@push.rocks/smartacme 9.1.3 → 9.3.0

package/dist_ts_server/server.handlers.order.js

@@ -0,0 +1,131 @@
+import * as crypto from 'node:crypto';
+import { AcmeServerError } from './server.classes.jws.verifier.js';
+/**
+ * POST /new-order — Create a new ACME order.
+ */
+export function createNewOrderHandler(baseUrl, jwsVerifier, orderStore) {
+    return async (req, res, _params, body) => {
+        const requestUrl = `${baseUrl}/new-order`;
+        const verified = await jwsVerifier.verify(body, requestUrl);
+        if (!verified.kid) {
+            throw new AcmeServerError(400, 'urn:ietf:params:acme:error:malformed', 'newOrder requires kid');
+        }
+        const { payload } = verified;
+        const identifiers = payload?.identifiers;
+        if (!identifiers || !Array.isArray(identifiers) || identifiers.length === 0) {
+            throw new AcmeServerError(400, 'urn:ietf:params:acme:error:malformed', 'Order must include at least one identifier');
+        }
+        const orderId = crypto.randomBytes(16).toString('hex');
+        const expires = new Date();
+        expires.setDate(expires.getDate() + 7);
+        // Create authorizations and challenges for each identifier
+        const authorizationIds = [];
+        for (const identifier of identifiers) {
+            const authzId = crypto.randomBytes(16).toString('hex');
+            const isWildcard = identifier.value.startsWith('*.');
+            const domain = isWildcard ? identifier.value.slice(2) : identifier.value;
+            // Create challenges for this authorization
+            const challengeIds = [];
+            // HTTP-01 challenge (not for wildcards)
+            if (!isWildcard) {
+                const http01Id = crypto.randomBytes(16).toString('hex');
+                const http01Token = crypto.randomBytes(32).toString('base64url');
+                await orderStore.createChallenge({
+                    id: http01Id,
+                    authorizationId: authzId,
+                    type: 'http-01',
+                    token: http01Token,
+                    status: 'pending',
+                });
+                challengeIds.push(http01Id);
+            }
+            // DNS-01 challenge (always)
+            const dns01Id = crypto.randomBytes(16).toString('hex');
+            const dns01Token = crypto.randomBytes(32).toString('base64url');
+            await orderStore.createChallenge({
+                id: dns01Id,
+                authorizationId: authzId,
+                type: 'dns-01',
+                token: dns01Token,
+                status: 'pending',
+            });
+            challengeIds.push(dns01Id);
+            await orderStore.createAuthorization({
+                id: authzId,
+                orderId,
+                identifier: { type: 'dns', value: domain },
+                status: 'pending',
+                expires: expires.toISOString(),
+                challengeIds,
+                wildcard: isWildcard || undefined,
