@push.rocks/smartacme 9.1.3 → 9.3.0

package/dist_ts_server/server.classes.acmeserver.js

@@ -0,0 +1,100 @@
+import * as http from 'node:http';
+import { NonceManager } from './server.classes.nonce.js';
+import { JwsVerifier } from './server.classes.jws.verifier.js';
+import { MemoryAccountStore } from './server.classes.account.store.js';
+import { MemoryOrderStore } from './server.classes.order.store.js';
+import { AcmeServerCA } from './server.classes.ca.js';
+import { ChallengeVerifier } from './server.classes.challenge.verifier.js';
+import { AcmeRouter } from './server.classes.router.js';
+import { createDirectoryHandler } from './server.handlers.directory.js';
+import { createNonceHeadHandler, createNonceGetHandler } from './server.handlers.nonce.js';
+import { createAccountHandler } from './server.handlers.account.js';
+import { createNewOrderHandler, createOrderPollHandler } from './server.handlers.order.js';
+import { createAuthzHandler } from './server.handlers.authz.js';
+import { createChallengeHandler } from './server.handlers.challenge.js';
+import { createFinalizeHandler } from './server.handlers.finalize.js';
+import { createCertHandler } from './server.handlers.cert.js';
+/**
+ * ACME Directory Server — a self-contained RFC 8555 Certificate Authority.
+ *
+ * Usage:
+ * ```ts
+ * const server = new AcmeServer({ port: 14000 });
+ * await server.start();
+ * console.log(server.getDirectoryUrl()); // http://localhost:14000/directory
+ * ```
+ */
+export class AcmeServer {
+    constructor(options = {}) {
+        this.httpServer = null;
+        this.options = {
+            port: options.port ?? 14000,
+            hostname: options.hostname ?? '0.0.0.0',
+            ...options,
+        };
+        this.baseUrl = options.baseUrl ?? `http://localhost:${this.options.port}`;
+        this.ca = new AcmeServerCA(options.caOptions);
+    }
+    async start() {
+        // Initialize CA
+        await this.ca.init();
+        // Create stores
+        const accountStore = new MemoryAccountStore();
+        const orderStore = new MemoryOrderStore();
+        // Create managers
+        const nonceManager = new NonceManager();
+        const jwsVerifier = new JwsVerifier(nonceManager, accountStore);
+        const challengeVerifier = new ChallengeVerifier(this.options.challengeVerification ?? true);
+        // Create router and register routes
+        const router = new AcmeRouter(nonceManager);
+        // Directory
+        router.addRoute('GET', '/directory', createDirectoryHandler(this.baseUrl));
+        // Nonce
+        router.addRoute('HEAD', '/new-nonce', createNonceHeadHandler());
+        router.addRoute('GET', '/new-nonce', createNonceGetHandler());
+        // Account
+        router.addRoute('POST', '/new-account', createAccountHandler(this.baseUrl, jwsVerifier, accountStore));
+        // Order
+        router.addRoute('POST', '/new-order', createNewOrderHandler(this.baseUrl, jwsVerifier, orderStore));
+        router.addRoute('POST', '/order/:id', createOrderPollHandler(this.baseUrl, jwsVerifier, orderStore));
+        // Authorization
+        router.addRoute('POST', '/authz/:id', createAuthzHandler(this.baseUrl, jwsVerifier, orderStore));
+        // Challenge
+        router.addRoute('POST', '/challenge/:id', createChallengeHandler(this.baseUrl, jwsVerifier, orderStore, accountStore, challengeVerifier));
+        // Finalize
+        router.addRoute('POST', '/finalize/:id', createFinalizeHandler(this.baseUrl, jwsVerifier, orderStore, this.ca));
+        // Certificate
+        router.addRoute('POST', '/cert/:id', createCertHandler(this.baseUrl, jwsVerifier, orderStore));
+        // Start HTTP server
+        this.httpServer = http.createServer((req, res) => {
+            router.handle(req, res).catch((err) => {
+                if (!res.headersSent) {
+                    res.writeHead(500, { 'Content-Type': 'application/problem+json' });
+                    res.end(JSON.stringify({
+                        type: 'urn:ietf:params:acme:error:serverInternal',
+                        detail: err instanceof Error ? err.message : 'Unknown error',
+                        status: 500,
+                    }));
+                }
+            });
+        });
+        await new Promise((resolve) => {
+            this.httpServer.listen(this.options.port, this.options.hostname, () => resolve());
+        });
+    }
+    async stop() {
+        if (this.httpServer) {
+            await new Promise((resolve, reject) => {
+                this.httpServer.close((err) => (err ? reject(err) : resolve()));
+            });
+            this.httpServer = null;
+        }
+    }
+    getDirectoryUrl() {
+        return `${this.baseUrl}/directory`;
+    }
+    getCaCertPem() {
+        return this.ca.getCaCertPem();
+    }
+}
