@ship-et/buildatlas-cli 0.0.0-stage → 0.12.0

package/dist/prompt.js

@@ -0,0 +1,157 @@
+import { createInterface } from 'node:readline/promises';
+import pc from 'picocolors';
+/**
+ * Asks a sequence of questions, working both interactively and from piped input.
+ *
+ * Piped stdin needs different handling than a TTY. `readline.question()` only
+ * captures the *next* 'line' event, but a pipe delivers its whole buffer at once,
+ * so readline emits every line immediately and answers after the first are lost —
+ * leaving a later `question()` promise that never settles and a process that exits
+ * with "unsettled top-level await". Draining stdin up front and serving answers
+ * from a queue removes the race entirely, which matters because piping answers is
+ * exactly how CI drives `buildatlas credentials add`.
+ */
+export class Prompter {
+    rl;
+    queue;
+    interactive = process.stdin.isTTY === true;
+    async drainStdin() {
+        const chunks = [];
+        for await (const chunk of process.stdin)
+            chunks.push(chunk);
+        return Buffer.concat(chunks).toString('utf8').split('\n');
+    }
+    async next(question) {
+        this.queue ??= await this.drainStdin();
+        // Echo the prompt so piped runs still produce a readable transcript.
+        process.stdout.write(question);
+        const value = this.queue.shift();
+        if (value === undefined) {
+            throw new Error(`No input available for prompt: ${question.trim()}`);
+        }
+        process.stdout.write('\n');
+        return value.trim();
+    }
+    async ask(question, opts = {}) {
+        const suffix = opts.default ? pc.dim(` [${opts.default}]`) : '';
+        const text = `${question}${suffix}: `;
+        const answer = this.interactive
+            ? (await (this.rl ??= createInterface({
+                input: process.stdin,
+                output: process.stdout,
+            })).question(text)).trim()
+            : await this.next(text);
+        return answer || opts.default || '';
+    }
+    /**
+     * Reads a value without echoing it.
+     *
+     * Passwords must not appear on screen — fine alone at a desk, not fine over a shared
+     * screen or a recorded session.
+     *
+     * Raw mode rather than muting readline's echo: readline's write hook is private on
+     * current Node, so overriding it silently does nothing and the password appears in
+     * full. Reading the bytes ourselves is the only approach that actually hides them.
+     *
+     * The subtlety is handing stdin back afterwards. An earlier version paused the stream
+     * during cleanup, which dropped buffered input and split the *next* answer — typing
+     * "US" at the following prompt submitted "U" and left "S" behind. So the stream is
+     * left flowing and only the mode and the listener are undone.
+     */
+    async askHidden(question) {
+        const text = `${question}: `;
+        if (!this.interactive)
+            return this.next(text);
+        // readline and a raw-mode reader cannot both own stdin. Closing it here means the
+        // next ask() lazily creates a fresh one.
+        this.close();
+        process.stdout.write(text);
+        return new Promise((resolve, reject) => {
+            const stdin = process.stdin;
+            let value = '';
+            const cleanup = () => {
+                stdin.removeListener('data', onData);
+                stdin.setRawMode(false);
+                // Deliberately no stdin.pause(): pausing here is what corrupted the next answer.
+                process.stdout.write('\n');
+            };
+            const onData = (chunk) => {
+                for (const ch of chunk.toString('utf8')) {
+                    if (ch === '\r' || ch === '\n' || ch === '\u0004') {
+                        cleanup();
+                        resolve(value);
+                        return;
+                    }
+                    // Ctrl-C must still abort: raw mode means the terminal no longer turns it
+                    // into SIGINT for us.
+                    if (ch === '\u0003') {
+                        cleanup();
+                        reject(new Error('Cancelled'));
+                        return;
+                    }
+                    if (ch === '\u007f' || ch === '\b') {
+                        value = value.slice(0, -1);
+                        continue;
+                    }
+                    // Drop other control characters rather than storing them in something the
+                    // user cannot see.
+                    if (ch >= ' ')
+                        value += ch;
+                }
+            };
+            stdin.setRawMode(true);
+            stdin.resume();
+            stdin.on('data', onData);
+        });
+    }
+    /**
+     * Numbered menu.
+     *
+     * Numbered rather than arrow-key driven so the same code path serves a TTY and a
+     * pipe — CI answers by echoing "1" — and so it degrades gracefully in terminals
+     * that mangle cursor control.
+     */
+    async select(question, options, opts = {}) {
+        const width = Math.max(...options.map((o) => o.label.length));
+        console.log(`\n${pc.bold(question)}`);
+        for (const [i, o] of options.entries()) {
+            const hint = o.hint ? pc.dim(`  ${o.hint}`) : '';
+            console.log(`  ${pc.cyan(String(i + 1))}) ${o.label.padEnd(width)}${hint}`);
+        }
+        const fallback = opts.default ?? options[0].value;
+        const defaultIndex = options.findIndex((o) => o.value === fallback) + 1;
+        for (let attempt = 0; attempt < 5; attempt++) {
+            const answer = await this.ask('Choose', { default: String(defaultIndex) });
+            const byNumber = options[Number(answer) - 1];
+            if (byNumber)
+                return byNumber.value;
+            // Accept the value itself too, so a scripted `--kind`-style answer works.
+            const byValue = options.find((o) => o.value === answer);
+            if (byValue)
+                return byValue.value;
+            console.log(pc.red(`  Enter 1-${options.length}.`));
+        }
+        throw new Error('No valid selection.');
+    }
+    async confirm(question, defaultYes = true) {
+        const answer = await this.ask(`${question} ${pc.dim(defaultYes ? '(Y/n)' : '(y/N)')}`, {
+            default: defaultYes ? 'y' : 'n',
+        });
+        return answer.toLowerCase().startsWith('y');
+    }
+    close() {
+        this.rl?.close();
+        this.rl = undefined;
+    }
+}
+/** Runs `fn` with a prompter and always closes it, so the process can exit. */
+export async function withPrompter(fn) {
+    const prompter = new Prompter();
+    try {
+        return await fn(prompter);
+    }
+    finally {
+        prompter.close();
+    }
+}
+//# sourceMappingURL=prompt.js.map