+            });
+            authorizationIds.push(authzId);
+        }
+        const order = await orderStore.createOrder({
+            id: orderId,
+            accountUrl: verified.kid,
+            status: 'pending',
+            identifiers,
+            authorizationIds,
+            expires: expires.toISOString(),
+            finalize: `${baseUrl}/finalize/${orderId}`,
+        });
+        const responseBody = {
+            status: order.status,
+            expires: order.expires,
+            identifiers: order.identifiers,
+            authorizations: order.authorizationIds.map((id) => `${baseUrl}/authz/${id}`),
+            finalize: order.finalize,
+        };
+        res.writeHead(201, {
+            'Content-Type': 'application/json',
+            'Location': `${baseUrl}/order/${orderId}`,
+        });
+        res.end(JSON.stringify(responseBody));
+    };
+}
+/**
+ * POST /order/:id — Poll order status (POST-as-GET).
+ */
+export function createOrderPollHandler(baseUrl, jwsVerifier, orderStore) {
+    return async (req, res, params, body) => {
+        const orderId = params.id;
+        const requestUrl = `${baseUrl}/order/${orderId}`;
+        await jwsVerifier.verify(body, requestUrl);
+        const order = await orderStore.getOrder(orderId);
+        if (!order) {
+            throw new AcmeServerError(404, 'urn:ietf:params:acme:error:malformed', 'Order not found');
+        }
+        // Check if all authorizations are valid → transition to ready
+        if (order.status === 'pending') {
+            let allValid = true;
+            for (const authzId of order.authorizationIds) {
+                const authz = await orderStore.getAuthorization(authzId);
+                if (!authz || authz.status !== 'valid') {
+                    allValid = false;
+                    break;
+                }
+            }
+            if (allValid) {
+                await orderStore.updateOrder(orderId, { status: 'ready' });
+                order.status = 'ready';
+            }
+        }
+        const responseBody = {
+            status: order.status,
+            expires: order.expires,
+            identifiers: order.identifiers,
+            authorizations: order.authorizationIds.map((id) => `${baseUrl}/authz/${id}`),
+            finalize: order.finalize,
+        };
+        if (order.certificate) {
+            responseBody.certificate = order.certificate;
+        }
+        res.writeHead(200, {
+            'Content-Type': 'application/json',
+            'Location': requestUrl,
+        });
+        res.end(JSON.stringify(responseBody));
+    };
+}
