@sitepong/fastnode 0.1.0

package/dist/cert/index.cjs

@@ -0,0 +1,219 @@
+'use strict';
+
+var child_process = require('child_process');
+var util = require('util');
+var promises = require('fs/promises');
+var path = require('path');
+var x509 = require('@peculiar/x509');
+var crypto = require('crypto');
+var fs = require('fs');
+var os = require('os');
+
+function _interopNamespace(e) {
+  if (e && e.__esModule) return e;
+  var n = Object.create(null);
+  if (e) {
+    Object.keys(e).forEach(function (k) {
+      if (k !== 'default') {
+        var d = Object.getOwnPropertyDescriptor(e, k);
+        Object.defineProperty(n, k, d.get ? d : {
+          enumerable: true,
+          get: function () { return e[k]; }
+        });
+      }
+    });
+  }
+  n.default = e;
+  return Object.freeze(n);
+}
+
+var x509__namespace = /*#__PURE__*/_interopNamespace(x509);
+
+// src/cert/cert.ts
+x509__namespace.cryptoProvider.set(crypto.webcrypto);
+function toPem(header, der) {
+  const b64 = der.toString("base64");
+  const lines = [];
+  for (let i = 0; i < b64.length; i += 64) lines.push(b64.slice(i, i + 64));
+  return `-----BEGIN ${header}-----
+${lines.join("\n")}
+-----END ${header}-----`;
+}
+async function generateCSR() {
+  const algorithm = { name: "ECDSA", namedCurve: "P-256" };
+  const keyPair = await crypto.webcrypto.subtle.generateKey(algorithm, true, ["sign", "verify"]);
+  const csr = await x509__namespace.Pkcs10CertificateRequestGenerator.create({
+    name: "CN=PEM",
+    keys: keyPair,
+    signingAlgorithm: { name: "ECDSA", hash: "SHA-256" }
+  });
+  const pkcs8 = await crypto.webcrypto.subtle.exportKey("pkcs8", keyPair.privateKey);
+  return {
+    csr: csr.toString("pem"),
+    privateKey: toPem("PRIVATE KEY", Buffer.from(pkcs8))
+  };
+}
+function generateRSACSR() {
+  const { privateKey, publicKey } = crypto.generateKeyPairSync("rsa", {
+    modulusLength: 2048,
+    privateKeyEncoding: { type: "pkcs8", format: "pem" },
+    publicKeyEncoding: { type: "spki", format: "pem" }
+  });
+  const keyPath = path.join(os.tmpdir(), `fastnode-rsa-${Date.now()}.pem`);
+  const csrPath = path.join(os.tmpdir(), `fastnode-rsa-${Date.now()}.csr`);
+  try {
+    fs.writeFileSync(keyPath, privateKey);
+    child_process.execSync(`openssl req -new -key "${keyPath}" -out "${csrPath}" -subj "/CN=PEM" 2>/dev/null`);
+    const csr = fs.readFileSync(csrPath, "utf-8");
+    return { csr, privateKey };
+  } finally {
+    try {
+      fs.unlinkSync(keyPath);
+    } catch {
+    }
+    try {
+      fs.unlinkSync(csrPath);
+    } catch {
+    }
+  }
+}
+
+// src/cert/cert.ts
+var execFileAsync = util.promisify(child_process.execFile);
+function resolveCertificateTypes(options) {
+  if (options.type) return [options.type];
+  const platform = options.platform ?? "ios";
+  if (options.development) {
+    return platform === "macos" ? ["MAC_APP_DEVELOPMENT"] : ["IOS_DEVELOPMENT"];
+  }
+  return platform === "macos" ? ["MAC_APP_DISTRIBUTION"] : ["IOS_DISTRIBUTION"];
+}
+async function findValidCertificates(options) {
+  const types = resolveCertificateTypes(options);
+  const certs = await options.client.certificates.list({
+    filter: { certificateType: types },
+    limit: 200
+  });
+  const now = /* @__PURE__ */ new Date();
+  return certs.filter(
+    (c) => new Date(c.attributes.expirationDate) > now
+  );
+}
+async function createCertificate(options) {
+  if (!options.force) {
+    const existing = await findValidCertificates(options);
+    if (existing.length > 0) {
+      const cert2 = existing[0];
+      const content2 = Buffer.from(cert2.attributes.certificateContent, "base64");
+      const result2 = {
+        certificate: cert2,
+        privateKey: "",
+        certificateContent: content2
+      };
+      if (options.outputDir) {
+        await promises.mkdir(options.outputDir, { recursive: true });
+        const certPath = path.join(options.outputDir, `${cert2.id}.cer`);
+        await promises.writeFile(certPath, content2);
+        result2.certPath = certPath;
+      }
+      return result2;
+    }
+  }
+  const types = resolveCertificateTypes(options);
+  const { csr, privateKey } = await generateCSR();
+  const cert = await options.client.certificates.create({
+    certificateType: types[0],
+    csrContent: csr
+  });
+  const content = Buffer.from(cert.attributes.certificateContent, "base64");
+  const result = {
+    certificate: cert,
+    privateKey,
+    certificateContent: content
+  };
+  if (options.outputDir) {
+    await promises.mkdir(options.outputDir, { recursive: true });
+    const certPath = path.join(options.outputDir, `${cert.id}.cer`);
+    await promises.writeFile(certPath, content);
+    result.certPath = certPath;
+    const keyPath = path.join(options.outputDir, `${cert.id}.p12`);
+    await promises.writeFile(keyPath, privateKey);
+    result.p12Path = keyPath;
+  }
+  if (options.keychainPath && process.platform === "darwin") {
+    await importToKeychain(
+      content,
+      options.keychainPath,
+      options.keychainPassword
+    );
+  }
+  return result;
+}
+async function revokeCertificate(client, id) {
+  await client.certificates.revoke(id);
+}
+async function downloadCertificate(client, id) {
+  const cert = await client.certificates.get(id);
+  return Buffer.from(cert.attributes.certificateContent, "base64");
+}
+async function revokeExpiredCertificates(options) {
+  const types = resolveCertificateTypes(options);
+  const certs = await options.client.certificates.list({
+    filter: { certificateType: types }
+  });
+  const now = /* @__PURE__ */ new Date();
+  let count = 0;
+  for (const cert of certs) {
+    if (new Date(cert.attributes.expirationDate) <= now) {
+      try {
