expo-modules-autolinking 3.0.25 → 3.0.26

package/CHANGELOG.md

@@ -10,6 +10,12 @@
 
 ### 💡 Others
 
+## 3.0.26 — 2026-05-28
+
+### 🐛 Bug fixes
+
+- Disallow devtools plugins to point to `webpageRoot` outside of their own bounds ([#45841](https://github.com/expo/expo/pull/45841) by [@kitten](https://github.com/kitten))
+
 ## 3.0.25 — 2026-04-27
 
 ### 🐛 Bug fixes

package/build/platforms/devtools.js

@@ -6,6 +6,7 @@ Object.defineProperty(exports, "__esModule", { value: true });
 exports.resolveModuleAsync = resolveModuleAsync;
 exports.resolveExtraBuildDependenciesAsync = resolveExtraBuildDependenciesAsync;
 const path_1 = __importDefault(require("path"));
+const utils_1 = require("../utils");
 async function resolveModuleAsync(packageName, revision) {
     const devtoolsConfig = revision.config?.toJSON().devtools;
     if (devtoolsConfig == null) {
@@ -14,9 +15,18 @@ async function resolveModuleAsync(packageName, revision) {
     return {
         packageName,
         packageRoot: revision.path,
-        webpageRoot: path_1.default.join(revision.path, devtoolsConfig.webpageRoot),
+        webpageRoot: await resolveWebpageRoot(revision.path, devtoolsConfig.webpageRoot),
     };
 }
+async function resolveWebpageRoot(packageRoot, configuredWebpageRoot) {
+    if (!configuredWebpageRoot) {
+        return undefined;
+    }
+    const resolvedWebpageRoot = path_1.default.resolve(packageRoot, configuredWebpageRoot);
+    // NOTE(@kitten): Failing realpath-ing, typically due to ENOENT, results in the original value
+    const webpageRoot = (await (0, utils_1.maybeRealpath)(resolvedWebpageRoot)) ?? resolvedWebpageRoot;
+    return (0, utils_1.isPathInside)(webpageRoot, packageRoot) ? webpageRoot : undefined;
+}
 async function resolveExtraBuildDependenciesAsync(_projectNativeRoot) {
     return null;
 }

package/build/platforms/devtools.js.map

@@ -1 +1 @@
-{"version":3,"file":"devtools.js","sourceRoot":"","sources":["../../src/platforms/devtools.ts"],"names":[],"mappings":";;;;;AAIA,gDAcC;AAED,gFAIC;AAxBD,gDAAwB;AAIjB,KAAK,UAAU,kBAAkB,CACtC,WAAmB,EACnB,QAAyB;IAEzB,MAAM,cAAc,GAAG,QAAQ,CAAC,MAAM,EAAE,MAAM,EAAE,CAAC,QAAQ,CAAC;IAC1D,IAAI,cAAc,IAAI,IAAI,EAAE,CAAC;QAC3B,OAAO,IAAI,CAAC;IACd,CAAC;IAED,OAAO;QACL,WAAW;QACX,WAAW,EAAE,QAAQ,CAAC,IAAI;QAC1B,WAAW,EAAE,cAAI,CAAC,IAAI,CAAC,QAAQ,CAAC,IAAI,EAAE,cAAc,CAAC,WAAW,CAAC;KAClE,CAAC;AACJ,CAAC;AAEM,KAAK,UAAU,kCAAkC,CACtD,kBAA0B;IAE1B,OAAO,IAAI,CAAC;AACd,CAAC","sourcesContent":["import path from 'path';\n\nimport type { ExtraDependencies, ModuleDescriptorDevTools, PackageRevision } from '../types';\n\nexport async function resolveModuleAsync(\n  packageName: string,\n  revision: PackageRevision\n): Promise<ModuleDescriptorDevTools | null> {\n  const devtoolsConfig = revision.config?.toJSON().devtools;\n  if (devtoolsConfig == null) {\n    return null;\n  }\n\n  return {\n    packageName,\n    packageRoot: revision.path,\n    webpageRoot: path.join(revision.path, devtoolsConfig.webpageRoot),\n  };\n}\n\nexport async function resolveExtraBuildDependenciesAsync(\n  _projectNativeRoot: string\n): Promise<ExtraDependencies | null> {\n  return null;\n}\n"]}
+{"version":3,"file":"devtools.js","sourceRoot":"","sources":["../../src/platforms/devtools.ts"],"names":[],"mappings":";;;;;AAKA,gDAcC;AAeD,gFAIC;AAtCD,gDAAwB;AAGxB,oCAAuD;AAEhD,KAAK,UAAU,kBAAkB,CACtC,WAAmB,EACnB,QAAyB;IAEzB,MAAM,cAAc,GAAG,QAAQ,CAAC,MAAM,EAAE,MAAM,EAAE,CAAC,QAAQ,CAAC;IAC1D,IAAI,cAAc,IAAI,IAAI,EAAE,CAAC;QAC3B,OAAO,IAAI,CAAC;IACd,CAAC;IAED,OAAO;QACL,WAAW;QACX,WAAW,EAAE,QAAQ,CAAC,IAAI;QAC1B,WAAW,EAAE,MAAM,kBAAkB,CAAC,QAAQ,CAAC,IAAI,EAAE,cAAc,CAAC,WAAW,CAAC;KACjF,CAAC;AACJ,CAAC;AAED,KAAK,UAAU,kBAAkB,CAC/B,WAAmB,EACnB,qBAAyC;IAEzC,IAAI,CAAC,qBAAqB,EAAE,CAAC;QAC3B,OAAO,SAAS,CAAC;IACnB,CAAC;IACD,MAAM,mBAAmB,GAAG,cAAI,CAAC,OAAO,CAAC,WAAW,EAAE,qBAAqB,CAAC,CAAC;IAC7E,8FAA8F;IAC9F,MAAM,WAAW,GAAG,CAAC,MAAM,IAAA,qBAAa,EAAC,mBAAmB,CAAC,CAAC,IAAI,mBAAmB,CAAC;IACtF,OAAO,IAAA,oBAAY,EAAC,WAAW,EAAE,WAAW,CAAC,CAAC,CAAC,CAAC,WAAW,CAAC,CAAC,CAAC,SAAS,CAAC;AAC1E,CAAC;AAEM,KAAK,UAAU,kCAAkC,CACtD,kBAA0B;IAE1B,OAAO,IAAI,CAAC;AACd,CAAC","sourcesContent":["import path from 'path';\n\nimport type { ExtraDependencies, ModuleDescriptorDevTools, PackageRevision } from '../types';\nimport { isPathInside, maybeRealpath } from '../utils';\n\nexport async function resolveModuleAsync(\n  packageName: string,\n  revision: PackageRevision\n): Promise<ModuleDescriptorDevTools | null> {\n  const devtoolsConfig = revision.config?.toJSON().devtools;\n  if (devtoolsConfig == null) {\n    return null;\n  }\n\n  return {\n    packageName,\n    packageRoot: revision.path,\n    webpageRoot: await resolveWebpageRoot(revision.path, devtoolsConfig.webpageRoot),\n  };\n}\n\nasync function resolveWebpageRoot(\n  packageRoot: string,\n  configuredWebpageRoot: string | undefined\n): Promise<string | undefined> {\n  if (!configuredWebpageRoot) {\n    return undefined;\n  }\n  const resolvedWebpageRoot = path.resolve(packageRoot, configuredWebpageRoot);\n  // NOTE(@kitten): Failing realpath-ing, typically due to ENOENT, results in the original value\n  const webpageRoot = (await maybeRealpath(resolvedWebpageRoot)) ?? resolvedWebpageRoot;\n  return isPathInside(webpageRoot, packageRoot) ? webpageRoot : undefined;\n}\n\nexport async function resolveExtraBuildDependenciesAsync(\n  _projectNativeRoot: string\n): Promise<ExtraDependencies | null> {\n  return null;\n}\n"]}

