@alchemy.run/acme 0.0.0 → 2.0.0-beta.85

package/lib/Certificate.d.ts

@@ -0,0 +1,138 @@
+import * as Provider from "alchemy/Provider";
+import { Resource } from "alchemy/Resource";
+import * as Duration from "effect/Duration";
+import type * as Redacted from "effect/Redacted";
+import type { Account } from "./Account.ts";
+import type { PropagationOptions } from "./Dns.ts";
+import { type DnsSolverDescriptor } from "./DnsSolver.ts";
+import type { KeyAlgorithm } from "./Pki.ts";
+import type { Providers } from "./Providers.ts";
+export interface CertificateProps {
+    /** The {@link Account} that orders the certificate. Changing it replaces. */
+    account: Account;
+    /**
+     * DNS names the certificate covers. The first is the subject CN;
+     * wildcards (`*.example.com`) are allowed. Changing the set re-issues.
+     */
+    identifiers: string[];
+    /**
+     * How `_acme-challenge` TXT records are published, e.g.
+     * `Cloudflare.ACME.ZoneSolver(zone)`. Changing the solver alone does not
+     * re-issue.
+     */
+    solver: DnsSolverDescriptor;
+    /**
+     * Certificate key algorithm. Changing it re-issues the certificate.
+     * @default "ES256"
+     */
+    keyAlgorithm?: KeyAlgorithm;
+    /**
+     * Re-issue when less than this remains before `notAfter`. Renewal is a
+     * `diff` result, so any `alchemy deploy` (a scheduled one, typically)
+     * renews.
+     * @default "30 days"
+     */
+    renewBefore?: Duration.Input;
+    /**
+     * Revoke the certificate at the CA when the resource is deleted. By
+     * default deletion only forgets the certificate.
+     * @default false
+     */
+    revokeOnDelete?: boolean;
+    /**
+     * Issuer name to prefer (`CN=…` substring, e.g. `ISRG Root X1`) when the
+     * CA offers alternate chains.
+     */
+    preferredChain?: string;
+    /** DNS propagation polling (resolvers, timeout, interval). */
+    propagation?: PropagationOptions;
+}
+export interface Certificate extends Resource<"ACME.Certificate", CertificateProps, {
+    /** Leaf certificate PEM. */
+    certificate: string;
+    /** Full chain PEM, leaf first. */
+    chain: string;
+    /** PKCS#8 private key PEM. Sensitive; persisted in stack state. */
+    privateKey: Redacted.Redacted<string>;
+    /** Serial number, hex. */
+    serial: string;
+    /** ISO 8601 validity start. */
+    notBefore: string;
+    /** ISO 8601 expiry. Renewal is scheduled against it. */
+    notAfter: string;
+    /** Issuer distinguished name. */
+    issuer: string;
+    /** The DNS names covered. */
+    identifiers: string[];
+    /** The CA's certificate URL. */
+    certificateUrl: string;
+    /** The CA's order URL. */
+    orderUrl: string;
+    /** Key algorithm of `privateKey`. */
+    keyAlgorithm: KeyAlgorithm;
+    /** The account that issued the certificate. */
+    accountUrl: string;
+    /** The CA the certificate was issued by (for revocation on delete). */
+    directoryUrl: string;
+    /** PEM root trusted for the CA's endpoint (private CAs only). */
+    trustedRoot: string | undefined;
+}, never, Providers> {
+}
+/**
+ * A TLS certificate issued over ACME at deploy time, with renewal.
+ *
+ * Reconcile places an order, proves control of every name over DNS-01
+ * through the `solver`, finalizes with a fresh key's CSR and stores the
+ * chain and redacted private key in state. Protect the state store as
+ * secret material. `diff` reports an update when the
+ * names change or when `renewBefore` of validity remains, so a scheduled
+ * `alchemy deploy` keeps certificates fresh.
+ *
+ * ### Wildcard certificate
+ * **Example:** Let's Encrypt wildcard over Cloudflare DNS
+ * ```typescript
+ * const account = yield* ACME.Account("Issuer", {
+ *   ca: ACME.LetsEncrypt,
+ *   termsOfServiceAgreed: true,
+ * });
+ * const zone = yield* Zone;
+ * const wildcard = yield* ACME.Certificate("Wildcard", {
+ *   account,
+ *   identifiers: ["*.example.com", "example.com"],
+ *   solver: Cloudflare.ACME.ZoneSolver(zone),
+ * });
+ * ```
+ *
+ * ### Using the certificate
+ * The chain and key are Outputs — pass them to whatever terminates TLS.
+ *
+ * **Example:** Upload to a Fly App
+ * ```typescript
+ * const www = yield* Fly.Certificate("Www", {
+ *   app: Site,
+ *   hostname: "www.example.com",
+ *   kind: "custom",
+ *   fullchain: wildcard.chain,
+ *   privateKey: wildcard.privateKey,
+ * });
+ * ```
+ *
+ * ### Renewal
+ * **Example:** Renew earlier and revoke on delete
+ * ```typescript
+ * const api = yield* ACME.Certificate("Api", {
+ *   account,
+ *   identifiers: ["api.example.com"],
+ *   solver: Cloudflare.ACME.ZoneSolver(zone),
+ *   renewBefore: "45 days",
+ *   revokeOnDelete: true,
+ * });
+ * ```
+ *
+ * @resource
+ * @product Certificate
+ * @category Certificates
+ */
+export declare const Certificate: import("alchemy/Resource").ResourceClass<Certificate>;
+export declare const CertificateProvider: () => import("effect/Layer").Layer<Provider.Provider<Certificate>, never, never>;
+//# sourceMappingURL=Certificate.d.ts.map