+//# sourceMappingURL=data:application/json;base64,eyJ2ZXJzaW9uIjozLCJmaWxlIjoic2VydmVyLmNsYXNzZXMuYWNtZXNlcnZlci5qcyIsInNvdXJjZVJvb3QiOiIiLCJzb3VyY2VzIjpbIi4uLy4uL3RzX3NlcnZlci9zZXJ2ZXIuY2xhc3Nlcy5hY21lc2VydmVyLnRzIl0sIm5hbWVzIjpbXSwibWFwcGluZ3MiOiJBQUFBLE9BQU8sS0FBSyxJQUFJLE1BQU0sV0FBVyxDQUFDO0FBRWxDLE9BQU8sRUFBRSxZQUFZLEVBQUUsTUFBTSwyQkFBMkIsQ0FBQztBQUN6RCxPQUFPLEVBQUUsV0FBVyxFQUFFLE1BQU0sa0NBQWtDLENBQUM7QUFDL0QsT0FBTyxFQUFFLGtCQUFrQixFQUFFLE1BQU0sbUNBQW1DLENBQUM7QUFDdkUsT0FBTyxFQUFFLGdCQUFnQixFQUFFLE1BQU0saUNBQWlDLENBQUM7QUFDbkUsT0FBTyxFQUFFLFlBQVksRUFBRSxNQUFNLHdCQUF3QixDQUFDO0FBQ3RELE9BQU8sRUFBRSxpQkFBaUIsRUFBRSxNQUFNLHdDQUF3QyxDQUFDO0FBQzNFLE9BQU8sRUFBRSxVQUFVLEVBQUUsTUFBTSw0QkFBNEIsQ0FBQztBQUN4RCxPQUFPLEVBQUUsc0JBQXNCLEVBQUUsTUFBTSxnQ0FBZ0MsQ0FBQztBQUN4RSxPQUFPLEVBQUUsc0JBQXNCLEVBQUUscUJBQXFCLEVBQUUsTUFBTSw0QkFBNEIsQ0FBQztBQUMzRixPQUFPLEVBQUUsb0JBQW9CLEVBQUUsTUFBTSw4QkFBOEIsQ0FBQztBQUNwRSxPQUFPLEVBQUUscUJBQXFCLEVBQUUsc0JBQXNCLEVBQUUsTUFBTSw0QkFBNEIsQ0FBQztBQUMzRixPQUFPLEVBQUUsa0JBQWtCLEVBQUUsTUFBTSw0QkFBNEIsQ0FBQztBQUNoRSxPQUFPLEVBQUUsc0JBQXNCLEVBQUUsTUFBTSxnQ0FBZ0MsQ0FBQztBQUN4RSxPQUFPLEVBQUUscUJBQXFCLEVBQUUsTUFBTSwrQkFBK0IsQ0FBQztBQUN0RSxPQUFPLEVBQUUsaUJBQWlCLEVBQUUsTUFBTSwyQkFBMkIsQ0FBQztBQUU5RDs7Ozs7Ozs7O0dBU0c7QUFDSCxNQUFNLE9BQU8sVUFBVTtJQU1yQixZQUFZLFVBQThCLEVBQUU7UUFKcEMsZUFBVSxHQUF1QixJQUFJLENBQUM7UUFLNUMsSUFBSSxDQUFDLE9BQU8sR0FBRztZQUNiLElBQUksRUFBRSxPQUFPLENBQUMsSUFBSSxJQUFJLEtBQUs7WUFDM0IsUUFBUSxFQUFFLE9BQU8sQ0FBQyxRQUFRLElBQUksU0FBUztZQUN2QyxHQUFHLE9BQU87U0FDWCxDQUFDO1FBQ0YsSUFBSSxDQUFDLE9BQU8sR0FBRyxPQUFPLENBQUMsT0FBTyxJQUFJLG9CQUFvQixJQUFJLENBQUMsT0FBTyxDQUFDLElBQUksRUFBRSxDQUFDO1FBQzFFLElBQUksQ0FBQyxFQUFFLEdBQUcsSUFBSSxZQUFZLENBQUMsT0FBTyxDQUFDLFNBQVMsQ0FBQyxDQUFDO0lBQ2hELENBQUM7SUFFRCxLQUFLLENBQUMsS0FBSztRQUNULGdCQUFnQjtRQUNoQixNQUFNLElBQUksQ0FBQyxFQUFFLENBQUMsSUFBSSxFQUFFLENBQUM7UUFFckIsZ0JBQWdCO1FBQ2hCLE1BQU0sWUFBWSxHQUFHLElBQUksa0JBQWtCLEVBQUUsQ0FBQztRQUM5QyxNQUFNLFVBQVUsR0FBRyxJQUFJLGdCQUFnQixFQUFFLENBQUM7UUFFMUMsa0JBQWtCO1FBQ2xCLE1BQU0sWUFBWSxHQUFHLElBQUksWUFBWSxFQUFFLENBQUM7UUFDeEMsTUFBTSxXQUFXLEdBQUcsSUFBSSxXQUFXLENBQUMsWUFBWSxFQUFFLFlBQVksQ0FBQyxDQUFDO1FBQ2hFLE1BQU0saUJBQWlCLEdBQUcsSUFBSSxpQkFBaUIsQ0FBQyxJQUFJLENBQUMsT0FBTyxDQUFDLHFCQUFxQixJQUFJLElBQUksQ0FBQyxDQUFDO1FBRTVGLG9DQUFvQztRQUNwQyxNQUFNLE1BQU0sR0FBRyxJQUFJLFVBQVUsQ0FBQyxZQUFZLENBQUMsQ0FBQztRQUU1QyxZQUFZO1FBQ1osTUFBTSxDQUFDLFFBQVEsQ0FBQyxLQUFLLEVBQUUsWUFBWSxFQUFFLHNCQUFzQixDQUFDLElBQUksQ0FBQyxPQUFPLENBQUMsQ0FBQyxDQUFDO1FBRTNFLFFBQVE7UUFDUixNQUFNLENBQUMsUUFBUSxDQUFDLE1BQU0sRUFBRSxZQUFZLEVBQUUsc0JBQXNCLEVBQUUsQ0FBQyxDQUFDO1FBQ2hFLE1BQU0sQ0FBQyxRQUFRLENBQUMsS0FBSyxFQUFFLFlBQVksRUFBRSxxQkFBcUIsRUFBRSxDQUFDLENBQUM7UUFFOUQsVUFBVTtRQUNWLE1BQU0sQ0FBQyxRQUFRLENBQUMsTUFBTSxFQUFFLGNBQWMsRUFBRSxvQkFBb0IsQ0FBQyxJQUFJLENBQUMsT0FBTyxFQUFFLFdBQVcsRUFBRSxZQUFZLENBQUMsQ0FBQyxDQUFDO1FBRXZHLFFBQVE7UUFDUixNQUFNLENBQUMsUUFBUSxDQUFDLE1BQU0sRUFBRSxZQUFZLEVBQUUscUJBQXFCLENBQUMsSUFBSSxDQUFDLE9BQU8sRUFBRSxXQUFXLEVBQUUsVUFBVSxDQUFDLENBQUMsQ0FBQztRQUNwRyxNQUFNLENBQUMsUUFBUSxDQUFDLE1BQU0sRUFBRSxZQUFZLEVBQUUsc0JBQXNCLENBQUMsSUFBSSxDQUFDLE9BQU8sRUFBRSxXQUFXLEVBQUUsVUFBVSxDQUFDLENBQUMsQ0FBQztRQUVyRyxnQkFBZ0I7UUFDaEIsTUFBTSxDQUFDLFFBQVEsQ0FBQyxNQUFNLEVBQUUsWUFBWSxFQUFFLGtCQUFrQixDQUFDLElBQUksQ0FBQyxPQUFPLEVBQUUsV0FBVyxFQUFFLFVBQVUsQ0FBQyxDQUFDLENBQUM7UUFFakcsWUFBWTtRQUNaLE1BQU0sQ0FBQyxRQUFRLENBQUMsTUFBTSxFQUFFLGdCQUFnQixFQUFFLHNCQUFzQixDQUM5RCxJQUFJLENBQUMsT0FBTyxFQUNaLFdBQVcsRUFDWCxVQUFVLEVBQ1YsWUFBWSxFQUNaLGlCQUFpQixDQUNsQixDQUFDLENBQUM7UUFFSCxXQUFXO1FBQ1gsTUFBTSxDQUFDLFFBQVEsQ0FBQyxNQUFNLEVBQUUsZUFBZSxFQUFFLHFCQUFxQixDQUFDLElBQUksQ0FBQyxPQUFPLEVBQUUsV0FBVyxFQUFFLFVBQVUsRUFBRSxJQUFJLENBQUMsRUFBRSxDQUFDLENBQUMsQ0FBQztRQUVoSCxjQUFjO1FBQ2QsTUFBTSxDQUFDLFFBQVEsQ0FBQyxNQUFNLEVBQUUsV0FBVyxFQUFFLGlCQUFpQixDQUFDLElBQUksQ0FBQyxPQUFPLEVBQUUsV0FBVyxFQUFFLFVBQVUsQ0FBQyxDQUFDLENBQUM7UUFFL0Ysb0JBQW9CO1FBQ3BCLElBQUksQ0FBQyxVQUFVLEdBQUcsSUFBSSxDQUFDLFlBQVksQ0FBQyxDQUFDLEdBQUcsRUFBRSxHQUFHLEVBQUUsRUFBRTtZQUMvQyxNQUFNLENBQUMsTUFBTSxDQUFDLEdBQUcsRUFBRSxHQUFHLENBQUMsQ0FBQyxLQUFLLENBQUMsQ0FBQyxHQUFHLEVBQUUsRUFBRTtnQkFDcEMsSUFBSSxDQUFDLEdBQUcsQ0FBQyxXQUFXLEVBQUUsQ0FBQztvQkFDckIsR0FBRyxDQUFDLFNBQVMsQ0FBQyxHQUFHLEVBQUUsRUFBRSxjQUFjLEVBQUUsMEJBQTBCLEVBQUUsQ0FBQyxDQUFDO29CQUNuRSxHQUFHLENBQUMsR0FBRyxDQUFDLElBQUksQ0FBQyxTQUFTLENBQUM7d0JBQ3JCLElBQUksRUFBRSwyQ0FBMkM7d0JBQ2pELE1BQU0sRUFBRSxHQUFHLFlBQVksS0FBSyxDQUFDLENBQUMsQ0FBQyxHQUFHLENBQUMsT0FBTyxDQUFDLENBQUMsQ0FBQyxlQUFlO3dCQUM1RCxNQUFNLEVBQUUsR0FBRztxQkFDWixDQUFDLENBQUMsQ0FBQztnQkFDTixDQUFDO1lBQ0gsQ0FBQyxDQUFDLENBQUM7UUFDTCxDQUFDLENBQUMsQ0FBQztRQUVILE1BQU0sSUFBSSxPQUFPLENBQU8sQ0FBQyxPQUFPLEVBQUUsRUFBRTtZQUNsQyxJQUFJLENBQUMsVUFBVyxDQUFDLE1BQU0sQ0FBQyxJQUFJLENBQUMsT0FBTyxDQUFDLElBQUksRUFBRSxJQUFJLENBQUMsT0FBTyxDQUFDLFFBQVEsRUFBRSxHQUFHLEVBQUUsQ0FBQyxPQUFPLEVBQUUsQ0FBQyxDQUFDO1FBQ3JGLENBQUMsQ0FBQyxDQUFDO0lBQ0wsQ0FBQztJQUVELEtBQUssQ0FBQyxJQUFJO1FBQ1IsSUFBSSxJQUFJLENBQUMsVUFBVSxFQUFFLENBQUM7WUFDcEIsTUFBTSxJQUFJLE9BQU8sQ0FBTyxDQUFDLE9BQU8sRUFBRSxNQUFNLEVBQUUsRUFBRTtnQkFDMUMsSUFBSSxDQUFDLFVBQVcsQ0FBQyxLQUFLLENBQUMsQ0FBQyxHQUFHLEVBQUUsRUFBRSxDQUFDLENBQUMsR0FBRyxDQUFDLENBQUMsQ0FBQyxNQUFNLENBQUMsR0FBRyxDQUFDLENBQUMsQ0FBQyxDQUFDLE9BQU8sRUFBRSxDQUFDLENBQUMsQ0FBQztZQUNuRSxDQUFDLENBQUMsQ0FBQztZQUNILElBQUksQ0FBQyxVQUFVLEdBQUcsSUFBSSxDQUFDO1FBQ3pCLENBQUM7SUFDSCxDQUFDO0lBRUQsZUFBZTtRQUNiLE9BQU8sR0FBRyxJQUFJLENBQUMsT0FBTyxZQUFZLENBQUM7SUFDckMsQ0FBQztJQUVELFlBQVk7UUFDVixPQUFPLElBQUksQ0FBQyxFQUFFLENBQUMsWUFBWSxFQUFFLENBQUM7SUFDaEMsQ0FBQztDQUNGIn0=

