@tapflowio/relay 0.8.2 → 0.9.1

package/dist/api/team.js.map

@@ -1 +1 @@
-{"version":3,"file":"team.js","sourceRoot":"","sources":["../../src/api/team.ts"],"names":[],"mappings":"AACA,OAAO,MAAM,MAAM,QAAQ,CAAA;AAC3B,OAAO,EAAE,KAAK,EAAE,MAAM,UAAU,CAAA;AAChC,OAAO,EAAE,WAAW,EAAE,MAAM,uBAAuB,CAAA;AACnD,OAAO,EAAE,IAAI,EAAE,QAAQ,EAAE,MAAM,cAAc,CAAA;AAC7C,OAAO,EAAE,QAAQ,EAAE,MAAM,kBAAkB,CAAA;AAE3C,MAAM,UAAU,iBAAiB,CAAC,GAAyB,EAAE,GAAwB;IACnF,MAAM,IAAI,GAAG,WAAW,CAAC,GAAG,EAAE,GAAG,EAAE,CAAC,OAAO,CAAC,CAAC,CAAA;IAC7C,IAAI,CAAC,IAAI;QAAE,OAAM;IAEjB,MAAM,EAAE,GAAG,KAAK,EAAE,CAAA;IAClB,MAAM,OAAO,GAAG,EAAE,CAAC,OAAO,CACxB,mFAAmF,CACpF,CAAC,GAAG,EAAE,CAAA;IACP,IAAI,CAAC,GAAG,EAAE,GAAG,EAAE,OAAO,CAAC,CAAA;AACzB,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,YAAY,CAAC,GAAyB,EAAE,GAAwB;IACpF,MAAM,IAAI,GAAG,WAAW,CAAC,GAAG,EAAE,GAAG,EAAE,CAAC,OAAO,CAAC,CAAC,CAAA;IAC7C,IAAI,CAAC,IAAI;QAAE,OAAM;IAEjB,MAAM,IAAI,GAAG,MAAM,QAAQ,CAAoC,GAAG,CAAC,CAAA;IACnE,MAAM,IAAI,GAAG,CAAC,OAAO,EAAE,WAAW,EAAE,IAAI,EAAE,QAAQ,CAAC,CAAC,QAAQ,CAAC,IAAI,CAAC,IAAI,IAAI,EAAE,CAAC;QAC3E,CAAC,CAAC,IAAI,CAAC,IAAK;QACZ,CAAC,CAAC,IAAI,CAAA;IAER,MAAM,KAAK,GAAG,MAAM,CAAC,WAAW,CAAC,EAAE,CAAC,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAA;IACpD,MAAM,SAAS,GAAG,IAAI,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,CAAC,GAAG,EAAE,GAAG,IAAI,GAAG,IAAI,CAAC,CAAC,WAAW,EAAE,CAAA;IAE3E,MAAM,EAAE,GAAG,KAAK,EAAE,CAAA;IAClB,EAAE,CAAC,OAAO,CAAC,8EAA8E,CAAC;SACvF,GAAG,CAAC,KAAK,EAAE,IAAI,CAAC,KAAK,IAAI,IAAI,EAAE,IAAI,EAAE,SAAS,CAAC,CAAA;IAElD,IAAI,SAAS,GAAG,KAAK,CAAA;IACrB,IAAI,IAAI,CAAC,KAAK,EAAE,CAAC;QACf,MAAM,KAAK,GAAI,GAAG,CAAC,OAAO,CAAC,mBAAmB,CAAwB,IAAI,MAAM,CAAA;QAChF,MAAM,SAAS,GAAG,GAAG,KAAK,MAAM,GAAG,CAAC,OAAO,CAAC,IAAI,iBAAiB,KAAK,EAAE,CAAA;QACxE,MAAM,IAAI,GAAG,qDAAqD,IAAI;cAC5D,SAAS;oCACa,CAAA;QAChC,SAAS,GAAG,MAAM,QAAQ,CAAC,IAAI,CAAC,KAAK,EAAE,kCAAkC,EAAE,IAAI,CAAC,CAAA;IAClF,CAAC;IAED,IAAI,CAAC,GAAG,EAAE,GAAG,EAAE,EAAE,KAAK,EAAE,SAAS,EAAE,CAAC,CAAA;AACtC,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,kBAAkB,CACtC,GAAyB,EACzB,GAAwB,EACxB,MAA8B;IAE9B,MAAM,IAAI,GAAG,WAAW,CAAC,GAAG,EAAE,GAAG,EAAE,CAAC,OAAO,CAAC,CAAC,CAAA;IAC7C,IAAI,CAAC,IAAI;QAAE,OAAM;IAEjB,MAAM,IAAI,GAAG,MAAM,QAAQ,CAAoB,GAAG,CAAC,CAAA;IACnD,IAAI,CAAC,IAAI,CAAC,IAAI,IAAI,CAAC,CAAC,OAAO,EAAE,WAAW,EAAE,IAAI,EAAE,QAAQ,CAAC,CAAC,QAAQ,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC;QAC9E,OAAO,IAAI,CAAC,GAAG,EAAE,GAAG,EAAE,EAAE,KAAK,EAAE,qBAAqB,EAAE,CAAC,CAAA;IACzD,CAAC;IAED,MAAM,EAAE,GAAG,KAAK,EAAE,CAAA;IAClB,MAAM,MAAM,GAAG,EAAE,CAAC,OAAO,CAAC,wCAAwC,CAAC,CAAC,GAAG,CAAC,IAAI,CAAC,IAAI,EAAE,MAAM,CAAC,EAAE,CAAC,CAAA;IAC7F,IAAI,MAAM,CAAC,OAAO,KAAK,CAAC;QAAE,OAAO,IAAI,CAAC,GAAG,EAAE,GAAG,EAAE,EAAE,KAAK,EAAE,kBAAkB,EAAE,CAAC,CAAA;IAC9E,IAAI,CAAC,GAAG,EAAE,GAAG,EAAE,EAAE,EAAE,EAAE,IAAI,EAAE,CAAC,CAAA;AAC9B,CAAC;AAED,MAAM,UAAU,kBAAkB,CAChC,GAAyB,EACzB,GAAwB,EACxB,MAA8B;IAE9B,MAAM,IAAI,GAAG,WAAW,CAAC,GAAG,EAAE,GAAG,EAAE,CAAC,OAAO,CAAC,CAAC,CAAA;IAC7C,IAAI,CAAC,IAAI;QAAE,OAAM;IAEjB,IAAI,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,KAAK,MAAM,CAAC,EAAE,EAAE,CAAC;QACtC,OAAO,IAAI,CAAC,GAAG,EAAE,GAAG,EAAE,EAAE,KAAK,EAAE,wBAAwB,EAAE,CAAC,CAAA;IAC5D,CAAC;IAED,MAAM,EAAE,GAAG,KAAK,EAAE,CAAA;IAClB,MAAM,MAAM,GAAG,EAAE,CAAC,OAAO,CAAC,gCAAgC,CAAC,CAAC,GAAG,CAAC,MAAM,CAAC,EAAE,CAAC,CAAA;IAC1E,IAAI,MAAM,CAAC,OAAO,KAAK,CAAC;QAAE,OAAO,IAAI,CAAC,GAAG,EAAE,GAAG,EAAE,EAAE,KAAK,EAAE,kBAAkB,EAAE,CAAC,CAAA;IAC9E,IAAI,CAAC,GAAG,EAAE,GAAG,EAAE,IAAI,CAAC,CAAA;AACtB,CAAC"}
+{"version":3,"file":"team.js","sourceRoot":"","sources":["../../src/api/team.ts"],"names":[],"mappings":"AACA,OAAO,MAAM,MAAM,QAAQ,CAAA;AAC3B,OAAO,EAAE,KAAK,EAAE,MAAM,UAAU,CAAA;AAChC,OAAO,EAAE,WAAW,EAAE,MAAM,uBAAuB,CAAA;AACnD,OAAO,EAAE,IAAI,EAAE,QAAQ,EAAE,MAAM,cAAc,CAAA;AAC7C,OAAO,EAAE,QAAQ,EAAE,MAAM,kBAAkB,CAAA;AAC3C,OAAO,EAAE,MAAM,EAAE,MAAM,kBAAkB,CAAA;AACzC,OAAO,EAAE,kBAAkB,EAAE,MAAM,qBAAqB,CAAA;AAExD,MAAM,UAAU,iBAAiB,CAAC,GAAyB,EAAE,GAAwB;IACnF,MAAM,IAAI,GAAG,WAAW,CAAC,GAAG,EAAE,GAAG,EAAE,CAAC,OAAO,CAAC,CAAC,CAAA;IAC7C,IAAI,CAAC,IAAI;QAAE,OAAM;IAEjB,MAAM,EAAE,GAAG,KAAK,EAAE,CAAA;IAClB,MAAM,OAAO,GAAG,EAAE,CAAC,OAAO,CACxB,mFAAmF,CACpF,CAAC,GAAG,EAAE,CAAA;IACP,IAAI,CAAC,GAAG,EAAE,GAAG,EAAE,OAAO,CAAC,CAAA;AACzB,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,YAAY,CAAC,GAAyB,EAAE,GAAwB;IACpF,MAAM,IAAI,GAAG,WAAW,CAAC,GAAG,EAAE,GAAG,EAAE,CAAC,OAAO,CAAC,CAAC,CAAA;IAC7C,IAAI,CAAC,IAAI;QAAE,OAAM;IAEjB,MAAM,IAAI,GAAG,MAAM,QAAQ,CAAoC,GAAG,CAAC,CAAA;IACnE,MAAM,IAAI,GAAG,CAAC,OAAO,EAAE,WAAW,EAAE,IAAI,EAAE,QAAQ,CAAC,CAAC,QAAQ,CAAC,IAAI,CAAC,IAAI,IAAI,EAAE,CAAC;QAC3E,CAAC,CAAC,IAAI,CAAC,IAAK;QACZ,CAAC,CAAC,IAAI,CAAA;IAER,MAAM,KAAK,GAAG,MAAM,CAAC,WAAW,CAAC,EAAE,CAAC,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAA;IACpD,MAAM,SAAS,GAAG,IAAI,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,CAAC,GAAG,EAAE,GAAG,IAAI,GAAG,IAAI,CAAC,CAAC,WAAW,EAAE,CAAA;IAE3E,MAAM,EAAE,GAAG,KAAK,EAAE,CAAA;IAClB,EAAE,CAAC,OAAO,CAAC,8EAA8E,CAAC;SACvF,GAAG,CAAC,KAAK,EAAE,IAAI,CAAC,KAAK,IAAI,IAAI,EAAE,IAAI,EAAE,SAAS,CAAC,CAAA;IAElD,IAAI,SAAS,GAAG,KAAK,CAAA;IACrB,IAAI,IAAI,CAAC,KAAK,EAAE,CAAC;QACf,iEAAiE;QACjE,MAAM,SAAS,GAAG,GAAG,kBAAkB,CAAC,MAAM,CAAC,iBAAiB,KAAK,EAAE,CAAA;QACvE,MAAM,IAAI,GAAG,qDAAqD,IAAI;cAC5D,SAAS;oCACa,CAAA;QAChC,SAAS,GAAG,MAAM,QAAQ,CAAC,IAAI,CAAC,KAAK,EAAE,kCAAkC,EAAE,IAAI,CAAC,CAAA;IAClF,CAAC;IAED,IAAI,CAAC,GAAG,EAAE,GAAG,EAAE,EAAE,KAAK,EAAE,SAAS,EAAE,CAAC,CAAA;AACtC,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,kBAAkB,CACtC,GAAyB,EACzB,GAAwB,EACxB,MAA8B;IAE9B,MAAM,IAAI,GAAG,WAAW,CAAC,GAAG,EAAE,GAAG,EAAE,CAAC,OAAO,CAAC,CAAC,CAAA;IAC7C,IAAI,CAAC,IAAI;QAAE,OAAM;IAEjB,MAAM,IAAI,GAAG,MAAM,QAAQ,CAAoB,GAAG,CAAC,CAAA;IACnD,IAAI,CAAC,IAAI,CAAC,IAAI,IAAI,CAAC,CAAC,OAAO,EAAE,WAAW,EAAE,IAAI,EAAE,QAAQ,CAAC,CAAC,QAAQ,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC;QAC9E,OAAO,IAAI,CAAC,GAAG,EAAE,GAAG,EAAE,EAAE,KAAK,EAAE,qBAAqB,EAAE,CAAC,CAAA;IACzD,CAAC;IAED,MAAM,EAAE,GAAG,KAAK,EAAE,CAAA;IAClB,MAAM,MAAM,GAAG,EAAE,CAAC,OAAO,CAAC,wCAAwC,CAAC,CAAC,GAAG,CAAC,IAAI,CAAC,IAAI,EAAE,MAAM,CAAC,EAAE,CAAC,CAAA;IAC7F,IAAI,MAAM,CAAC,OAAO,KAAK,CAAC;QAAE,OAAO,IAAI,CAAC,GAAG,EAAE,GAAG,EAAE,EAAE,KAAK,EAAE,kBAAkB,EAAE,CAAC,CAAA;IAC9E,IAAI,CAAC,GAAG,EAAE,GAAG,EAAE,EAAE,EAAE,EAAE,IAAI,EAAE,CAAC,CAAA;AAC9B,CAAC;AAED,MAAM,UAAU,kBAAkB,CAChC,GAAyB,EACzB,GAAwB,EACxB,MAA8B;IAE9B,MAAM,IAAI,GAAG,WAAW,CAAC,GAAG,EAAE,GAAG,EAAE,CAAC,OAAO,CAAC,CAAC,CAAA;IAC7C,IAAI,CAAC,IAAI;QAAE,OAAM;IAEjB,IAAI,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,KAAK,MAAM,CAAC,EAAE,EAAE,CAAC;QACtC,OAAO,IAAI,CAAC,GAAG,EAAE,GAAG,EAAE,EAAE,KAAK,EAAE,wBAAwB,EAAE,CAAC,CAAA;IAC5D,CAAC;IAED,MAAM,EAAE,GAAG,KAAK,EAAE,CAAA;IAClB,MAAM,MAAM,GAAG,EAAE,CAAC,OAAO,CAAC,gCAAgC,CAAC,CAAC,GAAG,CAAC,MAAM,CAAC,EAAE,CAAC,CAAA;IAC1E,IAAI,MAAM,CAAC,OAAO,KAAK,CAAC;QAAE,OAAO,IAAI,CAAC,GAAG,EAAE,GAAG,EAAE,EAAE,KAAK,EAAE,kBAAkB,EAAE,CAAC,CAAA;IAC9E,IAAI,CAAC,GAAG,EAAE,GAAG,EAAE,IAAI,CAAC,CAAA;AACtB,CAAC"}

