@push.rocks/smartacme 9.1.2 → 9.2.0

package/dist_ts_server/server.classes.router.js

@@ -0,0 +1,99 @@
+import { AcmeServerError } from './server.classes.jws.verifier.js';
+/**
+ * Minimal HTTP router for the ACME server.
+ * Supports parameterized paths like /order/:id.
+ */
+export class AcmeRouter {
+    constructor(nonceManager) {
+        this.routes = [];
+        this.nonceManager = nonceManager;
+    }
+    addRoute(method, pattern, handler) {
+        this.routes.push({
+            method: method.toUpperCase(),
+            pattern,
+            segments: pattern.split('/').filter(Boolean),
+            handler,
+        });
+    }
+    async handle(req, res) {
+        const url = new URL(req.url || '/', `http://${req.headers.host || 'localhost'}`);
+        const method = (req.method || 'GET').toUpperCase();
+        const pathSegments = url.pathname.split('/').filter(Boolean);
+        // Always add a fresh nonce to every response
+        res.setHeader('Replay-Nonce', this.nonceManager.generate());
+        res.setHeader('Cache-Control', 'no-store');
+        // Find matching route
+        for (const route of this.routes) {
+            if (route.method !== method)
+                continue;
+            const params = this.matchPath(route.segments, pathSegments);
+            if (params === null)
+                continue;
+            try {
+                const body = method === 'POST' ? await this.parseBody(req) : undefined;
+                await route.handler(req, res, params, body);
+            }
+            catch (err) {
+                this.sendError(res, err);
+            }
+            return;
+        }
+        // No route found
+        this.sendError(res, new AcmeServerError(404, 'urn:ietf:params:acme:error:malformed', 'Not found'));
+    }
+    matchPath(routeSegments, pathSegments) {
+        if (routeSegments.length !== pathSegments.length)
+            return null;
+        const params = {};
+        for (let i = 0; i < routeSegments.length; i++) {
+            if (routeSegments[i].startsWith(':')) {
+                params[routeSegments[i].slice(1)] = pathSegments[i];
+            }
+            else if (routeSegments[i] !== pathSegments[i]) {
+                return null;
+            }
+        }
+        return params;
+    }
+    parseBody(req) {
+        return new Promise((resolve, reject) => {
+            const chunks = [];
+            req.on('data', (chunk) => chunks.push(chunk));
+            req.on('end', () => {
+                const raw = Buffer.concat(chunks).toString('utf-8');
+                if (!raw) {
+                    resolve(undefined);
+                    return;
+                }
+                try {
+                    resolve(JSON.parse(raw));
+                }
+                catch {
+                    reject(new AcmeServerError(400, 'urn:ietf:params:acme:error:malformed', 'Invalid JSON body'));
+                }
+            });
+            req.on('error', reject);
+        });
+    }
+    sendError(res, err) {
+        if (err instanceof AcmeServerError) {
+            res.writeHead(err.status, { 'Content-Type': 'application/problem+json' });
+            res.end(JSON.stringify({
+                type: err.type,
+                detail: err.detail,
+                status: err.status,
+            }));
+        }
+        else {
+            const message = err instanceof Error ? err.message : 'Internal server error';
+            res.writeHead(500, { 'Content-Type': 'application/problem+json' });
+            res.end(JSON.stringify({
+                type: 'urn:ietf:params:acme:error:serverInternal',
+                detail: message,
+                status: 500,
+            }));
+        }
+    }
+}
+//# sourceMappingURL=data:application/json;base64,eyJ2ZXJzaW9uIjozLCJmaWxlIjoic2VydmVyLmNsYXNzZXMucm91dGVyLmpzIiwic291cmNlUm9vdCI6IiIsInNvdXJjZXMiOlsiLi4vLi4vdHNfc2VydmVyL3NlcnZlci5jbGFzc2VzLnJvdXRlci50cyJdLCJuYW1lcyI6W10sIm1hcHBpbmdzIjoiQUFHQSxPQUFPLEVBQUUsZUFBZSxFQUFFLE1BQU0sa0NBQWtDLENBQUM7QUFTbkU7OztHQUdHO0FBQ0gsTUFBTSxPQUFPLFVBQVU7SUFJckIsWUFBWSxZQUEwQjtRQUg5QixXQUFNLEdBQWEsRUFBRSxDQUFDO1FBSTVCLElBQUksQ0FBQyxZQUFZLEdBQUcsWUFBWSxDQUFDO0lBQ25DLENBQUM7SUFFRCxRQUFRLENBQUMsTUFBYyxFQUFFLE9BQWUsRUFBRSxPQUFzQjtRQUM5RCxJQUFJLENBQUMsTUFBTSxDQUFDLElBQUksQ0FBQztZQUNmLE1BQU0sRUFBRSxNQUFNLENBQUMsV0FBVyxFQUFFO1lBQzVCLE9BQU87WUFDUCxRQUFRLEVBQUUsT0FBTyxDQUFDLEtBQUssQ0FBQyxHQUFHLENBQUMsQ0FBQyxNQUFNLENBQUMsT0FBTyxDQUFDO1lBQzVDLE9BQU87U0FDUixDQUFDLENBQUM7SUFDTCxDQUFDO0lBRUQsS0FBSyxDQUFDLE1BQU0sQ0FBQyxHQUF5QixFQUFFLEdBQXdCO1FBQzlELE1BQU0sR0FBRyxHQUFHLElBQUksR0FBRyxDQUFDLEdBQUcsQ0FBQyxHQUFHLElBQUksR0FBRyxFQUFFLFVBQVUsR0FBRyxDQUFDLE9BQU8sQ0FBQyxJQUFJLElBQUksV0FBVyxFQUFFLENBQUMsQ0FBQztRQUNqRixNQUFNLE1BQU0sR0FBRyxDQUFDLEdBQUcsQ0FBQyxNQUFNLElBQUksS0FBSyxDQUFDLENBQUMsV0FBVyxFQUFFLENBQUM7UUFDbkQsTUFBTSxZQUFZLEdBQUcsR0FBRyxDQUFDLFFBQVEsQ0FBQyxLQUFLLENBQUMsR0FBRyxDQUFDLENBQUMsTUFBTSxDQUFDLE9BQU8sQ0FBQyxDQUFDO1FBRTdELDZDQUE2QztRQUM3QyxHQUFHLENBQUMsU0FBUyxDQUFDLGNBQWMsRUFBRSxJQUFJLENBQUMsWUFBWSxDQUFDLFFBQVEsRUFBRSxDQUFDLENBQUM7UUFDNUQsR0FBRyxDQUFDLFNBQVMsQ0FBQyxlQUFlLEVBQUUsVUFBVSxDQUFDLENBQUM7UUFFM0Msc0JBQXNCO1FBQ3RCLEtBQUssTUFBTSxLQUFLLElBQUksSUFBSSxDQUFDLE1BQU0sRUFBRSxDQUFDO1lBQ2hDLElBQUksS0FBSyxDQUFDLE1BQU0sS0FBSyxNQUFNO2dCQUFFLFNBQVM7WUFDdEMsTUFBTSxNQUFNLEdBQUcsSUFBSSxDQUFDLFNBQVMsQ0FBQyxLQUFLLENBQUMsUUFBUSxFQUFFLFlBQVksQ0FBQyxDQUFDO1lBQzVELElBQUksTUFBTSxLQUFLLElBQUk7Z0JBQUUsU0FBUztZQUU5QixJQUFJLENBQUM7Z0JBQ0gsTUFBTSxJQUFJLEdBQUcsTUFBTSxLQUFLLE1BQU0sQ0FBQyxDQUFDLENBQUMsTUFBTSxJQUFJLENBQUMsU0FBUyxDQUFDLEdBQUcsQ0FBQyxDQUFDLENBQUMsQ0FBQyxTQUFTLENBQUM7Z0JBQ3ZFLE1BQU0sS0FBSyxDQUFDLE9BQU8sQ0FBQyxHQUFHLEVBQUUsR0FBRyxFQUFFLE1BQU0sRUFBRSxJQUFJLENBQUMsQ0FBQztZQUM5QyxDQUFDO1lBQUMsT0FBTyxHQUFHLEVBQUUsQ0FBQztnQkFDYixJQUFJLENBQUMsU0FBUyxDQUFDLEdBQUcsRUFBRSxHQUFHLENBQUMsQ0FBQztZQUMzQixDQUFDO1lBQ0QsT0FBTztRQUNULENBQUM7UUFFRCxpQkFBaUI7UUFDakIsSUFBSSxDQUFDLFNBQVMsQ0FBQyxHQUFHLEVBQUUsSUFBSSxlQUFlLENBQUMsR0FBRyxFQUFFLHNDQUFzQyxFQUFFLFdBQVcsQ0FBQyxDQUFDLENBQUM7SUFDckcsQ0FBQztJQUVPLFNBQVMsQ0FDZixhQUF1QixFQUN2QixZQUFzQjtRQUV0QixJQUFJLGFBQWEsQ0FBQyxNQUFNLEtBQUssWUFBWSxDQUFDLE1BQU07WUFBRSxPQUFPLElBQUksQ0FBQztRQUM5RCxNQUFNLE1BQU0sR0FBMkIsRUFBRSxDQUFDO1FBQzFDLEtBQUssSUFBSSxDQUFDLEdBQUcsQ0FBQyxFQUFFLENBQUMsR0FBRyxhQUFhLENBQUMsTUFBTSxFQUFFLENBQUMsRUFBRSxFQUFFLENBQUM7WUFDOUMsSUFBSSxhQUFhLENBQUMsQ0FBQyxDQUFDLENBQUMsVUFBVSxDQUFDLEdBQUcsQ0FBQyxFQUFFLENBQUM7Z0JBQ3JDLE1BQU0sQ0FBQyxhQUFhLENBQUMsQ0FBQyxDQUFDLENBQUMsS0FBSyxDQUFDLENBQUMsQ0FBQyxDQUFDLEdBQUcsWUFBWSxDQUFDLENBQUMsQ0FBQyxDQUFDO1lBQ3RELENBQUM7aUJBQU0sSUFBSSxhQUFhLENBQUMsQ0FBQyxDQUFDLEtBQUssWUFBWSxDQUFDLENBQUMsQ0FBQyxFQUFFLENBQUM7Z0JBQ2hELE9BQU8sSUFBSSxDQUFDO1lBQ2QsQ0FBQztRQUNILENBQUM7UUFDRCxPQUFPLE1BQU0sQ0FBQztJQUNoQixDQUFDO0lBRU8sU0FBUyxDQUFDLEdBQXlCO1FBQ3pDLE9BQU8sSUFBSSxPQUFPLENBQUMsQ0FBQyxPQUFPLEVBQUUsTUFBTSxFQUFFLEVBQUU7WUFDckMsTUFBTSxNQUFNLEdBQWEsRUFBRSxDQUFDO1lBQzVCLEdBQUcsQ0FBQyxFQUFFLENBQUMsTUFBTSxFQUFFLENBQUMsS0FBYSxFQUFFLEVBQUUsQ0FBQyxNQUFNLENBQUMsSUFBSSxDQUFDLEtBQUssQ0FBQyxDQUFDLENBQUM7WUFDdEQsR0FBRyxDQUFDLEVBQUUsQ0FBQyxLQUFLLEVBQUUsR0FBRyxFQUFFO2dCQUNqQixNQUFNLEdBQUcsR0FBRyxNQUFNLENBQUMsTUFBTSxDQUFDLE1BQU0sQ0FBQyxDQUFDLFFBQVEsQ0FBQyxPQUFPLENBQUMsQ0FBQztnQkFDcEQsSUFBSSxDQUFDLEdBQUcsRUFBRSxDQUFDO29CQUNULE9BQU8sQ0FBQyxTQUFTLENBQUMsQ0FBQztvQkFDbkIsT0FBTztnQkFDVCxDQUFDO2dCQUNELElBQUksQ0FBQztvQkFDSCxPQUFPLENBQUMsSUFBSSxDQUFDLEtBQUssQ0FBQyxHQUFHLENBQUMsQ0FBQyxDQUFDO2dCQUMzQixDQUFDO2dCQUFDLE1BQU0sQ0FBQztvQkFDUCxNQUFNLENBQUMsSUFBSSxlQUFlLENBQUMsR0FBRyxFQUFFLHNDQUFzQyxFQUFFLG1CQUFtQixDQUFDLENBQUMsQ0FBQztnQkFDaEcsQ0FBQztZQUNILENBQUMsQ0FBQyxDQUFDO1lBQ0gsR0FBRyxDQUFDLEVBQUUsQ0FBQyxPQUFPLEVBQUUsTUFBTSxDQUFDLENBQUM7UUFDMUIsQ0FBQyxDQUFDLENBQUM7SUFDTCxDQUFDO0lBRU8sU0FBUyxDQUFDLEdBQXdCLEVBQUUsR0FBWTtRQUN0RCxJQUFJLEdBQUcsWUFBWSxlQUFlLEVBQUUsQ0FBQztZQUNuQyxHQUFHLENBQUMsU0FBUyxDQUFDLEdBQUcsQ0FBQyxNQUFNLEVBQUUsRUFBRSxjQUFjLEVBQUUsMEJBQTBCLEVBQUUsQ0FBQyxDQUFDO1lBQzFFLEdBQUcsQ0FBQyxHQUFHLENBQUMsSUFBSSxDQUFDLFNBQVMsQ0FBQztnQkFDckIsSUFBSSxFQUFFLEdBQUcsQ0FBQyxJQUFJO2dCQUNkLE1BQU0sRUFBRSxHQUFHLENBQUMsTUFBTTtnQkFDbEIsTUFBTSxFQUFFLEdBQUcsQ0FBQyxNQUFNO2FBQ25CLENBQUMsQ0FBQyxDQUFDO1FBQ04sQ0FBQzthQUFNLENBQUM7WUFDTixNQUFNLE9BQU8sR0FBRyxHQUFHLFlBQVksS0FBSyxDQUFDLENBQUMsQ0FBQyxHQUFHLENBQUMsT0FBTyxDQUFDLENBQUMsQ0FBQyx1QkFBdUIsQ0FBQztZQUM3RSxHQUFHLENBQUMsU0FBUyxDQUFDLEdBQUcsRUFBRSxFQUFFLGNBQWMsRUFBRSwwQkFBMEIsRUFBRSxDQUFDLENBQUM7WUFDbkUsR0FBRyxDQUFDLEdBQUcsQ0FBQyxJQUFJLENBQUMsU0FBUyxDQUFDO2dCQUNyQixJQUFJLEVBQUUsMkNBQTJDO2dCQUNqRCxNQUFNLEVBQUUsT0FBTztnQkFDZixNQUFNLEVBQUUsR0FBRzthQUNaLENBQUMsQ0FBQyxDQUFDO1FBQ04sQ0FBQztJQUNILENBQUM7Q0FDRiJ9

