eoas 3.0.5 → 3.1.0

package/dist/lib/serverConfig/helmValues.js

@@ -0,0 +1,281 @@
+"use strict";
+// Renders and validates the Helm deployment pair for the chart (helm/ in the
+// server repository): values.yaml carries the toggles and the structure of the
+// environment list (committable, no secret), secrets.yaml is a values overlay
+// holding every value in the secretEnv map. The chart renders that map into
+// the secretName Secret, so one `helm install -f values.yaml -f secrets.yaml`
+// deploys everything.
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.validateHelmPair = exports.looksLikeChartValues = exports.parseYamlFile = exports.extractSecretEnv = exports.renderHelmSecretsValues = exports.renderHelmValues = exports.HELM_SECRETS_FILE = exports.HELM_SECRET_NAME = void 0;
+const js_yaml_1 = require("js-yaml");
+const choices_1 = require("./choices");
+const envCatalog_1 = require("./envCatalog");
+const passwordPolicy_1 = require("./passwordPolicy");
+exports.HELM_SECRET_NAME = 'xprem-secrets';
+exports.HELM_SECRETS_FILE = 'secrets.yaml';
+// The chart injects PROMETHEUS_ENABLED from podAnnotations, never from the
+// environment list; computed vars (helmKey) come from the values toggles.
+const CHART_OWNED_VARS = new Set(['PROMETHEUS_ENABLED']);
+function yamlString(value) {
+    return JSON.stringify(value);
+}
+function ingressHost(choices) {
+    if (choices.baseUrl) {
+        try {
+            return new URL(choices.baseUrl).hostname;
+        }
+        catch {
+            // Fall through to the placeholder.
+        }
+    }
+    return '<your-ota-domain>';
+}
+/** Renders the values.yaml content: toggles and structure, no secret values. */
+function renderHelmValues(choices) {
+    const host = ingressHost(choices);
+    const lines = [
+        '# Generated by eoas server:init. Safe to commit: every value lives in',
+        `# ${exports.HELM_SECRETS_FILE} (gitignored), which the chart renders into the`,
+        `# "${exports.HELM_SECRET_NAME}" Secret. Deploy both files together:`,
+        `#   helm install xprem <chart> -f values.yaml -f ${exports.HELM_SECRETS_FILE} -n <namespace>`,
+        '# Check the pair with: eoas server:validate <this directory>',
+        '# Values not listed here keep the chart defaults.',
+        '',
+        `replicaCount: ${choices.replicas === 'multi' ? 3 : 1}`,
+        '',
+        `secretName: ${yamlString(exports.HELM_SECRET_NAME)}`,
+        '',
+        'controlPlane: "true"',
+        `dbKeysMasterKeySource: ${yamlString(choices.masterKeySource)}`,
+        '# Also selects the CloudFront private-key source.',
+        `keysStorageType: ${yamlString(choices.masterKeySource === 'aws-secrets-manager' ? 'aws-secrets-manager' : 'environment')}`,
+        `storageMode: ${yamlString(choices.storage === 'gcs' ? 'gcs' : choices.storage === 'azure' ? 'azure' : 's3')}`,
+        `cacheMode: ${yamlString(choices.cacheMode)}`,
+        'useDashboard: "true"',
+        `useCloudfrontRedirect: "${choices.delivery === 'cloudfront'}"`,
+        `useGenericCDN: "${choices.delivery === 'generic-cdn'}"`,
+        `useAWSAccessKeys: "${(0, choices_1.needsAwsAccessKeys)(choices)}"`,
+        '',
+    ];
+    if (choices.awsAuth === 'iam-role' &&
+        (choices.storage === 'aws-s3' || choices.masterKeySource === 'aws-secrets-manager')) {
+        lines.push('serviceAccount:', '  create: true', '  name: "xprem-sa"', '  # On EKS, bind the IAM role through the service account (IRSA):', '  annotations: {}', '    # eks.amazonaws.com/role-arn: "arn:aws:iam::ACCOUNT_ID:role/xprem-storage"', '');
+    }
+    lines.push('# Which env vars the pod gets. Values come from the secret; optional entries', `# are read from it only when present. Fill the values in ${exports.HELM_SECRETS_FILE}.`, 'environment:');
+    for (const section of envCatalog_1.ENV_SECTIONS) {
+        const vars = section.vars.filter(spec => spec.applies(choices) && !CHART_OWNED_VARS.has(spec.name));
+        for (const spec of vars) {
+            if (spec.helmKey) {
+                lines.push(`  - name: ${yamlString(spec.name)}`, `    key: ${yamlString(spec.helmKey)}`, '    required: true', '    computed: true');
+            }
+            else if (spec.required) {
+                lines.push(`  - name: ${yamlString(spec.name)}`, '    required: true');
+            }
+            else {
+                lines.push(`  - name: ${yamlString(spec.name)}`, '    enabled: true', '    required: false');