package/dist/index.d.ts

@@ -1,8 +1,14 @@
 export { RelayServer } from './RelayServer.js';
 export { SessionManager } from './SessionManager.js';
 export { initDb, getDb, closeDb } from './db.js';
-export { config } from './lib/config.js';
+export { config, loadedEnvPath } from './lib/config.js';
 export type { TapflowConfig } from './lib/config.js';
+export { buildCorsOrigins, proxyWithoutPublicUrlWarning } from './lib/proxyConfig.js';
+export type { CertProvider, CertMaterial, CertStrategy } from './lib/cert/index.js';
+export type { DnsProvider } from './lib/cert/index.js';
+export { createCertProvider, startCertRenewal, startAddressPublisher, dnsProviders } from './lib/cert/index.js';
+export type { DnsProviderEntry } from './lib/cert/index.js';
+export type { TlsConfig } from './lib/cert/index.js';
 export type { Session } from './SessionManager.js';
 export type { RelayMessage, MessageType } from './types.js';
 //# sourceMappingURL=index.d.ts.map

package/dist/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,WAAW,EAAE,MAAM,kBAAkB,CAAA;AAC9C,OAAO,EAAE,cAAc,EAAE,MAAM,qBAAqB,CAAA;AACpD,OAAO,EAAE,MAAM,EAAE,KAAK,EAAE,OAAO,EAAE,MAAM,SAAS,CAAA;AAChD,OAAO,EAAE,MAAM,EAAE,MAAM,iBAAiB,CAAA;AACxC,YAAY,EAAE,aAAa,EAAE,MAAM,iBAAiB,CAAA;AACpD,YAAY,EAAE,OAAO,EAAE,MAAM,qBAAqB,CAAA;AAClD,YAAY,EAAE,YAAY,EAAE,WAAW,EAAE,MAAM,YAAY,CAAA"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,WAAW,EAAE,MAAM,kBAAkB,CAAA;AAC9C,OAAO,EAAE,cAAc,EAAE,MAAM,qBAAqB,CAAA;AACpD,OAAO,EAAE,MAAM,EAAE,KAAK,EAAE,OAAO,EAAE,MAAM,SAAS,CAAA;AAChD,OAAO,EAAE,MAAM,EAAE,aAAa,EAAE,MAAM,iBAAiB,CAAA;AACvD,YAAY,EAAE,aAAa,EAAE,MAAM,iBAAiB,CAAA;AACpD,OAAO,EAAE,gBAAgB,EAAE,4BAA4B,EAAE,MAAM,sBAAsB,CAAA;AACrF,YAAY,EAAE,YAAY,EAAE,YAAY,EAAE,YAAY,EAAE,MAAM,qBAAqB,CAAA;AACnF,YAAY,EAAE,WAAW,EAAE,MAAM,qBAAqB,CAAA;AACtD,OAAO,EAAE,kBAAkB,EAAE,gBAAgB,EAAE,qBAAqB,EAAE,YAAY,EAAE,MAAM,qBAAqB,CAAA;AAC/G,YAAY,EAAE,gBAAgB,EAAE,MAAM,qBAAqB,CAAA;AAC3D,YAAY,EAAE,SAAS,EAAE,MAAM,qBAAqB,CAAA;AACpD,YAAY,EAAE,OAAO,EAAE,MAAM,qBAAqB,CAAA;AAClD,YAAY,EAAE,YAAY,EAAE,WAAW,EAAE,MAAM,YAAY,CAAA"}

package/dist/index.js

@@ -1,5 +1,7 @@
 export { RelayServer } from './RelayServer.js';
 export { SessionManager } from './SessionManager.js';
 export { initDb, getDb, closeDb } from './db.js';
-export { config } from './lib/config.js';
+export { config, loadedEnvPath } from './lib/config.js';
+export { buildCorsOrigins, proxyWithoutPublicUrlWarning } from './lib/proxyConfig.js';
+export { createCertProvider, startCertRenewal, startAddressPublisher, dnsProviders } from './lib/cert/index.js';
 //# sourceMappingURL=index.js.map

