@renbostudios/edge-ota 0.1.0

package/README.md

@@ -0,0 +1,119 @@
+# `@renbostudios/edge-ota`
+
+> Zero-SDK, self-hostable OTA update CLI for Expo apps.  
+> Push cryptographically signed JS bundles to any EdgeOTA server — no Expo account required.
+
+## Install
+
+```bash
+npm install -g @renbostudios/edge-ota
+# or use without installing:
+npx @renbostudios/edge-ota <command>
+```
+
+## Quick Start
+
+Run these commands **inside your Expo project directory**:
+
+```bash
+# 1. Generate ECDSA P-256 keys and write config
+edge-ota init
+
+# 2. Push your first update
+edge-ota push --channel production --runtime 1.0.0
+
+# 3. Check what's deployed
+edge-ota status
+```
+
+## Commands
+
+### `edge-ota init [options]`
+
+Generates an ECDSA P-256 key pair, writes `edge-ota.config.json` and `.edge-ota.private.key`, and auto-adds the private key to `.gitignore`.
+
+| Option | Default | Description |
+|--------|---------|-------------|
+| `-s, --server <url>` | `http://localhost:3000` | Your EdgeOTA server URL |
+
+**Output:**
+- `edge-ota.config.json` — server URL + public key (safe to commit)
+- `.edge-ota.private.key` — private signing key (**never commit this**)
+
+---
+
+### `edge-ota push [options]`
+
+Runs `expo export`, hashes every asset with SHA-256, signs the payload with your private key, then uploads the bundle to your server.
+
+| Option | Default | Description |
+|--------|---------|-------------|
+| `-c, --channel <name>` | `production` | Deployment channel |
+| `-r, --runtime <version>` | `1.0.0` | Native runtime version (must match `runtimeVersion` in app.json) |
+| `-p, --platform <platform>` | `all` | `ios`, `android`, or `all` |
+| `--skip-export` | — | Skip `expo export` — use existing `./dist` |
+| `--dry-run` | — | Sign the payload but don't upload |
+
+**Example — CI/CD:**
+```bash
+edge-ota push \
+  --channel production \
+  --runtime 1.2.0 \
+  --platform all
+```
+
+---
+
+### `edge-ota status [options]`
+
+Lists recent releases from the server as a table.
+
+| Option | Default | Description |
+|--------|---------|-------------|
+| `-t, --token <token>` | `$EDGE_OTA_TOKEN` | Auth token from the dashboard |
+| `-n, --limit <n>` | `10` | Number of releases to show |
+
+```bash
+export EDGE_OTA_TOKEN="your-dashboard-token"
+edge-ota status
+```
+
+---
+
+### `edge-ota keygen`
+
+Prints a fresh ECDSA P-256 key pair to stdout without writing any files. Useful for generating secrets to store in CI/CD environment variables.
+
+```bash
+edge-ota keygen
+```
+
+---
+
+## How it works
+
+1. **Build** — `expo export` produces a JS bundle + assets in `./dist/`
+2. **Hash** — every file gets a SHA-256 content hash (enables deduplication on the server)
+3. **Sign** — the upload payload (`{ channel, runtimeVersion, bundleHash, ... }`) is signed with your ECDSA P-256 private key
+4. **Upload** — `POST /api/updates` with `multipart/form-data` containing the bundle zip, payload JSON, and signature
+5. **Serve** — when your app checks for updates, the server verifies the stored signature and returns a signed manifest
+6. **Verify** — the Expo SDK verifies the manifest signature and bundle hash before swapping the active bundle
+
+## Expo App Setup
+
+Add to your `app.json`:
+
+```json
+{
+  "expo": {
+    "updates": {
+      "url": "https://your-edge-ota-server.com/api/updates",
+      "runtimeVersion": { "policy": "nativeVersion" }
+    }
+  }
+}
+```
+
+## License
+
+MIT

package/dist/core/crypto.js

@@ -0,0 +1,87 @@
+/**
+ * EdgeOTA Core - Cryptographic Utilities
+ *
+ * Implements ECDSA P-256 + SHA-256 signing and verification,
+ * compatible with both Node.js (via globalThis.crypto.subtle) and
+ * the Cloudflare Workers runtime (same Web Crypto API).