+//# sourceMappingURL=data:application/json;base64,eyJ2ZXJzaW9uIjozLCJmaWxlIjoic2VydmVyLmhhbmRsZXJzLm9yZGVyLmpzIiwic291cmNlUm9vdCI6IiIsInNvdXJjZXMiOlsiLi4vLi4vdHNfc2VydmVyL3NlcnZlci5oYW5kbGVycy5vcmRlci50cyJdLCJuYW1lcyI6W10sIm1hcHBpbmdzIjoiQUFDQSxPQUFPLEtBQUssTUFBTSxNQUFNLGFBQWEsQ0FBQztBQUV0QyxPQUFPLEVBQUUsZUFBZSxFQUFFLE1BQU0sa0NBQWtDLENBQUM7QUFJbkU7O0dBRUc7QUFDSCxNQUFNLFVBQVUscUJBQXFCLENBQ25DLE9BQWUsRUFDZixXQUF3QixFQUN4QixVQUE2QjtJQUU3QixPQUFPLEtBQUssRUFDVixHQUF5QixFQUN6QixHQUF3QixFQUN4QixPQUErQixFQUMvQixJQUFTLEVBQ00sRUFBRTtRQUNqQixNQUFNLFVBQVUsR0FBRyxHQUFHLE9BQU8sWUFBWSxDQUFDO1FBQzFDLE1BQU0sUUFBUSxHQUFHLE1BQU0sV0FBVyxDQUFDLE1BQU0sQ0FBQyxJQUFJLEVBQUUsVUFBVSxDQUFDLENBQUM7UUFFNUQsSUFBSSxDQUFDLFFBQVEsQ0FBQyxHQUFHLEVBQUUsQ0FBQztZQUNsQixNQUFNLElBQUksZUFBZSxDQUFDLEdBQUcsRUFBRSxzQ0FBc0MsRUFBRSx1QkFBdUIsQ0FBQyxDQUFDO1FBQ2xHLENBQUM7UUFFRCxNQUFNLEVBQUUsT0FBTyxFQUFFLEdBQUcsUUFBUSxDQUFDO1FBQzdCLE1BQU0sV0FBVyxHQUFzQixPQUFPLEVBQUUsV0FBVyxDQUFDO1FBRTVELElBQUksQ0FBQyxXQUFXLElBQUksQ0FBQyxLQUFLLENBQUMsT0FBTyxDQUFDLFdBQVcsQ0FBQyxJQUFJLFdBQVcsQ0FBQyxNQUFNLEtBQUssQ0FBQyxFQUFFLENBQUM7WUFDNUUsTUFBTSxJQUFJLGVBQWUsQ0FDdkIsR0FBRyxFQUNILHNDQUFzQyxFQUN0Qyw0Q0FBNEMsQ0FDN0MsQ0FBQztRQUNKLENBQUM7UUFFRCxNQUFNLE9BQU8sR0FBRyxNQUFNLENBQUMsV0FBVyxDQUFDLEVBQUUsQ0FBQyxDQUFDLFFBQVEsQ0FBQyxLQUFLLENBQUMsQ0FBQztRQUN2RCxNQUFNLE9BQU8sR0FBRyxJQUFJLElBQUksRUFBRSxDQUFDO1FBQzNCLE9BQU8sQ0FBQyxPQUFPLENBQUMsT0FBTyxDQUFDLE9BQU8sRUFBRSxHQUFHLENBQUMsQ0FBQyxDQUFDO1FBRXZDLDJEQUEyRDtRQUMzRCxNQUFNLGdCQUFnQixHQUFhLEVBQUUsQ0FBQztRQUV0QyxLQUFLLE1BQU0sVUFBVSxJQUFJLFdBQVcsRUFBRSxDQUFDO1lBQ3JDLE1BQU0sT0FBTyxHQUFHLE1BQU0sQ0FBQyxXQUFXLENBQUMsRUFBRSxDQUFDLENBQUMsUUFBUSxDQUFDLEtBQUssQ0FBQyxDQUFDO1lBQ3ZELE1BQU0sVUFBVSxHQUFHLFVBQVUsQ0FBQyxLQUFLLENBQUMsVUFBVSxDQUFDLElBQUksQ0FBQyxDQUFDO1lBQ3JELE1BQU0sTUFBTSxHQUFHLFVBQVUsQ0FBQyxDQUFDLENBQUMsVUFBVSxDQUFDLEtBQUssQ0FBQyxLQUFLLENBQUMsQ0FBQyxDQUFDLENBQUMsQ0FBQyxDQUFDLFVBQVUsQ0FBQyxLQUFLLENBQUM7WUFFekUsMkNBQTJDO1lBQzNDLE1BQU0sWUFBWSxHQUFhLEVBQUUsQ0FBQztZQUVsQyx3Q0FBd0M7WUFDeEMsSUFBSSxDQUFDLFVBQVUsRUFBRSxDQUFDO2dCQUNoQixNQUFNLFFBQVEsR0FBRyxNQUFNLENBQUMsV0FBVyxDQUFDLEVBQUUsQ0FBQyxDQUFDLFFBQVEsQ0FBQyxLQUFLLENBQUMsQ0FBQztnQkFDeEQsTUFBTSxXQUFXLEdBQUcsTUFBTSxDQUFDLFdBQVcsQ0FBQyxFQUFFLENBQUMsQ0FBQyxRQUFRLENBQUMsV0FBVyxDQUFDLENBQUM7Z0JBQ2pFLE1BQU0sVUFBVSxDQUFDLGVBQWUsQ0FBQztvQkFDL0IsRUFBRSxFQUFFLFFBQVE7b0JBQ1osZUFBZSxFQUFFLE9BQU87b0JBQ3hCLElBQUksRUFBRSxTQUFTO29CQUNmLEtBQUssRUFBRSxXQUFXO29CQUNsQixNQUFNLEVBQUUsU0FBUztpQkFDbEIsQ0FBQyxDQUFDO2dCQUNILFlBQVksQ0FBQyxJQUFJLENBQUMsUUFBUSxDQUFDLENBQUM7WUFDOUIsQ0FBQztZQUVELDRCQUE0QjtZQUM1QixNQUFNLE9BQU8sR0FBRyxNQUFNLENBQUMsV0FBVyxDQUFDLEVBQUUsQ0FBQyxDQUFDLFFBQVEsQ0FBQyxLQUFLLENBQUMsQ0FBQztZQUN2RCxNQUFNLFVBQVUsR0FBRyxNQUFNLENBQUMsV0FBVyxDQUFDLEVBQUUsQ0FBQyxDQUFDLFFBQVEsQ0FBQyxXQUFXLENBQUMsQ0FBQztZQUNoRSxNQUFNLFVBQVUsQ0FBQyxlQUFlLENBQUM7Z0JBQy9CLEVBQUUsRUFBRSxPQUFPO2dCQUNYLGVBQWUsRUFBRSxPQUFPO2dCQUN4QixJQUFJLEVBQUUsUUFBUTtnQkFDZCxLQUFLLEVBQUUsVUFBVTtnQkFDakIsTUFBTSxFQUFFLFNBQVM7YUFDbEIsQ0FBQyxDQUFDO1lBQ0gsWUFBWSxDQUFDLElBQUksQ0FBQyxPQUFPLENBQUMsQ0FBQztZQUUzQixNQUFNLFVBQVUsQ0FBQyxtQkFBbUIsQ0FBQztnQkFDbkMsRUFBRSxFQUFFLE9BQU87Z0JBQ1gsT0FBTztnQkFDUCxVQUFVLEVBQUUsRUFBRSxJQUFJLEVBQUUsS0FBSyxFQUFFLEtBQUssRUFBRSxNQUFNLEVBQUU7Z0JBQzFDLE1BQU0sRUFBRSxTQUFTO2dCQUNqQixPQUFPLEVBQUUsT0FBTyxDQUFDLFdBQVcsRUFBRTtnQkFDOUIsWUFBWTtnQkFDWixRQUFRLEVBQUUsVUFBVSxJQUFJLFNBQVM7YUFDbEMsQ0FBQyxDQUFDO1lBRUgsZ0JBQWdCLENBQUMsSUFBSSxDQUFDLE9BQU8sQ0FBQyxDQUFDO1FBQ2pDLENBQUM7UUFFRCxNQUFNLEtBQUssR0FBRyxNQUFNLFVBQVUsQ0FBQyxXQUFXLENBQUM7WUFDekMsRUFBRSxFQUFFLE9BQU87WUFDWCxVQUFVLEVBQUUsUUFBUSxDQUFDLEdBQUc7WUFDeEIsTUFBTSxFQUFFLFNBQVM7WUFDakIsV0FBVztZQUNYLGdCQUFnQjtZQUNoQixPQUFPLEVBQUUsT0FBTyxDQUFDLFdBQVcsRUFBRTtZQUM5QixRQUFRLEVBQUUsR0FBRyxPQUFPLGFBQWEsT0FBTyxFQUFFO1NBQzNDLENBQUMsQ0FBQztRQUVILE1BQU0sWUFBWSxHQUFHO1lBQ25CLE1BQU0sRUFBRSxLQUFLLENBQUMsTUFBTTtZQUNwQixPQUFPLEVBQUUsS0FBSyxDQUFDLE9BQU87WUFDdEIsV0FBVyxFQUFFLEtBQUssQ0FBQyxXQUFXO1lBQzlCLGNBQWMsRUFBRSxLQUFLLENBQUMsZ0JBQWdCLENBQUMsR0FBRyxDQUFDLENBQUMsRUFBRSxFQUFFLEVBQUUsQ0FBQyxHQUFHLE9BQU8sVUFBVSxFQUFFLEVBQUUsQ0FBQztZQUM1RSxRQUFRLEVBQUUsS0FBSyxDQUFDLFFBQVE7U0FDekIsQ0FBQztRQUVGLEdBQUcsQ0FBQyxTQUFTLENBQUMsR0FBRyxFQUFFO1lBQ2pCLGNBQWMsRUFBRSxrQkFBa0I7WUFDbEMsVUFBVSxFQUFFLEdBQUcsT0FBTyxVQUFVLE9BQU8sRUFBRTtTQUMxQyxDQUFDLENBQUM7UUFDSCxHQUFHLENBQUMsR0FBRyxDQUFDLElBQUksQ0FBQyxTQUFTLENBQUMsWUFBWSxDQUFDLENBQUMsQ0FBQztJQUN4QyxDQUFDLENBQUM7QUFDSixDQUFDO0FBRUQ7O0dBRUc7QUFDSCxNQUFNLFVBQVUsc0JBQXNCLENBQ3BDLE9BQWUsRUFDZixXQUF3QixFQUN4QixVQUE2QjtJQUU3QixPQUFPLEtBQUssRUFDVixHQUF5QixFQUN6QixHQUF3QixFQUN4QixNQUE4QixFQUM5QixJQUFTLEVBQ00sRUFBRTtRQUNqQixNQUFNLE9BQU8sR0FBRyxNQUFNLENBQUMsRUFBRSxDQUFDO1FBQzFCLE1BQU0sVUFBVSxHQUFHLEdBQUcsT0FBTyxVQUFVLE9BQU8sRUFBRSxDQUFDO1FBQ2pELE1BQU0sV0FBVyxDQUFDLE1BQU0sQ0FBQyxJQUFJLEVBQUUsVUFBVSxDQUFDLENBQUM7UUFFM0MsTUFBTSxLQUFLLEdBQUcsTUFBTSxVQUFVLENBQUMsUUFBUSxDQUFDLE9BQU8sQ0FBQyxDQUFDO1FBQ2pELElBQUksQ0FBQyxLQUFLLEVBQUUsQ0FBQztZQUNYLE1BQU0sSUFBSSxlQUFlLENBQUMsR0FBRyxFQUFFLHNDQUFzQyxFQUFFLGlCQUFpQixDQUFDLENBQUM7UUFDNUYsQ0FBQztRQUVELDhEQUE4RDtRQUM5RCxJQUFJLEtBQUssQ0FBQyxNQUFNLEtBQUssU0FBUyxFQUFFLENBQUM7WUFDL0IsSUFBSSxRQUFRLEdBQUcsSUFBSSxDQUFDO1lBQ3BCLEtBQUssTUFBTSxPQUFPLElBQUksS0FBSyxDQUFDLGdCQUFnQixFQUFFLENBQUM7Z0JBQzdDLE1BQU0sS0FBSyxHQUFHLE1BQU0sVUFBVSxDQUFDLGdCQUFnQixDQUFDLE9BQU8sQ0FBQyxDQUFDO2dCQUN6RCxJQUFJLENBQUMsS0FBSyxJQUFJLEtBQUssQ0FBQyxNQUFNLEtBQUssT0FBTyxFQUFFLENBQUM7b0JBQ3ZDLFFBQVEsR0FBRyxLQUFLLENBQUM7b0JBQ2pCLE1BQU07Z0JBQ1IsQ0FBQztZQUNILENBQUM7WUFDRCxJQUFJLFFBQVEsRUFBRSxDQUFDO2dCQUNiLE1BQU0sVUFBVSxDQUFDLFdBQVcsQ0FBQyxPQUFPLEVBQUUsRUFBRSxNQUFNLEVBQUUsT0FBTyxFQUFFLENBQUMsQ0FBQztnQkFDM0QsS0FBSyxDQUFDLE1BQU0sR0FBRyxPQUFPLENBQUM7WUFDekIsQ0FBQztRQUNILENBQUM7UUFFRCxNQUFNLFlBQVksR0FBd0I7WUFDeEMsTUFBTSxFQUFFLEtBQUssQ0FBQyxNQUFNO1lBQ3BCLE9BQU8sRUFBRSxLQUFLLENBQUMsT0FBTztZQUN0QixXQUFXLEVBQUUsS0FBSyxDQUFDLFdBQVc7WUFDOUIsY0FBYyxFQUFFLEtBQUssQ0FBQyxnQkFBZ0IsQ0FBQyxHQUFHLENBQUMsQ0FBQyxFQUFFLEVBQUUsRUFBRSxDQUFDLEdBQUcsT0FBTyxVQUFVLEVBQUUsRUFBRSxDQUFDO1lBQzVFLFFBQVEsRUFBRSxLQUFLLENBQUMsUUFBUTtTQUN6QixDQUFDO1FBRUYsSUFBSSxLQUFLLENBQUMsV0FBVyxFQUFFLENBQUM7WUFDdEIsWUFBWSxDQUFDLFdBQVcsR0FBRyxLQUFLLENBQUMsV0FBVyxDQUFDO1FBQy9DLENBQUM7UUFFRCxHQUFHLENBQUMsU0FBUyxDQUFDLEdBQUcsRUFBRTtZQUNqQixjQUFjLEVBQUUsa0JBQWtCO1lBQ2xDLFVBQVUsRUFBRSxVQUFVO1NBQ3ZCLENBQUMsQ0FBQztRQUNILEdBQUcsQ0FBQyxHQUFHLENBQUMsSUFBSSxDQUFDLFNBQVMsQ0FBQyxZQUFZLENBQUMsQ0FBQyxDQUFDO0lBQ3hDLENBQUMsQ0FBQztBQUNKLENBQUMifQ==

