eoas 3.1.2 → 3.2.0-beta1

package/dist/commands/doctor.js

@@ -60,19 +60,10 @@ class Doctor extends core_1.Command {
         const privateConfig = await (0, expoConfig_1.getPrivateExpoConfigAsync)(projectDir, {
             env: process.env,
         });
-        const updateUrl = flags.url ?? (0, expoConfig_1.getExpoConfigUpdateUrl)(privateConfig);
-        if (!updateUrl) {
-            log_1.default.error("Update url is not setup in your config. Please run 'eoas init' to setup the update url, or pass --url");
+        const baseUrl = await (0, expoConfig_1.resolveServerUrl)(privateConfig, flags.url).catch(e => {
+            log_1.default.error(e.message);
             process.exit(1);
-        }
-        let baseUrl;
-        try {
-            baseUrl = new URL(updateUrl).origin;
-        }
-        catch (e) {
-            log_1.default.error('Invalid URL', e);
-            process.exit(1);
-        }
+        });
         const appId = flags.appId ?? (0, expoConfig_1.getExpoAppId)(privateConfig);
         log_1.default.log(`🩺 Probing ${baseUrl} on channel '${flags.channel}'`);
         log_1.default.newLine();

package/dist/commands/init.js

@@ -38,7 +38,7 @@ class Init extends core_1.Command {
             validate: v => !!v,
         });
         const { updateUrl: promptedUrl } = await (0, prompts_1.promptAsync)({
-            message: 'Enter the URL of your update server (ex: https://customota.com)',
+            message: 'Enter the URL of your update server (ex: https://customota.com or https://api.example.com/ota)',
             name: 'updateUrl',
             type: 'text',
             initial: ((0, expoConfig_1.getExpoConfigUpdateUrl)(config) || '').replace(/\/manifest$/, ''),
@@ -46,7 +46,7 @@ class Init extends core_1.Command {
                 return !!v && (0, utils_1.isValidUpdateUrl)(v);
             },
         });
-        let manifestEndpoint = `${promptedUrl}/manifest`;
+        let manifestEndpoint = `${promptedUrl.replace(/\/+$/, '')}/manifest`;
         const updateUrl = (0, expoConfig_1.getExpoConfigUpdateUrl)(config);
         if (updateUrl && !updateUrl.includes('expo.dev')) {
             const confirmed = await (0, prompts_1.confirmAsync)({