+ *
+ * Key format: PKCS#8 private key / SPKI public key — PEM-encoded.
+ * Signature format: raw DER bytes → base64 string (NOT base64url,
+ * to stay compatible with the existing expo-updates SDK verification).
+ */
+/** Generate a fresh ECDSA P-256 key pair encoded as PEM. */
+export async function generateECDSAKeyPair() {
+    const keyPair = await globalThis.crypto.subtle.generateKey({ name: "ECDSA", namedCurve: "P-256" }, true, ["sign", "verify"]);
+    const privateKeyDer = await globalThis.crypto.subtle.exportKey("pkcs8", keyPair.privateKey);
+    const publicKeyDer = await globalThis.crypto.subtle.exportKey("spki", keyPair.publicKey);
+    return {
+        privateKey: derToPem(privateKeyDer, "PRIVATE KEY"),
+        publicKey: derToPem(publicKeyDer, "PUBLIC KEY")
+    };
+}
+/**
+ * Sign an arbitrary string payload with a PEM-encoded ECDSA P-256 private key.
+ * Returns the raw signature bytes encoded as base64.
+ */
+export async function signPayload(payload, privateKeyPem) {
+    const privateKeyDer = pemToDer(privateKeyPem, "PRIVATE KEY");
+    const privateKey = await globalThis.crypto.subtle.importKey("pkcs8", privateKeyDer, { name: "ECDSA", namedCurve: "P-256" }, false, ["sign"]);
+    const data = new TextEncoder().encode(payload);
+    const sigBuffer = await globalThis.crypto.subtle.sign({ name: "ECDSA", hash: { name: "SHA-256" } }, privateKey, data);
+    return arrayBufferToBase64(sigBuffer);
+}
+/**
+ * Verify a base64-encoded ECDSA P-256 signature against a payload string
+ * using a PEM-encoded public key.
+ */
+export async function verifyPayload(payload, signatureBase64, publicKeyPem) {
+    try {
+        const publicKeyDer = pemToDer(publicKeyPem, "PUBLIC KEY");
+        const publicKey = await globalThis.crypto.subtle.importKey("spki", publicKeyDer, { name: "ECDSA", namedCurve: "P-256" }, false, ["verify"]);
+        const data = new TextEncoder().encode(payload);
+        const signature = base64ToArrayBuffer(signatureBase64);
+        return await globalThis.crypto.subtle.verify({ name: "ECDSA", hash: { name: "SHA-256" } }, publicKey, signature, data);
+    }
+    catch {
+        return false;
+    }
+}
+/**
+ * SHA-256 hash a buffer and return the hex string.
+ * Used to produce the per-asset `hash` field in the Expo manifest.