package/dist/prompt.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"prompt.js","sourceRoot":"","sources":["../src/prompt.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,eAAe,EAAkB,MAAM,wBAAwB,CAAC;AACzE,OAAO,EAAE,MAAM,YAAY,CAAC;AAE5B;;;;;;;;;;GAUG;AACH,MAAM,OAAO,QAAQ;IACX,EAAE,CAAwB;IAC1B,KAAK,CAAuB;IAC3B,WAAW,GAAG,OAAO,CAAC,KAAK,CAAC,KAAK,KAAK,IAAI,CAAC;IAE5C,KAAK,CAAC,UAAU;QACtB,MAAM,MAAM,GAAa,EAAE,CAAC;QAC5B,IAAI,KAAK,EAAE,MAAM,KAAK,IAAI,OAAO,CAAC,KAAK;YAAE,MAAM,CAAC,IAAI,CAAC,KAAe,CAAC,CAAC;QACtE,OAAO,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;IAC5D,CAAC;IAEO,KAAK,CAAC,IAAI,CAAC,QAAgB;QACjC,IAAI,CAAC,KAAK,KAAK,MAAM,IAAI,CAAC,UAAU,EAAE,CAAC;QACvC,qEAAqE;QACrE,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAC;QAC/B,MAAM,KAAK,GAAG,IAAI,CAAC,KAAK,CAAC,KAAK,EAAE,CAAC;QACjC,IAAI,KAAK,KAAK,SAAS,EAAE,CAAC;YACxB,MAAM,IAAI,KAAK,CAAC,kCAAkC,QAAQ,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC;QACvE,CAAC;QACD,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;QAC3B,OAAO,KAAK,CAAC,IAAI,EAAE,CAAC;IACtB,CAAC;IAED,KAAK,CAAC,GAAG,CAAC,QAAgB,EAAE,IAAI,GAAyB,EAAE;QACzD,MAAM,MAAM,GAAG,IAAI,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,CAAC,GAAG,CAAC,KAAK,IAAI,CAAC,OAAO,GAAG,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;QAChE,MAAM,IAAI,GAAG,GAAG,QAAQ,GAAG,MAAM,IAAI,CAAC;QACtC,MAAM,MAAM,GAAG,IAAI,CAAC,WAAW;YAC7B,CAAC,CAAC,CACE,MAAM,CAAC,IAAI,CAAC,EAAE,KAAK,eAAe,CAAC;gBACjC,KAAK,EAAE,OAAO,CAAC,KAAK;gBACpB,MAAM,EAAE,OAAO,CAAC,MAAM;aACvB,CAAC,CAAC,CAAC,QAAQ,CAAC,IAAI,CAAC,CACnB,CAAC,IAAI,EAAE;YACV,CAAC,CAAC,MAAM,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QAC1B,OAAO,MAAM,IAAI,IAAI,CAAC,OAAO,IAAI,EAAE,CAAC;IACtC,CAAC;IAED;;;;;;;;;;;;;;OAcG;IACH,KAAK,CAAC,SAAS,CAAC,QAAgB;QAC9B,MAAM,IAAI,GAAG,GAAG,QAAQ,IAAI,CAAC;QAC7B,IAAI,CAAC,IAAI,CAAC,WAAW;YAAE,OAAO,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QAE9C,kFAAkF;QAClF,yCAAyC;QACzC,IAAI,CAAC,KAAK,EAAE,CAAC;QACb,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;QAE3B,OAAO,IAAI,OAAO,CAAS,CAAC,OAAO,EAAE,MAAM,EAAE,EAAE;YAC7C,MAAM,KAAK,GAAG,OAAO,CAAC,KAAK,CAAC;YAC5B,IAAI,KAAK,GAAG,EAAE,CAAC;YAEf,MAAM,OAAO,GAAG,GAAG,EAAE;gBACnB,KAAK,CAAC,cAAc,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;gBACrC,KAAK,CAAC,UAAU,CAAC,KAAK,CAAC,CAAC;gBACxB,iFAAiF;gBACjF,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;YAC7B,CAAC,CAAC;YAEF,MAAM,MAAM,GAAG,CAAC,KAAa,EAAE,EAAE;gBAC/B,KAAK,MAAM,EAAE,IAAI,KAAK,CAAC,QAAQ,CAAC,MAAM,CAAC,EAAE,CAAC;oBACxC,IAAI,EAAE,KAAK,IAAI,IAAI,EAAE,KAAK,IAAI,IAAI,EAAE,KAAK,QAAQ,EAAE,CAAC;wBAClD,OAAO,EAAE,CAAC;wBACV,OAAO,CAAC,KAAK,CAAC,CAAC;wBACf,OAAO;oBACT,CAAC;oBACD,0EAA0E;oBAC1E,sBAAsB;oBACtB,IAAI,EAAE,KAAK,QAAQ,EAAE,CAAC;wBACpB,OAAO,EAAE,CAAC;wBACV,MAAM,CAAC,IAAI,KAAK,CAAC,WAAW,CAAC,CAAC,CAAC;wBAC/B,OAAO;oBACT,CAAC;oBACD,IAAI,EAAE,KAAK,QAAQ,IAAI,EAAE,KAAK,IAAI,EAAE,CAAC;wBACnC,KAAK,GAAG,KAAK,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC;wBAC3B,SAAS;oBACX,CAAC;oBACD,0EAA0E;oBAC1E,mBAAmB;oBACnB,IAAI,EAAE,IAAI,GAAG;wBAAE,KAAK,IAAI,EAAE,CAAC;gBAC7B,CAAC;YACH,CAAC,CAAC;YAEF,KAAK,CAAC,UAAU,CAAC,IAAI,CAAC,CAAC;YACvB,KAAK,CAAC,MAAM,EAAE,CAAC;YACf,KAAK,CAAC,EAAE,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;QAC3B,CAAC,CAAC,CAAC;IACL,CAAC;IAED;;;;;;OAMG;IACH,KAAK,CAAC,MAAM,CACV,QAAgB,EAChB,OAAqD,EACrD,IAAI,GAAoB,EAAE;QAE1B,MAAM,KAAK,GAAG,IAAI,CAAC,GAAG,CAAC,GAAG,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC;QAC9D,OAAO,CAAC,GAAG,CAAC,KAAK,EAAE,CAAC,IAAI,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAC;QACtC,KAAK,MAAM,CAAC,CAAC,EAAE,CAAC,CAAC,IAAI,OAAO,CAAC,OAAO,EAAE,EAAE,CAAC;YACvC,MAAM,IAAI,GAAG,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;YACjD,OAAO,CAAC,GAAG,CAAC,KAAK,EAAE,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,KAAK,CAAC,MAAM,CAAC,KAAK,CAAC,GAAG,IAAI,EAAE,CAAC,CAAC;QAC9E,CAAC;QAED,MAAM,QAAQ,GAAG,IAAI,CAAC,OAAO,IAAI,OAAO,CAAC,CAAC,CAAE,CAAC,KAAK,CAAC;QACnD,MAAM,YAAY,GAAG,OAAO,CAAC,SAAS,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,KAAK,KAAK,QAAQ,CAAC,GAAG,CAAC,CAAC;QAExE,KAAK,IAAI,OAAO,GAAG,CAAC,EAAE,OAAO,GAAG,CAAC,EAAE,OAAO,EAAE,EAAE,CAAC;YAC7C,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,GAAG,CAAC,QAAQ,EAAE,EAAE,OAAO,EAAE,MAAM,CAAC,YAAY,CAAC,EAAE,CAAC,CAAC;YAC3E,MAAM,QAAQ,GAAG,OAAO,CAAC,MAAM,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC;YAC7C,IAAI,QAAQ;gBAAE,OAAO,QAAQ,CAAC,KAAK,CAAC;YACpC,0EAA0E;YAC1E,MAAM,OAAO,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,KAAK,KAAK,MAAM,CAAC,CAAC;YACxD,IAAI,OAAO;gBAAE,OAAO,OAAO,CAAC,KAAK,CAAC;YAClC,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,CAAC,aAAa,OAAO,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC;QACtD,CAAC;QACD,MAAM,IAAI,KAAK,CAAC,qBAAqB,CAAC,CAAC;IACzC,CAAC;IAED,KAAK,CAAC,OAAO,CAAC,QAAgB,EAAE,UAAU,GAAG,IAAI;QAC/C,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,GAAG,CAAC,GAAG,QAAQ,IAAI,EAAE,CAAC,GAAG,CAAC,UAAU,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,OAAO,CAAC,EAAE,EAAE;YACrF,OAAO,EAAE,UAAU,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,GAAG;SAChC,CAAC,CAAC;QACH,OAAO,MAAM,CAAC,WAAW,EAAE,CAAC,UAAU,CAAC,GAAG,CAAC,CAAC;IAC9C,CAAC;IAED,KAAK;QACH,IAAI,CAAC,EAAE,EAAE,KAAK,EAAE,CAAC;QACjB,IAAI,CAAC,EAAE,GAAG,SAAS,CAAC;IACtB,CAAC;CACF;AAED,+EAA+E;AAC/E,MAAM,CAAC,KAAK,UAAU,YAAY,CAAI,EAAsC;IAC1E,MAAM,QAAQ,GAAG,IAAI,QAAQ,EAAE,CAAC;IAChC,IAAI,CAAC;QACH,OAAO,MAAM,EAAE,CAAC,QAAQ,CAAC,CAAC;IAC5B,CAAC;YAAS,CAAC;QACT,QAAQ,CAAC,KAAK,EAAE,CAAC;IACnB,CAAC;AACH,CAAC"}

