@undefineds.co/xpod 0.1.0-local.202602081751

package/dist/sdk/xpodFetch.js

@@ -0,0 +1,251 @@
+"use strict";
+/**
+ * xpodFetch SDK
+ *
+ * 提供 fetch 兼容的 API，通过 WebRTC 连接 Local 节点
+ * 可与 Inrupt Solid SDK 集成
+ */
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.XpodFetch = void 0;
+exports.createXpodFetch = createXpodFetch;
+const WebRTCClient_1 = require("../webrtc/WebRTCClient");
+/**
+ * xpodFetch 类
+ *
+ * 提供 fetch 兼容的 API，自动通过 WebRTC 连接 Local 节点
+ */
+class XpodFetch {
+    constructor(options) {
+        /** 待处理的连接 */
+        this.pendingConnections = new Map();
+        this.signalingConnector = options.signalingConnector;
+        this.urlToNodeId = options.urlToNodeId;
+        this.fallbackFetch = options.fallbackFetch;
+        this.connectionTimeout = options.connectionTimeout ?? 30000;
+        this.webrtcClient = new WebRTCClient_1.WebRTCClient(options.peerConnectionFactory, options.signalingConnector.getSender(), options.rtcConfig, options.requestTimeout);
+        // 设置信令处理器
+        this.setupSignalingHandlers();
+    }
+    /**
+     * 初始化（连接信令服务器）
+     */
+    async initialize() {
+        if (!this.signalingConnector.isConnected()) {
+            await this.signalingConnector.connect();
+        }
+    }
+    /**
+     * 关闭连接
+     */
+    close() {
+        this.webrtcClient.disconnectAll();
+        this.signalingConnector.disconnect();
+        // 取消所有待处理的连接
+        for (const [, pending] of this.pendingConnections) {
+            clearTimeout(pending.timeout);
+            pending.reject(new Error('XpodFetch closed'));
+        }
+        this.pendingConnections.clear();
+    }
+    /**
+     * 创建 fetch 函数
+     *
+     * 返回一个可以与 Inrupt SDK 集成的 fetch 函数
+     */
+    createFetch() {
+        return async (input, init) => {
+            const url = typeof input === 'string' ? input : input instanceof URL ? input.href : input.url;
+            const nodeId = this.urlToNodeId(url);
+            // 如果无法确定 nodeId，回退到普通 fetch
+            if (!nodeId) {
+                if (this.fallbackFetch) {
+                    return this.fallbackFetch(input, init);
+                }
+                throw new Error(`Cannot determine nodeId for URL: ${url}`);
+            }
+            // 确保连接已建立
+            await this.ensureConnected(nodeId);
+            // 解析请求
+            const method = init?.method ?? 'GET';
+            const parsedUrl = new URL(url);
+            const path = parsedUrl.pathname + parsedUrl.search;
+            // 处理请求头
+            const headers = {};
+            if (init?.headers) {
+                if (init.headers instanceof Headers) {
+                    init.headers.forEach((value, key) => {
+                        headers[key] = value;
+                    });
+                }
+                else if (Array.isArray(init.headers)) {
+                    for (const [key, value] of init.headers) {
+                        headers[key] = value;
+                    }
+                }
+                else {
+                    Object.assign(headers, init.headers);
+                }
+            }
+            // 处理请求体
+            let body;
+            if (init?.body) {
+                if (typeof init.body === 'string') {
+                    body = init.body;
+                }
+                else if (init.body instanceof ArrayBuffer) {
+                    body = init.body;
+                }
+                else if (init.body instanceof Uint8Array) {
+                    body = init.body.buffer;
+                }
+                else if (typeof Blob !== 'undefined' && init.body instanceof Blob) {
+                    body = await init.body.arrayBuffer();
+                }
+                else {
+                    // 其他类型尝试转为字符串
+                    body = String(init.body);
+                }
+            }
+            // 发送请求
+            const response = await this.webrtcClient.fetch(nodeId, method, path, headers, body);
+            // 转换为 Response
+            return this.toFetchResponse(response, url);
+        };
+    }
+    /**
+     * 获取 WebRTC 客户端
+     */
+    getWebRTCClient() {
+        return this.webrtcClient;
+    }
+    /**
+     * 检查是否已连接到指定节点
+     */
+    isConnectedToNode(nodeId) {
+        return this.webrtcClient.isConnected(nodeId);
+    }
+    /**
+     * 手动连接到指定节点
+     */
+    async connectToNode(nodeId) {
+        return this.ensureConnected(nodeId);
+    }
+    /**
+     * 断开与指定节点的连接
+     */
+    disconnectFromNode(nodeId) {
+        this.webrtcClient.disconnect(nodeId);
+    }
+    setupSignalingHandlers() {
+        // 处理 RTC answer
+        this.signalingConnector.onAnswer((nodeId, sessionId, sdp) => {
+            this.webrtcClient.handleAnswer(nodeId, sessionId, sdp);
+        });
+        // 处理 ICE candidate
+        this.signalingConnector.onIceCandidate((nodeId, sessionId, candidate, sdpMid, sdpMLineIndex) => {
+            this.webrtcClient.handleIceCandidate(nodeId, sessionId, candidate, sdpMid, sdpMLineIndex);
+        });
+        // 处理连接关闭
+        this.signalingConnector.onClose((nodeId, reason) => {
+            this.webrtcClient.handleClose(nodeId, reason);
+        });
+        // 处理连接成功
+        this.webrtcClient.on('connected', (nodeId) => {
+            const pending = this.pendingConnections.get(nodeId);
+            if (pending) {
+                clearTimeout(pending.timeout);
+                pending.resolve();
+                this.pendingConnections.delete(nodeId);
+            }
+        });
+        // 处理连接失败
+        this.webrtcClient.on('disconnected', (nodeId, reason) => {
+            const pending = this.pendingConnections.get(nodeId);
+            if (pending) {
+                clearTimeout(pending.timeout);
+                pending.reject(new Error(`Connection failed: ${reason ?? 'unknown'}`));
+                this.pendingConnections.delete(nodeId);
+            }
+        });
+    }
+    async ensureConnected(nodeId) {
+        // 已连接
