@push.rocks/smartacme 7.3.4 → 9.0.0

package/dist_ts/00_commitinfo_data.js

@@ -3,7 +3,7 @@
  */
 export const commitinfo = {
     name: '@push.rocks/smartacme',
-    version: '7.3.4',
+    version: '9.0.0',
     description: 'A TypeScript-based ACME client for LetsEncrypt certificate management with a focus on simplicity and power.'
 };
 //# sourceMappingURL=data:application/json;base64,eyJ2ZXJzaW9uIjozLCJmaWxlIjoiMDBfY29tbWl0aW5mb19kYXRhLmpzIiwic291cmNlUm9vdCI6IiIsInNvdXJjZXMiOlsiLi4vdHMvMDBfY29tbWl0aW5mb19kYXRhLnRzIl0sIm5hbWVzIjpbXSwibWFwcGluZ3MiOiJBQUFBOztHQUVHO0FBQ0gsTUFBTSxDQUFDLE1BQU0sVUFBVSxHQUFHO0lBQ3hCLElBQUksRUFBRSx1QkFBdUI7SUFDN0IsT0FBTyxFQUFFLE9BQU87SUFDaEIsV0FBVyxFQUFFLDZHQUE2RztDQUMzSCxDQUFBIn0=

package/dist_ts/acme/acme.classes.account.d.ts

@@ -0,0 +1,20 @@
+import type { AcmeHttpClient } from './acme.classes.http-client.js';
+import type { IAcmeAccount, IAcmeAccountCreateRequest } from './acme.interfaces.js';
+/**
+ * ACME account management - registration and key management
+ */
+export declare class AcmeAccount {
+    private httpClient;
+    private accountUrl;
+    constructor(httpClient: AcmeHttpClient);
+    /**
+     * Register or retrieve an ACME account.
+     * Uses JWK (not kid) since account URL is not yet known.
+     * Captures account URL from Location header for subsequent requests.
+     */
+    create(request: IAcmeAccountCreateRequest): Promise<IAcmeAccount>;
+    /**
+     * Get the account URL (kid) for use in JWS headers
+     */
+    getAccountUrl(): string;
+}

package/dist_ts/acme/acme.classes.account.js

@@ -0,0 +1,37 @@
+/**
+ * ACME account management - registration and key management
+ */
+export class AcmeAccount {
+    constructor(httpClient) {
+        this.accountUrl = null;
+        this.httpClient = httpClient;
+    }
+    /**
+     * Register or retrieve an ACME account.
+     * Uses JWK (not kid) since account URL is not yet known.
+     * Captures account URL from Location header for subsequent requests.
+     */
+    async create(request) {
+        const dir = await this.httpClient.getDirectory();
+        const response = await this.httpClient.signedRequest(dir.newAccount, request, {
+            useJwk: true,
+        });
+        // Capture account URL from Location header (used as kid for future requests)
+        const location = response.headers['location'];
+        if (location) {
+            this.accountUrl = location;
+            this.httpClient.kid = location;
+        }
+        return response.data;
+    }
+    /**
+     * Get the account URL (kid) for use in JWS headers
+     */
+    getAccountUrl() {
+        if (!this.accountUrl) {
+            throw new Error('Account not yet created - call create() first');
+        }
+        return this.accountUrl;
+    }
+}
+//# sourceMappingURL=data:application/json;base64,eyJ2ZXJzaW9uIjozLCJmaWxlIjoiYWNtZS5jbGFzc2VzLmFjY291bnQuanMiLCJzb3VyY2VSb290IjoiIiwic291cmNlcyI6WyIuLi8uLi90cy9hY21lL2FjbWUuY2xhc3Nlcy5hY2NvdW50LnRzIl0sIm5hbWVzIjpbXSwibWFwcGluZ3MiOiJBQUdBOztHQUVHO0FBQ0gsTUFBTSxPQUFPLFdBQVc7SUFJdEIsWUFBWSxVQUEwQjtRQUY5QixlQUFVLEdBQWtCLElBQUksQ0FBQztRQUd2QyxJQUFJLENBQUMsVUFBVSxHQUFHLFVBQVUsQ0FBQztJQUMvQixDQUFDO0lBRUQ7Ozs7T0FJRztJQUNILEtBQUssQ0FBQyxNQUFNLENBQUMsT0FBa0M7UUFDN0MsTUFBTSxHQUFHLEdBQUcsTUFBTSxJQUFJLENBQUMsVUFBVSxDQUFDLFlBQVksRUFBRSxDQUFDO1FBQ2pELE1BQU0sUUFBUSxHQUFHLE1BQU0sSUFBSSxDQUFDLFVBQVUsQ0FBQyxhQUFhLENBQUMsR0FBRyxDQUFDLFVBQVUsRUFBRSxPQUFPLEVBQUU7WUFDNUUsTUFBTSxFQUFFLElBQUk7U0FDYixDQUFDLENBQUM7UUFFSCw2RUFBNkU7UUFDN0UsTUFBTSxRQUFRLEdBQUcsUUFBUSxDQUFDLE9BQU8sQ0FBQyxVQUFVLENBQUMsQ0FBQztRQUM5QyxJQUFJLFFBQVEsRUFBRSxDQUFDO1lBQ2IsSUFBSSxDQUFDLFVBQVUsR0FBRyxRQUFRLENBQUM7WUFDM0IsSUFBSSxDQUFDLFVBQVUsQ0FBQyxHQUFHLEdBQUcsUUFBUSxDQUFDO1FBQ2pDLENBQUM7UUFFRCxPQUFPLFFBQVEsQ0FBQyxJQUFvQixDQUFDO0lBQ3ZDLENBQUM7SUFFRDs7T0FFRztJQUNILGFBQWE7UUFDWCxJQUFJLENBQUMsSUFBSSxDQUFDLFVBQVUsRUFBRSxDQUFDO1lBQ3JCLE1BQU0sSUFBSSxLQUFLLENBQUMsK0NBQStDLENBQUMsQ0FBQztRQUNuRSxDQUFDO1FBQ0QsT0FBTyxJQUFJLENBQUMsVUFBVSxDQUFDO0lBQ3pCLENBQUM7Q0FDRiJ9

package/dist_ts/acme/acme.classes.challenge.d.ts

@@ -0,0 +1,22 @@
+import type { AcmeHttpClient } from './acme.classes.http-client.js';
+import type { IAcmeChallenge } from './acme.interfaces.js';
+/**
+ * ACME challenge operations - key authorization computation and challenge completion
+ */
+export declare class AcmeChallengeManager {
+    private httpClient;
+    private accountKeyPem;
+    constructor(httpClient: AcmeHttpClient, accountKeyPem: string);
+    /**
+     * Compute the key authorization for a challenge.
+     * For http-01: returns `token.thumbprint`
+     * For dns-01: returns `base64url(sha256(token.thumbprint))`
+     *
+     * This is a synchronous, pure-crypto computation.
+     */
+    getKeyAuthorization(challenge: IAcmeChallenge): string;
+    /**
+     * Notify the ACME server to validate a challenge (POST {} to challenge URL)
+     */
+    complete(challenge: IAcmeChallenge): Promise<void>;
+}

