@tapflowio/relay 0.8.2 → 0.9.0

package/dist/lib/cert/VercelDnsProvider.d.ts

@@ -0,0 +1,38 @@
+import type { DnsProvider } from './DnsProvider.js';
+import { type FetchLike } from './CloudflareDnsProvider.js';
+export interface VercelDnsProviderOptions {
+    token: string;
+    /** 명시하면 도메인 디스커버리(GET /v5/domains)를 생략. */
+    zoneName?: string;
+    /** 팀 계정이면 teamId. */
+    teamId?: string;
+    /** 테스트 주입용. 기본 global fetch. */
+    fetchFn?: FetchLike;
+    /** 기본 https://api.vercel.com */
+    apiBase?: string;
+}
+export declare class VercelDnsProvider implements DnsProvider {
+    readonly name = "vercel";
+    private readonly token;
+    private readonly fetchFn;
+    private readonly apiBase;
+    private readonly fixedZoneName?;
+    private readonly teamId?;
+    private readonly zoneCache;
+    constructor(opts: VercelDnsProviderOptions);
+    setTxtRecord(fqdn: string, value: string): Promise<void>;
+    removeTxtRecord(fqdn: string, value: string): Promise<void>;
+    upsertAddressRecord(fqdn: string, ip: string): Promise<void>;
+    private subnameOf;
+    private url;
+    private zoneFor;
+    private findRecords;
+    private listAllDomains;
+    private listAllRecords;
+    private createRecord;
+    private deleteRecord;
+    private request;
+}
+/** env(TAPFLOW_VERCEL_TOKEN)에서 토큰을 읽어 provider를 만든다. 미설정 시 throw. (팀이면 TAPFLOW_VERCEL_TEAM_ID) */
+export declare function vercelDnsFromEnv(zoneName?: string): VercelDnsProvider;
+//# sourceMappingURL=VercelDnsProvider.d.ts.map

package/dist/lib/cert/VercelDnsProvider.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"VercelDnsProvider.d.ts","sourceRoot":"","sources":["../../../src/lib/cert/VercelDnsProvider.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,kBAAkB,CAAA;AACnD,OAAO,EAAsB,KAAK,SAAS,EAAE,MAAM,4BAA4B,CAAA;AAS/E,MAAM,WAAW,wBAAwB;IACvC,KAAK,EAAE,MAAM,CAAA;IACb,2CAA2C;IAC3C,QAAQ,CAAC,EAAE,MAAM,CAAA;IACjB,qBAAqB;IACrB,MAAM,CAAC,EAAE,MAAM,CAAA;IACf,gCAAgC;IAChC,OAAO,CAAC,EAAE,SAAS,CAAA;IACnB,gCAAgC;IAChC,OAAO,CAAC,EAAE,MAAM,CAAA;CACjB;AASD,qBAAa,iBAAkB,YAAW,WAAW;IACnD,QAAQ,CAAC,IAAI,YAAW;IACxB,OAAO,CAAC,QAAQ,CAAC,KAAK,CAAQ;IAC9B,OAAO,CAAC,QAAQ,CAAC,OAAO,CAAW;IACnC,OAAO,CAAC,QAAQ,CAAC,OAAO,CAAQ;IAChC,OAAO,CAAC,QAAQ,CAAC,aAAa,CAAC,CAAQ;IACvC,OAAO,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAQ;IAChC,OAAO,CAAC,QAAQ,CAAC,SAAS,CAA4B;gBAE1C,IAAI,EAAE,wBAAwB;IASpC,YAAY,CAAC,IAAI,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;IASxD,eAAe,CAAC,IAAI,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;IAU3D,mBAAmB,CAAC,IAAI,EAAE,MAAM,EAAE,EAAE,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;IAWlE,OAAO,CAAC,SAAS;IAMjB,OAAO,CAAC,GAAG;YAOG,OAAO;YAWP,WAAW;YAQX,cAAc;YAkBd,cAAc;YAkBd,YAAY;YAIZ,YAAY;YAIZ,OAAO;CActB;AAED,kGAAkG;AAClG,wBAAgB,gBAAgB,CAAC,QAAQ,CAAC,EAAE,MAAM,GAAG,iBAAiB,CAIrE"}

package/dist/lib/cert/VercelDnsProvider.js

@@ -0,0 +1,146 @@
+import { DNS_API_TIMEOUT_MS } from './CloudflareDnsProvider.js';
+// Vercel DNS-01 solver (issue #232). 사용자 자기 Vercel 계정 토큰으로 동작한다(BYO).
+// 토큰은 config가 아니라 env(TAPFLOW_VERCEL_TOKEN)에서 읽는다(vercelDnsFromEnv).
+// Vercel은 개별 레코드(id 보유) 모델: name은 도메인 기준 상대 subname(루트는 ''), TXT 값은 따옴표 없이.
+const DEFAULT_API_BASE = 'https://api.vercel.com';
+const TTL_SECONDS = 60;
+export class VercelDnsProvider {
+    name = 'vercel';
+    token;
+    fetchFn;
+    apiBase;
+    fixedZoneName;
+    teamId;
+    zoneCache = new Map();
+    constructor(opts) {
+        if (!opts.token)
+            throw new Error('Vercel API token is required (set TAPFLOW_VERCEL_TOKEN)');
+        this.token = opts.token;
+        this.fetchFn = opts.fetchFn ?? globalThis.fetch;
+        this.apiBase = opts.apiBase ?? DEFAULT_API_BASE;
+        this.fixedZoneName = opts.zoneName;
+        this.teamId = opts.teamId;
+    }
+    async setTxtRecord(fqdn, value) {
+        const recordName = `_acme-challenge.${fqdn}`;
+        const zone = await this.zoneFor(recordName);
+        const subname = this.subnameOf(recordName, zone);
+        const existing = await this.findRecords(zone, 'TXT', subname);
+        if (existing.some((r) => r.value === value || r.value === `"${value}"`))
+            return;
+        await this.createRecord(zone, { type: 'TXT', name: subname, value, ttl: TTL_SECONDS });
+    }
+    async removeTxtRecord(fqdn, value) {
+        const recordName = `_acme-challenge.${fqdn}`;
+        const zone = await this.zoneFor(recordName);
+        const subname = this.subnameOf(recordName, zone);
+        const matches = (await this.findRecords(zone, 'TXT', subname)).filter((r) => r.value === value || r.value === `"${value}"`);
+        for (const r of matches)
+            await this.deleteRecord(zone, r.id);
+    }
+    async upsertAddressRecord(fqdn, ip) {
+        const zone = await this.zoneFor(fqdn);
+        const subname = this.subnameOf(fqdn, zone);
+        const type = ip.includes(':') ? 'AAAA' : 'A';
+        // Vercel엔 레코드 PATCH가 번거로우니 기존 동type 레코드 삭제 후 재생성(upsert).
+        for (const r of await this.findRecords(zone, type, subname))
+            await this.deleteRecord(zone, r.id);
+        await this.createRecord(zone, { type, name: subname, value: ip, ttl: TTL_SECONDS });
+    }
+    // --- internals ---
+    subnameOf(fqdn, zone) {
+        if (fqdn === zone)
+            return '';
+        if (fqdn.endsWith(`.${zone}`))
+            return fqdn.slice(0, -(zone.length + 1));
+        throw new Error(`${fqdn} is not under Vercel zone ${zone}`);
+    }
+    url(path, params = {}) {
+        const q = new URLSearchParams(params);
+        if (this.teamId)
+            q.set('teamId', this.teamId);
+        const qs = q.toString();
+        return `${this.apiBase}${path}${qs ? `?${qs}` : ''}`;
+    }
+    async zoneFor(fqdn) {
+        if (this.fixedZoneName)
+            return this.fixedZoneName;
+        const cached = this.zoneCache.get(fqdn);
+        if (cached)
+            return cached;
+        const names = await this.listAllDomains();
+        const zone = names.filter((n) => fqdn === n || fqdn.endsWith(`.${n}`)).sort((a, b) => b.length - a.length)[0];
+        if (!zone)
+            throw new Error(`No Vercel domain found for ${fqdn}`);
+        this.zoneCache.set(fqdn, zone);
+        return zone;
+    }
+    async findRecords(zone, type, subname) {
+        const fullName = subname === '' ? zone : `${subname}.${zone}`;
+        const records = await this.listAllRecords(zone);
+        return records.filter((r) => r.type === type && (r.name === subname || r.name === fullName));
+    }
+    // Vercel 목록 API는 페이지네이션됨(기본/limit 초과 시). pagination.next(타임스탬프)를 until로 넘겨 끝까지 순회.
+    // >100 도메인/레코드 계정에서 "No Vercel domain found"나 누락으로 인한 idempotency 깨짐 방지.
+    async listAllDomains() {
+        const names = [];
+        let until;
+        for (let page = 0; page < 100; page++) {
+            const params = { limit: '100' };
+            if (until)
+                params.until = until;
+            const body = await this.request(this.url('/v5/domains', params), 'GET');
+            for (const d of body.domains)
+                names.push(d.name);
+            const next = body.pagination?.next;
+            if (!next)
+                break;
+            until = String(next);
+        }
+        return names;
+    }
+    async listAllRecords(zone) {
+        const all = [];
+        let until;
+        for (let page = 0; page < 100; page++) {
+            const params = { limit: '100' };
+            if (until)
+                params.until = until;
+            const body = await this.request(this.url(`/v5/domains/${zone}/records`, params), 'GET');
+            all.push(...(body.records ?? []));
+            const next = body.pagination?.next;
+            if (!next)
+                break;
+            until = String(next);
+        }
+        return all;
+    }
+    async createRecord(zone, record) {
+        await this.request(this.url(`/v2/domains/${zone}/records`), 'POST', record);
+    }
+    async deleteRecord(zone, recordId) {
+        await this.request(this.url(`/v2/domains/${zone}/records/${recordId}`), 'DELETE');
+    }
+    async request(url, method, body) {
+        const res = await this.fetchFn(url, {
+            method,
+            headers: { Authorization: `Bearer ${this.token}`, 'content-type': 'application/json' },
+            body: body === undefined ? undefined : JSON.stringify(body),
+            signal: AbortSignal.timeout(DNS_API_TIMEOUT_MS),
+        });
+        const data = (await res.json().catch(() => null));
+        if (!res.ok) {
+            const msg = data?.error?.message || `HTTP ${res.status}`;
+            throw new Error(`Vercel API error: ${msg}`);
+        }
+        return data;
+    }
+}
+/** env(TAPFLOW_VERCEL_TOKEN)에서 토큰을 읽어 provider를 만든다. 미설정 시 throw. (팀이면 TAPFLOW_VERCEL_TEAM_ID) */
+export function vercelDnsFromEnv(zoneName) {
+    const token = process.env.TAPFLOW_VERCEL_TOKEN;
+    if (!token)
+        throw new Error('TAPFLOW_VERCEL_TOKEN is not set');
+    return new VercelDnsProvider({ token, zoneName, teamId: process.env.TAPFLOW_VERCEL_TEAM_ID || undefined });
+}
+//# sourceMappingURL=VercelDnsProvider.js.map