+            }
+        }
+    }
+    lines.push('', 'podAnnotations: {}', '  # prometheus.io/scrape: "true"', '', 'ingress:', '  enabled: true', '  className: ""', '  hosts:', `    - host: ${yamlString(host)}`, '      paths:', '        - path: /', '          pathType: Prefix', '  tls:', '    - secretName: xprem-tls', '      hosts:', `        - ${yamlString(host)}`, '');
+    return lines.join('\n');
+}
+exports.renderHelmValues = renderHelmValues;
+/**
+ * Renders the secrets.yaml content: a values overlay whose secretEnv map the
+ * chart turns into the secretName Secret. Every non-computed value lands
+ * here; optional vars stay commented out.
+ */
+function renderHelmSecretsValues(choices) {
+    const lines = [
+        '# Generated by eoas server:init. Do NOT commit this file; gitignore it.',
+        '# Fill every <placeholder>, then deploy it together with values.yaml:',
+        `#   helm install xprem <chart> -f values.yaml -f ${exports.HELM_SECRETS_FILE} -n <namespace>`,
+        '# To change a value later, edit it here and run helm upgrade with the same',
+        '# flags: the chart re-rolls the pods automatically.',
+        'secretEnv:',
+    ];
+    for (const section of envCatalog_1.ENV_SECTIONS) {
+        const vars = section.vars.filter(spec => spec.applies(choices) && !CHART_OWNED_VARS.has(spec.name) && !spec.helmKey);
+        const note = section.note?.(choices);
+        if (vars.length === 0) {
+            continue;
+        }
+        lines.push(`  # ----- ${section.title} -----`);
+        if (note) {
+            lines.push(`  # ${note}`);
+        }
+        for (const spec of vars) {
+            if (spec.comment) {
+                lines.push(`  # ${spec.comment}`);
+            }
+            const assignment = `${spec.name}: ${yamlString(spec.value(choices))}`;
+            lines.push(spec.required ? `  ${assignment}` : `  # ${assignment}`);
+        }
+    }
+    lines.push('');
+    return lines.join('\n');
+}
+exports.renderHelmSecretsValues = renderHelmSecretsValues;
+/** The secretEnv map of a values document, when it carries one. */
+function extractSecretEnv(doc) {
+    const secretEnv = doc.secretEnv;
+    if (!secretEnv || typeof secretEnv !== 'object' || Array.isArray(secretEnv)) {
+        return undefined;
+    }
+    const env = {};
+    for (const [key, value] of Object.entries(secretEnv)) {
+        env[key] = String(value ?? '');
+    }
+    return env;
+}
+exports.extractSecretEnv = extractSecretEnv;
+function parseYamlFile(content) {
+    const parsed = (0, js_yaml_1.load)(content);
+    if (!parsed || typeof parsed !== 'object' || Array.isArray(parsed)) {
+        throw new Error('The file does not contain a YAML mapping.');
+    }
+    return parsed;
+}
+exports.parseYamlFile = parseYamlFile;
+/** True for a YAML mapping that plausibly is a values file for the chart. */
+function looksLikeChartValues(doc) {
+    return ['controlPlane', 'storageMode', 'cacheMode', 'secretName', 'environment'].some(key => key in doc);
+}
+exports.looksLikeChartValues = looksLikeChartValues;
+/** The env the pod would see: the secret env plus the computed toggle vars. */
+function envFromPair(values, secretEnv) {
+    const env = { ...secretEnv };
+    const entries = Array.isArray(values.environment) ? values.environment : [];
+    for (const entry of entries) {
+        if (entry && typeof entry === 'object' && entry.name && entry.computed && entry.key) {
+            env[entry.name] = String(values[entry.key] ?? '');
+        }
+    }
+    return env;
+}
+/**
+ * Validates a values/secret-env pair. Either side can be missing: the checks
+ * that need the other half are skipped and replaced with an issue saying so.
+ */
+function validateHelmPair(values, secretEnv) {
+    if (!values) {
+        return [
+            {
+                level: 'warning',
+                message: 'No chart values file found next to the secrets overlay: toggles are unknown, only the secret values themselves were checked.',
+            },
+            ...validateSecretValues(secretEnv ?? {}),
+        ];
+    }
+    if (String(values.controlPlane) !== 'true') {
+        return [
+            {
+                level: 'warning',
+                message: 'controlPlane is not "true": server:validate only checks control-plane configurations, nothing was verified.',
+            },
+        ];
+    }
+    const issues = [];
+    if (!secretEnv) {
+        issues.push({
+            level: 'error',
