@simplysm/service-server 14.0.97 → 14.0.99

package/dist/service-server.d.ts

@@ -15,6 +15,7 @@ export declare class ServiceServer<TAuthInfo = unknown> extends EventEmitter<{
     private readonly _wsHandler;
     private readonly _jwtSecret;
     private _shutdownRegistered;
+    private readonly _acmeManager;
     readonly fastify: FastifyInstance;
     constructor(options: ServiceServerOptions);
     listen(): Promise<void>;

package/dist/service-server.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"service-server.d.ts","sourceRoot":"","sources":["../src/service-server.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,0BAA0B,CAAC;AAIhE,OAAO,EAAQ,YAAY,EAAO,MAAM,uBAAuB,CAAC;AAChE,OAAO,KAAK,EAAE,eAAe,EAAkB,MAAM,SAAS,CAAC;AAa/D,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,2BAA2B,CAAC;AAClE,OAAO,KAAK,EAAE,oBAAoB,EAAE,MAAM,wBAAwB,CAAC;AAOnE,MAAM,WAAW,gBAAgB,CAAC,SAAS,SAAS,eAAe;IACjE,IAAI,CACF,YAAY,EAAE,CAAC,IAAI,EAAE,SAAS,CAAC,OAAO,CAAC,KAAK,OAAO,EACnD,IAAI,EAAE,SAAS,CAAC,OAAO,CAAC,GACvB,OAAO,CAAC,IAAI,CAAC,CAAC;CAClB;AAED,qBAAa,aAAa,CAAC,SAAS,GAAG,OAAO,CAAE,SAAQ,YAAY,CAAC;IACnE,KAAK,EAAE,IAAI,CAAC;IACZ,KAAK,EAAE,IAAI,CAAC;CACb,CAAC;IASY,QAAQ,CAAC,OAAO,EAAE,oBAAoB;IARlD,MAAM,UAAS;IAEf,OAAO,CAAC,QAAQ,CAAC,UAAU,CAA4C;IACvE,OAAO,CAAC,QAAQ,CAAC,UAAU,CAAqB;IAChD,OAAO,CAAC,mBAAmB,CAAS;IAEpC,QAAQ,CAAC,OAAO,EAAE,eAAe,CAAC;gBAEb,OAAO,EAAE,oBAAoB;IAoB5C,MAAM,IAAI,OAAO,CAAC,IAAI,CAAC;IAyJvB,KAAK,IAAI,OAAO,CAAC,IAAI,CAAC;IAS5B,QAAQ,CAAC,SAAS,SAAS,eAAe,EAAE,QAAQ,EAAE,SAAS,GAAG,gBAAgB,CAAC,SAAS,CAAC;IAMvF,SAAS,CAAC,SAAS,SAAS,eAAe,EAC/C,QAAQ,EAAE,SAAS,EACnB,YAAY,EAAE,CAAC,IAAI,EAAE,SAAS,CAAC,OAAO,CAAC,KAAK,OAAO,EACnD,IAAI,EAAE,SAAS,CAAC,OAAO,CAAC;IAKpB,aAAa,CAAC,OAAO,EAAE,gBAAgB,CAAC,SAAS,CAAC;IAKlD,eAAe,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,gBAAgB,CAAC,SAAS,CAAC,CAAC;IAK1E,OAAO,CAAC,yBAAyB;CA4BlC;AAED,wBAAgB,mBAAmB,CAAC,SAAS,GAAG,OAAO,EACrD,OAAO,EAAE,oBAAoB,GAC5B,aAAa,CAAC,SAAS,CAAC,CAE1B"}
+{"version":3,"file":"service-server.d.ts","sourceRoot":"","sources":["../src/service-server.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,0BAA0B,CAAC;AAIhE,OAAO,EAAQ,YAAY,EAAO,MAAM,uBAAuB,CAAC;AAChE,OAAO,KAAK,EAAE,eAAe,EAAkB,MAAM,SAAS,CAAC;AAgB/D,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,2BAA2B,CAAC;AAClE,OAAO,KAAK,EAAE,oBAAoB,EAAE,MAAM,wBAAwB,CAAC;AAOnE,MAAM,WAAW,gBAAgB,CAAC,SAAS,SAAS,eAAe;IACjE,IAAI,CACF,YAAY,EAAE,CAAC,IAAI,EAAE,SAAS,CAAC,OAAO,CAAC,KAAK,OAAO,EACnD,IAAI,EAAE,SAAS,CAAC,OAAO,CAAC,GACvB,OAAO,CAAC,IAAI,CAAC,CAAC;CAClB;AAED,qBAAa,aAAa,CAAC,SAAS,GAAG,OAAO,CAAE,SAAQ,YAAY,CAAC;IACnE,KAAK,EAAE,IAAI,CAAC;IACZ,KAAK,EAAE,IAAI,CAAC;CACb,CAAC;IAUY,QAAQ,CAAC,OAAO,EAAE,oBAAoB;IATlD,MAAM,UAAS;IAEf,OAAO,CAAC,QAAQ,CAAC,UAAU,CAA4C;IACvE,OAAO,CAAC,QAAQ,CAAC,UAAU,CAAqB;IAChD,OAAO,CAAC,mBAAmB,CAAS;IACpC,OAAO,CAAC,QAAQ,CAAC,YAAY,CAA0B;IAEvD,QAAQ,CAAC,OAAO,EAAE,eAAe,CAAC;gBAEb,OAAO,EAAE,oBAAoB;IAyD5C,MAAM,IAAI,OAAO,CAAC,IAAI,CAAC;IAyKvB,KAAK,IAAI,OAAO,CAAC,IAAI,CAAC;IAU5B,QAAQ,CAAC,SAAS,SAAS,eAAe,EAAE,QAAQ,EAAE,SAAS,GAAG,gBAAgB,CAAC,SAAS,CAAC;IAMvF,SAAS,CAAC,SAAS,SAAS,eAAe,EAC/C,QAAQ,EAAE,SAAS,EACnB,YAAY,EAAE,CAAC,IAAI,EAAE,SAAS,CAAC,OAAO,CAAC,KAAK,OAAO,EACnD,IAAI,EAAE,SAAS,CAAC,OAAO,CAAC;IAKpB,aAAa,CAAC,OAAO,EAAE,gBAAgB,CAAC,SAAS,CAAC;IAKlD,eAAe,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,gBAAgB,CAAC,SAAS,CAAC,CAAC;IAK1E,OAAO,CAAC,yBAAyB;CA4BlC;AAED,wBAAgB,mBAAmB,CAAC,SAAS,GAAG,OAAO,EACrD,OAAO,EAAE,oBAAoB,GAC5B,aAAa,CAAC,SAAS,CAAC,CAE1B"}

package/dist/service-server.js

@@ -10,6 +10,7 @@ import fastifyHelmet from "@fastify/helmet";
 import fastifyCors from "@fastify/cors";
 import path from "path";
 import { Buffer } from "node:buffer";
+import { AcmeManager } from "./ssl/acme-manager.js";
 import { handleUpload } from "./transport/http/upload-handler.js";
 import { createWebSocketHandler } from "./transport/socket/websocket-handler.js";
 import { signJwt, verifyJwt } from "./auth/jwt-manager.js";
@@ -23,22 +24,65 @@ export class ServiceServer extends EventEmitter {
     _wsHandler;
     _jwtSecret;
     _shutdownRegistered = false;
+    _acmeManager;
     fastify;
     constructor(options) {
         super();
         this.options = options;
         this._jwtSecret =
             options.auth != null && options.auth !== false ? options.auth.jwtSecret : undefined;
-        // SSL 설정 (동기)
+        // SSL 설정
         // 참고: Fastify HTTPS는 Buffer 타입이 필요함 (Uint8Array를 직접 사용할 수 없음)
-        const httpsConf = options.ssl
-            ? { pfx: Buffer.from(options.ssl.pfxBytes), passphrase: options.ssl.passphrase }
-            : null;
+        let httpsConf = null;
+        if (options.ssl != null) {
+            if ("letsencrypt" in options.ssl) {
+                const acmeManager = new AcmeManager({
+                    rootPath: options.rootPath,
+                    domains: options.ssl.letsencrypt.domains,
+                    email: options.ssl.letsencrypt.email,
+                    staging: options.ssl.letsencrypt.staging,
+                });
+                this._acmeManager = acmeManager;
+                // 인증서 없이 ALPNCallback 만으로 HTTPS 서버 생성.
+                // 발급 전엔 acme-tls/1 챌린지에만 응답하고, 실인증서는 listen() 에서 setSecureContext 로 주입한다.
+                httpsConf = {
+                    ALPNCallback: function ({ protocols }) {
+                        if (protocols.includes("acme-tls/1")) {
+                            const ctx = acmeManager.getChallengeContext();
+                            if (ctx != null) {
+                                this.setKeyCert(ctx);
+                                return "acme-tls/1";
+                            }
+                            return undefined;
+                        }
+                        return protocols.includes("http/1.1") ? "http/1.1" : undefined;
+                    },
+                };
+            }
+            else if ("pfxBytes" in options.ssl) {
+                httpsConf = {
+                    pfx: Buffer.from(options.ssl.pfxBytes),
+                    ...(options.ssl.passphrase != null ? { passphrase: options.ssl.passphrase } : {}),
+                };
+            }
+            else {
+                httpsConf = {
+                    key: Buffer.from(options.ssl.pemKeyBytes),
+                    cert: Buffer.from(options.ssl.certBytes),
+                    ...(options.ssl.caBytes != null ? { ca: Buffer.from(options.ssl.caBytes) } : {}),
+                    ...(options.ssl.passphrase != null ? { passphrase: options.ssl.passphrase } : {}),
+                };
+            }
+        }
         this.fastify = fastify({ https: httpsConf });
         this._wsHandler = createWebSocketHandler((def) => executeServiceMethod(this, def), this._jwtSecret);
     }
     async listen() {
         logger.info(`서버 시작 중... ${env("VER") ?? ""}`);
+        // letsencrypt 는 핸드셰이크 중 인증서를 주입하는 TLSSocket.setKeyCert 가 필요 (Node 20.18.0+/22.9.0+)
+        if (this._acmeManager != null) {
+            assertAcmeNodeSupport();
+        }
         // auth 설정 검증: auth 미설정(undefined)인데 auth 요구 서비스가 있으면 에러
         if (this.options.auth == null) {
             const authRequiredService = this.options.services.find((s) => s.authPermissions != null);
@@ -151,6 +195,16 @@ export class ServiceServer extends EventEmitter {
         });
         // 리슨
         await this.fastify.listen({ port: this.options.port, host: "0.0.0.0" });
+        // Let's Encrypt: 리슨(443 바인딩) 후 인증서를 확보해 적용 (하이브리드 기동)
+        if (this._acmeManager != null) {
+            const server = this.fastify.server;
+            const material = await this._acmeManager.ensureCertificate();
+            server.setSecureContext({ key: material.key, cert: material.cert });
+            this._acmeManager.onRenew((m) => {
+                server.setSecureContext({ key: m.key, cert: m.cert });
+                logger.info("갱신된 인증서가 적용되었습니다.");
+            });
+        }
         // 정상 종료 핸들러 등록
         this._registerGracefulShutdown();
         this.isOpen = true;
@@ -158,6 +212,7 @@ export class ServiceServer extends EventEmitter {
         this.emit("ready");
     }
     async close() {
+        this._acmeManager?.stop();
         this._wsHandler.closeAll();
         await this.fastify.close();
         this.isOpen = false;
@@ -221,4 +276,15 @@ function createV1AutoUpdateMethods(methods) {
         getLastVersion: (platform) => getLastVersion(platform),
     };
 }
+/**
+ * Let's Encrypt(TLS-ALPN-01) 는 핸드셰이크 중 인증서를 주입하는 `TLSSocket.setKeyCert` 를 쓴다.
+ * 이 API 는 Node 20.18.0+ / 22.9.0+ 에서만 제공되므로 미만 버전이면 throw.
+ */
+function assertAcmeNodeSupport() {
+    const [major = 0, minor = 0] = process.versions.node.split(".").map((v) => Number(v));
+    const supported = (major === 20 && minor >= 18) || (major === 22 && minor >= 9) || major >= 23;
+    if (!supported) {
+        throw new Error(`Let's Encrypt(letsencrypt) SSL 은 Node 20.18.0+ 또는 22.9.0+ 가 필요합니다. 현재 버전: ${process.versions.node}`);
+    }
+}
 //# sourceMappingURL=service-server.js.map