package/dist/tarball.d.ts

@@ -0,0 +1,39 @@
+export declare function toMatcher(patterns: string[]): (relativePath: string) => boolean;
+/** The exclusions every project gets, exported so a test can assert on them. */
+export declare const alwaysExcluded: readonly string[];
+export interface TarballResult {
+    path: string;
+    sizeBytes: number;
+    sha256: string;
+    /**
+     * Build-affecting files present locally but excluded by the ignore rules. Surfaced
+     * so a silently different install on the runner is not silent.
+     */
+    excludedButRelevant: string[];
+    /**
+     * The biggest directories that went in, largest first.
+     *
+     * Reported because an oversized upload is invisible at the moment it matters. A real
+     * Flutter app shipped 1,175 MB and nobody noticed until a build sat in "Fetch source"
+     * for an hour and sixteen minutes — at which point the only evidence was a duration.
+     * Naming the directories turns that into something fixable before the upload starts.
+     */
+    largest: {
+        path: string;
+        bytes: number;
+    }[];
+    cleanup(): Promise<void>;
+}
+/** Above this, an upload is worth questioning rather than just performing. */
+export declare const LARGE_UPLOAD_BYTES: number;
+/**
+ * Packs the project for upload, honouring `.easignore` when present and falling
+ * back to `.gitignore` — the same precedence eas-cli uses, so a project that
+ * builds on EAS packs identically here.
+ *
+ * Uploading the working tree rather than a git ref is deliberate: developers
+ * expect `buildatlas build` to build what is on their disk right now, including
+ * uncommitted changes.
+ */
+export declare function packProject(projectDir: string): Promise<TarballResult>;
+//# sourceMappingURL=tarball.d.ts.map

package/dist/tarball.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"tarball.d.ts","sourceRoot":"","sources":["../src/tarball.ts"],"names":[],"mappings":"AAyFA,wBAAgB,SAAS,CAAC,QAAQ,EAAE,MAAM,EAAE,GAAG,CAAC,YAAY,EAAE,MAAM,KAAK,OAAO,CAwB/E;AAED,gFAAgF;AAChF,eAAO,MAAM,cAAc,EAAE,SAAS,MAAM,EAAoB,CAAC;AAEjE,MAAM,WAAW,aAAa;IAC5B,IAAI,EAAE,MAAM,CAAC;IACb,SAAS,EAAE,MAAM,CAAC;IAClB,MAAM,EAAE,MAAM,CAAC;IACf;;;OAGG;IACH,mBAAmB,EAAE,MAAM,EAAE,CAAC;IAC9B;;;;;;;OAOG;IACH,OAAO,EAAE;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,KAAK,EAAE,MAAM,CAAA;KAAE,EAAE,CAAC;IAC3C,OAAO,IAAI,OAAO,CAAC,IAAI,CAAC,CAAC;CAC1B;AAED,8EAA8E;AAC9E,eAAO,MAAM,kBAAkB,QAAoB,CAAC;AAEpD;;;;;;;;GAQG;AACH,wBAAsB,WAAW,CAAC,UAAU,EAAE,MAAM,GAAG,OAAO,CAAC,aAAa,CAAC,CAuF5E"}