+        await options.client.certificates.revoke(cert.id);
+        count++;
+      } catch {
+      }
+    }
+  }
+  return count;
+}
+async function importToKeychain(certData, keychainPath, keychainPassword) {
+  const { tmpdir: tmpdir2 } = await import('os');
+  const tempCertPath = path.join(tmpdir2(), `fastnode-cert-${Date.now()}.cer`);
+  await promises.writeFile(tempCertPath, certData);
+  try {
+    const args = [
+      "import",
+      tempCertPath,
+      "-k",
+      keychainPath,
+      "-T",
+      "/usr/bin/codesign",
+      "-T",
+      "/usr/bin/security"
+    ];
+    await execFileAsync("security", args);
+    if (keychainPassword) {
+      await execFileAsync("security", [
+        "set-key-partition-list",
+        "-S",
+        "apple-tool:,apple:,codesign:",
+        "-s",
+        "-k",
+        keychainPassword,
+        keychainPath
+      ]);
+    }
+  } finally {
+    const { unlink } = await import('fs/promises');
+    await unlink(tempCertPath).catch(() => {
+    });
+  }
+}
+
+exports.createCertificate = createCertificate;
+exports.downloadCertificate = downloadCertificate;
+exports.findValidCertificates = findValidCertificates;
+exports.generateCSR = generateCSR;
+exports.generateRSACSR = generateRSACSR;
+exports.revokeCertificate = revokeCertificate;
+exports.revokeExpiredCertificates = revokeExpiredCertificates;
+//# sourceMappingURL=index.cjs.map
+//# sourceMappingURL=index.cjs.map

package/dist/cert/index.cjs.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../../src/cert/csr.ts","../../src/cert/cert.ts"],"names":["x509","webcrypto","generateKeyPairSync","join","tmpdir","writeFileSync","execSync","readFileSync","unlinkSync","promisify","execFile","cert","content","result","mkdir","writeFile"],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AAQKA,eAAA,CAAA,cAAA,CAAe,IAAIC,gBAAqE,CAAA;AAE7F,SAAS,KAAA,CAAM,QAAgB,GAAA,EAAqB;AAClD,EAAA,MAAM,GAAA,GAAM,GAAA,CAAI,QAAA,CAAS,QAAQ,CAAA;AACjC,EAAA,MAAM,QAAkB,EAAC;AACzB,EAAA,KAAA,IAAS,CAAA,GAAI,CAAA,EAAG,CAAA,GAAI,GAAA,CAAI,QAAQ,CAAA,IAAK,EAAA,EAAI,KAAA,CAAM,IAAA,CAAK,GAAA,CAAI,KAAA,CAAM,CAAA,EAAG,CAAA,GAAI,EAAE,CAAC,CAAA;AACxE,EAAA,OAAO,cAAc,MAAM,CAAA;AAAA,EAAU,KAAA,CAAM,IAAA,CAAK,IAAI,CAAC;AAAA,SAAA,EAAc,MAAM,CAAA,KAAA,CAAA;AAC3E;AAKA,eAAsB,WAAA,GAA4D;AAChF,EAAA,MAAM,SAAA,GAAY,EAAE,IAAA,EAAM,OAAA,EAAS,YAAY,OAAA,EAAQ;AACvD,EAAA,MAAM,OAAA,GAAU,MAAMA,gBAAA,CAAU,MAAA,CAAO,WAAA,CAAY,WAAW,IAAA,EAAM,CAAC,MAAA,EAAQ,QAAQ,CAAC,CAAA;AAEtF,EAAA,MAAM,GAAA,GAAM,MAAWD,eAAA,CAAA,iCAAA,CAAkC,MAAA,CAAO;AAAA,IAC9D,IAAA,EAAM,QAAA;AAAA,IACN,IAAA,EAAM,OAAA;AAAA,IACN,gBAAA,EAAkB,EAAE,IAAA,EAAM,OAAA,EAAS,MAAM,SAAA;AAAU,GACpD,CAAA;AAED,EAAA,MAAM,QAAQ,MAAMC,gBAAA,CAAU,OAAO,SAAA,CAAU,OAAA,EAAS,QAAQ,UAAU,CAAA;AAC1E,EAAA,OAAO;AAAA,IACL,GAAA,EAAK,GAAA,CAAI,QAAA,CAAS,KAAK,CAAA;AAAA,IACvB,YAAY,KAAA,CAAM,aAAA,EAAe,MAAA,CAAO,IAAA,CAAK,KAAK,CAAC;AAAA,GACrD;AACF;AAMO,SAAS,cAAA,GAAsD;AACpE,EAAA,MAAM,EAAE,UAAA,EAAY,SAAA,EAAU,GAAIC,2BAAoB,KAAA,EAAO;AAAA,IAC3D,aAAA,EAAe,IAAA;AAAA,IACf,kBAAA,EAAoB,EAAE,IAAA,EAAM,OAAA,EAAS,QAAQ,KAAA,EAAM;AAAA,IACnD,iBAAA,EAAmB,EAAE,IAAA,EAAM,MAAA,EAAQ,QAAQ,KAAA;AAAM,GAClD,CAAA;AAGD,EAAA,MAAM,OAAA,GAAUC,UAAKC,SAAA,EAAO,EAAG,gBAAgB,IAAA,CAAK,GAAA,EAAK,CAAA,IAAA,CAAM,CAAA;AAC/D,EAAA,MAAM,OAAA,GAAUD,UAAKC,SAAA,EAAO,EAAG,gBAAgB,IAAA,CAAK,GAAA,EAAK,CAAA,IAAA,CAAM,CAAA;AAE/D,EAAA,IAAI;AACF,IAAAC,gBAAA,CAAc,SAAS,UAAU,CAAA;AACjC,IAAAC,sBAAA,CAAS,CAAA,uBAAA,EAA0B,OAAO,CAAA,QAAA,EAAW,OAAO,CAAA,6BAAA,CAA+B,CAAA;AAC3F,IAAA,MAAM,GAAA,GAAMC,eAAA,CAAa,OAAA,EAAS,OAAO,CAAA;AACzC,IAAA,OAAO,EAAE,KAAK,UAAA,EAAW;AAAA,EAC3B,CAAA,SAAE;AACA,IAAA,IAAI;AAAE,MAAAC,aAAA,CAAW,OAAO,CAAA;AAAA,IAAG,CAAA,CAAA,MAAQ;AAAA,IAAC;AACpC,IAAA,IAAI;AAAE,MAAAA,aAAA,CAAW,OAAO,CAAA;AAAA,IAAG,CAAA,CAAA,MAAQ;AAAA,IAAC;AAAA,EACtC;AACF;;;ACpDA,IAAM,aAAA,GAAgBC,eAAUC,sBAAQ,CAAA;AAqBxC,SAAS,wBAAwB,OAAA,EAAyC;AACxE,EAAA,IAAI,OAAA,CAAQ,IAAA,EAAM,OAAO,CAAC,QAAQ,IAAI,CAAA;AAEtC,EAAA,MAAM,QAAA,GAAW,QAAQ,QAAA,IAAY,KAAA;AACrC,EAAA,IAAI,QAAQ,WAAA,EAAa;AACvB,IAAA,OAAO,aAAa,OAAA,GAAU,CAAC,qBAAqB,CAAA,GAAI,CAAC,iBAAiB,CAAA;AAAA,EAC5E;AACA,EAAA,OAAO,aAAa,OAAA,GAChB,CAAC,sBAAsB,CAAA,GACvB,CAAC,kBAAkB,CAAA;AACzB;AAEA,eAAsB,sBACpB,OAAA,EACwB;AACxB,EAAA,MAAM,KAAA,GAAQ,wBAAwB,OAAsB,CAAA;AAC5D,EAAA,MAAM,KAAA,GAAQ,MAAM,OAAA,CAAQ,MAAA,CAAO,aAAa,IAAA,CAAK;AAAA,IACnD,MAAA,EAAQ,EAAE,eAAA,EAAiB,KAAA,EAAM;AAAA,IACjC,KAAA,EAAO;AAAA,GACR,CAAA;AAED,EAAA,MAAM,GAAA,uBAAU,IAAA,EAAK;AACrB,EAAA,OAAO,KAAA,CAAM,MAAA;AAAA,IACX,CAAC,CAAA,KAAM,IAAI,KAAK,CAAA,CAAE,UAAA,CAAW,cAAc,CAAA,GAAI;AAAA,GACjD;AACF;AAEA,eAAsB,kBACpB,OAAA,EACqB;AAErB,EAAA,IAAI,CAAC,QAAQ,KAAA,EAAO;AAClB,IAAA,MAAM,QAAA,GAAW,MAAM,qBAAA,CAAsB,OAAO,CAAA;AACpD,IAAA,IAAI,QAAA,CAAS,SAAS,CAAA,EAAG;AACvB,MAAA,MAAMC,KAAAA,GAAO,SAAS,CAAC,CAAA;AACvB,MAAA,MAAMC,WAAU,MAAA,CAAO,IAAA,CAAKD,KAAAA,CAAK,UAAA,CAAW,oBAAoB,QAAQ,CAAA;AACxE,MAAA,MAAME,OAAAA,GAAqB;AAAA,QACzB,WAAA,EAAaF,KAAAA;AAAA,QACb,UAAA,EAAY,EAAA;AAAA,QACZ,kBAAA,EAAoBC;AAAA,OACtB;AAEA,MAAA,IAAI,QAAQ,SAAA,EAAW;AACrB,QAAA,MAAME,eAAM,OAAA,CAAQ,SAAA,EAAW,EAAE,SAAA,EAAW,MAAM,CAAA;AAClD,QAAA,MAAM,WAAWX,SAAAA,CAAK,OAAA,CAAQ,WAAW,CAAA,EAAGQ,KAAAA,CAAK,EAAE,CAAA,IAAA,CAAM,CAAA;AACzD,QAAA,MAAMI,kBAAA,CAAU,UAAUH,QAAO,CAAA;AACjC,QAAAC,QAAO,QAAA,GAAW,QAAA;AAAA,MACpB;AAEA,MAAA,OAAOA,OAAAA;AAAA,IACT;AAAA,EACF;AAGA,EAAA,MAAM,KAAA,GAAQ,wBAAwB,OAAO,CAAA;AAC7C,EAAA,MAAM,EAAE,GAAA,EAAK,UAAA,EAAW,GAAI,MAAM,WAAA,EAAY;AAE9C,EAAA,MAAM,IAAA,GAAO,MAAM,OAAA,CAAQ,MAAA,CAAO,aAAa,MAAA,CAAO;AAAA,IACpD,eAAA,EAAiB,MAAM,CAAC,CAAA;AAAA,IACxB,UAAA,EAAY;AAAA,GACb,CAAA;AAED,EAAA,MAAM,UAAU,MAAA,CAAO,IAAA,CAAK,IAAA,CAAK,UAAA,CAAW,oBAAoB,QAAQ,CAAA;AAExE,EAAA,MAAM,MAAA,GAAqB;AAAA,IACzB,WAAA,EAAa,IAAA;AAAA,IACb,UAAA;AAAA,IACA,kBAAA,EAAoB;AAAA,GACtB;AAGA,EAAA,IAAI,QAAQ,SAAA,EAAW;AACrB,IAAA,MAAMC,eAAM,OAAA,CAAQ,SAAA,EAAW,EAAE,SAAA,EAAW,MAAM,CAAA;AAElD,IAAA,MAAM,WAAWX,SAAAA,CAAK,OAAA,CAAQ,WAAW,CAAA,EAAG,IAAA,CAAK,EAAE,CAAA,IAAA,CAAM,CAAA;AACzD,IAAA,MAAMY,kBAAA,CAAU,UAAU,OAAO,CAAA;AACjC,IAAA,MAAA,CAAO,QAAA,GAAW,QAAA;AAElB,IAAA,MAAM,UAAUZ,SAAAA,CAAK,OAAA,CAAQ,WAAW,CAAA,EAAG,IAAA,CAAK,EAAE,CAAA,IAAA,CAAM,CAAA;AACxD,IAAA,MAAMY,kBAAA,CAAU,SAAS,UAAU,CAAA;AACnC,IAAA,MAAA,CAAO,OAAA,GAAU,OAAA;AAAA,EACnB;AAGA,EAAA,IAAI,OAAA,CAAQ,YAAA,IAAgB,OAAA,CAAQ,QAAA,KAAa,QAAA,EAAU;AACzD,IAAA,MAAM,gBAAA;AAAA,MACJ,OAAA;AAAA,MACA,OAAA,CAAQ,YAAA;AAAA,MACR,OAAA,CAAQ;AAAA,KACV;AAAA,EACF;AAEA,EAAA,OAAO,MAAA;AACT;AAEA,eAAsB,iBAAA,CACpB,QACA,EAAA,EACe;AACf,EAAA,MAAM,MAAA,CAAO,YAAA,CAAa,MAAA,CAAO,EAAE,CAAA;AACrC;AAEA,eAAsB,mBAAA,CACpB,QACA,EAAA,EACiB;AACjB,EAAA,MAAM,IAAA,GAAO,MAAM,MAAA,CAAO,YAAA,CAAa,IAAI,EAAE,CAAA;AAC7C,EAAA,OAAO,MAAA,CAAO,IAAA,CAAK,IAAA,CAAK,UAAA,CAAW,oBAAoB,QAAQ,CAAA;AACjE;AAEA,eAAsB,0BACpB,OAAA,EACiB;AACjB,EAAA,MAAM,KAAA,GAAQ,wBAAwB,OAAO,CAAA;AAC7C,EAAA,MAAM,KAAA,GAAQ,MAAM,OAAA,CAAQ,MAAA,CAAO,aAAa,IAAA,CAAK;AAAA,IACnD,MAAA,EAAQ,EAAE,eAAA,EAAiB,KAAA;AAAM,GAClC,CAAA;AAED,EAAA,MAAM,GAAA,uBAAU,IAAA,EAAK;AACrB,EAAA,IAAI,KAAA,GAAQ,CAAA;AACZ,EAAA,KAAA,MAAW,QAAQ,KAAA,EAAO;AACxB,IAAA,IAAI,IAAI,IAAA,CAAK,IAAA,CAAK,UAAA,CAAW,cAAc,KAAK,GAAA,EAAK;AACnD,MAAA,IAAI;AACF,QAAA,MAAM,OAAA,CAAQ,MAAA,CAAO,YAAA,CAAa,MAAA,CAAO,KAAK,EAAE,CAAA;AAChD,QAAA,KAAA,EAAA;AAAA,MACF,CAAA,CAAA,MAAQ;AAAA,MAER;AAAA,IACF;AAAA,EACF;AACA,EAAA,OAAO,KAAA;AACT;AAEA,eAAe,gBAAA,CACb,QAAA,EACA,YAAA,EACA,gBAAA,EACe;AACf,EAAA,MAAM,EAAE,MAAA,EAAAX,OAAAA,EAAO,GAAI,MAAM,OAAO,IAAS,CAAA;AACzC,EAAA,MAAM,YAAA,GAAeD,UAAKC,OAAAA,EAAO,EAAG,iBAAiB,IAAA,CAAK,GAAA,EAAK,CAAA,IAAA,CAAM,CAAA;AACrE,EAAA,MAAMW,kBAAA,CAAU,cAAc,QAAQ,CAAA;AAEtC,EAAA,IAAI;AACF,IAAA,MAAM,IAAA,GAAO;AAAA,MACX,QAAA;AAAA,MACA,YAAA;AAAA,MACA,IAAA;AAAA,MACA,YAAA;AAAA,MACA,IAAA;AAAA,MACA,mBAAA;AAAA,MACA,IAAA;AAAA,MACA;AAAA,KACF;AAEA,IAAA,MAAM,aAAA,CAAc,YAAY,IAAI,CAAA;AAGpC,IAAA,IAAI,gBAAA,EAAkB;AACpB,MAAA,MAAM,cAAc,UAAA,EAAY;AAAA,QAC9B,wBAAA;AAAA,QACA,IAAA;AAAA,QACA,8BAAA;AAAA,QACA,IAAA;AAAA,QACA,IAAA;AAAA,QACA,gBAAA;AAAA,QACA;AAAA,OACD,CAAA;AAAA,IACH;AAAA,EACF,CAAA,SAAE;AACA,IAAA,MAAM,EAAE,MAAA,EAAO,GAAI,MAAM,OAAO,aAAkB,CAAA;AAClD,IAAA,MAAM,MAAA,CAAO,YAAY,CAAA,CAAE,KAAA,CAAM,MAAM;AAAA,IAAC,CAAC,CAAA;AAAA,EAC3C;AACF","file":"index.cjs","sourcesContent":["import * as x509 from \"@peculiar/x509\";\nimport { webcrypto, generateKeyPairSync } from \"node:crypto\";\nimport { execSync } from \"node:child_process\";\nimport { writeFileSync, readFileSync, unlinkSync } from \"node:fs\";\nimport { join } from \"node:path\";\nimport { tmpdir } from \"node:os\";\n\n// Register the Node.js crypto provider.\nx509.cryptoProvider.set(webcrypto as unknown as Parameters<typeof x509.cryptoProvider.set>[0]);\n\nfunction toPem(header: string, der: Buffer): string {\n  const b64 = der.toString(\"base64\");\n  const lines: string[] = [];\n  for (let i = 0; i < b64.length; i += 64) lines.push(b64.slice(i, i + 64));\n  return `-----BEGIN ${header}-----\\n${lines.join(\"\\n\")}\\n-----END ${header}-----`;\n}\n\n/**\n * Generate EC P-256 CSR — used by App Store Connect API (JWT auth).\n */\nexport async function generateCSR(): Promise<{ csr: string; privateKey: string }> {\n  const algorithm = { name: \"ECDSA\", namedCurve: \"P-256\" } as const;\n  const keyPair = await webcrypto.subtle.generateKey(algorithm, true, [\"sign\", \"verify\"]);\n\n  const csr = await x509.Pkcs10CertificateRequestGenerator.create({\n    name: \"CN=PEM\",\n    keys: keyPair,\n    signingAlgorithm: { name: \"ECDSA\", hash: \"SHA-256\" },\n  });\n\n  const pkcs8 = await webcrypto.subtle.exportKey(\"pkcs8\", keyPair.privateKey);\n  return {\n    csr: csr.toString(\"pem\"),\n    privateKey: toPem(\"PRIVATE KEY\", Buffer.from(pkcs8)),\n  };\n}\n\n/**\n * Generate RSA 2048 CSR — required by Apple Developer Portal (session auth).\n * Matches Fastlane's create_certificate_signing_request which uses RSA 2048.\n */\nexport function generateRSACSR(): { csr: string; privateKey: string } {\n  const { privateKey, publicKey } = generateKeyPairSync(\"rsa\", {\n    modulusLength: 2048,\n    privateKeyEncoding: { type: \"pkcs8\", format: \"pem\" },\n    publicKeyEncoding: { type: \"spki\", format: \"pem\" },\n  });\n\n  // Generate CSR using openssl (Node crypto doesn't have native CSR generation for RSA)\n  const keyPath = join(tmpdir(), `fastnode-rsa-${Date.now()}.pem`);\n  const csrPath = join(tmpdir(), `fastnode-rsa-${Date.now()}.csr`);\n\n  try {\n    writeFileSync(keyPath, privateKey);\n    execSync(`openssl req -new -key \"${keyPath}\" -out \"${csrPath}\" -subj \"/CN=PEM\" 2>/dev/null`);\n    const csr = readFileSync(csrPath, \"utf-8\");\n    return { csr, privateKey };\n  } finally {\n    try { unlinkSync(keyPath); } catch {}\n    try { unlinkSync(csrPath); } catch {}\n  }\n}\n","import { execFile } from \"node:child_process\";\nimport { promisify } from \"node:util\";\nimport { writeFile, mkdir } from \"node:fs/promises\";\nimport { join } from \"node:path\";\nimport { createHash } from \"node:crypto\";\nimport type { AppStoreConnectClient } from \"../client/index.js\";\nimport type { Certificate, CertificateType } from \"../types/index.js\";\nimport { generateCSR } from \"./csr.js\";\n\nconst execFileAsync = promisify(execFile);\n\nexport interface CertOptions {\n  client: AppStoreConnectClient;\n  type?: CertificateType;\n  development?: boolean;\n  force?: boolean;\n  outputDir?: string;\n  keychainPath?: string;\n  keychainPassword?: string;\n  platform?: \"ios\" | \"macos\";\n}\n\nexport interface CertResult {\n  certificate: Certificate;\n  privateKey: string;\n  certificateContent: Buffer;\n  certPath?: string;\n  p12Path?: string;\n}\n\nfunction resolveCertificateTypes(options: CertOptions): CertificateType[] {\n  if (options.type) return [options.type];\n\n  const platform = options.platform ?? \"ios\";\n  if (options.development) {\n    return platform === \"macos\" ? [\"MAC_APP_DEVELOPMENT\"] : [\"IOS_DEVELOPMENT\"];\n  }\n  return platform === \"macos\"\n    ? [\"MAC_APP_DISTRIBUTION\"]\n    : [\"IOS_DISTRIBUTION\"];\n}\n\nexport async function findValidCertificates(\n  options: Omit<CertOptions, \"force\">\n): Promise<Certificate[]> {\n  const types = resolveCertificateTypes(options as CertOptions);\n  const certs = await options.client.certificates.list({\n    filter: { certificateType: types },\n    limit: 200,\n  });\n\n  const now = new Date();\n  return certs.filter(\n    (c) => new Date(c.attributes.expirationDate) > now\n  );\n}\n\nexport async function createCertificate(\n  options: CertOptions\n): Promise<CertResult> {\n  // Check for existing valid certs unless force\n  if (!options.force) {\n    const existing = await findValidCertificates(options);\n    if (existing.length > 0) {\n      const cert = existing[0];\n      const content = Buffer.from(cert.attributes.certificateContent, \"base64\");\n      const result: CertResult = {\n        certificate: cert,\n        privateKey: \"\",\n        certificateContent: content,\n      };\n\n      if (options.outputDir) {\n        await mkdir(options.outputDir, { recursive: true });\n        const certPath = join(options.outputDir, `${cert.id}.cer`);\n        await writeFile(certPath, content);\n        result.certPath = certPath;\n      }\n\n      return result;\n    }\n  }\n\n  // Generate CSR and create new certificate\n  const types = resolveCertificateTypes(options);\n  const { csr, privateKey } = await generateCSR();\n\n  const cert = await options.client.certificates.create({\n    certificateType: types[0],\n    csrContent: csr,\n  });\n\n  const content = Buffer.from(cert.attributes.certificateContent, \"base64\");\n\n  const result: CertResult = {\n    certificate: cert,\n    privateKey,\n    certificateContent: content,\n  };\n\n  // Write files if outputDir provided\n  if (options.outputDir) {\n    await mkdir(options.outputDir, { recursive: true });\n\n    const certPath = join(options.outputDir, `${cert.id}.cer`);\n    await writeFile(certPath, content);\n    result.certPath = certPath;\n\n    const keyPath = join(options.outputDir, `${cert.id}.p12`);\n    await writeFile(keyPath, privateKey);\n    result.p12Path = keyPath;\n  }\n\n  // Import to keychain if on macOS\n  if (options.keychainPath && process.platform === \"darwin\") {\n    await importToKeychain(\n      content,\n      options.keychainPath,\n      options.keychainPassword\n    );\n  }\n\n  return result;\n}\n\nexport async function revokeCertificate(\n  client: AppStoreConnectClient,\n  id: string\n): Promise<void> {\n  await client.certificates.revoke(id);\n}\n\nexport async function downloadCertificate(\n  client: AppStoreConnectClient,\n  id: string\n): Promise<Buffer> {\n  const cert = await client.certificates.get(id);\n  return Buffer.from(cert.attributes.certificateContent, \"base64\");\n}\n\nexport async function revokeExpiredCertificates(\n  options: CertOptions\n): Promise<number> {\n  const types = resolveCertificateTypes(options);\n  const certs = await options.client.certificates.list({\n    filter: { certificateType: types },\n  });\n\n  const now = new Date();\n  let count = 0;\n  for (const cert of certs) {\n    if (new Date(cert.attributes.expirationDate) <= now) {\n      try {\n        await options.client.certificates.revoke(cert.id);\n        count++;\n      } catch {\n        // Ignore revocation failures for already-revoked certs\n      }\n    }\n  }\n  return count;\n}\n\nasync function importToKeychain(\n  certData: Buffer,\n  keychainPath: string,\n  keychainPassword?: string\n): Promise<void> {\n  const { tmpdir } = await import(\"node:os\");\n  const tempCertPath = join(tmpdir(), `fastnode-cert-${Date.now()}.cer`);\n  await writeFile(tempCertPath, certData);\n\n  try {\n    const args = [\n      \"import\",\n      tempCertPath,\n      \"-k\",\n      keychainPath,\n      \"-T\",\n      \"/usr/bin/codesign\",\n      \"-T\",\n      \"/usr/bin/security\",\n    ];\n\n    await execFileAsync(\"security\", args);\n\n    // Set partition list if keychain password provided\n    if (keychainPassword) {\n      await execFileAsync(\"security\", [\n        \"set-key-partition-list\",\n        \"-S\",\n        \"apple-tool:,apple:,codesign:\",\n        \"-s\",\n        \"-k\",\n        keychainPassword,\n        keychainPath,\n      ]);\n    }\n  } finally {\n    const { unlink } = await import(\"node:fs/promises\");\n    await unlink(tempCertPath).catch(() => {});\n  }\n}\n"]}

package/dist/cert/index.d.cts

@@ -0,0 +1,4 @@
+export { C as CertOptions, a as CertResult, c as createCertificate, d as downloadCertificate, f as findValidCertificates, r as revokeCertificate, b as revokeExpiredCertificates } from '../cert-BmJGtYtb.cjs';
+export { g as generateCSR, a as generateRSACSR } from '../index-lt819Jgj.cjs';
+import '../index-BLubSlgK.cjs';
+import '../enums-B609j2rb.cjs';

package/dist/cert/index.d.ts

@@ -0,0 +1,4 @@
+export { C as CertOptions, a as CertResult, c as createCertificate, d as downloadCertificate, f as findValidCertificates, r as revokeCertificate, b as revokeExpiredCertificates } from '../cert-owkOFNW8.js';
+export { g as generateCSR, a as generateRSACSR } from '../index-DfirmFbC.js';
+import '../index-D1Izm7qt.js';
+import '../enums-B609j2rb.js';

package/dist/cert/index.mjs

@@ -0,0 +1,191 @@
+import { execFile, execSync } from 'child_process';
+import { promisify } from 'util';
+import { mkdir, writeFile } from 'fs/promises';
+import { join } from 'path';
+import * as x509 from '@peculiar/x509';
+import { webcrypto, generateKeyPairSync } from 'crypto';
+import { writeFileSync, readFileSync, unlinkSync } from 'fs';
