Generic CDN
CDN_BASE_URLOne base URL, and every asset URL in the manifest points at it. This is the Cloudflare in front of R2 route, the Azure Front Door route, and whatever else you already run.
Cloudflare
Front DoorManage your OTA Updates.
xprem implements the official Expo Updates protocol, so your app keeps the standard expo-updates runtime and the manifest it already speaks.
Publish
npx eoas publish --branch productionBuilds the update, uploads it to your bucket, and adds it to a branch. Nothing is delivered until a channel points at that branch.
Rollback
npx eoas rollback --branch productionSends devices back to the update they ran before, or all the way back to the build embedded in the store binary.
Republish
npx eoas republish --branch productionPromotes an older update to the head of the branch, so recovery is a publish and not a rebuild.
Support of Branches & Release Channels.
Each build of your app ships with one channel baked in, like production, staging or uat. Every OTA update you publish is tagged with a branch. You then attach branches to channels, and that mapping decides which updates a given build receives.
Channelproduction
Default branchproductionCurrent update
Many apps on one server.
A single deployment hosts as many Expo projects as you need. Clients identify themselves with the expo-app-id header, and each app keeps its own signing keys, API keys, branches, channels and update history, isolated in your database.
- Identity
- App ID · signing certificate · encrypted private key
- Access
- Named API keys, per app, with usage history
- Routing
- Its own branches, channels and update history
Split one channel across two branches.
A channel rollout sends a share of the channel to a second branch and the rest to the default one. Both groups keep receiving updates on their own line, so you can run two real release lines against each other and promote the winner.
Channelproduction
Default branchproduction90% of devicesCurrent update
Rollout branchalpha-release10% of devices
Progressive Update rollout.
Publish an update to a slice of the branch, follow its health from the dashboard or over MCP, and increase the percentage or revert at any time. The server hashes the device EAS-Client-ID with a salt unique to that rollout, so assignment is deterministic and needs no per-device state.
Rollout in progress
Update 17844529170002 · publishing to this branch and runtime version is paused until the rollout ends.
26IncreaseFinish rolloutRevert
25%
Every update lands in your own bucket.
xprem never holds your bundles. It writes them to the object storage you already pay for, under a key prefix you choose, and hands devices a URL into it. Switching provider is an environment variable.
- Amazon S3STORAGE_MODE=s3
- Cloudflare R2STORAGE_MODE=s3
Google Cloud StorageSTORAGE_MODE=gcs- Azure Blob StorageSTORAGE_MODE=azure
- Supabase StorageSTORAGE_MODE=s3
- MinIOSTORAGE_MODE=s3
- DigitalOcean SpacesSTORAGE_MODE=s3
- Local volumeSTORAGE_MODE=local
And any other S3-compatible provider. Key prefix optional on S3, GCS and Azure.
Assets download from your own infrastructure.
When a device checks for an update, xprem answers with a manifest: the list of every asset the device has to download, each with a URL. xprem decides what those URLs are. Point them at your CDN, or sign them into a private bucket.
xprem serverresolves the update
1 · asks for the manifest2 · manifest with CDN URLs
deviceexpo-updates
3 · downloads the assets
your CDNcaches the assets
4 · origin fetch
your bucketS3 · GCS · Azure
{ "id": "b0b76751-afe8-58dc-ed2c-d02d9cd1bec5", "runtimeVersion": "3.0.0", "launchAsset": { "contentType": "application/javascript", "url": "https://cdn.acme.internal/assets/3b1f9c…" }, "assets": [ { "contentType": "image/png", "url": "https://cdn.acme.internal/assets/a7c204…" }, { "contentType": "font/ttf", "url": "https://storage.googleapis.com/…?X-Goog-Signature=…" } ] }
These URLs are yours. A CDN domain, or a signed URL into a private bucket.
Fast
Point the URLs at a CDN and the download traffic never touches the update server, which only has to answer a small JSON check.
Private
Signed URLs mean a private GCS or Azure bucket serves updates without ever being exposed.
Yours
Every URL in the manifest resolves inside your infrastructure, under your contract, in the regions you picked.
CloudflareFront DoorCloudFront
domain · key pair ID · private keyYour distribution with your bucket as the origin. xprem writes CloudFront URLs into the manifest, and it takes precedence over the other CDN options.
CloudFrontSigned GCS and Azure
15-minute validityThe bucket stays private. xprem signs each asset URL at manifest time, valid for fifteen minutes, so nothing has to be made public to be reachable.
GCSAzure BlobPick the mode that fits.
xprem runs in two shapes, and you choose one at deploy time. If you do not want multi-app or metrics, and the only thing you want is to ship updates from your own bucket, stateless mode needs no database: a bucket, your Expo token, your app, and you are running.
Stateless
no databaseA bucket, an Expo token, one app. Expo stays the source of truth for release metadata, and you run nothing else.
- devicecalls /manifest, then downloads /assets
- xprem serverone app, no database to run
- Expo EAS APIauthenticates publishes and holds the release metadata
- your bucketholds every update you publish
- your CDNserves the assets to the device
Control plane
PostgresYour database is the source of truth. Many apps on one server, progressive rollouts, and no Expo account anywhere in the path.
- devicecalls /manifest, then downloads /assets
- xprem servermany apps, isolated by expo-app-id
- PostgreSQLrelease state, keys, branches and channels. No Expo account
- ClickHouseoptionalevents, metrics and logs, only if you want Observe
- your bucketholds every update you publish
- your CDNserves the assets to the device
What stateless gives up
One app per server
Stateless mode serves a single application. Running several means running several servers.
Expo stays in the loop
Branches, channels and their mappings are read from Expo, and publishing authenticates with Expo tokens.
No progressive rollouts
Percentage rollouts and channel splits need the release state that only control plane mode keeps.
Run it on infrastructure you own.
xprem is one Go process: your Postgres, your bucket, your network. Deploy it on Railway, Docker, Kubernetes or a bare binary, and ship your first update today.