE,OAAO,CAAC,CAAC,CAAC;IAC9E,MAAM,EAAE,IAAI,EAAE,GAAG,MAAO,CAAC,OAAO,EAAsB,CAAC;IACvD,OAAO,EAAE,MAAM,EAAE,oBAAoB,IAAI,EAAE,EAAE,KAAK,EAAE,GAAG,EAAE,CAAC,KAAK,EAAE,CAAC;AACpE,CAAC;AAED,SAAS,CAAC,GAAG,EAAE;IACb,MAAM,EAAE,KAAK,EAAE,CAAC;IAChB,MAAM,GAAG,SAAS,CAAC;AACrB,CAAC,CAAC,CAAC;AAEH,QAAQ,CAAC,YAAY,EAAE,GAAG,EAAE;IAC1B,EAAE,CAAC,yCAAyC,EAAE,KAAK,IAAI,EAAE;QACvD,MAAM,EAAE,MAAM,EAAE,KAAK,EAAE,GAAG,MAAM,KAAK,CAAC,CAAC,CAAC,EAAE,EAAE,CAC1C,CAAC,GAAG,CAAC;YACH,CAAC,CAAC,EAAE,MAAM,EAAE,GAAG,EAAE,IAAI,EAAE,+DAA+D,EAAE,IAAI,EAAE,WAAW,EAAE;YAC3G,CAAC,CAAC,EAAE,MAAM,EAAE,GAAG,EAAE,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,EAAE,MAAM,EAAE,EAAE,EAAE,CAAC,EAAE,CAC1D,CAAC;QAEF,MAAM,MAAM,GAAG,MAAM,UAAU,CAAwB,EAAE,MAAM,EAAE,EAAE,oBAAoB,CAAC,CAAC;QAEzF,MAAM,CAAC,SAAS,CAAC,MAAM,EAAE,EAAE,MAAM,EAAE,EAAE,EAAE,CAAC,CAAC;QACzC,MAAM,CAAC,KAAK,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC,CAAC;IAC3B,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,8CAA8C,EAAE,KAAK,IAAI,EAAE;QAC5D,MAAM,EAAE,MAAM,EAAE,KAAK,EAAE,GAAG,MAAM,KAAK,CAAC,GAAG,EAAE,CAAC,CAAC;YAC3C,MAAM,EAAE,GAAG;YACX,IAAI,EAAE,iCAAiC;YACvC,IAAI,EAAE,WAAW;SAClB,CAAC,CAAC,CAAC;QAEJ,MAAM,MAAM,CAAC,OAAO,CAClB,UAAU,CAAC,EAAE,MAAM,EAAE,EAAE,oBAAoB,EAAE,EAAE,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,IAAI,EAAE,CAAC,EAC5E,CAAC,GAAkB,EAAE,EAAE,CAAC,GAAG,CAAC,IAAI,KAAK,eAAe,CACrD,CAAC;QACF,gFAAgF;QAChF,kDAAkD;QAClD,MAAM,CAAC,KAAK,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC,CAAC;IAC3B,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,0CAA0C,EAAE,KAAK,IAAI,EAAE;QACxD,MAAM,EAAE,MAAM,EAAE,KAAK,EAAE,GAAG,MAAM,KAAK,CAAC,CAAC,CAAC,EAAE,EAAE,CAC1C,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,GAAG,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,WAAW,EAAE,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,GAAG,EAAE,IAAI,EAAE,aAAa,EAAE,CAChG,CAAC;QAEF,MAAM,UAAU,CAAC,EAAE,MAAM,EAAE,EAAE,oBAAoB,EAAE,EAAE,MAAM,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,EAAE,CAAC,CAAC;QACtF,MAAM,CAAC,KAAK,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC,CAAC;IAC3B,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,sDAAsD,EAAE,KAAK,IAAI,EAAE;QACpE,MAAM,