package/dist_ts/acme/acme.classes.challenge.js

@@ -0,0 +1,36 @@
+import * as crypto from 'node:crypto';
+import { AcmeCrypto } from './acme.classes.crypto.js';
+/**
+ * ACME challenge operations - key authorization computation and challenge completion
+ */
+export class AcmeChallengeManager {
+    constructor(httpClient, accountKeyPem) {
+        this.httpClient = httpClient;
+        this.accountKeyPem = accountKeyPem;
+    }
+    /**
+     * Compute the key authorization for a challenge.
+     * For http-01: returns `token.thumbprint`
+     * For dns-01: returns `base64url(sha256(token.thumbprint))`
+     *
+     * This is a synchronous, pure-crypto computation.
+     */
+    getKeyAuthorization(challenge) {
+        const jwk = AcmeCrypto.getJwk(this.accountKeyPem);
+        const thumbprint = AcmeCrypto.getJwkThumbprint(jwk);
+        const keyAuth = `${challenge.token}.${thumbprint}`;
+        if (challenge.type === 'dns-01') {
+            // DNS-01 uses base64url(SHA-256(keyAuthorization))
+            return crypto.createHash('sha256').update(keyAuth).digest().toString('base64url');
+        }
+        // HTTP-01 and others use the raw key authorization
+        return keyAuth;
+    }
+    /**
+     * Notify the ACME server to validate a challenge (POST {} to challenge URL)
+     */
+    async complete(challenge) {
+        await this.httpClient.signedRequest(challenge.url, {});
+    }
+}
+//# sourceMappingURL=data:application/json;base64,eyJ2ZXJzaW9uIjozLCJmaWxlIjoiYWNtZS5jbGFzc2VzLmNoYWxsZW5nZS5qcyIsInNvdXJjZVJvb3QiOiIiLCJzb3VyY2VzIjpbIi4uLy4uL3RzL2FjbWUvYWNtZS5jbGFzc2VzLmNoYWxsZW5nZS50cyJdLCJuYW1lcyI6W10sIm1hcHBpbmdzIjoiQUFBQSxPQUFPLEtBQUssTUFBTSxNQUFNLGFBQWEsQ0FBQztBQUN0QyxPQUFPLEVBQUUsVUFBVSxFQUFFLE1BQU0sMEJBQTBCLENBQUM7QUFJdEQ7O0dBRUc7QUFDSCxNQUFNLE9BQU8sb0JBQW9CO0lBSS9CLFlBQVksVUFBMEIsRUFBRSxhQUFxQjtRQUMzRCxJQUFJLENBQUMsVUFBVSxHQUFHLFVBQVUsQ0FBQztRQUM3QixJQUFJLENBQUMsYUFBYSxHQUFHLGFBQWEsQ0FBQztJQUNyQyxDQUFDO0lBRUQ7Ozs7OztPQU1HO0lBQ0gsbUJBQW1CLENBQUMsU0FBeUI7UUFDM0MsTUFBTSxHQUFHLEdBQUcsVUFBVSxDQUFDLE1BQU0sQ0FBQyxJQUFJLENBQUMsYUFBYSxDQUFDLENBQUM7UUFDbEQsTUFBTSxVQUFVLEdBQUcsVUFBVSxDQUFDLGdCQUFnQixDQUFDLEdBQUcsQ0FBQyxDQUFDO1FBQ3BELE1BQU0sT0FBTyxHQUFHLEdBQUcsU0FBUyxDQUFDLEtBQUssSUFBSSxVQUFVLEVBQUUsQ0FBQztRQUVuRCxJQUFJLFNBQVMsQ0FBQyxJQUFJLEtBQUssUUFBUSxFQUFFLENBQUM7WUFDaEMsbURBQW1EO1lBQ25ELE9BQU8sTUFBTSxDQUFDLFVBQVUsQ0FBQyxRQUFRLENBQUMsQ0FBQyxNQUFNLENBQUMsT0FBTyxDQUFDLENBQUMsTUFBTSxFQUFFLENBQUMsUUFBUSxDQUFDLFdBQVcsQ0FBQyxDQUFDO1FBQ3BGLENBQUM7UUFFRCxtREFBbUQ7UUFDbkQsT0FBTyxPQUFPLENBQUM7SUFDakIsQ0FBQztJQUVEOztPQUVHO0lBQ0gsS0FBSyxDQUFDLFFBQVEsQ0FBQyxTQUF5QjtRQUN0QyxNQUFNLElBQUksQ0FBQyxVQUFVLENBQUMsYUFBYSxDQUFDLFNBQVMsQ0FBQyxHQUFHLEVBQUUsRUFBRSxDQUFDLENBQUM7SUFDekQsQ0FBQztDQUNGIn0=

package/dist_ts/acme/acme.classes.client.d.ts

@@ -0,0 +1,68 @@
+import { AcmeCrypto } from './acme.classes.crypto.js';
+import { type TAcmeLogger } from './acme.classes.http-client.js';
+import type { IAcmeAccount, IAcmeAccountCreateRequest, IAcmeAuthorization, IAcmeChallenge, IAcmeIdentifier, IAcmeOrder } from './acme.interfaces.js';
+export interface IAcmeClientOptions {
+    directoryUrl: string;
+    accountKeyPem: string;
+    logger?: TAcmeLogger;
+}
+/**
+ * Top-level ACME client facade.
+ * Composes HTTP transport, account management, order lifecycle, and challenge handling.
+ */
+export declare class AcmeClient {
+    private httpClient;
+    private account;
+    private orderManager;
+    private challengeManager;
+    /** Well-known CA directory URLs */
+    static directory: {
+        readonly letsencrypt: {
+            readonly production: "https://acme-v02.api.letsencrypt.org/directory";
+            readonly staging: "https://acme-staging-v02.api.letsencrypt.org/directory";
+        };
+        readonly buypass: {
+            readonly production: "https://api.buypass.com/acme/directory";
+            readonly staging: "https://api.test4.buypass.no/acme/directory";
+        };
+    };
+    /** Crypto utilities */
+    static crypto: typeof AcmeCrypto;
+    constructor(options: IAcmeClientOptions);
+    /**
+     * Register or retrieve an ACME account
+     */
+    createAccount(request: IAcmeAccountCreateRequest): Promise<IAcmeAccount>;
+    /**
+     * Create a new certificate order
+     */
+    createOrder(opts: {
+        identifiers: IAcmeIdentifier[];
+    }): Promise<IAcmeOrder>;
+    /**
+     * Get all authorizations for an order
+     */
+    getAuthorizations(order: IAcmeOrder): Promise<IAcmeAuthorization[]>;
+    /**
+     * Compute the key authorization string for a challenge (sync)
+     */
+    getChallengeKeyAuthorization(challenge: IAcmeChallenge): string;
+    /**
+     * Notify the ACME server to validate a challenge
+     */
+    completeChallenge(challenge: IAcmeChallenge): Promise<void>;
+    /**
+     * Poll an ACME resource until it reaches valid/ready status
+     */
+    waitForValidStatus(item: {
+        url: string;
+    }): Promise<any>;
+    /**
+     * Finalize an order by submitting the CSR
+     */
+    finalizeOrder(order: IAcmeOrder, csrPem: string): Promise<void>;
+    /**
+     * Download the certificate chain (PEM)
+     */
+    getCertificate(order: IAcmeOrder): Promise<string>;
+}