package/dist/service-server.js.map

@@ -1 +1 @@
-{"version":3,"file":"service-server.js","sourceRoot":"","sources":["../src/service-server.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,gBAAgB,EAAE,MAAM,sCAAsC,CAAC;AACxE,OAAO,EAAE,iBAAiB,EAAE,MAAM,uCAAuC,CAAC;AAC1E,OAAO,EAAE,oBAAoB,EAAE,MAAM,yBAAyB,CAAC;AAC/D,OAAO,EAAE,IAAI,EAAE,YAAY,EAAE,GAAG,EAAE,MAAM,uBAAuB,CAAC;AAEhE,OAAO,OAAO,MAAM,SAAS,CAAC;AAC9B,OAAO,gBAAgB,MAAM,oBAAoB,CAAC;AAClD,OAAO,aAAa,MAAM,iBAAiB,CAAC;AAC5C,OAAO,gBAAgB,MAAM,oBAAoB,CAAC;AAClD,OAAO,aAAa,MAAM,iBAAiB,CAAC;AAC5C,OAAO,WAAW,MAAM,eAAe,CAAC;AACxC,OAAO,IAAI,MAAM,MAAM,CAAC;AACxB,OAAO,EAAE,MAAM,EAAE,MAAM,aAAa,CAAC;AACrC,OAAO,EAAE,YAAY,EAAE,MAAM,iCAAiC,CAAC;AAC/D,OAAO,EAAE,sBAAsB,EAAE,MAAM,sCAAsC,CAAC;AAE9E,OAAO,EAAE,OAAO,EAAE,SAAS,EAAE,MAAM,oBAAoB,CAAC;AAGxD,OAAO,EAAE,kBAAkB,EAA4B,MAAM,iCAAiC,CAAC;AAC/F,OAAO,EAAE,oBAAoB,EAAE,MAAM,uBAAuB,CAAC;AAC7D,OAAO,EAAE,YAAY,EAAE,MAAM,uBAAuB,CAAC;AAErD,MAAM,MAAM,GAAG,YAAY,CAAC,8BAA8B,CAAC,CAAC;AAS5D,MAAM,OAAO,aAAmC,SAAQ,YAGtD;IASqB;IARrB,MAAM,GAAG,KAAK,CAAC;IAEE,UAAU,CAA4C;IACtD,UAAU,CAAqB;IACxC,mBAAmB,GAAG,KAAK,CAAC;IAE3B,OAAO,CAAkB;IAElC,YAAqB,OAA6B;QAChD,KAAK,EAAE,CAAC;QADW,YAAO,GAAP,OAAO,CAAsB;QAGhD,IAAI,CAAC,UAAU;YACb,OAAO,CAAC,IAAI,IAAI,IAAI,IAAI,OAAO,CAAC,IAAI,KAAK,KAAK,CAAC,CAAC,CAAC,OAAO,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC,CAAC,SAAS,CAAC;QAEtF,cAAc;QACd,8DAA8D;QAC9D,MAAM,SAAS,GAAG,OAAO,CAAC,GAAG;YAC3B,CAAC,CAAC,EAAE,GAAG,EAAE,MAAM,CAAC,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,QAAQ,CAAC,EAAE,UAAU,EAAE,OAAO,CAAC,GAAG,CAAC,UAAU,EAAE;YAChF,CAAC,CAAC,IAAI,CAAC;QAET,IAAI,CAAC,OAAO,GAAG,OAAO,CAAC,EAAE,KAAK,EAAE,SAAS,EAAE,CAAC,CAAC;QAE7C,IAAI,CAAC,UAAU,GAAG,sBAAsB,CACtC,CAAC,GAAG,EAAE,EAAE,CAAC,oBAAoB,CAAC,IAAI,EAAE,GAAG,CAAC,EACxC,IAAI,CAAC,UAAU,CAChB,CAAC;IACJ,CAAC;IAED,KAAK,CAAC,MAAM;QACV,MAAM,CAAC,IAAI,CAAC,cAAc,GAAG,CAAC,KAAK,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC;QAE9C,wDAAwD;QACxD,IAAI,IAAI,CAAC,OAAO,CAAC,IAAI,IAAI,IAAI,EAAE,CAAC;YAC9B,MAAM,mBAAmB,GAAG,IAAI,CAAC,OAAO,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,eAAe,IAAI,IAAI,CAAC,CAAC;YACzF,IAAI,mBAAmB,IAAI,IAAI,EAAE,CAAC;gBAChC,MAAM,IAAI,KAAK,CACb,wBAAwB,mBAAmB,CAAC,IAAI,qBAAqB,CACtE,CAAC;YACJ,CAAC;QACH,CAAC;QAED,iBAAiB;QACjB,MAAM,IAAI,CAAC,OAAO,CAAC,QAAQ,CAAC,gBAAgB,CAAC,CAAC;QAE9C,UAAU;QACV,MAAM,IAAI,CAAC,OAAO,CAAC,QAAQ,CAAC,aAAa,EAAE;YACzC,MAAM,EAAE,IAAI;YACZ,qBAAqB,EAAE;gBACrB,UAAU,EAAE;oBACV,GAAG,aAAa,CAAC,qBAAqB,CAAC,oBAAoB,EAAE;oBAC7D,aAAa,EAAE,CAAC,QAAQ,EAAE,OAAO,EAAE,OAAO,EAAE,GAAG,CAAC;oBAChD,iBAAiB,EAAE,CAAC,iBAAiB,CAAC;oBACtC,YAAY,EAAE,CAAC,QAAQ,EAAE,iBAAiB,EAAE,OAAO,EAAE,OAAO,EAAE,GAAG,CAAC;oBAClE,GAAG,CAAC,IAAI,CAAC,OAAO,CAAC,GAAG,IAAI,IAAI;wBAC1B,CAAC,CAAC,EAAE;wBACJ,CAAC,CAAC;4BACE,2BAA2B,EAAE,IAAI;yBAClC,CAAC;iBACP;aACF;YACD,IAAI,EAAE,IAAI,CAAC,OAAO,CAAC,GAAG,IAAI,IAAI;YAC9B,uBAAuB,EAAE,IAAI,CAAC,OAAO,CAAC,GAAG,IAAI,IAAI;YACjD,kBAAkB,EAAE,KAAK;SAC1B,CAAC,CAAC;QAEH,WAAW;QACX,MAAM,IAAI,CAAC,OAAO,CAAC,QAAQ,CAAC,gBAAgB,CAAC,CAAC;QAE9C,qBAAqB;QACrB,MAAM,IAAI,CAAC,OAAO,CAAC,QAAQ,CAAC,aAAa,EAAE;YACzC,IAAI,EAAE,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,OAAO,CAAC,QAAQ,EAAE,KAAK,CAAC;YAChD,QAAQ,EAAE,KAAK;YACf,KAAK,EAAE,KAAK;SACb,CAAC,CAAC;QAEH,UAAU;QACV,MAAM,IAAI,CAAC,OAAO,CAAC,QAAQ,CAAC,WAAW,EAAE;YACvC,MAAM,EAAE,CAAC,OAAO,EAAE,EAAE,EAAE,EAAE;gBACtB,EAAE,CAAC,IAAI,EAAE,IAAI,CAAC,CAAC;YACjB,CAAC;YACD,cAAc,EAAE,CAAC,cAAc,EAAE,eAAe,EAAE,kBAAkB,CAAC;YACrE,cAAc,EAAE,CAAC,qBAAqB,EAAE,gBAAgB,CAAC;SAC1D,CAAC,CAAC;QAEH,UAAU;QACV,IAAI,CAAC,OAAO,CAAC,oBAAoB,CAC/B,kBAAkB,EAClB,EAAE,OAAO,EAAE,QAAQ,EAAE,EACrB,CAAC,GAAG,EAAE,IAAI,EAAE,IAAI,EAAE,EAAE;YAClB,IAAI,CAAC;gBACH,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,IAAc,CAAC,CAAC;gBAC1C,IAAI,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC;YACrB,CAAC;YAAC,OAAO,GAAY,EAAE,CAAC;gBACtB,MAAM,KAAK,GAAG,GAAsC,CAAC;gBACrD,KAAK,CAAC,UAAU,GAAG,GAAG,CAAC;gBACvB,IAAI,CAAC,KAAK,EAAE,SAAS,CAAC,CAAC;YACzB,CAAC;QACH,CAAC,CACF,CAAC;QAEF,YAAY;QACZ,IAAI,CAAC,OAAO,CAAC,qBAAqB,CAAC,GAAG,EAAE,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,CAAC,CAAC;QAEzE,UAAU;QACV,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,uBAAuB,EAAE,KAAK,EAAE,GAAG,EAAE,KAAK,EAAE,EAAE;YAC7D,MAAM,iBAAiB,CAAC,GAAG,EAAE,KAAK,EAAE,IAAI,CAAC,UAAU,EAAE,CAAC,GAAG,EAAE,EAAE,CAC3D,oBAAoB,CAAC,IAAI,EAAE,GAAG,CAAC,CAChC,CAAC;QACJ,CAAC,CAAC,CAAC;QAEH,UAAU;QACV,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,SAAS,EAAE,KAAK,EAAE,GAAG,EAAE,KAAK,EAAE,EAAE;YAC/C,MAAM,YAAY,CAAC,GAAG,EAAE,KAAK,EAAE,IAAI,CAAC,OAAO,CAAC,QAAQ,EAAE,IAAI,CAAC,UAAU,CAAC,CAAC;QACzE,CAAC,CAAC,CAAC;QAEH,gBAAgB;QAChB,MAAM,oBAAoB,GAAG,CAAC,MAAiB,EAAE,GAAmB,EAAE,EAAE;YACtE,MAAM,EAAE,GAAG,EAAE,QAAQ,EAAE,UAAU,EAAE,GAAG,GAAG,CAAC,KAIzC,CAAC;YAEF,IAAI,GAAG,KAAK,GAAG,EAAE,CAAC;gBAChB,IAAI,QAAQ,IAAI,IAAI,IAAI,UAAU,IAAI,IAAI,EAAE,CAAC;oBAC3C,MAAM,CAAC,KAAK,CAAC,IAAI,EAAE,wBAAwB,CAAC,CAAC;oBAC7C,OAAO;gBACT,CAAC;gBACD,IAAI,CAAC,UAAU,CAAC,SAAS,CAAC,MAAM,EAAE,QAAQ,EAAE,UAAU,EAAE,GAAG,CAAC,CAAC;YAC/D,CAAC;iBAAM,CAAC;gBACN,YAAY;gBACZ,MAAM,aAAa,GAAG,IAAI,CAAC,OAAO,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,KAAK,CAAC,QAAQ,CAAC,YAAY,CAAC,CAAC,CAAC;gBACxF,MAAM,gBAAgB,GAAG,IAAI,CAAC,OAAO,CAAC,gBAAgB,IAAI,EAAE,CAAC;gBAC7D,IAAI,aAAa,IAAI,IAAI,IAAI,gBAAgB,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;oBACzD,MAAM,CAAC,KAAK,CAAC,IAAI,EAAE,4BAA4B,CAAC,CAAC;oBACjD,OAAO;gBACT,CAAC;gBAED,kBAAkB,CAAC,MAAM,EAAE;oBACzB,qBAAqB,EAAE,CAAC,OAAO,EAAE,EAAE,CACjC,oBAAoB,CAAC,IAAI,EAAE,SAAS,EAAE,SAAS,EAAE,EAAE,UAAU,EAAE,OAAO,CAAC,UAAU,EAAE,CAAC;oBACtF,QAAQ,EAAE,gBAAgB;oBAC1B,wBAAwB,EACtB,aAAa,IAAI,IAAI;wBACnB,CAAC,CAAC,SAAS;wBACX,CAAC,CAAC,CAAC,EAAE,cAAc,EAAE,EAAE,EAAE,CACrB,yBAAyB,CAAC,aAAa,CAAC,OAAO,CAAC,cAAc,CAAC,CAAC;iBACzE,CAAC,CAAC;YACL,CAAC;QACH,CAAC,CAAC;QACF,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,GAAG,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,EAAE,oBAAoB,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC;QAC5E,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,KAAK,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,EAAE,oBAAoB,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC;QAE9E,kBAAkB;QAClB,IAAI,CAAC,OAAO,CAAC,KAAK,CAAC;YACjB,MAAM,EAAE,CAAC,KAAK,EAAE,MAAM,EAAE,KAAK,EAAE,QAAQ,EAAE,OAAO,EAAE,MAAM,CAAC;YACzD,GAAG,EAAE,IAAI;YACT,OAAO,EAAE,KAAK,EAAE,GAAG,EAAE,KAAK,EAAE,EAAE;gBAC5B,MAAM,MAAM,GAAG,IAAI,GAAG,CAAC,GAAG,CAAC,GAAG,CAAC,GAAI,EAAE,kBAAkB,CAAC,CAAC;gBACzD,MAAM,OAAO,GAAG,SAAS,CAAC,MAAM,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC;gBAEpD,MAAM,gBAAgB,CAAC,GAAG,EAAE,KAAK,EAAE,IAAI,CAAC,OAAO,CAAC,QAAQ,EAAE,OAAO,CAAC,CAAC;YACrE,CAAC;SACF,CAAC,CAAC;QAEH,oBAAoB;QACpB,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC,EAAE,CAAC,OAAO,EAAE,CAAC,GAAG,EAAE,EAAE;YACtC,MAAM,CAAC,KAAK,CAAC,YAAY,EAAE,GAAG,CAAC,CAAC;QAClC,CAAC,CAAC,CAAC;QAEH,KAAK;QACL,MAAM,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC,EAAE,IAAI,EAAE,IAAI,CAAC,OAAO,CAAC,IAAI,EAAE,IAAI,EAAE,SAAS,EAAE,CAAC,CAAC;QAExE,eAAe;QACf,IAAI,CAAC,yBAAyB,EAAE,CAAC;QAEjC,IAAI,CAAC,MAAM,GAAG,IAAI,CAAC;QACnB,MAAM,CAAC,IAAI,CAAC,eAAe,IAAI,CAAC,OAAO,CAAC,IAAI,GAAG,CAAC,CAAC;QACjD,IAAI,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;IACrB,CAAC;IAED,KAAK,CAAC,KAAK;QACT,IAAI,CAAC,UAAU,CAAC,QAAQ,EAAE,CAAC;QAC3B,MAAM,IAAI,CAAC,OAAO,CAAC,KAAK,EAAE,CAAC;QAE3B,IAAI,CAAC,MAAM,GAAG,KAAK,CAAC;QACpB,MAAM,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAC;QACvB,IAAI,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;IACrB,CAAC;IAED,QAAQ,CAAoC,QAAmB;QAC7D,OAAO;YACL,IAAI,EAAE,CAAC,YAAY,EAAE,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,SAAS,CAAY,QAAQ,EAAE,YAAY,EAAE,IAAI,CAAC;SACtF,CAAC;IACJ,CAAC;IAED,KAAK,CAAC,SAAS,CACb,QAAmB,EACnB,YAAmD,EACnD,IAAwB;QAExB,MAAM,IAAI,CAAC,UAAU,CAAC,IAAI,CAAY,QAAQ,CAAC,SAAS,EAAE,YAAY,EAAE,IAAI,CAAC,CAAC;IAChF,CAAC;IAED,KAAK,CAAC,aAAa,CAAC,OAAoC;QACtD,IAAI,IAAI,CAAC,UAAU,IAAI,IAAI;YAAE,MAAM,IAAI,KAAK,CAAC,yBAAyB,CAAC,CAAC;QACxE,OAAO,OAAO,CAAC,IAAI,CAAC,UAAU,EAAE,OAAO,CAAC,CAAC;IAC3C,CAAC;IAED,KAAK,CAAC,eAAe,CAAC,KAAa;QACjC,IAAI,IAAI,CAAC,UAAU,IAAI,IAAI;YAAE,MAAM,IAAI,KAAK,CAAC,yBAAyB,CAAC,CAAC;QACxE,OAAO,SAAS,CAAC,IAAI,CAAC,UAAU,EAAE,KAAK,CAAC,CAAC;IAC3C,CAAC;IAEO,yBAAyB;QAC/B,IAAI,IAAI,CAAC,mBAAmB;YAAE,OAAO;QACrC,IAAI,CAAC,mBAAmB,GAAG,IAAI,CAAC;QAEhC,MAAM,eAAe,GAAG,KAAK,EAAE,MAAc,EAAE,EAAE;YAC/C,MAAM,CAAC,IAAI,CAAC,GAAG,MAAM,2BAA2B,CAAC,CAAC;YAElD,MAAM,cAAc,GAAG,UAAU,CAAC,GAAG,EAAE;gBACrC,MAAM,CAAC,KAAK,CAAC,8BAA8B,CAAC,CAAC;gBAC7C,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;YAClB,CAAC,EAAE,KAAK,CAAC,CAAC;YAEV,IAAI,CAAC;gBACH,IAAI,IAAI,CAAC,MAAM,EAAE,CAAC;oBAChB,MAAM,IAAI,CAAC,KAAK,EAAE,CAAC;gBACrB,CAAC;gBACD,MAAM,CAAC,IAAI,CAAC,oBAAoB,CAAC,CAAC;gBAClC,YAAY,CAAC,cAAc,CAAC,CAAC;gBAC7B,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;YAClB,CAAC;YAAC,OAAO,GAAG,EAAE,CAAC;gBACb,MAAM,CAAC,KAAK,CAAC,eAAe,EAAE,GAAG,CAAC,CAAC;gBACnC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;YAClB,CAAC;QACH,CAAC,CAAC;QAEF,OAAO,CAAC,EAAE,CAAC,QAAQ,EAAE,GAAG,EAAE,CAAC,eAAe,CAAC,QAAQ,CAAC,CAAC,CAAC;QACtD,OAAO,CAAC,EAAE,CAAC,SAAS,EAAE,GAAG,EAAE,CAAC,eAAe,CAAC,SAAS,CAAC,CAAC,CAAC;IAC1D,CAAC;CACF;AAED,MAAM,UAAU,mBAAmB,CACjC,OAA6B;IAE7B,OAAO,IAAI,aAAa,CAAY,OAAO,CAAC,CAAC;AAC/C,CAAC;AAED,SAAS,yBAAyB,CAChC,OAA8D;IAE9D,MAAM,cAAc,GAAG,OAAO,CAAC,gBAAgB,CAAC,CAAC;IACjD,IAAI,cAAc,IAAI,IAAI,EAAE,CAAC;QAC3B,MAAM,IAAI,KAAK,CAAC,2CAA2C,CAAC,CAAC;IAC/D,CAAC;IAED,OAAO;QACL,cAAc,EAAE,CAAC,QAAQ,EAAE,EAAE,CAAC,cAAc,CAAC,QAAQ,CAAC;KACvD,CAAC;AACJ,CAAC"}
+{"version":3,"file":"service-server.js","sourceRoot":"","sources":["../src/service-server.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,gBAAgB,EAAE,MAAM,sCAAsC,CAAC;AACxE,OAAO,EAAE,iBAAiB,EAAE,MAAM,uCAAuC,CAAC;AAC1E,OAAO,EAAE,oBAAoB,EAAE,MAAM,yBAAyB,CAAC;AAC/D,OAAO,EAAE,IAAI,EAAE,YAAY,EAAE,GAAG,EAAE,MAAM,uBAAuB,CAAC;AAEhE,OAAO,OAAO,MAAM,SAAS,CAAC;AAC9B,OAAO,gBAAgB,MAAM,oBAAoB,CAAC;AAClD,OAAO,aAAa,MAAM,iBAAiB,CAAC;AAC5C,OAAO,gBAAgB,MAAM,oBAAoB,CAAC;AAClD,OAAO,aAAa,MAAM,iBAAiB,CAAC;AAC5C,OAAO,WAAW,MAAM,eAAe,CAAC;AACxC,OAAO,IAAI,MAAM,MAAM,CAAC;AACxB,OAAO,EAAE,MAAM,EAAE,MAAM,aAAa,CAAC;AAGrC,OAAO,EAAE,WAAW,EAAE,MAAM,oBAAoB,CAAC;AACjD,OAAO,EAAE,YAAY,EAAE,MAAM,iCAAiC,CAAC;AAC/D,OAAO,EAAE,sBAAsB,EAAE,MAAM,sCAAsC,CAAC;AAE9E,OAAO,EAAE,OAAO,EAAE,SAAS,EAAE,MAAM,oBAAoB,CAAC;AAGxD,OAAO,EAAE,kBAAkB,EAA4B,MAAM,iCAAiC,CAAC;AAC/F,OAAO,EAAE,oBAAoB,EAAE,MAAM,uBAAuB,CAAC;AAC7D,OAAO,EAAE,YAAY,EAAE,MAAM,uBAAuB,CAAC;AAErD,MAAM,MAAM,GAAG,YAAY,CAAC,8BAA8B,CAAC,CAAC;AAS5D,MAAM,OAAO,aAAmC,SAAQ,YAGtD;IAUqB;IATrB,MAAM,GAAG,KAAK,CAAC;IAEE,UAAU,CAA4C;IACtD,UAAU,CAAqB;IACxC,mBAAmB,GAAG,KAAK,CAAC;IACnB,YAAY,CAA0B;IAE9C,OAAO,CAAkB;IAElC,YAAqB,OAA6B;QAChD,KAAK,EAAE,CAAC;QADW,YAAO,GAAP,OAAO,CAAsB;QAGhD,IAAI,CAAC,UAAU;YACb,OAAO,CAAC,IAAI,IAAI,IAAI,IAAI,OAAO,CAAC,IAAI,KAAK,KAAK,CAAC,CAAC,CAAC,OAAO,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC,CAAC,SAAS,CAAC;QAEtF,SAAS;QACT,8DAA8D;QAC9D,IAAI,SAAS,GAA+B,IAAI,CAAC;QACjD,IAAI,OAAO,CAAC,GAAG,IAAI,IAAI,EAAE,CAAC;YACxB,IAAI,aAAa,IAAI,OAAO,CAAC,GAAG,EAAE,CAAC;gBACjC,MAAM,WAAW,GAAG,IAAI,WAAW,CAAC;oBAClC,QAAQ,EAAE,OAAO,CAAC,QAAQ;oBAC1B,OAAO,EAAE,OAAO,CAAC,GAAG,CAAC,WAAW,CAAC,OAAO;oBACxC,KAAK,EAAE,OAAO,CAAC,GAAG,CAAC,WAAW,CAAC,KAAK;oBACpC,OAAO,EAAE,OAAO,CAAC,GAAG,CAAC,WAAW,CAAC,OAAO;iBACzC,CAAC,CAAC;gBACH,IAAI,CAAC,YAAY,GAAG,WAAW,CAAC;gBAEhC,uCAAuC;gBACvC,0EAA0E;gBAC1E,SAAS,GAAG;oBACV,YAAY,EAAE,UAA2B,EAAE,SAAS,EAAE;wBACpD,IAAI,SAAS,CAAC,QAAQ,CAAC,YAAY,CAAC,EAAE,CAAC;4BACrC,MAAM,GAAG,GAAG,WAAW,CAAC,mBAAmB,EAAE,CAAC;4BAC9C,IAAI,GAAG,IAAI,IAAI,EAAE,CAAC;gCAChB,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,CAAC;gCACrB,OAAO,YAAY,CAAC;4BACtB,CAAC;4BACD,OAAO,SAAS,CAAC;wBACnB,CAAC;wBACD,OAAO,SAAS,CAAC,QAAQ,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC,SAAS,CAAC;oBACjE,CAAC;iBACF,CAAC;YACJ,CAAC;iBAAM,IAAI,UAAU,IAAI,OAAO,CAAC,GAAG,EAAE,CAAC;gBACrC,SAAS,GAAG;oBACV,GAAG,EAAE,MAAM,CAAC,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,QAAQ,CAAC;oBACtC,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,UAAU,IAAI,IAAI,CAAC,CAAC,CAAC,EAAE,UAAU,EAAE,OAAO,CAAC,GAAG,CAAC,UAAU,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;iBAClF,CAAC;YACJ,CAAC;iBAAM,CAAC;gBACN,SAAS,GAAG;oBACV,GAAG,EAAE,MAAM,CAAC,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,WAAW,CAAC;oBACzC,IAAI,EAAE,MAAM,CAAC,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,SAAS,CAAC;oBACxC,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,OAAO,IAAI,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,EAAE,MAAM,CAAC,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;oBAChF,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,UAAU,IAAI,IAAI,CAAC,CAAC,CAAC,EAAE,UAAU,EAAE,OAAO,CAAC,GAAG,CAAC,UAAU,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;iBAClF,CAAC;YACJ,CAAC;QACH,CAAC;QAED,IAAI,CAAC,OAAO,GAAG,OAAO,CAAC,EAAE,KAAK,EAAE,SAAS,EAAE,CAAC,CAAC;QAE7C,IAAI,CAAC,UAAU,GAAG,sBAAsB,CACtC,CAAC,GAAG,EAAE,EAAE,CAAC,oBAAoB,CAAC,IAAI,EAAE,GAAG,CAAC,EACxC,IAAI,CAAC,UAAU,CAChB,CAAC;IACJ,CAAC;IAED,KAAK,CAAC,MAAM;QACV,MAAM,CAAC,IAAI,CAAC,cAAc,GAAG,CAAC,KAAK,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC;QAE9C,oFAAoF;QACpF,IAAI,IAAI,CAAC,YAAY,IAAI,IAAI,EAAE,CAAC;YAC9B,qBAAqB,EAAE,CAAC;QAC1B,CAAC;QAED,wDAAwD;QACxD,IAAI,IAAI,CAAC,OAAO,CAAC,IAAI,IAAI,IAAI,EAAE,CAAC;YAC9B,MAAM,mBAAmB,GAAG,IAAI,CAAC,OAAO,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,eAAe,IAAI,IAAI,CAAC,CAAC;YACzF,IAAI,mBAAmB,IAAI,IAAI,EAAE,CAAC;gBAChC,MAAM,IAAI,KAAK,CACb,wBAAwB,mBAAmB,CAAC,IAAI,qBAAqB,CACtE,CAAC;YACJ,CAAC;QACH,CAAC;QAED,iBAAiB;QACjB,MAAM,IAAI,CAAC,OAAO,CAAC,QAAQ,CAAC,gBAAgB,CAAC,CAAC;QAE9C,UAAU;QACV,MAAM,IAAI,CAAC,OAAO,CAAC,QAAQ,CAAC,aAAa,EAAE;YACzC,MAAM,EAAE,IAAI;YACZ,qBAAqB,EAAE;gBACrB,UAAU,EAAE;oBACV,GAAG,aAAa,CAAC,qBAAqB,CAAC,oBAAoB,EAAE;oBAC7D,aAAa,EAAE,CAAC,QAAQ,EAAE,OAAO,EAAE,OAAO,EAAE,GAAG,CAAC;oBAChD,iBAAiB,EAAE,CAAC,iBAAiB,CAAC;oBACtC,YAAY,EAAE,CAAC,QAAQ,EAAE,iBAAiB,EAAE,OAAO,EAAE,OAAO,EAAE,GAAG,CAAC;oBAClE,GAAG,CAAC,IAAI,CAAC,OAAO,CAAC,GAAG,IAAI,IAAI;wBAC1B,CAAC,CAAC,EAAE;wBACJ,CAAC,CAAC;4BACE,2BAA2B,EAAE,IAAI;yBAClC,CAAC;iBACP;aACF;YACD,IAAI,EAAE,IAAI,CAAC,OAAO,CAAC,GAAG,IAAI,IAAI;YAC9B,uBAAuB,EAAE,IAAI,CAAC,OAAO,CAAC,GAAG,IAAI,IAAI;YACjD,kBAAkB,EAAE,KAAK;SAC1B,CAAC,CAAC;QAEH,WAAW;QACX,MAAM,IAAI,CAAC,OAAO,CAAC,QAAQ,CAAC,gBAAgB,CAAC,CAAC;QAE9C,qBAAqB;QACrB,MAAM,IAAI,CAAC,OAAO,CAAC,QAAQ,CAAC,aAAa,EAAE;YACzC,IAAI,EAAE,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,OAAO,CAAC,QAAQ,EAAE,KAAK,CAAC;YAChD,QAAQ,EAAE,KAAK;YACf,KAAK,EAAE,KAAK;SACb,CAAC,CAAC;QAEH,UAAU;QACV,MAAM,IAAI,CAAC,OAAO,CAAC,QAAQ,CAAC,WAAW,EAAE;YACvC,MAAM,EAAE,CAAC,OAAO,EAAE,EAAE,EAAE,EAAE;gBACtB,EAAE,CAAC,IAAI,EAAE,IAAI,CAAC,CAAC;YACjB,CAAC;YACD,cAAc,EAAE,CAAC,cAAc,EAAE,eAAe,EAAE,kBAAkB,CAAC;YACrE,cAAc,EAAE,CAAC,qBAAqB,EAAE,gBAAgB,CAAC;SAC1D,CAAC,CAAC;QAEH,UAAU;QACV,IAAI,CAAC,OAAO,CAAC,oBAAoB,CAC/B,kBAAkB,EAClB,EAAE,OAAO,EAAE,QAAQ,EAAE,EACrB,CAAC,GAAG,EAAE,IAAI,EAAE,IAAI,EAAE,EAAE;YAClB,IAAI,CAAC;gBACH,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,IAAc,CAAC,CAAC;gBAC1C,IAAI,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC;YACrB,CAAC;YAAC,OAAO,GAAY,EAAE,CAAC;gBACtB,MAAM,KAAK,GAAG,GAAsC,CAAC;gBACrD,KAAK,CAAC,UAAU,GAAG,GAAG,CAAC;gBACvB,IAAI,CAAC,KAAK,EAAE,SAAS,CAAC,CAAC;YACzB,CAAC;QACH,CAAC,CACF,CAAC;QAEF,YAAY;QACZ,IAAI,CAAC,OAAO,CAAC,qBAAqB,CAAC,GAAG,EAAE,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,CAAC,CAAC;QAEzE,UAAU;QACV,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,uBAAuB,EAAE,KAAK,EAAE,GAAG,EAAE,KAAK,EAAE,EAAE;YAC7D,MAAM,iBAAiB,CAAC,GAAG,EAAE,KAAK,EAAE,IAAI,CAAC,UAAU,EAAE,CAAC,GAAG,EAAE,EAAE,CAC3D,oBAAoB,CAAC,IAAI,EAAE,GAAG,CAAC,CAChC,CAAC;QACJ,CAAC,CAAC,CAAC;QAEH,UAAU;QACV,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,SAAS,EAAE,KAAK,EAAE,GAAG,EAAE,KAAK,EAAE,EAAE;YAC/C,MAAM,YAAY,CAAC,GAAG,EAAE,KAAK,EAAE,IAAI,CAAC,OAAO,CAAC,QAAQ,EAAE,IAAI,CAAC,UAAU,CAAC,CAAC;QACzE,CAAC,CAAC,CAAC;QAEH,gBAAgB;QAChB,MAAM,oBAAoB,GAAG,CAAC,MAAiB,EAAE,GAAmB,EAAE,EAAE;YACtE,MAAM,EAAE,GAAG,EAAE,QAAQ,EAAE,UAAU,EAAE,GAAG,GAAG,CAAC,KAIzC,CAAC;YAEF,IAAI,GAAG,KAAK,GAAG,EAAE,CAAC;gBAChB,IAAI,QAAQ,IAAI,IAAI,IAAI,UAAU,IAAI,IAAI,EAAE,CAAC;oBAC3C,MAAM,CAAC,KAAK,CAAC,IAAI,EAAE,wBAAwB,CAAC,CAAC;oBAC7C,OAAO;gBACT,CAAC;gBACD,IAAI,CAAC,UAAU,CAAC,SAAS,CAAC,MAAM,EAAE,QAAQ,EAAE,UAAU,EAAE,GAAG,CAAC,CAAC;YAC/D,CAAC;iBAAM,CAAC;gBACN,YAAY;gBACZ,MAAM,aAAa,GAAG,IAAI,CAAC,OAAO,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,KAAK,CAAC,QAAQ,CAAC,YAAY,CAAC,CAAC,CAAC;gBACxF,MAAM,gBAAgB,GAAG,IAAI,CAAC,OAAO,CAAC,gBAAgB,IAAI,EAAE,CAAC;gBAC7D,IAAI,aAAa,IAAI,IAAI,IAAI,gBAAgB,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;oBACzD,MAAM,CAAC,KAAK,CAAC,IAAI,EAAE,4BAA4B,CAAC,CAAC;oBACjD,OAAO;gBACT,CAAC;gBAED,kBAAkB,CAAC,MAAM,EAAE;oBACzB,qBAAqB,EAAE,CAAC,OAAO,EAAE,EAAE,CACjC,oBAAoB,CAAC,IAAI,EAAE,SAAS,EAAE,SAAS,EAAE,EAAE,UAAU,EAAE,OAAO,CAAC,UAAU,EAAE,CAAC;oBACtF,QAAQ,EAAE,gBAAgB;oBAC1B,wBAAwB,EACtB,aAAa,IAAI,IAAI;wBACnB,CAAC,CAAC,SAAS;wBACX,CAAC,CAAC,CAAC,EAAE,cAAc,EAAE,EAAE,EAAE,CACrB,yBAAyB,CAAC,aAAa,CAAC,OAAO,CAAC,cAAc,CAAC,CAAC;iBACzE,CAAC,CAAC;YACL,CAAC;QACH,CAAC,CAAC;QACF,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,GAAG,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,EAAE,oBAAoB,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC;QAC5E,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,KAAK,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,EAAE,oBAAoB,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC;QAE9E,kBAAkB;QAClB,IAAI,CAAC,OAAO,CAAC,KAAK,CAAC;YACjB,MAAM,EAAE,CAAC,KAAK,EAAE,MAAM,EAAE,KAAK,EAAE,QAAQ,EAAE,OAAO,EAAE,MAAM,CAAC;YACzD,GAAG,EAAE,IAAI;YACT,OAAO,EAAE,KAAK,EAAE,GAAG,EAAE,KAAK,EAAE,EAAE;gBAC5B,MAAM,MAAM,GAAG,IAAI,GAAG,CAAC,GAAG,CAAC,GAAG,CAAC,GAAI,EAAE,kBAAkB,CAAC,CAAC;gBACzD,MAAM,OAAO,GAAG,SAAS,CAAC,MAAM,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC;gBAEpD,MAAM,gBAAgB,CAAC,GAAG,EAAE,KAAK,EAAE,IAAI,CAAC,OAAO,CAAC,QAAQ,EAAE,OAAO,CAAC,CAAC;YACrE,CAAC;SACF,CAAC,CAAC;QAEH,oBAAoB;QACpB,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC,EAAE,CAAC,OAAO,EAAE,CAAC,GAAG,EAAE,EAAE;YACtC,MAAM,CAAC,KAAK,CAAC,YAAY,EAAE,GAAG,CAAC,CAAC;QAClC,CAAC,CAAC,CAAC;QAEH,KAAK;QACL,MAAM,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC,EAAE,IAAI,EAAE,IAAI,CAAC,OAAO,CAAC,IAAI,EAAE,IAAI,EAAE,SAAS,EAAE,CAAC,CAAC;QAExE,sDAAsD;QACtD,IAAI,IAAI,CAAC,YAAY,IAAI,IAAI,EAAE,CAAC;YAC9B,MAAM,MAAM,GAAG,IAAI,CAAC,OAAO,CAAC,MAAiC,CAAC;YAC9D,MAAM,QAAQ,GAAG,MAAM,IAAI,CAAC,YAAY,CAAC,iBAAiB,EAAE,CAAC;YAC7D,MAAM,CAAC,gBAAgB,CAAC,EAAE,GAAG,EAAE,QAAQ,CAAC,GAAG,EAAE,IAAI,EAAE,QAAQ,CAAC,IAAI,EAAE,CAAC,CAAC;YACpE,IAAI,CAAC,YAAY,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,EAAE;gBAC9B,MAAM,CAAC,gBAAgB,CAAC,EAAE,GAAG,EAAE,CAAC,CAAC,GAAG,EAAE,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC;gBACtD,MAAM,CAAC,IAAI,CAAC,mBAAmB,CAAC,CAAC;YACnC,CAAC,CAAC,CAAC;QACL,CAAC;QAED,eAAe;QACf,IAAI,CAAC,yBAAyB,EAAE,CAAC;QAEjC,IAAI,CAAC,MAAM,GAAG,IAAI,CAAC;QACnB,MAAM,CAAC,IAAI,CAAC,eAAe,IAAI,CAAC,OAAO,CAAC,IAAI,GAAG,CAAC,CAAC;QACjD,IAAI,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;IACrB,CAAC;IAED,KAAK,CAAC,KAAK;QACT,IAAI,CAAC,YAAY,EAAE,IAAI,EAAE,CAAC;QAC1B,IAAI,CAAC,UAAU,CAAC,QAAQ,EAAE,CAAC;QAC3B,MAAM,IAAI,CAAC,OAAO,CAAC,KAAK,EAAE,CAAC;QAE3B,IAAI,CAAC,MAAM,GAAG,KAAK,CAAC;QACpB,MAAM,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAC;QACvB,IAAI,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;IACrB,CAAC;IAED,QAAQ,CAAoC,QAAmB;QAC7D,OAAO;YACL,IAAI,EAAE,CAAC,YAAY,EAAE,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,SAAS,CAAY,QAAQ,EAAE,YAAY,EAAE,IAAI,CAAC;SACtF,CAAC;IACJ,CAAC;IAED,KAAK,CAAC,SAAS,CACb,QAAmB,EACnB,YAAmD,EACnD,IAAwB;QAExB,MAAM,IAAI,CAAC,UAAU,CAAC,IAAI,CAAY,QAAQ,CAAC,SAAS,EAAE,YAAY,EAAE,IAAI,CAAC,CAAC;IAChF,CAAC;IAED,KAAK,CAAC,aAAa,CAAC,OAAoC;QACtD,IAAI,IAAI,CAAC,UAAU,IAAI,IAAI;YAAE,MAAM,IAAI,KAAK,CAAC,yBAAyB,CAAC,CAAC;QACxE,OAAO,OAAO,CAAC,IAAI,CAAC,UAAU,EAAE,OAAO,CAAC,CAAC;IAC3C,CAAC;IAED,KAAK,CAAC,eAAe,CAAC,KAAa;QACjC,IAAI,IAAI,CAAC,UAAU,IAAI,IAAI;YAAE,MAAM,IAAI,KAAK,CAAC,yBAAyB,CAAC,CAAC;QACxE,OAAO,SAAS,CAAC,IAAI,CAAC,UAAU,EAAE,KAAK,CAAC,CAAC;IAC3C,CAAC;IAEO,yBAAyB;QAC/B,IAAI,IAAI,CAAC,mBAAmB;YAAE,OAAO;QACrC,IAAI,CAAC,mBAAmB,GAAG,IAAI,CAAC;QAEhC,MAAM,eAAe,GAAG,KAAK,EAAE,MAAc,EAAE,EAAE;YAC/C,MAAM,CAAC,IAAI,CAAC,GAAG,MAAM,2BAA2B,CAAC,CAAC;YAElD,MAAM,cAAc,GAAG,UAAU,CAAC,GAAG,EAAE;gBACrC,MAAM,CAAC,KAAK,CAAC,8BAA8B,CAAC,CAAC;gBAC7C,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;YAClB,CAAC,EAAE,KAAK,CAAC,CAAC;YAEV,IAAI,CAAC;gBACH,IAAI,IAAI,CAAC,MAAM,EAAE,CAAC;oBAChB,MAAM,IAAI,CAAC,KAAK,EAAE,CAAC;gBACrB,CAAC;gBACD,MAAM,CAAC,IAAI,CAAC,oBAAoB,CAAC,CAAC;gBAClC,YAAY,CAAC,cAAc,CAAC,CAAC;gBAC7B,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;YAClB,CAAC;YAAC,OAAO,GAAG,EAAE,CAAC;gBACb,MAAM,CAAC,KAAK,CAAC,eAAe,EAAE,GAAG,CAAC,CAAC;gBACnC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;YAClB,CAAC;QACH,CAAC,CAAC;QAEF,OAAO,CAAC,EAAE,CAAC,QAAQ,EAAE,GAAG,EAAE,CAAC,eAAe,CAAC,QAAQ,CAAC,CAAC,CAAC;QACtD,OAAO,CAAC,EAAE,CAAC,SAAS,EAAE,GAAG,EAAE,CAAC,eAAe,CAAC,SAAS,CAAC,CAAC,CAAC;IAC1D,CAAC;CACF;AAED,MAAM,UAAU,mBAAmB,CACjC,OAA6B;IAE7B,OAAO,IAAI,aAAa,CAAY,OAAO,CAAC,CAAC;AAC/C,CAAC;AAED,SAAS,yBAAyB,CAChC,OAA8D;IAE9D,MAAM,cAAc,GAAG,OAAO,CAAC,gBAAgB,CAAC,CAAC;IACjD,IAAI,cAAc,IAAI,IAAI,EAAE,CAAC;QAC3B,MAAM,IAAI,KAAK,CAAC,2CAA2C,CAAC,CAAC;IAC/D,CAAC;IAED,OAAO;QACL,cAAc,EAAE,CAAC,QAAQ,EAAE,EAAE,CAAC,cAAc,CAAC,QAAQ,CAAC;KACvD,CAAC;AACJ,CAAC;AAED;;;GAGG;AACH,SAAS,qBAAqB;IAC5B,MAAM,CAAC,KAAK,GAAG,CAAC,EAAE,KAAK,GAAG,CAAC,CAAC,GAAG,OAAO,CAAC,QAAQ,CAAC,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC;IACtF,MAAM,SAAS,GACb,CAAC,KAAK,KAAK,EAAE,IAAI,KAAK,IAAI,EAAE,CAAC,IAAI,CAAC,KAAK,KAAK,EAAE,IAAI,KAAK,IAAI,CAAC,CAAC,IAAI,KAAK,IAAI,EAAE,CAAC;IAC/E,IAAI,CAAC,SAAS,EAAE,CAAC;QACf,MAAM,IAAI,KAAK,CACb,6EAA6E,OAAO,CAAC,QAAQ,CAAC,IAAI,EAAE,CACrG,CAAC;IACJ,CAAC;AACH,CAAC"}

