@forthtilliath/expo-release-updates 0.7.1 → 0.9.0

package/README.md

@@ -76,9 +76,13 @@ if (release && isUpdateAvailable(currentVersion, release.version)) {
 }
 ```
 
-### `fetchLatestRelease({ owner, repo, token?, timeoutMs?, signal? })`
+### `fetchLatestRelease({ owner, repo, includePrereleases?, requireVerifiedApk?, token?, timeoutMs?, signal? })`
 
-Fetches the latest GitHub release and its `.apk` asset. Returns `null` if the latest release has no `.apk` attached; throws if the GitHub API request fails. Pass `token` for private repos, or to raise the API rate limit from 60 to 5000 requests/hour on public ones.
+Fetches the latest GitHub release and its `.apk` asset: `{ version, notes, apkUrl, apkSha256? }`. `apkSha256` is the SHA-256 GitHub computed when the APK was uploaded — pass it to `downloadAndInstallApk`'s `expectedSha256`. Returns `null` if the latest release has no `.apk` attached; throws if the GitHub API request fails. Pass `token` for private repos, or to raise the API rate limit from 60 to 5000 requests/hour on public ones.
+
+GitHub's `/releases/latest` only ever returns a **stable** release: an app that only publishes pre-releases (alpha, beta) would never see an update. Pass `includePrereleases: true` to scan the 10 most recent releases instead (drafts left out) and keep the highest version (semver, `1.0.0-alpha.10` > `1.0.0-alpha.2`) that carries an `.apk`.
+
+Pass `requireVerifiedApk: true` to only consider an `.apk` that `downloadAndInstallApk` with `expectedSha256` and `allowedUrlPrefix: releaseDownloadUrlPrefix(...)` would accept: one with a SHA-256, under this repo's release URLs. A release whose APK fails either is skipped (with `includePrereleases`, the next highest version wins), so the app never offers an update the install would then refuse. Every field of GitHub's answer is type-checked and bounded: notes are cut at 100,000 characters, an oversized tag or URL counts as missing, and a release without a tag is ignored.
 
 The request gives up after `timeoutMs` (default `15000`) instead of hanging on a bad network, and can be cancelled with `signal` (an `AbortSignal`) — both also apply to `fetchReleaseHistory`.
 
@@ -104,22 +108,34 @@ const history = await fetchReleaseHistory({
 // [{ version: "1.11.0", notes: "### Added\n- ...", publishedAt: "2026-07-30T..." }, ...]
 ```
 
-### `downloadAndInstallApk({ apkUrl, fileName, onProgress?, expectedMd5?, allowedHosts? })`
+### `downloadAndInstallApk({ apkUrl, fileName, onProgress?, expectedSha256?, allowedUrlPrefix?, expectedMd5?, allowedHosts? })`
+
+Downloads an APK to the app's cache directory and triggers the Android install-package intent. **Android only**. `apkUrl` must be an `https://` URL on one of `allowedHosts` (default `["github.com"]`, where `fetchLatestRelease`'s `apkUrl` points) — anything else throws before downloading.
+
+Recommended checks, both fed by `fetchLatestRelease`:
 
-Downloads an APK to the app's cache directory and triggers the Android install-package intent. **Android only** — there is no iOS equivalent (sideloading isn't possible there). `apkUrl` must be an `https://` URL on one of `allowedHosts` (default `["github.com"]`, where `fetchLatestRelease`'s `apkUrl` points) — anything else throws before downloading. Pass `expectedMd5` to verify the downloaded file before installing — a mismatch deletes the file and throws instead. Publish the checksum alongside the release (e.g. in the release notes or a `.md5` asset) and read it yourself: `fetchLatestRelease` doesn't return it.
+- **`allowedUrlPrefix: releaseDownloadUrlPrefix({ owner, repo })`** — only an APK of _this_ repo's releases (`https://github.com/<owner>/<repo>/releases/download/…`): `allowedHosts` alone accepts any github.com URL, another repo's included. After the prefix, only plain path segments pass (no `..`, query, fragment or `%`-escape).
+- **`expectedSha256: release.apkSha256`** — the downloaded file must match the SHA-256 GitHub computed on upload; a mismatch deletes it and throws. Computed natively with `File#digest`, so it needs **expo-file-system 58 or later** (with an older one, it throws rather than skip the check).
 
