@push.rocks/smartacme 8.0.0 → 9.0.0

package/dist_ts/acme/acme.classes.http-client.d.ts

@@ -0,0 +1,36 @@
+import type { IAcmeDirectory, IAcmeHttpResponse } from './acme.interfaces.js';
+export type TAcmeLogger = (level: string, message: string, data?: any) => void;
+/**
+ * JWS-signed HTTP transport for ACME protocol.
+ * Handles nonce management, bad-nonce retries, and signed requests.
+ */
+export declare class AcmeHttpClient {
+    private directoryUrl;
+    private accountKeyPem;
+    private directory;
+    private nonce;
+    kid: string | null;
+    private logger?;
+    constructor(directoryUrl: string, accountKeyPem: string, logger?: TAcmeLogger);
+    private log;
+    /**
+     * GET the ACME directory (cached after first call)
+     */
+    getDirectory(): Promise<IAcmeDirectory>;
+    /**
+     * Fetch a fresh nonce via HEAD to newNonce
+     */
+    getNonce(): Promise<string>;
+    /**
+     * Send a JWS-signed POST request to an ACME endpoint.
+     * Handles nonce rotation and bad-nonce retries (up to 5).
+     * payload=null means POST-as-GET.
+     */
+    signedRequest(url: string, payload: any | null, options?: {
+        useJwk?: boolean;
+    }): Promise<IAcmeHttpResponse>;
+    /**
+     * Raw HTTP request using native node:https
+     */
+    private httpRequest;
+}