package/dist_ts_server/server.handlers.account.d.ts

@@ -0,0 +1,8 @@
+import type * as http from 'node:http';
+import type { JwsVerifier } from './server.classes.jws.verifier.js';
+import type { IServerAccountStore } from './server.interfaces.js';
+/**
+ * POST /new-account — Register or retrieve an ACME account.
+ * Expects JWS with JWK in protected header (not kid).
+ */
+export declare function createAccountHandler(baseUrl: string, jwsVerifier: JwsVerifier, accountStore: IServerAccountStore): (req: http.IncomingMessage, res: http.ServerResponse, _params: Record<string, string>, body: any) => Promise<void>;

package/dist_ts_server/server.handlers.account.js

@@ -0,0 +1,59 @@
+import * as crypto from 'node:crypto';
+import { AcmeCrypto } from '../dist_ts/acme/acme.classes.crypto.js';
+import { AcmeServerError } from './server.classes.jws.verifier.js';
+/**
+ * POST /new-account — Register or retrieve an ACME account.
+ * Expects JWS with JWK in protected header (not kid).
+ */
+export function createAccountHandler(baseUrl, jwsVerifier, accountStore) {
+    return async (req, res, _params, body) => {
+        const requestUrl = `${baseUrl}/new-account`;
+        const verified = await jwsVerifier.verify(body, requestUrl);
+        // Account creation must use JWK, not kid
+        if (verified.kid) {
+            throw new AcmeServerError(400, 'urn:ietf:params:acme:error:malformed', 'newAccount requests must use JWK, not kid');
+        }
+        const { payload, jwk, thumbprint } = verified;
+        // Check if account already exists
+        const existing = await accountStore.getByThumbprint(thumbprint);
+        if (existing) {
+            // If onlyReturnExisting, or just returning the existing account
+            res.writeHead(200, {
+                'Content-Type': 'application/json',
+                'Location': existing.url,
+            });
+            res.end(JSON.stringify({
+                status: existing.status,
+                contact: existing.contact,
+                orders: `${baseUrl}/account/${existing.id}/orders`,
+            }));
+            return;
+        }
+        // onlyReturnExisting = true but no account found
+        if (payload?.onlyReturnExisting) {
+            throw new AcmeServerError(400, 'urn:ietf:params:acme:error:accountDoesNotExist', 'Account does not exist');
+        }
+        // Create new account
+        const id = crypto.randomBytes(16).toString('hex');
+        const accountUrl = `${baseUrl}/account/${id}`;
+        const account = await accountStore.create({
+            id,
+            thumbprint,
+            url: accountUrl,
+            jwk,
+            status: 'valid',
+            contact: payload?.contact || [],
+            createdAt: new Date().toISOString(),
+        });
+        res.writeHead(201, {
+            'Content-Type': 'application/json',
+            'Location': accountUrl,
+        });
+        res.end(JSON.stringify({
+            status: account.status,
+            contact: account.contact,
+            orders: `${baseUrl}/account/${id}/orders`,
+        }));
+    };
+}
+//# sourceMappingURL=data:application/json;base64,eyJ2ZXJzaW9uIjozLCJmaWxlIjoic2VydmVyLmhhbmRsZXJzLmFjY291bnQuanMiLCJzb3VyY2VSb290IjoiIiwic291cmNlcyI6WyIuLi8uLi90c19zZXJ2ZXIvc2VydmVyLmhhbmRsZXJzLmFjY291bnQudHMiXSwibmFtZXMiOltdLCJtYXBwaW5ncyI6IkFBQ0EsT0FBTyxLQUFLLE1BQU0sTUFBTSxhQUFhLENBQUM7QUFDdEMsT0FBTyxFQUFFLFVBQVUsRUFBRSxNQUFNLG1DQUFtQyxDQUFDO0FBRS9ELE9BQU8sRUFBRSxlQUFlLEVBQUUsTUFBTSxrQ0FBa0MsQ0FBQztBQUduRTs7O0dBR0c7QUFDSCxNQUFNLFVBQVUsb0JBQW9CLENBQ2xDLE9BQWUsRUFDZixXQUF3QixFQUN4QixZQUFpQztJQUVqQyxPQUFPLEtBQUssRUFDVixHQUF5QixFQUN6QixHQUF3QixFQUN4QixPQUErQixFQUMvQixJQUFTLEVBQ00sRUFBRTtRQUNqQixNQUFNLFVBQVUsR0FBRyxHQUFHLE9BQU8sY0FBYyxDQUFDO1FBQzVDLE1BQU0sUUFBUSxHQUFHLE1BQU0sV0FBVyxDQUFDLE1BQU0sQ0FBQyxJQUFJLEVBQUUsVUFBVSxDQUFDLENBQUM7UUFFNUQseUNBQXlDO1FBQ3pDLElBQUksUUFBUSxDQUFDLEdBQUcsRUFBRSxDQUFDO1lBQ2pCLE1BQU0sSUFBSSxlQUFlLENBQ3ZCLEdBQUcsRUFDSCxzQ0FBc0MsRUFDdEMsMkNBQTJDLENBQzVDLENBQUM7UUFDSixDQUFDO1FBRUQsTUFBTSxFQUFFLE9BQU8sRUFBRSxHQUFHLEVBQUUsVUFBVSxFQUFFLEdBQUcsUUFBUSxDQUFDO1FBRTlDLGtDQUFrQztRQUNsQyxNQUFNLFFBQVEsR0FBRyxNQUFNLFlBQVksQ0FBQyxlQUFlLENBQUMsVUFBVSxDQUFDLENBQUM7UUFDaEUsSUFBSSxRQUFRLEVBQUUsQ0FBQztZQUNiLGdFQUFnRTtZQUNoRSxHQUFHLENBQUMsU0FBUyxDQUFDLEdBQUcsRUFBRTtnQkFDakIsY0FBYyxFQUFFLGtCQUFrQjtnQkFDbEMsVUFBVSxFQUFFLFFBQVEsQ0FBQyxHQUFHO2FBQ3pCLENBQUMsQ0FBQztZQUNILEdBQUcsQ0FBQyxHQUFHLENBQUMsSUFBSSxDQUFDLFNBQVMsQ0FBQztnQkFDckIsTUFBTSxFQUFFLFFBQVEsQ0FBQyxNQUFNO2dCQUN2QixPQUFPLEVBQUUsUUFBUSxDQUFDLE9BQU87Z0JBQ3pCLE1BQU0sRUFBRSxHQUFHLE9BQU8sWUFBWSxRQUFRLENBQUMsRUFBRSxTQUFTO2FBQ25ELENBQUMsQ0FBQyxDQUFDO1lBQ0osT0FBTztRQUNULENBQUM7UUFFRCxpREFBaUQ7UUFDakQsSUFBSSxPQUFPLEVBQUUsa0JBQWtCLEVBQUUsQ0FBQztZQUNoQyxNQUFNLElBQUksZUFBZSxDQUN2QixHQUFHLEVBQ0gsZ0RBQWdELEVBQ2hELHdCQUF3QixDQUN6QixDQUFDO1FBQ0osQ0FBQztRQUVELHFCQUFxQjtRQUNyQixNQUFNLEVBQUUsR0FBRyxNQUFNLENBQUMsV0FBVyxDQUFDLEVBQUUsQ0FBQyxDQUFDLFFBQVEsQ0FBQyxLQUFLLENBQUMsQ0FBQztRQUNsRCxNQUFNLFVBQVUsR0FBRyxHQUFHLE9BQU8sWUFBWSxFQUFFLEVBQUUsQ0FBQztRQUM5QyxNQUFNLE9BQU8sR0FBRyxNQUFNLFlBQVksQ0FBQyxNQUFNLENBQUM7WUFDeEMsRUFBRTtZQUNGLFVBQVU7WUFDVixHQUFHLEVBQUUsVUFBVTtZQUNmLEdBQUc7WUFDSCxNQUFNLEVBQUUsT0FBTztZQUNmLE9BQU8sRUFBRSxPQUFPLEVBQUUsT0FBTyxJQUFJLEVBQUU7WUFDL0IsU0FBUyxFQUFFLElBQUksSUFBSSxFQUFFLENBQUMsV0FBVyxFQUFFO1NBQ3BDLENBQUMsQ0FBQztRQUVILEdBQUcsQ0FBQyxTQUFTLENBQUMsR0FBRyxFQUFFO1lBQ2pCLGNBQWMsRUFBRSxrQkFBa0I7WUFDbEMsVUFBVSxFQUFFLFVBQVU7U0FDdkIsQ0FBQyxDQUFDO1FBQ0gsR0FBRyxDQUFDLEdBQUcsQ0FBQyxJQUFJLENBQUMsU0FBUyxDQUFDO1lBQ3JCLE1BQU0sRUFBRSxPQUFPLENBQUMsTUFBTTtZQUN0QixPQUFPLEVBQUUsT0FBTyxDQUFDLE9BQU87WUFDeEIsTUFBTSxFQUFFLEdBQUcsT0FBTyxZQUFZLEVBQUUsU0FBUztTQUMxQyxDQUFDLENBQUMsQ0FBQztJQUNOLENBQUMsQ0FBQztBQUNKLENBQUMifQ==

package/dist_ts_server/server.handlers.authz.d.ts

@@ -0,0 +1,7 @@
+import type * as http from 'node:http';
+import type { JwsVerifier } from './server.classes.jws.verifier.js';
+import type { IServerOrderStore } from './server.interfaces.js';
+/**
+ * POST /authz/:id — Return authorization with embedded challenges (POST-as-GET).
+ */
+export declare function createAuthzHandler(baseUrl: string, jwsVerifier: JwsVerifier, orderStore: IServerOrderStore): (req: http.IncomingMessage, res: http.ServerResponse, params: Record<string, string>, body: any) => Promise<void>;