package/lib/Certificate.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"Certificate.d.ts","sourceRoot":"","sources":["../src/Certificate.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,QAAQ,MAAM,kBAAkB,CAAC;AAC7C,OAAO,EAAE,QAAQ,EAAE,MAAM,kBAAkB,CAAC;AAE5C,OAAO,KAAK,QAAQ,MAAM,iBAAiB,CAAC;AAE5C,OAAO,KAAK,KAAK,QAAQ,MAAM,iBAAiB,CAAC;AACjD,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,cAAc,CAAC;AAO5C,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,UAAU,CAAC;AACnD,OAAO,EAAoB,KAAK,mBAAmB,EAAE,MAAM,gBAAgB,CAAC;AAC5E,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,UAAU,CAAC;AAC7C,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,gBAAgB,CAAC;AAEhD,MAAM,WAAW,gBAAgB;IAC/B,6EAA6E;IAC7E,OAAO,EAAE,OAAO,CAAC;IACjB;;;OAGG;IACH,WAAW,EAAE,MAAM,EAAE,CAAC;IACtB;;;;OAIG;IACH,MAAM,EAAE,mBAAmB,CAAC;IAC5B;;;OAGG;IACH,YAAY,CAAC,EAAE,YAAY,CAAC;IAC5B;;;;;OAKG;IACH,WAAW,CAAC,EAAE,QAAQ,CAAC,KAAK,CAAC;IAC7B;;;;OAIG;IACH,cAAc,CAAC,EAAE,OAAO,CAAC;IACzB;;;OAGG;IACH,cAAc,CAAC,EAAE,MAAM,CAAC;IACxB,8DAA8D;IAC9D,WAAW,CAAC,EAAE,kBAAkB,CAAC;CAClC;AAED,MAAM,WAAW,WAAY,SAAQ,QAAQ,CAC3C,kBAAkB,EAClB,gBAAgB,EAChB;IACE,4BAA4B;IAC5B,WAAW,EAAE,MAAM,CAAC;IACpB,kCAAkC;IAClC,KAAK,EAAE,MAAM,CAAC;IACd,mEAAmE;IACnE,UAAU,EAAE,QAAQ,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC;IACtC,0BAA0B;IAC1B,MAAM,EAAE,MAAM,CAAC;IACf,+BAA+B;IAC/B,SAAS,EAAE,MAAM,CAAC;IAClB,wDAAwD;IACxD,QAAQ,EAAE,MAAM,CAAC;IACjB,iCAAiC;IACjC,MAAM,EAAE,MAAM,CAAC;IACf,6BAA6B;IAC7B,WAAW,EAAE,MAAM,EAAE,CAAC;IACtB,gCAAgC;IAChC,cAAc,EAAE,MAAM,CAAC;IACvB,0BAA0B;IAC1B,QAAQ,EAAE,MAAM,CAAC;IACjB,qCAAqC;IACrC,YAAY,EAAE,YAAY,CAAC;IAC3B,+CAA+C;IAC/C,UAAU,EAAE,MAAM,CAAC;IACnB,uEAAuE;IACvE,YAAY,EAAE,MAAM,CAAC;IACrB,iEAAiE;IACjE,WAAW,EAAE,MAAM,GAAG,SAAS,CAAC;CACjC,EACD,KAAK,EACL,SAAS,CACV;CAAG;AAEJ;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAsDG;AACH,eAAO,MAAM,WAAW,uDAA4C,CAAC;AA0BrE,eAAO,MAAM,mBAAmB,kFA6F5B,CAAC"}