EAAE,MAAM,EAAE,GAAG,MAAM,KAAK,CAAC,GAAG,EAAE,CAAC,CAAC;YACpC,MAAM,EAAE,GAAG;YACX,IAAI,EAAE,kDAAkD;YACxD,IAAI,EAAE,WAAW;SAClB,CAAC,CAAC,CAAC;QAEJ,MAAM,MAAM,CAAC,OAAO,CAClB,UAAU,CAAC,EAAE,MAAM,EAAE,EAAE,mBAAmB,EAAE,EAAE,MAAM,EAAE,MAAM,EAAE,CAAC,EAC/D,CAAC,GAAkB,EAAE,EAAE;YACrB,MAAM,CAAC,KAAK,CAAC,GAAG,CAAC,IAAI,EAAE,eAAe,CAAC,CAAC;YACxC,MAAM,CAAC,KAAK,CAAC,GAAG,CAAC,OAAO,EAAE,cAAc,CAAC,CAAC;YAC1C,MAAM,CAAC,KAAK,CAAC,GAAG,CAAC,OAAO,EAAE,mBAAmB,CAAC,CAAC;YAC/C,6CAA6C;YAC7C,MAAM,CAAC,YAAY,CAAC,GAAG,CAAC,OAAO,EAAE,aAAa,CAAC,CAAC;YAChD,OAAO,IAAI,CAAC;QACd,CAAC,CACF,CAAC;IACJ,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,kDAAkD,EAAE,KAAK,IAAI,EAAE;QAChE,MAAM,EAAE,MAAM,EAAE,GAAG,MAAM,KAAK,CAAC,GAAG,EAAE,CAAC,CAAC,EAAE,MAAM,EAAE,GAAG,EAAE,IAAI,EAAE,sBAAsB,EAAE,IAAI,EAAE,WAAW,EAAE,CAAC,CAAC,CAAC;QAEzG,MAAM,MAAM,CAAC,OAAO,CAAC,UAAU,CAAC,EAAE,MAAM,EAAE,EAAE,IAAI,EAAE,EAAE,MAAM,EAAE,MAAM,EAAE,CAAC,EAAE,CAAC,GAAkB,EAAE,EAAE;YAC5F,MAAM,CAAC,KAAK,CAAC,GAAG,CAAC,OAAO,EAAE,sBAAsB,CAAC,CAAC;YAClD,OAAO,IAAI,CAAC;QACd,CAAC,CAAC,CAAC;IACL,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,6CAA6C,EAAE,KAAK,IAAI,EAAE;QAC3D,MAAM,EAAE,MAAM,EAAE,KAAK,EAAE,GAAG,MAAM,KAAK,CAAC,GAAG,EAAE,CAAC,CAAC;YAC3C,MAAM,EAAE,GAAG;YACX,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,EAAE,KAAK,EAAE,EAAE,IAAI,EAAE,WAAW,EAAE,OAAO,EAAE,eAAe,EAAE,EAAE,CAAC;SACjF,CAAC,CAAC,CAAC;QAEJ,MAAM,MAAM,CAAC,OAAO,CAAC,UAAU,CAAC,EAAE,MAAM,EAAE,EAAE,cAAc,CAAC,EAAE,CAAC,GAAkB,EAAE,EAAE;YAClF,MAAM,CAAC,KAAK,CAAC,GAAG,CAAC,IAAI,EAAE,WAAW,CAAC,CAAC;YACpC,MAAM,CAAC,KAAK,CAAC,GAAG,CAAC,OAAO,EAAE,eAAe,CAAC,CAAC;YAC3C,OAAO,IAAI,CAAC;QACd,CAAC,CAAC,CAAC;QACH,kCAAkC;QAClC,MAAM,CAAC,KAAK,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC,CAAC;IAC3B,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,+DAA+D,EAAE,KAAK,IAAI,EAAE;QAC7E,MAAM,MAAM,CAAC,OAAO;QAClB,kFAAkF;QAClF,UAAU,CAAC,EAAE,MAAM,EAAE,oBAAoB,EAAE,EAAE,WAAW,EAAE,EAAE,MAAM,EAAE,MAAM,EAAE,CAAC,EAC7E,CAAC,GAAkB,EAAE,EAAE;YACrB,MAAM,CAAC,KAAK,CAAC,GAAG,CAAC,IAAI,EAAE,eAAe,CAAC,CAAC;YACxC,MAAM,CAAC,KAAK,CAAC,GAAG,CAAC,OAAO,EAAE,gCAAgC,CAAC,CAAC;YAC5D,OAAO,IAAI,CAAC;QACd,CAAC,CACF,CAAC;IACJ,CAAC,CAAC,CAAC;AACL,CAAC,CAAC,CAAC"}

