@tapflowio/relay 0.8.1 → 0.9.0

package/dist/lib/cert/CloudflareDnsProvider.js

@@ -0,0 +1,93 @@
+// Cloudflare DNS-01 solver (issue #232). 사용자 자기 Cloudflare 계정 토큰으로 동작한다(BYO).
+// 토큰은 config가 아니라 env(TAPFLOW_CLOUDFLARE_TOKEN)에서 읽는다 — cloudflareDnsFromEnv 참고.
+const DEFAULT_API_BASE = 'https://api.cloudflare.com/client/v4';
+const TTL_SECONDS = 60;
+// DNS 공급자 API 호출이 무한 대기하지 않도록 하는 요청 타임아웃.
+export const DNS_API_TIMEOUT_MS = 30_000;
+export class CloudflareDnsProvider {
+    name = 'cloudflare';
+    token;
+    fetchFn;
+    apiBase;
+    fixedZoneName;
+    zoneIdCache = new Map();
+    constructor(opts) {
+        if (!opts.token)
+            throw new Error('Cloudflare API token is required (set TAPFLOW_CLOUDFLARE_TOKEN)');
+        this.token = opts.token;
+        this.fetchFn = opts.fetchFn ?? globalThis.fetch;
+        this.apiBase = opts.apiBase ?? DEFAULT_API_BASE;
+        this.fixedZoneName = opts.zoneName;
+    }
+    async setTxtRecord(fqdn, value) {
+        const zoneId = await this.zoneIdFor(fqdn);
+        const name = `_acme-challenge.${fqdn}`;
+        const existing = await this.findRecords(zoneId, 'TXT', name);
+        if (existing.some((r) => r.content === value))
+            return;
+        await this.request(`/zones/${zoneId}/dns_records`, 'POST', { type: 'TXT', name, content: value, ttl: TTL_SECONDS });
+    }
+    async removeTxtRecord(fqdn, value) {
+        const zoneId = await this.zoneIdFor(fqdn);
+        const name = `_acme-challenge.${fqdn}`;
+        const matches = (await this.findRecords(zoneId, 'TXT', name)).filter((r) => r.content === value);
+        for (const r of matches) {
+            await this.request(`/zones/${zoneId}/dns_records/${r.id}`, 'DELETE');
+        }
+    }
+    async upsertAddressRecord(fqdn, ip) {
+        const zoneId = await this.zoneIdFor(fqdn);
+        const type = ip.includes(':') ? 'AAAA' : 'A';
+        const existing = await this.findRecords(zoneId, type, fqdn);
+        const payload = { type, name: fqdn, content: ip, ttl: TTL_SECONDS };
+        if (existing.length > 0) {
+            await this.request(`/zones/${zoneId}/dns_records/${existing[0].id}`, 'PATCH', payload);
+        }
+        else {
+            await this.request(`/zones/${zoneId}/dns_records`, 'POST', payload);
+        }
+    }
+    async zoneIdFor(fqdn) {
+        const cacheKey = this.fixedZoneName ?? fqdn;
+        const cached = this.zoneIdCache.get(cacheKey);
+        if (cached)
+            return cached;
+        const zones = await this.request('/zones', 'GET');
+        const candidates = this.fixedZoneName
+            ? zones.filter((z) => z.name === this.fixedZoneName)
+            : zones.filter((z) => fqdn === z.name || fqdn.endsWith(`.${z.name}`));
+        // 가장 구체적인(최장 suffix) zone 우선
+        candidates.sort((a, b) => b.name.length - a.name.length);
+        const zone = candidates[0];
+        if (!zone)
+            throw new Error(`No Cloudflare zone found for ${fqdn}`);
+        this.zoneIdCache.set(cacheKey, zone.id);
+        return zone.id;
+    }
+    async findRecords(zoneId, type, name) {
+        const qs = new URLSearchParams({ type, name }).toString();
+        return this.request(`/zones/${zoneId}/dns_records?${qs}`, 'GET');
+    }
+    async request(path, method, body) {
+        const res = await this.fetchFn(`${this.apiBase}${path}`, {
+            method,
+            headers: { Authorization: `Bearer ${this.token}`, 'content-type': 'application/json' },
+            body: body === undefined ? undefined : JSON.stringify(body),
+            signal: AbortSignal.timeout(DNS_API_TIMEOUT_MS),
+        });
+        const data = (await res.json());
+        if (!res.ok || !data.success) {
+            const msg = data.errors?.map((e) => e.message).join('; ') || `HTTP ${res.status}`;
+            throw new Error(`Cloudflare API error: ${msg}`);
+        }
+        return data.result;
+    }
+}
+/** env(TAPFLOW_CLOUDFLARE_TOKEN)에서 토큰을 읽어 provider를 만든다. 토큰 미설정 시 throw. */
+export function cloudflareDnsFromEnv(zoneName) {
+    const token = process.env.TAPFLOW_CLOUDFLARE_TOKEN;
+    if (!token)
+        throw new Error('TAPFLOW_CLOUDFLARE_TOKEN is not set');
+    return new CloudflareDnsProvider({ token, zoneName });
+}
+//# sourceMappingURL=CloudflareDnsProvider.js.map