package/dist_ts_server/server.handlers.authz.js

@@ -0,0 +1,41 @@
+import { AcmeServerError } from './server.classes.jws.verifier.js';
+/**
+ * POST /authz/:id — Return authorization with embedded challenges (POST-as-GET).
+ */
+export function createAuthzHandler(baseUrl, jwsVerifier, orderStore) {
+    return async (req, res, params, body) => {
+        const authzId = params.id;
+        const requestUrl = `${baseUrl}/authz/${authzId}`;
+        await jwsVerifier.verify(body, requestUrl);
+        const authz = await orderStore.getAuthorization(authzId);
+        if (!authz) {
+            throw new AcmeServerError(404, 'urn:ietf:params:acme:error:malformed', 'Authorization not found');
+        }
+        // Build challenge objects
+        const challenges = [];
+        for (const challengeId of authz.challengeIds) {
+            const challenge = await orderStore.getChallenge(challengeId);
+            if (challenge) {
+                challenges.push({
+                    type: challenge.type,
+                    url: `${baseUrl}/challenge/${challenge.id}`,
+                    status: challenge.status,
+                    token: challenge.token,
+                    ...(challenge.validated ? { validated: challenge.validated } : {}),
+                });
+            }
+        }
+        const responseBody = {
+            identifier: authz.identifier,
+            status: authz.status,
+            expires: authz.expires,
+            challenges,
+        };
+        if (authz.wildcard) {
+            responseBody.wildcard = true;
+        }
+        res.writeHead(200, { 'Content-Type': 'application/json' });
+        res.end(JSON.stringify(responseBody));
+    };
+}
+//# sourceMappingURL=data:application/json;base64,eyJ2ZXJzaW9uIjozLCJmaWxlIjoic2VydmVyLmhhbmRsZXJzLmF1dGh6LmpzIiwic291cmNlUm9vdCI6IiIsInNvdXJjZXMiOlsiLi4vLi4vdHNfc2VydmVyL3NlcnZlci5oYW5kbGVycy5hdXRoei50cyJdLCJuYW1lcyI6W10sIm1hcHBpbmdzIjoiQUFFQSxPQUFPLEVBQUUsZUFBZSxFQUFFLE1BQU0sa0NBQWtDLENBQUM7QUFHbkU7O0dBRUc7QUFDSCxNQUFNLFVBQVUsa0JBQWtCLENBQ2hDLE9BQWUsRUFDZixXQUF3QixFQUN4QixVQUE2QjtJQUU3QixPQUFPLEtBQUssRUFDVixHQUF5QixFQUN6QixHQUF3QixFQUN4QixNQUE4QixFQUM5QixJQUFTLEVBQ00sRUFBRTtRQUNqQixNQUFNLE9BQU8sR0FBRyxNQUFNLENBQUMsRUFBRSxDQUFDO1FBQzFCLE1BQU0sVUFBVSxHQUFHLEdBQUcsT0FBTyxVQUFVLE9BQU8sRUFBRSxDQUFDO1FBQ2pELE1BQU0sV0FBVyxDQUFDLE1BQU0sQ0FBQyxJQUFJLEVBQUUsVUFBVSxDQUFDLENBQUM7UUFFM0MsTUFBTSxLQUFLLEdBQUcsTUFBTSxVQUFVLENBQUMsZ0JBQWdCLENBQUMsT0FBTyxDQUFDLENBQUM7UUFDekQsSUFBSSxDQUFDLEtBQUssRUFBRSxDQUFDO1lBQ1gsTUFBTSxJQUFJLGVBQWUsQ0FBQyxHQUFHLEVBQUUsc0NBQXNDLEVBQUUseUJBQXlCLENBQUMsQ0FBQztRQUNwRyxDQUFDO1FBRUQsMEJBQTBCO1FBQzFCLE1BQU0sVUFBVSxHQUFHLEVBQUUsQ0FBQztRQUN0QixLQUFLLE1BQU0sV0FBVyxJQUFJLEtBQUssQ0FBQyxZQUFZLEVBQUUsQ0FBQztZQUM3QyxNQUFNLFNBQVMsR0FBRyxNQUFNLFVBQVUsQ0FBQyxZQUFZLENBQUMsV0FBVyxDQUFDLENBQUM7WUFDN0QsSUFBSSxTQUFTLEVBQUUsQ0FBQztnQkFDZCxVQUFVLENBQUMsSUFBSSxDQUFDO29CQUNkLElBQUksRUFBRSxTQUFTLENBQUMsSUFBSTtvQkFDcEIsR0FBRyxFQUFFLEdBQUcsT0FBTyxjQUFjLFNBQVMsQ0FBQyxFQUFFLEVBQUU7b0JBQzNDLE1BQU0sRUFBRSxTQUFTLENBQUMsTUFBTTtvQkFDeEIsS0FBSyxFQUFFLFNBQVMsQ0FBQyxLQUFLO29CQUN0QixHQUFHLENBQUMsU0FBUyxDQUFDLFNBQVMsQ0FBQyxDQUFDLENBQUMsRUFBRSxTQUFTLEVBQUUsU0FBUyxDQUFDLFNBQVMsRUFBRSxDQUFDLENBQUMsQ0FBQyxFQUFFLENBQUM7aUJBQ25FLENBQUMsQ0FBQztZQUNMLENBQUM7UUFDSCxDQUFDO1FBRUQsTUFBTSxZQUFZLEdBQXdCO1lBQ3hDLFVBQVUsRUFBRSxLQUFLLENBQUMsVUFBVTtZQUM1QixNQUFNLEVBQUUsS0FBSyxDQUFDLE1BQU07WUFDcEIsT0FBTyxFQUFFLEtBQUssQ0FBQyxPQUFPO1lBQ3RCLFVBQVU7U0FDWCxDQUFDO1FBRUYsSUFBSSxLQUFLLENBQUMsUUFBUSxFQUFFLENBQUM7WUFDbkIsWUFBWSxDQUFDLFFBQVEsR0FBRyxJQUFJLENBQUM7UUFDL0IsQ0FBQztRQUVELEdBQUcsQ0FBQyxTQUFTLENBQUMsR0FBRyxFQUFFLEVBQUUsY0FBYyxFQUFFLGtCQUFrQixFQUFFLENBQUMsQ0FBQztRQUMzRCxHQUFHLENBQUMsR0FBRyxDQUFDLElBQUksQ0FBQyxTQUFTLENBQUMsWUFBWSxDQUFDLENBQUMsQ0FBQztJQUN4QyxDQUFDLENBQUM7QUFDSixDQUFDIn0=

package/dist_ts_server/server.handlers.cert.d.ts

@@ -0,0 +1,7 @@
+import type * as http from 'node:http';
+import type { JwsVerifier } from './server.classes.jws.verifier.js';
+import type { IServerOrderStore } from './server.interfaces.js';
+/**
+ * POST /cert/:id — Download certificate chain (POST-as-GET).
+ */
+export declare function createCertHandler(baseUrl: string, jwsVerifier: JwsVerifier, orderStore: IServerOrderStore): (req: http.IncomingMessage, res: http.ServerResponse, params: Record<string, string>, body: any) => Promise<void>;

package/dist_ts_server/server.handlers.cert.js

@@ -0,0 +1,18 @@
+import { AcmeServerError } from './server.classes.jws.verifier.js';
+/**
+ * POST /cert/:id — Download certificate chain (POST-as-GET).
+ */
+export function createCertHandler(baseUrl, jwsVerifier, orderStore) {
+    return async (req, res, params, body) => {
+        const orderId = params.id;
+        const requestUrl = `${baseUrl}/cert/${orderId}`;
+        await jwsVerifier.verify(body, requestUrl);
+        const certPem = await orderStore.getCertPem(orderId);
+        if (!certPem) {
+            throw new AcmeServerError(404, 'urn:ietf:params:acme:error:malformed', 'Certificate not found');
+        }
+        res.writeHead(200, { 'Content-Type': 'application/pem-certificate-chain' });
+        res.end(certPem);
+    };
+}
+//# sourceMappingURL=data:application/json;base64,eyJ2ZXJzaW9uIjozLCJmaWxlIjoic2VydmVyLmhhbmRsZXJzLmNlcnQuanMiLCJzb3VyY2VSb290IjoiIiwic291cmNlcyI6WyIuLi8uLi90c19zZXJ2ZXIvc2VydmVyLmhhbmRsZXJzLmNlcnQudHMiXSwibmFtZXMiOltdLCJtYXBwaW5ncyI6IkFBRUEsT0FBTyxFQUFFLGVBQWUsRUFBRSxNQUFNLGtDQUFrQyxDQUFDO0FBR25FOztHQUVHO0FBQ0gsTUFBTSxVQUFVLGlCQUFpQixDQUMvQixPQUFlLEVBQ2YsV0FBd0IsRUFDeEIsVUFBNkI7SUFFN0IsT0FBTyxLQUFLLEVBQ1YsR0FBeUIsRUFDekIsR0FBd0IsRUFDeEIsTUFBOEIsRUFDOUIsSUFBUyxFQUNNLEVBQUU7UUFDakIsTUFBTSxPQUFPLEdBQUcsTUFBTSxDQUFDLEVBQUUsQ0FBQztRQUMxQixNQUFNLFVBQVUsR0FBRyxHQUFHLE9BQU8sU0FBUyxPQUFPLEVBQUUsQ0FBQztRQUNoRCxNQUFNLFdBQVcsQ0FBQyxNQUFNLENBQUMsSUFBSSxFQUFFLFVBQVUsQ0FBQyxDQUFDO1FBRTNDLE1BQU0sT0FBTyxHQUFHLE1BQU0sVUFBVSxDQUFDLFVBQVUsQ0FBQyxPQUFPLENBQUMsQ0FBQztRQUNyRCxJQUFJLENBQUMsT0FBTyxFQUFFLENBQUM7WUFDYixNQUFNLElBQUksZUFBZSxDQUFDLEdBQUcsRUFBRSxzQ0FBc0MsRUFBRSx1QkFBdUIsQ0FBQyxDQUFDO1FBQ2xHLENBQUM7UUFFRCxHQUFHLENBQUMsU0FBUyxDQUFDLEdBQUcsRUFBRSxFQUFFLGNBQWMsRUFBRSxtQ0FBbUMsRUFBRSxDQUFDLENBQUM7UUFDNUUsR0FBRyxDQUFDLEdBQUcsQ0FBQyxPQUFPLENBQUMsQ0FBQztJQUNuQixDQUFDLENBQUM7QUFDSixDQUFDIn0=

package/dist_ts_server/server.handlers.challenge.d.ts

@@ -0,0 +1,10 @@
+import type * as http from 'node:http';
+import type { JwsVerifier } from './server.classes.jws.verifier.js';
+import type { IServerOrderStore, IServerAccountStore } from './server.interfaces.js';
+import type { ChallengeVerifier } from './server.classes.challenge.verifier.js';
+/**
+ * POST /challenge/:id — Trigger or poll an ACME challenge.
+ * - POST with `{}` payload: trigger challenge validation
+ * - POST-as-GET (null payload): return current challenge state
+ */
+export declare function createChallengeHandler(baseUrl: string, jwsVerifier: JwsVerifier, orderStore: IServerOrderStore, accountStore: IServerAccountStore, challengeVerifier: ChallengeVerifier): (req: http.IncomingMessage, res: http.ServerResponse, params: Record<string, string>, body: any) => Promise<void>;