package/dist_ts_server/server.interfaces.d.ts

@@ -0,0 +1,72 @@
+import type { IAcmeIdentifier } from '../dist_ts/acme/acme.interfaces.js';
+export interface IAcmeServerOptions {
+    port?: number;
+    hostname?: string;
+    baseUrl?: string;
+    /** When false, challenges auto-approve on trigger (useful for testing) */
+    challengeVerification?: boolean;
+    caOptions?: {
+        commonName?: string;
+        validityDays?: number;
+        certValidityDays?: number;
+    };
+}
+export interface IServerAccountStore {
+    create(account: IServerAccount): Promise<IServerAccount>;
+    getByThumbprint(thumbprint: string): Promise<IServerAccount | null>;
+    getByUrl(url: string): Promise<IServerAccount | null>;
+}
+export interface IServerOrderStore {
+    createOrder(order: IServerOrder): Promise<IServerOrder>;
+    getOrder(id: string): Promise<IServerOrder | null>;
+    updateOrder(id: string, updates: Partial<IServerOrder>): Promise<void>;
+    createAuthorization(authz: IServerAuthorization): Promise<IServerAuthorization>;
+    getAuthorization(id: string): Promise<IServerAuthorization | null>;
+    updateAuthorization(id: string, updates: Partial<IServerAuthorization>): Promise<void>;
+    createChallenge(challenge: IServerChallenge): Promise<IServerChallenge>;
+    getChallenge(id: string): Promise<IServerChallenge | null>;
+    updateChallenge(id: string, updates: Partial<IServerChallenge>): Promise<void>;
+    storeCertPem(orderId: string, pem: string): Promise<void>;
+    getCertPem(orderId: string): Promise<string | null>;
+}
+export interface IServerAccount {
+    id: string;
+    thumbprint: string;
+    url: string;
+    jwk: Record<string, string>;
+    status: string;
+    contact: string[];
+    createdAt: string;
+}
+export interface IServerOrder {
+    id: string;
+    accountUrl: string;
+    status: string;
+    identifiers: IAcmeIdentifier[];
+    authorizationIds: string[];
+    expires: string;
+    finalize: string;
+    certificate?: string;
+}
+export interface IServerAuthorization {
+    id: string;
+    orderId: string;
+    identifier: IAcmeIdentifier;
+    status: string;
+    expires: string;
+    challengeIds: string[];
+    wildcard?: boolean;
+}
+export interface IServerChallenge {
+    id: string;
+    authorizationId: string;
+    type: string;
+    token: string;
+    status: string;
+    validated?: string;
+    error?: {
+        type: string;
+        detail: string;
+    };
+}
+export type TRouteHandler = (req: import('node:http').IncomingMessage, res: import('node:http').ServerResponse, params: Record<string, string>, body: any) => Promise<void>;

package/dist_ts_server/server.interfaces.js

@@ -0,0 +1,2 @@
+export {};
+//# sourceMappingURL=data:application/json;base64,eyJ2ZXJzaW9uIjozLCJmaWxlIjoic2VydmVyLmludGVyZmFjZXMuanMiLCJzb3VyY2VSb290IjoiIiwic291cmNlcyI6WyIuLi8uLi90c19zZXJ2ZXIvc2VydmVyLmludGVyZmFjZXMudHMiXSwibmFtZXMiOltdLCJtYXBwaW5ncyI6IiJ9