package/dist_ts/acme/acme.classes.client.js

@@ -0,0 +1,71 @@
+import { AcmeCrypto } from './acme.classes.crypto.js';
+import { ACME_DIRECTORY_URLS } from './acme.classes.directory.js';
+import { AcmeHttpClient } from './acme.classes.http-client.js';
+import { AcmeAccount } from './acme.classes.account.js';
+import { AcmeOrderManager } from './acme.classes.order.js';
+import { AcmeChallengeManager } from './acme.classes.challenge.js';
+/**
+ * Top-level ACME client facade.
+ * Composes HTTP transport, account management, order lifecycle, and challenge handling.
+ */
+export class AcmeClient {
+    /** Well-known CA directory URLs */
+    static { this.directory = ACME_DIRECTORY_URLS; }
+    /** Crypto utilities */
+    static { this.crypto = AcmeCrypto; }
+    constructor(options) {
+        this.httpClient = new AcmeHttpClient(options.directoryUrl, options.accountKeyPem, options.logger);
+        this.account = new AcmeAccount(this.httpClient);
+        this.orderManager = new AcmeOrderManager(this.httpClient);
+        this.challengeManager = new AcmeChallengeManager(this.httpClient, options.accountKeyPem);
+    }
+    /**
+     * Register or retrieve an ACME account
+     */
+    async createAccount(request) {
+        return this.account.create(request);
+    }
+    /**
+     * Create a new certificate order
+     */
+    async createOrder(opts) {
+        return this.orderManager.create(opts);
+    }
+    /**
+     * Get all authorizations for an order
+     */
+    async getAuthorizations(order) {
+        return this.orderManager.getAuthorizations(order);
+    }
+    /**
+     * Compute the key authorization string for a challenge (sync)
+     */
+    getChallengeKeyAuthorization(challenge) {
+        return this.challengeManager.getKeyAuthorization(challenge);
+    }
+    /**
+     * Notify the ACME server to validate a challenge
+     */
+    async completeChallenge(challenge) {
+        return this.challengeManager.complete(challenge);
+    }
+    /**
+     * Poll an ACME resource until it reaches valid/ready status
+     */
+    async waitForValidStatus(item) {
+        return this.orderManager.waitForValidStatus(item);
+    }
+    /**
+     * Finalize an order by submitting the CSR
+     */
+    async finalizeOrder(order, csrPem) {
+        return this.orderManager.finalize(order, csrPem);
+    }
+    /**
+     * Download the certificate chain (PEM)
+     */
+    async getCertificate(order) {
+        return this.orderManager.getCertificate(order);
+    }
+}
+//# sourceMappingURL=data:application/json;base64,eyJ2ZXJzaW9uIjozLCJmaWxlIjoiYWNtZS5jbGFzc2VzLmNsaWVudC5qcyIsInNvdXJjZVJvb3QiOiIiLCJzb3VyY2VzIjpbIi4uLy4uL3RzL2FjbWUvYWNtZS5jbGFzc2VzLmNsaWVudC50cyJdLCJuYW1lcyI6W10sIm1hcHBpbmdzIjoiQUFBQSxPQUFPLEVBQUUsVUFBVSxFQUFFLE1BQU0sMEJBQTBCLENBQUM7QUFDdEQsT0FBTyxFQUFFLG1CQUFtQixFQUFFLE1BQU0sNkJBQTZCLENBQUM7QUFDbEUsT0FBTyxFQUFFLGNBQWMsRUFBb0IsTUFBTSwrQkFBK0IsQ0FBQztBQUNqRixPQUFPLEVBQUUsV0FBVyxFQUFFLE1BQU0sMkJBQTJCLENBQUM7QUFDeEQsT0FBTyxFQUFFLGdCQUFnQixFQUFFLE1BQU0seUJBQXlCLENBQUM7QUFDM0QsT0FBTyxFQUFFLG9CQUFvQixFQUFFLE1BQU0sNkJBQTZCLENBQUM7QUFnQm5FOzs7R0FHRztBQUNILE1BQU0sT0FBTyxVQUFVO0lBTXJCLG1DQUFtQzthQUM1QixjQUFTLEdBQUcsbUJBQW1CLENBQUM7SUFDdkMsdUJBQXVCO2FBQ2hCLFdBQU0sR0FBRyxVQUFVLENBQUM7SUFFM0IsWUFBWSxPQUEyQjtRQUNyQyxJQUFJLENBQUMsVUFBVSxHQUFHLElBQUksY0FBYyxDQUFDLE9BQU8sQ0FBQyxZQUFZLEVBQUUsT0FBTyxDQUFDLGFBQWEsRUFBRSxPQUFPLENBQUMsTUFBTSxDQUFDLENBQUM7UUFDbEcsSUFBSSxDQUFDLE9BQU8sR0FBRyxJQUFJLFdBQVcsQ0FBQyxJQUFJLENBQUMsVUFBVSxDQUFDLENBQUM7UUFDaEQsSUFBSSxDQUFDLFlBQVksR0FBRyxJQUFJLGdCQUFnQixDQUFDLElBQUksQ0FBQyxVQUFVLENBQUMsQ0FBQztRQUMxRCxJQUFJLENBQUMsZ0JBQWdCLEdBQUcsSUFBSSxvQkFBb0IsQ0FBQyxJQUFJLENBQUMsVUFBVSxFQUFFLE9BQU8sQ0FBQyxhQUFhLENBQUMsQ0FBQztJQUMzRixDQUFDO0lBRUQ7O09BRUc7SUFDSCxLQUFLLENBQUMsYUFBYSxDQUFDLE9BQWtDO1FBQ3BELE9BQU8sSUFBSSxDQUFDLE9BQU8sQ0FBQyxNQUFNLENBQUMsT0FBTyxDQUFDLENBQUM7SUFDdEMsQ0FBQztJQUVEOztPQUVHO0lBQ0gsS0FBSyxDQUFDLFdBQVcsQ0FBQyxJQUF3QztRQUN4RCxPQUFPLElBQUksQ0FBQyxZQUFZLENBQUMsTUFBTSxDQUFDLElBQUksQ0FBQyxDQUFDO0lBQ3hDLENBQUM7SUFFRDs7T0FFRztJQUNILEtBQUssQ0FBQyxpQkFBaUIsQ0FBQyxLQUFpQjtRQUN2QyxPQUFPLElBQUksQ0FBQyxZQUFZLENBQUMsaUJBQWlCLENBQUMsS0FBSyxDQUFDLENBQUM7SUFDcEQsQ0FBQztJQUVEOztPQUVHO0lBQ0gsNEJBQTRCLENBQUMsU0FBeUI7UUFDcEQsT0FBTyxJQUFJLENBQUMsZ0JBQWdCLENBQUMsbUJBQW1CLENBQUMsU0FBUyxDQUFDLENBQUM7SUFDOUQsQ0FBQztJQUVEOztPQUVHO0lBQ0gsS0FBSyxDQUFDLGlCQUFpQixDQUFDLFNBQXlCO1FBQy9DLE9BQU8sSUFBSSxDQUFDLGdCQUFnQixDQUFDLFFBQVEsQ0FBQyxTQUFTLENBQUMsQ0FBQztJQUNuRCxDQUFDO0lBRUQ7O09BRUc7SUFDSCxLQUFLLENBQUMsa0JBQWtCLENBQUMsSUFBcUI7UUFDNUMsT0FBTyxJQUFJLENBQUMsWUFBWSxDQUFDLGtCQUFrQixDQUFDLElBQUksQ0FBQyxDQUFDO0lBQ3BELENBQUM7SUFFRDs7T0FFRztJQUNILEtBQUssQ0FBQyxhQUFhLENBQUMsS0FBaUIsRUFBRSxNQUFjO1FBQ25ELE9BQU8sSUFBSSxDQUFDLFlBQVksQ0FBQyxRQUFRLENBQUMsS0FBSyxFQUFFLE1BQU0sQ0FBQyxDQUFDO0lBQ25ELENBQUM7SUFFRDs7T0FFRztJQUNILEtBQUssQ0FBQyxjQUFjLENBQUMsS0FBaUI7UUFDcEMsT0FBTyxJQUFJLENBQUMsWUFBWSxDQUFDLGNBQWMsQ0FBQyxLQUFLLENBQUMsQ0FBQztJQUNqRCxDQUFDIn0=