+ */
+export async function sha256Hex(buffer) {
+    const digest = await globalThis.crypto.subtle.digest("SHA-256", buffer);
+    return Array.from(new Uint8Array(digest))
+        .map(b => b.toString(16).padStart(2, "0"))
+        .join("");
+}
+// ─── Internal PEM / DER utilities ────────────────────────────────────────────
+function derToPem(der, label) {
+    const base64 = arrayBufferToBase64(der);
+    const lines = base64.match(/.{1,64}/g) || [];
+    return `-----BEGIN ${label}-----\n${lines.join("\n")}\n-----END ${label}-----`;
+}
+function pemToDer(pem, label) {
+    const cleanPem = pem
+        .replace(`-----BEGIN ${label}-----`, "")
+        .replace(`-----END ${label}-----`, "")
+        .replace(/\s+/g, "");
+    return base64ToArrayBuffer(cleanPem);
+}
+function arrayBufferToBase64(buffer) {
+    const bytes = new Uint8Array(buffer);
+    let binary = "";
+    for (let i = 0; i < bytes.byteLength; i++) {
+        binary += String.fromCharCode(bytes[i]);
+    }
+    return globalThis.btoa(binary);
+}
+function base64ToArrayBuffer(base64) {
+    const binary = globalThis.atob(base64);
+    const bytes = new Uint8Array(binary.length);
+    for (let i = 0; i < binary.length; i++) {
+        bytes[i] = binary.charCodeAt(i);
+    }
+    return bytes.buffer;
+}

package/dist/core/index.js

@@ -0,0 +1,2 @@
+export * from "./crypto.js";
+export * from "./manifest.js";

package/dist/core/manifest.js

@@ -0,0 +1,78 @@
+/**
+ * EdgeOTA Core - Expo Updates Protocol v1 Manifest Engine
+ *
+ * Implements the exact wire format consumed by expo-updates SDK:
+ * - EAS Update-compatible manifest structure
+ * - Multipart/mixed response body with proper boundary
+ * - expo-signature header for ECDSA bundle verification
+ * - Structured extension (extra) metadata passthrough
+ */
+/**
+ * Build the Expo Updates v1 manifest object.
+ * The client SDK deserialises this from the `manifest` part of the
+ * multipart response (or directly from the response body in non-multipart mode).
+ */
+export function generateExpoManifest(params) {
+    return {
+        id: params.updateId,
+        createdAt: params.createdAt,
+        runtimeVersion: params.runtimeVersion,
+        launchAsset: {
+            hash: params.bundleHash,
+            key: "bundle",
+            contentType: "application/javascript",
+            url: params.bundleUrl
+        },
+        assets: params.assets,
+        metadata: params.metadata ?? {},
+        extra: params.extra ?? {}
+    };
+}
+/**
+ * Build the response headers required by the Expo Updates protocol.
+ *
+ * expo-protocol-version: "1"  — Signals v1 manifest format
+ * expo-sfv-version: "0"       — Structured Fields version
+ * cache-control               — Updates must never be stale; client always revalidates
+ * expo-signature              — ECDSA P-256 + SHA-256 signature over the manifest JSON
+ *                               (base64url-encoded DER). Omitted when no key is configured.
+ */
+export function createExpoHeaders(signature) {
+    const headers = {
+        "expo-protocol-version": "1",
+        "expo-sfv-version": "0",
+        "cache-control": "private, max-age=0, must-revalidate",
+        "content-type": "application/json"
+    };
+    if (signature) {
+        // EAS format: sig="<base64>", keyid="root", alg="sig-rs256"
+        // For ECDSA P-256 we use the simpler bare signature header
+        headers["expo-signature"] = `sig="${signature}", keyid="root", alg="ecdsa-p256-sha256"`;
+    }
+    return headers;
+}
+/**
+ * Build the multipart/mixed response body required when the client sends
+ * `Accept: multipart/mixed` (expo-updates >=0.18).
+ *
+ * Layout:
+ *   --<boundary>
+ *   Content-Type: application/json
+ *   expo-signature: sig="...", keyid="root", alg="ecdsa-p256-sha256"
+ *
+ *   <manifest JSON>
+ *   --<boundary>--
+ */
+export function buildMultipartManifestBody(manifest, signature) {
+    const boundary = "expo-update-boundary-" + Math.random().toString(36).slice(2, 10);
+    const manifestJson = JSON.stringify(manifest);
+    let partHeaders = "Content-Type: application/json\r\n";
+    if (signature) {
+        partHeaders += `expo-signature: sig="${signature}", keyid="root", alg="ecdsa-p256-sha256"\r\n`;
+    }
+    const body = `--${boundary}\r\n` +
+        `${partHeaders}\r\n` +
+        `${manifestJson}\r\n` +
+        `--${boundary}--\r\n`;
+    return { body, boundary };
+}

package/dist/index.js

@@ -0,0 +1,328 @@
+#!/usr/bin/env node
+/**
+ * edge-ota CLI
+ *
+ * Phase 1: Build / Upload
+ * ─────────────────────────────────────────────────────────────────────────
+ * 1. `edge-ota init`   – Generate ECDSA P-256 key pair, write config + private key.