+import { tmpdir } from 'os';
+
+// src/cert/cert.ts
+x509.cryptoProvider.set(webcrypto);
+function toPem(header, der) {
+  const b64 = der.toString("base64");
+  const lines = [];
+  for (let i = 0; i < b64.length; i += 64) lines.push(b64.slice(i, i + 64));
+  return `-----BEGIN ${header}-----
+${lines.join("\n")}
+-----END ${header}-----`;
+}
+async function generateCSR() {
+  const algorithm = { name: "ECDSA", namedCurve: "P-256" };
+  const keyPair = await webcrypto.subtle.generateKey(algorithm, true, ["sign", "verify"]);
+  const csr = await x509.Pkcs10CertificateRequestGenerator.create({
+    name: "CN=PEM",
+    keys: keyPair,
+    signingAlgorithm: { name: "ECDSA", hash: "SHA-256" }
+  });
+  const pkcs8 = await webcrypto.subtle.exportKey("pkcs8", keyPair.privateKey);
+  return {
+    csr: csr.toString("pem"),
+    privateKey: toPem("PRIVATE KEY", Buffer.from(pkcs8))
+  };
+}
+function generateRSACSR() {
+  const { privateKey, publicKey } = generateKeyPairSync("rsa", {
+    modulusLength: 2048,
+    privateKeyEncoding: { type: "pkcs8", format: "pem" },
+    publicKeyEncoding: { type: "spki", format: "pem" }
+  });
+  const keyPath = join(tmpdir(), `fastnode-rsa-${Date.now()}.pem`);
+  const csrPath = join(tmpdir(), `fastnode-rsa-${Date.now()}.csr`);
+  try {
+    writeFileSync(keyPath, privateKey);
+    execSync(`openssl req -new -key "${keyPath}" -out "${csrPath}" -subj "/CN=PEM" 2>/dev/null`);
+    const csr = readFileSync(csrPath, "utf-8");
+    return { csr, privateKey };
+  } finally {
+    try {
+      unlinkSync(keyPath);
+    } catch {
+    }
+    try {
+      unlinkSync(csrPath);
+    } catch {
+    }
+  }
+}
+
+// src/cert/cert.ts
+var execFileAsync = promisify(execFile);
+function resolveCertificateTypes(options) {
+  if (options.type) return [options.type];
+  const platform = options.platform ?? "ios";
+  if (options.development) {
+    return platform === "macos" ? ["MAC_APP_DEVELOPMENT"] : ["IOS_DEVELOPMENT"];
+  }
+  return platform === "macos" ? ["MAC_APP_DISTRIBUTION"] : ["IOS_DISTRIBUTION"];
+}
+async function findValidCertificates(options) {
+  const types = resolveCertificateTypes(options);
+  const certs = await options.client.certificates.list({
+    filter: { certificateType: types },
+    limit: 200
+  });
+  const now = /* @__PURE__ */ new Date();
+  return certs.filter(
+    (c) => new Date(c.attributes.expirationDate) > now
+  );
+}
+async function createCertificate(options) {
+  if (!options.force) {
+    const existing = await findValidCertificates(options);
+    if (existing.length > 0) {
+      const cert2 = existing[0];
+      const content2 = Buffer.from(cert2.attributes.certificateContent, "base64");
+      const result2 = {
+        certificate: cert2,
+        privateKey: "",
+        certificateContent: content2
+      };
+      if (options.outputDir) {
+        await mkdir(options.outputDir, { recursive: true });
+        const certPath = join(options.outputDir, `${cert2.id}.cer`);
+        await writeFile(certPath, content2);
+        result2.certPath = certPath;
+      }
+      return result2;
+    }
+  }
+  const types = resolveCertificateTypes(options);
+  const { csr, privateKey } = await generateCSR();
+  const cert = await options.client.certificates.create({
+    certificateType: types[0],
+    csrContent: csr
+  });
+  const content = Buffer.from(cert.attributes.certificateContent, "base64");
+  const result = {
+    certificate: cert,
+    privateKey,
+    certificateContent: content
+  };
+  if (options.outputDir) {
+    await mkdir(options.outputDir, { recursive: true });
+    const certPath = join(options.outputDir, `${cert.id}.cer`);
+    await writeFile(certPath, content);
+    result.certPath = certPath;
+    const keyPath = join(options.outputDir, `${cert.id}.p12`);
+    await writeFile(keyPath, privateKey);
+    result.p12Path = keyPath;
+  }
+  if (options.keychainPath && process.platform === "darwin") {
+    await importToKeychain(
+      content,
+      options.keychainPath,
+      options.keychainPassword
+    );
+  }
+  return result;
+}
+async function revokeCertificate(client, id) {
+  await client.certificates.revoke(id);
+}
+async function downloadCertificate(client, id) {
+  const cert = await client.certificates.get(id);
+  return Buffer.from(cert.attributes.certificateContent, "base64");
+}
+async function revokeExpiredCertificates(options) {
+  const types = resolveCertificateTypes(options);
+  const certs = await options.client.certificates.list({
+    filter: { certificateType: types }
+  });
+  const now = /* @__PURE__ */ new Date();
+  let count = 0;
+  for (const cert of certs) {
+    if (new Date(cert.attributes.expirationDate) <= now) {
+      try {
+        await options.client.certificates.revoke(cert.id);
+        count++;
+      } catch {
+      }
+    }
+  }
+  return count;
+}
+async function importToKeychain(certData, keychainPath, keychainPassword) {
+  const { tmpdir: tmpdir2 } = await import('os');
+  const tempCertPath = join(tmpdir2(), `fastnode-cert-${Date.now()}.cer`);
+  await writeFile(tempCertPath, certData);
+  try {
+    const args = [
+      "import",
+      tempCertPath,
+      "-k",
+      keychainPath,
+      "-T",
+      "/usr/bin/codesign",
+      "-T",
+      "/usr/bin/security"
+    ];
+    await execFileAsync("security", args);
+    if (keychainPassword) {
+      await execFileAsync("security", [
+        "set-key-partition-list",
+        "-S",
+        "apple-tool:,apple:,codesign:",
+        "-s",
+        "-k",
+        keychainPassword,
+        keychainPath
+      ]);
+    }
+  } finally {
+    const { unlink } = await import('fs/promises');
+    await unlink(tempCertPath).catch(() => {
+    });
+  }
+}
+