package/dist/ssl/acme-manager.d.ts

@@ -0,0 +1,51 @@
+import tls from "node:tls";
+export interface AcmeManagerOptions {
+    rootPath: string;
+    domains: string[];
+    email: string;
+    staging?: boolean;
+}
+export interface AcmeCertMaterial {
+    /** 개인키 PEM */
+    key: string;
+    /** 인증서 체인 PEM */
+    cert: string;
+}
+/**
+ * Let's Encrypt(ACME) 인증서 자동 발급·갱신 매니저.
+ *
+ * TLS-ALPN-01 챌린지로 발급한다. 챌린지 응답 인증서는 {@link getChallengeContext} 로 노출하여
+ * 서버의 ALPNCallback 이 `acme-tls/1` 핸드셰이크에 주입한다.
+ */
+export declare class AcmeManager {
+    private readonly _options;
+    private readonly _dir;
+    private _challengeContext;
+    private _renewTimer;
+    private _onRenew;
+    constructor(_options: AcmeManagerOptions);
+    private get _accountKeyPath();
+    private get _certPath();
+    private get _certKeyPath();
+    /** ALPNCallback 에서 사용할 현재 챌린지 컨텍스트 (챌린지 진행 중에만 존재) */
+    getChallengeContext(): tls.SecureContext | undefined;
+    /** 갱신 성공 시 호출될 핸들러 등록 (무중단 핫스왑용) */
+    onRenew(handler: (material: AcmeCertMaterial) => void): void;
+    /**
+     * 적용할 인증서를 확보한다.
+     * 캐시된 유효 인증서가 있으면 로드, 없으면(또는 만료 임박) 신규 발급.
+     * 발급 실패 시 throw (하이브리드 기동: 최초 발급 실패는 기동 실패).
+     */
+    ensureCertificate(): Promise<AcmeCertMaterial>;
+    /** 갱신 타이머 정리 */
+    stop(): void;
+    private _loadValidCachedCert;
+    private _directoryUrl;
+    private _getAccountKey;
+    private _issue;
+    private _scheduleRenewal;
+    /** 긴 지연(>24.8일)은 setTimeout 오버플로를 피해 분할 무장 */
+    private _armTimer;
+    private _renew;
+}
+//# sourceMappingURL=acme-manager.d.ts.map

package/dist/ssl/acme-manager.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"acme-manager.d.ts","sourceRoot":"","sources":["../../src/ssl/acme-manager.ts"],"names":[],"mappings":"AACA,OAAO,GAAG,MAAM,UAAU,CAAC;AAe3B,MAAM,WAAW,kBAAkB;IACjC,QAAQ,EAAE,MAAM,CAAC;IACjB,OAAO,EAAE,MAAM,EAAE,CAAC;IAClB,KAAK,EAAE,MAAM,CAAC;IACd,OAAO,CAAC,EAAE,OAAO,CAAC;CACnB;AAED,MAAM,WAAW,gBAAgB;IAC/B,cAAc;IACd,GAAG,EAAE,MAAM,CAAC;IACZ,iBAAiB;IACjB,IAAI,EAAE,MAAM,CAAC;CACd;AAED;;;;;GAKG;AACH,qBAAa,WAAW;IAMV,OAAO,CAAC,QAAQ,CAAC,QAAQ;IALrC,OAAO,CAAC,QAAQ,CAAC,IAAI,CAAS;IAC9B,OAAO,CAAC,iBAAiB,CAAgC;IACzD,OAAO,CAAC,WAAW,CAA6B;IAChD,OAAO,CAAC,QAAQ,CAAqD;gBAExC,QAAQ,EAAE,kBAAkB;IAIzD,OAAO,KAAK,eAAe,GAE1B;IACD,OAAO,KAAK,SAAS,GAEpB;IACD,OAAO,KAAK,YAAY,GAEvB;IAED,sDAAsD;IACtD,mBAAmB,IAAI,GAAG,CAAC,aAAa,GAAG,SAAS;IAIpD,oCAAoC;IACpC,OAAO,CAAC,OAAO,EAAE,CAAC,QAAQ,EAAE,gBAAgB,KAAK,IAAI,GAAG,IAAI;IAI5D;;;;OAIG;IACG,iBAAiB,IAAI,OAAO,CAAC,gBAAgB,CAAC;IAYpD,gBAAgB;IAChB,IAAI,IAAI,IAAI;YAOE,oBAAoB;IAiClC,OAAO,CAAC,aAAa;YAUP,cAAc;YAUd,MAAM;IA0CpB,OAAO,CAAC,gBAAgB;IAKxB,8CAA8C;IAC9C,OAAO,CAAC,SAAS;YASH,MAAM;CAarB"}