+        if (this.webrtcClient.isConnected(nodeId)) {
+            return;
+        }
+        // 检查是否有待处理的连接
+        const pending = this.pendingConnections.get(nodeId);
+        if (pending) {
+            return pending.promise;
+        }
+        // 创建新连接
+        let resolve;
+        let reject;
+        const promise = new Promise((res, rej) => {
+            resolve = res;
+            reject = rej;
+        });
+        const timeout = setTimeout(() => {
+            this.pendingConnections.delete(nodeId);
+            this.webrtcClient.disconnect(nodeId);
+            reject(new Error(`Connection timeout to node ${nodeId}`));
+        }, this.connectionTimeout);
+        this.pendingConnections.set(nodeId, {
+            promise,
+            resolve: resolve,
+            reject: reject,
+            timeout,
+        });
+        // 发起连接
+        try {
+            await this.webrtcClient.connect(nodeId);
+        }
+        catch (error) {
+            clearTimeout(timeout);
+            this.pendingConnections.delete(nodeId);
+            throw error;
+        }
+        return promise;
+    }
+    toFetchResponse(response, url) {
+        // 解码响应体
+        let body = null;
+        if (response.body) {
+            // 处理 Node.js 和浏览器环境
+            if (typeof Buffer !== 'undefined') {
+                body = Buffer.from(response.body, 'base64');
+            }
+            else {
+                // 浏览器环境
+                const binaryString = atob(response.body);
+                const bytes = new Uint8Array(binaryString.length);
+                for (let i = 0; i < binaryString.length; i++) {
+                    bytes[i] = binaryString.charCodeAt(i);
+                }
+                body = bytes.buffer;
+            }
+        }
+        // 创建 Response 对象
+        const responseInit = {
+            status: response.status,
+            statusText: response.statusText,
+            headers: new Headers(response.headers),
+        };
+        // 创建 Response（注意：Response 的 body 需要是 BodyInit 类型）
+        const fetchResponse = new Response(body, responseInit);
+        // 设置 url（只读属性，需要用 Object.defineProperty）
+        Object.defineProperty(fetchResponse, 'url', {
+            value: url,
+            writable: false,
+        });
+        return fetchResponse;
+    }
+}
+exports.XpodFetch = XpodFetch;
+/**
+ * 创建 xpodFetch 实例的便捷函数
+ */
+function createXpodFetch(options) {
+    return new XpodFetch(options);
+}
+//# sourceMappingURL=xpodFetch.js.map

package/dist/sdk/xpodFetch.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"xpodFetch.js","sourceRoot":"","sources":["../../src/sdk/xpodFetch.ts"],"names":[],"mappings":";AAAA;;;;;GAKG;;;AAoWH,0CAEC;AA/VD,yDAAkF;AA0ElF;;;;GAIG;AACH,MAAa,SAAS;IAUpB,YAAmB,OAAyB;QAH5C,aAAa;QACI,uBAAkB,GAAG,IAAI,GAAG,EAA6B,CAAC;QAGzE,IAAI,CAAC,kBAAkB,GAAG,OAAO,CAAC,kBAAkB,CAAC;QACrD,IAAI,CAAC,WAAW,GAAG,OAAO,CAAC,WAAW,CAAC;QACvC,IAAI,CAAC,aAAa,GAAG,OAAO,CAAC,aAAa,CAAC;QAC3C,IAAI,CAAC,iBAAiB,GAAG,OAAO,CAAC,iBAAiB,IAAI,KAAK,CAAC;QAE5D,IAAI,CAAC,YAAY,GAAG,IAAI,2BAAY,CAClC,OAAO,CAAC,qBAAqB,EAC7B,OAAO,CAAC,kBAAkB,CAAC,SAAS,EAAE,EACtC,OAAO,CAAC,SAAS,EACjB,OAAO,CAAC,cAAc,CACvB,CAAC;QAEF,UAAU;QACV,IAAI,CAAC,sBAAsB,EAAE,CAAC;IAChC,CAAC;IAED;;OAEG;IACI,KAAK,CAAC,UAAU;QACrB,IAAI,CAAC,IAAI,CAAC,kBAAkB,CAAC,WAAW,EAAE,EAAE,CAAC;YAC3C,MAAM,IAAI,CAAC,kBAAkB,CAAC,OAAO,EAAE,CAAC;QAC1C,CAAC;IACH,CAAC;IAED;;OAEG;IACI,KAAK;QACV,IAAI,CAAC,YAAY,CAAC,aAAa,EAAE,CAAC;QAClC,IAAI,CAAC,kBAAkB,CAAC,UAAU,EAAE,CAAC;QAErC,aAAa;QACb,KAAK,MAAM,CAAC,EAAE,OAAO,CAAC,IAAI,IAAI,CAAC,kBAAkB,EAAE,CAAC;YAClD,YAAY,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC;YAC9B,OAAO,CAAC,MAAM,CAAC,IAAI,KAAK,CAAC,kBAAkB,CAAC,CAAC,CAAC;QAChD,CAAC;QACD,IAAI,CAAC,kBAAkB,CAAC,KAAK,EAAE,CAAC;IAClC,CAAC;IAED;;;;OAIG;IACI,WAAW;QAChB,OAAO,KAAK,EAAE,KAA6B,EAAE,IAAkB,EAAqB,EAAE;YACpF,MAAM,GAAG,GAAG,OAAO,KAAK,KAAK,QAAQ,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,KAAK,YAAY,GAAG,CAAC,CAAC,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,KAAK,CAAC,GAAG,CAAC;YAC9F,MAAM,MAAM,GAAG,IAAI,CAAC,WAAW,CAAC,GAAG,CAAC,CAAC;YAErC,4BAA4B;YAC5B,IAAI,CAAC,MAAM,EAAE,CAAC;gBACZ,IAAI,IAAI,CAAC,aAAa,EAAE,CAAC;oBACvB,OAAO,IAAI,CAAC,aAAa,CAAC,KAAK,EAAE,IAAI,CAAC,CAAC;gBACzC,CAAC;gBACD,MAAM,IAAI,KAAK,CAAC,oCAAoC,GAAG,EAAE,CAAC,CAAC;YAC7D,CAAC;YAED,UAAU;YACV,MAAM,IAAI,CAAC,eAAe,CAAC,MAAM,CAAC,CAAC;YAEnC,OAAO;YACP,MAAM,MAAM,GAAG,IAAI,EAAE,MAAM,IAAI,KAAK,CAAC;YACrC,MAAM,SAAS,GAAG,IAAI,GAAG,CAAC,GAAG,CAAC,CAAC;YAC/B,MAAM,IAAI,GAAG,SAAS,CAAC,QAAQ,GAAG,SAAS,CAAC,MAAM,CAAC;YAEnD,QAAQ;YACR,MAAM,OAAO,GAA2B,EAAE,CAAC;YAC3C,IAAI,IAAI,EAAE,OAAO,EAAE,CAAC;gBAClB,IAAI,IAAI,CAAC,OAAO,YAAY,OAAO,EAAE,CAAC;oBACpC,IAAI,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC,KAAK,EAAE,GAAG,EAAE,EAAE;wBAClC,OAAO,CAAC,GAAG,CAAC,GAAG,KAAK,CAAC;oBACvB,CAAC,CAAC,CAAC;gBACL,CAAC;qBAAM,IAAI,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,OAAO,CAAC,EAAE,CAAC;oBACvC,KAAK,MAAM,CAAC,GAAG,EAAE,KAAK,CAAC,IAAI,IAAI,CAAC,OAAO,EAAE,CAAC;wBACxC,OAAO,CAAC,GAAG,CAAC,GAAG,KAAK,CAAC;oBACvB,CAAC;gBACH,CAAC;qBAAM,CAAC;oBACN,MAAM,CAAC,MAAM,CAAC,OAAO,EAAE,IAAI,CAAC,OAAO,CAAC,CAAC;gBACvC,CAAC;YACH,CAAC;YAED,QAAQ;YACR,IAAI,IAAsC,CAAC;YAC3C,IAAI,IAAI,EAAE,IAAI,EAAE,CAAC;gBACf,IAAI,OAAO,IAAI,CAAC,IAAI,KAAK,QAAQ,EAAE,CAAC;oBAClC,IAAI,GAAG,IAAI,CAAC,IAAI,CAAC;gBACnB,CAAC;qBAAM,IAAI,IAAI,CAAC,IAAI,YAAY,WAAW,EAAE,CAAC;oBAC5C,IAAI,GAAG,IAAI,CAAC,IAAI,CAAC;gBACnB,CAAC;qBAAM,IAAI,IAAI,CAAC,IAAI,YAAY,UAAU,EAAE,CAAC;oBAC3C,IAAI,GAAG,IAAI,CAAC,IAAI,CAAC,MAAqB,CAAC;gBACzC,CAAC;qBAAM,IAAI,OAAO,IAAI,KAAK,WAAW,IAAI,IAAI,CAAC,IAAI,YAAY,IAAI,EAAE,CAAC;oBACpE,IAAI,GAAG,MAAM,IAAI,CAAC,IAAI,CAAC,WAAW,EAAE,CAAC;gBACvC,CAAC;qBAAM,CAAC;oBACN,cAAc;oBACd,IAAI,GAAG,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;gBAC3B,CAAC;YACH,CAAC;YAED,OAAO;YACP,MAAM,QAAQ,GAAG,MAAM,IAAI,CAAC,YAAY,CAAC,KAAK,CAAC,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,OAAO,EAAE,IAAI,CAAC,CAAC;YAEpF,eAAe;YACf,OAAO,IAAI,CAAC,eAAe,CAAC,QAAQ,EAAE,GAAG,CAAC,CAAC;QAC7C,CAAC,CAAC;IACJ,CAAC;IAED;;OAEG;IACI,eAAe;QACpB,OAAO,IAAI,CAAC,YAAY,CAAC;IAC3B,CAAC;IAED;;OAEG;IACI,iBAAiB,CAAC,MAAc;QACrC,OAAO,IAAI,CAAC,YAAY,CAAC,WAAW,CAAC,MAAM,CAAC,CAAC;IAC/C,CAAC;IAED;;OAEG;IACI,KAAK,CAAC,aAAa,CAAC,MAAc;QACvC,OAAO,IAAI,CAAC,eAAe,CAAC,MAAM,CAAC,CAAC;IACtC,CAAC;IAED;;OAEG;IACI,kBAAkB,CAAC,MAAc;QACtC,IAAI,CAAC,YAAY,CAAC,UAAU,CAAC,MAAM,CAAC,CAAC;IACvC,CAAC;IAEO,sBAAsB;QAC5B,gBAAgB;QAChB,IAAI,CAAC,kBAAkB,CAAC,QAAQ,CAAC,CAAC,MAAM,EAAE,SAAS,EAAE,GAAG,EAAE,EAAE;YAC1D,IAAI,CAAC,YAAY,CAAC,YAAY,CAAC,MAAM,EAAE,SAAS,EAAE,GAAG,CAAC,CAAC;QACzD,CAAC,CAAC,CAAC;QAEH,mBAAmB;QACnB,IAAI,CAAC,kBAAkB,CAAC,cAAc,CAAC,CAAC,MAAM,EAAE,SAAS,EAAE,SAAS,EAAE,MAAM,EAAE,aAAa,EAAE,EAAE;YAC7F,IAAI,CAAC,YAAY,CAAC,kBAAkB,CAAC,MAAM,EAAE,SAAS,EAAE,SAAS,EAAE,MAAM,EAAE,aAAa,CAAC,CAAC;QAC5F,CAAC,CAAC,CAAC;QAEH,SAAS;QACT,IAAI,CAAC,kBAAkB,CAAC,OAAO,CAAC,CAAC,MAAM,EAAE,MAAM,EAAE,EAAE;YACjD,IAAI,CAAC,YAAY,CAAC,WAAW,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;QAChD,CAAC,CAAC,CAAC;QAEH,SAAS;QACT,IAAI,CAAC,YAAY,CAAC,EAAE,CAAC,WAAW,EAAE,CAAC,MAAM,EAAE,EAAE;YAC3C,MAAM,OAAO,GAAG,IAAI,CAAC,kBAAkB,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC;YACpD,IAAI,OAAO,EAAE,CAAC;gBACZ,YAAY,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC;gBAC9B,OAAO,CAAC,OAAO,EAAE,CAAC;gBAClB,IAAI,CAAC,kBAAkB,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC;YACzC,CAAC;QACH,CAAC,CAAC,CAAC;QAEH,SAAS;QACT,IAAI,CAAC,YAAY,CAAC,EAAE,CAAC,cAAc,EAAE,CAAC,MAAM,EAAE,MAAM,EAAE,EAAE;YACtD,MAAM,OAAO,GAAG,IAAI,CAAC,kBAAkB,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC;YACpD,IAAI,OAAO,EAAE,CAAC;gBACZ,YAAY,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC;gBAC9B,OAAO,CAAC,MAAM,CAAC,IAAI,KAAK,CAAC,sBAAsB,MAAM,IAAI,SAAS,EAAE,CAAC,CAAC,CAAC;gBACvE,IAAI,CAAC,kBAAkB,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC;YACzC,CAAC;QACH,CAAC,CAAC,CAAC;IACL,CAAC;IAEO,KAAK,CAAC,eAAe,CAAC,MAAc;QAC1C,MAAM;QACN,IAAI,IAAI,CAAC,YAAY,CAAC,WAAW,CAAC,MAAM,CAAC,EAAE,CAAC;YAC1C,OAAO;QACT,CAAC;QAED,cAAc;QACd,MAAM,OAAO,GAAG,IAAI,CAAC,kBAAkB,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC;QACpD,IAAI,OAAO,EAAE,CAAC;YACZ,OAAO,OAAO,CAAC,OAAO,CAAC;QACzB,CAAC;QAED,QAAQ;QACR,IAAI,OAAmB,CAAC;QACxB,IAAI,MAA8B,CAAC;QAEnC,MAAM,OAAO,GAAG,IAAI,OAAO,CAAO,CAAC,GAAG,EAAE,GAAG,EAAE,EAAE;YAC7C,OAAO,GAAG,GAAG,CAAC;YACd,MAAM,GAAG,GAAG,CAAC;QACf,CAAC,CAAC,CAAC;QAEH,MAAM,OAAO,GAAG,UAAU,CAAC,GAAG,EAAE;YAC9B,IAAI,CAAC,kBAAkB,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC;YACvC,IAAI,CAAC,YAAY,CAAC,UAAU,CAAC,MAAM,CAAC,CAAC;YACrC,MAAO,CAAC,IAAI,KAAK,CAAC,8BAA8B,MAAM,EAAE,CAAC,CAAC,CAAC;QAC7D,CAAC,EAAE,IAAI,CAAC,iBAAiB,CAAC,CAAC;QAE3B,IAAI,CAAC,kBAAkB,CAAC,GAAG,CAAC,MAAM,EAAE;YAClC,OAAO;YACP,OAAO,EAAE,OAAQ;YACjB,MAAM,EAAE,MAAO;YACf,OAAO;SACR,CAAC,CAAC;QAEH,OAAO;QACP,IAAI,CAAC;YACH,MAAM,IAAI,CAAC,YAAY,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC;QAC1C,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,YAAY,CAAC,OAAO,CAAC,CAAC;YACtB,IAAI,CAAC,kBAAkB,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC;YACvC,MAAM,KAAK,CAAC;QACd,CAAC;QAED,OAAO,OAAO,CAAC;IACjB,CAAC;IAEO,eAAe,CAAC,QAA4B,EAAE,GAAW;QAC/D,QAAQ;QACR,IAAI,IAAI,GAAuB,IAAI,CAAC;QACpC,IAAI,QAAQ,CAAC,IAAI,EAAE,CAAC;YAClB,oBAAoB;YACpB,IAAI,OAAO,MAAM,KAAK,WAAW,EAAE,CAAC;gBAClC,IAAI,GAAG,MAAM,CAAC,IAAI,CAAC,QAAQ,CAAC,IAAI,EAAE,QAAQ,CAAC,CAAC;YAC9C,CAAC;iBAAM,CAAC;gBACN,QAAQ;gBACR,MAAM,YAAY,GAAG,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC;gBACzC,MAAM,KAAK,GAAG,IAAI,UAAU,CAAC,YAAY,CAAC,MAAM,CAAC,CAAC;gBAClD,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,YAAY,CAAC,MAAM,EAAE,CAAC,EAAE,EAAE,CAAC;oBAC7C,KAAK,CAAC,CAAC,CAAC,GAAG,YAAY,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC;gBACxC,CAAC;gBACD,IAAI,GAAG,KAAK,CAAC,MAAM,CAAC;YACtB,CAAC;QACH,CAAC;QAED,iBAAiB;QACjB,MAAM,YAAY,GAAiB;YACjC,MAAM,EAAE,QAAQ,CAAC,MAAM;YACvB,UAAU,EAAE,QAAQ,CAAC,UAAU;YAC/B,OAAO,EAAE,IAAI,OAAO,CAAC,QAAQ,CAAC,OAAO,CAAC;SACvC,CAAC;QAEF,kDAAkD;QAClD,MAAM,aAAa,GAAG,IAAI,QAAQ,CAAC,IAAI,EAAE,YAAY,CAAC,CAAC;QAEvD,yCAAyC;QACzC,MAAM,CAAC,cAAc,CAAC,aAAa,EAAE,KAAK,EAAE;YAC1C,KAAK,EAAE,GAAG;YACV,QAAQ,EAAE,KAAK;SAChB,CAAC,CAAC;QAEH,OAAO,aAAa,CAAC;IACvB,CAAC;CACF;AAzQD,8BAyQC;AAED;;GAEG;AACH,SAAgB,eAAe,CAAC,OAAyB;IACvD,OAAO,IAAI,SAAS,CAAC,OAAO,CAAC,CAAC;AAChC,CAAC","sourcesContent":["/**\n * xpodFetch SDK\n *\n * 提供 fetch 兼容的 API，通过 WebRTC 连接 Local 节点\n * 可与 Inrupt Solid SDK 集成\n */\n\nimport type {\n  WebRTCConfig,\n  PeerConnectionFactory,\n  WebRTCHttpResponse,\n} from '../webrtc/types';\nimport { WebRTCClient, type ClientSignalingSender } from '../webrtc/WebRTCClient';\n\n/**\n * 信令连接器接口\n */\nexport interface SignalingConnector {\n  /**\n   * 连接到信令服务器\n   */\n  connect(): Promise<void>;\n\n  /**\n   * 断开信令连接\n   */\n  disconnect(): void;\n\n  /**\n   * 检查是否已连接\n   */\n  isConnected(): boolean;\n\n  /**\n   * 获取信令发送器\n   */\n  getSender(): ClientSignalingSender;\n\n  /**\n   * 设置 RTC answer 处理器\n   */\n  onAnswer(handler: (nodeId: string, sessionId: string, sdp: string) => void): void;\n\n  /**\n   * 设置 ICE candidate 处理器\n   */\n  onIceCandidate(\n    handler: (nodeId: string, sessionId: string, candidate: string, sdpMid?: string, sdpMLineIndex?: number) => void,\n  ): void;\n\n  /**\n   * 设置 RTC close 处理器\n   */\n  onClose(handler: (nodeId: string, reason?: string) => void): void;\n}\n\n/**\n * xpodFetch 配置\n */\nexport interface XpodFetchOptions {\n  /** 信令连接器 */\n  signalingConnector: SignalingConnector;\n  /** PeerConnection 工厂 */\n  peerConnectionFactory: PeerConnectionFactory;\n  /** WebRTC 配置 */\n  rtcConfig: WebRTCConfig;\n  /** 请求超时（毫秒） */\n  requestTimeout?: number;\n  /** 连接超时（毫秒） */\n  connectionTimeout?: number;\n  /** URL 到 nodeId 的映射函数 */\n  urlToNodeId: (url: string) => string | undefined;\n  /** 回退到普通 fetch（当无法使用 WebRTC 时） */\n  fallbackFetch?: typeof fetch;\n}\n\n/**\n * 待处理的连接请求\n */\ninterface PendingConnection {\n  promise: Promise<void>;\n  resolve: () => void;\n  reject: (error: Error) => void;\n  timeout: NodeJS.Timeout;\n}\n\n/**\n * xpodFetch 类\n *\n * 提供 fetch 兼容的 API，自动通过 WebRTC 连接 Local 节点\n */\nexport class XpodFetch {\n  private readonly signalingConnector: SignalingConnector;\n  private readonly webrtcClient: WebRTCClient;\n  private readonly urlToNodeId: (url: string) => string | undefined;\n  private readonly fallbackFetch?: typeof fetch;\n  private readonly connectionTimeout: number;\n\n  /** 待处理的连接 */\n  private readonly pendingConnections = new Map<string, PendingConnection>();\n\n  public constructor(options: XpodFetchOptions) {\n    this.signalingConnector = options.signalingConnector;\n    this.urlToNodeId = options.urlToNodeId;\n    this.fallbackFetch = options.fallbackFetch;\n    this.connectionTimeout = options.connectionTimeout ?? 