package/dist_ts/acme/acme.classes.http-client.js

@@ -0,0 +1,201 @@
+import * as https from 'node:https';
+import * as http from 'node:http';
+import { AcmeCrypto } from './acme.classes.crypto.js';
+import { AcmeError } from './acme.classes.error.js';
+/**
+ * JWS-signed HTTP transport for ACME protocol.
+ * Handles nonce management, bad-nonce retries, and signed requests.
+ */
+export class AcmeHttpClient {
+    constructor(directoryUrl, accountKeyPem, logger) {
+        this.directory = null;
+        this.nonce = null;
+        this.kid = null;
+        this.directoryUrl = directoryUrl;
+        this.accountKeyPem = accountKeyPem;
+        this.logger = logger;
+    }
+    log(level, message, data) {
+        if (this.logger) {
+            this.logger(level, message, data);
+        }
+    }
+    /**
+     * GET the ACME directory (cached after first call)
+     */
+    async getDirectory() {
+        if (this.directory)
+            return this.directory;
+        const response = await this.httpRequest(this.directoryUrl, 'GET');
+        if (response.status !== 200) {
+            throw new AcmeError({
+                status: response.status,
+                type: response.data?.type || '',
+                detail: `Failed to fetch ACME directory`,
+                url: this.directoryUrl,
+            });
+        }
+        this.directory = response.data;
+        return this.directory;
+    }
+    /**
+     * Fetch a fresh nonce via HEAD to newNonce
+     */
+    async getNonce() {
+        if (this.nonce) {
+            const n = this.nonce;
+            this.nonce = null;
+            return n;
+        }
+        const dir = await this.getDirectory();
+        const response = await this.httpRequest(dir.newNonce, 'HEAD');
+        const nonce = response.headers['replay-nonce'];
+        if (!nonce) {
+            throw new Error('No replay-nonce header in newNonce response');
+        }
+        return nonce;
+    }
+    /**
+     * Send a JWS-signed POST request to an ACME endpoint.
+     * Handles nonce rotation and bad-nonce retries (up to 5).
+     * payload=null means POST-as-GET.
+     */
+    async signedRequest(url, payload, options) {
+        const maxRetries = 5;
+        for (let attempt = 0; attempt <= maxRetries; attempt++) {
+            const nonce = await this.getNonce();
+            const jwsOptions = { nonce };
+            if (options?.useJwk) {
+                jwsOptions.jwk = AcmeCrypto.getJwk(this.accountKeyPem);
+            }
+            else if (this.kid) {
+                jwsOptions.kid = this.kid;
+            }
+            else {
+                jwsOptions.jwk = AcmeCrypto.getJwk(this.accountKeyPem);
+            }
+            const jws = AcmeCrypto.createJws(this.accountKeyPem, url, payload, jwsOptions);
+            const body = JSON.stringify(jws);
+            const response = await this.httpRequest(url, 'POST', body, {
+                'Content-Type': 'application/jose+json',
+            });
+            // Save nonce from response for reuse
+            if (response.headers['replay-nonce']) {
+                this.nonce = response.headers['replay-nonce'];
+            }
+            this.log('debug', `ACME request: POST ${url} → ${response.status}`);
+            // Retry on bad-nonce
+            if (response.status === 400 &&
+                response.data?.type === 'urn:ietf:params:acme:error:badNonce') {
+                this.log('debug', `Bad nonce on attempt ${attempt + 1}, retrying`);
+                if (attempt < maxRetries) {
+                    this.nonce = null; // Force fresh nonce
+                    continue;
+                }
+            }
+            // Throw on error responses
+            if (response.status >= 400) {
+                const retryAfterRaw = response.headers['retry-after'];
+                let retryAfter = 0;
+                if (retryAfterRaw) {
+                    const parsed = parseInt(retryAfterRaw, 10);
+                    if (!isNaN(parsed)) {
+                        retryAfter = parsed;
+                    }
+                }
+                const acmeError = new AcmeError({
+                    status: response.status,
+                    type: response.data?.type || '',
+                    detail: response.data?.detail || JSON.stringify(response.data),
+                    subproblems: response.data?.subproblems,
+                    url,
+                    retryAfter,
+                });
+                if (acmeError.isRateLimited) {
+                    this.log('warn', `RATE LIMITED: ${url} (HTTP ${response.status}), Retry-After: ${retryAfter}s`, {
+                        type: acmeError.type,
+                        detail: acmeError.detail,
+                        retryAfter,
+                    });
+                }
+                else {
+                    this.log('warn', `ACME error: ${url} (HTTP ${response.status})`, {
+                        type: acmeError.type,
+                        detail: acmeError.detail,
+                    });
+                }
+                throw acmeError;
+            }
+            return response;
+        }
+        throw new Error('Max bad-nonce retries exceeded');
+    }
+    /**
+     * Raw HTTP request using native node:https
+     */
+    httpRequest(url, method, body, headers) {
+        return new Promise((resolve, reject) => {
+            const urlObj = new URL(url);
+            const isHttps = urlObj.protocol === 'https:';
+            const lib = isHttps ? https : http;
+            const requestHeaders = {
+                ...headers,
+                'User-Agent': 'smartacme-acme-client/1.0',
+            };
+            if (body) {
+                requestHeaders['Content-Length'] = Buffer.byteLength(body);
+            }
+            const options = {
+                hostname: urlObj.hostname,
+                port: urlObj.port || (isHttps ? 443 : 80),
+                path: urlObj.pathname + urlObj.search,
+                method,
+                headers: requestHeaders,
+            };
+            const req = lib.request(options, (res) => {
+                const chunks = [];
+                res.on('data', (chunk) => chunks.push(chunk));
+                res.on('end', () => {
+                    const responseBody = Buffer.concat(chunks).toString('utf-8');
+                    // Normalize headers to lowercase single-value
+                    const responseHeaders = {};
+                    for (const [key, value] of Object.entries(res.headers)) {
+                        if (typeof value === 'string') {
+                            responseHeaders[key.toLowerCase()] = value;
+                        }
+                        else if (Array.isArray(value)) {
+                            responseHeaders[key.toLowerCase()] = value[0];
+                        }
+                    }
+                    // Parse JSON if applicable, otherwise return raw string
+                    let data;
+                    const contentType = responseHeaders['content-type'] || '';
+                    if (contentType.includes('json')) {
+                        try {
+                            data = JSON.parse(responseBody);
+                        }
+                        catch {
+                            data = responseBody;
+                        }
+                    }
+                    else {
+                        data = responseBody;
+                    }
+                    resolve({
+                        status: res.statusCode || 0,
+                        headers: responseHeaders,
+                        data,
+                    });
+                });
+            });
+            req.on('error', reject);
+            req.setTimeout(30000, () => {
+                req.destroy(new Error('Request timeout'));
+            });
+            if (body)
+                req.write(body);
+            req.end();
+        });
+    }
+}