+            message: `No ${exports.HELM_SECRETS_FILE} with a secretEnv map found next to the values file: it holds the environment values the chart renders into the "${String(values.secretName ?? exports.HELM_SECRET_NAME)}" Secret.`,
+        });
+    }
+    else {
+        issues.push(...(0, envCatalog_1.validateEnvMap)(envFromPair(values, secretEnv), {
+            masterKeySource: String(values.dbKeysMasterKeySource) === 'aws-secrets-manager'
+                ? 'aws-secrets-manager'
+                : 'environment',
+            ...(String(values.useCloudfrontRedirect) === 'true'
+                ? { delivery: 'cloudfront' }
+                : String(values.useGenericCDN) === 'true'
+                    ? { delivery: 'generic-cdn' }
+                    : {}),
+        }));
+    }
+    const replicaCount = Number(values.replicaCount ?? 1);
+    if (replicaCount > 1) {
+        if (String(values.cacheMode) === 'local') {
+            issues.push({
+                level: 'error',
+                message: `replicaCount is ${replicaCount} with cacheMode "local": replicas need a shared cache, use redis or redis-sentinel.`,
+            });
+        }
+        if (String(values.storageMode) === 'local') {
+            issues.push({
+                level: 'error',
+                message: `replicaCount is ${replicaCount} with storageMode "local": local storage cannot be shared between replicas.`,
+            });
+        }
+    }
+    const env = secretEnv ? envFromPair(values, secretEnv) : {};
+    if (String(values.useCloudfrontRedirect) !== 'true' && env.CLOUDFRONT_DOMAIN) {
+        issues.push({
+            level: 'warning',
+            message: 'CLOUDFRONT_DOMAIN is set but useCloudfrontRedirect is not "true".',
+        });
+    }
+    if (String(values.useGenericCDN) !== 'true' && env.CDN_BASE_URL) {
+        issues.push({
+            level: 'warning',
+            message: 'CDN_BASE_URL is set but useGenericCDN is not "true"; the chart will not render it.',
+        });
+    }
+    const ingress = values.ingress;
+    const host = ingress?.hosts?.[0]?.host;
+    if (host && env.BASE_URL && !(0, envCatalog_1.isPlaceholder)(env.BASE_URL) && !(0, envCatalog_1.isPlaceholder)(host)) {
+        try {
+            if (new URL(env.BASE_URL).hostname !== host) {
+                issues.push({
+                    level: 'warning',
+                    message: `BASE_URL (${env.BASE_URL}) does not match the ingress host (${host}).`,
+                });
+            }
+        }
+        catch {
+            // BASE_URL validity is already reported by validateEnvMap.
+        }
+    }
+    return issues;
+}
+exports.validateHelmPair = validateHelmPair;
+/**
+ * Value-level checks for a secret env validated alone: without the values
+ * file the applicable variable set is unknown, so only what can be judged
+ * from the values themselves is checked.
+ */
+function validateSecretValues(env) {
+    const issues = [];
+    const lenientVars = new Set(envCatalog_1.ENV_SECTIONS.flatMap(section => section.vars.filter(spec => spec.lenient)).map(spec => spec.name));
+    for (const [name, value] of Object.entries(env)) {
+        if ((0, envCatalog_1.isPlaceholder)(value)) {
+            issues.push({
+                level: lenientVars.has(name) ? 'warning' : 'error',
+                message: `${name} is still a placeholder: ${value}`,
+            });
+        }
+    }
+    if (env.DB_KEYS_MASTER_KEY_B64 && env.AWSSM_DB_KEYS_MASTER_KEY_SECRET_ID) {
+        issues.push({
+            level: 'error',
+            message: 'Both DB_KEYS_MASTER_KEY_B64 and AWSSM_DB_KEYS_MASTER_KEY_SECRET_ID are set; the server requires exactly one master key source.',
+        });
+    }
+    if (!!env.MAXMIND_ACCOUNT_ID !== !!env.MAXMIND_LICENSE_KEY) {
+        issues.push({
+            level: 'error',
+            message: 'MAXMIND_ACCOUNT_ID and MAXMIND_LICENSE_KEY must be set together; the server refuses to start with only one of them.',
+        });
+    }
+    if (env.ADMIN_PASSWORD && !(0, envCatalog_1.isPlaceholder)(env.ADMIN_PASSWORD)) {
+        const missing = (0, passwordPolicy_1.missingPasswordRules)(env.ADMIN_PASSWORD);
+        if (missing.length > 0) {
+            issues.push({
+                level: 'error',
+                message: `ADMIN_PASSWORD does not meet the dashboard password policy, it needs ${missing.join(', ')}. The first boot fails otherwise.`,
+            });
+        }
+    }
+    return issues;
+}