-What `expectedMd5` does and doesn't protect against:
+`expectedMd5` remains for a checksum you publish yourself (release notes, `.md5` asset).
 
-- ✅ a corrupted or truncated download;
+What a checksum does and doesn't protect against:
+
+- ✅ a corrupted, truncated or swapped download;
 - ❌ a malicious release — whoever can publish the APK can publish its checksum too. The real safeguard there is Android itself: it refuses to install an update that isn't signed with the same key as the installed app. **Keep that signing key out of the repo and CI logs**, and restrict who can publish releases.
 
 ```ts
-await downloadAndInstallApk({
-  apkUrl: release.apkUrl,
-  fileName: "myapp-update.apk",
-  onProgress: (fraction) => setProgress(fraction),
-  expectedMd5, // read from the release notes or a .md5 asset
-});
+const repo = { owner: "acme", repo: "app" };
+const release = await fetchLatestRelease(repo);
+if (release) {
+  await downloadAndInstallApk({
+    apkUrl: release.apkUrl,
+    fileName: "myapp-update.apk",
+    onProgress: (fraction) => setProgress(fraction),
+    allowedUrlPrefix: releaseDownloadUrlPrefix(repo),
+    expectedSha256: release.apkSha256,
+  });
+}
 ```
 
 ### `parseChangelogNotes(notes)`

package/dist/downloadAndInstallApk.d.ts

@@ -12,6 +12,16 @@ export interface DownloadAndInstallApkOptions {
      * signed with the same key as the installed app is what guards against that.
      */
     expectedMd5?: string;
+    /**
+     * SHA-256 the downloaded file must match — `apkSha256` from
+     * `fetchLatestRelease`, computed by GitHub itself when the asset was
+     * uploaded (`"sha256:…"` or bare hex, any case). A mismatch deletes the
+     * file and rejects instead of installing it. Same limits as `expectedMd5`
+     * against a malicious release, but SHA-256 can't be forged to match a
+     * tampered file. Needs expo-file-system 58 or later (`File#digest`, native,
+     * without loading the APK in JS); with an older one, it rejects.
+     */
+    expectedSha256?: string;
     /**
      * Hosts `apkUrl` may point to — `["github.com"]` by default, the host of
      * the `apkUrl` returned by `fetchLatestRelease` (GitHub then redirects to
@@ -19,15 +29,24 @@ export interface DownloadAndInstallApkOptions {
      * rejected before downloading anything.
      */
     allowedHosts?: string[];
+    /**
+     * The start `apkUrl` must have, e.g. `releaseDownloadUrlPrefix({ owner,
+     * repo })` to only accept an APK of this repo's releases (any github.com
+     * URL passes `allowedHosts`, another repo's included). After the prefix,
+     * only plain path segments are allowed: no `..`, query, fragment or
+     * `%`-escape.
+     */
+    allowedUrlPrefix?: string;
 }
 /**
  * Downloads an APK to the cache directory and triggers the Android
  * install-package intent. Android only — there is no equivalent flow on iOS,
  * which doesn't allow installing a downloaded package outside the App Store.
  *
- * @throws if `apkUrl` isn't an `https://` URL on one of `allowedHosts`, if
- * the download fails, or if `expectedMd5` is set and doesn't match the
- * downloaded file.
+ * @throws if `apkUrl` isn't an `https://` URL on one of `allowedHosts` (or
+ * under `allowedUrlPrefix`), if `expectedSha256` isn't a SHA-256, if the
+ * download fails, or if `expectedMd5` / `expectedSha256` is set and doesn't
+ * match the downloaded file.
  */
-export declare function downloadAndInstallApk({ apkUrl, fileName, onProgress, expectedMd5, allowedHosts, }: DownloadAndInstallApkOptions): Promise<void>;
+export declare function downloadAndInstallApk({ apkUrl, fileName, onProgress, expectedMd5, expectedSha256, allowedHosts, allowedUrlPrefix, }: DownloadAndInstallApkOptions): Promise<void>;
 //# sourceMappingURL=downloadAndInstallApk.d.ts.map