package/dist/index.js.map

@@ -1 +1 @@
-{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,WAAW,EAAE,MAAM,kBAAkB,CAAA;AAC9C,OAAO,EAAE,cAAc,EAAE,MAAM,qBAAqB,CAAA;AACpD,OAAO,EAAE,MAAM,EAAE,KAAK,EAAE,OAAO,EAAE,MAAM,SAAS,CAAA;AAChD,OAAO,EAAE,MAAM,EAAE,MAAM,iBAAiB,CAAA"}
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,WAAW,EAAE,MAAM,kBAAkB,CAAA;AAC9C,OAAO,EAAE,cAAc,EAAE,MAAM,qBAAqB,CAAA;AACpD,OAAO,EAAE,MAAM,EAAE,KAAK,EAAE,OAAO,EAAE,MAAM,SAAS,CAAA;AAChD,OAAO,EAAE,MAAM,EAAE,aAAa,EAAE,MAAM,iBAAiB,CAAA;AAEvD,OAAO,EAAE,gBAAgB,EAAE,4BAA4B,EAAE,MAAM,sBAAsB,CAAA;AAGrF,OAAO,EAAE,kBAAkB,EAAE,gBAAgB,EAAE,qBAAqB,EAAE,YAAY,EAAE,MAAM,qBAAqB,CAAA"}

package/dist/lib/cert/AcmeCertProvider.d.ts

@@ -0,0 +1,55 @@
+import type { CertProvider, CertMaterial, CertStrategy } from './CertProvider.js';
+import type { DnsProvider } from './DnsProvider.js';
+/** 발급된 인증서 자료(만료 포함). */
+export interface IssuedCert {
+    cert: string;
+    key: string;
+    expiresAt: Date;
+}
+/**
+ * ACME 발급 추상화. 실제 Let's Encrypt 왕복은 AcmeClientIssuer가 구현하고,
+ * 단위 테스트는 fake가 구현한다. 키는 issuer 내부(로컬)에서 생성된다.
+ */
+export interface AcmeIssuer {
+    issue(opts: {
+        domain: string;
+        dns: DnsProvider;
+    }): Promise<IssuedCert>;
+}
+/** cert 영속화 추상화. 기본은 in-memory, 디스크 구현은 갱신 스케줄러 단계에서 주입. */
+export interface CertStore {
+    load(): Promise<CertMaterial | null>;
+    save(material: CertMaterial): Promise<void>;
+}
+export declare class InMemoryCertStore implements CertStore {
+    private material;
+    load(): Promise<CertMaterial | null>;
+    save(material: CertMaterial): Promise<void>;
+}
+export interface AcmeCertProviderOptions {
+    domain: string;
+    dns: DnsProvider;
+    issuer: AcmeIssuer;
+    store?: CertStore;
+    /** 테스트용 시계. 기본 Date.now. */
+    now?: () => number;
+    renewThresholdDays?: number;
+}
+/**
+ * BYO API 토큰 경로의 CertProvider. 로컬에서 발급/갱신하며 키를 외부로 내보내지 않는다.
+ */
+export declare class AcmeCertProvider implements CertProvider {
+    readonly strategy: CertStrategy;
+    private readonly domain;
+    private readonly dns;
+    private readonly issuer;
+    private readonly store;
+    private readonly now;
+    private readonly thresholdMs;
+    private inflight;
+    constructor(opts: AcmeCertProviderOptions);
+    ensureCert(): Promise<CertMaterial>;
+    renewIfNeeded(): Promise<CertMaterial | null>;
+    private issueAndStore;
+}
+//# sourceMappingURL=AcmeCertProvider.d.ts.map

package/dist/lib/cert/AcmeCertProvider.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"AcmeCertProvider.d.ts","sourceRoot":"","sources":["../../../src/lib/cert/AcmeCertProvider.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,YAAY,EAAE,YAAY,EAAE,YAAY,EAAE,MAAM,mBAAmB,CAAA;AACjF,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,kBAAkB,CAAA;AAKnD,yBAAyB;AACzB,MAAM,WAAW,UAAU;IACzB,IAAI,EAAE,MAAM,CAAA;IACZ,GAAG,EAAE,MAAM,CAAA;IACX,SAAS,EAAE,IAAI,CAAA;CAChB;AAED;;;GAGG;AACH,MAAM,WAAW,UAAU;IACzB,KAAK,CAAC,IAAI,EAAE;QAAE,MAAM,EAAE,MAAM,CAAC;QAAC,GAAG,EAAE,WAAW,CAAA;KAAE,GAAG,OAAO,CAAC,UAAU,CAAC,CAAA;CACvE;AAED,4DAA4D;AAC5D,MAAM,WAAW,SAAS;IACxB,IAAI,IAAI,OAAO,CAAC,YAAY,GAAG,IAAI,CAAC,CAAA;IACpC,IAAI,CAAC,QAAQ,EAAE,YAAY,GAAG,OAAO,CAAC,IAAI,CAAC,CAAA;CAC5C;AAED,qBAAa,iBAAkB,YAAW,SAAS;IACjD,OAAO,CAAC,QAAQ,CAA4B;IACtC,IAAI,IAAI,OAAO,CAAC,YAAY,GAAG,IAAI,CAAC;IAGpC,IAAI,CAAC,QAAQ,EAAE,YAAY,GAAG,OAAO,CAAC,IAAI,CAAC;CAGlD;AAED,MAAM,WAAW,uBAAuB;IACtC,MAAM,EAAE,MAAM,CAAA;IACd,GAAG,EAAE,WAAW,CAAA;IAChB,MAAM,EAAE,UAAU,CAAA;IAClB,KAAK,CAAC,EAAE,SAAS,CAAA;IACjB,4BAA4B;IAC5B,GAAG,CAAC,EAAE,MAAM,MAAM,CAAA;IAClB,kBAAkB,CAAC,EAAE,MAAM,CAAA;CAC5B;AAED;;GAEG;AACH,qBAAa,gBAAiB,YAAW,YAAY;IACnD,QAAQ,CAAC,QAAQ,EAAE,YAAY,CAAkB;IACjD,OAAO,CAAC,QAAQ,CAAC,MAAM,CAAQ;IAC/B,OAAO,CAAC,QAAQ,CAAC,GAAG,CAAa;IACjC,OAAO,CAAC,QAAQ,CAAC,MAAM,CAAY;IACnC,OAAO,CAAC,QAAQ,CAAC,KAAK,CAAW;IACjC,OAAO,CAAC,QAAQ,CAAC,GAAG,CAAc;IAClC,OAAO,CAAC,QAAQ,CAAC,WAAW,CAAQ;IAEpC,OAAO,CAAC,QAAQ,CAAqC;gBAEzC,IAAI,EAAE,uBAAuB;IASnC,UAAU,IAAI,OAAO,CAAC,YAAY,CAAC;IAMnC,aAAa,IAAI,OAAO,CAAC,YAAY,GAAG,IAAI,CAAC;IAMnD,OAAO,CAAC,aAAa;CActB"}

package/dist/lib/cert/AcmeCertProvider.js

@@ -0,0 +1,62 @@
+const DAY = 24 * 60 * 60 * 1000;
+const RENEW_THRESHOLD_DAYS = 30;
+export class InMemoryCertStore {
+    material = null;
+    async load() {
+        return this.material;
+    }
+    async save(material) {
+        this.material = material;
+    }
+}
+/**
+ * BYO API 토큰 경로의 CertProvider. 로컬에서 발급/갱신하며 키를 외부로 내보내지 않는다.
+ */
+export class AcmeCertProvider {
+    strategy = 'byo-api-token';
+    domain;
+    dns;
+    issuer;
+    store;
+    now;
+    thresholdMs;
+    // 진행 중 발급을 공유해 동시 호출이 중복 ACME 주문(→ CA 한도)을 내지 않게 한다(single-flight).
+    inflight = null;
+    constructor(opts) {
+        this.domain = opts.domain;
+        this.dns = opts.dns;
+        this.issuer = opts.issuer;
+        this.store = opts.store ?? new InMemoryCertStore();
+        this.now = opts.now ?? Date.now;
+        this.thresholdMs = (opts.renewThresholdDays ?? RENEW_THRESHOLD_DAYS) * DAY;
+    }
+    async ensureCert() {
+        const existing = await this.store.load();
+        if (existing && existing.expiresAt.getTime() > this.now())
+            return existing;
+        return this.issueAndStore();
+    }
+    async renewIfNeeded() {
+        const cur = await this.ensureCert();
+        if (cur.expiresAt.getTime() - this.now() > this.thresholdMs)
+            return null;
+        return this.issueAndStore();
+    }
+    issueAndStore() {
+        if (this.inflight)
+            return this.inflight;
+        this.inflight = (async () => {
+            try {
+                const issued = await this.issuer.issue({ domain: this.domain, dns: this.dns });
+                const material = { cert: issued.cert, key: issued.key, expiresAt: issued.expiresAt };
+                await this.store.save(material);
+                return material;
+            }
+            finally {
+                this.inflight = null;
+            }
+        })();
+        return this.inflight;
+    }
+}
+//# sourceMappingURL=AcmeCertProvider.js.map

