@push.rocks/smartacme 9.1.2 → 9.2.0

package/dist_ts_server/server.handlers.order.js

@@ -0,0 +1,131 @@
+import * as crypto from 'node:crypto';
+import { AcmeServerError } from './server.classes.jws.verifier.js';
+/**
+ * POST /new-order — Create a new ACME order.
+ */
+export function createNewOrderHandler(baseUrl, jwsVerifier, orderStore) {
+    return async (req, res, _params, body) => {
+        const requestUrl = `${baseUrl}/new-order`;
+        const verified = await jwsVerifier.verify(body, requestUrl);
+        if (!verified.kid) {
+            throw new AcmeServerError(400, 'urn:ietf:params:acme:error:malformed', 'newOrder requires kid');
+        }
+        const { payload } = verified;
+        const identifiers = payload?.identifiers;
+        if (!identifiers || !Array.isArray(identifiers) || identifiers.length === 0) {
+            throw new AcmeServerError(400, 'urn:ietf:params:acme:error:malformed', 'Order must include at least one identifier');
+        }
+        const orderId = crypto.randomBytes(16).toString('hex');
+        const expires = new Date();
+        expires.setDate(expires.getDate() + 7);
+        // Create authorizations and challenges for each identifier
+        const authorizationIds = [];
+        for (const identifier of identifiers) {
+            const authzId = crypto.randomBytes(16).toString('hex');
+            const isWildcard = identifier.value.startsWith('*.');
+            const domain = isWildcard ? identifier.value.slice(2) : identifier.value;
+            // Create challenges for this authorization
+            const challengeIds = [];
+            // HTTP-01 challenge (not for wildcards)
+            if (!isWildcard) {
+                const http01Id = crypto.randomBytes(16).toString('hex');
+                const http01Token = crypto.randomBytes(32).toString('base64url');
+                await orderStore.createChallenge({
+                    id: http01Id,
+                    authorizationId: authzId,
+                    type: 'http-01',
+                    token: http01Token,
+                    status: 'pending',
+                });
+                challengeIds.push(http01Id);
+            }
+            // DNS-01 challenge (always)
+            const dns01Id = crypto.randomBytes(16).toString('hex');
+            const dns01Token = crypto.randomBytes(32).toString('base64url');
+            await orderStore.createChallenge({
+                id: dns01Id,
+                authorizationId: authzId,
+                type: 'dns-01',
+                token: dns01Token,
+                status: 'pending',
+            });
+            challengeIds.push(dns01Id);
+            await orderStore.createAuthorization({
+                id: authzId,
+                orderId,
+                identifier: { type: 'dns', value: domain },
+                status: 'pending',
+                expires: expires.toISOString(),
+                challengeIds,
+                wildcard: isWildcard || undefined,