package/dist_ts_server/server.handlers.challenge.js

@@ -0,0 +1,110 @@
+import * as crypto from 'node:crypto';
+import { AcmeCrypto } from '../dist_ts/acme/acme.classes.crypto.js';
+import { AcmeServerError } from './server.classes.jws.verifier.js';
+/**
+ * POST /challenge/:id — Trigger or poll an ACME challenge.
+ * - POST with `{}` payload: trigger challenge validation
+ * - POST-as-GET (null payload): return current challenge state
+ */
+export function createChallengeHandler(baseUrl, jwsVerifier, orderStore, accountStore, challengeVerifier) {
+    return async (req, res, params, body) => {
+        const challengeId = params.id;
+        const requestUrl = `${baseUrl}/challenge/${challengeId}`;
+        const verified = await jwsVerifier.verify(body, requestUrl);
+        const challenge = await orderStore.getChallenge(challengeId);
+        if (!challenge) {
+            throw new AcmeServerError(404, 'urn:ietf:params:acme:error:malformed', 'Challenge not found');
+        }
+        // POST-as-GET: just return current state
+        if (verified.payload === null) {
+            sendChallengeResponse(res, challenge, baseUrl);
+            return;
+        }
+        // Trigger validation (payload should be `{}`)
+        if (challenge.status !== 'pending') {
+            // Already processing or completed
+            sendChallengeResponse(res, challenge, baseUrl);
+            return;
+        }
+        // Set to processing
+        await orderStore.updateChallenge(challengeId, { status: 'processing' });
+        // Get the authorization to find the domain
+        const authz = await orderStore.getAuthorization(challenge.authorizationId);
+        if (!authz) {
+            throw new AcmeServerError(500, 'urn:ietf:params:acme:error:serverInternal', 'Authorization not found');
+        }
+        // Resolve the account's JWK for key authorization computation
+        const account = await accountStore.getByUrl(verified.kid);
+        if (!account) {
+            throw new AcmeServerError(400, 'urn:ietf:params:acme:error:accountDoesNotExist', 'Account not found');
+        }
+        const thumbprint = AcmeCrypto.getJwkThumbprint(account.jwk);
+        const keyAuth = `${challenge.token}.${thumbprint}`;
+        // Verify the challenge
+        let valid = false;
+        const domain = authz.identifier.value;
+        if (challenge.type === 'http-01') {
+            valid = await challengeVerifier.verifyHttp01(domain, challenge.token, keyAuth);
+        }
+        else if (challenge.type === 'dns-01') {
+            const hash = crypto.createHash('sha256').update(keyAuth).digest('base64url');
+            valid = await challengeVerifier.verifyDns01(domain, hash);
+        }
+        if (valid) {
+            await orderStore.updateChallenge(challengeId, {
+                status: 'valid',
+                validated: new Date().toISOString(),
+            });
+            challenge.status = 'valid';
+            challenge.validated = new Date().toISOString();
+            // Check if all challenges for this authorization's required type are valid
+            // One valid challenge is enough to validate the authorization
+            await orderStore.updateAuthorization(authz.id, { status: 'valid' });
+            // Check if all authorizations for the order are now valid
+            const order = await orderStore.getOrder(authz.orderId);
+            if (order && order.status === 'pending') {
+                let allValid = true;
+                for (const authzId of order.authorizationIds) {
+                    const a = await orderStore.getAuthorization(authzId);
+                    if (!a || a.status !== 'valid') {
+                        allValid = false;
+                        break;
+                    }
+                }
+                if (allValid) {
+                    await orderStore.updateOrder(order.id, { status: 'ready' });
+                }
+            }
+        }
+        else {
+            await orderStore.updateChallenge(challengeId, {
+                status: 'invalid',
+                error: {
+                    type: 'urn:ietf:params:acme:error:incorrectResponse',
+                    detail: `Challenge verification failed for ${domain}`,
+                },
+            });
+            challenge.status = 'invalid';
+            // Mark authorization as invalid too
+            await orderStore.updateAuthorization(authz.id, { status: 'invalid' });
+        }
+        sendChallengeResponse(res, challenge, baseUrl);
+    };
+}
+function sendChallengeResponse(res, challenge, baseUrl) {
+    const responseBody = {
+        type: challenge.type,
+        url: `${baseUrl}/challenge/${challenge.id}`,
+        status: challenge.status,
+        token: challenge.token,
+    };
+    if (challenge.validated) {
+        responseBody.validated = challenge.validated;
+    }
+    res.writeHead(200, {
+        'Content-Type': 'application/json',
+        'Link': `<${baseUrl}/directory>;rel="index"`,
+    });
+    res.end(JSON.stringify(responseBody));
+}