package/lib/Certificate.js

@@ -0,0 +1,157 @@
+import { isResolved } from "alchemy/Diff";
+import * as Provider from "alchemy/Provider";
+import { Resource } from "alchemy/Resource";
+import { arrayEqualsUnordered } from "alchemy/Util/equal";
+import * as Duration from "effect/Duration";
+import * as Effect from "effect/Effect";
+import { accountLayer, issueCertificate, revokeCertificate, } from "./Client.js";
+import { resolveDnsSolver } from "./DnsSolver.js";
+/**
+ * A TLS certificate issued over ACME at deploy time, with renewal.
+ *
+ * Reconcile places an order, proves control of every name over DNS-01
+ * through the `solver`, finalizes with a fresh key's CSR and stores the
+ * chain and redacted private key in state. Protect the state store as
+ * secret material. `diff` reports an update when the
+ * names change or when `renewBefore` of validity remains, so a scheduled
+ * `alchemy deploy` keeps certificates fresh.
+ *
+ * ### Wildcard certificate
+ * **Example:** Let's Encrypt wildcard over Cloudflare DNS
+ * ```typescript
+ * const account = yield* ACME.Account("Issuer", {
+ *   ca: ACME.LetsEncrypt,
+ *   termsOfServiceAgreed: true,
+ * });
+ * const zone = yield* Zone;
+ * const wildcard = yield* ACME.Certificate("Wildcard", {
+ *   account,
+ *   identifiers: ["*.example.com", "example.com"],
+ *   solver: Cloudflare.ACME.ZoneSolver(zone),
+ * });
+ * ```
+ *
+ * ### Using the certificate
+ * The chain and key are Outputs — pass them to whatever terminates TLS.
+ *
+ * **Example:** Upload to a Fly App
+ * ```typescript
+ * const www = yield* Fly.Certificate("Www", {
+ *   app: Site,
+ *   hostname: "www.example.com",
+ *   kind: "custom",
+ *   fullchain: wildcard.chain,
+ *   privateKey: wildcard.privateKey,
+ * });
+ * ```
+ *
+ * ### Renewal
+ * **Example:** Renew earlier and revoke on delete
+ * ```typescript
+ * const api = yield* ACME.Certificate("Api", {
+ *   account,
+ *   identifiers: ["api.example.com"],
+ *   solver: Cloudflare.ACME.ZoneSolver(zone),
+ *   renewBefore: "45 days",
+ *   revokeOnDelete: true,
+ * });
+ * ```
+ *
+ * @resource
+ * @product Certificate
+ * @category Certificates
+ */
+export const Certificate = Resource("ACME.Certificate");
+/** The resolved account attributes behind a resource-valued prop. */
+const accountOf = (value) => value;
+const credentialsOf = (account) => ({
+    ca: { directoryUrl: account.directoryUrl, trustedRoot: account.trustedRoot },
+    accountKey: account.privateKey,
+    accountUrl: account.accountUrl,
+});
+const DEFAULT_RENEW_BEFORE = "30 days";
+const renewalDue = (notAfter, renewBefore, now) => Date.parse(notAfter) - now < Duration.toMillis(renewBefore ?? DEFAULT_RENEW_BEFORE);
+export const CertificateProvider = () => Provider.succeed(Certificate, {
+    stables: ["directoryUrl"],
+    diff: Effect.fn(function* ({ news, olds, output }) {
+        if (news === undefined || !isResolved(news) || output === undefined) {
+            return undefined;
+        }
+        const account = accountOf(news.account);
+        if (account.accountUrl !== output.accountUrl) {
+            return { action: "replace" };
+        }
+        const now = yield* Effect.sync(() => Date.now());
+        const reissue = !arrayEqualsUnordered(news.identifiers, output.identifiers) ||
+            (news.keyAlgorithm ?? "ES256") !== output.keyAlgorithm ||
+            news.preferredChain !== olds?.preferredChain ||
+            renewalDue(output.notAfter, news.renewBefore, now);
+        return reissue ? { action: "update" } : undefined;
+    }),
+    read: Effect.fn(function* ({ output }) {
+        return output;
+    }),
+    reconcile: Effect.fn(function* ({ news, olds, output }) {
+        const account = accountOf(news.account);
+        const keyAlgorithm = news.keyAlgorithm ?? "ES256";
+        const now = yield* Effect.sync(() => Date.now());
+        // Observe: the stored certificate is authoritative — nothing to do
+        // while it covers the names and isn't due.
+        if (output !== undefined &&
+            output.accountUrl === account.accountUrl &&
+            arrayEqualsUnordered(news.identifiers, output.identifiers) &&
+            output.keyAlgorithm === keyAlgorithm &&
+            news.preferredChain === olds?.preferredChain &&
+            !renewalDue(output.notAfter, news.renewBefore, now)) {
+            return {
+                ...output,
+                directoryUrl: account.directoryUrl,
+                trustedRoot: account.trustedRoot,
+            };
+        }
+        const solver = yield* resolveDnsSolver(news.solver);
+        const issued = yield* issueCertificate({
+            identifiers: news.identifiers,
+            solver,
+            keyAlgorithm,
+            preferredChain: news.preferredChain,
+            propagation: news.propagation,
+        }).pipe(Effect.provide(accountLayer(credentialsOf(account))));
+        return {
+            certificate: issued.certificate,
+            chain: issued.chain,
+            privateKey: issued.privateKey,
+            serial: issued.serial,
+            notBefore: issued.notBefore,
+            notAfter: issued.notAfter,
+            issuer: issued.issuer,
+            identifiers: [...news.identifiers],
+            certificateUrl: issued.certificateUrl,
+            orderUrl: issued.orderUrl,
+            keyAlgorithm,
+            accountUrl: account.accountUrl,
+            directoryUrl: account.directoryUrl,
+            trustedRoot: account.trustedRoot,
+        };
+    }),
+    delete: Effect.fn(function* ({ olds, output }) {
+        if (olds.revokeOnDelete !== true)
+            return;
+        const account = accountOf(olds.account);
+        // Signed with the certificate's own key, so revocation works even
+        // after the account was replaced or deactivated.
+        yield* revokeCertificate({
+            certificate: output.certificate,
+            privateKey: output.privateKey,
+            reason: "cessationOfOperation",
+        }).pipe(Effect.provide(accountLayer({
+            ca: {
+                directoryUrl: output.directoryUrl,
+                trustedRoot: output.trustedRoot,
+            },
+            accountKey: account.privateKey,
+            accountUrl: account.accountUrl,
+        })));
+    }),
+});
+//# sourceMappingURL=Certificate.js.map

