@alchemy.run/acme 0.0.0 → 2.0.0-beta.85

package/lib/Pki.js

@@ -0,0 +1,182 @@
+import { Jose } from "@distilled.cloud/acme";
+/**
+ * Keys, PKCS#10 certificate requests and X.509 parsing for the ACME flow.
+ * WebCrypto plus the tiny DER codec in `Der.ts` — no native code, so the
+ * same code runs at deploy time and inside a Worker or Fly Service.
+ */
+import * as Effect from "effect/Effect";
+import * as Redacted from "effect/Redacted";
+import * as Der from "./Der.js";
+import { PkiError } from "./Errors.js";
+const OID = {
+    commonName: "2.5.4.3",
+    organization: "2.5.4.10",
+    extensionRequest: "1.2.840.113549.1.9.14",
+    subjectAltName: "2.5.29.17",
+    ecdsaWithSha256: "1.2.840.10045.4.3.2",
+    sha256WithRsa: "1.2.840.113549.1.1.11",
+};
+const keyGenParams = (alg) => alg === "RS256"
+    ? {
+        name: "RSASSA-PKCS1-v1_5",
+        modulusLength: 2048,
+        publicExponent: new Uint8Array([1, 0, 1]),
+        hash: "SHA-256",
+    }
+    : { name: "ECDSA", namedCurve: "P-256" };
+const importParams = (alg) => alg === "RS256"
+    ? { name: "RSASSA-PKCS1-v1_5", hash: "SHA-256" }
+    : { name: "ECDSA", namedCurve: "P-256" };
+const signParams = (alg) => alg === "RS256" ? { name: "RSASSA-PKCS1-v1_5" } : { name: "ECDSA", hash: "SHA-256" };
+const toPem = (label, der) => {
+    const b64 = btoa(String.fromCharCode(...der));
+    const lines = b64.match(/.{1,64}/g) ?? [];
+    return `-----BEGIN ${label}-----\n${lines.join("\n")}\n-----END ${label}-----\n`;
+};
+/** The DER bytes of the first (or `index`-th) PEM block in `pem`. */
+export const fromPem = (pem, index = 0) => {
+    const blocks = pem.match(/-----BEGIN [^-]+-----[\s\S]*?-----END [^-]+-----/g);
+    const block = blocks?.[index];
+    if (block === undefined) {
+        throw new Error(`PEM block ${index} not found`);
+    }
+    const body = block
+        .replace(/-----BEGIN [^-]+-----/, "")
+        .replace(/-----END [^-]+-----/, "")
+        .replace(/\s+/g, "");
+    const binary = atob(body);
+    const out = new Uint8Array(binary.length);
+    for (let i = 0; i < binary.length; i++)
+        out[i] = binary.charCodeAt(i);
+    return out;
+};
+/** Every PEM block in a chain, leaf first. */
+export const splitPemChain = (pem) => pem.match(/-----BEGIN [^-]+-----[\s\S]*?-----END [^-]+-----/g) ?? [];
+const tryPromise = (message, run) => Effect.tryPromise({
+    try: run,
+    catch: (cause) => new PkiError({ message, cause }),
+});
+/** Generate a certificate key pair (ES256 P-256 by default). */
+export const generateKey = (algorithm = "ES256") => tryPromise("Generating the certificate key failed.", async () => {
+    const pair = await crypto.subtle.generateKey(keyGenParams(algorithm), true, ["sign", "verify"]);
+    const pkcs8 = new Uint8Array(await crypto.subtle.exportKey("pkcs8", pair.privateKey));
+    const spki = new Uint8Array(await crypto.subtle.exportKey("spki", pair.publicKey));
+    return {
+        algorithm,
+        privateKeyPem: Redacted.make(toPem("PRIVATE KEY", pkcs8)),
+        privateKey: pair.privateKey,
+        spki,
+    };
+});
+const algorithmOfPkcs8 = (der) => {
+    // PrivateKeyInfo ::= SEQUENCE { version, AlgorithmIdentifier, ... }
+    const root = Der.read(der, 0);
+    const [, algorithm] = Der.children(root);
+    const [algOid] = Der.children(algorithm);
+    return Der.decodeOid(algOid) === "1.2.840.113549.1.1.1" ? "RS256" : "ES256";
+};
+/** Import a PKCS#8 PEM private key (ES256 or RS256, detected from the DER). */
+export const importPrivateKey = (pem) => tryPromise("Importing the certificate key failed.", async () => {
+    const text = Redacted.isRedacted(pem) ? Redacted.value(pem) : pem;
+    const der = fromPem(text);
+    const algorithm = algorithmOfPkcs8(der);
+    const key = await crypto.subtle.importKey("pkcs8", der, importParams(algorithm), true, ["sign"]);
+    return { key, algorithm };
+});
+/** The private JWK of a PKCS#8 PEM key (for revocation signed by the certificate key). */
+export const privateKeyToJwk = (pem) => importPrivateKey(pem).pipe(Effect.flatMap(({ key }) => tryPromise("Exporting the certificate key as a JWK failed.", async () => Redacted.make(JSON.stringify(await crypto.subtle.exportKey("jwk", key))))));
+/** Raw `r || s` ECDSA signature → DER `SEQUENCE { r INTEGER, s INTEGER }`. */
+const ecdsaToDer = (raw) => {
+    const half = raw.length / 2;
+    return Der.sequence(Der.integer(raw.subarray(0, half)), Der.integer(raw.subarray(half)));
+};
+/**
+ * A PKCS#10 certificate request for `identifiers` signed by `key`: the
+ * first identifier is the subject CN, all of them are `subjectAltName`
+ * dNSName entries. Returned as DER.
+ */
+export const createCsr = (options) => tryPromise("Encoding the certificate request failed.", async () => {
+    const { key, identifiers } = options;
+    if (identifiers.length === 0) {
+        throw new Error("a certificate needs at least one identifier");
+    }
+    const subject = Der.sequence(Der.set(Der.sequence(Der.oid(OID.commonName), Der.utf8String(identifiers[0]))));
+    const sanExtension = Der.sequence(Der.oid(OID.subjectAltName), Der.octetString(Der.sequence(...identifiers.map((name) => Der.contextPrimitive(2, new TextEncoder().encode(name))))));
+    const attributes = Der.contextTag(0, Der.sequence(Der.oid(OID.extensionRequest), Der.set(Der.sequence(sanExtension))));
+    const info = Der.sequence(Der.integer(0), subject, key.spki, attributes);
+    const rawSignature = new Uint8Array(await crypto.subtle.sign(signParams(key.algorithm), key.privateKey, info));
+    const signature = key.algorithm === "ES256" ? ecdsaToDer(rawSignature) : rawSignature;
+    const algorithm = key.algorithm === "ES256"
+        ? Der.sequence(Der.oid(OID.ecdsaWithSha256))
+        : Der.sequence(Der.oid(OID.sha256WithRsa), Der.nullValue());
+    return Der.sequence(info, algorithm, Der.bitString(signature));
+});
+/** base64url of a DER CSR, as ACME's `finalize` expects. */
+export const csrToBase64Url = (der) => Jose.base64url(der);
+const decodeName = (name) => {
+    const parts = [];
+    for (const rdn of Der.children(name)) {
+        for (const attribute of Der.children(rdn)) {
+            const [typeNode, valueNode] = Der.children(attribute);
+            const type = Der.decodeOid(typeNode);
+            const value = new TextDecoder().decode(Der.content(valueNode));
+            const label = type === OID.commonName
+                ? "CN"
+                : type === OID.organization
+                    ? "O"
+                    : type === "2.5.4.6"
+                        ? "C"
+                        : type;
+            parts.push(`${label}=${value}`);
+        }
+    }
+    // CN first for readability; the rest keep their order.
+    parts.sort((a, b) => (a.startsWith("CN=") ? -1 : b.startsWith("CN=") ? 1 : 0));
+    return parts.join(", ");
+};
+/** Parse the first certificate of a PEM (or a DER buffer). */
+export const parseCertificate = (input) => Effect.try({
+    try: () => {
+        const der = typeof input === "string" ? fromPem(input) : input;
+        const certificate = Der.read(der, 0);
+        const [tbs] = Der.children(certificate);
+        const fields = Der.children(tbs);
+        let index = 0;
+        if (fields[0].tag === 0xa0)
+            index++; // [0] EXPLICIT version
+        const serial = Der.toHex(Der.content(fields[index++]));
+        index++; // signature AlgorithmIdentifier
+        const issuer = decodeName(fields[index++]);
+        const [notBeforeNode, notAfterNode] = Der.children(fields[index++]);
+        const subject = decodeName(fields[index++]);
+        index++; // subjectPublicKeyInfo
+        const dnsNames = [];
+        for (const field of fields.slice(index)) {
+            if (field.tag !== 0xa3)
+                continue; // [3] EXPLICIT extensions
+            const [extensions] = Der.children(field);
+            for (const extension of Der.children(extensions)) {
+                const members = Der.children(extension);
+                if (Der.decodeOid(members[0]) !== OID.subjectAltName)
+                    continue;
+                const valueNode = members[members.length - 1]; // OCTET STRING (critical may precede)
+                const generalNames = Der.read(Der.content(valueNode), 0);
+                for (const generalName of Der.children(generalNames)) {
+                    if (generalName.tag === 0x82) {
+                        dnsNames.push(new TextDecoder().decode(Der.content(generalName)));
+                    }
+                }
+            }
+        }
+        return {
+            serial: serial.replace(/^00/, "") || "0",
+            notBefore: Der.decodeTime(notBeforeNode),
+            notAfter: Der.decodeTime(notAfterNode),
+            issuer,
+            subject,
+            dnsNames,
+        };
+    },
+    catch: (cause) => new PkiError({ message: "Parsing the certificate failed.", cause }),
+});
+//# sourceMappingURL=Pki.js.map