package/dist/commands/publish.js

@@ -51,7 +51,7 @@ class Publish extends core_1.Command {
             required: true,
         }),
         serverUrl: core_1.Flags.string({
-            description: 'URL of the self-hosted update server to publish to. Defaults to the origin of updates.url from your Expo config',
+            description: 'URL of the self-hosted update server to publish to. Defaults to updates.url from your Expo config, minus a trailing /manifest',
             required: false,
         }),
         nonInteractive: core_1.Flags.boolean({
@@ -72,8 +72,9 @@ class Publish extends core_1.Command {
             required: false,
         }),
         dumpSourcemap: core_1.Flags.boolean({
-            description: 'Emit Hermes source maps alongside the bundle so the published artifact can be symbolicated by tools like Sentry or PostHog.',
-            default: false,
+            description: 'Emit Hermes source maps alongside the bundle (default: true). Without a source map Hermes bakes a random temp path into the bytecode, so two exports of identical code never hash the same and server-side change detection cannot work. The maps also let tools like Sentry or PostHog symbolicate the published artifact; they stay in the output directory and are never uploaded. Disable with --no-dumpSourcemap.',
+            default: true,
+            allowNo: true,
         }),
         'rollout-percentage': core_1.Flags.integer({
             min: 1,
@@ -259,7 +260,7 @@ class Publish extends core_1.Command {
         });
         log_1.default.withInfo(`expoConfig.json file created in ${outputDir} directory`);
         const uploadFilesSpinner = (0, ora_1.ora)('📤 Uploading files...').start();
-        const files = (0, assets_1.computeFilesRequests)(projectDir, outputDir, platform || expoConfig_1.RequestedPlatform.All);
+        const files = await (0, assets_1.computeFilesRequests)(projectDir, outputDir, platform || expoConfig_1.RequestedPlatform.All);
         if (!files.length) {
             uploadFilesSpinner.fail('No files to upload');
             process.exit(1);
@@ -268,30 +269,47 @@ class Publish extends core_1.Command {
         // One group id for the whole run: every platform update of this publish
         // shares it, so control plane servers list them as a single publish.
         const publishGroupId = (0, crypto_1.randomUUID)();
+        // Collected rather than logged inline: writing to the terminal under a
+        // running spinner interleaves with its frames.
+        const unchangedPlatforms = [];
         try {
-            uploadUrls = await Promise.all(runtimeVersions.map(async ({ runtimeVersion, platform }) => {
+            const outcomes = await Promise.all(runtimeVersions.map(async ({ runtimeVersion, platform }) => {
                 if (!runtimeVersion) {
                     throw new Error('Runtime version is not resolved');
                 }
-                return {
-                    ...(await (0, assets_1.requestUploadUrls)({
-                        body: {
-                            fileNames: files.map(file => file.path),
-                        },
-                        requestUploadUrl: `${serverUrl}/${appId}/requestUploadUrl/${branch}`,
-                        auth: credentials,
+                try {
+                    return {
+                        ...(await (0, assets_1.requestUploadUrls)({
+                            body: { files: (0, assets_1.buildUploadFiles)(files, platform) },
+                            requestUploadUrl: `${serverUrl}/${appId}/requestUploadUrl/${branch}`,
+                            auth: credentials,
+                            runtimeVersion,
+                            platform,
+                            commitHash,
+                            message: resolvedMessage,
+                            rolloutPercentage,
+                            publishGroup: publishGroupId,
+                            branch,
+                        })),
                         runtimeVersion,
                         platform,
-                        commitHash,
-                        message: resolvedMessage,
-                        rolloutPercentage,
-                        publishGroup: publishGroupId,
-                        branch,
-                    })),
-                    runtimeVersion,
-                    platform,
-                };
+                    };
+                }
+                catch (error) {
+                    if (error instanceof assets_1.NoChangesDetectedError) {
+                        unchangedPlatforms.push(platform);
+                        return null;
+                    }
+                    throw error;
+                }
             }));
+            uploadUrls = outcomes.filter((entry) => {
+                return entry !== null;
+            });
+            if (!uploadUrls.length) {
+                uploadFilesSpinner.warn('⚠️ No changes found in the update, nothing to deploy');
+                return;
+            }
             // Every path and URL the server handed back is checked here, before a
             // single file is opened. A server that forges a filePath would otherwise
             // make the CLI read arbitrary files off this machine and PUT them wherever
@@ -358,6 +376,14 @@ class Publish extends core_1.Command {
                 }
             }));
             uploadFilesSpinner.succeed('✅ Files uploaded successfully');
+            for (const { platform: uploadedPlatform, uploadRequests } of uploadUrls) {
+                const totalFiles = (0, assets_1.buildUploadFiles)(files, uploadedPlatform).length;
+                const deduplicated = totalFiles - uploadRequests.length;
+                log_1.default.withInfo(`📊 ${uploadedPlatform}: ${uploadRequests.length}/${totalFiles} files uploaded, ${deduplicated} deduplicated (already on the server)`);
+            }
+            for (const skipped of unchangedPlatforms) {
+                log_1.default.withInfo(`⚠️ There is no change in the update for ${skipped}, ignored...`);
+            }
         }
         catch (e) {
             uploadFilesSpinner.fail('❌ Failed to upload static files');
@@ -423,9 +449,14 @@ class Publish extends core_1.Command {
         if (hasSuccess) {
             log_1.default.withInfo(`🌿 Branch: \`${branch}\``);
             log_1.default.withInfo(`⏳ Deployed at: \`${new Date().toUTCString()}\`\n`);
+            for (const { platform: publishedPlatform, updateId } of uploadUrls) {
+                log_1.default.withInfo(`🆔 ${publishedPlatform} update id: \`${updateId}\``);
+            }
             const groupAcknowledged = uploadUrls.every(u => u.publishGroup === publishGroupId);
             if (groupAcknowledged) {
-                log_1.default.withInfo(`📦 Publish group: \`${publishGroupId}\``);
+                log_1.default.withInfo(`📦 Publish group: \`${publishGroupId}\` (groups the ${uploadUrls
+                    .map(u => u.platform)
+                    .join(' + ')} updates of this run)`);
             }
             else if (uploadUrls.length > 1) {
                 // Only worth a note when several platforms were published: a single

