@undefineds.co/xpod 0.1.0-local.202602081751

package/dist/edge/acme/AcmeCertificateManager.jsonld

@@ -0,0 +1,373 @@
+{
+  "@context": [
+    "https://linkedsoftwaredependencies.org/bundles/npm/@undefineds.co/xpod/^0.0.0/components/context.jsonld"
+  ],
+  "@id": "npmd:@undefineds.co/xpod",
+  "components": [
+    {
+      "@id": "undefineds:dist/edge/acme/AcmeCertificateManager.jsonld#AcmeCertificateManager",
+      "@type": "Class",
+      "requireElement": "AcmeCertificateManager",
+      "parameters": [
+        {
+          "@id": "undefineds:dist/edge/acme/AcmeCertificateManager.jsonld#AcmeCertificateManager_options_signalEndpoint",
+          "range": {
+            "@type": "ParameterRangeUnion",
+            "parameterRangeElements": [
+              "xsd:string",
+              {
+                "@type": "ParameterRangeUndefined"
+              }
+            ]
+          },
+          "comment": "Cloud 模式: 通过 signal endpoint 操作 DNS"
+        },
+        {
+          "@id": "undefineds:dist/edge/acme/AcmeCertificateManager.jsonld#AcmeCertificateManager_options_nodeId",
+          "range": {
+            "@type": "ParameterRangeUnion",
+            "parameterRangeElements": [
+              "xsd:string",
+              {
+                "@type": "ParameterRangeUndefined"
+              }
+            ]
+          }
+        },
+        {
+          "@id": "undefineds:dist/edge/acme/AcmeCertificateManager.jsonld#AcmeCertificateManager_options_nodeToken",
+          "range": {
+            "@type": "ParameterRangeUnion",
+            "parameterRangeElements": [
+              "xsd:string",
+              {
+                "@type": "ParameterRangeUndefined"
+              }
+            ]
+          }
+        },
+        {
+          "@id": "undefineds:dist/edge/acme/AcmeCertificateManager.jsonld#AcmeCertificateManager_options_dnsProvider",
+          "range": {
+            "@type": "ParameterRangeUnion",
+            "parameterRangeElements": [
+              "undefineds:dist/dns/DnsProvider.jsonld#DnsProvider",
+              {
+                "@type": "ParameterRangeUndefined"
+              }
+            ]
+          },
+          "comment": "Local 模式: 直接使用 DNS Provider"
+        },
+        {
+          "@id": "undefineds:dist/edge/acme/AcmeCertificateManager.jsonld#AcmeCertificateManager_options_rootDomain",
+          "range": {
+            "@type": "ParameterRangeUnion",
+            "parameterRangeElements": [
+              "xsd:string",
+              {
+                "@type": "ParameterRangeUndefined"
+              }
+            ]
+          }
+        },
+        {
+          "@id": "undefineds:dist/edge/acme/AcmeCertificateManager.jsonld#AcmeCertificateManager_options_dnsChallengeHandler",
+          "range": {
+            "@type": "ParameterRangeUnion",
+            "parameterRangeElements": [
+              "undefineds:dist/edge/acme/AcmeCertificateManager.jsonld#DnsChallengeHandler",
+              {
+                "@type": "ParameterRangeUndefined"
+              }
+            ]
+          },
+          "comment": "或者直接提供自定义的 DNS 验证处理器"
+        },
+        {
+          "@id": "undefineds:dist/edge/acme/AcmeCertificateManager.jsonld#AcmeCertificateManager_options_email",
+          "range": "xsd:string"
+        },
+        {
+          "@id": "undefineds:dist/edge/acme/AcmeCertificateManager.jsonld#AcmeCertificateManager_options_domains",
+          "range": {
+            "@type": "ParameterRangeArray",
+            "parameterRangeValue": "xsd:string"
+          }
+        },
+        {
+          "@id": "undefineds:dist/edge/acme/AcmeCertificateManager.jsonld#AcmeCertificateManager_options_directoryUrl",
+          "range": {
+            "@type": "ParameterRangeUnion",
+            "parameterRangeElements": [
+              "xsd:string",
+              {
+                "@type": "ParameterRangeUndefined"
+              }
+            ]
+          }
+        },
+        {
+          "@id": "undefineds:dist/edge/acme/AcmeCertificateManager.jsonld#AcmeCertificateManager_options_fallbackDirectoryUrls",
+          "range": {
+            "@type": "ParameterRangeUnion",
+            "parameterRangeElements": [
+              {
+                "@type": "ParameterRangeArray",
+                "parameterRangeValue": "xsd:string"
+              },
+              {
+                "@type": "ParameterRangeUndefined"
+              }
+            ]
+          }
+        },
+        {
+          "@id": "undefineds:dist/edge/acme/AcmeCertificateManager.jsonld#AcmeCertificateManager_options_accountKeyPath",
+          "range": "xsd:string"
+        },
+        {
+          "@id": "undefineds:dist/edge/acme/AcmeCertificateManager.jsonld#AcmeCertificateManager_options_certificateKeyPath",