+            });
+            authorizationIds.push(authzId);
+        }
+        const order = await orderStore.createOrder({
+            id: orderId,
+            accountUrl: verified.kid,
+            status: 'pending',
+            identifiers,
+            authorizationIds,
+            expires: expires.toISOString(),
+            finalize: `${baseUrl}/finalize/${orderId}`,
+        });
+        const responseBody = {
+            status: order.status,
+            expires: order.expires,
+            identifiers: order.identifiers,
+            authorizations: order.authorizationIds.map((id) => `${baseUrl}/authz/${id}`),
+            finalize: order.finalize,
+        };
+        res.writeHead(201, {
+            'Content-Type': 'application/json',
+            'Location': `${baseUrl}/order/${orderId}`,
+        });
+        res.end(JSON.stringify(responseBody));
+    };
+}
+/**
+ * POST /order/:id — Poll order status (POST-as-GET).
+ */
+export function createOrderPollHandler(baseUrl, jwsVerifier, orderStore) {
+    return async (req, res, params, body) => {
+        const orderId = params.id;
+        const requestUrl = `${baseUrl}/order/${orderId}`;
+        await jwsVerifier.verify(body, requestUrl);
+        const order = await orderStore.getOrder(orderId);
+        if (!order) {
+            throw new AcmeServerError(404, 'urn:ietf:params:acme:error:malformed', 'Order not found');
+        }
+        // Check if all authorizations are valid → transition to ready
+        if (order.status === 'pending') {
+            let allValid = true;
+            for (const authzId of order.authorizationIds) {
+                const authz = await orderStore.getAuthorization(authzId);
+                if (!authz || authz.status !== 'valid') {
+                    allValid = false;
+                    break;
+                }
+            }
+            if (allValid) {
+                await orderStore.updateOrder(orderId, { status: 'ready' });
+                order.status = 'ready';
+            }
+        }
+        const responseBody = {
+            status: order.status,
+            expires: order.expires,
+            identifiers: order.identifiers,
+            authorizations: order.authorizationIds.map((id) => `${baseUrl}/authz/${id}`),
+            finalize: order.finalize,
+        };
+        if (order.certificate) {
+            responseBody.certificate = order.certificate;
+        }
+        res.writeHead(200, {
+            'Content-Type': 'application/json',
+            'Location': requestUrl,
+        });
+        res.end(JSON.stringify(responseBody));
+    };
+}