package/lib/Certificate.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"Certificate.js","sourceRoot":"","sources":["../src/Certificate.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,UAAU,EAAE,MAAM,cAAc,CAAC;AAC1C,OAAO,KAAK,QAAQ,MAAM,kBAAkB,CAAC;AAC7C,OAAO,EAAE,QAAQ,EAAE,MAAM,kBAAkB,CAAC;AAC5C,OAAO,EAAE,oBAAoB,EAAE,MAAM,oBAAoB,CAAC;AAC1D,OAAO,KAAK,QAAQ,MAAM,iBAAiB,CAAC;AAC5C,OAAO,KAAK,MAAM,MAAM,eAAe,CAAC;AAGxC,OAAO,EACL,YAAY,EACZ,gBAAgB,EAChB,iBAAiB,GAElB,MAAM,aAAa,CAAC;AAErB,OAAO,EAAE,gBAAgB,EAA4B,MAAM,gBAAgB,CAAC;AAkF5E;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAsDG;AACH,MAAM,CAAC,MAAM,WAAW,GAAG,QAAQ,CAAc,kBAAkB,CAAC,CAAC;AASrE,qEAAqE;AACrE,MAAM,SAAS,GAAG,CAAC,KAAc,EAAc,EAAE,CAAC,KAAmB,CAAC;AAEtE,MAAM,aAAa,GAAG,CAAC,OAAmB,EAAsB,EAAE,CAAC,CAAC;IAClE,EAAE,EAAE,EAAE,YAAY,EAAE,OAAO,CAAC,YAAY,EAAE,WAAW,EAAE,OAAO,CAAC,WAAW,EAAE;IAC5E,UAAU,EAAE,OAAO,CAAC,UAAU;IAC9B,UAAU,EAAE,OAAO,CAAC,UAAU;CAC/B,CAAC,CAAC;AAEH,MAAM,oBAAoB,GAAmB,SAAS,CAAC;AAEvD,MAAM,UAAU,GAAG,CACjB,QAAgB,EAChB,WAAuC,EACvC,GAAW,EACF,EAAE,CAAC,IAAI,CAAC,KAAK,CAAC,QAAQ,CAAC,GAAG,GAAG,GAAG,QAAQ,CAAC,QAAQ,CAAC,WAAW,IAAI,oBAAoB,CAAC,CAAC;AAElG,MAAM,CAAC,MAAM,mBAAmB,GAAG,GAAG,EAAE,CACtC,QAAQ,CAAC,OAAO,CAAC,WAAW,EAAE;IAC5B,OAAO,EAAE,CAAC,cAAc,CAAC;IAEzB,IAAI,EAAE,MAAM,CAAC,EAAE,CAAC,QAAQ,CAAC,EAAE,EAAE,IAAI,EAAE,IAAI,EAAE,MAAM,EAAE;QAC/C,IAAI,IAAI,KAAK,SAAS,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC,IAAI,MAAM,KAAK,SAAS,EAAE,CAAC;YACpE,OAAO,SAAS,CAAC;QACnB,CAAC;QACD,MAAM,OAAO,GAAG,SAAS,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;QACxC,IAAI,OAAO,CAAC,UAAU,KAAK,MAAM,CAAC,UAAU,EAAE,CAAC;YAC7C,OAAO,EAAE,MAAM,EAAE,SAAkB,EAAE,CAAC;QACxC,CAAC;QACD,MAAM,GAAG,GAAG,KAAK,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,GAAG,EAAE,CAAC,IAAI,CAAC,GAAG,EAAE,CAAC,CAAC;QACjD,MAAM,OAAO,GACX,CAAC,oBAAoB,CAAC,IAAI,CAAC,WAAW,EAAE,MAAM,CAAC,WAAW,CAAC;YAC3D,CAAC,IAAI,CAAC,YAAY,IAAI,OAAO,CAAC,KAAK,MAAM,CAAC,YAAY;YACtD,IAAI,CAAC,cAAc,KAAK,IAAI,EAAE,cAAc;YAC5C,UAAU,CAAC,MAAM,CAAC,QAAQ,EAAE,IAAI,CAAC,WAAW,EAAE,GAAG,CAAC,CAAC;QACrD,OAAO,OAAO,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,QAAiB,EAAE,CAAC,CAAC,CAAC,SAAS,CAAC;IAC7D,CAAC,CAAC;IAEF,IAAI,EAAE,MAAM,CAAC,EAAE,CAAC,QAAQ,CAAC,EAAE,EAAE,MAAM,EAAE;QACnC,OAAO,MAAM,CAAC;IAChB,CAAC,CAAC;IAEF,SAAS,EAAE,MAAM,CAAC,EAAE,CAAC,QAAQ,CAAC,EAAE,EAAE,IAAI,EAAE,IAAI,EAAE,MAAM,EAAE;QACpD,MAAM,OAAO,GAAG,SAAS,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;QACxC,MAAM,YAAY,GAAG,IAAI,CAAC,YAAY,IAAI,OAAO,CAAC;QAClD,MAAM,GAAG,GAAG,KAAK,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,GAAG,EAAE,CAAC,IAAI,CAAC,GAAG,EAAE,CAAC,CAAC;QACjD,mEAAmE;QACnE,2CAA2C;QAC3C,IACE,MAAM,KAAK,SAAS;YACpB,MAAM,CAAC,UAAU,KAAK,OAAO,CAAC,UAAU;YACxC,oBAAoB,CAAC,IAAI,CAAC,WAAW,EAAE,MAAM,CAAC,WAAW,CAAC;YAC1D,MAAM,CAAC,YAAY,KAAK,YAAY;YACpC,IAAI,CAAC,cAAc,KAAK,IAAI,EAAE,cAAc;YAC5C,CAAC,UAAU,CAAC,MAAM,CAAC,QAAQ,EAAE,IAAI,CAAC,WAAW,EAAE,GAAG,CAAC,EACnD,CAAC;YACD,OAAO;gBACL,GAAG,MAAM;gBACT,YAAY,EAAE,OAAO,CAAC,YAAY;gBAClC,WAAW,EAAE,OAAO,CAAC,WAAW;aACjC,CAAC;QACJ,CAAC;QACD,MAAM,MAAM,GAAG,KAAK,CAAC,CAAC,gBAAgB,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;QACpD,MAAM,MAAM,GAAG,KAAK,CAAC,CAAC,gBAAgB,CAAC;YACrC,WAAW,EAAE,IAAI,CAAC,WAAW;YAC7B,MAAM;YACN,YAAY;YACZ,cAAc,EAAE,IAAI,CAAC,cAAc;YACnC,WAAW,EAAE,IAAI,CAAC,WAAW;SAC9B,CAAC,CAAC,IAAI,CAAC,MAAM,CAAC,OAAO,CAAC,YAAY,CAAC,aAAa,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,CAAC;QAC9D,OAAO;YACL,WAAW,EAAE,MAAM,CAAC,WAAW;YAC/B,KAAK,EAAE,MAAM,CAAC,KAAK;YACnB,UAAU,EAAE,MAAM,CAAC,UAAU;YAC7B,MAAM,EAAE,MAAM,CAAC,MAAM;YACrB,SAAS,EAAE,MAAM,CAAC,SAAS;YAC3B,QAAQ,EAAE,MAAM,CAAC,QAAQ;YACzB,MAAM,EAAE,MAAM,CAAC,MAAM;YACrB,WAAW,EAAE,CAAC,GAAG,IAAI,CAAC,WAAW,CAAC;YAClC,cAAc,EAAE,MAAM,CAAC,cAAc;YACrC,QAAQ,EAAE,MAAM,CAAC,QAAQ;YACzB,YAAY;YACZ,UAAU,EAAE,OAAO,CAAC,UAAU;YAC9B,YAAY,EAAE,OAAO,CAAC,YAAY;YAClC,WAAW,EAAE,OAAO,CAAC,WAAW;SACjC,CAAC;IACJ,CAAC,CAAC;IAEF,MAAM,EAAE,MAAM,CAAC,EAAE,CAAC,QAAQ,CAAC,EAAE,EAAE,IAAI,EAAE,MAAM,EAAE;QAC3C,IAAI,IAAI,CAAC,cAAc,KAAK,IAAI;YAAE,OAAO;QACzC,MAAM,OAAO,GAAG,SAAS,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;QACxC,kEAAkE;QAClE,iDAAiD;QACjD,KAAK,CAAC,CAAC,iBAAiB,CAAC;YACvB,WAAW,EAAE,MAAM,CAAC,WAAW;YAC/B,UAAU,EAAE,MAAM,CAAC,UAAU;YAC7B,MAAM,EAAE,sBAAsB;SAC/B,CAAC,CAAC,IAAI,CACL,MAAM,CAAC,OAAO,CACZ,YAAY,CAAC;YACX,EAAE,EAAE;gBACF,YAAY,EAAE,MAAM,CAAC,YAAY;gBACjC,WAAW,EAAE,MAAM,CAAC,WAAW;aAChC;YACD,UAAU,EAAE,OAAO,CAAC,UAAU;YAC9B,UAAU,EAAE,OAAO,CAAC,UAAU;SAC/B,CAAC,CACH,CACF,CAAC;IACJ,CAAC,CAAC;CACH,CAAC,CAAC"}