package/dist/lib/cert/VercelDnsProvider.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"VercelDnsProvider.js","sourceRoot":"","sources":["../../../src/lib/cert/VercelDnsProvider.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,kBAAkB,EAAkB,MAAM,4BAA4B,CAAA;AAE/E,sEAAsE;AACtE,qEAAqE;AACrE,4EAA4E;AAE5E,MAAM,gBAAgB,GAAG,wBAAwB,CAAA;AACjD,MAAM,WAAW,GAAG,EAAE,CAAA;AAqBtB,MAAM,OAAO,iBAAiB;IACnB,IAAI,GAAG,QAAQ,CAAA;IACP,KAAK,CAAQ;IACb,OAAO,CAAW;IAClB,OAAO,CAAQ;IACf,aAAa,CAAS;IACtB,MAAM,CAAS;IACf,SAAS,GAAG,IAAI,GAAG,EAAkB,CAAA;IAEtD,YAAY,IAA8B;QACxC,IAAI,CAAC,IAAI,CAAC,KAAK;YAAE,MAAM,IAAI,KAAK,CAAC,yDAAyD,CAAC,CAAA;QAC3F,IAAI,CAAC,KAAK,GAAG,IAAI,CAAC,KAAK,CAAA;QACvB,IAAI,CAAC,OAAO,GAAG,IAAI,CAAC,OAAO,IAAK,UAAU,CAAC,KAA8B,CAAA;QACzE,IAAI,CAAC,OAAO,GAAG,IAAI,CAAC,OAAO,IAAI,gBAAgB,CAAA;QAC/C,IAAI,CAAC,aAAa,GAAG,IAAI,CAAC,QAAQ,CAAA;QAClC,IAAI,CAAC,MAAM,GAAG,IAAI,CAAC,MAAM,CAAA;IAC3B,CAAC;IAED,KAAK,CAAC,YAAY,CAAC,IAAY,EAAE,KAAa;QAC5C,MAAM,UAAU,GAAG,mBAAmB,IAAI,EAAE,CAAA;QAC5C,MAAM,IAAI,GAAG,MAAM,IAAI,CAAC,OAAO,CAAC,UAAU,CAAC,CAAA;QAC3C,MAAM,OAAO,GAAG,IAAI,CAAC,SAAS,CAAC,UAAU,EAAE,IAAI,CAAC,CAAA;QAChD,MAAM,QAAQ,GAAG,MAAM,IAAI,CAAC,WAAW,CAAC,IAAI,EAAE,KAAK,EAAE,OAAO,CAAC,CAAA;QAC7D,IAAI,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,KAAK,KAAK,KAAK,IAAI,CAAC,CAAC,KAAK,KAAK,IAAI,KAAK,GAAG,CAAC;YAAE,OAAM;QAC/E,MAAM,IAAI,CAAC,YAAY,CAAC,IAAI,EAAE,EAAE,IAAI,EAAE,KAAK,EAAE,IAAI,EAAE,OAAO,EAAE,KAAK,EAAE,GAAG,EAAE,WAAW,EAAE,CAAC,CAAA;IACxF,CAAC;IAED,KAAK,CAAC,eAAe,CAAC,IAAY,EAAE,KAAa;QAC/C,MAAM,UAAU,GAAG,mBAAmB,IAAI,EAAE,CAAA;QAC5C,MAAM,IAAI,GAAG,MAAM,IAAI,CAAC,OAAO,CAAC,UAAU,CAAC,CAAA;QAC3C,MAAM,OAAO,GAAG,IAAI,CAAC,SAAS,CAAC,UAAU,EAAE,IAAI,CAAC,CAAA;QAChD,MAAM,OAAO,GAAG,CAAC,MAAM,IAAI,CAAC,WAAW,CAAC,IAAI,EAAE,KAAK,EAAE,OAAO,CAAC,CAAC,CAAC,MAAM,CACnE,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,KAAK,KAAK,KAAK,IAAI,CAAC,CAAC,KAAK,KAAK,IAAI,KAAK,GAAG,CACrD,CAAA;QACD,KAAK,MAAM,CAAC,IAAI,OAAO;YAAE,MAAM,IAAI,CAAC,YAAY,CAAC,IAAI,EAAE,CAAC,CAAC,EAAE,CAAC,CAAA;IAC9D,CAAC;IAED,KAAK,CAAC,mBAAmB,CAAC,IAAY,EAAE,EAAU;QAChD,MAAM,IAAI,GAAG,MAAM,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,CAAA;QACrC,MAAM,OAAO,GAAG,IAAI,CAAC,SAAS,CAAC,IAAI,EAAE,IAAI,CAAC,CAAA;QAC1C,MAAM,IAAI,GAAG,EAAE,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,GAAG,CAAA;QAC5C,0DAA0D;QAC1D,KAAK,MAAM,CAAC,IAAI,MAAM,IAAI,CAAC,WAAW,CAAC,IAAI,EAAE,IAAI,EAAE,OAAO,CAAC;YAAE,MAAM,IAAI,CAAC,YAAY,CAAC,IAAI,EAAE,CAAC,CAAC,EAAE,CAAC,CAAA;QAChG,MAAM,IAAI,CAAC,YAAY,CAAC,IAAI,EAAE,EAAE,IAAI,EAAE,IAAI,EAAE,OAAO,EAAE,KAAK,EAAE,EAAE,EAAE,GAAG,EAAE,WAAW,EAAE,CAAC,CAAA;IACrF,CAAC;IAED,oBAAoB;IAEZ,SAAS,CAAC,IAAY,EAAE,IAAY;QAC1C,IAAI,IAAI,KAAK,IAAI;YAAE,OAAO,EAAE,CAAA;QAC5B,IAAI,IAAI,CAAC,QAAQ,CAAC,IAAI,IAAI,EAAE,CAAC;YAAE,OAAO,IAAI,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,IAAI,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAA;QACvE,MAAM,IAAI,KAAK,CAAC,GAAG,IAAI,6BAA6B,IAAI,EAAE,CAAC,CAAA;IAC7D,CAAC;IAEO,GAAG,CAAC,IAAY,EAAE,SAAiC,EAAE;QAC3D,MAAM,CAAC,GAAG,IAAI,eAAe,CAAC,MAAM,CAAC,CAAA;QACrC,IAAI,IAAI,CAAC,MAAM;YAAE,CAAC,CAAC,GAAG,CAAC,QAAQ,EAAE,IAAI,CAAC,MAAM,CAAC,CAAA;QAC7C,MAAM,EAAE,GAAG,CAAC,CAAC,QAAQ,EAAE,CAAA;QACvB,OAAO,GAAG,IAAI,CAAC,OAAO,GAAG,IAAI,GAAG,EAAE,CAAC,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,EAAE,CAAA;IACtD,CAAC;IAEO,KAAK,CAAC,OAAO,CAAC,IAAY;QAChC,IAAI,IAAI,CAAC,aAAa;YAAE,OAAO,IAAI,CAAC,aAAa,CAAA;QACjD,MAAM,MAAM,GAAG,IAAI,CAAC,SAAS,CAAC,GAAG,CAAC,IAAI,CAAC,CAAA;QACvC,IAAI,MAAM;YAAE,OAAO,MAAM,CAAA;QACzB,MAAM,KAAK,GAAG,MAAM,IAAI,CAAC,cAAc,EAAE,CAAA;QACzC,MAAM,IAAI,GAAG,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,IAAI,KAAK,CAAC,IAAI,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,MAAM,GAAG,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,CAAA;QAC7G,IAAI,CAAC,IAAI;YAAE,MAAM,IAAI,KAAK,CAAC,8BAA8B,IAAI,EAAE,CAAC,CAAA;QAChE,IAAI,CAAC,SAAS,CAAC,GAAG,CAAC,IAAI,EAAE,IAAI,CAAC,CAAA;QAC9B,OAAO,IAAI,CAAA;IACb,CAAC;IAEO,KAAK,CAAC,WAAW,CAAC,IAAY,EAAE,IAAY,EAAE,OAAe;QACnE,MAAM,QAAQ,GAAG,OAAO,KAAK,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,GAAG,OAAO,IAAI,IAAI,EAAE,CAAA;QAC7D,MAAM,OAAO,GAAG,MAAM,IAAI,CAAC,cAAc,CAAC,IAAI,CAAC,CAAA;QAC/C,OAAO,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,KAAK,IAAI,IAAI,CAAC,CAAC,CAAC,IAAI,KAAK,OAAO,IAAI,CAAC,CAAC,IAAI,KAAK,QAAQ,CAAC,CAAC,CAAA;IAC9F,CAAC;IAED,mFAAmF;IACnF,yEAAyE;IACjE,KAAK,CAAC,cAAc;QAC1B,MAAM,KAAK,GAAa,EAAE,CAAA;QAC1B,IAAI,KAAyB,CAAA;QAC7B,KAAK,IAAI,IAAI,GAAG,CAAC,EAAE,IAAI,GAAG,GAAG,EAAE,IAAI,EAAE,EAAE,CAAC;YACtC,MAAM,MAAM,GAA2B,EAAE,KAAK,EAAE,KAAK,EAAE,CAAA;YACvD,IAAI,KAAK;gBAAE,MAAM,CAAC,KAAK,GAAG,KAAK,CAAA;YAC/B,MAAM,IAAI,GAAG,MAAM,IAAI,CAAC,OAAO,CAC7B,IAAI,CAAC,GAAG,CAAC,aAAa,EAAE,MAAM,CAAC,EAC/B,KAAK,CACN,CAAA;YACD,KAAK,MAAM,CAAC,IAAI,IAAI,CAAC,OAAO;gBAAE,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,CAAA;YAChD,MAAM,IAAI,GAAG,IAAI,CAAC,UAAU,EAAE,IAAI,CAAA;YAClC,IAAI,CAAC,IAAI;gBAAE,MAAK;YAChB,KAAK,GAAG,MAAM,CAAC,IAAI,CAAC,CAAA;QACtB,CAAC;QACD,OAAO,KAAK,CAAA;IACd,CAAC;IAEO,KAAK,CAAC,cAAc,CAAC,IAAY;QACvC,MAAM,GAAG,GAAmB,EAAE,CAAA;QAC9B,IAAI,KAAyB,CAAA;QAC7B,KAAK,IAAI,IAAI,GAAG,CAAC,EAAE,IAAI,GAAG,GAAG,EAAE,IAAI,EAAE,EAAE,CAAC;YACtC,MAAM,MAAM,GAA2B,EAAE,KAAK,EAAE,KAAK,EAAE,CAAA;YACvD,IAAI,KAAK;gBAAE,MAAM,CAAC,KAAK,GAAG,KAAK,CAAA;YAC/B,MAAM,IAAI,GAAG,MAAM,IAAI,CAAC,OAAO,CAC7B,IAAI,CAAC,GAAG,CAAC,eAAe,IAAI,UAAU,EAAE,MAAM,CAAC,EAC/C,KAAK,CACN,CAAA;YACD,GAAG,CAAC,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,OAAO,IAAI,EAAE,CAAC,CAAC,CAAA;YACjC,MAAM,IAAI,GAAG,IAAI,CAAC,UAAU,EAAE,IAAI,CAAA;YAClC,IAAI,CAAC,IAAI;gBAAE,MAAK;YAChB,KAAK,GAAG,MAAM,CAAC,IAAI,CAAC,CAAA;QACtB,CAAC;QACD,OAAO,GAAG,CAAA;IACZ,CAAC;IAEO,KAAK,CAAC,YAAY,CAAC,IAAY,EAAE,MAAkE;QACzG,MAAM,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,GAAG,CAAC,eAAe,IAAI,UAAU,CAAC,EAAE,MAAM,EAAE,MAAM,CAAC,CAAA;IAC7E,CAAC;IAEO,KAAK,CAAC,YAAY,CAAC,IAAY,EAAE,QAAgB;QACvD,MAAM,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,GAAG,CAAC,eAAe,IAAI,YAAY,QAAQ,EAAE,CAAC,EAAE,QAAQ,CAAC,CAAA;IACnF,CAAC;IAEO,KAAK,CAAC,OAAO,CAAI,GAAW,EAAE,MAAc,EAAE,IAAc;QAClE,MAAM,GAAG,GAAG,MAAM,IAAI,CAAC,OAAO,CAAC,GAAG,EAAE;YAClC,MAAM;YACN,OAAO,EAAE,EAAE,aAAa,EAAE,UAAU,IAAI,CAAC,KAAK,EAAE,EAAE,cAAc,EAAE,kBAAkB,EAAE;YACtF,IAAI,EAAE,IAAI,KAAK,SAAS,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC;YAC3D,MAAM,EAAE,WAAW,CAAC,OAAO,CAAC,kBAAkB,CAAC;SAChD,CAAC,CAAA;QACF,MAAM,IAAI,GAAG,CAAC,MAAM,GAAG,CAAC,IAAI,EAAE,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,IAAI,CAAC,CAA4C,CAAA;QAC5F,IAAI,CAAC,GAAG,CAAC,EAAE,EAAE,CAAC;YACZ,MAAM,GAAG,GAAG,IAAI,EAAE,KAAK,EAAE,OAAO,IAAI,QAAQ,GAAG,CAAC,MAAM,EAAE,CAAA;YACxD,MAAM,IAAI,KAAK,CAAC,qBAAqB,GAAG,EAAE,CAAC,CAAA;QAC7C,CAAC;QACD,OAAO,IAAS,CAAA;IAClB,CAAC;CACF;AAED,kGAAkG;AAClG,MAAM,UAAU,gBAAgB,CAAC,QAAiB;IAChD,MAAM,KAAK,GAAG,OAAO,CAAC,GAAG,CAAC,oBAAoB,CAAA;IAC9C,IAAI,CAAC,KAAK;QAAE,MAAM,IAAI,KAAK,CAAC,iCAAiC,CAAC,CAAA;IAC9D,OAAO,IAAI,iBAAiB,CAAC,EAAE,KAAK,EAAE,QAAQ,EAAE,MAAM,EAAE,OAAO,CAAC,GAAG,CAAC,sBAAsB,IAAI,SAAS,EAAE,CAAC,CAAA;AAC5G,CAAC"}