+//# sourceMappingURL=data:application/json;base64,eyJ2ZXJzaW9uIjozLCJmaWxlIjoic2VydmVyLmhhbmRsZXJzLmNoYWxsZW5nZS5qcyIsInNvdXJjZVJvb3QiOiIiLCJzb3VyY2VzIjpbIi4uLy4uL3RzX3NlcnZlci9zZXJ2ZXIuaGFuZGxlcnMuY2hhbGxlbmdlLnRzIl0sIm5hbWVzIjpbXSwibWFwcGluZ3MiOiJBQUNBLE9BQU8sS0FBSyxNQUFNLE1BQU0sYUFBYSxDQUFDO0FBQ3RDLE9BQU8sRUFBRSxVQUFVLEVBQUUsTUFBTSxtQ0FBbUMsQ0FBQztBQUUvRCxPQUFPLEVBQUUsZUFBZSxFQUFFLE1BQU0sa0NBQWtDLENBQUM7QUFJbkU7Ozs7R0FJRztBQUNILE1BQU0sVUFBVSxzQkFBc0IsQ0FDcEMsT0FBZSxFQUNmLFdBQXdCLEVBQ3hCLFVBQTZCLEVBQzdCLFlBQWlDLEVBQ2pDLGlCQUFvQztJQUVwQyxPQUFPLEtBQUssRUFDVixHQUF5QixFQUN6QixHQUF3QixFQUN4QixNQUE4QixFQUM5QixJQUFTLEVBQ00sRUFBRTtRQUNqQixNQUFNLFdBQVcsR0FBRyxNQUFNLENBQUMsRUFBRSxDQUFDO1FBQzlCLE1BQU0sVUFBVSxHQUFHLEdBQUcsT0FBTyxjQUFjLFdBQVcsRUFBRSxDQUFDO1FBQ3pELE1BQU0sUUFBUSxHQUFHLE1BQU0sV0FBVyxDQUFDLE1BQU0sQ0FBQyxJQUFJLEVBQUUsVUFBVSxDQUFDLENBQUM7UUFFNUQsTUFBTSxTQUFTLEdBQUcsTUFBTSxVQUFVLENBQUMsWUFBWSxDQUFDLFdBQVcsQ0FBQyxDQUFDO1FBQzdELElBQUksQ0FBQyxTQUFTLEVBQUUsQ0FBQztZQUNmLE1BQU0sSUFBSSxlQUFlLENBQUMsR0FBRyxFQUFFLHNDQUFzQyxFQUFFLHFCQUFxQixDQUFDLENBQUM7UUFDaEcsQ0FBQztRQUVELHlDQUF5QztRQUN6QyxJQUFJLFFBQVEsQ0FBQyxPQUFPLEtBQUssSUFBSSxFQUFFLENBQUM7WUFDOUIscUJBQXFCLENBQUMsR0FBRyxFQUFFLFNBQVMsRUFBRSxPQUFPLENBQUMsQ0FBQztZQUMvQyxPQUFPO1FBQ1QsQ0FBQztRQUVELDhDQUE4QztRQUM5QyxJQUFJLFNBQVMsQ0FBQyxNQUFNLEtBQUssU0FBUyxFQUFFLENBQUM7WUFDbkMsa0NBQWtDO1lBQ2xDLHFCQUFxQixDQUFDLEdBQUcsRUFBRSxTQUFTLEVBQUUsT0FBTyxDQUFDLENBQUM7WUFDL0MsT0FBTztRQUNULENBQUM7UUFFRCxvQkFBb0I7UUFDcEIsTUFBTSxVQUFVLENBQUMsZUFBZSxDQUFDLFdBQVcsRUFBRSxFQUFFLE1BQU0sRUFBRSxZQUFZLEVBQUUsQ0FBQyxDQUFDO1FBRXhFLDJDQUEyQztRQUMzQyxNQUFNLEtBQUssR0FBRyxNQUFNLFVBQVUsQ0FBQyxnQkFBZ0IsQ0FBQyxTQUFTLENBQUMsZUFBZSxDQUFDLENBQUM7UUFDM0UsSUFBSSxDQUFDLEtBQUssRUFBRSxDQUFDO1lBQ1gsTUFBTSxJQUFJLGVBQWUsQ0FBQyxHQUFHLEVBQUUsMkNBQTJDLEVBQUUseUJBQXlCLENBQUMsQ0FBQztRQUN6RyxDQUFDO1FBRUQsOERBQThEO1FBQzlELE1BQU0sT0FBTyxHQUFHLE1BQU0sWUFBWSxDQUFDLFFBQVEsQ0FBQyxRQUFRLENBQUMsR0FBSSxDQUFDLENBQUM7UUFDM0QsSUFBSSxDQUFDLE9BQU8sRUFBRSxDQUFDO1lBQ2IsTUFBTSxJQUFJLGVBQWUsQ0FBQyxHQUFHLEVBQUUsZ0RBQWdELEVBQUUsbUJBQW1CLENBQUMsQ0FBQztRQUN4RyxDQUFDO1FBRUQsTUFBTSxVQUFVLEdBQUcsVUFBVSxDQUFDLGdCQUFnQixDQUFDLE9BQU8sQ0FBQyxHQUFHLENBQUMsQ0FBQztRQUM1RCxNQUFNLE9BQU8sR0FBRyxHQUFHLFNBQVMsQ0FBQyxLQUFLLElBQUksVUFBVSxFQUFFLENBQUM7UUFFbkQsdUJBQXVCO1FBQ3ZCLElBQUksS0FBSyxHQUFHLEtBQUssQ0FBQztRQUNsQixNQUFNLE1BQU0sR0FBRyxLQUFLLENBQUMsVUFBVSxDQUFDLEtBQUssQ0FBQztRQUV0QyxJQUFJLFNBQVMsQ0FBQyxJQUFJLEtBQUssU0FBUyxFQUFFLENBQUM7WUFDakMsS0FBSyxHQUFHLE1BQU0saUJBQWlCLENBQUMsWUFBWSxDQUFDLE1BQU0sRUFBRSxTQUFTLENBQUMsS0FBSyxFQUFFLE9BQU8sQ0FBQyxDQUFDO1FBQ2pGLENBQUM7YUFBTSxJQUFJLFNBQVMsQ0FBQyxJQUFJLEtBQUssUUFBUSxFQUFFLENBQUM7WUFDdkMsTUFBTSxJQUFJLEdBQUcsTUFBTSxDQUFDLFVBQVUsQ0FBQyxRQUFRLENBQUMsQ0FBQyxNQUFNLENBQUMsT0FBTyxDQUFDLENBQUMsTUFBTSxDQUFDLFdBQVcsQ0FBQyxDQUFDO1lBQzdFLEtBQUssR0FBRyxNQUFNLGlCQUFpQixDQUFDLFdBQVcsQ0FBQyxNQUFNLEVBQUUsSUFBSSxDQUFDLENBQUM7UUFDNUQsQ0FBQztRQUVELElBQUksS0FBSyxFQUFFLENBQUM7WUFDVixNQUFNLFVBQVUsQ0FBQyxlQUFlLENBQUMsV0FBVyxFQUFFO2dCQUM1QyxNQUFNLEVBQUUsT0FBTztnQkFDZixTQUFTLEVBQUUsSUFBSSxJQUFJLEVBQUUsQ0FBQyxXQUFXLEVBQUU7YUFDcEMsQ0FBQyxDQUFDO1lBQ0gsU0FBUyxDQUFDLE1BQU0sR0FBRyxPQUFPLENBQUM7WUFDM0IsU0FBUyxDQUFDLFNBQVMsR0FBRyxJQUFJLElBQUksRUFBRSxDQUFDLFdBQVcsRUFBRSxDQUFDO1lBRS9DLDJFQUEyRTtZQUMzRSw4REFBOEQ7WUFDOUQsTUFBTSxVQUFVLENBQUMsbUJBQW1CLENBQUMsS0FBSyxDQUFDLEVBQUUsRUFBRSxFQUFFLE1BQU0sRUFBRSxPQUFPLEVBQUUsQ0FBQyxDQUFDO1lBRXBFLDBEQUEwRDtZQUMxRCxNQUFNLEtBQUssR0FBRyxNQUFNLFVBQVUsQ0FBQyxRQUFRLENBQUMsS0FBSyxDQUFDLE9BQU8sQ0FBQyxDQUFDO1lBQ3ZELElBQUksS0FBSyxJQUFJLEtBQUssQ0FBQyxNQUFNLEtBQUssU0FBUyxFQUFFLENBQUM7Z0JBQ3hDLElBQUksUUFBUSxHQUFHLElBQUksQ0FBQztnQkFDcEIsS0FBSyxNQUFNLE9BQU8sSUFBSSxLQUFLLENBQUMsZ0JBQWdCLEVBQUUsQ0FBQztvQkFDN0MsTUFBTSxDQUFDLEdBQUcsTUFBTSxVQUFVLENBQUMsZ0JBQWdCLENBQUMsT0FBTyxDQUFDLENBQUM7b0JBQ3JELElBQUksQ0FBQyxDQUFDLElBQUksQ0FBQyxDQUFDLE1BQU0sS0FBSyxPQUFPLEVBQUUsQ0FBQzt3QkFDL0IsUUFBUSxHQUFHLEtBQUssQ0FBQzt3QkFDakIsTUFBTTtvQkFDUixDQUFDO2dCQUNILENBQUM7Z0JBQ0QsSUFBSSxRQUFRLEVBQUUsQ0FBQztvQkFDYixNQUFNLFVBQVUsQ0FBQyxXQUFXLENBQUMsS0FBSyxDQUFDLEVBQUUsRUFBRSxFQUFFLE1BQU0sRUFBRSxPQUFPLEVBQUUsQ0FBQyxDQUFDO2dCQUM5RCxDQUFDO1lBQ0gsQ0FBQztRQUNILENBQUM7YUFBTSxDQUFDO1lBQ04sTUFBTSxVQUFVLENBQUMsZUFBZSxDQUFDLFdBQVcsRUFBRTtnQkFDNUMsTUFBTSxFQUFFLFNBQVM7Z0JBQ2pCLEtBQUssRUFBRTtvQkFDTCxJQUFJLEVBQUUsOENBQThDO29CQUNwRCxNQUFNLEVBQUUscUNBQXFDLE1BQU0sRUFBRTtpQkFDdEQ7YUFDRixDQUFDLENBQUM7WUFDSCxTQUFTLENBQUMsTUFBTSxHQUFHLFNBQVMsQ0FBQztZQUU3QixvQ0FBb0M7WUFDcEMsTUFBTSxVQUFVLENBQUMsbUJBQW1CLENBQUMsS0FBSyxDQUFDLEVBQUUsRUFBRSxFQUFFLE1BQU0sRUFBRSxTQUFTLEVBQUUsQ0FBQyxDQUFDO1FBQ3hFLENBQUM7UUFFRCxxQkFBcUIsQ0FBQyxHQUFHLEVBQUUsU0FBUyxFQUFFLE9BQU8sQ0FBQyxDQUFDO0lBQ2pELENBQUMsQ0FBQztBQUNKLENBQUM7QUFFRCxTQUFTLHFCQUFxQixDQUM1QixHQUF3QixFQUN4QixTQUEwRixFQUMxRixPQUFlO0lBRWYsTUFBTSxZQUFZLEdBQXdCO1FBQ3hDLElBQUksRUFBRSxTQUFTLENBQUMsSUFBSTtRQUNwQixHQUFHLEVBQUUsR0FBRyxPQUFPLGNBQWMsU0FBUyxDQUFDLEVBQUUsRUFBRTtRQUMzQyxNQUFNLEVBQUUsU0FBUyxDQUFDLE1BQU07UUFDeEIsS0FBSyxFQUFFLFNBQVMsQ0FBQyxLQUFLO0tBQ3ZCLENBQUM7SUFDRixJQUFJLFNBQVMsQ0FBQyxTQUFTLEVBQUUsQ0FBQztRQUN4QixZQUFZLENBQUMsU0FBUyxHQUFHLFNBQVMsQ0FBQyxTQUFTLENBQUM7SUFDL0MsQ0FBQztJQUNELEdBQUcsQ0FBQyxTQUFTLENBQUMsR0FBRyxFQUFFO1FBQ2pCLGNBQWMsRUFBRSxrQkFBa0I7UUFDbEMsTUFBTSxFQUFFLElBQUksT0FBTyx5QkFBeUI7S0FDN0MsQ0FBQyxDQUFDO0lBQ0gsR0FBRyxDQUFDLEdBQUcsQ0FBQyxJQUFJLENBQUMsU0FBUyxDQUFDLFlBQVksQ0FBQyxDQUFDLENBQUM7QUFDeEMsQ0FBQyJ9