+          "range": "xsd:string"
+        },
+        {
+          "@id": "undefineds:dist/edge/acme/AcmeCertificateManager.jsonld#AcmeCertificateManager_options_certificatePath",
+          "range": "xsd:string"
+        },
+        {
+          "@id": "undefineds:dist/edge/acme/AcmeCertificateManager.jsonld#AcmeCertificateManager_options_fullChainPath",
+          "range": {
+            "@type": "ParameterRangeUnion",
+            "parameterRangeElements": [
+              "xsd:string",
+              {
+                "@type": "ParameterRangeUndefined"
+              }
+            ]
+          }
+        },
+        {
+          "@id": "undefineds:dist/edge/acme/AcmeCertificateManager.jsonld#AcmeCertificateManager_options_renewBeforeDays",
+          "range": {
+            "@type": "ParameterRangeUnion",
+            "parameterRangeElements": [
+              "xsd:number",
+              {
+                "@type": "ParameterRangeUndefined"
+              }
+            ]
+          }
+        },
+        {
+          "@id": "undefineds:dist/edge/acme/AcmeCertificateManager.jsonld#AcmeCertificateManager_options_propagationDelayMs",
+          "range": {
+            "@type": "ParameterRangeUnion",
+            "parameterRangeElements": [
+              "xsd:number",
+              {
+                "@type": "ParameterRangeUndefined"
+              }
+            ]
+          }
+        }
+      ],
+      "memberFields": [
+        {
+          "@id": "undefineds:dist/edge/acme/AcmeCertificateManager.jsonld#AcmeCertificateManager__member_logger",
+          "memberFieldName": "logger"
+        },
+        {
+          "@id": "undefineds:dist/edge/acme/AcmeCertificateManager.jsonld#AcmeCertificateManager__member_dnsHandler",
+          "memberFieldName": "dnsHandler"
+        },
+        {
+          "@id": "undefineds:dist/edge/acme/AcmeCertificateManager.jsonld#AcmeCertificateManager__member_email",
+          "memberFieldName": "email"
+        },
+        {
+          "@id": "undefineds:dist/edge/acme/AcmeCertificateManager.jsonld#AcmeCertificateManager__member_domains",
+          "memberFieldName": "domains"
+        },
+        {
+          "@id": "undefineds:dist/edge/acme/AcmeCertificateManager.jsonld#AcmeCertificateManager__member_directoryUrl",
+          "memberFieldName": "directoryUrl"
+        },
+        {
+          "@id": "undefineds:dist/edge/acme/AcmeCertificateManager.jsonld#AcmeCertificateManager__member_fallbackDirectoryUrls",
+          "memberFieldName": "fallbackDirectoryUrls"
+        },
+        {
+          "@id": "undefineds:dist/edge/acme/AcmeCertificateManager.jsonld#AcmeCertificateManager__member_accountKeyPath",
+          "memberFieldName": "accountKeyPath"
+        },
+        {
+          "@id": "undefineds:dist/edge/acme/AcmeCertificateManager.jsonld#AcmeCertificateManager__member_certificateKeyPath",
+          "memberFieldName": "certificateKeyPath"
+        },
+        {
+          "@id": "undefineds:dist/edge/acme/AcmeCertificateManager.jsonld#AcmeCertificateManager__member_certificatePath",
+          "memberFieldName": "certificatePath"
+        },
+        {
+          "@id": "undefineds:dist/edge/acme/AcmeCertificateManager.jsonld#AcmeCertificateManager__member_fullChainPath",
+          "memberFieldName": "fullChainPath"
+        },
+        {
+          "@id": "undefineds:dist/edge/acme/AcmeCertificateManager.jsonld#AcmeCertificateManager__member_renewBeforeDays",
+          "memberFieldName": "renewBeforeDays"
+        },
+        {
+          "@id": "undefineds:dist/edge/acme/AcmeCertificateManager.jsonld#AcmeCertificateManager__member_propagationDelayMs",
+          "memberFieldName": "propagationDelayMs"
+        },
+        {
+          "@id": "undefineds:dist/edge/acme/AcmeCertificateManager.jsonld#AcmeCertificateManager__member_constructor",
+          "memberFieldName": "constructor"
+        },
+        {
+          "@id": "undefineds:dist/edge/acme/AcmeCertificateManager.jsonld#AcmeCertificateManager__member_ensureCertificate",
+          "memberFieldName": "ensureCertificate"
+        },
+        {
+          "@id": "undefineds:dist/edge/acme/AcmeCertificateManager.jsonld#AcmeCertificateManager__member_isCertificateValid",
+          "memberFieldName": "isCertificateValid"
+        },
+        {
+          "@id": "undefineds:dist/edge/acme/AcmeCertificateManager.jsonld#AcmeCertificateManager__member_issueCertificate",
+          "memberFieldName": "issueCertificate"
+        },
+        {
+          "@id": "undefineds:dist/edge/acme/AcmeCertificateManager.jsonld#AcmeCertificateManager__member_issueCertificateFromCA",
+          "memberFieldName": "issueCertificateFromCA"
+        },
+        {
