@sitepong/fastnode 0.1.0

package/dist/match/index.cjs

@@ -0,0 +1,942 @@
+'use strict';
+
+var child_process = require('child_process');
+var fs = require('fs');
+var path = require('path');
+var os = require('os');
+var x509 = require('@peculiar/x509');
+var crypto = require('crypto');
+var util = require('util');
+var promises = require('fs/promises');
+
+function _interopNamespace(e) {
+  if (e && e.__esModule) return e;
+  var n = Object.create(null);
+  if (e) {
+    Object.keys(e).forEach(function (k) {
+      if (k !== 'default') {
+        var d = Object.getOwnPropertyDescriptor(e, k);
+        Object.defineProperty(n, k, d.get ? d : {
+          enumerable: true,
+          get: function () { return e[k]; }
+        });
+      }
+    });
+  }
+  n.default = e;
+  return Object.freeze(n);
+}
+
+var x509__namespace = /*#__PURE__*/_interopNamespace(x509);
+
+var __defProp = Object.defineProperty;
+var __getOwnPropNames = Object.getOwnPropertyNames;
+var __esm = (fn, res) => function __init() {
+  return fn && (res = (0, fn[__getOwnPropNames(fn)[0]])(fn = 0)), res;
+};
+var __export = (target, all) => {
+  for (var name in all)
+    __defProp(target, name, { get: all[name], enumerable: true });
+};
+
+// src/match/storage/git.ts
+var git_exports = {};
+__export(git_exports, {
+  GitStorage: () => GitStorage
+});
+var GitStorage;
+var init_git = __esm({
+  "src/match/storage/git.ts"() {
+    GitStorage = class {
+      workingDirectory;
+      gitUrl;
+      branch;
+      privateKeyPath;
+      privateKeyContent;
+      basicAuth;
+      bearerToken;
+      userName;
+      userEmail;
+      shallowClone;
+      /** Temp path written from `gitPrivateKeyContent`. Cleaned up on `cleanup`. */
+      tempKeyPath;
+      constructor(params) {
+        this.gitUrl = params.gitUrl ?? "";
+        this.branch = params.gitBranch ?? "master";
+        this.privateKeyPath = params.gitPrivateKey;
+        this.privateKeyContent = params.gitPrivateKeyContent;
+        this.basicAuth = params.gitBasicAuth;
+        this.bearerToken = params.gitBearerToken;
+        this.userName = params.gitUserName;
+        this.userEmail = params.gitUserEmail;
+        this.shallowClone = params.shallowClone ?? true;
+        this.workingDirectory = "";
+      }
+      async download() {
+        this.workingDirectory = fs.mkdtempSync(path.join(os.tmpdir(), "fastnode-match-"));
+        if (this.privateKeyContent && !this.privateKeyPath) {
+          this.tempKeyPath = path.join(
+            fs.mkdtempSync(path.join(os.tmpdir(), "fastnode-match-key-")),
+            "id_rsa"
+          );
+          fs.writeFileSync(this.tempKeyPath, this.privateKeyContent);
+          fs.chmodSync(this.tempKeyPath, 384);
+        }
+        const env = this.buildEnv();
+        const extraArgs = this.buildHttpAuthArgs();
+        ["-c", "http.extraheader=", ...extraArgs];
+        const configArgs = extraArgs.flatMap((entry) => ["-c", entry]);
+        const baseArgs = this.shallowClone ? ["--depth", "1"] : [];
+        const branchArgs = ["-b", this.branch, "--single-branch"];
+        try {
+          child_process.execFileSync(
+            "git",
+            [
+              ...configArgs,
+              "clone",
+              ...baseArgs,
+              ...branchArgs,
+              this.gitUrl,
+              this.workingDirectory
+            ],
+            { env, stdio: "pipe" }
+          );
+        } catch {
+          child_process.execFileSync(
+            "git",
+            [
+              ...configArgs,
+              "clone",
+              ...baseArgs,
+              this.gitUrl,
+              this.workingDirectory
+            ],
+            { env, stdio: "pipe" }
+          );
+          try {
+            child_process.execFileSync("git", ["checkout", this.branch], {
+              cwd: this.workingDirectory,
+              env,
+              stdio: "pipe"
+            });
+          } catch {
+            child_process.execFileSync("git", ["checkout", "--orphan", this.branch], {
+              cwd: this.workingDirectory,