package/dist_ts_server/server.classes.ca.d.ts

@@ -0,0 +1,25 @@
+/**
+ * Certificate Authority for the ACME server.
+ * Generates a self-signed root CA and signs certificates from CSRs.
+ * Uses @peculiar/x509 (already a project dependency).
+ */
+export declare class AcmeServerCA {
+    private options;
+    private caKeyPair;
+    private caCert;
+    private caCertPem;
+    private certValidityDays;
+    constructor(options?: {
+        commonName?: string;
+        validityDays?: number;
+        certValidityDays?: number;
+    });
+    init(): Promise<void>;
+    /**
+     * Sign a CSR and return a PEM certificate chain (end-entity + root CA).
+     * @param csrDerBase64url - The CSR in base64url-encoded DER format (as sent by ACME clients)
+     */
+    signCsr(csrDerBase64url: string): Promise<string>;
+    getCaCertPem(): string;
+    private randomSerialNumber;
+}

package/dist_ts_server/server.classes.ca.js

@@ -0,0 +1,109 @@
+import * as crypto from 'node:crypto';
+/**
+ * Certificate Authority for the ACME server.
+ * Generates a self-signed root CA and signs certificates from CSRs.
+ * Uses @peculiar/x509 (already a project dependency).
+ */
+export class AcmeServerCA {
+    constructor(options = {}) {
+        this.options = options;
+        this.certValidityDays = options.certValidityDays ?? 90;
+    }
+    async init() {
+        const x509 = await import('@peculiar/x509');
+        const { webcrypto } = crypto;
+        x509.cryptoProvider.set(webcrypto);
+        // Generate RSA key pair for the CA
+        this.caKeyPair = await webcrypto.subtle.generateKey({
+            name: 'RSASSA-PKCS1-v1_5',
+            modulusLength: 2048,
+            publicExponent: new Uint8Array([1, 0, 1]),
+            hash: 'SHA-256',
+        }, true, ['sign', 'verify']);
+        const cn = this.options.commonName ?? 'SmartACME Test CA';
+        const validityDays = this.options.validityDays ?? 3650;
+        const notBefore = new Date();
+        const notAfter = new Date();
+        notAfter.setDate(notAfter.getDate() + validityDays);
+        // Create self-signed root CA certificate
+        this.caCert = await x509.X509CertificateGenerator.createSelfSigned({
+            serialNumber: this.randomSerialNumber(),
+            name: `CN=${cn}`,
+            notBefore,
+            notAfter,
+            signingAlgorithm: { name: 'RSASSA-PKCS1-v1_5' },
+            keys: this.caKeyPair,
+            extensions: [
+                new x509.BasicConstraintsExtension(true, undefined, true),
+                new x509.KeyUsagesExtension(x509.KeyUsageFlags.keyCertSign | x509.KeyUsageFlags.cRLSign, true),
+                await x509.SubjectKeyIdentifierExtension.create(this.caKeyPair.publicKey),
+            ],
+        });
+        this.caCertPem = this.caCert.toString('pem');
+    }
+    /**
+     * Sign a CSR and return a PEM certificate chain (end-entity + root CA).
+     * @param csrDerBase64url - The CSR in base64url-encoded DER format (as sent by ACME clients)
+     */
+    async signCsr(csrDerBase64url) {
+        const x509 = await import('@peculiar/x509');
+        const { webcrypto } = crypto;
+        x509.cryptoProvider.set(webcrypto);
+        // Parse the CSR
+        const csrDer = Buffer.from(csrDerBase64url, 'base64url');
+        const csr = new x509.Pkcs10CertificateRequest(csrDer);
+        // Extract Subject Alternative Names from CSR extensions
+        const sanNames = [];
+        const sanExt = csr.extensions?.find((ext) => ext.type === '2.5.29.17');
+        if (sanExt) {
+            const san = new x509.SubjectAlternativeNameExtension(sanExt.rawData);
+            if (san.names) {
+                const jsonNames = san.names.toJSON();
+                for (const name of jsonNames) {
+                    if (name.type === 'dns') {
+                        sanNames.push({ type: 'dns', value: name.value });
+                    }
+                }
+            }
+        }
+        // If no SAN found, use CN from subject
+        if (sanNames.length === 0) {
+            const cnMatch = csr.subject.match(/CN=([^,]+)/);
+            if (cnMatch) {
+                sanNames.push({ type: 'dns', value: cnMatch[1] });
+            }
+        }
+        const notBefore = new Date();
+        const notAfter = new Date();
+        notAfter.setDate(notAfter.getDate() + this.certValidityDays);
+        // Sign the certificate
+        const cert = await x509.X509CertificateGenerator.create({
+            serialNumber: this.randomSerialNumber(),
+            subject: csr.subject,
+            issuer: this.caCert.subject,
+            notBefore,
+            notAfter,
+            signingAlgorithm: { name: 'RSASSA-PKCS1-v1_5' },
+            publicKey: csr.publicKey,
+            signingKey: this.caKeyPair.privateKey,
+            extensions: [
+                new x509.BasicConstraintsExtension(false, undefined, true),
+                new x509.KeyUsagesExtension(x509.KeyUsageFlags.digitalSignature | x509.KeyUsageFlags.keyEncipherment, true),
+                new x509.ExtendedKeyUsageExtension(['1.3.6.1.5.5.7.3.1'], // serverAuth
+                true),
+                new x509.SubjectAlternativeNameExtension(sanNames),
+                await x509.AuthorityKeyIdentifierExtension.create(this.caKeyPair.publicKey),
+            ],
+        });
+        // Return PEM chain: end-entity cert + root CA cert
+        const certPem = cert.toString('pem');
+        return `${certPem}\n${this.caCertPem}`;