package/dist/commands/republish.js

@@ -28,7 +28,7 @@ class Publish extends core_1.Command {
             required: true,
         }),
         serverUrl: core_1.Flags.string({
-            description: 'URL of the self-hosted update server to republish on. Defaults to the origin of updates.url from your Expo config',
+            description: 'URL of the self-hosted update server to republish on. Defaults to updates.url from your Expo config, minus a trailing /manifest',
             required: false,
         }),
     };

package/dist/commands/rollback.js

@@ -29,7 +29,7 @@ class Publish extends core_1.Command {
             required: true,
         }),
         serverUrl: core_1.Flags.string({
-            description: 'URL of the self-hosted update server to roll back on. Defaults to the origin of updates.url from your Expo config',
+            description: 'URL of the self-hosted update server to roll back on. Defaults to updates.url from your Expo config, minus a trailing /manifest',
             required: false,
         }),
         nonInteractive: core_1.Flags.boolean({

package/dist/commands/server/init.js

@@ -64,6 +64,18 @@ function isHttpUrl(value) {
         return false;
     }
 }
+/** The path of the URL without trailing slash; '' when at the root or invalid. */
+function pathPrefix(baseUrl) {
+    if (!baseUrl) {
+        return '';
+    }
+    try {
+        return new URL(baseUrl).pathname.replace(/\/+$/, '');
+    }
+    catch {
+        return '';
+    }
+}
 function shortPasswordHint(missing) {
     const short = missing.map(rule => rule
         .replace('at least 8 characters', '8+ chars')
@@ -117,8 +129,19 @@ function summaryLines(state) {
     const storageChoice = STORAGE_CHOICES.find(choice => choice.value === state.storagePick);
     const set = ACCENT;
     const later = chalk_1.default.dim('to fill later');
+    const prefix = pathPrefix(state.baseUrl);
     const rows = [
         ['Base URL', state.baseUrl ? set(state.baseUrl) : later],
+        ...(prefix
+            ? [
+                [
+                    'Path prefix',
+                    set(state.serveFromSubPath
+                        ? `${prefix} · routed by the server`
+                        : `${prefix} · stripped by the proxy`),
+                ],
+            ]
+            : []),
         ['JWT secret', state.jwtSecret ? set('generated') : later],
         ['PostgreSQL', state.dbUrl ? set(state.dbUrl) : later],
         ['Master key', set('generated, keep a backup')],
@@ -165,16 +188,39 @@ class ServerInit extends core_1.Command {
             {
                 id: 'base-url',
                 run: async () => {
-                    const value = await (0, prompts_1.textStep)('Public HTTPS URL of the server', {
-                        optional: true,
-                        initial: state.baseUrl,
-                        validate: v => isHttpUrl(v) || 'Must be a valid http(s) URL',
-                    });
-                    if (value === prompts_1.BACK) {
-                        return 'back';
+                    while (true) {
+                        const value = await (0, prompts_1.textStep)('Public HTTPS URL of the server', {
+                            optional: true,
+                            initial: state.baseUrl,
+                            validate: v => isHttpUrl(v) || 'Must be a valid http(s) URL',
+                        });
+                        if (value === prompts_1.BACK) {
+                            return 'back';
+                        }
+                        state.baseUrl = value;
+                        const prefix = pathPrefix(value);
+                        if (!prefix) {
+                            state.serveFromSubPath = undefined;
+                            return 'next';
+                        }
+                        const passthrough = await (0, prompts_1.selectStep)(`How does your proxy forward the ${prefix} prefix?`, [
+                            {
+                                title: 'It strips it',
+                                value: false,
+                                description: `${prefix}/manifest reaches the server as /manifest`,
+                            },
+                            {
+                                title: 'It passes it through',
+                                value: true,
+                                description: `the server routes under ${prefix} itself`,
+                            },
+                        ], { allowBack: true, initial: state.serveFromSubPath ?? false });
+                        if (passthrough === prompts_1.BACK) {
+                            continue;
+                        }
+                        state.serveFromSubPath = passthrough;
+                        return 'next';
                     }
-                    state.baseUrl = value;
-                    return 'next';
                 },
             },
             {
@@ -552,6 +598,7 @@ class ServerInit extends core_1.Command {
         }
         const choices = {
             baseUrl: state.baseUrl,
+            serveFromSubPath: state.serveFromSubPath,
             jwtSecret: state.jwtSecret,
             dbUrl: state.dbUrl,
             // The wizard always seals the master key in the env; storing it in AWS