package/dist_ts_server/server.handlers.directory.d.ts

@@ -0,0 +1,5 @@
+import type * as http from 'node:http';
+/**
+ * GET /directory — Returns the ACME directory object with all endpoint URLs.
+ */
+export declare function createDirectoryHandler(baseUrl: string): (_req: http.IncomingMessage, res: http.ServerResponse, _params: Record<string, string>, _body: any) => Promise<void>;

package/dist_ts_server/server.handlers.directory.js

@@ -0,0 +1,23 @@
+/**
+ * GET /directory — Returns the ACME directory object with all endpoint URLs.
+ */
+export function createDirectoryHandler(baseUrl) {
+    return async (_req, res, _params, _body) => {
+        const directory = {
+            newNonce: `${baseUrl}/new-nonce`,
+            newAccount: `${baseUrl}/new-account`,
+            newOrder: `${baseUrl}/new-order`,
+            revokeCert: `${baseUrl}/revoke-cert`,
+            keyChange: `${baseUrl}/key-change`,
+            meta: {
+                termsOfService: `${baseUrl}/terms`,
+                website: `${baseUrl}`,
+                caaIdentities: [],
+                externalAccountRequired: false,
+            },
+        };
+        res.writeHead(200, { 'Content-Type': 'application/json' });
+        res.end(JSON.stringify(directory));
+    };
+}
+//# sourceMappingURL=data:application/json;base64,eyJ2ZXJzaW9uIjozLCJmaWxlIjoic2VydmVyLmhhbmRsZXJzLmRpcmVjdG9yeS5qcyIsInNvdXJjZVJvb3QiOiIiLCJzb3VyY2VzIjpbIi4uLy4uL3RzX3NlcnZlci9zZXJ2ZXIuaGFuZGxlcnMuZGlyZWN0b3J5LnRzIl0sIm5hbWVzIjpbXSwibWFwcGluZ3MiOiJBQUdBOztHQUVHO0FBQ0gsTUFBTSxVQUFVLHNCQUFzQixDQUFDLE9BQWU7SUFDcEQsT0FBTyxLQUFLLEVBQ1YsSUFBMEIsRUFDMUIsR0FBd0IsRUFDeEIsT0FBK0IsRUFDL0IsS0FBVSxFQUNLLEVBQUU7UUFDakIsTUFBTSxTQUFTLEdBQW1CO1lBQ2hDLFFBQVEsRUFBRSxHQUFHLE9BQU8sWUFBWTtZQUNoQyxVQUFVLEVBQUUsR0FBRyxPQUFPLGNBQWM7WUFDcEMsUUFBUSxFQUFFLEdBQUcsT0FBTyxZQUFZO1lBQ2hDLFVBQVUsRUFBRSxHQUFHLE9BQU8sY0FBYztZQUNwQyxTQUFTLEVBQUUsR0FBRyxPQUFPLGFBQWE7WUFDbEMsSUFBSSxFQUFFO2dCQUNKLGNBQWMsRUFBRSxHQUFHLE9BQU8sUUFBUTtnQkFDbEMsT0FBTyxFQUFFLEdBQUcsT0FBTyxFQUFFO2dCQUNyQixhQUFhLEVBQUUsRUFBRTtnQkFDakIsdUJBQXVCLEVBQUUsS0FBSzthQUMvQjtTQUNGLENBQUM7UUFDRixHQUFHLENBQUMsU0FBUyxDQUFDLEdBQUcsRUFBRSxFQUFFLGNBQWMsRUFBRSxrQkFBa0IsRUFBRSxDQUFDLENBQUM7UUFDM0QsR0FBRyxDQUFDLEdBQUcsQ0FBQyxJQUFJLENBQUMsU0FBUyxDQUFDLFNBQVMsQ0FBQyxDQUFDLENBQUM7SUFDckMsQ0FBQyxDQUFDO0FBQ0osQ0FBQyJ9

package/dist_ts_server/server.handlers.finalize.d.ts

@@ -0,0 +1,8 @@
+import type * as http from 'node:http';
+import type { JwsVerifier } from './server.classes.jws.verifier.js';
+import type { IServerOrderStore } from './server.interfaces.js';
+import type { AcmeServerCA } from './server.classes.ca.js';
+/**
+ * POST /finalize/:id — Submit CSR and issue certificate.
+ */
+export declare function createFinalizeHandler(baseUrl: string, jwsVerifier: JwsVerifier, orderStore: IServerOrderStore, ca: AcmeServerCA): (req: http.IncomingMessage, res: http.ServerResponse, params: Record<string, string>, body: any) => Promise<void>;

package/dist_ts_server/server.handlers.finalize.js

@@ -0,0 +1,65 @@
+import { AcmeServerError } from './server.classes.jws.verifier.js';
+/**
+ * POST /finalize/:id — Submit CSR and issue certificate.
+ */
+export function createFinalizeHandler(baseUrl, jwsVerifier, orderStore, ca) {
+    return async (req, res, params, body) => {
+        const orderId = params.id;
+        const requestUrl = `${baseUrl}/finalize/${orderId}`;
+        const verified = await jwsVerifier.verify(body, requestUrl);
+        if (!verified.kid) {
+            throw new AcmeServerError(400, 'urn:ietf:params:acme:error:malformed', 'Finalize requires kid');
+        }
+        const order = await orderStore.getOrder(orderId);
+        if (!order) {
+            throw new AcmeServerError(404, 'urn:ietf:params:acme:error:malformed', 'Order not found');
+        }
+        // Check all authorizations are valid and update order status if needed
+        if (order.status === 'pending') {
+            let allValid = true;
+            for (const authzId of order.authorizationIds) {
+                const authz = await orderStore.getAuthorization(authzId);
+                if (!authz || authz.status !== 'valid') {
+                    allValid = false;
+                    break;
+                }
+            }
+            if (allValid) {
+                await orderStore.updateOrder(orderId, { status: 'ready' });
+                order.status = 'ready';
+            }
+        }
+        if (order.status !== 'ready') {
+            throw new AcmeServerError(403, 'urn:ietf:params:acme:error:orderNotReady', `Order is in "${order.status}" state, expected "ready"`);