+    }
+    getCaCertPem() {
+        return this.caCertPem;
+    }
+    randomSerialNumber() {
+        return crypto.randomBytes(16).toString('hex');
+    }
+}
+//# sourceMappingURL=data:application/json;base64,eyJ2ZXJzaW9uIjozLCJmaWxlIjoic2VydmVyLmNsYXNzZXMuY2EuanMiLCJzb3VyY2VSb290IjoiIiwic291cmNlcyI6WyIuLi8uLi90c19zZXJ2ZXIvc2VydmVyLmNsYXNzZXMuY2EudHMiXSwibmFtZXMiOltdLCJtYXBwaW5ncyI6IkFBQUEsT0FBTyxLQUFLLE1BQU0sTUFBTSxhQUFhLENBQUM7QUFFdEM7Ozs7R0FJRztBQUNILE1BQU0sT0FBTyxZQUFZO0lBTXZCLFlBQW9CLFVBQXFGLEVBQUU7UUFBdkYsWUFBTyxHQUFQLE9BQU8sQ0FBZ0Y7UUFDekcsSUFBSSxDQUFDLGdCQUFnQixHQUFHLE9BQU8sQ0FBQyxnQkFBZ0IsSUFBSSxFQUFFLENBQUM7SUFDekQsQ0FBQztJQUVELEtBQUssQ0FBQyxJQUFJO1FBQ1IsTUFBTSxJQUFJLEdBQUcsTUFBTSxNQUFNLENBQUMsZ0JBQWdCLENBQUMsQ0FBQztRQUM1QyxNQUFNLEVBQUUsU0FBUyxFQUFFLEdBQUcsTUFBTSxDQUFDO1FBQzdCLElBQUksQ0FBQyxjQUFjLENBQUMsR0FBRyxDQUFDLFNBQWdCLENBQUMsQ0FBQztRQUUxQyxtQ0FBbUM7UUFDbkMsSUFBSSxDQUFDLFNBQVMsR0FBRyxNQUFNLFNBQVMsQ0FBQyxNQUFNLENBQUMsV0FBVyxDQUNqRDtZQUNFLElBQUksRUFBRSxtQkFBbUI7WUFDekIsYUFBYSxFQUFFLElBQUk7WUFDbkIsY0FBYyxFQUFFLElBQUksVUFBVSxDQUFDLENBQUMsQ0FBQyxFQUFFLENBQUMsRUFBRSxDQUFDLENBQUMsQ0FBQztZQUN6QyxJQUFJLEVBQUUsU0FBUztTQUNoQixFQUNELElBQUksRUFDSixDQUFDLE1BQU0sRUFBRSxRQUFRLENBQUMsQ0FDRixDQUFDO1FBRW5CLE1BQU0sRUFBRSxHQUFHLElBQUksQ0FBQyxPQUFPLENBQUMsVUFBVSxJQUFJLG1CQUFtQixDQUFDO1FBQzFELE1BQU0sWUFBWSxHQUFHLElBQUksQ0FBQyxPQUFPLENBQUMsWUFBWSxJQUFJLElBQUksQ0FBQztRQUN2RCxNQUFNLFNBQVMsR0FBRyxJQUFJLElBQUksRUFBRSxDQUFDO1FBQzdCLE1BQU0sUUFBUSxHQUFHLElBQUksSUFBSSxFQUFFLENBQUM7UUFDNUIsUUFBUSxDQUFDLE9BQU8sQ0FBQyxRQUFRLENBQUMsT0FBTyxFQUFFLEdBQUcsWUFBWSxDQUFDLENBQUM7UUFFcEQseUNBQXlDO1FBQ3pDLElBQUksQ0FBQyxNQUFNLEdBQUcsTUFBTSxJQUFJLENBQUMsd0JBQXdCLENBQUMsZ0JBQWdCLENBQUM7WUFDakUsWUFBWSxFQUFFLElBQUksQ0FBQyxrQkFBa0IsRUFBRTtZQUN2QyxJQUFJLEVBQUUsTUFBTSxFQUFFLEVBQUU7WUFDaEIsU0FBUztZQUNULFFBQVE7WUFDUixnQkFBZ0IsRUFBRSxFQUFFLElBQUksRUFBRSxtQkFBbUIsRUFBRTtZQUMvQyxJQUFJLEVBQUUsSUFBSSxDQUFDLFNBQVM7WUFDcEIsVUFBVSxFQUFFO2dCQUNWLElBQUksSUFBSSxDQUFDLHlCQUF5QixDQUFDLElBQUksRUFBRSxTQUFTLEVBQUUsSUFBSSxDQUFDO2dCQUN6RCxJQUFJLElBQUksQ0FBQyxrQkFBa0IsQ0FDekIsSUFBSSxDQUFDLGFBQWEsQ0FBQyxXQUFXLEdBQUcsSUFBSSxDQUFDLGFBQWEsQ0FBQyxPQUFPLEVBQzNELElBQUksQ0FDTDtnQkFDRCxNQUFNLElBQUksQ0FBQyw2QkFBNkIsQ0FBQyxNQUFNLENBQUMsSUFBSSxDQUFDLFNBQVMsQ0FBQyxTQUFTLENBQUM7YUFDMUU7U0FDRixDQUFDLENBQUM7UUFFSCxJQUFJLENBQUMsU0FBUyxHQUFHLElBQUksQ0FBQyxNQUFNLENBQUMsUUFBUSxDQUFDLEtBQUssQ0FBQyxDQUFDO0lBQy9DLENBQUM7SUFFRDs7O09BR0c7SUFDSCxLQUFLLENBQUMsT0FBTyxDQUFDLGVBQXVCO1FBQ25DLE1BQU0sSUFBSSxHQUFHLE1BQU0sTUFBTSxDQUFDLGdCQUFnQixDQUFDLENBQUM7UUFDNUMsTUFBTSxFQUFFLFNBQVMsRUFBRSxHQUFHLE1BQU0sQ0FBQztRQUM3QixJQUFJLENBQUMsY0FBYyxDQUFDLEdBQUcsQ0FBQyxTQUFnQixDQUFDLENBQUM7UUFFMUMsZ0JBQWdCO1FBQ2hCLE1BQU0sTUFBTSxHQUFHLE1BQU0sQ0FBQyxJQUFJLENBQUMsZUFBZSxFQUFFLFdBQVcsQ0FBQyxDQUFDO1FBQ3pELE1BQU0sR0FBRyxHQUFHLElBQUksSUFBSSxDQUFDLHdCQUF3QixDQUFDLE1BQU0sQ0FBQyxDQUFDO1FBRXRELHdEQUF3RDtRQUN4RCxNQUFNLFFBQVEsR0FBcUMsRUFBRSxDQUFDO1FBQ3RELE1BQU0sTUFBTSxHQUFHLEdBQUcsQ0FBQyxVQUFVLEVBQUUsSUFBSSxDQUNqQyxDQUFDLEdBQUcsRUFBRSxFQUFFLENBQUMsR0FBRyxDQUFDLElBQUksS0FBSyxXQUFXLENBQ2xDLENBQUM7UUFFRixJQUFJLE1BQU0sRUFBRSxDQUFDO1lBQ1gsTUFBTSxHQUFHLEdBQUcsSUFBSSxJQUFJLENBQUMsK0JBQStCLENBQUMsTUFBTSxDQUFDLE9BQU8sQ0FBQyxDQUFDO1lBQ3JFLElBQUksR0FBRyxDQUFDLEtBQUssRUFBRSxDQUFDO2dCQUNkLE1BQU0sU0FBUyxHQUFHLEdBQUcsQ0FBQyxLQUFLLENBQUMsTUFBTSxFQUFFLENBQUM7Z0JBQ3JDLEtBQUssTUFBTSxJQUFJLElBQUksU0FBUyxFQUFFLENBQUM7b0JBQzdCLElBQUksSUFBSSxDQUFDLElBQUksS0FBSyxLQUFLLEVBQUUsQ0FBQzt3QkFDeEIsUUFBUSxDQUFDLElBQUksQ0FBQyxFQUFFLElBQUksRUFBRSxLQUFLLEVBQUUsS0FBSyxFQUFFLElBQUksQ0FBQyxLQUFLLEVBQUUsQ0FBQyxDQUFDO29CQUNwRCxDQUFDO2dCQUNILENBQUM7WUFDSCxDQUFDO1FBQ0gsQ0FBQztRQUVELHVDQUF1QztRQUN2QyxJQUFJLFFBQVEsQ0FBQyxNQUFNLEtBQUssQ0FBQyxFQUFFLENBQUM7WUFDMUIsTUFBTSxPQUFPLEdBQUcsR0FBRyxDQUFDLE9BQU8sQ0FBQyxLQUFLLENBQUMsWUFBWSxDQUFDLENBQUM7WUFDaEQsSUFBSSxPQUFPLEVBQUUsQ0FBQztnQkFDWixRQUFRLENBQUMsSUFBSSxDQUFDLEVBQUUsSUFBSSxFQUFFLEtBQUssRUFBRSxLQUFLLEVBQUUsT0FBTyxDQUFDLENBQUMsQ0FBQyxFQUFFLENBQUMsQ0FBQztZQUNwRCxDQUFDO1FBQ0gsQ0FBQztRQUVELE1BQU0sU0FBUyxHQUFHLElBQUksSUFBSSxFQUFFLENBQUM7UUFDN0IsTUFBTSxRQUFRLEdBQUcsSUFBSSxJQUFJLEVBQUUsQ0FBQztRQUM1QixRQUFRLENBQUMsT0FBTyxDQUFDLFFBQVEsQ0FBQyxPQUFPLEVBQUUsR0FBRyxJQUFJLENBQUMsZ0JBQWdCLENBQUMsQ0FBQztRQUU3RCx1QkFBdUI7UUFDdkIsTUFBTSxJQUFJLEdBQUcsTUFBTSxJQUFJLENBQUMsd0JBQXdCLENBQUMsTUFBTSxDQUFDO1lBQ3RELFlBQVksRUFBRSxJQUFJLENBQUMsa0JBQWtCLEVBQUU7WUFDdkMsT0FBTyxFQUFFLEdBQUcsQ0FBQyxPQUFPO1lBQ3BCLE1BQU0sRUFBRSxJQUFJLENBQUMsTUFBTSxDQUFDLE9BQU87WUFDM0IsU0FBUztZQUNULFFBQVE7WUFDUixnQkFBZ0IsRUFBRSxFQUFFLElBQUksRUFBRSxtQkFBbUIsRUFBRTtZQUMvQyxTQUFTLEVBQUUsR0FBRyxDQUFDLFNBQVM7WUFDeEIsVUFBVSxFQUFFLElBQUksQ0FBQyxTQUFTLENBQUMsVUFBVTtZQUNyQyxVQUFVLEVBQUU7Z0JBQ1YsSUFBSSxJQUFJLENBQUMseUJBQXlCLENBQUMsS0FBSyxFQUFFLFNBQVMsRUFBRSxJQUFJLENBQUM7Z0JBQzFELElBQUksSUFBSSxDQUFDLGtCQUFrQixDQUN6QixJQUFJLENBQUMsYUFBYSxDQUFDLGdCQUFnQixHQUFHLElBQUksQ0FBQyxhQUFhLENBQUMsZUFBZSxFQUN4RSxJQUFJLENBQ0w7Z0JBQ0QsSUFBSSxJQUFJLENBQUMseUJBQXlCLENBQ2hDLENBQUMsbUJBQW1CLENBQUMsRUFBRSxhQUFhO2dCQUNwQyxJQUFJLENBQ0w7Z0JBQ0QsSUFBSSxJQUFJLENBQUMsK0JBQStCLENBQUMsUUFBUSxDQUFDO2dCQUNsRCxNQUFNLElBQUksQ0FBQywrQkFBK0IsQ0FBQyxNQUFNLENBQUMsSUFBSSxDQUFDLFNBQVMsQ0FBQyxTQUFTLENBQUM7YUFDNUU7U0FDRixDQUFDLENBQUM7UUFFSCxtREFBbUQ7UUFDbkQsTUFBTSxPQUFPLEdBQUcsSUFBSSxDQUFDLFFBQVEsQ0FBQyxLQUFLLENBQUMsQ0FBQztRQUNyQyxPQUFPLEdBQUcsT0FBTyxLQUFLLElBQUksQ0FBQyxTQUFTLEVBQUUsQ0FBQztJQUN6QyxDQUFDO0lBRUQsWUFBWTtRQUNWLE9BQU8sSUFBSSxDQUFDLFNBQVMsQ0FBQztJQUN4QixDQUFDO0lBRU8sa0JBQWtCO1FBQ3hCLE9BQU8sTUFBTSxDQUFDLFdBQVcsQ0FBQyxFQUFFLENBQUMsQ0FBQyxRQUFRLENBQUMsS0FBSyxDQUFDLENBQUM7SUFDaEQsQ0FBQztDQUNGIn0=