+          "@id": "undefineds:dist/edge/acme/AcmeCertificateManager.jsonld#AcmeCertificateManager__member_ensureAccount",
+          "memberFieldName": "ensureAccount"
+        },
+        {
+          "@id": "undefineds:dist/edge/acme/AcmeCertificateManager.jsonld#AcmeCertificateManager__member_loadOrCreateAccountKey",
+          "memberFieldName": "loadOrCreateAccountKey"
+        },
+        {
+          "@id": "undefineds:dist/edge/acme/AcmeCertificateManager.jsonld#AcmeCertificateManager__member_readOptionalFile",
+          "memberFieldName": "readOptionalFile"
+        },
+        {
+          "@id": "undefineds:dist/edge/acme/AcmeCertificateManager.jsonld#AcmeCertificateManager__member_ensureDirectory",
+          "memberFieldName": "ensureDirectory"
+        },
+        {
+          "@id": "undefineds:dist/edge/acme/AcmeCertificateManager.jsonld#AcmeCertificateManager__member_delay",
+          "memberFieldName": "delay"
+        },
+        {
+          "@id": "undefineds:dist/edge/acme/AcmeCertificateManager.jsonld#AcmeCertificateManager__member_isConflictError",
+          "memberFieldName": "isConflictError"
+        }
+      ],
+      "constructorArguments": [
+        {
+          "@id": "undefineds:dist/edge/acme/AcmeCertificateManager.jsonld#AcmeCertificateManager_options__constructorArgument",
+          "fields": [
+            {
+              "keyRaw": "signalEndpoint",
+              "value": {
+                "@id": "undefineds:dist/edge/acme/AcmeCertificateManager.jsonld#AcmeCertificateManager_options_signalEndpoint"
+              }
+            },
+            {
+              "keyRaw": "nodeId",
+              "value": {
+                "@id": "undefineds:dist/edge/acme/AcmeCertificateManager.jsonld#AcmeCertificateManager_options_nodeId"
+              }
+            },
+            {
+              "keyRaw": "nodeToken",
+              "value": {
+                "@id": "undefineds:dist/edge/acme/AcmeCertificateManager.jsonld#AcmeCertificateManager_options_nodeToken"
+              }
+            },
+            {
+              "keyRaw": "dnsProvider",
+              "value": {
+                "@id": "undefineds:dist/edge/acme/AcmeCertificateManager.jsonld#AcmeCertificateManager_options_dnsProvider"
+              }
+            },
+            {
+              "keyRaw": "rootDomain",
+              "value": {
+                "@id": "undefineds:dist/edge/acme/AcmeCertificateManager.jsonld#AcmeCertificateManager_options_rootDomain"
+              }
+            },
+            {
+              "keyRaw": "dnsChallengeHandler",
+              "value": {
+                "@id": "undefineds:dist/edge/acme/AcmeCertificateManager.jsonld#AcmeCertificateManager_options_dnsChallengeHandler"
+              }
+            },
+            {
+              "keyRaw": "email",
+              "value": {
+                "@id": "undefineds:dist/edge/acme/AcmeCertificateManager.jsonld#AcmeCertificateManager_options_email"
+              }
+            },
+            {
+              "keyRaw": "domains",
+              "value": {
+                "@id": "undefineds:dist/edge/acme/AcmeCertificateManager.jsonld#AcmeCertificateManager_options_domains"
+              }
+            },
+            {
+              "keyRaw": "directoryUrl",
+              "value": {
+                "@id": "undefineds:dist/edge/acme/AcmeCertificateManager.jsonld#AcmeCertificateManager_options_directoryUrl"
+              }
+            },
+            {
+              "keyRaw": "fallbackDirectoryUrls",
+              "value": {
+                "@id": "undefineds:dist/edge/acme/AcmeCertificateManager.jsonld#AcmeCertificateManager_options_fallbackDirectoryUrls"
+              }
+            },
+            {
+              "keyRaw": "accountKeyPath",
+              "value": {
+                "@id": "undefineds:dist/edge/acme/AcmeCertificateManager.jsonld#AcmeCertificateManager_options_accountKeyPath"
+              }
+            },
+            {
+              "keyRaw": "certificateKeyPath",
+              "value": {
+                "@id": "undefineds:dist/edge/acme/AcmeCertificateManager.jsonld#AcmeCertificateManager_options_certificateKeyPath"
+              }
+            },
+            {
+              "keyRaw": "certificatePath",
+              "value": {
+                "@id": "undefineds:dist/edge/acme/AcmeCertificateManager.jsonld#AcmeCertificateManager_options_certificatePath"
+              }
+            },
+            {
+              "keyRaw": "fullChainPath",
+              "value": {
+                "@id": "undefineds:dist/edge/acme/AcmeCertificateManager.jsonld#AcmeCertificateManager_options_fullChainPath"
+              }
+            },
+            {