+//# sourceMappingURL=data:application/json;base64,eyJ2ZXJzaW9uIjozLCJmaWxlIjoiYWNtZS5jbGFzc2VzLmh0dHAtY2xpZW50LmpzIiwic291cmNlUm9vdCI6IiIsInNvdXJjZXMiOlsiLi4vLi4vdHMvYWNtZS9hY21lLmNsYXNzZXMuaHR0cC1jbGllbnQudHMiXSwibmFtZXMiOltdLCJtYXBwaW5ncyI6IkFBQUEsT0FBTyxLQUFLLEtBQUssTUFBTSxZQUFZLENBQUM7QUFDcEMsT0FBTyxLQUFLLElBQUksTUFBTSxXQUFXLENBQUM7QUFDbEMsT0FBTyxFQUFFLFVBQVUsRUFBRSxNQUFNLDBCQUEwQixDQUFDO0FBQ3RELE9BQU8sRUFBRSxTQUFTLEVBQUUsTUFBTSx5QkFBeUIsQ0FBQztBQUtwRDs7O0dBR0c7QUFDSCxNQUFNLE9BQU8sY0FBYztJQVF6QixZQUFZLFlBQW9CLEVBQUUsYUFBcUIsRUFBRSxNQUFvQjtRQUxyRSxjQUFTLEdBQTBCLElBQUksQ0FBQztRQUN4QyxVQUFLLEdBQWtCLElBQUksQ0FBQztRQUM3QixRQUFHLEdBQWtCLElBQUksQ0FBQztRQUkvQixJQUFJLENBQUMsWUFBWSxHQUFHLFlBQVksQ0FBQztRQUNqQyxJQUFJLENBQUMsYUFBYSxHQUFHLGFBQWEsQ0FBQztRQUNuQyxJQUFJLENBQUMsTUFBTSxHQUFHLE1BQU0sQ0FBQztJQUN2QixDQUFDO0lBRU8sR0FBRyxDQUFDLEtBQWEsRUFBRSxPQUFlLEVBQUUsSUFBVTtRQUNwRCxJQUFJLElBQUksQ0FBQyxNQUFNLEVBQUUsQ0FBQztZQUNoQixJQUFJLENBQUMsTUFBTSxDQUFDLEtBQUssRUFBRSxPQUFPLEVBQUUsSUFBSSxDQUFDLENBQUM7UUFDcEMsQ0FBQztJQUNILENBQUM7SUFFRDs7T0FFRztJQUNILEtBQUssQ0FBQyxZQUFZO1FBQ2hCLElBQUksSUFBSSxDQUFDLFNBQVM7WUFBRSxPQUFPLElBQUksQ0FBQyxTQUFTLENBQUM7UUFDMUMsTUFBTSxRQUFRLEdBQUcsTUFBTSxJQUFJLENBQUMsV0FBVyxDQUFDLElBQUksQ0FBQyxZQUFZLEVBQUUsS0FBSyxDQUFDLENBQUM7UUFDbEUsSUFBSSxRQUFRLENBQUMsTUFBTSxLQUFLLEdBQUcsRUFBRSxDQUFDO1lBQzVCLE1BQU0sSUFBSSxTQUFTLENBQUM7Z0JBQ2xCLE1BQU0sRUFBRSxRQUFRLENBQUMsTUFBTTtnQkFDdkIsSUFBSSxFQUFFLFFBQVEsQ0FBQyxJQUFJLEVBQUUsSUFBSSxJQUFJLEVBQUU7Z0JBQy9CLE1BQU0sRUFBRSxnQ0FBZ0M7Z0JBQ3hDLEdBQUcsRUFBRSxJQUFJLENBQUMsWUFBWTthQUN2QixDQUFDLENBQUM7UUFDTCxDQUFDO1FBQ0QsSUFBSSxDQUFDLFNBQVMsR0FBRyxRQUFRLENBQUMsSUFBc0IsQ0FBQztRQUNqRCxPQUFPLElBQUksQ0FBQyxTQUFTLENBQUM7SUFDeEIsQ0FBQztJQUVEOztPQUVHO0lBQ0gsS0FBSyxDQUFDLFFBQVE7UUFDWixJQUFJLElBQUksQ0FBQyxLQUFLLEVBQUUsQ0FBQztZQUNmLE1BQU0sQ0FBQyxHQUFHLElBQUksQ0FBQyxLQUFLLENBQUM7WUFDckIsSUFBSSxDQUFDLEtBQUssR0FBRyxJQUFJLENBQUM7WUFDbEIsT0FBTyxDQUFDLENBQUM7UUFDWCxDQUFDO1FBQ0QsTUFBTSxHQUFHLEdBQUcsTUFBTSxJQUFJLENBQUMsWUFBWSxFQUFFLENBQUM7UUFDdEMsTUFBTSxRQUFRLEdBQUcsTUFBTSxJQUFJLENBQUMsV0FBVyxDQUFDLEdBQUcsQ0FBQyxRQUFRLEVBQUUsTUFBTSxDQUFDLENBQUM7UUFDOUQsTUFBTSxLQUFLLEdBQUcsUUFBUSxDQUFDLE9BQU8sQ0FBQyxjQUFjLENBQUMsQ0FBQztRQUMvQyxJQUFJLENBQUMsS0FBSyxFQUFFLENBQUM7WUFDWCxNQUFNLElBQUksS0FBSyxDQUFDLDZDQUE2QyxDQUFDLENBQUM7UUFDakUsQ0FBQztRQUNELE9BQU8sS0FBSyxDQUFDO0lBQ2YsQ0FBQztJQUVEOzs7O09BSUc7SUFDSCxLQUFLLENBQUMsYUFBYSxDQUNqQixHQUFXLEVBQ1gsT0FBbUIsRUFDbkIsT0FBOEI7UUFFOUIsTUFBTSxVQUFVLEdBQUcsQ0FBQyxDQUFDO1FBRXJCLEtBQUssSUFBSSxPQUFPLEdBQUcsQ0FBQyxFQUFFLE9BQU8sSUFBSSxVQUFVLEVBQUUsT0FBTyxFQUFFLEVBQUUsQ0FBQztZQUN2RCxNQUFNLEtBQUssR0FBRyxNQUFNLElBQUksQ0FBQyxRQUFRLEVBQUUsQ0FBQztZQUVwQyxNQUFNLFVBQVUsR0FBa0UsRUFBRSxLQUFLLEVBQUUsQ0FBQztZQUM1RixJQUFJLE9BQU8sRUFBRSxNQUFNLEVBQUUsQ0FBQztnQkFDcEIsVUFBVSxDQUFDLEdBQUcsR0FBRyxVQUFVLENBQUMsTUFBTSxDQUFDLElBQUksQ0FBQyxhQUFhLENBQUMsQ0FBQztZQUN6RCxDQUFDO2lCQUFNLElBQUksSUFBSSxDQUFDLEdBQUcsRUFBRSxDQUFDO2dCQUNwQixVQUFVLENBQUMsR0FBRyxHQUFHLElBQUksQ0FBQyxHQUFHLENBQUM7WUFDNUIsQ0FBQztpQkFBTSxDQUFDO2dCQUNOLFVBQVUsQ0FBQyxHQUFHLEdBQUcsVUFBVSxDQUFDLE1BQU0sQ0FBQyxJQUFJLENBQUMsYUFBYSxDQUFDLENBQUM7WUFDekQsQ0FBQztZQUVELE1BQU0sR0FBRyxHQUFHLFVBQVUsQ0FBQyxTQUFTLENBQUMsSUFBSSxDQUFDLGFBQWEsRUFBRSxHQUFHLEVBQUUsT0FBTyxFQUFFLFVBQVUsQ0FBQyxDQUFDO1lBQy9FLE1BQU0sSUFBSSxHQUFHLElBQUksQ0FBQyxTQUFTLENBQUMsR0FBRyxDQUFDLENBQUM7WUFFakMsTUFBTSxRQUFRLEdBQUcsTUFBTSxJQUFJLENBQUMsV0FBVyxDQUFDLEdBQUcsRUFBRSxNQUFNLEVBQUUsSUFBSSxFQUFFO2dCQUN6RCxjQUFjLEVBQUUsdUJBQXVCO2FBQ3hDLENBQUMsQ0FBQztZQUVILHFDQUFxQztZQUNyQyxJQUFJLFFBQVEsQ0FBQyxPQUFPLENBQUMsY0FBYyxDQUFDLEVBQUUsQ0FBQztnQkFDckMsSUFBSSxDQUFDLEtBQUssR0FBRyxRQUFRLENBQUMsT0FBTyxDQUFDLGNBQWMsQ0FBQyxDQUFDO1lBQ2hELENBQUM7WUFFRCxJQUFJLENBQUMsR0FBRyxDQUFDLE9BQU8sRUFBRSxzQkFBc0IsR0FBRyxNQUFNLFFBQVEsQ0FBQyxNQUFNLEVBQUUsQ0FBQyxDQUFDO1lBRXBFLHFCQUFxQjtZQUNyQixJQUNFLFFBQVEsQ0FBQyxNQUFNLEtBQUssR0FBRztnQkFDdkIsUUFBUSxDQUFDLElBQUksRUFBRSxJQUFJLEtBQUsscUNBQXFDLEVBQzdELENBQUM7Z0JBQ0QsSUFBSSxDQUFDLEdBQUcsQ0FBQyxPQUFPLEVBQUUsd0JBQXdCLE9BQU8sR0FBRyxDQUFDLFlBQVksQ0FBQyxDQUFDO2dCQUNuRSxJQUFJLE9BQU8sR0FBRyxVQUFVLEVBQUUsQ0FBQztvQkFDekIsSUFBSSxDQUFDLEtBQUssR0FBRyxJQUFJLENBQUMsQ0FBQyxvQkFBb0I7b0JBQ3ZDLFNBQVM7Z0JBQ1gsQ0FBQztZQUNILENBQUM7WUFFRCwyQkFBMkI7WUFDM0IsSUFBSSxRQUFRLENBQUMsTUFBTSxJQUFJLEdBQUcsRUFBRSxDQUFDO2dCQUMzQixNQUFNLGFBQWEsR0FBRyxRQUFRLENBQUMsT0FBTyxDQUFDLGFBQWEsQ0FBQyxDQUFDO2dCQUN0RCxJQUFJLFVBQVUsR0FBRyxDQUFDLENBQUM7Z0JBQ25CLElBQUksYUFBYSxFQUFFLENBQUM7b0JBQ2xCLE1BQU0sTUFBTSxHQUFHLFFBQVEsQ0FBQyxhQUFhLEVBQUUsRUFBRSxDQUFDLENBQUM7b0JBQzNDLElBQUksQ0FBQyxLQUFLLENBQUMsTUFBTSxDQUFDLEVBQUUsQ0FBQzt3QkFDbkIsVUFBVSxHQUFHLE1BQU0sQ0FBQztvQkFDdEIsQ0FBQztnQkFDSCxDQUFDO2dCQUVELE1BQU0sU0FBUyxHQUFHLElBQUksU0FBUyxDQUFDO29CQUM5QixNQUFNLEVBQUUsUUFBUSxDQUFDLE1BQU07b0JBQ3ZCLElBQUksRUFBRSxRQUFRLENBQUMsSUFBSSxFQUFFLElBQUksSUFBSSxFQUFFO29CQUMvQixNQUFNLEVBQUUsUUFBUSxDQUFDLElBQUksRUFBRSxNQUFNLElBQUksSUFBSSxDQUFDLFNBQVMsQ0FBQyxRQUFRLENBQUMsSUFBSSxDQUFDO29CQUM5RCxXQUFXLEVBQUUsUUFBUSxDQUFDLElBQUksRUFBRSxXQUFXO29CQUN2QyxHQUFHO29CQUNILFVBQVU7aUJBQ1gsQ0FBQyxDQUFDO2dCQUVILElBQUksU0FBUyxDQUFDLGFBQWEsRUFBRSxDQUFDO29CQUM1QixJQUFJLENBQUMsR0FBRyxDQUFDLE1BQU0sRUFBRSxpQkFBaUIsR0FBRyxVQUFVLFFBQVEsQ0FBQyxNQUFNLG1CQUFtQixVQUFVLEdBQUcsRUFBRTt3QkFDOUYsSUFBSSxFQUFFLFNBQVMsQ0FBQyxJQUFJO3dCQUNwQixNQUFNLEVBQUUsU0FBUyxDQUFDLE1BQU07d0JBQ3hCLFVBQVU7cUJBQ1gsQ0FBQyxDQUFDO2dCQUNMLENBQUM7cUJBQU0sQ0FBQztvQkFDTixJQUFJLENBQUMsR0FBRyxDQUFDLE1BQU0sRUFBRSxlQUFlLEdBQUcsVUFBVSxRQUFRLENBQUMsTUFBTSxHQUFHLEVBQUU7d0JBQy9ELElBQUksRUFBRSxTQUFTLENBQUMsSUFBSTt3QkFDcEIsTUFBTSxFQUFFLFNBQVMsQ0FBQyxNQUFNO3FCQUN6QixDQUFDLENBQUM7Z0JBQ0wsQ0FBQztnQkFFRCxNQUFNLFNBQVMsQ0FBQztZQUNsQixDQUFDO1lBRUQsT0FBTyxRQUFRLENBQUM7UUFDbEIsQ0FBQztRQUVELE1BQU0sSUFBSSxLQUFLLENBQUMsZ0NBQWdDLENBQUMsQ0FBQztJQUNwRCxDQUFDO0lBRUQ7O09BRUc7SUFDSyxXQUFXLENBQ2pCLEdBQVcsRUFDWCxNQUFjLEVBQ2QsSUFBYSxFQUNiLE9BQWdDO1FBRWhDLE9BQU8sSUFBSSxPQUFPLENBQUMsQ0FBQyxPQUFPLEVBQUUsTUFBTSxFQUFFLEVBQUU7WUFDckMsTUFBTSxNQUFNLEdBQUcsSUFBSSxHQUFHLENBQUMsR0FBRyxDQUFDLENBQUM7WUFDNUIsTUFBTSxPQUFPLEdBQUcsTUFBTSxDQUFDLFFBQVEsS0FBSyxRQUFRLENBQUM7WUFDN0MsTUFBTSxHQUFHLEdBQUcsT0FBTyxDQUFDLENBQUMsQ0FBQyxLQUFLLENBQUMsQ0FBQyxDQUFDLElBQUksQ0FBQztZQUVuQyxNQUFNLGNBQWMsR0FBb0M7Z0JBQ3RELEdBQUcsT0FBTztnQkFDVixZQUFZLEVBQUUsMkJBQTJCO2FBQzFDLENBQUM7WUFDRixJQUFJLElBQUksRUFBRSxDQUFDO2dCQUNULGNBQWMsQ0FBQyxnQkFBZ0IsQ0FBQyxHQUFHLE1BQU0sQ0FBQyxVQUFVLENBQUMsSUFBSSxDQUFDLENBQUM7WUFDN0QsQ0FBQztZQUVELE1BQU0sT0FBTyxHQUF5QjtnQkFDcEMsUUFBUSxFQUFFLE1BQU0sQ0FBQyxRQUFRO2dCQUN6QixJQUFJLEVBQUUsTUFBTSxDQUFDLElBQUksSUFBSSxDQUFDLE9BQU8sQ0FBQyxDQUFDLENBQUMsR0FBRyxDQUFDLENBQUMsQ0FBQyxFQUFFLENBQUM7Z0JBQ3pDLElBQUksRUFBRSxNQUFNLENBQUMsUUFBUSxHQUFHLE1BQU0sQ0FBQyxNQUFNO2dCQUNyQyxNQUFNO2dCQUNOLE9BQU8sRUFBRSxjQUFjO2FBQ3hCLENBQUM7WUFFRixNQUFNLEdBQUcsR0FBRyxHQUFHLENBQUMsT0FBTyxDQUFDLE9BQU8sRUFBRSxDQUFDLEdBQUcsRUFBRSxFQUFFO2dCQUN2QyxNQUFNLE1BQU0sR0FBYSxFQUFFLENBQUM7Z0JBQzVCLEdBQUcsQ0FBQyxFQUFFLENBQUMsTUFBTSxFQUFFLENBQUMsS0FBYSxFQUFFLEVBQUUsQ0FBQyxNQUFNLENBQUMsSUFBSSxDQUFDLEtBQUssQ0FBQyxDQUFDLENBQUM7Z0JBQ3RELEdBQUcsQ0FBQyxFQUFFLENBQUMsS0FBSyxFQUFFLEdBQUcsRUFBRTtvQkFDakIsTUFBTSxZQUFZLEdBQUcsTUFBTSxDQUFDLE1BQU0sQ0FBQyxNQUFNLENBQUMsQ0FBQyxRQUFRLENBQUMsT0FBTyxDQUFDLENBQUM7b0JBRTdELDhDQUE4QztvQkFDOUMsTUFBTSxlQUFlLEdBQTJCLEVBQUUsQ0FBQztvQkFDbkQsS0FBSyxNQUFNLENBQUMsR0FBRyxFQUFFLEtBQUssQ0FBQyxJQUFJLE1BQU0sQ0FBQyxPQUFPLENBQUMsR0FBRyxDQUFDLE9BQU8sQ0FBQyxFQUFFLENBQUM7d0JBQ3ZELElBQUksT0FBTyxLQUFLLEtBQUssUUFBUSxFQUFFLENBQUM7NEJBQzlCLGVBQWUsQ0FBQyxHQUFHLENBQUMsV0FBVyxFQUFFLENBQUMsR0FBRyxLQUFLLENBQUM7d0JBQzdDLENBQUM7NkJBQU0sSUFBSSxLQUFLLENBQUMsT0FBTyxDQUFDLEtBQUssQ0FBQyxFQUFFLENBQUM7NEJBQ2hDLGVBQWUsQ0FBQyxHQUFHLENBQUMsV0FBVyxFQUFFLENBQUMsR0FBRyxLQUFLLENBQUMsQ0FBQyxDQUFDLENBQUM7d0JBQ2hELENBQUM7b0JBQ0gsQ0FBQztvQkFFRCx3REFBd0Q7b0JBQ3hELElBQUksSUFBUyxDQUFDO29CQUNkLE1BQU0sV0FBVyxHQUFHLGVBQWUsQ0FBQyxjQUFjLENBQUMsSUFBSSxFQUFFLENBQUM7b0JBQzFELElBQUksV0FBVyxDQUFDLFFBQVEsQ0FBQyxNQUFNLENBQUMsRUFBRSxDQUFDO3dCQUNqQyxJQUFJLENBQUM7NEJBQ0gsSUFBSSxHQUFHLElBQUksQ0FBQyxLQUFLLENBQUMsWUFBWSxDQUFDLENBQUM7d0JBQ2xDLENBQUM7d0JBQUMsTUFBTSxDQUFDOzRCQUNQLElBQUksR0FBRyxZQUFZLENBQUM7d0JBQ3RCLENBQUM7b0JBQ0gsQ0FBQzt5QkFBTSxDQUFDO3dCQUNOLElBQUksR0FBRyxZQUFZLENBQUM7b0JBQ3RCLENBQUM7b0JBRUQsT0FBTyxDQUFDO3dCQUNOLE1BQU0sRUFBRSxHQUFHLENBQUMsVUFBVSxJQUFJLENBQUM7d0JBQzNCLE9BQU8sRUFBRSxlQUFlO3dCQUN4QixJQUFJO3FCQUNMLENBQUMsQ0FBQztnQkFDTCxDQUFDLENBQUMsQ0FBQztZQUNMLENBQUMsQ0FBQyxDQUFDO1lBRUgsR0FBRyxDQUFDLEVBQUUsQ0FBQyxPQUFPLEVBQUUsTUFBTSxDQUFDLENBQUM7WUFDeEIsR0FBRyxDQUFDLFVBQVUsQ0FBQyxLQUFLLEVBQUUsR0FBRyxFQUFFO2dCQUN6QixHQUFHLENBQUMsT0FBTyxDQUFDLElBQUksS0FBSyxDQUFDLGlCQUFpQixDQUFDLENBQUMsQ0FBQztZQUM1QyxDQUFDLENBQUMsQ0FBQztZQUNILElBQUksSUFBSTtnQkFBRSxHQUFHLENBQUMsS0FBSyxDQUFDLElBQUksQ0FBQyxDQUFDO1lBQzFCLEdBQUcsQ0FBQyxHQUFHLEVBQUUsQ0FBQztRQUNaLENBQUMsQ0FBQyxDQUFDO0lBQ0wsQ0FBQztDQUNGIn0=

