npm - @undefineds.co/xpod - Versions diffs - 0.3.57 → 0.3.61 - Mend

@undefineds.co/xpod 0.3.57 → 0.3.61

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.

Files changed (779) hide show

package/dist/edge/acme/AcmeCertificateManager.js.map CHANGED Viewed

	@@ -1 +1 @@
1	- {"version":3,"file":"AcmeCertificateManager.js","sourceRoot":"","sources":["../../../src/edge/acme/AcmeCertificateManager.ts"],"names":[],"mappings":";;;;;;AAAA,qCAAyC;AACzC,yCAAoC;AACpC,+CAAyC;AACzC,6CAA8C;AAC9C,8DAA+B;AAE/B,iEAAqD;AACrD,6DAA0D;AAC1D,mCAAuC;AAWvC;;GAEG;AACH,MAAa,wBAAwB;IAInC,YAAmB,QAAqB,EAAE,UAAkB;QAC1D,IAAI,CAAC,QAAQ,GAAG,QAAQ,CAAC;QACzB,IAAI,CAAC,UAAU,GAAG,UAAU,CAAC;IAC/B,CAAC;IAEM,KAAK,CAAC,YAAY,CAAC,IAAY,EAAE,KAAa;QACnD,oDAAoD;QACpD,6CAA6C;QAC7C,MAAM,SAAS,GAAG,IAAI,CAAC,gBAAgB,CAAC,IAAI,CAAC,CAAC;QAC9C,MAAM,IAAI,CAAC,QAAQ,CAAC,YAAY,CAAC;YAC/B,MAAM,EAAE,IAAI,CAAC,UAAU;YACvB,SAAS;YACT,IAAI,EAAE,KAAK;YACX,KAAK;YACL,GAAG,EAAE,EAAE;SACR,CAAC,CAAC;IACL,CAAC;IAEM,KAAK,CAAC,eAAe,CAAC,IAAY,EAAE,KAAc;QACvD,MAAM,SAAS,GAAG,IAAI,CAAC,gBAAgB,CAAC,IAAI,CAAC,CAAC;QAC9C,MAAM,IAAI,CAAC,QAAQ,CAAC,YAAY,CAAC;YAC/B,MAAM,EAAE,IAAI,CAAC,UAAU;YACvB,SAAS;YACT,IAAI,EAAE,KAAK;YACX,KAAK;SACN,CAAC,CAAC;IACL,CAAC;IAEO,gBAAgB,CAAC,IAAY;QACnC,2EAA2E;QAC3E,MAAM,MAAM,GAAG,IAAI,IAAI,CAAC,UAAU,EAAE,CAAC;QACrC,IAAI,IAAI,CAAC,QAAQ,CAAC,MAAM,CAAC,EAAE,CAAC;YAC1B,OAAO,IAAI,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC;QACvC,CAAC;QACD,OAAO,IAAI,CAAC;IACd,CAAC;CACF;AAxCD,4DAwCC;AA2BD,MAAM,qBAAqB,GAAG,qBAAI,CAAC,SAAS,CAAC,WAAW,CAAC,UAAU,CAAC;AACpE,MAAM,qBAAqB,GAAG;IAC5B,qBAAI,CAAC,SAAS,CAAC,WAAW,CAAC,OAAO,EAAE,kCAAkC;IACtE,kCAAkC,EAAE,4BAA4B;CACjE,CAAC;AAEF,MAAa,sBAAsB;IAcjC,YAAmB,OAAsC;QAbxC,WAAM,GAAG,IAAA,oCAAY,EAAC,IAAI,CAAC,CAAC;QAc3C,eAAe;QACf,IAAI,OAAO,CAAC,mBAAmB,EAAE,CAAC;YAChC,aAAa;YACb,IAAI,CAAC,UAAU,GAAG,OAAO,CAAC,mBAAmB,CAAC;QAChD,CAAC;aAAM,IAAI,OAAO,CAAC,WAAW,IAAI,OAAO,CAAC,UAAU,EAAE,CAAC;YACrD,2BAA2B;YAC3B,IAAI,CAAC,UAAU,GAAG,IAAI,wBAAwB,CAAC,OAAO,CAAC,WAAW,EAAE,OAAO,CAAC,UAAU,CAAC,CAAC;QAC1F,CAAC;aAAM,IAAI,OAAO,CAAC,cAAc,IAAI,OAAO,CAAC,MAAM,IAAI,OAAO,CAAC,SAAS,EAAE,CAAC;YACzE,8BAA8B;YAC9B,IAAI,CAAC,UAAU,GAAG,IAAI,uCAAkB,CAAC;gBACvC,cAAc,EAAE,OAAO,CAAC,cAAc;gBACtC,MAAM,EAAE,OAAO,CAAC,MAAM;gBACtB,SAAS,EAAE,OAAO,CAAC,SAAS;aAC7B,CAAC,CAAC;QACL,CAAC;aAAM,CAAC;YACN,MAAM,IAAI,KAAK,CAAC,gIAAgI,CAAC,CAAC;QACpJ,CAAC;QAED,IAAI,CAAC,KAAK,GAAG,OAAO,CAAC,KAAK,CAAC;QAC3B,IAAI,CAAC,OAAO,GAAG,OAAO,CAAC,OAAO,CAAC;QAC/B,IAAI,CAAC,YAAY,GAAG,OAAO,CAAC,YAAY,IAAI,qBAAqB,CAAC;QAClE,IAAI,CAAC,qBAAqB,GAAG,OAAO,CAAC,qBAAqB,IAAI,qBAAqB,CAAC;QACpF,IAAI,CAAC,cAAc,GAAG,OAAO,CAAC,cAAc,CAAC;QAC7C,IAAI,CAAC,kBAAkB,GAAG,OAAO,CAAC,kBAAkB,CAAC;QACrD,IAAI,CAAC,eAAe,GAAG,OAAO,CAAC,eAAe,CAAC;QAC/C,IAAI,CAAC,aAAa,GAAG,OAAO,CAAC,aAAa,CAAC;QAC3C,IAAI,CAAC,eAAe,GAAG,OAAO,CAAC,eAAe,IAAI,EAAE,CAAC;QACrD,IAAI,CAAC,kBAAkB,GAAG,OAAO,CAAC,kBAAkB,IAAI,MAAM,CAAC;IACjE,CAAC;IAEM,KAAK,CAAC,iBAAiB;QAC5B,IAAI,MAAM,IAAI,CAAC,kBAAkB,EAAE,EAAE,CAAC;YACpC,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,wBAAwB,CAAC,CAAC;YAC5C,OAAO,KAAK,CAAC;QACf,CAAC;QACD,MAAM,IAAI,CAAC,gBAAgB,EAAE,CAAC;QAC9B,OAAO,IAAI,CAAC;IACd,CAAC;IAEO,KAAK,CAAC,kBAAkB;QAC9B,IAAI,CAAC;YACH,MAAM,OAAO,GAAG,MAAM,kBAAE,CAAC,QAAQ,CAAC,IAAI,CAAC,eAAe,EAAE,MAAM,CAAC,CAAC;YAChE,MAAM,IAAI,GAAG,IAAI,6BAAe,CAAC,OAAO,CAAC,CAAC;YAC1C,MAAM,SAAS,GAAG,IAAI,CAAC,OAAO,CAAC,CAAC,CAAC,IAAI,IAAI,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC,OAAO,EAAE,CAAC,CAAC,CAAC,GAAG,CAAC;YACxE,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,SAAS,CAAC,EAAE,CAAC;gBAChC,OAAO,KAAK,CAAC;YACf,CAAC;YACD,MAAM,WAAW,GAAG,SAAS,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;YAC3C,MAAM,WAAW,GAAG,IAAI,CAAC,eAAe,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,IAAI,CAAC;YAC/D,MAAM,kBAAkB,GAAG,IAAI,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,IAAI,CAAC,cAAc,EAAE,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC;YACjG,OAAO,WAAW,GAAG,WAAW,IAAI,kBAAkB,CAAC;QACzD,CAAC;QAAC,MAAM,CAAC;YACP,OAAO,KAAK,CAAC;QACf,CAAC;IACH,CAAC;IAEO,KAAK,CAAC,gBAAgB;QAC5B,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,cAAc,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;QAC1D,MAAM,IAAI,CAAC,eAAe,CAAC,IAAA,mBAAO,EAAC,IAAI,CAAC,cAAc,CAAC,CAAC,CAAC;QACzD,MAAM,IAAI,CAAC,eAAe,CAAC,IAAA,mBAAO,EAAC,IAAI,CAAC,kBAAkB,CAAC,CAAC,CAAC;QAC7D,MAAM,IAAI,CAAC,eAAe,CAAC,IAAA,mBAAO,EAAC,IAAI,CAAC,eAAe,CAAC,CAAC,CAAC;QAC1D,IAAI,IAAI,CAAC,aAAa,EAAE,CAAC;YACvB,MAAM,IAAI,CAAC,eAAe,CAAC,IAAA,mBAAO,EAAC,IAAI,CAAC,aAAa,CAAC,CAAC,CAAC;QAC1D,CAAC;QAED,0CAA0C;QAC1C,MAAM,aAAa,GAAG,CAAC,IAAI,CAAC,YAAY,EAAE,GAAG,IAAI,CAAC,qBAAqB,CAAC,CAAC;QACzE,IAAI,SAA4B,CAAC;QAEjC,KAAK,MAAM,YAAY,IAAI,aAAa,EAAE,CAAC;YACzC,IAAI,CAAC;gBACH,MAAM,IAAI,CAAC,sBAAsB,CAAC,YAAY,CAAC,CAAC;gBAChD,OAAO,CAAC,WAAW;YACrB,CAAC;YAAC,OAAO,KAAc,EAAE,CAAC;gBACxB,SAAS,GAAG,KAAc,CAAC;gBAC3B,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,WAAW,YAAY,QAAQ,SAAS,CAAC,OAAO,EAAE,CAAC,CAAC;gBACrE,IAAI,YAAY,KAAK,aAAa,CAAC,aAAa,CAAC,MAAM,GAAG,CAAC,CAAC,EAAE,CAAC;oBAC7D,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,kBAAkB,CAAC,CAAC;gBACvC,CAAC;YACH,CAAC;QACH,CAAC;QAED,iBAAiB;QACjB,MAAM,IAAI,KAAK,CAAC,wBAAwB,SAAS,EAAE,OAAO,EAAE,CAAC,CAAC;IAChE,CAAC;IAEO,KAAK,CAAC,sBAAsB,CAAC,YAAoB;QACvD,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,eAAe,YAAY,EAAE,CAAC,CAAC;QAEhD,MAAM,UAAU,GAAG,MAAM,IAAI,CAAC,sBAAsB,CAAC,IAAI,CAAC,cAAc,CAAC,CAAC;QAC1E,MAAM,MAAM,GAAG,IAAI,qBAAI,CAAC,MAAM,CAAC;YAC7B,YAAY;YACZ,UAAU;SACX,CAAC,CAAC;QAEH,MAAM,IAAI,CAAC,aAAa,CAAC,MAAM,CAAC,CAAC;QAEjC,MAAM,eAAe,GAAG,MAAM,IAAI,CAAC,gBAAgB,CAAC,IAAI,CAAC,kBAAkB,CAAC,CAAC;QAC7E,MAAM,CAAE,UAAU,EAAE,GAAG,CAAE,GAAG,MAAM,qBAAI,CAAC,MAAM,CAAC,SAAS,CAAC;YACtD,QAAQ,EAAE,IAAI,CAAC,OAAO;YACtB,UAAU,EAAE,IAAI,CAAC,OAAO,CAAC,CAAC,CAAC;SAC5B,EAAE,eAAe,IAAI,SAAS,CAAC,CAAC;QAEjC,MAAM,WAAW,GAAG,MAAM,MAAM,CAAC,IAAI,CAAC;YACpC,GAAG;YACH,KAAK,EAAE,IAAI,CAAC,KAAK;YACjB,oBAAoB,EAAE,IAAI;YAC1B,iBAAiB,EAAE,CAAE,QAAQ,CAAE;YAC/B,iBAAiB,EAAE,KAAK,EAAE,KAAoB,EAAE,UAAmB,EAAE,gBAAwB,EAAiB,EAAE;gBAC9G,MAAM,UAAU,GAAG,mBAAmB,KAAK,CAAC,UAAU,CAAC,KAAK,EAAE,CAAC;gBAC/D,MAAM,KAAK,GAAG,IAAA,oBAAY,EAAC,gBAAgB,CAAC,CAAC;gBAC7C,MAAM,IAAI,CAAC,UAAU,CAAC,YAAY,CAAC,UAAU,EAAE,KAAK,CAAC,CAAC;gBACtD,MAAM,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,kBAAkB,CAAC,CAAC;YAC5C,CAAC;YACD,iBAAiB,EAAE,KAAK,EAAE,KAAoB,EAAiB,EAAE;gBAC/D,MAAM,UAAU,GAAG,mBAAmB,KAAK,CAAC,UAAU,CAAC,KAAK,EAAE,CAAC;gBAC/D,MAAM,IAAI,CAAC,UAAU,CAAC,eAAe,CAAC,UAAU,CAAC,CAAC;YACpD,CAAC;SACF,CAAC,CAAC;QAEH,MAAM,kBAAE,CAAC,SAAS,CAAC,IAAI,CAAC,kBAAkB,EAAE,UAAU,CAAC,QAAQ,EAAE,CAAC,CAAC;QACnE,MAAM,kBAAE,CAAC,SAAS,CAAC,IAAI,CAAC,eAAe,EAAE,WAAW,CAAC,CAAC;QACtD,IAAI,IAAI,CAAC,aAAa,EAAE,CAAC;YACvB,MAAM,kBAAE,CAAC,SAAS,CAAC,IAAI,CAAC,aAAa,EAAE,WAAW,CAAC,CAAC;QACtD,CAAC;QACD,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,oBAAoB,YAAY,GAAG,CAAC,CAAC;IACxD,CAAC;IAEO,KAAK,CAAC,aAAa,CAAC,MAAmB;QAC7C,IAAI,CAAC;YACH,MAAM,MAAM,CAAC,aAAa,CAAC;gBACzB,oBAAoB,EAAE,IAAI;gBAC1B,OAAO,EAAE,CAAE,UAAU,IAAI,CAAC,KAAK,EAAE,CAAE;aACpC,CAAC,CAAC;YACH,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,aAAa,CAAC,CAAC;QACnC,CAAC;QAAC,OAAO,KAAc,EAAE,CAAC;YACxB,IAAI,IAAI,CAAC,eAAe,CAAC,KAAK,CAAC,EAAE,CAAC;gBAChC,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,kBAAkB,CAAC,CAAC;YACxC,CAAC;iBAAM,CAAC;gBACN,MAAM,KAAK,CAAC;YACd,CAAC;QACH,CAAC;IACH,CAAC;IAEO,KAAK,CAAC,sBAAsB,CAAC,IAAY;QAC/C,MAAM,QAAQ,GAAG,MAAM,IAAI,CAAC,gBAAgB,CAAC,IAAI,CAAC,CAAC;QACnD,IAAI,QAAQ,EAAE,CAAC;YACb,OAAO,QAAQ,CAAC,QAAQ,EAAE,CAAC;QAC7B,CAAC;QACD,MAAM,IAAI,CAAC,eAAe,CAAC,IAAA,mBAAO,EAAC,IAAI,CAAC,CAAC,CAAC;QAC1C,MAAM,GAAG,GAAG,MAAM,qBAAI,CAAC,MAAM,CAAC,gBAAgB,EAAE,CAAC;QACjD,MAAM,kBAAE,CAAC,SAAS,CAAC,IAAI,EAAE,GAAG,CAAC,CAAC;QAC9B,OAAO,GAAG,CAAC,QAAQ,EAAE,CAAC;IACxB,CAAC;IAEO,KAAK,CAAC,gBAAgB,CAAC,IAAY;QACzC,IAAI,CAAC;YACH,OAAO,MAAM,kBAAE,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC;QACjC,CAAC;QAAC,MAAM,CAAC;YACP,OAAO,SAAS,CAAC;QACnB,CAAC;IACH,CAAC;IAEO,KAAK,CAAC,eAAe,CAAC,IAAY;QACxC,IAAI,CAAC,IAAI,IAAI,IAAI,KAAK,GAAG,EAAE,CAAC;YAC1B,OAAO;QACT,CAAC;QACD,MAAM,IAAA,gBAAK,EAAC,IAAI,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;IACzC,CAAC;IAEO,KAAK,CAAC,KAAK,CAAC,EAAU;QAC5B,IAAI,EAAE,IAAI,CAAC,EAAE,CAAC;YACZ,OAAO;QACT,CAAC;QACD,MAAM,IAAI,OAAO,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC,UAAU,CAAC,OAAO,EAAE,EAAE,CAAC,CAAC,CAAC;IAC1D,CAAC;IAEO,eAAe,CAAC,KAAc;QACpC,OAAO,OAAO,CAAC,KAAK,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,QAAQ,IAAI,KAAK,IAAK,KAAa,CAAC,MAAM,KAAK,GAAG,CAAC,CAAC;IAC3G,CAAC;CACF;AAnMD,wDAmMC","sourcesContent":["import { promises as fs } from 'node:fs';\nimport { dirname } from 'node:path';\nimport { mkdir } from 'node:fs/promises';\nimport { X509Certificate } from 'node:crypto';\nimport acme from 'acme-client';\nimport type { Authorization } from 'acme-client';\nimport { getLoggerFor } from 'global-logger-factory';\nimport { DnsChallengeClient } from './DnsChallengeClient';\nimport { toDns01Value } from './utils';\nimport type { DnsProvider } from '../../dns/DnsProvider';\n\n/*\n DNS 验证处理器接口\n /\nexport interface DnsChallengeHandler {\n setChallenge(host: string, value: string): Promise<void>;\n removeChallenge(host: string, value?: string): Promise<void>;\n}\n\n/\n 使用 DnsProvider 的本地 DNS 验证处理器\n /\nexport class LocalDnsChallengeHandler implements DnsChallengeHandler {\n private readonly provider: DnsProvider;\n private readonly rootDomain: string;\n\n public constructor(provider: DnsProvider, rootDomain: string) {\n this.provider = provider;\n this.rootDomain = rootDomain;\n }\n\n public async setChallenge(host: string, value: string): Promise<void> {\n // host 格式: _acme-challenge.node1.pods.undefineds.co\n // 需要提取 subdomain: _acme-challenge.node1.pods\n const subdomain = this.extractSubdomain(host);\n await this.provider.upsertRecord({\n domain: this.rootDomain,\n subdomain,\n type: 'TXT',\n value,\n ttl: 60,\n });\n }\n\n public async removeChallenge(host: string, value?: string): Promise<void> {\n const subdomain = this.extractSubdomain(host);\n await this.provider.deleteRecord({\n domain: this.rootDomain,\n subdomain,\n type: 'TXT',\n value,\n });\n }\n\n private extractSubdomain(host: string): string {\n // 从 _acme-challenge.node1.pods.undefineds.co 提取 _acme-challenge.node1.pods\n const suffix = `.${this.rootDomain}`;\n if (host.endsWith(suffix)) {\n return host.slice(0, -suffix.length);\n }\n return host;\n }\n}\n\nexport interface AcmeCertificateManagerOptions {\n /* Cloud 模式: 通过 signal endpoint 操作 DNS /\n signalEndpoint?: string;\n nodeId?: string;\n nodeToken?: string;\n \n /* Local 模式: 直接使用 DNS Provider /\n dnsProvider?: DnsProvider;\n rootDomain?: string;\n \n /* 或者直接提供自定义的 DNS 验证处理器 /\n dnsChallengeHandler?: DnsChallengeHandler;\n \n email: string;\n domains: string[];\n directoryUrl?: string;\n fallbackDirectoryUrls?: string[]; // CA failover support\n accountKeyPath: string;\n certificateKeyPath: string;\n certificatePath: string;\n fullChainPath?: string;\n renewBeforeDays?: number;\n propagationDelayMs?: number;\n}\n\nconst DEFAULT_DIRECTORY_URL = acme.directory.letsencrypt.production;\nconst DEFAULT_FALLBACK_URLS = [\n acme.directory.letsencrypt.staging, // Staging as fallback for testing\n 'https://acme.zerossl.com/v2/DV90', // ZeroSSL as alternative CA\n];\n\nexport class AcmeCertificateManager {\n private readonly logger = getLoggerFor(this);\n private readonly dnsHandler: DnsChallengeHandler;\n private readonly email: string;\n private readonly domains: string[];\n private readonly directoryUrl: string;\n private readonly fallbackDirectoryUrls: string[];\n private readonly accountKeyPath: string;\n private readonly certificateKeyPath: string;\n private readonly certificatePath: string;\n private readonly fullChainPath?: string;\n private readonly renewBeforeDays: number;\n private readonly propagationDelayMs: number;\n\n public constructor(options: AcmeCertificateManagerOptions) {\n // 确定 DNS 验证处理器\n if (options.dnsChallengeHandler) {\n // 用户提供自定义处理器\n this.dnsHandler = options.dnsChallengeHandler;\n } else if (options.dnsProvider && options.rootDomain) {\n // Local 模式：使用 DNS Provider\n this.dnsHandler = new LocalDnsChallengeHandler(options.dnsProvider, options.rootDomain);\n } else if (options.signalEndpoint && options.nodeId && options.nodeToken) {\n // Cloud 模式：通过 signal endpoint\n this.dnsHandler = new DnsChallengeClient({\n signalEndpoint: options.signalEndpoint,\n nodeId: options.nodeId,\n nodeToken: options.nodeToken,\n });\n } else {\n throw new Error('AcmeCertificateManager 需要提供 DNS 验证方式: dnsChallengeHandler, (dnsProvider + rootDomain), 或 (signalEndpoint + nodeId + nodeToken)');\n }\n \n this.email = options.email;\n this.domains = options.domains;\n this.directoryUrl = options.directoryUrl ?? DEFAULT_DIRECTORY_URL;\n this.fallbackDirectoryUrls = options.fallbackDirectoryUrls ?? DEFAULT_FALLBACK_URLS;\n this.accountKeyPath = options.accountKeyPath;\n this.certificateKeyPath = options.certificateKeyPath;\n this.certificatePath = options.certificatePath;\n this.fullChainPath = options.fullChainPath;\n this.renewBeforeDays = options.renewBeforeDays ?? 15;\n this.propagationDelayMs = options.propagationDelayMs ?? 