@renbostudios/edge-ota 0.2.7 → 0.2.9

package/README.md

@@ -1,125 +1,26 @@
-# `@edge-ota/cli`
+# @renbostudios/edge-ota CLI
 
-> Zero-SDK, self-hostable OTA update CLI for Expo apps.  
-> Push cryptographically signed JS bundles to any EdgeOTA server — no Expo account required.
+Zero-SDK, self-hostable OTA updates for Expo.
 
-## Install
-
-```bash
-npm install -g @edge-ota/cli
-# or use without installing:
-npx @edge-ota/cli <command>
-```
-
-## Quick Start
-
-Run these commands **inside your Expo project directory**:
-
-```bash
-# 1. Generate ECDSA P-256 keys and write config
-edge-ota init
-
-# 2. Push your first update
-edge-ota push --channel production --runtime 1.0.0
-
-# 3. Check what's deployed
-edge-ota status
-```
+See the [main README](../../README.md) for full documentation.
 
 ## Commands
 
-### `edge-ota init [options]`
-
-Generates an ECDSA P-256 key pair, writes `edge-ota.config.json` and `.edge-ota.private.key`, auto-adds the private key to `.gitignore`, and automatically updates your Expo `app.json` configuration file with the new updates URL.
-
-If `--server` is not specified, you will be prompted interactively to enter the URL of your hosted or local EdgeOTA server and your optional Project ID.
-
-| Option | Default | Description |
-|--------|---------|-------------|
-| `-s, --server <url>` | — | Your EdgeOTA server URL (prompts if omitted) |
-| `--project <id>` | — | Your EdgeOTA Project ID (prompts if omitted, optional) |
-
-**Output:**
-- `edge-ota.config.json` — server URL, public key, and optional project ID (safe to commit)
-- `.edge-ota.private.key` — private signing key (**never commit this**)
-- **Auto-configured:** `app.json` is modified to point `expo.updates.url` to your server's updates endpoint. If a Project ID is configured, it points to `/api/projects/:projectId/updates`; otherwise, it falls back to the global `/api/updates` endpoint.
-
----
-
-### `edge-ota push [options]`
-
-Runs `expo export`, hashes every asset with SHA-256, signs the payload with your private key, then uploads the bundle to your server.
-
-| Option | Default | Description |
-|--------|---------|-------------|
-| `-c, --channel <name>` | `production` | Deployment channel |
-| `-r, --runtime <version>` | `1.0.0` | Native runtime version (must match `runtimeVersion` in app.json) |
-| `-p, --platform <platform>` | `all` | `ios`, `android`, or `all` |
-| `--project <id>` | — | Project ID (overrides value in `edge-ota.config.json`) |
-| `--skip-export` | — | Skip `expo export` — use existing `./dist` |
-| `--dry-run` | — | Sign the payload but don't upload |
-
-**Example — CI/CD:**
-```bash
-edge-ota push \
-  --channel production \
-  --runtime 1.2.0 \
-  --platform all
 ```
-
----
-
-### `edge-ota status [options]`
-
-Lists recent releases from the server as a table.
-
-| Option | Default | Description |
-|--------|---------|-------------|
-| `-t, --token <token>` | `$EDGE_OTA_TOKEN` | Auth token from the dashboard |
-| `-n, --limit <n>` | `10` | Number of releases to show |
-| `--project <id>` | — | Project ID to query (overrides config) |
-
-```bash
-export EDGE_OTA_TOKEN="your-dashboard-token"
-edge-ota status
+edge-ota login          # Log in globally
+edge-ota logout         # Log out
+edge-ota init           # Set up a new project
+edge-ota push           # Publish an OTA update
+edge-ota status         # View recent deployments
+edge-ota keygen         # Generate a new key pair
 ```
 
----
-
-### `edge-ota keygen`
-
-Prints a fresh ECDSA P-256 key pair to stdout without writing any files. Useful for generating secrets to store in CI/CD environment variables.
+## Install
 
 ```bash
-edge-ota keygen
+npm install -g @renbostudios/edge-ota
 ```
 
 ---
 
-## How it works
-
-1. **Build** — `expo export` produces a JS bundle + assets in `./dist/`
-2. **Hash** — every file gets a SHA-256 content hash (enables deduplication on the server)
-3. **Sign** — the upload payload (`{ channel, runtimeVersion, bundleHash, ... }`) is signed with your ECDSA P-256 private key
-4. **Upload** — `POST /api/updates` with `multipart/form-data` containing the bundle zip, payload JSON, and signature
-5. **Serve** — when your app checks for updates, the server verifies the stored signature and returns a signed manifest
-6. **Verify** — the Expo SDK verifies the manifest signature and bundle hash before swapping the active bundle
-
-## Expo App Setup
-
-Add to your `app.json`:
-
-```json
-{
-  "expo": {
-    "updates": {
-      "url": "https://your-edge-ota-server.com/api/updates",
-      "runtimeVersion": { "policy": "nativeVersion" }
-    }
-  }
-}
-```
-
-## License
-
-MIT
+by **[Renbo Studios](https://renbostudios.com)** — Mobile App Development Studio