+              env,
+              stdio: "pipe"
+            });
+          }
+        }
+        if (this.userName) {
+          child_process.execFileSync("git", ["config", "user.name", this.userName], {
+            cwd: this.workingDirectory,
+            env,
+            stdio: "pipe"
+          });
+        }
+        if (this.userEmail) {
+          child_process.execFileSync("git", ["config", "user.email", this.userEmail], {
+            cwd: this.workingDirectory,
+            env,
+            stdio: "pipe"
+          });
+        }
+        return this.workingDirectory;
+      }
+      async saveChanges(files, message) {
+        const env = this.buildEnv();
+        const extraArgs = this.buildHttpAuthArgs();
+        const configArgs = extraArgs.flatMap((entry) => ["-c", entry]);
+        const opts = {
+          cwd: this.workingDirectory,
+          env,
+          stdio: "pipe"
+        };
+        for (const file of files) {
+          child_process.execFileSync("git", ["add", file], opts);
+        }
+        try {
+          child_process.execFileSync("git", ["commit", "-m", message], opts);
+          child_process.execFileSync(
+            "git",
+            [...configArgs, "push", "origin", this.branch],
+            opts
+          );
+        } catch {
+        }
+      }
+      async cleanup() {
+        if (this.workingDirectory) {
+          fs.rmSync(this.workingDirectory, { recursive: true, force: true });
+        }
+        if (this.tempKeyPath) {
+          fs.rmSync(this.tempKeyPath, { force: true });
+          fs.rmSync(path.join(this.tempKeyPath, ".."), { recursive: true, force: true });
+        }
+      }
+      buildHttpAuthArgs() {
+        const args = [];
+        if (this.basicAuth) {
+          const encoded = Buffer.from(
+            `${this.basicAuth.user}:${this.basicAuth.pass}`
+          ).toString("base64");
+          args.push(`http.extraheader=Authorization: Basic ${encoded}`);
+        } else if (this.bearerToken) {
+          args.push(`http.extraheader=Authorization: Bearer ${this.bearerToken}`);
+        }
+        return args;
+      }
+      buildEnv() {
+        const env = {
+          ...process.env,
+          GIT_TERMINAL_PROMPT: "0"
+        };
+        const keyPath = this.privateKeyPath ?? this.tempKeyPath;
+        if (keyPath) {
+          env.GIT_SSH_COMMAND = `ssh -i ${keyPath} -o StrictHostKeyChecking=no -o IdentitiesOnly=yes`;
+        }
+        return env;
+      }
+    };
+  }
+});
+
+// src/match/storage/s3.ts
+var s3_exports = {};
+__export(s3_exports, {
+  S3Storage: () => S3Storage
+});
+var S3Storage;
+var init_s3 = __esm({
+  "src/match/storage/s3.ts"() {
+    S3Storage = class {
+      workingDirectory;
+      bucket;
+      region;
+      prefix;
+      constructor(params) {
+        this.bucket = params.s3Bucket ?? "";
+        this.region = params.s3Region ?? "us-east-1";
+        this.prefix = params.s3ObjectPrefix ?? "";
+        this.workingDirectory = "";
+      }
+      async download() {
+        this.workingDirectory = fs.mkdtempSync(path.join(os.tmpdir(), "fastnode-match-s3-"));
+        const s3Path = this.prefix ? `s3://${this.bucket}/${this.prefix}` : `s3://${this.bucket}`;
+        child_process.execFileSync("aws", ["s3", "sync", s3Path, this.workingDirectory, "--region", this.region], { stdio: "pipe" });
+        return this.workingDirectory;
+      }
+      async saveChanges(files, _message) {
+        const s3Path = this.prefix ? `s3://${this.bucket}/${this.prefix}` : `s3://${this.bucket}`;
+        for (const file of files) {
+          const relativePath = file.replace(this.workingDirectory + "/", "");
+          child_process.execFileSync(
+            "aws",
+            ["s3", "cp", file, `${s3Path}/${relativePath}`, "--region", this.region],
+            { stdio: "pipe" }
+          );
+        }
+      }
+      async cleanup() {
+        if (this.workingDirectory) {
+          fs.rmSync(this.workingDirectory, { recursive: true, force: true });
+        }
+      }
+    };
+  }
+});
+
+// src/match/storage/local.ts