package/dist/lib/cert/accountKey.d.ts

@@ -0,0 +1,2 @@
+export declare function loadOrCreateAccountKey(filePath: string, create: () => Promise<string>): Promise<string>;
+//# sourceMappingURL=accountKey.d.ts.map

package/dist/lib/cert/accountKey.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"accountKey.d.ts","sourceRoot":"","sources":["../../../src/lib/cert/accountKey.ts"],"names":[],"mappings":"AAKA,wBAAsB,sBAAsB,CAAC,QAAQ,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,OAAO,CAAC,MAAM,CAAC,GAAG,OAAO,CAAC,MAAM,CAAC,CAe7G"}

package/dist/lib/cert/accountKey.js

@@ -0,0 +1,23 @@
+import fs from 'fs';
+import path from 'path';
+// ACME 계정 키를 디스크에 캐시한다. 매 발급마다 새 키로 새 LE 계정을 등록하면
+// Accounts-per-IP 한도(3h/10)에 닿을 수 있으므로 재사용한다. 키 파일은 0600.
+export async function loadOrCreateAccountKey(filePath, create) {
+    try {
+        return fs.readFileSync(filePath, 'utf-8');
+    }
+    catch {
+        // not yet created
+    }
+    const key = await create();
+    fs.mkdirSync(path.dirname(filePath), { recursive: true });
+    fs.writeFileSync(filePath, key, { mode: 0o600 });
+    try {
+        fs.chmodSync(filePath, 0o600);
+    }
+    catch {
+        // best-effort on platforms without POSIX permissions
+    }
+    return key;
+}
+//# sourceMappingURL=accountKey.js.map

package/dist/lib/cert/accountKey.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"accountKey.js","sourceRoot":"","sources":["../../../src/lib/cert/accountKey.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,MAAM,IAAI,CAAA;AACnB,OAAO,IAAI,MAAM,MAAM,CAAA;AAEvB,kDAAkD;AAClD,0DAA0D;AAC1D,MAAM,CAAC,KAAK,UAAU,sBAAsB,CAAC,QAAgB,EAAE,MAA6B;IAC1F,IAAI,CAAC;QACH,OAAO,EAAE,CAAC,YAAY,CAAC,QAAQ,EAAE,OAAO,CAAC,CAAA;IAC3C,CAAC;IAAC,MAAM,CAAC;QACP,kBAAkB;IACpB,CAAC;IACD,MAAM,GAAG,GAAG,MAAM,MAAM,EAAE,CAAA;IAC1B,EAAE,CAAC,SAAS,CAAC,IAAI,CAAC,OAAO,CAAC,QAAQ,CAAC,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAA;IACzD,EAAE,CAAC,aAAa,CAAC,QAAQ,EAAE,GAAG,EAAE,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAA;IAChD,IAAI,CAAC;QACH,EAAE,CAAC,SAAS,CAAC,QAAQ,EAAE,KAAK,CAAC,CAAA;IAC/B,CAAC;IAAC,MAAM,CAAC;QACP,qDAAqD;IACvD,CAAC;IACD,OAAO,GAAG,CAAA;AACZ,CAAC"}

package/dist/lib/cert/addressPublisher.d.ts

@@ -0,0 +1,20 @@
+import type { DnsProvider } from './DnsProvider.js';
+export interface AddressPublisherTls {
+    domain: string;
+    dnsProvider: string;
+    /** 자동 감지 대신 쓸 고정 IP. */
+    address?: string;
+}
+export interface AddressPublisherOptions {
+    intervalMs?: number;
+    /** IP 소스 주입(테스트/오버라이드). 기본 = address ?? detectLanIPv4. */
+    getIp?: () => Promise<string | null>;
+    /** DnsProvider 주입(테스트). 기본 = dnsProvider별 env 팩토리. */
+    provider?: DnsProvider;
+    /** IP 불변이어도 이 틱 수마다 강제 재발행(self-heal). 기본 12(~1h). */
+    reassertEveryTicks?: number;
+    onError?: (err: unknown) => void;
+}
+export declare function detectLanIPv4(): Promise<string | null>;
+export declare function startAddressPublisher(tls: AddressPublisherTls, opts?: AddressPublisherOptions): () => void;
+//# sourceMappingURL=addressPublisher.d.ts.map

package/dist/lib/cert/addressPublisher.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"addressPublisher.d.ts","sourceRoot":"","sources":["../../../src/lib/cert/addressPublisher.ts"],"names":[],"mappings":"AAEA,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,kBAAkB,CAAA;AAYnD,MAAM,WAAW,mBAAmB;IAClC,MAAM,EAAE,MAAM,CAAA;IACd,WAAW,EAAE,MAAM,CAAA;IACnB,wBAAwB;IACxB,OAAO,CAAC,EAAE,MAAM,CAAA;CACjB;AAED,MAAM,WAAW,uBAAuB;IACtC,UAAU,CAAC,EAAE,MAAM,CAAA;IACnB,0DAA0D;IAC1D,KAAK,CAAC,EAAE,MAAM,OAAO,CAAC,MAAM,GAAG,IAAI,CAAC,CAAA;IACpC,sDAAsD;IACtD,QAAQ,CAAC,EAAE,WAAW,CAAA;IACtB,sDAAsD;IACtD,kBAAkB,CAAC,EAAE,MAAM,CAAA;IAC3B,OAAO,CAAC,EAAE,CAAC,GAAG,EAAE,OAAO,KAAK,IAAI,CAAA;CACjC;AAGD,wBAAgB,aAAa,IAAI,OAAO,CAAC,MAAM,GAAG,IAAI,CAAC,CAsBtD;AAGD,wBAAgB,qBAAqB,CAAC,GAAG,EAAE,mBAAmB,EAAE,IAAI,GAAE,uBAA4B,GAAG,MAAM,IAAI,CAkD9G"}

package/dist/lib/cert/addressPublisher.js

@@ -0,0 +1,103 @@
+import dgram from 'dgram';
+import { createLogger } from '@tapflowio/agent-core';
+import { dnsProviders } from './dnsRegistry.js';
+const logger = createLogger('relay:dns');
+// DHCP로 IP가 바뀔 수 있어 cert 갱신(12h)보다 자주 재확인한다.
+const DEFAULT_INTERVAL_MS = 5 * 60_000;
+// IP 불변이어도 이 틱 수마다 강제 재발행 — 외부에서 지워지거나 바뀐 레코드를 self-heal(기본 ~1h).
+const DEFAULT_REASSERT_TICKS = 12;
+// connect 콜백/error 둘 다 안 오는 극단 케이스에서 영구 await 방지.
+const DETECT_TIMEOUT_MS = 2_000;
+// UDP connect(패킷 미전송)로 기본 라우트 인터페이스 IPv4를 얻는다 — networkInterfaces()는 VPN/멀티NIC 오감지 위험.
+export function detectLanIPv4() {
+    return new Promise((resolve) => {
+        const sock = dgram.createSocket('udp4');
+        let settled = false;
+        const done = (ip) => {
+            if (settled)
+                return;
+            settled = true;
+            clearTimeout(timer);
+            try {
+                sock.close();
+            }
+            catch { /* already closed */ }
+            resolve(ip && ip !== '0.0.0.0' ? ip : null);
+        };
+        const timer = setTimeout(() => done(null), DETECT_TIMEOUT_MS);
+        timer.unref?.();
+        sock.once('error', () => done(null));
+        try {
+            sock.connect(53, '8.8.8.8', () => {
+                try {
+                    done(sock.address().address);
+                }
+                catch {
+                    done(null);
+                }
+            });
+        }
+        catch {
+            done(null);
+        }
+    });
+}
+// byo-api-token일 때 LAN IP를 자기 도메인 A 레코드로 발행 — 팀원은 DNS를 손대지 않고 도메인만 연다.
+export function startAddressPublisher(tls, opts = {}) {
+    const dns = opts.provider ?? dnsProviders.get(tls.dnsProvider)?.fromEnv();
+    if (!dns) {
+        logger.warn(`unknown dnsProvider "${tls.dnsProvider}" — skipping address auto-publish`);
+        return () => { };
+    }
+    const upsert = dns.upsertAddressRecord?.bind(dns);
+    if (!upsert) {
+        logger.warn(`${dns.name} cannot publish A records — skipping address auto-publish`);
+        return () => { };
+    }
+    const getIp = opts.getIp ?? (tls.address ? () => Promise.resolve(tls.address ?? null) : detectLanIPv4);
+    const reassertEvery = opts.reassertEveryTicks ?? DEFAULT_REASSERT_TICKS;
+    let last = null;
+    let skipped = 0;
+    const publish = async () => {
+        try {
+            const ip = await getIp();
+            if (!ip) {
+                logger.warn(`could not determine LAN IP to publish ${tls.domain}`);
+                return;
+            }
+            // 보통은 IP 불변이면 skip하되, reassertEvery 틱마다 한 번은 강제 재발행해 외부 변경을 self-heal한다.
+            if (ip === last && skipped < reassertEvery) {
+                skipped++;
+                return;
+            }
+            await upsert(tls.domain, ip);
+            last = ip;
+            skipped = 0;
+            logger.info(`published ${tls.domain} A -> ${ip}`);
+        }
+        catch (err) {
+            if (opts.onError)
+                opts.onError(err);
+            else
+                logger.warn(`failed to publish ${tls.domain} A record: ${String(err)}`);
+        }
+    };
+    // setInterval이 이전 upsert 완료 전 다음 publish를 시작하면 쓰기가 역순으로 끝나 stale IP가 남을 수 있다.
+    let inFlight = false;
+    const tick = async () => {
+        if (inFlight)
+            return;
+        inFlight = true;
+        try {
+            await publish();
+        }
+        finally {
+            inFlight = false;
+        }
+    };
+    void tick();
+    const timer = setInterval(() => void tick(), opts.intervalMs ?? DEFAULT_INTERVAL_MS);
+    timer.unref?.();
+    return () => clearInterval(timer);
+}
+//# sourceMappingURL=addressPublisher.js.map