package/dist/ssl/acme-manager.js

@@ -0,0 +1,176 @@
+import * as acme from "acme-client";
+import tls from "node:tls";
+import { chmod } from "node:fs/promises";
+import path from "node:path";
+import { fsx } from "@simplysm/core-node";
+import { createLogger, env } from "@simplysm/core-common";
+const logger = createLogger("service-server:AcmeManager");
+/** 만료 이 시점 전이면 갱신 (30일) */
+const RENEW_BEFORE_MS = 30 * 24 * 60 * 60 * 1000;
+/** 갱신 실패 시 재시도 간격 (1시간) */
+const RETRY_DELAY_MS = 60 * 60 * 1000;
+/** setTimeout 최대 지연 (약 24.8일). 초과 시 분할하여 재무장 */
+const MAX_TIMER_DELAY_MS = 2 ** 31 - 1;
+/**
+ * Let's Encrypt(ACME) 인증서 자동 발급·갱신 매니저.
+ *
+ * TLS-ALPN-01 챌린지로 발급한다. 챌린지 응답 인증서는 {@link getChallengeContext} 로 노출하여
+ * 서버의 ALPNCallback 이 `acme-tls/1` 핸드셰이크에 주입한다.
+ */
+export class AcmeManager {
+    _options;
+    _dir;
+    _challengeContext;
+    _renewTimer;
+    _onRenew;
+    constructor(_options) {
+        this._options = _options;
+        this._dir = path.resolve(_options.rootPath, ".acme");
+    }
+    get _accountKeyPath() {
+        return path.resolve(this._dir, "account.key");
+    }
+    get _certPath() {
+        return path.resolve(this._dir, "cert.pem");
+    }
+    get _certKeyPath() {
+        return path.resolve(this._dir, "cert.key");
+    }
+    /** ALPNCallback 에서 사용할 현재 챌린지 컨텍스트 (챌린지 진행 중에만 존재) */
+    getChallengeContext() {
+        return this._challengeContext;
+    }
+    /** 갱신 성공 시 호출될 핸들러 등록 (무중단 핫스왑용) */
+    onRenew(handler) {
+        this._onRenew = handler;
+    }
+    /**
+     * 적용할 인증서를 확보한다.
+     * 캐시된 유효 인증서가 있으면 로드, 없으면(또는 만료 임박) 신규 발급.
+     * 발급 실패 시 throw (하이브리드 기동: 최초 발급 실패는 기동 실패).
+     */
+    async ensureCertificate() {
+        const cached = await this._loadValidCachedCert();
+        if (cached != null) {
+            logger.info(`캐시된 인증서 사용 (만료: ${cached.notAfter.toISOString()})`);
+            this._scheduleRenewal(cached.notAfter);
+            return { key: cached.key, cert: cached.cert };
+        }
+        logger.info("유효한 캐시 인증서 없음. 신규 발급을 시작합니다.");
+        return this._issue();
+    }
+    /** 갱신 타이머 정리 */
+    stop() {
+        if (this._renewTimer != null) {
+            clearTimeout(this._renewTimer);
+            this._renewTimer = undefined;
+        }
+    }
+    async _loadValidCachedCert() {
+        if (!(await fsx.exists(this._certPath)) || !(await fsx.exists(this._certKeyPath))) {
+            return undefined;
+        }
+        const cert = await fsx.read(this._certPath);
+        const key = await fsx.read(this._certKeyPath);
+        let info;
+        try {
+            info = acme.crypto.readCertificateInfo(cert);
+        }
+        catch (err) {
+            logger.warn("캐시 인증서 파싱 실패. 재발급을 진행합니다.", err);
+            return undefined;
+        }
+        // 만료 30일 이내면 캐시 무효 처리 (즉시 갱신 대상)
+        if (info.notAfter.getTime() - Date.now() <= RENEW_BEFORE_MS) {
+            return undefined;
+        }
+        // 요청 도메인을 모두 포함하는지 확인
+        const certDomains = new Set([info.domains.commonName, ...info.domains.altNames]);
+        if (!this._options.domains.every((d) => certDomains.has(d))) {
+            logger.info("캐시 인증서가 요청 도메인을 모두 포함하지 않음. 재발급을 진행합니다.");
+            return undefined;
+        }
+        return { key, cert, notAfter: info.notAfter };
+    }
+    _directoryUrl() {
+        // 운영 환경 변수로 ACME 디렉토리 URL 재정의 가능 (사설 CA·테스트용 pebble 등)
+        const override = env("SD_ACME_DIRECTORY_URL");
+        if (override != null && override !== "")
+            return override;
+        return this._options.staging === true
+            ? acme.directory.letsencrypt.staging
+            : acme.directory.letsencrypt.production;
+    }
+    async _getAccountKey() {
+        if (await fsx.exists(this._accountKeyPath)) {
+            return fsx.read(this._accountKeyPath);
+        }
+        const accountKey = (await acme.crypto.createPrivateRsaKey()).toString();
+        await fsx.write(this._accountKeyPath, accountKey);
+        await chmod(this._accountKeyPath, 0o600).catch(() => { });
+        return accountKey;
+    }
+    async _issue() {
+        const accountKey = await this._getAccountKey();
+        const client = new acme.Client({ directoryUrl: this._directoryUrl(), accountKey });
+        const [certKey, csr] = await acme.crypto.createCsr({
+            commonName: this._options.domains[0],
+            altNames: this._options.domains,
+        });
+        const cert = await client.auto({
+            csr,
+            email: this._options.email,
+            termsOfServiceAgreed: true,
+            challengePriority: ["tls-alpn-01"],
+            // 로컬 사전검증(발급 호스트가 자기 공개 도메인:443 으로 hairpin 접속) 생략.
+            // 망 구성에 따라 hairpin 이 막힐 수 있고, 실검증은 CA(LE) 가 직접 수행한다.
+            skipChallengeVerification: true,
+            // challengePriority 를 tls-alpn-01 로 고정했으므로 이 콜백은 항상 tls-alpn-01 챌린지로 호출된다.
+            challengeCreateFn: async (authz, _challenge, keyAuthorization) => {
+                const [alpnKey, alpnCert] = await acme.crypto.createAlpnCertificate(authz, keyAuthorization);
+                this._challengeContext = tls.createSecureContext({ key: alpnKey, cert: alpnCert });
+            },
+            challengeRemoveFn: () => {
+                this._challengeContext = undefined;
+                return Promise.resolve();
+            },
+        });
+        const keyPem = certKey.toString();
+        await fsx.write(this._certPath, cert);
+        await fsx.write(this._certKeyPath, keyPem);
+        await chmod(this._certKeyPath, 0o600).catch(() => { });
+        const info = acme.crypto.readCertificateInfo(cert);
+        logger.info(`인증서 발급 완료 (도메인: ${this._options.domains.join(", ")}, 만료: ${info.notAfter.toISOString()})`);
+        this._scheduleRenewal(info.notAfter);
+        return { key: keyPem, cert };
+    }
+    _scheduleRenewal(notAfter) {
+        this.stop();
+        this._armTimer(notAfter.getTime() - RENEW_BEFORE_MS);
+    }
+    /** 긴 지연(>24.8일)은 setTimeout 오버플로를 피해 분할 무장 */
+    _armTimer(targetTime) {
+        const remaining = Math.max(0, targetTime - Date.now());
+        if (remaining > MAX_TIMER_DELAY_MS) {
+            this._renewTimer = setTimeout(() => this._armTimer(targetTime), MAX_TIMER_DELAY_MS);
+        }
+        else {
+            this._renewTimer = setTimeout(() => void this._renew(), remaining);
+        }
+    }
+    async _renew() {
+        try {
+            logger.info("인증서 갱신을 시작합니다.");
+            const material = await this._issue();
+            this._onRenew?.(material);
+            logger.info("인증서 갱신 및 적용이 완료되었습니다.");
+        }
+        catch (err) {
+            // 갱신 실패는 문제 발생 사실이므로 error. 기존 유효 인증서로 계속 서비스하며 재시도.
+            logger.error("인증서 갱신 실패. 기존 인증서를 유지하고 재시도를 예약합니다.", err);
+            this.stop();
+            this._renewTimer = setTimeout(() => void this._renew(), RETRY_DELAY_MS);
+        }
+    }
+}
+//# sourceMappingURL=acme-manager.js.map

package/dist/ssl/acme-manager.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"acme-manager.js","sourceRoot":"","sources":["../../src/ssl/acme-manager.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,IAAI,MAAM,aAAa,CAAC;AACpC,OAAO,GAAG,MAAM,UAAU,CAAC;AAC3B,OAAO,EAAE,KAAK,EAAE,MAAM,kBAAkB,CAAC;AACzC,OAAO,IAAI,MAAM,WAAW,CAAC;AAC7B,OAAO,EAAE,GAAG,EAAE,MAAM,qBAAqB,CAAC;AAC1C,OAAO,EAAE,YAAY,EAAE,GAAG,EAAE,MAAM,uBAAuB,CAAC;AAE1D,MAAM,MAAM,GAAG,YAAY,CAAC,4BAA4B,CAAC,CAAC;AAE1D,2BAA2B;AAC3B,MAAM,eAAe,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,IAAI,CAAC;AACjD,2BAA2B;AAC3B,MAAM,cAAc,GAAG,EAAE,GAAG,EAAE,GAAG,IAAI,CAAC;AACtC,gDAAgD;AAChD,MAAM,kBAAkB,GAAG,CAAC,IAAI,EAAE,GAAG,CAAC,CAAC;AAgBvC;;;;;GAKG;AACH,MAAM,OAAO,WAAW;IAMO;IALZ,IAAI,CAAS;IACtB,iBAAiB,CAAgC;IACjD,WAAW,CAA6B;IACxC,QAAQ,CAAqD;IAErE,YAA6B,QAA4B;QAA5B,aAAQ,GAAR,QAAQ,CAAoB;QACvD,IAAI,CAAC,IAAI,GAAG,IAAI,CAAC,OAAO,CAAC,QAAQ,CAAC,QAAQ,EAAE,OAAO,CAAC,CAAC;IACvD,CAAC;IAED,IAAY,eAAe;QACzB,OAAO,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,IAAI,EAAE,aAAa,CAAC,CAAC;IAChD,CAAC;IACD,IAAY,SAAS;QACnB,OAAO,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,IAAI,EAAE,UAAU,CAAC,CAAC;IAC7C,CAAC;IACD,IAAY,YAAY;QACtB,OAAO,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,IAAI,EAAE,UAAU,CAAC,CAAC;IAC7C,CAAC;IAED,sDAAsD;IACtD,mBAAmB;QACjB,OAAO,IAAI,CAAC,iBAAiB,CAAC;IAChC,CAAC;IAED,oCAAoC;IACpC,OAAO,CAAC,OAA6C;QACnD,IAAI,CAAC,QAAQ,GAAG,OAAO,CAAC;IAC1B,CAAC;IAED;;;;OAIG;IACH,KAAK,CAAC,iBAAiB;QACrB,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,oBAAoB,EAAE,CAAC;QACjD,IAAI,MAAM,IAAI,IAAI,EAAE,CAAC;YACnB,MAAM,CAAC,IAAI,CAAC,mBAAmB,MAAM,CAAC,QAAQ,CAAC,WAAW,EAAE,GAAG,CAAC,CAAC;YACjE,IAAI,CAAC,gBAAgB,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC;YACvC,OAAO,EAAE,GAAG,EAAE,MAAM,CAAC,GAAG,EAAE,IAAI,EAAE,MAAM,CAAC,IAAI,EAAE,CAAC;QAChD,CAAC;QAED,MAAM,CAAC,IAAI,CAAC,8BAA8B,CAAC,CAAC;QAC5C,OAAO,IAAI,CAAC,MAAM,EAAE,CAAC;IACvB,CAAC;IAED,gBAAgB;IAChB,IAAI;QACF,IAAI,IAAI,CAAC,WAAW,IAAI,IAAI,EAAE,CAAC;YAC7B,YAAY,CAAC,IAAI,CAAC,WAAW,CAAC,CAAC;YAC/B,IAAI,CAAC,WAAW,GAAG,SAAS,CAAC;QAC/B,CAAC;IACH,CAAC;IAEO,KAAK,CAAC,oBAAoB;QAGhC,IAAI,CAAC,CAAC,MAAM,GAAG,CAAC,MAAM,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC,IAAI,CAAC,CAAC,MAAM,GAAG,CAAC,MAAM,CAAC,IAAI,CAAC,YAAY,CAAC,CAAC,EAAE,CAAC;YAClF,OAAO,SAAS,CAAC;QACnB,CAAC;QAED,MAAM,IAAI,GAAG,MAAM,GAAG,CAAC,IAAI,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC;QAC5C,MAAM,GAAG,GAAG,MAAM,GAAG,CAAC,IAAI,CAAC,IAAI,CAAC,YAAY,CAAC,CAAC;QAE9C,IAAI,IAAI,CAAC;QACT,IAAI,CAAC;YACH,IAAI,GAAG,IAAI,CAAC,MAAM,CAAC,mBAAmB,CAAC,IAAI,CAAC,CAAC;QAC/C,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,MAAM,CAAC,IAAI,CAAC,2BAA2B,EAAE,GAAG,CAAC,CAAC;YAC9C,OAAO,SAAS,CAAC;QACnB,CAAC;QAED,iCAAiC;QACjC,IAAI,IAAI,CAAC,QAAQ,CAAC,OAAO,EAAE,GAAG,IAAI,CAAC,GAAG,EAAE,IAAI,eAAe,EAAE,CAAC;YAC5D,OAAO,SAAS,CAAC;QACnB,CAAC;QAED,sBAAsB;QACtB,MAAM,WAAW,GAAG,IAAI,GAAG,CAAC,CAAC,IAAI,CAAC,OAAO,CAAC,UAAU,EAAE,GAAG,IAAI,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAC,CAAC;QACjF,IAAI,CAAC,IAAI,CAAC,QAAQ,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,WAAW,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;YAC5D,MAAM,CAAC,IAAI,CAAC,yCAAyC,CAAC,CAAC;YACvD,OAAO,SAAS,CAAC;QACnB,CAAC;QAED,OAAO,EAAE,GAAG,EAAE,IAAI,EAAE,QAAQ,EAAE,IAAI,CAAC,QAAQ,EAAE,CAAC;IAChD,CAAC;IAEO,aAAa;QACnB,uDAAuD;QACvD,MAAM,QAAQ,GAAG,GAAG,CAAC,uBAAuB,CAAC,CAAC;QAC9C,IAAI,QAAQ,IAAI,IAAI,IAAI,QAAQ,KAAK,EAAE;YAAE,OAAO,QAAQ,CAAC;QAEzD,OAAO,IAAI,CAAC,QAAQ,CAAC,OAAO,KAAK,IAAI;YACnC,CAAC,CAAC,IAAI,CAAC,SAAS,CAAC,WAAW,CAAC,OAAO;YACpC,CAAC,CAAC,IAAI,CAAC,SAAS,CAAC,WAAW,CAAC,UAAU,CAAC;IAC5C,CAAC;IAEO,KAAK,CAAC,cAAc;QAC1B,IAAI,MAAM,GAAG,CAAC,MAAM,CAAC,IAAI,CAAC,eAAe,CAAC,EAAE,CAAC;YAC3C,OAAO,GAAG,CAAC,IAAI,CAAC,IAAI,CAAC,eAAe,CAAC,CAAC;QACxC,CAAC;QACD,MAAM,UAAU,GAAG,CAAC,MAAM,IAAI,CAAC,MAAM,CAAC,mBAAmB,EAAE,CAAC,CAAC,QAAQ,EAAE,CAAC;QACxE,MAAM,GAAG,CAAC,KAAK,CAAC,IAAI,CAAC,eAAe,EAAE,UAAU,CAAC,CAAC;QAClD,MAAM,KAAK,CAAC,IAAI,CAAC,eAAe,EAAE,KAAK,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE,GAAE,CAAC,CAAC,CAAC;QACzD,OAAO,UAAU,CAAC;IACpB,CAAC;IAEO,KAAK,CAAC,MAAM;QAClB,MAAM,UAAU,GAAG,MAAM,IAAI,CAAC,cAAc,EAAE,CAAC;QAC/C,MAAM,MAAM,GAAG,IAAI,IAAI,CAAC,MAAM,CAAC,EAAE,YAAY,EAAE,IAAI,CAAC,aAAa,EAAE,EAAE,UAAU,EAAE,CAAC,CAAC;QAEnF,MAAM,CAAC,OAAO,EAAE,GAAG,CAAC,GAAG,MAAM,IAAI,CAAC,MAAM,CAAC,SAAS,CAAC;YACjD,UAAU,EAAE,IAAI,CAAC,QAAQ,CAAC,OAAO,CAAC,CAAC,CAAC;YACpC,QAAQ,EAAE,IAAI,CAAC,QAAQ,CAAC,OAAO;SAChC,CAAC,CAAC;QAEH,MAAM,IAAI,GAAG,MAAM,MAAM,CAAC,IAAI,CAAC;YAC7B,GAAG;YACH,KAAK,EAAE,IAAI,CAAC,QAAQ,CAAC,KAAK;YAC1B,oBAAoB,EAAE,IAAI;YAC1B,iBAAiB,EAAE,CAAC,aAAa,CAAC;YAClC,mDAAmD;YACnD,qDAAqD;YACrD,yBAAyB,EAAE,IAAI;YAC/B,2EAA2E;YAC3E,iBAAiB,EAAE,KAAK,EAAE,KAAK,EAAE,UAAU,EAAE,gBAAgB,EAAE,EAAE;gBAC/D,MAAM,CAAC,OAAO,EAAE,QAAQ,CAAC,GAAG,MAAM,IAAI,CAAC,MAAM,CAAC,qBAAqB,CAAC,KAAK,EAAE,gBAAgB,CAAC,CAAC;gBAC7F,IAAI,CAAC,iBAAiB,GAAG,GAAG,CAAC,mBAAmB,CAAC,EAAE,GAAG,EAAE,OAAO,EAAE,IAAI,EAAE,QAAQ,EAAE,CAAC,CAAC;YACrF,CAAC;YACD,iBAAiB,EAAE,GAAG,EAAE;gBACtB,IAAI,CAAC,iBAAiB,GAAG,SAAS,CAAC;gBACnC,OAAO,OAAO,CAAC,OAAO,EAAE,CAAC;YAC3B,CAAC;SACF,CAAC,CAAC;QAEH,MAAM,MAAM,GAAG,OAAO,CAAC,QAAQ,EAAE,CAAC;QAClC,MAAM,GAAG,CAAC,KAAK,CAAC,IAAI,CAAC,SAAS,EAAE,IAAI,CAAC,CAAC;QACtC,MAAM,GAAG,CAAC,KAAK,CAAC,IAAI,CAAC,YAAY,EAAE,MAAM,CAAC,CAAC;QAC3C,MAAM,KAAK,CAAC,IAAI,CAAC,YAAY,EAAE,KAAK,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE,GAAE,CAAC,CAAC,CAAC;QAEtD,MAAM,IAAI,GAAG,IAAI,CAAC,MAAM,CAAC,mBAAmB,CAAC,IAAI,CAAC,CAAC;QACnD,MAAM,CAAC,IAAI,CACT,mBAAmB,IAAI,CAAC,QAAQ,CAAC,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,SAAS,IAAI,CAAC,QAAQ,CAAC,WAAW,EAAE,GAAG,CAC3F,CAAC;QACF,IAAI,CAAC,gBAAgB,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;QAErC,OAAO,EAAE,GAAG,EAAE,MAAM,EAAE,IAAI,EAAE,CAAC;IAC/B,CAAC;IAEO,gBAAgB,CAAC,QAAc;QACrC,IAAI,CAAC,IAAI,EAAE,CAAC;QACZ,IAAI,CAAC,SAAS,CAAC,QAAQ,CAAC,OAAO,EAAE,GAAG,eAAe,CAAC,CAAC;IACvD,CAAC;IAED,8CAA8C;IACtC,SAAS,CAAC,UAAkB;QAClC,MAAM,SAAS,GAAG,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,UAAU,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC,CAAC;QACvD,IAAI,SAAS,GAAG,kBAAkB,EAAE,CAAC;YACnC,IAAI,CAAC,WAAW,GAAG,UAAU,CAAC,GAAG,EAAE,CAAC,IAAI,CAAC,SAAS,CAAC,UAAU,CAAC,EAAE,kBAAkB,CAAC,CAAC;QACtF,CAAC;aAAM,CAAC;YACN,IAAI,CAAC,WAAW,GAAG,UAAU,CAAC,GAAG,EAAE,CAAC,KAAK,IAAI,CAAC,MAAM,EAAE,EAAE,SAAS,CAAC,CAAC;QACrE,CAAC;IACH,CAAC;IAEO,KAAK,CAAC,MAAM;QAClB,IAAI,CAAC;YACH,MAAM,CAAC,IAAI,CAAC,gBAAgB,CAAC,CAAC;YAC9B,MAAM,QAAQ,GAAG,MAAM,IAAI,CAAC,MAAM,EAAE,CAAC;YACrC,IAAI,CAAC,QAAQ,EAAE,CAAC,QAAQ,CAAC,CAAC;YAC1B,MAAM,CAAC,IAAI,CAAC,uBAAuB,CAAC,CAAC;QACvC,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,qDAAqD;YACrD,MAAM,CAAC,KAAK,CAAC,qCAAqC,EAAE,GAAG,CAAC,CAAC;YACzD,IAAI,CAAC,IAAI,EAAE,CAAC;YACZ,IAAI,CAAC,WAAW,GAAG,UAAU,CAAC,GAAG,EAAE,CAAC,KAAK,IAAI,CAAC,MAAM,EAAE,EAAE,cAAc,CAAC,CAAC;QAC1E,CAAC;IACH,CAAC;CACF"}