+//# sourceMappingURL=data:application/json;base64,eyJ2ZXJzaW9uIjozLCJmaWxlIjoic2VydmVyLmhhbmRsZXJzLm9yZGVyLmpzIiwic291cmNlUm9vdCI6IiIsInNvdXJjZXMiOlsiLi4vLi4vdHNfc2VydmVyL3NlcnZlci5oYW5kbGVycy5vcmRlci50cyJdLCJuYW1lcyI6W10sIm1hcHBpbmdzIjoiQUFDQSxPQUFPLEtBQUssTUFBTSxNQUFNLGFBQWEsQ0FBQztBQUV0QyxPQUFPLEVBQUUsZUFBZSxFQUFFLE1BQU0sa0NBQWtDLENBQUM7QUFJbkU7O0dBRUc7QUFDSCxNQUFNLFVBQVUscUJBQXFCLENBQ25DLE9BQWUsRUFDZixXQUF3QixFQUN4QixVQUE2QjtJQUU3QixPQUFPLEtBQUssRUFDVixHQUF5QixFQUN6QixHQUF3QixFQUN4QixPQUErQixFQUMvQixJQUFTLEVBQ00sRUFBRTtRQUNqQixNQUFNLFVBQVUsR0FBRyxHQUFHLE9BQU8sWUFBWSxDQUFDO1FBQzFDLE1BQU0sUUFBUSxHQUFHLE1BQU0sV0FBVyxDQUFDLE1BQU0sQ0FBQyxJQUFJLEVBQUUsVUFBVSxDQUFDLENBQUM7UUFFNUQsSUFBSSxDQUFDLFFBQVEsQ0FBQyxHQUFHLEVBQUUsQ0FBQztZQUNsQixNQUFNLElBQUksZUFBZSxDQUFDLEdBQUcsRUFBRSxzQ0FBc0MsRUFBRSx1QkFBdUIsQ0FBQyxDQUFDO1FBQ2xHLENBQUM7UUFFRCxNQUFNLEVBQUUsT0FBTyxFQUFFLEdBQUcsUUFBUSxDQUFDO1FBQzdCLE1BQU0sV0FBVyxHQUFzQixPQUFPLEVBQUUsV0FBVyxDQUFDO1FBRTVELElBQUksQ0FBQyxXQUFXLElBQUksQ0FBQyxLQUFLLENBQUMsT0FBTyxDQUFDLFdBQVcsQ0FBQyxJQUFJLFdBQVcsQ0FBQyxNQUFNLEtBQUssQ0FBQyxFQUFFLENBQUM7WUFDNUUsTUFBTSxJQUFJLGVBQWUsQ0FDdkIsR0FBRyxFQUNILHNDQUFzQyxFQUN0Qyw0Q0FBNEMsQ0FDN0MsQ0FBQztRQUNKLENBQUM7UUFFRCxNQUFNLE9BQU8sR0FBRyxNQUFNLENBQUMsV0FBVyxDQUFDLEVBQUUsQ0FBQyxDQUFDLFFBQVEsQ0FBQyxLQUFLLENBQUMsQ0FBQztRQUN2RCxNQUFNLE9BQU8sR0FBRyxJQUFJLElBQUksRUFBRSxDQUFDO1FBQzNCLE9BQU8sQ0FBQyxPQUFPLENBQUMsT0FBTyxDQUFDLE9BQU8sRUFBRSxHQUFHLENBQUMsQ0FBQyxDQUFDO1FBRXZDLDJEQUEyRDtRQUMzRCxNQUFNLGdCQUFnQixHQUFhLEVBQUUsQ0FBQztRQUV0QyxLQUFLLE1BQU0sVUFBVSxJQUFJLFdBQVcsRUFBRSxDQUFDO1lBQ3JDLE1BQU0sT0FBTyxHQUFHLE1BQU0sQ0FBQyxXQUFXLENBQUMsRUFBRSxDQUFDLENBQUMsUUFBUSxDQUFDLEtBQUssQ0FBQyxDQUFDO1lBQ3ZELE1BQU0sVUFBVSxHQUFHLFVBQVUsQ0FBQyxLQUFLLENBQUMsVUFBVSxDQUFDLElBQUksQ0FBQyxDQUFDO1lBQ3JELE1BQU0sTUFBTSxHQUFHLFVBQVUsQ0FBQyxDQUFDLENBQUMsVUFBVSxDQUFDLEtBQUssQ0FBQyxLQUFLLENBQUMsQ0FBQyxDQUFDLENBQUMsQ0FBQyxDQUFDLFVBQVUsQ0FBQyxLQUFLLENBQUM7WUFFekUsMkNBQTJDO1lBQzNDLE1BQU0sWUFBWSxHQUFhLEVBQUUsQ0FBQztZQUVsQyx3Q0FBd0M7WUFDeEMsSUFBSSxDQUFDLFVBQVUsRUFBRSxDQUFDO2dCQUNoQixNQUFNLFFBQVEsR0FBRyxNQUFNLENBQUMsV0FBVyxDQUFDLEVBQUUsQ0FBQyxDQUFDLFFBQVEsQ0FBQyxLQUFLLENBQUMsQ0FBQztnQkFDeEQsTUFBTSxXQUFXLEdBQUcsTUFBTSxDQUFDLFdBQVcsQ0FBQyxFQUFFLENBQUMsQ0FBQyxRQUFRLENBQUMsV0FBVyxDQUFDLENBQUM7Z0JBQ2pFLE1BQU0sVUFBVSxDQUFDLGVBQWUsQ0FBQztvQkFDL0IsRUFBRSxFQUFFLFFBQVE7b0JBQ1osZUFBZSxFQUFFLE9BQU87b0JBQ3hCLElBQUksRUFBRSxTQUFTO29CQUNmLEtBQUssRUFBRSxXQUFXO29CQUNsQixNQUFNLEVBQUUsU0FBUztpQkFDbEIsQ0FBQyxDQUFDO2dCQUNILFlBQVksQ0FBQyxJQUFJLENBQUMsUUFBUSxDQUFDLENBQUM7WUFDOUIsQ0FBQztZQUVELDRCQUE0QjtZQUM1QixNQUFNLE9BQU8sR0FBRyxNQUFNLENBQUMsV0FBVyxDQUFDLEVBQUUsQ0FBQyxDQUFDLFFBQVEsQ0FBQyxLQUFLLENBQUMsQ0FBQztZQUN2RCxNQUFNLFVBQVUsR0FBRyxNQUFNLENBQUMsV0FBVyxDQUFDLEVBQUUsQ0FBQyxDQUFDLFFBQVEsQ0FBQyxXQUFXLENBQUMsQ0FBQztZQUNoRSxNQUFNLFVBQVUsQ0FBQyxlQUFlLENBQUM7Z0JBQy9CLEVBQUUsRUFBRSxPQUFPO2dCQUNYLGVBQWUsRUFBRSxPQUFPO2dCQUN4QixJQUFJLEVBQUUsUUFBUTtnQkFDZCxLQUFLLEVBQUUsVUFBVTtnQkFDakIsTUFBTSxFQUFFLFNBQVM7YUFDbEIsQ0FBQyxDQUFDO1lBQ0gsWUFBWSxDQUFDLElBQUksQ0FBQyxPQUFPLENBQUMsQ0FBQztZQUUzQixNQUFNLFVBQVUsQ0FBQyxtQkFBbUIsQ0FBQztnQkFDbkMsRUFBRSxFQUFFLE9BQU87Z0JBQ1gsT0FBTztnQkFDUCxVQUFVLEVBQUUsRUFBRSxJQUFJLEVBQUUsS0FBSyxFQUFFLEtBQUssRUFBRSxNQUFNLEVBQUU7Z0JBQzFDLE1BQU0sRUFBRSxTQUFTO2dCQUNqQixPQUFPLEVBQUUsT0FBTyxDQUFDLFdBQVcsRUFBRTtnQkFDOUIsWUFBWTtnQkFDWixRQUFRLEVBQUUsVUFBVSxJQUFJLFNBQVM7YUFDbEMsQ0FBQyxDQUFDO1lBRUgsZ0JBQWdCLENBQUMsSUFBSSxDQUFDLE9BQU8sQ0FBQyxDQUFDO1FBQ2pDLENBQUM7UUFFRCxNQUFNLEtBQUssR0FBRyxNQUFNLFVBQVUsQ0FBQyxXQUFXLENBQUM7WUFDekMsRUFBRSxFQUFFLE9BQU87WUFDWCxVQUFVLEVBQUUsUUFBUSxDQUFDLEdBQUc7WUFDeEIsTUFBTSxFQUFFLFNBQVM7WUFDakIsV0FBVztZQUNYLGdCQUFnQjtZQUNoQixPQUFPLEVBQUUsT0FBTyxDQUFDLFdBQVcsRUFBRTtZQUM5QixRQUFRLEVBQUUsR0FBRyxPQUFPLGFBQWEsT0FBTyxFQUFFO1NBQzNDLENBQUMsQ0FBQztRQUVILE1BQU0sWUFBWSxHQUFHO1lBQ25CLE1BQU0sRUFBRSxLQUFLLENBQUMsTUFBTTtZQUNwQixPQUFPLEVBQUUsS0FBSyxDQUFDLE9BQU87WUFDdEIsV0FBVyxFQUFFLEtBQUssQ0FBQyxXQUFXO1lBQzlCLGNBQWMsRUFBRSxLQUFLLENBQUMsZ0JBQWdCLENBQUMsR0FBRyxDQUFDLENBQUMsRUFBRSxFQUFFLEVBQUUsQ0FBQyxHQUFHLE9BQU8sVUFBVSxFQUFFLEVBQUUsQ0FBQztZQUM1RSxRQUFRLEVBQUUsS0FBSyxDQUFDLFFBQVE7U0FDekIsQ0FBQztRQUVGLEdBQUcsQ0FBQyxTQUFTLENBQUMsR0FBRyxFQUFFO1lBQ2pCLGNBQWMsRUFBRSxrQkFBa0I7WUFDbEMsVUFBVSxFQUFFLEdBQUcsT0FBTyxVQUFVLE9BQU8sRUFBRTtTQUMxQyxDQUFDLENBQUM7UUFDSCxHQUFHLENBQUMsR0FBRyxDQUFDLElBQUksQ0FBQyxTQUFTLENBQUMsWUFBWSxDQUFDLENBQUMsQ0FBQztJQUN4QyxDQUFDLENBQUM7QUFDSixDQUFDO0FBRUQ7O0dBRUc7QUFDSCxNQUFNLFVBQVUsc0JBQXNCLENBQ3BDLE9BQWUsRUFDZixXQUF3QixFQUN4QixVQUE2QjtJQUU3QixPQUFPLEtBQUssRUFDVixHQUF5QixFQUN6QixHQUF3QixFQUN4QixNQUE4QixFQUM5QixJQUFTLEVBQ00sRUFBRTtRQUNqQixNQUFNLE9BQU8sR0FBRyxNQUFNLENBQUMsRUFBRSxDQUFDO1FBQzFCLE1BQU0sVUFBVSxHQUFHLEdBQUcsT0FBTyxVQUFVLE9BQU8sRUFBRSxDQUFDO1FBQ2pELE1BQU0sV0FBVyxDQUFDLE1BQU0sQ0FBQyxJQUFJLEVBQUUsVUFBVSxDQUFDLENBQUM7UUFFM0MsTUFBTSxLQUFLLEdBQUcsTUFBTSxVQUFVLENBQUMsUUFBUSxDQUFDLE9BQU8sQ0FBQyxDQUFDO1FBQ2pELElBQUksQ0FBQyxLQUFLLEVBQUUsQ0FBQztZQUNYLE1BQU0sSUFBSSxlQUFlLENBQUMsR0FBRyxFQUFFLHNDQUFzQyxFQUFFLGlCQUFpQixDQUFDLENBQUM7UUFDNUYsQ0FBQztRQUVELDhEQUE4RDtRQUM5RCxJQUFJLEtBQUssQ0FBQyxNQUFNLEtBQUssU0FBUyxFQUFFLENBQUM7WUFDL0IsSUFBSSxRQUFRLEdBQUcsSUFBSSxDQUFDO1lBQ3BCLEtBQUssTUFBTSxPQUFPLElBQUksS0FBSyxDQUFDLGdCQUFnQixFQUFFLENBQUM7Z0JBQzdDLE1BQU0sS0FBSyxHQUFHLE1BQU0sVUFBVSxDQUFDLGdCQUFnQixDQUFDLE9BQU8sQ0FBQyxDQUFDO2dCQUN6RCxJQUFJLENBQUMsS0FBSyxJQUFJLEtBQUssQ0FBQyxNQUFNLEtBQUssT0FBTyxFQUFFLENBQUM7b0JBQ3ZDLFFBQVEsR0FBRyxLQUFLLENBQUM7b0JBQ2pCLE1BQU07Z0JBQ1IsQ0FBQztZQUNILENBQUM7WUFDRCxJQUFJLFFBQVEsRUFBRSxDQUFDO2dCQUNiLE1BQU0sVUFBVSxDQUFDLFdBQVcsQ0FBQyxPQUFPLEVBQUUsRUFBRSxNQUFNLEVBQUUsT0FBTyxFQUFFLENBQUMsQ0FBQztnQkFDM0QsS0FBSyxDQUFDLE1BQU0sR0FBRyxPQUFPLENBQUM7WUFDekIsQ0FBQztRQUNILENBQUM7UUFFRCxNQUFNLFlBQVksR0FBd0I7WUFDeEMsTUFBTSxFQUFFLEtBQUssQ0FBQyxNQUFNO1lBQ3BCLE9BQU8sRUFBRSxLQUFLLENBQUMsT0FBTztZQUN0QixXQUFXLEVBQUUsS0FBSyxDQUFDLFdBQVc7WUFDOUIsY0FBYyxFQUFFLEtBQUssQ0FBQyxnQkFBZ0IsQ0FBQyxHQUFHLENBQUMsQ0FBQyxFQUFFLEVBQUUsRUFBRSxDQUFDLEdBQUcsT0FBTyxVQUFVLEVBQUUsRUFBRSxDQUFDO1lBQzVFLFFBQVEsRUFBRSxLQUFLLENBQUMsUUFBUTtTQUN6QixDQUFDO1FBRUYsSUFBSSxLQUFLLENBQUMsV0FBVyxFQUFFLENBQUM7WUFDdEIsWUFBWSxDQUFDLFdBQVcsR0FBRyxLQUFLLENBQUMsV0FBVyxDQUFDO1FBQy9DLENBQUM7UUFFRCxHQUFHLENBQUMsU0FBUyxDQUFDLEdBQUcsRUFBRTtZQUNqQixjQUFjLEVBQUUsa0JBQWtCO1lBQ2xDLFVBQVUsRUFBRSxVQUFVO1NBQ3ZCLENBQUMsQ0FBQztRQUNILEdBQUcsQ0FBQyxHQUFHLENBQUMsSUFBSSxDQUFDLFNBQVMsQ0FBQyxZQUFZLENBQUMsQ0FBQyxDQUFDO0lBQ3hDLENBQUMsQ0FBQztBQUNKLENBQUMifQ==

