@renbostudios/edge-ota 0.4.0 → 0.4.2

package/package.json

@@ -1,14 +1,18 @@
 {
   "name": "@renbostudios/edge-ota",
-  "version": "0.4.0",
+  "version": "0.4.2",
   "preferGlobal": true,
   "description": "Zero-SDK, self-hostable OTA update CLI for Expo — push signed JS bundles to any EdgeOTA server",
   "license": "MIT",
   "author": "EdgeOTA Contributors",
   "homepage": "https://github.com/renbostudios/edge-ota-cli",
+  "publishConfig": {
+    "access": "public"
+  },
   "repository": {
     "type": "git",
-    "url": "https://github.com/renbostudios/edge-ota-cli.git"
+    "url": "https://github.com/itskodaaa/edge-ota.git",
+    "directory": "apps/cli"
   },
   "bugs": {
     "url": "https://github.com/renbostudios/edge-ota-cli/issues"
@@ -30,19 +34,20 @@
     "dist",
     "README.md"
   ],
-  "scripts": {
-    "build": "tsc",
-    "dev": "tsc --watch",
-    "clean": "rm -rf dist",
-    "prepublishOnly": "npm run build"
-  },
   "dependencies": {
-    "commander": "^12.1.0",
-    "archiver": "^7.0.1"
+    "archiver": "^7.0.1",
+    "commander": "^12.1.0"
   },
   "devDependencies": {
-    "typescript": "^5.4.5",
+    "@types/archiver": "^6.0.2",
     "@types/node": "^20.12.12",
-    "@types/archiver": "^6.0.2"
+    "tsup": "^8.5.1",
+    "typescript": "^5.4.5",
+    "@renbostudios/edge-ota-core": "0.1.1"
+  },
+  "scripts": {
+    "build": "tsup",
+    "dev": "tsup --watch",
+    "clean": "rm -rf dist"
   }
-}
+}

package/dist/core/crypto.js

@@ -1,87 +0,0 @@
-/**
- * EdgeOTA Core - Cryptographic Utilities
- *
- * Implements ECDSA P-256 + SHA-256 signing and verification,
- * compatible with both Node.js (via globalThis.crypto.subtle) and
- * the Cloudflare Workers runtime (same Web Crypto API).
- *
- * Key format: PKCS#8 private key / SPKI public key — PEM-encoded.
- * Signature format: raw DER bytes → base64 string (NOT base64url,
- * to stay compatible with the existing expo-updates SDK verification).
- */
-/** Generate a fresh ECDSA P-256 key pair encoded as PEM. */
-export async function generateECDSAKeyPair() {
-    const keyPair = await globalThis.crypto.subtle.generateKey({ name: "ECDSA", namedCurve: "P-256" }, true, ["sign", "verify"]);
-    const privateKeyDer = await globalThis.crypto.subtle.exportKey("pkcs8", keyPair.privateKey);
-    const publicKeyDer = await globalThis.crypto.subtle.exportKey("spki", keyPair.publicKey);
-    return {
-        privateKey: derToPem(privateKeyDer, "PRIVATE KEY"),
-        publicKey: derToPem(publicKeyDer, "PUBLIC KEY")
-    };
-}
-/**
- * Sign an arbitrary string payload with a PEM-encoded ECDSA P-256 private key.
- * Returns the raw signature bytes encoded as base64.
- */
-export async function signPayload(payload, privateKeyPem) {
-    const privateKeyDer = pemToDer(privateKeyPem, "PRIVATE KEY");
-    const privateKey = await globalThis.crypto.subtle.importKey("pkcs8", privateKeyDer, { name: "ECDSA", namedCurve: "P-256" }, false, ["sign"]);
-    const data = new TextEncoder().encode(payload);
-    const sigBuffer = await globalThis.crypto.subtle.sign({ name: "ECDSA", hash: { name: "SHA-256" } }, privateKey, data);
-    return arrayBufferToBase64(sigBuffer);
-}
-/**
- * Verify a base64-encoded ECDSA P-256 signature against a payload string
- * using a PEM-encoded public key.
- */
-export async function verifyPayload(payload, signatureBase64, publicKeyPem) {
-    try {
-        const publicKeyDer = pemToDer(publicKeyPem, "PUBLIC KEY");
-        const publicKey = await globalThis.crypto.subtle.importKey("spki", publicKeyDer, { name: "ECDSA", namedCurve: "P-256" }, false, ["verify"]);
-        const data = new TextEncoder().encode(payload);
-        const signature = base64ToArrayBuffer(signatureBase64);
-        return await globalThis.crypto.subtle.verify({ name: "ECDSA", hash: { name: "SHA-256" } }, publicKey, signature, data);
-    }
-    catch {
-        return false;
-    }
-}
-/**
- * SHA-256 hash a buffer and return the hex string.
- * Used to produce the per-asset `hash` field in the Expo manifest.
- */
-export async function sha256Hex(buffer) {
-    const digest = await globalThis.crypto.subtle.digest("SHA-256", buffer);
-    return Array.from(new Uint8Array(digest))
-        .map(b => b.toString(16).padStart(2, "0"))
-        .join("");
-}
-// ─── Internal PEM / DER utilities ────────────────────────────────────────────
-function derToPem(der, label) {
-    const base64 = arrayBufferToBase64(der);
-    const lines = base64.match(/.{1,64}/g) || [];
-    return `-----BEGIN ${label}-----\n${lines.join("\n")}\n-----END ${label}-----`;
-}
-function pemToDer(pem, label) {
-    const cleanPem = pem
-        .replace(`-----BEGIN ${label}-----`, "")
-        .replace(`-----END ${label}-----`, "")
-        .replace(/\s+/g, "");
-    return base64ToArrayBuffer(cleanPem);
-}
-function arrayBufferToBase64(buffer) {
-    const bytes = new Uint8Array(buffer);
-    let binary = "";
-    for (let i = 0; i < bytes.byteLength; i++) {
-        binary += String.fromCharCode(bytes[i]);
-    }
-    return globalThis.btoa(binary);
-}
-function base64ToArrayBuffer(base64) {
-    const binary = globalThis.atob(base64);
-    const bytes = new Uint8Array(binary.length);
-    for (let i = 0; i < binary.length; i++) {
-        bytes[i] = binary.charCodeAt(i);
-    }
-    return bytes.buffer;
-}