+              "keyRaw": "renewBeforeDays",
+              "value": {
+                "@id": "undefineds:dist/edge/acme/AcmeCertificateManager.jsonld#AcmeCertificateManager_options_renewBeforeDays"
+              }
+            },
+            {
+              "keyRaw": "propagationDelayMs",
+              "value": {
+                "@id": "undefineds:dist/edge/acme/AcmeCertificateManager.jsonld#AcmeCertificateManager_options_propagationDelayMs"
+              }
+            }
+          ]
+        }
+      ]
+    }
+  ]
+}

package/dist/edge/acme/ClusterCertificateManager.d.ts

@@ -0,0 +1,40 @@
+interface ClusterCertificateManagerOptions {
+    signalEndpoint: string;
+    nodeId: string;
+    nodeToken: string;
+    certificateKeyPath: string;
+    certificatePath: string;
+    fullChainPath?: string;
+    renewBeforeDays?: number;
+    checkIntervalMs?: number;
+    onCertificateInstalled?: () => Promise<void> | void;
+}
+export declare class ClusterCertificateManager {
+    private readonly logger;
+    private readonly endpoint;
+    private readonly nodeId;
+    private readonly nodeToken;
+    private readonly certificateKeyPath;
+    private readonly certificatePath;
+    private readonly fullChainPath?;
+    private readonly renewBeforeMs;
+    private readonly checkIntervalMs;
+    private readonly onCertificateInstalled?;
+    private assignedDomain?;
+    private status;
+    private interval?;
+    private issuing;
+    constructor(options: ClusterCertificateManagerOptions);
+    start(): Promise<void>;
+    stop(): void;
+    handleHeartbeatMetadata(metadata?: Record<string, unknown>): void;
+    getHeartbeatPayload(): Record<string, unknown> | undefined;
+    private ensureCertificate;
+    private isCertificateValid;
+    private refreshCertificateStatus;
+    private extractDomainsFromCertificate;
+    private requestCertificate;
+    private generateKeyAndCsr;
+    private ensureDirectory;
+}
+export {};

package/dist/edge/acme/ClusterCertificateManager.js

@@ -0,0 +1,184 @@
+"use strict";
+var __importDefault = (this && this.__importDefault) || function (mod) {
+    return (mod && mod.__esModule) ? mod : { "default": mod };
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.ClusterCertificateManager = void 0;
+const node_fs_1 = require("node:fs");
+const node_path_1 = require("node:path");
+const node_crypto_1 = require("node:crypto");
+const acme_client_1 = __importDefault(require("acme-client"));
+const global_logger_factory_1 = require("global-logger-factory");
+class ClusterCertificateManager {
+    constructor(options) {
+        this.logger = (0, global_logger_factory_1.getLoggerFor)(this);
+        this.status = {};
+        this.issuing = false;
+        this.endpoint = `${options.signalEndpoint.replace(/\/$/u, '')}/certificate`;
+        this.nodeId = options.nodeId;
+        this.nodeToken = options.nodeToken;
+        this.certificateKeyPath = options.certificateKeyPath;
+        this.certificatePath = options.certificatePath;
+        this.fullChainPath = options.fullChainPath;
+        this.renewBeforeMs = (options.renewBeforeDays ?? 15) * 24 * 60 * 60 * 1000;
+        this.checkIntervalMs = options.checkIntervalMs ?? 6 * 60 * 60 * 1000;
+        this.onCertificateInstalled = options.onCertificateInstalled;
+    }
+    async start() {
+        await this.refreshCertificateStatus();
+        await this.ensureCertificate();
+        this.interval = setInterval(() => {
+            void this.ensureCertificate().catch((error) => {
+                this.logger.error(`定期检查证书失败：${error.message}`);
+            });
+        }, this.checkIntervalMs);
+    }
+    stop() {
+        if (this.interval) {
+            clearInterval(this.interval);
+        }
+    }
+    handleHeartbeatMetadata(metadata) {
+        const subdomain = typeof metadata?.subdomain === 'string' ? metadata.subdomain.trim() : undefined;
+        if (subdomain && subdomain.length > 0) {
+            this.assignedDomain = subdomain.toLowerCase();
+        }
+    }
+    getHeartbeatPayload() {
+        if (!this.status.expiresAt) {
+            return undefined;
+        }
+        return {
+            deployment: {
+                expiresAt: this.status.expiresAt.toISOString(),
+                domains: this.status.domains ?? [],
+                updatedAt: this.status.updatedAt?.toISOString(),
+            },
+        };
+    }
+    async ensureCertificate() {
+        if (this.issuing) {
+            return;
+        }
+        if (!this.assignedDomain) {
+            this.logger.debug('尚未分配域名，等待下一次心跳。');
+            return;
+        }
+        const valid = await this.isCertificateValid();
+        if (valid) {
+            return;
+        }
+        this.issuing = true;
+        try {