+export { createCertificate, downloadCertificate, findValidCertificates, generateCSR, generateRSACSR, revokeCertificate, revokeExpiredCertificates };
+//# sourceMappingURL=index.mjs.map
+//# sourceMappingURL=index.mjs.map

package/dist/cert/index.mjs.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../../src/cert/csr.ts","../../src/cert/cert.ts"],"names":["cert","content","result","join","tmpdir"],"mappings":";;;;;;;;;;AAQK,IAAA,CAAA,cAAA,CAAe,IAAI,SAAqE,CAAA;AAE7F,SAAS,KAAA,CAAM,QAAgB,GAAA,EAAqB;AAClD,EAAA,MAAM,GAAA,GAAM,GAAA,CAAI,QAAA,CAAS,QAAQ,CAAA;AACjC,EAAA,MAAM,QAAkB,EAAC;AACzB,EAAA,KAAA,IAAS,CAAA,GAAI,CAAA,EAAG,CAAA,GAAI,GAAA,CAAI,QAAQ,CAAA,IAAK,EAAA,EAAI,KAAA,CAAM,IAAA,CAAK,GAAA,CAAI,KAAA,CAAM,CAAA,EAAG,CAAA,GAAI,EAAE,CAAC,CAAA;AACxE,EAAA,OAAO,cAAc,MAAM,CAAA;AAAA,EAAU,KAAA,CAAM,IAAA,CAAK,IAAI,CAAC;AAAA,SAAA,EAAc,MAAM,CAAA,KAAA,CAAA;AAC3E;AAKA,eAAsB,WAAA,GAA4D;AAChF,EAAA,MAAM,SAAA,GAAY,EAAE,IAAA,EAAM,OAAA,EAAS,YAAY,OAAA,EAAQ;AACvD,EAAA,MAAM,OAAA,GAAU,MAAM,SAAA,CAAU,MAAA,CAAO,WAAA,CAAY,WAAW,IAAA,EAAM,CAAC,MAAA,EAAQ,QAAQ,CAAC,CAAA;AAEtF,EAAA,MAAM,GAAA,GAAM,MAAW,IAAA,CAAA,iCAAA,CAAkC,MAAA,CAAO;AAAA,IAC9D,IAAA,EAAM,QAAA;AAAA,IACN,IAAA,EAAM,OAAA;AAAA,IACN,gBAAA,EAAkB,EAAE,IAAA,EAAM,OAAA,EAAS,MAAM,SAAA;AAAU,GACpD,CAAA;AAED,EAAA,MAAM,QAAQ,MAAM,SAAA,CAAU,OAAO,SAAA,CAAU,OAAA,EAAS,QAAQ,UAAU,CAAA;AAC1E,EAAA,OAAO;AAAA,IACL,GAAA,EAAK,GAAA,CAAI,QAAA,CAAS,KAAK,CAAA;AAAA,IACvB,YAAY,KAAA,CAAM,aAAA,EAAe,MAAA,CAAO,IAAA,CAAK,KAAK,CAAC;AAAA,GACrD;AACF;AAMO,SAAS,cAAA,GAAsD;AACpE,EAAA,MAAM,EAAE,UAAA,EAAY,SAAA,EAAU,GAAI,oBAAoB,KAAA,EAAO;AAAA,IAC3D,aAAA,EAAe,IAAA;AAAA,IACf,kBAAA,EAAoB,EAAE,IAAA,EAAM,OAAA,EAAS,QAAQ,KAAA,EAAM;AAAA,IACnD,iBAAA,EAAmB,EAAE,IAAA,EAAM,MAAA,EAAQ,QAAQ,KAAA;AAAM,GAClD,CAAA;AAGD,EAAA,MAAM,OAAA,GAAU,KAAK,MAAA,EAAO,EAAG,gBAAgB,IAAA,CAAK,GAAA,EAAK,CAAA,IAAA,CAAM,CAAA;AAC/D,EAAA,MAAM,OAAA,GAAU,KAAK,MAAA,EAAO,EAAG,gBAAgB,IAAA,CAAK,GAAA,EAAK,CAAA,IAAA,CAAM,CAAA;AAE/D,EAAA,IAAI;AACF,IAAA,aAAA,CAAc,SAAS,UAAU,CAAA;AACjC,IAAA,QAAA,CAAS,CAAA,uBAAA,EAA0B,OAAO,CAAA,QAAA,EAAW,OAAO,CAAA,6BAAA,CAA+B,CAAA;AAC3F,IAAA,MAAM,GAAA,GAAM,YAAA,CAAa,OAAA,EAAS,OAAO,CAAA;AACzC,IAAA,OAAO,EAAE,KAAK,UAAA,EAAW;AAAA,EAC3B,CAAA,SAAE;AACA,IAAA,IAAI;AAAE,MAAA,UAAA,CAAW,OAAO,CAAA;AAAA,IAAG,CAAA,CAAA,MAAQ;AAAA,IAAC;AACpC,IAAA,IAAI;AAAE,MAAA,UAAA,CAAW,OAAO,CAAA;AAAA,IAAG,CAAA,CAAA,MAAQ;AAAA,IAAC;AAAA,EACtC;AACF;;;ACpDA,IAAM,aAAA,GAAgB,UAAU,QAAQ,CAAA;AAqBxC,SAAS,wBAAwB,OAAA,EAAyC;AACxE,EAAA,IAAI,OAAA,CAAQ,IAAA,EAAM,OAAO,CAAC,QAAQ,IAAI,CAAA;AAEtC,EAAA,MAAM,QAAA,GAAW,QAAQ,QAAA,IAAY,KAAA;AACrC,EAAA,IAAI,QAAQ,WAAA,EAAa;AACvB,IAAA,OAAO,aAAa,OAAA,GAAU,CAAC,qBAAqB,CAAA,GAAI,CAAC,iBAAiB,CAAA;AAAA,EAC5E;AACA,EAAA,OAAO,aAAa,OAAA,GAChB,CAAC,sBAAsB,CAAA,GACvB,CAAC,kBAAkB,CAAA;AACzB;AAEA,eAAsB,sBACpB,OAAA,EACwB;AACxB,EAAA,MAAM,KAAA,GAAQ,wBAAwB,OAAsB,CAAA;AAC5D,EAAA,MAAM,KAAA,GAAQ,MAAM,OAAA,CAAQ,MAAA,CAAO,aAAa,IAAA,CAAK;AAAA,IACnD,MAAA,EAAQ,EAAE,eAAA,EAAiB,KAAA,EAAM;AAAA,IACjC,KAAA,EAAO;AAAA,GACR,CAAA;AAED,EAAA,MAAM,GAAA,uBAAU,IAAA,EAAK;AACrB,EAAA,OAAO,KAAA,CAAM,MAAA;AAAA,IACX,CAAC,CAAA,KAAM,IAAI,KAAK,CAAA,CAAE,UAAA,CAAW,cAAc,CAAA,GAAI;AAAA,GACjD;AACF;AAEA,eAAsB,kBACpB,OAAA,EACqB;AAErB,EAAA,IAAI,CAAC,QAAQ,KAAA,EAAO;AAClB,IAAA,MAAM,QAAA,GAAW,MAAM,qBAAA,CAAsB,OAAO,CAAA;AACpD,IAAA,IAAI,QAAA,CAAS,SAAS,CAAA,EAAG;AACvB,MAAA,MAAMA,KAAAA,GAAO,SAAS,CAAC,CAAA;AACvB,MAAA,MAAMC,WAAU,MAAA,CAAO,IAAA,CAAKD,KAAAA,CAAK,UAAA,CAAW,oBAAoB,QAAQ,CAAA;AACxE,MAAA,MAAME,OAAAA,GAAqB;AAAA,QACzB,WAAA,EAAaF,KAAAA;AAAA,QACb,UAAA,EAAY,EAAA;AAAA,QACZ,kBAAA,EAAoBC;AAAA,OACtB;AAEA,MAAA,IAAI,QAAQ,SAAA,EAAW;AACrB,QAAA,MAAM,MAAM,OAAA,CAAQ,SAAA,EAAW,EAAE,SAAA,EAAW,MAAM,CAAA;AAClD,QAAA,MAAM,WAAWE,IAAAA,CAAK,OAAA,CAAQ,WAAW,CAAA,EAAGH,KAAAA,CAAK,EAAE,CAAA,IAAA,CAAM,CAAA;AACzD,QAAA,MAAM,SAAA,CAAU,UAAUC,QAAO,CAAA;AACjC,QAAAC,QAAO,QAAA,GAAW,QAAA;AAAA,MACpB;AAEA,MAAA,OAAOA,OAAAA;AAAA,IACT;AAAA,EACF;AAGA,EAAA,MAAM,KAAA,GAAQ,wBAAwB,OAAO,CAAA;AAC7C,EAAA,MAAM,EAAE,GAAA,EAAK,UAAA,EAAW,GAAI,MAAM,WAAA,EAAY;AAE9C,EAAA,MAAM,IAAA,GAAO,MAAM,OAAA,CAAQ,MAAA,CAAO,aAAa,MAAA,CAAO;AAAA,IACpD,eAAA,EAAiB,MAAM,CAAC,CAAA;AAAA,IACxB,UAAA,EAAY;AAAA,GACb,CAAA;AAED,EAAA,MAAM,UAAU,MAAA,CAAO,IAAA,CAAK,IAAA,CAAK,UAAA,CAAW,oBAAoB,QAAQ,CAAA;AAExE,EAAA,MAAM,MAAA,GAAqB;AAAA,IACzB,WAAA,EAAa,IAAA;AAAA,IACb,UAAA;AAAA,IACA,kBAAA,EAAoB;AAAA,GACtB;AAGA,EAAA,IAAI,QAAQ,SAAA,EAAW;AACrB,IAAA,MAAM,MAAM,OAAA,CAAQ,SAAA,EAAW,EAAE,SAAA,EAAW,MAAM,CAAA;AAElD,IAAA,MAAM,WAAWC,IAAAA,CAAK,OAAA,CAAQ,WAAW,CAAA,EAAG,IAAA,CAAK,EAAE,CAAA,IAAA,CAAM,CAAA;AACzD,IAAA,MAAM,SAAA,CAAU,UAAU,OAAO,CAAA;AACjC,IAAA,MAAA,CAAO,QAAA,GAAW,QAAA;AAElB,IAAA,MAAM,UAAUA,IAAAA,CAAK,OAAA,CAAQ,WAAW,CAAA,EAAG,IAAA,CAAK,EAAE,CAAA,IAAA,CAAM,CAAA;AACxD,IAAA,MAAM,SAAA,CAAU,SAAS,UAAU,CAAA;AACnC,IAAA,MAAA,CAAO,OAAA,GAAU,OAAA;AAAA,EACnB;AAGA,EAAA,IAAI,OAAA,CAAQ,YAAA,IAAgB,OAAA,CAAQ,QAAA,KAAa,QAAA,EAAU;AACzD,IAAA,MAAM,gBAAA;AAAA,MACJ,OAAA;AAAA,MACA,OAAA,CAAQ,YAAA;AAAA,MACR,OAAA,CAAQ;AAAA,KACV;AAAA,EACF;AAEA,EAAA,OAAO,MAAA;AACT;AAEA,eAAsB,iBAAA,CACpB,QACA,EAAA,EACe;AACf,EAAA,MAAM,MAAA,CAAO,YAAA,CAAa,MAAA,CAAO,EAAE,CAAA;AACrC;AAEA,eAAsB,mBAAA,CACpB,QACA,EAAA,EACiB;AACjB,EAAA,MAAM,IAAA,GAAO,MAAM,MAAA,CAAO,YAAA,CAAa,IAAI,EAAE,CAAA;AAC7C,EAAA,OAAO,MAAA,CAAO,IAAA,CAAK,IAAA,CAAK,UAAA,CAAW,oBAAoB,QAAQ,CAAA;AACjE;AAEA,eAAsB,0BACpB,OAAA,EACiB;AACjB,EAAA,MAAM,KAAA,GAAQ,wBAAwB,OAAO,CAAA;AAC7C,EAAA,MAAM,KAAA,GAAQ,MAAM,OAAA,CAAQ,MAAA,CAAO,aAAa,IAAA,CAAK;AAAA,IACnD,MAAA,EAAQ,EAAE,eAAA,EAAiB,KAAA;AAAM,GAClC,CAAA;AAED,EAAA,MAAM,GAAA,uBAAU,IAAA,EAAK;AACrB,EAAA,IAAI,KAAA,GAAQ,CAAA;AACZ,EAAA,KAAA,MAAW,QAAQ,KAAA,EAAO;AACxB,IAAA,IAAI,IAAI,IAAA,CAAK,IAAA,CAAK,UAAA,CAAW,cAAc,KAAK,GAAA,EAAK;AACnD,MAAA,IAAI;AACF,QAAA,MAAM,OAAA,CAAQ,MAAA,CAAO,YAAA,CAAa,MAAA,CAAO,KAAK,EAAE,CAAA;AAChD,QAAA,KAAA,EAAA;AAAA,MACF,CAAA,CAAA,MAAQ;AAAA,MAER;AAAA,IACF;AAAA,EACF;AACA,EAAA,OAAO,KAAA;AACT;AAEA,eAAe,gBAAA,CACb,QAAA,EACA,YAAA,EACA,gBAAA,EACe;AACf,EAAA,MAAM,EAAE,MAAA,EAAAC,OAAAA,EAAO,GAAI,MAAM,OAAO,IAAS,CAAA;AACzC,EAAA,MAAM,YAAA,GAAeD,KAAKC,OAAAA,EAAO,EAAG,iBAAiB,IAAA,CAAK,GAAA,EAAK,CAAA,IAAA,CAAM,CAAA;AACrE,EAAA,MAAM,SAAA,CAAU,cAAc,QAAQ,CAAA;AAEtC,EAAA,IAAI;AACF,IAAA,MAAM,IAAA,GAAO;AAAA,MACX,QAAA;AAAA,MACA,YAAA;AAAA,MACA,IAAA;AAAA,MACA,YAAA;AAAA,MACA,IAAA;AAAA,MACA,mBAAA;AAAA,MACA,IAAA;AAAA,MACA;AAAA,KACF;AAEA,IAAA,MAAM,aAAA,CAAc,YAAY,IAAI,CAAA;AAGpC,IAAA,IAAI,gBAAA,EAAkB;AACpB,MAAA,MAAM,cAAc,UAAA,EAAY;AAAA,QAC9B,wBAAA;AAAA,QACA,IAAA;AAAA,QACA,8BAAA;AAAA,QACA,IAAA;AAAA,QACA,IAAA;AAAA,QACA,gBAAA;AAAA,QACA;AAAA,OACD,CAAA;AAAA,IACH;AAAA,EACF,CAAA,SAAE;AACA,IAAA,MAAM,EAAE,MAAA,EAAO,GAAI,MAAM,OAAO,aAAkB,CAAA;AAClD,IAAA,MAAM,MAAA,CAAO,YAAY,CAAA,CAAE,KAAA,CAAM,MAAM;AAAA,IAAC,CAAC,CAAA;AAAA,EAC3C;AACF","file":"index.mjs","sourcesContent":["import * as x509 from \"@peculiar/x509\";\nimport { webcrypto, generateKeyPairSync } from \"node:crypto\";\nimport { execSync } from \"node:child_process\";\nimport { writeFileSync, readFileSync, unlinkSync } from \"node:fs\";\nimport { join } from \"node:path\";\nimport { tmpdir } from \"node:os\";\n\n// Register the Node.js crypto provider.\nx509.cryptoProvider.set(webcrypto as unknown as Parameters<typeof x509.cryptoProvider.set>[0]);\n\nfunction toPem(header: string, der: Buffer): string {\n  const b64 = der.toString(\"base64\");\n  const lines: string[] = [];\n  for (let i = 0; i < b64.length; i += 64) lines.push(b64.slice(i, i + 64));\n  return `-----BEGIN ${header}-----\\n${lines.join(\"\\n\")}\\n-----END ${header}-----`;\n}\n\n/**\n * Generate EC P-256 CSR — used by App Store Connect API (JWT auth).\n */\nexport async function generateCSR(): Promise<{ csr: string; privateKey: string }> {\n  const algorithm = { name: \"ECDSA\", namedCurve: \"P-256\" } as const;\n  const keyPair = await webcrypto.subtle.generateKey(algorithm, true, [\"sign\", \"verify\"]);\n\n  const csr = await x509.Pkcs10CertificateRequestGenerator.create({\n    name: \"CN=PEM\",\n    keys: keyPair,\n    signingAlgorithm: { name: \"ECDSA\", hash: \"SHA-256\" },\n  });\n\n  const pkcs8 = await webcrypto.subtle.exportKey(\"pkcs8\", keyPair.privateKey);\n  return {\n    csr: csr.toString(\"pem\"),\n    privateKey: toPem(\"PRIVATE KEY\", Buffer.from(pkcs8)),\n  };\n}\n\n/**\n * Generate RSA 2048 CSR — required by Apple Developer Portal (session auth).\n * Matches Fastlane's create_certificate_signing_request which uses RSA 2048.\n */\nexport function generateRSACSR(): { csr: string; privateKey: string } {\n  const { privateKey, publicKey } = generateKeyPairSync(\"rsa\", {\n    modulusLength: 2048,\n    privateKeyEncoding: { type: \"pkcs8\", format: \"pem\" },\n    publicKeyEncoding: { type: \"spki\", format: \"pem\" },\n  });\n\n  // Generate CSR using openssl (Node crypto doesn't have native CSR generation for RSA)\n  const keyPath = join(tmpdir(), `fastnode-rsa-${Date.now()}.pem`);\n  const csrPath = join(tmpdir(), `fastnode-rsa-${Date.now()}.csr`);\n\n  try {\n    writeFileSync(keyPath, privateKey);\n    execSync(`openssl req -new -key \"${keyPath}\" -out \"${csrPath}\" -subj \"/CN=PEM\" 2>/dev/null`);\n    const csr = readFileSync(csrPath, \"utf-8\");\n    return { csr, privateKey };\n  } finally {\n    try { unlinkSync(keyPath); } catch {}\n    try { unlinkSync(csrPath); } catch {}\n  }\n}\n","import { execFile } from \"node:child_process\";\nimport { promisify } from \"node:util\";\nimport { writeFile, mkdir } from \"node:fs/promises\";\nimport { join } from \"node:path\";\nimport { createHash } from \"node:crypto\";\nimport type { AppStoreConnectClient } from \"../client/index.js\";\nimport type { Certificate, CertificateType } from \"../types/index.js\";\nimport { generateCSR } from \"./csr.js\";\n\nconst execFileAsync = promisify(execFile);\n\nexport interface CertOptions {\n  client: AppStoreConnectClient;\n  type?: CertificateType;\n  development?: boolean;\n  force?: boolean;\n  outputDir?: string;\n  keychainPath?: string;\n  keychainPassword?: string;\n  platform?: \"ios\" | \"macos\";\n}\n\nexport interface CertResult {\n  certificate: Certificate;\n  privateKey: string;\n  certificateContent: Buffer;\n  certPath?: string;\n  p12Path?: string;\n}\n\nfunction resolveCertificateTypes(options: CertOptions): CertificateType[] {\n  if (options.type) return [options.type];\n\n  const platform = options.platform ?? \"ios\";\n  if (options.development) {\n    return platform === \"macos\" ? [\"MAC_APP_DEVELOPMENT\"] : [\"IOS_DEVELOPMENT\"];\n  }\n  return platform === \"macos\"\n    ? [\"MAC_APP_DISTRIBUTION\"]\n    : [\"IOS_DISTRIBUTION\"];\n}\n\nexport async function findValidCertificates(\n  options: Omit<CertOptions, \"force\">\n): Promise<Certificate[]> {\n  const types = resolveCertificateTypes(options as CertOptions);\n  const certs = await options.client.certificates.list({\n    filter: { certificateType: types },\n    limit: 200,\n  });\n\n  const now = new Date();\n  return certs.filter(\n    (c) => new Date(c.attributes.expirationDate) > now\n  );\n}\n\nexport async function createCertificate(\n  options: CertOptions\n): Promise<CertResult> {\n  // Check for existing valid certs unless force\n  if (!options.force) {\n    const existing = await findValidCertificates(options);\n    if (existing.length > 0) {\n      const cert = existing[0];\n      const content = Buffer.from(cert.attributes.certificateContent, \"base64\");\n      const result: CertResult = {\n        certificate: cert,\n        privateKey: \"\",\n        certificateContent: content,\n      };\n\n      if (options.outputDir) {\n        await mkdir(options.outputDir, { recursive: true });\n        const certPath = join(options.outputDir, `${cert.id}.cer`);\n        await writeFile(certPath, content);\n        result.certPath = certPath;\n      }\n\n      return result;\n    }\n  }\n\n  // Generate CSR and create new certificate\n  const types = resolveCertificateTypes(options);\n  const { csr, privateKey } = await generateCSR();\n\n  const cert = await options.client.certificates.create({\n    certificateType: types[0],\n    csrContent: csr,\n  });\n\n  const content = Buffer.from(cert.attributes.certificateContent, \"base64\");\n\n  const result: CertResult = {\n    certificate: cert,\n    privateKey,\n    certificateContent: content,\n  };\n\n  // Write files if outputDir provided\n  if (options.outputDir) {\n    await mkdir(options.outputDir, { recursive: true });\n\n    const certPath = join(options.outputDir, `${cert.id}.cer`);\n    await writeFile(certPath, content);\n    result.certPath = certPath;\n\n    const keyPath = join(options.outputDir, `${cert.id}.p12`);\n    await writeFile(keyPath, privateKey);\n    result.p12Path = keyPath;\n  }\n\n  // Import to keychain if on macOS\n  if (options.keychainPath && process.platform === \"darwin\") {\n    await importToKeychain(\n      content,\n      options.keychainPath,\n      options.keychainPassword\n    );\n  }\n\n  return result;\n}\n\nexport async function revokeCertificate(\n  client: AppStoreConnectClient,\n  id: string\n): Promise<void> {\n  await client.certificates.revoke(id);\n}\n\nexport async function downloadCertificate(\n  client: AppStoreConnectClient,\n  id: string\n): Promise<Buffer> {\n  const cert = await client.certificates.get(id);\n  return Buffer.from(cert.attributes.certificateContent, \"base64\");\n}\n\nexport async function revokeExpiredCertificates(\n  options: CertOptions\n): Promise<number> {\n  const types = resolveCertificateTypes(options);\n  const certs = await options.client.certificates.list({\n    filter: { certificateType: types },\n  });\n\n  const now = new Date();\n  let count = 0;\n  for (const cert of certs) {\n    if (new Date(cert.attributes.expirationDate) <= now) {\n      try {\n        await options.client.certificates.revoke(cert.id);\n        count++;\n      } catch {\n        // Ignore revocation failures for already-revoked certs\n      }\n    }\n  }\n  return count;\n}\n\nasync function importToKeychain(\n  certData: Buffer,\n  keychainPath: string,\n  keychainPassword?: string\n): Promise<void> {\n  const { tmpdir } = await import(\"node:os\");\n  const tempCertPath = join(tmpdir(), `fastnode-cert-${Date.now()}.cer`);\n  await writeFile(tempCertPath, certData);\n\n  try {\n    const args = [\n      \"import\",\n      tempCertPath,\n      \"-k\",\n      keychainPath,\n      \"-T\",\n      \"/usr/bin/codesign\",\n      \"-T\",\n      \"/usr/bin/security\",\n    ];\n\n    await execFileAsync(\"security\", args);\n\n    // Set partition list if keychain password provided\n    if (keychainPassword) {\n      await execFileAsync(\"security\", [\n        \"set-key-partition-list\",\n        \"-S\",\n        \"apple-tool:,apple:,codesign:\",\n        \"-s\",\n        \"-k\",\n        keychainPassword,\n        keychainPath,\n      ]);\n    }\n  } finally {\n    const { unlink } = await import(\"node:fs/promises\");\n    await unlink(tempCertPath).catch(() => {});\n  }\n}\n"]}

package/dist/cert-BmJGtYtb.d.cts

@@ -0,0 +1,27 @@
+import { A as AppStoreConnectClient, C as Certificate } from './index-BLubSlgK.cjs';
+import { C as CertificateType } from './enums-B609j2rb.cjs';
+
+interface CertOptions {
+    client: AppStoreConnectClient;
+    type?: CertificateType;
+    development?: boolean;
+    force?: boolean;
+    outputDir?: string;
+    keychainPath?: string;
+    keychainPassword?: string;
+    platform?: "ios" | "macos";
+}
+interface CertResult {
+    certificate: Certificate;
+    privateKey: string;
+    certificateContent: Buffer;
+    certPath?: string;
+    p12Path?: string;
+}
+declare function findValidCertificates(options: Omit<CertOptions, "force">): Promise<Certificate[]>;
+declare function createCertificate(options: CertOptions): Promise<CertResult>;
+declare function revokeCertificate(client: AppStoreConnectClient, id: string): Promise<void>;
+declare function downloadCertificate(client: AppStoreConnectClient, id: string): Promise<Buffer>;
+declare function revokeExpiredCertificates(options: CertOptions): Promise<number>;
+
+export { type CertOptions as C, type CertResult as a, revokeExpiredCertificates as b, createCertificate as c, downloadCertificate as d, findValidCertificates as f, revokeCertificate as r };

package/dist/cert-owkOFNW8.d.ts

@@ -0,0 +1,27 @@
+import { A as AppStoreConnectClient, C as Certificate } from './index-D1Izm7qt.js';
+import { C as CertificateType } from './enums-B609j2rb.js';
+
+interface CertOptions {
+    client: AppStoreConnectClient;
+    type?: CertificateType;
+    development?: boolean;
+    force?: boolean;
+    outputDir?: string;
+    keychainPath?: string;
+    keychainPassword?: string;
+    platform?: "ios" | "macos";
+}
+interface CertResult {
+    certificate: Certificate;
+    privateKey: string;
+    certificateContent: Buffer;
+    certPath?: string;
+    p12Path?: string;
+}
+declare function findValidCertificates(options: Omit<CertOptions, "force">): Promise<Certificate[]>;
+declare function createCertificate(options: CertOptions): Promise<CertResult>;
+declare function revokeCertificate(client: AppStoreConnectClient, id: string): Promise<void>;
+declare function downloadCertificate(client: AppStoreConnectClient, id: string): Promise<Buffer>;
+declare function revokeExpiredCertificates(options: CertOptions): Promise<number>;
+
+export { type CertOptions as C, type CertResult as a, revokeExpiredCertificates as b, createCertificate as c, downloadCertificate as d, findValidCertificates as f, revokeCertificate as r };