package/build/types.d.ts

@@ -53,7 +53,7 @@ export interface ModuleDescriptorIos extends CommonNativeModuleDescriptor {
 export interface ModuleDescriptorDevTools {
     packageName: string;
     packageRoot: string;
-    webpageRoot: string;
+    webpageRoot: string | undefined;
 }
 export interface ModuleDescriptorWeb {
     packageName: string;

package/build/types.js.map

@@ -1 +1 @@
-{"version":3,"file":"types.js","sourceRoot":"","sources":["../src/types.ts"],"names":[],"mappings":"","sourcesContent":["import { ExpoModuleConfig } from './ExpoModuleConfig';\n\ntype Required<T, K extends keyof T> = T & { [P in K]-?: T[P] };\n\ntype WithRequired<T, K extends keyof T> = Pick<T, Exclude<keyof T, K>> & Required<T, K>;\n\n// NOTE(@kitten): Our code has never guaranteed this to be exhaustive, hence the `| (string & {})` addition\nexport type SupportedPlatform =\n  | 'apple'\n  | 'ios'\n  | 'android'\n  | 'web'\n  | 'macos'\n  | 'tvos'\n  | 'devtools'\n  | (string & {});\n\nexport type PackageRevision = {\n  name: string;\n  path: string;\n  version: string;\n  config?: ExpoModuleConfig;\n  duplicates?: PackageRevision[];\n};\n\nexport type SearchResults = {\n  [moduleName: string]: PackageRevision;\n};\n\nexport interface ModuleAndroidProjectInfo {\n  name: string;\n  sourceDir: string;\n  modules: string[];\n  publication?: AndroidPublication;\n  aarProjects?: AndroidGradleAarProjectDescriptor[];\n  shouldUsePublicationScriptPath?: string;\n}\n\nexport interface ModuleAndroidPluginInfo {\n  id: string;\n  sourceDir: string;\n}\n\nexport interface ModuleAndroidAarProjectInfo extends AndroidGradleAarProjectDescriptor {\n  projectDir: string;\n}\n\nexport interface CommonNativeModuleDescriptor {\n  packageName: string;\n  coreFeatures?: string[];\n}\n\nexport interface ModuleDescriptorAndroid extends CommonNativeModuleDescriptor {\n  projects?: ModuleAndroidProjectInfo[];\n  plugins?: ModuleAndroidPluginInfo[];\n}\n\nexport interface ModuleIosPodspecInfo {\n  podName: string;\n  podspecDir: string;\n}\nexport interface ModuleDescriptorIos extends CommonNativeModuleDescriptor {\n  modules: string[];\n  pods: ModuleIosPodspecInfo[];\n  flags: Record<string, any> | undefined;\n  swiftModuleNames: string[];\n  appDelegateSubscribers: string[];\n  reactDelegateHandlers: string[];\n  debugOnly: boolean;\n}\n\nexport interface ModuleDescriptorDevTools {\n  packageName: string;\n  packageRoot: string;\n  webpageRoot: string;\n}\n\nexport interface ModuleDescriptorWeb {\n  packageName: string;\n  packageRoot: string;\n}\n\nexport type ModuleDescriptor =\n  | ModuleDescriptorAndroid\n  | ModuleDescriptorIos\n  | ModuleDescriptorDevTools\n  | ModuleDescriptorWeb;\n\nexport interface AndroidGradlePluginDescriptor {\n  /**\n   * Gradle plugin ID\n   */\n  id: string;\n\n  /**\n   * Artifact group\n   */\n  group: string;\n\n  /**\n   * Relative path to the gradle plugin directory\n   */\n  sourceDir: string;\n\n  /**\n   * Whether to apply the plugin to the root project\n   * Defaults to true\n   */\n  applyToRootProject?: boolean;\n}\n\nexport interface AndroidGradleAarProjectDescriptor {\n  /**\n   * Gradle project name\n   */\n  name: string;\n\n  /**\n   * Path to the AAR file\n   */\n  aarFilePath: string;\n}\n\n/**\n * Information about the available publication of an Android AAR file.\n */\nexport interface AndroidPublication {\n  /**\n   * The Maven artifact ID.\n   */\n  id: string;\n  /**\n   * The Maven group ID.\n   */\n  group: string;\n  /**\n   * The Maven version.\n   */\n  version: string;\n  /**\n   * The Maven repository.\n   */\n  repository: string;\n}\n\n/**\n * Represents a raw config specific to Apple platforms.\n */\nexport type RawModuleConfigApple = {\n  /**\n   * Names of Swift native modules classes to put to the generated modules provider file.\n   */\n  modules?: string[];\n\n  /**\n   * Names of Swift classes that hooks into `ExpoAppDelegate` to receive AppDelegate life-cycle events.\n   */\n  appDelegateSubscribers?: string[];\n\n  /**\n   * Names of Swift classes that implement `ExpoReactDelegateHandler` to hook React instance creation.\n   */\n  reactDelegateHandlers?: string[];\n\n  /**\n   * Podspec relative path.\n   * To have multiple podspecs, string array type is also supported.\n   */\n  podspecPath?: string | string[];\n\n  /**\n   * Swift product module name. If empty, the pod name is used for Swift imports.\n   * To have multiple modules, string array is also supported.\n   */\n  swiftModuleName?: string | string[];\n\n  /**\n   * Whether this module will be added only to the debug configuration.\n   * Defaults to false.\n   */\n  debugOnly?: boolean;\n};\n\n/**\n * Represents a raw config specific to Android platforms.\n */\nexport type RawAndroidProjectConfig = {\n  /**\n   * The name of the project. It will be used as the Gradle project name.\n   */\n  name?: string;\n\n  /**\n   * The path to the project directory. Should contain the `build.gradle{.kts}` file.\n   * It's relative to the module root directory.\n   */\n  path?: string;\n\n  /**\n   * Information about the available publication of an Android AAR file\n   */\n  publication?: AndroidPublication;\n\n  /**\n   * The path to the script that determines whether the publication should be used.\n   * Evaluate in the context of the `settings.gradle` file.\n   * Won't be run if the publication is not defined.\n   */\n  shouldUsePublicationScriptPath?: string;\n  /**\n   * Names of the modules to be linked in the project.\n   */\n  modules?: string[];\n\n  /**\n   * Prebuilded AAR projects.\n   */\n  gradleAarProjects?: AndroidGradleAarProjectDescriptor[];\n\n  gradlePath?: string;\n};\n\nexport type RawAndroidConfig = {\n  projects?: WithRequired<RawAndroidProjectConfig, 'name' | 'path'>[];\n  /**\n   * Gradle plugins.\n   */\n  gradlePlugins?: AndroidGradlePluginDescriptor[];\n\n  /**\n   * Gradle projects containing AAR files.\n   */\n} & RawAndroidProjectConfig;\n\n/**\n * Represents a raw config from `expo-module.json`.\n */\nexport interface RawExpoModuleConfig {\n  /**\n   * An array of supported platforms.\n   */\n  platforms?: SupportedPlatform[];\n\n  /**\n   * A config for all Apple platforms.\n   */\n  apple?: RawModuleConfigApple;\n\n  /**\n   * The legacy config previously used for iOS platform. For backwards compatibility it's used as the fallback for `apple`.\n   * @deprecated As the module can now support more than iOS platform, use the generic `apple` config instead.\n   */\n  ios?: RawModuleConfigApple;\n\n  /**\n   * Android-specific config.\n   */\n  android?: RawAndroidConfig;\n\n  /**\n   * List of core features that this module requires.\n   */\n  coreFeatures?: string[];\n\n  /**\n   * DevTools-specific config.\n   */\n  devtools?: {\n    /**\n     * The webpage root directory for Expo CLI DevTools to serve the web resources.\n     */\n    webpageRoot: string;\n  };\n}\n\ninterface AndroidMavenRepositoryPasswordCredentials {\n  username: string;\n  password: string;\n}\n\ninterface AndroidMavenRepositoryHttpHeaderCredentials {\n  name: string;\n  value: string;\n}\n\ninterface AndroidMavenRepositoryAWSCredentials {\n  accessKey: string;\n  secretKey: string;\n  sessionToken?: string;\n}\n\ntype AndroidMavenRepositoryCredentials =\n  | AndroidMavenRepositoryPasswordCredentials\n  | AndroidMavenRepositoryHttpHeaderCredentials\n  | AndroidMavenRepositoryAWSCredentials;\n\nexport interface AndroidMavenRepository {\n  /**\n   * The URL of the Maven repository.\n   */\n  url: string;\n  /**\n   * The credentials to use when accessing the Maven repository.\n   * May be of type PasswordCredentials, HttpHeaderCredentials, or AWSCredentials.\n   *\n   * @see the authentication schemes section of [Gradle documentation](https://docs.gradle.org/current/userguide/declaring_repositories.html#sec:authentication_schemes) for more information.\n   */\n  credentials?: AndroidMavenRepositoryCredentials;\n  /**\n   * The authentication scheme to use when accessing the Maven repository.\n   */\n  authentication?: 'basic' | 'digest' | 'header';\n}\n\ninterface ApplePod {\n  name: string;\n  version?: string;\n  configurations?: string[];\n  modular_headers?: boolean;\n  source?: string;\n  path?: string;\n  podspec?: string;\n  testspecs?: string[];\n  git?: string;\n  branch?: string;\n  tag?: string;\n  commit?: string;\n}\n\nexport type ExtraDependencies = AndroidMavenRepository[] | ApplePod[];\n\n/**\n * Represents code signing entitlements passed to the `ExpoModulesProvider` for Apple platforms.\n */\nexport interface AppleCodeSignEntitlements {\n  /**\n   * @see https://developer.apple.com/documentation/bundleresources/entitlements/com_apple_security_application-groups\n   */\n  appGroups?: string[];\n}\n"]}