15_000;\n }\n\n public async ensureCertificate(): Promise<boolean> {\n if (await this.isCertificateValid()) {\n this.logger.debug('现有证书仍在有效期内，跳过 ACME 申请。');\n return false;\n }\n await this.issueCertificate();\n return true;\n }\n\n private async isCertificateValid(): Promise<boolean> {\n try {\n const certPem = await fs.readFile(this.certificatePath, 'utf8');\n const cert = new X509Certificate(certPem);\n const expiresAt = cert.validTo ? new Date(cert.validTo).getTime() : NaN;\n if (!Number.isFinite(expiresAt)) {\n return false;\n }\n const remainingMs = expiresAt - Date.now();\n const thresholdMs = this.renewBeforeDays 24 * 60 * 60 * 1000;\n const containsAllDomains = this.domains.every((domain) => cert.subjectAltName?.includes(domain));\n return remainingMs > thresholdMs && containsAllDomains;\n } catch {\n return false;\n }\n }\n\n private async issueCertificate(): Promise<void> {\n this.logger.info(`申请 ACME 证书：${this.domains.join(', ')}`);\n await this.ensureDirectory(dirname(this.accountKeyPath));\n await this.ensureDirectory(dirname(this.certificateKeyPath));\n await this.ensureDirectory(dirname(this.certificatePath));\n if (this.fullChainPath) {\n await this.ensureDirectory(dirname(this.fullChainPath));\n }\n\n // Try primary CA first, then fallback CAs\n const directoryUrls = [this.directoryUrl, ...this.fallbackDirectoryUrls];\n let lastError: Error \| undefined;\n\n for (const directoryUrl of directoryUrls) {\n try {\n await this.issueCertificateFromCA(directoryUrl);\n return; // Success!\n } catch (error: unknown) {\n lastError = error as Error;\n this.logger.warn(`ACME CA ${directoryUrl} 失败: ${lastError.message}`);\n if (directoryUrl !== directoryUrls[directoryUrls.length - 1]) {\n this.logger.info('尝试下一个 ACME CA...');\n }\n }\n }\n\n // All CAs failed\n throw new Error(`所有 ACME CA 都失败。最后错误: ${lastError?.message}`);\n }\n\n private async issueCertificateFromCA(directoryUrl: string): Promise<void> {\n this.logger.info(`使用 ACME CA: ${directoryUrl}`);\n \n const accountKey = await this.loadOrCreateAccountKey(this.accountKeyPath);\n const client = new acme.Client({\n directoryUrl,\n accountKey,\n });\n\n await this.ensureAccount(client);\n\n const existingCertKey = await this.readOptionalFile(this.certificateKeyPath);\n const [ privateKey, csr ] = await acme.crypto.createCsr({\n altNames: this.domains,\n commonName: this.domains[0],\n }, existingCertKey ?? undefined);\n\n const certificate = await client.auto({\n csr,\n email: this.email,\n termsOfServiceAgreed: true,\n challengePriority: [ 'dns-01' ],\n challengeCreateFn: async (authz: Authorization, _challenge: unknown, keyAuthorization: string): Promise<void> => {\n const recordName = `_acme-challenge.${authz.identifier.value}`;\n const value = toDns01Value(keyAuthorization);\n await this.dnsHandler.setChallenge(recordName, value);\n await this.delay(this.propagationDelayMs);\n },\n challengeRemoveFn: async (authz: Authorization): Promise<void> => {\n const recordName = `_acme-challenge.${authz.identifier.value}`;\n await this.dnsHandler.removeChallenge(recordName);\n },\n });\n\n await fs.writeFile(this.certificateKeyPath, privateKey.toString());\n await fs.writeFile(this.certificatePath, certificate);\n if (this.fullChainPath) {\n await fs.writeFile(this.fullChainPath, certificate);\n }\n this.logger.info(`ACME 证书申请成功 (CA: ${directoryUrl})`);\n }\n\n private async ensureAccount(client: acme.Client): Promise<void> {\n try {\n await client.createAccount({\n termsOfServiceAgreed: true,\n contact: [ `mailto:${this.email}` ],\n });\n this.logger.debug('ACME 账户已创建。');\n } catch (error: unknown) {\n if (this.isConflictError(error)) {\n this.logger.debug('ACME 账户已存在，跳过创建。');\n } else {\n throw error;\n }\n }\n }\n\n private async loadOrCreateAccountKey(path: string): Promise<string> {\n const existing = await this.readOptionalFile(path);\n if (existing) {\n return existing.toString();\n }\n await this.ensureDirectory(dirname(path));\n const key = await acme.crypto.createPrivateKey();\n await fs.writeFile(path, key);\n return key.toString();\n }\n\n private async readOptionalFile(path: string): Promise<Buffer \| undefined> {\n try {\n return await fs.readFile(path);\n } catch {\n return undefined;\n }\n }\n\n private async ensureDirectory(path: string): Promise<void> {\n if (!path \|\| path === '.') {\n return;\n }\n await mkdir(path, { recursive: true });\n }\n\n private async delay(ms: number): Promise<void> {\n if (ms <= 0) {\n return;\n }\n await new Promise((resolve) => setTimeout(resolve, ms));\n }\n\n private isConflictError(error: unknown): boolean {\n return Boolean(error && typeof error === 'object' && 'status' in error && (error as any).status === 409);\n }\n}\n"]}
1	+ {"version":3,"file":"AcmeCertificateManager.js","sourceRoot":"","sources":["../../../src/edge/acme/AcmeCertificateManager.ts"],"names":[],"mappings":";;;;;;AAAA,qCAAyC;AACzC,yCAAoC;AACpC,+CAAyC;AACzC,6CAA8C;AAC9C,8DAA+B;AAE/B,iEAAqD;AACrD,6DAA0D;AAC1D,mCAAuC;AAWvC;;GAEG;AACH,MAAa,wBAAwB;IAInC,YAAmB,QAAqB,EAAE,UAAkB;QAC1D,IAAI,CAAC,QAAQ,GAAG,QAAQ,CAAC;QACzB,IAAI,CAAC,UAAU,GAAG,UAAU,CAAC;IAC/B,CAAC;IAEM,KAAK,CAAC,YAAY,CAAC,IAAY,EAAE,KAAa;QACnD,oDAAoD;QACpD,6CAA6C;QAC7C,MAAM,SAAS,GAAG,IAAI,CAAC,gBAAgB,CAAC,IAAI,CAAC,CAAC;QAC9C,MAAM,IAAI,CAAC,QAAQ,CAAC,YAAY,CAAC;YAC/B,MAAM,EAAE,IAAI,CAAC,UAAU;YACvB,SAAS;YACT,IAAI,EAAE,KAAK;YACX,KAAK;YACL,GAAG,EAAE,EAAE;SACR,CAAC,CAAC;IACL,CAAC;IAEM,KAAK,CAAC,eAAe,CAAC,IAAY,EAAE,KAAc;QACvD,MAAM,SAAS,GAAG,IAAI,CAAC,gBAAgB,CAAC,IAAI,CAAC,CAAC;QAC9C,MAAM,IAAI,CAAC,QAAQ,CAAC,YAAY,CAAC;YAC/B,MAAM,EAAE,IAAI,CAAC,UAAU;YACvB,SAAS;YACT,IAAI,EAAE,KAAK;YACX,KAAK;SACN,CAAC,CAAC;IACL,CAAC;IAEO,gBAAgB,CAAC,IAAY;QACnC,2EAA2E;QAC3E,MAAM,MAAM,GAAG,IAAI,IAAI,CAAC,UAAU,EAAE,CAAC;QACrC,IAAI,IAAI,CAAC,QAAQ,CAAC,MAAM,CAAC,EAAE,CAAC;YAC1B,OAAO,IAAI,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC;QACvC,CAAC;QACD,OAAO,IAAI,CAAC;IACd,CAAC;CACF;AAxCD,4DAwCC;AAqCD,MAAM,qBAAqB,GAAG,qBAAI,CAAC,SAAS,CAAC,WAAW,CAAC,UAAU,CAAC;AACpE,MAAM,qBAAqB,GAAG;IAC5B,qBAAI,CAAC,SAAS,CAAC,WAAW,CAAC,OAAO,EAAE,kCAAkC;IACtE,kCAAkC,EAAE,4BAA4B;CACjE,CAAC;AAEF,MAAa,sBAAsB;IAejC,YAAmB,OAAsC;QAdxC,WAAM,GAAG,IAAA,oCAAY,EAAC,IAAI,CAAC,CAAC;QAYrC,YAAO,GAAG,KAAK,CAAC;QAGtB,eAAe;QACf,IAAI,OAAO,CAAC,mBAAmB,EAAE,CAAC;YAChC,aAAa;YACb,IAAI,CAAC,UAAU,GAAG,OAAO,CAAC,mBAAmB,CAAC;QAChD,CAAC;aAAM,IAAI,OAAO,CAAC,WAAW,IAAI,OAAO,CAAC,UAAU,EAAE,CAAC;YACrD,2BAA2B;YAC3B,IAAI,CAAC,UAAU,GAAG,IAAI,wBAAwB,CAAC,OAAO,CAAC,WAAW,EAAE,OAAO,CAAC,UAAU,CAAC,CAAC;QAC1F,CAAC;aAAM,IAAI,OAAO,CAAC,cAAc,IAAI,OAAO,CAAC,MAAM,IAAI,OAAO,CAAC,SAAS,EAAE,CAAC;YACzE,8BAA8B;YAC9B,IAAI,CAAC,UAAU,GAAG,IAAI,uCAAkB,CAAC;gBACvC,cAAc,EAAE,OAAO,CAAC,cAAc;gBACtC,MAAM,EAAE,OAAO,CAAC,MAAM;gBACtB,SAAS,EAAE,OAAO,CAAC,SAAS;aAC7B,CAAC,CAAC;QACL,CAAC;aAAM,CAAC;YACN,MAAM,IAAI,KAAK,CAAC,gIAAgI,CAAC,CAAC;QACpJ,CAAC;QAED,IAAI,CAAC,KAAK,GAAG,OAAO,CAAC,KAAK,CAAC;QAC3B,IAAI,CAAC,OAAO,GAAG,OAAO,CAAC,OAAO,CAAC;QAC/B,IAAI,CAAC,YAAY,GAAG,OAAO,CAAC,YAAY,IAAI,qBAAqB,CAAC;QAClE,IAAI,CAAC,qBAAqB,GAAG,OAAO,CAAC,qBAAqB,IAAI,qBAAqB,CAAC;QACpF,IAAI,CAAC,cAAc,GAAG,OAAO,CAAC,cAAc,CAAC;QAC7C,IAAI,CAAC,kBAAkB,GAAG,OAAO,CAAC,kBAAkB,CAAC;QACrD,IAAI,CAAC,eAAe,GAAG,OAAO,CAAC,eAAe,CAAC;QAC/C,IAAI,CAAC,aAAa,GAAG,OAAO,CAAC,aAAa,CAAC;QAC3C,IAAI,CAAC,eAAe,GAAG,OAAO,CAAC,eAAe,IAAI,EAAE,CAAC;QACrD,IAAI,CAAC,kBAAkB,GAAG,OAAO,CAAC,kBAAkB,IAAI,MAAM,CAAC;IACjE,CAAC;IAEM,KAAK,CAAC,iBAAiB;QAC5B,IAAI,CAAC,IAAI,CAAC,WAAW,EAAE,EAAE,CAAC;YACxB,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,yBAAyB,CAAC,CAAC;YAC7C,OAAO,KAAK,CAAC;QACf,CAAC;QACD,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,qBAAqB,EAAE,CAAC;QAClD,IAAI,MAAM,CAAC,MAAM,KAAK,OAAO,EAAE,CAAC;YAC9B,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,wBAAwB,CAAC,CAAC;YAC5C,OAAO,KAAK,CAAC;QACf,CAAC;QACD,MAAM,IAAI,CAAC,wBAAwB,EAAE,CAAC;QACtC,OAAO,IAAI,CAAC;IACd,CAAC;IAEM,KAAK,CAAC,qBAAqB;QAChC,IAAI,CAAC;YACH,MAAM,OAAO,GAAG,MAAM,kBAAE,CAAC,QAAQ,CAAC,IAAI,CAAC,eAAe,EAAE,MAAM,CAAC,CAAC;YAChE,MAAM,IAAI,GAAG,IAAI,6BAAe,CAAC,OAAO,CAAC,CAAC;YAC1C,MAAM,SAAS,GAAG,IAAI,CAAC,OAAO,CAAC,CAAC,CAAC,IAAI,IAAI,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC,OAAO,EAAE,CAAC,CAAC,CAAC,GAAG,CAAC;YACxE,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,SAAS,CAAC,EAAE,CAAC;gBAChC,OAAO,EAAE,MAAM,EAAE,SAAS,EAAE,CAAC;YAC/B,CAAC;YACD,MAAM,WAAW,GAAG,SAAS,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;YAC3C,MAAM,WAAW,GAAG,IAAI,CAAC,eAAe,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,IAAI,CAAC;YAC/D,MAAM,OAAO,GAAG,IAAI,CAAC,6BAA6B,CAAC,IAAI,CAAC,CAAC;YACzD,MAAM,kBAAkB,GAAG,IAAI,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,OAAO,CAAC,QAAQ,CAAC,MAAM,CAAC,WAAW,EAAE,CAAC,CAAC,CAAC;YAClG,OAAO;gBACL,MAAM,EAAE,WAAW,GAAG,WAAW,IAAI,kBAAkB,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,aAAa;gBACjF,SAAS,EAAE,IAAI,IAAI,CAAC,SAAS,CAAC,CAAC,WAAW,EAAE;gBAC5C,OAAO;aACR,CAAC;QACJ,CAAC;QAAC,MAAM,CAAC;YACP,OAAO,EAAE,MAAM,EAAE,SAAS,EAAE,CAAC;QAC/B,CAAC;IACH,CAAC;IAEM,WAAW;QAChB,OAAO,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,MAAM,CAAC,IAAI,EAAE,CAAC,MAAM,GAAG,CAAC,CAAC;eACzD,IAAI,CAAC,KAAK,CAAC,IAAI,EAAE,CAAC,MAAM,GAAG,CAAC;eAC5B,IAAI,CAAC,cAAc,CAAC,IAAI,EAAE,CAAC,MAAM,GAAG,CAAC;eACrC,IAAI,CAAC,kBAAkB,CAAC,IAAI,EAAE,CAAC,MAAM,GAAG,CAAC;eACzC,IAAI,CAAC,eAAe,CAAC,IAAI,EAAE,CAAC,MAAM,GAAG,CAAC,CAAC;IAC9C,CAAC;IAEM,KAAK,CAAC,gBAAgB;QAC3B,IAAI,CAAC,IAAI,CAAC,WAAW,EAAE,EAAE,CAAC;YACxB,MAAM,6BAA6B,CACjC,GAAG,EACH,iCAAiC,EACjC,uEAAuE,CACxE,CAAC;QACJ,CAAC;QACD,MAAM,IAAI,CAAC,wBAAwB,EAAE,CAAC;QACtC,OAAO,EAAE,MAAM,EAAE,SAAS,EAAE,CAAC;IAC/B,CAAC;IAEO,6BAA6B,CAAC,IAAqB;QACzD,MAAM,MAAM,GAAG,IAAI,GAAG,EAAU,CAAC;QACjC,MAAM,OAAO,GAAG,IAAI,CAAC,OAAO,CAAC;QAC7B,IAAI,OAAO,EAAE,CAAC;YACZ,MAAM,KAAK,GAAG,aAAa,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;YAC1C,IAAI,KAAK,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;gBACf,MAAM,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC,CAAC;YAC5C,CAAC;QACH,CAAC;QACD,MAAM,QAAQ,GAAG,IAAI,CAAC,cAAc,EAAE,KAAK,CAAC,GAAG,CAAC,CAAC;QACjD,IAAI,QAAQ,EAAE,CAAC;YACb,KAAK,MAAM,KAAK,IAAI,QAAQ,EAAE,CAAC;gBAC7B,MAAM,OAAO,GAAG,KAAK,CAAC,IAAI,EAAE,CAAC;gBAC7B,IAAI,OAAO,CAAC,WAAW,EAAE,CAAC,UAAU,CAAC,MAAM,CAAC,EAAE,CAAC;oBAC7C,MAAM,CAAC,GAAG,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC,CAAC;gBACpD,CAAC;YACH,CAAC;QACH,CAAC;QACD,OAAO,KAAK,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;IAC5B,CAAC;IAEO,KAAK,CAAC,wBAAwB;QACpC,IAAI,IAAI,CAAC,OAAO,EAAE,CAAC;YACjB,MAAM,6BAA6B,CACjC,GAAG,EACH,8BAA8B,EAC9B,wCAAwC,CACzC,CAAC;QACJ,CAAC;QACD,IAAI,CAAC,OAAO,GAAG,IAAI,CAAC;QACpB,IAAI,CAAC;YACH,MAAM,IAAI,CAAC,gBAAgB,EAAE,CAAC;QAChC,CAAC;gBAAS,CAAC;YACT,IAAI,CAAC,OAAO,GAAG,KAAK,CAAC;QACvB,CAAC;IACH,CAAC;IAEO,KAAK,CAAC,gBAAgB;QAC5B,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,cAAc,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;QAC1D,MAAM,IAAI,CAAC,eAAe,CAAC,IAAA,mBAAO,EAAC,IAAI,CAAC,cAAc,CAAC,CAAC,CAAC;QACzD,MAAM,IAAI,CAAC,eAAe,CAAC,IAAA,mBAAO,EAAC,IAAI,CAAC,kBAAkB,CAAC,CAAC,CAAC;QAC7D,MAAM,IAAI,CAAC,eAAe,CAAC,IAAA,mBAAO,EAAC,IAAI,CAAC,eAAe,CAAC,CAAC,CAAC;QAC1D,IAAI,IAAI,CAAC,aAAa,EAAE,CAAC;YACvB,MAAM,IAAI,CAAC,eAAe,CAAC,IAAA,mBAAO,EAAC,IAAI,CAAC,aAAa,CAAC,CAAC,CAAC;QAC1D,CAAC;QAED,0CAA0C;QAC1C,MAAM,aAAa,GAAG,CAAC,IAAI,CAAC,YAAY,EAAE,GAAG,IAAI,CAAC,qBAAqB,CAAC,CAAC;QACzE,IAAI,SAA4B,CAAC;QAEjC,KAAK,MAAM,YAAY,IAAI,aAAa,EAAE,CAAC;YACzC,IAAI,CAAC;gBACH,MAAM,IAAI,CAAC,sBAAsB,CAAC,YAAY,CAAC,CAAC;gBAChD,OAAO,CAAC,WAAW;YACrB,CAAC;YAAC,OAAO,KAAc,EAAE,CAAC;gBACxB,SAAS,GAAG,KAAc,CAAC;gBAC3B,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,WAAW,YAAY,QAAQ,SAAS,CAAC,OAAO,EAAE,CAAC,CAAC;gBACrE,IAAI,YAAY,KAAK,aAAa,CAAC,aAAa,CAAC,MAAM,GAAG,CAAC,CAAC,EAAE,CAAC;oBAC7D,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,kBAAkB,CAAC,CAAC;gBACvC,CAAC;YACH,CAAC;QACH,CAAC;QAED,iBAAiB;QACjB,MAAM,IAAI,KAAK,CAAC,wBAAwB,SAAS,EAAE,OAAO,EAAE,CAAC,CAAC;IAChE,CAAC;IAEO,KAAK,CAAC,sBAAsB,CAAC,YAAoB;QACvD,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,eAAe,YAAY,EAAE,CAAC,CAAC;QAEhD,MAAM,UAAU,GAAG,MAAM,IAAI,CAAC,sBAAsB,CAAC,IAAI,CAAC,cAAc,CAAC,CAAC;QAC1E,MAAM,MAAM,GAAG,IAAI,qBAAI,CAAC,MAAM,CAAC;YAC7B,YAAY;YACZ,UAAU;SACX,CAAC,CAAC;QAEH,MAAM,IAAI,CAAC,aAAa,CAAC,MAAM,CAAC,CAAC;QAEjC,MAAM,eAAe,GAAG,MAAM,IAAI,CAAC,gBAAgB,CAAC,IAAI,CAAC,kBAAkB,CAAC,CAAC;QAC7E,MAAM,CAAE,UAAU,EAAE,GAAG,CAAE,GAAG,MAAM,qBAAI,CAAC,MAAM,CAAC,SAAS,CAAC;YACtD,QAAQ,EAAE,IAAI,CAAC,OAAO;YACtB,UAAU,EAAE,IAAI,CAAC,OAAO,CAAC,CAAC,CAAC;SAC5B,EAAE,eAAe,IAAI,SAAS,CAAC,CAAC;QAEjC,MAAM,WAAW,GAAG,MAAM,MAAM,CAAC,IAAI,CAAC;YACpC,GAAG;YACH,KAAK,EAAE,IAAI,CAAC,KAAK;YACjB,oBAAoB,EAAE,IAAI;YAC1B,iBAAiB,EAAE,CAAE,QAAQ,CAAE;YAC/B,iBAAiB,EAAE,KAAK,EAAE,KAAoB,EAAE,UAAmB,EAAE,gBAAwB,EAAiB,EAAE;gBAC9G,MAAM,UAAU,GAAG,mBAAmB,KAAK,CAAC,UAAU,CAAC,KAAK,EAAE,CAAC;gBAC/D,MAAM,KAAK,GAAG,IAAA,oBAAY,EAAC,gBAAgB,CAAC,CAAC;gBAC7C,MAAM,IAAI,CAAC,UAAU,CAAC,YAAY,CAAC,UAAU,EAAE,KAAK,CAAC,CAAC;gBACtD,MAAM,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,kBAAkB,CAAC,CAAC;YAC5C,CAAC;YACD,iBAAiB,EAAE,KAAK,EAAE,KAAoB,EAAiB,EAAE;gBAC/D,MAAM,UAAU,GAAG,mBAAmB,KAAK,CAAC,UAAU,CAAC,KAAK,EAAE,CAAC;gBAC/D,MAAM,IAAI,CAAC,UAAU,CAAC,eAAe,CAAC,UAAU,CAAC,CAAC;YACpD,CAAC;SACF,CAAC,CAAC;QAEH,MAAM,kBAAE,CAAC,SAAS,CAAC,IAAI,CAAC,kBAAkB,EAAE,UAAU,CAAC,QAAQ,EAAE,CAAC,CAAC;QACnE,MAAM,kBAAE,CAAC,SAAS,CAAC,IAAI,CAAC,eAAe,EAAE,WAAW,CAAC,CAAC;QACtD,IAAI,IAAI,CAAC,aAAa,EAAE,CAAC;YACvB,MAAM,kBAAE,CAAC,SAAS,CAAC,IAAI,CAAC,aAAa,EAAE,WAAW,CAAC,CAAC;QACtD,CAAC;QACD,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,oBAAoB,YAAY,GAAG,CAAC,CAAC;IACxD,CAAC;IAEO,KAAK,CAAC,aAAa,CAAC,MAAmB;QAC7C,IAAI,CAAC;YACH,MAAM,MAAM,CAAC,aAAa,CAAC;gBACzB,oBAAoB,EAAE,IAAI;gBAC1B,OAAO,EAAE,CAAE,UAAU,IAAI,CAAC,KAAK,EAAE,CAAE;aACpC,CAAC,CAAC;YACH,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,aAAa,CAAC,CAAC;QACnC,CAAC;QAAC,OAAO,KAAc,EAAE,CAAC;YACxB,IAAI,IAAI,CAAC,eAAe,CAAC,KAAK,CAAC,EAAE,CAAC;gBAChC,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,kBAAkB,CAAC,CAAC;YACxC,CAAC;iBAAM,CAAC;gBACN,MAAM,KAAK,CAAC;YACd,CAAC;QACH,CAAC;IACH,CAAC;IAEO,KAAK,CAAC,sBAAsB,CAAC,IAAY;QAC/C,MAAM,QAAQ,GAAG,MAAM,IAAI,CAAC,gBAAgB,CAAC,IAAI,CAAC,CAAC;QACnD,IAAI,QAAQ,EAAE,CAAC;YACb,OAAO,QAAQ,CAAC,QAAQ,EAAE,CAAC;QAC7B,CAAC;QACD,MAAM,IAAI,CAAC,eAAe,CAAC,IAAA,mBAAO,EAAC,IAAI,CAAC,CAAC,CAAC;QAC1C,MAAM,GAAG,GAAG,MAAM,qBAAI,CAAC,MAAM,CAAC,gBAAgB,EAAE,CAAC;QACjD,MAAM,kBAAE,CAAC,SAAS,CAAC,IAAI,EAAE,GAAG,CAAC,CAAC;QAC9B,OAAO,GAAG,CAAC,QAAQ,EAAE,CAAC;IACxB,CAAC;IAEO,KAAK,CAAC,gBAAgB,CAAC,IAAY;QACzC,IAAI,CAAC;YACH,OAAO,MAAM,kBAAE,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC;QACjC,CAAC;QAAC,MAAM,CAAC;YACP,OAAO,SAAS,CAAC;QACnB,CAAC;IACH,CAAC;IAEO,KAAK,CAAC,eAAe,CAAC,IAAY;QACxC,IAAI,CAAC,IAAI,IAAI,IAAI,KAAK,GAAG,EAAE,CAAC;YAC1B,OAAO;QACT,CAAC;QACD,MAAM,IAAA,gBAAK,EAAC,IAAI,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;IACzC,CAAC;IAEO,KAAK,CAAC,KAAK,CAAC,EAAU;QAC5B,IAAI,EAAE,IAAI,CAAC,EAAE,CAAC;YACZ,OAAO;QACT,CAAC;QACD,MAAM,IAAI,OAAO,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC,UAAU,CAAC,OAAO,EAAE,EAAE,CAAC,CAAC,CAAC;IAC1D,CAAC;IAEO,eAAe,CAAC,KAAc;QACpC,OAAO,OAAO,CAAC,KAAK,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,QAAQ,IAAI,KAAK,IAAK,KAAa,CAAC,MAAM,KAAK,GAAG,CAAC,CAAC;IAC3G,CAAC;CACF;AAvQD,wDAuQC;AAED,SAAS,6BAA6B,CAAC,UAAkB,EAAE,IAAY,EAAE,OAAe;IAItF,OAAO,MAAM,CAAC,MAAM,CAAC,IAAI,KAAK,CAAC,OAAO,CAAC,EAAE,EAAE,UAAU,EAAE,IAAI,EAAE,CAAC,CAAC;AACjE,CAAC","sourcesContent":["import { promises as fs } from 'node:fs';\nimport { dirname } from 'node:path';\nimport { mkdir } from 'node:fs/promises';\nimport { X509Certificate } from 'node:crypto';\nimport acme from 'acme-client';\nimport type { Authorization } from 'acme-client';\nimport { getLoggerFor } from 'global-logger-factory';\nimport { DnsChallengeClient } from './DnsChallengeClient';\nimport { toDns01Value } from './utils';\nimport type { DnsProvider } from '../../dns/DnsProvider';\n\n/*\n DNS 验证处理器接口\n /\nexport interface DnsChallengeHandler {\n setChallenge(host: string, value: string): Promise<void>;\n removeChallenge(host: string, value?: string): Promise<void>;\n}\n\n/\n 使用 DnsProvider 的本地 DNS 验证处理器\n /\nexport class LocalDnsChallengeHandler implements DnsChallengeHandler {\n private readonly provider: DnsProvider;\n private readonly rootDomain: string;\n\n public constructor(provider: DnsProvider, rootDomain: string) {\n this.provider = provider;\n this.rootDomain = rootDomain;\n }\n\n public async setChallenge(host: string, value: string): Promise<void> {\n // host 格式: _acme-challenge.node1.pods.undefineds.co\n // 需要提取 subdomain: _acme-challenge.node1.pods\n const subdomain = this.extractSubdomain(host);\n await this.provider.upsertRecord({\n domain: this.rootDomain,\n subdomain,\n type: 'TXT',\n value,\n ttl: 60,\n });\n }\n\n public async removeChallenge(host: string, value?: string): Promise<void> {\n const subdomain = this.extractSubdomain(host);\n await this.provider.deleteRecord({\n domain: this.rootDomain,\n subdomain,\n type: 'TXT',\n value,\n });\n }\n\n private extractSubdomain(host: string): string {\n // 从 _acme-challenge.node1.pods.undefineds.co 提取 _acme-challenge.node1.pods\n const suffix = `.${this.rootDomain}`;\n if (host.endsWith(suffix)) {\n return host.slice(0, -suffix.length);\n }\n return host;\n }\n}\n\nexport interface AcmeCertificateManagerOptions {\n /* Cloud 模式: 通过 signal endpoint 操作 DNS /\n signalEndpoint?: string;\n nodeId?: string;\n nodeToken?: string;\n \n /* Local 模式: 直接使用 DNS Provider /\n dnsProvider?: DnsProvider;\n rootDomain?: string;\n \n /* 或者直接提供自定义的 DNS 验证处理器 /\n dnsChallengeHandler?: DnsChallengeHandler;\n \n email: string;\n domains: string[];\n directoryUrl?: string;\n fallbackDirectoryUrls?: string[]; // CA failover support\n accountKeyPath: string;\n certificateKeyPath: string;\n certificatePath: string;\n fullChainPath?: string;\n renewBeforeDays?: number;\n propagationDelayMs?: number;\n}\n\nexport interface RuntimeCertificateStatus {\n status: 'valid' \| 'renewal_due' \| 'missing' \| 'invalid';\n expiresAt?: string;\n domains?: string[];\n}\n\nexport interface RuntimeCertificateRenewalResult {\n status: 'renewed';\n}\n\nconst DEFAULT_DIRECTORY_URL = acme.directory.letsencrypt.production;\nconst DEFAULT_FALLBACK_URLS = [\n acme.directory.letsencrypt.staging, // Staging as fallback for testing\n 'https://acme.zerossl.com/v2/DV90', // ZeroSSL as alternative CA\n];\n\nexport class AcmeCertificateManager {\n private readonly logger = getLoggerFor(this);\n private readonly dnsHandler: DnsChallengeHandler;\n private readonly email: string;\n private readonly domains: string[];\n private readonly directoryUrl: string;\n private readonly fallbackDirectoryUrls: string[];\n private readonly accountKeyPath: string;\n private readonly certificateKeyPath: string;\n private readonly certificatePath: string;\n private readonly fullChainPath?: string;\n private readonly renewBeforeDays: number;\n private readonly propagationDelayMs: number;\n private issuing = false;\n\n public constructor(options: AcmeCertificateManagerOptions) {\n // 确定 DNS 验证处理器\n if (options.dnsChallengeHandler) {\n // 用户提供自定义处理器\n this.dnsHandler = options.dnsChallengeHandler;\n } else if (options.dnsProvider && options.rootDomain) {\n // Local 模式：使用 DNS Provider\n this.dnsHandler = new LocalDnsChallengeHandler(options.dnsProvider, options.rootDomain);\n } else if (options.signalEndpoint && options.nodeId && options.nodeToken) {\n // Cloud 模式：通过 signal endpoint\n this.dnsHandler = new DnsChallengeClient({\n signalEndpoint: options.signalEndpoint,\n nodeId: options.nodeId,\n nodeToken: options.nodeToken,\n });\n } else {\n throw new Error('AcmeCertificateManager 需要提供 DNS 验证方式: dnsChallengeHandler, (dnsProvider + rootDomain), 或 (signalEndpoint + nodeId + nodeToken)');\n }\n \n this.email = options.email;\n this.domains = options.domains;\n this.directoryUrl = options.directoryUrl ?? DEFAULT_DIRECTORY_URL;\n this.fallbackDirectoryUrls = options.fallbackDirectoryUrls ?? DEFAULT_FALLBACK_URLS;\n this.accountKeyPath = options.accountKeyPath;\n this.certificateKeyPath = options.certificateKeyPath;\n this.certificatePath = options.certificatePath;\n this.fullChainPath = options.fullChainPath;\n this.renewBeforeDays = options.renewBeforeDays ?? 15;\n this.propagationDelayMs = options.propagationDelayMs ?? 15_000;\n }\n\n public async ensureCertificate(): Promise<boolean> {\n if (!this.isAvailable()) {\n this.logger.debug('ACME 证书运行时未配置有效域名，跳过申请。');\n return false;\n }\n const status = await this.readCertificateStatus();\n if (status.status === 'valid') {\n this.logger.debug('现有证书仍在有效期内，跳过 ACME 申请。');\n return false;\n }\n await this.issueCertificateWithLock();\n return true;\n }\n\n public async readCertificateStatus(): Promise<RuntimeCertificateStatus> {\n try {\n const certPem = await fs.readFile(this.certificatePath, 'utf8');\n const cert = new X509Certificate(certPem);\n const expiresAt = cert.validTo ? new Date(cert.validTo).getTime() : NaN;\n if (!Number.isFinite(expiresAt)) {\n return { status: 'invalid' };\n }\n const remainingMs = expiresAt - Date.now();\n const thresholdMs = this.renewBeforeDays 24 * 60 * 60 * 1000;\n const domains = this.extractDomainsFromCertificate(cert);\n const containsAllDomains = this.domains.every((domain) => domains.includes(domain.toLowerCase()));\n return {\n status: remainingMs > thresholdMs && containsAllDomains ? 'valid' : 'renewal_due',\n expiresAt: new Date(expiresAt).toISOString(),\n domains,\n };\n } catch {\n return { status: 'missing' };\n }\n }\n\n public isAvailable(): boolean {\n return this.domains.some((domain) => domain.trim().length > 0)\n && this.email.trim().length > 0\n && this.accountKeyPath.trim().length > 0\n && this.certificateKeyPath.trim().length > 0\n && this.certificatePath.trim().length > 0;\n }\n\n public async renewCertificate(): Promise<RuntimeCertificateRenewalResult> {\n if (!this.isAvailable()) {\n throw createCertificateRenewalError(\n 503,\n 'certificate_renewal_unavailable',\n 'Certificate renewal is unavailable before ACME domains are configured',\n );\n }\n await this.issueCertificateWithLock();\n return { status: 'renewed' };\n }\n\n private extractDomainsFromCertificate(cert: X509Certificate): string[] {\n const result = new Set<string>();\n const subject = cert.subject;\n if (subject) {\n const match = /CN=([^,]+)/u.exec(subject);\n if (match?.[1]) {\n result.add(match[1].trim().toLowerCase());\n }\n }\n const altNames = cert.subjectAltName?.split(',');\n if (altNames) {\n for (const entry of altNames) {\n const trimmed = entry.trim();\n if (trimmed.toLowerCase().startsWith('dns:')) {\n result.add(trimmed.slice(4).trim().toLowerCase());\n }\n }\n }\n return Array.from(result);\n }\n\n private async issueCertificateWithLock(): Promise<void> {\n if (this.issuing) {\n throw createCertificateRenewalError(\n 409,\n 'certificate_renewal_conflict',\n 'Certificate renewal is already running',\n );\n }\n this.issuing = true;\n try {\n await this.issueCertificate();\n } finally {\n this.issuing = false;\n }\n }\n\n private async issueCertificate(): Promise<void> {\n this.logger.info(`申请 ACME 证书：${this.domains.join(', ')}`);\n await this.ensureDirectory(dirname(this.accountKeyPath));\n await this.ensureDirectory(dirname(this.certificateKeyPath));\n await this.ensureDirectory(dirname(this.certificatePath));\n if (this.fullChainPath) {\n await this.ensureDirectory(dirname(this.fullChainPath));\n }\n\n // Try primary CA first, then fallback CAs\n const directoryUrls = [this.directoryUrl, ...this.fallbackDirectoryUrls];\n let lastError: Error \| undefined;\n\n for (const directoryUrl of directoryUrls) {\n try {\n await this.issueCertificateFromCA(directoryUrl);\n return; // Success!\n } catch (error: unknown) {\n lastError = error as Error;\n this.logger.warn(`ACME CA ${directoryUrl} 失败: ${lastError.message}`);\n if (directoryUrl !== directoryUrls[directoryUrls.length - 1]) {\n this.logger.info('尝试下一个 ACME CA...');\n }\n }\n }\n\n // All CAs failed\n throw new Error(`所有 ACME CA 都失败。最后错误: ${lastError?.message}`);\n }\n\n private async issueCertificateFromCA(directoryUrl: string): Promise<void> {\n this.logger.info(`使用 ACME CA: ${directoryUrl}`);\n \n const accountKey = await this.loadOrCreateAccountKey(this.accountKeyPath);\n const client = new acme.Client({\n directoryUrl,\n accountKey,\n });\n\n await this.ensureAccount(client);\n\n const existingCertKey = await this.readOptionalFile(this.certificateKeyPath);\n const [ privateKey, csr ] = await acme.crypto.createCsr({\n altNames: this.domains,\n commonName: this.domains[0],\n }, existingCertKey ?? undefined);\n\n const certificate = await client.auto({\n csr,\n email: this.email,\n termsOfServiceAgreed: true,\n challengePriority: [ 'dns-01' ],\n challengeCreateFn: async (authz: Authorization, _challenge: unknown, keyAuthorization: string): Promise<void> => {\n const recordName = `_acme-challenge.${authz.identifier.value}`;\n const value = toDns01Value(keyAuthorization);\n await this.dnsHandler.setChallenge(recordName, value);\n await this.delay(this.propagationDelayMs);\n },\n challengeRemoveFn: async (authz: Authorization): Promise<void> => {\n const recordName = `_acme-challenge.${authz.identifier.value}`;\n await this.dnsHandler.removeChallenge(recordName);\n },\n });\n\n await fs.writeFile(this.certificateKeyPath, privateKey.toString());\n await fs.writeFile(this.certificatePath, certificate);\n if (this.fullChainPath) {\n await fs.writeFile(this.fullChainPath, certificate);\n }\n this.logger.info(`ACME 证书申请成功 (CA: ${directoryUrl})`);\n }\n\n private async ensureAccount(client: acme.Client): Promise<void> {\n try {\n await client.createAccount({\n termsOfServiceAgreed: true,\n contact: [ `mailto:${this.email}` ],\n });\n this.logger.debug('ACME 账户已创建。');\n } catch (error: unknown) {\n if (this.isConflictError(error)) {\n this.logger.debug('ACME 账户已存在，跳过创建。');\n } else {\n throw error;\n }\n }\n }\n\n private async loadOrCreateAccountKey(path: string): Promise<string> {\n const existing = await this.readOptionalFile(path);\n if (existing) {\n return existing.toString();\n }\n await this.ensureDirectory(dirname(path));\n const key = await acme.crypto.createPrivateKey();\n await fs.writeFile(path, key);\n return key.toString();\n }\n\n private async readOptionalFile(path: string): Promise<Buffer \| undefined> {\n try {\n return await fs.readFile(path);\n } catch {\n return undefined;\n }\n }\n\n private async ensureDirectory(path: string): Promise<void> {\n if (!path \|\| path === '.') {\n return;\n }\n await mkdir(path, { recursive: true });\n }\n\n private async delay(ms: number): Promise<void> {\n if (ms <= 0) {\n return;\n }\n await new Promise((resolve) => setTimeout(resolve, ms));\n }\n\n private isConflictError(error: unknown): boolean {\n return Boolean(error && typeof error === 'object' && 'status' in error && (error as any).status === 409);\n }\n}\n\nfunction createCertificateRenewalError(statusCode: number, code: string, message: string): Error & {\n statusCode: number;\n code: string;\n} {\n return Object.assign(new Error(message), { statusCode, code });\n}\n"]}