package/dist/lib/cert/addressPublisher.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"addressPublisher.js","sourceRoot":"","sources":["../../../src/lib/cert/addressPublisher.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,MAAM,OAAO,CAAA;AACzB,OAAO,EAAE,YAAY,EAAE,MAAM,uBAAuB,CAAA;AAEpD,OAAO,EAAE,YAAY,EAAE,MAAM,kBAAkB,CAAA;AAE/C,MAAM,MAAM,GAAG,YAAY,CAAC,WAAW,CAAC,CAAA;AAExC,6CAA6C;AAC7C,MAAM,mBAAmB,GAAG,CAAC,GAAG,MAAM,CAAA;AACtC,kEAAkE;AAClE,MAAM,sBAAsB,GAAG,EAAE,CAAA;AACjC,kDAAkD;AAClD,MAAM,iBAAiB,GAAG,KAAK,CAAA;AAoB/B,uFAAuF;AACvF,MAAM,UAAU,aAAa;IAC3B,OAAO,IAAI,OAAO,CAAC,CAAC,OAAO,EAAE,EAAE;QAC7B,MAAM,IAAI,GAAG,KAAK,CAAC,YAAY,CAAC,MAAM,CAAC,CAAA;QACvC,IAAI,OAAO,GAAG,KAAK,CAAA;QACnB,MAAM,IAAI,GAAG,CAAC,EAAiB,EAAE,EAAE;YACjC,IAAI,OAAO;gBAAE,OAAM;YACnB,OAAO,GAAG,IAAI,CAAA;YACd,YAAY,CAAC,KAAK,CAAC,CAAA;YACnB,IAAI,CAAC;gBAAC,IAAI,CAAC,KAAK,EAAE,CAAA;YAAC,CAAC;YAAC,MAAM,CAAC,CAAC,oBAAoB,CAAC,CAAC;YACnD,OAAO,CAAC,EAAE,IAAI,EAAE,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,CAAA;QAC7C,CAAC,CAAA;QACD,MAAM,KAAK,GAAG,UAAU,CAAC,GAAG,EAAE,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,iBAAiB,CAAC,CAAA;QAC7D,KAAK,CAAC,KAAK,EAAE,EAAE,CAAA;QACf,IAAI,CAAC,IAAI,CAAC,OAAO,EAAE,GAAG,EAAE,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAA;QACpC,IAAI,CAAC;YACH,IAAI,CAAC,OAAO,CAAC,EAAE,EAAE,SAAS,EAAE,GAAG,EAAE;gBAC/B,IAAI,CAAC;oBAAC,IAAI,CAAC,IAAI,CAAC,OAAO,EAAE,CAAC,OAAO,CAAC,CAAA;gBAAC,CAAC;gBAAC,MAAM,CAAC;oBAAC,IAAI,CAAC,IAAI,CAAC,CAAA;gBAAC,CAAC;YAC3D,CAAC,CAAC,CAAA;QACJ,CAAC;QAAC,MAAM,CAAC;YACP,IAAI,CAAC,IAAI,CAAC,CAAA;QACZ,CAAC;IACH,CAAC,CAAC,CAAA;AACJ,CAAC;AAED,uEAAuE;AACvE,MAAM,UAAU,qBAAqB,CAAC,GAAwB,EAAE,OAAgC,EAAE;IAChG,MAAM,GAAG,GAAG,IAAI,CAAC,QAAQ,IAAI,YAAY,CAAC,GAAG,CAAC,GAAG,CAAC,WAAW,CAAC,EAAE,OAAO,EAAE,CAAA;IACzE,IAAI,CAAC,GAAG,EAAE,CAAC;QACT,MAAM,CAAC,IAAI,CAAC,wBAAwB,GAAG,CAAC,WAAW,mCAAmC,CAAC,CAAA;QACvF,OAAO,GAAG,EAAE,GAAE,CAAC,CAAA;IACjB,CAAC;IACD,MAAM,MAAM,GAAG,GAAG,CAAC,mBAAmB,EAAE,IAAI,CAAC,GAAG,CAAC,CAAA;IACjD,IAAI,CAAC,MAAM,EAAE,CAAC;QACZ,MAAM,CAAC,IAAI,CAAC,GAAG,GAAG,CAAC,IAAI,2DAA2D,CAAC,CAAA;QACnF,OAAO,GAAG,EAAE,GAAE,CAAC,CAAA;IACjB,CAAC;IACD,MAAM,KAAK,GAAG,IAAI,CAAC,KAAK,IAAI,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,GAAG,EAAE,CAAC,OAAO,CAAC,OAAO,CAAC,GAAG,CAAC,OAAO,IAAI,IAAI,CAAC,CAAC,CAAC,CAAC,aAAa,CAAC,CAAA;IACtG,MAAM,aAAa,GAAG,IAAI,CAAC,kBAAkB,IAAI,sBAAsB,CAAA;IACvE,IAAI,IAAI,GAAkB,IAAI,CAAA;IAC9B,IAAI,OAAO,GAAG,CAAC,CAAA;IAEf,MAAM,OAAO,GAAG,KAAK,IAAmB,EAAE;QACxC,IAAI,CAAC;YACH,MAAM,EAAE,GAAG,MAAM,KAAK,EAAE,CAAA;YACxB,IAAI,CAAC,EAAE,EAAE,CAAC;gBACR,MAAM,CAAC,IAAI,CAAC,yCAAyC,GAAG,CAAC,MAAM,EAAE,CAAC,CAAA;gBAClE,OAAM;YACR,CAAC;YACD,yEAAyE;YACzE,IAAI,EAAE,KAAK,IAAI,IAAI,OAAO,GAAG,aAAa,EAAE,CAAC;gBAC3C,OAAO,EAAE,CAAA;gBACT,OAAM;YACR,CAAC;YACD,MAAM,MAAM,CAAC,GAAG,CAAC,MAAM,EAAE,EAAE,CAAC,CAAA;YAC5B,IAAI,GAAG,EAAE,CAAA;YACT,OAAO,GAAG,CAAC,CAAA;YACX,MAAM,CAAC,IAAI,CAAC,aAAa,GAAG,CAAC,MAAM,SAAS,EAAE,EAAE,CAAC,CAAA;QACnD,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,IAAI,IAAI,CAAC,OAAO;gBAAE,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,CAAA;;gBAC9B,MAAM,CAAC,IAAI,CAAC,qBAAqB,GAAG,CAAC,MAAM,cAAc,MAAM,CAAC,GAAG,CAAC,EAAE,CAAC,CAAA;QAC9E,CAAC;IACH,CAAC,CAAA;IAED,8EAA8E;IAC9E,IAAI,QAAQ,GAAG,KAAK,CAAA;IACpB,MAAM,IAAI,GAAG,KAAK,IAAmB,EAAE;QACrC,IAAI,QAAQ;YAAE,OAAM;QACpB,QAAQ,GAAG,IAAI,CAAA;QACf,IAAI,CAAC;YAAC,MAAM,OAAO,EAAE,CAAA;QAAC,CAAC;gBAAS,CAAC;YAAC,QAAQ,GAAG,KAAK,CAAA;QAAC,CAAC;IACtD,CAAC,CAAA;IAED,KAAK,IAAI,EAAE,CAAA;IACX,MAAM,KAAK,GAAG,WAAW,CAAC,GAAG,EAAE,CAAC,KAAK,IAAI,EAAE,EAAE,IAAI,CAAC,UAAU,IAAI,mBAAmB,CAAC,CAAA;IACpF,KAAK,CAAC,KAAK,EAAE,EAAE,CAAA;IACf,OAAO,GAAG,EAAE,CAAC,aAAa,CAAC,KAAK,CAAC,CAAA;AACnC,CAAC"}

package/dist/lib/cert/createCertProvider.d.ts

@@ -0,0 +1,20 @@
+import type { CertProvider } from './CertProvider.js';
+export type TlsConfig = {
+    mode: 'byo-api-token';
+    domain: string;
+    dnsProvider: string;
+} | {
+    mode: 'import-cert';
+    certPath: string;
+    keyPath: string;
+};
+export interface CreateCertProviderDeps {
+    dataDir: string;
+    /** ACME 계정 이메일. 기본 env TAPFLOW_ACME_EMAIL. */
+    email?: string;
+    /** LE 스테이징 사용(테스트). 기본 env TAPFLOW_ACME_STAGING === '1'. */
+    staging?: boolean;
+}
+/** config.tls를 적절한 CertProvider로 매핑한다. 비밀(토큰)은 env에서 읽는다. */
+export declare function createCertProvider(tls: TlsConfig, deps: CreateCertProviderDeps): CertProvider;
+//# sourceMappingURL=createCertProvider.d.ts.map