+{"version":3,"file":"types.js","sourceRoot":"","sources":["../src/types.ts"],"names":[],"mappings":"","sourcesContent":["import { ExpoModuleConfig } from './ExpoModuleConfig';\n\ntype Required<T, K extends keyof T> = T & { [P in K]-?: T[P] };\n\ntype WithRequired<T, K extends keyof T> = Pick<T, Exclude<keyof T, K>> & Required<T, K>;\n\n// NOTE(@kitten): Our code has never guaranteed this to be exhaustive, hence the `| (string & {})` addition\nexport type SupportedPlatform =\n  | 'apple'\n  | 'ios'\n  | 'android'\n  | 'web'\n  | 'macos'\n  | 'tvos'\n  | 'devtools'\n  | (string & {});\n\nexport type PackageRevision = {\n  name: string;\n  path: string;\n  version: string;\n  config?: ExpoModuleConfig;\n  duplicates?: PackageRevision[];\n};\n\nexport type SearchResults = {\n  [moduleName: string]: PackageRevision;\n};\n\nexport interface ModuleAndroidProjectInfo {\n  name: string;\n  sourceDir: string;\n  modules: string[];\n  publication?: AndroidPublication;\n  aarProjects?: AndroidGradleAarProjectDescriptor[];\n  shouldUsePublicationScriptPath?: string;\n}\n\nexport interface ModuleAndroidPluginInfo {\n  id: string;\n  sourceDir: string;\n}\n\nexport interface ModuleAndroidAarProjectInfo extends AndroidGradleAarProjectDescriptor {\n  projectDir: string;\n}\n\nexport interface CommonNativeModuleDescriptor {\n  packageName: string;\n  coreFeatures?: string[];\n}\n\nexport interface ModuleDescriptorAndroid extends CommonNativeModuleDescriptor {\n  projects?: ModuleAndroidProjectInfo[];\n  plugins?: ModuleAndroidPluginInfo[];\n}\n\nexport interface ModuleIosPodspecInfo {\n  podName: string;\n  podspecDir: string;\n}\nexport interface ModuleDescriptorIos extends CommonNativeModuleDescriptor {\n  modules: string[];\n  pods: ModuleIosPodspecInfo[];\n  flags: Record<string, any> | undefined;\n  swiftModuleNames: string[];\n  appDelegateSubscribers: string[];\n  reactDelegateHandlers: string[];\n  debugOnly: boolean;\n}\n\nexport interface ModuleDescriptorDevTools {\n  packageName: string;\n  packageRoot: string;\n  webpageRoot: string | undefined;\n}\n\nexport interface ModuleDescriptorWeb {\n  packageName: string;\n  packageRoot: string;\n}\n\nexport type ModuleDescriptor =\n  | ModuleDescriptorAndroid\n  | ModuleDescriptorIos\n  | ModuleDescriptorDevTools\n  | ModuleDescriptorWeb;\n\nexport interface AndroidGradlePluginDescriptor {\n  /**\n   * Gradle plugin ID\n   */\n  id: string;\n\n  /**\n   * Artifact group\n   */\n  group: string;\n\n  /**\n   * Relative path to the gradle plugin directory\n   */\n  sourceDir: string;\n\n  /**\n   * Whether to apply the plugin to the root project\n   * Defaults to true\n   */\n  applyToRootProject?: boolean;\n}\n\nexport interface AndroidGradleAarProjectDescriptor {\n  /**\n   * Gradle project name\n   */\n  name: string;\n\n  /**\n   * Path to the AAR file\n   */\n  aarFilePath: string;\n}\n\n/**\n * Information about the available publication of an Android AAR file.\n */\nexport interface AndroidPublication {\n  /**\n   * The Maven artifact ID.\n   */\n  id: string;\n  /**\n   * The Maven group ID.\n   */\n  group: string;\n  /**\n   * The Maven version.\n   */\n  version: string;\n  /**\n   * The Maven repository.\n   */\n  repository: string;\n}\n\n/**\n * Represents a raw config specific to Apple platforms.\n */\nexport type RawModuleConfigApple = {\n  /**\n   * Names of Swift native modules classes to put to the generated modules provider file.\n   */\n  modules?: string[];\n\n  /**\n   * Names of Swift classes that hooks into `ExpoAppDelegate` to receive AppDelegate life-cycle events.\n   */\n  appDelegateSubscribers?: string[];\n\n  /**\n   * Names of Swift classes that implement `ExpoReactDelegateHandler` to hook React instance creation.\n   */\n  reactDelegateHandlers?: string[];\n\n  /**\n   * Podspec relative path.\n   * To have multiple podspecs, string array type is also supported.\n   */\n  podspecPath?: string | string[];\n\n  /**\n   * Swift product module name. If empty, the pod name is used for Swift imports.\n   * To have multiple modules, string array is also supported.\n   */\n  swiftModuleName?: string | string[];\n\n  /**\n   * Whether this module will be added only to the debug configuration.\n   * Defaults to false.\n   */\n  debugOnly?: boolean;\n};\n\n/**\n * Represents a raw config specific to Android platforms.\n */\nexport type RawAndroidProjectConfig = {\n  /**\n   * The name of the project. It will be used as the Gradle project name.\n   */\n  name?: string;\n\n  /**\n   * The path to the project directory. Should contain the `build.gradle{.kts}` file.\n   * It's relative to the module root directory.\n   */\n  path?: string;\n\n  /**\n   * Information about the available publication of an Android AAR file\n   */\n  publication?: AndroidPublication;\n\n  /**\n   * The path to the script that determines whether the publication should be used.\n   * Evaluate in the context of the `settings.gradle` file.\n   * Won't be run if the publication is not defined.\n   */\n  shouldUsePublicationScriptPath?: string;\n  /**\n   * Names of the modules to be linked in the project.\n   */\n  modules?: string[];\n\n  /**\n   * Prebuilded AAR projects.\n   */\n  gradleAarProjects?: AndroidGradleAarProjectDescriptor[];\n\n  gradlePath?: string;\n};\n\nexport type RawAndroidConfig = {\n  projects?: WithRequired<RawAndroidProjectConfig, 'name' | 'path'>[];\n  /**\n   * Gradle plugins.\n   */\n  gradlePlugins?: AndroidGradlePluginDescriptor[];\n\n  /**\n   * Gradle projects containing AAR files.\n   */\n} & RawAndroidProjectConfig;\n\n/**\n * Represents a raw config from `expo-module.json`.\n */\nexport interface RawExpoModuleConfig {\n  /**\n   * An array of supported platforms.\n   */\n  platforms?: SupportedPlatform[];\n\n  /**\n   * A config for all Apple platforms.\n   */\n  apple?: RawModuleConfigApple;\n\n  /**\n   * The legacy config previously used for iOS platform. For backwards compatibility it's used as the fallback for `apple`.\n   * @deprecated As the module can now support more than iOS platform, use the generic `apple` config instead.\n   */\n  ios?: RawModuleConfigApple;\n\n  /**\n   * Android-specific config.\n   */\n  android?: RawAndroidConfig;\n\n  /**\n   * List of core features that this module requires.\n   */\n  coreFeatures?: string[];\n\n  /**\n   * DevTools-specific config.\n   */\n  devtools?: {\n    /**\n     * The webpage root directory for Expo CLI DevTools to serve the web resources.\n     */\n    webpageRoot: string;\n  };\n}\n\ninterface AndroidMavenRepositoryPasswordCredentials {\n  username: string;\n  password: string;\n}\n\ninterface AndroidMavenRepositoryHttpHeaderCredentials {\n  name: string;\n  value: string;\n}\n\ninterface AndroidMavenRepositoryAWSCredentials {\n  accessKey: string;\n  secretKey: string;\n  sessionToken?: string;\n}\n\ntype AndroidMavenRepositoryCredentials =\n  | AndroidMavenRepositoryPasswordCredentials\n  | AndroidMavenRepositoryHttpHeaderCredentials\n  | AndroidMavenRepositoryAWSCredentials;\n\nexport interface AndroidMavenRepository {\n  /**\n   * The URL of the Maven repository.\n   */\n  url: string;\n  /**\n   * The credentials to use when accessing the Maven repository.\n   * May be of type PasswordCredentials, HttpHeaderCredentials, or AWSCredentials.\n   *\n   * @see the authentication schemes section of [Gradle documentation](https://docs.gradle.org/current/userguide/declaring_repositories.html#sec:authentication_schemes) for more information.\n   */\n  credentials?: AndroidMavenRepositoryCredentials;\n  /**\n   * The authentication scheme to use when accessing the Maven repository.\n   */\n  authentication?: 'basic' | 'digest' | 'header';\n}\n\ninterface ApplePod {\n  name: string;\n  version?: string;\n  configurations?: string[];\n  modular_headers?: boolean;\n  source?: string;\n  path?: string;\n  podspec?: string;\n  testspecs?: string[];\n  git?: string;\n  branch?: string;\n  tag?: string;\n  commit?: string;\n}\n\nexport type ExtraDependencies = AndroidMavenRepository[] | ApplePod[];\n\n/**\n * Represents code signing entitlements passed to the `ExpoModulesProvider` for Apple platforms.\n */\nexport interface AppleCodeSignEntitlements {\n  /**\n   * @see https://developer.apple.com/documentation/bundleresources/entitlements/com_apple_security_application-groups\n   */\n  appGroups?: string[];\n}\n"]}