package/dist_ts_server/server.classes.challenge.verifier.d.ts

@@ -0,0 +1,16 @@
+/**
+ * Verifies ACME challenges by making HTTP requests or DNS lookups.
+ */
+export declare class ChallengeVerifier {
+    private verificationEnabled;
+    constructor(verificationEnabled?: boolean);
+    /**
+     * Verify an HTTP-01 challenge by fetching the token from the domain.
+     */
+    verifyHttp01(domain: string, token: string, expectedKeyAuth: string): Promise<boolean>;
+    /**
+     * Verify a DNS-01 challenge by looking up the TXT record.
+     */
+    verifyDns01(domain: string, expectedHash: string): Promise<boolean>;
+    private httpGet;
+}

package/dist_ts_server/server.classes.challenge.verifier.js

@@ -0,0 +1,56 @@
+import * as http from 'node:http';
+/**
+ * Verifies ACME challenges by making HTTP requests or DNS lookups.
+ */
+export class ChallengeVerifier {
+    constructor(verificationEnabled = true) {
+        this.verificationEnabled = verificationEnabled;
+    }
+    /**
+     * Verify an HTTP-01 challenge by fetching the token from the domain.
+     */
+    async verifyHttp01(domain, token, expectedKeyAuth) {
+        if (!this.verificationEnabled) {
+            return true;
+        }
+        try {
+            const url = `http://${domain}/.well-known/acme-challenge/${token}`;
+            const body = await this.httpGet(url);
+            return body.trim() === expectedKeyAuth.trim();
+        }
+        catch {
+            return false;
+        }
+    }
+    /**
+     * Verify a DNS-01 challenge by looking up the TXT record.
+     */
+    async verifyDns01(domain, expectedHash) {
+        if (!this.verificationEnabled) {
+            return true;
+        }
+        try {
+            const { promises: dns } = await import('node:dns');
+            const records = await dns.resolveTxt(`_acme-challenge.${domain}`);
+            const flatRecords = records.map((r) => r.join(''));
+            return flatRecords.some((r) => r === expectedHash);
+        }
+        catch {
+            return false;
+        }
+    }
+    httpGet(url) {
+        return new Promise((resolve, reject) => {
+            const req = http.get(url, { timeout: 10000 }, (res) => {
+                const chunks = [];
+                res.on('data', (chunk) => chunks.push(chunk));
+                res.on('end', () => resolve(Buffer.concat(chunks).toString('utf-8')));
+            });
+            req.on('error', reject);
+            req.on('timeout', () => {
+                req.destroy(new Error('HTTP-01 verification timeout'));
+            });
+        });
+    }
+}
+//# sourceMappingURL=data:application/json;base64,eyJ2ZXJzaW9uIjozLCJmaWxlIjoic2VydmVyLmNsYXNzZXMuY2hhbGxlbmdlLnZlcmlmaWVyLmpzIiwic291cmNlUm9vdCI6IiIsInNvdXJjZXMiOlsiLi4vLi4vdHNfc2VydmVyL3NlcnZlci5jbGFzc2VzLmNoYWxsZW5nZS52ZXJpZmllci50cyJdLCJuYW1lcyI6W10sIm1hcHBpbmdzIjoiQUFBQSxPQUFPLEtBQUssSUFBSSxNQUFNLFdBQVcsQ0FBQztBQUVsQzs7R0FFRztBQUNILE1BQU0sT0FBTyxpQkFBaUI7SUFHNUIsWUFBWSxtQkFBbUIsR0FBRyxJQUFJO1FBQ3BDLElBQUksQ0FBQyxtQkFBbUIsR0FBRyxtQkFBbUIsQ0FBQztJQUNqRCxDQUFDO0lBRUQ7O09BRUc7SUFDSCxLQUFLLENBQUMsWUFBWSxDQUFDLE1BQWMsRUFBRSxLQUFhLEVBQUUsZUFBdUI7UUFDdkUsSUFBSSxDQUFDLElBQUksQ0FBQyxtQkFBbUIsRUFBRSxDQUFDO1lBQzlCLE9BQU8sSUFBSSxDQUFDO1FBQ2QsQ0FBQztRQUVELElBQUksQ0FBQztZQUNILE1BQU0sR0FBRyxHQUFHLFVBQVUsTUFBTSwrQkFBK0IsS0FBSyxFQUFFLENBQUM7WUFDbkUsTUFBTSxJQUFJLEdBQUcsTUFBTSxJQUFJLENBQUMsT0FBTyxDQUFDLEdBQUcsQ0FBQyxDQUFDO1lBQ3JDLE9BQU8sSUFBSSxDQUFDLElBQUksRUFBRSxLQUFLLGVBQWUsQ0FBQyxJQUFJLEVBQUUsQ0FBQztRQUNoRCxDQUFDO1FBQUMsTUFBTSxDQUFDO1lBQ1AsT0FBTyxLQUFLLENBQUM7UUFDZixDQUFDO0lBQ0gsQ0FBQztJQUVEOztPQUVHO0lBQ0gsS0FBSyxDQUFDLFdBQVcsQ0FBQyxNQUFjLEVBQUUsWUFBb0I7UUFDcEQsSUFBSSxDQUFDLElBQUksQ0FBQyxtQkFBbUIsRUFBRSxDQUFDO1lBQzlCLE9BQU8sSUFBSSxDQUFDO1FBQ2QsQ0FBQztRQUVELElBQUksQ0FBQztZQUNILE1BQU0sRUFBRSxRQUFRLEVBQUUsR0FBRyxFQUFFLEdBQUcsTUFBTSxNQUFNLENBQUMsVUFBVSxDQUFDLENBQUM7WUFDbkQsTUFBTSxPQUFPLEdBQUcsTUFBTSxHQUFHLENBQUMsVUFBVSxDQUFDLG1CQUFtQixNQUFNLEVBQUUsQ0FBQyxDQUFDO1lBQ2xFLE1BQU0sV0FBVyxHQUFHLE9BQU8sQ0FBQyxHQUFHLENBQUMsQ0FBQyxDQUFDLEVBQUUsRUFBRSxDQUFDLENBQUMsQ0FBQyxJQUFJLENBQUMsRUFBRSxDQUFDLENBQUMsQ0FBQztZQUNuRCxPQUFPLFdBQVcsQ0FBQyxJQUFJLENBQUMsQ0FBQyxDQUFDLEVBQUUsRUFBRSxDQUFDLENBQUMsS0FBSyxZQUFZLENBQUMsQ0FBQztRQUNyRCxDQUFDO1FBQUMsTUFBTSxDQUFDO1lBQ1AsT0FBTyxLQUFLLENBQUM7UUFDZixDQUFDO0lBQ0gsQ0FBQztJQUVPLE9BQU8sQ0FBQyxHQUFXO1FBQ3pCLE9BQU8sSUFBSSxPQUFPLENBQUMsQ0FBQyxPQUFPLEVBQUUsTUFBTSxFQUFFLEVBQUU7WUFDckMsTUFBTSxHQUFHLEdBQUcsSUFBSSxDQUFDLEdBQUcsQ0FBQyxHQUFHLEVBQUUsRUFBRSxPQUFPLEVBQUUsS0FBSyxFQUFFLEVBQUUsQ0FBQyxHQUFHLEVBQUUsRUFBRTtnQkFDcEQsTUFBTSxNQUFNLEdBQWEsRUFBRSxDQUFDO2dCQUM1QixHQUFHLENBQUMsRUFBRSxDQUFDLE1BQU0sRUFBRSxDQUFDLEtBQWEsRUFBRSxFQUFFLENBQUMsTUFBTSxDQUFDLElBQUksQ0FBQyxLQUFLLENBQUMsQ0FBQyxDQUFDO2dCQUN0RCxHQUFHLENBQUMsRUFBRSxDQUFDLEtBQUssRUFBRSxHQUFHLEVBQUUsQ0FBQyxPQUFPLENBQUMsTUFBTSxDQUFDLE1BQU0sQ0FBQyxNQUFNLENBQUMsQ0FBQyxRQUFRLENBQUMsT0FBTyxDQUFDLENBQUMsQ0FBQyxDQUFDO1lBQ3hFLENBQUMsQ0FBQyxDQUFDO1lBQ0gsR0FBRyxDQUFDLEVBQUUsQ0FBQyxPQUFPLEVBQUUsTUFBTSxDQUFDLENBQUM7WUFDeEIsR0FBRyxDQUFDLEVBQUUsQ0FBQyxTQUFTLEVBQUUsR0FBRyxFQUFFO2dCQUNyQixHQUFHLENBQUMsT0FBTyxDQUFDLElBQUksS0FBSyxDQUFDLDhCQUE4QixDQUFDLENBQUMsQ0FBQztZQUN6RCxDQUFDLENBQUMsQ0FBQztRQUNMLENBQUMsQ0FBQyxDQUFDO0lBQ0wsQ0FBQztDQUNGIn0=

package/dist_ts_server/server.classes.jws.verifier.d.ts

@@ -0,0 +1,31 @@
+import type { NonceManager } from './server.classes.nonce.js';
+import type { IServerAccountStore } from './server.interfaces.js';
+export interface IJwsVerifyResult {
+    jwk: Record<string, string>;
+    kid: string | null;
+    thumbprint: string;
+    payload: any;
+}
+/**
+ * Verifies JWS-signed ACME requests.
+ * This is the inverse of AcmeCrypto.createJws().
+ */
+export declare class JwsVerifier {
+    private nonceManager;
+    private accountStore;
+    constructor(nonceManager: NonceManager, accountStore: IServerAccountStore);
+    verify(body: {
+        protected: string;
+        payload: string;
+        signature: string;
+    }, expectedUrl: string): Promise<IJwsVerifyResult>;
+}
+/**
+ * Simple error class for ACME server errors that maps to RFC 8555 problem responses.
+ */
+export declare class AcmeServerError extends Error {
+    readonly status: number;
+    readonly type: string;
+    readonly detail: string;
+    constructor(status: number, type: string, detail: string);
+}