package/dist_ts/acme/acme.classes.order.d.ts

@@ -0,0 +1,40 @@
+import type { AcmeHttpClient } from './acme.classes.http-client.js';
+import type { IAcmeAuthorization, IAcmeIdentifier, IAcmeOrder } from './acme.interfaces.js';
+/**
+ * ACME order lifecycle management.
+ * Handles order creation, authorization retrieval, finalization, and certificate download.
+ */
+export declare class AcmeOrderManager {
+    private httpClient;
+    constructor(httpClient: AcmeHttpClient);
+    /**
+     * Create a new ACME order for the given identifiers
+     */
+    create(opts: {
+        identifiers: IAcmeIdentifier[];
+    }): Promise<IAcmeOrder>;
+    /**
+     * Retrieve all authorizations for an order (POST-as-GET each authorization URL)
+     */
+    getAuthorizations(order: IAcmeOrder): Promise<IAcmeAuthorization[]>;
+    /**
+     * Finalize an order by submitting the CSR.
+     * Waits for the order to reach 'valid' status.
+     * Mutates the order object with updated status and certificate URL.
+     */
+    finalize(order: IAcmeOrder, csrPem: string): Promise<void>;
+    /**
+     * Download the certificate chain (PEM) from the order's certificate URL
+     */
+    getCertificate(order: IAcmeOrder): Promise<string>;
+    /**
+     * Poll an ACME resource (order or challenge) until it reaches 'valid' or 'ready' status.
+     * Uses exponential backoff with Retry-After header support.
+     */
+    waitForValidStatus(item: {
+        url: string;
+    }, opts?: {
+        maxAttempts?: number;
+        initialDelayMs?: number;
+    }): Promise<any>;
+}