package/build/utils.d.ts

@@ -10,3 +10,5 @@ export declare function scanFilesRecursively(parentPath: string, includeDirector
     readonly name: string;
 }, void, unknown>;
 export declare const fileExistsAsync: (file: string) => Promise<string | null>;
+export declare const maybeRealpath: (target: string) => Promise<string | null>;
+export declare function isPathInside(child: string, parent: string): boolean;

package/build/utils.js

@@ -3,11 +3,12 @@ var __importDefault = (this && this.__importDefault) || function (mod) {
     return (mod && mod.__esModule) ? mod : { "default": mod };
 };
 Object.defineProperty(exports, "__esModule", { value: true });
-exports.fileExistsAsync = void 0;
+exports.maybeRealpath = exports.fileExistsAsync = void 0;
 exports.memoize = memoize;
 exports.listFilesSorted = listFilesSorted;
 exports.listFilesInDirectories = listFilesInDirectories;
 exports.scanFilesRecursively = scanFilesRecursively;
+exports.isPathInside = isPathInside;
 const fs_1 = __importDefault(require("fs"));
 const path_1 = __importDefault(require("path"));
 const MAX_SIZE = 5_000;
@@ -89,4 +90,17 @@ const fileExistsAsync = async (file) => {
     return stat?.isFile() ? file : null;
 };
 exports.fileExistsAsync = fileExistsAsync;
+const maybeRealpath = async (target) => {
+    try {
+        return await fs_1.default.promises.realpath(target);
+    }
+    catch {
+        return null;
+    }
+};
+exports.maybeRealpath = maybeRealpath;
+function isPathInside(child, parent) {
+    const relative = path_1.default.relative(parent, child);
+    return !!relative && !relative.startsWith('..') && !path_1.default.isAbsolute(relative);
+}
 //# sourceMappingURL=utils.js.map