package/lib/Pki.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"Pki.js","sourceRoot":"","sources":["../src/Pki.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,IAAI,EAAE,MAAM,uBAAuB,CAAC;AAC7C;;;;GAIG;AACH,OAAO,KAAK,MAAM,MAAM,eAAe,CAAC;AACxC,OAAO,KAAK,QAAQ,MAAM,iBAAiB,CAAC;AAC5C,OAAO,KAAK,GAAG,MAAM,UAAU,CAAC;AAChC,OAAO,EAAE,QAAQ,EAAE,MAAM,aAAa,CAAC;AAIvC,MAAM,GAAG,GAAG;IACV,UAAU,EAAE,SAAS;IACrB,YAAY,EAAE,UAAU;IACxB,gBAAgB,EAAE,uBAAuB;IACzC,cAAc,EAAE,WAAW;IAC3B,eAAe,EAAE,qBAAqB;IACtC,aAAa,EAAE,uBAAuB;CAC9B,CAAC;AAEX,MAAM,YAAY,GAAG,CAAC,GAAiB,EAAE,EAAE,CACzC,GAAG,KAAK,OAAO;IACb,CAAC,CAAC;QACE,IAAI,EAAE,mBAAmB;QACzB,aAAa,EAAE,IAAI;QACnB,cAAc,EAAE,IAAI,UAAU,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,CAAC,CAAC,CAAC;QACzC,IAAI,EAAE,SAAS;KAChB;IACH,CAAC,CAAC,EAAE,IAAI,EAAE,OAAO,EAAE,UAAU,EAAE,OAAO,EAAE,CAAC;AAE7C,MAAM,YAAY,GAAG,CAAC,GAAiB,EAAE,EAAE,CACzC,GAAG,KAAK,OAAO;IACb,CAAC,CAAC,EAAE,IAAI,EAAE,mBAAmB,EAAE,IAAI,EAAE,SAAS,EAAE;IAChD,CAAC,CAAC,EAAE,IAAI,EAAE,OAAO,EAAE,UAAU,EAAE,OAAO,EAAE,CAAC;AAE7C,MAAM,UAAU,GAAG,CAAC,GAAiB,EAAE,EAAE,CACvC,GAAG,KAAK,OAAO,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,mBAAmB,EAAE,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,OAAO,EAAE,IAAI,EAAE,SAAS,EAAE,CAAC;AAEvF,MAAM,KAAK,GAAG,CAAC,KAAa,EAAE,GAAe,EAAU,EAAE;IACvD,MAAM,GAAG,GAAG,IAAI,CAAC,MAAM,CAAC,YAAY,CAAC,GAAG,GAAG,CAAC,CAAC,CAAC;IAC9C,MAAM,KAAK,GAAG,GAAG,CAAC,KAAK,CAAC,UAAU,CAAC,IAAI,EAAE,CAAC;IAC1C,OAAO,cAAc,KAAK,UAAU,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,cAAc,KAAK,SAAS,CAAC;AACnF,CAAC,CAAC;AAEF,qEAAqE;AACrE,MAAM,CAAC,MAAM,OAAO,GAAG,CAAC,GAAW,EAAE,KAAK,GAAG,CAAC,EAAc,EAAE;IAC5D,MAAM,MAAM,GAAG,GAAG,CAAC,KAAK,CAAC,mDAAmD,CAAC,CAAC;IAC9E,MAAM,KAAK,GAAG,MAAM,EAAE,CAAC,KAAK,CAAC,CAAC;IAC9B,IAAI,KAAK,KAAK,SAAS,EAAE,CAAC;QACxB,MAAM,IAAI,KAAK,CAAC,aAAa,KAAK,YAAY,CAAC,CAAC;IAClD,CAAC;IACD,MAAM,IAAI,GAAG,KAAK;SACf,OAAO,CAAC,uBAAuB,EAAE,EAAE,CAAC;SACpC,OAAO,CAAC,qBAAqB,EAAE,EAAE,CAAC;SAClC,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC;IACvB,MAAM,MAAM,GAAG,IAAI,CAAC,IAAI,CAAC,CAAC;IAC1B,MAAM,GAAG,GAAG,IAAI,UAAU,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC;IAC1C,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,MAAM,CAAC,MAAM,EAAE,CAAC,EAAE;QAAE,GAAG,CAAC,CAAC,CAAC,GAAG,MAAM,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC;IACtE,OAAO,GAAG,CAAC;AACb,CAAC,CAAC;AAEF,8CAA8C;AAC9C,MAAM,CAAC,MAAM,aAAa,GAAG,CAAC,GAAW,EAAY,EAAE,CACrD,GAAG,CAAC,KAAK,CAAC,mDAAmD,CAAC,IAAI,EAAE,CAAC;AAEvE,MAAM,UAAU,GAAG,CAAI,OAAe,EAAE,GAAqB,EAAE,EAAE,CAC/D,MAAM,CAAC,UAAU,CAAC;IAChB,GAAG,EAAE,GAAG;IACR,KAAK,EAAE,CAAC,KAAK,EAAE,EAAE,CAAC,IAAI,QAAQ,CAAC,EAAE,OAAO,EAAE,KAAK,EAAE,CAAC;CACnD,CAAC,CAAC;AAWL,gEAAgE;AAChE,MAAM,CAAC,MAAM,WAAW,GAAG,CACzB,SAAS,GAAiB,OAAO,EACM,EAAE,CACzC,UAAU,CAAC,wCAAwC,EAAE,KAAK,IAAI,EAAE;IAC9D,MAAM,IAAI,GAAG,MAAM,MAAM,CAAC,MAAM,CAAC,WAAW,CAAC,YAAY,CAAC,SAAS,CAAC,EAAE,IAAI,EAAE,CAAC,MAAM,EAAE,QAAQ,CAAC,CAAC,CAAC;IAChG,MAAM,KAAK,GAAG,IAAI,UAAU,CAAC,MAAM,MAAM,CAAC,MAAM,CAAC,SAAS,CAAC,OAAO,EAAE,IAAI,CAAC,UAAU,CAAC,CAAC,CAAC;IACtF,MAAM,IAAI,GAAG,IAAI,UAAU,CAAC,MAAM,MAAM,CAAC,MAAM,CAAC,SAAS,CAAC,MAAM,EAAE,IAAI,CAAC,SAAS,CAAC,CAAC,CAAC;IACnF,OAAO;QACL,SAAS;QACT,aAAa,EAAE,QAAQ,CAAC,IAAI,CAAC,KAAK,CAAC,aAAa,EAAE,KAAK,CAAC,CAAC;QACzD,UAAU,EAAE,IAAI,CAAC,UAAU;QAC3B,IAAI;KACL,CAAC;