package/dist/lib/assets.d.ts

@@ -1,3 +1,4 @@
+import { Platform } from '@expo/config';
 import Joi from 'joi';
 import { Credentials } from './auth';
 import { RequestedPlatform } from './expoConfig';
@@ -6,12 +7,26 @@ export interface AssetToUpload {
     path: string;
     name: string;
     ext: string;
+    hash: string;
+    key: string;
+    platform: Platform | null;
+    isLaunchAsset: boolean;
 }
-export declare function computeFilesRequests(projectDir: string, outputDir: string, requestedPlatform: RequestedPlatform): AssetToUpload[];
+export type FileRole = 'launch' | 'asset' | 'config';
+export interface FileUploadItem {
+    path: string;
+    hash: string;
+    key?: string;
+    ext?: string;
+    role: FileRole;
+}
+export declare function buildUploadFiles(files: AssetToUpload[], platform: string): FileUploadItem[];
+export declare function computeFilesRequests(projectDir: string, outputDir: string, requestedPlatform: RequestedPlatform): Promise<AssetToUpload[]>;
 export interface RequestUploadUrlItem {
     requestUploadUrl: string;
     fileName: string;
     filePath: string;
+    originalFileName: string;
     headers?: Record<string, string>;
 }
 export interface RequestUploadUrlsResponse {
@@ -41,9 +56,13 @@ export declare function resolveUploadRequests({ uploadRequests, exportDir, manif
     manifest: AssetToUpload[];
 }): Promise<ResolvedUploadRequest[]>;
 export declare function activeRolloutConflictMessage(branch: string): string;
+export declare class NoChangesDetectedError extends Error {
+    readonly platform: string;
+    constructor(platform: string);
+}
 export declare function requestUploadUrls({ body, requestUploadUrl, auth, runtimeVersion, platform, commitHash, message, rolloutPercentage, publishGroup, branch, }: {
     body: {
-        fileNames: string[];
+        files: FileUploadItem[];
     };
     requestUploadUrl: string;
     auth: Credentials;