package/package.json

@@ -1,14 +1,14 @@
 {
   "name": "@push.rocks/smartacme",
-  "version": "9.1.3",
+  "version": "9.3.0",
   "private": false,
-  "description": "A TypeScript-based ACME client for LetsEncrypt certificate management with a focus on simplicity and power.",
+  "description": "A TypeScript-based ACME client and server for certificate management with built-in CA, supporting LetsEncrypt and custom ACME authorities.",
   "main": "dist_ts/index.js",
   "typings": "dist_ts/index.d.ts",
   "type": "module",
   "scripts": {
     "test": "(tstest test/ --verbose --logfile --timeout 600)",
-    "build": "(tsbuild)",
+    "build": "(tsbuild tsfolders)",
     "buildDocs": "tsdoc"
   },
   "repository": {
@@ -20,6 +20,9 @@
     "LetsEncrypt",
     "TypeScript",
     "certificate management",
+    "certificate authority",
+    "ACME server",
+    "PKI",
     "DNS challenges",
     "SSL/TLS",
     "secure communication",
@@ -28,9 +31,11 @@
     "crypto",
     "MongoDB",
     "dns-01 challenge",
+    "http-01 challenge",
     "token-based challenges",
     "certificate renewal",
-    "wildcard certificates"
+    "wildcard certificates",
+    "RFC 8555"
   ],
   "author": "Task Venture Capital GmbH",
   "license": "MIT",
@@ -41,28 +46,28 @@
   "dependencies": {
     "@apiclient.xyz/cloudflare": "^7.1.0",
     "@peculiar/x509": "^1.14.3",
-    "@push.rocks/lik": "^6.2.2",
-    "@push.rocks/smartdata": "^7.0.15",
+    "@push.rocks/lik": "^6.3.1",
+    "@push.rocks/smartdata": "^7.1.0",
     "@push.rocks/smartdelay": "^3.0.5",
-    "@push.rocks/smartdns": "^7.8.1",
-    "@push.rocks/smartlog": "^3.1.10",
+    "@push.rocks/smartdns": "^7.9.0",
+    "@push.rocks/smartlog": "^3.2.1",
     "@push.rocks/smartnetwork": "^4.4.0",
     "@push.rocks/smartstring": "^4.1.0",
     "@push.rocks/smarttime": "^4.2.3",
     "@push.rocks/smartunique": "^3.0.9",
     "@push.rocks/taskbuffer": "^6.1.2",
-    "@tsclass/tsclass": "^9.3.0"
+    "@tsclass/tsclass": "^9.5.0"
   },
   "devDependencies": {
-    "@git.zone/tsbuild": "^4.1.2",
+    "@git.zone/tsbuild": "^4.3.0",
     "@git.zone/tsrun": "^2.0.1",
-    "@git.zone/tstest": "^3.1.8",
+    "@git.zone/tstest": "^3.4.0",
     "@push.rocks/qenv": "^6.1.3",
-    "@types/node": "^25.2.3"
+    "@types/node": "^25.5.0"
   },
   "files": [
     "ts/**/*",
-    "ts_web/**/*",
+    "ts_*/**/*",
     "dist/**/*",
     "dist_*/**/*",
     "dist_ts/**/*",

package/readme.hints.md

@@ -43,10 +43,34 @@ Key implementation details:
 - `TaskManager.start()` is called in `SmartAcme.start()` and `TaskManager.stop()` in `SmartAcme.stop()`.
 - The "no cronjobs specified" log messages during tests come from taskbuffer's internal CronManager polling — harmless noise when no cron tasks are scheduled.
 
+## ACME Directory Server (ts_server/)
+
+As of v9.2.0, a built-in ACME Directory Server lives under `ts_server/`. This is a full RFC 8555-compliant CA server that allows running your own Certificate Authority.
+
+Key files:
+- `ts_server/server.classes.acmeserver.ts` — Top-level `AcmeServer` facade (start/stop/config)
+- `ts_server/server.classes.ca.ts` — Self-signed root CA generation + certificate signing via `@peculiar/x509`
+- `ts_server/server.classes.jws.verifier.ts` — JWS signature verification (inverse of `AcmeCrypto.createJws`)
+- `ts_server/server.classes.router.ts` — Minimal HTTP router with `:param` support using raw `node:http`
+- `ts_server/server.classes.nonce.ts` — Single-use replay nonce management
+- `ts_server/server.classes.challenge.verifier.ts` — HTTP-01/DNS-01 verification (with bypass mode)
+- `ts_server/server.classes.account.store.ts` — In-memory account storage
+- `ts_server/server.classes.order.store.ts` — In-memory order/authz/challenge/cert storage
+- `ts_server/server.handlers.*.ts` — Route handlers for each ACME endpoint
+
+Design decisions:
+- Uses raw `node:http` (no framework dependency — `@api.global/typedserver` was explicitly removed in v8.1.0)
+- Zero new dependencies: uses `node:crypto`, `@peculiar/x509`, and existing project deps
+- Reuses `AcmeCrypto` for JWK thumbprint/base64url, ACME interfaces for response types, `AcmeError` patterns
+- `AcmeCrypto.getAlg()` was made public (was private) for use by the JWS verifier
+- Storage interfaces (`IServerAccountStore`, `IServerOrderStore`) are pluggable, with in-memory defaults
+- `challengeVerification: false` option auto-approves challenges for testing
+- `tsbuild tsfolders` automatically compiles `ts_server/` to `dist_ts_server/`
+
 ## Dependency Notes
 