package/dist_ts/acme/acme.classes.order.js

@@ -0,0 +1,100 @@
+import { AcmeCrypto } from './acme.classes.crypto.js';
+import { AcmeError } from './acme.classes.error.js';
+/**
+ * ACME order lifecycle management.
+ * Handles order creation, authorization retrieval, finalization, and certificate download.
+ */
+export class AcmeOrderManager {
+    constructor(httpClient) {
+        this.httpClient = httpClient;
+    }
+    /**
+     * Create a new ACME order for the given identifiers
+     */
+    async create(opts) {
+        const dir = await this.httpClient.getDirectory();
+        const response = await this.httpClient.signedRequest(dir.newOrder, {
+            identifiers: opts.identifiers,
+        });
+        const order = response.data;
+        // Capture order URL from Location header
+        order.url = response.headers['location'] || '';
+        return order;
+    }
+    /**
+     * Retrieve all authorizations for an order (POST-as-GET each authorization URL)
+     */
+    async getAuthorizations(order) {
+        const authorizations = [];
+        for (const authzUrl of order.authorizations) {
+            const response = await this.httpClient.signedRequest(authzUrl, null);
+            authorizations.push(response.data);
+        }
+        return authorizations;
+    }
+    /**
+     * Finalize an order by submitting the CSR.
+     * Waits for the order to reach 'valid' status.
+     * Mutates the order object with updated status and certificate URL.
+     */
+    async finalize(order, csrPem) {
+        // Convert PEM CSR to base64url DER for ACME
+        const csrDer = AcmeCrypto.pemToBuffer(csrPem);
+        const csrB64url = csrDer.toString('base64url');
+        const response = await this.httpClient.signedRequest(order.finalize, { csr: csrB64url });
+        // Update order with response data
+        const updatedOrder = response.data;
+        order.status = updatedOrder.status;
+        if (updatedOrder.certificate) {
+            order.certificate = updatedOrder.certificate;
+        }
+        // If not yet valid, poll until it is
+        if (order.status !== 'valid' && order.url) {
+            const finalOrder = await this.waitForValidStatus({ url: order.url });
+            order.status = finalOrder.status;
+            order.certificate = finalOrder.certificate;
+        }
+    }
+    /**
+     * Download the certificate chain (PEM) from the order's certificate URL
+     */
+    async getCertificate(order) {
+        if (!order.certificate) {
+            throw new Error('Order does not have a certificate URL - finalize first');
+        }
+        const response = await this.httpClient.signedRequest(order.certificate, null);
+        // Certificate chain is returned as PEM text
+        return typeof response.data === 'string' ? response.data : response.data.toString();
+    }
+    /**
+     * Poll an ACME resource (order or challenge) until it reaches 'valid' or 'ready' status.
+     * Uses exponential backoff with Retry-After header support.
+     */
+    async waitForValidStatus(item, opts) {
+        const maxAttempts = opts?.maxAttempts ?? 30;
+        const initialDelay = opts?.initialDelayMs ?? 1000;
+        for (let i = 0; i < maxAttempts; i++) {
+            const response = await this.httpClient.signedRequest(item.url, null);
+            const body = response.data;
+            if (body.status === 'valid' || body.status === 'ready') {
+                return body;
+            }
+            if (body.status === 'invalid') {
+                const challengeError = body.challenges?.find((c) => c.error)?.error;
+                throw new AcmeError({
+                    status: 0,
+                    type: challengeError?.type || 'urn:ietf:params:acme:error:rejectedIdentifier',
+                    detail: challengeError?.detail || JSON.stringify(body),
+                    subproblems: challengeError?.subproblems,
+                    url: item.url,
+                });
+            }
+            // Respect Retry-After header, otherwise exponential backoff
+            const retryAfter = parseInt(response.headers['retry-after'] || '0', 10);
+            const delay = retryAfter > 0 ? retryAfter * 1000 : Math.min(initialDelay * Math.pow(2, i), 30000);
+            await new Promise((resolve) => setTimeout(resolve, delay));
+        }
+        throw new Error(`Timeout waiting for valid status after ${maxAttempts} attempts`);
+    }
+}
+//# sourceMappingURL=data:application/json;base64,eyJ2ZXJzaW9uIjozLCJmaWxlIjoiYWNtZS5jbGFzc2VzLm9yZGVyLmpzIiwic291cmNlUm9vdCI6IiIsInNvdXJjZXMiOlsiLi4vLi4vdHMvYWNtZS9hY21lLmNsYXNzZXMub3JkZXIudHMiXSwibmFtZXMiOltdLCJtYXBwaW5ncyI6IkFBQUEsT0FBTyxFQUFFLFVBQVUsRUFBRSxNQUFNLDBCQUEwQixDQUFDO0FBQ3RELE9BQU8sRUFBRSxTQUFTLEVBQUUsTUFBTSx5QkFBeUIsQ0FBQztBQVFwRDs7O0dBR0c7QUFDSCxNQUFNLE9BQU8sZ0JBQWdCO0lBRzNCLFlBQVksVUFBMEI7UUFDcEMsSUFBSSxDQUFDLFVBQVUsR0FBRyxVQUFVLENBQUM7SUFDL0IsQ0FBQztJQUVEOztPQUVHO0lBQ0gsS0FBSyxDQUFDLE1BQU0sQ0FBQyxJQUF3QztRQUNuRCxNQUFNLEdBQUcsR0FBRyxNQUFNLElBQUksQ0FBQyxVQUFVLENBQUMsWUFBWSxFQUFFLENBQUM7UUFDakQsTUFBTSxRQUFRLEdBQUcsTUFBTSxJQUFJLENBQUMsVUFBVSxDQUFDLGFBQWEsQ0FBQyxHQUFHLENBQUMsUUFBUSxFQUFFO1lBQ2pFLFdBQVcsRUFBRSxJQUFJLENBQUMsV0FBVztTQUM5QixDQUFDLENBQUM7UUFFSCxNQUFNLEtBQUssR0FBRyxRQUFRLENBQUMsSUFBa0IsQ0FBQztRQUMxQyx5Q0FBeUM7UUFDekMsS0FBSyxDQUFDLEdBQUcsR0FBRyxRQUFRLENBQUMsT0FBTyxDQUFDLFVBQVUsQ0FBQyxJQUFJLEVBQUUsQ0FBQztRQUMvQyxPQUFPLEtBQUssQ0FBQztJQUNmLENBQUM7SUFFRDs7T0FFRztJQUNILEtBQUssQ0FBQyxpQkFBaUIsQ0FBQyxLQUFpQjtRQUN2QyxNQUFNLGNBQWMsR0FBeUIsRUFBRSxDQUFDO1FBQ2hELEtBQUssTUFBTSxRQUFRLElBQUksS0FBSyxDQUFDLGNBQWMsRUFBRSxDQUFDO1lBQzVDLE1BQU0sUUFBUSxHQUFHLE1BQU0sSUFBSSxDQUFDLFVBQVUsQ0FBQyxhQUFhLENBQUMsUUFBUSxFQUFFLElBQUksQ0FBQyxDQUFDO1lBQ3JFLGNBQWMsQ0FBQyxJQUFJLENBQUMsUUFBUSxDQUFDLElBQTBCLENBQUMsQ0FBQztRQUMzRCxDQUFDO1FBQ0QsT0FBTyxjQUFjLENBQUM7SUFDeEIsQ0FBQztJQUVEOzs7O09BSUc7SUFDSCxLQUFLLENBQUMsUUFBUSxDQUFDLEtBQWlCLEVBQUUsTUFBYztRQUM5Qyw0Q0FBNEM7UUFDNUMsTUFBTSxNQUFNLEdBQUcsVUFBVSxDQUFDLFdBQVcsQ0FBQyxNQUFNLENBQUMsQ0FBQztRQUM5QyxNQUFNLFNBQVMsR0FBRyxNQUFNLENBQUMsUUFBUSxDQUFDLFdBQVcsQ0FBQyxDQUFDO1FBRS9DLE1BQU0sUUFBUSxHQUFHLE1BQU0sSUFBSSxDQUFDLFVBQVUsQ0FBQyxhQUFhLENBQUMsS0FBSyxDQUFDLFFBQVEsRUFBRSxFQUFFLEdBQUcsRUFBRSxTQUFTLEVBQUUsQ0FBQyxDQUFDO1FBRXpGLGtDQUFrQztRQUNsQyxNQUFNLFlBQVksR0FBRyxRQUFRLENBQUMsSUFBSSxDQUFDO1FBQ25DLEtBQUssQ0FBQyxNQUFNLEdBQUcsWUFBWSxDQUFDLE1BQU0sQ0FBQztRQUNuQyxJQUFJLFlBQVksQ0FBQyxXQUFXLEVBQUUsQ0FBQztZQUM3QixLQUFLLENBQUMsV0FBVyxHQUFHLFlBQVksQ0FBQyxXQUFXLENBQUM7UUFDL0MsQ0FBQztRQUVELHFDQUFxQztRQUNyQyxJQUFJLEtBQUssQ0FBQyxNQUFNLEtBQUssT0FBTyxJQUFJLEtBQUssQ0FBQyxHQUFHLEVBQUUsQ0FBQztZQUMxQyxNQUFNLFVBQVUsR0FBRyxNQUFNLElBQUksQ0FBQyxrQkFBa0IsQ0FBQyxFQUFFLEdBQUcsRUFBRSxLQUFLLENBQUMsR0FBRyxFQUFFLENBQUMsQ0FBQztZQUNyRSxLQUFLLENBQUMsTUFBTSxHQUFHLFVBQVUsQ0FBQyxNQUFNLENBQUM7WUFDakMsS0FBSyxDQUFDLFdBQVcsR0FBRyxVQUFVLENBQUMsV0FBVyxDQUFDO1FBQzdDLENBQUM7SUFDSCxDQUFDO0lBRUQ7O09BRUc7SUFDSCxLQUFLLENBQUMsY0FBYyxDQUFDLEtBQWlCO1FBQ3BDLElBQUksQ0FBQyxLQUFLLENBQUMsV0FBVyxFQUFFLENBQUM7WUFDdkIsTUFBTSxJQUFJLEtBQUssQ0FBQyx3REFBd0QsQ0FBQyxDQUFDO1FBQzVFLENBQUM7UUFDRCxNQUFNLFFBQVEsR0FBRyxNQUFNLElBQUksQ0FBQyxVQUFVLENBQUMsYUFBYSxDQUFDLEtBQUssQ0FBQyxXQUFXLEVBQUUsSUFBSSxDQUFDLENBQUM7UUFDOUUsNENBQTRDO1FBQzVDLE9BQU8sT0FBTyxRQUFRLENBQUMsSUFBSSxLQUFLLFFBQVEsQ0FBQyxDQUFDLENBQUMsUUFBUSxDQUFDLElBQUksQ0FBQyxDQUFDLENBQUMsUUFBUSxDQUFDLElBQUksQ0FBQyxRQUFRLEVBQUUsQ0FBQztJQUN0RixDQUFDO0lBRUQ7OztPQUdHO0lBQ0gsS0FBSyxDQUFDLGtCQUFrQixDQUN0QixJQUFxQixFQUNyQixJQUF3RDtRQUV4RCxNQUFNLFdBQVcsR0FBRyxJQUFJLEVBQUUsV0FBVyxJQUFJLEVBQUUsQ0FBQztRQUM1QyxNQUFNLFlBQVksR0FBRyxJQUFJLEVBQUUsY0FBYyxJQUFJLElBQUksQ0FBQztRQUVsRCxLQUFLLElBQUksQ0FBQyxHQUFHLENBQUMsRUFBRSxDQUFDLEdBQUcsV0FBVyxFQUFFLENBQUMsRUFBRSxFQUFFLENBQUM7WUFDckMsTUFBTSxRQUFRLEdBQUcsTUFBTSxJQUFJLENBQUMsVUFBVSxDQUFDLGFBQWEsQ0FBQyxJQUFJLENBQUMsR0FBRyxFQUFFLElBQUksQ0FBQyxDQUFDO1lBQ3JFLE1BQU0sSUFBSSxHQUFHLFFBQVEsQ0FBQyxJQUFJLENBQUM7WUFFM0IsSUFBSSxJQUFJLENBQUMsTUFBTSxLQUFLLE9BQU8sSUFBSSxJQUFJLENBQUMsTUFBTSxLQUFLLE9BQU8sRUFBRSxDQUFDO2dCQUN2RCxPQUFPLElBQUksQ0FBQztZQUNkLENBQUM7WUFDRCxJQUFJLElBQUksQ0FBQyxNQUFNLEtBQUssU0FBUyxFQUFFLENBQUM7Z0JBQzlCLE1BQU0sY0FBYyxHQUFHLElBQUksQ0FBQyxVQUFVLEVBQUUsSUFBSSxDQUFDLENBQUMsQ0FBTSxFQUFFLEVBQUUsQ0FBQyxDQUFDLENBQUMsS0FBSyxDQUFDLEVBQUUsS0FBSyxDQUFDO2dCQUN6RSxNQUFNLElBQUksU0FBUyxDQUFDO29CQUNsQixNQUFNLEVBQUUsQ0FBQztvQkFDVCxJQUFJLEVBQUUsY0FBYyxFQUFFLElBQUksSUFBSSwrQ0FBK0M7b0JBQzdFLE1BQU0sRUFBRSxjQUFjLEVBQUUsTUFBTSxJQUFJLElBQUksQ0FBQyxTQUFTLENBQUMsSUFBSSxDQUFDO29CQUN0RCxXQUFXLEVBQUUsY0FBYyxFQUFFLFdBQVc7b0JBQ3hDLEdBQUcsRUFBRSxJQUFJLENBQUMsR0FBRztpQkFDZCxDQUFDLENBQUM7WUFDTCxDQUFDO1lBRUQsNERBQTREO1lBQzVELE1BQU0sVUFBVSxHQUFHLFFBQVEsQ0FBQyxRQUFRLENBQUMsT0FBTyxDQUFDLGFBQWEsQ0FBQyxJQUFJLEdBQUcsRUFBRSxFQUFFLENBQUMsQ0FBQztZQUN4RSxNQUFNLEtBQUssR0FDVCxVQUFVLEdBQUcsQ0FBQyxDQUFDLENBQUMsQ0FBQyxVQUFVLEdBQUcsSUFBSSxDQUFDLENBQUMsQ0FBQyxJQUFJLENBQUMsR0FBRyxDQUFDLFlBQVksR0FBRyxJQUFJLENBQUMsR0FBRyxDQUFDLENBQUMsRUFBRSxDQUFDLENBQUMsRUFBRSxLQUFLLENBQUMsQ0FBQztZQUN0RixNQUFNLElBQUksT0FBTyxDQUFDLENBQUMsT0FBTyxFQUFFLEVBQUUsQ0FBQyxVQUFVLENBQUMsT0FBTyxFQUFFLEtBQUssQ0FBQyxDQUFDLENBQUM7UUFDN0QsQ0FBQztRQUVELE1BQU0sSUFBSSxLQUFLLENBQUMsMENBQTBDLFdBQVcsV0FBVyxDQUFDLENBQUM7SUFDcEYsQ0FBQztDQUNGIn0=