package/dist/lib/assets.js

@@ -1,11 +1,12 @@
 "use strict";
 Object.defineProperty(exports, "__esModule", { value: true });
-exports.requestUploadUrls = exports.activeRolloutConflictMessage = exports.resolveUploadRequests = exports.RequestUploadUrlsResponseJoi = exports.computeFilesRequests = exports.MetadataJoi = void 0;
+exports.requestUploadUrls = exports.NoChangesDetectedError = exports.activeRolloutConflictMessage = exports.resolveUploadRequests = exports.RequestUploadUrlsResponseJoi = exports.computeFilesRequests = exports.buildUploadFiles = exports.MetadataJoi = void 0;
 const tslib_1 = require("tslib");
 const fs_extra_1 = tslib_1.__importDefault(require("fs-extra"));
 const joi_1 = tslib_1.__importDefault(require("joi"));
 const path_1 = tslib_1.__importDefault(require("path"));
 const auth_1 = require("./auth");
+const crypto_1 = require("./crypto");
 const expoConfig_1 = require("./expoConfig");
 const fetch_1 = require("./fetch");
 const log_1 = tslib_1.__importDefault(require("./log"));
@@ -24,6 +25,26 @@ exports.MetadataJoi = joi_1.default.object({
         web: fileMetadataJoi,
     }).required(),
 }).required();
+// buildUploadFiles is one platform's publish: its launch asset, its assets and
+// the config files, each stamped with its role. This is what tells the server
+// which bundle is which — only the CLI reads metadata.json.
+function buildUploadFiles(files, platform) {
+    return files
+        .filter(file => file.platform === null || file.platform === platform)
+        .map(file => {
+        if (file.platform === null) {
+            return { path: file.path, hash: file.hash, role: 'config' };
+        }
+        return {
+            path: file.path,
+            hash: file.hash,
+            key: file.key,
+            ext: file.ext,
+            role: file.isLaunchAsset ? 'launch' : 'asset',
+        };
+    });
+}
+exports.buildUploadFiles = buildUploadFiles;
 function loadMetadata(distRoot) {
     // eslint-disable-next-line
     const fileContent = fs_extra_1.default.readFileSync(path_1.default.join(distRoot, 'metadata.json'), 'utf8');
@@ -54,23 +75,65 @@ function loadMetadata(distRoot) {
     log_1.default.debug(`Loaded ${platforms.length} platform(s): ${platforms.join(', ')}`);
     return metadata;
 }
-function computeFilesRequests(projectDir, outputDir, requestedPlatform) {
-    const metadata = loadMetadata(path_1.default.join(projectDir, outputDir));
-    const assets = [
-        { path: 'metadata.json', name: 'metadata.json', ext: 'json' },
-        { path: 'expoConfig.json', name: 'expoConfig.json', ext: 'json' },
+async function digestExportFile(exportRoot, relativePath) {
+    const absolutePath = path_1.default.resolve(exportRoot, relativePath);
+    if (absolutePath !== exportRoot && !absolutePath.startsWith(exportRoot + path_1.default.sep)) {
+        throw new Error(`Refusing to hash "${relativePath}": it resolves outside the export directory.`);
+    }
+    return await (0, crypto_1.digestFile)(absolutePath);
+}
+async function computeFilesRequests(projectDir, outputDir, requestedPlatform) {
+    const exportDir = path_1.default.join(projectDir, outputDir);
+    let exportRoot;
+    try {
+        exportRoot = await fs_extra_1.default.realpath(exportDir);
+    }
+    catch {
+        throw new Error(`Export directory ${exportDir} could not be resolved.`);
+    }
+    const metadata = loadMetadata(exportRoot);
+    const pending = [
+        {
+            path: 'metadata.json',
+            name: 'metadata.json',
+            ext: 'json',
+            platform: null,
+            isLaunchAsset: false,
+        },
+        {
+            path: 'expoConfig.json',
+            name: 'expoConfig.json',
+            ext: 'json',
+            platform: null,
+            isLaunchAsset: false,
+        },
     ];
     for (const platform of Object.keys(metadata.fileMetadata)) {
         if (requestedPlatform !== expoConfig_1.RequestedPlatform.All && requestedPlatform !== platform) {
             continue;
         }
         const bundle = metadata.fileMetadata[platform].bundle;
-        assets.push({ path: bundle, name: path_1.default.basename(bundle), ext: 'hbc' });
+        pending.push({
+            path: bundle,
+            name: path_1.default.basename(bundle),
+            ext: 'hbc',
+            platform,
+            isLaunchAsset: true,
+        });
         for (const asset of metadata.fileMetadata[platform].assets) {
-            assets.push({ path: asset.path, name: path_1.default.basename(asset.path), ext: asset.ext });
+            pending.push({
+                path: asset.path,
+                name: path_1.default.basename(asset.path),
+                ext: asset.ext,
+                platform,
+                isLaunchAsset: false,
+            });
         }
     }
-    return assets;
+    return await Promise.all(pending.map(async (entry) => ({
+        ...entry,
+        ...(await digestExportFile(exportRoot, entry.path)),
+    })));
 }
 exports.computeFilesRequests = computeFilesRequests;
 // The server dictates which local files the CLI opens and where their bytes are
@@ -91,6 +154,7 @@ const uploadRequestJoi = joi_1.default.object({