package/dist/tarball.js

@@ -0,0 +1,208 @@
+import { createHash } from 'node:crypto';
+import { createReadStream } from 'node:fs';
+import { readFile, rm, stat } from 'node:fs/promises';
+import { tmpdir } from 'node:os';
+import { join } from 'node:path';
+import { pipeline } from 'node:stream/promises';
+import { create } from 'tar';
+/**
+ * Directories never worth uploading. `node_modules` is the big one: the build
+ * reinstalls dependencies from the lockfile anyway, and including it would turn a
+ * 2 MB upload into 400 MB while risking native artifacts built for the wrong
+ * architecture leaking into the build.
+ */
+const ALWAYS_EXCLUDED = [
+    'node_modules',
+    '.git',
+    '.expo',
+    'ios/Pods',
+    'ios/build',
+    'android/build',
+    'android/.gradle',
+    'android/app/build',
+    'dist',
+    'credentials',
+    'credentials.json',
+    '.DS_Store',
+    // A native Android project is its own Gradle root: the module is `app/`, not
+    // `android/app/`, so none of the `android/…` entries above match anything and the
+    // whole of Gradle's output went up with the source. On a trivial test app that is a
+    // 1 MB upload turned into 21 MB — minutes on a slow uplink, every build, for files
+    // the runner deletes before it compiles. `build` is matched as a path segment so it
+    // also covers the modules of a multi-module project (`feature/build`), which is where
+    // the weight really is. Gradle owns that directory name by convention; a source
+    // directory called `build` would be a surprising thing to find in any project this
+    // tool builds, and `dist` has been excluded on exactly the same reasoning since the
+    // first version.
+    'build',
+    '.gradle',
+    '.kotlin',
+    '.idea',
+    '.cxx',
+    // Flutter and Dart output, none of which the runner uses and all of which it deletes
+    // before compiling.
+    //
+    // A real Flutter app uploaded **1,175 MB** of source. The runner then spent 1h 16m
+    // downloading it over a link from Hetzner to Addis, to run a two-minute build. None
+    // of the weight was source: `.dart_tool` holds the package and build caches,
+    // `ios/.symlinks` links the entire pub cache copy of every plugin, `ephemeral`
+    // directories hold a generated copy of the Flutter engine per platform, and `.fvm`
+    // can hold a whole SDK — 1.5 GB on its own.
+    //
+    // Flutter's own .gitignore covers most of this, but it is split across
+    // `ios/.gitignore`, `android/.gitignore`, `macos/.gitignore` and the rest, and only
+    // the project root's is read here. Naming them directly is simpler than implementing
+    // nested gitignore semantics, and it works for a project whose ignore files have been
+    // edited or lost.
+    '.dart_tool',
+    '.symlinks',
+    'ephemeral',
+    // `.fvm/versions`, not `.fvm`: the directory holds whole SDKs, but `.fvm/fvm_config.json`
+    // beside them is the *pin* — the legacy location the worker still reads. Excluding the
+    // parent would have dropped the pin and built the project with whatever SDK the runner
+    // defaults to, silently, which is the exact failure the pinning feature exists to
+    // prevent.
+    '.fvm/versions',
+    '.fvm/flutter_sdk',
+    'Pods',
+    '.flutter-plugins',
+    '.flutter-plugins-dependencies',
+    'DerivedData',
+    // Desktop targets of a Flutter app. A mobile build never reads them, and a Linux or
+    // Windows build directory is pure weight on an iOS upload.
+    'windows/flutter/ephemeral',
+    'linux/flutter/ephemeral',
+];
+async function readIgnoreFile(projectDir, name) {
+    try {
+        const raw = await readFile(join(projectDir, name), 'utf8');
+        return raw
+            .split('\n')
+            .map((l) => l.trim())
+            .filter((l) => l && !l.startsWith('#') && !l.startsWith('!'));
+    }
+    catch {
+        return [];
+    }
+}
+export function toMatcher(patterns) {
+    // Deliberately simple prefix/suffix/segment matching rather than full gitignore
+    // semantics. Getting gitignore exactly right is a project of its own; excluding
+    // slightly too little is safe (the build still works), while a subtle bug that
+    // excludes a source file produces a baffling build failure.
+    //
+    // A leading slash is kept rather than stripped, because in a .gitignore it means
+    // something: `/build` is the root directory only. Dropped, it became the literal
+    // path "/build", which no relative path can ever equal — so a root-anchored pattern
+    // silently matched nothing at all. Anchored patterns are now matched at the root,
+    // which is what they say.
+    const normalized = patterns.map((p) => p.replace(/^\.\//, '').replace(/\/$/, ''));
+    return (relativePath) => {
+        const segments = relativePath.split('/');
+        return normalized.some((pattern) => {
+            if (pattern.startsWith('/')) {
+                const anchored = pattern.slice(1);
+                return relativePath === anchored || relativePath.startsWith(`${anchored}/`);
+            }
+            if (pattern.startsWith('*.'))
+                return relativePath.endsWith(pattern.slice(1));
+            if (pattern.includes('/'))
+                return relativePath === pattern || relativePath.startsWith(`${pattern}/`);
+            return segments.includes(pattern);
+        });
+    };
+}
+/** The exclusions every project gets, exported so a test can assert on them. */
+export const alwaysExcluded = ALWAYS_EXCLUDED;
+/** Above this, an upload is worth questioning rather than just performing. */
+export const LARGE_UPLOAD_BYTES = 100 * 1024 * 1024;
+/**
+ * Packs the project for upload, honouring `.easignore` when present and falling
+ * back to `.gitignore` — the same precedence eas-cli uses, so a project that
+ * builds on EAS packs identically here.
+ *
+ * Uploading the working tree rather than a git ref is deliberate: developers
+ * expect `buildatlas build` to build what is on their disk right now, including
+ * uncommitted changes.
+ */
+export async function packProject(projectDir) {
+    const easIgnore = await readIgnoreFile(projectDir, '.easignore');
+    const ignorePatterns = easIgnore.length
+        ? easIgnore
+        : await readIgnoreFile(projectDir, '.gitignore');
+    const isIgnored = toMatcher([...ALWAYS_EXCLUDED, ...ignorePatterns]);
+    // Files that change how the build behaves and are commonly gitignored. Excluding
+    // them is silent and the consequence is remote: a project whose `.npmrc` sets
+    // `node-linker=hoisted` gets a different node_modules layout on the runner than on
+    // the developer's machine, then fails while bundling for reasons that point nowhere
+    // near a missing file.
+    //
+    // Reported rather than force-included, because an .npmrc is gitignored for a good
+    // reason more often than not — it can hold registry auth tokens, and uploading
+    // those to a build server should be a decision rather than a default.
+    // Files that change how a build behaves and are commonly gitignored. The point is
+    // not to upload them — they can hold tokens — but to say they are missing, because
+    // the failure otherwise looks like a code problem. `.env` is the one people lose most:
+    // react-native-config and react-native-dotenv read a file rather than the
+    // environment, so an excluded .env compiles into an app with empty configuration and
+    // no error anywhere.
+    const buildAffecting = [
+        '.npmrc',
+        '.yarnrc.yml',
+        '.nvmrc',
+        '.node-version',
+        '.env',
+        '.env.local',
+        '.env.production',
+        '.env.staging',
+    ];
+    const excludedButRelevant = [];
+    for (const name of buildAffecting) {
+        if (!isIgnored(name))
+            continue;
+        try {
+            await stat(join(projectDir, name));
+            excludedButRelevant.push(name);
+        }
+        catch {
+            // Not present, so nothing is being lost.
+        }
+    }
+    const outPath = join(tmpdir(), `buildatlas-src-${process.pid}-${Date.now()}.tar.gz`);
+    // Totalled per top-level directory as the archive is walked, so this costs one map
+    // update per file rather than a second pass over the tree.
+    const byDirectory = new Map();
+    await create({
+        gzip: true,
+        file: outPath,
+        cwd: projectDir,
+        filter: (path, stat) => {
+            const relative = path.replace(/^\.\/?/, '');
+            if (relative !== '' && isIgnored(relative))
+                return false;
+            if (stat.size) {
+                // Two segments deep: "ios" is not as useful as "ios/.symlinks", and three is
+                // more detail than a warning can use.
+                const key = relative.split('/').slice(0, 2).join('/') || relative;
+                byDirectory.set(key, (byDirectory.get(key) ?? 0) + stat.size);
+            }
+            return true;
+        },
+    }, ['.']);
+    const largest = [...byDirectory.entries()]
+        .map(([path, bytes]) => ({ path, bytes }))
+        .sort((a, b) => b.bytes - a.bytes)
+        .slice(0, 5);
+    const hash = createHash('sha256');
+    await pipeline(createReadStream(outPath), hash);
+    const { size } = await stat(outPath);
+    return {
+        excludedButRelevant,
+        largest,
+        path: outPath,
+        sizeBytes: size,
+        sha256: hash.digest('hex'),
+        cleanup: () => rm(outPath, { force: true }),
+    };
+}
+//# sourceMappingURL=tarball.js.map