package/dist_ts/acme/acme.classes.crypto.d.ts

@@ -0,0 +1,50 @@
+import type { IAcmeCsrOptions } from './acme.interfaces.js';
+/**
+ * All cryptographic operations for the ACME protocol.
+ * Uses node:crypto for key gen, JWK, JWS signing.
+ * Uses @peculiar/x509 for CSR generation (no native Node.js CSR API).
+ */
+export declare class AcmeCrypto {
+    /**
+     * Generate an RSA private key in PEM format
+     */
+    static createRsaPrivateKey(modulusLength?: number): string;
+    /**
+     * Export public JWK from PEM private key, keys sorted alphabetically per RFC 7638
+     */
+    static getJwk(keyPem: string): Record<string, string>;
+    /**
+     * Compute JWK Thumbprint (SHA-256, base64url) per RFC 7638
+     */
+    static getJwkThumbprint(jwk: Record<string, string>): string;
+    /**
+     * Create a flattened JWS for ACME requests (RFC 7515)
+     * payload=null means POST-as-GET (empty string payload)
+     */
+    static createJws(keyPem: string, url: string, payload: any | null, options: {
+        nonce: string;
+        kid?: string;
+        jwk?: Record<string, string>;
+    }): {
+        protected: string;
+        payload: string;
+        signature: string;
+    };
+    /**
+     * Create a CSR (PKCS#10) via @peculiar/x509
+     * Returns [privateKeyPem, csrPem]
+     */
+    static createCsr(options: IAcmeCsrOptions, existingKeyPem?: string): Promise<[string, string]>;
+    /**
+     * Convert PEM to raw DER Buffer (strip headers, decode base64)
+     */
+    static pemToBuffer(pem: string): Buffer;
+    /**
+     * Determine JWS algorithm from key type
+     */
+    private static getAlg;
+    /**
+     * Import a PEM private key into WebCrypto as a CryptoKeyPair
+     */
+    private static importKeyPairToWebCrypto;
+}