package/build/utils.js.map

@@ -1 +1 @@
-{"version":3,"file":"utils.js","sourceRoot":"","sources":["../src/utils.ts"],"names":[],"mappings":";;;;;;AAKA,0BAcC;AAGD,0CAaC;AAGD,wDAoBC;AAGD,oDA+BC;AA5FD,4CAAoB;AACpB,gDAAwB;AAExB,MAAM,QAAQ,GAAG,KAAK,CAAC;AAEvB,SAAgB,OAAO,CAAmE,EAAM;IAC9F,MAAM,KAAK,GAAG,IAAI,GAAG,EAA0B,CAAC;IAChD,OAAO,KAAK,EAAE,KAAa,EAAE,GAAG,IAAW,EAAE,EAAE;QAC7C,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,KAAK,CAAC,EAAE,CAAC;YACtB,MAAM,MAAM,GAAG,MAAM,EAAE,CAAC,KAAK,EAAE,GAAG,IAAI,CAAC,CAAC;YACxC,IAAI,KAAK,CAAC,IAAI,GAAG,QAAQ,EAAE,CAAC;gBAC1B,KAAK,CAAC,KAAK,EAAE,CAAC;YAChB,CAAC;YACD,KAAK,CAAC,GAAG,CAAC,KAAK,EAAE,MAAM,CAAC,CAAC;YACzB,OAAO,MAAM,CAAC;QAChB,CAAC;aAAM,CAAC;YACN,OAAO,KAAK,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC;QAC1B,CAAC;IACH,CAAC,CAAC;AACJ,CAAC;AAED,6EAA6E;AACtE,KAAK,UAAU,eAAe,CACnC,UAAkB,EAClB,MAAqC;IAErC,IAAI,CAAC;QACH,qDAAqD;QACrD,OAAO,CAAC,MAAM,YAAE,CAAC,QAAQ,CAAC,OAAO,CAAC,UAAU,EAAE,EAAE,aAAa,EAAE,IAAI,EAAE,CAAC,CAAC;aACpE,MAAM,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,MAAM,EAAE,IAAI,MAAM,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;aACvD,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,aAAa,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC;aAC5C,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,cAAI,CAAC,IAAI,CAAC,UAAU,EAAE,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC;IACvD,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,EAAE,CAAC;IACZ,CAAC;AACH,CAAC;AAED,0FAA0F;AACnF,KAAK,UAAU,sBAAsB,CAC1C,UAAkB,EAClB,MAAqC;IAErC,OAAO,CACL,MAAM,OAAO,CAAC,GAAG,CACf,CAAC,MAAM,YAAE,CAAC,QAAQ,CAAC,OAAO,CAAC,UAAU,EAAE,EAAE,aAAa,EAAE,IAAI,EAAE,CAAC,CAAC;SAC7D,MAAM,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,WAAW,EAAE,IAAI,KAAK,CAAC,IAAI,KAAK,cAAc,CAAC;SACvE,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,aAAa,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC;SAC5C,GAAG,CAAC,KAAK,EAAE,SAAS,EAAE,EAAE;QACvB,MAAM,OAAO,GAAG,MAAM,YAAE,CAAC,QAAQ,CAAC,OAAO,CAAC,cAAI,CAAC,IAAI,CAAC,UAAU,EAAE,SAAS,CAAC,IAAI,CAAC,EAAE;YAC/E,aAAa,EAAE,IAAI;SACpB,CAAC,CAAC;QACH,OAAO,OAAO;aACX,MAAM,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,MAAM,EAAE,IAAI,MAAM,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;aACvD,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,aAAa,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC;aAC5C,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,cAAI,CAAC,IAAI,CAAC,SAAS,CAAC,IAAI,EAAE,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC;IAC3D,CAAC,CAAC,CACL,CACF,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;AACZ,CAAC;AAED,kGAAkG;AAC3F,KAAK,SAAS,CAAC,CAAC,oBAAoB,CACzC,UAAkB,EAClB,gBAAgE,EAChE,IAAI,GAAG,CAAC,YAAE,CAAC,OAAO;IAElB,MAAM,KAAK,GAAG,CAAC,UAAU,CAAC,CAAC;IAC3B,IAAI,UAA8B,CAAC;IACnC,OAAO,KAAK,CAAC,MAAM,GAAG,CAAC,IAAI,CAAC,UAAU,GAAG,KAAK,CAAC,KAAK,EAAE,CAAC,IAAI,IAAI,EAAE,CAAC;QAChE,IAAI,CAAC;YACH,MAAM,OAAO,GAAG,IAAI;gBAClB,CAAC,CAAC,CAAC,MAAM,YAAE,CAAC,QAAQ,CAAC,OAAO,CAAC,UAAU,EAAE,EAAE,aAAa,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAC7E,CAAC,CAAC,IAAI,CAAC,aAAa,CAAC,CAAC,CAAC,IAAI,CAAC,CAC7B;gBACH,CAAC,CAAC,MAAM,YAAE,CAAC,QAAQ,CAAC,OAAO,CAAC,UAAU,CAAC,CAAC;YAC1C,IAAI,KAAK,EAAE,MAAM,KAAK,IAAI,OAAO,EAAE,CAAC;gBAClC,IAAI,KAAK,CAAC,WAAW,EAAE,IAAI,KAAK,CAAC,IAAI,KAAK,cAAc,EAAE,CAAC;oBACzD,IAAI,CAAC,gBAAgB,IAAI,gBAAgB,CAAC,UAAU,EAAE,KAAK,CAAC,IAAI,CAAC,EAAE,CAAC;wBAClE,KAAK,CAAC,IAAI,CAAC,cAAI,CAAC,IAAI,CAAC,UAAU,EAAE,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC;oBAChD,CAAC;gBACH,CAAC;qBAAM,IAAI,KAAK,CAAC,MAAM,EAAE,EAAE,CAAC;oBAC1B,MAAM;wBACJ,IAAI,EAAE,cAAI,CAAC,IAAI,CAAC,UAAU,EAAE,KAAK,CAAC,IAAI,CAAC;wBACvC,UAAU,EAAE,UAAU;wBACtB,IAAI,EAAE,KAAK,CAAC,IAAI;qBACR,CAAC;gBACb,CAAC;YACH,CAAC;QACH,CAAC;QAAC,MAAM,CAAC;YACP,SAAS;QACX,CAAC;IACH,CAAC;AACH,CAAC;AAEM,MAAM,eAAe,GAAG,KAAK,EAAE,IAAY,EAA0B,EAAE;IAC5E,MAAM,IAAI,GAAG,MAAM,YAAE,CAAC,QAAQ,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,IAAI,CAAC,CAAC;IAC5D,OAAO,IAAI,EAAE,MAAM,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC;AACtC,CAAC,CAAC;AAHW,QAAA,eAAe,mBAG1B","sourcesContent":["import fs from 'fs';\nimport path from 'path';\n\nconst MAX_SIZE = 5_000;\n\nexport function memoize<const Fn extends (input: string, ...args: any[]) => Promise<any>>(fn: Fn) {\n  const cache = new Map<string, ReturnType<Fn>>();\n  return async (input: string, ...args: any[]) => {\n    if (!cache.has(input)) {\n      const result = await fn(input, ...args);\n      if (cache.size > MAX_SIZE) {\n        cache.clear();\n      }\n      cache.set(input, result);\n      return result;\n    } else {\n      return cache.get(input);\n    }\n  };\n}\n\n/** List filtered top-level files in `targetPath` (returns absolute paths) */\nexport async function listFilesSorted(\n  targetPath: string,\n  filter: (basename: string) => boolean\n): Promise<string[]> {\n  try {\n    // `readdir` isn't guaranteed to be sorted on Windows\n    return (await fs.promises.readdir(targetPath, { withFileTypes: true }))\n      .filter((entry) => entry.isFile() && filter(entry.name))\n      .sort((a, b) => a.name.localeCompare(b.name))\n      .map((entry) => path.join(targetPath, entry.name));\n  } catch {\n    return [];\n  }\n}\n\n/** List nested files in top-level directories in `targetPath` (returns relative paths) */\nexport async function listFilesInDirectories(\n  targetPath: string,\n  filter: (basename: string) => boolean\n): Promise<string[]> {\n  return (\n    await Promise.all(\n      (await fs.promises.readdir(targetPath, { withFileTypes: true }))\n        .filter((entry) => entry.isDirectory() && entry.name !