package/dist/downloadAndInstallApk.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"downloadAndInstallApk.d.ts","sourceRoot":"","sources":["../src/downloadAndInstallApk.ts"],"names":[],"mappings":"AAqBA,MAAM,WAAW,4BAA4B;IAC3C,MAAM,EAAE,MAAM,CAAC;IACf,qEAAqE;IACrE,QAAQ,EAAE,MAAM,CAAC;IACjB,UAAU,CAAC,EAAE,CAAC,QAAQ,EAAE,MAAM,KAAK,IAAI,CAAC;IACxC;;;;;;;OAOG;IACH,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB;;;;;OAKG;IACH,YAAY,CAAC,EAAE,MAAM,EAAE,CAAC;CACzB;AAED;;;;;;;;GAQG;AACH,wBAAsB,qBAAqB,CAAC,EAC1C,MAAM,EACN,QAAQ,EACR,UAAU,EACV,WAAW,EACX,YAAoC,GACrC,EAAE,4BAA4B,GAAG,OAAO,CAAC,IAAI,CAAC,CAqC9C"}
+{"version":3,"file":"downloadAndInstallApk.d.ts","sourceRoot":"","sources":["../src/downloadAndInstallApk.ts"],"names":[],"mappings":"AAmDA,MAAM,WAAW,4BAA4B;IAC3C,MAAM,EAAE,MAAM,CAAC;IACf,qEAAqE;IACrE,QAAQ,EAAE,MAAM,CAAC;IACjB,UAAU,CAAC,EAAE,CAAC,QAAQ,EAAE,MAAM,KAAK,IAAI,CAAC;IACxC;;;;;;;OAOG;IACH,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB;;;;;;;;OAQG;IACH,cAAc,CAAC,EAAE,MAAM,CAAC;IACxB;;;;;OAKG;IACH,YAAY,CAAC,EAAE,MAAM,EAAE,CAAC;IACxB;;;;;;OAMG;IACH,gBAAgB,CAAC,EAAE,MAAM,CAAC;CAC3B;AAED;;;;;;;;;GASG;AACH,wBAAsB,qBAAqB,CAAC,EAC1C,MAAM,EACN,QAAQ,EACR,UAAU,EACV,WAAW,EACX,cAAc,EACd,YAAoC,EACpC,gBAAgB,GACjB,EAAE,4BAA4B,GAAG,OAAO,CAAC,IAAI,CAAC,CAmE9C"}