package/lib/CertificateAuthority.d.ts

@@ -0,0 +1,25 @@
+/**
+ * An ACME certificate authority: its directory URL plus, for private CAs
+ * (Pebble, step-ca), the PEM root that signs the CA's own HTTPS endpoint.
+ */
+export interface CertificateAuthority {
+    /** The CA's ACME directory URL. */
+    readonly directoryUrl: string;
+    /**
+     * PEM root certificate to trust for the CA's HTTPS endpoint. Only for
+     * private CAs whose API certificate is not publicly trusted; public CAs
+     * leave it unset.
+     */
+    readonly trustedRoot?: string | undefined;
+}
+/** Let's Encrypt production. No External Account Binding. */
+export declare const LetsEncrypt: CertificateAuthority;
+/** Let's Encrypt staging: generous limits, untrusted chain. */
+export declare const LetsEncryptStaging: CertificateAuthority;
+/** ZeroSSL. Requires an External Account Binding (`eab`). */
+export declare const ZeroSSL: CertificateAuthority;
+/** Google Trust Services. Requires an External Account Binding (`eab`). */
+export declare const GoogleTrustServices: CertificateAuthority;
+/** Google Trust Services staging. */
+export declare const GoogleTrustServicesStaging: CertificateAuthority;
+//# sourceMappingURL=CertificateAuthority.d.ts.map

package/lib/CertificateAuthority.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"CertificateAuthority.d.ts","sourceRoot":"","sources":["../src/CertificateAuthority.ts"],"names":[],"mappings":"AAEA;;;GAGG;AACH,MAAM,WAAW,oBAAoB;IACnC,mCAAmC;IACnC,QAAQ,CAAC,YAAY,EAAE,MAAM,CAAC;IAC9B;;;;OAIG;IACH,QAAQ,CAAC,WAAW,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;CAC3C;AAED,6DAA6D;AAC7D,eAAO,MAAM,WAAW,EAAE,oBAEzB,CAAC;AAEF,+DAA+D;AAC/D,eAAO,MAAM,kBAAkB,EAAE,oBAEhC,CAAC;AAEF,6DAA6D;AAC7D,eAAO,MAAM,OAAO,EAAE,oBAErB,CAAC;AAEF,2EAA2E;AAC3E,eAAO,MAAM,mBAAmB,EAAE,oBAEjC,CAAC;AAEF,qCAAqC;AACrC,eAAO,MAAM,0BAA0B,EAAE,oBAExC,CAAC"}

package/lib/CertificateAuthority.js

@@ -0,0 +1,22 @@
+import { Directories } from "@distilled.cloud/acme";
+/** Let's Encrypt production. No External Account Binding. */
+export const LetsEncrypt = {
+    directoryUrl: Directories.LetsEncrypt,
+};
+/** Let's Encrypt staging: generous limits, untrusted chain. */
+export const LetsEncryptStaging = {
+    directoryUrl: Directories.LetsEncryptStaging,
+};
+/** ZeroSSL. Requires an External Account Binding (`eab`). */
+export const ZeroSSL = {
+    directoryUrl: Directories.ZeroSSL,
+};
+/** Google Trust Services. Requires an External Account Binding (`eab`). */
+export const GoogleTrustServices = {
+    directoryUrl: Directories.GoogleTrustServices,
+};
+/** Google Trust Services staging. */
+export const GoogleTrustServicesStaging = {
+    directoryUrl: Directories.GoogleTrustServicesStaging,
+};
+//# sourceMappingURL=CertificateAuthority.js.map

package/lib/CertificateAuthority.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"CertificateAuthority.js","sourceRoot":"","sources":["../src/CertificateAuthority.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,WAAW,EAAE,MAAM,uBAAuB,CAAC;AAiBpD,6DAA6D;AAC7D,MAAM,CAAC,MAAM,WAAW,GAAyB;IAC/C,YAAY,EAAE,WAAW,CAAC,WAAW;CACtC,CAAC;AAEF,+DAA+D;AAC/D,MAAM,CAAC,MAAM,kBAAkB,GAAyB;IACtD,YAAY,EAAE,WAAW,CAAC,kBAAkB;CAC7C,CAAC;AAEF,6DAA6D;AAC7D,MAAM,CAAC,MAAM,OAAO,GAAyB;IAC3C,YAAY,EAAE,WAAW,CAAC,OAAO;CAClC,CAAC;AAEF,2EAA2E;AAC3E,MAAM,CAAC,MAAM,mBAAmB,GAAyB;IACvD,YAAY,EAAE,WAAW,CAAC,mBAAmB;CAC9C,CAAC;AAEF,qCAAqC;AACrC,MAAM,CAAC,MAAM,0BAA0B,GAAyB;IAC9D,YAAY,EAAE,WAAW,CAAC,0BAA0B;CACrD,CAAC"}