package/dist/edge/acme/AcmeCertificateManager.jsonld CHANGED Viewed

@@ -220,6 +220,10 @@
           "@id": "undefineds:dist/edge/acme/AcmeCertificateManager.jsonld#AcmeCertificateManager__member_propagationDelayMs",
           "memberFieldName": "propagationDelayMs"
         },
+        {
+          "@id": "undefineds:dist/edge/acme/AcmeCertificateManager.jsonld#AcmeCertificateManager__member_issuing",
+          "memberFieldName": "issuing"
+        },
         {
           "@id": "undefineds:dist/edge/acme/AcmeCertificateManager.jsonld#AcmeCertificateManager__member_constructor",
           "memberFieldName": "constructor"
@@ -229,8 +233,24 @@
           "memberFieldName": "ensureCertificate"
         },
         {
-          "@id": "undefineds:dist/edge/acme/AcmeCertificateManager.jsonld#AcmeCertificateManager__member_isCertificateValid",
-          "memberFieldName": "isCertificateValid"
+          "@id": "undefineds:dist/edge/acme/AcmeCertificateManager.jsonld#AcmeCertificateManager__member_readCertificateStatus",
+          "memberFieldName": "readCertificateStatus"
+        },
+        {
+          "@id": "undefineds:dist/edge/acme/AcmeCertificateManager.jsonld#AcmeCertificateManager__member_isAvailable",
+          "memberFieldName": "isAvailable"
+        },
+        {
+          "@id": "undefineds:dist/edge/acme/AcmeCertificateManager.jsonld#AcmeCertificateManager__member_renewCertificate",
+          "memberFieldName": "renewCertificate"
+        },
+        {
+          "@id": "undefineds:dist/edge/acme/AcmeCertificateManager.jsonld#AcmeCertificateManager__member_extractDomainsFromCertificate",
+          "memberFieldName": "extractDomainsFromCertificate"
+        },
+        {
+          "@id": "undefineds:dist/edge/acme/AcmeCertificateManager.jsonld#AcmeCertificateManager__member_issueCertificateWithLock",
+          "memberFieldName": "issueCertificateWithLock"
         },
         {
           "@id": "undefineds:dist/edge/acme/AcmeCertificateManager.jsonld#AcmeCertificateManager__member_issueCertificate",

package/dist/edge/acme/ClusterCertificateManager.d.ts CHANGED Viewed

@@ -9,6 +9,15 @@ interface ClusterCertificateManagerOptions {
     checkIntervalMs?: number;
     onCertificateInstalled?: () => Promise<void> | void;
 }
+export interface RuntimeCertificateStatus {
+    status: 'valid' | 'renewal_due' | 'missing';
+    expiresAt?: string;
+    domains?: string[];
+    updatedAt?: string;
+}
+export interface RuntimeCertificateRenewalResult {
+    status: 'renewed';
+}
 export declare class ClusterCertificateManager {
     private readonly logger;
     private readonly endpoint;
@@ -29,6 +38,9 @@ export declare class ClusterCertificateManager {
     stop(): void;
     handleHeartbeatMetadata(metadata?: Record<string, unknown>): void;
     getHeartbeatPayload(): Record<string, unknown> | undefined;
+    readCertificateStatus(): Promise<RuntimeCertificateStatus>;
+    isAvailable(): boolean;
+    renewCertificate(): Promise<RuntimeCertificateRenewalResult>;
     private ensureCertificate;
     private isCertificateValid;
     private refreshCertificateStatus;

package/dist/edge/acme/ClusterCertificateManager.js CHANGED Viewed

@@ -56,6 +56,41 @@ class ClusterCertificateManager {
             },
         };
     }
+    async readCertificateStatus() {
+        await this.refreshCertificateStatus();
+        if (!this.status.expiresAt) {
+            return { status: 'missing' };
+        }
+        return {
+            status: await this.isCertificateValid() ? 'valid' : 'renewal_due',
+            expiresAt: this.status.expiresAt.toISOString(),
+            domains: this.status.domains ?? [],
+            updatedAt: this.status.updatedAt?.toISOString(),
+        };
+    }
+    isAvailable() {
+        return Boolean(this.assignedDomain);
+    }
+    async renewCertificate() {
+        if (this.issuing) {
+            throw createCertificateRenewalError(409, 'certificate_renewal_conflict', 'Certificate renewal is already running');
+        }
+        if (!this.assignedDomain) {
+            throw createCertificateRenewalError(503, 'certificate_renewal_unavailable', 'Certificate renewal is unavailable before the cluster assigns a domain');
+        }
+        this.issuing = true;
+        try {
+            await this.requestCertificate();
+            await this.refreshCertificateStatus();
+            if (this.onCertificateInstalled) {
+                await this.onCertificateInstalled();
+            }
+            return { status: 'renewed' };
+        }
+        finally {
+            this.issuing = false;
+        }
+    }
     async ensureCertificate() {
         if (this.issuing) {
             return;
@@ -181,4 +216,7 @@ class ClusterCertificateManager {
     }
 }
 exports.ClusterCertificateManager = ClusterCertificateManager;
+function createCertificateRenewalError(statusCode, code, message) {
+    return Object.assign(new Error(message), { statusCode, code });
+}
 //# sourceMappingURL=ClusterCertificateManager.js.map