package/dist/lib/serverConfig/passwordPolicy.d.ts

@@ -0,0 +1,3 @@
+export declare const PASSWORD_MIN_LENGTH = 8;
+/** Returns the labels of every failing rule, empty when the password passes. */
+export declare function missingPasswordRules(password: string): string[];

package/dist/lib/serverConfig/passwordPolicy.js

@@ -0,0 +1,36 @@
+"use strict";
+// Mirror of the server-side password policy (internal/crypto/password.go),
+// same as the dashboard mirror (apps/dashboard/src/lib/password-policy.ts).
+// Keep the three in sync. Classes are unicode to match Go's
+// unicode.IsUpper/IsLower/IsDigit, and length counts code points to match the
+// server's rune count.
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.missingPasswordRules = exports.PASSWORD_MIN_LENGTH = void 0;
+exports.PASSWORD_MIN_LENGTH = 8;
+const PASSWORD_RULES = [
+    {
+        label: `at least ${exports.PASSWORD_MIN_LENGTH} characters`,
+        test: password => [...password].length >= exports.PASSWORD_MIN_LENGTH,
+    },
+    {
+        label: 'an uppercase letter',
+        test: password => /\p{Lu}/u.test(password),
+    },
+    {
+        label: 'a lowercase letter',
+        test: password => /\p{Ll}/u.test(password),
+    },
+    {
+        label: 'a digit',
+        test: password => /\p{Nd}/u.test(password),
+    },
+    {
+        label: 'a special character',
+        test: password => /[^\p{Lu}\p{Ll}\p{Nd}]/u.test(password),
+    },
+];
+/** Returns the labels of every failing rule, empty when the password passes. */
+function missingPasswordRules(password) {
+    return PASSWORD_RULES.filter(rule => !rule.test(password)).map(rule => rule.label);
+}
+exports.missingPasswordRules = missingPasswordRules;