+var local_exports = {};
+__export(local_exports, {
+  LocalStorage: () => LocalStorage
+});
+var LocalStorage;
+var init_local = __esm({
+  "src/match/storage/local.ts"() {
+    LocalStorage = class {
+      workingDirectory;
+      constructor(params) {
+        this.workingDirectory = params.localPath ?? "";
+      }
+      async download() {
+        fs.mkdirSync(this.workingDirectory, { recursive: true });
+        return this.workingDirectory;
+      }
+      async saveChanges(_files, _message) {
+      }
+      async cleanup() {
+      }
+    };
+  }
+});
+function toPem(header, der) {
+  const b64 = der.toString("base64");
+  const lines = [];
+  for (let i = 0; i < b64.length; i += 64) lines.push(b64.slice(i, i + 64));
+  return `-----BEGIN ${header}-----
+${lines.join("\n")}
+-----END ${header}-----`;
+}
+async function generateCSR() {
+  const algorithm = { name: "ECDSA", namedCurve: "P-256" };
+  const keyPair = await crypto.webcrypto.subtle.generateKey(algorithm, true, ["sign", "verify"]);
+  const csr = await x509__namespace.Pkcs10CertificateRequestGenerator.create({
+    name: "CN=PEM",
+    keys: keyPair,
+    signingAlgorithm: { name: "ECDSA", hash: "SHA-256" }
+  });
+  const pkcs8 = await crypto.webcrypto.subtle.exportKey("pkcs8", keyPair.privateKey);
+  return {
+    csr: csr.toString("pem"),
+    privateKey: toPem("PRIVATE KEY", Buffer.from(pkcs8))
+  };
+}
+var init_csr = __esm({
+  "src/cert/csr.ts"() {
+    x509__namespace.cryptoProvider.set(crypto.webcrypto);
+  }
+});
+
+// src/cert/cert.ts
+var cert_exports = {};
+__export(cert_exports, {
+  createCertificate: () => createCertificate,
+  downloadCertificate: () => downloadCertificate,
+  findValidCertificates: () => findValidCertificates,
+  revokeCertificate: () => revokeCertificate,
+  revokeExpiredCertificates: () => revokeExpiredCertificates
+});
+function resolveCertificateTypes(options) {
+  if (options.type) return [options.type];
+  const platform = options.platform ?? "ios";
+  if (options.development) {
+    return platform === "macos" ? ["MAC_APP_DEVELOPMENT"] : ["IOS_DEVELOPMENT"];
+  }
+  return platform === "macos" ? ["MAC_APP_DISTRIBUTION"] : ["IOS_DISTRIBUTION"];
+}
+async function findValidCertificates(options) {
+  const types = resolveCertificateTypes(options);
+  const certs = await options.client.certificates.list({
+    filter: { certificateType: types },
+    limit: 200
+  });
+  const now = /* @__PURE__ */ new Date();
+  return certs.filter(
+    (c) => new Date(c.attributes.expirationDate) > now
+  );
+}
+async function createCertificate(options) {
+  if (!options.force) {
+    const existing = await findValidCertificates(options);
+    if (existing.length > 0) {
+      const cert2 = existing[0];
+      const content2 = Buffer.from(cert2.attributes.certificateContent, "base64");
+      const result2 = {
+        certificate: cert2,
+        privateKey: "",
+        certificateContent: content2
+      };
+      if (options.outputDir) {
+        await promises.mkdir(options.outputDir, { recursive: true });
+        const certPath = path.join(options.outputDir, `${cert2.id}.cer`);
+        await promises.writeFile(certPath, content2);
+        result2.certPath = certPath;
+      }
+      return result2;
+    }
+  }
+  const types = resolveCertificateTypes(options);
+  const { csr, privateKey } = await generateCSR();
+  const cert = await options.client.certificates.create({
+    certificateType: types[0],
+    csrContent: csr
+  });
+  const content = Buffer.from(cert.attributes.certificateContent, "base64");
+  const result = {
+    certificate: cert,
+    privateKey,
+    certificateContent: content
+  };
+  if (options.outputDir) {
+    await promises.mkdir(options.outputDir, { recursive: true });
+    const certPath = path.join(options.outputDir, `${cert.id}.cer`);
+    await promises.writeFile(certPath, content);
+    result.certPath = certPath;
+    const keyPath = path.join(options.outputDir, `${cert.id}.p12`);
+    await promises.writeFile(keyPath, privateKey);
+    result.p12Path = keyPath;
+  }
