v0.2.0

Bundle what you're working on

A pattern can now name a set of changed files instead of a glob:

bundles: {
  review: ["git:staged", "!bun.lock"],
}

Source	Files
git:staged	Staged changes
git:unstaged	Unstaged changes to tracked files
git:untracked	New files not ignored by git
git:dirty	All three
git:<rev>	Changes vs <rev> — e.g. git:main, git:HEAD~3

Or skip the config file entirely:

npx srcpack --staged       # staged changes
npx srcpack --dirty        # staged + unstaged + untracked
npx srcpack --since main   # everything you changed on this branch

Git sources mix freely with globs and ! exclusions. Content always comes from your working tree, so line numbers in the bundle match the files on disk. git:<rev> compares against the merge base, so a branch that has fallen behind main still reports only your own changes.

Documentation →

Breaking changes

Node 22.18+ is now required (^22.18.0 || >=24). Config files are loaded with Node's built-in TypeScript support instead of a bundled compiler, which cuts the install from 20.2 MB to 2.9 MB. Node 18 and 20 are both past end of life.

CommonJS projects: rename srcpack.config.ts → srcpack.config.mts. If your package.json has no "type": "module", the .ts config will no longer load — Node treats it as CommonJS and its import line fails to parse. .mts works in both kinds of project, and srcpack init now picks the right one for you. ESM projects are unaffected.

Config files are type-stripped rather than compiled, so they must use erasable syntax — type annotations and import type are fine, enum and namespace are not.

Fixes

Data loss:

• outDir: "." deleted your entire project — sources, config and all — and reported success. It is now refused.
• Running srcpack twice bundled its own previous output, growing the bundle on every run.
• srcpack web emptied the whole output directory, deleting the bundles it wasn't rebuilding.

Security:

• Symlinks were followed, so a tracked link like notes.txt -> ~/.ssh/id_rsa could pull a file in from outside your project — and upload it. Symlinks are now skipped.
• A quote in a bundle filename could make an upload overwrite an unrelated file in your Google Drive.
• Google credentials were written world-readable. They are now 0600, and existing files are repaired on the next login.

Also fixed:

• srcpack init generated invalid TypeScript for hyphenated bundle names, and dropped backslashes from patterns.
• Failed uploads exited 0, so CI reported success.
• --since <branch> ran the init wizard when the branch was named init.