== 'node_modules')\n        .sort((a, b) => a.name.localeCompare(b.name))\n        .map(async (directory) => {\n          const entries = await fs.promises.readdir(path.join(targetPath, directory.name), {\n            withFileTypes: true,\n          });\n          return entries\n            .filter((entry) => entry.isFile() && filter(entry.name))\n            .sort((a, b) => a.name.localeCompare(b.name))\n            .map((entry) => path.join(directory.name, entry.name));\n        })\n    )\n  ).flat(1);\n}\n\n/** Iterate folders recursively for files, optionally sorting results and filtering directories */\nexport async function* scanFilesRecursively(\n  parentPath: string,\n  includeDirectory?: (parentPath: string, name: string) => boolean,\n  sort = !fs.opendir\n) {\n  const queue = [parentPath];\n  let targetPath: string | undefined;\n  while (queue.length > 0 && (targetPath = queue.shift()) != null) {\n    try {\n      const entries = sort\n        ? (await fs.promises.readdir(targetPath, { withFileTypes: true })).sort((a, b) =>\n            a.name.localeCompare(b.name)\n          )\n        : await fs.promises.opendir(targetPath);\n      for await (const entry of entries) {\n        if (entry.isDirectory() && entry.name !== 'node_modules') {\n          if (!includeDirectory || includeDirectory(targetPath, entry.name)) {\n            queue.push(path.join(targetPath, entry.name));\n          }\n        } else if (entry.isFile()) {\n          yield {\n            path: path.join(targetPath, entry.name),\n            parentPath: targetPath,\n            name: entry.name,\n          } as const;\n        }\n      }\n    } catch {\n      continue;\n    }\n  }\n}\n\nexport const fileExistsAsync = async (file: string): Promise<string | null> => {\n  const stat = await fs.promises.stat(file).catch(() => null);\n  return stat?.isFile() ? file : null;\n};\n"]}
+{"version":3,"file":"utils.js","sourceRoot":"","sources":["../src/utils.ts"],"names":[],"mappings":";;;;;;AAKA,0BAcC;AAGD,0CAaC;AAGD,wDAoBC;AAGD,oDA+BC;AAeD,oCAGC;AA9GD,4CAAoB;AACpB,gDAAwB;AAExB,MAAM,QAAQ,GAAG,KAAK,CAAC;AAEvB,SAAgB,OAAO,CAAmE,EAAM;IAC9F,MAAM,KAAK,GAAG,IAAI,GAAG,EAA0B,CAAC;IAChD,OAAO,KAAK,EAAE,KAAa,EAAE,GAAG,IAAW,EAAE,EAAE;QAC7C,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,KAAK,CAAC,EAAE,CAAC;YACtB,MAAM,MAAM,GAAG,MAAM,EAAE,CAAC,KAAK,EAAE,GAAG,IAAI,CAAC,CAAC;YACxC,IAAI,KAAK,CAAC,IAAI,GAAG,QAAQ,EAAE,CAAC;gBAC1B,KAAK,CAAC,KAAK,EAAE,CAAC;YAChB,CAAC;YACD,KAAK,CAAC,GAAG,CAAC,KAAK,EAAE,MAAM,CAAC,CAAC;YACzB,OAAO,MAAM,CAAC;QAChB,CAAC;aAAM,CAAC;YACN,OAAO,KAAK,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC;QAC1B,CAAC;IACH,CAAC,CAAC;AACJ,CAAC;AAED,6EAA6E;AACtE,KAAK,UAAU,eAAe,CACnC,UAAkB,EAClB,MAAqC;IAErC,IAAI,CAAC;QACH,qDAAqD;QACrD,OAAO,CAAC,MAAM,YAAE,CAAC,QAAQ,CAAC,OAAO,CAAC,UAAU,EAAE,EAAE,aAAa,EAAE,IAAI,EAAE,CAAC,CAAC;aACpE,MAAM,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,MAAM,EAAE,IAAI,MAAM,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;aACvD,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,aAAa,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC;aAC5C,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,cAAI,CAAC,IAAI,CAAC,UAAU,EAAE,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC;IACvD,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,EAAE,CAAC;IACZ,CAAC;AACH,CAAC;AAED,0FAA0F;AACnF,KAAK,UAAU,sBAAsB,CAC1C,UAAkB,EAClB,MAAqC;IAErC,OAAO,CACL,MAAM,OAAO,CAAC,GAAG,CACf,CAAC,MAAM,YAAE,CAAC,QAAQ,CAAC,OAAO,CAAC,UAAU,EAAE,EAAE,aAAa,EAAE,IAAI,EAAE,CAAC,CAAC;SAC7D,MAAM,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,WAAW,EAAE,IAAI,KAAK,CAAC,IAAI,KAAK,cAAc,CAAC;SACvE,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,aAAa,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC;SAC5C,GAAG,CAAC,KAAK,EAAE,SAAS,EAAE,EAAE;QACvB,MAAM,OAAO,GAAG,MAAM,YAAE,CAAC,QAAQ,CAAC,OAAO,CAAC,cAAI,CAAC,IAAI,CAAC,UAAU,EAAE,SAAS,CAAC,IAAI,CAAC,EAAE;YAC/E,aAAa,EAAE,IAAI;SACpB,CAAC,CAAC;QACH,OAAO,OAAO;aACX,MAAM,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,MAAM,EAAE,IAAI,MAAM,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;aACvD,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,aAAa,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC;aAC5C,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,cAAI,CAAC,IAAI,CAAC,SAAS,CAAC,IAAI,EAAE,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC;IAC3D,CAAC,CAAC,CACL,CACF,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;AACZ,CAAC;AAED,kGAAkG;AAC3F,KAAK,SAAS,CAAC,CAAC,oBAAoB,CACzC,UAAkB,EAClB,gBAAgE,EAChE,IAAI,GAAG,CAAC,YAAE,CAAC,OAAO;IAElB,MAAM,KAAK,GAAG,CAAC,UAAU,CAAC,CAAC;IAC3B,IAAI,UAA8B,CAAC;IACnC,OAAO,KAAK,CAAC,MAAM,GAAG,CAAC,IAAI,CAAC,UAAU,GAAG,KAAK,CAAC,KAAK,EAAE,CAAC,IAAI,IAAI,EAAE,CAAC;QAChE,IAAI,CAAC;YACH,MAAM,OAAO,GAAG,IAAI;gBAClB,CAAC,CAAC,CAAC,MAAM,YAAE,CAAC,QAAQ,CAAC,OAAO,CAAC,UAAU,EAAE,EAAE,aAAa,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAC7E,CAAC,CAAC,IAAI,CAAC,aAAa,CAAC,CAAC,CAAC,IAAI,CAAC,CAC7B;gBACH,CAAC,CAAC,MAAM,YAAE,CAAC,QAAQ,CAAC,OAAO,CAAC,UAAU,CAAC,CAAC;YAC1C,IAAI,KAAK,EAAE,MAAM,KAAK,IAAI,OAAO,EAAE,CAAC;gBAClC,IAAI,KAAK,CAAC,WAAW,EAAE,IAAI,KAAK,CAAC,IAAI,KAAK,cAAc,EAAE,CAAC;oBACzD,IAAI,CAAC,gBAAgB,IAAI,gBAAgB,CAAC,UAAU,EAAE,KAAK,CAAC,IAAI,CAAC,EAAE,CAAC;wBAClE,KAAK,