+  if (options.keychainPath && process.platform === "darwin") {
+    await importToKeychain(
+      content,
+      options.keychainPath,
+      options.keychainPassword
+    );
+  }
+  return result;
+}
+async function revokeCertificate(client, id) {
+  await client.certificates.revoke(id);
+}
+async function downloadCertificate(client, id) {
+  const cert = await client.certificates.get(id);
+  return Buffer.from(cert.attributes.certificateContent, "base64");
+}
+async function revokeExpiredCertificates(options) {
+  const types = resolveCertificateTypes(options);
+  const certs = await options.client.certificates.list({
+    filter: { certificateType: types }
+  });
+  const now = /* @__PURE__ */ new Date();
+  let count = 0;
+  for (const cert of certs) {
+    if (new Date(cert.attributes.expirationDate) <= now) {
+      try {
+        await options.client.certificates.revoke(cert.id);
+        count++;
+      } catch {
+      }
+    }
+  }
+  return count;
+}
+async function importToKeychain(certData, keychainPath, keychainPassword) {
+  const { tmpdir: tmpdir4 } = await import('os');
+  const tempCertPath = path.join(tmpdir4(), `fastnode-cert-${Date.now()}.cer`);
+  await promises.writeFile(tempCertPath, certData);
+  try {
+    const args = [
+      "import",
+      tempCertPath,
+      "-k",
+      keychainPath,
+      "-T",
+      "/usr/bin/codesign",
+      "-T",
+      "/usr/bin/security"
+    ];
+    await execFileAsync("security", args);
+    if (keychainPassword) {
+      await execFileAsync("security", [
+        "set-key-partition-list",
+        "-S",
+        "apple-tool:,apple:,codesign:",
+        "-s",
+        "-k",
+        keychainPassword,
+        keychainPath
+      ]);
+    }
+  } finally {
+    const { unlink } = await import('fs/promises');
+    await unlink(tempCertPath).catch(() => {
+    });
+  }
+}
+var execFileAsync;
+var init_cert = __esm({
+  "src/cert/cert.ts"() {
+    init_csr();
+    execFileAsync = util.promisify(child_process.execFile);
+  }
+});
+
+// src/sigh/index.ts
+var sigh_exports = {};
+__export(sigh_exports, {
+  createProfile: () => createProfile,
+  downloadProfile: () => downloadProfile,
+  findMatchingProfile: () => findMatchingProfile,
+  installProfile: () => installProfile
+});
+function resolveProfileType(options) {
+  if (options.profileType) return options.profileType;
+  const platform = options.platform ?? "ios";
+  const isDev = options.development ?? false;
+  const isAdhoc = options.adhoc ?? false;
+  const isInHouse = options.inHouse ?? false;
+  switch (platform) {
+    case "macos":
+      if (isDev) return "MAC_APP_DEVELOPMENT";
+      if (isInHouse) return "MAC_APP_INHOUSE";
+      return "MAC_APP_STORE";
+    case "tvos":
+      if (isDev) return "TVOS_APP_DEVELOPMENT";
+      if (isAdhoc) return "TVOS_APP_ADHOC";
+      if (isInHouse) return "TVOS_APP_INHOUSE";
+      return "TVOS_APP_STORE";
+    case "catalyst":
+      if (isDev) return "MAC_CATALYST_APP_DEVELOPMENT";
+      if (isInHouse) return "MAC_CATALYST_APP_INHOUSE";
+      return "MAC_CATALYST_APP_STORE";
+    default:
+      if (isDev) return "IOS_APP_DEVELOPMENT";
+      if (isAdhoc) return "IOS_APP_ADHOC";
+      if (isInHouse) return "IOS_APP_INHOUSE";
+      return "IOS_APP_STORE";
+  }
+}
+function certificateTypesForProfile(profileType) {
+  switch (profileType) {
+    case "IOS_APP_DEVELOPMENT":
+    case "TVOS_APP_DEVELOPMENT":
+    case "MAC_CATALYST_APP_DEVELOPMENT":
+      return ["IOS_DEVELOPMENT"];
+    case "MAC_APP_DEVELOPMENT":
+      return ["MAC_APP_DEVELOPMENT"];
+    case "IOS_APP_STORE":
+    case "IOS_APP_ADHOC":
+    case "TVOS_APP_STORE":
+    case "TVOS_APP_ADHOC":
+    case "MAC_CATALYST_APP_STORE":
+      return ["IOS_DISTRIBUTION"];
+    case "IOS_APP_INHOUSE":
+    case "TVOS_APP_INHOUSE":
+    case "MAC_CATALYST_APP_INHOUSE":
+      return ["IOS_DISTRIBUTION"];
+    case "MAC_APP_STORE":
+    case "MAC_APP_INHOUSE":
+      return ["MAC_APP_DISTRIBUTION"];
+    case "MAC_APP_DIRECT":
+      return ["DEVELOPER_ID_APPLICATION"];
+    default:
+      return ["IOS_DISTRIBUTION"];