package/dist_ts_server/server.interfaces.d.ts

@@ -0,0 +1,72 @@
+import type { IAcmeIdentifier } from '../dist_ts/acme/acme.interfaces.js';
+export interface IAcmeServerOptions {
+    port?: number;
+    hostname?: string;
+    baseUrl?: string;
+    /** When false, challenges auto-approve on trigger (useful for testing) */
+    challengeVerification?: boolean;
+    caOptions?: {
+        commonName?: string;
+        validityDays?: number;
+        certValidityDays?: number;
+    };
+}
+export interface IServerAccountStore {
+    create(account: IServerAccount): Promise<IServerAccount>;
+    getByThumbprint(thumbprint: string): Promise<IServerAccount | null>;
+    getByUrl(url: string): Promise<IServerAccount | null>;
+}
+export interface IServerOrderStore {
+    createOrder(order: IServerOrder): Promise<IServerOrder>;
+    getOrder(id: string): Promise<IServerOrder | null>;
+    updateOrder(id: string, updates: Partial<IServerOrder>): Promise<void>;
+    createAuthorization(authz: IServerAuthorization): Promise<IServerAuthorization>;
+    getAuthorization(id: string): Promise<IServerAuthorization | null>;
+    updateAuthorization(id: string, updates: Partial<IServerAuthorization>): Promise<void>;
+    createChallenge(challenge: IServerChallenge): Promise<IServerChallenge>;
+    getChallenge(id: string): Promise<IServerChallenge | null>;
+    updateChallenge(id: string, updates: Partial<IServerChallenge>): Promise<void>;
+    storeCertPem(orderId: string, pem: string): Promise<void>;
+    getCertPem(orderId: string): Promise<string | null>;
+}
+export interface IServerAccount {
+    id: string;
+    thumbprint: string;
+    url: string;
+    jwk: Record<string, string>;
+    status: string;
+    contact: string[];
+    createdAt: string;
+}
+export interface IServerOrder {
+    id: string;
+    accountUrl: string;
+    status: string;
+    identifiers: IAcmeIdentifier[];
+    authorizationIds: string[];
+    expires: string;
+    finalize: string;
+    certificate?: string;
+}
+export interface IServerAuthorization {
+    id: string;
+    orderId: string;
+    identifier: IAcmeIdentifier;
+    status: string;
+    expires: string;
+    challengeIds: string[];
+    wildcard?: boolean;
+}
+export interface IServerChallenge {
+    id: string;
+    authorizationId: string;
+    type: string;
+    token: string;
+    status: string;
+    validated?: string;
+    error?: {
+        type: string;
+        detail: string;
+    };
+}
+export type TRouteHandler = (req: import('node:http').IncomingMessage, res: import('node:http').ServerResponse, params: Record<string, string>, body: any) => Promise<void>;

package/dist_ts_server/server.interfaces.js

@@ -0,0 +1,2 @@
+export {};
+//# sourceMappingURL=data:application/json;base64,eyJ2ZXJzaW9uIjozLCJmaWxlIjoic2VydmVyLmludGVyZmFjZXMuanMiLCJzb3VyY2VSb290IjoiIiwic291cmNlcyI6WyIuLi8uLi90c19zZXJ2ZXIvc2VydmVyLmludGVyZmFjZXMudHMiXSwibmFtZXMiOltdLCJtYXBwaW5ncyI6IiJ9

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@push.rocks/smartacme",
-  "version": "9.1.2",
+  "version": "9.2.0",
   "private": false,
   "description": "A TypeScript-based ACME client for LetsEncrypt certificate management with a focus on simplicity and power.",
   "main": "dist_ts/index.js",
@@ -8,7 +8,7 @@
   "type": "module",
   "scripts": {
     "test": "(tstest test/ --verbose --logfile --timeout 600)",
-    "build": "(tsbuild)",
+    "build": "(tsbuild tsfolders)",
     "buildDocs": "tsdoc"
   },
   "repository": {
@@ -41,28 +41,28 @@
   "dependencies": {
     "@apiclient.xyz/cloudflare": "^7.1.0",
     "@peculiar/x509": "^1.14.3",
-    "@push.rocks/lik": "^6.2.2",
-    "@push.rocks/smartdata": "^7.0.15",
+    "@push.rocks/lik": "^6.3.1",
+    "@push.rocks/smartdata": "^7.1.0",
     "@push.rocks/smartdelay": "^3.0.5",
-    "@push.rocks/smartdns": "^7.8.1",
-    "@push.rocks/smartlog": "^3.1.10",
+    "@push.rocks/smartdns": "^7.9.0",
+    "@push.rocks/smartlog": "^3.2.1",
     "@push.rocks/smartnetwork": "^4.4.0",
     "@push.rocks/smartstring": "^4.1.0",
     "@push.rocks/smarttime": "^4.2.3",
     "@push.rocks/smartunique": "^3.0.9",
     "@push.rocks/taskbuffer": "^6.1.2",
-    "@tsclass/tsclass": "^9.3.0"
+    "@tsclass/tsclass": "^9.5.0"
   },
   "devDependencies": {
-    "@git.zone/tsbuild": "^4.1.2",
+    "@git.zone/tsbuild": "^4.3.0",
     "@git.zone/tsrun": "^2.0.1",
-    "@git.zone/tstest": "^3.1.8",
+    "@git.zone/tstest": "^3.4.0",
     "@push.rocks/qenv": "^6.1.3",
-    "@types/node": "^25.2.3"
+    "@types/node": "^25.5.0"
   },
   "files": [
     "ts/**/*",
-    "ts_web/**/*",
+    "ts_*/**/*",
     "dist/**/*",
     "dist_*/**/*",
     "dist_ts/**/*",