package/dist/tarball.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"tarball.js","sourceRoot":"","sources":["../src/tarball.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AACzC,OAAO,EAAE,gBAAgB,EAAE,MAAM,SAAS,CAAC;AAC3C,OAAO,EAAE,QAAQ,EAAE,EAAE,EAAE,IAAI,EAAE,MAAM,kBAAkB,CAAC;AACtD,OAAO,EAAE,MAAM,EAAE,MAAM,SAAS,CAAC;AACjC,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAC;AACjC,OAAO,EAAE,QAAQ,EAAE,MAAM,sBAAsB,CAAC;AAChD,OAAO,EAAE,MAAM,EAAE,MAAM,KAAK,CAAC;AAE7B;;;;;GAKG;AACH,MAAM,eAAe,GAAG;IACtB,cAAc;IACd,MAAM;IACN,OAAO;IACP,UAAU;IACV,WAAW;IACX,eAAe;IACf,iBAAiB;IACjB,mBAAmB;IACnB,MAAM;IACN,aAAa;IACb,kBAAkB;IAClB,WAAW;IACX,6EAA6E;IAC7E,kFAAkF;IAClF,oFAAoF;IACpF,mFAAmF;IACnF,oFAAoF;IACpF,sFAAsF;IACtF,gFAAgF;IAChF,mFAAmF;IACnF,oFAAoF;IACpF,iBAAiB;IACjB,OAAO;IACP,SAAS;IACT,SAAS;IACT,OAAO;IACP,MAAM;IACN,qFAAqF;IACrF,oBAAoB;IACpB,EAAE;IACF,mFAAmF;IACnF,oFAAoF;IACpF,6EAA6E;IAC7E,+EAA+E;IAC/E,mFAAmF;IACnF,4CAA4C;IAC5C,EAAE;IACF,uEAAuE;IACvE,oFAAoF;IACpF,qFAAqF;IACrF,sFAAsF;IACtF,kBAAkB;IAClB,YAAY;IACZ,WAAW;IACX,WAAW;IACX,0FAA0F;IAC1F,uFAAuF;IACvF,uFAAuF;IACvF,kFAAkF;IAClF,WAAW;IACX,eAAe;IACf,kBAAkB;IAClB,MAAM;IACN,kBAAkB;IAClB,+BAA+B;IAC/B,aAAa;IACb,oFAAoF;IACpF,2DAA2D;IAC3D,2BAA2B;IAC3B,yBAAyB;CAC1B,CAAC;AAEF,KAAK,UAAU,cAAc,CAAC,UAAkB,EAAE,IAAY;IAC5D,IAAI,CAAC;QACH,MAAM,GAAG,GAAG,MAAM,QAAQ,CAAC,IAAI,CAAC,UAAU,EAAE,IAAI,CAAC,EAAE,MAAM,CAAC,CAAC;QAC3D,OAAO,GAAG;aACP,KAAK,CAAC,IAAI,CAAC;aACX,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;aACpB,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,UAAU,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC,UAAU,CAAC,GAAG,CAAC,CAAC,CAAC;IAClE,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,EAAE,CAAC;IACZ,CAAC;AACH,CAAC;AAED,MAAM,UAAU,SAAS,CAAC,QAAkB;IAC1C,gFAAgF;IAChF,gFAAgF;IAChF,+EAA+E;IAC/E,4DAA4D;IAC5D,EAAE;IACF,iFAAiF;IACjF,iFAAiF;IACjF,oFAAoF;IACpF,kFAAkF;IAClF,0BAA0B;IAC1B,MAAM,UAAU,GAAG,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,OAAO,CAAC,OAAO,EAAE,EAAE,CAAC,CAAC,OAAO,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC,CAAC;IAClF,OAAO,CAAC,YAAY,EAAE,EAAE;QACtB,MAAM,QAAQ,GAAG,YAAY,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;QACzC,OAAO,UAAU,CAAC,IAAI,CAAC,CAAC,OAAO,EAAE,EAAE;YACjC,IAAI,OAAO,CAAC,UAAU,CAAC,GAAG,CAAC,EAAE,CAAC;gBAC5B,MAAM,QAAQ,GAAG,OAAO,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC;gBAClC,OAAO,YAAY,KAAK,QAAQ,IAAI,YAAY,CAAC,UAAU,CAAC,GAAG,QAAQ,GAAG,CAAC,CAAC;YAC9E,CAAC;YACD,IAAI,OAAO,CAAC,UAAU,CAAC,IAAI,CAAC;gBAAE,OAAO,YAAY,CAAC,QAAQ,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC;YAC7E,IAAI,OAAO,CAAC,QAAQ,CAAC,GAAG,CAAC;gBAAE,OAAO,YAAY,KAAK,OAAO,IAAI,YAAY,CAAC,UAAU,CAAC,GAAG,OAAO,GAAG,CAAC,CAAC;YACrG,OAAO,QAAQ,CAAC,QAAQ,CAAC,OAAO,CAAC,CAAC;QACpC,CAAC,CAAC,CAAC;IACL,CAAC,CAAC;AACJ,CAAC;AAED,gFAAgF;AAChF,MAAM,CAAC,MAAM,cAAc,GAAsB,eAAe,CAAC;AAuBjE,8EAA8E;AAC9E,MAAM,CAAC,MAAM,kBAAkB,GAAG,GAAG,GAAG,IAAI,GAAG,IAAI,CAAC;AAEpD;;;;;;;;GAQG;AACH,MAAM,CAAC,KAAK,UAAU,WAAW,CAAC,UAAkB;IAClD,MAAM,SAAS,GAAG,MAAM,cAAc,CAAC,UAAU,EAAE,YAAY,CAAC,CAAC;IACjE,MAAM,cAAc,GAAG,SAAS,CAAC,MAAM;QACrC,CAAC,CAAC,SAAS;QACX,CAAC,CAAC,MAAM,cAAc,CAAC,UAAU,EAAE,YAAY,CAAC,CAAC;IAEnD,MAAM,SAAS,GAAG,SAAS,CAAC,CAAC,GAAG,eAAe,EAAE,GAAG,cAAc,CAAC,CAAC,CAAC;IAErE,iFAAiF;IACjF,8EAA8E;IAC9E,mFAAmF;IACnF,oFAAoF;IACpF,uBAAuB;IACvB,EAAE;IACF,kFAAkF;IAClF,+EAA+E;IAC/E,sEAAsE;IACtE,kFAAkF;IAClF,mFAAmF;IACnF,uFAAuF;IACvF,0EAA0E;IAC1E,qFAAqF;IACrF,qBAAqB;IACrB,MAAM,cAAc,GAAG;QACrB,QAAQ;QACR,aAAa;QACb,QAAQ;QACR,eAAe;QACf,MAAM;QACN,YAAY;QACZ,iBAAiB;QACjB,cAAc;KACf,CAAC;IACF,MAAM,mBAAmB,GAAa,EAAE,CAAC;IACzC,KAAK,MAAM,IAAI,IAAI,cAAc,EAAE,CAAC;QAClC,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC;YAAE,SAAS;QAC/B,IAAI,CAAC;YACH,MAAM,IAAI,CAAC,IAAI,CAAC,UAAU,EAAE,IAAI,CAAC,CAAC,CAAC;YACnC,mBAAmB,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QACjC,CAAC;QAAC,MAAM,CAAC;YACP,yCAAyC;QAC3C,CAAC;IACH,CAAC;IAED,MAAM,OAAO,GAAG,IAAI,CAAC,MAAM,EAAE,EAAE,kBAAkB,OAAO,CAAC,GAAG,IAAI,IAAI,CAAC,GAAG,EAAE,SAAS,CAAC,CAAC;IAErF,mFAAmF;IACnF,2DAA2D;IAC3D,MAAM,WAAW,GAAG,IAAI,GAAG,EAAkB,CAAC;IAE9C,MAAM,MAAM,CACV;QACE,IAAI,EAAE,IAAI;QACV,IAAI,EAAE,OAAO;QACb,GAAG,EAAE,UAAU;QACf,MAAM,EAAE,CAAC,IAAI,EAAE,IAAI,EAAE,EAAE;YACrB,MAAM,QAAQ,GAAG,IAAI,CAAC,OAAO,CAAC,QAAQ,EAAE,EAAE,CAAC,CAAC;YAC5C,IAAI,QAAQ,KAAK,EAAE,IAAI,SAAS,CAAC,QAAQ,CAAC;gBAAE,OAAO,KAAK,CAAC;YACzD,IAAI,IAAI,CAAC,IAAI,EAAE,CAAC;gBACd,6EAA6E;gBAC7E,sCAAsC;gBACtC,MAAM,GAAG,GAAG,QAAQ,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,IAAI,QAAQ,CAAC;gBAClE,WAAW,CAAC,GAAG,CAAC,GAAG,EAAE,CAAC,WAAW,CAAC,GAAG,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,GAAG,IAAI,CAAC,IAAI,CAAC,CAAC;YAChE,CAAC;YACD,OAAO,IAAI,CAAC;QACd,CAAC;KACF,EACD,CAAC,GAAG,CAAC,CACN,CAAC;IAEF,MAAM,OAAO,GAAG,CAAC,GAAG,WAAW,CAAC,OAAO,EAAE,CAAC;SACvC,GAAG,CAAC,CAAC,CAAC,IAAI,EAAE,KAAK,CAAC,EAAE,EAAE,CAAC,CAAC,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC;SACzC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,KAAK,GAAG,CAAC,CAAC,KAAK,CAAC;SACjC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC;IAEf,MAAM,IAAI,GAAG,UAAU,CAAC,QAAQ,CAAC,CAAC;IAClC,MAAM,QAAQ,CAAC,gBAAgB,CAAC,OAAO,CAAC,EAAE,IAAI,CAAC,CAAC;IAChD,MAAM,EAAE,IAAI,EAAE,GAAG,MAAM,IAAI,CAAC,OAAO,CAAC,CAAC;IAErC,OAAO;QACL,mBAAmB;QACnB,OAAO;QACP,IAAI,EAAE,OAAO;QACb,SAAS,EAAE,IAAI;QACf,MAAM,EAAE,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC;QAC1B,OAAO,EAAE,GAAG,EAAE,CAAC,EAAE,CAAC,OAAO,EAAE,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC;KAC5C,CAAC;AACJ,CAAC"}