+  }
+}
+function needsDevices(profileType) {
+  return profileType.includes("DEVELOPMENT") || profileType.includes("ADHOC");
+}
+function profileExtension(profileType) {
+  return profileType.startsWith("MAC_") && !profileType.includes("CATALYST") ? ".provisionprofile" : ".mobileprovision";
+}
+async function findMatchingProfile(options) {
+  const profileType = resolveProfileType(options);
+  const profiles = await options.client.profiles.list({
+    filter: { profileType },
+    include: "bundleId",
+    limit: 200
+  });
+  const now = /* @__PURE__ */ new Date();
+  for (const profile of profiles) {
+    const bundleIdRel = profile.relationships?.bundleId?.data;
+    if (bundleIdRel) {
+      const bundleId = await options.client.bundleIds.get(bundleIdRel.id);
+      if (bundleId.attributes.identifier !== options.bundleIdentifier) continue;
+    }
+    if (profile.attributes.profileState !== "ACTIVE") continue;
+    if (new Date(profile.attributes.expirationDate) <= now) continue;
+    if (options.profileName && profile.attributes.name !== options.profileName) {
+      continue;
+    }
+    return profile;
+  }
+  return null;
+}
+async function createProfile(options) {
+  const profileType = resolveProfileType(options);
+  if (options.force) {
+    const existing = await findMatchingProfile(options);
+    if (existing) {
+      await options.client.profiles.delete(existing.id);
+    }
+  } else {
+    const existing = await findMatchingProfile(options);
+    if (existing) {
+      return downloadAndReturn(options, existing);
+    }
+  }
+  let bundleId = await options.client.bundleIds.find(options.bundleIdentifier);
+  if (!bundleId) {
+    throw new Error(
+      `Bundle ID '${options.bundleIdentifier}' not found. Register it first with produce.registerBundleId().`
+    );
+  }
+  const certTypes = certificateTypesForProfile(profileType);
+  let certificateIds = options.certificateIds;
+  if (!certificateIds || certificateIds.length === 0) {
+    const certs = await options.client.certificates.list({
+      filter: { certificateType: certTypes }
+    });
+    const now = /* @__PURE__ */ new Date();
+    const validCerts = certs.filter(
+      (c) => new Date(c.attributes.expirationDate) > now
+    );
+    if (validCerts.length === 0) {
+      throw new Error(
+        `No valid certificates found of type ${certTypes.join(", ")}. Create one first with cert.createCertificate().`
+      );
+    }
+    certificateIds = options.includeAllCertificates ? validCerts.map((c) => c.id) : [validCerts[0].id];
+  }
+  let deviceIds = options.deviceIds;
+  if (needsDevices(profileType) && (!deviceIds || deviceIds.length === 0)) {
+    const platform = options.platform === "macos" ? "MAC_OS" : options.platform === "tvos" ? "TVOS" : "IOS";
+    const devices = await options.client.devices.list({
+      filter: { platform, status: "ENABLED" }
+    });
+    deviceIds = devices.map((d) => d.id);
+  }
+  const profileName = options.profileName ?? `${profileType} ${options.bundleIdentifier} ${Date.now()}`;
+  const profile = await options.client.profiles.create({
+    name: profileName,
+    profileType,
+    bundleIdId: bundleId.id,
+    certificateIds,
+    deviceIds
+  });
+  return downloadAndReturn(options, profile);
+}
+async function downloadAndReturn(options, profile) {
+  const content = Buffer.from(profile.attributes.profileContent, "base64");
+  const profileType = resolveProfileType(options);
+  const ext = profileExtension(profileType);
+  const result = {
+    profile,
+    profileContent: content,
+    uuid: profile.attributes.uuid,
+    name: profile.attributes.name
+  };
+  if (options.outputDir) {
+    await promises.mkdir(options.outputDir, { recursive: true });
+    const filename = `${profileType}_${options.bundleIdentifier}${ext}`;
+    const filePath = path.join(options.outputDir, filename);
+    await promises.writeFile(filePath, content);
+    result.filePath = filePath;
+  }
+  if (!options.skipInstall && process.platform === "darwin") {
+    await installProfile(content, profile.attributes.uuid);
+  }