+ * 2. `edge-ota push`   – Run `expo export`, collect JS bundle + assets, compute
+ *                        per-asset SHA-256 hashes, sign the upload payload with the
+ *                        private key, POST a multipart/form-data to /api/updates.
+ * 3. `edge-ota status` – List recent releases and their channel assignments.
+ *
+ * The server verifies the ECDSA signature before accepting the bundle,
+ * then stores assets on disk (server-node) or R2 (worker-oss) and
+ * records the update in the database.
+ *
+ * From that point the Expo Updates SDK handshake is:
+ *   GET /api/updates
+ *   expo-platform: ios | android
+ *   expo-runtime-version: <semver>
+ *   expo-channel-name: production | staging | …
+ *
+ * The server responds with an Expo Updates v1 manifest JSON (signed if a
+ * public key is configured) and the SDK fetches launchAsset.url to swap
+ * the active bundle.
+ */
+import { Command } from "commander";
+import { execSync } from "child_process";
+import fs from "fs";
+import path from "path";
+import { createWriteStream } from "fs";
+import archiver from "archiver";
+import { generateECDSAKeyPair, signPayload, sha256Hex } from "./core/index.js";
+function loadConfig(cwd) {
+    const configPath = path.resolve(cwd, "edge-ota.config.json");
+    if (!fs.existsSync(configPath)) {
+        console.error("❌  edge-ota.config.json not found. Run `edge-ota init` first.");
+        process.exit(1);
+    }
+    return JSON.parse(fs.readFileSync(configPath, "utf-8"));
+}
+function loadPrivateKey(cwd) {
+    const keyPath = path.resolve(cwd, ".edge-ota.private.key");
+    if (!fs.existsSync(keyPath)) {
+        console.error("❌  .edge-ota.private.key not found. Run `edge-ota init` first.");
+        process.exit(1);
+    }
+    return fs.readFileSync(keyPath, "utf-8");
+}
+// ─── Archive helper ──────────────────────────────────────────────────────────
+function zipDirectory(sourceDir, outPath) {
+    return new Promise((resolve, reject) => {
+        const archive = archiver("zip", { zlib: { level: 9 } });
+        const stream = createWriteStream(outPath);
+        archive.directory(sourceDir, false);
+        archive.on("error", reject);
+        stream.on("close", resolve);
+        archive.pipe(stream);
+        archive.finalize();
+    });
+}
+// ─── SHA-256 of a file ───────────────────────────────────────────────────────
+async function hashFile(filePath) {
+    const buffer = fs.readFileSync(filePath);
+    return sha256Hex(buffer.buffer.slice(buffer.byteOffset, buffer.byteOffset + buffer.byteLength));
+}
+const CONTENT_TYPES = {
+    ".js": "application/javascript",
+    ".json": "application/json",
+    ".png": "image/png",
+    ".jpg": "image/jpeg",
+    ".jpeg": "image/jpeg",
+    ".gif": "image/gif",
+    ".svg": "image/svg+xml",
+    ".ttf": "font/ttf",
+    ".otf": "font/otf",
+    ".woff": "font/woff",
+    ".woff2": "font/woff2",
+    ".mp4": "video/mp4",
+    ".webm": "video/webm"
+};
+async function collectAssets(distDir) {
+    const entries = [];
+    function walk(dir) {
+        for (const name of fs.readdirSync(dir)) {
+            const full = path.join(dir, name);
+            const stat = fs.statSync(full);
+            if (stat.isDirectory()) {
+                walk(full);
+            }
+            else {
+                const ext = path.extname(name).toLowerCase();
+                const ct = CONTENT_TYPES[ext] || "application/octet-stream";
+                const key = path.relative(distDir, full).replace(/\\/g, "/");
+                entries.push({ localPath: full, key, contentType: ct, hash: "" });
+            }
+        }
+    }