package/ts/00_commitinfo_data.ts

@@ -3,6 +3,6 @@
  */
 export const commitinfo = {
   name: '@push.rocks/smartacme',
-  version: '9.1.2',
+  version: '9.2.0',
   description: 'A TypeScript-based ACME client for LetsEncrypt certificate management with a focus on simplicity and power.'
 }

package/ts/acme/acme.classes.crypto.ts

@@ -175,7 +175,7 @@ export class AcmeCrypto {
   /**
    * Determine JWS algorithm from key type
    */
-  private static getAlg(keyPem: string): string {
+  static getAlg(keyPem: string): string {
     const keyObj = crypto.createPrivateKey(keyPem);
     const keyType = keyObj.asymmetricKeyType;
     if (keyType === 'rsa') return 'RS256';

package/ts/index.ts

@@ -10,5 +10,9 @@ export { certmanagers };
 import * as handlers from './handlers/index.js';
 export { handlers };
 
+// server (ACME Directory Server / CA)
+import * as server from '../ts_server/index.js';
+export { server };
+
 // re-export taskbuffer event types for consumers
 export type { ITaskEvent, ITaskMetadata } from '@push.rocks/taskbuffer';

package/ts/smartacme.classes.smartacme.ts

@@ -430,6 +430,7 @@ export class SmartAcme {
 
     if (isWildcardRequest) {
       identifiers.push({ type: 'dns', value: `*.${certDomainName}` });
+      identifiers.push({ type: 'dns', value: certDomainName });
     } else {
       identifiers.push({ type: 'dns', value: certDomainName });
 

package/ts_server/index.ts

@@ -0,0 +1,12 @@
+export { AcmeServer } from './server.classes.acmeserver.js';
+export { AcmeServerError } from './server.classes.jws.verifier.js';
+export { AcmeServerCA } from './server.classes.ca.js';
+export type {
+  IAcmeServerOptions,
+  IServerAccountStore,
+  IServerOrderStore,
+  IServerAccount,
+  IServerOrder,
+  IServerAuthorization,
+  IServerChallenge,
+} from './server.interfaces.js';

package/ts_server/server.classes.account.store.ts

@@ -0,0 +1,27 @@
+import type { IServerAccountStore, IServerAccount } from './server.interfaces.js';
+
+/**
+ * In-memory account storage for the ACME server.
+ */
+export class MemoryAccountStore implements IServerAccountStore {
+  private accounts = new Map<string, IServerAccount>();
+  private byThumbprint = new Map<string, string>();
+  private byUrl = new Map<string, string>();
+
+  async create(account: IServerAccount): Promise<IServerAccount> {
+    this.accounts.set(account.id, account);
+    this.byThumbprint.set(account.thumbprint, account.id);
+    this.byUrl.set(account.url, account.id);
+    return account;
+  }
+
+  async getByThumbprint(thumbprint: string): Promise<IServerAccount | null> {
+    const id = this.byThumbprint.get(thumbprint);
+    return id ? this.accounts.get(id) || null : null;
+  }
+
+  async getByUrl(url: string): Promise<IServerAccount | null> {
+    const id = this.byUrl.get(url);
+    return id ? this.accounts.get(id) || null : null;
+  }
+}