+  return result;
+}
+async function downloadProfile(client, id) {
+  const profile = await client.profiles.get(id);
+  return Buffer.from(profile.attributes.profileContent, "base64");
+}
+async function installProfile(profileContent, uuid) {
+  const legacyDir = path.join(
+    os.homedir(),
+    "Library",
+    "MobileDevice",
+    "Provisioning Profiles"
+  );
+  const xcode16Dir = path.join(
+    os.homedir(),
+    "Library",
+    "Developer",
+    "Xcode",
+    "UserData",
+    "Provisioning Profiles"
+  );
+  const filename = `${uuid}.mobileprovision`;
+  await promises.mkdir(legacyDir, { recursive: true });
+  const legacyPath = path.join(legacyDir, filename);
+  await promises.writeFile(legacyPath, profileContent);
+  try {
+    await promises.mkdir(xcode16Dir, { recursive: true });
+    await promises.writeFile(path.join(xcode16Dir, filename), profileContent);
+  } catch {
+  }
+  return legacyPath;
+}
+var init_sigh = __esm({
+  "src/sigh/index.ts"() {
+  }
+});
+
+// src/match/storage/index.ts
+async function createStorage(params) {
+  switch (params.mode) {
+    case "git": {
+      const { GitStorage: GitStorage2 } = await Promise.resolve().then(() => (init_git(), git_exports));
+      return new GitStorage2(params);
+    }
+    case "s3": {
+      const { S3Storage: S3Storage2 } = await Promise.resolve().then(() => (init_s3(), s3_exports));
+      return new S3Storage2(params);
+    }
+    case "local": {
+      const { LocalStorage: LocalStorage2 } = await Promise.resolve().then(() => (init_local(), local_exports));
+      return new LocalStorage2(params);
+    }
+    default:
+      throw new Error(`Unknown storage mode: ${params.mode}`);
+  }
+}
+var V2_PREFIX = "match_encrypted_v2__";
+var V1_PREFIX = "Salted__";
+var PBKDF2_ITERATIONS = 1e4;
+var PBKDF2_HASH = "sha256";
+var PBKDF2_KEY_LEN = 32 + 12 + 24;
+var ENCRYPTABLE_EXTENSIONS = [".cer", ".p12", ".mobileprovision", ".provisionprofile", ".pkey", ".pem"];
+function encryptV2(data, password) {
+  const salt = crypto.randomBytes(8);
+  const derived = crypto.pbkdf2Sync(password, salt, PBKDF2_ITERATIONS, PBKDF2_KEY_LEN, PBKDF2_HASH);
+  const key = derived.subarray(0, 32);
+  const iv = derived.subarray(32, 44);
+  const authData = derived.subarray(44, 68);
+  const cipher = crypto.createCipheriv("aes-256-gcm", key, iv);
+  cipher.setAAD(authData);
+  const encrypted = Buffer.concat([cipher.update(data), cipher.final()]);
+  const authTag = cipher.getAuthTag();
+  const prefix = Buffer.from(V2_PREFIX, "utf-8");
+  const result = Buffer.concat([prefix, salt, authTag, encrypted]);
+  return Buffer.from(result.toString("base64"));
+}
+function decryptV2(data, password) {
+  const raw = Buffer.from(data.toString("utf-8"), "base64");
+  const prefixLen = Buffer.from(V2_PREFIX, "utf-8").length;
+  const salt = raw.subarray(prefixLen, prefixLen + 8);
+  const authTag = raw.subarray(prefixLen + 8, prefixLen + 24);
+  const ciphertext = raw.subarray(prefixLen + 24);
+  const derived = crypto.pbkdf2Sync(password, salt, PBKDF2_ITERATIONS, PBKDF2_KEY_LEN, PBKDF2_HASH);
+  const key = derived.subarray(0, 32);
+  const iv = derived.subarray(32, 44);
+  const authData = derived.subarray(44, 68);
+  const decipher = crypto.createDecipheriv("aes-256-gcm", key, iv);
+  decipher.setAAD(authData);
+  decipher.setAuthTag(authTag);
+  return Buffer.concat([decipher.update(ciphertext), decipher.final()]);
+}
+function evpBytesToKey(password, salt, keyLen, ivLen, hashAlg) {
+  const target = keyLen + ivLen;
+  const result = [];
+  let total = 0;
+  let prev = Buffer.alloc(0);
+  while (total < target) {
+    const input = Buffer.concat([prev, Buffer.from(password, "utf-8"), salt]);
+    prev = crypto.createHash(hashAlg).update(input).digest();
+    result.push(prev);
+    total += prev.length;
+  }
+  const derived = Buffer.concat(result);
+  return {
+    key: derived.subarray(0, keyLen),
+    iv: derived.subarray(keyLen, keyLen + ivLen)
+  };
+}
+function decryptV1(data, password) {
+  const raw = Buffer.from(data.toString("utf-8"), "base64");
+  const saltHeader = raw.subarray(0, 8).toString("utf-8");