+        }
+        const { payload } = verified;
+        if (!payload?.csr) {
+            throw new AcmeServerError(400, 'urn:ietf:params:acme:error:malformed', 'Missing CSR in finalize request');
+        }
+        // Transition to processing
+        await orderStore.updateOrder(orderId, { status: 'processing' });
+        // Sign the certificate
+        const certPem = await ca.signCsr(payload.csr);
+        // Store certificate and update order
+        const certUrl = `${baseUrl}/cert/${orderId}`;
+        await orderStore.storeCertPem(orderId, certPem);
+        await orderStore.updateOrder(orderId, {
+            status: 'valid',
+            certificate: certUrl,
+        });
+        const responseBody = {
+            status: 'valid',
+            expires: order.expires,
+            identifiers: order.identifiers,
+            authorizations: order.authorizationIds.map((id) => `${baseUrl}/authz/${id}`),
+            finalize: order.finalize,
+            certificate: certUrl,
+        };
+        res.writeHead(200, {
+            'Content-Type': 'application/json',
+            'Location': `${baseUrl}/order/${orderId}`,
+        });
+        res.end(JSON.stringify(responseBody));
+    };
+}
+//# sourceMappingURL=data:application/json;base64,eyJ2ZXJzaW9uIjozLCJmaWxlIjoic2VydmVyLmhhbmRsZXJzLmZpbmFsaXplLmpzIiwic291cmNlUm9vdCI6IiIsInNvdXJjZXMiOlsiLi4vLi4vdHNfc2VydmVyL3NlcnZlci5oYW5kbGVycy5maW5hbGl6ZS50cyJdLCJuYW1lcyI6W10sIm1hcHBpbmdzIjoiQUFFQSxPQUFPLEVBQUUsZUFBZSxFQUFFLE1BQU0sa0NBQWtDLENBQUM7QUFJbkU7O0dBRUc7QUFDSCxNQUFNLFVBQVUscUJBQXFCLENBQ25DLE9BQWUsRUFDZixXQUF3QixFQUN4QixVQUE2QixFQUM3QixFQUFnQjtJQUVoQixPQUFPLEtBQUssRUFDVixHQUF5QixFQUN6QixHQUF3QixFQUN4QixNQUE4QixFQUM5QixJQUFTLEVBQ00sRUFBRTtRQUNqQixNQUFNLE9BQU8sR0FBRyxNQUFNLENBQUMsRUFBRSxDQUFDO1FBQzFCLE1BQU0sVUFBVSxHQUFHLEdBQUcsT0FBTyxhQUFhLE9BQU8sRUFBRSxDQUFDO1FBQ3BELE1BQU0sUUFBUSxHQUFHLE1BQU0sV0FBVyxDQUFDLE1BQU0sQ0FBQyxJQUFJLEVBQUUsVUFBVSxDQUFDLENBQUM7UUFFNUQsSUFBSSxDQUFDLFFBQVEsQ0FBQyxHQUFHLEVBQUUsQ0FBQztZQUNsQixNQUFNLElBQUksZUFBZSxDQUFDLEdBQUcsRUFBRSxzQ0FBc0MsRUFBRSx1QkFBdUIsQ0FBQyxDQUFDO1FBQ2xHLENBQUM7UUFFRCxNQUFNLEtBQUssR0FBRyxNQUFNLFVBQVUsQ0FBQyxRQUFRLENBQUMsT0FBTyxDQUFDLENBQUM7UUFDakQsSUFBSSxDQUFDLEtBQUssRUFBRSxDQUFDO1lBQ1gsTUFBTSxJQUFJLGVBQWUsQ0FBQyxHQUFHLEVBQUUsc0NBQXNDLEVBQUUsaUJBQWlCLENBQUMsQ0FBQztRQUM1RixDQUFDO1FBRUQsdUVBQXVFO1FBQ3ZFLElBQUksS0FBSyxDQUFDLE1BQU0sS0FBSyxTQUFTLEVBQUUsQ0FBQztZQUMvQixJQUFJLFFBQVEsR0FBRyxJQUFJLENBQUM7WUFDcEIsS0FBSyxNQUFNLE9BQU8sSUFBSSxLQUFLLENBQUMsZ0JBQWdCLEVBQUUsQ0FBQztnQkFDN0MsTUFBTSxLQUFLLEdBQUcsTUFBTSxVQUFVLENBQUMsZ0JBQWdCLENBQUMsT0FBTyxDQUFDLENBQUM7Z0JBQ3pELElBQUksQ0FBQyxLQUFLLElBQUksS0FBSyxDQUFDLE1BQU0sS0FBSyxPQUFPLEVBQUUsQ0FBQztvQkFDdkMsUUFBUSxHQUFHLEtBQUssQ0FBQztvQkFDakIsTUFBTTtnQkFDUixDQUFDO1lBQ0gsQ0FBQztZQUNELElBQUksUUFBUSxFQUFFLENBQUM7Z0JBQ2IsTUFBTSxVQUFVLENBQUMsV0FBVyxDQUFDLE9BQU8sRUFBRSxFQUFFLE1BQU0sRUFBRSxPQUFPLEVBQUUsQ0FBQyxDQUFDO2dCQUMzRCxLQUFLLENBQUMsTUFBTSxHQUFHLE9BQU8sQ0FBQztZQUN6QixDQUFDO1FBQ0gsQ0FBQztRQUVELElBQUksS0FBSyxDQUFDLE1BQU0sS0FBSyxPQUFPLEVBQUUsQ0FBQztZQUM3QixNQUFNLElBQUksZUFBZSxDQUN2QixHQUFHLEVBQ0gsMENBQTBDLEVBQzFDLGdCQUFnQixLQUFLLENBQUMsTUFBTSwyQkFBMkIsQ0FDeEQsQ0FBQztRQUNKLENBQUM7UUFFRCxNQUFNLEVBQUUsT0FBTyxFQUFFLEdBQUcsUUFBUSxDQUFDO1FBQzdCLElBQUksQ0FBQyxPQUFPLEVBQUUsR0FBRyxFQUFFLENBQUM7WUFDbEIsTUFBTSxJQUFJLGVBQWUsQ0FBQyxHQUFHLEVBQUUsc0NBQXNDLEVBQUUsaUNBQWlDLENBQUMsQ0FBQztRQUM1RyxDQUFDO1FBRUQsMkJBQTJCO1FBQzNCLE1BQU0sVUFBVSxDQUFDLFdBQVcsQ0FBQyxPQUFPLEVBQUUsRUFBRSxNQUFNLEVBQUUsWUFBWSxFQUFFLENBQUMsQ0FBQztRQUVoRSx1QkFBdUI7UUFDdkIsTUFBTSxPQUFPLEdBQUcsTUFBTSxFQUFFLENBQUMsT0FBTyxDQUFDLE9BQU8sQ0FBQyxHQUFHLENBQUMsQ0FBQztRQUU5QyxxQ0FBcUM7UUFDckMsTUFBTSxPQUFPLEdBQUcsR0FBRyxPQUFPLFNBQVMsT0FBTyxFQUFFLENBQUM7UUFDN0MsTUFBTSxVQUFVLENBQUMsWUFBWSxDQUFDLE9BQU8sRUFBRSxPQUFPLENBQUMsQ0FBQztRQUNoRCxNQUFNLFVBQVUsQ0FBQyxXQUFXLENBQUMsT0FBTyxFQUFFO1lBQ3BDLE1BQU0sRUFBRSxPQUFPO1lBQ2YsV0FBVyxFQUFFLE9BQU87U0FDckIsQ0FBQyxDQUFDO1FBRUgsTUFBTSxZQUFZLEdBQUc7WUFDbkIsTUFBTSxFQUFFLE9BQU87WUFDZixPQUFPLEVBQUUsS0FBSyxDQUFDLE9BQU87WUFDdEIsV0FBVyxFQUFFLEtBQUssQ0FBQyxXQUFXO1lBQzlCLGNBQWMsRUFBRSxLQUFLLENBQUMsZ0JBQWdCLENBQUMsR0FBRyxDQUFDLENBQUMsRUFBRSxFQUFFLEVBQUUsQ0FBQyxHQUFHLE9BQU8sVUFBVSxFQUFFLEVBQUUsQ0FBQztZQUM1RSxRQUFRLEVBQUUsS0FBSyxDQUFDLFFBQVE7WUFDeEIsV0FBVyxFQUFFLE9BQU87U0FDckIsQ0FBQztRQUVGLEdBQUcsQ0FBQyxTQUFTLENBQUMsR0FBRyxFQUFFO1lBQ2pCLGNBQWMsRUFBRSxrQkFBa0I7WUFDbEMsVUFBVSxFQUFFLEdBQUcsT0FBTyxVQUFVLE9BQU8sRUFBRTtTQUMxQyxDQUFDLENBQUM7UUFDSCxHQUFHLENBQUMsR0FBRyxDQUFDLElBQUksQ0FBQyxTQUFTLENBQUMsWUFBWSxDQUFDLENBQUMsQ0FBQztJQUN4QyxDQUFDLENBQUM7QUFDSixDQUFDIn0=