package/dist/lib/cert/CloudflareDnsProvider.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"CloudflareDnsProvider.js","sourceRoot":"","sources":["../../../src/lib/cert/CloudflareDnsProvider.ts"],"names":[],"mappings":"AAEA,8EAA8E;AAC9E,iFAAiF;AAEjF,MAAM,gBAAgB,GAAG,sCAAsC,CAAA;AAC/D,MAAM,WAAW,GAAG,EAAE,CAAA;AAQtB,0CAA0C;AAC1C,MAAM,CAAC,MAAM,kBAAkB,GAAG,MAAM,CAAA;AA8BxC,MAAM,OAAO,qBAAqB;IACvB,IAAI,GAAG,YAAY,CAAA;IACX,KAAK,CAAQ;IACb,OAAO,CAAW;IAClB,OAAO,CAAQ;IACf,aAAa,CAAS;IACtB,WAAW,GAAG,IAAI,GAAG,EAAkB,CAAA;IAExD,YAAY,IAAkC;QAC5C,IAAI,CAAC,IAAI,CAAC,KAAK;YAAE,MAAM,IAAI,KAAK,CAAC,iEAAiE,CAAC,CAAA;QACnG,IAAI,CAAC,KAAK,GAAG,IAAI,CAAC,KAAK,CAAA;QACvB,IAAI,CAAC,OAAO,GAAG,IAAI,CAAC,OAAO,IAAK,UAAU,CAAC,KAA8B,CAAA;QACzE,IAAI,CAAC,OAAO,GAAG,IAAI,CAAC,OAAO,IAAI,gBAAgB,CAAA;QAC/C,IAAI,CAAC,aAAa,GAAG,IAAI,CAAC,QAAQ,CAAA;IACpC,CAAC;IAED,KAAK,CAAC,YAAY,CAAC,IAAY,EAAE,KAAa;QAC5C,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,CAAA;QACzC,MAAM,IAAI,GAAG,mBAAmB,IAAI,EAAE,CAAA;QACtC,MAAM,QAAQ,GAAG,MAAM,IAAI,CAAC,WAAW,CAAC,MAAM,EAAE,KAAK,EAAE,IAAI,CAAC,CAAA;QAC5D,IAAI,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,OAAO,KAAK,KAAK,CAAC;YAAE,OAAM;QACrD,MAAM,IAAI,CAAC,OAAO,CAAC,UAAU,MAAM,cAAc,EAAE,MAAM,EAAE,EAAE,IAAI,EAAE,KAAK,EAAE,IAAI,EAAE,OAAO,EAAE,KAAK,EAAE,GAAG,EAAE,WAAW,EAAE,CAAC,CAAA;IACrH,CAAC;IAED,KAAK,CAAC,eAAe,CAAC,IAAY,EAAE,KAAa;QAC/C,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,CAAA;QACzC,MAAM,IAAI,GAAG,mBAAmB,IAAI,EAAE,CAAA;QACtC,MAAM,OAAO,GAAG,CAAC,MAAM,IAAI,CAAC,WAAW,CAAC,MAAM,EAAE,KAAK,EAAE,IAAI,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,OAAO,KAAK,KAAK,CAAC,CAAA;QAChG,KAAK,MAAM,CAAC,IAAI,OAAO,EAAE,CAAC;YACxB,MAAM,IAAI,CAAC,OAAO,CAAC,UAAU,MAAM,gBAAgB,CAAC,CAAC,EAAE,EAAE,EAAE,QAAQ,CAAC,CAAA;QACtE,CAAC;IACH,CAAC;IAED,KAAK,CAAC,mBAAmB,CAAC,IAAY,EAAE,EAAU;QAChD,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,CAAA;QACzC,MAAM,IAAI,GAAG,EAAE,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,GAAG,CAAA;QAC5C,MAAM,QAAQ,GAAG,MAAM,IAAI,CAAC,WAAW,CAAC,MAAM,EAAE,IAAI,EAAE,IAAI,CAAC,CAAA;QAC3D,MAAM,OAAO,GAAG,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,OAAO,EAAE,EAAE,EAAE,GAAG,EAAE,WAAW,EAAE,CAAA;QACnE,IAAI,QAAQ,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YACxB,MAAM,IAAI,CAAC,OAAO,CAAC,UAAU,MAAM,gBAAgB,QAAQ,CAAC,CAAC,CAAC,CAAC,EAAE,EAAE,EAAE,OAAO,EAAE,OAAO,CAAC,CAAA;QACxF,CAAC;aAAM,CAAC;YACN,MAAM,IAAI,CAAC,OAAO,CAAC,UAAU,MAAM,cAAc,EAAE,MAAM,EAAE,OAAO,CAAC,CAAA;QACrE,CAAC;IACH,CAAC;IAEO,KAAK,CAAC,SAAS,CAAC,IAAY;QAClC,MAAM,QAAQ,GAAG,IAAI,CAAC,aAAa,IAAI,IAAI,CAAA;QAC3C,MAAM,MAAM,GAAG,IAAI,CAAC,WAAW,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAA;QAC7C,IAAI,MAAM;YAAE,OAAO,MAAM,CAAA;QAEzB,MAAM,KAAK,GAAG,MAAM,IAAI,CAAC,OAAO,CAAW,QAAQ,EAAE,KAAK,CAAC,CAAA;QAC3D,MAAM,UAAU,GAAG,IAAI,CAAC,aAAa;YACnC,CAAC,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,KAAK,IAAI,CAAC,aAAa,CAAC;YACpD,CAAC,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,IAAI,KAAK,CAAC,CAAC,IAAI,IAAI,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC,CAAA;QACvE,6BAA6B;QAC7B,UAAU,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,MAAM,GAAG,CAAC,CAAC,IAAI,CAAC,MAAM,CAAC,CAAA;QACxD,MAAM,IAAI,GAAG,UAAU,CAAC,CAAC,CAAC,CAAA;QAC1B,IAAI,CAAC,IAAI;YAAE,MAAM,IAAI,KAAK,CAAC,gCAAgC,IAAI,EAAE,CAAC,CAAA;QAClE,IAAI,CAAC,WAAW,CAAC,GAAG,CAAC,QAAQ,EAAE,IAAI,CAAC,EAAE,CAAC,CAAA;QACvC,OAAO,IAAI,CAAC,EAAE,CAAA;IAChB,CAAC;IAEO,KAAK,CAAC,WAAW,CAAC,MAAc,EAAE,IAAY,EAAE,IAAY;QAClE,MAAM,EAAE,GAAG,IAAI,eAAe,CAAC,EAAE,IAAI,EAAE,IAAI,EAAE,CAAC,CAAC,QAAQ,EAAE,CAAA;QACzD,OAAO,IAAI,CAAC,OAAO,CAAa,UAAU,MAAM,gBAAgB,EAAE,EAAE,EAAE,KAAK,CAAC,CAAA;IAC9E,CAAC;IAEO,KAAK,CAAC,OAAO,CAAI,IAAY,EAAE,MAAc,EAAE,IAAc;QACnE,MAAM,GAAG,GAAG,MAAM,IAAI,CAAC,OAAO,CAAC,GAAG,IAAI,CAAC,OAAO,GAAG,IAAI,EAAE,EAAE;YACvD,MAAM;YACN,OAAO,EAAE,EAAE,aAAa,EAAE,UAAU,IAAI,CAAC,KAAK,EAAE,EAAE,cAAc,EAAE,kBAAkB,EAAE;YACtF,IAAI,EAAE,IAAI,KAAK,SAAS,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC;YAC3D,MAAM,EAAE,WAAW,CAAC,OAAO,CAAC,kBAAkB,CAAC;SAChD,CAAC,CAAA;QACF,MAAM,IAAI,GAAG,CAAC,MAAM,GAAG,CAAC,IAAI,EAAE,CAAkB,CAAA;QAChD,IAAI,CAAC,GAAG,CAAC,EAAE,IAAI,CAAC,IAAI,CAAC,OAAO,EAAE,CAAC;YAC7B,MAAM,GAAG,GAAG,IAAI,CAAC,MAAM,EAAE,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,QAAQ,GAAG,CAAC,MAAM,EAAE,CAAA;YACjF,MAAM,IAAI,KAAK,CAAC,yBAAyB,GAAG,EAAE,CAAC,CAAA;QACjD,CAAC;QACD,OAAO,IAAI,CAAC,MAAM,CAAA;IACpB,CAAC;CACF;AAED,4EAA4E;AAC5E,MAAM,UAAU,oBAAoB,CAAC,QAAiB;IACpD,MAAM,KAAK,GAAG,OAAO,CAAC,GAAG,CAAC,wBAAwB,CAAA;IAClD,IAAI,CAAC,KAAK;QAAE,MAAM,IAAI,KAAK,CAAC,qCAAqC,CAAC,CAAA;IAClE,OAAO,IAAI,qBAAqB,CAAC,EAAE,KAAK,EAAE,QAAQ,EAAE,CAAC,CAAA;AACvD,CAAC"}

package/dist/lib/cert/DiskCertStore.d.ts

@@ -0,0 +1,10 @@
+import type { CertStore } from './AcmeCertProvider.js';
+import type { CertMaterial } from './CertProvider.js';
+export declare class DiskCertStore implements CertStore {
+    private readonly certPath;
+    private readonly keyPath;
+    constructor(dir: string);
+    load(): Promise<CertMaterial | null>;
+    save(material: CertMaterial): Promise<void>;
+}
+//# sourceMappingURL=DiskCertStore.d.ts.map

package/dist/lib/cert/DiskCertStore.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"DiskCertStore.d.ts","sourceRoot":"","sources":["../../../src/lib/cert/DiskCertStore.ts"],"names":[],"mappings":"AAEA,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,uBAAuB,CAAA;AACtD,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,mBAAmB,CAAA;AAKrD,qBAAa,aAAc,YAAW,SAAS;IAC7C,OAAO,CAAC,QAAQ,CAAC,QAAQ,CAAQ;IACjC,OAAO,CAAC,QAAQ,CAAC,OAAO,CAAQ;gBAEpB,GAAG,EAAE,MAAM;IAKjB,IAAI,IAAI,OAAO,CAAC,YAAY,GAAG,IAAI,CAAC;IAUpC,IAAI,CAAC,QAAQ,EAAE,YAAY,GAAG,OAAO,CAAC,IAAI,CAAC;CAUlD"}

package/dist/lib/cert/DiskCertStore.js

@@ -0,0 +1,35 @@
+import fs from 'fs';
+import path from 'path';
+import { parseCertNotAfter } from './parseCert.js';
+// cert/key를 디스크에 영속화한다. 만료는 저장값이 아니라 cert에서 파싱(드리프트 방지).
+// 키 파일은 0600(JWT secret과 동일 패턴) — 개인키는 소유자만 읽는다.
+export class DiskCertStore {
+    certPath;
+    keyPath;
+    constructor(dir) {
+        this.certPath = path.join(dir, 'cert.pem');
+        this.keyPath = path.join(dir, 'key.pem');
+    }
+    async load() {
+        try {
+            const cert = fs.readFileSync(this.certPath, 'utf-8');
+            const key = fs.readFileSync(this.keyPath, 'utf-8');
+            return { cert, key, expiresAt: parseCertNotAfter(cert) };
+        }
+        catch {
+            return null;
+        }
+    }
+    async save(material) {
+        fs.mkdirSync(path.dirname(this.certPath), { recursive: true });
+        fs.writeFileSync(this.certPath, material.cert, { mode: 0o644 });
+        fs.writeFileSync(this.keyPath, material.key, { mode: 0o600 });
+        try {
+            fs.chmodSync(this.keyPath, 0o600);
+        }
+        catch {
+            // best-effort on platforms without POSIX permissions
+        }
+    }
+}
+//# sourceMappingURL=DiskCertStore.js.map