 - `acme-client` was replaced with custom implementation in `ts/acme/` + `@peculiar/x509` for CSR generation
 - `@push.rocks/smartfile`, `@api.global/typedserver`, `@push.rocks/smartrequest`, `@push.rocks/smartpromise` were removed as unused dependencies in v8.1.0
 - The `@apiclient.xyz/cloudflare` `convenience` namespace is deprecated but still functional. The `Dns01Handler` accepts an `IConvenientDnsProvider` interface which remains stable.
 - Test imports use `@git.zone/tstest/tapbundle` (not `@push.rocks/tapbundle`)
-- Build uses `tsbuild` (no flags needed, v4+)
+- Build uses `tsbuild tsfolders` (v4.3.0+) — auto-discovers and compiles `ts/` and `ts_server/` directories

package/readme.md

@@ -1,6 +1,6 @@
 # @push.rocks/smartacme
 
-A TypeScript-based ACME client for Let's Encrypt certificate management with a focus on simplicity and power. 🔒
+A TypeScript-based ACME client and server for certificate management with a focus on simplicity and power. Includes a full RFC 8555-compliant ACME client for Let's Encrypt and a built-in ACME Directory Server for running your own Certificate Authority.
 
 ## Issue Reporting and Security
 
@@ -372,10 +372,117 @@ await smartAcme.stop();
 server.close();
 ```
 
+## ACME Directory Server (Built-in CA)
+
+SmartAcme includes a full RFC 8555-compliant ACME Directory Server, allowing you to run your own Certificate Authority. This is useful for internal PKI, development/testing environments, and air-gapped networks.
+
+### Quick Start — ACME Server
+
+```typescript
+import { server } from '@push.rocks/smartacme';
+
+const acmeServer = new server.AcmeServer({
+  port: 14000,
+  challengeVerification: false, // Auto-approve challenges (for testing)
+  caOptions: {
+    commonName: 'My Internal CA',
+    certValidityDays: 365,
+  },
+});
+
+await acmeServer.start();
+console.log(acmeServer.getDirectoryUrl()); // http://localhost:14000/directory
+console.log(acmeServer.getCaCertPem());    // Root CA certificate in PEM format
+
+// ... use it, then shut down
+await acmeServer.stop();
+```
+
+### Server Options
+
+```typescript
+interface IAcmeServerOptions {
+  port?: number;                    // Default: 14000
+  hostname?: string;                // Default: '0.0.0.0'
+  baseUrl?: string;                 // Auto-built from hostname:port if not provided
+  challengeVerification?: boolean;  // Default: true. Set false to auto-approve challenges
+  caOptions?: {
+    commonName?: string;            // CA subject CN (default: 'SmartACME Test CA')
+    validityDays?: number;          // Root cert validity in days (default: 3650)
+    certValidityDays?: number;      // Issued cert validity in days (default: 90)
+  };
+}
+```
+
+### Using the Server with SmartAcme Client
+
+Point the SmartAcme client at your own ACME server for a fully self-contained PKI:
+
+```typescript
+import { SmartAcme, certmanagers, handlers, server } from '@push.rocks/smartacme';
+
+// 1. Start your own CA
+const acmeServer = new server.AcmeServer({
+  port: 14000,
+  challengeVerification: false,
+});
+await acmeServer.start();
+
+// 2. Set up the client pointing at your CA
+const memHandler = new handlers.Http01MemoryHandler();
+const smartAcme = new SmartAcme({
+  accountEmail: 'admin@internal.example.com',
+  certManager: new certmanagers.MemoryCertManager(),
+  environment: 'integration',
+  challengeHandlers: [memHandler],
+  directoryUrl: acmeServer.getDirectoryUrl(), // Use your own CA!
+});
+
+await smartAcme.start();
+const cert = await smartAcme.getCertificateForDomain('myapp.internal');
+// cert.publicKey — PEM certificate chain signed by your CA
+// cert.privateKey — PEM private key
+
+await smartAcme.stop();
+await acmeServer.stop();
+```
+
+### Server Endpoints
+
+The ACME server implements all RFC 8555 endpoints:
+
+| Endpoint | Method | Description |
+|----------|--------|-------------|
+| `/directory` | GET | ACME directory with all endpoint URLs |
+| `/new-nonce` | HEAD/GET | Fresh replay nonce |
+| `/new-account` | POST | Account registration/lookup |
+| `/new-order` | POST | Create certificate order |
+| `/order/:id` | POST | Poll order status |
+| `/authz/:id` | POST | Get authorization with challenges |
+| `/challenge/:id` | POST | Trigger or poll challenge validation |
+| `/finalize/:id` | POST | Submit CSR and issue certificate |
+| `/cert/:id` | POST | Download PEM certificate chain |
+
+### Challenge Verification
+
+By default, the server performs real challenge verification (HTTP-01 fetches the token, DNS-01 queries TXT records). Set `challengeVerification: false` to auto-approve all challenges — useful for testing or internal environments where domain validation isn't needed.