package/dist/core/manifest.js

@@ -1,16 +1,18 @@
 /**
  * EdgeOTA Core - Expo Updates Protocol v1 Manifest Engine
  *
- * Implements the exact wire format consumed by expo-updates SDK:
+ * Implements the exact wire format consumed by expo-updates SDK,
+ * matching the official expo/custom-expo-updates-server reference:
  * - EAS Update-compatible manifest structure
- * - Multipart/mixed response body with proper boundary
+ * - Multipart/mixed response body with FormData-compatible boundary
  * - expo-signature header for ECDSA bundle verification
- * - Structured extension (extra) metadata passthrough
+ * - fileExtension on launchAsset and assets
+ * - extra.expoClient config passthrough
  */
 /**
- * Build the Expo Updates v1 manifest object.
- * The client SDK deserialises this from the `manifest` part of the
- * multipart response (or directly from the response body in non-multipart mode).
+ * Convert a hex SHA-256 hash to base64url encoding.
+ * expo-updates verifies downloaded assets by computing SHA-256, base64url-encoding it,
+ * and comparing against the manifest `hash` field.
  */
 function hexToBase64Url(hex) {
     if (hex.length !== 64 || !/^[0-9a-fA-F]+$/.test(hex)) {
@@ -30,6 +32,10 @@ function hexToBase64Url(hex) {
         .replace(/\//g, '_')
         .replace(/=+$/, '');
 }
+/**
+ * Build the Expo Updates v1 manifest object.
+ * Matches the format produced by expo/custom-expo-updates-server.
+ */
 export function generateExpoManifest(params) {
     return {
         id: params.updateId,
@@ -37,7 +43,8 @@ export function generateExpoManifest(params) {
         runtimeVersion: params.runtimeVersion,
         launchAsset: {
             hash: hexToBase64Url(params.bundleHash),
-            key: "bundle",
+            key: params.bundleKey || params.bundleHash.slice(0, 32),
+            fileExtension: ".bundle",
             contentType: "application/javascript",
             url: params.bundleUrl
         },
@@ -56,45 +63,46 @@ export function generateExpoManifest(params) {
  * expo-sfv-version: "0"       — Structured Fields version
  * cache-control               — Updates must never be stale; client always revalidates
  * expo-signature              — ECDSA P-256 + SHA-256 signature over the manifest JSON
- *                               (base64url-encoded DER). Omitted when no key is configured.
  */
 export function createExpoHeaders(signature) {
     const headers = {
         "expo-protocol-version": "1",
         "expo-sfv-version": "0",
-        "cache-control": "private, max-age=0, must-revalidate",
-        "content-type": "application/json"
+        "cache-control": "private, max-age=0",
     };
     if (signature) {
-        // EAS format: sig="<base64>", keyid="root", alg="sig-rs256"
-        // For ECDSA P-256 we use the simpler bare signature header
         headers["expo-signature"] = `sig="${signature}", keyid="root", alg="ecdsa-p256-sha256"`;
     }
     return headers;
 }
 /**
- * Build the multipart/mixed response body required when the client sends
- * `Accept: multipart/mixed` (expo-updates >=0.18).
- *
- * Layout:
- *   --<boundary>
- *   Content-Type: application/json
- *   expo-signature: sig="...", keyid="root", alg="ecdsa-p256-sha256"
+ * Build the multipart/mixed response body required by expo-updates protocol v1.
+ * Uses FormData-compatible boundary formatting matching the official Expo server.
  *
- *   <manifest JSON>
- *   --<boundary>--
+ * The expo-updates native client parses this multipart body to extract the manifest
+ * from the part named "manifest".
  */
 export function buildMultipartManifestBody(manifest, signature) {
-    const boundary = "expo-update-boundary-" + Math.random().toString(36).slice(2, 10);
+    const boundary = "ota" + Date.now().toString(36) + Math.random().toString(36).slice(2, 8);
     const manifestJson = JSON.stringify(manifest);
-    let partHeaders = "Content-Disposition: inline; name=\"manifest\"\r\n";
-    partHeaders += "Content-Type: application/json\r\n";
+    // Build the manifest part headers exactly as FormData would
+    let manifestPart = `--${boundary}\r\n`;
+    manifestPart += `Content-Disposition: form-data; name="manifest"\r\n`;
+    manifestPart += `Content-Type: application/json; charset=utf-8\r\n`;
     if (signature) {
-        partHeaders += `expo-signature: sig="${signature}", keyid="root", alg="ecdsa-p256-sha256"\r\n`;
+        manifestPart += `expo-signature: sig="${signature}", keyid="root", alg="ecdsa-p256-sha256"\r\n`;
     }
-    const body = `--${boundary}\r\n` +
-        `${partHeaders}\r\n` +
-        `${manifestJson}\r\n` +
-        `--${boundary}--\r\n`;
-    return { body, boundary };
+    manifestPart += `\r\n`;
+    manifestPart += manifestJson;
+    manifestPart += `\r\n`;
+    // Build the extensions part (included by official Expo server)
+    const extensions = { assetRequestHeaders: {} };
+    let extensionsPart = `--${boundary}\r\n`;
+    extensionsPart += `Content-Disposition: form-data; name="extensions"\r\n`;
+    extensionsPart += `Content-Type: application/json\r\n`;
+    extensionsPart += `\r\n`;
+    extensionsPart += JSON.stringify(extensions);
+    extensionsPart += `\r\n`;
+    const body = manifestPart + extensionsPart + `--${boundary}--\r\n`;
+    return { body, boundary, contentType: `multipart/mixed; boundary=${boundary}` };
 }