AACJ,CAAC,CAAC,CAAC;AAEL,MAAM,gBAAgB,GAAG,CAAC,GAAe,EAAgB,EAAE;IACzD,oEAAoE;IACpE,MAAM,IAAI,GAAG,GAAG,CAAC,IAAI,CAAC,GAAG,EAAE,CAAC,CAAC,CAAC;IAC9B,MAAM,CAAC,EAAE,SAAS,CAAC,GAAG,GAAG,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC;IACzC,MAAM,CAAC,MAAM,CAAC,GAAG,GAAG,CAAC,QAAQ,CAAC,SAAU,CAAC,CAAC;IAC1C,OAAO,GAAG,CAAC,SAAS,CAAC,MAAO,CAAC,KAAK,sBAAsB,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,OAAO,CAAC;AAC/E,CAAC,CAAC;AAEF,+EAA+E;AAC/E,MAAM,CAAC,MAAM,gBAAgB,GAAG,CAC9B,GAAuC,EACiD,EAAE,CAC1F,UAAU,CAAC,uCAAuC,EAAE,KAAK,IAAI,EAAE;IAC7D,MAAM,IAAI,GAAG,QAAQ,CAAC,UAAU,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC;IAClE,MAAM,GAAG,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IAC1B,MAAM,SAAS,GAAG,gBAAgB,CAAC,GAAG,CAAC,CAAC;IACxC,MAAM,GAAG,GAAG,MAAM,MAAM,CAAC,MAAM,CAAC,SAAS,CACvC,OAAO,EACP,GAA8B,EAC9B,YAAY,CAAC,SAAS,CAAC,EACvB,IAAI,EACJ,CAAC,MAAM,CAAC,CACT,CAAC;IACF,OAAO,EAAE,GAAG,EAAE,SAAS,EAAE,CAAC;AAC5B,CAAC,CAAC,CAAC;AAEL,0FAA0F;AAC1F,MAAM,CAAC,MAAM,eAAe,GAAG,CAC7B,GAAuC,EACa,EAAE,CACtD,gBAAgB,CAAC,GAAG,CAAC,CAAC,IAAI,CACxB,MAAM,CAAC,OAAO,CAAC,CAAC,EAAE,GAAG,EAAE,EAAE,EAAE,CACzB,UAAU,CAAC,gDAAgD,EAAE,KAAK,IAAI,EAAE,CACtE,QAAQ,CAAC,IAAI,CAAC,IAAI,CAAC,SAAS,CAAC,MAAM,MAAM,CAAC,MAAM,CAAC,SAAS,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC,CAAC,CACzE,CACF,CACF,CAAC;AAEJ,8EAA8E;AAC9E,MAAM,UAAU,GAAG,CAAC,GAAe,EAAc,EAAE;IACjD,MAAM,IAAI,GAAG,GAAG,CAAC,MAAM,GAAG,CAAC,CAAC;IAC5B,OAAO,GAAG,CAAC,QAAQ,CAAC,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC,EAAE,IAAI,CAAC,CAAC,EAAE,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;AAC3F,CAAC,CAAC;AAEF;;;;GAIG;AACH,MAAM,CAAC,MAAM,SAAS,GAAG,CAAC,OAGzB,EAAuC,EAAE,CACxC,UAAU,CAAC,0CAA0C,EAAE,KAAK,IAAI,EAAE;IAChE,MAAM,EAAE,GAAG,EAAE,WAAW,EAAE,GAAG,OAAO,CAAC;IACrC,IAAI,WAAW,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QAC7B,MAAM,IAAI,KAAK,CAAC,6CAA6C,CAAC,CAAC;IACjE,CAAC;IACD,MAAM,OAAO,GAAG,GAAG,CAAC,QAAQ,CAC1B,GAAG,CAAC,GAAG,CAAC,GAAG,CAAC,QAAQ,CAAC,GAAG,CAAC,GAAG,CAAC,GAAG,CAAC,UAAU,CAAC,EAAE,GAAG,CAAC,UAAU,CAAC,WAAW,CAAC,CAAC,CAAE,CAAC,CAAC,CAAC,CAChF,CAAC;IACF,MAAM,YAAY,GAAG,GAAG,CAAC,QAAQ,CAC/B,GAAG,CAAC,GAAG,CAAC,GAAG,CAAC,cAAc,CAAC,EAC3B,GAAG,CAAC,WAAW,CACb,GAAG,CAAC,QAAQ,CACV,GAAG,WAAW,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,GAAG,CAAC,gBAAgB,CAAC,CAAC,EAAE,IAAI,WAAW,EAAE,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,CACtF,CACF,CACF,CAAC;IACF,MAAM,UAAU,GAAG,GAAG,CAAC,UAAU,CAC/B,CAAC,EACD,GAAG,CAAC,QAAQ,CAAC,GAAG,CAAC,GAAG,CAAC,GAAG,CAAC,gBAAgB,CAAC,EAAE,GAAG,CAAC,GAAG,CAAC,GAAG,CAAC,QAAQ,CAAC,YAAY,CAAC,CAAC,CAAC,CACjF,CAAC;IACF,MAAM,IAAI,GAAG,GAAG,CAAC,QAAQ,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,OAAO,EAAE,GAAG,CAAC,IAAI,EAAE,UAAU,CAAC,CAAC;IACzE,MAAM,YAAY,GAAG,IAAI,UAAU,CACjC,MAAM,MAAM,CAAC,MAAM,CAAC,IAAI,CACtB,UAAU,CAAC,GAAG,CAAC,SAAS,CAAC,EACzB,GAAG,CAAC,UAAU,EACd,IAA+B,CAChC,CACF,CAAC;IACF,MAAM,SAAS,GAAG,GAAG,CAAC,SAAS,KAAK,OAAO,CAAC,CAAC,CAAC,UAAU,CAAC,YAAY,CAAC,CAAC,CAAC,CAAC,YAAY,CAAC;IACtF,MAAM,SAAS,GACb,GAAG,CAAC,SAAS,KAAK,OAAO;QACvB,CAAC,CAAC,GAAG,CAAC,QAAQ,CAAC,GAAG,CAAC,GAAG,CAAC,GAAG,CAAC,eAAe,CAAC,CAAC;QAC5C,CAAC,CAAC,GAAG,CAAC,QAAQ,CAAC,GAAG,CAAC,GAAG,CAAC,GAAG,CAAC,aAAa,CAAC,EAAE,GAAG,CAAC,SAAS,EAAE,CAAC,CAAC;IAChE,OAAO,GAAG,CAAC,QAAQ,CAAC,IAAI,EAAE,SAAS,EAAE,GAAG,CAAC,SAAS,CAAC,