package/dist_ts/acme/acme.interfaces.d.ts

@@ -0,0 +1,64 @@
+/**
+ * ACME Protocol interfaces per RFC 8555
+ */
+export interface IAcmeDirectory {
+    newNonce: string;
+    newAccount: string;
+    newOrder: string;
+    newAuthz?: string;
+    revokeCert?: string;
+    keyChange?: string;
+    meta?: IAcmeDirectoryMeta;
+}
+export interface IAcmeDirectoryMeta {
+    termsOfService?: string;
+    website?: string;
+    caaIdentities?: string[];
+    externalAccountRequired?: boolean;
+}
+export interface IAcmeIdentifier {
+    type: 'dns';
+    value: string;
+}
+export interface IAcmeAccount {
+    status: string;
+    contact?: string[];
+    termsOfServiceAgreed?: boolean;
+    orders?: string;
+}
+export interface IAcmeAccountCreateRequest {
+    termsOfServiceAgreed: boolean;
+    contact?: string[];
+}
+export interface IAcmeOrder {
+    url: string;
+    status: string;
+    expires?: string;
+    identifiers: IAcmeIdentifier[];
+    authorizations: string[];
+    finalize: string;
+    certificate?: string;
+}
+export interface IAcmeAuthorization {
+    identifier: IAcmeIdentifier;
+    status: string;
+    expires?: string;
+    challenges: IAcmeChallenge[];
+    wildcard?: boolean;
+}
+export interface IAcmeChallenge {
+    type: string;
+    url: string;
+    status: string;
+    token: string;
+    validated?: string;
+}
+export interface IAcmeCsrOptions {
+    commonName: string;
+    altNames?: string[];
+}
+export interface IAcmeHttpResponse {
+    status: number;
+    headers: Record<string, string>;
+    data: any;
+}

package/dist_ts/acme/acme.interfaces.js

@@ -0,0 +1,5 @@
+/**
+ * ACME Protocol interfaces per RFC 8555
+ */
+export {};
+//# sourceMappingURL=data:application/json;base64,eyJ2ZXJzaW9uIjozLCJmaWxlIjoiYWNtZS5pbnRlcmZhY2VzLmpzIiwic291cmNlUm9vdCI6IiIsInNvdXJjZXMiOlsiLi4vLi4vdHMvYWNtZS9hY21lLmludGVyZmFjZXMudHMiXSwibmFtZXMiOltdLCJtYXBwaW5ncyI6IkFBQUE7O0dBRUcifQ==

package/dist_ts/acme/index.d.ts

@@ -0,0 +1,5 @@
+export { AcmeClient, type IAcmeClientOptions } from './acme.classes.client.js';
+export { AcmeCrypto } from './acme.classes.crypto.js';
+export { AcmeError } from './acme.classes.error.js';
+export { ACME_DIRECTORY_URLS } from './acme.classes.directory.js';
+export type { IAcmeDirectory, IAcmeDirectoryMeta, IAcmeIdentifier, IAcmeAccount, IAcmeAccountCreateRequest, IAcmeOrder, IAcmeAuthorization, IAcmeChallenge, IAcmeCsrOptions, IAcmeHttpResponse, } from './acme.interfaces.js';

package/dist_ts/acme/index.js

@@ -0,0 +1,5 @@
+export { AcmeClient } from './acme.classes.client.js';
+export { AcmeCrypto } from './acme.classes.crypto.js';
+export { AcmeError } from './acme.classes.error.js';
+export { ACME_DIRECTORY_URLS } from './acme.classes.directory.js';
+//# sourceMappingURL=data:application/json;base64,eyJ2ZXJzaW9uIjozLCJmaWxlIjoiaW5kZXguanMiLCJzb3VyY2VSb290IjoiIiwic291cmNlcyI6WyIuLi8uLi90cy9hY21lL2luZGV4LnRzIl0sIm5hbWVzIjpbXSwibWFwcGluZ3MiOiJBQUFBLE9BQU8sRUFBRSxVQUFVLEVBQTJCLE1BQU0sMEJBQTBCLENBQUM7QUFDL0UsT0FBTyxFQUFFLFVBQVUsRUFBRSxNQUFNLDBCQUEwQixDQUFDO0FBQ3RELE9BQU8sRUFBRSxTQUFTLEVBQUUsTUFBTSx5QkFBeUIsQ0FBQztBQUNwRCxPQUFPLEVBQUUsbUJBQW1CLEVBQUUsTUFBTSw2QkFBNkIsQ0FBQyJ9