package/dist/lib/cert/DiskCertStore.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"DiskCertStore.js","sourceRoot":"","sources":["../../../src/lib/cert/DiskCertStore.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,MAAM,IAAI,CAAA;AACnB,OAAO,IAAI,MAAM,MAAM,CAAA;AAGvB,OAAO,EAAE,iBAAiB,EAAE,MAAM,gBAAgB,CAAA;AAElD,yDAAyD;AACzD,iDAAiD;AACjD,MAAM,OAAO,aAAa;IACP,QAAQ,CAAQ;IAChB,OAAO,CAAQ;IAEhC,YAAY,GAAW;QACrB,IAAI,CAAC,QAAQ,GAAG,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,UAAU,CAAC,CAAA;QAC1C,IAAI,CAAC,OAAO,GAAG,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,SAAS,CAAC,CAAA;IAC1C,CAAC;IAED,KAAK,CAAC,IAAI;QACR,IAAI,CAAC;YACH,MAAM,IAAI,GAAG,EAAE,CAAC,YAAY,CAAC,IAAI,CAAC,QAAQ,EAAE,OAAO,CAAC,CAAA;YACpD,MAAM,GAAG,GAAG,EAAE,CAAC,YAAY,CAAC,IAAI,CAAC,OAAO,EAAE,OAAO,CAAC,CAAA;YAClD,OAAO,EAAE,IAAI,EAAE,GAAG,EAAE,SAAS,EAAE,iBAAiB,CAAC,IAAI,CAAC,EAAE,CAAA;QAC1D,CAAC;QAAC,MAAM,CAAC;YACP,OAAO,IAAI,CAAA;QACb,CAAC;IACH,CAAC;IAED,KAAK,CAAC,IAAI,CAAC,QAAsB;QAC/B,EAAE,CAAC,SAAS,CAAC,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,QAAQ,CAAC,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAA;QAC9D,EAAE,CAAC,aAAa,CAAC,IAAI,CAAC,QAAQ,EAAE,QAAQ,CAAC,IAAI,EAAE,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAA;QAC/D,EAAE,CAAC,aAAa,CAAC,IAAI,CAAC,OAAO,EAAE,QAAQ,CAAC,GAAG,EAAE,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAA;QAC7D,IAAI,CAAC;YACH,EAAE,CAAC,SAAS,CAAC,IAAI,CAAC,OAAO,EAAE,KAAK,CAAC,CAAA;QACnC,CAAC;QAAC,MAAM,CAAC;YACP,qDAAqD;QACvD,CAAC;IACH,CAAC;CACF"}

package/dist/lib/cert/DnsProvider.d.ts

@@ -0,0 +1,7 @@
+export interface DnsProvider {
+    readonly name: string;
+    setTxtRecord(fqdn: string, value: string): Promise<void>;
+    removeTxtRecord(fqdn: string, value: string): Promise<void>;
+    upsertAddressRecord?(fqdn: string, ip: string): Promise<void>;
+}
+//# sourceMappingURL=DnsProvider.d.ts.map

package/dist/lib/cert/DnsProvider.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"DnsProvider.d.ts","sourceRoot":"","sources":["../../../src/lib/cert/DnsProvider.ts"],"names":[],"mappings":"AACA,MAAM,WAAW,WAAW;IAC1B,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAA;IAErB,YAAY,CAAC,IAAI,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAAA;IACxD,eAAe,CAAC,IAAI,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAAA;IAE3D,mBAAmB,CAAC,CAAC,IAAI,EAAE,MAAM,EAAE,EAAE,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAAA;CAC9D"}

package/dist/lib/cert/DnsProvider.js

@@ -0,0 +1,2 @@
+export {};
+//# sourceMappingURL=DnsProvider.js.map

package/dist/lib/cert/DnsProvider.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"DnsProvider.js","sourceRoot":"","sources":["../../../src/lib/cert/DnsProvider.ts"],"names":[],"mappings":""}

package/dist/lib/cert/ImportCertProvider.d.ts

@@ -0,0 +1,20 @@
+import type { CertProvider, CertMaterial, CertStrategy } from './CertProvider.js';
+export interface ImportCertProviderOptions {
+    certPath: string;
+    keyPath: string;
+    /** 테스트 주입용. 기본 fs.readFileSync(utf-8). */
+    readFileFn?: (filePath: string) => string;
+}
+/**
+ * 사용자가 직접 마련한 cert/key 파일을 로드하는 CertProvider.
+ * ACME를 돌리지 않으므로 갱신은 사용자 책임 — renewIfNeeded는 항상 null.
+ */
+export declare class ImportCertProvider implements CertProvider {
+    private readonly opts;
+    readonly strategy: CertStrategy;
+    private readonly readFile;
+    constructor(opts: ImportCertProviderOptions);
+    ensureCert(): Promise<CertMaterial>;
+    renewIfNeeded(): Promise<CertMaterial | null>;
+}
+//# sourceMappingURL=ImportCertProvider.d.ts.map

package/dist/lib/cert/ImportCertProvider.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"ImportCertProvider.d.ts","sourceRoot":"","sources":["../../../src/lib/cert/ImportCertProvider.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,YAAY,EAAE,YAAY,EAAE,YAAY,EAAE,MAAM,mBAAmB,CAAA;AAGjF,MAAM,WAAW,yBAAyB;IACxC,QAAQ,EAAE,MAAM,CAAA;IAChB,OAAO,EAAE,MAAM,CAAA;IACf,0CAA0C;IAC1C,UAAU,CAAC,EAAE,CAAC,QAAQ,EAAE,MAAM,KAAK,MAAM,CAAA;CAC1C;AAED;;;GAGG;AACH,qBAAa,kBAAmB,YAAW,YAAY;IAIzC,OAAO,CAAC,QAAQ,CAAC,IAAI;IAHjC,QAAQ,CAAC,QAAQ,EAAE,YAAY,CAAgB;IAC/C,OAAO,CAAC,QAAQ,CAAC,QAAQ,CAA8B;gBAE1B,IAAI,EAAE,yBAAyB;IAItD,UAAU,IAAI,OAAO,CAAC,YAAY,CAAC;IAMnC,aAAa,IAAI,OAAO,CAAC,YAAY,GAAG,IAAI,CAAC;CAGpD"}

package/dist/lib/cert/ImportCertProvider.js

@@ -0,0 +1,24 @@
+import fs from 'fs';
+import { parseCertNotAfter } from './parseCert.js';
+/**
+ * 사용자가 직접 마련한 cert/key 파일을 로드하는 CertProvider.
+ * ACME를 돌리지 않으므로 갱신은 사용자 책임 — renewIfNeeded는 항상 null.
+ */
+export class ImportCertProvider {
+    opts;
+    strategy = 'import-cert';
+    readFile;
+    constructor(opts) {
+        this.opts = opts;
+        this.readFile = opts.readFileFn ?? ((filePath) => fs.readFileSync(filePath, 'utf-8'));
+    }
+    async ensureCert() {
+        const cert = this.readFile(this.opts.certPath);
+        const key = this.readFile(this.opts.keyPath);
+        return { cert, key, expiresAt: parseCertNotAfter(cert) };
+    }
+    async renewIfNeeded() {
+        return null;
+    }
+}
+//# sourceMappingURL=ImportCertProvider.js.map

package/dist/lib/cert/ImportCertProvider.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"ImportCertProvider.js","sourceRoot":"","sources":["../../../src/lib/cert/ImportCertProvider.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,MAAM,IAAI,CAAA;AAEnB,OAAO,EAAE,iBAAiB,EAAE,MAAM,gBAAgB,CAAA;AASlD;;;GAGG;AACH,MAAM,OAAO,kBAAkB;IAIA;IAHpB,QAAQ,GAAiB,aAAa,CAAA;IAC9B,QAAQ,CAA8B;IAEvD,YAA6B,IAA+B;QAA/B,SAAI,GAAJ,IAAI,CAA2B;QAC1D,IAAI,CAAC,QAAQ,GAAG,IAAI,CAAC,UAAU,IAAI,CAAC,CAAC,QAAgB,EAAE,EAAE,CAAC,EAAE,CAAC,YAAY,CAAC,QAAQ,EAAE,OAAO,CAAC,CAAC,CAAA;IAC/F,CAAC;IAED,KAAK,CAAC,UAAU;QACd,MAAM,IAAI,GAAG,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAA;QAC9C,MAAM,GAAG,GAAG,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,IAAI,CAAC,OAAO,CAAC,CAAA;QAC5C,OAAO,EAAE,IAAI,EAAE,GAAG,EAAE,SAAS,EAAE,iBAAiB,CAAC,IAAI,CAAC,EAAE,CAAA;IAC1D,CAAC;IAED,KAAK,CAAC,aAAa;QACjB,OAAO,IAAI,CAAA;IACb,CAAC;CACF"}