package/dist/edge/acme/ClusterCertificateManager.js.map CHANGED Viewed

	@@ -1 +1 @@
1	- {"version":3,"file":"ClusterCertificateManager.js","sourceRoot":"","sources":["../../../src/edge/acme/ClusterCertificateManager.ts"],"names":[],"mappings":";;;;;;AAAA,qCAAyC;AACzC,yCAAoC;AACpC,6CAA8C;AAC9C,8DAA+B;AAC/B,iEAAqD;AA8BrD,MAAa,yBAAyB;IAgBpC,YAAmB,OAAyC;QAf3C,WAAM,GAAG,IAAA,oCAAY,EAAC,IAAI,CAAC,CAAC;QAWrC,WAAM,GAAsB,EAAE,CAAC;QAE/B,YAAO,GAAG,KAAK,CAAC;QAGtB,IAAI,CAAC,QAAQ,GAAG,GAAG,OAAO,CAAC,cAAc,CAAC,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC,cAAc,CAAC;QAC5E,IAAI,CAAC,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC;QAC7B,IAAI,CAAC,SAAS,GAAG,OAAO,CAAC,SAAS,CAAC;QACnC,IAAI,CAAC,kBAAkB,GAAG,OAAO,CAAC,kBAAkB,CAAC;QACrD,IAAI,CAAC,eAAe,GAAG,OAAO,CAAC,eAAe,CAAC;QAC/C,IAAI,CAAC,aAAa,GAAG,OAAO,CAAC,aAAa,CAAC;QAC3C,IAAI,CAAC,aAAa,GAAG,CAAC,OAAO,CAAC,eAAe,IAAI,EAAE,CAAC,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,IAAI,CAAC;QAC3E,IAAI,CAAC,eAAe,GAAG,OAAO,CAAC,eAAe,IAAI,CAAC,GAAG,EAAE,GAAG,EAAE,GAAG,IAAI,CAAC;QACrE,IAAI,CAAC,sBAAsB,GAAG,OAAO,CAAC,sBAAsB,CAAC;IAC/D,CAAC;IAEM,KAAK,CAAC,KAAK;QAChB,MAAM,IAAI,CAAC,wBAAwB,EAAE,CAAC;QACtC,MAAM,IAAI,CAAC,iBAAiB,EAAE,CAAC;QAC/B,IAAI,CAAC,QAAQ,GAAG,WAAW,CAAC,GAAG,EAAE;YAC/B,KAAK,IAAI,CAAC,iBAAiB,EAAE,CAAC,KAAK,CAAC,CAAC,KAAc,EAAE,EAAE;gBACrD,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,YAAa,KAAe,CAAC,OAAO,EAAE,CAAC,CAAC;YAC5D,CAAC,CAAC,CAAC;QACL,CAAC,EAAE,IAAI,CAAC,eAAe,CAAC,CAAC;IAC3B,CAAC;IAEM,IAAI;QACT,IAAI,IAAI,CAAC,QAAQ,EAAE,CAAC;YAClB,aAAa,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;QAC/B,CAAC;IACH,CAAC;IAEM,uBAAuB,CAAC,QAAkC;QAC/D,MAAM,SAAS,GAAG,OAAO,QAAQ,EAAE,SAAS,KAAK,QAAQ,CAAC,CAAC,CAAC,QAAQ,CAAC,SAAS,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,SAAS,CAAC;QAClG,IAAI,SAAS,IAAI,SAAS,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YACtC,IAAI,CAAC,cAAc,GAAG,SAAS,CAAC,WAAW,EAAE,CAAC;QAChD,CAAC;IACH,CAAC;IAEM,mBAAmB;QACxB,IAAI,CAAC,IAAI,CAAC,MAAM,CAAC,SAAS,EAAE,CAAC;YAC3B,OAAO,SAAS,CAAC;QACnB,CAAC;QACD,OAAO;YACL,UAAU,EAAE;gBACV,SAAS,EAAE,IAAI,CAAC,MAAM,CAAC,SAAS,CAAC,WAAW,EAAE;gBAC9C,OAAO,EAAE,IAAI,CAAC,MAAM,CAAC,OAAO,IAAI,EAAE;gBAClC,SAAS,EAAE,IAAI,CAAC,MAAM,CAAC,SAAS,EAAE,WAAW,EAAE;aAChD;SACF,CAAC;IACJ,CAAC;IAEO,KAAK,CAAC,iBAAiB;QAC7B,IAAI,IAAI,CAAC,OAAO,EAAE,CAAC;YACjB,OAAO;QACT,CAAC;QACD,IAAI,CAAC,IAAI,CAAC,cAAc,EAAE,CAAC;YACzB,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,iBAAiB,CAAC,CAAC;YACrC,OAAO;QACT,CAAC;QACD,MAAM,KAAK,GAAG,MAAM,IAAI,CAAC,kBAAkB,EAAE,CAAC;QAC9C,IAAI,KAAK,EAAE,CAAC;YACV,OAAO;QACT,CAAC;QAED,IAAI,CAAC,OAAO,GAAG,IAAI,CAAC;QACpB,IAAI,CAAC;YACH,MAAM,IAAI,CAAC,kBAAkB,EAAE,CAAC;YAChC,MAAM,IAAI,CAAC,wBAAwB,EAAE,CAAC;YACtC,IAAI,IAAI,CAAC,sBAAsB,EAAE,CAAC;gBAChC,MAAM,IAAI,CAAC,sBAAsB,EAAE,CAAC;YACtC,CAAC;QACH,CAAC;gBAAS,CAAC;YACT,IAAI,CAAC,OAAO,GAAG,KAAK,CAAC;QACvB,CAAC;IACH,CAAC;IAEO,KAAK,CAAC,kBAAkB;QAC9B,IAAI,CAAC,IAAI,CAAC,MAAM,CAAC,SAAS,IAAI,CAAC,IAAI,CAAC,cAAc,EAAE,CAAC;YACnD,OAAO,KAAK,CAAC;QACf,CAAC;QACD,MAAM,SAAS,GAAG,IAAI,CAAC,MAAM,CAAC,SAAS,CAAC,OAAO,EAAE,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;QAC/D,IAAI,SAAS,IAAI,IAAI,CAAC,aAAa,EAAE,CAAC;YACpC,OAAO,KAAK,CAAC;QACf,CAAC;QACD,IAAI,CAAC,IAAI,CAAC,MAAM,CAAC,OAAO,EAAE,QAAQ,CAAC,IAAI,CAAC,cAAc,CAAC,EAAE,CAAC;YACxD,OAAO,KAAK,CAAC;QACf,CAAC;QACD,OAAO,IAAI,CAAC;IACd,CAAC;IAEO,KAAK,CAAC,wBAAwB;QACpC,IAAI,CAAC;YACH,MAAM,GAAG,GAAG,MAAM,kBAAE,CAAC,QAAQ,CAAC,IAAI,CAAC,eAAe,EAAE,MAAM,CAAC,CAAC;YAC5D,MAAM,IAAI,GAAG,IAAI,6BAAe,CAAC,GAAG,CAAC,CAAC;YACtC,MAAM,SAAS,GAAG,IAAI,CAAC,OAAO,CAAC,CAAC,CAAC,IAAI,IAAI,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;YACpE,MAAM,OAAO,GAAG,IAAI,CAAC,6BAA6B,CAAC,IAAI,CAAC,CAAC;YACzD,IAAI,CAAC,MAAM,GAAG;gBACZ,SAAS;gBACT,OAAO;gBACP,SAAS,EAAE,IAAI,IAAI,EAAE;aACtB,CAAC;QACJ,CAAC;QAAC,MAAM,CAAC;YACP,IAAI,CAAC,MAAM,GAAG,EAAE,CAAC;QACnB,CAAC;IACH,CAAC;IAEO,6BAA6B,CAAC,IAAqB;QACzD,MAAM,MAAM,GAAG,IAAI,GAAG,EAAU,CAAC;QACjC,MAAM,OAAO,GAAG,IAAI,CAAC,OAAO,CAAC;QAC7B,IAAI,OAAO,EAAE,CAAC;YACZ,MAAM,KAAK,GAAG,aAAa,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;YAC1C,IAAI,KAAK,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;gBACf,MAAM,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC,CAAC;YAC5C,CAAC;QACH,CAAC;QACD,MAAM,QAAQ,GAAG,IAAI,CAAC,cAAc,EAAE,KAAK,CAAC,GAAG,CAAC,CAAC;QACjD,IAAI,QAAQ,EAAE,CAAC;YACb,KAAK,MAAM,KAAK,IAAI,QAAQ,EAAE,CAAC;gBAC7B,MAAM,OAAO,GAAG,KAAK,CAAC,IAAI,EAAE,CAAC;gBAC7B,IAAI,OAAO,CAAC,WAAW,EAAE,CAAC,UAAU,CAAC,MAAM,CAAC,EAAE,CAAC;oBAC7C,MAAM,CAAC,GAAG,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC,CAAC;gBACpD,CAAC;YACH,CAAC;QACH,CAAC;QACD,OAAO,KAAK,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;IAC5B,CAAC;IAEO,KAAK,CAAC,kBAAkB;QAC9B,IAAI,CAAC,IAAI,CAAC,cAAc,EAAE,CAAC;YACzB,MAAM,IAAI,KAAK,CAAC,gBAAgB,CAAC,CAAC;QACpC,CAAC;QACD,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,MAAM,IAAI,CAAC,MAAM,eAAe,IAAI,CAAC,cAAc,GAAG,CAAC,CAAC;QACzE,MAAM,EAAE,UAAU,EAAE,GAAG,EAAE,GAAG,MAAM,IAAI,CAAC,iBAAiB,CAAC,IAAI,CAAC,cAAc,CAAC,CAAC;QAE9E,MAAM,IAAI,CAAC,eAAe,CAAC,IAAA,mBAAO,EAAC,IAAI,CAAC,kBAAkB,CAAC,CAAC,CAAC;QAC7D,MAAM,kBAAE,CAAC,SAAS,CAAC,IAAI,CAAC,kBAAkB,EAAE,UAAU,EAAE,MAAM,CAAC,CAAC;QAEhE,MAAM,QAAQ,GAAG,MAAM,KAAK,CAAC,IAAI,CAAC,QAAQ,EAAE;YAC1C,MAAM,EAAE,MAAM;YACd,OAAO,EAAE,EAAE,cAAc,EAAE,kBAAkB,EAAE;YAC/C,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC;gBACnB,MAAM,EAAE,IAAI,CAAC,MAAM;gBACnB,KAAK,EAAE,IAAI,CAAC,SAAS;gBACrB,GAAG;aACJ,CAAC;SACH,CAAC,CAAC;QAEH,IAAI,CAAC,QAAQ,CAAC,EAAE,EAAE,CAAC;YACjB,MAAM,IAAI,GAAG,MAAM,QAAQ,CAAC,IAAI,EAAE,CAAC;YACnC,MAAM,IAAI,KAAK,CAAC,UAAU,QAAQ,CAAC,MAAM,IAAI,QAAQ,CAAC,UAAU,IAAI,IAAI,EAAE,CAAC,CAAC;QAC9E,CAAC;QAED,MAAM,OAAO,GAAG,MAAM,QAAQ,CAAC,IAAI,EAAyB,CAAC;QAC7D,IAAI,CAAC,OAAO,CAAC,WAAW,EAAE,SAAS,EAAE,CAAC;YACpC,MAAM,IAAI,KAAK,CAAC,eAAe,CAAC,CAAC;QACnC,CAAC;QAED,MAAM,IAAI,CAAC,eAAe,CAAC,IAAA,mBAAO,EAAC,IAAI,CAAC,eAAe,CAAC,CAAC,CAAC;QAC1D,MAAM,kBAAE,CAAC,SAAS,CAAC,IAAI,CAAC,eAAe,EAAE,OAAO,CAAC,WAAW,CAAC,SAAS,EAAE,MAAM,CAAC,CAAC;QAChF,IAAI,IAAI,CAAC,aAAa,EAAE,CAAC;YACvB,MAAM,IAAI,CAAC,eAAe,CAAC,IAAA,mBAAO,EAAC,IAAI,CAAC,aAAa,CAAC,CAAC,CAAC;YACxD,MAAM,kBAAE,CAAC,SAAS,CAAC,IAAI,CAAC,aAAa,EAAE,OAAO,CAAC,WAAW,CAAC,SAAS,EAAE,MAAM,CAAC,CAAC;QAChF,CAAC;QACD,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,MAAM,IAAI,CAAC,MAAM,iBAAiB,OAAO,CAAC,WAAW,CAAC,SAAS,EAAE,CAAC,CAAC;IACtF,CAAC;IAEO,KAAK,CAAC,iBAAiB,CAAC,MAAc;QAC5C,MAAM,UAAU,GAAG,MAAM,qBAAI,CAAC,MAAM,CAAC,gBAAgB,EAAE,CAAC;QACxD,MAAM,CAAC,EAAE,GAAG,CAAC,GAAG,MAAM,qBAAI,CAAC,MAAM,CAAC,SAAS,CAAC;YAC1C,UAAU,EAAE,MAAM;YAClB,QAAQ,EAAE,CAAE,MAAM,CAAE;SACrB,EAAE,UAAU,CAAC,CAAC;QACf,OAAO;YACL,UAAU,EAAE,UAAU,CAAC,QAAQ,EAAE;YACjC,GAAG,EAAE,GAAG,CAAC,QAAQ,EAAE;SACpB,CAAC;IACJ,CAAC;IAEO,KAAK,CAAC,eAAe,CAAC,MAAc;QAC1C,IAAI,CAAC,MAAM,IAAI,MAAM,KAAK,GAAG,EAAE,CAAC;YAC9B,OAAO;QACT,CAAC;QACD,MAAM,kBAAE,CAAC,KAAK,CAAC,MAAM,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;IAC9C,CAAC;CACF;AArMD,8DAqMC","sourcesContent":["import { promises as fs } from 'node:fs';\nimport { dirname } from 'node:path';\nimport { X509Certificate } from 'node:crypto';\nimport acme from 'acme-client';\nimport { getLoggerFor } from 'global-logger-factory';\n\ninterface ClusterCertificateManagerOptions {\n signalEndpoint: string;\n nodeId: string;\n nodeToken: string;\n certificateKeyPath: string;\n certificatePath: string;\n fullChainPath?: string;\n renewBeforeDays?: number;\n checkIntervalMs?: number;\n onCertificateInstalled?: () => Promise<void> \| void;\n}\n\ninterface CertificateStatus {\n expiresAt?: Date;\n domains?: string[];\n updatedAt?: Date;\n}\n\ninterface CertificateResponse {\n status: string;\n certificate: {\n pem: string;\n fullChain: string;\n expiresAt: string;\n domains: string[];\n };\n}\n\nexport class ClusterCertificateManager {\n private readonly logger = getLoggerFor(this);\n private readonly endpoint: string;\n private readonly nodeId: string;\n private readonly nodeToken: string;\n private readonly certificateKeyPath: string;\n private readonly certificatePath: string;\n private readonly fullChainPath?: string;\n private readonly renewBeforeMs: number;\n private readonly checkIntervalMs: number;\n private readonly onCertificateInstalled?: () => Promise<void> \| void;\n private assignedDomain?: string;\n private status: CertificateStatus = {};\n private interval?: NodeJS.Timeout;\n private issuing = false;\n\n public constructor(options: ClusterCertificateManagerOptions) {\n this.endpoint = `${options.signalEndpoint.replace(/\\/$/u, '')}/certificate`;\n this.nodeId = options.nodeId;\n this.nodeToken = options.nodeToken;\n this.certificateKeyPath = options.certificateKeyPath;\n this.certificatePath = options.certificatePath;\n this.fullChainPath = options.fullChainPath;\n this.renewBeforeMs = (options.renewBeforeDays ?? 15) * 24 * 60 * 60 * 1000;\n this.checkIntervalMs = options.checkIntervalMs ?? 6 * 60 * 60 * 1000;\n this.onCertificateInstalled = options.onCertificateInstalled;\n }\n\n public async start(): Promise<void> {\n await this.refreshCertificateStatus();\n await this.ensureCertificate();\n this.interval = setInterval(() => {\n void this.ensureCertificate().catch((error: unknown) => {\n this.logger.error(`定期检查证书失败：${(error as Error).message}`);\n });\n }, this.checkIntervalMs);\n }\n\n public stop(): void {\n if (this.interval) {\n clearInterval(this.interval);\n }\n }\n\n public handleHeartbeatMetadata(metadata?: Record<string, unknown>): void {\n const subdomain = typeof metadata?.subdomain === 'string' ? metadata.subdomain.trim() : undefined;\n if (subdomain && subdomain.length > 0) {\n this.assignedDomain = subdomain.toLowerCase();\n }\n }\n\n public getHeartbeatPayload(): Record<string, unknown> \| undefined {\n if (!this.status.expiresAt) {\n return undefined;\n }\n return {\n deployment: {\n expiresAt: this.status.expiresAt.toISOString(),\n domains: this.status.domains ?? [],\n updatedAt: this.status.updatedAt?.toISOString(),\n },\n };\n }\n\n private async ensureCertificate(): Promise<void> {\n if (this.issuing) {\n return;\n }\n if (!this.assignedDomain) {\n this.logger.debug('尚未分配域名，等待下一次心跳。');\n return;\n }\n const valid = await this.isCertificateValid();\n if (valid) {\n return;\n }\n\n this.issuing = true;\n try {\n await this.requestCertificate();\n await this.refreshCertificateStatus();\n if (this.onCertificateInstalled) {\n await this.onCertificateInstalled();\n }\n } finally {\n this.issuing = false;\n }\n }\n\n private async isCertificateValid(): Promise<boolean> {\n if (!this.status.expiresAt \|\| !this.assignedDomain) {\n return false;\n }\n const remaining = this.status.expiresAt.getTime() - Date.now();\n if (remaining <= this.renewBeforeMs) {\n return false;\n }\n if (!this.status.domains?.includes(this.assignedDomain)) {\n return false;\n }\n return true;\n }\n\n private async refreshCertificateStatus(): Promise<void> {\n try {\n const pem = await fs.readFile(this.certificatePath, 'utf8');\n const cert = new X509Certificate(pem);\n const expiresAt = cert.validTo ? new Date(cert.validTo) : undefined;\n const domains = this.extractDomainsFromCertificate(cert);\n this.status = {\n expiresAt,\n domains,\n updatedAt: new Date(),\n };\n } catch {\n this.status = {};\n }\n }\n\n private extractDomainsFromCertificate(cert: X509Certificate): string[] {\n const result = new Set<string>();\n const subject = cert.subject;\n if (subject) {\n const match = /CN=([^,]+)/u.exec(subject);\n if (match?.[1]) {\n result.add(match[1].trim().toLowerCase());\n }\n }\n const altNames = cert.subjectAltName?.split(',');\n if (altNames) {\n for (const entry of altNames) {\n const trimmed = entry.trim();\n if (trimmed.toLowerCase().startsWith('dns:')) {\n result.add(trimmed.slice(4).trim().toLowerCase());\n }\n }\n }\n return Array.from(result);\n }\n\n private async requestCertificate(): Promise<void> {\n if (!this.assignedDomain) {\n throw new Error('无法申请证书：尚未分配域名。');\n }\n this.logger.info(`节点 ${this.nodeId} 正在向集群申请证书 (${this.assignedDomain})`);\n const { privateKey, csr } = await this.generateKeyAndCsr(this.assignedDomain);\n\n await this.ensureDirectory(dirname(this.certificateKeyPath));\n await fs.writeFile(this.certificateKeyPath, privateKey, 'utf8');\n\n const response = await fetch(this.endpoint, {\n method: 'POST',\n headers: { 'content-type': 'application/json' },\n body: JSON.stringify({\n nodeId: this.nodeId,\n token: this.nodeToken,\n csr,\n }),\n });\n\n if (!response.ok) {\n const text = await response.text();\n throw new Error(`申请证书失败：${response.status} ${response.statusText} ${text}`);\n }\n\n const payload = await response.json() as CertificateResponse;\n if (!payload.certificate?.fullChain) {\n throw new Error('集群返回数据缺少证书内容。');\n }\n\n await this.ensureDirectory(dirname(this.certificatePath));\n await fs.writeFile(this.certificatePath, payload.certificate.fullChain, 'utf8');\n if (this.fullChainPath) {\n await this.ensureDirectory(dirname(this.fullChainPath));\n await fs.writeFile(this.fullChainPath, payload.certificate.fullChain, 'utf8');\n }\n this.logger.info(`节点 ${this.nodeId} 已获取最新证书，有效期至 ${payload.certificate.expiresAt}`);\n }\n\n private async generateKeyAndCsr(domain: string): Promise<{ privateKey: string; csr: string }> {\n const privateKey = await acme.crypto.createPrivateKey();\n const [, csr] = await acme.crypto.createCsr({\n commonName: domain,\n altNames: [ domain ],\n }, privateKey);\n return {\n privateKey: privateKey.toString(),\n csr: csr.toString(),\n };\n }\n\n private async ensureDirectory(target: string): Promise<void> {\n if (!target \|\| target === '.') {\n return;\n }\n await fs.mkdir(target, { recursive: true });\n }\n}\n"]}