package/dist/lib/cert/AcmeCertProvider.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"AcmeCertProvider.js","sourceRoot":"","sources":["../../../src/lib/cert/AcmeCertProvider.ts"],"names":[],"mappings":"AAGA,MAAM,GAAG,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,IAAI,CAAA;AAC/B,MAAM,oBAAoB,GAAG,EAAE,CAAA;AAuB/B,MAAM,OAAO,iBAAiB;IACpB,QAAQ,GAAwB,IAAI,CAAA;IAC5C,KAAK,CAAC,IAAI;QACR,OAAO,IAAI,CAAC,QAAQ,CAAA;IACtB,CAAC;IACD,KAAK,CAAC,IAAI,CAAC,QAAsB;QAC/B,IAAI,CAAC,QAAQ,GAAG,QAAQ,CAAA;IAC1B,CAAC;CACF;AAYD;;GAEG;AACH,MAAM,OAAO,gBAAgB;IAClB,QAAQ,GAAiB,eAAe,CAAA;IAChC,MAAM,CAAQ;IACd,GAAG,CAAa;IAChB,MAAM,CAAY;IAClB,KAAK,CAAW;IAChB,GAAG,CAAc;IACjB,WAAW,CAAQ;IACpC,oEAAoE;IAC5D,QAAQ,GAAiC,IAAI,CAAA;IAErD,YAAY,IAA6B;QACvC,IAAI,CAAC,MAAM,GAAG,IAAI,CAAC,MAAM,CAAA;QACzB,IAAI,CAAC,GAAG,GAAG,IAAI,CAAC,GAAG,CAAA;QACnB,IAAI,CAAC,MAAM,GAAG,IAAI,CAAC,MAAM,CAAA;QACzB,IAAI,CAAC,KAAK,GAAG,IAAI,CAAC,KAAK,IAAI,IAAI,iBAAiB,EAAE,CAAA;QAClD,IAAI,CAAC,GAAG,GAAG,IAAI,CAAC,GAAG,IAAI,IAAI,CAAC,GAAG,CAAA;QAC/B,IAAI,CAAC,WAAW,GAAG,CAAC,IAAI,CAAC,kBAAkB,IAAI,oBAAoB,CAAC,GAAG,GAAG,CAAA;IAC5E,CAAC;IAED,KAAK,CAAC,UAAU;QACd,MAAM,QAAQ,GAAG,MAAM,IAAI,CAAC,KAAK,CAAC,IAAI,EAAE,CAAA;QACxC,IAAI,QAAQ,IAAI,QAAQ,CAAC,SAAS,CAAC,OAAO,EAAE,GAAG,IAAI,CAAC,GAAG,EAAE;YAAE,OAAO,QAAQ,CAAA;QAC1E,OAAO,IAAI,CAAC,aAAa,EAAE,CAAA;IAC7B,CAAC;IAED,KAAK,CAAC,aAAa;QACjB,MAAM,GAAG,GAAG,MAAM,IAAI,CAAC,UAAU,EAAE,CAAA;QACnC,IAAI,GAAG,CAAC,SAAS,CAAC,OAAO,EAAE,GAAG,IAAI,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC,WAAW;YAAE,OAAO,IAAI,CAAA;QACxE,OAAO,IAAI,CAAC,aAAa,EAAE,CAAA;IAC7B,CAAC;IAEO,aAAa;QACnB,IAAI,IAAI,CAAC,QAAQ;YAAE,OAAO,IAAI,CAAC,QAAQ,CAAA;QACvC,IAAI,CAAC,QAAQ,GAAG,CAAC,KAAK,IAAI,EAAE;YAC1B,IAAI,CAAC;gBACH,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,EAAE,MAAM,EAAE,IAAI,CAAC,MAAM,EAAE,GAAG,EAAE,IAAI,CAAC,GAAG,EAAE,CAAC,CAAA;gBAC9E,MAAM,QAAQ,GAAiB,EAAE,IAAI,EAAE,MAAM,CAAC,IAAI,EAAE,GAAG,EAAE,MAAM,CAAC,GAAG,EAAE,SAAS,EAAE,MAAM,CAAC,SAAS,EAAE,CAAA;gBAClG,MAAM,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAA;gBAC/B,OAAO,QAAQ,CAAA;YACjB,CAAC;oBAAS,CAAC;gBACT,IAAI,CAAC,QAAQ,GAAG,IAAI,CAAA;YACtB,CAAC;QACH,CAAC,CAAC,EAAE,CAAA;QACJ,OAAO,IAAI,CAAC,QAAQ,CAAA;IACtB,CAAC;CACF"}

package/dist/lib/cert/AcmeClientIssuer.d.ts

@@ -0,0 +1,23 @@
+import type { DnsProvider } from './DnsProvider.js';
+import type { AcmeIssuer, IssuedCert } from './AcmeCertProvider.js';
+export interface AcmeClientIssuerOptions {
+    /** ACME 계정 이메일. 빈 값이면 생략. */
+    email: string;
+    /** true면 LE 스테이징(테스트), 기본은 프로덕션. */
+    staging?: boolean;
+    /** 영속화된 계정 키(PEM) 직접 주입. */
+    accountKey?: Buffer | string;
+    /** 계정 키를 캐시할 파일 경로 — 없으면 읽고, 없으면 생성·저장(매 발급마다 새 LE 계정 방지). */
+    accountKeyPath?: string;
+    /** TXT 설정 후 LE 검증 전 고정 전파 대기(ms). 기본 60초. */
+    dnsPropagationMs?: number;
+}
+export declare class AcmeClientIssuer implements AcmeIssuer {
+    private readonly opts;
+    constructor(opts: AcmeClientIssuerOptions);
+    issue({ domain, dns }: {
+        domain: string;
+        dns: DnsProvider;
+    }): Promise<IssuedCert>;
+}
+//# sourceMappingURL=AcmeClientIssuer.d.ts.map

package/dist/lib/cert/AcmeClientIssuer.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"AcmeClientIssuer.d.ts","sourceRoot":"","sources":["../../../src/lib/cert/AcmeClientIssuer.ts"],"names":[],"mappings":"AAEA,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,kBAAkB,CAAA;AACnD,OAAO,KAAK,EAAE,UAAU,EAAE,UAAU,EAAE,MAAM,uBAAuB,CAAA;AASnE,MAAM,WAAW,uBAAuB;IACtC,6BAA6B;IAC7B,KAAK,EAAE,MAAM,CAAA;IACb,oCAAoC;IACpC,OAAO,CAAC,EAAE,OAAO,CAAA;IACjB,4BAA4B;IAC5B,UAAU,CAAC,EAAE,MAAM,GAAG,MAAM,CAAA;IAC5B,8DAA8D;IAC9D,cAAc,CAAC,EAAE,MAAM,CAAA;IACvB,6CAA6C;IAC7C,gBAAgB,CAAC,EAAE,MAAM,CAAA;CAC1B;AASD,qBAAa,gBAAiB,YAAW,UAAU;IACrC,OAAO,CAAC,QAAQ,CAAC,IAAI;gBAAJ,IAAI,EAAE,uBAAuB;IAEpD,KAAK,CAAC,EAAE,MAAM,EAAE,GAAG,EAAE,EAAE;QAAE,MAAM,EAAE,MAAM,CAAC;QAAC,GAAG,EAAE,WAAW,CAAA;KAAE,GAAG,OAAO,CAAC,UAAU,CAAC;CA0CxF"}

package/dist/lib/cert/AcmeClientIssuer.js

@@ -0,0 +1,54 @@
+import * as acme from 'acme-client';
+import { createLogger } from '@tapflowio/agent-core';
+import { parseCertNotAfter } from './parseCert.js';
+import { loadOrCreateAccountKey } from './accountKey.js';
+const logger = createLogger('relay:acme');
+// DNS-01 TXT 전파를 위한 고정 대기. 폴링/권위조회는 재귀 리졸버 음성캐시에 취약해 단순 고정 대기를 쓴다.
+const DEFAULT_DNS_PROPAGATION_MS = 60_000;
+function sleep(ms) {
+    return new Promise((resolve) => setTimeout(resolve, ms));
+}
+export class AcmeClientIssuer {
+    opts;
+    constructor(opts) {
+        this.opts = opts;
+    }
+    async issue({ domain, dns }) {
+        const accountKey = this.opts.accountKey ??
+            (this.opts.accountKeyPath
+                ? await loadOrCreateAccountKey(this.opts.accountKeyPath, async () => (await acme.crypto.createPrivateKey()).toString())
+                : await acme.crypto.createPrivateKey());
+        const client = new acme.Client({
+            directoryUrl: this.opts.staging
+                ? acme.directory.letsencrypt.staging
+                : acme.directory.letsencrypt.production,
+            accountKey,
+        });
+        const [key, csr] = await acme.crypto.createCsr({ commonName: domain });
+        const propagationMs = this.opts.dnsPropagationMs ?? DEFAULT_DNS_PROPAGATION_MS;
+        logger.info(`requesting ${this.opts.staging ? 'STAGING' : 'production'} cert for ${domain} via ${dns.name} (dns-01)`);
+        const cert = await client.auto({
+            csr,
+            email: this.opts.email || undefined,
+            termsOfServiceAgreed: true,
+            challengePriority: ['dns-01'],
+            // 우리가 고정 전파 대기를 하므로 acme-client 내부 DNS 재확인은 생략한다(재귀 음성캐시로 정체될 수 있음).
+            // 검증은 LE에 맡긴다(LE는 권위 NS를 직접 조회).
+            skipChallengeVerification: true,
+            challengeCreateFn: async (_authz, _challenge, keyAuthorization) => {
+                logger.info(`setting _acme-challenge.${domain} TXT`);
+                await dns.setTxtRecord(domain, keyAuthorization);
+                logger.info(`TXT set; waiting ${propagationMs}ms for propagation before LE validation`);
+                if (propagationMs > 0)
+                    await sleep(propagationMs);
+                logger.info('handing challenge to ACME for validation');
+            },
+            challengeRemoveFn: async (_authz, _challenge, keyAuthorization) => {
+                await dns.removeTxtRecord(domain, keyAuthorization);
+            },
+        });
+        logger.info(`cert issued for ${domain}`);
+        return { cert, key: key.toString(), expiresAt: parseCertNotAfter(cert) };
+    }
+}
+//# sourceMappingURL=AcmeClientIssuer.js.map