package/dist/lib/cert/VercelDnsProvider.d.ts

@@ -0,0 +1,38 @@
+import type { DnsProvider } from './DnsProvider.js';
+import { type FetchLike } from './CloudflareDnsProvider.js';
+export interface VercelDnsProviderOptions {
+    token: string;
+    /** 명시하면 도메인 디스커버리(GET /v5/domains)를 생략. */
+    zoneName?: string;
+    /** 팀 계정이면 teamId. */
+    teamId?: string;
+    /** 테스트 주입용. 기본 global fetch. */
+    fetchFn?: FetchLike;
+    /** 기본 https://api.vercel.com */
+    apiBase?: string;
+}
+export declare class VercelDnsProvider implements DnsProvider {
+    readonly name = "vercel";
+    private readonly token;
+    private readonly fetchFn;
+    private readonly apiBase;
+    private readonly fixedZoneName?;
+    private readonly teamId?;
+    private readonly zoneCache;
+    constructor(opts: VercelDnsProviderOptions);
+    setTxtRecord(fqdn: string, value: string): Promise<void>;
+    removeTxtRecord(fqdn: string, value: string): Promise<void>;
+    upsertAddressRecord(fqdn: string, ip: string): Promise<void>;
+    private subnameOf;
+    private url;
+    private zoneFor;
+    private findRecords;
+    private listAllDomains;
+    private listAllRecords;
+    private createRecord;
+    private deleteRecord;
+    private request;
+}
+/** env(TAPFLOW_VERCEL_TOKEN)에서 토큰을 읽어 provider를 만든다. 미설정 시 throw. (팀이면 TAPFLOW_VERCEL_TEAM_ID) */
+export declare function vercelDnsFromEnv(zoneName?: string): VercelDnsProvider;
+//# sourceMappingURL=VercelDnsProvider.d.ts.map

package/dist/lib/cert/VercelDnsProvider.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"VercelDnsProvider.d.ts","sourceRoot":"","sources":["../../../src/lib/cert/VercelDnsProvider.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,kBAAkB,CAAA;AACnD,OAAO,EAAsB,KAAK,SAAS,EAAE,MAAM,4BAA4B,CAAA;AAS/E,MAAM,WAAW,wBAAwB;IACvC,KAAK,EAAE,MAAM,CAAA;IACb,2CAA2C;IAC3C,QAAQ,CAAC,EAAE,MAAM,CAAA;IACjB,qBAAqB;IACrB,MAAM,CAAC,EAAE,MAAM,CAAA;IACf,gCAAgC;IAChC,OAAO,CAAC,EAAE,SAAS,CAAA;IACnB,gCAAgC;IAChC,OAAO,CAAC,EAAE,MAAM,CAAA;CACjB;AASD,qBAAa,iBAAkB,YAAW,WAAW;IACnD,QAAQ,CAAC,IAAI,YAAW;IACxB,OAAO,CAAC,QAAQ,CAAC,KAAK,CAAQ;IAC9B,OAAO,CAAC,QAAQ,CAAC,OAAO,CAAW;IACnC,OAAO,CAAC,QAAQ,CAAC,OAAO,CAAQ;IAChC,OAAO,CAAC,QAAQ,CAAC,aAAa,CAAC,CAAQ;IACvC,OAAO,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAQ;IAChC,OAAO,CAAC,QAAQ,CAAC,SAAS,CAA4B;gBAE1C,IAAI,EAAE,wBAAwB;IASpC,YAAY,CAAC,IAAI,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;IASxD,eAAe,CAAC,IAAI,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;IAU3D,mBAAmB,CAAC,IAAI,EAAE,MAAM,EAAE,EAAE,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;IAWlE,OAAO,CAAC,SAAS;IAMjB,OAAO,CAAC,GAAG;YAOG,OAAO;YAWP,WAAW;YAQX,cAAc;YAkBd,cAAc;YAkBd,YAAY;YAIZ,YAAY;YAIZ,OAAO;CActB;AAED,kGAAkG;AAClG,wBAAgB,gBAAgB,CAAC,QAAQ,CAAC,EAAE,MAAM,GAAG,iBAAiB,CAIrE"}

package/dist/lib/cert/VercelDnsProvider.js

@@ -0,0 +1,146 @@
+import { DNS_API_TIMEOUT_MS } from './CloudflareDnsProvider.js';
+// Vercel DNS-01 solver (issue #232). 사용자 자기 Vercel 계정 토큰으로 동작한다(BYO).
+// 토큰은 config가 아니라 env(TAPFLOW_VERCEL_TOKEN)에서 읽는다(vercelDnsFromEnv).
+// Vercel은 개별 레코드(id 보유) 모델: name은 도메인 기준 상대 subname(루트는 ''), TXT 값은 따옴표 없이.
+const DEFAULT_API_BASE = 'https://api.vercel.com';
+const TTL_SECONDS = 60;
+export class VercelDnsProvider {
+    name = 'vercel';
+    token;
+    fetchFn;
+    apiBase;
+    fixedZoneName;
+    teamId;
+    zoneCache = new Map();
+    constructor(opts) {
+        if (!opts.token)
+            throw new Error('Vercel API token is required (set TAPFLOW_VERCEL_TOKEN)');
+        this.token = opts.token;
+        this.fetchFn = opts.fetchFn ?? globalThis.fetch;
+        this.apiBase = opts.apiBase ?? DEFAULT_API_BASE;
+        this.fixedZoneName = opts.zoneName;
+        this.teamId = opts.teamId;
+    }
+    async setTxtRecord(fqdn, value) {
+        const recordName = `_acme-challenge.${fqdn}`;
+        const zone = await this.zoneFor(recordName);
+        const subname = this.subnameOf(recordName, zone);
+        const existing = await this.findRecords(zone, 'TXT', subname);
+        if (existing.some((r) => r.value === value || r.value === `"${value}"`))
+            return;
+        await this.createRecord(zone, { type: 'TXT', name: subname, value, ttl: TTL_SECONDS });
+    }
+    async removeTxtRecord(fqdn, value) {
+        const recordName = `_acme-challenge.${fqdn}`;
+        const zone = await this.zoneFor(recordName);
+        const subname = this.subnameOf(recordName, zone);
+        const matches = (await this.findRecords(zone, 'TXT', subname)).filter((r) => r.value === value || r.value === `"${value}"`);
+        for (const r of matches)
+            await this.deleteRecord(zone, r.id);
+    }
+    async upsertAddressRecord(fqdn, ip) {
+        const zone = await this.zoneFor(fqdn);
+        const subname = this.subnameOf(fqdn, zone);
+        const type = ip.includes(':') ? 'AAAA' : 'A';
+        // Vercel엔 레코드 PATCH가 번거로우니 기존 동type 레코드 삭제 후 재생성(upsert).
+        for (const r of await this.findRecords(zone, type, subname))
+            await this.deleteRecord(zone, r.id);
+        await this.createRecord(zone, { type, name: subname, value: ip, ttl: TTL_SECONDS });
+    }
+    // --- internals ---
+    subnameOf(fqdn, zone) {
+        if (fqdn === zone)
+            return '';
+        if (fqdn.endsWith(`.${zone}`))
+            return fqdn.slice(0, -(zone.length + 1));
+        throw new Error(`${fqdn} is not under Vercel zone ${zone}`);
+    }
+    url(path, params = {}) {
+        const q = new URLSearchParams(params);
+        if (this.teamId)
+            q.set('teamId', this.teamId);
+        const qs = q.toString();
+        return `${this.apiBase}${path}${qs ? `?${qs}` : ''}`;
+    }
+    async zoneFor(fqdn) {
+        if (this.fixedZoneName)
+            return this.fixedZoneName;
+        const cached = this.zoneCache.get(fqdn);
+        if (cached)
+            return cached;
+        const names = await this.listAllDomains();
+        const zone = names.filter((n) => fqdn === n || fqdn.endsWith(`.${n}`)).sort((a, b) => b.length - a.length)[0];
+        if (!zone)
+            throw new Error(`No Vercel domain found for ${fqdn}`);
+        this.zoneCache.set(fqdn, zone);
+        return zone;
+    }
+    async findRecords(zone, type, subname) {
+        const fullName = subname === '' ? zone : `${subname}.${zone}`;
+        const records = await this.listAllRecords(zone);
+        return records.filter((r) => r.type === type && (r.name === subname || r.name === fullName));
+    }
+    // Vercel 목록 API는 페이지네이션됨(기본/limit 초과 시). pagination.next(타임스탬프)를 until로 넘겨 끝까지 순회.
+    // >100 도메인/레코드 계정에서 "No Vercel domain found"나 누락으로 인한 idempotency 깨짐 방지.
+    async listAllDomains() {
+        const names = [];
+        let until;
+        for (let page = 0; page < 100; page++) {
+            const params = { limit: '100' };
+            if (until)
+                params.until = until;
+            const body = await this.request(this.url('/v5/domains', params), 'GET');
+            for (const d of body.domains)
+                names.push(d.name);
+            const next = body.pagination?.next;
+            if (!next)
+                break;
+            until = String(next);
+        }
+        return names;
+    }
+    async listAllRecords(zone) {
+        const all = [];
+        let until;
+        for (let page = 0; page < 100; page++) {
+            const params = { limit: '100' };
+            if (until)
+                params.until = until;
+            const body = await this.request(this.url(`/v5/domains/${zone}/records`, params), 'GET');
+            all.push(...(body.records ?? []));
+            const next = body.pagination?.next;
+            if (!next)
+                break;
+            until = String(next);
+        }
+        return all;
+    }
+    async createRecord(zone, record) {
+        await this.request(this.url(`/v2/domains/${zone}/records`), 'POST', record);
+    }
+    async deleteRecord(zone, recordId) {
+        await this.request(this.url(`/v2/domains/${zone}/records/${recordId}`), 'DELETE');
+    }
+    async request(url, method, body) {
+        const res = await this.fetchFn(url, {
+            method,
+            headers: { Authorization: `Bearer ${this.token}`, 'content-type': 'application/json' },
+            body: body === undefined ? undefined : JSON.stringify(body),
+            signal: AbortSignal.timeout(DNS_API_TIMEOUT_MS),
+        });
+        const data = (await res.json().catch(() => null));
+        if (!res.ok) {
+            const msg = data?.error?.message || `HTTP ${res.status}`;
+            throw new Error(`Vercel API error: ${msg}`);
+        }
+        return data;
+    }
+}
+/** env(TAPFLOW_VERCEL_TOKEN)에서 토큰을 읽어 provider를 만든다. 미설정 시 throw. (팀이면 TAPFLOW_VERCEL_TEAM_ID) */
+export function vercelDnsFromEnv(zoneName) {
+    const token = process.env.TAPFLOW_VERCEL_TOKEN;
+    if (!token)
+        throw new Error('TAPFLOW_VERCEL_TOKEN is not set');
+    return new VercelDnsProvider({ token, zoneName, teamId: process.env.TAPFLOW_VERCEL_TEAM_ID || undefined });
+}
+//# sourceMappingURL=VercelDnsProvider.js.map