package/dist/commands/auth.d.ts

@@ -0,0 +1,3 @@
+import type { Command } from 'commander';
+export declare function registerAuthCommands(program: Command): void;
+//# sourceMappingURL=auth.d.ts.map

package/dist/commands/auth.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"auth.d.ts","sourceRoot":"","sources":["../../src/commands/auth.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AA8BzC,wBAAgB,oBAAoB,CAAC,OAAO,EAAE,OAAO,GAAG,IAAI,CAoE3D"}

package/dist/commands/auth.js

@@ -0,0 +1,88 @@
+import pc from 'picocolors';
+import { startBrowserLogin, defaultTokenName } from '../browser-login.js';
+import { AtlasApiError, apiRequest } from '../client.js';
+import { DEFAULT_API_URL, configPath, loadConfig, saveConfig, storedApiUrl } from '../config.js';
+import { withPrompter } from '../prompt.js';
+/**
+ * Validate a token against the server, then persist it. Shared by the browser flow, a
+ * pasted token and the `--token` CI path — a dead token fails here rather than on the
+ * next command, where it is harder to diagnose.
+ */
+async function finishLogin(apiUrl, token) {
+    try {
+        const { user } = await apiRequest({ apiUrl }, '/auth/me', {
+            token,
+        });
+        await saveConfig({ apiUrl, token, email: user.email });
+        console.log(pc.green('✔'), `Logged in as ${pc.bold(user.email)} at ${pc.dim(apiUrl)}`);
+        console.log(pc.dim(`  token stored in ${configPath()} (mode 0600)`));
+    }
+    catch (err) {
+        if (err instanceof AtlasApiError) {
+            console.error(pc.red('✖'), `Token rejected: ${err.message}`);
+        }
+        else {
+            console.error(pc.red('✖'), `Could not reach ${apiUrl}: ${err.message}`);
+        }
+        process.exitCode = 1;
+    }
+}
+export function registerAuthCommands(program) {
+    program
+        .command('login')
+        .description('Log in — opens the browser, mints a token, and captures it automatically')
+        .option('--api <url>', 'API base URL (default: your instance, remembered after first login)')
+        .option('--name <name>', 'Name for the token that gets created (default: this machine)')
+        .option('--create', 'Prompt for a token name instead of defaulting to this machine')
+        .option('--token <token>', 'Use this token directly and skip the browser (for CI)')
+        .action(async (opts) => {
+        // The server: an explicit flag, then a previous login, then the instance this CLI
+        // ships pointed at. No prompt in the common case.
+        const apiUrl = (opts.api ?? (await storedApiUrl()) ?? DEFAULT_API_URL).replace(/\/+$/, '');
+        // CI path: a token was supplied, so there is nothing to open.
+        if (opts.token) {
+            await finishLogin(apiUrl, opts.token);
+            return;
+        }
+        await withPrompter(async (prompter) => {
+            const chosen = opts.name ?? (opts.create ? (await prompter.ask('Token name: ')).trim() : '');
+            const tokenName = chosen || defaultTokenName();
+            const login = startBrowserLogin(apiUrl, tokenName);
+            // Race the browser callback against a paste, so a box that cannot open a browser
+            // (SSH, locked down) still has a way through. An empty line is ignored — it just
+            // means "keep waiting for the browser".
+            const paste = prompter
+                .ask(pc.dim('  …or paste a token here and press enter: '))
+                .then((v) => v.trim())
+                .catch(() => '');
+            const winner = await Promise.race([
+                login.done.then((t) => ({ src: 'browser', t })),
+                paste.then((t) => ({ src: 'paste', t })),
+            ]);
+            let token;
+            if (winner.src === 'paste' && winner.t) {
+                login.abort();
+                token = winner.t;
+            }
+            else {
+                token = winner.src === 'browser' ? winner.t : await login.done;
+            }
+            if (!token) {
+                console.error(pc.red('✖'), 'No token received (the browser login timed out).');
+                console.error(pc.dim('  Retry, or create one at'), pc.cyan(`${apiUrl}/settings`), pc.dim('and paste it.'));
+                process.exitCode = 1;
+                return;
+            }
+            await finishLogin(apiUrl, token);
+        });
+    });
+    program
+        .command('logout')
+        .description('Remove the stored token')
+        .action(async () => {
+        const config = await loadConfig();
+        await saveConfig({ apiUrl: config.apiUrl });
+        console.log(pc.green('✔'), 'Token removed');
+    });
+}
+//# sourceMappingURL=auth.js.map