package/lib/Client.d.ts

@@ -0,0 +1,89 @@
+/**
+ * The ACME issuance flow shared by the `Certificate` resource (deploy time)
+ * and the `IssueCertificate` binding (runtime):
+ *
+ *   order → DNS-01 per authorization (present → propagated → respond →
+ *   poll) → finalize with a fresh key's CSR → download → parse.
+ *
+ * The wire is `@distilled.cloud/acme`; this file only sequences it.
+ */
+import * as Acme from "@distilled.cloud/acme";
+import * as acme from "@distilled.cloud/acme/acme";
+import * as Effect from "effect/Effect";
+import * as HttpClient from "effect/http/HttpClient";
+import * as Layer from "effect/Layer";
+import * as Redacted from "effect/Redacted";
+import type { CertificateAuthority } from "./CertificateAuthority.ts";
+import { type PropagationOptions } from "./Dns.ts";
+import type { DnsSolver } from "./DnsSolver.ts";
+import { ChallengeFailed, ChallengeUnsupported, OrderInvalid, OrderTimeout, PkiError, type DnsPropagationTimeout, type DnsSolverError } from "./Errors.ts";
+import { type KeyAlgorithm } from "./Pki.ts";
+/** Everything the flow needs to sign requests as an account. */
+export interface AccountCredentials {
+    readonly ca: CertificateAuthority;
+    /** The account's private JWK (JSON). */
+    readonly accountKey: Redacted.Redacted<string>;
+    /** The account URL (`kid`), once the account exists. */
+    readonly accountUrl?: string | undefined;
+    readonly externalAccountBinding?: {
+        readonly keyId: string;
+        readonly hmacKey: Redacted.Redacted<string>;
+    } | undefined;
+}
+/**
+ * The SDK's `Credentials` (+ a CA-trusting `HttpClient` for private CAs)
+ * for one account. Provide around any `@distilled.cloud/acme` call.
+ */
+export declare const accountLayer: (credentials: AccountCredentials) => Layer.Layer<Acme.Credentials | HttpClient.HttpClient>;
+export interface IssueRequest<R = never> {
+    /** DNS names; the first is the subject CN. Wildcards allowed. */
+    readonly identifiers: ReadonlyArray<string>;
+    readonly solver: DnsSolver<R>;
+    /** @default "ES256" */
+    readonly keyAlgorithm?: KeyAlgorithm | undefined;
+    /** Issuer name (`CN=...` substring) to prefer when the CA offers alternate chains. */
+    readonly preferredChain?: string | undefined;
+    readonly propagation?: PropagationOptions | undefined;
+}
+export interface IssuedCertificate {
+    /** Leaf certificate PEM. */
+    readonly certificate: string;
+    /** Full chain PEM, leaf first. */
+    readonly chain: string;
+    /** PKCS#8 private key PEM. */
+    readonly privateKey: Redacted.Redacted<string>;
+    readonly identifiers: ReadonlyArray<string>;
+    readonly serial: string;
+    /** ISO 8601. */
+    readonly notBefore: string;
+    /** ISO 8601. */
+    readonly notAfter: string;
+    readonly issuer: string;
+    /** The CA's certificate URL (for re-download and revocation bookkeeping). */
+    readonly certificateUrl: string;
+    readonly orderUrl: string;
+}
+export type IssueError = OrderInvalid | ChallengeFailed | ChallengeUnsupported | OrderTimeout | DnsPropagationTimeout | DnsSolverError | PkiError | Acme.JoseError | acme.NewOrderError | acme.GetAuthorizationError | acme.RespondChallengeError | acme.FinalizeOrderError | acme.GetOrderError | acme.DownloadCertificateError;
+/**
+ * Issue a certificate for `identifiers` as the current `Credentials`
+ * account. Requires the SDK's `Credentials` and an `HttpClient` (see
+ * {@link accountLayer}) plus whatever the solver needs.
+ */
+export declare const issueCertificate: <R = never>(request: IssueRequest<R>) => Effect.Effect<IssuedCertificate, IssueError, Acme.Credentials | HttpClient.HttpClient | R>;
+/** RFC 5280 revocation reasons. */
+export type RevocationReason = "unspecified" | "keyCompromise" | "affiliationChanged" | "superseded" | "cessationOfOperation";
+export interface RevokeRequest {
+    /** Leaf certificate PEM. */
+    readonly certificate: string;
+    /**
+     * The certificate's private key. When given, the request is signed with
+     * it (RFC 8555 §7.6) so no account is needed; otherwise the ambient
+     * account credentials sign.
+     */
+    readonly privateKey?: Redacted.Redacted<string> | string | undefined;
+    readonly reason?: RevocationReason | undefined;
+}
+export type RevokeError = PkiError | acme.RevokeCertificateError;
+/** Revoke a certificate. `AcmeAlreadyRevoked` is folded into success. */
+export declare const revokeCertificate: (request: RevokeRequest) => Effect.Effect<void, RevokeError, Acme.Credentials | HttpClient.HttpClient>;
+//# sourceMappingURL=Client.d.ts.map