package/dist/lib/cert/VercelDnsProvider.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"VercelDnsProvider.js","sourceRoot":"","sources":["../../../src/lib/cert/VercelDnsProvider.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,kBAAkB,EAAkB,MAAM,4BAA4B,CAAA;AAE/E,sEAAsE;AACtE,qEAAqE;AACrE,4EAA4E;AAE5E,MAAM,gBAAgB,GAAG,wBAAwB,CAAA;AACjD,MAAM,WAAW,GAAG,EAAE,CAAA;AAqBtB,MAAM,OAAO,iBAAiB;IACnB,IAAI,GAAG,QAAQ,CAAA;IACP,KAAK,CAAQ;IACb,OAAO,CAAW;IAClB,OAAO,CAAQ;IACf,aAAa,CAAS;IACtB,MAAM,CAAS;IACf,SAAS,GAAG,IAAI,GAAG,EAAkB,CAAA;IAEtD,YAAY,IAA8B;QACxC,IAAI,CAAC,IAAI,CAAC,KAAK;YAAE,MAAM,IAAI,KAAK,CAAC,yDAAyD,CAAC,CAAA;QAC3F,IAAI,CAAC,KAAK,GAAG,IAAI,CAAC,KAAK,CAAA;QACvB,IAAI,CAAC,OAAO,GAAG,IAAI,CAAC,OAAO,IAAK,UAAU,CAAC,KAA8B,CAAA;QACzE,IAAI,CAAC,OAAO,GAAG,IAAI,CAAC,OAAO,IAAI,gBAAgB,CAAA;QAC/C,IAAI,CAAC,aAAa,GAAG,IAAI,CAAC,QAAQ,CAAA;QAClC,IAAI,CAAC,MAAM,GAAG,IAAI,CAAC,MAAM,CAAA;IAC3B,CAAC;IAED,KAAK,CAAC,YAAY,CAAC,IAAY,EAAE,KAAa;QAC5C,MAAM,UAAU,GAAG,mBAAmB,IAAI,EAAE,CAAA;QAC5C,MAAM,IAAI,GAAG,MAAM,IAAI,CAAC,OAAO,CAAC,UAAU,CAAC,CAAA;QAC3C,MAAM,OAAO,GAAG,IAAI,CAAC,SAAS,CAAC,UAAU,EAAE,IAAI,CAAC,CAAA;QAChD,MAAM,QAAQ,GAAG,MAAM,IAAI,CAAC,WAAW,CAAC,IAAI,EAAE,KAAK,EAAE,OAAO,CAAC,CAAA;QAC7D,IAAI,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,KAAK,KAAK,KAAK,IAAI,CAAC,CAAC,KAAK,KAAK,IAAI,KAAK,GAAG,CAAC;YAAE,OAAM;QAC/E,MAAM,IAAI,CAAC,YAAY,CAAC,IAAI,EAAE,EAAE,IAAI,EAAE,KAAK,EAAE,IAAI,EAAE,OAAO,EAAE,KAAK,EAAE,GAAG,EAAE,WAAW,EAAE,CAAC,CAAA;IACxF,CAAC;IAED,KAAK,CAAC,eAAe,CAAC,IAAY,EAAE,KAAa;QAC/C,MAAM,UAAU,GAAG,mBAAmB,IAAI,EAAE,CAAA;QAC5C,MAAM,IAAI,GAAG,MAAM,IAAI,CAAC,OAAO,CAAC,UAAU,CAAC,CAAA;QAC3C,MAAM,OAAO,GAAG,IAAI,CAAC,SAAS,CAAC,UAAU,EAAE,IAAI,CAAC,CAAA;QAChD,MAAM,OAAO,GAAG,CAAC,MAAM,IAAI,CAAC,WAAW,CAAC,IAAI,EAAE,KAAK,EAAE,OAAO,CAAC,CAAC,CAAC,MAAM,CACnE,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,KAAK,KAAK,KAAK,IAAI,CAAC,CAAC,KAAK,KAAK,IAAI,KAAK,GAAG,CACrD,CAAA;QACD,KAAK,MAAM,CAAC,IAAI,OAAO;YAAE,MAAM,IAAI,CAAC,YAAY,CAAC,IAAI,EAAE,CAAC,CAAC,EAAE,CAAC,CAAA;IAC9D,CAAC;IAED,KAAK,CAAC,mBAAmB,CAAC,IAAY,EAAE,EAAU;QAChD,MAAM,IAAI,GAAG,MAAM,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,CAAA;QACrC,MAAM,OAAO,GAAG,IAAI,CAAC,SAAS,CAAC,IAAI,EAAE,IAAI,CAAC,CAAA;QAC1C,MAAM,IAAI,GAAG,EAAE,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,GAAG,CAAA;QAC5C,0DAA0D;QAC1D,KAAK,MAAM,CAAC,IAAI,MAAM,IAAI,CAAC,WAAW,CAAC,IAAI,EAAE,IAAI,EAAE,OAAO,CAAC;YAAE,MAAM,IAAI,CAAC,YAAY,CAAC,IAAI,EAAE,CAAC,CAAC,EAAE,CAAC,CAAA;QAChG,MAAM,IAAI,CAAC,YAAY,CAAC,IAAI,EAAE,EAAE,IAAI,EAAE,IAAI,EAAE,OAAO,EAAE,KAAK,EAAE,EAAE,EAAE,GAAG,EAAE,WAAW,EAAE,CAAC,CAAA;IACrF,CAAC;IAED,oBAAoB;IAEZ,SAAS,CAAC,IAAY,EAAE,IAAY;QAC1C,IAAI,IAAI,KAAK,IAAI;YAAE,OAAO,EAAE,CAAA;QAC5B,IAAI,IAAI,CAAC,QAAQ,CAAC,IAAI,IAAI,EAAE,CAAC;YAAE,OAAO,IAAI,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,IAAI,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAA;QACvE,MAAM,IAAI,KAAK,CAAC,GAAG,IAAI,6BAA6B,IAAI,EAAE,CAAC,CAAA;IAC7D,CAAC;IAEO,GAAG,CAAC,IAAY,EAAE,SAAiC,EAAE;QAC3D,MAAM,CAAC,GAAG,IAAI,eAAe,CAAC,MAAM,CAAC,CAAA;QACrC,IAAI,IAAI,CAAC,MAAM;YAAE,CAAC,CAAC,GAAG,CAAC,QAAQ,EAAE,IAAI,CAAC,MAAM,CAAC,CAAA;QAC7C,MAAM,EAAE,GAAG,CAAC,CAAC,QAAQ,EAAE,CAAA;QACvB,OAAO,GAAG,IAAI,CAAC,OAAO,GAAG,IAAI,GAAG,EAAE,CAAC,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,EAAE,CAAA;IACtD,CAAC;IAEO,KAAK,CAAC,OAAO,CAAC,IAAY;QAChC,IAAI,IAAI,CAAC,aAAa;YAAE,OAAO,IAAI,CAAC,aAAa,CAAA;QACjD,MAAM,MAAM,GAAG,IAAI,CAAC,SAAS,CAAC,GAAG,CAAC,IAAI,CAAC,CAAA;QACvC,IAAI,MAAM;YAAE,OAAO,MAAM,CAAA;QACzB,MAAM,KAAK,GAAG,MAAM,IAAI,CAAC,cAAc,EAAE,CAAA;QACzC,MAAM,IAAI,GAAG,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,IAAI,KAAK,CAAC,IAAI,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,MAAM,GAAG,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,CAAA;QAC7G,IAAI,CAAC,IAAI;YAAE,MAAM,IAAI,KAAK,CAAC,8BAA8B,IAAI,EAAE,CAAC,CAAA;QAChE,IAAI,CAAC,SAAS,CAAC,GAAG,CAAC,IAAI,EAAE,IAAI,CAAC,CAAA;QAC9B,OAAO,IAAI,CAAA;IACb,CAAC;IAEO,KAAK,CAAC,WAAW,CAAC,IAAY,EAAE,IAAY,EAAE,OAAe;QACnE,MAAM,QAAQ,GAAG,OAAO,KAAK,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,GAAG,OAAO,IAAI,IAAI,EAAE,CAAA;QAC7D,MAAM,OAAO,GAAG,MAAM,IAAI,CAAC,cAAc,CAAC,IAAI,CAAC,CAAA;QAC/C,OAAO,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,KAAK,IAAI,IAAI,CAAC,CAAC,CAAC,IAAI,KAAK,OAAO,IAAI,CAAC,CAAC,IAAI,KAAK,QAAQ,CAAC,CAAC,CAAA;IAC9F,CAAC;IAED,mFAAmF;IACnF,yEAAyE;IACjE,KAAK,CAAC,cAAc;QAC1B,MAAM,KAAK,GAAa,EAAE,CAAA;QAC1B,IAAI,KAAyB,CAAA;QAC7B,KAAK,IAAI,IAAI,GAAG,CAAC,EAAE,IAAI,GAAG,GAAG,EAAE,IAAI,EAAE,EAAE,CAAC;YACtC,MAAM,MAAM,GAA2B,EAAE,KAAK,EAAE,KAAK,EAAE,CAAA;YACvD,IAAI,KAAK;gBAAE,MAAM,CAAC,KAAK,GAAG,KAAK,CAAA;YAC/B,MAAM,IAAI,GAAG,MAAM,IAAI,CAAC,OAAO,CAC7B,IAAI,CAAC,GAAG,CAAC,aAAa,EAAE,MAAM,CAAC,EAC/B,KAAK,CACN,CAAA;YACD,KAAK,MAAM,CAAC,IAAI,IAAI,CAAC,OAAO;gBAAE,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,CAAA;YAChD,MAAM,IAAI,GAAG,IAAI,CAAC,UAAU,EAAE,IAAI,CAAA;YAClC,IAAI,CAAC,IAAI;gBAAE,MAAK;YAChB,KAAK,GAAG,MAAM,CAAC,IAAI,CAAC,CAAA;QACtB,CAAC;QACD,OAAO,KAAK,CAAA;IACd,CAAC;IAEO,KAAK,CAAC,cAAc,CAAC,IAAY;QACvC,MAAM,GAAG,GAAmB,EAAE,CAAA;QAC9B,IAAI,KAAyB,CAAA;QAC7B,KAAK,IAAI,IAAI,GAAG,CAAC,EAAE,IAAI,GAAG,GAAG,EAAE,IAAI,EAAE,EAAE,CAAC;YACtC,MAAM,MAAM,GAA2B,EAAE,KAAK,EAAE,KAAK,EAAE,CAAA;YACvD,IAAI,KAAK;gBAAE,MAAM,CAAC,KAAK,GAAG,KAAK,CAAA;YAC/B,MAAM,IAAI,GAAG,MAAM,IAAI,CAAC,OAAO,CAC7B,IAAI,CAAC,GAAG,CAAC,eAAe,IAAI,UAAU,EAAE,MAAM,CAAC,EAC/C,KAAK,CACN,CAAA;YACD,GAAG,CAAC,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,OAAO,IAAI,EAAE,CAAC,CAAC,CAAA;YACjC,MAAM,IAAI,GAAG,IAAI,CAAC,UAAU,EAAE,IAAI,CAAA;YAClC,IAAI,CAAC,IAAI;gBAAE,MAAK;YAChB,KAAK,GAAG,MAAM,CAAC,IAAI,CAAC,CAAA;QACtB,CAAC;QACD,OAAO,GAAG,CAAA;IACZ,CAAC;IAEO,KAAK,CAAC,YAAY,CAAC,IAAY,EAAE,MAAkE;QACzG,MAAM,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,GAAG,CAAC,eAAe,IAAI,UAAU,CAAC,EAAE,MAAM,EAAE,MAAM,CAAC,CAAA;IAC7E,CAAC;IAEO,KAAK,CAAC,YAAY,CAAC,IAAY,EAAE,QAAgB;QACvD,MAAM,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,GAAG,CAAC,eAAe,IAAI,YAAY,QAAQ,EAAE,CAAC,EAAE,QAAQ,CAAC,CAAA;IACnF,CAAC;IAEO,KAAK,CAAC,OAAO,CAAI,GAAW,EAAE,MAAc,EAAE,IAAc;QAClE,MAAM,GAAG,GAAG,MAAM,IAAI,CAAC,OAAO,CAAC,GAAG,EAAE;YAClC,MAAM;YACN,OAAO,EAAE,EAAE,aAAa,EAAE,UAAU,IAAI,CAAC,KAAK,EAAE,EAAE,cAAc,EAAE,kBAAkB,EAAE;YACtF,IAAI,EAAE,IAAI,KAAK,SAAS,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC;YAC3D,MAAM,EAAE,WAAW,CAAC,OAAO,CAAC,kBAAkB,CAAC;SAChD,CAAC,CAAA;QACF,MAAM,IAAI,GAAG,CAAC,MAAM,GAAG,CAAC,IAAI,EAAE,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,IAAI,CAAC,CAA4C,CAAA;QAC5F,IAAI,CAAC,GAAG,CAAC,EAAE,EAAE,CAAC;YACZ,MAAM,GAAG,GAAG,IAAI,EAAE,KAAK,EAAE,OAAO,IAAI,QAAQ,GAAG,CAAC,MAAM,EAAE,CAAA;YACxD,MAAM,IAAI,KAAK,CAAC,qBAAqB,GAAG,EAAE,CAAC,CAAA;QAC7C,CAAC;QACD,OAAO,IAAS,CAAA;IAClB,CAAC;CACF;AAED,kGAAkG;AAClG,MAAM,UAAU,gBAAgB,CAAC,QAAiB;IAChD,MAAM,KAAK,GAAG,OAAO,CAAC,GAAG,CAAC,oBAAoB,CAAA;IAC9C,IAAI,CAAC,KAAK;QAAE,MAAM,IAAI,KAAK,CAAC,iCAAiC,CAAC,CAAA;IAC9D,OAAO,IAAI,iBAAiB,CAAC,EAAE,KAAK,EAAE,QAAQ,EAAE,MAAM,EAAE,OAAO,CAAC,GAAG,CAAC,sBAAsB,IAAI,SAAS,EAAE,CAAC,CAAA;AAC5G,CAAC"}