package/dist/lib/cert/AcmeClientIssuer.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"AcmeClientIssuer.js","sourceRoot":"","sources":["../../../src/lib/cert/AcmeClientIssuer.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,IAAI,MAAM,aAAa,CAAA;AACnC,OAAO,EAAE,YAAY,EAAE,MAAM,uBAAuB,CAAA;AAGpD,OAAO,EAAE,iBAAiB,EAAE,MAAM,gBAAgB,CAAA;AAClD,OAAO,EAAE,sBAAsB,EAAE,MAAM,iBAAiB,CAAA;AAExD,MAAM,MAAM,GAAG,YAAY,CAAC,YAAY,CAAC,CAAA;AAkBzC,mEAAmE;AACnE,MAAM,0BAA0B,GAAG,MAAM,CAAA;AAEzC,SAAS,KAAK,CAAC,EAAU;IACvB,OAAO,IAAI,OAAO,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC,UAAU,CAAC,OAAO,EAAE,EAAE,CAAC,CAAC,CAAA;AAC1D,CAAC;AAED,MAAM,OAAO,gBAAgB;IACE;IAA7B,YAA6B,IAA6B;QAA7B,SAAI,GAAJ,IAAI,CAAyB;IAAG,CAAC;IAE9D,KAAK,CAAC,KAAK,CAAC,EAAE,MAAM,EAAE,GAAG,EAAwC;QAC/D,MAAM,UAAU,GACd,IAAI,CAAC,IAAI,CAAC,UAAU;YACpB,CAAC,IAAI,CAAC,IAAI,CAAC,cAAc;gBACvB,CAAC,CAAC,MAAM,sBAAsB,CAAC,IAAI,CAAC,IAAI,CAAC,cAAc,EAAE,KAAK,IAAI,EAAE,CAAC,CAAC,MAAM,IAAI,CAAC,MAAM,CAAC,gBAAgB,EAAE,CAAC,CAAC,QAAQ,EAAE,CAAC;gBACvH,CAAC,CAAC,MAAM,IAAI,CAAC,MAAM,CAAC,gBAAgB,EAAE,CAAC,CAAA;QAC3C,MAAM,MAAM,GAAG,IAAI,IAAI,CAAC,MAAM,CAAC;YAC7B,YAAY,EAAE,IAAI,CAAC,IAAI,CAAC,OAAO;gBAC7B,CAAC,CAAC,IAAI,CAAC,SAAS,CAAC,WAAW,CAAC,OAAO;gBACpC,CAAC,CAAC,IAAI,CAAC,SAAS,CAAC,WAAW,CAAC,UAAU;YACzC,UAAU;SACX,CAAC,CAAA;QAEF,MAAM,CAAC,GAAG,EAAE,GAAG,CAAC,GAAG,MAAM,IAAI,CAAC,MAAM,CAAC,SAAS,CAAC,EAAE,UAAU,EAAE,MAAM,EAAE,CAAC,CAAA;QAEtE,MAAM,aAAa,GAAG,IAAI,CAAC,IAAI,CAAC,gBAAgB,IAAI,0BAA0B,CAAA;QAE9E,MAAM,CAAC,IAAI,CAAC,cAAc,IAAI,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,YAAY,aAAa,MAAM,QAAQ,GAAG,CAAC,IAAI,WAAW,CAAC,CAAA;QAErH,MAAM,IAAI,GAAG,MAAM,MAAM,CAAC,IAAI,CAAC;YAC7B,GAAG;YACH,KAAK,EAAE,IAAI,CAAC,IAAI,CAAC,KAAK,IAAI,SAAS;YACnC,oBAAoB,EAAE,IAAI;YAC1B,iBAAiB,EAAE,CAAC,QAAQ,CAAC;YAC7B,qEAAqE;YACrE,iCAAiC;YACjC,yBAAyB,EAAE,IAAI;YAC/B,iBAAiB,EAAE,KAAK,EAAE,MAAM,EAAE,UAAU,EAAE,gBAAgB,EAAE,EAAE;gBAChE,MAAM,CAAC,IAAI,CAAC,2BAA2B,MAAM,MAAM,CAAC,CAAA;gBACpD,MAAM,GAAG,CAAC,YAAY,CAAC,MAAM,EAAE,gBAAgB,CAAC,CAAA;gBAChD,MAAM,CAAC,IAAI,CAAC,oBAAoB,aAAa,yCAAyC,CAAC,CAAA;gBACvF,IAAI,aAAa,GAAG,CAAC;oBAAE,MAAM,KAAK,CAAC,aAAa,CAAC,CAAA;gBACjD,MAAM,CAAC,IAAI,CAAC,0CAA0C,CAAC,CAAA;YACzD,CAAC;YACD,iBAAiB,EAAE,KAAK,EAAE,MAAM,EAAE,UAAU,EAAE,gBAAgB,EAAE,EAAE;gBAChE,MAAM,GAAG,CAAC,eAAe,CAAC,MAAM,EAAE,gBAAgB,CAAC,CAAA;YACrD,CAAC;SACF,CAAC,CAAA;QAEF,MAAM,CAAC,IAAI,CAAC,mBAAmB,MAAM,EAAE,CAAC,CAAA;QACxC,OAAO,EAAE,IAAI,EAAE,GAAG,EAAE,GAAG,CAAC,QAAQ,EAAE,EAAE,SAAS,EAAE,iBAAiB,CAAC,IAAI,CAAC,EAAE,CAAA;IAC1E,CAAC;CACF"}

package/dist/lib/cert/CertProvider.d.ts

@@ -0,0 +1,30 @@
+/** relay가 https 종단에 쓰는 PEM 자료. key는 이 프로세스 밖으로 나가지 않는다. */
+export interface CertMaterial {
+    /** PEM 인증서 체인 (leaf + intermediates). */
+    cert: string;
+    /** PEM 개인키. */
+    key: string;
+    /** 만료 시각 — 갱신 판단에 사용. */
+    expiresAt: Date;
+}
+/**
+ * cert 발급 전략 — 도달성 모드별로 다른 경로를 추상화한다.
+ * v1: 'byo-api-token'(자기 DNS 계정 DNS-01, 주력) | 'import-cert'(기존 cert 로드).
+ * 후속: 'tailscale'(Tailscale 자체 cert) | 'free-subdomain' | 'byo-cname' | 'local-ca'.
+ */
+export type CertStrategy = 'byo-api-token' | 'import-cert';
+/**
+ * 인증서 공급 계약. relay가 시작 시 ensureCert()로 자료를 확보하고,
+ * 스케줄러가 renewIfNeeded()를 주기 호출한다.
+ */
+export interface CertProvider {
+    readonly strategy: CertStrategy;
+    /** 유효한 cert 확보(없으면 발급/로드). 멱등 — 이미 유효하면 기존 자료를 반환. */
+    ensureCert(): Promise<CertMaterial>;
+    /**
+     * 만료 임박(잔여 ~30일 이하)일 때만 갱신하고 새 자료를 반환.
+     * 충분히 남았으면 갱신하지 않고 null(중복 발급 한도 방어 — 부팅마다 재발급 금지).
+     */
+    renewIfNeeded(): Promise<CertMaterial | null>;
+}
+//# sourceMappingURL=CertProvider.d.ts.map

package/dist/lib/cert/CertProvider.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"CertProvider.d.ts","sourceRoot":"","sources":["../../../src/lib/cert/CertProvider.ts"],"names":[],"mappings":"AAGA,2DAA2D;AAC3D,MAAM,WAAW,YAAY;IAC3B,yCAAyC;IACzC,IAAI,EAAE,MAAM,CAAA;IACZ,eAAe;IACf,GAAG,EAAE,MAAM,CAAA;IACX,yBAAyB;IACzB,SAAS,EAAE,IAAI,CAAA;CAChB;AAED;;;;GAIG;AACH,MAAM,MAAM,YAAY,GAAG,eAAe,GAAG,aAAa,CAAA;AAE1D;;;GAGG;AACH,MAAM,WAAW,YAAY;IAC3B,QAAQ,CAAC,QAAQ,EAAE,YAAY,CAAA;IAC/B,sDAAsD;IACtD,UAAU,IAAI,OAAO,CAAC,YAAY,CAAC,CAAA;IACnC;;;OAGG;IACH,aAAa,IAAI,OAAO,CAAC,YAAY,GAAG,IAAI,CAAC,CAAA;CAC9C"}

package/dist/lib/cert/CertProvider.js

@@ -0,0 +1,4 @@
+// LAN HTTPS — cert/TLS 인터페이스 (issue #232). 터널(도달성)과 직교하는 TLS 축.
+// 구현은 개인키를 로컬에서만 생성·보관하며 외부로 내보내지 않는다(키 locality).
+export {};
+//# sourceMappingURL=CertProvider.js.map

package/dist/lib/cert/CertProvider.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"CertProvider.js","sourceRoot":"","sources":["../../../src/lib/cert/CertProvider.ts"],"names":[],"mappings":"AAAA,gEAAgE;AAChE,mDAAmD"}

package/dist/lib/cert/CloudflareDnsProvider.d.ts

@@ -0,0 +1,40 @@
+import type { DnsProvider } from './DnsProvider.js';
+/** 의존성 주입용 최소 fetch 계약 — global fetch 타입에 묶이지 않게 자체 정의. */
+export type FetchLike = (url: string, init?: {
+    method?: string;
+    headers?: Record<string, string>;
+    body?: string;
+    signal?: AbortSignal;
+}) => Promise<{
+    ok: boolean;
+    status: number;
+    json(): Promise<unknown>;
+}>;
+export declare const DNS_API_TIMEOUT_MS = 30000;
+export interface CloudflareDnsProviderOptions {
+    token: string;
+    /** 명시하면 zone 디스커버리를 생략하고 이 이름의 zone만 쓴다. */
+    zoneName?: string;
+    /** 테스트 주입용. 기본은 global fetch. */
+    fetchFn?: FetchLike;
+    /** 기본 https://api.cloudflare.com/client/v4 */
+    apiBase?: string;
+}
+export declare class CloudflareDnsProvider implements DnsProvider {
+    readonly name = "cloudflare";
+    private readonly token;
+    private readonly fetchFn;
+    private readonly apiBase;
+    private readonly fixedZoneName?;
+    private readonly zoneIdCache;
+    constructor(opts: CloudflareDnsProviderOptions);
+    setTxtRecord(fqdn: string, value: string): Promise<void>;
+    removeTxtRecord(fqdn: string, value: string): Promise<void>;
+    upsertAddressRecord(fqdn: string, ip: string): Promise<void>;
+    private zoneIdFor;
+    private findRecords;
+    private request;
+}
+/** env(TAPFLOW_CLOUDFLARE_TOKEN)에서 토큰을 읽어 provider를 만든다. 토큰 미설정 시 throw. */
+export declare function cloudflareDnsFromEnv(zoneName?: string): CloudflareDnsProvider;
+//# sourceMappingURL=CloudflareDnsProvider.d.ts.map