SAAS,CAAC,CAAC,CAAC;AACjE,CAAC,CAAC,CAAC;AAEL,4DAA4D;AAC5D,MAAM,CAAC,MAAM,cAAc,GAAG,CAAC,GAAe,EAAU,EAAE,CAAC,IAAI,CAAC,SAAS,CAAC,GAAG,CAAC,CAAC;AAmB/E,MAAM,UAAU,GAAG,CAAC,IAAc,EAAU,EAAE;IAC5C,MAAM,KAAK,GAAa,EAAE,CAAC;IAC3B,KAAK,MAAM,GAAG,IAAI,GAAG,CAAC,QAAQ,CAAC,IAAI,CAAC,EAAE,CAAC;QACrC,KAAK,MAAM,SAAS,IAAI,GAAG,CAAC,QAAQ,CAAC,GAAG,CAAC,EAAE,CAAC;YAC1C,MAAM,CAAC,QAAQ,EAAE,SAAS,CAAC,GAAG,GAAG,CAAC,QAAQ,CAAC,SAAS,CAAC,CAAC;YACtD,MAAM,IAAI,GAAG,GAAG,CAAC,SAAS,CAAC,QAAS,CAAC,CAAC;YACtC,MAAM,KAAK,GAAG,IAAI,WAAW,EAAE,CAAC,MAAM,CAAC,GAAG,CAAC,OAAO,CAAC,SAAU,CAAC,CAAC,CAAC;YAChE,MAAM,KAAK,GACT,IAAI,KAAK,GAAG,CAAC,UAAU;gBACrB,CAAC,CAAC,IAAI;gBACN,CAAC,CAAC,IAAI,KAAK,GAAG,CAAC,YAAY;oBACzB,CAAC,CAAC,GAAG;oBACL,CAAC,CAAC,IAAI,KAAK,SAAS;wBAClB,CAAC,CAAC,GAAG;wBACL,CAAC,CAAC,IAAI,CAAC;YACf,KAAK,CAAC,IAAI,CAAC,GAAG,KAAK,IAAI,KAAK,EAAE,CAAC,CAAC;QAClC,CAAC;IACH,CAAC;IACD,uDAAuD;IACvD,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,UAAU,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,UAAU,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;IAC/E,OAAO,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;AAC1B,CAAC,CAAC;AAEF,8DAA8D;AAC9D,MAAM,CAAC,MAAM,gBAAgB,GAAG,CAC9B,KAA0B,EACkB,EAAE,CAC9C,MAAM,CAAC,GAAG,CAAC;IACT,GAAG,EAAE,GAAG,EAAE;QACR,MAAM,GAAG,GAAG,OAAO,KAAK,KAAK,QAAQ,CAAC,CAAC,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC;QAC/D,MAAM,WAAW,GAAG,GAAG,CAAC,IAAI,CAAC,GAAG,EAAE,CAAC,CAAC,CAAC;QACrC,MAAM,CAAC,GAAG,CAAC,GAAG,GAAG,CAAC,QAAQ,CAAC,WAAW,CAAC,CAAC;QACxC,MAAM,MAAM,GAAG,GAAG,CAAC,QAAQ,CAAC,GAAI,CAAC,CAAC;QAClC,IAAI,KAAK,GAAG,CAAC,CAAC;QACd,IAAI,MAAM,CAAC,CAAC,CAAE,CAAC,GAAG,KAAK,IAAI;YAAE,KAAK,EAAE,CAAC,CAAC,uBAAuB;QAC7D,MAAM,MAAM,GAAG,GAAG,CAAC,KAAK,CAAC,GAAG,CAAC,OAAO,CAAC,MAAM,CAAC,KAAK,EAAE,CAAE,CAAC,CAAC,CAAC;QACxD,KAAK,EAAE,CAAC,CAAC,gCAAgC;QACzC,MAAM,MAAM,GAAG,UAAU,CAAC,MAAM,CAAC,KAAK,EAAE,CAAE,CAAC,CAAC;QAC5C,MAAM,CAAC,aAAa,EAAE,YAAY,CAAC,GAAG,GAAG,CAAC,QAAQ,CAAC,MAAM,CAAC,KAAK,EAAE,CAAE,CAAC,CAAC;QACrE,MAAM,OAAO,GAAG,UAAU,CAAC,MAAM,CAAC,KAAK,EAAE,CAAE,CAAC,CAAC;QAC7C,KAAK,EAAE,CAAC,CAAC,uBAAuB;QAChC,MAAM,QAAQ,GAAa,EAAE,CAAC;QAC9B,KAAK,MAAM,KAAK,IAAI,MAAM,CAAC,KAAK,CAAC,KAAK,CAAC,EAAE,CAAC;YACxC,IAAI,KAAK,CAAC,GAAG,KAAK,IAAI;gBAAE,SAAS,CAAC,0BAA0B;YAC5D,MAAM,CAAC,UAAU,CAAC,GAAG,GAAG,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC;YACzC,KAAK,MAAM,SAAS,IAAI,GAAG,CAAC,QAAQ,CAAC,UAAW,CAAC,EAAE,CAAC;gBAClD,MAAM,OAAO,GAAG,GAAG,CAAC,QAAQ,CAAC,SAAS,CAAC,CAAC;gBACxC,IAAI,GAAG,CAAC,SAAS,CAAC,OAAO,CAAC,CAAC,CAAE,CAAC,KAAK,GAAG,CAAC,cAAc;oBAAE,SAAS;gBAChE,MAAM,SAAS,GAAG,OAAO,CAAC,OAAO,CAAC,MAAM,GAAG,CAAC,CAAE,CAAC,CAAC,sCAAsC;gBACtF,MAAM,YAAY,GAAG,GAAG,CAAC,IAAI,CAAC,GAAG,CAAC,OAAO,CAAC,SAAS,CAAC,EAAE,CAAC,CAAC,CAAC;gBACzD,KAAK,MAAM,WAAW,IAAI,GAAG,CAAC,QAAQ,CAAC,YAAY,CAAC,EAAE,CAAC;oBACrD,IAAI,WAAW,CAAC,GAAG,KAAK,IAAI,EAAE,CAAC;wBAC7B,QAAQ,CAAC,IAAI,CAAC,IAAI,WAAW,EAAE,CAAC,MAAM,CAAC,GAAG,CAAC,OAAO,CAAC,WAAW,CAAC,CAAC,CAAC,CAAC;oBACpE,CAAC;gBACH,CAAC;YACH,CAAC;QACH,CAAC;QACD,OAAO;YACL,MAAM,EAAE,MAAM,CAAC,OAAO,CAAC,KAAK,EAAE,EAAE,CAAC,IAAI,GAAG;YACxC,SAAS,EAAE,GAAG,CAAC,UAAU,CAAC,aAAc,CAAC;YACzC,QAAQ,EAAE,GAAG,CAAC,UAAU,CAAC,YAAa,CAAC;YACvC,MAAM;YACN,OAAO;YACP,QAAQ;SACT,CAAC;IACJ,CAAC;IACD,KAAK,EAAE,CAAC,KAAK,EAAE,EAAE,CAAC,IAAI,QAAQ,CAAC,EAAE,OAAO,EAAE,iCAAiC,EAAE,KAAK,EAAE,CAAC;CACtF,CAAC,CAAC"}