CAAC,IAAI,CAAC,cAAI,CAAC,IAAI,CAAC,UAAU,EAAE,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC;oBAChD,CAAC;gBACH,CAAC;qBAAM,IAAI,KAAK,CAAC,MAAM,EAAE,EAAE,CAAC;oBAC1B,MAAM;wBACJ,IAAI,EAAE,cAAI,CAAC,IAAI,CAAC,UAAU,EAAE,KAAK,CAAC,IAAI,CAAC;wBACvC,UAAU,EAAE,UAAU;wBACtB,IAAI,EAAE,KAAK,CAAC,IAAI;qBACR,CAAC;gBACb,CAAC;YACH,CAAC;QACH,CAAC;QAAC,MAAM,CAAC;YACP,SAAS;QACX,CAAC;IACH,CAAC;AACH,CAAC;AAEM,MAAM,eAAe,GAAG,KAAK,EAAE,IAAY,EAA0B,EAAE;IAC5E,MAAM,IAAI,GAAG,MAAM,YAAE,CAAC,QAAQ,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,IAAI,CAAC,CAAC;IAC5D,OAAO,IAAI,EAAE,MAAM,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC;AACtC,CAAC,CAAC;AAHW,QAAA,eAAe,mBAG1B;AAEK,MAAM,aAAa,GAAG,KAAK,EAAE,MAAc,EAA0B,EAAE;IAC5E,IAAI,CAAC;QACH,OAAO,MAAM,YAAE,CAAC,QAAQ,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC;IAC5C,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAC;IACd,CAAC;AACH,CAAC,CAAC;AANW,QAAA,aAAa,iBAMxB;AAEF,SAAgB,YAAY,CAAC,KAAa,EAAE,MAAc;IACxD,MAAM,QAAQ,GAAG,cAAI,CAAC,QAAQ,CAAC,MAAM,EAAE,KAAK,CAAC,CAAC;IAC9C,OAAO,CAAC,CAAC,QAAQ,IAAI,CAAC,QAAQ,CAAC,UAAU,CAAC,IAAI,CAAC,IAAI,CAAC,cAAI,CAAC,UAAU,CAAC,QAAQ,CAAC,CAAC;AAChF,CAAC","sourcesContent":["import fs from 'fs';\nimport path from 'path';\n\nconst MAX_SIZE = 5_000;\n\nexport function memoize<const Fn extends (input: string, ...args: any[]) => Promise<any>>(fn: Fn) {\n  const cache = new Map<string, ReturnType<Fn>>();\n  return async (input: string, ...args: any[]) => {\n    if (!cache.has(input)) {\n      const result = await fn(input, ...args);\n      if (cache.size > MAX_SIZE) {\n        cache.clear();\n      }\n      cache.set(input, result);\n      return result;\n    } else {\n      return cache.get(input);\n    }\n  };\n}\n\n/** List filtered top-level files in `targetPath` (returns absolute paths) */\nexport async function listFilesSorted(\n  targetPath: string,\n  filter: (basename: string) => boolean\n): Promise<string[]> {\n  try {\n    // `readdir` isn't guaranteed to be sorted on Windows\n    return (await fs.promises.readdir(targetPath, { withFileTypes: true }))\n      .filter((entry) => entry.isFile() && filter(entry.name))\n      .sort((a, b) => a.name.localeCompare(b.name))\n      .map((entry) => path.join(targetPath, entry.name));\n  } catch {\n    return [];\n  }\n}\n\n/** List nested files in top-level directories in `targetPath` (returns relative paths) */\nexport async function listFilesInDirectories(\n  targetPath: string,\n  filter: (basename: string) => boolean\n): Promise<string[]> {\n  return (\n    await Promise.all(\n      (await fs.promises.readdir(targetPath, { withFileTypes: true }))\n        .filter((entry) => entry.isDirectory() && entry.name !== 'node_modules')\n        .sort((a, b) => a.name.localeCompare(b.name))\n        .map(async (directory) => {\n          const entries = await fs.promises.readdir(path.join(targetPath, directory.name), {\n            withFileTypes: true,\n          });\n          return entries\n            .filter((entry) => entry.isFile() && filter(entry.name))\n            .sort((a, b) => a.name.localeCompare(b.name))\n            .map((entry) => path.join(directory.name, entry.name));\n        })\n    )\n  ).flat(1);\n}\n\n/** Iterate folders recursively for files, optionally sorting results and filtering directories */\nexport async function* scanFilesRecursively(\n  parentPath: string,\n  includeDirectory?: (parentPath: string, name: string) => boolean,\n  sort = !fs.opendir\n) {\n  const queue = [parentPath];\n  let targetPath: string | undefined;\n  while (queue.length > 0 && (targetPath = queue.shift()) != null) {\n    try {\n      const entries = sort\n        ? (await fs.promises.readdir(targetPath, { withFileTypes: true })).sort((a, b) =>\n            a.name.localeCompare(b.name)\n          )\n        : await fs.promises.opendir(targetPath);\n      for await (const entry of entries) {\n        if (entry.isDirectory() && entry.name !== 'node_modules') {\n          if (!includeDirectory || includeDirectory(targetPath, entry.name)) {\n            queue.push(path.join(targetPath, entry.name));\n          }\n        } else if (entry.isFile()) {\n          yield {\n            path: path.join(targetPath, entry.name),\n            parentPath: targetPath,\n            name: entry.name,\n          } as const;\n        }\n      }\n    } catch {\n      continue;\n    }\n  }\n}\n\nexport const fileExistsAsync = async (file: string): Promise<string | null> => {\n  const stat = await fs.promises.stat(file).catch(() => null);\n  return stat?.isFile() ? file : null;\n};\n\nexport const maybeRealpath = async (target: string): Promise<string | null> => {\n  try {\n    return await fs.promises.realpath(target);\n  } catch {\n    return null;\n  }\n};\n\nexport function isPathInside(child: string, parent: string): boolean {\n  const relative = path.relative(parent, child);\n  return !!relative && !relative.startsWith('..') && !path.isAbsolute(relative);\n}\n"]}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "expo-modules-autolinking",
-  "version": "3.0.25",
+  "version": "3.0.26",
   "description": "Scripts that autolink Expo modules.",
   "main": "build/index.js",
   "types": "build/index.d.ts",
@@ -44,5 +44,5 @@
     "require-from-string": "^2.0.2",
     "resolve-from": "^5.0.0"
   },
-  "gitHead": "dd4e87727c4ef32ac5d8a7b5a42fd80da254140f"
+  "gitHead": "45c60e10956764bbac6c62454890eeb25c74bbd6"
 }