package/dist/lib/cert/CloudflareDnsProvider.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"CloudflareDnsProvider.d.ts","sourceRoot":"","sources":["../../../src/lib/cert/CloudflareDnsProvider.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,kBAAkB,CAAA;AAQnD,2DAA2D;AAC3D,MAAM,MAAM,SAAS,GAAG,CACtB,GAAG,EAAE,MAAM,EACX,IAAI,CAAC,EAAE;IAAE,MAAM,CAAC,EAAE,MAAM,CAAC;IAAC,OAAO,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IAAC,IAAI,CAAC,EAAE,MAAM,CAAC;IAAC,MAAM,CAAC,EAAE,WAAW,CAAA;CAAE,KAC9F,OAAO,CAAC;IAAE,EAAE,EAAE,OAAO,CAAC;IAAC,MAAM,EAAE,MAAM,CAAC;IAAC,IAAI,IAAI,OAAO,CAAC,OAAO,CAAC,CAAA;CAAE,CAAC,CAAA;AAGvE,eAAO,MAAM,kBAAkB,QAAS,CAAA;AAExC,MAAM,WAAW,4BAA4B;IAC3C,KAAK,EAAE,MAAM,CAAA;IACb,4CAA4C;IAC5C,QAAQ,CAAC,EAAE,MAAM,CAAA;IACjB,iCAAiC;IACjC,OAAO,CAAC,EAAE,SAAS,CAAA;IACnB,8CAA8C;IAC9C,OAAO,CAAC,EAAE,MAAM,CAAA;CACjB;AAoBD,qBAAa,qBAAsB,YAAW,WAAW;IACvD,QAAQ,CAAC,IAAI,gBAAe;IAC5B,OAAO,CAAC,QAAQ,CAAC,KAAK,CAAQ;IAC9B,OAAO,CAAC,QAAQ,CAAC,OAAO,CAAW;IACnC,OAAO,CAAC,QAAQ,CAAC,OAAO,CAAQ;IAChC,OAAO,CAAC,QAAQ,CAAC,aAAa,CAAC,CAAQ;IACvC,OAAO,CAAC,QAAQ,CAAC,WAAW,CAA4B;gBAE5C,IAAI,EAAE,4BAA4B;IAQxC,YAAY,CAAC,IAAI,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;IAQxD,eAAe,CAAC,IAAI,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;IAS3D,mBAAmB,CAAC,IAAI,EAAE,MAAM,EAAE,EAAE,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;YAYpD,SAAS;YAiBT,WAAW;YAKX,OAAO;CActB;AAED,4EAA4E;AAC5E,wBAAgB,oBAAoB,CAAC,QAAQ,CAAC,EAAE,MAAM,GAAG,qBAAqB,CAI7E"}

package/dist/lib/cert/CloudflareDnsProvider.js

@@ -0,0 +1,93 @@
+// Cloudflare DNS-01 solver (issue #232). 사용자 자기 Cloudflare 계정 토큰으로 동작한다(BYO).
+// 토큰은 config가 아니라 env(TAPFLOW_CLOUDFLARE_TOKEN)에서 읽는다 — cloudflareDnsFromEnv 참고.
+const DEFAULT_API_BASE = 'https://api.cloudflare.com/client/v4';
+const TTL_SECONDS = 60;
+// DNS 공급자 API 호출이 무한 대기하지 않도록 하는 요청 타임아웃.
+export const DNS_API_TIMEOUT_MS = 30_000;
+export class CloudflareDnsProvider {
+    name = 'cloudflare';
+    token;
+    fetchFn;
+    apiBase;
+    fixedZoneName;
+    zoneIdCache = new Map();
+    constructor(opts) {
+        if (!opts.token)
+            throw new Error('Cloudflare API token is required (set TAPFLOW_CLOUDFLARE_TOKEN)');
+        this.token = opts.token;
+        this.fetchFn = opts.fetchFn ?? globalThis.fetch;
+        this.apiBase = opts.apiBase ?? DEFAULT_API_BASE;
+        this.fixedZoneName = opts.zoneName;
+    }
+    async setTxtRecord(fqdn, value) {
+        const zoneId = await this.zoneIdFor(fqdn);
+        const name = `_acme-challenge.${fqdn}`;
+        const existing = await this.findRecords(zoneId, 'TXT', name);
+        if (existing.some((r) => r.content === value))
+            return;
+        await this.request(`/zones/${zoneId}/dns_records`, 'POST', { type: 'TXT', name, content: value, ttl: TTL_SECONDS });
+    }
+    async removeTxtRecord(fqdn, value) {
+        const zoneId = await this.zoneIdFor(fqdn);
+        const name = `_acme-challenge.${fqdn}`;
+        const matches = (await this.findRecords(zoneId, 'TXT', name)).filter((r) => r.content === value);
+        for (const r of matches) {
+            await this.request(`/zones/${zoneId}/dns_records/${r.id}`, 'DELETE');
+        }
+    }
+    async upsertAddressRecord(fqdn, ip) {
+        const zoneId = await this.zoneIdFor(fqdn);
+        const type = ip.includes(':') ? 'AAAA' : 'A';
+        const existing = await this.findRecords(zoneId, type, fqdn);
+        const payload = { type, name: fqdn, content: ip, ttl: TTL_SECONDS };
+        if (existing.length > 0) {
+            await this.request(`/zones/${zoneId}/dns_records/${existing[0].id}`, 'PATCH', payload);
+        }
+        else {
+            await this.request(`/zones/${zoneId}/dns_records`, 'POST', payload);
+        }
+    }
+    async zoneIdFor(fqdn) {
+        const cacheKey = this.fixedZoneName ?? fqdn;
+        const cached = this.zoneIdCache.get(cacheKey);
+        if (cached)
+            return cached;
+        const zones = await this.request('/zones', 'GET');
+        const candidates = this.fixedZoneName
+            ? zones.filter((z) => z.name === this.fixedZoneName)
+            : zones.filter((z) => fqdn === z.name || fqdn.endsWith(`.${z.name}`));
+        // 가장 구체적인(최장 suffix) zone 우선
+        candidates.sort((a, b) => b.name.length - a.name.length);
+        const zone = candidates[0];
+        if (!zone)
+            throw new Error(`No Cloudflare zone found for ${fqdn}`);
+        this.zoneIdCache.set(cacheKey, zone.id);
+        return zone.id;
+    }
+    async findRecords(zoneId, type, name) {
+        const qs = new URLSearchParams({ type, name }).toString();
+        return this.request(`/zones/${zoneId}/dns_records?${qs}`, 'GET');
+    }
+    async request(path, method, body) {
+        const res = await this.fetchFn(`${this.apiBase}${path}`, {
+            method,
+            headers: { Authorization: `Bearer ${this.token}`, 'content-type': 'application/json' },
+            body: body === undefined ? undefined : JSON.stringify(body),
+            signal: AbortSignal.timeout(DNS_API_TIMEOUT_MS),
+        });
+        const data = (await res.json());
+        if (!res.ok || !data.success) {
+            const msg = data.errors?.map((e) => e.message).join('; ') || `HTTP ${res.status}`;
+            throw new Error(`Cloudflare API error: ${msg}`);
+        }
+        return data.result;
+    }
+}
+/** env(TAPFLOW_CLOUDFLARE_TOKEN)에서 토큰을 읽어 provider를 만든다. 토큰 미설정 시 throw. */
+export function cloudflareDnsFromEnv(zoneName) {
+    const token = process.env.TAPFLOW_CLOUDFLARE_TOKEN;
+    if (!token)
+        throw new Error('TAPFLOW_CLOUDFLARE_TOKEN is not set');
+    return new CloudflareDnsProvider({ token, zoneName });
+}
+//# sourceMappingURL=CloudflareDnsProvider.js.map