package/lib/Providers.d.ts

@@ -0,0 +1,30 @@
+import * as Provider from "alchemy/Provider";
+import * as Layer from "effect/Layer";
+declare const Providers_base: Provider.ProviderCollection<Providers, "ACME">;
+export declare class Providers extends Providers_base {
+}
+export type ProviderRequirements = Layer.Services<ReturnType<typeof providers>>;
+/**
+ * Registers the ACME resource providers ({@link Account},
+ * {@link Certificate}) and the {@link IssueCertificateHttp} binding. DNS-01
+ * solvers come from the DNS provider, e.g. `Cloudflare.providers()` registers
+ * `Cloudflare.ACME.ZoneSolver`.
+ *
+ * @example
+ * ```typescript
+ * export default Alchemy.Stack(
+ *   "Certs",
+ *   {
+ *     providers: Layer.mergeAll(ACME.providers(), Cloudflare.providers()),
+ *     state: Alchemy.localState(),
+ *   },
+ *   Effect.gen(function* () {
+ *     const wildcard = yield* Wildcard;
+ *     return { notAfter: wildcard.notAfter };
+ *   }),
+ * );
+ * ```
+ */
+export declare const providers: () => Layer.Layer<import("effect/http/HttpClient").HttpClient | import("./IssueCertificate.ts").IssueCertificate | Providers, never, never>;
+export {};
+//# sourceMappingURL=Providers.d.ts.map