package/dist_ts_server/server.classes.jws.verifier.js

@@ -0,0 +1,116 @@
+import * as crypto from 'node:crypto';
+import { AcmeCrypto } from '../dist_ts/acme/acme.classes.crypto.js';
+/**
+ * Verifies JWS-signed ACME requests.
+ * This is the inverse of AcmeCrypto.createJws().
+ */
+export class JwsVerifier {
+    constructor(nonceManager, accountStore) {
+        this.nonceManager = nonceManager;
+        this.accountStore = accountStore;
+    }
+    async verify(body, expectedUrl) {
+        if (!body || !body.protected || body.signature === undefined) {
+            throw new AcmeServerError(400, 'urn:ietf:params:acme:error:malformed', 'Invalid JWS structure');
+        }
+        // 1. Decode protected header
+        const headerJson = Buffer.from(body.protected, 'base64url').toString('utf-8');
+        let header;
+        try {
+            header = JSON.parse(headerJson);
+        }
+        catch {
+            throw new AcmeServerError(400, 'urn:ietf:params:acme:error:malformed', 'Invalid JWS protected header');
+        }
+        // 2. Validate required fields
+        const { alg, nonce, url, jwk, kid } = header;
+        if (!alg) {
+            throw new AcmeServerError(400, 'urn:ietf:params:acme:error:malformed', 'Missing alg in protected header');
+        }
+        if (!nonce) {
+            throw new AcmeServerError(400, 'urn:ietf:params:acme:error:badNonce', 'Missing nonce in protected header');
+        }
+        if (!url) {
+            throw new AcmeServerError(400, 'urn:ietf:params:acme:error:malformed', 'Missing url in protected header');
+        }
+        // 3. Validate URL matches
+        if (url !== expectedUrl) {
+            throw new AcmeServerError(400, 'urn:ietf:params:acme:error:malformed', `URL mismatch: expected ${expectedUrl}, got ${url}`);
+        }
+        // 4. Validate and consume nonce
+        if (!this.nonceManager.consume(nonce)) {
+            throw new AcmeServerError(400, 'urn:ietf:params:acme:error:badNonce', 'Invalid or expired nonce');
+        }
+        // 5. Must have exactly one of jwk or kid
+        if (jwk && kid) {
+            throw new AcmeServerError(400, 'urn:ietf:params:acme:error:malformed', 'JWS must have jwk or kid, not both');
+        }
+        if (!jwk && !kid) {
+            throw new AcmeServerError(400, 'urn:ietf:params:acme:error:malformed', 'JWS must have jwk or kid');
+        }
+        // 6. Resolve the public key
+        let resolvedJwk;
+        if (jwk) {
+            resolvedJwk = jwk;
+        }
+        else {
+            // Look up account by kid (account URL)
+            const account = await this.accountStore.getByUrl(kid);
+            if (!account) {
+                throw new AcmeServerError(400, 'urn:ietf:params:acme:error:accountDoesNotExist', 'Account not found for kid');
+            }
+            resolvedJwk = account.jwk;
+        }
+        // 7. Reconstruct public key and verify signature
+        const publicKey = crypto.createPublicKey({ key: resolvedJwk, format: 'jwk' });
+        const signingInput = `${body.protected}.${body.payload}`;
+        const signatureBuffer = Buffer.from(body.signature, 'base64url');
+        const supportedAlgs = ['RS256', 'ES256', 'ES384'];
+        if (!supportedAlgs.includes(alg)) {
+            throw new AcmeServerError(400, 'urn:ietf:params:acme:error:badSignatureAlgorithm', `Unsupported algorithm: ${alg}`);
+        }
+        let valid;
+        if (alg.startsWith('RS')) {
+            valid = crypto.verify('sha256', Buffer.from(signingInput), publicKey, signatureBuffer);
+        }
+        else {
+            valid = crypto.verify('sha256', Buffer.from(signingInput), { key: publicKey, dsaEncoding: 'ieee-p1363' }, signatureBuffer);
+        }
+        if (!valid) {
+            throw new AcmeServerError(403, 'urn:ietf:params:acme:error:unauthorized', 'Invalid JWS signature');
+        }
+        // 8. Decode payload
+        let payload;
+        if (body.payload === '') {
+            payload = null; // POST-as-GET
+        }
+        else {
+            try {
+                payload = JSON.parse(Buffer.from(body.payload, 'base64url').toString('utf-8'));
+            }
+            catch {
+                throw new AcmeServerError(400, 'urn:ietf:params:acme:error:malformed', 'Invalid JWS payload');
+            }
+        }
+        const thumbprint = AcmeCrypto.getJwkThumbprint(resolvedJwk);
+        return {
+            jwk: resolvedJwk,
+            kid: kid || null,
+            thumbprint,
+            payload,
+        };
+    }
+}
+/**
+ * Simple error class for ACME server errors that maps to RFC 8555 problem responses.
+ */
+export class AcmeServerError extends Error {
+    constructor(status, type, detail) {
+        super(`${type}: ${detail}`);
+        this.name = 'AcmeServerError';
+        this.status = status;
+        this.type = type;
+        this.detail = detail;
+    }
+}
+//# sourceMappingURL=data:application/json;base64,eyJ2ZXJzaW9uIjozLCJmaWxlIjoic2VydmVyLmNsYXNzZXMuandzLnZlcmlmaWVyLmpzIiwic291cmNlUm9vdCI6IiIsInNvdXJjZXMiOlsiLi4vLi4vdHNfc2VydmVyL3NlcnZlci5jbGFzc2VzLmp3cy52ZXJpZmllci50cyJdLCJuYW1lcyI6W10sIm1hcHBpbmdzIjoiQUFBQSxPQUFPLEtBQUssTUFBTSxNQUFNLGFBQWEsQ0FBQztBQUN0QyxPQUFPLEVBQUUsVUFBVSxFQUFFLE1BQU0sbUNBQW1DLENBQUM7QUFXL0Q7OztHQUdHO0FBQ0gsTUFBTSxPQUFPLFdBQVc7SUFJdEIsWUFBWSxZQUEwQixFQUFFLFlBQWlDO1FBQ3ZFLElBQUksQ0FBQyxZQUFZLEdBQUcsWUFBWSxDQUFDO1FBQ2pDLElBQUksQ0FBQyxZQUFZLEdBQUcsWUFBWSxDQUFDO0lBQ25DLENBQUM7SUFFRCxLQUFLLENBQUMsTUFBTSxDQUNWLElBQStELEVBQy9ELFdBQW1CO1FBRW5CLElBQUksQ0FBQyxJQUFJLElBQUksQ0FBQyxJQUFJLENBQUMsU0FBUyxJQUFJLElBQUksQ0FBQyxTQUFTLEtBQUssU0FBUyxFQUFFLENBQUM7WUFDN0QsTUFBTSxJQUFJLGVBQWUsQ0FBQyxHQUFHLEVBQUUsc0NBQXNDLEVBQUUsdUJBQXVCLENBQUMsQ0FBQztRQUNsRyxDQUFDO1FBRUQsNkJBQTZCO1FBQzdCLE1BQU0sVUFBVSxHQUFHLE1BQU0sQ0FBQyxJQUFJLENBQUMsSUFBSSxDQUFDLFNBQVMsRUFBRSxXQUFXLENBQUMsQ0FBQyxRQUFRLENBQUMsT0FBTyxDQUFDLENBQUM7UUFDOUUsSUFBSSxNQUEyQixDQUFDO1FBQ2hDLElBQUksQ0FBQztZQUNILE1BQU0sR0FBRyxJQUFJLENBQUMsS0FBSyxDQUFDLFVBQVUsQ0FBQyxDQUFDO1FBQ2xDLENBQUM7UUFBQyxNQUFNLENBQUM7WUFDUCxNQUFNLElBQUksZUFBZSxDQUFDLEdBQUcsRUFBRSxzQ0FBc0MsRUFBRSw4QkFBOEIsQ0FBQyxDQUFDO1FBQ3pHLENBQUM7UUFFRCw4QkFBOEI7UUFDOUIsTUFBTSxFQUFFLEdBQUcsRUFBRSxLQUFLLEVBQUUsR0FBRyxFQUFFLEdBQUcsRUFBRSxHQUFHLEVBQUUsR0FBRyxNQUFNLENBQUM7UUFDN0MsSUFBSSxDQUFDLEdBQUcsRUFBRSxDQUFDO1lBQ1QsTUFBTSxJQUFJLGVBQWUsQ0FBQyxHQUFHLEVBQUUsc0NBQXNDLEVBQUUsaUNBQWlDLENBQUMsQ0FBQztRQUM1RyxDQUFDO1FBQ0QsSUFBSSxDQUFDLEtBQUssRUFBRSxDQUFDO1lBQ1gsTUFBTSxJQUFJLGVBQWUsQ0FBQyxHQUFHLEVBQUUscUNBQXFDLEVBQUUsbUNBQW1DLENBQUMsQ0FBQztRQUM3RyxDQUFDO1FBQ0QsSUFBSSxDQUFDLEdBQUcsRUFBRSxDQUFDO1lBQ1QsTUFBTSxJQUFJLGVBQWUsQ0FBQyxHQUFHLEVBQUUsc0NBQXNDLEVBQUUsaUNBQWlDLENBQUMsQ0FBQztRQUM1RyxDQUFDO1FBRUQsMEJBQTBCO1FBQzFCLElBQUksR0FBRyxLQUFLLFdBQVcsRUFBRSxDQUFDO1lBQ3hCLE1BQU0sSUFBSSxlQUFlLENBQ3ZCLEdBQUcsRUFDSCxzQ0FBc0MsRUFDdEMsMEJBQTBCLFdBQVcsU0FBUyxHQUFHLEVBQUUsQ0FDcEQsQ0FBQztRQUNKLENBQUM7UUFFRCxnQ0FBZ0M7UUFDaEMsSUFBSSxDQUFDLElBQUksQ0FBQyxZQUFZLENBQUMsT0FBTyxDQUFDLEtBQUssQ0FBQyxFQUFFLENBQUM7WUFDdEMsTUFBTSxJQUFJLGVBQWUsQ0FBQyxHQUFHLEVBQUUscUNBQXFDLEVBQUUsMEJBQTBCLENBQUMsQ0FBQztRQUNwRyxDQUFDO1FBRUQseUNBQXlDO1FBQ3pDLElBQUksR0FBRyxJQUFJLEdBQUcsRUFBRSxDQUFDO1lBQ2YsTUFBTSxJQUFJLGVBQWUsQ0FBQyxHQUFHLEVBQUUsc0NBQXNDLEVBQUUsb0NBQW9DLENBQUMsQ0FBQztRQUMvRyxDQUFDO1FBQ0QsSUFBSSxDQUFDLEdBQUcsSUFBSSxDQUFDLEdBQUcsRUFBRSxDQUFDO1lBQ2pCLE1BQU0sSUFBSSxlQUFlLENBQUMsR0FBRyxFQUFFLHNDQUFzQyxFQUFFLDBCQUEwQixDQUFDLENBQUM7UUFDckcsQ0FBQztRQUVELDRCQUE0QjtRQUM1QixJQUFJLFdBQW1DLENBQUM7UUFDeEMsSUFBSSxHQUFHLEVBQUUsQ0FBQztZQUNSLFdBQVcsR0FBRyxHQUFHLENBQUM7UUFDcEIsQ0FBQzthQUFNLENBQUM7WUFDTix1Q0FBdUM7WUFDdkMsTUFBTSxPQUFPLEdBQUcsTUFBTSxJQUFJLENBQUMsWUFBWSxDQUFDLFFBQVEsQ0FBQyxHQUFHLENBQUMsQ0FBQztZQUN0RCxJQUFJLENBQUMsT0FBTyxFQUFFLENBQUM7Z0JBQ2IsTUFBTSxJQUFJLGVBQWUsQ0FDdkIsR0FBRyxFQUNILGdEQUFnRCxFQUNoRCwyQkFBMkIsQ0FDNUIsQ0FBQztZQUNKLENBQUM7WUFDRCxXQUFXLEdBQUcsT0FBTyxDQUFDLEdBQUcsQ0FBQztRQUM1QixDQUFDO1FBRUQsaURBQWlEO1FBQ2pELE1BQU0sU0FBUyxHQUFHLE1BQU0sQ0FBQyxlQUFlLENBQUMsRUFBRSxHQUFHLEVBQUUsV0FBVyxFQUFFLE1BQU0sRUFBRSxLQUFLLEVBQUUsQ0FBQyxDQUFDO1FBQzlFLE1BQU0sWUFBWSxHQUFHLEdBQUcsSUFBSSxDQUFDLFNBQVMsSUFBSSxJQUFJLENBQUMsT0FBTyxFQUFFLENBQUM7UUFDekQsTUFBTSxlQUFlLEdBQUcsTUFBTSxDQUFDLElBQUksQ0FBQyxJQUFJLENBQUMsU0FBUyxFQUFFLFdBQVcsQ0FBQyxDQUFDO1FBRWpFLE1BQU0sYUFBYSxHQUFHLENBQUMsT0FBTyxFQUFFLE9BQU8sRUFBRSxPQUFPLENBQUMsQ0FBQztRQUNsRCxJQUFJLENBQUMsYUFBYSxDQUFDLFFBQVEsQ0FBQyxHQUFHLENBQUMsRUFBRSxDQUFDO1lBQ2pDLE1BQU0sSUFBSSxlQUFlLENBQUMsR0FBRyxFQUFFLGtEQUFrRCxFQUFFLDBCQUEwQixHQUFHLEVBQUUsQ0FBQyxDQUFDO1FBQ3RILENBQUM7UUFFRCxJQUFJLEtBQWMsQ0FBQztRQUNuQixJQUFJLEdBQUcsQ0FBQyxVQUFVLENBQUMsSUFBSSxDQUFDLEVBQUUsQ0FBQztZQUN6QixLQUFLLEdBQUcsTUFBTSxDQUFDLE1BQU0sQ0FBQyxRQUFRLEVBQUUsTUFBTSxDQUFDLElBQUksQ0FBQyxZQUFZLENBQUMsRUFBRSxTQUFTLEVBQUUsZUFBZSxDQUFDLENBQUM7UUFDekYsQ0FBQzthQUFNLENBQUM7WUFDTixLQUFLLEdBQUcsTUFBTSxDQUFDLE1BQU0sQ0FBQyxRQUFRLEVBQUUsTUFBTSxDQUFDLElBQUksQ0FBQyxZQUFZLENBQUMsRUFBRSxFQUFFLEdBQUcsRUFBRSxTQUFTLEVBQUUsV0FBVyxFQUFFLFlBQVksRUFBRSxFQUFFLGVBQWUsQ0FBQyxDQUFDO1FBQzdILENBQUM7UUFFRCxJQUFJLENBQUMsS0FBSyxFQUFFLENBQUM7WUFDWCxNQUFNLElBQUksZUFBZSxDQUFDLEdBQUcsRUFBRSx5Q0FBeUMsRUFBRSx1QkFBdUIsQ0FBQyxDQUFDO1FBQ3JHLENBQUM7UUFFRCxvQkFBb0I7UUFDcEIsSUFBSSxPQUFZLENBQUM7UUFDakIsSUFBSSxJQUFJLENBQUMsT0FBTyxLQUFLLEVBQUUsRUFBRSxDQUFDO1lBQ3hCLE9BQU8sR0FBRyxJQUFJLENBQUMsQ0FBQyxjQUFjO1FBQ2hDLENBQUM7YUFBTSxDQUFDO1lBQ04sSUFBSSxDQUFDO2dCQUNILE9BQU8sR0FBRyxJQUFJLENBQUMsS0FBSyxDQUFDLE1BQU0sQ0FBQyxJQUFJLENBQUMsSUFBSSxDQUFDLE9BQU8sRUFBRSxXQUFXLENBQUMsQ0FBQyxRQUFRLENBQUMsT0FBTyxDQUFDLENBQUMsQ0FBQztZQUNqRixDQUFDO1lBQUMsTUFBTSxDQUFDO2dCQUNQLE1BQU0sSUFBSSxlQUFlLENBQUMsR0FBRyxFQUFFLHNDQUFzQyxFQUFFLHFCQUFxQixDQUFDLENBQUM7WUFDaEcsQ0FBQztRQUNILENBQUM7UUFFRCxNQUFNLFVBQVUsR0FBRyxVQUFVLENBQUMsZ0JBQWdCLENBQUMsV0FBVyxDQUFDLENBQUM7UUFFNUQsT0FBTztZQUNMLEdBQUcsRUFBRSxXQUFXO1lBQ2hCLEdBQUcsRUFBRSxHQUFHLElBQUksSUFBSTtZQUNoQixVQUFVO1lBQ1YsT0FBTztTQUNSLENBQUM7SUFDSixDQUFDO0NBQ0Y7QUFFRDs7R0FFRztBQUNILE1BQU0sT0FBTyxlQUFnQixTQUFRLEtBQUs7SUFLeEMsWUFBWSxNQUFjLEVBQUUsSUFBWSxFQUFFLE1BQWM7UUFDdEQsS0FBSyxDQUFDLEdBQUcsSUFBSSxLQUFLLE1BQU0sRUFBRSxDQUFDLENBQUM7UUFDNUIsSUFBSSxDQUFDLElBQUksR0FBRyxpQkFBaUIsQ0FBQztRQUM5QixJQUFJLENBQUMsTUFBTSxHQUFHLE1BQU0sQ0FBQztRQUNyQixJQUFJLENBQUMsSUFBSSxHQUFHLElBQUksQ0FBQztRQUNqQixJQUFJLENBQUMsTUFBTSxHQUFHLE1BQU0sQ0FBQztJQUN2QixDQUFDO0NBQ0YifQ==