package/ts_server/server.classes.acmeserver.ts

@@ -0,0 +1,128 @@
+import * as http from 'node:http';
+import type { IAcmeServerOptions } from './server.interfaces.js';
+import { NonceManager } from './server.classes.nonce.js';
+import { JwsVerifier } from './server.classes.jws.verifier.js';
+import { MemoryAccountStore } from './server.classes.account.store.js';
+import { MemoryOrderStore } from './server.classes.order.store.js';
+import { AcmeServerCA } from './server.classes.ca.js';
+import { ChallengeVerifier } from './server.classes.challenge.verifier.js';
+import { AcmeRouter } from './server.classes.router.js';
+import { createDirectoryHandler } from './server.handlers.directory.js';
+import { createNonceHeadHandler, createNonceGetHandler } from './server.handlers.nonce.js';
+import { createAccountHandler } from './server.handlers.account.js';
+import { createNewOrderHandler, createOrderPollHandler } from './server.handlers.order.js';
+import { createAuthzHandler } from './server.handlers.authz.js';
+import { createChallengeHandler } from './server.handlers.challenge.js';
+import { createFinalizeHandler } from './server.handlers.finalize.js';
+import { createCertHandler } from './server.handlers.cert.js';
+
+/**
+ * ACME Directory Server — a self-contained RFC 8555 Certificate Authority.
+ *
+ * Usage:
+ * ```ts
+ * const server = new AcmeServer({ port: 14000 });
+ * await server.start();
+ * console.log(server.getDirectoryUrl()); // http://localhost:14000/directory
+ * ```
+ */
+export class AcmeServer {
+  private options: Required<Pick<IAcmeServerOptions, 'port' | 'hostname'>> & IAcmeServerOptions;
+  private httpServer: http.Server | null = null;
+  private ca: AcmeServerCA;
+  private baseUrl: string;
+
+  constructor(options: IAcmeServerOptions = {}) {
+    this.options = {
+      port: options.port ?? 14000,
+      hostname: options.hostname ?? '0.0.0.0',
+      ...options,
+    };
+    this.baseUrl = options.baseUrl ?? `http://localhost:${this.options.port}`;
+    this.ca = new AcmeServerCA(options.caOptions);
+  }
+
+  async start(): Promise<void> {
+    // Initialize CA
+    await this.ca.init();
+
+    // Create stores
+    const accountStore = new MemoryAccountStore();
+    const orderStore = new MemoryOrderStore();
+
+    // Create managers
+    const nonceManager = new NonceManager();
+    const jwsVerifier = new JwsVerifier(nonceManager, accountStore);
+    const challengeVerifier = new ChallengeVerifier(this.options.challengeVerification ?? true);
+
+    // Create router and register routes
+    const router = new AcmeRouter(nonceManager);
+
+    // Directory
+    router.addRoute('GET', '/directory', createDirectoryHandler(this.baseUrl));
+
+    // Nonce
+    router.addRoute('HEAD', '/new-nonce', createNonceHeadHandler());
+    router.addRoute('GET', '/new-nonce', createNonceGetHandler());
+
+    // Account
+    router.addRoute('POST', '/new-account', createAccountHandler(this.baseUrl, jwsVerifier, accountStore));
+
+    // Order
+    router.addRoute('POST', '/new-order', createNewOrderHandler(this.baseUrl, jwsVerifier, orderStore));
+    router.addRoute('POST', '/order/:id', createOrderPollHandler(this.baseUrl, jwsVerifier, orderStore));
+
+    // Authorization
+    router.addRoute('POST', '/authz/:id', createAuthzHandler(this.baseUrl, jwsVerifier, orderStore));
+
+    // Challenge
+    router.addRoute('POST', '/challenge/:id', createChallengeHandler(
+      this.baseUrl,
+      jwsVerifier,
+      orderStore,
+      accountStore,
+      challengeVerifier,
+    ));
+
+    // Finalize
+    router.addRoute('POST', '/finalize/:id', createFinalizeHandler(this.baseUrl, jwsVerifier, orderStore, this.ca));
+
+    // Certificate
+    router.addRoute('POST', '/cert/:id', createCertHandler(this.baseUrl, jwsVerifier, orderStore));
+
+    // Start HTTP server
+    this.httpServer = http.createServer((req, res) => {
+      router.handle(req, res).catch((err) => {
+        if (!res.headersSent) {
+          res.writeHead(500, { 'Content-Type': 'application/problem+json' });
+          res.end(JSON.stringify({
+            type: 'urn:ietf:params:acme:error:serverInternal',
+            detail: err instanceof Error ? err.message : 'Unknown error',
+            status: 500,
+          }));
+        }
+      });
+    });
+
+    await new Promise<void>((resolve) => {
+      this.httpServer!.listen(this.options.port, this.options.hostname, () => resolve());
+    });
+  }
+
+  async stop(): Promise<void> {
+    if (this.httpServer) {
+      await new Promise<void>((resolve, reject) => {
+        this.httpServer!.close((err) => (err ? reject(err) : resolve()));
+      });
+      this.httpServer = null;
+    }
+  }
+
+  getDirectoryUrl(): string {
+    return `${this.baseUrl}/directory`;
+  }
+
+  getCaCertPem(): string {
+    return this.ca.getCaCertPem();
+  }
+}