package/dist/types/server-options.d.ts

@@ -5,7 +5,18 @@ export interface ServiceServerOptions {
     port: number;
     ssl?: {
         pfxBytes: Uint8Array;
-        passphrase: string;
+        passphrase?: string;
+    } | {
+        pemKeyBytes: Uint8Array;
+        certBytes: Uint8Array;
+        caBytes?: Uint8Array;
+        passphrase?: string;
+    } | {
+        letsencrypt: {
+            domains: string[];
+            email: string;
+            staging?: boolean;
+        };
     };
     auth?: {
         jwtSecret: string;

package/dist/types/server-options.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"server-options.d.ts","sourceRoot":"","sources":["../../src/types/server-options.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,iBAAiB,EAAE,MAAM,wBAAwB,CAAC;AAChE,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,kCAAkC,CAAC;AAEzE,MAAM,WAAW,oBAAoB;IACnC,QAAQ,EAAE,MAAM,CAAC;IACjB,IAAI,EAAE,MAAM,CAAC;IACb,GAAG,CAAC,EAAE;QACJ,QAAQ,EAAE,UAAU,CAAC;QACrB,UAAU,EAAE,MAAM,CAAC;KACpB,CAAC;IACF,IAAI,CAAC,EACD;QACE,SAAS,EAAE,MAAM,CAAC;KACnB,GACD,KAAK,CAAC;IACV,QAAQ,EAAE,iBAAiB,EAAE,CAAC;IAC9B,gBAAgB,CAAC,EAAE,gBAAgB,EAAE,CAAC;CACvC"}
+{"version":3,"file":"server-options.d.ts","sourceRoot":"","sources":["../../src/types/server-options.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,iBAAiB,EAAE,MAAM,wBAAwB,CAAC;AAChE,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,kCAAkC,CAAC;AAEzE,MAAM,WAAW,oBAAoB;IACnC,QAAQ,EAAE,MAAM,CAAC;IACjB,IAAI,EAAE,MAAM,CAAC;IACb,GAAG,CAAC,EACA;QACE,QAAQ,EAAE,UAAU,CAAC;QACrB,UAAU,CAAC,EAAE,MAAM,CAAC;KACrB,GACD;QACE,WAAW,EAAE,UAAU,CAAC;QACxB,SAAS,EAAE,UAAU,CAAC;QACtB,OAAO,CAAC,EAAE,UAAU,CAAC;QACrB,UAAU,CAAC,EAAE,MAAM,CAAC;KACrB,GACD;QACE,WAAW,EAAE;YACX,OAAO,EAAE,MAAM,EAAE,CAAC;YAClB,KAAK,EAAE,MAAM,CAAC;YACd,OAAO,CAAC,EAAE,OAAO,CAAC;SACnB,CAAC;KACH,CAAC;IACN,IAAI,CAAC,EACD;QACE,SAAS,EAAE,MAAM,CAAC;KACnB,GACD,KAAK,CAAC;IACV,QAAQ,EAAE,iBAAiB,EAAE,CAAC;IAC9B,gBAAgB,CAAC,EAAE,gBAAgB,EAAE,CAAC;CACvC"}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@simplysm/service-server",
-  "version": "14.0.97",
+  "version": "14.0.99",
   "description": "심플리즘 패키지 - 서비스 (server)",
   "author": "심플리즘",
   "license": "Apache-2.0",
@@ -23,17 +23,18 @@
     "@fastify/multipart": "^9.4.0",
     "@fastify/static": "^9.1.3",
     "@fastify/websocket": "^11.2.0",
+    "acme-client": "^5.4.0",
     "bufferutil": "^4.1.0",
     "fastify": "^5.8.5",
     "jose": "^6.2.3",
     "semver": "^7.8.4",
     "utf-8-validate": "^6.0.6",
     "ws": "^8.21.0",
-    "@simplysm/core-common": "14.0.97",
-    "@simplysm/orm-node": "14.0.97",
-    "@simplysm/orm-common": "14.0.97",
-    "@simplysm/core-node": "14.0.97",
-    "@simplysm/service-common": "14.0.97"
+    "@simplysm/core-common": "14.0.99",
+    "@simplysm/core-node": "14.0.99",
+    "@simplysm/orm-node": "14.0.99",
+    "@simplysm/orm-common": "14.0.99",
+    "@simplysm/service-common": "14.0.99"
   },
   "devDependencies": {
     "@types/semver": "^7.7.1",

package/src/service-server.ts

@@ -12,6 +12,9 @@ import fastifyHelmet from "@fastify/helmet";
 import fastifyCors from "@fastify/cors";
 import path from "path";
 import { Buffer } from "node:buffer";
+import type { TLSSocket } from "node:tls";
+import type * as https from "node:https";
+import { AcmeManager } from "./ssl/acme-manager";
 import { handleUpload } from "./transport/http/upload-handler";
 import { createWebSocketHandler } from "./transport/socket/websocket-handler";
 import type { WebSocket } from "ws";
@@ -40,6 +43,7 @@ export class ServiceServer<TAuthInfo = unknown> extends EventEmitter<{
   private readonly _wsHandler: ReturnType<typeof createWebSocketHandler>;
   private readonly _jwtSecret: string | undefined;
   private _shutdownRegistered = false;
+  private readonly _acmeManager: AcmeManager | undefined;
 
   readonly fastify: FastifyInstance;
 
@@ -49,11 +53,48 @@ export class ServiceServer<TAuthInfo = unknown> extends EventEmitter<{
     this._jwtSecret =
       options.auth != null && options.auth !== false ? options.auth.jwtSecret : undefined;
 
-    // SSL 설정 (동기)
+    // SSL 설정
     // 참고: Fastify HTTPS는 Buffer 타입이 필요함 (Uint8Array를 직접 사용할 수 없음)
-    const httpsConf = options.ssl
-      ? { pfx: Buffer.from(options.ssl.pfxBytes), passphrase: options.ssl.passphrase }
-      : null;
+    let httpsConf: https.ServerOptions | null = null;
+    if (options.ssl != null) {
+      if ("letsencrypt" in options.ssl) {
+        const acmeManager = new AcmeManager({
+          rootPath: options.rootPath,
+          domains: options.ssl.letsencrypt.domains,
+          email: options.ssl.letsencrypt.email,
+          staging: options.ssl.letsencrypt.staging,
+        });
+        this._acmeManager = acmeManager;
+
+        // 인증서 없이 ALPNCallback 만으로 HTTPS 서버 생성.
+        // 발급 전엔 acme-tls/1 챌린지에만 응답하고, 실인증서는 listen() 에서 setSecureContext 로 주입한다.
+        httpsConf = {
+          ALPNCallback: function (this: TLSSocket, { protocols }): string | undefined {
+            if (protocols.includes("acme-tls/1")) {
+              const ctx = acmeManager.getChallengeContext();
+              if (ctx != null) {
+                this.setKeyCert(ctx);
+                return "acme-tls/1";
+              }
+              return undefined;
+            }
+            return protocols.includes("http/1.1") ? "http/1.1" : undefined;
+          },
+        };
+      } else if ("pfxBytes" in options.ssl) {
+        httpsConf = {
+          pfx: Buffer.from(options.ssl.pfxBytes),
+          ...(options.ssl.passphrase != null ? { passphrase: options.ssl.passphrase } : {}),
+        };
+      } else {
+        httpsConf = {
+          key: Buffer.from(options.ssl.pemKeyBytes),
+          cert: Buffer.from(options.ssl.certBytes),
+          ...(options.ssl.caBytes != null ? { ca: Buffer.from(options.ssl.caBytes) } : {}),
+          ...(options.ssl.passphrase != null ? { passphrase: options.ssl.passphrase } : {}),
+        };
+      }
+    }
 
     this.fastify = fastify({ https: httpsConf });
 