package/dist/lib/cert/accountKey.d.ts

@@ -0,0 +1,2 @@
+export declare function loadOrCreateAccountKey(filePath: string, create: () => Promise<string>): Promise<string>;
+//# sourceMappingURL=accountKey.d.ts.map

package/dist/lib/cert/accountKey.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"accountKey.d.ts","sourceRoot":"","sources":["../../../src/lib/cert/accountKey.ts"],"names":[],"mappings":"AAKA,wBAAsB,sBAAsB,CAAC,QAAQ,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,OAAO,CAAC,MAAM,CAAC,GAAG,OAAO,CAAC,MAAM,CAAC,CAe7G"}

package/dist/lib/cert/accountKey.js

@@ -0,0 +1,23 @@
+import fs from 'fs';
+import path from 'path';
+// ACME 계정 키를 디스크에 캐시한다. 매 발급마다 새 키로 새 LE 계정을 등록하면
+// Accounts-per-IP 한도(3h/10)에 닿을 수 있으므로 재사용한다. 키 파일은 0600.
+export async function loadOrCreateAccountKey(filePath, create) {
+    try {
+        return fs.readFileSync(filePath, 'utf-8');
+    }
+    catch {
+        // not yet created
+    }
+    const key = await create();
+    fs.mkdirSync(path.dirname(filePath), { recursive: true });
+    fs.writeFileSync(filePath, key, { mode: 0o600 });
+    try {
+        fs.chmodSync(filePath, 0o600);
+    }
+    catch {
+        // best-effort on platforms without POSIX permissions
+    }
+    return key;
+}
+//# sourceMappingURL=accountKey.js.map