1	+ {"version":3,"file":"ClusterCertificateManager.js","sourceRoot":"","sources":["../../../src/edge/acme/ClusterCertificateManager.ts"],"names":[],"mappings":";;;;;;AAAA,qCAAyC;AACzC,yCAAoC;AACpC,6CAA8C;AAC9C,8DAA+B;AAC/B,iEAAqD;AAyCrD,MAAa,yBAAyB;IAgBpC,YAAmB,OAAyC;QAf3C,WAAM,GAAG,IAAA,oCAAY,EAAC,IAAI,CAAC,CAAC;QAWrC,WAAM,GAAsB,EAAE,CAAC;QAE/B,YAAO,GAAG,KAAK,CAAC;QAGtB,IAAI,CAAC,QAAQ,GAAG,GAAG,OAAO,CAAC,cAAc,CAAC,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC,cAAc,CAAC;QAC5E,IAAI,CAAC,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC;QAC7B,IAAI,CAAC,SAAS,GAAG,OAAO,CAAC,SAAS,CAAC;QACnC,IAAI,CAAC,kBAAkB,GAAG,OAAO,CAAC,kBAAkB,CAAC;QACrD,IAAI,CAAC,eAAe,GAAG,OAAO,CAAC,eAAe,CAAC;QAC/C,IAAI,CAAC,aAAa,GAAG,OAAO,CAAC,aAAa,CAAC;QAC3C,IAAI,CAAC,aAAa,GAAG,CAAC,OAAO,CAAC,eAAe,IAAI,EAAE,CAAC,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,IAAI,CAAC;QAC3E,IAAI,CAAC,eAAe,GAAG,OAAO,CAAC,eAAe,IAAI,CAAC,GAAG,EAAE,GAAG,EAAE,GAAG,IAAI,CAAC;QACrE,IAAI,CAAC,sBAAsB,GAAG,OAAO,CAAC,sBAAsB,CAAC;IAC/D,CAAC;IAEM,KAAK,CAAC,KAAK;QAChB,MAAM,IAAI,CAAC,wBAAwB,EAAE,CAAC;QACtC,MAAM,IAAI,CAAC,iBAAiB,EAAE,CAAC;QAC/B,IAAI,CAAC,QAAQ,GAAG,WAAW,CAAC,GAAG,EAAE;YAC/B,KAAK,IAAI,CAAC,iBAAiB,EAAE,CAAC,KAAK,CAAC,CAAC,KAAc,EAAE,EAAE;gBACrD,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,YAAa,KAAe,CAAC,OAAO,EAAE,CAAC,CAAC;YAC5D,CAAC,CAAC,CAAC;QACL,CAAC,EAAE,IAAI,CAAC,eAAe,CAAC,CAAC;IAC3B,CAAC;IAEM,IAAI;QACT,IAAI,IAAI,CAAC,QAAQ,EAAE,CAAC;YAClB,aAAa,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;QAC/B,CAAC;IACH,CAAC;IAEM,uBAAuB,CAAC,QAAkC;QAC/D,MAAM,SAAS,GAAG,OAAO,QAAQ,EAAE,SAAS,KAAK,QAAQ,CAAC,CAAC,CAAC,QAAQ,CAAC,SAAS,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,SAAS,CAAC;QAClG,IAAI,SAAS,IAAI,SAAS,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YACtC,IAAI,CAAC,cAAc,GAAG,SAAS,CAAC,WAAW,EAAE,CAAC;QAChD,CAAC;IACH,CAAC;IAEM,mBAAmB;QACxB,IAAI,CAAC,IAAI,CAAC,MAAM,CAAC,SAAS,EAAE,CAAC;YAC3B,OAAO,SAAS,CAAC;QACnB,CAAC;QACD,OAAO;YACL,UAAU,EAAE;gBACV,SAAS,EAAE,IAAI,CAAC,MAAM,CAAC,SAAS,CAAC,WAAW,EAAE;gBAC9C,OAAO,EAAE,IAAI,CAAC,MAAM,CAAC,OAAO,IAAI,EAAE;gBAClC,SAAS,EAAE,IAAI,CAAC,MAAM,CAAC,SAAS,EAAE,WAAW,EAAE;aAChD;SACF,CAAC;IACJ,CAAC;IAEM,KAAK,CAAC,qBAAqB;QAChC,MAAM,IAAI,CAAC,wBAAwB,EAAE,CAAC;QACtC,IAAI,CAAC,IAAI,CAAC,MAAM,CAAC,SAAS,EAAE,CAAC;YAC3B,OAAO,EAAE,MAAM,EAAE,SAAS,EAAE,CAAC;QAC/B,CAAC;QACD,OAAO;YACL,MAAM,EAAE,MAAM,IAAI,CAAC,kBAAkB,EAAE,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,aAAa;YACjE,SAAS,EAAE,IAAI,CAAC,MAAM,CAAC,SAAS,CAAC,WAAW,EAAE;YAC9C,OAAO,EAAE,IAAI,CAAC,MAAM,CAAC,OAAO,IAAI,EAAE;YAClC,SAAS,EAAE,IAAI,CAAC,MAAM,CAAC,SAAS,EAAE,WAAW,EAAE;SAChD,CAAC;IACJ,CAAC;IAEM,WAAW;QAChB,OAAO,OAAO,CAAC,IAAI,CAAC,cAAc,CAAC,CAAC;IACtC,CAAC;IAEM,KAAK,CAAC,gBAAgB;QAC3B,IAAI,IAAI,CAAC,OAAO,EAAE,CAAC;YACjB,MAAM,6BAA6B,CACjC,GAAG,EACH,8BAA8B,EAC9B,wCAAwC,CACzC,CAAC;QACJ,CAAC;QACD,IAAI,CAAC,IAAI,CAAC,cAAc,EAAE,CAAC;YACzB,MAAM,6BAA6B,CACjC,GAAG,EACH,iCAAiC,EACjC,wEAAwE,CACzE,CAAC;QACJ,CAAC;QACD,IAAI,CAAC,OAAO,GAAG,IAAI,CAAC;QACpB,IAAI,CAAC;YACH,MAAM,IAAI,CAAC,kBAAkB,EAAE,CAAC;YAChC,MAAM,IAAI,CAAC,wBAAwB,EAAE,CAAC;YACtC,IAAI,IAAI,CAAC,sBAAsB,EAAE,CAAC;gBAChC,MAAM,IAAI,CAAC,sBAAsB,EAAE,CAAC;YACtC,CAAC;YACD,OAAO,EAAE,MAAM,EAAE,SAAS,EAAE,CAAC;QAC/B,CAAC;gBAAS,CAAC;YACT,IAAI,CAAC,OAAO,GAAG,KAAK,CAAC;QACvB,CAAC;IACH,CAAC;IAEO,KAAK,CAAC,iBAAiB;QAC7B,IAAI,IAAI,CAAC,OAAO,EAAE,CAAC;YACjB,OAAO;QACT,CAAC;QACD,IAAI,CAAC,IAAI,CAAC,cAAc,EAAE,CAAC;YACzB,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,iBAAiB,CAAC,CAAC;YACrC,OAAO;QACT,CAAC;QACD,MAAM,KAAK,GAAG,MAAM,IAAI,CAAC,kBAAkB,EAAE,CAAC;QAC9C,IAAI,KAAK,EAAE,CAAC;YACV,OAAO;QACT,CAAC;QAED,IAAI,CAAC,OAAO,GAAG,IAAI,CAAC;QACpB,IAAI,CAAC;YACH,MAAM,IAAI,CAAC,kBAAkB,EAAE,CAAC;YAChC,MAAM,IAAI,CAAC,wBAAwB,EAAE,CAAC;YACtC,IAAI,IAAI,CAAC,sBAAsB,EAAE,CAAC;gBAChC,MAAM,IAAI,CAAC,sBAAsB,EAAE,CAAC;YACtC,CAAC;QACH,CAAC;gBAAS,CAAC;YACT,IAAI,CAAC,OAAO,GAAG,KAAK,CAAC;QACvB,CAAC;IACH,CAAC;IAEO,KAAK,CAAC,kBAAkB;QAC9B,IAAI,CAAC,IAAI,CAAC,MAAM,CAAC,SAAS,IAAI,CAAC,IAAI,CAAC,cAAc,EAAE,CAAC;YACnD,OAAO,KAAK,CAAC;QACf,CAAC;QACD,MAAM,SAAS,GAAG,IAAI,CAAC,MAAM,CAAC,SAAS,CAAC,OAAO,EAAE,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;QAC/D,IAAI,SAAS,IAAI,IAAI,CAAC,aAAa,EAAE,CAAC;YACpC,OAAO,KAAK,CAAC;QACf,CAAC;QACD,IAAI,CAAC,IAAI,CAAC,MAAM,CAAC,OAAO,EAAE,QAAQ,CAAC,IAAI,CAAC,cAAc,CAAC,EAAE,CAAC;YACxD,OAAO,KAAK,CAAC;QACf,CAAC;QACD,OAAO,IAAI,CAAC;IACd,CAAC;IAEO,KAAK,CAAC,wBAAwB;QACpC,IAAI,CAAC;YACH,MAAM,GAAG,GAAG,MAAM,kBAAE,CAAC,QAAQ,CAAC,IAAI,CAAC,eAAe,EAAE,MAAM,CAAC,CAAC;YAC5D,MAAM,IAAI,GAAG,IAAI,6BAAe,CAAC,GAAG,CAAC,CAAC;YACtC,MAAM,SAAS,GAAG,IAAI,CAAC,OAAO,CAAC,CAAC,CAAC,IAAI,IAAI,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;YACpE,MAAM,OAAO,GAAG,IAAI,CAAC,6BAA6B,CAAC,IAAI,CAAC,CAAC;YACzD,IAAI,CAAC,MAAM,GAAG;gBACZ,SAAS;gBACT,OAAO;gBACP,SAAS,EAAE,IAAI,IAAI,EAAE;aACtB,CAAC;QACJ,CAAC;QAAC,MAAM,CAAC;YACP,IAAI,CAAC,MAAM,GAAG,EAAE,CAAC;QACnB,CAAC;IACH,CAAC;IAEO,6BAA6B,CAAC,IAAqB;QACzD,MAAM,MAAM,GAAG,IAAI,GAAG,EAAU,CAAC;QACjC,MAAM,OAAO,GAAG,IAAI,CAAC,OAAO,CAAC;QAC7B,IAAI,OAAO,EAAE,CAAC;YACZ,MAAM,KAAK,GAAG,aAAa,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;YAC1C,IAAI,KAAK,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;gBACf,MAAM,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC,CAAC;YAC5C,CAAC;QACH,CAAC;QACD,MAAM,QAAQ,GAAG,IAAI,CAAC,cAAc,EAAE,KAAK,CAAC,GAAG,CAAC,CAAC;QACjD,IAAI,QAAQ,EAAE,CAAC;YACb,KAAK,MAAM,KAAK,IAAI,QAAQ,EAAE,CAAC;gBAC7B,MAAM,OAAO,GAAG,KAAK,CAAC,IAAI,EAAE,CAAC;gBAC7B,IAAI,OAAO,CAAC,WAAW,EAAE,CAAC,UAAU,CAAC,MAAM,CAAC,EAAE,CAAC;oBAC7C,MAAM,CAAC,GAAG,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC,CAAC;gBACpD,CAAC;YACH,CAAC;QACH,CAAC;QACD,OAAO,KAAK,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;IAC5B,CAAC;IAEO,KAAK,CAAC,kBAAkB;QAC9B,IAAI,CAAC,IAAI,CAAC,cAAc,EAAE,CAAC;YACzB,MAAM,IAAI,KAAK,CAAC,gBAAgB,CAAC,CAAC;QACpC,CAAC;QACD,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,MAAM,IAAI,CAAC,MAAM,eAAe,IAAI,CAAC,cAAc,GAAG,CAAC,CAAC;QACzE,MAAM,EAAE,UAAU,EAAE,GAAG,EAAE,GAAG,MAAM,IAAI,CAAC,iBAAiB,CAAC,IAAI,CAAC,cAAc,CAAC,CAAC;QAE9E,MAAM,IAAI,CAAC,eAAe,CAAC,IAAA,mBAAO,EAAC,IAAI,CAAC,kBAAkB,CAAC,CAAC,CAAC;QAC7D,MAAM,kBAAE,CAAC,SAAS,CAAC,IAAI,CAAC,kBAAkB,EAAE,UAAU,EAAE,MAAM,CAAC,CAAC;QAEhE,MAAM,QAAQ,GAAG,MAAM,KAAK,CAAC,IAAI,CAAC,QAAQ,EAAE;YAC1C,MAAM,EAAE,MAAM;YACd,OAAO,EAAE,EAAE,cAAc,EAAE,kBAAkB,EAAE;YAC/C,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC;gBACnB,MAAM,EAAE,IAAI,CAAC,MAAM;gBACnB,KAAK,EAAE,IAAI,CAAC,SAAS;gBACrB,GAAG;aACJ,CAAC;SACH,CAAC,CAAC;QAEH,IAAI,CAAC,QAAQ,CAAC,EAAE,EAAE,CAAC;YACjB,MAAM,IAAI,GAAG,MAAM,QAAQ,CAAC,IAAI,EAAE,CAAC;YACnC,MAAM,IAAI,KAAK,CAAC,UAAU,QAAQ,CAAC,MAAM,IAAI,QAAQ,CAAC,UAAU,IAAI,IAAI,EAAE,CAAC,CAAC;QAC9E,CAAC;QAED,MAAM,OAAO,GAAG,MAAM,QAAQ,CAAC,IAAI,EAAyB,CAAC;QAC7D,IAAI,CAAC,OAAO,CAAC,WAAW,EAAE,SAAS,EAAE,CAAC;YACpC,MAAM,IAAI,KAAK,CAAC,eAAe,CAAC,CAAC;QACnC,CAAC;QAED,MAAM,IAAI,CAAC,eAAe,CAAC,IAAA,mBAAO,EAAC,IAAI,CAAC,eAAe,CAAC,CAAC,CAAC;QAC1D,MAAM,kBAAE,CAAC,SAAS,CAAC,IAAI,CAAC,eAAe,EAAE,OAAO,CAAC,WAAW,CAAC,SAAS,EAAE,MAAM,CAAC,CAAC;QAChF,IAAI,IAAI,CAAC,aAAa,EAAE,CAAC;YACvB,MAAM,IAAI,CAAC,eAAe,CAAC,IAAA,mBAAO,EAAC,IAAI,CAAC,aAAa,CAAC,CAAC,CAAC;YACxD,MAAM,kBAAE,CAAC,SAAS,CAAC,IAAI,CAAC,aAAa,EAAE,OAAO,CAAC,WAAW,CAAC,SAAS,EAAE,MAAM,CAAC,CAAC;QAChF,CAAC;QACD,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,MAAM,IAAI,CAAC,MAAM,iBAAiB,OAAO,CAAC,WAAW,CAAC,SAAS,EAAE,CAAC,CAAC;IACtF,CAAC;IAEO,KAAK,CAAC,iBAAiB,CAAC,MAAc;QAC5C,MAAM,UAAU,GAAG,MAAM,qBAAI,CAAC,MAAM,CAAC,gBAAgB,EAAE,CAAC;QACxD,MAAM,CAAC,EAAE,GAAG,CAAC,GAAG,MAAM,qBAAI,CAAC,MAAM,CAAC,SAAS,CAAC;YAC1C,UAAU,EAAE,MAAM;YAClB,QAAQ,EAAE,CAAE,MAAM,CAAE;SACrB,EAAE,UAAU,CAAC,CAAC;QACf,OAAO;YACL,UAAU,EAAE,UAAU,CAAC,QAAQ,EAAE;YACjC,GAAG,EAAE,GAAG,CAAC,QAAQ,EAAE;SACpB,CAAC;IACJ,CAAC;IAEO,KAAK,CAAC,eAAe,CAAC,MAAc;QAC1C,IAAI,CAAC,MAAM,IAAI,MAAM,KAAK,GAAG,EAAE,CAAC;YAC9B,OAAO;QACT,CAAC;QACD,MAAM,kBAAE,CAAC,KAAK,CAAC,MAAM,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;IAC9C,CAAC;CACF;AAlPD,8DAkPC;AAED,SAAS,6BAA6B,CAAC,UAAkB,EAAE,IAAY,EAAE,OAAe;IAItF,OAAO,MAAM,CAAC,MAAM,CAAC,IAAI,KAAK,CAAC,OAAO,CAAC,EAAE,EAAE,UAAU,EAAE,IAAI,EAAE,CAAC,CAAC;AACjE,CAAC","sourcesContent":["import { promises as fs } from 'node:fs';\nimport { dirname } from 'node:path';\nimport { X509Certificate } from 'node:crypto';\nimport acme from 'acme-client';\nimport { getLoggerFor } from 'global-logger-factory';\n\ninterface ClusterCertificateManagerOptions {\n signalEndpoint: string;\n nodeId: string;\n nodeToken: string;\n certificateKeyPath: string;\n certificatePath: string;\n fullChainPath?: string;\n renewBeforeDays?: number;\n checkIntervalMs?: number;\n onCertificateInstalled?: () => Promise<void> \| void;\n}\n\ninterface CertificateStatus {\n expiresAt?: Date;\n domains?: string[];\n updatedAt?: Date;\n}\n\nexport interface RuntimeCertificateStatus {\n status: 'valid' \| 'renewal_due' \| 'missing';\n expiresAt?: string;\n domains?: string[];\n updatedAt?: string;\n}\n\nexport interface RuntimeCertificateRenewalResult {\n status: 'renewed';\n}\n\ninterface CertificateResponse {\n status: string;\n certificate: {\n pem: string;\n fullChain: string;\n expiresAt: string;\n domains: string[];\n };\n}\n\nexport class ClusterCertificateManager {\n private readonly logger = getLoggerFor(this);\n private readonly endpoint: string;\n private readonly nodeId: string;\n private readonly nodeToken: string;\n private readonly certificateKeyPath: string;\n private readonly certificatePath: string;\n private readonly fullChainPath?: string;\n private readonly renewBeforeMs: number;\n private readonly checkIntervalMs: number;\n private readonly onCertificateInstalled?: () => Promise<void> \| void;\n private assignedDomain?: string;\n private status: CertificateStatus = {};\n private interval?: NodeJS.Timeout;\n private issuing = false;\n\n public constructor(options: ClusterCertificateManagerOptions) {\n this.endpoint = `${options.signalEndpoint.replace(/\\/$/u, '')}/certificate`;\n this.nodeId = options.nodeId;\n this.nodeToken = options.nodeToken;\n this.certificateKeyPath = options.certificateKeyPath;\n this.certificatePath = options.certificatePath;\n this.fullChainPath = options.fullChainPath;\n this.renewBeforeMs = (options.renewBeforeDays ?? 15) * 24 * 60 * 60 * 1000;\n this.checkIntervalMs = options.checkIntervalMs ?? 6 * 60 * 60 * 1000;\n this.onCertificateInstalled = options.onCertificateInstalled;\n }\n\n public async start(): Promise<void> {\n await this.refreshCertificateStatus();\n await this.ensureCertificate();\n this.interval = setInterval(() => {\n void this.ensureCertificate().catch((error: unknown) => {\n this.logger.error(`定期检查证书失败：${(error as Error).message}`);\n });\n }, this.checkIntervalMs);\n }\n\n public stop(): void {\n if (this.interval) {\n clearInterval(this.interval);\n }\n }\n\n public handleHeartbeatMetadata(metadata?: Record<string, unknown>): void {\n const subdomain = typeof metadata?.subdomain === 'string' ? metadata.subdomain.trim() : undefined;\n if (subdomain && subdomain.length > 0) {\n this.assignedDomain = subdomain.toLowerCase();\n }\n }\n\n public getHeartbeatPayload(): Record<string, unknown> \| undefined {\n if (!this.status.expiresAt) {\n return undefined;\n }\n return {\n deployment: {\n expiresAt: this.status.expiresAt.toISOString(),\n domains: this.status.domains ?? [],\n updatedAt: this.status.updatedAt?.toISOString(),\n },\n };\n }\n\n public async readCertificateStatus(): Promise<RuntimeCertificateStatus> {\n await this.refreshCertificateStatus();\n if (!this.status.expiresAt) {\n return { status: 'missing' };\n }\n return {\n status: await this.isCertificateValid() ? 'valid' : 'renewal_due',\n expiresAt: this.status.expiresAt.toISOString(),\n domains: this.status.domains ?? [],\n updatedAt: this.status.updatedAt?.toISOString(),\n };\n }\n\n public isAvailable(): boolean {\n return Boolean(this.assignedDomain);\n }\n\n public async renewCertificate(): Promise<RuntimeCertificateRenewalResult> {\n if (this.issuing) {\n throw createCertificateRenewalError(\n 409,\n 'certificate_renewal_conflict',\n 'Certificate renewal is already running',\n );\n }\n if (!this.assignedDomain) {\n throw createCertificateRenewalError(\n 503,\n 'certificate_renewal_unavailable',\n 'Certificate renewal is unavailable before the cluster assigns a domain',\n );\n }\n this.issuing = true;\n try {\n await this.requestCertificate();\n await this.refreshCertificateStatus();\n if (this.onCertificateInstalled) {\n await this.onCertificateInstalled();\n }\n return { status: 'renewed' };\n } finally {\n this.issuing = false;\n }\n }\n\n private async ensureCertificate(): Promise<void> {\n if (this.issuing) {\n return;\n }\n if (!this.assignedDomain) {\n this.logger.debug('尚未分配域名，等待下一次心跳。');\n return;\n }\n const valid = await this.isCertificateValid();\n if (valid) {\n return;\n }\n\n this.issuing = true;\n try {\n await this.requestCertificate();\n await this.refreshCertificateStatus();\n if (this.onCertificateInstalled) {\n await this.onCertificateInstalled();\n }\n } finally {\n this.issuing = false;\n }\n }\n\n private async isCertificateValid(): Promise<boolean> {\n if (!this.status.expiresAt \|\| !this.assignedDomain) {\n return false;\n }\n const remaining = this.status.expiresAt.getTime() - Date.now();\n if (remaining <= this.renewBeforeMs) {\n return false;\n }\n if (!this.status.domains?.includes(this.assignedDomain)) {\n return false;\n }\n return true;\n }\n\n private async refreshCertificateStatus(): Promise<void> {\n try {\n const pem = await fs.readFile(this.certificatePath, 'utf8');\n const cert = new X509Certificate(pem);\n const expiresAt = cert.validTo ? new Date(cert.validTo) : undefined;\n const domains = this.extractDomainsFromCertificate(cert);\n this.status = {\n expiresAt,\n domains,\n updatedAt: new Date(),\n };\n } catch {\n this.status = {};\n }\n }\n\n private extractDomainsFromCertificate(cert: X509Certificate): string[] {\n const result = new Set<string>();\n const subject = cert.subject;\n if (subject) {\n const match = /CN=([^,]+)/u.exec(subject);\n if (match?.[1]) {\n result.add(match[1].trim().toLowerCase());\n }\n }\n const altNames = cert.subjectAltName?.split(',');\n if (altNames) {\n for (const entry of altNames) {\n const trimmed = entry.trim();\n if (trimmed.toLowerCase().startsWith('dns:')) {\n result.add(trimmed.slice(4).trim().toLowerCase());\n }\n }\n }\n return Array.from(result);\n }\n\n private async requestCertificate(): Promise<void> {\n if (!this.assignedDomain) {\n throw new Error('无法申请证书：尚未分配域名。');\n }\n this.logger.info(`节点 ${this.nodeId} 正在向集群申请证书 (${this.assignedDomain})`);\n const { privateKey, csr } = await this.generateKeyAndCsr(this.assignedDomain);\n\n await this.ensureDirectory(dirname(this.certificateKeyPath));\n await fs.writeFile(this.certificateKeyPath, privateKey, 'utf8');\n\n const response = await fetch(this.endpoint, {\n method: 'POST',\n headers: { 'content-type': 'application/json' },\n body: JSON.stringify({\n nodeId: this.nodeId,\n token: this.nodeToken,\n csr,\n }),\n });\n\n if (!response.ok) {\n const text = await response.text();\n throw new Error(`申请证书失败：${response.status} ${response.statusText} ${text}`);\n }\n\n const payload = await response.json() as CertificateResponse;\n if (!payload.certificate?.fullChain) {\n throw new Error('集群返回数据缺少证书内容。');\n }\n\n await this.ensureDirectory(dirname(this.certificatePath));\n await fs.writeFile(this.certificatePath, payload.certificate.fullChain, 'utf8');\n if (this.fullChainPath) {\n await this.ensureDirectory(dirname(this.fullChainPath));\n await fs.writeFile(this.fullChainPath, payload.certificate.fullChain, 'utf8');\n }\n this.logger.info(`节点 ${this.nodeId} 已获取最新证书，有效期至 ${payload.certificate.expiresAt}`);\n }\n\n private async generateKeyAndCsr(domain: string): Promise<{ privateKey: string; csr: string }> {\n const privateKey = await acme.crypto.createPrivateKey();\n const [, csr] = await acme.crypto.createCsr({\n commonName: domain,\n altNames: [ domain ],\n }, privateKey);\n return {\n privateKey: privateKey.toString(),\n csr: csr.toString(),\n };\n }\n\n private async ensureDirectory(target: string): Promise<void> {\n if (!target \|\| target === '.') {\n return;\n }\n await fs.mkdir(target, { recursive: true });\n }\n}\n\nfunction createCertificateRenewalError(statusCode: number, code: string, message: string): Error & {\n statusCode: number;\n code: string;\n} {\n return Object.assign(new Error(message), { statusCode, code });\n}\n"]}