+    walk(distDir);
+    // Hash all assets in parallel
+    await Promise.all(entries.map(async (e) => {
+        e.hash = await hashFile(e.localPath);
+    }));
+    return entries;
+}
+// ─── Detect the JS bundle within the Expo export output ──────────────────────
+function findBundle(distDir, platform) {
+    // Expo SDK 50+ writes: dist/_expo/static/js/<platform>/<hash>.js
+    const expoStaticJs = path.join(distDir, "_expo", "static", "js", platform);
+    if (fs.existsSync(expoStaticJs)) {
+        const files = fs.readdirSync(expoStaticJs).filter(f => f.endsWith(".js"));
+        if (files.length)
+            return path.join(expoStaticJs, files[0]);
+    }
+    // Fallback: older SDK flat layout
+    const flat = path.join(distDir, `index.${platform}.js`);
+    if (fs.existsSync(flat))
+        return flat;
+    // Any .js at root
+    const rootJs = fs.readdirSync(distDir).find(f => f.endsWith(".js"));
+    if (rootJs)
+        return path.join(distDir, rootJs);
+    return null;
+}
+// ─── CLI definition ──────────────────────────────────────────────────────────
+const program = new Command();
+program
+    .name("edge-ota")
+    .description("Zero-SDK, self-hostable OTA update platform for Expo")
+    .version("0.2.0");
+// ──────────────────────────────────────────────────────
+// edge-ota init
+// ──────────────────────────────────────────────────────
+program
+    .command("init")
+    .description("Generate an ECDSA P-256 key pair and write edge-ota.config.json")
+    .option("-s, --server <url>", "EdgeOTA server URL", "http://localhost:3000")
+    .action(async (options) => {
+    console.log("⚙️  Generating ECDSA P-256 key pair...");
+    const keys = await generateECDSAKeyPair();
+    const config = {
+        serverUrl: options.server,
+        publicKey: keys.publicKey
+    };
+    fs.writeFileSync("edge-ota.config.json", JSON.stringify(config, null, 2));
+    fs.writeFileSync(".edge-ota.private.key", keys.privateKey, { mode: 0o600 });
+    // Add the private key to .gitignore if it isn't already
+    const gitignorePath = ".gitignore";
+    const gitignoreEntry = ".edge-ota.private.key";
+    if (fs.existsSync(gitignorePath)) {
+        const current = fs.readFileSync(gitignorePath, "utf-8");
+        if (!current.includes(gitignoreEntry)) {
+            fs.appendFileSync(gitignorePath, `\n${gitignoreEntry}\n`);
+            console.log("✅  Added .edge-ota.private.key to .gitignore");
+        }
+    }
+    else {
+        fs.writeFileSync(gitignorePath, `${gitignoreEntry}\n`);
+    }
+    console.log("\n✅  EdgeOTA initialised.");
+    console.log("   Config :  edge-ota.config.json");
+    console.log("   Key    :  .edge-ota.private.key  (keep this secret!)");
+    console.log("\n📋  Public key to paste into your dashboard → Settings → Infrastructure:\n");
+    console.log(keys.publicKey);
+    console.log("\n💡  Add this to your app.json:\n" +
+        '   "updates": {\n' +
+        '     "url": "' + options.server + '/api/updates"\n' +
+        "   }");
+});
+// ──────────────────────────────────────────────────────
+// edge-ota push
+// ──────────────────────────────────────────────────────
+program
+    .command("push")
+    .description("Export the Expo bundle, compute per-asset hashes, sign & upload to the EdgeOTA server")
+    .option("-c, --channel <channel>", "Deployment channel", "production")
+    .option("-r, --runtime <version>", "React Native runtime version (semver)", "1.0.0")
+    .option("-p, --platform <platform>", "Target platform: ios | android | all", "all")
+    .option("--skip-export", "Skip expo export (use existing ./dist directory)")