package/dist/lib/serverUpdates.d.ts

@@ -0,0 +1,45 @@
+import { Credentials } from './auth';
+export interface RuntimeVersionInfo {
+    runtimeVersion: string;
+    lastUpdatedAt: string;
+    createdAt: string;
+    numberOfUpdates: number;
+}
+export interface ServerUpdateItem {
+    updateUUID: string;
+    createdAt: string;
+    updateId: string;
+    platform: string;
+    commitHash: string;
+    message?: string;
+    publishGroup?: string;
+}
+export declare function fetchRuntimeVersions({ baseUrl, appId, branch, credentials, }: {
+    baseUrl: string;
+    appId: string;
+    branch: string;
+    credentials: Credentials;
+}): Promise<RuntimeVersionInfo[]>;
+export declare function fetchUpdates({ baseUrl, appId, branch, runtimeVersion, credentials, }: {
+    baseUrl: string;
+    appId: string;
+    branch: string;
+    runtimeVersion: string;
+    credentials: Credentials;
+}): Promise<ServerUpdateItem[]>;
+export interface PublishGroupSummary {
+    publishGroup: string;
+    platforms: string[];
+    commitHash: string;
+    message?: string;
+    createdAt: string;
+    updates: ServerUpdateItem[];
+}
+export declare function groupPublishedUpdates(updates: ServerUpdateItem[]): {
+    groups: PublishGroupSummary[];
+    ungrouped: ServerUpdateItem[];
+};
+export declare function describePublishGroup(group: PublishGroupSummary): {
+    title: string;
+    description: string;
+};

package/dist/lib/serverUpdates.js

@@ -0,0 +1,108 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.describePublishGroup = exports.groupPublishedUpdates = exports.fetchUpdates = exports.fetchRuntimeVersions = void 0;
+const auth_1 = require("./auth");
+const fetch_1 = require("./fetch");
+async function fetchRuntimeVersions({ baseUrl, appId, branch, credentials, }) {
+    const response = await (0, fetch_1.fetchWithRetries)(`${baseUrl}/api/apps/${appId}/branch/${branch}/runtimeVersions`, {
+        headers: {
+            ...(0, auth_1.getAuthHeaders)(credentials),
+            'use-cli-auth': 'true',
+        },
+    });
+    if (!response.ok) {
+        throw new Error(`Failed to fetch runtime versions: ${await response.text()}`);
+    }
+    return (await response.json());
+}
+exports.fetchRuntimeVersions = fetchRuntimeVersions;
+async function fetchUpdates({ baseUrl, appId, branch, runtimeVersion, credentials, }) {
+    const response = await (0, fetch_1.fetchWithRetries)(`${baseUrl}/api/apps/${appId}/branch/${branch}/runtimeVersion/${runtimeVersion}/updates`, {
+        headers: {
+            ...(0, auth_1.getAuthHeaders)(credentials),
+            'use-cli-auth': 'true',
+        },
+    });
+    if (!response.ok) {
+        throw new Error(`Failed to fetch updates: ${await response.text()}`);
+    }
+    return (await response.json());
+}
+exports.fetchUpdates = fetchUpdates;
+// groupPublishedUpdates splits a listing into publish groups (newest first)
+// and the leftover ungrouped updates (older CLIs, stateless servers). Filter
+// out rollback markers before calling if they should not be offered.
+function groupPublishedUpdates(updates) {
+    const groupsById = new Map();
+    const ungrouped = [];
+    for (const update of updates) {
+        if (!update.publishGroup) {
+            ungrouped.push(update);
+            continue;
+        }
+        const existing = groupsById.get(update.publishGroup);
+        if (!existing) {
+            groupsById.set(update.publishGroup, {
+                publishGroup: update.publishGroup,
+                platforms: [update.platform],
+                commitHash: update.commitHash,
+                message: update.message,
+                createdAt: update.createdAt,
+                updates: [update],
+            });
+            continue;
+        }
+        existing.updates.push(update);
+        if (!existing.platforms.includes(update.platform)) {
+            existing.platforms.push(update.platform);
+        }
+        // The freshest member dates the group in the picker.
+        if (update.createdAt > existing.createdAt) {
+            existing.createdAt = update.createdAt;
+        }
+    }
+    const groups = [...groupsById.values()].sort((a, b) => b.createdAt.localeCompare(a.createdAt));
+    return { groups, ungrouped };
+}
+exports.groupPublishedUpdates = groupPublishedUpdates;
+// A commit message can be a full paragraph; past this length the picker line
+// wraps and drowns the platforms suffix.
+const MAX_TITLE_MESSAGE_LENGTH = 48;
+function truncateMessage(message) {
+    if (message.length <= MAX_TITLE_MESSAGE_LENGTH) {
+        return message;
+    }
+    return `${message.slice(0, MAX_TITLE_MESSAGE_LENGTH - 1).trimEnd()}…`;
+}
+// Compact deterministic timestamp (no locale, no seconds): publishes made in
+// the same run are seconds apart, minute precision is enough to tell runs
+// apart without flooding the line.
+function formatPublishedAt(createdAt) {
+    const parsed = new Date(createdAt);
+    if (Number.isNaN(parsed.getTime())) {
+        return createdAt;
+    }
+    return `${parsed.toISOString().slice(0, 16).replace('T', ' ')} UTC`;
+}
+// describePublishGroup renders one picker entry: a truncated message (or
+// commit) plus the platforms as the title, and each sub-update with its
+// platform and release time as the description.
+function describePublishGroup(group) {
+    // A publish made outside a git repository stores an empty commit hash; fall
+    // back to the date so the picker never renders an empty label.
+    const shortCommit = group.commitHash.slice(0, 7);
+    const label = group.message?.trim()
+        ? truncateMessage(group.message.trim())
+        : shortCommit
+            ? `Commit ${shortCommit}`
+            : `Published ${formatPublishedAt(group.createdAt)}`;
+    const members = group.updates
+        .map(update => `${update.platform} ${formatPublishedAt(update.createdAt)}`)
+        .join(', ');
+    const commitSuffix = shortCommit ? ` (commit ${shortCommit})` : '';
+    return {
+        title: `${label} (${group.platforms.join(' + ')})`,
+        description: `${members}${commitSuffix}`,
+    };
+}
+exports.describePublishGroup = describePublishGroup;