package/dist/lib/cert/createCertProvider.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"createCertProvider.d.ts","sourceRoot":"","sources":["../../../src/lib/cert/createCertProvider.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,mBAAmB,CAAA;AASrD,MAAM,MAAM,SAAS,GACjB;IAAE,IAAI,EAAE,eAAe,CAAC;IAAC,MAAM,EAAE,MAAM,CAAC;IAAC,WAAW,EAAE,MAAM,CAAA;CAAE,GAC9D;IAAE,IAAI,EAAE,aAAa,CAAC;IAAC,QAAQ,EAAE,MAAM,CAAC;IAAC,OAAO,EAAE,MAAM,CAAA;CAAE,CAAA;AAE9D,MAAM,WAAW,sBAAsB;IACrC,OAAO,EAAE,MAAM,CAAA;IACf,8CAA8C;IAC9C,KAAK,CAAC,EAAE,MAAM,CAAA;IACd,4DAA4D;IAC5D,OAAO,CAAC,EAAE,OAAO,CAAA;CAClB;AAED,6DAA6D;AAC7D,wBAAgB,kBAAkB,CAAC,GAAG,EAAE,SAAS,EAAE,IAAI,EAAE,sBAAsB,GAAG,YAAY,CAe7F"}

package/dist/lib/cert/createCertProvider.js

@@ -0,0 +1,25 @@
+import path from 'path';
+import { AcmeCertProvider } from './AcmeCertProvider.js';
+import { AcmeClientIssuer } from './AcmeClientIssuer.js';
+import { dnsProviders } from './dnsRegistry.js';
+import { ImportCertProvider } from './ImportCertProvider.js';
+import { DiskCertStore } from './DiskCertStore.js';
+/** config.tls를 적절한 CertProvider로 매핑한다. 비밀(토큰)은 env에서 읽는다. */
+export function createCertProvider(tls, deps) {
+    if (tls.mode === 'import-cert') {
+        return new ImportCertProvider({ certPath: tls.certPath, keyPath: tls.keyPath });
+    }
+    // byo-api-token: 레지스트리에서 provider를 찾아 자기 DNS 계정 토큰(env)으로 DNS-01.
+    const entry = dnsProviders.get(tls.dnsProvider);
+    if (!entry)
+        throw new Error(`unknown dnsProvider "${tls.dnsProvider}" — available: ${dnsProviders.names().join(', ')}`);
+    const dns = entry.fromEnv();
+    const issuer = new AcmeClientIssuer({
+        email: deps.email ?? process.env.TAPFLOW_ACME_EMAIL ?? '',
+        staging: deps.staging ?? process.env.TAPFLOW_ACME_STAGING === '1',
+        accountKeyPath: path.join(deps.dataDir, 'tls', 'account.pem'),
+    });
+    const store = new DiskCertStore(path.join(deps.dataDir, 'tls'));
+    return new AcmeCertProvider({ domain: tls.domain, dns, issuer, store });
+}
+//# sourceMappingURL=createCertProvider.js.map

package/dist/lib/cert/createCertProvider.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"createCertProvider.js","sourceRoot":"","sources":["../../../src/lib/cert/createCertProvider.ts"],"names":[],"mappings":"AAAA,OAAO,IAAI,MAAM,MAAM,CAAA;AAGvB,OAAO,EAAE,gBAAgB,EAAE,MAAM,uBAAuB,CAAA;AACxD,OAAO,EAAE,gBAAgB,EAAE,MAAM,uBAAuB,CAAA;AACxD,OAAO,EAAE,YAAY,EAAE,MAAM,kBAAkB,CAAA;AAC/C,OAAO,EAAE,kBAAkB,EAAE,MAAM,yBAAyB,CAAA;AAC5D,OAAO,EAAE,aAAa,EAAE,MAAM,oBAAoB,CAAA;AAelD,6DAA6D;AAC7D,MAAM,UAAU,kBAAkB,CAAC,GAAc,EAAE,IAA4B;IAC7E,IAAI,GAAG,CAAC,IAAI,KAAK,aAAa,EAAE,CAAC;QAC/B,OAAO,IAAI,kBAAkB,CAAC,EAAE,QAAQ,EAAE,GAAG,CAAC,QAAQ,EAAE,OAAO,EAAE,GAAG,CAAC,OAAO,EAAE,CAAC,CAAA;IACjF,CAAC;IACD,kEAAkE;IAClE,MAAM,KAAK,GAAG,YAAY,CAAC,GAAG,CAAC,GAAG,CAAC,WAAW,CAAC,CAAA;IAC/C,IAAI,CAAC,KAAK;QAAE,MAAM,IAAI,KAAK,CAAC,wBAAwB,GAAG,CAAC,WAAW,kBAAkB,YAAY,CAAC,KAAK,EAAE,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,CAAA;IACvH,MAAM,GAAG,GAAgB,KAAK,CAAC,OAAO,EAAE,CAAA;IACxC,MAAM,MAAM,GAAG,IAAI,gBAAgB,CAAC;QAClC,KAAK,EAAE,IAAI,CAAC,KAAK,IAAI,OAAO,CAAC,GAAG,CAAC,kBAAkB,IAAI,EAAE;QACzD,OAAO,EAAE,IAAI,CAAC,OAAO,IAAI,OAAO,CAAC,GAAG,CAAC,oBAAoB,KAAK,GAAG;QACjE,cAAc,EAAE,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,OAAO,EAAE,KAAK,EAAE,aAAa,CAAC;KAC9D,CAAC,CAAA;IACF,MAAM,KAAK,GAAG,IAAI,aAAa,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,OAAO,EAAE,KAAK,CAAC,CAAC,CAAA;IAC/D,OAAO,IAAI,gBAAgB,CAAC,EAAE,MAAM,EAAE,GAAG,CAAC,MAAM,EAAE,GAAG,EAAE,MAAM,EAAE,KAAK,EAAE,CAAC,CAAA;AACzE,CAAC"}

package/dist/lib/cert/dnsRegistry.d.ts

@@ -0,0 +1,24 @@
+import type { DnsProvider } from './DnsProvider.js';
+export interface DnsProviderEntry {
+    /** config의 dnsProvider 값이자 식별자. */
+    name: string;
+    /** wizard 표시 라벨. */
+    label: string;
+    /** wizard 힌트. */
+    hint: string;
+    /** 자격 증명 env 변수(검증·요약용). 비밀은 config가 아니라 env에서만 읽는다. */
+    envVars: string[];
+    /** env에서 자격을 읽어 DnsProvider를 만든다(미설정 시 throw). */
+    fromEnv(zoneName?: string): DnsProvider;
+}
+declare class DnsProviderRegistry {
+    private readonly entries;
+    register(entry: DnsProviderEntry): void;
+    get(name: string): DnsProviderEntry | undefined;
+    has(name: string): boolean;
+    list(): DnsProviderEntry[];
+    names(): string[];
+}
+export declare const dnsProviders: DnsProviderRegistry;
+export {};
+//# sourceMappingURL=dnsRegistry.d.ts.map

package/dist/lib/cert/dnsRegistry.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"dnsRegistry.d.ts","sourceRoot":"","sources":["../../../src/lib/cert/dnsRegistry.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,kBAAkB,CAAA;AAMnD,MAAM,WAAW,gBAAgB;IAC/B,mCAAmC;IACnC,IAAI,EAAE,MAAM,CAAA;IACZ,oBAAoB;IACpB,KAAK,EAAE,MAAM,CAAA;IACb,iBAAiB;IACjB,IAAI,EAAE,MAAM,CAAA;IACZ,wDAAwD;IACxD,OAAO,EAAE,MAAM,EAAE,CAAA;IACjB,kDAAkD;IAClD,OAAO,CAAC,QAAQ,CAAC,EAAE,MAAM,GAAG,WAAW,CAAA;CACxC;AAED,cAAM,mBAAmB;IACvB,OAAO,CAAC,QAAQ,CAAC,OAAO,CAAsC;IAC9D,QAAQ,CAAC,KAAK,EAAE,gBAAgB,GAAG,IAAI;IAGvC,GAAG,CAAC,IAAI,EAAE,MAAM,GAAG,gBAAgB,GAAG,SAAS;IAG/C,GAAG,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO;IAG1B,IAAI,IAAI,gBAAgB,EAAE;IAG1B,KAAK,IAAI,MAAM,EAAE;CAGlB;AAED,eAAO,MAAM,YAAY,qBAA4B,CAAA"}