package/dist_ts/acme/acme.classes.crypto.js

@@ -0,0 +1,180 @@
+import * as crypto from 'node:crypto';
+/**
+ * All cryptographic operations for the ACME protocol.
+ * Uses node:crypto for key gen, JWK, JWS signing.
+ * Uses @peculiar/x509 for CSR generation (no native Node.js CSR API).
+ */
+export class AcmeCrypto {
+    /**
+     * Generate an RSA private key in PEM format
+     */
+    static createRsaPrivateKey(modulusLength = 2048) {
+        const { privateKey } = crypto.generateKeyPairSync('rsa', {
+            modulusLength,
+            publicKeyEncoding: { type: 'spki', format: 'pem' },
+            privateKeyEncoding: { type: 'pkcs8', format: 'pem' },
+        });
+        return privateKey;
+    }
+    /**
+     * Export public JWK from PEM private key, keys sorted alphabetically per RFC 7638
+     */
+    static getJwk(keyPem) {
+        const keyObj = crypto.createPublicKey(keyPem);
+        const jwk = keyObj.export({ format: 'jwk' });
+        if (jwk.kty === 'RSA') {
+            return { e: jwk.e, kty: jwk.kty, n: jwk.n };
+        }
+        else if (jwk.kty === 'EC') {
+            return { crv: jwk.crv, kty: jwk.kty, x: jwk.x, y: jwk.y };
+        }
+        throw new Error(`Unsupported key type: ${jwk.kty}`);
+    }
+    /**
+     * Compute JWK Thumbprint (SHA-256, base64url) per RFC 7638
+     */
+    static getJwkThumbprint(jwk) {
+        let canonical;
+        if (jwk.kty === 'RSA') {
+            canonical = JSON.stringify({ e: jwk.e, kty: jwk.kty, n: jwk.n });
+        }
+        else if (jwk.kty === 'EC') {
+            canonical = JSON.stringify({ crv: jwk.crv, kty: jwk.kty, x: jwk.x, y: jwk.y });
+        }
+        else {
+            throw new Error(`Unsupported key type: ${jwk.kty}`);
+        }
+        const hash = crypto.createHash('sha256').update(canonical).digest();
+        return hash.toString('base64url');
+    }
+    /**
+     * Create a flattened JWS for ACME requests (RFC 7515)
+     * payload=null means POST-as-GET (empty string payload)
+     */
+    static createJws(keyPem, url, payload, options) {
+        const header = {
+            alg: AcmeCrypto.getAlg(keyPem),
+            nonce: options.nonce,
+            url,
+        };
+        if (options.kid) {
+            header.kid = options.kid;
+        }
+        else if (options.jwk) {
+            header.jwk = options.jwk;
+        }
+        else {
+            header.jwk = AcmeCrypto.getJwk(keyPem);
+        }
+        const protectedB64 = Buffer.from(JSON.stringify(header)).toString('base64url');
+        const payloadB64 = payload !== null ? Buffer.from(JSON.stringify(payload)).toString('base64url') : '';
+        const signingInput = `${protectedB64}.${payloadB64}`;
+        const keyObj = crypto.createPrivateKey(keyPem);
+        const alg = AcmeCrypto.getAlg(keyPem);
+        let signature;
+        if (alg.startsWith('RS')) {
+            signature = crypto.sign('sha256', Buffer.from(signingInput), keyObj);
+        }
+        else if (alg.startsWith('ES')) {
+            signature = crypto.sign('sha256', Buffer.from(signingInput), {
+                key: keyObj,
+                dsaEncoding: 'ieee-p1363',
+            });
+        }
+        else {
+            throw new Error(`Unsupported algorithm: ${alg}`);
+        }
+        return {
+            protected: protectedB64,
+            payload: payloadB64,
+            signature: signature.toString('base64url'),
+        };
+    }
+    /**
+     * Create a CSR (PKCS#10) via @peculiar/x509
+     * Returns [privateKeyPem, csrPem]
+     */
+    static async createCsr(options, existingKeyPem) {
+        const x509 = await import('@peculiar/x509');
+        const { webcrypto } = crypto;
+        x509.cryptoProvider.set(webcrypto);
+        let keys;
+        let keyPem;
+        if (existingKeyPem) {
+            keys = await AcmeCrypto.importKeyPairToWebCrypto(existingKeyPem, webcrypto);
+            keyPem = existingKeyPem;
+        }
+        else {
+            keys = (await webcrypto.subtle.generateKey({
+                name: 'RSASSA-PKCS1-v1_5',
+                modulusLength: 2048,
+                publicExponent: new Uint8Array([1, 0, 1]),
+                hash: 'SHA-256',
+            }, true, ['sign', 'verify']));
+            const pkcs8 = await webcrypto.subtle.exportKey('pkcs8', keys.privateKey);
+            const b64 = Buffer.from(pkcs8).toString('base64');
+            const lines = b64.match(/.{1,64}/g);
+            keyPem = `-----BEGIN PRIVATE KEY-----\n${lines.join('\n')}\n-----END PRIVATE KEY-----\n`;
+        }
+        // Collect all DNS names for SAN (CN is always included)
+        const sanNames = [options.commonName];
+        if (options.altNames) {
+            for (const name of options.altNames) {
+                if (!sanNames.includes(name)) {
+                    sanNames.push(name);
+                }
+            }
+        }
+        const csr = await x509.Pkcs10CertificateRequestGenerator.create({
+            name: `CN=${options.commonName}`,
+            keys,
+            signingAlgorithm: { name: 'RSASSA-PKCS1-v1_5' },
+            extensions: [
+                new x509.SubjectAlternativeNameExtension(sanNames.map((name) => ({ type: 'dns', value: name }))),
+            ],
+        });
+        // Convert to PEM
+        const csrPem = csr.toString('pem');