package/dist/lib/cert/CloudflareDnsProvider.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"CloudflareDnsProvider.js","sourceRoot":"","sources":["../../../src/lib/cert/CloudflareDnsProvider.ts"],"names":[],"mappings":"AAEA,8EAA8E;AAC9E,iFAAiF;AAEjF,MAAM,gBAAgB,GAAG,sCAAsC,CAAA;AAC/D,MAAM,WAAW,GAAG,EAAE,CAAA;AAQtB,0CAA0C;AAC1C,MAAM,CAAC,MAAM,kBAAkB,GAAG,MAAM,CAAA;AA8BxC,MAAM,OAAO,qBAAqB;IACvB,IAAI,GAAG,YAAY,CAAA;IACX,KAAK,CAAQ;IACb,OAAO,CAAW;IAClB,OAAO,CAAQ;IACf,aAAa,CAAS;IACtB,WAAW,GAAG,IAAI,GAAG,EAAkB,CAAA;IAExD,YAAY,IAAkC;QAC5C,IAAI,CAAC,IAAI,CAAC,KAAK;YAAE,MAAM,IAAI,KAAK,CAAC,iEAAiE,CAAC,CAAA;QACnG,IAAI,CAAC,KAAK,GAAG,IAAI,CAAC,KAAK,CAAA;QACvB,IAAI,CAAC,OAAO,GAAG,IAAI,CAAC,OAAO,IAAK,UAAU,CAAC,KAA8B,CAAA;QACzE,IAAI,CAAC,OAAO,GAAG,IAAI,CAAC,OAAO,IAAI,gBAAgB,CAAA;QAC/C,IAAI,CAAC,aAAa,GAAG,IAAI,CAAC,QAAQ,CAAA;IACpC,CAAC;IAED,KAAK,CAAC,YAAY,CAAC,IAAY,EAAE,KAAa;QAC5C,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,CAAA;QACzC,MAAM,IAAI,GAAG,mBAAmB,IAAI,EAAE,CAAA;QACtC,MAAM,QAAQ,GAAG,MAAM,IAAI,CAAC,WAAW,CAAC,MAAM,EAAE,KAAK,EAAE,IAAI,CAAC,CAAA;QAC5D,IAAI,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,OAAO,KAAK,KAAK,CAAC;YAAE,OAAM;QACrD,MAAM,IAAI,CAAC,OAAO,CAAC,UAAU,MAAM,cAAc,EAAE,MAAM,EAAE,EAAE,IAAI,EAAE,KAAK,EAAE,IAAI,EAAE,OAAO,EAAE,KAAK,EAAE,GAAG,EAAE,WAAW,EAAE,CAAC,CAAA;IACrH,CAAC;IAED,KAAK,CAAC,eAAe,CAAC,IAAY,EAAE,KAAa;QAC/C,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,CAAA;QACzC,MAAM,IAAI,GAAG,mBAAmB,IAAI,EAAE,CAAA;QACtC,MAAM,OAAO,GAAG,CAAC,MAAM,IAAI,CAAC,WAAW,CAAC,MAAM,EAAE,KAAK,EAAE,IAAI,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,OAAO,KAAK,KAAK,CAAC,CAAA;QAChG,KAAK,MAAM,CAAC,IAAI,OAAO,EAAE,CAAC;YACxB,MAAM,IAAI,CAAC,OAAO,CAAC,UAAU,MAAM,gBAAgB,CAAC,CAAC,EAAE,EAAE,EAAE,QAAQ,CAAC,CAAA;QACtE,CAAC;IACH,CAAC;IAED,KAAK,CAAC,mBAAmB,CAAC,IAAY,EAAE,EAAU;QAChD,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,CAAA;QACzC,MAAM,IAAI,GAAG,EAAE,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,GAAG,CAAA;QAC5C,MAAM,QAAQ,GAAG,MAAM,IAAI,CAAC,WAAW,CAAC,MAAM,EAAE,IAAI,EAAE,IAAI,CAAC,CAAA;QAC3D,MAAM,OAAO,GAAG,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,OAAO,EAAE,EAAE,EAAE,GAAG,EAAE,WAAW,EAAE,CAAA;QACnE,IAAI,QAAQ,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YACxB,MAAM,IAAI,CAAC,OAAO,CAAC,UAAU,MAAM,gBAAgB,QAAQ,CAAC,CAAC,CAAC,CAAC,EAAE,EAAE,EAAE,OAAO,EAAE,OAAO,CAAC,CAAA;QACxF,CAAC;aAAM,CAAC;YACN,MAAM,IAAI,CAAC,OAAO,CAAC,UAAU,MAAM,cAAc,EAAE,MAAM,EAAE,OAAO,CAAC,CAAA;QACrE,CAAC;IACH,CAAC;IAEO,KAAK,CAAC,SAAS,CAAC,IAAY;QAClC,MAAM,QAAQ,GAAG,IAAI,CAAC,aAAa,IAAI,IAAI,CAAA;QAC3C,MAAM,MAAM,GAAG,IAAI,CAAC,WAAW,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAA;QAC7C,IAAI,MAAM;YAAE,OAAO,MAAM,CAAA;QAEzB,MAAM,KAAK,GAAG,MAAM,IAAI,CAAC,OAAO,CAAW,QAAQ,EAAE,KAAK,CAAC,CAAA;QAC3D,MAAM,UAAU,GAAG,IAAI,CAAC,aAAa;YACnC,CAAC,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,KAAK,IAAI,CAAC,aAAa,CAAC;YACpD,CAAC,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,IAAI,KAAK,CAAC,CAAC,IAAI,IAAI,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC,CAAA;QACvE,6BAA6B;QAC7B,UAAU,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,MAAM,GAAG,CAAC,CAAC,IAAI,CAAC,MAAM,CAAC,CAAA;QACxD,MAAM,IAAI,GAAG,UAAU,CAAC,CAAC,CAAC,CAAA;QAC1B,IAAI,CAAC,IAAI;YAAE,MAAM,IAAI,KAAK,CAAC,gCAAgC,IAAI,EAAE,CAAC,CAAA;QAClE,IAAI,CAAC,WAAW,CAAC,GAAG,CAAC,QAAQ,EAAE,IAAI,CAAC,EAAE,CAAC,CAAA;QACvC,OAAO,IAAI,CAAC,EAAE,CAAA;IAChB,CAAC;IAEO,KAAK,CAAC,WAAW,CAAC,MAAc,EAAE,IAAY,EAAE,IAAY;QAClE,MAAM,EAAE,GAAG,IAAI,eAAe,CAAC,EAAE,IAAI,EAAE,IAAI,EAAE,CAAC,CAAC,QAAQ,EAAE,CAAA;QACzD,OAAO,IAAI,CAAC,OAAO,CAAa,UAAU,MAAM,gBAAgB,EAAE,EAAE,EAAE,KAAK,CAAC,CAAA;IAC9E,CAAC;IAEO,KAAK,CAAC,OAAO,CAAI,IAAY,EAAE,MAAc,EAAE,IAAc;QACnE,MAAM,GAAG,GAAG,MAAM,IAAI,CAAC,OAAO,CAAC,GAAG,IAAI,CAAC,OAAO,GAAG,IAAI,EAAE,EAAE;YACvD,MAAM;YACN,OAAO,EAAE,EAAE,aAAa,EAAE,UAAU,IAAI,CAAC,KAAK,EAAE,EAAE,cAAc,EAAE,kBAAkB,EAAE;YACtF,IAAI,EAAE,IAAI,KAAK,SAAS,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC;YAC3D,MAAM,EAAE,WAAW,CAAC,OAAO,CAAC,kBAAkB,CAAC;SAChD,CAAC,CAAA;QACF,MAAM,IAAI,GAAG,CAAC,MAAM,GAAG,CAAC,IAAI,EAAE,CAAkB,CAAA;QAChD,IAAI,CAAC,GAAG,CAAC,EAAE,IAAI,CAAC,IAAI,CAAC,OAAO,EAAE,CAAC;YAC7B,MAAM,GAAG,GAAG,IAAI,CAAC,MAAM,EAAE,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,QAAQ,GAAG,CAAC,MAAM,EAAE,CAAA;YACjF,MAAM,IAAI,KAAK,CAAC,yBAAyB,GAAG,EAAE,CAAC,CAAA;QACjD,CAAC;QACD,OAAO,IAAI,CAAC,MAAM,CAAA;IACpB,CAAC;CACF;AAED,4EAA4E;AAC5E,MAAM,UAAU,oBAAoB,CAAC,QAAiB;IACpD,MAAM,KAAK,GAAG,OAAO,CAAC,GAAG,CAAC,wBAAwB,CAAA;IAClD,IAAI,CAAC,KAAK;QAAE,MAAM,IAAI,KAAK,CAAC,qCAAqC,CAAC,CAAA;IAClE,OAAO,IAAI,qBAAqB,CAAC,EAAE,KAAK,EAAE,QAAQ,EAAE,CAAC,CAAA;AACvD,CAAC"}

package/dist/lib/cert/DiskCertStore.d.ts

@@ -0,0 +1,10 @@
+import type { CertStore } from './AcmeCertProvider.js';
+import type { CertMaterial } from './CertProvider.js';
+export declare class DiskCertStore implements CertStore {
+    private readonly certPath;
+    private readonly keyPath;
+    constructor(dir: string);
+    load(): Promise<CertMaterial | null>;
+    save(material: CertMaterial): Promise<void>;
+}
+//# sourceMappingURL=DiskCertStore.d.ts.map

package/dist/lib/cert/DiskCertStore.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"DiskCertStore.d.ts","sourceRoot":"","sources":["../../../src/lib/cert/DiskCertStore.ts"],"names":[],"mappings":"AAEA,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,uBAAuB,CAAA;AACtD,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,mBAAmB,CAAA;AAKrD,qBAAa,aAAc,YAAW,SAAS;IAC7C,OAAO,CAAC,QAAQ,CAAC,QAAQ,CAAQ;IACjC,OAAO,CAAC,QAAQ,CAAC,OAAO,CAAQ;gBAEpB,GAAG,EAAE,MAAM;IAKjB,IAAI,IAAI,OAAO,CAAC,YAAY,GAAG,IAAI,CAAC;IAUpC,IAAI,CAAC,QAAQ,EAAE,YAAY,GAAG,OAAO,CAAC,IAAI,CAAC;CAUlD"}