package/dist/lib/cert/dnsRegistry.js

@@ -0,0 +1,36 @@
+import { cloudflareDnsFromEnv } from './CloudflareDnsProvider.js';
+import { vercelDnsFromEnv } from './VercelDnsProvider.js';
+class DnsProviderRegistry {
+    entries = new Map();
+    register(entry) {
+        this.entries.set(entry.name, entry);
+    }
+    get(name) {
+        return this.entries.get(name);
+    }
+    has(name) {
+        return this.entries.has(name);
+    }
+    list() {
+        return [...this.entries.values()];
+    }
+    names() {
+        return [...this.entries.keys()];
+    }
+}
+export const dnsProviders = new DnsProviderRegistry();
+dnsProviders.register({
+    name: 'cloudflare',
+    label: 'Cloudflare DNS',
+    hint: 'auto-issue & renew via API token (env TAPFLOW_CLOUDFLARE_TOKEN)',
+    envVars: ['TAPFLOW_CLOUDFLARE_TOKEN'],
+    fromEnv: cloudflareDnsFromEnv,
+});
+dnsProviders.register({
+    name: 'vercel',
+    label: 'Vercel DNS',
+    hint: 'auto-issue & renew via API token (env TAPFLOW_VERCEL_TOKEN)',
+    envVars: ['TAPFLOW_VERCEL_TOKEN'],
+    fromEnv: vercelDnsFromEnv,
+});
+//# sourceMappingURL=dnsRegistry.js.map

package/dist/lib/cert/dnsRegistry.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"dnsRegistry.js","sourceRoot":"","sources":["../../../src/lib/cert/dnsRegistry.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,oBAAoB,EAAE,MAAM,4BAA4B,CAAA;AACjE,OAAO,EAAE,gBAAgB,EAAE,MAAM,wBAAwB,CAAA;AAiBzD,MAAM,mBAAmB;IACN,OAAO,GAAG,IAAI,GAAG,EAA4B,CAAA;IAC9D,QAAQ,CAAC,KAAuB;QAC9B,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,IAAI,EAAE,KAAK,CAAC,CAAA;IACrC,CAAC;IACD,GAAG,CAAC,IAAY;QACd,OAAO,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,IAAI,CAAC,CAAA;IAC/B,CAAC;IACD,GAAG,CAAC,IAAY;QACd,OAAO,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,IAAI,CAAC,CAAA;IAC/B,CAAC;IACD,IAAI;QACF,OAAO,CAAC,GAAG,IAAI,CAAC,OAAO,CAAC,MAAM,EAAE,CAAC,CAAA;IACnC,CAAC;IACD,KAAK;QACH,OAAO,CAAC,GAAG,IAAI,CAAC,OAAO,CAAC,IAAI,EAAE,CAAC,CAAA;IACjC,CAAC;CACF;AAED,MAAM,CAAC,MAAM,YAAY,GAAG,IAAI,mBAAmB,EAAE,CAAA;AAErD,YAAY,CAAC,QAAQ,CAAC;IACpB,IAAI,EAAE,YAAY;IAClB,KAAK,EAAE,gBAAgB;IACvB,IAAI,EAAE,iEAAiE;IACvE,OAAO,EAAE,CAAC,0BAA0B,CAAC;IACrC,OAAO,EAAE,oBAAoB;CAC9B,CAAC,CAAA;AACF,YAAY,CAAC,QAAQ,CAAC;IACpB,IAAI,EAAE,QAAQ;IACd,KAAK,EAAE,YAAY;IACnB,IAAI,EAAE,6DAA6D;IACnE,OAAO,EAAE,CAAC,sBAAsB,CAAC;IACjC,OAAO,EAAE,gBAAgB;CAC1B,CAAC,CAAA"}

package/dist/lib/cert/index.d.ts

@@ -0,0 +1,23 @@
+export type { CertProvider, CertMaterial, CertStrategy } from './CertProvider.js';
+export type { DnsProvider } from './DnsProvider.js';
+export { CloudflareDnsProvider, cloudflareDnsFromEnv } from './CloudflareDnsProvider.js';
+export type { CloudflareDnsProviderOptions, FetchLike } from './CloudflareDnsProvider.js';
+export { VercelDnsProvider, vercelDnsFromEnv } from './VercelDnsProvider.js';
+export type { VercelDnsProviderOptions } from './VercelDnsProvider.js';
+export { AcmeCertProvider, InMemoryCertStore } from './AcmeCertProvider.js';
+export type { AcmeIssuer, IssuedCert, CertStore, AcmeCertProviderOptions } from './AcmeCertProvider.js';
+export { AcmeClientIssuer } from './AcmeClientIssuer.js';
+export type { AcmeClientIssuerOptions } from './AcmeClientIssuer.js';
+export { ImportCertProvider } from './ImportCertProvider.js';
+export type { ImportCertProviderOptions } from './ImportCertProvider.js';
+export { parseCertNotAfter } from './parseCert.js';
+export { DiskCertStore } from './DiskCertStore.js';
+export { startCertRenewal, renewalTick } from './renewal.js';
+export type { CertRenewalOptions } from './renewal.js';
+export { startAddressPublisher, detectLanIPv4 } from './addressPublisher.js';
+export type { AddressPublisherTls, AddressPublisherOptions } from './addressPublisher.js';
+export { dnsProviders } from './dnsRegistry.js';
+export type { DnsProviderEntry } from './dnsRegistry.js';
+export { createCertProvider } from './createCertProvider.js';
+export type { TlsConfig, CreateCertProviderDeps } from './createCertProvider.js';
+//# sourceMappingURL=index.d.ts.map

package/dist/lib/cert/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../src/lib/cert/index.ts"],"names":[],"mappings":"AAAA,YAAY,EAAE,YAAY,EAAE,YAAY,EAAE,YAAY,EAAE,MAAM,mBAAmB,CAAA;AACjF,YAAY,EAAE,WAAW,EAAE,MAAM,kBAAkB,CAAA;AACnD,OAAO,EAAE,qBAAqB,EAAE,oBAAoB,EAAE,MAAM,4BAA4B,CAAA;AACxF,YAAY,EAAE,4BAA4B,EAAE,SAAS,EAAE,MAAM,4BAA4B,CAAA;AACzF,OAAO,EAAE,iBAAiB,EAAE,gBAAgB,EAAE,MAAM,wBAAwB,CAAA;AAC5E,YAAY,EAAE,wBAAwB,EAAE,MAAM,wBAAwB,CAAA;AACtE,OAAO,EAAE,gBAAgB,EAAE,iBAAiB,EAAE,MAAM,uBAAuB,CAAA;AAC3E,YAAY,EAAE,UAAU,EAAE,UAAU,EAAE,SAAS,EAAE,uBAAuB,EAAE,MAAM,uBAAuB,CAAA;AACvG,OAAO,EAAE,gBAAgB,EAAE,MAAM,uBAAuB,CAAA;AACxD,YAAY,EAAE,uBAAuB,EAAE,MAAM,uBAAuB,CAAA;AACpE,OAAO,EAAE,kBAAkB,EAAE,MAAM,yBAAyB,CAAA;AAC5D,YAAY,EAAE,yBAAyB,EAAE,MAAM,yBAAyB,CAAA;AACxE,OAAO,EAAE,iBAAiB,EAAE,MAAM,gBAAgB,CAAA;AAClD,OAAO,EAAE,aAAa,EAAE,MAAM,oBAAoB,CAAA;AAClD,OAAO,EAAE,gBAAgB,EAAE,WAAW,EAAE,MAAM,cAAc,CAAA;AAC5D,YAAY,EAAE,kBAAkB,EAAE,MAAM,cAAc,CAAA;AACtD,OAAO,EAAE,qBAAqB,EAAE,aAAa,EAAE,MAAM,uBAAuB,CAAA;AAC5E,YAAY,EAAE,mBAAmB,EAAE,uBAAuB,EAAE,MAAM,uBAAuB,CAAA;AACzF,OAAO,EAAE,YAAY,EAAE,MAAM,kBAAkB,CAAA;AAC/C,YAAY,EAAE,gBAAgB,EAAE,MAAM,kBAAkB,CAAA;AACxD,OAAO,EAAE,kBAAkB,EAAE,MAAM,yBAAyB,CAAA;AAC5D,YAAY,EAAE,SAAS,EAAE,sBAAsB,EAAE,MAAM,yBAAyB,CAAA"}

package/dist/lib/cert/index.js

@@ -0,0 +1,12 @@
+export { CloudflareDnsProvider, cloudflareDnsFromEnv } from './CloudflareDnsProvider.js';
+export { VercelDnsProvider, vercelDnsFromEnv } from './VercelDnsProvider.js';
+export { AcmeCertProvider, InMemoryCertStore } from './AcmeCertProvider.js';
+export { AcmeClientIssuer } from './AcmeClientIssuer.js';
+export { ImportCertProvider } from './ImportCertProvider.js';
+export { parseCertNotAfter } from './parseCert.js';
+export { DiskCertStore } from './DiskCertStore.js';
+export { startCertRenewal, renewalTick } from './renewal.js';
+export { startAddressPublisher, detectLanIPv4 } from './addressPublisher.js';
+export { dnsProviders } from './dnsRegistry.js';
+export { createCertProvider } from './createCertProvider.js';
+//# sourceMappingURL=index.js.map