         .required(),
     fileName: joi_1.default.string().required(),
     filePath: joi_1.default.string().required(),
+    originalFileName: joi_1.default.string().required(),
     headers: uploadRequestHeadersJoi,
     // Unknown keys are tolerated so a newer server can add fields without
     // breaking older CLIs; nothing reads them.
@@ -177,40 +241,41 @@ async function resolveUploadRequests({ uploadRequests, exportDir, manifest, }) {
     const resolved = [];
     for (const item of uploadRequests) {
         assertSafeUploadUrl(item.requestUploadUrl);
-        assertRelativePathShape(item.filePath);
-        const manifestEntry = manifestByPath.get(item.filePath);
+        const exportPath = item.originalFileName;
+        assertRelativePathShape(exportPath);
+        const manifestEntry = manifestByPath.get(exportPath);
         if (!manifestEntry) {
-            throw new Error(`Refusing to upload "${item.filePath}": the server asked for a file that is not part of this export.`);
+            throw new Error(`Refusing to upload "${exportPath}": the server asked for a file that is not part of this export.`);
         }
-        if (item.fileName !== path_1.default.basename(item.filePath)) {
-            throw new Error(`Refusing to upload "${item.filePath}": the server returned the mismatched name "${item.fileName}".`);
+        if (item.fileName !== path_1.default.basename(exportPath)) {
+            throw new Error(`Refusing to upload "${exportPath}": the server returned the mismatched name "${item.fileName}".`);
         }
-        if (seen.has(item.filePath)) {
-            throw new Error(`The server requested "${item.filePath}" more than once.`);
+        if (seen.has(exportPath)) {
+            throw new Error(`The server requested "${exportPath}" more than once.`);
         }
-        seen.add(item.filePath);
-        const absolutePath = path_1.default.resolve(exportRoot, item.filePath);
+        seen.add(exportPath);
+        const absolutePath = path_1.default.resolve(exportRoot, exportPath);
         // Unreachable on POSIX: a path with no '..' segment and no leading separator
         // cannot resolve out of the root. Kept for the Windows drive-relative case
         // ("C:file" when the export root sits on another drive) and as a backstop if
         // the checks above are ever relaxed.
         if (absolutePath !== exportRoot && !absolutePath.startsWith(exportRoot + path_1.default.sep)) {
-            throw new Error(`Refusing to upload "${item.filePath}": it resolves outside the export directory.`);
+            throw new Error(`Refusing to upload "${exportPath}": it resolves outside the export directory.`);
         }
         let realPath;
         try {
             realPath = await fs_extra_1.default.realpath(absolutePath);
         }
         catch {
-            throw new Error(`File ${item.filePath} not found in the export directory.`);
+            throw new Error(`File ${exportPath} not found in the export directory.`);
         }
         // The root is already canonical, so any difference here means a symlink was
         // traversed, either as the file itself or as one of its parent directories.
         if (realPath !== absolutePath) {
-            throw new Error(`Refusing to upload "${item.filePath}": it is or goes through a symlink.`);
+            throw new Error(`Refusing to upload "${exportPath}": it is or goes through a symlink.`);
         }
         if (!(await fs_extra_1.default.lstat(absolutePath)).isFile()) {
-            throw new Error(`Refusing to upload "${item.filePath}": it is not a regular file.`);
+            throw new Error(`Refusing to upload "${exportPath}": it is not a regular file.`);
         }
         resolved.push({ item, absolutePath, manifestEntry });
     }
@@ -221,6 +286,15 @@ function activeRolloutConflictMessage(branch) {
     return `A progressive rollout is already active for branch "${branch}" on this runtime version. End or revert it from the dashboard before publishing a new update.`;
 }
 exports.activeRolloutConflictMessage = activeRolloutConflictMessage;
+class NoChangesDetectedError extends Error {
+    platform;
+    constructor(platform) {
+        super(`There is no change in the update for ${platform}`);
+        this.platform = platform;
+        this.name = 'NoChangesDetectedError';
+    }
+}
+exports.NoChangesDetectedError = NoChangesDetectedError;
 async function requestUploadUrls({ body, requestUploadUrl, auth, runtimeVersion, platform, commitHash, message, rolloutPercentage, publishGroup, branch, }) {
     const uploadUrl = new URL(requestUploadUrl);
     uploadUrl.searchParams.set('runtimeVersion', runtimeVersion);
@@ -247,6 +321,9 @@ async function requestUploadUrls({ body, requestUploadUrl, auth, runtimeVersion,
     if (response.status === 409) {
         throw new Error(activeRolloutConflictMessage(branch));
     }
+    if (response.status === 406) {
+        throw new NoChangesDetectedError(platform);
+    }
     if (!response.ok) {
         const text = await response.text();
         throw new Error(`Failed to request upload URL: ${text}${(0, auth_1.missingEooTokenHint)(response.status)}`);