package/dist/commands/auth.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"auth.js","sourceRoot":"","sources":["../../src/commands/auth.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,MAAM,YAAY,CAAC;AAC5B,OAAO,EAAE,iBAAiB,EAAE,gBAAgB,EAAE,MAAM,qBAAqB,CAAC;AAC1E,OAAO,EAAE,aAAa,EAAE,UAAU,EAAE,MAAM,cAAc,CAAC;AACzD,OAAO,EAAE,eAAe,EAAE,UAAU,EAAE,UAAU,EAAE,UAAU,EAAE,YAAY,EAAE,MAAM,cAAc,CAAC;AACjG,OAAO,EAAE,YAAY,EAAE,MAAM,cAAc,CAAC;AAE5C;;;;GAIG;AACH,KAAK,UAAU,WAAW,CAAC,MAAc,EAAE,KAAa;IACtD,IAAI,CAAC;QACH,MAAM,EAAE,IAAI,EAAE,GAAG,MAAM,UAAU,CAA8B,EAAE,MAAM,EAAE,EAAE,UAAU,EAAE;YACrF,KAAK;SACN,CAAC,CAAC;QACH,MAAM,UAAU,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE,KAAK,EAAE,IAAI,CAAC,KAAK,EAAE,CAAC,CAAC;QACvD,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC,KAAK,CAAC,GAAG,CAAC,EAAE,gBAAgB,EAAE,CAAC,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,OAAO,EAAE,CAAC,GAAG,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC;QACvF,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,CAAC,qBAAqB,UAAU,EAAE,cAAc,CAAC,CAAC,CAAC;IACvE,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,IAAI,GAAG,YAAY,aAAa,EAAE,CAAC;YACjC,OAAO,CAAC,KAAK,CAAC,EAAE,CAAC,GAAG,CAAC,GAAG,CAAC,EAAE,mBAAmB,GAAG,CAAC,OAAO,EAAE,CAAC,CAAC;QAC/D,CAAC;aAAM,CAAC;YACN,OAAO,CAAC,KAAK,CAAC,EAAE,CAAC,GAAG,CAAC,GAAG,CAAC,EAAE,mBAAmB,MAAM,KAAM,GAAa,CAAC,OAAO,EAAE,CAAC,CAAC;QACrF,CAAC;QACD,OAAO,CAAC,QAAQ,GAAG,CAAC,CAAC;IACvB,CAAC;AACH,CAAC;AAED,MAAM,UAAU,oBAAoB,CAAC,OAAgB;IACnD,OAAO;SACJ,OAAO,CAAC,OAAO,CAAC;SAChB,WAAW,CAAC,0EAA0E,CAAC;SACvF,MAAM,CAAC,aAAa,EAAE,qEAAqE,CAAC;SAC5F,MAAM,CAAC,eAAe,EAAE,8DAA8D,CAAC;SACvF,MAAM,CAAC,UAAU,EAAE,+DAA+D,CAAC;SACnF,MAAM,CAAC,iBAAiB,EAAE,uDAAuD,CAAC;SAClF,MAAM,CAAC,KAAK,EAAE,IAAuE,EAAE,EAAE;QACxF,kFAAkF;QAClF,kDAAkD;QAClD,MAAM,MAAM,GAAG,CAAC,IAAI,CAAC,GAAG,IAAI,CAAC,MAAM,YAAY,EAAE,CAAC,IAAI,eAAe,CAAC,CAAC,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC;QAE3F,8DAA8D;QAC9D,IAAI,IAAI,CAAC,KAAK,EAAE,CAAC;YACf,MAAM,WAAW,CAAC,MAAM,EAAE,IAAI,CAAC,KAAK,CAAC,CAAC;YACtC,OAAO;QACT,CAAC;QAED,MAAM,YAAY,CAAC,KAAK,EAAE,QAAQ,EAAE,EAAE;YACpC,MAAM,MAAM,GAAG,IAAI,CAAC,IAAI,IAAI,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,MAAM,QAAQ,CAAC,GAAG,CAAC,cAAc,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC;YAC7F,MAAM,SAAS,GAAG,MAAM,IAAI,gBAAgB,EAAE,CAAC;YAE/C