30000;\n\n    this.webrtcClient = new WebRTCClient(\n      options.peerConnectionFactory,\n      options.signalingConnector.getSender(),\n      options.rtcConfig,\n      options.requestTimeout,\n    );\n\n    // 设置信令处理器\n    this.setupSignalingHandlers();\n  }\n\n  /**\n   * 初始化（连接信令服务器）\n   */\n  public async initialize(): Promise<void> {\n    if (!this.signalingConnector.isConnected()) {\n      await this.signalingConnector.connect();\n    }\n  }\n\n  /**\n   * 关闭连接\n   */\n  public close(): void {\n    this.webrtcClient.disconnectAll();\n    this.signalingConnector.disconnect();\n\n    // 取消所有待处理的连接\n    for (const [, pending] of this.pendingConnections) {\n      clearTimeout(pending.timeout);\n      pending.reject(new Error('XpodFetch closed'));\n    }\n    this.pendingConnections.clear();\n  }\n\n  /**\n   * 创建 fetch 函数\n   *\n   * 返回一个可以与 Inrupt SDK 集成的 fetch 函数\n   */\n  public createFetch(): typeof fetch {\n    return async (input: string | URL | Request, init?: RequestInit): Promise<Response> => {\n      const url = typeof input === 'string' ? input : input instanceof URL ? input.href : input.url;\n      const nodeId = this.urlToNodeId(url);\n\n      // 如果无法确定 nodeId，回退到普通 fetch\n      if (!nodeId) {\n        if (this.fallbackFetch) {\n          return this.fallbackFetch(input, init);\n        }\n        throw new Error(`Cannot determine nodeId for URL: ${url}`);\n      }\n\n      // 确保连接已建立\n      await this.ensureConnected(nodeId);\n\n      // 解析请求\n      const method = init?.method ?? 'GET';\n      const parsedUrl = new URL(url);\n      const path = parsedUrl.pathname + parsedUrl.search;\n\n      // 处理请求头\n      const headers: Record<string, string> = {};\n      if (init?.headers) {\n        if (init.headers instanceof Headers) {\n          init.headers.forEach((value, key) => {\n            headers[key] = value;\n          });\n        } else if (Array.isArray(init.headers)) {\n          for (const [key, value] of init.headers) {\n            headers[key] = value;\n          }\n        } else {\n          Object.assign(headers, init.headers);\n        }\n      }\n\n      // 处理请求体\n      let body: ArrayBuffer | string | undefined;\n      if (init?.body) {\n        if (typeof init.body === 'string') {\n          body = init.body;\n        } else if (init.body instanceof ArrayBuffer) {\n          body = init.body;\n        } else if (init.body instanceof Uint8Array) {\n          body = init.body.buffer as ArrayBuffer;\n        } else if (typeof Blob !== 'undefined' && init.body instanceof Blob) {\n          body = await init.body.arrayBuffer();\n        } else {\n          // 其他类型尝试转为字符串\n          body = String(init.body);\n        }\n      }\n\n      // 发送请求\n      const response = await this.webrtcClient.fetch(nodeId, method, path, headers, body);\n\n      // 转换为 Response\n      return this.toFetchResponse(response, url);\n    };\n  }\n\n  /**\n   * 获取 WebRTC 客户端\n   */\n  public getWebRTCClient(): WebRTCClient {\n    return this.webrtcClient;\n  }\n\n  /**\n   * 检查是否已连接到指定节点\n   */\n  public isConnectedToNode(nodeId: string): boolean {\n    return this.webrtcClient.isConnected(nodeId);\n  }\n\n  /**\n   * 手动连接到指定节点\n   */\n  public async connectToNode(nodeId: string): Promise<void> {\n    return this.ensureConnected(nodeId);\n  }\n\n  /**\n   * 断开与指定节点的连接\n   */\n  public disconnectFromNode(nodeId: string): void {\n    this.webrtcClient.disconnect(nodeId);\n  }\n\n  private setupSignalingHandlers(): void {\n    // 处理 RTC answer\n    this.signalingConnector.onAnswer((nodeId, sessionId, sdp) => {\n      this.webrtcClient.handleAnswer(nodeId, sessionId, sdp);\n    });\n\n    // 处理 ICE candidate\n    this.signalingConnector.onIceCandidate((nodeId, sessionId, candidate, sdpMid, sdpMLineIndex) => {\n      this.webrtcClient.handleIceCandidate(nodeId, sessionId, candidate, sdpMid, sdpMLineIndex);\n    });\n\n    // 处理连接关闭\n    this.signalingConnector.onClose((nodeId, reason) => {\n      this.webrtcClient.handleClose(nodeId, reason);\n    });\n\n    // 处理连接成功\n    this.webrtcClient.on('connected', (nodeId) => {\n      const pending = this.pendingConnections.get(nodeId);\n      if (pending) {\n        clearTimeout(pending.timeout);\n        pending.resolve();\n        this.pendingConnections.delete(nodeId);\n      }\n    });\n\n    // 处理连接失败\n    this.webrtcClient.on('disconnected', (nodeId, reason) => {\n      const pending = this.pendingConnections.get(nodeId);\n      if (pending) {\n        clearTimeout(pending.timeout);\n        pending.reject(new Error(`Connection failed: ${reason ?? 'unknown'}`));\n        this.pendingConnections.delete(nodeId);\n      }\n    });\n  }\n\n  private async ensureConnected(nodeId: string): Promise<void> {\n    // 已连接\n    if (this.webrtcClient.isConnected(nodeId)) {\n      return;\n    }\n\n    // 检查是否有待处理的连接\n    const pending = this.pendingConnections.get(nodeId);\n    if (pending) {\n      return pending.promise;\n    }\n\n    // 创建新连接\n    let resolve: () => void;\n    let reject: (error: Error) => void;\n\n    const promise = new Promise<void>((res, rej) => {\n      resolve = res;\n      reject = rej;\n    });\n\n    const timeout = setTimeout(() => {\n      this.pendingConnections.delete(nodeId);\n      this.webrtcClient.disconnect(nodeId);\n      reject!