package/dist/lib/cert/DiskCertStore.js

@@ -0,0 +1,35 @@
+import fs from 'fs';
+import path from 'path';
+import { parseCertNotAfter } from './parseCert.js';
+// cert/key를 디스크에 영속화한다. 만료는 저장값이 아니라 cert에서 파싱(드리프트 방지).
+// 키 파일은 0600(JWT secret과 동일 패턴) — 개인키는 소유자만 읽는다.
+export class DiskCertStore {
+    certPath;
+    keyPath;
+    constructor(dir) {
+        this.certPath = path.join(dir, 'cert.pem');
+        this.keyPath = path.join(dir, 'key.pem');
+    }
+    async load() {
+        try {
+            const cert = fs.readFileSync(this.certPath, 'utf-8');
+            const key = fs.readFileSync(this.keyPath, 'utf-8');
+            return { cert, key, expiresAt: parseCertNotAfter(cert) };
+        }
+        catch {
+            return null;
+        }
+    }
+    async save(material) {
+        fs.mkdirSync(path.dirname(this.certPath), { recursive: true });
+        fs.writeFileSync(this.certPath, material.cert, { mode: 0o644 });
+        fs.writeFileSync(this.keyPath, material.key, { mode: 0o600 });
+        try {
+            fs.chmodSync(this.keyPath, 0o600);
+        }
+        catch {
+            // best-effort on platforms without POSIX permissions
+        }
+    }
+}
+//# sourceMappingURL=DiskCertStore.js.map

package/dist/lib/cert/DiskCertStore.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"DiskCertStore.js","sourceRoot":"","sources":["../../../src/lib/cert/DiskCertStore.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,MAAM,IAAI,CAAA;AACnB,OAAO,IAAI,MAAM,MAAM,CAAA;AAGvB,OAAO,EAAE,iBAAiB,EAAE,MAAM,gBAAgB,CAAA;AAElD,yDAAyD;AACzD,iDAAiD;AACjD,MAAM,OAAO,aAAa;IACP,QAAQ,CAAQ;IAChB,OAAO,CAAQ;IAEhC,YAAY,GAAW;QACrB,IAAI,CAAC,QAAQ,GAAG,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,UAAU,CAAC,CAAA;QAC1C,IAAI,CAAC,OAAO,GAAG,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,SAAS,CAAC,CAAA;IAC1C,CAAC;IAED,KAAK,CAAC,IAAI;QACR,IAAI,CAAC;YACH,MAAM,IAAI,GAAG,EAAE,CAAC,YAAY,CAAC,IAAI,CAAC,QAAQ,EAAE,OAAO,CAAC,CAAA;YACpD,MAAM,GAAG,GAAG,EAAE,CAAC,YAAY,CAAC,IAAI,CAAC,OAAO,EAAE,OAAO,CAAC,CAAA;YAClD,OAAO,EAAE,IAAI,EAAE,GAAG,EAAE,SAAS,EAAE,iBAAiB,CAAC,IAAI,CAAC,EAAE,CAAA;QAC1D,CAAC;QAAC,MAAM,CAAC;YACP,OAAO,IAAI,CAAA;QACb,CAAC;IACH,CAAC;IAED,KAAK,CAAC,IAAI,CAAC,QAAsB;QAC/B,EAAE,CAAC,SAAS,CAAC,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,QAAQ,CAAC,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAA;QAC9D,EAAE,CAAC,aAAa,CAAC,IAAI,CAAC,QAAQ,EAAE,QAAQ,CAAC,IAAI,EAAE,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAA;QAC/D,EAAE,CAAC,aAAa,CAAC,IAAI,CAAC,OAAO,EAAE,QAAQ,CAAC,GAAG,EAAE,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAA;QAC7D,IAAI,CAAC;YACH,EAAE,CAAC,SAAS,CAAC,IAAI,CAAC,OAAO,EAAE,KAAK,CAAC,CAAA;QACnC,CAAC;QAAC,MAAM,CAAC;YACP,qDAAqD;QACvD,CAAC;IACH,CAAC;CACF"}

package/dist/lib/cert/DnsProvider.d.ts

@@ -0,0 +1,7 @@
+export interface DnsProvider {
+    readonly name: string;
+    setTxtRecord(fqdn: string, value: string): Promise<void>;
+    removeTxtRecord(fqdn: string, value: string): Promise<void>;
+    upsertAddressRecord?(fqdn: string, ip: string): Promise<void>;
+}
+//# sourceMappingURL=DnsProvider.d.ts.map

package/dist/lib/cert/DnsProvider.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"DnsProvider.d.ts","sourceRoot":"","sources":["../../../src/lib/cert/DnsProvider.ts"],"names":[],"mappings":"AACA,MAAM,WAAW,WAAW;IAC1B,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAA;IAErB,YAAY,CAAC,IAAI,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAAA;IACxD,eAAe,CAAC,IAAI,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAAA;IAE3D,mBAAmB,CAAC,CAAC,IAAI,EAAE,MAAM,EAAE,EAAE,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAAA;CAC9D"}

package/dist/lib/cert/DnsProvider.js

@@ -0,0 +1,2 @@
+export {};
+//# sourceMappingURL=DnsProvider.js.map

package/dist/lib/cert/DnsProvider.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"DnsProvider.js","sourceRoot":"","sources":["../../../src/lib/cert/DnsProvider.ts"],"names":[],"mappings":""}

package/dist/lib/cert/ImportCertProvider.d.ts

@@ -0,0 +1,20 @@
+import type { CertProvider, CertMaterial, CertStrategy } from './CertProvider.js';
+export interface ImportCertProviderOptions {
+    certPath: string;
+    keyPath: string;
+    /** 테스트 주입용. 기본 fs.readFileSync(utf-8). */
+    readFileFn?: (filePath: string) => string;
+}
+/**
+ * 사용자가 직접 마련한 cert/key 파일을 로드하는 CertProvider.
+ * ACME를 돌리지 않으므로 갱신은 사용자 책임 — renewIfNeeded는 항상 null.
+ */
+export declare class ImportCertProvider implements CertProvider {
+    private readonly opts;
+    readonly strategy: CertStrategy;
+    private readonly readFile;
+    constructor(opts: ImportCertProviderOptions);
+    ensureCert(): Promise<CertMaterial>;
+    renewIfNeeded(): Promise<CertMaterial | null>;
+}
+//# sourceMappingURL=ImportCertProvider.d.ts.map

package/dist/lib/cert/ImportCertProvider.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"ImportCertProvider.d.ts","sourceRoot":"","sources":["../../../src/lib/cert/ImportCertProvider.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,YAAY,EAAE,YAAY,EAAE,YAAY,EAAE,MAAM,mBAAmB,CAAA;AAGjF,MAAM,WAAW,yBAAyB;IACxC,QAAQ,EAAE,MAAM,CAAA;IAChB,OAAO,EAAE,MAAM,CAAA;IACf,0CAA0C;IAC1C,UAAU,CAAC,EAAE,CAAC,QAAQ,EAAE,MAAM,KAAK,MAAM,CAAA;CAC1C;AAED;;;GAGG;AACH,qBAAa,kBAAmB,YAAW,YAAY;IAIzC,OAAO,CAAC,QAAQ,CAAC,IAAI;IAHjC,QAAQ,CAAC,QAAQ,EAAE,YAAY,CAAgB;IAC/C,OAAO,CAAC,QAAQ,CAAC,QAAQ,CAA8B;gBAE1B,IAAI,EAAE,yBAAyB;IAItD,UAAU,IAAI,OAAO,CAAC,YAAY,CAAC;IAMnC,aAAa,IAAI,OAAO,CAAC,YAAY,GAAG,IAAI,CAAC;CAGpD"}

package/dist/lib/cert/ImportCertProvider.js

@@ -0,0 +1,24 @@
+import fs from 'fs';
+import { parseCertNotAfter } from './parseCert.js';
+/**
+ * 사용자가 직접 마련한 cert/key 파일을 로드하는 CertProvider.
+ * ACME를 돌리지 않으므로 갱신은 사용자 책임 — renewIfNeeded는 항상 null.
+ */
+export class ImportCertProvider {
+    opts;
+    strategy = 'import-cert';
+    readFile;
+    constructor(opts) {
+        this.opts = opts;
+        this.readFile = opts.readFileFn ?? ((filePath) => fs.readFileSync(filePath, 'utf-8'));
+    }
+    async ensureCert() {
+        const cert = this.readFile(this.opts.certPath);
+        const key = this.readFile(this.opts.keyPath);
+        return { cert, key, expiresAt: parseCertNotAfter(cert) };
+    }
+    async renewIfNeeded() {
+        return null;
+    }
+}
+//# sourceMappingURL=ImportCertProvider.js.map

package/dist/lib/cert/ImportCertProvider.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"ImportCertProvider.js","sourceRoot":"","sources":["../../../src/lib/cert/ImportCertProvider.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,MAAM,IAAI,CAAA;AAEnB,OAAO,EAAE,iBAAiB,EAAE,MAAM,gBAAgB,CAAA;AASlD;;;GAGG;AACH,MAAM,OAAO,kBAAkB;IAIA;IAHpB,QAAQ,GAAiB,aAAa,CAAA;IAC9B,QAAQ,CAA8B;IAEvD,YAA6B,IAA+B;QAA/B,SAAI,GAAJ,IAAI,CAA2B;QAC1D,IAAI,CAAC,QAAQ,GAAG,IAAI,CAAC,UAAU,IAAI,CAAC,CAAC,QAAgB,EAAE,EAAE,CAAC,EAAE,CAAC,YAAY,CAAC,QAAQ,EAAE,OAAO,CAAC,CAAC,CAAA;IAC/F,CAAC;IAED,KAAK,CAAC,UAAU;QACd,MAAM,IAAI,GAAG,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAA;QAC9C,MAAM,GAAG,GAAG,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,IAAI,CAAC,OAAO,CAAC,CAAA;QAC5C,OAAO,EAAE,IAAI,EAAE,GAAG,EAAE,SAAS,EAAE,iBAAiB,CAAC,IAAI,CAAC,EAAE,CAAA;IAC1D,CAAC;IAED,KAAK,CAAC,aAAa;QACjB,OAAO,IAAI,CAAA;IACb,CAAC;CACF"}