package/ts_server/server.classes.ca.ts

@@ -0,0 +1,142 @@
+import * as crypto from 'node:crypto';
+
+/**
+ * Certificate Authority for the ACME server.
+ * Generates a self-signed root CA and signs certificates from CSRs.
+ * Uses @peculiar/x509 (already a project dependency).
+ */
+export class AcmeServerCA {
+  private caKeyPair!: CryptoKeyPair;
+  private caCert!: InstanceType<typeof import('@peculiar/x509').X509Certificate>;
+  private caCertPem!: string;
+  private certValidityDays: number;
+
+  constructor(private options: { commonName?: string; validityDays?: number; certValidityDays?: number } = {}) {
+    this.certValidityDays = options.certValidityDays ?? 90;
+  }
+
+  async init(): Promise<void> {
+    const x509 = await import('@peculiar/x509');
+    const { webcrypto } = crypto;
+    x509.cryptoProvider.set(webcrypto as any);
+
+    // Generate RSA key pair for the CA
+    this.caKeyPair = await webcrypto.subtle.generateKey(
+      {
+        name: 'RSASSA-PKCS1-v1_5',
+        modulusLength: 2048,
+        publicExponent: new Uint8Array([1, 0, 1]),
+        hash: 'SHA-256',
+      },
+      true,
+      ['sign', 'verify'],
+    ) as CryptoKeyPair;
+
+    const cn = this.options.commonName ?? 'SmartACME Test CA';
+    const validityDays = this.options.validityDays ?? 3650;
+    const notBefore = new Date();
+    const notAfter = new Date();
+    notAfter.setDate(notAfter.getDate() + validityDays);
+
+    // Create self-signed root CA certificate
+    this.caCert = await x509.X509CertificateGenerator.createSelfSigned({
+      serialNumber: this.randomSerialNumber(),
+      name: `CN=${cn}`,
+      notBefore,
+      notAfter,
+      signingAlgorithm: { name: 'RSASSA-PKCS1-v1_5' },
+      keys: this.caKeyPair,
+      extensions: [
+        new x509.BasicConstraintsExtension(true, undefined, true),
+        new x509.KeyUsagesExtension(
+          x509.KeyUsageFlags.keyCertSign | x509.KeyUsageFlags.cRLSign,
+          true,
+        ),
+        await x509.SubjectKeyIdentifierExtension.create(this.caKeyPair.publicKey),
+      ],
+    });
+
+    this.caCertPem = this.caCert.toString('pem');
+  }
+
+  /**
+   * Sign a CSR and return a PEM certificate chain (end-entity + root CA).
+   * @param csrDerBase64url - The CSR in base64url-encoded DER format (as sent by ACME clients)
+   */
+  async signCsr(csrDerBase64url: string): Promise<string> {
+    const x509 = await import('@peculiar/x509');
+    const { webcrypto } = crypto;
+    x509.cryptoProvider.set(webcrypto as any);
+
+    // Parse the CSR
+    const csrDer = Buffer.from(csrDerBase64url, 'base64url');
+    const csr = new x509.Pkcs10CertificateRequest(csrDer);
+
+    // Extract Subject Alternative Names from CSR extensions
+    const sanNames: { type: 'dns'; value: string }[] = [];
+    const sanExt = csr.extensions?.find(
+      (ext) => ext.type === '2.5.29.17', // OID for SubjectAlternativeName
+    );
+
+    if (sanExt) {
+      const san = new x509.SubjectAlternativeNameExtension(sanExt.rawData);
+      if (san.names) {
+        const jsonNames = san.names.toJSON();
+        for (const name of jsonNames) {
+          if (name.type === 'dns') {
+            sanNames.push({ type: 'dns', value: name.value });
+          }
+        }
+      }
+    }
+
+    // If no SAN found, use CN from subject
+    if (sanNames.length === 0) {
+      const cnMatch = csr.subject.match(/CN=([^,]+)/);
+      if (cnMatch) {
+        sanNames.push({ type: 'dns', value: cnMatch[1] });
+      }
+    }
+
+    const notBefore = new Date();
+    const notAfter = new Date();
+    notAfter.setDate(notAfter.getDate() + this.certValidityDays);
+
+    // Sign the certificate
+    const cert = await x509.X509CertificateGenerator.create({
+      serialNumber: this.randomSerialNumber(),
+      subject: csr.subject,
+      issuer: this.caCert.subject,
+      notBefore,
+      notAfter,
+      signingAlgorithm: { name: 'RSASSA-PKCS1-v1_5' },
+      publicKey: csr.publicKey,
+      signingKey: this.caKeyPair.privateKey,
+      extensions: [
+        new x509.BasicConstraintsExtension(false, undefined, true),
+        new x509.KeyUsagesExtension(
+          x509.KeyUsageFlags.digitalSignature | x509.KeyUsageFlags.keyEncipherment,
+          true,
+        ),
+        new x509.ExtendedKeyUsageExtension(
+          ['1.3.6.1.5.5.7.3.1'], // serverAuth
+          true,
+        ),
+        new x509.SubjectAlternativeNameExtension(sanNames),
+        await x509.AuthorityKeyIdentifierExtension.create(this.caKeyPair.publicKey),
+      ],
+    });
+
+    // Return PEM chain: end-entity cert + root CA cert
+    const certPem = cert.toString('pem');
+    return `${certPem}\n${this.caCertPem}`;
+  }
+
+  getCaCertPem(): string {
+    return this.caCertPem;
+  }
+
+  private randomSerialNumber(): string {
+    return crypto.randomBytes(16).toString('hex');
+  }
+}