+
+### Root CA Certificate
+
+Use `getCaCertPem()` to retrieve the root CA certificate for trust configuration:
+
+```typescript
+import * as fs from 'fs';
+fs.writeFileSync('/usr/local/share/ca-certificates/my-ca.crt', acmeServer.getCaCertPem());
+// Then: sudo update-ca-certificates
+```
+
 ## Architecture
 
 Under the hood, SmartAcme uses a fully custom RFC 8555-compliant ACME protocol implementation (no external ACME libraries). Key internal modules:
 
+### Client Modules (`ts/acme/`)
+
 | Module | Purpose |
 |--------|---------|
 | `AcmeClient` | Top-level ACME facade — orders, authorizations, finalization |
@@ -386,7 +493,20 @@ Under the hood, SmartAcme uses a fully custom RFC 8555-compliant ACME protocol i
 | `AcmeChallengeManager` | Key authorization computation and challenge completion |
 | `TaskManager` | Constraint-based concurrency control, rate limiting, and request deduplication via `@push.rocks/taskbuffer` |
 
-All cryptographic operations use `node:crypto`. The only external crypto dependency is `@peculiar/x509` for CSR generation.
+### Server Modules (`ts_server/`)
+
+| Module | Purpose |
+|--------|---------|
+| `AcmeServer` | Top-level server facade — start, stop, configuration |
+| `AcmeServerCA` | Self-signed root CA generation and certificate signing via `@peculiar/x509` |
+| `JwsVerifier` | JWS signature verification (inverse of `AcmeCrypto.createJws`) |
+| `NonceManager` | Single-use replay nonce generation and validation |
+| `ChallengeVerifier` | HTTP-01 and DNS-01 challenge verification (with bypass mode) |
+| `AcmeRouter` | Minimal HTTP router with parameterized path support |
+| `MemoryAccountStore` | In-memory ACME account storage |
+| `MemoryOrderStore` | In-memory order, authorization, challenge, and certificate storage |
+
+All cryptographic operations use `node:crypto`. The only external crypto dependency is `@peculiar/x509` for CSR generation and certificate signing.
 
 ## License and Legal Information
 

package/ts/00_commitinfo_data.ts

@@ -3,6 +3,6 @@
  */
 export const commitinfo = {
   name: '@push.rocks/smartacme',
-  version: '9.1.3',
-  description: 'A TypeScript-based ACME client for LetsEncrypt certificate management with a focus on simplicity and power.'
+  version: '9.3.0',
+  description: 'A TypeScript-based ACME client and server for certificate management with built-in CA, supporting LetsEncrypt and custom ACME authorities.'
 }

package/ts/acme/acme.classes.crypto.ts

@@ -175,7 +175,7 @@ export class AcmeCrypto {
   /**
    * Determine JWS algorithm from key type
    */
-  private static getAlg(keyPem: string): string {
+  static getAlg(keyPem: string): string {
     const keyObj = crypto.createPrivateKey(keyPem);
     const keyType = keyObj.asymmetricKeyType;
     if (keyType === 'rsa') return 'RS256';

package/ts/index.ts

@@ -10,5 +10,9 @@ export { certmanagers };
 import * as handlers from './handlers/index.js';
 export { handlers };
 
+// server (ACME Directory Server / CA)
+import * as server from '../ts_server/index.js';
+export { server };
+
 // re-export taskbuffer event types for consumers
 export type { ITaskEvent, ITaskMetadata } from '@push.rocks/taskbuffer';

package/ts_server/index.ts

@@ -0,0 +1,12 @@
+export { AcmeServer } from './server.classes.acmeserver.js';
+export { AcmeServerError } from './server.classes.jws.verifier.js';
+export { AcmeServerCA } from './server.classes.ca.js';
+export type {
+  IAcmeServerOptions,
+  IServerAccountStore,
+  IServerOrderStore,
+  IServerAccount,
+  IServerOrder,
+  IServerAuthorization,
+  IServerChallenge,
+} from './server.interfaces.js';

package/ts_server/server.classes.account.store.ts

@@ -0,0 +1,27 @@
+import type { IServerAccountStore, IServerAccount } from './server.interfaces.js';
+
+/**
+ * In-memory account storage for the ACME server.
+ */
+export class MemoryAccountStore implements IServerAccountStore {
+  private accounts = new Map<string, IServerAccount>();
+  private byThumbprint = new Map<string, string>();
+  private byUrl = new Map<string, string>();
+
+  async create(account: IServerAccount): Promise<IServerAccount> {
+    this.accounts.set(account.id, account);
+    this.byThumbprint.set(account.thumbprint, account.id);
+    this.byUrl.set(account.url, account.id);
+    return account;
+  }
+
+  async getByThumbprint(thumbprint: string): Promise<IServerAccount | null> {
+    const id = this.byThumbprint.get(thumbprint);
+    return id ? this.accounts.get(id) || null : null;
+  }
+
+  async getByUrl(url: string): Promise<IServerAccount | null> {
+    const id = this.byUrl.get(url);
+    return id ? this.accounts.get(id) || null : null;
+  }
+}