package/lib/Providers.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"Providers.d.ts","sourceRoot":"","sources":["../src/Providers.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,QAAQ,MAAM,kBAAkB,CAAC;AAE7C,OAAO,KAAK,KAAK,MAAM,cAAc,CAAC;;AAKtC,qBAAa,SAAU,SAAQ,cAAgD;CAAG;AAElF,MAAM,MAAM,oBAAoB,GAAG,KAAK,CAAC,QAAQ,CAAC,UAAU,CAAC,OAAO,SAAS,CAAC,CAAC,CAAC;AAEhF;;;;;;;;;;;;;;;;;;;;GAoBG;AACH,eAAO,MAAM,SAAS,6IAMnB,CAAC"}

package/lib/Providers.js

@@ -0,0 +1,31 @@
+import * as Provider from "alchemy/Provider";
+import * as FetchHttpClient from "effect/http/FetchHttpClient";
+import * as Layer from "effect/Layer";
+import { Account, AccountProvider } from "./Account.js";
+import { Certificate, CertificateProvider } from "./Certificate.js";
+import { IssueCertificateHttp } from "./IssueCertificateHttp.js";
+export class Providers extends Provider.ProviderCollection()("ACME") {
+}
+/**
+ * Registers the ACME resource providers ({@link Account},
+ * {@link Certificate}) and the {@link IssueCertificateHttp} binding. DNS-01
+ * solvers come from the DNS provider, e.g. `Cloudflare.providers()` registers
+ * `Cloudflare.ACME.ZoneSolver`.
+ *
+ * @example
+ * ```typescript
+ * export default Alchemy.Stack(
+ *   "Certs",
+ *   {
+ *     providers: Layer.mergeAll(ACME.providers(), Cloudflare.providers()),
+ *     state: Alchemy.localState(),
+ *   },
+ *   Effect.gen(function* () {
+ *     const wildcard = yield* Wildcard;
+ *     return { notAfter: wildcard.notAfter };
+ *   }),
+ * );
+ * ```
+ */
+export const providers = () => Layer.effect(Providers, Provider.collection([Account, Certificate])).pipe(Layer.provide(Layer.mergeAll(AccountProvider(), CertificateProvider())), Layer.provideMerge(IssueCertificateHttp), Layer.provideMerge(FetchHttpClient.layer), Layer.orDie);
+//# sourceMappingURL=Providers.js.map

package/lib/Providers.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"Providers.js","sourceRoot":"","sources":["../src/Providers.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,QAAQ,MAAM,kBAAkB,CAAC;AAC7C,OAAO,KAAK,eAAe,MAAM,6BAA6B,CAAC;AAC/D,OAAO,KAAK,KAAK,MAAM,cAAc,CAAC;AACtC,OAAO,EAAE,OAAO,EAAE,eAAe,EAAE,MAAM,cAAc,CAAC;AACxD,OAAO,EAAE,WAAW,EAAE,mBAAmB,EAAE,MAAM,kBAAkB,CAAC;AACpE,OAAO,EAAE,oBAAoB,EAAE,MAAM,2BAA2B,CAAC;AAEjE,MAAM,OAAO,SAAU,SAAQ,QAAQ,CAAC,kBAAkB,EAAa,CAAC,MAAM,CAAC;CAAG;AAIlF;;;;;;;;;;;;;;;;;;;;GAoBG;AACH,MAAM,CAAC,MAAM,SAAS,GAAG,GAAG,EAAE,CAC5B,KAAK,CAAC,MAAM,CAAC,SAAS,EAAE,QAAQ,CAAC,UAAU,CAAC,CAAC,OAAO,EAAE,WAAW,CAAC,CAAC,CAAC,CAAC,IAAI,CACvE,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,QAAQ,CAAC,eAAe,EAAE,EAAE,mBAAmB,EAAE,CAAC,CAAC,EACvE,KAAK,CAAC,YAAY,CAAC,oBAAoB,CAAC,EACxC,KAAK,CAAC,YAAY,CAAC,eAAe,CAAC,KAAK,CAAC,EACzC,KAAK,CAAC,KAAK,CACZ,CAAC"}

package/lib/index.d.ts

@@ -0,0 +1,12 @@
+export * from "./Account.ts";
+export * from "./Certificate.ts";
+export * from "./CertificateAuthority.ts";
+export * from "./Client.ts";
+export * from "./Dns.ts";
+export * from "./DnsSolver.ts";
+export * from "./Errors.ts";
+export * from "./IssueCertificate.ts";
+export * from "./IssueCertificateHttp.ts";
+export * from "./Pki.ts";
+export * from "./Providers.ts";
+//# sourceMappingURL=index.d.ts.map

package/lib/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA,cAAc,cAAc,CAAC;AAC7B,cAAc,kBAAkB,CAAC;AACjC,cAAc,2BAA2B,CAAC;AAC1C,cAAc,aAAa,CAAC;AAC5B,cAAc,UAAU,CAAC;AACzB,cAAc,gBAAgB,CAAC;AAC/B,cAAc,aAAa,CAAC;AAC5B,cAAc,uBAAuB,CAAC;AACtC,cAAc,2BAA2B,CAAC;AAC1C,cAAc,UAAU,CAAC;AACzB,cAAc,gBAAgB,CAAC"}

package/lib/index.js

@@ -0,0 +1,12 @@
+export * from "./Account.js";
+export * from "./Certificate.js";
+export * from "./CertificateAuthority.js";
+export * from "./Client.js";
+export * from "./Dns.js";
+export * from "./DnsSolver.js";
+export * from "./Errors.js";
+export * from "./IssueCertificate.js";
+export * from "./IssueCertificateHttp.js";
+export * from "./Pki.js";
+export * from "./Providers.js";
+//# sourceMappingURL=index.js.map