package/dist/downloadAndInstallApk.js

@@ -15,21 +15,51 @@ function httpsHost(url) {
     const match = /^https:\/\/([^/?#:@]+)(?::\d+)?(?:[/?#]|$)/i.exec(url);
     return match?.[1]?.toLowerCase() ?? null;
 }
+/**
+ * Whether `url` is `prefix` followed by plain path segments only: letters,
+ * digits, `.`, `_`, `-` — no `..` segment, query, fragment, `%`-escape or
+ * `@` that could lead it out of the prefix.
+ */
+function isUnderPrefix(url, prefix) {
+    if (!url.startsWith(prefix))
+        return false;
+    const rest = url.slice(prefix.length);
+    return (/^[\w.-]+(\/[\w.-]+)*$/.test(rest) &&
+        rest.split("/").every((segment) => segment !== "." && segment !== ".."));
+}
+const SHA256_HEX = /^[0-9a-f]{64}$/;
+/** `"sha256:ABC…"` or `"abc…"` → `"abc…"`, or `null` if not a SHA-256. */
+function normalizeSha256(value) {
+    const hex = value
+        .trim()
+        .replace(/^sha256:/i, "")
+        .toLowerCase();
+    return SHA256_HEX.test(hex) ? hex : null;
+}
 /**
  * Downloads an APK to the cache directory and triggers the Android
  * install-package intent. Android only — there is no equivalent flow on iOS,
  * which doesn't allow installing a downloaded package outside the App Store.
  *
- * @throws if `apkUrl` isn't an `https://` URL on one of `allowedHosts`, if
- * the download fails, or if `expectedMd5` is set and doesn't match the
- * downloaded file.
+ * @throws if `apkUrl` isn't an `https://` URL on one of `allowedHosts` (or
+ * under `allowedUrlPrefix`), if `expectedSha256` isn't a SHA-256, if the
+ * download fails, or if `expectedMd5` / `expectedSha256` is set and doesn't
+ * match the downloaded file.
  */
-export async function downloadAndInstallApk({ apkUrl, fileName, onProgress, expectedMd5, allowedHosts = DEFAULT_ALLOWED_HOSTS, }) {
+export async function downloadAndInstallApk({ apkUrl, fileName, onProgress, expectedMd5, expectedSha256, allowedHosts = DEFAULT_ALLOWED_HOSTS, allowedUrlPrefix, }) {
     const host = httpsHost(apkUrl);
     if (!host ||
         !allowedHosts.some((allowed) => allowed.toLowerCase() === host)) {
         throw new Error(`Refusing to download the APK from ${apkUrl}: expected an https:// URL on ${allowedHosts.join(", ")}.`);
     }
+    if (allowedUrlPrefix !== undefined &&
+        !isUnderPrefix(apkUrl, allowedUrlPrefix)) {
+        throw new Error(`Refusing to download the APK from ${apkUrl}: expected a file under ${allowedUrlPrefix}.`);
+    }
+    const sha256 = expectedSha256 === undefined ? undefined : normalizeSha256(expectedSha256);
+    if (sha256 === null) {
+        throw new Error(`Invalid expectedSha256: "${String(expectedSha256)}".`);
+    }
     const destination = new File(Paths.cache, fileName);
     if (destination.exists)
         destination.delete();
@@ -49,6 +79,18 @@ export async function downloadAndInstallApk({ apkUrl, fileName, onProgress, expe
             throw new Error(`APK checksum mismatch: expected ${expectedMd5}, got ${actualMd5 ?? "none"}.`);
         }
     }
+    if (sha256) {
+        const { digest } = file;
+        if (typeof digest !== "function") {
+            file.delete();
+            throw new Error("expectedSha256 needs expo-file-system 58 or later (File#digest).");
+        }
+        const actualSha256 = (await digest.call(file, "SHA-256")).toLowerCase();
+        if (actualSha256 !== sha256) {
+            file.delete();
+            throw new Error(`APK SHA-256 mismatch: expected ${sha256}, got ${actualSha256}.`);
+        }
+    }
     await IntentLauncher.startActivityAsync("android.intent.action.VIEW", {
         data: file.contentUri,
         flags: FLAG_GRANT_READ_URI_PERMISSION,