package/dist/tarball.test.d.ts

@@ -0,0 +1,2 @@
+export {};
+//# sourceMappingURL=tarball.test.d.ts.map

package/dist/tarball.test.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"tarball.test.d.ts","sourceRoot":"","sources":["../src/tarball.test.ts"],"names":[],"mappings":""}

package/dist/tarball.test.js

@@ -0,0 +1,97 @@
+import assert from 'node:assert/strict';
+import { describe, it } from 'node:test';
+import { alwaysExcluded, toMatcher } from './tarball.js';
+/**
+ * What goes into the upload, and what must not.
+ *
+ * Two bugs live here. A native Android project (its own Gradle root, module in `app/`
+ * rather than `android/app/`) matched none of the `android/…` exclusions, so every
+ * build uploaded Gradle's entire output directory — 21 MB instead of 1 MB on a trivial
+ * app, over an uplink in Addis Ababa, for files the runner deletes before compiling.
+ * And a root-anchored `.gitignore` entry like `/build` was normalised into the literal
+ * path "/build", which no relative path can equal, so it excluded nothing.
+ */
+describe('tarball exclusions', () => {
+    const isIgnored = toMatcher([...alwaysExcluded]);
+    it('excludes Gradle output in a native Android project', () => {
+        assert.equal(isIgnored('app/build/outputs/apk/release/app-release.apk'), true);
+        assert.equal(isIgnored('.gradle/8.13/checksums/checksums.lock'), true);
+        assert.equal(isIgnored('.kotlin/sessions'), true);
+        assert.equal(isIgnored('.idea/workspace.xml'), true);
+        // Multi-module: the weight is in the modules, not the root.
+        assert.equal(isIgnored('feature/profile/build/intermediates/x.jar'), true);
+    });
+    it('still excludes the Expo layout it always did', () => {
+        assert.equal(isIgnored('android/app/build/outputs/x.apk'), true);
+        assert.equal(isIgnored('ios/Pods/Firebase/x.h'), true);
+        assert.equal(isIgnored('node_modules/react/index.js'), true);
+    });
+    it('keeps the source a build actually needs', () => {
+        assert.equal(isIgnored('app/build.gradle.kts'), false);
+        assert.equal(isIgnored('app/src/main/java/com/example/Main.kt'), false);
+        assert.equal(isIgnored('gradle/libs.versions.toml'), false);
+        assert.equal(isIgnored('gradlew'), false);
+        assert.equal(isIgnored('settings.gradle.kts'), false);
+        assert.equal(isIgnored('buildatlas.json'), false);
+        // `build` as a path segment, not as a prefix of a file name.
+        assert.equal(isIgnored('scripts/buildinfo.ts'), false);
+    });
+    it('honours a root-anchored ignore pattern at the root only', () => {
+        const matcher = toMatcher(['/local.properties', '/captures']);
+        assert.equal(matcher('local.properties'), true);
+        assert.equal(matcher('captures/trace.hprof'), true);
+        // Anchored means the root: the same name deeper down is a different file.
+        assert.equal(matcher('app/local.properties'), false);
+    });
+    it('still handles the unanchored forms', () => {
+        const matcher = toMatcher(['*.iml', 'ios/Pods', '.DS_Store']);
+        assert.equal(matcher('app/app.iml'), true);
+        assert.equal(matcher('ios/Pods/Manifest.lock'), true);
+        assert.equal(matcher('app/src/.DS_Store'), true);
+        assert.equal(matcher('app/src/main.kt'), false);
+    });
+});
+describe('what a Flutter project must not upload', () => {
+    // A real Flutter app uploaded 1,175 MB and the runner spent 1h 16m downloading it to
+    // run a two-minute build. None of the weight was source. Flutter's own ignore rules
+    // cover most of this, but they live in ios/.gitignore, macos/.gitignore and the rest,
+    // and only the project root's file is read here.
+    const excluded = [
+        '.dart_tool/package_config.json',
+        'ios/.symlinks/plugins/path_provider/ios/Classes/x.m',
+        'ios/Pods/Firebase/x.h',
+        'macos/Flutter/ephemeral/FlutterMacOS.framework/x',
+        'linux/flutter/ephemeral/x',
+        'windows/flutter/ephemeral/x',
+        '.fvm/versions/3.24.3/bin/flutter',
+        '.fvm/flutter_sdk/bin/flutter',
+        '.flutter-plugins-dependencies',
+        'ios/DerivedData/Build/x.o',
+    ];
+    for (const path of excluded) {
+        it(`leaves out ${path}`, () => {
+            assert.equal(toMatcher([...alwaysExcluded])(path), true);
+        });
+    }
+    const kept = [
+        'lib/main.dart',
+        'pubspec.yaml',
+        'pubspec.lock',
+        'ios/Runner/Info.plist',
+        'ios/Runner.xcodeproj/project.pbxproj',
+        'android/app/src/main/AndroidManifest.xml',
+        'assets/images/logo.png',
+        // The pins themselves. Dropping either means the runner silently builds with the
+        // wrong SDK, which is worse than any amount of upload weight.
+        '.fvmrc',
+        '.fvm/fvm_config.json',
+    ];
+    for (const path of kept) {
+        it(`still ships ${path}`, () => {
+            // The other half, and the one that breaks a build rather than slowing it: an
+            // over-eager rule here means a project that cannot compile at all.
+            assert.equal(toMatcher([...alwaysExcluded])(path), false);
+        });
+    }
+});
+//# sourceMappingURL=tarball.test.js.map