,MAAM,KAAK,GAAG,iBAAiB,CAAC,MAAM,EAAE,SAAS,CAAC,CAAC;YAEnD,iFAAiF;YACjF,iFAAiF;YACjF,wCAAwC;YACxC,MAAM,KAAK,GAAG,QAAQ;iBACnB,GAAG,CAAC,EAAE,CAAC,GAAG,CAAC,4CAA4C,CAAC,CAAC;iBACzD,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;iBACrB,KAAK,CAAC,GAAG,EAAE,CAAC,EAAE,CAAC,CAAC;YAEnB,MAAM,MAAM,GAAG,MAAM,OAAO,CAAC,IAAI,CAAC;gBAChC,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,EAAE,GAAG,EAAE,SAAkB,EAAE,CAAC,EAAE,CAAC,CAAC;gBACxD,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,EAAE,GAAG,EAAE,OAAgB,EAAE,CAAC,EAAE,CAAC,CAAC;aAClD,CAAC,CAAC;YAEH,IAAI,KAAoB,CAAC;YACzB,IAAI,MAAM,CAAC,GAAG,KAAK,OAAO,IAAI,MAAM,CAAC,CAAC,EAAE,CAAC;gBACvC,KAAK,CAAC,KAAK,EAAE,CAAC;gBACd,KAAK,GAAG,MAAM,CAAC,CAAC,CAAC;YACnB,CAAC;iBAAM,CAAC;gBACN,KAAK,GAAG,MAAM,CAAC,GAAG,KAAK,SAAS,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC,MAAM,KAAK,CAAC,IAAI,CAAC;YACjE,CAAC;YAED,IAAI,CAAC,KAAK,EAAE,CAAC;gBACX,OAAO,CAAC,KAAK,CAAC,EAAE,CAAC,GAAG,CAAC,GAAG,CAAC,EAAE,kDAAkD,CAAC,CAAC;gBAC/E,OAAO,CAAC,KAAK,CACX,EAAE,CAAC,GAAG,CAAC,2BAA2B,CAAC,EACnC,EAAE,CAAC,IAAI,CAAC,GAAG,MAAM,WAAW,CAAC,EAC7B,EAAE,CAAC,GAAG,CAAC,eAAe,CAAC,CACxB,CAAC;gBACF,OAAO,CAAC,QAAQ,GAAG,CAAC,CAAC;gBACrB,OAAO;YACT,CAAC;YACD,MAAM,WAAW,CAAC,MAAM,EAAE,KAAK,CAAC,CAAC;QACnC,CAAC,CAAC,CAAC;IACL,CAAC,CAAC,CAAC;IAEL,OAAO;SACJ,OAAO,CAAC,QAAQ,CAAC;SACjB,WAAW,CAAC,yBAAyB,CAAC;SACtC,MAAM,CAAC,KAAK,IAAI,EAAE;QACjB,MAAM,MAAM,GAAG,MAAM,UAAU,EAAE,CAAC;QAClC,MAAM,UAAU,CAAC,EAAE,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,CAAC,CAAC;QAC5C,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC,KAAK,CAAC,GAAG,CAAC,EAAE,eAAe,CAAC,CAAC;IAC9C,CAAC,CAAC,CAAC;AACP,CAAC"}

package/dist/commands/build.d.ts

@@ -0,0 +1,4 @@
+import type { Command } from 'commander';
+export declare function assertProfileExists(projectDir: string, profile: string): Promise<void>;
+export declare function registerBuildCommand(program: Command): void;
+//# sourceMappingURL=build.d.ts.map

package/dist/commands/build.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"build.d.ts","sourceRoot":"","sources":["../../src/commands/build.ts"],"names":[],"mappings":"AAKA,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AAgEzC,wBAAsB,mBAAmB,CAAC,UAAU,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAgC5F;AAED,wBAAgB,oBAAoB,CAAC,OAAO,EAAE,OAAO,GAAG,IAAI,CAiD3D"}