package/dist/githubReleases.d.ts

@@ -20,6 +20,32 @@ export interface LatestRelease {
     version: string;
     notes: string;
     apkUrl: string;
+    /**
+     * SHA-256 of the `.apk` (64 lowercase hex digits), as computed by GitHub
+     * when the asset was uploaded — pass it to `downloadAndInstallApk`'s
+     * `expectedSha256`. Missing for assets uploaded before GitHub computed
+     * digests (mid-2025).
+     */
+    apkSha256?: string;
+}
+export interface FetchLatestReleaseOptions extends GithubRepoRef {
+    /**
+     * Also consider pre-releases. GitHub's `/releases/latest` only ever returns
+     * a stable release, so an app that only publishes pre-releases (alpha,
+     * beta) would never see an update: with this flag, the most recent
+     * releases are scanned instead and the highest version carrying an `.apk`
+     * wins. Defaults to `false`.
+     */
+    includePrereleases?: boolean;
+    /**
+     * Only consider an `.apk` the recommended install would accept: one with a
+     * SHA-256 (`apkSha256`, for `downloadAndInstallApk`'s `expectedSha256`)
+     * and a URL under `releaseDownloadUrlPrefix(options)` (its
+     * `allowedUrlPrefix`). A release whose APK fails either is skipped — with
+     * `includePrereleases`, the next highest version wins — so nothing is
+     * offered that the install would then refuse. Defaults to `false`.
+     */
+    requireVerifiedApk?: boolean;
 }
 export interface ReleaseHistoryEntry {
     version: string;
@@ -27,12 +53,21 @@ export interface ReleaseHistoryEntry {
     publishedAt: string;
 }
 /**
- * Fetches the latest GitHub release for a repo, along with its `.apk` asset.
+ * `https://github.com/<owner>/<repo>/releases/download/` — where every asset
+ * of this repo's releases lives. Pass it to `downloadAndInstallApk`'s
+ * `allowedUrlPrefix` so only an APK of this very repo can be installed.
+ */
+export declare function releaseDownloadUrlPrefix({ owner, repo }: GithubRepoRef): string;
+/**
+ * Fetches the latest GitHub release for a repo, along with its `.apk` asset
+ * and the SHA-256 GitHub computed for it. Stable releases only, unless
+ * `includePrereleases` is set.
  *
- * @returns `null` if the latest release has no `.apk` asset attached.
+ * @returns `null` if the latest release has no `.apk` asset attached (with
+ * `includePrereleases`: if none of the 10 most recent releases has one).
  * @throws if the GitHub API request fails or times out.
  */
-export declare function fetchLatestRelease(ref: GithubRepoRef): Promise<LatestRelease | null>;
+export declare function fetchLatestRelease(options: FetchLatestReleaseOptions): Promise<LatestRelease | null>;
 /**
  * Fetches the most recent published releases for a repo (version, notes,
  * publish date), most recent first — useful for a "release history" screen.

package/dist/githubReleases.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"githubReleases.d.ts","sourceRoot":"","sources":["../src/githubReleases.ts"],"names":[],"mappings":"AAAA,MAAM,WAAW,aAAa;IAC5B,KAAK,EAAE,MAAM,CAAC;IACd,IAAI,EAAE,MAAM,CAAC;IACb;;;;;OAKG;IACH,KAAK,CAAC,EAAE,MAAM,CAAC;IACf;;;OAGG;IACH,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,4EAA4E;IAC5E,MAAM,CAAC,EAAE,WAAW,CAAC;CACtB;AAED,MAAM,WAAW,aAAa;IAC5B,OAAO,EAAE,MAAM,CAAC;IAChB,KAAK,EAAE,MAAM,CAAC;IACd,MAAM,EAAE,MAAM,CAAC;CAChB;AAED,MAAM,WAAW,mBAAmB;IAClC,OAAO,EAAE,MAAM,CAAC;IAChB,KAAK,EAAE,MAAM,CAAC;IACd,WAAW,EAAE,MAAM,CAAC;CACrB;AAqED;;;;;GAKG;AACH,wBAAsB,kBAAkB,CACtC,GAAG,EAAE,aAAa,GACjB,OAAO,CAAC,aAAa,GAAG,IAAI,CAAC,CAe/B;AAED;;;;GAIG;AACH,wBAAsB,mBAAmB,CACvC,GAAG,EAAE,aAAa,GAAG;IAAE,KAAK,CAAC,EAAE,MAAM,CAAA;CAAE,GACtC,OAAO,CAAC,mBAAmB,EAAE,CAAC,CAchC"}
+{"version":3,"file":"githubReleases.d.ts","sourceRoot":"","sources":["../src/githubReleases.ts"],"names":[],"mappings":"AAEA,MAAM,WAAW,aAAa;IAC5B,KAAK,EAAE,MAAM,CAAC;IACd,IAAI,EAAE,MAAM,CAAC;IACb;;;;;OAKG;IACH,KAAK,CAAC,EAAE,MAAM,CAAC;IACf;;;OAGG;IACH,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,4EAA4E;IAC5E,MAAM,CAAC,EAAE,WAAW,CAAC;CACtB;AAED,MAAM,WAAW,aAAa;IAC5B,OAAO,EAAE,MAAM,CAAC;IAChB,KAAK,EAAE,MAAM,CAAC;IACd,MAAM,EAAE,MAAM,CAAC;IACf;;;;;OAKG;IACH,SAAS,CAAC,EAAE,MAAM,CAAC;CACpB;AAED,MAAM,WAAW,yBAA0B,SAAQ,aAAa;IAC9D;;;;;;OAMG;IACH,kBAAkB,CAAC,EAAE,OAAO,CAAC;IAC7B;;;;;;;OAOG;IACH,kBAAkB,CAAC,EAAE,OAAO,CAAC;CAC9B;AAED,MAAM,WAAW,mBAAmB;IAClC,OAAO,EAAE,MAAM,CAAC;IAChB,KAAK,EAAE,MAAM,CAAC;IACd,WAAW,EAAE,MAAM,CAAC;CACrB;AAgCD;;;;GAIG;AACH,wBAAgB,wBAAwB,CAAC,EAAE,KAAK,EAAE,IAAI,EAAE,EAAE,aAAa,UAEtE;AAwGD;;;;;;;;GAQG;AACH,wBAAsB,kBAAkB,CACtC,OAAO,EAAE,yBAAyB,GACjC,OAAO,CAAC,aAAa,GAAG,IAAI,CAAC,CAyB/B;AAED;;;;GAIG;AACH,wBAAsB,mBAAmB,CACvC,GAAG,EAAE,aAAa,GAAG;IAAE,KAAK,CAAC,EAAE,MAAM,CAAA;CAAE,GACtC,OAAO,CAAC,mBAAmB,EAAE,CAAC,CAchC"}