+    .option("--dry-run", "Build and sign the payload but do NOT upload")
+    .action(async (options) => {
+    const cwd = process.cwd();
+    const config = loadConfig(cwd);
+    const privateKey = loadPrivateKey(cwd);
+    // ── Step 1: Build ────────────────────────────────────────────────────────
+    const distDir = path.resolve(cwd, "dist");
+    if (!options.skipExport) {
+        console.log("📦  Running expo export...");
+        try {
+            execSync("npx expo export", { stdio: "inherit", cwd });
+        }
+        catch {
+            console.error("❌  expo export failed. Aborting.");
+            process.exit(1);
+        }
+    }
+    else {
+        console.log("⏭️   Skipping expo export (--skip-export)");
+    }
+    if (!fs.existsSync(distDir)) {
+        console.error("❌  ./dist directory not found after export. Aborting.");
+        process.exit(1);
+    }
+    // ── Step 2: Collect assets & hashes ─────────────────────────────────────
+    console.log("🔍  Collecting assets and computing SHA-256 hashes...");
+    const assets = await collectAssets(distDir);
+    console.log(`   Found ${assets.length} asset(s)`);
+    const platforms = options.platform === "all" ? ["ios", "android"] : [options.platform];
+    for (const platform of platforms) {
+        console.log(`\n🚀  Processing platform: ${platform.toUpperCase()}`);
+        // Find the JS bundle
+        const bundlePath = findBundle(distDir, platform);
+        if (!bundlePath) {
+            console.warn(`⚠️   No bundle found for ${platform}. Skipping.`);
+            continue;
+        }
+        const bundleHash = await hashFile(bundlePath);
+        const bundleAsset = assets.find(a => a.localPath === bundlePath);
+        // ── Step 3: Build the signed payload ──────────────────────────────────
+        const payloadObj = {
+            channel: options.channel,
+            runtimeVersion: options.runtime,
+            platform,
+            bundleHash,
+            timestamp: Date.now(),
+            assetCount: assets.length
+        };
+        const payloadStr = JSON.stringify(payloadObj);
+        console.log("🔏  Signing payload with ECDSA P-256...");
+        const signature = await signPayload(payloadStr, privateKey);
+        console.log(`   Signature: ${signature.slice(0, 24)}…`);
+        if (options.dryRun) {
+            console.log("🏳️   Dry run — skipping upload.");
+            console.log("   Payload:", payloadObj);
+            continue;
+        }
+        // ── Step 4: Upload ─────────────────────────────────────────────────────
+        // Pack the whole dist directory into a zip for server-side extraction
+        const zipPath = path.resolve(cwd, `update-bundle-${platform}.zip`);
+        console.log("🗜️   Zipping bundle...");
+        await zipDirectory(distDir, zipPath);
+        const zipBuffer = fs.readFileSync(zipPath);
+        // Build multipart/form-data manually (Node 18+ has FormData but
+        // Blob.arrayBuffer is not always available; use Buffer directly).
+        const form = new FormData();
+        form.append("bundle", new Blob([zipBuffer], { type: "application/zip" }), `bundle-${platform}.zip`);
+        form.append("payload", payloadStr);
+        form.append("signature", signature);
+        form.append("platform", platform);
+        console.log(`📡  Uploading to ${config.serverUrl}/api/updates ...`);
+        const response = await fetch(`${config.serverUrl}/api/updates`, {
+            method: "POST",
+            body: form
+            // Note: do NOT set Content-Type; fetch sets it automatically
+            //       with the correct multipart boundary.