package/dist/lib/crypto.d.ts

@@ -0,0 +1,8 @@
+/// <reference types="node" />
+/// <reference types="node" />
+export declare function toBase64Url(buffer: Buffer): string;
+export interface FileDigest {
+    hash: string;
+    key: string;
+}
+export declare function digestFile(filePath: string): Promise<FileDigest>;

package/dist/lib/crypto.js

@@ -0,0 +1,27 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.digestFile = exports.toBase64Url = void 0;
+const tslib_1 = require("tslib");
+const crypto_1 = require("crypto");
+const fs_1 = tslib_1.__importDefault(require("fs"));
+// Same encoding as internal/crypto.GetBase64URLEncoding: the string
+// shapeManifestAsset puts on ManifestAsset.hash.
+function toBase64Url(buffer) {
+    return buffer.toString('base64').replace(/\+/g, '-').replace(/\//g, '_').replace(/=+$/, '');
+}
+exports.toBase64Url = toBase64Url;
+async function digestFile(filePath) {
+    const sha256 = (0, crypto_1.createHash)('sha256');
+    const md5 = (0, crypto_1.createHash)('md5');
+    await new Promise((resolve, reject) => {
+        fs_1.default.createReadStream(filePath)
+            .on('error', reject)
+            .on('data', chunk => {
+            sha256.update(chunk);
+            md5.update(chunk);
+        })
+            .on('end', resolve);
+    });
+    return { hash: toBase64Url(sha256.digest()), key: md5.digest('hex') };
+}
+exports.digestFile = digestFile;

package/dist/lib/expoConfig.d.ts

@@ -30,4 +30,5 @@ export type CommentedValue = {
 };
 /** Strips the comment wrappers, for the JSON path and for reading values back. */
 export declare function unwrapValue(value: any): any;
+export declare function publicServerUrl(raw: string): string;
 export declare function resolveServerUrl(config: ExpoConfig, customServerUrl?: string): Promise<string>;

package/dist/lib/expoConfig.js

@@ -1,6 +1,6 @@
 "use strict";
 Object.defineProperty(exports, "__esModule", { value: true });
-exports.resolveServerUrl = exports.unwrapValue = exports.createOrModifyExpoConfigAsync = exports.requireExpoAppId = exports.getExpoAppId = exports.getExpoConfigUpdateUrl = exports.getPublicExpoConfigAsync = exports.isUsingStaticExpoConfig = exports.ensureExpoConfigExists = exports.getPrivateExpoConfigAsync = exports.RequestedPlatform = void 0;
+exports.resolveServerUrl = exports.publicServerUrl = exports.unwrapValue = exports.createOrModifyExpoConfigAsync = exports.requireExpoAppId = exports.getExpoAppId = exports.getExpoConfigUpdateUrl = exports.getPublicExpoConfigAsync = exports.isUsingStaticExpoConfig = exports.ensureExpoConfigExists = exports.getPrivateExpoConfigAsync = exports.RequestedPlatform = void 0;
 const tslib_1 = require("tslib");
 // This file is copied from eas-cli[https://github.com/expo/eas-cli] to ensure consistent user experience across the CLI.
 const config_1 = require("@expo/config");
@@ -314,6 +314,17 @@ function stringifyWithEnv(obj) {
         : value, 2);
     return json.replace(/"__RAW_EXPR_(\d+)__"/g, (_match, index) => rawExpressions[Number(index)]);
 }
+// Strips a trailing /manifest from an Expo updates.url (or --serverUrl) and
+// keeps any path prefix the server is mounted under.
+function publicServerUrl(raw) {
+    const parsed = new URL(raw);
+    let path = parsed.pathname.replace(/\/+$/, '');
+    if (path.endsWith('/manifest')) {
+        path = path.slice(0, -'/manifest'.length);
+    }
+    return `${parsed.origin}${path}`;
+}
+exports.publicServerUrl = publicServerUrl;
 // customServerUrl wins over the Expo config, so a project serving updates and
 // receiving publishes on two different origins can point the CLI at the second
 // one without touching its config.
@@ -323,7 +334,7 @@ async function resolveServerUrl(config, customServerUrl) {
         throw new Error("Update url is not setup in your config. Please run 'eoas init' to setup the update url, or pass --serverUrl");
     }
     try {
-        return new URL(updateUrl).origin;
+        return publicServerUrl(updateUrl);
     }
     catch {
         throw new Error(customServerUrl ? 'Invalid --serverUrl value.' : 'Invalid update URL.');