(new Error(`Connection timeout to node ${nodeId}`));\n    }, this.connectionTimeout);\n\n    this.pendingConnections.set(nodeId, {\n      promise,\n      resolve: resolve!,\n      reject: reject!,\n      timeout,\n    });\n\n    // 发起连接\n    try {\n      await this.webrtcClient.connect(nodeId);\n    } catch (error) {\n      clearTimeout(timeout);\n      this.pendingConnections.delete(nodeId);\n      throw error;\n    }\n\n    return promise;\n  }\n\n  private toFetchResponse(response: WebRTCHttpResponse, url: string): Response {\n    // 解码响应体\n    let body: ArrayBuffer | null = null;\n    if (response.body) {\n      // 处理 Node.js 和浏览器环境\n      if (typeof Buffer !== 'undefined') {\n        body = Buffer.from(response.body, 'base64');\n      } else {\n        // 浏览器环境\n        const binaryString = atob(response.body);\n        const bytes = new Uint8Array(binaryString.length);\n        for (let i = 0; i < binaryString.length; i++) {\n          bytes[i] = binaryString.charCodeAt(i);\n        }\n        body = bytes.buffer;\n      }\n    }\n\n    // 创建 Response 对象\n    const responseInit: ResponseInit = {\n      status: response.status,\n      statusText: response.statusText,\n      headers: new Headers(response.headers),\n    };\n\n    // 创建 Response（注意：Response 的 body 需要是 BodyInit 类型）\n    const fetchResponse = new Response(body, responseInit);\n\n    // 设置 url（只读属性，需要用 Object.defineProperty）\n    Object.defineProperty(fetchResponse, 'url', {\n      value: url,\n      writable: false,\n    });\n\n    return fetchResponse;\n  }\n}\n\n/**\n * 创建 xpodFetch 实例的便捷函数\n */\nexport function createXpodFetch(options: XpodFetchOptions): XpodFetch {\n  return new XpodFetch(options);\n}\n"]}

package/dist/service/EdgeNodeCertificateService.d.ts

@@ -0,0 +1,45 @@
+import { EdgeNodeRepository } from '../identity/drizzle/EdgeNodeRepository';
+import type { Dns01CertificateProvisioner } from '../edge/Dns01CertificateProvisioner';
+export interface EdgeNodeCertificateServiceOptions {
+    identityDbUrl?: string;
+    repository?: EdgeNodeRepository;
+    provisioner: Dns01CertificateProvisioner;
+    accountKeyPath: string;
+    certificateStorePath: string;
+    directoryUrl?: string;
+    email: string;
+    propagationDelayMs?: number;
+}
+export interface EdgeNodeCertificateRequest {
+    nodeId: string;
+    csr: string;
+    subdomain: string;
+}
+export interface EdgeNodeCertificateResponse {
+    certificate: string;
+    fullChain: string;
+    expiresAt: string;
+    domains: string[];
+}
+export declare class EdgeNodeCertificateService {
+    private readonly logger;
+    private readonly repository;
+    private readonly provisioner;
+    private readonly accountKeyPath;
+    private readonly certificateStorePath;
+    private readonly directoryUrl;
+    private readonly email;
+    private readonly propagationDelayMs;
+    private readonly pending;
+    constructor(options: EdgeNodeCertificateServiceOptions);
+    issueCertificate(request: EdgeNodeCertificateRequest): Promise<EdgeNodeCertificateResponse>;
+    private issueCertificateInternal;
+    private extractDomains;
+    private validateDomains;
+    private createClient;
+    private ensureAccount;
+    private loadOrCreateAccountKey;
+    private persistCertificate;
+    private readExpiration;
+    private delay;
+}

package/dist/service/EdgeNodeCertificateService.js

@@ -0,0 +1,164 @@
+"use strict";
+var __importDefault = (this && this.__importDefault) || function (mod) {
+    return (mod && mod.__esModule) ? mod : { "default": mod };
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.EdgeNodeCertificateService = void 0;
+const node_path_1 = __importDefault(require("node:path"));
+const node_fs_1 = require("node:fs");
+const node_crypto_1 = require("node:crypto");
+const acme_client_1 = __importDefault(require("acme-client"));
+const global_logger_factory_1 = require("global-logger-factory");
+const db_1 = require("../identity/drizzle/db");
+const EdgeNodeRepository_1 = require("../identity/drizzle/EdgeNodeRepository");
+const utils_1 = require("../edge/acme/utils");
+class EdgeNodeCertificateService {
+    constructor(options) {
+        this.logger = (0, global_logger_factory_1.getLoggerFor)(this);
+        this.pending = new Map();
+        let db;
+        if (!options.repository) {
+            if (!options.identityDbUrl) {
+                throw new Error('EdgeNodeCertificateService 需要 identityDbUrl 或 repository。');
+            }
+            db = (0, db_1.getIdentityDatabase)(options.identityDbUrl);
+        }
+        this.repository = options.repository ?? new EdgeNodeRepository_1.EdgeNodeRepository(db);
+        this.provisioner = options.provisioner;
+        this.accountKeyPath = options.accountKeyPath;
+        this.certificateStorePath = options.certificateStorePath;
+        this.directoryUrl = options.directoryUrl ?? acme_client_1.default.directory.letsencrypt.production;
+        this.email = options.email;
+        this.propagationDelayMs = options.propagationDelayMs ?? 15_000;
+    }
+    async issueCertificate(request) {
+        if (this.pending.has(request.nodeId)) {
+            return this.pending.get(request.nodeId);
+        }
+        const job = this.issueCertificateInternal(request)
+            .finally(() => {
+            this.pending.delete(request.nodeId);
+        });
+        this.pending.set(request.nodeId, job);
+        return job;
+    }
+    async issueCertificateInternal(request) {
+        const domains = this.extractDomains(request);
+        await this.validateDomains(domains, request.subdomain);
+        const client = await this.createClient();
+        await this.ensureAccount(client);
+        const certificate = await client.auto({
+            csr: request.csr,
+            email: this.email,
+            termsOfServiceAgreed: true,
+            challengePriority: ['dns-01'],
+            challengeCreateFn: async (authz, _challenge, keyAuthorization) => {