package/lib/Client.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"Client.d.ts","sourceRoot":"","sources":["../src/Client.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AACH,OAAO,KAAK,IAAI,MAAM,uBAAuB,CAAC;AAC9C,OAAO,KAAK,IAAI,MAAM,4BAA4B,CAAC;AACnD,OAAO,KAAK,MAAM,MAAM,eAAe,CAAC;AAExC,OAAO,KAAK,UAAU,MAAM,wBAAwB,CAAC;AACrD,OAAO,KAAK,KAAK,MAAM,cAAc,CAAC;AACtC,OAAO,KAAK,QAAQ,MAAM,iBAAiB,CAAC;AAE5C,OAAO,KAAK,EAAE,oBAAoB,EAAE,MAAM,2BAA2B,CAAC;AACtE,OAAO,EAAc,KAAK,kBAAkB,EAAE,MAAM,UAAU,CAAC;AAC/D,OAAO,KAAK,EAAsB,SAAS,EAAE,MAAM,gBAAgB,CAAC;AACpE,OAAO,EACL,eAAe,EACf,oBAAoB,EACpB,YAAY,EACZ,YAAY,EACZ,QAAQ,EACR,KAAK,qBAAqB,EAC1B,KAAK,cAAc,EACpB,MAAM,aAAa,CAAC;AACrB,OAAO,EAQL,KAAK,YAAY,EAElB,MAAM,UAAU,CAAC;AAElB,gEAAgE;AAChE,MAAM,WAAW,kBAAkB;IACjC,QAAQ,CAAC,EAAE,EAAE,oBAAoB,CAAC;IAClC,wCAAwC;IACxC,QAAQ,CAAC,UAAU,EAAE,QAAQ,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC;IAC/C,wDAAwD;IACxD,QAAQ,CAAC,UAAU,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;IACzC,QAAQ,CAAC,sBAAsB,CAAC,EAC5B;QAAE,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;QAAC,QAAQ,CAAC,OAAO,EAAE,QAAQ,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAA;KAAE,GACvE,SAAS,CAAC;CACf;AAED;;;GAGG;AACH,eAAO,MAAM,YAAY,gBACV,kBAAkB,KAC9B,KAAK,CAAC,KAAK,CAAC,IAAI,CAAC,WAAW,GAAG,UAAU,CAAC,UAAU,CAmBtD,CAAC;AAEF,MAAM,WAAW,YAAY,CAAC,CAAC,GAAG,KAAK;IACrC,iEAAiE;IACjE,QAAQ,CAAC,WAAW,EAAE,aAAa,CAAC,MAAM,CAAC,CAAC;IAC5C,QAAQ,CAAC,MAAM,EAAE,SAAS,CAAC,CAAC,CAAC,CAAC;IAC9B,uBAAuB;IACvB,QAAQ,CAAC,YAAY,CAAC,EAAE,YAAY,GAAG,SAAS,CAAC;IACjD,sFAAsF;IACtF,QAAQ,CAAC,cAAc,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;IAC7C,QAAQ,CAAC,WAAW,CAAC,EAAE,kBAAkB,GAAG,SAAS,CAAC;CACvD;AAED,MAAM,WAAW,iBAAiB;IAChC,4BAA4B;IAC5B,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAC;IAC7B,kCAAkC;IAClC,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;IACvB,8BAA8B;IAC9B,QAAQ,CAAC,UAAU,EAAE,QAAQ,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC;IAC/C,QAAQ,CAAC,WAAW,EAAE,aAAa,CAAC,MAAM,CAAC,CAAC;IAC5C,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IACxB,gBAAgB;IAChB,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;IAC3B,gBAAgB;IAChB,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;IAC1B,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IACxB,6EAA6E;IAC7E,QAAQ,CAAC,cAAc,EAAE,MAAM,CAAC;IAChC,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;CAC3B;AAED,MAAM,MAAM,UAAU,GAClB,YAAY,GACZ,eAAe,GACf,oBAAoB,GACpB,YAAY,GACZ,qBAAqB,GACrB,cAAc,GACd,QAAQ,GACR,IAAI,CAAC,SAAS,GACd,IAAI,CAAC,aAAa,GAClB,IAAI,CAAC,qBAAqB,GAC1B,IAAI,CAAC,qBAAqB,GAC1B,IAAI,CAAC,kBAAkB,GACvB,IAAI,CAAC,aAAa,GAClB,IAAI,CAAC,wBAAwB,CAAC;AA8GlC;;;;GAIG;AACH,eAAO,MAAM,gBAAgB,GAAI,CAAC,GAAG,KAAK,WAC/B,YAAY,CAAC,CAAC,CAAC,KACvB,MAAM,CAAC,MAAM,CAAC,iBAAiB,EAAE,UAAU,EAAE,IAAI,CAAC,WAAW,GAAG,UAAU,CAAC,UAAU,GAAG,CAAC,CAmFxF,CAAC;AAuBL,mCAAmC;AACnC,MAAM,MAAM,gBAAgB,GACxB,aAAa,GACb,eAAe,GACf,oBAAoB,GACpB,YAAY,GACZ,sBAAsB,CAAC;AAU3B,MAAM,WAAW,aAAa;IAC5B,4BAA4B;IAC5B,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAC;IAC7B;;;;OAIG;IACH,QAAQ,CAAC,UAAU,CAAC,EAAE,QAAQ,CAAC,QAAQ,CAAC,MAAM,CAAC,GAAG,MAAM,GAAG,SAAS,CAAC;IACrE,QAAQ,CAAC,MAAM,CAAC,EAAE,gBAAgB,GAAG,SAAS,CAAC;CAChD;AAED,MAAM,MAAM,WAAW,GAAG,QAAQ,GAAG,IAAI,CAAC,sBAAsB,CAAC;AAEjE,yEAAyE;AACzE,eAAO,MAAM,iBAAiB,YACnB,aAAa,KACrB,MAAM,CAAC,MAAM,CAAC,IAAI,EAAE,WAAW,EAAE,IAAI,CAAC,WAAW,GAAG,UAAU,CAAC,UAAU,CAwBxE,CAAC"}