+        return [keyPem, csrPem];
+    }
+    /**
+     * Convert PEM to raw DER Buffer (strip headers, decode base64)
+     */
+    static pemToBuffer(pem) {
+        const lines = pem
+            .split('\n')
+            .filter((line) => !line.startsWith('-----') && line.trim().length > 0);
+        return Buffer.from(lines.join(''), 'base64');
+    }
+    /**
+     * Determine JWS algorithm from key type
+     */
+    static getAlg(keyPem) {
+        const keyObj = crypto.createPrivateKey(keyPem);
+        const keyType = keyObj.asymmetricKeyType;
+        if (keyType === 'rsa')
+            return 'RS256';
+        if (keyType === 'ec') {
+            const details = keyObj.asymmetricKeyDetails;
+            if (details?.namedCurve === 'prime256v1' || details?.namedCurve === 'P-256')
+                return 'ES256';
+            if (details?.namedCurve === 'secp384r1' || details?.namedCurve === 'P-384')
+                return 'ES384';
+            return 'ES256';
+        }
+        throw new Error(`Unsupported key type: ${keyType}`);
+    }
+    /**
+     * Import a PEM private key into WebCrypto as a CryptoKeyPair
+     */
+    static async importKeyPairToWebCrypto(keyPem, wc) {
+        const keyObj = crypto.createPrivateKey(keyPem);
+        const pkcs8Der = keyObj.export({ type: 'pkcs8', format: 'der' });
+        const privateKey = await wc.subtle.importKey('pkcs8', pkcs8Der, { name: 'RSASSA-PKCS1-v1_5', hash: 'SHA-256' }, true, ['sign']);
+        const pubKeyObj = crypto.createPublicKey(keyPem);
+        const spkiDer = pubKeyObj.export({ type: 'spki', format: 'der' });
+        const publicKey = await wc.subtle.importKey('spki', spkiDer, { name: 'RSASSA-PKCS1-v1_5', hash: 'SHA-256' }, true, ['verify']);
+        return { privateKey: privateKey, publicKey: publicKey };
+    }
+}
+//# sourceMappingURL=data:application/json;base64,eyJ2ZXJzaW9uIjozLCJmaWxlIjoiYWNtZS5jbGFzc2VzLmNyeXB0by5qcyIsInNvdXJjZVJvb3QiOiIiLCJzb3VyY2VzIjpbIi4uLy4uL3RzL2FjbWUvYWNtZS5jbGFzc2VzLmNyeXB0by50cyJdLCJuYW1lcyI6W10sIm1hcHBpbmdzIjoiQUFBQSxPQUFPLEtBQUssTUFBTSxNQUFNLGFBQWEsQ0FBQztBQUd0Qzs7OztHQUlHO0FBQ0gsTUFBTSxPQUFPLFVBQVU7SUFDckI7O09BRUc7SUFDSCxNQUFNLENBQUMsbUJBQW1CLENBQUMsYUFBYSxHQUFHLElBQUk7UUFDN0MsTUFBTSxFQUFFLFVBQVUsRUFBRSxHQUFHLE1BQU0sQ0FBQyxtQkFBbUIsQ0FBQyxLQUFLLEVBQUU7WUFDdkQsYUFBYTtZQUNiLGlCQUFpQixFQUFFLEVBQUUsSUFBSSxFQUFFLE1BQU0sRUFBRSxNQUFNLEVBQUUsS0FBSyxFQUFFO1lBQ2xELGtCQUFrQixFQUFFLEVBQUUsSUFBSSxFQUFFLE9BQU8sRUFBRSxNQUFNLEVBQUUsS0FBSyxFQUFFO1NBQ3JELENBQUMsQ0FBQztRQUNILE9BQU8sVUFBVSxDQUFDO0lBQ3BCLENBQUM7SUFFRDs7T0FFRztJQUNILE1BQU0sQ0FBQyxNQUFNLENBQUMsTUFBYztRQUMxQixNQUFNLE1BQU0sR0FBRyxNQUFNLENBQUMsZUFBZSxDQUFDLE1BQU0sQ0FBQyxDQUFDO1FBQzlDLE1BQU0sR0FBRyxHQUFHLE1BQU0sQ0FBQyxNQUFNLENBQUMsRUFBRSxNQUFNLEVBQUUsS0FBSyxFQUFFLENBQXdCLENBQUM7UUFDcEUsSUFBSSxHQUFHLENBQUMsR0FBRyxLQUFLLEtBQUssRUFBRSxDQUFDO1lBQ3RCLE9BQU8sRUFBRSxDQUFDLEVBQUUsR0FBRyxDQUFDLENBQUMsRUFBRSxHQUFHLEVBQUUsR0FBRyxDQUFDLEdBQUcsRUFBRSxDQUFDLEVBQUUsR0FBRyxDQUFDLENBQUMsRUFBRSxDQUFDO1FBQzlDLENBQUM7YUFBTSxJQUFJLEdBQUcsQ0FBQyxHQUFHLEtBQUssSUFBSSxFQUFFLENBQUM7WUFDNUIsT0FBTyxFQUFFLEdBQUcsRUFBRSxHQUFHLENBQUMsR0FBRyxFQUFFLEdBQUcsRUFBRSxHQUFHLENBQUMsR0FBRyxFQUFFLENBQUMsRUFBRSxHQUFHLENBQUMsQ0FBQyxFQUFFLENBQUMsRUFBRSxHQUFHLENBQUMsQ0FBQyxFQUFFLENBQUM7UUFDNUQsQ0FBQztRQUNELE1BQU0sSUFBSSxLQUFLLENBQUMseUJBQXlCLEdBQUcsQ0FBQyxHQUFHLEVBQUUsQ0FBQyxDQUFDO0lBQ3RELENBQUM7SUFFRDs7T0FFRztJQUNILE1BQU0sQ0FBQyxnQkFBZ0IsQ0FBQyxHQUEyQjtRQUNqRCxJQUFJLFNBQWlCLENBQUM7UUFDdEIsSUFBSSxHQUFHLENBQUMsR0FBRyxLQUFLLEtBQUssRUFBRSxDQUFDO1lBQ3RCLFNBQVMsR0FBRyxJQUFJLENBQUMsU0FBUyxDQUFDLEVBQUUsQ0FBQyxFQUFFLEdBQUcsQ0FBQyxDQUFDLEVBQUUsR0FBRyxFQUFFLEdBQUcsQ0FBQyxHQUFHLEVBQUUsQ0FBQyxFQUFFLEdBQUcsQ0FBQyxDQUFDLEVBQUUsQ0FBQyxDQUFDO1FBQ25FLENBQUM7YUFBTSxJQUFJLEdBQUcsQ0FBQyxHQUFHLEtBQUssSUFBSSxFQUFFLENBQUM7WUFDNUIsU0FBUyxHQUFHLElBQUksQ0FBQyxTQUFTLENBQUMsRUFBRSxHQUFHLEVBQUUsR0FBRyxDQUFDLEdBQUcsRUFBRSxHQUFHLEVBQUUsR0FBRyxDQUFDLEdBQUcsRUFBRSxDQUFDLEVBQUUsR0FBRyxDQUFDLENBQUMsRUFBRSxDQUFDLEVBQUUsR0FBRyxDQUFDLENBQUMsRUFBRSxDQUFDLENBQUM7UUFDakYsQ0FBQzthQUFNLENBQUM7WUFDTixNQUFNLElBQUksS0FBSyxDQUFDLHlCQUF5QixHQUFHLENBQUMsR0FBRyxFQUFFLENBQUMsQ0FBQztRQUN0RCxDQUFDO1FBQ0QsTUFBTSxJQUFJLEdBQUcsTUFBTSxDQUFDLFVBQVUsQ0FBQyxRQUFRLENBQUMsQ0FBQyxNQUFNLENBQUMsU0FBUyxDQUFDLENBQUMsTUFBTSxFQUFFLENBQUM7UUFDcEUsT0FBTyxJQUFJLENBQUMsUUFBUSxDQUFDLFdBQVcsQ0FBQyxDQUFDO0lBQ3BDLENBQUM7SUFFRDs7O09BR0c7SUFDSCxNQUFNLENBQUMsU0FBUyxDQUNkLE1BQWMsRUFDZCxHQUFXLEVBQ1gsT0FBbUIsRUFDbkIsT0FBc0U7UUFFdEUsTUFBTSxNQUFNLEdBQXdCO1lBQ2xDLEdBQUcsRUFBRSxVQUFVLENBQUMsTUFBTSxDQUFDLE1BQU0sQ0FBQztZQUM5QixLQUFLLEVBQUUsT0FBTyxDQUFDLEtBQUs7WUFDcEIsR0FBRztTQUNKLENBQUM7UUFDRixJQUFJLE9BQU8sQ0FBQyxHQUFHLEVBQUUsQ0FBQztZQUNoQixNQUFNLENBQUMsR0FBRyxHQUFHLE9BQU8sQ0FBQyxHQUFHLENBQUM7UUFDM0IsQ0FBQzthQUFNLElBQUksT0FBTyxDQUFDLEdBQUcsRUFBRSxDQUFDO1lBQ3ZCLE1BQU0sQ0FBQyxHQUFHLEdBQUcsT0FBTyxDQUFDLEdBQUcsQ0FBQztRQUMzQixDQUFDO2FBQU0sQ0FBQztZQUNOLE1BQU0sQ0FBQyxHQUFHLEdBQUcsVUFBVSxDQUFDLE1BQU0sQ0FBQyxNQUFNLENBQUMsQ0FBQztRQUN6QyxDQUFDO1FBRUQsTUFBTSxZQUFZLEdBQUcsTUFBTSxDQUFDLElBQUksQ0FBQyxJQUFJLENBQUMsU0FBUyxDQUFDLE1BQU0sQ0FBQyxDQUFDLENBQUMsUUFBUSxDQUFDLFdBQVcsQ0FBQyxDQUFDO1FBQy9FLE1BQU0sVUFBVSxHQUNkLE9BQU8sS0FBSyxJQUFJLENBQUMsQ0FBQyxDQUFDLE1BQU0sQ0FBQyxJQUFJLENBQUMsSUFBSSxDQUFDLFNBQVMsQ0FBQyxPQUFPLENBQUMsQ0FBQyxDQUFDLFFBQVEsQ0FBQyxXQUFXLENBQUMsQ0FBQyxDQUFDLENBQUMsRUFBRSxDQUFDO1FBRXJGLE1BQU0sWUFBWSxHQUFHLEdBQUcsWUFBWSxJQUFJLFVBQVUsRUFBRSxDQUFDO1FBQ3JELE1BQU0sTUFBTSxHQUFHLE1BQU0sQ0FBQyxnQkFBZ0IsQ0FBQyxNQUFNLENBQUMsQ0FBQztRQUMvQyxNQUFNLEdBQUcsR0FBRyxVQUFVLENBQUMsTUFBTSxDQUFDLE1BQU0sQ0FBQyxDQUFDO1FBRXRDLElBQUksU0FBaUIsQ0FBQztRQUN0QixJQUFJLEdBQUcsQ0FBQyxVQUFVLENBQUMsSUFBSSxDQUFDLEVBQUUsQ0FBQztZQUN6QixTQUFTLEdBQUcsTUFBTSxDQUFDLElBQUksQ0FBQyxRQUFRLEVBQUUsTUFBTSxDQUFDLElBQUksQ0FBQyxZQUFZLENBQUMsRUFBRSxNQUFNLENBQUMsQ0FBQztRQUN2RSxDQUFDO2FBQU0sSUFBSSxHQUFHLENBQUMsVUFBVSxDQUFDLElBQUksQ0FBQyxFQUFFLENBQUM7WUFDaEMsU0FBUyxHQUFHLE1BQU0sQ0FBQyxJQUFJLENBQUMsUUFBUSxFQUFFLE1BQU0sQ0FBQyxJQUFJLENBQUMsWUFBWSxDQUFDLEVBQUU7Z0JBQzNELEdBQUcsRUFBRSxNQUFNO2dCQUNYLFdBQVcsRUFBRSxZQUFZO2FBQzFCLENBQUMsQ0FBQztRQUNMLENBQUM7YUFBTSxDQUFDO1lBQ04sTUFBTSxJQUFJLEtBQUssQ0FBQywwQkFBMEIsR0FBRyxFQUFFLENBQUMsQ0FBQztRQUNuRCxDQUFDO1FBRUQsT0FBTztZQUNMLFNBQVMsRUFBRSxZQUFZO1lBQ3ZCLE9BQU8sRUFBRSxVQUFVO1lBQ25CLFNBQVMsRUFBRSxTQUFTLENBQUMsUUFBUSxDQUFDLFdBQVcsQ0FBQztTQUMzQyxDQUFDO0lBQ0osQ0FBQztJQUVEOzs7T0FHRztJQUNILE1BQU0sQ0FBQyxLQUFLLENBQUMsU0FBUyxDQUNwQixPQUF3QixFQUN4QixjQUF1QjtRQUV2QixNQUFNLElBQUksR0FBRyxNQUFNLE1BQU0sQ0FBQyxnQkFBZ0IsQ0FBQyxDQUFDO1FBQzVDLE1BQU0sRUFBRSxTQUFTLEVBQUUsR0FBRyxNQUFNLENBQUM7UUFDN0IsSUFBSSxDQUFDLGNBQWMsQ0FBQyxHQUFHLENBQUMsU0FBZ0IsQ0FBQyxDQUFDO1FBRTFDLElBQUksSUFBbUIsQ0FBQztRQUN4QixJQUFJLE1BQWMsQ0FBQztRQUVuQixJQUFJLGNBQWMsRUFBRSxDQUFDO1lBQ25CLElBQUksR0FBRyxNQUFNLFVBQVUsQ0FBQyx3QkFBd0IsQ0FBQyxjQUFjLEVBQUUsU0FBUyxDQUFDLENBQUM7WUFDNUUsTUFBTSxHQUFHLGNBQWMsQ0FBQztRQUMxQixDQUFDO2FBQU0sQ0FBQztZQUNOLElBQUksR0FBRyxDQUFDLE1BQU0sU0FBUyxDQUFDLE1BQU0sQ0FBQyxXQUFXLENBQ3hDO2dCQUNFLElBQUksRUFBRSxtQkFBbUI7Z0JBQ3pCLGFBQWEsRUFBRSxJQUFJO2dCQUNuQixjQUFjLEVBQUUsSUFBSSxVQUFVLENBQUMsQ0FBQyxDQUFDLEVBQUUsQ0FBQyxFQUFFLENBQUMsQ0FBQyxDQUFDO2dCQUN6QyxJQUFJLEVBQUUsU0FBUzthQUNoQixFQUNELElBQUksRUFDSixDQUFDLE1BQU0sRUFBRSxRQUFRLENBQUMsQ0FDbkIsQ0FBa0IsQ0FBQztZQUVwQixNQUFNLEtBQUssR0FBRyxNQUFNLFNBQVMsQ0FBQyxNQUFNLENBQUMsU0FBUyxDQUFDLE9BQU8sRUFBRSxJQUFJLENBQUMsVUFBVSxDQUFDLENBQUM7WUFDekUsTUFBTSxHQUFHLEdBQUcsTUFBTSxDQUFDLElBQUksQ0FBQyxLQUFLLENBQUMsQ0FBQyxRQUFRLENBQUMsUUFBUSxDQUFDLENBQUM7WUFDbEQsTUFBTSxLQUFLLEdBQUcsR0FBRyxDQUFDLEtBQUssQ0FBQyxVQUFVLENBQUUsQ0FBQztZQUNyQyxNQUFNLEdBQUcsZ0NBQWdDLEtBQUssQ0FBQyxJQUFJLENBQUMsSUFBSSxDQUFDLCtCQUErQixDQUFDO1FBQzNGLENBQUM7UUFFRCx3REFBd0Q7UUFDeEQsTUFBTSxRQUFRLEdBQWEsQ0FBQyxPQUFPLENBQUMsVUFBVSxDQUFDLENBQUM7UUFDaEQsSUFBSSxPQUFPLENBQUMsUUFBUSxFQUFFLENBQUM7WUFDckIsS0FBSyxNQUFNLElBQUksSUFBSSxPQUFPLENBQUMsUUFBUSxFQUFFLENBQUM7Z0JBQ3BDLElBQUksQ0FBQyxRQUFRLENBQUMsUUFBUSxDQUFDLElBQUksQ0FBQyxFQUFFLENBQUM7b0JBQzdCLFFBQVEsQ0FBQyxJQUFJLENBQUMsSUFBSSxDQUFDLENBQUM7Z0JBQ3RCLENBQUM7WUFDSCxDQUFDO1FBQ0gsQ0FBQztRQUVELE1BQU0sR0FBRyxHQUFHLE1BQU0sSUFBSSxDQUFDLGlDQUFpQyxDQUFDLE1BQU0sQ0FBQztZQUM5RCxJQUFJLEVBQUUsTUFBTSxPQUFPLENBQUMsVUFBVSxFQUFFO1lBQ2hDLElBQUk7WUFDSixnQkFBZ0IsRUFBRSxFQUFFLElBQUksRUFBRSxtQkFBbUIsRUFBRTtZQUMvQyxVQUFVLEVBQUU7Z0JBQ1YsSUFBSSxJQUFJLENBQUMsK0JBQStCLENBQ3RDLFFBQVEsQ0FBQyxHQUFHLENBQUMsQ0FBQyxJQUFJLEVBQUUsRUFBRSxDQUFDLENBQUMsRUFBRSxJQUFJLEVBQUUsS0FBYyxFQUFFLEtBQUssRUFBRSxJQUFJLEVBQUUsQ0FBQyxDQUFDLENBQ2hFO2FBQ0Y7U0FDRixDQUFDLENBQUM7UUFFSCxpQkFBaUI7UUFDakIsTUFBTSxNQUFNLEdBQUcsR0FBRyxDQUFDLFFBQVEsQ0FBQyxLQUFLLENBQUMsQ0FBQztRQUVuQyxPQUFPLENBQUMsTUFBTSxFQUFFLE1BQU0sQ0FBQyxDQUFDO0lBQzFCLENBQUM7SUFFRDs7T0FFRztJQUNILE1BQU0sQ0FBQyxXQUFXLENBQUMsR0FBVztRQUM1QixNQUFNLEtBQUssR0FBRyxHQUFHO2FBQ2QsS0FBSyxDQUFDLElBQUksQ0FBQzthQUNYLE1BQU0sQ0FBQyxDQUFDLElBQUksRUFBRSxFQUFFLENBQUMsQ0FBQyxJQUFJLENBQUMsVUFBVSxDQUFDLE9BQU8sQ0FBQyxJQUFJLElBQUksQ0FBQyxJQUFJLEVBQUUsQ0FBQyxNQUFNLEdBQUcsQ0FBQyxDQUFDLENBQUM7UUFDekUsT0FBTyxNQUFNLENBQUMsSUFBSSxDQUFDLEtBQUssQ0FBQyxJQUFJLENBQUMsRUFBRSxDQUFDLEVBQUUsUUFBUSxDQUFDLENBQUM7SUFDL0MsQ0FBQztJQUVEOztPQUVHO0lBQ0ssTUFBTSxDQUFDLE1BQU0sQ0FBQyxNQUFjO1FBQ2xDLE1BQU0sTUFBTSxHQUFHLE1BQU0sQ0FBQyxnQkFBZ0IsQ0FBQyxNQUFNLENBQUMsQ0FBQztRQUMvQyxNQUFNLE9BQU8sR0FBRyxNQUFNLENBQUMsaUJBQWlCLENBQUM7UUFDekMsSUFBSSxPQUFPLEtBQUssS0FBSztZQUFFLE9BQU8sT0FBTyxDQUFDO1FBQ3RDLElBQUksT0FBTyxLQUFLLElBQUksRUFBRSxDQUFDO1lBQ3JCLE1BQU0sT0FBTyxHQUFHLE1BQU0sQ0FBQyxvQkFBb0IsQ0FBQztZQUM1QyxJQUFJLE9BQU8sRUFBRSxVQUFVLEtBQUssWUFBWSxJQUFJLE9BQU8sRUFBRSxVQUFVLEtBQUssT0FBTztnQkFBRSxPQUFPLE9BQU8sQ0FBQztZQUM1RixJQUFJLE9BQU8sRUFBRSxVQUFVLEtBQUssV0FBVyxJQUFJLE9BQU8sRUFBRSxVQUFVLEtBQUssT0FBTztnQkFBRSxPQUFPLE9BQU8sQ0FBQztZQUMzRixPQUFPLE9BQU8sQ0FBQztRQUNqQixDQUFDO1FBQ0QsTUFBTSxJQUFJLEtBQUssQ0FBQyx5QkFBeUIsT0FBTyxFQUFFLENBQUMsQ0FBQztJQUN0RCxDQUFDO0lBRUQ7O09BRUc7SUFDSyxNQUFNLENBQUMsS0FBSyxDQUFDLHdCQUF3QixDQUMzQyxNQUFjLEVBQ2QsRUFBMkI7UUFFM0IsTUFBTSxNQUFNLEdBQUcsTUFBTSxDQUFDLGdCQUFnQixDQUFDLE1BQU0sQ0FBQyxDQUFDO1FBQy9DLE1BQU0sUUFBUSxHQUFHLE1BQU0sQ0FBQyxNQUFNLENBQUMsRUFBRSxJQUFJLEVBQUUsT0FBTyxFQUFFLE1BQU0sRUFBRSxLQUFLLEVBQUUsQ0FBQyxDQUFDO1FBQ2pFLE1BQU0sVUFBVSxHQUFHLE1BQU0sRUFBRSxDQUFDLE1BQU0sQ0FBQyxTQUFTLENBQzFDLE9BQU8sRUFDUCxRQUFRLEVBQ1IsRUFBRSxJQUFJLEVBQUUsbUJBQW1CLEVBQUUsSUFBSSxFQUFFLFNBQVMsRUFBRSxFQUM5QyxJQUFJLEVBQ0osQ0FBQyxNQUFNLENBQUMsQ0FDVCxDQUFDO1FBRUYsTUFBTSxTQUFTLEdBQUcsTUFBTSxDQUFDLGVBQWUsQ0FBQyxNQUFNLENBQUMsQ0FBQztRQUNqRCxNQUFNLE9BQU8sR0FBRyxTQUFTLENBQUMsTUFBTSxDQUFDLEVBQUUsSUFBSSxFQUFFLE1BQU0sRUFBRSxNQUFNLEVBQUUsS0FBSyxFQUFFLENBQUMsQ0FBQztRQUNsRSxNQUFNLFNBQVMsR0FBRyxNQUFNLEVBQUUsQ0FBQyxNQUFNLENBQUMsU0FBUyxDQUN6QyxNQUFNLEVBQ04sT0FBTyxFQUNQLEVBQUUsSUFBSSxFQUFFLG1CQUFtQixFQUFFLElBQUksRUFBRSxTQUFTLEVBQUUsRUFDOUMsSUFBSSxFQUNKLENBQUMsUUFBUSxDQUFDLENBQ1gsQ0FBQztRQUVGLE9BQU8sRUFBRSxVQUFVLEVBQUUsVUFBa0MsRUFBRSxTQUFTLEVBQUUsU0FBaUMsRUFBRSxDQUFDO0lBQzFHLENBQUM7Q0FDRiJ9