+            await this.requestCertificate();
+            await this.refreshCertificateStatus();
+            if (this.onCertificateInstalled) {
+                await this.onCertificateInstalled();
+            }
+        }
+        finally {
+            this.issuing = false;
+        }
+    }
+    async isCertificateValid() {
+        if (!this.status.expiresAt || !this.assignedDomain) {
+            return false;
+        }
+        const remaining = this.status.expiresAt.getTime() - Date.now();
+        if (remaining <= this.renewBeforeMs) {
+            return false;
+        }
+        if (!this.status.domains?.includes(this.assignedDomain)) {
+            return false;
+        }
+        return true;
+    }
+    async refreshCertificateStatus() {
+        try {
+            const pem = await node_fs_1.promises.readFile(this.certificatePath, 'utf8');
+            const cert = new node_crypto_1.X509Certificate(pem);
+            const expiresAt = cert.validTo ? new Date(cert.validTo) : undefined;
+            const domains = this.extractDomainsFromCertificate(cert);
+            this.status = {
+                expiresAt,
+                domains,
+                updatedAt: new Date(),
+            };
+        }
+        catch {
+            this.status = {};
+        }
+    }
+    extractDomainsFromCertificate(cert) {
+        const result = new Set();
+        const subject = cert.subject;
+        if (subject) {
+            const match = /CN=([^,]+)/u.exec(subject);
+            if (match?.[1]) {
+                result.add(match[1].trim().toLowerCase());
+            }
+        }
+        const altNames = cert.subjectAltName?.split(',');
+        if (altNames) {
+            for (const entry of altNames) {
+                const trimmed = entry.trim();
+                if (trimmed.toLowerCase().startsWith('dns:')) {
+                    result.add(trimmed.slice(4).trim().toLowerCase());
+                }
+            }
+        }
+        return Array.from(result);
+    }
+    async requestCertificate() {
+        if (!this.assignedDomain) {
+            throw new Error('无法申请证书：尚未分配域名。');
+        }
+        this.logger.info(`节点 ${this.nodeId} 正在向集群申请证书 (${this.assignedDomain})`);
+        const { privateKey, csr } = await this.generateKeyAndCsr(this.assignedDomain);
+        await this.ensureDirectory((0, node_path_1.dirname)(this.certificateKeyPath));
+        await node_fs_1.promises.writeFile(this.certificateKeyPath, privateKey, 'utf8');
+        const response = await fetch(this.endpoint, {
+            method: 'POST',
+            headers: { 'content-type': 'application/json' },
+            body: JSON.stringify({
+                nodeId: this.nodeId,
+                token: this.nodeToken,
+                csr,
+            }),
+        });
+        if (!response.ok) {
+            const text = await response.text();
+            throw new Error(`申请证书失败：${response.status} ${response.statusText} ${text}`);
+        }
+        const payload = await response.json();
+        if (!payload.certificate?.fullChain) {
+            throw new Error('集群返回数据缺少证书内容。');
+        }
+        await this.ensureDirectory((0, node_path_1.dirname)(this.certificatePath));
+        await node_fs_1.promises.writeFile(this.certificatePath, payload.certificate.fullChain, 'utf8');
+        if (this.fullChainPath) {
+            await this.ensureDirectory((0, node_path_1.dirname)(this.fullChainPath));
+            await node_fs_1.promises.writeFile(this.fullChainPath, payload.certificate.fullChain, 'utf8');
+        }
+        this.logger.info(`节点 ${this.nodeId} 已获取最新证书，有效期至 ${payload.certificate.expiresAt}`);
+    }
+    async generateKeyAndCsr(domain) {
+        const privateKey = await acme_client_1.default.crypto.createPrivateKey();
+        const [, csr] = await acme_client_1.default.crypto.createCsr({
+            commonName: domain,
+            altNames: [domain],
+        }, privateKey);
+        return {
+            privateKey: privateKey.toString(),
+            csr: csr.toString(),
+        };
+    }
+    async ensureDirectory(target) {
+        if (!target || target === '.') {
+            return;
+        }
+        await node_fs_1.promises.mkdir(target, { recursive: true });
+    }
+}
+exports.ClusterCertificateManager = ClusterCertificateManager;
+//# sourceMappingURL=ClusterCertificateManager.js.map