package/dist/extensions/ExtensionRuntime.d.ts ADDED Viewed

@@ -0,0 +1,17 @@
+import type { ReadResult } from '@undefineds.co/extensions';
+import type { EmbeddingService } from '../ai/service/EmbeddingService';
+import type { CredentialResolver, ExtensionContext, ExtensionEmbedInput, ExtensionEmbedResult, ExtensionFetch, ExtensionReadInput, ExtensionRuntime } from './types';
+export interface DefaultExtensionRuntimeOptions {
+    credentialResolver: CredentialResolver;
+    embeddingService?: Pick<EmbeddingService, 'embedBatch'>;
+    fetch?: ExtensionFetch;
+}
+export declare class DefaultExtensionRuntime implements ExtensionRuntime {
+    private readonly credentialResolver;
+    private readonly embeddingService?;
+    private readonly providerFetch?;
+    constructor(options: DefaultExtensionRuntimeOptions);
+    read(context: ExtensionContext, input: ExtensionReadInput): Promise<ReadResult>;
+    embed(context: ExtensionContext, input: ExtensionEmbedInput): Promise<ExtensionEmbedResult>;
+    private resolveApiKeyCredential;
+}

package/dist/extensions/ExtensionRuntime.js ADDED Viewed

@@ -0,0 +1,171 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.DefaultExtensionRuntime = void 0;
+const extensions_1 = require("@undefineds.co/extensions");
+class DefaultExtensionRuntime {
+    constructor(options) {
+        this.credentialResolver = options.credentialResolver;
+        this.embeddingService = options.embeddingService;
+        this.providerFetch = options.fetch;
+    }
+    async read(context, input) {
+        const model = parseModelRef(input.model);
+        if (model.provider !== 'paddleocr') {
+            throw new Error(`No reader extension registered for provider: ${model.provider}`);
+        }
+        const startedAt = Date.now();
+        try {
+            const credential = await this.resolveApiKeyCredential({
+                service: 'ai',
+                capability: 'reader',
+                provider: model.provider,
+                credentialId: normalizeResourceKey(input.credential),
+                model: model.iri,
+            }, context);
+            const reader = (0, extensions_1.createPaddleOcrReader)({
+                endpoint: credential.baseUrl,
+                apiKey: credential.apiKey,
+                model: model.model,
+                fetch: this.providerFetch,
+            });
+            const result = await reader.read({
+                source: input.source,
+                output: normalizeReaderOutput(input.output),
+                pages: input.pages,
+                model: model.model,
+                options: input.options,
+            }, {
+                signal: input.signal ?? context.signal,
+            });
+            context.emit?.({
+                type: 'extension.completed',
+                capability: 'reader',
+                provider: model.provider,
+                model: model.model,
+                latencyMs: Date.now() - startedAt,
+                usage: result.usage,
+            });
+            return result;
+        }
+        catch (error) {
+            context.emit?.({
+                type: 'extension.failed',
+                capability: 'reader',
+                provider: model.provider,
+                model: model.model,
+                latencyMs: Date.now() - startedAt,
+                error: error instanceof Error ? error.message : String(error),
+            });
+            throw error;
+        }
+    }
+    async embed(context, input) {
+        if (!this.embeddingService) {
+            throw new Error('No embedding service registered for ExtensionRuntime');
+        }
+        const model = parseModelRef(input.model);
+        const startedAt = Date.now();
+        try {
+            const credential = await this.resolveApiKeyCredential({
+                service: 'ai',
+                capability: 'embedding',
+                provider: model.provider,
+                credentialId: normalizeResourceKey(input.credential),
+                model: model.iri,
+            }, context);
+            const vectors = await this.embeddingService.embedBatch(input.texts, toAiCredential(credential), model.model);
+            context.emit?.({
+                type: 'extension.completed',
+                capability: 'embedding',
+                provider: model.provider,
+                model: model.model,
+                latencyMs: Date.now() - startedAt,
+            });
+            return { vectors };
+        }
+        catch (error) {
+            context.emit?.({
+                type: 'extension.failed',
+                capability: 'embedding',
+                provider: model.provider,
+                model: model.model,
+                latencyMs: Date.now() - startedAt,
+                error: error instanceof Error ? error.message : String(error),
+            });
+            throw error;
+        }
+    }
+    async resolveApiKeyCredential(input, context) {
+        const credential = await this.credentialResolver.resolve(input, context);
+        if (!hasApiKeyCredential(credential)) {
+            throw new Error(`No API key credential available for provider: ${input.provider}`);
+        }
+        return credential;
+    }
+}
+exports.DefaultExtensionRuntime = DefaultExtensionRuntime;
+function hasApiKeyCredential(credential) {
+    return typeof credential?.apiKey === 'string' && credential.apiKey.length > 0;
+}
+function toAiCredential(credential) {
+    return {
+        provider: credential.provider,
+        apiKey: credential.apiKey,
+        credentialId: credential.credentialId,
+        baseUrl: credential.baseUrl,
+        proxyUrl: credential.proxyUrl,
+    };
+}
+function parseModelRef(model) {
+    const trimmed = model.trim();
+    if (!trimmed) {
+        throw new Error('Model URI is required');
+    }
+    const [withoutFragment, fragment] = trimmed.split('#');
+    const provider = providerFromModelPath(withoutFragment);
+    const modelId = fragment?.trim() || lastPathSegment(withoutFragment);
+    if (!provider || !modelId) {
+        throw new Error(`Cannot derive provider/model from model URI: ${model}`);
+    }
+    return {
+        iri: trimmed,
+        provider,
+        model: decodeURIComponent(modelId),
+    };
+}
+function providerFromModelPath(value) {
+    const clean = value.replace(/\/+$/u, '');
+    const segments = clean.split('/').filter(Boolean);
+    const last = segments[segments.length - 1] ?? '';
+    if (last.endsWith('.ttl')) {
+        return normalizeProviderId(last.slice(0, -4));
+    }
+    const providerSegment = segments[segments.length - 2] ?? last;
+    return normalizeProviderId(providerSegment.replace(/\.ttl$/u, ''));
+}
+function lastPathSegment(value) {
+    const clean = value.replace(/\/+$/u, '');
+    return clean.split('/').filter(Boolean).pop() ?? '';
+}
+function normalizeProviderId(value) {
+    const id = decodeURIComponent(value).trim().toLowerCase();
+    return id === 'paddle' ? 'paddleocr' : id;
+}
+function normalizeResourceKey(value) {
+    if (!value?.trim())
+        return undefined;
+    const trimmed = value.trim();
+    if (trimmed.includes('#'))
+        return trimmed.split('#').pop() || trimmed;
+    const clean = trimmed.replace(/\/+$/u, '');
+    const tail = clean.split('/').filter(Boolean).pop() ?? clean;
+    return tail.endsWith('.ttl') ? tail.slice(0, -4) : tail;
+}
+function normalizeReaderOutput(output) {
+    if (output === 'text')
+        return 'text';
+    if (output === 'structured')
+        return 'structured';
+    return 'markdown';
+}
+//# sourceMappingURL=ExtensionRuntime.js.map