package/dist/tarball.test.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"tarball.test.js","sourceRoot":"","sources":["../src/tarball.test.ts"],"names":[],"mappings":"AAAA,OAAO,MAAM,MAAM,oBAAoB,CAAC;AACxC,OAAO,EAAE,QAAQ,EAAE,EAAE,EAAE,MAAM,WAAW,CAAC;AAEzC,OAAO,EAAE,cAAc,EAAE,SAAS,EAAE,MAAM,cAAc,CAAC;AAEzD;;;;;;;;;GASG;AACH,QAAQ,CAAC,oBAAoB,EAAE,GAAG,EAAE;IAClC,MAAM,SAAS,GAAG,SAAS,CAAC,CAAC,GAAG,cAAc,CAAC,CAAC,CAAC;IAEjD,EAAE,CAAC,oDAAoD,EAAE,GAAG,EAAE;QAC5D,MAAM,CAAC,KAAK,CAAC,SAAS,CAAC,+CAA+C,CAAC,EAAE,IAAI,CAAC,CAAC;QAC/E,MAAM,CAAC,KAAK,CAAC,SAAS,CAAC,uCAAuC,CAAC,EAAE,IAAI,CAAC,CAAC;QACvE,MAAM,CAAC,KAAK,CAAC,SAAS,CAAC,kBAAkB,CAAC,EAAE,IAAI,CAAC,CAAC;QAClD,MAAM,CAAC,KAAK,CAAC,SAAS,CAAC,qBAAqB,CAAC,EAAE,IAAI,CAAC,CAAC;QACrD,4DAA4D;QAC5D,MAAM,CAAC,KAAK,CAAC,SAAS,CAAC,2CAA2C,CAAC,EAAE,IAAI,CAAC,CAAC;IAC7E,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,8CAA8C,EAAE,GAAG,EAAE;QACtD,MAAM,CAAC,KAAK,CAAC,SAAS,CAAC,iCAAiC,CAAC,EAAE,IAAI,CAAC,CAAC;QACjE,MAAM,CAAC,KAAK,CAAC,SAAS,CAAC,uBAAuB,CAAC,EAAE,IAAI,CAAC,CAAC;QACvD,MAAM,CAAC,KAAK,CAAC,SAAS,CAAC,6BAA6B,CAAC,EAAE,IAAI,CAAC,CAAC;IAC/D,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,yCAAyC,EAAE,GAAG,EAAE;QACjD,MAAM,CAAC,KAAK,CAAC,SAAS,CAAC,sBAAsB,CAAC,EAAE,KAAK,CAAC,CAAC;QACvD,MAAM,CAAC,KAAK,CAAC,SAAS,CAAC,uCAAuC,CAAC,EAAE,KAAK,CAAC,CAAC;QACxE,MAAM,CAAC,KAAK,CAAC,SAAS,CAAC,2BAA2B,CAAC,EAAE,KAAK,CAAC,CAAC;QAC5D,MAAM,CAAC,KAAK,CAAC,SAAS,CAAC,SAAS,CAAC,EAAE,KAAK,CAAC,CAAC;QAC1C,MAAM,CAAC,KAAK,CAAC,SAAS,CAAC,qBAAqB,CAAC,EAAE,KAAK,CAAC,CAAC;QACtD,MAAM,CAAC,KAAK,CAAC,SAAS,CAAC,iBAAiB,CAAC,EAAE,KAAK,CAAC,CAAC;QAClD,6DAA6D;QAC7D,MAAM,CAAC,KAAK,CAAC,SAAS,CAAC,sBAAsB,CAAC,EAAE,KAAK,CAAC,CAAC;IACzD,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,yDAAyD,EAAE,GAAG,EAAE;QACjE,MAAM,OAAO,GAAG,SAAS,CAAC,CAAC,mBAAmB,EAAE,WAAW,CAAC,CAAC,CAAC;QAC9D,MAAM,CAAC,KAAK,CAAC,OAAO,CAAC,kBAAkB,CAAC,EAAE,IAAI,CAAC,CAAC;QAChD,MAAM,CAAC,KAAK,CAAC,OAAO,CAAC,sBAAsB,CAAC,EAAE,IAAI,CAAC,CAAC;QACpD,0EAA0E;QAC1E,MAAM,CAAC,KAAK,CAAC,OAAO,CAAC,sBAAsB,CAAC,EAAE,KAAK,CAAC,CAAC;IACvD,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,oCAAoC,EAAE,GAAG,EAAE;QAC5C,MAAM,OAAO,GAAG,SAAS,CAAC,CAAC,OAAO,EAAE,UAAU,EAAE,WAAW,CAAC,CAAC,CAAC;QAC9D,MAAM,CAAC,KAAK,CAAC,OAAO,CAAC,aAAa,CAAC,EAAE,IAAI,CAAC,CAAC;QAC3C,MAAM,CAAC,KAAK,CAAC,OAAO,CAAC,wBAAwB,CAAC,EAAE,IAAI,CAAC,CAAC;QACtD,MAAM,CAAC,KAAK,CAAC,OAAO,CAAC,mBAAmB,CAAC,EAAE,IAAI,CAAC,CAAC;QACjD,MAAM,CAAC,KAAK,CAAC,OAAO,CAAC,iBAAiB,CAAC,EAAE,KAAK,CAAC,CAAC;IAClD,CAAC,CAAC,CAAC;AACL,CAAC,CAAC,CAAC;AAEH,QAAQ,CAAC,wCAAwC,EAAE,GAAG,EAAE;IACtD,qFAAqF;IACrF,oFAAoF;IACpF,sFAAsF;IACtF,iDAAiD;IACjD,MAAM,QAAQ,GAAG;QACf,gCAAgC;QAChC,qDAAqD;QACrD,uBAAuB;QACvB,kDAAkD;QAClD,2BAA2B;QAC3B,6BAA6B;QAC7B,kCAAkC;QAClC,8BAA8B;QAC9B,+BAA+B;QAC/B,2BAA2B;KAC5B,CAAC;IAEF,KAAK,MAAM,IAAI,IAAI,QAAQ,EAAE,CAAC;QAC5B,EAAE,CAAC,cAAc,IAAI,EAAE,EAAE,GAAG,EAAE;YAC5B,MAAM,CAAC,KAAK,CAAC,SAAS,CAAC,CAAC,GAAG,cAAc,CAAC,CAAC,CAAC,IAAI,CAAC,EAAE,IAAI,CAAC,CAAC;QAC3D,CAAC,CAAC,CAAC;IACL,CAAC;IAED,MAAM,IAAI,GAAG;QACX,eAAe;QACf,cAAc;QACd,cAAc;QACd,uBAAuB;QACvB,sCAAsC;QACtC,0CAA0C;QAC1C,wBAAwB;QACxB,iFAAiF;QACjF,8DAA8D;QAC9D,QAAQ;QACR,sBAAsB;KACvB,CAAC;IAEF,KAAK,MAAM,IAAI,IAAI,IAAI,EAAE,CAAC;QACxB,EAAE,CAAC,eAAe,IAAI,EAAE,EAAE,GAAG,EAAE;YAC7B,6EAA6E;YAC7E,mEAAmE;YACnE,MAAM,CAAC,KAAK,CAAC,SAAS,CAAC,CAAC,GAAG,cAAc,CAAC,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,CAAC,CAAC;QAC5D,CAAC,CAAC,CAAC;IACL,CAAC;AACH,CAAC,CAAC,CAAC"}

package/package.json

@@ -1,6 +1,57 @@
 {
   "name": "@ship-et/buildatlas-cli",
-  "version": "0.0.0-stage",
-  "stub": true,
-  "description": "Temporary package placeholder for staged publishing"
-}
+  "version": "0.12.0",
+  "description": "CLI for BuildAtlas — self-hosted Expo builds and OTA updates. Drop-in for `eas build`.",
+  "license": "MIT",
+  "author": "Digicom",
+  "homepage": "https://github.com/ship-et/BuildAtlas#readme",
+  "repository": {
+    "type": "git",
+    "url": "git+https://github.com/ship-et/BuildAtlas.git",
+    "directory": "packages/cli"
+  },
+  "bugs": {
+    "url": "https://github.com/ship-et/BuildAtlas/issues"
+  },
+  "publishConfig": {
+    "registry": "https://registry.npmjs.org",
+    "access": "public"
+  },
+  "keywords": [
+    "expo",
+    "eas",
+    "react-native",
+    "build",
+    "ci",
+    "ota",
+    "self-hosted",
+    "eas-build"
+  ],
+  "type": "module",
+  "engines": {
+    "node": ">=20.11"
+  },
+  "bin": {
+    "buildatlas": "dist/index.js",
+    "ba": "dist/index.js"
+  },
+  "files": [
+    "dist",
+    "README.md",
+    "LICENSE"
+  ],
+  "scripts": {
+    "dev": "tsx src/index.ts",
+    "build": "tsc && chmod +x dist/index.js",
+    "typecheck": "tsc --noEmit",
+    "test": "node --env-file-if-exists=../../.env --test 'src/**/*.test.ts'",
+    "prepublishOnly": "rm -rf dist && tsc && chmod +x dist/index.js",
+    "prepare": "if command -v tsc >/dev/null 2>&1; then tsc && chmod +x dist/index.js; else echo 'buildatlas-cli: skipping the dist build, typescript is not installed'; fi"
+  },
+  "dependencies": {
+    "commander": "^15.0.0",
+    "picocolors": "^1.1.1",
+    "tar": "^7.5.22",
+    "zod": "^4.4.3"
+  }
+}