package/dist_ts/acme/acme.classes.directory.d.ts

@@ -0,0 +1,13 @@
+/**
+ * ACME directory URL constants for well-known CAs
+ */
+export declare const ACME_DIRECTORY_URLS: {
+    readonly letsencrypt: {
+        readonly production: "https://acme-v02.api.letsencrypt.org/directory";
+        readonly staging: "https://acme-staging-v02.api.letsencrypt.org/directory";
+    };
+    readonly buypass: {
+        readonly production: "https://api.buypass.com/acme/directory";
+        readonly staging: "https://api.test4.buypass.no/acme/directory";
+    };
+};

package/dist_ts/acme/acme.classes.directory.js

@@ -0,0 +1,14 @@
+/**
+ * ACME directory URL constants for well-known CAs
+ */
+export const ACME_DIRECTORY_URLS = {
+    letsencrypt: {
+        production: 'https://acme-v02.api.letsencrypt.org/directory',
+        staging: 'https://acme-staging-v02.api.letsencrypt.org/directory',
+    },
+    buypass: {
+        production: 'https://api.buypass.com/acme/directory',
+        staging: 'https://api.test4.buypass.no/acme/directory',
+    },
+};
+//# sourceMappingURL=data:application/json;base64,eyJ2ZXJzaW9uIjozLCJmaWxlIjoiYWNtZS5jbGFzc2VzLmRpcmVjdG9yeS5qcyIsInNvdXJjZVJvb3QiOiIiLCJzb3VyY2VzIjpbIi4uLy4uL3RzL2FjbWUvYWNtZS5jbGFzc2VzLmRpcmVjdG9yeS50cyJdLCJuYW1lcyI6W10sIm1hcHBpbmdzIjoiQUFBQTs7R0FFRztBQUNILE1BQU0sQ0FBQyxNQUFNLG1CQUFtQixHQUFHO0lBQ2pDLFdBQVcsRUFBRTtRQUNYLFVBQVUsRUFBRSxnREFBZ0Q7UUFDNUQsT0FBTyxFQUFFLHdEQUF3RDtLQUNsRTtJQUNELE9BQU8sRUFBRTtRQUNQLFVBQVUsRUFBRSx3Q0FBd0M7UUFDcEQsT0FBTyxFQUFFLDZDQUE2QztLQUN2RDtDQUNPLENBQUMifQ==

package/dist_ts/acme/acme.classes.error.d.ts

@@ -0,0 +1,44 @@
+/**
+ * Structured ACME protocol error with RFC 8555 fields.
+ * Provides type URN, subproblems, Retry-After, and retryability classification.
+ */
+export declare class AcmeError extends Error {
+    readonly status: number;
+    readonly type: string;
+    readonly detail: string;
+    readonly subproblems: Array<{
+        type: string;
+        detail: string;
+        identifier?: {
+            type: string;
+            value: string;
+        };
+    }>;
+    readonly url: string;
+    readonly retryAfter: number;
+    constructor(options: {
+        message?: string;
+        status: number;
+        type?: string;
+        detail?: string;
+        subproblems?: Array<{
+            type: string;
+            detail: string;
+            identifier?: {
+                type: string;
+                value: string;
+            };
+        }>;
+        url?: string;
+        retryAfter?: number;
+    });
+    /**
+     * True for HTTP 429 or ACME rateLimited type URN
+     */
+    get isRateLimited(): boolean;
+    /**
+     * True for transient/retryable errors: 429, 503, 5xx, badNonce.
+     * False for definitive client errors: 400 (non-badNonce), 403, 404, 409.
+     */
+    get isRetryable(): boolean;
+}

package/dist_ts/acme/acme.classes.error.js

@@ -0,0 +1,41 @@
+/**
+ * Structured ACME protocol error with RFC 8555 fields.
+ * Provides type URN, subproblems, Retry-After, and retryability classification.
+ */
+export class AcmeError extends Error {
+    constructor(options) {
+        const type = options.type || '';
+        const detail = options.detail || '';
+        const url = options.url || '';
+        const msg = options.message ||
+            `ACME error: ${type || 'unknown'} (HTTP ${options.status}) at ${url || 'unknown'} - ${detail || 'no detail'}`;
+        super(msg);
+        this.name = 'AcmeError';
+        this.status = options.status;
+        this.type = type;
+        this.detail = detail;
+        this.subproblems = options.subproblems || [];
+        this.url = url;
+        this.retryAfter = options.retryAfter || 0;
+    }
+    /**
+     * True for HTTP 429 or ACME rateLimited type URN
+     */
+    get isRateLimited() {
+        return this.status === 429 || this.type === 'urn:ietf:params:acme:error:rateLimited';
+    }
+    /**
+     * True for transient/retryable errors: 429, 503, 5xx, badNonce.
+     * False for definitive client errors: 400 (non-badNonce), 403, 404, 409.
+     */
+    get isRetryable() {
+        if (this.type === 'urn:ietf:params:acme:error:badNonce')
+            return true;
+        if (this.status === 429 || this.status === 503)
+            return true;
+        if (this.status >= 500)
+            return true;
+        return false;
+    }
+}
+//# sourceMappingURL=data:application/json;base64,eyJ2ZXJzaW9uIjozLCJmaWxlIjoiYWNtZS5jbGFzc2VzLmVycm9yLmpzIiwic291cmNlUm9vdCI6IiIsInNvdXJjZXMiOlsiLi4vLi4vdHMvYWNtZS9hY21lLmNsYXNzZXMuZXJyb3IudHMiXSwibmFtZXMiOltdLCJtYXBwaW5ncyI6IkFBQUE7OztHQUdHO0FBQ0gsTUFBTSxPQUFPLFNBQVUsU0FBUSxLQUFLO0lBUWxDLFlBQVksT0FRWDtRQUNDLE1BQU0sSUFBSSxHQUFHLE9BQU8sQ0FBQyxJQUFJLElBQUksRUFBRSxDQUFDO1FBQ2hDLE1BQU0sTUFBTSxHQUFHLE9BQU8sQ0FBQyxNQUFNLElBQUksRUFBRSxDQUFDO1FBQ3BDLE1BQU0sR0FBRyxHQUFHLE9BQU8sQ0FBQyxHQUFHLElBQUksRUFBRSxDQUFDO1FBQzlCLE1BQU0sR0FBRyxHQUNQLE9BQU8sQ0FBQyxPQUFPO1lBQ2YsZUFBZSxJQUFJLElBQUksU0FBUyxVQUFVLE9BQU8sQ0FBQyxNQUFNLFFBQVEsR0FBRyxJQUFJLFNBQVMsTUFBTSxNQUFNLElBQUksV0FBVyxFQUFFLENBQUM7UUFDaEgsS0FBSyxDQUFDLEdBQUcsQ0FBQyxDQUFDO1FBQ1gsSUFBSSxDQUFDLElBQUksR0FBRyxXQUFXLENBQUM7UUFDeEIsSUFBSSxDQUFDLE1BQU0sR0FBRyxPQUFPLENBQUMsTUFBTSxDQUFDO1FBQzdCLElBQUksQ0FBQyxJQUFJLEdBQUcsSUFBSSxDQUFDO1FBQ2pCLElBQUksQ0FBQyxNQUFNLEdBQUcsTUFBTSxDQUFDO1FBQ3JCLElBQUksQ0FBQyxXQUFXLEdBQUcsT0FBTyxDQUFDLFdBQVcsSUFBSSxFQUFFLENBQUM7UUFDN0MsSUFBSSxDQUFDLEdBQUcsR0FBRyxHQUFHLENBQUM7UUFDZixJQUFJLENBQUMsVUFBVSxHQUFHLE9BQU8sQ0FBQyxVQUFVLElBQUksQ0FBQyxDQUFDO0lBQzVDLENBQUM7SUFFRDs7T0FFRztJQUNILElBQUksYUFBYTtRQUNmLE9BQU8sSUFBSSxDQUFDLE1BQU0sS0FBSyxHQUFHLElBQUksSUFBSSxDQUFDLElBQUksS0FBSyx3Q0FBd0MsQ0FBQztJQUN2RixDQUFDO0lBRUQ7OztPQUdHO0lBQ0gsSUFBSSxXQUFXO1FBQ2IsSUFBSSxJQUFJLENBQUMsSUFBSSxLQUFLLHFDQUFxQztZQUFFLE9BQU8sSUFBSSxDQUFDO1FBQ3JFLElBQUksSUFBSSxDQUFDLE1BQU0sS0FBSyxHQUFHLElBQUksSUFBSSxDQUFDLE1BQU0sS0FBSyxHQUFHO1lBQUUsT0FBTyxJQUFJLENBQUM7UUFDNUQsSUFBSSxJQUFJLENBQUMsTUFBTSxJQUFJLEdBQUc7WUFBRSxPQUFPLElBQUksQ0FBQztRQUNwQyxPQUFPLEtBQUssQ0FBQztJQUNmLENBQUM7Q0FDRiJ9