package/dist/lib/cert/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../../src/lib/cert/index.ts"],"names":[],"mappings":"AAEA,OAAO,EAAE,qBAAqB,EAAE,oBAAoB,EAAE,MAAM,4BAA4B,CAAA;AAExF,OAAO,EAAE,iBAAiB,EAAE,gBAAgB,EAAE,MAAM,wBAAwB,CAAA;AAE5E,OAAO,EAAE,gBAAgB,EAAE,iBAAiB,EAAE,MAAM,uBAAuB,CAAA;AAE3E,OAAO,EAAE,gBAAgB,EAAE,MAAM,uBAAuB,CAAA;AAExD,OAAO,EAAE,kBAAkB,EAAE,MAAM,yBAAyB,CAAA;AAE5D,OAAO,EAAE,iBAAiB,EAAE,MAAM,gBAAgB,CAAA;AAClD,OAAO,EAAE,aAAa,EAAE,MAAM,oBAAoB,CAAA;AAClD,OAAO,EAAE,gBAAgB,EAAE,WAAW,EAAE,MAAM,cAAc,CAAA;AAE5D,OAAO,EAAE,qBAAqB,EAAE,aAAa,EAAE,MAAM,uBAAuB,CAAA;AAE5E,OAAO,EAAE,YAAY,EAAE,MAAM,kBAAkB,CAAA;AAE/C,OAAO,EAAE,kBAAkB,EAAE,MAAM,yBAAyB,CAAA"}

package/dist/lib/cert/parseCert.d.ts

@@ -0,0 +1,3 @@
+/** PEM 인증서에서 notAfter(만료 시각)를 파싱한다. 잘못된 PEM이면 throw. */
+export declare function parseCertNotAfter(certPem: string): Date;
+//# sourceMappingURL=parseCert.d.ts.map

package/dist/lib/cert/parseCert.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"parseCert.d.ts","sourceRoot":"","sources":["../../../src/lib/cert/parseCert.ts"],"names":[],"mappings":"AAEA,wDAAwD;AACxD,wBAAgB,iBAAiB,CAAC,OAAO,EAAE,MAAM,GAAG,IAAI,CAEvD"}

package/dist/lib/cert/parseCert.js

@@ -0,0 +1,6 @@
+import { X509Certificate } from 'crypto';
+/** PEM 인증서에서 notAfter(만료 시각)를 파싱한다. 잘못된 PEM이면 throw. */
+export function parseCertNotAfter(certPem) {
+    return new Date(new X509Certificate(certPem).validTo);
+}
+//# sourceMappingURL=parseCert.js.map

package/dist/lib/cert/parseCert.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"parseCert.js","sourceRoot":"","sources":["../../../src/lib/cert/parseCert.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,eAAe,EAAE,MAAM,QAAQ,CAAA;AAExC,wDAAwD;AACxD,MAAM,UAAU,iBAAiB,CAAC,OAAe;IAC/C,OAAO,IAAI,IAAI,CAAC,IAAI,eAAe,CAAC,OAAO,CAAC,CAAC,OAAO,CAAC,CAAA;AACvD,CAAC"}

package/dist/lib/cert/renewal.d.ts

@@ -0,0 +1,13 @@
+import type { CertProvider, CertMaterial } from './CertProvider.js';
+export interface CertRenewalOptions {
+    intervalMs?: number;
+    /** 갱신이 일어났을 때(새 자료) 호출 — 예: relay TLS 컨텍스트 핫스왑. */
+    onRenew?: (material: CertMaterial) => void;
+    /** 갱신 중 오류. 미지정 시 경고 로그. 절대 전파하지 않는다. */
+    onError?: (err: unknown) => void;
+}
+/** 1회 점검 — renewIfNeeded 호출, 갱신 시 onRenew, 오류는 삼키고 onError/로그. */
+export declare function renewalTick(provider: CertProvider, opts?: CertRenewalOptions): Promise<void>;
+/** 주기 갱신 타이머를 시작하고 정지 함수를 반환한다. */
+export declare function startCertRenewal(provider: CertProvider, opts?: CertRenewalOptions): () => void;
+//# sourceMappingURL=renewal.d.ts.map

package/dist/lib/cert/renewal.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"renewal.d.ts","sourceRoot":"","sources":["../../../src/lib/cert/renewal.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,YAAY,EAAE,YAAY,EAAE,MAAM,mBAAmB,CAAA;AAOnE,MAAM,WAAW,kBAAkB;IACjC,UAAU,CAAC,EAAE,MAAM,CAAA;IACnB,mDAAmD;IACnD,OAAO,CAAC,EAAE,CAAC,QAAQ,EAAE,YAAY,KAAK,IAAI,CAAA;IAC1C,yCAAyC;IACzC,OAAO,CAAC,EAAE,CAAC,GAAG,EAAE,OAAO,KAAK,IAAI,CAAA;CACjC;AAED,kEAAkE;AAClE,wBAAsB,WAAW,CAAC,QAAQ,EAAE,YAAY,EAAE,IAAI,GAAE,kBAAuB,GAAG,OAAO,CAAC,IAAI,CAAC,CAQtG;AAED,mCAAmC;AACnC,wBAAgB,gBAAgB,CAAC,QAAQ,EAAE,YAAY,EAAE,IAAI,GAAE,kBAAuB,GAAG,MAAM,IAAI,CAOlG"}

package/dist/lib/cert/renewal.js

@@ -0,0 +1,28 @@
+import { createLogger } from '@tapflowio/agent-core';
+const logger = createLogger('relay:cert');
+// ACME 클라이언트 관례대로 하루 두 번 점검. 실제 발급은 만료 30일 이내일 때만 일어난다.
+const DEFAULT_INTERVAL_MS = 12 * 60 * 60 * 1000;
+/** 1회 점검 — renewIfNeeded 호출, 갱신 시 onRenew, 오류는 삼키고 onError/로그. */
+export async function renewalTick(provider, opts = {}) {
+    try {
+        const renewed = await provider.renewIfNeeded();
+        if (renewed)
+            opts.onRenew?.(renewed);
+    }
+    catch (err) {
+        if (opts.onError)
+            opts.onError(err);
+        else
+            logger.warn(`cert renewal failed: ${String(err)}`);
+    }
+}
+/** 주기 갱신 타이머를 시작하고 정지 함수를 반환한다. */
+export function startCertRenewal(provider, opts = {}) {
+    const interval = opts.intervalMs ?? DEFAULT_INTERVAL_MS;
+    const timer = setInterval(() => {
+        void renewalTick(provider, opts);
+    }, interval);
+    timer.unref?.();
+    return () => clearInterval(timer);
+}
+//# sourceMappingURL=renewal.js.map

package/dist/lib/cert/renewal.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"renewal.js","sourceRoot":"","sources":["../../../src/lib/cert/renewal.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,YAAY,EAAE,MAAM,uBAAuB,CAAA;AAGpD,MAAM,MAAM,GAAG,YAAY,CAAC,YAAY,CAAC,CAAA;AAEzC,wDAAwD;AACxD,MAAM,mBAAmB,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,IAAI,CAAA;AAU/C,kEAAkE;AAClE,MAAM,CAAC,KAAK,UAAU,WAAW,CAAC,QAAsB,EAAE,OAA2B,EAAE;IACrF,IAAI,CAAC;QACH,MAAM,OAAO,GAAG,MAAM,QAAQ,CAAC,aAAa,EAAE,CAAA;QAC9C,IAAI,OAAO;YAAE,IAAI,CAAC,OAAO,EAAE,CAAC,OAAO,CAAC,CAAA;IACtC,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,IAAI,IAAI,CAAC,OAAO;YAAE,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,CAAA;;YAC9B,MAAM,CAAC,IAAI,CAAC,wBAAwB,MAAM,CAAC,GAAG,CAAC,EAAE,CAAC,CAAA;IACzD,CAAC;AACH,CAAC;AAED,mCAAmC;AACnC,MAAM,UAAU,gBAAgB,CAAC,QAAsB,EAAE,OAA2B,EAAE;IACpF,MAAM,QAAQ,GAAG,IAAI,CAAC,UAAU,IAAI,mBAAmB,CAAA;IACvD,MAAM,KAAK,GAAG,WAAW,CAAC,GAAG,EAAE;QAC7B,KAAK,WAAW,CAAC,QAAQ,EAAE,IAAI,CAAC,CAAA;IAClC,CAAC,EAAE,QAAQ,CAAC,CAAA;IACZ,KAAK,CAAC,KAAK,EAAE,EAAE,CAAA;IACf,OAAO,GAAG,EAAE,CAAC,aAAa,CAAC,KAAK,CAAC,CAAA;AACnC,CAAC"}