package/dist/lib/cert/accountKey.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"accountKey.js","sourceRoot":"","sources":["../../../src/lib/cert/accountKey.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,MAAM,IAAI,CAAA;AACnB,OAAO,IAAI,MAAM,MAAM,CAAA;AAEvB,kDAAkD;AAClD,0DAA0D;AAC1D,MAAM,CAAC,KAAK,UAAU,sBAAsB,CAAC,QAAgB,EAAE,MAA6B;IAC1F,IAAI,CAAC;QACH,OAAO,EAAE,CAAC,YAAY,CAAC,QAAQ,EAAE,OAAO,CAAC,CAAA;IAC3C,CAAC;IAAC,MAAM,CAAC;QACP,kBAAkB;IACpB,CAAC;IACD,MAAM,GAAG,GAAG,MAAM,MAAM,EAAE,CAAA;IAC1B,EAAE,CAAC,SAAS,CAAC,IAAI,CAAC,OAAO,CAAC,QAAQ,CAAC,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAA;IACzD,EAAE,CAAC,aAAa,CAAC,QAAQ,EAAE,GAAG,EAAE,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAA;IAChD,IAAI,CAAC;QACH,EAAE,CAAC,SAAS,CAAC,QAAQ,EAAE,KAAK,CAAC,CAAA;IAC/B,CAAC;IAAC,MAAM,CAAC;QACP,qDAAqD;IACvD,CAAC;IACD,OAAO,GAAG,CAAA;AACZ,CAAC"}

package/dist/lib/cert/addressPublisher.d.ts

@@ -0,0 +1,20 @@
+import type { DnsProvider } from './DnsProvider.js';
+export interface AddressPublisherTls {
+    domain: string;
+    dnsProvider: string;
+    /** 자동 감지 대신 쓸 고정 IP. */
+    address?: string;
+}
+export interface AddressPublisherOptions {
+    intervalMs?: number;
+    /** IP 소스 주입(테스트/오버라이드). 기본 = address ?? detectLanIPv4. */
+    getIp?: () => Promise<string | null>;
+    /** DnsProvider 주입(테스트). 기본 = dnsProvider별 env 팩토리. */
+    provider?: DnsProvider;
+    /** IP 불변이어도 이 틱 수마다 강제 재발행(self-heal). 기본 12(~1h). */
+    reassertEveryTicks?: number;
+    onError?: (err: unknown) => void;
+}
+export declare function detectLanIPv4(): Promise<string | null>;
+export declare function startAddressPublisher(tls: AddressPublisherTls, opts?: AddressPublisherOptions): () => void;
+//# sourceMappingURL=addressPublisher.d.ts.map

package/dist/lib/cert/addressPublisher.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"addressPublisher.d.ts","sourceRoot":"","sources":["../../../src/lib/cert/addressPublisher.ts"],"names":[],"mappings":"AAEA,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,kBAAkB,CAAA;AAYnD,MAAM,WAAW,mBAAmB;IAClC,MAAM,EAAE,MAAM,CAAA;IACd,WAAW,EAAE,MAAM,CAAA;IACnB,wBAAwB;IACxB,OAAO,CAAC,EAAE,MAAM,CAAA;CACjB;AAED,MAAM,WAAW,uBAAuB;IACtC,UAAU,CAAC,EAAE,MAAM,CAAA;IACnB,0DAA0D;IAC1D,KAAK,CAAC,EAAE,MAAM,OAAO,CAAC,MAAM,GAAG,IAAI,CAAC,CAAA;IACpC,sDAAsD;IACtD,QAAQ,CAAC,EAAE,WAAW,CAAA;IACtB,sDAAsD;IACtD,kBAAkB,CAAC,EAAE,MAAM,CAAA;IAC3B,OAAO,CAAC,EAAE,CAAC,GAAG,EAAE,OAAO,KAAK,IAAI,CAAA;CACjC;AAGD,wBAAgB,aAAa,IAAI,OAAO,CAAC,MAAM,GAAG,IAAI,CAAC,CAsBtD;AAGD,wBAAgB,qBAAqB,CAAC,GAAG,EAAE,mBAAmB,EAAE,IAAI,GAAE,uBAA4B,GAAG,MAAM,IAAI,CAkD9G"}

package/dist/lib/cert/addressPublisher.js

@@ -0,0 +1,103 @@
+import dgram from 'dgram';
+import { createLogger } from '@tapflowio/agent-core';
+import { dnsProviders } from './dnsRegistry.js';
+const logger = createLogger('relay:dns');
+// DHCP로 IP가 바뀔 수 있어 cert 갱신(12h)보다 자주 재확인한다.
+const DEFAULT_INTERVAL_MS = 5 * 60_000;
+// IP 불변이어도 이 틱 수마다 강제 재발행 — 외부에서 지워지거나 바뀐 레코드를 self-heal(기본 ~1h).
+const DEFAULT_REASSERT_TICKS = 12;
+// connect 콜백/error 둘 다 안 오는 극단 케이스에서 영구 await 방지.
+const DETECT_TIMEOUT_MS = 2_000;
+// UDP connect(패킷 미전송)로 기본 라우트 인터페이스 IPv4를 얻는다 — networkInterfaces()는 VPN/멀티NIC 오감지 위험.
+export function detectLanIPv4() {
+    return new Promise((resolve) => {
+        const sock = dgram.createSocket('udp4');
+        let settled = false;
+        const done = (ip) => {
+            if (settled)
+                return;
+            settled = true;
+            clearTimeout(timer);
+            try {
+                sock.close();
+            }
+            catch { /* already closed */ }
+            resolve(ip && ip !== '0.0.0.0' ? ip : null);
+        };
+        const timer = setTimeout(() => done(null), DETECT_TIMEOUT_MS);
+        timer.unref?.();
+        sock.once('error', () => done(null));
+        try {
+            sock.connect(53, '8.8.8.8', () => {
+                try {
+                    done(sock.address().address);
+                }
+                catch {
+                    done(null);
+                }
+            });
+        }
+        catch {
+            done(null);
+        }
+    });
+}
+// byo-api-token일 때 LAN IP를 자기 도메인 A 레코드로 발행 — 팀원은 DNS를 손대지 않고 도메인만 연다.
+export function startAddressPublisher(tls, opts = {}) {
+    const dns = opts.provider ?? dnsProviders.get(tls.dnsProvider)?.fromEnv();
+    if (!dns) {
+        logger.warn(`unknown dnsProvider "${tls.dnsProvider}" — skipping address auto-publish`);
+        return () => { };
+    }
+    const upsert = dns.upsertAddressRecord?.bind(dns);
+    if (!upsert) {
+        logger.warn(`${dns.name} cannot publish A records — skipping address auto-publish`);
+        return () => { };
+    }
+    const getIp = opts.getIp ?? (tls.address ? () => Promise.resolve(tls.address ?? null) : detectLanIPv4);
+    const reassertEvery = opts.reassertEveryTicks ?? DEFAULT_REASSERT_TICKS;
+    let last = null;
+    let skipped = 0;
+    const publish = async () => {
+        try {
+            const ip = await getIp();
+            if (!ip) {
+                logger.warn(`could not determine LAN IP to publish ${tls.domain}`);
+                return;
+            }
+            // 보통은 IP 불변이면 skip하되, reassertEvery 틱마다 한 번은 강제 재발행해 외부 변경을 self-heal한다.
+            if (ip === last && skipped < reassertEvery) {
+                skipped++;
+                return;
+            }
+            await upsert(tls.domain, ip);
+            last = ip;
+            skipped = 0;
+            logger.info(`published ${tls.domain} A -> ${ip}`);
+        }
+        catch (err) {
+            if (opts.onError)
+                opts.onError(err);
+            else
+                logger.warn(`failed to publish ${tls.domain} A record: ${String(err)}`);
+        }
+    };
+    // setInterval이 이전 upsert 완료 전 다음 publish를 시작하면 쓰기가 역순으로 끝나 stale IP가 남을 수 있다.
+    let inFlight = false;
+    const tick = async () => {
+        if (inFlight)
+            return;
+        inFlight = true;
+        try {
+            await publish();
+        }
+        finally {
+            inFlight = false;
+        }
+    };
+    void tick();
+    const timer = setInterval(() => void tick(), opts.intervalMs ?? DEFAULT_INTERVAL_MS);
+    timer.unref?.();
+    return () => clearInterval(timer);
+}
+//# sourceMappingURL=addressPublisher.js.map