+        });
+        // Clean up zip
+        fs.unlinkSync(zipPath);
+        if (response.ok) {
+            const body = await response.json().catch(() => ({}));
+            const updateId = body.updateId || "unknown";
+            console.log(`\n✅  ${platform.toUpperCase()} update deployed!`);
+            console.log(`   Update ID : ${updateId}`);
+            console.log(`   Channel   : ${options.channel}`);
+            console.log(`   Runtime   : ${options.runtime}`);
+            console.log(`   Bundle    : ${bundleHash.slice(0, 16)}…`);
+        }
+        else {
+            const text = await response.text();
+            console.error(`\n❌  Upload failed (HTTP ${response.status}): ${text}`);
+            process.exit(1);
+        }
+    }
+    console.log("\n🎉  Done. Your app will receive this update on the next OTA sync.\n" +
+        "   Powered by EdgeOTA — https://github.com/edge-ota");
+});
+// ──────────────────────────────────────────────────────
+// edge-ota status
+// ──────────────────────────────────────────────────────
+program
+    .command("status")
+    .description("List recent releases from the EdgeOTA server")
+    .option("-t, --token <token>", "Auth token (or set EDGE_OTA_TOKEN env var)")
+    .option("-n, --limit <n>", "Number of releases to show", "10")
+    .action(async (options) => {
+    const cwd = process.cwd();
+    const config = loadConfig(cwd);
+    const token = options.token || process.env.EDGE_OTA_TOKEN;
+    if (!token) {
+        console.error("❌  Auth token required. Use -t <token> or set EDGE_OTA_TOKEN.");
+        process.exit(1);
+    }
+    const res = await fetch(`${config.serverUrl}/api/releases`, {
+        headers: { Authorization: `Bearer ${token}` }
+    });
+    if (!res.ok) {
+        console.error(`❌  Failed to fetch releases (HTTP ${res.status})`);
+        process.exit(1);
+    }
+    const releases = (await res.json());
+    if (!releases.length) {
+        console.log("No releases found.");
+        return;
+    }
+    const rows = releases.slice(0, parseInt(options.limit)).map((r) => ({
+        ID: r.id.slice(0, 8),
+        Channel: r.channel,
+        Runtime: r.runtime,
+        Status: r.status,
+        Published: r.published,
+        "By": r.publisher
+    }));
+    console.table(rows);
+});
+// ──────────────────────────────────────────────────────
+// edge-ota keygen
+// ──────────────────────────────────────────────────────
+program
+    .command("keygen")
+    .description("Generate a fresh ECDSA key pair (prints to stdout, does not write files)")
+    .action(async () => {
+    const keys = await generateECDSAKeyPair();
+    console.log("--- PRIVATE KEY (keep secret) ---");
+    console.log(keys.privateKey);
+    console.log("\n--- PUBLIC KEY (paste into dashboard) ---");
+    console.log(keys.publicKey);
+});
+program.parse(process.argv);

package/package.json

@@ -0,0 +1,39 @@
+{
+  "name": "@renbostudios/edge-ota",
+  "version": "0.1.0",
+  "description": "Zero-SDK, self-hostable OTA update CLI for Expo — push signed JS bundles to any EdgeOTA server",
+  "license": "MIT",
+  "author": "EdgeOTA Contributors",
+  "homepage": "https://github.com/Renbo-Studios/edge-ota",
+  "repository": {
+    "type": "git",
+    "url": "https://github.com/Renbo-Studios/edge-ota.git"
+  },
+  "bugs": {
+    "url": "https://github.com/Renbo-Studios/edge-ota/issues"
+  },
+  "keywords": ["expo", "ota", "updates", "react-native", "cli", "edge", "cloudflare"],
+  "type": "module",
+  "bin": {
+    "edge-ota": "./dist/index.js"
+  },
+  "files": [
+    "dist",
+    "README.md"
+  ],
+  "scripts": {
+    "build": "tsc",
+    "dev": "tsc --watch",
+    "clean": "rm -rf dist",
+    "prepublishOnly": "npm run build"
+  },
+  "dependencies": {
+    "commander": "^12.1.0",
+    "archiver": "^7.0.1"
+  },
+  "devDependencies": {
+    "typescript": "^5.4.5",
+    "@types/node": "^20.12.12",
+    "@types/archiver": "^6.0.2"
+  }
+}