package/dist/githubReleases.js

@@ -1,9 +1,71 @@
+import { compareVersions } from "./compareVersions.js";
 const DEFAULT_TIMEOUT_MS = 15_000;
 /** GitHub's own max for `per_page`. */
 const MAX_PER_PAGE = 100;
+/** Enough to skip a few releases without an APK (notes only, drafts). */
+const PRERELEASE_SCAN = 10;
+const SHA256_DIGEST = /^sha256:([0-9a-f]{64})$/i;
+/** Release notes longer than this are cut: rendered as is, they'd stall the UI. */
+const MAX_NOTES_LENGTH = 100_000;
+/** Tags, asset names, URLs, dates: anything longer is treated as missing. */
+const MAX_FIELD_LENGTH = 2_048;
 function releasesUrl({ owner, repo }) {
     return `https://api.github.com/repos/${owner}/${repo}/releases`;
 }
+/**
+ * `https://github.com/<owner>/<repo>/releases/download/` — where every asset
+ * of this repo's releases lives. Pass it to `downloadAndInstallApk`'s
+ * `allowedUrlPrefix` so only an APK of this very repo can be installed.
+ */
+export function releaseDownloadUrlPrefix({ owner, repo }) {
+    return `https://github.com/${owner}/${repo}/releases/download/`;
+}
+function text(value) {
+    return typeof value === "string" && value.length <= MAX_FIELD_LENGTH
+        ? value
+        : "";
+}
+function notesOf(release) {
+    return typeof release.body === "string"
+        ? release.body.slice(0, MAX_NOTES_LENGTH)
+        : "";
+}
+function isObject(value) {
+    return typeof value === "object" && value !== null;
+}
+function releasesIn(data) {
+    return Array.isArray(data) ? data.filter(isObject) : [];
+}
+function versionOf(release) {
+    return text(release.tag_name).replace(/^v/, "");
+}
+function apkOf(release, options) {
+    const assets = Array.isArray(release.assets)
+        ? release.assets.filter(isObject)
+        : [];
+    const prefix = releaseDownloadUrlPrefix(options);
+    for (const asset of assets) {
+        const apkUrl = text(asset.browser_download_url);
+        if (!text(asset.name).endsWith(".apk") || apkUrl === "")
+            continue;
+        const sha256 = SHA256_DIGEST.exec(text(asset.digest))?.[1]?.toLowerCase();
+        if (options.requireVerifiedApk && (!sha256 || !apkUrl.startsWith(prefix))) {
+            continue;
+        }
+        return { apkUrl, ...(sha256 ? { apkSha256: sha256 } : {}) };
+    }
+    return null;
+}
+function toLatestRelease(release, options) {
+    const version = versionOf(release);
+    // Without a tag, there's nothing to compare the installed version with.
+    if (version === "")
+        return null;
+    const apk = apkOf(release, options);
+    if (!apk)
+        return null;
+    return { version, notes: notesOf(release), ...apk };
+}
 function githubHeaders({ token }) {
     return {
         Accept: "application/vnd.github+json",
@@ -51,21 +113,31 @@ async function fetchGithubJson(url, ref) {
     }
 }
 /**
- * Fetches the latest GitHub release for a repo, along with its `.apk` asset.
+ * Fetches the latest GitHub release for a repo, along with its `.apk` asset
+ * and the SHA-256 GitHub computed for it. Stable releases only, unless
+ * `includePrereleases` is set.
  *
- * @returns `null` if the latest release has no `.apk` asset attached.