package/dist/edge/acme/ClusterCertificateManager.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"ClusterCertificateManager.js","sourceRoot":"","sources":["../../../src/edge/acme/ClusterCertificateManager.ts"],"names":[],"mappings":";;;;;;AAAA,qCAAyC;AACzC,yCAAoC;AACpC,6CAA8C;AAC9C,8DAA+B;AAC/B,iEAAqD;AA8BrD,MAAa,yBAAyB;IAgBpC,YAAmB,OAAyC;QAf3C,WAAM,GAAG,IAAA,oCAAY,EAAC,IAAI,CAAC,CAAC;QAWrC,WAAM,GAAsB,EAAE,CAAC;QAE/B,YAAO,GAAG,KAAK,CAAC;QAGtB,IAAI,CAAC,QAAQ,GAAG,GAAG,OAAO,CAAC,cAAc,CAAC,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC,cAAc,CAAC;QAC5E,IAAI,CAAC,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC;QAC7B,IAAI,CAAC,SAAS,GAAG,OAAO,CAAC,SAAS,CAAC;QACnC,IAAI,CAAC,kBAAkB,GAAG,OAAO,CAAC,kBAAkB,CAAC;QACrD,IAAI,CAAC,eAAe,GAAG,OAAO,CAAC,eAAe,CAAC;QAC/C,IAAI,CAAC,aAAa,GAAG,OAAO,CAAC,aAAa,CAAC;QAC3C,IAAI,CAAC,aAAa,GAAG,CAAC,OAAO,CAAC,eAAe,IAAI,EAAE,CAAC,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,IAAI,CAAC;QAC3E,IAAI,CAAC,eAAe,GAAG,OAAO,CAAC,eAAe,IAAI,CAAC,GAAG,EAAE,GAAG,EAAE,GAAG,IAAI,CAAC;QACrE,IAAI,CAAC,sBAAsB,GAAG,OAAO,CAAC,sBAAsB,CAAC;IAC/D,CAAC;IAEM,KAAK,CAAC,KAAK;QAChB,MAAM,IAAI,CAAC,wBAAwB,EAAE,CAAC;QACtC,MAAM,IAAI,CAAC,iBAAiB,EAAE,CAAC;QAC/B,IAAI,CAAC,QAAQ,GAAG,WAAW,CAAC,GAAG,EAAE;YAC/B,KAAK,IAAI,CAAC,iBAAiB,EAAE,CAAC,KAAK,CAAC,CAAC,KAAc,EAAE,EAAE;gBACrD,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,YAAa,KAAe,CAAC,OAAO,EAAE,CAAC,CAAC;YAC5D,CAAC,CAAC,CAAC;QACL,CAAC,EAAE,IAAI,CAAC,eAAe,CAAC,CAAC;IAC3B,CAAC;IAEM,IAAI;QACT,IAAI,IAAI,CAAC,QAAQ,EAAE,CAAC;YAClB,aAAa,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;QAC/B,CAAC;IACH,CAAC;IAEM,uBAAuB,CAAC,QAAkC;QAC/D,MAAM,SAAS,GAAG,OAAO,QAAQ,EAAE,SAAS,KAAK,QAAQ,CAAC,CAAC,CAAC,QAAQ,CAAC,SAAS,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,SAAS,CAAC;QAClG,IAAI,SAAS,IAAI,SAAS,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YACtC,IAAI,CAAC,cAAc,GAAG,SAAS,CAAC,WAAW,EAAE,CAAC;QAChD,CAAC;IACH,CAAC;IAEM,mBAAmB;QACxB,IAAI,CAAC,IAAI,CAAC,MAAM,CAAC,SAAS,EAAE,CAAC;YAC3B,OAAO,SAAS,CAAC;QACnB,CAAC;QACD,OAAO;YACL,UAAU,EAAE;gBACV,SAAS,EAAE,IAAI,CAAC,MAAM,CAAC,SAAS,CAAC,WAAW,EAAE;gBAC9C,OAAO,EAAE,IAAI,CAAC,MAAM,CAAC,OAAO,IAAI,EAAE;gBAClC,SAAS,EAAE,IAAI,CAAC,MAAM,CAAC,SAAS,EAAE,WAAW,EAAE;aAChD;SACF,CAAC;IACJ,CAAC;IAEO,KAAK,CAAC,iBAAiB;QAC7B,IAAI,IAAI,CAAC,OAAO,EAAE,CAAC;YACjB,OAAO;QACT,CAAC;QACD,IAAI,CAAC,IAAI,CAAC,cAAc,EAAE,CAAC;YACzB,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,iBAAiB,CAAC,CAAC;YACrC,OAAO;QACT,CAAC;QACD,MAAM,KAAK,GAAG,MAAM,IAAI,CAAC,kBAAkB,EAAE,CAAC;QAC9C,IAAI,KAAK,EAAE,CAAC;YACV,OAAO;QACT,CAAC;QAED,IAAI,CAAC,OAAO,GAAG,IAAI,CAAC;QACpB,IAAI,CAAC;YACH,MAAM,IAAI,CAAC,kBAAkB,EAAE,CAAC;YAChC,MAAM,IAAI,CAAC,wBAAwB,EAAE,CAAC;YACtC,IAAI,IAAI,CAAC,sBAAsB,EAAE,CAAC;gBAChC,MAAM,IAAI,CAAC,sBAAsB,EAAE,CAAC;YACtC,CAAC;QACH,CAAC;gBAAS,CAAC;YACT,IAAI,CAAC,OAAO,GAAG,KAAK,CAAC;QACvB,CAAC;IACH,CAAC;IAEO,KAAK,CAAC,kBAAkB;QAC9B,IAAI,CAAC,IAAI,CAAC,MAAM,CAAC,SAAS,IAAI,CAAC,IAAI,CAAC,cAAc,EAAE,CAAC;YACnD,OAAO,KAAK,CAAC;QACf,CAAC;QACD,MAAM,SAAS,GAAG,IAAI,CAAC,MAAM,CAAC,SAAS,CAAC,OAAO,EAAE,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;QAC/D,IAAI,SAAS,IAAI,IAAI,CAAC,aAAa,EAAE,CAAC;YACpC,OAAO,KAAK,CAAC;QACf,CAAC;QACD,IAAI,CAAC,IAAI,CAAC,MAAM,CAAC,OAAO,EAAE,QAAQ,CAAC,IAAI,CAAC,cAAc,CAAC,EAAE,CAAC;YACxD,OAAO,KAAK,CAAC;QACf,CAAC;QACD,OAAO,IAAI,CAAC;IACd,CAAC;IAEO,KAAK,CAAC,wBAAwB;QACpC,IAAI,CAAC;YACH,MAAM,GAAG,GAAG,MAAM,kBAAE,CAAC,QAAQ,CAAC,IAAI,CAAC,eAAe,EAAE,MAAM,CAAC,CAAC;YAC5D,MAAM,IAAI,GAAG,IAAI,6BAAe,CAAC,GAAG,CAAC,CAAC;YACtC,MAAM,SAAS,GAAG,IAAI,CAAC,OAAO,CAAC,CAAC,CAAC,IAAI,IAAI,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;YACpE,MAAM,OAAO,GAAG,IAAI,CAAC,6BAA6B,CAAC,IAAI,CAAC,CAAC;YACzD,IAAI,CAAC,MAAM,GAAG;gBACZ,SAAS;gBACT,OAAO;gBACP,SAAS,EAAE,IAAI,IAAI,EAAE;aACtB,CAAC;QACJ,CAAC;QAAC,MAAM,CAAC;YACP,IAAI,CAAC,MAAM,GAAG,EAAE,CAAC;QACnB,CAAC;IACH,CAAC;IAEO,6BAA6B,CAAC,IAAqB;QACzD,MAAM,MAAM,GAAG,IAAI,GAAG,EAAU,CAAC;QACjC,MAAM,OAAO,GAAG,IAAI,CAAC,OAAO,CAAC;QAC7B,IAAI,OAAO,EAAE,CAAC;YACZ,MAAM,KAAK,GAAG,aAAa,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;YAC1C,IAAI,KAAK,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;gBACf,MAAM,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC,CAAC;YAC5C,CAAC;QACH,CAAC;QACD,MAAM,QAAQ,GAAG,IAAI,CAAC,cAAc,EAAE,KAAK,CAAC,GAAG,CAAC,CAAC;QACjD,IAAI,QAAQ,EAAE,CAAC;YACb,KAAK,MAAM,KAAK,IAAI,QAAQ,EAAE,CAAC;gBAC7B,MAAM,OAAO,GAAG,KAAK,CAAC,IAAI,EAAE,CAAC;gBAC7B,IAAI,OAAO,CAAC,WAAW,EAAE,CAAC,UAAU,CAAC,MAAM,CAAC,EAAE,CAAC;oBAC7C,MAAM,CAAC,GAAG,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC,CAAC;gBACpD,CAAC;YACH,CAAC;QACH,CAAC;QACD,OAAO,KAAK,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;IAC5B,CAAC;IAEO,KAAK,CAAC,kBAAkB;QAC9B,IAAI,CAAC,IAAI,CAAC,cAAc,EAAE,CAAC;YACzB,MAAM,IAAI,KAAK,CAAC,gBAAgB,CAAC,CAAC;QACpC,CAAC;QACD,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,MAAM,IAAI,CAAC,MAAM,eAAe,IAAI,CAAC,cAAc,GAAG,CAAC,CAAC;QACzE,MAAM,EAAE,UAAU,EAAE,GAAG,EAAE,GAAG,MAAM,IAAI,CAAC,iBAAiB,CAAC,IAAI,CAAC,cAAc,CAAC,CAAC;QAE9E,MAAM,IAAI,CAAC,eAAe,CAAC,IAAA,mBAAO,EAAC,IAAI,CAAC,kBAAkB,CAAC,CAAC,CAAC;QAC7D,MAAM,kBAAE,CAAC,SAAS,CAAC,IAAI,CAAC,kBAAkB,EAAE,UAAU,EAAE,MAAM,CAAC,CAAC;QAEhE,MAAM,QAAQ,GAAG,MAAM,KAAK,CAAC,IAAI,CAAC,QAAQ,EAAE;YAC1C,MAAM,EAAE,MAAM;YACd,OAAO,EAAE,EAAE,cAAc,EAAE,kBAAkB,EAAE;YAC/C,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC;gBACnB,MAAM,EAAE,IAAI,CAAC,MAAM;gBACnB,KAAK,EAAE,IAAI,CAAC,SAAS;gBACrB,GAAG;aACJ,CAAC;SACH,CAAC,CAAC;QAEH,IAAI,CAAC,QAAQ,CAAC,EAAE,EAAE,CAAC;YACjB,MAAM,IAAI,GAAG,MAAM,QAAQ,CAAC,IAAI,EAAE,CAAC;YACnC,MAAM,IAAI,KAAK,CAAC,UAAU,QAAQ,CAAC,MAAM,IAAI,QAAQ,CAAC,UAAU,IAAI,IAAI,EAAE,CAAC,CAAC;QAC9E,CAAC;QAED,MAAM,OAAO,GAAG,MAAM,QAAQ,CAAC,IAAI,EAAyB,CAAC;QAC7D,IAAI,CAAC,OAAO,CAAC,WAAW,EAAE,SAAS,EAAE,CAAC;YACpC,MAAM,IAAI,KAAK,CAAC,eAAe,CAAC,CAAC;QACnC,CAAC;QAED,MAAM,IAAI,CAAC,eAAe,CAAC,IAAA,mBAAO,EAAC,IAAI,CAAC,eAAe,CAAC,CAAC,CAAC;QAC1D,MAAM,kBAAE,CAAC,SAAS,CAAC,IAAI,CAAC,eAAe,EAAE,OAAO,CAAC,WAAW,CAAC,SAAS,EAAE,MAAM,CAAC,CAAC;QAChF,IAAI,IAAI,CAAC,aAAa,EAAE,CAAC;YACvB,MAAM,IAAI,CAAC,eAAe,CAAC,IAAA,mBAAO,EAAC,IAAI,CAAC,aAAa,CAAC,CAAC,CAAC;YACxD,MAAM,kBAAE,CAAC,SAAS,CAAC,IAAI,CAAC,aAAa,EAAE,OAAO,CAAC,WAAW,CAAC,SAAS,EAAE,MAAM,CAAC,CAAC;QAChF,CAAC;QACD,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,MAAM,IAAI,CAAC,MAAM,iBAAiB,OAAO,CAAC,WAAW,CAAC,SAAS,EAAE,CAAC,CAAC;IACtF,CAAC;IAEO,KAAK,CAAC,iBAAiB,CAAC,MAAc;QAC5C,MAAM,UAAU,GAAG,MAAM,qBAAI,CAAC,MAAM,CAAC,gBAAgB,EAAE,CAAC;QACxD,MAAM,CAAC,EAAE,GAAG,CAAC,GAAG,MAAM,qBAAI,CAAC,MAAM,CAAC,SAAS,CAAC;YAC1C,UAAU,EAAE,MAAM;YAClB,QAAQ,EAAE,CAAE,MAAM,CAAE;SACrB,EAAE,UAAU,CAAC,CAAC;QACf,OAAO;YACL,UAAU,EAAE,UAAU,CAAC,QAAQ,EAAE;YACjC,GAAG,EAAE,GAAG,CAAC,QAAQ,EAAE;SACpB,CAAC;IACJ,CAAC;IAEO,KAAK,CAAC,eAAe,CAAC,MAAc;QAC1C,IAAI,CAAC,MAAM,IAAI,MAAM,KAAK,GAAG,EAAE,CAAC;YAC9B,OAAO;QACT,CAAC;QACD,MAAM,kBAAE,CAAC,KAAK,CAAC,MAAM,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;IAC9C,CAAC;CACF;AArMD,8DAqMC","sourcesContent":["import { promises as fs } from 'node:fs';\nimport { dirname } from 'node:path';\nimport { X509Certificate } from 'node:crypto';\nimport acme from 'acme-client';\nimport { getLoggerFor } from 'global-logger-factory';\n\ninterface ClusterCertificateManagerOptions {\n  signalEndpoint: string;\n  nodeId: string;\n  nodeToken: string;\n  certificateKeyPath: string;\n  certificatePath: string;\n  fullChainPath?: string;\n  renewBeforeDays?: number;\n  checkIntervalMs?: number;\n  onCertificateInstalled?: () => Promise<void> | void;\n}\n\ninterface CertificateStatus {\n  expiresAt?: Date;\n  domains?: string[];\n  updatedAt?: Date;\n}\n\ninterface CertificateResponse {\n  status: string;\n  certificate: {\n    pem: string;\n    fullChain: string;\n    expiresAt: string;\n    domains: string[];\n  };\n}\n\nexport class ClusterCertificateManager {\n  private readonly logger = getLoggerFor(this);\n  private readonly endpoint: string;\n  private readonly nodeId: string;\n  private readonly nodeToken: string;\n  private readonly certificateKeyPath: string;\n  private readonly certificatePath: string;\n  private readonly fullChainPath?: string;\n  private readonly renewBeforeMs: number;\n  private readonly checkIntervalMs: number;\n  private readonly onCertificateInstalled?: () => Promise<void> | void;\n  private assignedDomain?: string;\n  private status: CertificateStatus = {};\n  private interval?: NodeJS.Timeout;\n  private issuing = false;\n\n  public constructor(options: ClusterCertificateManagerOptions) {\n    this.endpoint = `${options.signalEndpoint.replace(/\\/$/u, '')}/certificate`;\n    this.nodeId = options.nodeId;\n    this.nodeToken = options.nodeToken;\n    this.certificateKeyPath = options.certificateKeyPath;\n    this.certificatePath = options.certificatePath;\n    this.fullChainPath = options.fullChainPath;\n    this.renewBeforeMs = (options.renewBeforeDays ?? 15) * 24 * 60 * 60 * 1000;\n    this.checkIntervalMs = options.checkIntervalMs ?? 6 * 60 * 60 * 1000;\n    this.onCertificateInstalled = options.onCertificateInstalled;\n  }\n\n  public async start(): Promise<void> {\n    await this.refreshCertificateStatus();\n    await this.ensureCertificate();\n    this.interval = setInterval(() => {\n      void this.ensureCertificate().catch((error: unknown) => {\n        this.logger.error(`定期检查证书失败：${(error as Error).message}`);\n      });\n    }, this.checkIntervalMs);\n  }\n\n  public stop(): void {\n    if (this.interval) {\n      clearInterval(this.interval);\n    }\n  }\n\n  public handleHeartbeatMetadata(metadata?: Record<string, unknown>): void {\n    const subdomain = typeof metadata?.subdomain === 'string' ? metadata.subdomain.trim() : undefined;\n    if (subdomain && subdomain.length > 0) {\n      this.assignedDomain = subdomain.toLowerCase();\n    }\n  }\n\n  public getHeartbeatPayload(): Record<string, unknown> | undefined {\n    if (!this.status.expiresAt) {\n      return undefined;\n    }\n    return {\n      deployment: {\n        expiresAt: this.status.expiresAt.toISOString(),\n        domains: this.status.domains ?? [],\n        updatedAt: this.status.updatedAt?.toISOString(),\n      },\n    };\n  }\n\n  private async ensureCertificate(): Promise<void> {\n    if (this.issuing) {\n      return;\n    }\n    if (!this.assignedDomain) {\n      this.logger.debug('尚未分配域名，等待下一次心跳。');\n      return;\n    }\n    const valid = await this.isCertificateValid();\n    if (valid) {\n      return;\n    }\n\n    this.issuing = true;\n    try {\n      await this.requestCertificate();\n      await this.refreshCertificateStatus();\n      if (this.onCertificateInstalled) {\n        await this.onCertificateInstalled();\n      }\n    } finally {\n      this.issuing = false;\n    }\n  }\n\n  private async isCertificateValid(): Promise<boolean> {\n    if (!this.status.expiresAt || !this.assignedDomain) {\n      return false;\n    }\n    const remaining = this.status.expiresAt.getTime() - Date.now();\n    if (remaining <= this.renewBeforeMs) {\n      return false;\n    }\n    if (!this.status.domains?.includes(this.assignedDomain)) {\n      return false;\n    }\n    return true;\n  }\n\n  private async refreshCertificateStatus(): Promise<void> {\n    try {\n      const pem = await fs.readFile(this.certificatePath, 'utf8');\n      const cert = new X509Certificate(pem);\n      const expiresAt = cert.validTo ? new Date(cert.validTo) : undefined;\n      const domains = this.extractDomainsFromCertificate(cert);\n      this.status = {\n        expiresAt,\n        domains,\n        updatedAt: new Date(),\n      };\n    } catch {\n      this.status = {};\n    }\n  }\n\n  private extractDomainsFromCertificate(cert: X509Certificate): string[] {\n    const result = new Set<string>();\n    const subject = cert.subject;\n    if (subject) {\n      const match = /CN=([^,]+)/u.exec(subject);\n      if (match?.[1]) {\n        result.add(match[1].trim().toLowerCase());\n      }\n    }\n    const altNames = cert.subjectAltName?.split(',');\n    if (altNames) {\n      for (const entry of altNames) {\n        const trimmed = entry.trim();\n        if (trimmed.toLowerCase().startsWith('dns:')) {\n          result.add(trimmed.slice(4).trim().toLowerCase());\n        }\n      }\n    }\n    return Array.from(result);\n  }\n\n  private async requestCertificate(): Promise<void> {\n    if (!this.assignedDomain) {\n      throw new Error('无法申请证书：尚未分配域名。');\n    }\n    this.logger.info(`节点 ${this.nodeId} 正在向集群申请证书 (${this.assignedDomain})`);\n    const { privateKey, csr } = await this.generateKeyAndCsr(this.assignedDomain);\n\n    await this.ensureDirectory(dirname(this.certificateKeyPath));\n    await fs.writeFile(this.certificateKeyPath, privateKey, 'utf8');\n\n    const response = await fetch(this.endpoint, {\n      method: 'POST',\n      headers: { 'content-type': 'application/json' },\n      body: JSON.stringify({\n        nodeId: this.nodeId,\n        token: this.nodeToken,\n        csr,\n      }),\n    });\n\n    if (!response.ok) {\n      const text = await response.text();\n      throw new Error(`申请证书失败：${response.status} ${response.statusText} ${text}`);\n    }\n\n    const payload = await response.json() as CertificateResponse;\n    if (!payload.certificate?.fullChain) {\n      throw new Error('集群返回数据缺少证书内容。');\n    }\n\n    await this.ensureDirectory(dirname(this.certificatePath));\n    await fs.writeFile(this.certificatePath, payload.certificate.fullChain, 'utf8');\n    if (this.fullChainPath) {\n      await this.ensureDirectory(dirname(this.fullChainPath));\n      await fs.writeFile(this.fullChainPath, payload.certificate.fullChain, 'utf8');\n    }\n    this.logger.info(`节点 ${this.nodeId} 已获取最新证书，有效期至 ${payload.certificate.expiresAt}`);\n  }\n\n  private async generateKeyAndCsr(domain: string): Promise<{ privateKey: string; csr: string }> {\n    const privateKey = await acme.crypto.createPrivateKey();\n    const [, csr] = await acme.crypto.createCsr({\n      commonName: domain,\n      altNames: [ domain ],\n    }, privateKey);\n    return {\n      privateKey: privateKey.toString(),\n      csr: csr.toString(),\n    };\n  }\n\n  private async ensureDirectory(target: string): Promise<void> {\n    if (!target || target === '.') {\n      return;\n    }\n    await fs.mkdir(target, { recursive: true });\n  }\n}\n"]}

package/dist/edge/acme/DnsChallengeClient.d.ts

@@ -0,0 +1,15 @@
+interface DnsChallengeClientOptions {
+    signalEndpoint: string;
+    nodeId: string;
+    nodeToken: string;
+}
+export declare class DnsChallengeClient {
+    private readonly endpoint;
+    private readonly nodeId;
+    private readonly nodeToken;
+    constructor(options: DnsChallengeClientOptions);
+    setChallenge(host: string, value: string): Promise<void>;
+    removeChallenge(host: string, value?: string): Promise<void>;
+    private postChallenge;
+}
+export {};