package/dist_ts_server/server.classes.nonce.d.ts

@@ -0,0 +1,12 @@
+/**
+ * Manages ACME replay nonces.
+ * Each nonce is single-use: consumed on verification, fresh one issued with every response.
+ */
+export declare class NonceManager {
+    private nonces;
+    private nonceQueue;
+    private maxSize;
+    constructor(maxSize?: number);
+    generate(): string;
+    consume(nonce: string): boolean;
+}

package/dist_ts_server/server.classes.nonce.js

@@ -0,0 +1,32 @@
+import * as crypto from 'node:crypto';
+/**
+ * Manages ACME replay nonces.
+ * Each nonce is single-use: consumed on verification, fresh one issued with every response.
+ */
+export class NonceManager {
+    constructor(maxSize = 10000) {
+        this.nonces = new Set();
+        this.nonceQueue = [];
+        this.maxSize = maxSize;
+    }
+    generate() {
+        const nonce = crypto.randomBytes(16).toString('base64url');
+        if (this.nonces.size >= this.maxSize) {
+            const oldest = this.nonceQueue.shift();
+            if (oldest) {
+                this.nonces.delete(oldest);
+            }
+        }
+        this.nonces.add(nonce);
+        this.nonceQueue.push(nonce);
+        return nonce;
+    }
+    consume(nonce) {
+        if (this.nonces.has(nonce)) {
+            this.nonces.delete(nonce);
+            return true;
+        }
+        return false;
+    }
+}
+//# sourceMappingURL=data:application/json;base64,eyJ2ZXJzaW9uIjozLCJmaWxlIjoic2VydmVyLmNsYXNzZXMubm9uY2UuanMiLCJzb3VyY2VSb290IjoiIiwic291cmNlcyI6WyIuLi8uLi90c19zZXJ2ZXIvc2VydmVyLmNsYXNzZXMubm9uY2UudHMiXSwibmFtZXMiOltdLCJtYXBwaW5ncyI6IkFBQUEsT0FBTyxLQUFLLE1BQU0sTUFBTSxhQUFhLENBQUM7QUFFdEM7OztHQUdHO0FBQ0gsTUFBTSxPQUFPLFlBQVk7SUFLdkIsWUFBWSxPQUFPLEdBQUcsS0FBSztRQUpuQixXQUFNLEdBQUcsSUFBSSxHQUFHLEVBQVUsQ0FBQztRQUMzQixlQUFVLEdBQWEsRUFBRSxDQUFDO1FBSWhDLElBQUksQ0FBQyxPQUFPLEdBQUcsT0FBTyxDQUFDO0lBQ3pCLENBQUM7SUFFRCxRQUFRO1FBQ04sTUFBTSxLQUFLLEdBQUcsTUFBTSxDQUFDLFdBQVcsQ0FBQyxFQUFFLENBQUMsQ0FBQyxRQUFRLENBQUMsV0FBVyxDQUFDLENBQUM7UUFDM0QsSUFBSSxJQUFJLENBQUMsTUFBTSxDQUFDLElBQUksSUFBSSxJQUFJLENBQUMsT0FBTyxFQUFFLENBQUM7WUFDckMsTUFBTSxNQUFNLEdBQUcsSUFBSSxDQUFDLFVBQVUsQ0FBQyxLQUFLLEVBQUUsQ0FBQztZQUN2QyxJQUFJLE1BQU0sRUFBRSxDQUFDO2dCQUNYLElBQUksQ0FBQyxNQUFNLENBQUMsTUFBTSxDQUFDLE1BQU0sQ0FBQyxDQUFDO1lBQzdCLENBQUM7UUFDSCxDQUFDO1FBQ0QsSUFBSSxDQUFDLE1BQU0sQ0FBQyxHQUFHLENBQUMsS0FBSyxDQUFDLENBQUM7UUFDdkIsSUFBSSxDQUFDLFVBQVUsQ0FBQyxJQUFJLENBQUMsS0FBSyxDQUFDLENBQUM7UUFDNUIsT0FBTyxLQUFLLENBQUM7SUFDZixDQUFDO0lBRUQsT0FBTyxDQUFDLEtBQWE7UUFDbkIsSUFBSSxJQUFJLENBQUMsTUFBTSxDQUFDLEdBQUcsQ0FBQyxLQUFLLENBQUMsRUFBRSxDQUFDO1lBQzNCLElBQUksQ0FBQyxNQUFNLENBQUMsTUFBTSxDQUFDLEtBQUssQ0FBQyxDQUFDO1lBQzFCLE9BQU8sSUFBSSxDQUFDO1FBQ2QsQ0FBQztRQUNELE9BQU8sS0FBSyxDQUFDO0lBQ2YsQ0FBQztDQUNGIn0=