+ * @returns `null` if the latest release has no `.apk` asset attached (with
+ * `includePrereleases`: if none of the 10 most recent releases has one).
  * @throws if the GitHub API request fails or times out.
  */
-export async function fetchLatestRelease(ref) {
-    const data = await fetchGithubJson(`${releasesUrl(ref)}/latest`, ref);
-    const apkAsset = (data.assets ?? []).find((asset) => asset.name.endsWith(".apk"));
-    if (!apkAsset)
-        return null;
-    return {
-        version: (data.tag_name ?? "").replace(/^v/, ""),
-        notes: data.body ?? "",
-        apkUrl: apkAsset.browser_download_url,
-    };
+export async function fetchLatestRelease(options) {
+    if (!options.includePrereleases) {
+        const data = await fetchGithubJson(`${releasesUrl(options)}/latest`, options);
+        return isObject(data) ? toLatestRelease(data, options) : null;
+    }
+    const data = await fetchGithubJson(`${releasesUrl(options)}?per_page=${String(PRERELEASE_SCAN)}`, options);
+    let latest = null;
+    for (const release of releasesIn(data)) {
+        if (release.draft === true)
+            continue;
+        const candidate = toLatestRelease(release, options);
+        if (candidate &&
+            (!latest || compareVersions(candidate.version, latest.version) > 0)) {
+            latest = candidate;
+        }
+    }
+    return latest;
 }
 /**
  * Fetches the most recent published releases for a repo (version, notes,
@@ -76,11 +148,11 @@ export async function fetchReleaseHistory(ref) {
     const { limit = 10 } = ref;
     const perPage = Math.min(Math.max(Math.trunc(limit), 1), MAX_PER_PAGE);
     const data = await fetchGithubJson(`${releasesUrl(ref)}?per_page=${String(perPage)}`, ref);
-    return data
-        .filter((release) => !release.draft)
+    return releasesIn(data)
+        .filter((release) => release.draft !== true)
         .map((release) => ({
-        version: (release.tag_name ?? "").replace(/^v/, ""),
-        notes: release.body ?? "",
-        publishedAt: release.published_at ?? "",
+        version: versionOf(release),
+        notes: notesOf(release),
+        publishedAt: text(release.published_at),
     }));
 }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@forthtilliath/expo-release-updates",
-  "version": "0.7.1",
+  "version": "0.9.0",
   "type": "module",
   "sideEffects": false,
   "license": "MIT",
@@ -34,18 +34,18 @@
     }
   },
   "dependencies": {
-    "@forthtilliath/ts-kit": "^0.13.0"
+    "@forthtilliath/ts-kit": "^0.15.0"
   },
   "devDependencies": {
-    "@vitest/coverage-v8": "5.0.2",
+    "@vitest/coverage-v8": "5.0.5",
     "eslint": "10.7.0",
     "expo-file-system": "~57.0.2",
     "expo-intent-launcher": "~57.0.1",
     "typescript": "^5.9.3",
-    "vitest": "^5.0.2",
-    "@forthtilliath/test-kit": "0.3.0",
-    "@forthtilliath/eslint-config": "0.9.0",
-    "@forthtilliath/typescript-config": "0.1.1"
+    "vitest": "^5.0.5",
+    "@forthtilliath/typescript-config": "0.1.1",
+    "@forthtilliath/eslint-config": "0.10.0",
+    "@forthtilliath/test-kit": "0.4.0"
   },
   "scripts": {
     "lint": "eslint . --max-warnings 0",