package/dist/lib/cert/addressPublisher.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"addressPublisher.js","sourceRoot":"","sources":["../../../src/lib/cert/addressPublisher.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,MAAM,OAAO,CAAA;AACzB,OAAO,EAAE,YAAY,EAAE,MAAM,uBAAuB,CAAA;AAEpD,OAAO,EAAE,YAAY,EAAE,MAAM,kBAAkB,CAAA;AAE/C,MAAM,MAAM,GAAG,YAAY,CAAC,WAAW,CAAC,CAAA;AAExC,6CAA6C;AAC7C,MAAM,mBAAmB,GAAG,CAAC,GAAG,MAAM,CAAA;AACtC,kEAAkE;AAClE,MAAM,sBAAsB,GAAG,EAAE,CAAA;AACjC,kDAAkD;AAClD,MAAM,iBAAiB,GAAG,KAAK,CAAA;AAoB/B,uFAAuF;AACvF,MAAM,UAAU,aAAa;IAC3B,OAAO,IAAI,OAAO,CAAC,CAAC,OAAO,EAAE,EAAE;QAC7B,MAAM,IAAI,GAAG,KAAK,CAAC,YAAY,CAAC,MAAM,CAAC,CAAA;QACvC,IAAI,OAAO,GAAG,KAAK,CAAA;QACnB,MAAM,IAAI,GAAG,CAAC,EAAiB,EAAE,EAAE;YACjC,IAAI,OAAO;gBAAE,OAAM;YACnB,OAAO,GAAG,IAAI,CAAA;YACd,YAAY,CAAC,KAAK,CAAC,CAAA;YACnB,IAAI,CAAC;gBAAC,IAAI,CAAC,KAAK,EAAE,CAAA;YAAC,CAAC;YAAC,MAAM,CAAC,CAAC,oBAAoB,CAAC,CAAC;YACnD,OAAO,CAAC,EAAE,IAAI,EAAE,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,CAAA;QAC7C,CAAC,CAAA;QACD,MAAM,KAAK,GAAG,UAAU,CAAC,GAAG,EAAE,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,iBAAiB,CAAC,CAAA;QAC7D,KAAK,CAAC,KAAK,EAAE,EAAE,CAAA;QACf,IAAI,CAAC,IAAI,CAAC,OAAO,EAAE,GAAG,EAAE,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAA;QACpC,IAAI,CAAC;YACH,IAAI,CAAC,OAAO,CAAC,EAAE,EAAE,SAAS,EAAE,GAAG,EAAE;gBAC/B,IAAI,CAAC;oBAAC,IAAI,CAAC,IAAI,CAAC,OAAO,EAAE,CAAC,OAAO,CAAC,CAAA;gBAAC,CAAC;gBAAC,MAAM,CAAC;oBAAC,IAAI,CAAC,IAAI,CAAC,CAAA;gBAAC,CAAC;YAC3D,CAAC,CAAC,CAAA;QACJ,CAAC;QAAC,MAAM,CAAC;YACP,IAAI,CAAC,IAAI,CAAC,CAAA;QACZ,CAAC;IACH,CAAC,CAAC,CAAA;AACJ,CAAC;AAED,uEAAuE;AACvE,MAAM,UAAU,qBAAqB,CAAC,GAAwB,EAAE,OAAgC,EAAE;IAChG,MAAM,GAAG,GAAG,IAAI,CAAC,QAAQ,IAAI,YAAY,CAAC,GAAG,CAAC,GAAG,CAAC,WAAW,CAAC,EAAE,OAAO,EAAE,CAAA;IACzE,IAAI,CAAC,GAAG,EAAE,CAAC;QACT,MAAM,CAAC,IAAI,CAAC,wBAAwB,GAAG,CAAC,WAAW,mCAAmC,CAAC,CAAA;QACvF,OAAO,GAAG,EAAE,GAAE,CAAC,CAAA;IACjB,CAAC;IACD,MAAM,MAAM,GAAG,GAAG,CAAC,mBAAmB,EAAE,IAAI,CAAC,GAAG,CAAC,CAAA;IACjD,IAAI,CAAC,MAAM,EAAE,CAAC;QACZ,MAAM,CAAC,IAAI,CAAC,GAAG,GAAG,CAAC,IAAI,2DAA2D,CAAC,CAAA;QACnF,OAAO,GAAG,EAAE,GAAE,CAAC,CAAA;IACjB,CAAC;IACD,MAAM,KAAK,GAAG,IAAI,CAAC,KAAK,IAAI,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,GAAG,EAAE,CAAC,OAAO,CAAC,OAAO,CAAC,GAAG,CAAC,OAAO,IAAI,IAAI,CAAC,CAAC,CAAC,CAAC,aAAa,CAAC,CAAA;IACtG,MAAM,aAAa,GAAG,IAAI,CAAC,kBAAkB,IAAI,sBAAsB,CAAA;IACvE,IAAI,IAAI,GAAkB,IAAI,CAAA;IAC9B,IAAI,OAAO,GAAG,CAAC,CAAA;IAEf,MAAM,OAAO,GAAG,KAAK,IAAmB,EAAE;QACxC,IAAI,CAAC;YACH,MAAM,EAAE,GAAG,MAAM,KAAK,EAAE,CAAA;YACxB,IAAI,CAAC,EAAE,EAAE,CAAC;gBACR,MAAM,CAAC,IAAI,CAAC,yCAAyC,GAAG,CAAC,MAAM,EAAE,CAAC,CAAA;gBAClE,OAAM;YACR,CAAC;YACD,yEAAyE;YACzE,IAAI,EAAE,KAAK,IAAI,IAAI,OAAO,GAAG,aAAa,EAAE,CAAC;gBAC3C,OAAO,EAAE,CAAA;gBACT,OAAM;YACR,CAAC;YACD,MAAM,MAAM,CAAC,GAAG,CAAC,MAAM,EAAE,EAAE,CAAC,CAAA;YAC5B,IAAI,GAAG,EAAE,CAAA;YACT,OAAO,GAAG,CAAC,CAAA;YACX,MAAM,CAAC,IAAI,CAAC,aAAa,GAAG,CAAC,MAAM,SAAS,EAAE,EAAE,CAAC,CAAA;QACnD,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,IAAI,IAAI,CAAC,OAAO;gBAAE,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,CAAA;;gBAC9B,MAAM,CAAC,IAAI,CAAC,qBAAqB,GAAG,CAAC,MAAM,cAAc,MAAM,CAAC,GAAG,CAAC,EAAE,CAAC,CAAA;QAC9E,CAAC;IACH,CAAC,CAAA;IAED,8EAA8E;IAC9E,IAAI,QAAQ,GAAG,KAAK,CAAA;IACpB,MAAM,IAAI,GAAG,KAAK,IAAmB,EAAE;QACrC,IAAI,QAAQ;YAAE,OAAM;QACpB,QAAQ,GAAG,IAAI,CAAA;QACf,IAAI,CAAC;YAAC,MAAM,OAAO,EAAE,CAAA;QAAC,CAAC;gBAAS,CAAC;YAAC,QAAQ,GAAG,KAAK,CAAA;QAAC,CAAC;IACtD,CAAC,CAAA;IAED,KAAK,IAAI,EAAE,CAAA;IACX,MAAM,KAAK,GAAG,WAAW,CAAC,GAAG,EAAE,CAAC,KAAK,IAAI,EAAE,EAAE,IAAI,CAAC,UAAU,IAAI,mBAAmB,CAAC,CAAA;IACpF,KAAK,CAAC,KAAK,EAAE,EAAE,CAAA;IACf,OAAO,GAAG,EAAE,CAAC,aAAa,CAAC,KAAK,CAAC,CAAA;AACnC,CAAC"}

package/dist/lib/cert/createCertProvider.d.ts

@@ -0,0 +1,20 @@
+import type { CertProvider } from './CertProvider.js';
+export type TlsConfig = {
+    mode: 'byo-api-token';
+    domain: string;
+    dnsProvider: string;
+} | {
+    mode: 'import-cert';
+    certPath: string;
+    keyPath: string;
+};
+export interface CreateCertProviderDeps {
+    dataDir: string;
+    /** ACME 계정 이메일. 기본 env TAPFLOW_ACME_EMAIL. */
+    email?: string;
+    /** LE 스테이징 사용(테스트). 기본 env TAPFLOW_ACME_STAGING === '1'. */
+    staging?: boolean;
+}
+/** config.tls를 적절한 CertProvider로 매핑한다. 비밀(토큰)은 env에서 읽는다. */
+export declare function createCertProvider(tls: TlsConfig, deps: CreateCertProviderDeps): CertProvider;
+//# sourceMappingURL=createCertProvider.d.ts.map

package/dist/lib/cert/createCertProvider.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"createCertProvider.d.ts","sourceRoot":"","sources":["../../../src/lib/cert/createCertProvider.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,mBAAmB,CAAA;AASrD,MAAM,MAAM,SAAS,GACjB;IAAE,IAAI,EAAE,eAAe,CAAC;IAAC,MAAM,EAAE,MAAM,CAAC;IAAC,WAAW,EAAE,MAAM,CAAA;CAAE,GAC9D;IAAE,IAAI,EAAE,aAAa,CAAC;IAAC,QAAQ,EAAE,MAAM,CAAC;IAAC,OAAO,EAAE,MAAM,CAAA;CAAE,CAAA;AAE9D,MAAM,WAAW,sBAAsB;IACrC,OAAO,EAAE,MAAM,CAAA;IACf,8CAA8C;IAC9C,KAAK,CAAC,EAAE,MAAM,CAAA;IACd,4DAA4D;IAC5D,OAAO,CAAC,EAAE,OAAO,CAAA;CAClB;AAED,6DAA6D;AAC7D,wBAAgB,kBAAkB,CAAC,GAAG,EAAE,SAAS,EAAE,IAAI,EAAE,sBAAsB,GAAG,YAAY,CAe7F"}