package/dist_ts/certmanagers/mongo.js

@@ -9,7 +9,6 @@ export class MongoCertManager {
      */
     constructor(mongoDescriptor) {
         this.db = new plugins.smartdata.SmartdataDb(mongoDescriptor);
-        // Use a single EasyStore document to hold all certs keyed by domainName
         this.store = new plugins.smartdata.EasyStore('smartacme-certs', this.db);
     }
     async init() {
@@ -37,4 +36,4 @@ export class MongoCertManager {
         await this.store.wipe();
     }
 }
-//# sourceMappingURL=data:application/json;base64,eyJ2ZXJzaW9uIjozLCJmaWxlIjoibW9uZ28uanMiLCJzb3VyY2VSb290IjoiIiwic291cmNlcyI6WyIuLi8uLi90cy9jZXJ0bWFuYWdlcnMvbW9uZ28udHMiXSwibmFtZXMiOltdLCJtYXBwaW5ncyI6IkFBQUEsT0FBTyxLQUFLLE9BQU8sTUFBTSxlQUFlLENBQUM7QUFFekMsT0FBTyxFQUFFLGFBQWEsRUFBRSxNQUFNLDhCQUE4QixDQUFDO0FBRTdEOztHQUVHO0FBQ0gsTUFBTSxPQUFPLGdCQUFnQjtJQUkzQjs7T0FFRztJQUNILFlBQVksZUFBbUQ7UUFDN0QsSUFBSSxDQUFDLEVBQUUsR0FBRyxJQUFJLE9BQU8sQ0FBQyxTQUFTLENBQUMsV0FBVyxDQUFDLGVBQWUsQ0FBQyxDQUFDO1FBQzdELHdFQUF3RTtRQUN4RSxJQUFJLENBQUMsS0FBSyxHQUFHLElBQUksT0FBTyxDQUFDLFNBQVMsQ0FBQyxTQUFTLENBQzFDLGlCQUFpQixFQUNqQixJQUFJLENBQUMsRUFBRSxDQUNSLENBQUM7SUFDSixDQUFDO0lBRU0sS0FBSyxDQUFDLElBQUk7UUFDZixNQUFNLElBQUksQ0FBQyxFQUFFLENBQUMsSUFBSSxFQUFFLENBQUM7SUFDdkIsQ0FBQztJQUVNLEtBQUssQ0FBQyxtQkFBbUIsQ0FBQyxVQUFrQjtRQUNqRCxNQUFNLElBQUksR0FBRyxNQUFNLElBQUksQ0FBQyxLQUFLLENBQUMsT0FBTyxDQUFDLFVBQVUsQ0FBQyxDQUFDO1FBQ2xELE9BQU8sSUFBSSxDQUFDLENBQUMsQ0FBQyxJQUFJLGFBQWEsQ0FBQyxJQUFJLENBQUMsQ0FBQyxDQUFDLENBQUMsSUFBSSxDQUFDO0lBQy9DLENBQUM7SUFFTSxLQUFLLENBQUMsZ0JBQWdCLENBQUMsSUFBbUI7UUFDL0MscUNBQXFDO1FBQ3JDLE1BQU0sSUFBSSxDQUFDLEtBQUssQ0FBQyxRQUFRLENBQUMsSUFBSSxDQUFDLFVBQVUsRUFBRSxFQUFFLEdBQUcsSUFBSSxFQUFFLENBQUMsQ0FBQztJQUMxRCxDQUFDO0lBRU0sS0FBSyxDQUFDLGlCQUFpQixDQUFDLFVBQWtCO1FBQy9DLE1BQU0sSUFBSSxDQUFDLEtBQUssQ0FBQyxTQUFTLENBQUMsVUFBVSxDQUFDLENBQUM7SUFDekMsQ0FBQztJQUVNLEtBQUssQ0FBQyxLQUFLO1FBQ2hCLE1BQU0sSUFBSSxDQUFDLEVBQUUsQ0FBQyxLQUFLLEVBQUUsQ0FBQztJQUN4QixDQUFDO0lBQ0Q7O09BRUc7SUFDSSxLQUFLLENBQUMsSUFBSTtRQUNmLG1DQUFtQztRQUNuQyxNQUFNLElBQUksQ0FBQyxLQUFLLENBQUMsSUFBSSxFQUFFLENBQUM7SUFDMUIsQ0FBQztDQUNGIn0=
+//# sourceMappingURL=data:application/json;base64,eyJ2ZXJzaW9uIjozLCJmaWxlIjoibW9uZ28uanMiLCJzb3VyY2VSb290IjoiIiwic291cmNlcyI6WyIuLi8uLi90cy9jZXJ0bWFuYWdlcnMvbW9uZ28udHMiXSwibmFtZXMiOltdLCJtYXBwaW5ncyI6IkFBQUEsT0FBTyxLQUFLLE9BQU8sTUFBTSxlQUFlLENBQUM7QUFFekMsT0FBTyxFQUFFLGFBQWEsRUFBRSxNQUFNLDhCQUE4QixDQUFDO0FBRTdEOztHQUVHO0FBQ0gsTUFBTSxPQUFPLGdCQUFnQjtJQUkzQjs7T0FFRztJQUNILFlBQVksZUFBbUQ7UUFDN0QsSUFBSSxDQUFDLEVBQUUsR0FBRyxJQUFJLE9BQU8sQ0FBQyxTQUFTLENBQUMsV0FBVyxDQUFDLGVBQWUsQ0FBQyxDQUFDO1FBQzdELElBQUksQ0FBQyxLQUFLLEdBQUcsSUFBSSxPQUFPLENBQUMsU0FBUyxDQUFDLFNBQVMsQ0FDMUMsaUJBQWlCLEVBQ2pCLElBQUksQ0FBQyxFQUFFLENBQ1IsQ0FBQztJQUNKLENBQUM7SUFFTSxLQUFLLENBQUMsSUFBSTtRQUNmLE1BQU0sSUFBSSxDQUFDLEVBQUUsQ0FBQyxJQUFJLEVBQUUsQ0FBQztJQUN2QixDQUFDO0lBRU0sS0FBSyxDQUFDLG1CQUFtQixDQUFDLFVBQWtCO1FBQ2pELE1BQU0sSUFBSSxHQUFHLE1BQU0sSUFBSSxDQUFDLEtBQUssQ0FBQyxPQUFPLENBQUMsVUFBVSxDQUFDLENBQUM7UUFDbEQsT0FBTyxJQUFJLENBQUMsQ0FBQyxDQUFDLElBQUksYUFBYSxDQUFDLElBQUksQ0FBQyxDQUFDLENBQUMsQ0FBQyxJQUFJLENBQUM7SUFDL0MsQ0FBQztJQUVNLEtBQUssQ0FBQyxnQkFBZ0IsQ0FBQyxJQUFtQjtRQUMvQyxxQ0FBcUM7UUFDckMsTUFBTSxJQUFJLENBQUMsS0FBSyxDQUFDLFFBQVEsQ0FBQyxJQUFJLENBQUMsVUFBVSxFQUFFLEVBQUUsR0FBRyxJQUFJLEVBQUUsQ0FBQyxDQUFDO0lBQzFELENBQUM7SUFFTSxLQUFLLENBQUMsaUJBQWlCLENBQUMsVUFBa0I7UUFDL0MsTUFBTSxJQUFJLENBQUMsS0FBSyxDQUFDLFNBQVMsQ0FBQyxVQUFVLENBQUMsQ0FBQztJQUN6QyxDQUFDO0lBRU0sS0FBSyxDQUFDLEtBQUs7UUFDaEIsTUFBTSxJQUFJLENBQUMsRUFBRSxDQUFDLEtBQUssRUFBRSxDQUFDO0lBQ3hCLENBQUM7SUFDRDs7T0FFRztJQUNJLEtBQUssQ0FBQyxJQUFJO1FBQ2YsbUNBQW1DO1FBQ25DLE1BQU0sSUFBSSxDQUFDLEtBQUssQ0FBQyxJQUFJLEVBQUUsQ0FBQztJQUMxQixDQUFDO0NBQ0YifQ==

package/dist_ts/plugins.d.ts

@@ -3,24 +3,19 @@ import * as path from 'path';
 export { fs, path };
 import * as cloudflare from '@apiclient.xyz/cloudflare';
 export { cloudflare };
-import * as typedserver from '@api.global/typedserver';
-export { typedserver };
 import * as lik from '@push.rocks/lik';
 import * as smartdata from '@push.rocks/smartdata';
 import * as smartdelay from '@push.rocks/smartdelay';
 import * as smartdnsClient from '@push.rocks/smartdns/client';
-import * as smartfile from '@push.rocks/smartfile';
 import * as smartlog from '@push.rocks/smartlog';
 import * as smartnetwork from '@push.rocks/smartnetwork';
-import * as smartpromise from '@push.rocks/smartpromise';
-import * as smartrequest from '@push.rocks/smartrequest';
 import * as smartunique from '@push.rocks/smartunique';
 import * as smartstring from '@push.rocks/smartstring';
 import * as smarttime from '@push.rocks/smarttime';
-export { lik, smartdata, smartdelay, smartdnsClient, smartfile, smartlog, smartnetwork, smartpromise, smartrequest, smartunique, smartstring, smarttime, };
+export { lik, smartdata, smartdelay, smartdnsClient, smartlog, smartnetwork, smartunique, smartstring, smarttime, };
 import * as tsclass from '@tsclass/tsclass';
 export { tsclass };
-import * as acme from 'acme-client';
+import * as acme from './acme/index.js';
 export { acme };
 import * as handlers from './handlers/index.js';
 export { handlers };