package/dist/core/index.js

@@ -1,2 +0,0 @@
-export * from "./crypto.js";
-export * from "./manifest.js";

package/dist/core/manifest.js

@@ -1,108 +0,0 @@
-/**
- * EdgeOTA Core - Expo Updates Protocol v1 Manifest Engine
- *
- * Implements the exact wire format consumed by expo-updates SDK,
- * matching the official expo/custom-expo-updates-server reference:
- * - EAS Update-compatible manifest structure
- * - Multipart/mixed response body with FormData-compatible boundary
- * - expo-signature header for ECDSA bundle verification
- * - fileExtension on launchAsset and assets
- * - extra.expoClient config passthrough
- */
-/**
- * Convert a hex SHA-256 hash to base64url encoding.
- * expo-updates verifies downloaded assets by computing SHA-256, base64url-encoding it,
- * and comparing against the manifest `hash` field.
- */
-function hexToBase64Url(hex) {
-    if (hex.length !== 64 || !/^[0-9a-fA-F]+$/.test(hex)) {
-        return hex;
-    }
-    const bytes = new Uint8Array(hex.length / 2);
-    for (let i = 0; i < hex.length; i += 2) {
-        bytes[i / 2] = parseInt(hex.substring(i, i + 2), 16);
-    }
-    let binString = "";
-    for (let i = 0; i < bytes.length; i++) {
-        binString += String.fromCharCode(bytes[i]);
-    }
-    const base64 = btoa(binString);
-    return base64
-        .replace(/\+/g, '-')
-        .replace(/\//g, '_')
-        .replace(/=+$/, '');
-}
-/**
- * Build the Expo Updates v1 manifest object.
- * Matches the format produced by expo/custom-expo-updates-server.
- */
-export function generateExpoManifest(params) {
-    return {
-        id: params.updateId,
-        createdAt: params.createdAt,
-        runtimeVersion: params.runtimeVersion,
-        launchAsset: {
-            hash: hexToBase64Url(params.bundleHash),
-            key: params.bundleKey || params.bundleHash.slice(0, 32),
-            fileExtension: ".bundle",
-            contentType: "application/javascript",
-            url: params.bundleUrl
-        },
-        assets: params.assets.map(asset => ({
-            ...asset,
-            hash: hexToBase64Url(asset.hash)
-        })),
-        metadata: params.metadata ?? {},
-        extra: params.extra ?? {}
-    };
-}
-/**
- * Build the response headers required by the Expo Updates protocol.
- *
- * expo-protocol-version: "1"  — Signals v1 manifest format
- * expo-sfv-version: "0"       — Structured Fields version
- * cache-control               — Updates must never be stale; client always revalidates
- * expo-signature              — ECDSA P-256 + SHA-256 signature over the manifest JSON
- */
-export function createExpoHeaders(signature) {
-    const headers = {
-        "expo-protocol-version": "1",
-        "expo-sfv-version": "0",
-        "cache-control": "private, max-age=0",
-    };
-    if (signature) {
-        headers["expo-signature"] = `sig="${signature}", keyid="root", alg="ecdsa-p256-sha256"`;
-    }
-    return headers;
-}
-/**
- * Build the multipart/mixed response body required by expo-updates protocol v1.
- * Uses FormData-compatible boundary formatting matching the official Expo server.
- *
- * The expo-updates native client parses this multipart body to extract the manifest
- * from the part named "manifest".
- */
-export function buildMultipartManifestBody(manifest, signature) {
-    const boundary = "ota" + Date.now().toString(36) + Math.random().toString(36).slice(2, 8);
-    const manifestJson = JSON.stringify(manifest);
-    // Build the manifest part headers exactly as FormData would
-    let manifestPart = `--${boundary}\r\n`;
-    manifestPart += `Content-Disposition: form-data; name="manifest"\r\n`;
-    manifestPart += `Content-Type: application/json; charset=utf-8\r\n`;
-    if (signature) {
-        manifestPart += `expo-signature: sig="${signature}", keyid="root", alg="ecdsa-p256-sha256"\r\n`;
-    }
-    manifestPart += `\r\n`;
-    manifestPart += manifestJson;
-    manifestPart += `\r\n`;
-    // Build the extensions part (included by official Expo server)
-    const extensions = { assetRequestHeaders: {} };
-    let extensionsPart = `--${boundary}\r\n`;
-    extensionsPart += `Content-Disposition: form-data; name="extensions"\r\n`;
-    extensionsPart += `Content-Type: application/json\r\n`;
-    extensionsPart += `\r\n`;
-    extensionsPart += JSON.stringify(extensions);
-    extensionsPart += `\r\n`;
-    const body = manifestPart + extensionsPart + `--${boundary}--\r\n`;
-    return { body, boundary, contentType: `multipart/mixed; boundary=${boundary}` };
-}