package/lib/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA,cAAc,cAAc,CAAC;AAC7B,cAAc,kBAAkB,CAAC;AACjC,cAAc,2BAA2B,CAAC;AAC1C,cAAc,aAAa,CAAC;AAC5B,cAAc,UAAU,CAAC;AACzB,cAAc,gBAAgB,CAAC;AAC/B,cAAc,aAAa,CAAC;AAC5B,cAAc,uBAAuB,CAAC;AACtC,cAAc,2BAA2B,CAAC;AAC1C,cAAc,UAAU,CAAC;AACzB,cAAc,gBAAgB,CAAC"}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@alchemy.run/acme",
-  "version": "0.0.0",
+  "version": "2.0.0-beta.85",
   "description": "ACME (Let's Encrypt, ZeroSSL) certificates for Alchemy, with a Cloudflare DNS-01 solver.",
   "keywords": [
     "acme",
@@ -10,12 +10,56 @@
     "letsencrypt",
     "tls"
   ],
+  "homepage": "https://alchemy.run",
+  "bugs": {
+    "url": "https://github.com/alchemy-run/alchemy/issues"
+  },
   "license": "Apache-2.0",
   "author": "Sam Goodwin <sam@alchemy.run>",
-  "homepage": "https://alchemy.run",
   "repository": {
     "type": "git",
     "url": "git+https://github.com/alchemy-run/alchemy.git",
     "directory": "packages/acme"
+  },
+  "files": [
+    "lib",
+    "src"
+  ],
+  "type": "module",
+  "sideEffects": false,
+  "exports": {
+    ".": {
+      "types": "./lib/index.d.ts",
+      "bun": "./src/index.ts",
+      "worker": "./src/index.ts",
+      "default": "./lib/index.js"
+    },
+    "./*": {
+      "types": "./lib/*.d.ts",
+      "bun": "./src/*.ts",
+      "worker": "./src/*.ts",
+      "default": "./lib/*.js"
+    },
+    "./package.json": "./package.json"
+  },
+  "publishConfig": {
+    "access": "public"
+  },
+  "dependencies": {
+    "@distilled.cloud/acme": "1.0.0-rc.18"
+  },
+  "devDependencies": {
+    "@types/bun": "1.4.3",
+    "alchemy": "2.0.0-beta.85",
+    "effect": "^4.1.0",
+    "typescript": "^7.0.2"
+  },
+  "peerDependencies": {
+    "alchemy": "2.0.0-beta.85",
+    "effect": "^4.1.0"
+  },
+  "scripts": {
+    "build": "pnpm -r --filter \"{.}...\" run build:package",
+    "build:package": "node scripts/build.ts"
   }
-}
+}