package/dist_ts_server/server.handlers.nonce.d.ts

@@ -0,0 +1,7 @@
+import type * as http from 'node:http';
+/**
+ * HEAD /new-nonce — Returns 200 with Replay-Nonce header (added by router).
+ * GET  /new-nonce — Returns 204 with Replay-Nonce header (added by router).
+ */
+export declare function createNonceHeadHandler(): (_req: http.IncomingMessage, res: http.ServerResponse, _params: Record<string, string>, _body: any) => Promise<void>;
+export declare function createNonceGetHandler(): (_req: http.IncomingMessage, res: http.ServerResponse, _params: Record<string, string>, _body: any) => Promise<void>;

package/dist_ts_server/server.handlers.nonce.js

@@ -0,0 +1,17 @@
+/**
+ * HEAD /new-nonce — Returns 200 with Replay-Nonce header (added by router).
+ * GET  /new-nonce — Returns 204 with Replay-Nonce header (added by router).
+ */
+export function createNonceHeadHandler() {
+    return async (_req, res, _params, _body) => {
+        res.writeHead(200, { 'Content-Type': 'application/octet-stream' });
+        res.end();
+    };
+}
+export function createNonceGetHandler() {
+    return async (_req, res, _params, _body) => {
+        res.writeHead(204);
+        res.end();
+    };
+}
+//# sourceMappingURL=data:application/json;base64,eyJ2ZXJzaW9uIjozLCJmaWxlIjoic2VydmVyLmhhbmRsZXJzLm5vbmNlLmpzIiwic291cmNlUm9vdCI6IiIsInNvdXJjZXMiOlsiLi4vLi4vdHNfc2VydmVyL3NlcnZlci5oYW5kbGVycy5ub25jZS50cyJdLCJuYW1lcyI6W10sIm1hcHBpbmdzIjoiQUFFQTs7O0dBR0c7QUFDSCxNQUFNLFVBQVUsc0JBQXNCO0lBQ3BDLE9BQU8sS0FBSyxFQUNWLElBQTBCLEVBQzFCLEdBQXdCLEVBQ3hCLE9BQStCLEVBQy9CLEtBQVUsRUFDSyxFQUFFO1FBQ2pCLEdBQUcsQ0FBQyxTQUFTLENBQUMsR0FBRyxFQUFFLEVBQUUsY0FBYyxFQUFFLDBCQUEwQixFQUFFLENBQUMsQ0FBQztRQUNuRSxHQUFHLENBQUMsR0FBRyxFQUFFLENBQUM7SUFDWixDQUFDLENBQUM7QUFDSixDQUFDO0FBRUQsTUFBTSxVQUFVLHFCQUFxQjtJQUNuQyxPQUFPLEtBQUssRUFDVixJQUEwQixFQUMxQixHQUF3QixFQUN4QixPQUErQixFQUMvQixLQUFVLEVBQ0ssRUFBRTtRQUNqQixHQUFHLENBQUMsU0FBUyxDQUFDLEdBQUcsQ0FBQyxDQUFDO1FBQ25CLEdBQUcsQ0FBQyxHQUFHLEVBQUUsQ0FBQztJQUNaLENBQUMsQ0FBQztBQUNKLENBQUMifQ==

package/dist_ts_server/server.handlers.order.d.ts

@@ -0,0 +1,11 @@
+import type * as http from 'node:http';
+import type { JwsVerifier } from './server.classes.jws.verifier.js';
+import type { IServerOrderStore } from './server.interfaces.js';
+/**
+ * POST /new-order — Create a new ACME order.
+ */
+export declare function createNewOrderHandler(baseUrl: string, jwsVerifier: JwsVerifier, orderStore: IServerOrderStore): (req: http.IncomingMessage, res: http.ServerResponse, _params: Record<string, string>, body: any) => Promise<void>;
+/**
+ * POST /order/:id — Poll order status (POST-as-GET).
+ */
+export declare function createOrderPollHandler(baseUrl: string, jwsVerifier: JwsVerifier, orderStore: IServerOrderStore): (req: http.IncomingMessage, res: http.ServerResponse, params: Record<string, string>, body: any) => Promise<void>;