package/dist/lib/utils.d.ts

@@ -1,2 +1,3 @@
 export declare function isValidUpdateUrl(updateUrl: string): boolean;
+export declare function ensureGitIgnored(projectDir: string, pattern: string, reason: string): void;
 export declare function ensurePrivateKeyIgnored(projectDir: string): void;

package/dist/lib/utils.js

@@ -1,6 +1,6 @@
 "use strict";
 Object.defineProperty(exports, "__esModule", { value: true });
-exports.ensurePrivateKeyIgnored = exports.isValidUpdateUrl = void 0;
+exports.ensurePrivateKeyIgnored = exports.ensureGitIgnored = exports.isValidUpdateUrl = void 0;
 const tslib_1 = require("tslib");
 const fs_extra_1 = tslib_1.__importDefault(require("fs-extra"));
 const path_1 = tslib_1.__importDefault(require("path"));
@@ -9,30 +9,34 @@ function isValidUpdateUrl(updateUrl) {
     return updateUrl.match(/^https?:\/\/[^/]+$/) !== null;
 }
 exports.isValidUpdateUrl = isValidUpdateUrl;
-// Keeps the code signing private key out of the app repository: appends a bare
-// 'private-key.pem' pattern to the project .gitignore (a pattern without a
-// slash matches at every directory level). Only an existing bare rule counts:
-// comments, negated entries and path-specific rules like certs/private-key.pem
-// do not guarantee project-wide protection. Appending at the end also wins over
-// an earlier negated entry, since the last matching gitignore rule prevails.
-function ensurePrivateKeyIgnored(projectDir) {
+// Appends pattern to the project .gitignore unless an identical rule is already
+// in force. Only an exact existing rule counts: comments, negated entries and
+// rules that differ in path do not guarantee the same protection. Appending at
+// the end also wins over an earlier negated entry, since the last matching
+// gitignore rule prevails. A pattern without a slash matches at every directory
+// level; one with a slash is relative to the .gitignore.
+function ensureGitIgnored(projectDir, pattern, reason) {
     const gitignorePath = path_1.default.join(projectDir, '.gitignore');
     try {
         // eslint-disable-next-line node/no-sync
         const gitignore = fs_extra_1.default.existsSync(gitignorePath) ? fs_extra_1.default.readFileSync(gitignorePath, 'utf8') : '';
         const lines = gitignore.split(/\r?\n/).map(line => line.trim());
-        const lastBareRule = lines.lastIndexOf('private-key.pem');
-        const lastNegation = lines.lastIndexOf('!private-key.pem');
-        if (lastBareRule !== -1 && lastBareRule > lastNegation) {
+        const lastRule = lines.lastIndexOf(pattern);
+        const lastNegation = lines.lastIndexOf(`!${pattern}`);
+        if (lastRule !== -1 && lastRule > lastNegation) {
             return;
         }
         const separator = gitignore === '' ? '' : gitignore.endsWith('\n') ? '\n' : '\n\n';
         // eslint-disable-next-line node/no-sync
-        fs_extra_1.default.appendFileSync(gitignorePath, `${separator}# Code signing private key (server-side secret, never commit it)\nprivate-key.pem\n`);
-        log_1.default.succeed('Added private-key.pem to .gitignore');
+        fs_extra_1.default.appendFileSync(gitignorePath, `${separator}# ${reason}\n${pattern}\n`);
+        log_1.default.succeed(`Added ${pattern} to .gitignore`);
     }
     catch {
-        log_1.default.warn('Could not update .gitignore. Make sure private-key.pem is never committed to your repository.');
+        log_1.default.warn(`Could not update .gitignore. Make sure ${pattern} is never committed to your repository.`);
     }
 }
+exports.ensureGitIgnored = ensureGitIgnored;
+function ensurePrivateKeyIgnored(projectDir) {
+    ensureGitIgnored(projectDir, 'private-key.pem', 'Code signing private key (server-side secret, never commit it)');
+}
 exports.ensurePrivateKeyIgnored = ensurePrivateKeyIgnored;