package/dist/lib/serverConfig/choices.d.ts

@@ -9,6 +9,8 @@ export type Deployment = 'docker' | 'binary' | 'helm';
 export type GeoipStrategy = 'proxy-headers' | 'maxmind';
 export type ServerChoices = {
     baseUrl?: string;
+    /** The server routes under BASE_URL's path itself (SERVE_FROM_SUB_PATH). */
+    serveFromSubPath?: boolean;
     jwtSecret?: string;
     dbUrl?: string;
     masterKeySource: MasterKeySource;

package/dist/lib/serverConfig/envCatalog.js

@@ -19,7 +19,14 @@ exports.ENV_SECTIONS = [
                 applies: () => true,
                 required: true,
                 value: c => or(c.baseUrl, '<https://your-ota-domain>'),
-                comment: 'Public HTTPS URL of the server; manifest and asset URLs are built from it.',
+                comment: 'Public HTTPS URL of the server, including a path prefix if the gateway mounts it under one (e.g. https://api.example.com/ota).',
+            },
+            {
+                name: 'SERVE_FROM_SUB_PATH',
+                applies: c => c.serveFromSubPath === true,
+                required: true,
+                value: () => 'true',
+                comment: "Serve every route under the BASE_URL path prefix. Remove when the gateway strips the prefix before forwarding (it only affects routing; links always use BASE_URL's path).",
             },
             {
                 name: 'JWT_SECRET',
@@ -282,6 +289,13 @@ exports.ENV_SECTIONS = [
                 value: c => or(c.adminPassword, '<strong-password>'),
                 comment: 'Policy: 8+ characters, an uppercase, a lowercase, a digit and a special character.',
             },
+            {
+                name: 'DASHBOARD_ROOT_REDIRECT',
+                applies: c => c.dashboard !== false,
+                required: false,
+                value: () => 'true',
+                comment: 'Sends / to the dashboard login. Off by default: the root stays a 404 rather than pointing every visitor at the admin UI.',
+            },
         ],
     },
     {
@@ -474,6 +488,7 @@ function inferChoicesFromEnv(env) {
     const cacheMode = (env.CACHE_MODE ?? 'local');
     return {
         baseUrl: env.BASE_URL,
+        serveFromSubPath: env.SERVE_FROM_SUB_PATH === 'true',
         jwtSecret: env.JWT_SECRET,
         dbUrl: env.DB_URL,
         masterKeySource,

package/dist/lib/utils.js

@@ -6,7 +6,23 @@ const fs_extra_1 = tslib_1.__importDefault(require("fs-extra"));
 const path_1 = tslib_1.__importDefault(require("path"));
 const log_1 = tslib_1.__importDefault(require("./log"));
 function isValidUpdateUrl(updateUrl) {
-    return updateUrl.match(/^https?:\/\/[^/]+$/) !== null;
+    try {
+        const parsed = new URL(updateUrl);
+        if (parsed.protocol !== 'http:' && parsed.protocol !== 'https:') {
+            return false;
+        }
+        if (!parsed.host) {
+            return false;
+        }
+        // A query or fragment would corrupt the `${url}/manifest` concatenation.
+        if (parsed.search || parsed.hash) {
+            return false;
+        }
+        return !parsed.pathname.replace(/\/+$/, '').endsWith('/manifest');
+    }
+    catch {
+        return false;
+    }
 }
 exports.isValidUpdateUrl = isValidUpdateUrl;
 // Appends pattern to the project .gitignore unless an identical rule is already

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "eoas",
-  "version": "3.1.2",
+  "version": "3.2.0-beta1",
   "main": "index.js",
   "scripts": {
     "build": "tsc --project tsconfig.json",