package/dist_ts/plugins.js

@@ -5,30 +5,24 @@ export { fs, path };
 // @apiclient.xyz scope
 import * as cloudflare from '@apiclient.xyz/cloudflare';
 export { cloudflare };
-// @apiglobal scope
-import * as typedserver from '@api.global/typedserver';
-export { typedserver };
-// @pushrocks scope
+// @push.rocks scope
 import * as lik from '@push.rocks/lik';
 import * as smartdata from '@push.rocks/smartdata';
 import * as smartdelay from '@push.rocks/smartdelay';
 import * as smartdnsClient from '@push.rocks/smartdns/client';
-import * as smartfile from '@push.rocks/smartfile';
 import * as smartlog from '@push.rocks/smartlog';
 import * as smartnetwork from '@push.rocks/smartnetwork';
-import * as smartpromise from '@push.rocks/smartpromise';
-import * as smartrequest from '@push.rocks/smartrequest';
 import * as smartunique from '@push.rocks/smartunique';
 import * as smartstring from '@push.rocks/smartstring';
 import * as smarttime from '@push.rocks/smarttime';
-export { lik, smartdata, smartdelay, smartdnsClient, smartfile, smartlog, smartnetwork, smartpromise, smartrequest, smartunique, smartstring, smarttime, };
+export { lik, smartdata, smartdelay, smartdnsClient, smartlog, smartnetwork, smartunique, smartstring, smarttime, };
 // @tsclass scope
 import * as tsclass from '@tsclass/tsclass';
 export { tsclass };
-// third party scope
-import * as acme from 'acme-client';
+// acme protocol (custom implementation)
+import * as acme from './acme/index.js';
 export { acme };
 // local handlers for challenge types
 import * as handlers from './handlers/index.js';
 export { handlers };
-//# sourceMappingURL=data:application/json;base64,eyJ2ZXJzaW9uIjozLCJmaWxlIjoicGx1Z2lucy5qcyIsInNvdXJjZVJvb3QiOiIiLCJzb3VyY2VzIjpbIi4uL3RzL3BsdWdpbnMudHMiXSwibmFtZXMiOltdLCJtYXBwaW5ncyI6IkFBQUEsY0FBYztBQUNkLE9BQU8sS0FBSyxFQUFFLE1BQU0sSUFBSSxDQUFDO0FBQ3pCLE9BQU8sS0FBSyxJQUFJLE1BQU0sTUFBTSxDQUFDO0FBRTdCLE9BQU8sRUFBRSxFQUFFLEVBQUUsSUFBSSxFQUFFLENBQUM7QUFFcEIsdUJBQXVCO0FBQ3ZCLE9BQU8sS0FBSyxVQUFVLE1BQU0sMkJBQTJCLENBQUM7QUFFeEQsT0FBTyxFQUFFLFVBQVUsRUFBRSxDQUFDO0FBRXRCLG1CQUFtQjtBQUNuQixPQUFPLEtBQUssV0FBVyxNQUFNLHlCQUF5QixDQUFDO0FBRXZELE9BQU8sRUFBRSxXQUFXLEVBQUUsQ0FBQztBQUV2QixtQkFBbUI7QUFDbkIsT0FBTyxLQUFLLEdBQUcsTUFBTSxpQkFBaUIsQ0FBQztBQUN2QyxPQUFPLEtBQUssU0FBUyxNQUFNLHVCQUF1QixDQUFDO0FBQ25ELE9BQU8sS0FBSyxVQUFVLE1BQU0sd0JBQXdCLENBQUM7QUFDckQsT0FBTyxLQUFLLGNBQWMsTUFBTSw2QkFBNkIsQ0FBQztBQUM5RCxPQUFPLEtBQUssU0FBUyxNQUFNLHVCQUF1QixDQUFDO0FBQ25ELE9BQU8sS0FBSyxRQUFRLE1BQU0sc0JBQXNCLENBQUM7QUFDakQsT0FBTyxLQUFLLFlBQVksTUFBTSwwQkFBMEIsQ0FBQztBQUN6RCxPQUFPLEtBQUssWUFBWSxNQUFNLDBCQUEwQixDQUFDO0FBQ3pELE9BQU8sS0FBSyxZQUFZLE1BQU0sMEJBQTBCLENBQUM7QUFDekQsT0FBTyxLQUFLLFdBQVcsTUFBTSx5QkFBeUIsQ0FBQztBQUN2RCxPQUFPLEtBQUssV0FBVyxNQUFNLHlCQUF5QixDQUFDO0FBQ3ZELE9BQU8sS0FBSyxTQUFTLE1BQU0sdUJBQXVCLENBQUM7QUFFbkQsT0FBTyxFQUNMLEdBQUcsRUFDSCxTQUFTLEVBQ1QsVUFBVSxFQUNWLGNBQWMsRUFDZCxTQUFTLEVBQ1QsUUFBUSxFQUNSLFlBQVksRUFDWixZQUFZLEVBQ1osWUFBWSxFQUNaLFdBQVcsRUFDWCxXQUFXLEVBQ1gsU0FBUyxHQUNWLENBQUM7QUFFRixpQkFBaUI7QUFDakIsT0FBTyxLQUFLLE9BQU8sTUFBTSxrQkFBa0IsQ0FBQztBQUU1QyxPQUFPLEVBQUUsT0FBTyxFQUFFLENBQUM7QUFFbkIsb0JBQW9CO0FBQ3BCLE9BQU8sS0FBSyxJQUFJLE1BQU0sYUFBYSxDQUFDO0FBRXBDLE9BQU8sRUFBRSxJQUFJLEVBQUUsQ0FBQztBQUNoQixxQ0FBcUM7QUFDckMsT0FBTyxLQUFLLFFBQVEsTUFBTSxxQkFBcUIsQ0FBQztBQUNoRCxPQUFPLEVBQUUsUUFBUSxFQUFFLENBQUMifQ==
+//# sourceMappingURL=data:application/json;base64,eyJ2ZXJzaW9uIjozLCJmaWxlIjoicGx1Z2lucy5qcyIsInNvdXJjZVJvb3QiOiIiLCJzb3VyY2VzIjpbIi4uL3RzL3BsdWdpbnMudHMiXSwibmFtZXMiOltdLCJtYXBwaW5ncyI6IkFBQUEsY0FBYztBQUNkLE9BQU8sS0FBSyxFQUFFLE1BQU0sSUFBSSxDQUFDO0FBQ3pCLE9BQU8sS0FBSyxJQUFJLE1BQU0sTUFBTSxDQUFDO0FBRTdCLE9BQU8sRUFBRSxFQUFFLEVBQUUsSUFBSSxFQUFFLENBQUM7QUFFcEIsdUJBQXVCO0FBQ3ZCLE9BQU8sS0FBSyxVQUFVLE1BQU0sMkJBQTJCLENBQUM7QUFFeEQsT0FBTyxFQUFFLFVBQVUsRUFBRSxDQUFDO0FBRXRCLG9CQUFvQjtBQUNwQixPQUFPLEtBQUssR0FBRyxNQUFNLGlCQUFpQixDQUFDO0FBQ3ZDLE9BQU8sS0FBSyxTQUFTLE1BQU0sdUJBQXVCLENBQUM7QUFDbkQsT0FBTyxLQUFLLFVBQVUsTUFBTSx3QkFBd0IsQ0FBQztBQUNyRCxPQUFPLEtBQUssY0FBYyxNQUFNLDZCQUE2QixDQUFDO0FBQzlELE9BQU8sS0FBSyxRQUFRLE1BQU0sc0JBQXNCLENBQUM7QUFDakQsT0FBTyxLQUFLLFlBQVksTUFBTSwwQkFBMEIsQ0FBQztBQUN6RCxPQUFPLEtBQUssV0FBVyxNQUFNLHlCQUF5QixDQUFDO0FBQ3ZELE9BQU8sS0FBSyxXQUFXLE1BQU0seUJBQXlCLENBQUM7QUFDdkQsT0FBTyxLQUFLLFNBQVMsTUFBTSx1QkFBdUIsQ0FBQztBQUVuRCxPQUFPLEVBQ0wsR0FBRyxFQUNILFNBQVMsRUFDVCxVQUFVLEVBQ1YsY0FBYyxFQUNkLFFBQVEsRUFDUixZQUFZLEVBQ1osV0FBVyxFQUNYLFdBQVcsRUFDWCxTQUFTLEdBQ1YsQ0FBQztBQUVGLGlCQUFpQjtBQUNqQixPQUFPLEtBQUssT0FBTyxNQUFNLGtCQUFrQixDQUFDO0FBRTVDLE9BQU8sRUFBRSxPQUFPLEVBQUUsQ0FBQztBQUVuQix3Q0FBd0M7QUFDeEMsT0FBTyxLQUFLLElBQUksTUFBTSxpQkFBaUIsQ0FBQztBQUV4QyxPQUFPLEVBQUUsSUFBSSxFQUFFLENBQUM7QUFDaEIscUNBQXFDO0FBQ3JDLE9BQU8sS0FBSyxRQUFRLE1BQU0scUJBQXFCLENBQUM7QUFDaEQsT0FBTyxFQUFFLFFBQVEsRUFBRSxDQUFDIn0=

package/dist_ts/smartacme.classes.smartacme.d.ts

@@ -58,6 +58,8 @@ export declare class SmartAcme {
     private pendingChallenges;
     private challengePriority;
     private interestMap;
+    private boundSigintHandler;
+    private boundSigtermHandler;
     constructor(optionsArg: ISmartAcmeOptions);
     /**
      * starts the instance
@@ -70,7 +72,7 @@ export declare class SmartAcme {
      * Stops the SmartAcme instance and closes certificate store connections.
      */
     stop(): Promise<void>;
-    /** Retry helper with exponential backoff */
+    /** Retry helper with exponential backoff and AcmeError awareness */
     private retry;
     /** Clean up pending challenges and shut down */
     private handleShutdown;