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "eoas",
-  "version": "3.0.5",
+  "version": "3.1.0",
   "main": "index.js",
   "scripts": {
     "build": "tsc --project tsconfig.json",
@@ -11,21 +11,22 @@
   "engines": {
     "node": ">=18.0.0"
   },
-  "homepage": "https://github.com/mercuretechnologies/expo-open-ota/tree/main/eoas",
+  "homepage": "https://github.com/mercuretechnologies/xprem/tree/main/eoas",
   "keywords": [
-    "expo-open-ota",
+    "xprem",
     "expo",
     "eas",
     "cli"
   ],
   "author": "Axel Marciano",
   "license": "MIT",
-  "description": "A CLI tool to manage publishing and OTA updates for expo-open-OTA self-hosted server. This is not an official tool from Expo but an open-source project (https://github.com/mercuretechnologies/expo-open-ota)",
+  "description": "A CLI tool to manage publishing and OTA updates for the xprem self-hosted server. This is not an official tool from Expo but an open-source project (https://github.com/mercuretechnologies/xprem)",
   "repository": {
     "type": "git",
-    "url": "git+https://github.com/mercuretechnologies/expo-open-ota.git"
+    "url": "git+https://github.com/mercuretechnologies/xprem.git"
   },
   "dependencies": {
+    "@clack/prompts": "^0.11.0",
     "@expo/code-signing-certificates": "^0.0.5",
     "@expo/config": "10.0.11",
     "@expo/config-plugins": "9.0.12",
@@ -52,11 +53,11 @@
     "https-proxy-agent": "5.0.1",
     "ignore": "5.3.0",
     "joi": "17.11.0",
+    "js-yaml": "^5.2.2",
     "jscodeshift": "^17.1.2",
     "log-symbols": "^4.0.0",
     "mime": "3.0.0",
     "node-fetch": "^2.6.7",
-    "ora": "^5.1.0",
     "prettier": "3.1.1",
     "prompts": "^2.4.2",
     "recast": "^0.23.9",
@@ -72,6 +73,7 @@
     "@tsconfig/node18": "^18.2.4",
     "@types/fs-extra": "11.0.4",
     "@types/getenv": "^1.0.0",
+    "@types/js-yaml": "^4.0.9",
     "@types/jscodeshift": "^0.12.0",
     "@types/mime": "^3.0.4",
     "@types/node": "^18.19.74",