+                const recordName = `_acme-challenge.${authz.identifier.value}`;
+                const value = (0, utils_1.toDns01Value)(keyAuthorization);
+                await this.provisioner.publishChallenge(recordName, value, request.nodeId);
+                await this.delay(this.propagationDelayMs);
+            },
+            challengeRemoveFn: async (authz) => {
+                const recordName = `_acme-challenge.${authz.identifier.value}`;
+                await this.provisioner.removeChallenge(recordName, request.nodeId);
+            },
+        });
+        const [leaf, ...restChain] = acme_client_1.default.crypto.splitPemChain(certificate);
+        const leafCert = leaf ?? certificate;
+        const expiresAt = this.readExpiration(leafCert);
+        await this.persistCertificate(request.nodeId, certificate, leafCert);
+        await this.repository.mergeNodeMetadata(request.nodeId, {
+            certificate: {
+                issuedAt: new Date().toISOString(),
+                expiresAt,
+                domains,
+            },
+        });
+        return {
+            certificate: leafCert,
+            fullChain: certificate,
+            expiresAt,
+            domains,
+        };
+    }
+    extractDomains(request) {
+        try {
+            const info = acme_client_1.default.crypto.readCsrDomains(request.csr);
+            const set = new Set();
+            if (info.commonName) {
+                set.add(info.commonName.toLowerCase());
+            }
+            for (const alt of info.altNames ?? []) {
+                if (alt) {
+                    set.add(alt.toLowerCase());
+                }
+            }
+            return Array.from(set);
+        }
+        catch (error) {
+            throw new Error(`无法解析 CSR 域名: ${error.message}`);
+        }
+    }
+    async validateDomains(domains, expected) {
+        const normalizedExpected = expected.toLowerCase();
+        if (domains.length === 0) {
+            throw new Error('CSR 中未包含任何域名。');
+        }
+        if (domains.length !== 1 || domains[0] !== normalizedExpected) {
+            throw new Error(`CSR 域名必须与分配域名一致：${normalizedExpected}`);
+        }
+    }
+    async createClient() {
+        const accountKey = await this.loadOrCreateAccountKey();
+        return new acme_client_1.default.Client({
+            directoryUrl: this.directoryUrl,
+            accountKey,
+        });
+    }
+    async ensureAccount(client) {
+        try {
+            await client.createAccount({
+                termsOfServiceAgreed: true,
+                contact: [`mailto:${this.email}`],
+            });
+            this.logger.debug('ACME 账户已创建。');
+        }
+        catch (error) {
+            if (error && typeof error === 'object' && 'status' in error && error.status === 409) {
+                this.logger.debug('ACME 账户已存在，跳过创建。');
+            }
+            else {
+                throw error;
+            }
+        }
+    }
+    async loadOrCreateAccountKey() {
+        try {
+            return await node_fs_1.promises.readFile(this.accountKeyPath, 'utf8');
+        }
+        catch {
+            await node_fs_1.promises.mkdir(node_path_1.default.dirname(this.accountKeyPath), { recursive: true });
+            const key = await acme_client_1.default.crypto.createPrivateKey();
+            await node_fs_1.promises.writeFile(this.accountKeyPath, key.toString());
+            return key.toString();
+        }
+    }
+    async persistCertificate(nodeId, fullChain, leaf) {
+        const nodeDir = node_path_1.default.join(this.certificateStorePath, nodeId);
+        await node_fs_1.promises.mkdir(nodeDir, { recursive: true });
+        await node_fs_1.promises.writeFile(node_path_1.default.join(nodeDir, 'fullchain.pem'), fullChain, 'utf8');
+        await node_fs_1.promises.writeFile(node_path_1.default.join(nodeDir, 'cert.pem'), leaf, 'utf8');
+    }
+    readExpiration(pem) {
+        const cert = new node_crypto_1.X509Certificate(pem);
+        return cert.validTo ? new Date(cert.validTo).toISOString() : new Date(Date.now() + 90 * 24 * 60 * 60 * 1000).toISOString();
+    }
+    async delay(ms) {
+        if (ms <= 0) {
+            return;
+        }
+        await new Promise((resolve) => setTimeout(resolve, ms));
+    }
+}
+exports.EdgeNodeCertificateService = EdgeNodeCertificateService;
+//# sourceMappingURL=EdgeNodeCertificateService.js.map

package/dist/service/EdgeNodeCertificateService.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"EdgeNodeCertificateService.js","sourceRoot":"","sources":["../../src/service/EdgeNodeCertificateService.ts"],"names":[],"mappings":";;;;;;AAAA,0DAA6B;AAC7B,qCAAyC;AACzC,6CAA8C;AAC9C,8DAA+B;AAC/B,iEAAqD;AACrD,+CAA6D;AAC7D,+EAA4E;AAE5E,8CAAkD;AA0BlD,MAAa,0BAA0B;IAWrC,YAAmB,OAA0C;QAV5C,WAAM,GAAG,IAAA,oCAAY,EAAC,IAAI,CAAC,CAAC;QAQ5B,YAAO,GAAsD,IAAI,GAAG,EAAE,CAAC;QAGtF,IAAI,EAAE,CAAC;QACP,IAAI,CAAC,OAAO,CAAC,UAAU,EAAE,CAAC;YACxB,IAAI,CAAC,OAAO,CAAC,aAAa,EAAE,CAAC;gBAC3B,MAAM,IAAI,KAAK,CAAC,2DAA2D,CAAC,CAAC;YAC/E,CAAC;YACD,EAAE,GAAG,IAAA,wBAAmB,EAAC,OAAO,CAAC,aAAa,CAAC,CAAC;QAClD,CAAC;QAED,IAAI,CAAC,UAAU,GAAG,OAAO,CAAC,UAAU,IAAI,IAAI,uCAAkB,CAAC,EAAG,CAAC,CAAC;QACpE,IAAI,CAAC,WAAW,GAAG,OAAO,CAAC,WAAW,CAAC;QACvC,IAAI,CAAC,cAAc,GAAG,OAAO,CAAC,cAAc,CAAC;QAC7C,IAAI,CAAC,oBAAoB,GAAG,OAAO,CAAC,oBAAoB,CAAC;QACzD,IAAI,CAAC,YAAY,GAAG,OAAO,CAAC,YAAY,IAAI,qBAAI,CAAC,SAAS,CAAC,WAAW,CAAC,UAAU,CAAC;QAClF,IAAI,CAAC,KAAK,GAAG,OAAO,CAAC,KAAK,CAAC;QAC3B,IAAI,CAAC,kBAAkB,GAAG,OAAO,CAAC,kBAAkB,IAAI,MAAM,CAAC;IACjE,CAAC;IAEM,KAAK,CAAC,gBAAgB,CAAC,OAAmC;QAC/D,IAAI,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,OAAO,CAAC,MAAM,CAAC,EAAE,CAAC;YACrC,OAAO,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,OAAO,CAAC,MAAM,CAAE,CAAC;QAC3C,CAAC;QAED,MAAM,GAAG,GAAG,IAAI,CAAC,wBAAwB,CAAC,OAAO,CAAC;aAC/C,OAAO,CAAC,GAAG,EAAE;YACZ,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC;QACtC,CAAC,CAAC,CAAC;QAEL,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,OAAO,CAAC,MAAM,EAAE,GAAG,CAAC,CAAC;QACtC,OAAO,GAAG,CAAC;IACb,CAAC;IAEO,KAAK,CAAC,wBAAwB,CAAC,OAAmC;QACxE,MAAM,OAAO,GAAG,IAAI,CAAC,cAAc,CAAC,OAAO,CAAC,CAAC;QAC7C,MAAM,IAAI,CAAC,eAAe,CAAC,OAAO,EAAE,OAAO,CAAC,SAAS,CAAC,CAAC;QAEvD,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,YAAY,EAAE,CAAC;QACzC,MAAM,IAAI,CAAC,aAAa,CAAC,MAAM,CAAC,CAAC;QAEjC,MAAM,WAAW,GAAG,MAAM,MAAM,CAAC,IAAI,CAAC;YACpC,GAAG,EAAE,OAAO,CAAC,GAAG;YAChB,KAAK,EAAE,IAAI,CAAC,KAAK;YACjB,oBAAoB,EAAE,IAAI;YAC1B,iBAAiB,EAAE,CAAE,QAAQ,CAAE;YAC/B,iBAAiB,EAAE,KAAK,EAAE,KAAK,EAAE,UAAU,EAAE,gBAAgB,EAAE,EAAE;gBAC/D,MAAM,UAAU,GAAG,mBAAmB,KAAK,CAAC,UAAU,CAAC,KAAK,EAAE,CAAC;gBAC/D,MAAM,KAAK,GAAG,IAAA,oBAAY,EAAC,gBAAgB,CAAC,CAAC;gBAC7C,MAAM,IAAI,CAAC,WAAW,CAAC,gBAAgB,CAAC,UAAU,EAAE,KAAK,EAAE,OAAO,CAAC,MAAM,CAAC,CAAC;gBAC3E,MAAM,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,kBAAkB,CAAC,CAAC;YAC5C,CAAC;YACD,iBAAiB,EAAE,KAAK,EAAE,KAAK,EAAE,EAAE;gBACjC,MAAM,UAAU,GAAG,mBAAmB,KAAK,CAAC,UAAU,CAAC,KAAK,EAAE,CAAC;gBAC/D,MAAM,IAAI,CAAC,WAAW,CAAC,eAAe,CAAC,UAAU,EAAE,OAAO,CAAC,MAAM,CAAC,CAAC;YACrE,CAAC;SACF,CAAC,CAAC;QAEH,MAAM,CAAE,IAAI,EAAE,GAAG,SAAS,CAAE,GAAG,qBAAI,CAAC,MAAM,CAAC,aAAa,CAAC,WAAW,CAAC,CAAC;QACtE,MAAM,QAAQ,GAAG,IAAI,IAAI,WAAW,CAAC;QACrC,MAAM,SAAS,GAAG,IAAI,CAAC,cAAc,CAAC,QAAQ,CAAC,CAAC;QAChD,MAAM,IAAI,CAAC,kBAAkB,CAAC,OAAO,CAAC,MAAM,EAAE,WAAW,EAAE,QAAQ,CAAC,CAAC;QAErE,MAAM,IAAI,CAAC,UAAU,CAAC,iBAAiB,CAAC,OAAO,CAAC,MAAM,EAAE;YACtD,WAAW,EAAE;gBACX,QAAQ,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE;gBAClC,SAAS;gBACT,OAAO;aACR;SACF,CAAC,CAAC;QAEH,OAAO;YACL,WAAW,EAAE,QAAQ;YACrB,SAAS,EAAE,WAAW;YACtB,SAAS;YACT,OAAO;SACR,CAAC;IACJ,CAAC;IAEO,cAAc,CAAC,OAAmC;QACxD,IAAI,CAAC;YACH,MAAM,IAAI,GAAG,qBAAI,CAAC,MAAM,CAAC,cAAc,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;YACrD,MAAM,GAAG,GAAG,IAAI,GAAG,EAAU,CAAC;YAC9B,IAAI,IAAI,CAAC,UAAU,EAAE,CAAC;gBACpB,GAAG,CAAC,GAAG,CAAC,IAAI,CAAC,UAAU,CAAC,WAAW,EAAE,CAAC,CAAC;YACzC,CAAC;YACD,KAAK,MAAM,GAAG,IAAI,IAAI,CAAC,QAAQ,IAAI,EAAE,EAAE,CAAC;gBACtC,IAAI,GAAG,EAAE,CAAC;oBACR,GAAG,CAAC,GAAG,CAAC,GAAG,CAAC,WAAW,EAAE,CAAC,CAAC;gBAC7B,CAAC;YACH,CAAC;YACD,OAAO,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;QACzB,CAAC;QAAC,OAAO,KAAc,EAAE,CAAC;YACxB,MAAM,IAAI,KAAK,CAAC,gBAAiB,KAAe,CAAC,OAAO,EAAE,CAAC,CAAC;QAC9D,CAAC;IACH,CAAC;IAEO,KAAK,CAAC,eAAe,CAAC,OAAiB,EAAE,QAAgB;QAC/D,MAAM,kBAAkB,GAAG,QAAQ,CAAC,WAAW,EAAE,CAAC;QAClD,IAAI,OAAO,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YACzB,MAAM,IAAI,KAAK,CAAC,eAAe,CAAC,CAAC;QACnC,CAAC;QACD,IAAI,OAAO,CAAC,MAAM,KAAK,CAAC,IAAI,OAAO,CAAC,CAAC,CAAC,KAAK,kBAAkB,EAAE,CAAC;YAC9D,MAAM,IAAI,KAAK,CAAC,mBAAmB,kBAAkB,EAAE,CAAC,CAAC;QAC3D,CAAC;IACH,CAAC;IAEO,KAAK,CAAC,YAAY;QACxB,MAAM,UAAU,GAAG,MAAM,IAAI,CAAC,sBAAsB,EAAE,CAAC;QACvD,OAAO,IAAI,qBAAI,CAAC,MAAM,CAAC;YACrB,YAAY,EAAE,IAAI,CAAC,YAAY;YAC/B,UAAU;SACX,CAAC,CAAC;IACL,CAAC;IAEO,KAAK,CAAC,aAAa,CAAC,MAAmB;QAC7C,IAAI,CAAC;YACH,MAAM,MAAM,CAAC,aAAa,CAAC;gBACzB,oBAAoB,EAAE,IAAI;gBAC1B,OAAO,EAAE,CAAE,UAAU,IAAI,CAAC,KAAK,EAAE,CAAE;aACpC,CAAC,CAAC;YACH,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,aAAa,CAAC,CAAC;QACnC,CAAC;QAAC,OAAO,KAAc,EAAE,CAAC;YACxB,IAAI,KAAK,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,QAAQ,IAAI,KAAK,IAAK,KAAa,CAAC,MAAM,KAAK,GAAG,EAAE,CAAC;gBAC7F,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,kBAAkB,CAAC,CAAC;YACxC,CAAC;iBAAM,CAAC;gBACN,MAAM,KAAK,CAAC;YACd,CAAC;QACH,CAAC;IACH,CAAC;IAEO,KAAK,CAAC,sBAAsB;QAClC,IAAI,CAAC;YACH,OAAO,MAAM,kBAAE,CAAC,QAAQ,CAAC,IAAI,CAAC,cAAc,EAAE,MAAM,CAAC,CAAC;QACxD,CAAC;QAAC,MAAM,CAAC;YACP,MAAM,kBAAE,CAAC,KAAK,CAAC,mBAAI,CAAC,OAAO,CAAC,IAAI,CAAC,cAAc,CAAC,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;YACvE,MAAM,GAAG,GAAG,MAAM,qBAAI,CAAC,MAAM,CAAC,gBAAgB,EAAE,CAAC;YACjD,MAAM,kBAAE,CAAC,SAAS,CAAC,IAAI,CAAC,cAAc,EAAE,GAAG,CAAC,QAAQ,EAAE,CAAC,CAAC;YACxD,OAAO,GAAG,CAAC,QAAQ,EAAE,CAAC;QACxB,CAAC;IACH,CAAC;IAEO,KAAK,CAAC,kBAAkB,CAAC,MAAc,EAAE,SAAiB,EAAE,IAAY;QAC9E,MAAM,OAAO,GAAG,mBAAI,CAAC,IAAI,CAAC,IAAI,CAAC,oBAAoB,EAAE,MAAM,CAAC,CAAC;QAC7D,MAAM,kBAAE,CAAC,KAAK,CAAC,OAAO,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;QAC7C,MAAM,kBAAE,CAAC,SAAS,CAAC,mBAAI,CAAC,IAAI,CAAC,OAAO,EAAE,eAAe,CAAC,EAAE,SAAS,EAAE,MAAM,CAAC,CAAC;QAC3E,MAAM,kBAAE,CAAC,SAAS,CAAC,mBAAI,CAAC,IAAI,CAAC,OAAO,EAAE,UAAU,CAAC,EAAE,IAAI,EAAE,MAAM,CAAC,CAAC;IACnE,CAAC;IAEO,cAAc,CAAC,GAAW;QAChC,MAAM,IAAI,GAAG,IAAI,6BAAe,CAAC,GAAG,CAAC,CAAC;QACtC,OAAO,IAAI,CAAC,OAAO,CAAC,CAAC,CAAC,IAAI,IAAI,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC,WAAW,EAAE,CAAC,CAAC,CAAC,IAAI,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,IAAI,CAAC,CAAC,WAAW,EAAE,CAAC;IAC7H,CAAC;IAEO,KAAK,CAAC,KAAK,CAAC,EAAU;QAC5B,IAAI,EAAE,IAAI,CAAC,EAAE,CAAC;YACZ,OAAO;QACT,CAAC;QACD,MAAM,IAAI,OAAO,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC,UAAU,CAAC,OAAO,EAAE,EAAE,CAAC,CAAC,CAAC;IAC1D,CAAC;CACF;AAzKD,gEAyKC","sourcesContent":["import path from 'node:path';\nimport { promises as fs } from 'node:fs';\nimport { X509Certificate } from 'node:crypto';\nimport acme from 'acme-client';\nimport { getLoggerFor } from 'global-logger-factory';\nimport { getIdentityDatabase } from '../identity/drizzle/db';\nimport { EdgeNodeRepository } from '../identity/drizzle/EdgeNodeRepository';\nimport type { Dns01CertificateProvisioner } from '../edge/Dns01CertificateProvisioner';\nimport { toDns01Value } from '../edge/acme/utils';\n\nexport interface EdgeNodeCertificateServiceOptions {\n  identityDbUrl?: string;\n  repository?: EdgeNodeRepository;\n  provisioner: Dns01CertificateProvisioner;\n  accountKeyPath: string;\n  certificateStorePath: string;\n  directoryUrl?: string;\n  email: string;\n  propagationDelayMs?: number;\n}\n\nexport interface EdgeNodeCertificateRequest {\n  nodeId: string;\n  csr: string;\n  subdomain: string;\n}\n\nexport interface EdgeNodeCertificateResponse {\n  certificate: string;\n  fullChain: string;\n  expiresAt: string;\n  domains: string[];\n}\n\nexport class EdgeNodeCertificateService {\n  private readonly logger = getLoggerFor(this);\n  private readonly repository: EdgeNodeRepository;\n  private readonly provisioner: Dns01CertificateProvisioner;\n  private readonly accountKeyPath: string;\n  private readonly certificateStorePath: string;\n  private readonly directoryUrl: string;\n  private readonly email: string;\n  private readonly propagationDelayMs: number;\n  private readonly pending: Map<string, Promise<EdgeNodeCertificateResponse>> = new Map();\n\n  public constructor(options: EdgeNodeCertificateServiceOptions) {\n    let db;\n    if (!options.repository) {\n      if (!options.identityDbUrl) {\n        throw new Error('EdgeNodeCertificateService 需要 identityDbUrl 或 repository。');\n      }\n      db = getIdentityDatabase(options.identityDbUrl);\n    }\n\n    this.repository = options.repository ?? new EdgeNodeRepository(db!);\n    this.provisioner = options.provisioner;\n    this.accountKeyPath = options.accountKeyPath;\n    this.certificateStorePath = options.certificateStorePath;\n    this.directoryUrl = options.directoryUrl ?? acme.directory.letsencrypt.production;\n    this.email = options.email;\n    this.propagationDelayMs = options.propagationDelayMs ?? 15_000;\n  }\n\n  public async issueCertificate(request: EdgeNodeCertificateRequest): Promise<EdgeNodeCertificateResponse> {\n    if (this.pending.has(request.nodeId)) {\n      return this.pending.get(request.nodeId)!;\n    }\n\n    const job = this.issueCertificateInternal(request)\n      .finally(() => {\n        this.pending.delete(request.nodeId);\n      });\n\n    this.pending.set(request.nodeId, job);\n    return job;\n  }\n\n  private async issueCertificateInternal(request: EdgeNodeCertificateRequest): Promise<EdgeNodeCertificateResponse> {\n    const domains = this.extractDomains(request);\n    await this.validateDomains(domains, request.subdomain);\n\n    const client = await this.createClient();\n    await this.ensureAccount(client);\n\n    const certificate = await client.auto({\n      csr: request.csr,\n      email: this.email,\n      termsOfServiceAgreed: true,\n      challengePriority: [ 'dns-01' ],\n      challengeCreateFn: async (authz, _challenge, keyAuthorization) => {\n        const recordName = `_acme-challenge.${authz.identifier.value}`;\n        const value = toDns01Value(keyAuthorization);\n        await this.provisioner.publishChallenge(recordName, value, request.nodeId);\n        await this.delay(this.propagationDelayMs);\n      },\n      challengeRemoveFn: async (authz) => {\n        const recordName = `_acme-challenge.${authz.identifier.value}`;\n        await this.provisioner.removeChallenge(recordName, request.nodeId);\n      },\n    });\n\n    const [ leaf, ...restChain ] = acme.crypto.splitPemChain(certificate);\n    const leafCert = leaf ?? certificate;\n    const expiresAt = this.readExpiration(leafCert);\n    await this.persistCertificate(request.nodeId, certificate, leafCert);\n\n    await this.repository.mergeNodeMetadata(request.nodeId, {\n      certificate: {\n        issuedAt: new Date().toISOString(),\n        expiresAt,\n        domains,\n      },\n    });\n\n    return {\n      certificate: leafCert,\n      fullChain: certificate,\n      expiresAt,\n      domains,\n    };\n  }\n\n  private extractDomains(request: EdgeNodeCertificateRequest): string[] {\n    try {\n      const info = acme.crypto.readCsrDomains(request.csr);\n      const set = new Set<string>();\n      if (info.commonName) {\n        set.add(info.commonName.toLowerCase());\n      }\n      for (const alt of info.altNames ?? []) {\n        if (alt) {\n          set.add(alt.toLowerCase());\n        }\n      }\n      return Array.from(set);\n    } catch (error: unknown) {\n      throw new Error(`无法解析 CSR 域名: ${(error as Error).message}`);\n    }\n  }\n\n  private async validateDomains(domains: string[], expected: string): Promise<void> {\n    const normalizedExpected = expected.toLowerCase();\n    if (domains.length === 0) {\n      throw new Error('CSR 中未包含任何域名。');\n    }\n    if (domains.length !== 1 || domains[0] !== normalizedExpected) {\n      throw new Error(`CSR 域名必须与分配域名一致：${normalizedExpected}`);\n    }\n  }\n\n  private async createClient(): Promise<acme.Client> {\n    const accountKey = await this.loadOrCreateAccountKey();\n    return new acme.Client({\n      directoryUrl: this.directoryUrl,\n      accountKey,\n    });\n  }\n\n  private async ensureAccount(client: acme.Client): Promise<void> {\n    try {\n      await client.createAccount({\n        termsOfServiceAgreed: true,\n        contact: [ `mailto:${this.email}` ],\n      });\n      this.logger.debug('ACME 账户已创建。');\n    } catch (error: unknown) {\n      if (error && typeof error === 'object' && 'status' in error && (error as any).status === 409) {\n        this.logger.debug('ACME 账户已存在，跳过创建。');\n      } else {\n        throw error;\n      }\n    }\n  }\n\n  private async loadOrCreateAccountKey(): Promise<string> {\n    try {\n      return await fs.readFile(this.accountKeyPath, 'utf8');\n    } catch {\n      await fs.mkdir(path.dirname(this.accountKeyPath), { recursive: true });\n      const key = await acme.crypto.createPrivateKey();\n      await fs.writeFile(this.accountKeyPath, key.toString());\n      return key.toString();\n    }\n  }\n\n  private async persistCertificate(nodeId: string, fullChain: string, leaf: string): Promise<void> {\n    const nodeDir = path.join(this.certificateStorePath, nodeId);\n    await fs.mkdir(nodeDir, { recursive: true });\n    await fs.writeFile(path.join(nodeDir, 'fullchain.pem'), fullChain, 'utf8');\n    await fs.writeFile(path.join(nodeDir, 'cert.pem'), leaf, 'utf8');\n  }\n\n  private readExpiration(pem: string): string {\n    const cert = new X509Certificate(pem);\n    return cert.validTo ? new Date(cert.validTo).toISOString() : new Date(Date.now() + 90 * 24 * 60 * 60 * 1000).toISOString();\n  }\n\n  private async delay(ms: number): Promise<void> {\n    if (ms <= 0) {\n      return;\n    }\n    await new Promise((resolve) => setTimeout(resolve, ms));\n  }\n}\n"]}