package/src/platforms/devtools.ts

@@ -1,6 +1,7 @@
 import path from 'path';
 
 import type { ExtraDependencies, ModuleDescriptorDevTools, PackageRevision } from '../types';
+import { isPathInside, maybeRealpath } from '../utils';
 
 export async function resolveModuleAsync(
   packageName: string,
@@ -14,10 +15,23 @@ export async function resolveModuleAsync(
   return {
     packageName,
     packageRoot: revision.path,
-    webpageRoot: path.join(revision.path, devtoolsConfig.webpageRoot),
+    webpageRoot: await resolveWebpageRoot(revision.path, devtoolsConfig.webpageRoot),
   };
 }
 
+async function resolveWebpageRoot(
+  packageRoot: string,
+  configuredWebpageRoot: string | undefined
+): Promise<string | undefined> {
+  if (!configuredWebpageRoot) {
+    return undefined;
+  }
+  const resolvedWebpageRoot = path.resolve(packageRoot, configuredWebpageRoot);
+  // NOTE(@kitten): Failing realpath-ing, typically due to ENOENT, results in the original value
+  const webpageRoot = (await maybeRealpath(resolvedWebpageRoot)) ?? resolvedWebpageRoot;
+  return isPathInside(webpageRoot, packageRoot) ? webpageRoot : undefined;
+}
+
 export async function resolveExtraBuildDependenciesAsync(
   _projectNativeRoot: string
 ): Promise<ExtraDependencies | null> {

package/src/types.ts

@@ -72,7 +72,7 @@ export interface ModuleDescriptorIos extends CommonNativeModuleDescriptor {
 export interface ModuleDescriptorDevTools {
   packageName: string;
   packageRoot: string;
-  webpageRoot: string;
+  webpageRoot: string | undefined;
 }
 
 export interface ModuleDescriptorWeb {

package/src/utils.ts

@@ -96,3 +96,16 @@ export const fileExistsAsync = async (file: string): Promise<string | null> => {
   const stat = await fs.promises.stat(file).catch(() => null);
   return stat?.isFile() ? file : null;
 };
+
+export const maybeRealpath = async (target: string): Promise<string | null> => {
+  try {
+    return await fs.promises.realpath(target);
+  } catch {
+    return null;
+  }
+};
+
+export function isPathInside(child: string, parent: string): boolean {
+  const relative = path.relative(parent, child);
+  return !!relative && !relative.startsWith('..') && !path.isAbsolute(relative);
+}