@@ -66,6 +107,11 @@ export class ServiceServer<TAuthInfo = unknown> extends EventEmitter<{
   async listen(): Promise<void> {
     logger.info(`서버 시작 중... ${env("VER") ?? ""}`);
 
+    // letsencrypt 는 핸드셰이크 중 인증서를 주입하는 TLSSocket.setKeyCert 가 필요 (Node 20.18.0+/22.9.0+)
+    if (this._acmeManager != null) {
+      assertAcmeNodeSupport();
+    }
+
     // auth 설정 검증: auth 미설정(undefined)인데 auth 요구 서비스가 있으면 에러
     if (this.options.auth == null) {
       const authRequiredService = this.options.services.find((s) => s.authPermissions != null);
@@ -208,6 +254,17 @@ export class ServiceServer<TAuthInfo = unknown> extends EventEmitter<{
     // 리슨
     await this.fastify.listen({ port: this.options.port, host: "0.0.0.0" });
 
+    // Let's Encrypt: 리슨(443 바인딩) 후 인증서를 확보해 적용 (하이브리드 기동)
+    if (this._acmeManager != null) {
+      const server = this.fastify.server as unknown as https.Server;
+      const material = await this._acmeManager.ensureCertificate();
+      server.setSecureContext({ key: material.key, cert: material.cert });
+      this._acmeManager.onRenew((m) => {
+        server.setSecureContext({ key: m.key, cert: m.cert });
+        logger.info("갱신된 인증서가 적용되었습니다.");
+      });
+    }
+
     // 정상 종료 핸들러 등록
     this._registerGracefulShutdown();
 
@@ -217,6 +274,7 @@ export class ServiceServer<TAuthInfo = unknown> extends EventEmitter<{
   }
 
   async close(): Promise<void> {
+    this._acmeManager?.stop();
     this._wsHandler.closeAll();
     await this.fastify.close();
 
@@ -297,3 +355,18 @@ function createV1AutoUpdateMethods(
     getLastVersion: (platform) => getLastVersion(platform),
   };
 }
+
+/**
+ * Let's Encrypt(TLS-ALPN-01) 는 핸드셰이크 중 인증서를 주입하는 `TLSSocket.setKeyCert` 를 쓴다.
+ * 이 API 는 Node 20.18.0+ / 22.9.0+ 에서만 제공되므로 미만 버전이면 throw.
+ */
+function assertAcmeNodeSupport(): void {
+  const [major = 0, minor = 0] = process.versions.node.split(".").map((v) => Number(v));
+  const supported =
+    (major === 20 && minor >= 18) || (major === 22 && minor >= 9) || major >= 23;
+  if (!supported) {
+    throw new Error(
+      `Let's Encrypt(letsencrypt) SSL 은 Node 20.18.0+ 또는 22.9.0+ 가 필요합니다. 현재 버전: ${process.versions.node}`,
+    );
+  }
+}

package/src/ssl/acme-manager.ts

@@ -0,0 +1,215 @@
+import * as acme from "acme-client";
+import tls from "node:tls";
+import { chmod } from "node:fs/promises";
+import path from "node:path";
+import { fsx } from "@simplysm/core-node";
+import { createLogger, env } from "@simplysm/core-common";
+
+const logger = createLogger("service-server:AcmeManager");
+
+/** 만료 이 시점 전이면 갱신 (30일) */
+const RENEW_BEFORE_MS = 30 * 24 * 60 * 60 * 1000;
+/** 갱신 실패 시 재시도 간격 (1시간) */
+const RETRY_DELAY_MS = 60 * 60 * 1000;
+/** setTimeout 최대 지연 (약 24.8일). 초과 시 분할하여 재무장 */
+const MAX_TIMER_DELAY_MS = 2 ** 31 - 1;
+
+export interface AcmeManagerOptions {
+  rootPath: string;
+  domains: string[];
+  email: string;
+  staging?: boolean;
+}
+
+export interface AcmeCertMaterial {
+  /** 개인키 PEM */
+  key: string;
+  /** 인증서 체인 PEM */
+  cert: string;
+}
+
+/**
+ * Let's Encrypt(ACME) 인증서 자동 발급·갱신 매니저.
+ *
+ * TLS-ALPN-01 챌린지로 발급한다. 챌린지 응답 인증서는 {@link getChallengeContext} 로 노출하여
+ * 서버의 ALPNCallback 이 `acme-tls/1` 핸드셰이크에 주입한다.
+ */
+export class AcmeManager {
+  private readonly _dir: string;
+  private _challengeContext: tls.SecureContext | undefined;
+  private _renewTimer: NodeJS.Timeout | undefined;
+  private _onRenew: ((material: AcmeCertMaterial) => void) | undefined;
+
+  constructor(private readonly _options: AcmeManagerOptions) {
+    this._dir = path.resolve(_options.rootPath, ".acme");
+  }
+
+  private get _accountKeyPath(): string {
+    return path.resolve(this._dir, "account.key");
+  }
+  private get _certPath(): string {
+    return path.resolve(this._dir, "cert.pem");
+  }
+  private get _certKeyPath(): string {
+    return path.resolve(this._dir, "cert.key");
+  }
+
+  /** ALPNCallback 에서 사용할 현재 챌린지 컨텍스트 (챌린지 진행 중에만 존재) */
+  getChallengeContext(): tls.SecureContext | undefined {
+    return this._challengeContext;
+  }
+
+  /** 갱신 성공 시 호출될 핸들러 등록 (무중단 핫스왑용) */
+  onRenew(handler: (material: AcmeCertMaterial) => void): void {
+    this._onRenew = handler;
+  }
+
+  /**
+   * 적용할 인증서를 확보한다.
+   * 캐시된 유효 인증서가 있으면 로드, 없으면(또는 만료 임박) 신규 발급.
+   * 발급 실패 시 throw (하이브리드 기동: 최초 발급 실패는 기동 실패).
+   */
+  async ensureCertificate(): Promise<AcmeCertMaterial> {
+    const cached = await this._loadValidCachedCert();
+    if (cached != null) {
+      logger.info(`캐시된 인증서 사용 (만료: ${cached.notAfter.toISOString()})`);
+      this._scheduleRenewal(cached.notAfter);
+      return { key: cached.key, cert: cached.cert };
+    }
+
+    logger.info("유효한 캐시 인증서 없음. 신규 발급을 시작합니다.");
+    return this._issue();
+  }
+
+  /** 갱신 타이머 정리 */
+  stop(): void {
+    if (this._renewTimer != null) {
+      clearTimeout(this._renewTimer);
+      this._renewTimer = undefined;
+    }
+  }
+
+  private async _loadValidCachedCert(): Promise<
+    { key: string; cert: string; notAfter: Date } | undefined
+  > {
+    if (!(await fsx.exists(this._certPath)) || !(await fsx.exists(this._certKeyPath))) {
+      return undefined;
+    }
+
+    const cert = await fsx.read(this._certPath);
+    const key = await fsx.read(this._certKeyPath);
+
+    let info;
+    try {
+      info = acme.crypto.readCertificateInfo(cert);
+    } catch (err) {
+      logger.warn("캐시 인증서 파싱 실패. 재발급을 진행합니다.", err);
+      return undefined;
+    }
+
+    // 만료 30일 이내면 캐시 무효 처리 (즉시 갱신 대상)
+    if (info.notAfter.getTime() - Date.now() <= RENEW_BEFORE_MS) {
+      return undefined;
+    }
+
+    // 요청 도메인을 모두 포함하는지 확인
+    const certDomains = new Set([info.domains.commonName, ...info.domains.altNames]);
+    if (!this._options.domains.every((d) => certDomains.has(d))) {
+      logger.info("캐시 인증서가 요청 도메인을 모두 포함하지 않음. 재발급을 진행합니다.");
+      return undefined;
+    }
+
+    return { key, cert, notAfter: info.notAfter };
+  }
+
+  private _directoryUrl(): string {
+    // 운영 환경 변수로 ACME 디렉토리 URL 재정의 가능 (사설 CA·테스트용 pebble 등)
+    const override = env("SD_ACME_DIRECTORY_URL");
+    if (override != null && override !== "") return override;
+
+    return this._options.staging === true
+      ? acme.directory.letsencrypt.staging
+      : acme.directory.letsencrypt.production;
+  }
+
+  private async _getAccountKey(): Promise<string> {
+    if (await fsx.exists(this._accountKeyPath)) {
+      return fsx.read(this._accountKeyPath);
+    }
+    const accountKey = (await acme.crypto.createPrivateRsaKey()).toString();
+    await fsx.write(this._accountKeyPath, accountKey);
+    await chmod(this._accountKeyPath, 0o600).catch(() => {});
+    return accountKey;
+  }
+
+  private async _issue(): Promise<AcmeCertMaterial> {
+    const accountKey = await this._getAccountKey();
+    const client = new acme.Client({ directoryUrl: this._directoryUrl(), accountKey });
+
+    const [certKey, csr] = await acme.crypto.createCsr({
+      commonName: this._options.domains[0],
+      altNames: this._options.domains,
+    });
+
+    const cert = await client.auto({
+      csr,
+      email: this._options.email,
+      termsOfServiceAgreed: true,
+      challengePriority: ["tls-alpn-01"],
+      // 로컬 사전검증(발급 호스트가 자기 공개 도메인:443 으로 hairpin 접속) 생략.
+      // 망 구성에 따라 hairpin 이 막힐 수 있고, 실검증은 CA(LE) 가 직접 수행한다.
+      skipChallengeVerification: true,
+      // challengePriority 를 tls-alpn-01 로 고정했으므로 이 콜백은 항상 tls-alpn-01 챌린지로 호출된다.
+      challengeCreateFn: async (authz, _challenge, keyAuthorization) => {
+        const [alpnKey, alpnCert] = await acme.crypto.createAlpnCertificate(authz, keyAuthorization);
+        this._challengeContext = tls.createSecureContext({ key: alpnKey, cert: alpnCert });
+      },
+      challengeRemoveFn: () => {
+        this._challengeContext = undefined;
+        return Promise.resolve();
+      },
+    });
+
+    const keyPem = certKey.toString();
+    await fsx.write(this._certPath, cert);
+    await fsx.write(this._certKeyPath, keyPem);
+    await chmod(this._certKeyPath, 0o600).catch(() => {});
+
+    const info = acme.crypto.readCertificateInfo(cert);
+    logger.info(
+      `인증서 발급 완료 (도메인: ${this._options.domains.join(", ")}, 만료: ${info.notAfter.toISOString()})`,
+    );
+    this._scheduleRenewal(info.notAfter);
+
+    return { key: keyPem, cert };
+  }
+
+  private _scheduleRenewal(notAfter: Date): void {
+    this.stop();
+    this._armTimer(notAfter.getTime() - RENEW_BEFORE_MS);
+  }
+
+  /** 긴 지연(>24.8일)은 setTimeout 오버플로를 피해 분할 무장 */
+  private _armTimer(targetTime: number): void {
+    const remaining = Math.max(0, targetTime - Date.now());
+    if (remaining > MAX_TIMER_DELAY_MS) {
+      this._renewTimer = setTimeout(() => this._armTimer(targetTime), MAX_TIMER_DELAY_MS);
+    } else {
+      this._renewTimer = setTimeout(() => void this._renew(), remaining);
+    }
+  }
+
+  private async _renew(): Promise<void> {
+    try {
+      logger.info("인증서 갱신을 시작합니다.");
+      const material = await this._issue();
+      this._onRenew?.(material);
+      logger.info("인증서 갱신 및 적용이 완료되었습니다.");
+    } catch (err) {
+      // 갱신 실패는 문제 발생 사실이므로 error. 기존 유효 인증서로 계속 서비스하며 재시도.
+      logger.error("인증서 갱신 실패. 기존 인증서를 유지하고 재시도를 예약합니다.", err);
+      this.stop();
+      this._renewTimer = setTimeout(() => void this._renew(), RETRY_DELAY_MS);
+    }
+  }
+}

package/src/types/server-options.ts

@@ -4,10 +4,24 @@ import type { V1RequestHandler } from "../legacy/v1-auto-update-handler";
 export interface ServiceServerOptions {
   rootPath: string;
   port: number;
-  ssl?: {
-    pfxBytes: Uint8Array;
-    passphrase: string;
-  };
+  ssl?:
+    | {
+        pfxBytes: Uint8Array;
+        passphrase?: string;
+      }
+    | {
+        pemKeyBytes: Uint8Array;
+        certBytes: Uint8Array;
+        caBytes?: Uint8Array;
+        passphrase?: string;
+      }
+    | {
+        letsencrypt: {
+          domains: string[];
+          email: string;
+          staging?: boolean;
+        };
+      };
   auth?:
     | {
         jwtSecret: string;