package/src/Account.ts

@@ -0,0 +1,254 @@
+import * as Acme from "@distilled.cloud/acme";
+import * as acme from "@distilled.cloud/acme/acme";
+import { isResolved } from "alchemy/Diff";
+import * as Provider from "alchemy/Provider";
+import { Resource } from "alchemy/Resource";
+import * as Data from "effect/Data";
+import * as Effect from "effect/Effect";
+import * as Redacted from "effect/Redacted";
+import type { CertificateAuthority } from "./CertificateAuthority.ts";
+import { accountLayer, type AccountCredentials } from "./Client.ts";
+import type { KeyAlgorithm } from "./Pki.ts";
+import type { Providers } from "./Providers.ts";
+
+export interface ExternalAccountBinding {
+  /** The key id the CA issued (ZeroSSL: `eab_kid`). */
+  keyId: string;
+  /** The base64url HMAC key the CA issued (ZeroSSL: `eab_hmac_key`). */
+  hmacKey: Redacted.Redacted<string> | string;
+}
+
+export interface AccountProps {
+  /**
+   * The certificate authority: a preset ({@link LetsEncrypt},
+   * {@link ZeroSSL}, …) or `{ directoryUrl }`. Changing it replaces the
+   * account.
+   */
+  ca: CertificateAuthority;
+  /**
+   * Contact URLs (`mailto:…`) the CA notifies about expiry and incidents.
+   * Updated in place.
+   */
+  contact?: string[];
+  /**
+   * You must agree to the CA's terms of service. Explicit on purpose —
+   * never defaulted.
+   */
+  termsOfServiceAgreed: true;
+  /**
+   * External Account Binding for CAs that require one (ZeroSSL, Google
+   * Trust Services). Changing the key id replaces the account.
+   */
+  eab?: ExternalAccountBinding;
+  /**
+   * Account key algorithm. Changing it replaces the account.
+   * @default "ES256"
+   */
+  keyAlgorithm?: KeyAlgorithm;
+}
+
+export interface Account extends Resource<
+  "ACME.Account",
+  AccountProps,
+  {
+    /** The CA's directory URL. */
+    directoryUrl: string;
+    /** PEM root trusted for the CA's HTTPS endpoint (private CAs only). */
+    trustedRoot: string | undefined;
+    /** The account URL the CA assigned — the `kid` on every later request. */
+    accountUrl: string;
+    /** Observed account status (`valid`, `deactivated`, `revoked`). */
+    status: string;
+    /** Observed contact URLs. */
+    contact: string[];
+    /** Account key algorithm. */
+    keyAlgorithm: KeyAlgorithm;
+    /** The account's private JWK (JSON). Sensitive; persisted in stack state. */
+    privateKey: Redacted.Redacted<string>;
+  },
+  never,
+  Providers
+> {}
+
+/**
+ * An ACME account with a certificate authority — the identity that every
+ * {@link Certificate} and every runtime {@link IssueCertificate} call
+ * signs with. One per CA per stack.
+ *
+ * The account key is generated on first reconcile and persisted as a
+ * redacted value alongside the CA's account URL. Protect the state store
+ * as secret material; redaction alone does not encrypt the storage backend.
+ *
+ * ### Let's Encrypt
+ * **Example:** An account with Let's Encrypt
+ * ```typescript
+ * export const LetsEncrypt = ACME.Account("LetsEncrypt", {
+ *   ca: ACME.LetsEncrypt,
+ *   contact: ["mailto:ops@example.com"],
+ *   termsOfServiceAgreed: true,
+ * });
+ * ```
+ *
+ * ### External Account Binding
+ * ZeroSSL and Google Trust Services bind ACME accounts to an existing
+ * customer account with a key id + HMAC pair from their dashboard (ZeroSSL
+ * also mints them over its REST API — see `@distilled.cloud/zerossl`).
+ *
+ * **Example:** ZeroSSL
+ * ```typescript
+ * export const ZeroSsl = ACME.Account("ZeroSSL", {
+ *   ca: ACME.ZeroSSL,
+ *   eab: {
+ *     keyId: Config.String("ZEROSSL_EAB_KID"),
+ *     hmacKey: Config.Redacted("ZEROSSL_EAB_HMAC_KEY"),
+ *   },
+ *   termsOfServiceAgreed: true,
+ * });
+ * ```
+ *
+ * ### Private CAs
+ * A private CA (Pebble, step-ca) whose HTTPS certificate is not publicly
+ * trusted passes its root as `trustedRoot`.
+ *
+ * **Example:** Pebble
+ * ```typescript
+ * export const Pebble = ACME.Account("Pebble", {
+ *   ca: { directoryUrl: "https://localhost:14000/dir", trustedRoot: pebbleRootPem },
+ *   termsOfServiceAgreed: true,
+ * });
+ * ```
+ *
+ * @resource
+ * @product Account
+ * @category Certificates
+ */
+export const Account = Resource<Account>("ACME.Account");
+
+/** The CA answered `newAccount` without a `Location`, so the account has no URL. */
+export class AccountUrlMissing extends Data.TaggedError("ACME.AccountUrlMissing")<{
+  readonly directoryUrl: string;
+}> {}
+
+/**
+ * Normalize to exactly one `Redacted` layer: a value that already came
+ * redacted (an SDK's sensitive field) wrapped again by the caller would
+ * otherwise sign with an object instead of the key.
+ */
+const unwrap = (value: Redacted.Redacted<string> | string) => {
+  let inner: unknown = value;
+  while (Redacted.isRedacted(inner)) inner = Redacted.value(inner);
+  return Redacted.make(String(inner));
+};
+
+const credentialsOf = (
+  props: Pick<AccountProps, "ca" | "eab">,
+  accountKey: Redacted.Redacted<string>,
+  accountUrl: string | undefined,
+): AccountCredentials => ({
+  ca: props.ca,
+  accountKey,
+  accountUrl,
+  externalAccountBinding:
+    props.eab === undefined
+      ? undefined
+      : { keyId: props.eab.keyId, hmacKey: unwrap(props.eab.hmacKey) },
+});
+
+/** `newAccount` with `onlyReturnExisting` — the account, or `undefined`. */
+const observeAccount = (credentials: AccountCredentials) =>
+  acme.newAccount({ onlyReturnExisting: true }).pipe(
+    Effect.catchTag("AcmeAccountDoesNotExist", () => Effect.undefined),
+    Effect.provide(accountLayer(credentials)),
+  );
+
+const sameContacts = (
+  a: ReadonlyArray<string> | undefined,
+  b: ReadonlyArray<string> | undefined,
+) => {
+  const left = [...(a ?? [])].sort();
+  const right = [...(b ?? [])].sort();
+  return left.length === right.length && left.every((v, i) => v === right[i]);
+};
+
+export const AccountProvider = () =>
+  Provider.succeed(Account, {
+    stables: ["directoryUrl", "accountUrl", "keyAlgorithm", "privateKey"],
+
+    diff: Effect.fn(function* ({ news, olds, output }) {
+      if (news === undefined || !isResolved(news) || output === undefined) {
+        return undefined;
+      }
+      if (
+        news.ca.directoryUrl !== output.directoryUrl ||
+        (news.keyAlgorithm ?? "ES256") !== output.keyAlgorithm ||
+        news.eab?.keyId !== olds?.eab?.keyId
+      ) {
+        return { action: "replace" as const };
+      }
+      return undefined;
+    }),
+
+    read: Effect.fn(function* ({ olds, output }) {
+      if (output === undefined || olds === undefined) return undefined;
+      const credentials = credentialsOf(olds, output.privateKey, output.accountUrl);
+      const existing = yield* observeAccount(credentials);
+      if (existing === undefined) return undefined;
+      return {
+        ...output,
+        status: existing.status,
+        contact: existing.contact ?? [],
+      };
+    }),
+
+    reconcile: Effect.fn(function* ({ news, output }) {
+      const keyAlgorithm = news.keyAlgorithm ?? "ES256";
+      // Observe: the key is the identity; keep it across reconciles.
+      const accountKey = output?.privateKey ?? (yield* Acme.Jose.generateAccountKey(keyAlgorithm));
+      const credentials = credentialsOf(news, accountKey, output?.accountUrl);
+      let account = yield* observeAccount(credentials);
+
+      // Repeating newAccount with the same key returns the existing account.
+      if (account === undefined) {
+        account = yield* acme
+          .newAccount({
+            contact: news.contact,
+            termsOfServiceAgreed: true,
+          })
+          .pipe(Effect.provide(accountLayer(credentials)));
+      }
+      const accountUrl = account.location ?? output?.accountUrl;
+      if (accountUrl === undefined) {
+        return yield* new AccountUrlMissing({
+          directoryUrl: news.ca.directoryUrl,
+        });
+      }
+
+      // Sync: contacts are the only mutable aspect.
+      const withKid = accountLayer(credentialsOf(news, accountKey, accountUrl));
+      if (!sameContacts(news.contact, account.contact)) {
+        account = yield* acme
+          .updateAccount({ url: accountUrl, contact: news.contact ?? [] })
+          .pipe(Effect.provide(withKid));
+      }
+
+      return {
+        directoryUrl: news.ca.directoryUrl,
+        trustedRoot: news.ca.trustedRoot,
+        accountUrl,
+        status: account.status,
+        contact: account.contact ?? [],
+        keyAlgorithm,
+        privateKey: accountKey,
+      };
+    }),
+
+    delete: Effect.fn(function* ({ olds, output }) {
+      const credentials = credentialsOf(olds, output.privateKey, output.accountUrl);
+      // Deactivation is permanent and idempotent: a deactivated account
+      // answers `unauthorized`, a purged one `accountDoesNotExist`.
+      yield* acme.updateAccount({ url: output.accountUrl, status: "deactivated" }).pipe(
+        Effect.catchTag(["AcmeAccountDoesNotExist", "AcmeUnauthorized"], () => Effect.undefined),
+        Effect.provide(accountLayer(credentials)),
+      );
+    }),
+  });