package/dist_ts_server/server.classes.order.store.d.ts

@@ -0,0 +1,21 @@
+import type { IServerOrderStore, IServerOrder, IServerAuthorization, IServerChallenge } from './server.interfaces.js';
+/**
+ * In-memory order/authorization/challenge/certificate storage for the ACME server.
+ */
+export declare class MemoryOrderStore implements IServerOrderStore {
+    private orders;
+    private authorizations;
+    private challenges;
+    private certPems;
+    createOrder(order: IServerOrder): Promise<IServerOrder>;
+    getOrder(id: string): Promise<IServerOrder | null>;
+    updateOrder(id: string, updates: Partial<IServerOrder>): Promise<void>;
+    createAuthorization(authz: IServerAuthorization): Promise<IServerAuthorization>;
+    getAuthorization(id: string): Promise<IServerAuthorization | null>;
+    updateAuthorization(id: string, updates: Partial<IServerAuthorization>): Promise<void>;
+    createChallenge(challenge: IServerChallenge): Promise<IServerChallenge>;
+    getChallenge(id: string): Promise<IServerChallenge | null>;
+    updateChallenge(id: string, updates: Partial<IServerChallenge>): Promise<void>;
+    storeCertPem(orderId: string, pem: string): Promise<void>;
+    getCertPem(orderId: string): Promise<string | null>;
+}

package/dist_ts_server/server.classes.order.store.js

@@ -0,0 +1,57 @@
+/**
+ * In-memory order/authorization/challenge/certificate storage for the ACME server.
+ */
+export class MemoryOrderStore {
+    constructor() {
+        this.orders = new Map();
+        this.authorizations = new Map();
+        this.challenges = new Map();
+        this.certPems = new Map();
+    }
+    async createOrder(order) {
+        this.orders.set(order.id, order);
+        return order;
+    }
+    async getOrder(id) {
+        return this.orders.get(id) || null;
+    }
+    async updateOrder(id, updates) {
+        const order = this.orders.get(id);
+        if (order) {
+            Object.assign(order, updates);
+        }
+    }
+    async createAuthorization(authz) {
+        this.authorizations.set(authz.id, authz);
+        return authz;
+    }
+    async getAuthorization(id) {
+        return this.authorizations.get(id) || null;
+    }
+    async updateAuthorization(id, updates) {
+        const authz = this.authorizations.get(id);
+        if (authz) {
+            Object.assign(authz, updates);
+        }
+    }
+    async createChallenge(challenge) {
+        this.challenges.set(challenge.id, challenge);
+        return challenge;
+    }
+    async getChallenge(id) {
+        return this.challenges.get(id) || null;
+    }
+    async updateChallenge(id, updates) {
+        const challenge = this.challenges.get(id);
+        if (challenge) {
+            Object.assign(challenge, updates);
+        }
+    }
+    async storeCertPem(orderId, pem) {
+        this.certPems.set(orderId, pem);
+    }
+    async getCertPem(orderId) {
+        return this.certPems.get(orderId) || null;
+    }
+}
+//# sourceMappingURL=data:application/json;base64,eyJ2ZXJzaW9uIjozLCJmaWxlIjoic2VydmVyLmNsYXNzZXMub3JkZXIuc3RvcmUuanMiLCJzb3VyY2VSb290IjoiIiwic291cmNlcyI6WyIuLi8uLi90c19zZXJ2ZXIvc2VydmVyLmNsYXNzZXMub3JkZXIuc3RvcmUudHMiXSwibmFtZXMiOltdLCJtYXBwaW5ncyI6IkFBT0E7O0dBRUc7QUFDSCxNQUFNLE9BQU8sZ0JBQWdCO0lBQTdCO1FBQ1UsV0FBTSxHQUFHLElBQUksR0FBRyxFQUF3QixDQUFDO1FBQ3pDLG1CQUFjLEdBQUcsSUFBSSxHQUFHLEVBQWdDLENBQUM7UUFDekQsZUFBVSxHQUFHLElBQUksR0FBRyxFQUE0QixDQUFDO1FBQ2pELGFBQVEsR0FBRyxJQUFJLEdBQUcsRUFBa0IsQ0FBQztJQXlEL0MsQ0FBQztJQXZEQyxLQUFLLENBQUMsV0FBVyxDQUFDLEtBQW1CO1FBQ25DLElBQUksQ0FBQyxNQUFNLENBQUMsR0FBRyxDQUFDLEtBQUssQ0FBQyxFQUFFLEVBQUUsS0FBSyxDQUFDLENBQUM7UUFDakMsT0FBTyxLQUFLLENBQUM7SUFDZixDQUFDO0lBRUQsS0FBSyxDQUFDLFFBQVEsQ0FBQyxFQUFVO1FBQ3ZCLE9BQU8sSUFBSSxDQUFDLE1BQU0sQ0FBQyxHQUFHLENBQUMsRUFBRSxDQUFDLElBQUksSUFBSSxDQUFDO0lBQ3JDLENBQUM7SUFFRCxLQUFLLENBQUMsV0FBVyxDQUFDLEVBQVUsRUFBRSxPQUE4QjtRQUMxRCxNQUFNLEtBQUssR0FBRyxJQUFJLENBQUMsTUFBTSxDQUFDLEdBQUcsQ0FBQyxFQUFFLENBQUMsQ0FBQztRQUNsQyxJQUFJLEtBQUssRUFBRSxDQUFDO1lBQ1YsTUFBTSxDQUFDLE1BQU0sQ0FBQyxLQUFLLEVBQUUsT0FBTyxDQUFDLENBQUM7UUFDaEMsQ0FBQztJQUNILENBQUM7SUFFRCxLQUFLLENBQUMsbUJBQW1CLENBQUMsS0FBMkI7UUFDbkQsSUFBSSxDQUFDLGNBQWMsQ0FBQyxHQUFHLENBQUMsS0FBSyxDQUFDLEVBQUUsRUFBRSxLQUFLLENBQUMsQ0FBQztRQUN6QyxPQUFPLEtBQUssQ0FBQztJQUNmLENBQUM7SUFFRCxLQUFLLENBQUMsZ0JBQWdCLENBQUMsRUFBVTtRQUMvQixPQUFPLElBQUksQ0FBQyxjQUFjLENBQUMsR0FBRyxDQUFDLEVBQUUsQ0FBQyxJQUFJLElBQUksQ0FBQztJQUM3QyxDQUFDO0lBRUQsS0FBSyxDQUFDLG1CQUFtQixDQUFDLEVBQVUsRUFBRSxPQUFzQztRQUMxRSxNQUFNLEtBQUssR0FBRyxJQUFJLENBQUMsY0FBYyxDQUFDLEdBQUcsQ0FBQyxFQUFFLENBQUMsQ0FBQztRQUMxQyxJQUFJLEtBQUssRUFBRSxDQUFDO1lBQ1YsTUFBTSxDQUFDLE1BQU0sQ0FBQyxLQUFLLEVBQUUsT0FBTyxDQUFDLENBQUM7UUFDaEMsQ0FBQztJQUNILENBQUM7SUFFRCxLQUFLLENBQUMsZUFBZSxDQUFDLFNBQTJCO1FBQy9DLElBQUksQ0FBQyxVQUFVLENBQUMsR0FBRyxDQUFDLFNBQVMsQ0FBQyxFQUFFLEVBQUUsU0FBUyxDQUFDLENBQUM7UUFDN0MsT0FBTyxTQUFTLENBQUM7SUFDbkIsQ0FBQztJQUVELEtBQUssQ0FBQyxZQUFZLENBQUMsRUFBVTtRQUMzQixPQUFPLElBQUksQ0FBQyxVQUFVLENBQUMsR0FBRyxDQUFDLEVBQUUsQ0FBQyxJQUFJLElBQUksQ0FBQztJQUN6QyxDQUFDO0lBRUQsS0FBSyxDQUFDLGVBQWUsQ0FBQyxFQUFVLEVBQUUsT0FBa0M7UUFDbEUsTUFBTSxTQUFTLEdBQUcsSUFBSSxDQUFDLFVBQVUsQ0FBQyxHQUFHLENBQUMsRUFBRSxDQUFDLENBQUM7UUFDMUMsSUFBSSxTQUFTLEVBQUUsQ0FBQztZQUNkLE1BQU0sQ0FBQyxNQUFNLENBQUMsU0FBUyxFQUFFLE9BQU8sQ0FBQyxDQUFDO1FBQ3BDLENBQUM7SUFDSCxDQUFDO0lBRUQsS0FBSyxDQUFDLFlBQVksQ0FBQyxPQUFlLEVBQUUsR0FBVztRQUM3QyxJQUFJLENBQUMsUUFBUSxDQUFDLEdBQUcsQ0FBQyxPQUFPLEVBQUUsR0FBRyxDQUFDLENBQUM7SUFDbEMsQ0FBQztJQUVELEtBQUssQ0FBQyxVQUFVLENBQUMsT0FBZTtRQUM5QixPQUFPLElBQUksQ0FBQyxRQUFRLENBQUMsR0FBRyxDQUFDLE9BQU8sQ0FBQyxJQUFJLElBQUksQ0FBQztJQUM1QyxDQUFDO0NBQ0YifQ==

package/dist_ts_server/server.classes.router.d.ts

@@ -0,0 +1,17 @@
+import type * as http from 'node:http';
+import type { TRouteHandler } from './server.interfaces.js';
+import type { NonceManager } from './server.classes.nonce.js';
+/**
+ * Minimal HTTP router for the ACME server.
+ * Supports parameterized paths like /order/:id.
+ */
+export declare class AcmeRouter {
+    private routes;
+    private nonceManager;
+    constructor(nonceManager: NonceManager);
+    addRoute(method: string, pattern: string, handler: TRouteHandler): void;
+    handle(req: http.IncomingMessage, res: http.ServerResponse): Promise<void>;
+    private matchPath;
+    private parseBody;
+    private sendError;
+}