+  if (saltHeader !== V1_PREFIX) {
+    throw new Error("Invalid V1 encrypted data: missing Salted__ header");
+  }
+  const salt = raw.subarray(8, 16);
+  const ciphertext = raw.subarray(16);
+  for (const hashAlg of ["md5", "sha256"]) {
+    try {
+      const { key, iv } = evpBytesToKey(password, salt, 32, 16, hashAlg);
+      const decipher = crypto.createDecipheriv("aes-256-cbc", key, iv);
+      return Buffer.concat([decipher.update(ciphertext), decipher.final()]);
+    } catch {
+      continue;
+    }
+  }
+  throw new Error("Failed to decrypt V1 data with both MD5 and SHA256");
+}
+function decrypt(data, password) {
+  const str = data.toString("utf-8");
+  const decoded = Buffer.from(str, "base64").toString("utf-8");
+  if (decoded.startsWith(V2_PREFIX)) {
+    return decryptV2(data, password);
+  }
+  if (decoded.startsWith(V1_PREFIX)) {
+    return decryptV1(data, password);
+  }
+  try {
+    return decryptV2(data, password);
+  } catch {
+    return decryptV1(data, password);
+  }
+}
+function encrypt(data, password) {
+  return encryptV2(data, password);
+}
+function isEncryptable(filePath) {
+  return ENCRYPTABLE_EXTENSIONS.includes(path.extname(filePath).toLowerCase());
+}
+async function decryptFiles(dir, password) {
+  const entries = await promises.readdir(dir, { withFileTypes: true });
+  for (const entry of entries) {
+    const fullPath = path.join(dir, entry.name);
+    if (entry.isDirectory()) {
+      await decryptFiles(fullPath, password);
+    } else if (isEncryptable(fullPath)) {
+      const data = await promises.readFile(fullPath);
+      try {
+        const decrypted = decrypt(data, password);
+        await promises.writeFile(fullPath, decrypted);
+      } catch {
+      }
+    }
+  }
+}
+async function encryptFiles(dir, password) {
+  const entries = await promises.readdir(dir, { withFileTypes: true });
+  for (const entry of entries) {
+    const fullPath = path.join(dir, entry.name);
+    if (entry.isDirectory()) {
+      await encryptFiles(fullPath, password);
+    } else if (isEncryptable(fullPath)) {
+      const data = await promises.readFile(fullPath);
+      const encrypted = encrypt(data, password);
+      await promises.writeFile(fullPath, encrypted);
+    }
+  }
+}
+
+// src/match/index.ts
+function profileTypeForMatch(type, platform) {
+  const p = platform ?? "ios";
+  switch (type) {
+    case "development":
+      if (p === "macos") return "MAC_APP_DEVELOPMENT";
+      if (p === "tvos") return "TVOS_APP_DEVELOPMENT";
+      if (p === "catalyst") return "MAC_CATALYST_APP_DEVELOPMENT";
+      return "IOS_APP_DEVELOPMENT";
+    case "adhoc":
+      if (p === "tvos") return "TVOS_APP_ADHOC";
+      return "IOS_APP_ADHOC";
+    case "enterprise":
+      if (p === "macos") return "MAC_APP_INHOUSE";
+      if (p === "tvos") return "TVOS_APP_INHOUSE";
+      if (p === "catalyst") return "MAC_CATALYST_APP_INHOUSE";
+      return "IOS_APP_INHOUSE";
+    default:
+      if (p === "macos") return "MAC_APP_STORE";
+      if (p === "tvos") return "TVOS_APP_STORE";
+      if (p === "catalyst") return "MAC_CATALYST_APP_STORE";
+      return "IOS_APP_STORE";
+  }
+}
+function certTypeForMatch(type, platform) {
+  const p = platform ?? "ios";
+  if (type === "development") {
+    return p === "macos" ? "MAC_APP_DEVELOPMENT" : "IOS_DEVELOPMENT";
+  }
+  return p === "macos" ? "MAC_APP_DISTRIBUTION" : "IOS_DISTRIBUTION";
+}
+function certSubdir(type) {
+  return type === "development" ? "development" : "distribution";
+}
+function profileSubdir(type) {
+  switch (type) {
+    case "development":
+      return "development";
+    case "adhoc":
+      return "adhoc";
+    case "enterprise":
+      return "enterprise";
+    default:
+      return "appstore";
+  }
+}
+async function syncSigningAssets(options) {
+  const password = options.password ?? process.env.MATCH_PASSWORD ?? "";
+  if (!password) {
+    throw new Error("Match password is required. Set MATCH_PASSWORD or pass password option.");
+  }
+  const storage = await createStorage({
+    mode: options.storageMode,
+    gitUrl: options.gitUrl,
+    gitBranch: options.gitBranch,
+    gitPrivateKey: options.gitPrivateKey,
+    gitPrivateKeyContent: options.gitPrivateKeyContent,
+    gitBasicAuth: options.gitBasicAuth,
+    gitBearerToken: options.gitBearerToken,
+    gitUserName: options.gitUserName,
+    gitUserEmail: options.gitUserEmail,
+    shallowClone: options.shallowClone,
+    s3Bucket: options.s3Bucket,
+    s3Region: options.s3Region,
+    localPath: options.localPath,
+    teamId: options.teamId
+  });
+  const workDir = await storage.download();
+  await decryptFiles(workDir, password);
+  const certificates = [];
+  const profiles = [];
+  const filesToCommit = [];
+  const certDir = path.join(workDir, "certs", certSubdir(options.type));
+  const profileDir = path.join(workDir, "profiles", profileSubdir(options.type));
+  for (const appId of options.appIdentifiers) {
+    let certResult = null;
+    const certFiles = fs.existsSync(certDir) ? await findFilesWithExt(certDir, ".cer") : [];
+    if (certFiles.length > 0 && !options.force) {
+      const certContent = await promises.readFile(certFiles[0]);
+      certResult = {
+        certificate: null,
+        // Stored cert doesn't have full API object
+        privateKey: "",
+        certificateContent: certContent,
+        certPath: certFiles[0]
+      };
+    } else if (!options.readonly) {
+      const { createCertificate: createCertificate2 } = await Promise.resolve().then(() => (init_cert(), cert_exports));
+      certResult = await createCertificate2({
+        client: options.client,
+        type: certTypeForMatch(options.type, options.platform),
+        outputDir: certDir,
+        keychainPath: options.keychainName,
+        keychainPassword: options.keychainPassword
+      });
+      if (certResult.certPath) filesToCommit.push(certResult.certPath);
+      if (certResult.p12Path) filesToCommit.push(certResult.p12Path);
+    }
+    if (certResult) certificates.push(certResult);
+    const profileFiles = fs.existsSync(profileDir) ? await findFilesWithExt(profileDir, ".mobileprovision") : [];
+    const matchingProfile = profileFiles.find((f) => f.includes(appId));
+    if (matchingProfile && !options.force) {
+      const profileContent = await promises.readFile(matchingProfile);
+      profiles.push({
+        profile: null,
+        profileContent,
+        uuid: "",
+        name: "",
+        filePath: matchingProfile
+      });
+    } else if (!options.readonly) {
+      const { createProfile: createProfile2 } = await Promise.resolve().then(() => (init_sigh(), sigh_exports));
+      const profileType = profileTypeForMatch(options.type, options.platform);
+      const sighResult = await createProfile2({
+        client: options.client,
+        bundleIdentifier: appId,
+        profileType,
+        outputDir: profileDir,
+        skipInstall: false
+      });
+      if (sighResult.filePath) filesToCommit.push(sighResult.filePath);
+      profiles.push(sighResult);
+    }
+  }
+  if (filesToCommit.length > 0 && !options.readonly) {
+    await encryptFiles(workDir, password);
+    const appList = options.appIdentifiers.join(", ");
+    const message = `[fastlane-match] Updated ${options.type} and profile for ${appList}`;
+    await storage.saveChanges(filesToCommit, message);
+  }
+  await storage.cleanup();
+  return { certificates, profiles };
+}
+async function findFilesWithExt(dir, ext) {
+  const entries = await promises.readdir(dir, { withFileTypes: true });
+  const results = [];
+  for (const entry of entries) {
+    const fullPath = path.join(dir, entry.name);
+    if (!entry.isDirectory() && path.extname(entry.name) === ext) {
+      results.push(fullPath);
+    }
+  }
+  return results;
+}
+
+exports.decrypt = decrypt;
+exports.decryptFiles = decryptFiles;
+exports.decryptV1 = decryptV1;
+exports.decryptV2 = decryptV2;
+exports.encrypt = encrypt;
+exports.encryptFiles = encryptFiles;
+exports.encryptV2 = encryptV2;
+exports.syncSigningAssets = syncSigningAssets;
+//# sourceMappingURL=index.cjs.map
+//# sourceMappingURL=index.cjs.map