package/dist/extensions/ExtensionRuntime.js.map ADDED Viewed

@@ -0,0 +1 @@

+ {"version":3,"file":"ExtensionRuntime.js","sourceRoot":"","sources":["../../src/extensions/ExtensionRuntime.ts"],"names":[],"mappings":";;;AAAA,0DAAkE;AA6BlE,MAAa,uBAAuB;IAKlC,YAAmB,OAAuC;QACxD,IAAI,CAAC,kBAAkB,GAAG,OAAO,CAAC,kBAAkB,CAAC;QACrD,IAAI,CAAC,gBAAgB,GAAG,OAAO,CAAC,gBAAgB,CAAC;QACjD,IAAI,CAAC,aAAa,GAAG,OAAO,CAAC,KAAK,CAAC;IACrC,CAAC;IAEM,KAAK,CAAC,IAAI,CAAC,OAAyB,EAAE,KAAyB;QACpE,MAAM,KAAK,GAAG,aAAa,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC;QACzC,IAAI,KAAK,CAAC,QAAQ,KAAK,WAAW,EAAE,CAAC;YACnC,MAAM,IAAI,KAAK,CAAC,gDAAgD,KAAK,CAAC,QAAQ,EAAE,CAAC,CAAC;QACpF,CAAC;QAED,MAAM,SAAS,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;QAC7B,IAAI,CAAC;YACH,MAAM,UAAU,GAAG,MAAM,IAAI,CAAC,uBAAuB,CAAC;gBACpD,OAAO,EAAE,IAAI;gBACb,UAAU,EAAE,QAAQ;gBACpB,QAAQ,EAAE,KAAK,CAAC,QAAQ;gBACxB,YAAY,EAAE,oBAAoB,CAAC,KAAK,CAAC,UAAU,CAAC;gBACpD,KAAK,EAAE,KAAK,CAAC,GAAG;aACjB,EAAE,OAAO,CAAC,CAAC;YAEZ,MAAM,MAAM,GAAG,IAAA,kCAAqB,EAAC;gBACnC,QAAQ,EAAE,UAAU,CAAC,OAAO;gBAC5B,MAAM,EAAE,UAAU,CAAC,MAAM;gBACzB,KAAK,EAAE,KAAK,CAAC,KAAK;gBAClB,KAAK,EAAE,IAAI,CAAC,aAAa;aAC1B,CAAC,CAAC;YAEH,MAAM,MAAM,GAAG,MAAM,MAAM,CAAC,IAAI,CAAC;gBAC/B,MAAM,EAAE,KAAK,CAAC,MAAM;gBACpB,MAAM,EAAE,qBAAqB,CAAC,KAAK,CAAC,MAAM,CAAC;gBAC3C,KAAK,EAAE,KAAK,CAAC,KAAK;gBAClB,KAAK,EAAE,KAAK,CAAC,KAAK;gBAClB,OAAO,EAAE,KAAK,CAAC,OAAO;aACvB,EAAE;gBACD,MAAM,EAAE,KAAK,CAAC,MAAM,IAAI,OAAO,CAAC,MAAM;aACvC,CAAC,CAAC;YAEH,OAAO,CAAC,IAAI,EAAE,CAAC;gBACb,IAAI,EAAE,qBAAqB;gBAC3B,UAAU,EAAE,QAAQ;gBACpB,QAAQ,EAAE,KAAK,CAAC,QAAQ;gBACxB,KAAK,EAAE,KAAK,CAAC,KAAK;gBAClB,SAAS,EAAE,IAAI,CAAC,GAAG,EAAE,GAAG,SAAS;gBACjC,KAAK,EAAE,MAAM,CAAC,KAAK;aACpB,CAAC,CAAC;YACH,OAAO,MAAM,CAAC;QAChB,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,OAAO,CAAC,IAAI,EAAE,CAAC;gBACb,IAAI,EAAE,kBAAkB;gBACxB,UAAU,EAAE,QAAQ;gBACpB,QAAQ,EAAE,KAAK,CAAC,QAAQ;gBACxB,KAAK,EAAE,KAAK,CAAC,KAAK;gBAClB,SAAS,EAAE,IAAI,CAAC,GAAG,EAAE,GAAG,SAAS;gBACjC,KAAK,EAAE,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC;aAC9D,CAAC,CAAC;YACH,MAAM,KAAK,CAAC;QACd,CAAC;IACH,CAAC;IAEM,KAAK,CAAC,KAAK,CAAC,OAAyB,EAAE,KAA0B;QACtE,IAAI,CAAC,IAAI,CAAC,gBAAgB,EAAE,CAAC;YAC3B,MAAM,IAAI,KAAK,CAAC,sDAAsD,CAAC,CAAC;QAC1E,CAAC;QAED,MAAM,KAAK,GAAG,aAAa,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC;QACzC,MAAM,SAAS,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;QAC7B,IAAI,CAAC;YACH,MAAM,UAAU,GAAG,MAAM,IAAI,CAAC,uBAAuB,CAAC;gBACpD,OAAO,EAAE,IAAI;gBACb,UAAU,EAAE,WAAW;gBACvB,QAAQ,EAAE,KAAK,CAAC,QAAQ;gBACxB,YAAY,EAAE,oBAAoB,CAAC,KAAK,CAAC,UAAU,CAAC;gBACpD,KAAK,EAAE,KAAK,CAAC,GAAG;aACjB,EAAE,OAAO,CAAC,CAAC;YACZ,MAAM,OAAO,GAAG,MAAM,IAAI,CAAC,gBAAgB,CAAC,UAAU,CAAC,KAAK,CAAC,KAAK,EAAE,cAAc,CAAC,UAAU,CAAC,EAAE,KAAK,CAAC,KAAK,CAAC,CAAC;YAC7G,OAAO,CAAC,IAAI,EAAE,CAAC;gBACb,IAAI,EAAE,qBAAqB;gBAC3B,UAAU,EAAE,WAAW;gBACvB,QAAQ,EAAE,KAAK,CAAC,QAAQ;gBACxB,KAAK,EAAE,KAAK,CAAC,KAAK;gBAClB,SAAS,EAAE,IAAI,CAAC,GAAG,EAAE,GAAG,SAAS;aAClC,CAAC,CAAC;YACH,OAAO,EAAE,OAAO,EAAE,CAAC;QACrB,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,OAAO,CAAC,IAAI,EAAE,CAAC;gBACb,IAAI,EAAE,kBAAkB;gBACxB,UAAU,EAAE,WAAW;gBACvB,QAAQ,EAAE,KAAK,CAAC,QAAQ;gBACxB,KAAK,EAAE,KAAK,CAAC,KAAK;gBAClB,SAAS,EAAE,IAAI,CAAC,GAAG,EAAE,GAAG,SAAS;gBACjC,KAAK,EAAE,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC;aAC9D,CAAC,CAAC;YACH,MAAM,KAAK,CAAC;QACd,CAAC;IACH,CAAC;IAEO,KAAK,CAAC,uBAAuB,CACnC,KAMC,EACD,OAAyB;QAEzB,MAAM,UAAU,GAAG,MAAM,IAAI,CAAC,kBAAkB,CAAC,OAAO,CAAC,KAAK,EAAE,OAAO,CAAC,CAAC;QACzE,IAAI,CAAC,mBAAmB,CAAC,UAAU,CAAC,EAAE,CAAC;YACrC,MAAM,IAAI,KAAK,CAAC,iDAAiD,KAAK,CAAC,QAAQ,EAAE,CAAC,CAAC;QACrF,CAAC;QACD,OAAO,UAAU,CAAC;IACpB,CAAC;CACF;AAvHD,0DAuHC;AAED,SAAS,mBAAmB,CAAC,UAAqC;IAChE,OAAO,OAAO,UAAU,EAAE,MAAM,KAAK,QAAQ,IAAI,UAAU,CAAC,MAAM,CAAC,MAAM,GAAG,CAAC,CAAC;AAChF,CAAC;AAED,SAAS,cAAc,CAAC,UAAoC;IAC1D,OAAO;QACL,QAAQ,EAAE,UAAU,CAAC,QAAQ;QAC7B,MAAM,EAAE,UAAU,CAAC,MAAM;QACzB,YAAY,EAAE,UAAU,CAAC,YAAY;QACrC,OAAO,EAAE,UAAU,CAAC,OAAO;QAC3B,QAAQ,EAAE,UAAU,CAAC,QAAQ;KAC9B,CAAC;AACJ,CAAC;AAED,SAAS,aAAa,CAAC,KAAa;IAClC,MAAM,OAAO,GAAG,KAAK,CAAC,IAAI,EAAE,CAAC;IAC7B,IAAI,CAAC,OAAO,EAAE,CAAC;QACb,MAAM,IAAI,KAAK,CAAC,uBAAuB,CAAC,CAAC;IAC3C,CAAC;IAED,MAAM,CAAC,eAAe,EAAE,QAAQ,CAAC,GAAG,OAAO,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;IACvD,MAAM,QAAQ,GAAG,qBAAqB,CAAC,eAAe,CAAC,CAAC;IACxD,MAAM,OAAO,GAAG,QAAQ,EAAE,IAAI,EAAE,IAAI,eAAe,CAAC,eAAe,CAAC,CAAC;IACrE,IAAI,CAAC,QAAQ,IAAI,CAAC,OAAO,EAAE,CAAC;QAC1B,MAAM,IAAI,KAAK,CAAC,gDAAgD,KAAK,EAAE,CAAC,CAAC;IAC3E,CAAC;IACD,OAAO;QACL,GAAG,EAAE,OAAO;QACZ,QAAQ;QACR,KAAK,EAAE,kBAAkB,CAAC,OAAO,CAAC;KACnC,CAAC;AACJ,CAAC;AAED,SAAS,qBAAqB,CAAC,KAAa;IAC1C,MAAM,KAAK,GAAG,KAAK,CAAC,OAAO,CAAC,OAAO,EAAE,EAAE,CAAC,CAAC;IACzC,MAAM,QAAQ,GAAG,KAAK,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC;IAClD,MAAM,IAAI,GAAG,QAAQ,CAAC,QAAQ,CAAC,MAAM,GAAG,CAAC,CAAC,IAAI,EAAE,CAAC;IACjD,IAAI,IAAI,CAAC,QAAQ,CAAC,MAAM,CAAC,EAAE,CAAC;QAC1B,OAAO,mBAAmB,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC;IAChD,CAAC;IACD,MAAM,eAAe,GAAG,QAAQ,CAAC,QAAQ,CAAC,MAAM,GAAG,CAAC,CAAC,IAAI,IAAI,CAAC;IAC9D,OAAO,mBAAmB,CAAC,eAAe,CAAC,OAAO,CAAC,SAAS,EAAE,EAAE,CAAC,CAAC,CAAC;AACrE,CAAC;AAED,SAAS,eAAe,CAAC,KAAa;IACpC,MAAM,KAAK,GAAG,KAAK,CAAC,OAAO,CAAC,OAAO,EAAE,EAAE,CAAC,CAAC;IACzC,OAAO,KAAK,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,GAAG,EAAE,IAAI,EAAE,CAAC;AACtD,CAAC;AAED,SAAS,mBAAmB,CAAC,KAAa;IACxC,MAAM,EAAE,GAAG,kBAAkB,CAAC,KAAK,CAAC,CAAC,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC;IAC1D,OAAO,EAAE,KAAK,QAAQ,CAAC,CAAC,CAAC,WAAW,CAAC,CAAC,CAAC,EAAE,CAAC;AAC5C,CAAC;AAED,SAAS,oBAAoB,CAAC,KAAc;IAC1C,IAAI,CAAC,KAAK,EAAE,IAAI,EAAE;QAAE,OAAO,SAAS,CAAC;IACrC,MAAM,OAAO,GAAG,KAAK,CAAC,IAAI,EAAE,CAAC;IAC7B,IAAI,OAAO,CAAC,QAAQ,CAAC,GAAG,CAAC;QAAE,OAAO,OAAO,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,GAAG,EAAE,IAAI,OAAO,CAAC;IACtE,MAAM,KAAK,GAAG,OAAO,CAAC,OAAO,CAAC,OAAO,EAAE,EAAE,CAAC,CAAC;IAC3C,MAAM,IAAI,GAAG,KAAK,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,GAAG,EAAE,IAAI,KAAK,CAAC;IAC7D,OAAO,IAAI,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC;AAC1D,CAAC;AAED,SAAS,qBAAqB,CAAC,MAAoC;IACjE,IAAI,MAAM,KAAK,MAAM;QAAE,OAAO,MAAM,CAAC;IACrC,IAAI,MAAM,KAAK,YAAY;QAAE,OAAO,YAAY,CAAC;IACjD,OAAO,UAAU,CAAC;AACpB,CAAC","sourcesContent":["import { createPaddleOcrReader } from '@undefineds.co/extensions';\nimport type { ReadResult, ReaderOutput } from '@undefineds.co/extensions';\nimport type { EmbeddingService } from '../ai/service/EmbeddingService';\nimport type { AiCredential } from '../ai/service/types';\nimport type {\n CredentialResolver,\n ExtensionContext,\n ExtensionEmbedInput,\n ExtensionEmbedResult,\n ExtensionFetch,\n ExtensionReadInput,\n ExtensionRuntime,\n ResolvedCredential,\n} from './types';\n\ntype ApiKeyResolvedCredential = ResolvedCredential & { apiKey: string };\n\ninterface RuntimeModelRef {\n iri: string;\n provider: string;\n model: string;\n}\n\nexport interface DefaultExtensionRuntimeOptions {\n credentialResolver: CredentialResolver;\n embeddingService?: Pick<EmbeddingService, 'embedBatch'>;\n fetch?: ExtensionFetch;\n}\n\nexport class DefaultExtensionRuntime implements ExtensionRuntime {\n private readonly credentialResolver: CredentialResolver;\n private readonly embeddingService?: Pick<EmbeddingService, 'embedBatch'>;\n private readonly providerFetch?: ExtensionFetch;\n\n public constructor(options: DefaultExtensionRuntimeOptions) {\n this.credentialResolver = options.credentialResolver;\n this.embeddingService = options.embeddingService;\n this.providerFetch = options.fetch;\n }\n\n public async read(context: ExtensionContext, input: ExtensionReadInput): Promise<ReadResult> {\n const model = parseModelRef(input.model);\n if (model.provider !== 'paddleocr') {\n throw new Error(`No reader extension registered for provider: ${model.provider}`);\n }\n\n const startedAt = Date.now();\n try {\n const credential = await this.resolveApiKeyCredential({\n service: 'ai',\n capability: 'reader',\n provider: model.provider,\n credentialId: normalizeResourceKey(input.credential),\n model: model.iri,\n }, context);\n\n const reader = createPaddleOcrReader({\n endpoint: credential.baseUrl,\n apiKey: credential.apiKey,\n model: model.model,\n fetch: this.providerFetch,\n });\n\n const result = await reader.read({\n source: input.source,\n output: normalizeReaderOutput(input.output),\n pages: input.pages,\n model: model.model,\n options: input.options,\n }, {\n signal: input.signal ?? context.signal,\n });\n\n context.emit?.({\n type: 'extension.completed',\n capability: 'reader',\n provider: model.provider,\n model: model.model,\n latencyMs: Date.now() - startedAt,\n usage: result.usage,\n });\n return result;\n } catch (error) {\n context.emit?.({\n type: 'extension.failed',\n capability: 'reader',\n provider: model.provider,\n model: model.model,\n latencyMs: Date.now() - startedAt,\n error: error instanceof Error ? error.message : String(error),\n });\n throw error;\n }\n }\n\n public async embed(context: ExtensionContext, input: ExtensionEmbedInput): Promise<ExtensionEmbedResult> {\n if (!this.embeddingService) {\n throw new Error('No embedding service registered for ExtensionRuntime');\n }\n\n const model = parseModelRef(input.model);\n const startedAt = Date.now();\n try {\n const credential = await this.resolveApiKeyCredential({\n service: 'ai',\n capability: 'embedding',\n provider: model.provider,\n credentialId: normalizeResourceKey(input.credential),\n model: model.iri,\n }, context);\n const vectors = await this.embeddingService.embedBatch(input.texts, toAiCredential(credential), model.model);\n context.emit?.({\n type: 'extension.completed',\n capability: 'embedding',\n provider: model.provider,\n model: model.model,\n latencyMs: Date.now() - startedAt,\n });\n return { vectors };\n } catch (error) {\n context.emit?.({\n type: 'extension.failed',\n capability: 'embedding',\n provider: model.provider,\n model: model.model,\n latencyMs: Date.now() - startedAt,\n error: error instanceof Error ? error.message : String(error),\n });\n throw error;\n }\n }\n\n private async resolveApiKeyCredential(\n input: {\n service: string;\n capability: string;\n provider: string;\n credentialId?: string;\n model?: string;\n },\n context: ExtensionContext,\n ): Promise<ApiKeyResolvedCredential> {\n const credential = await this.credentialResolver.resolve(input, context);\n if (!hasApiKeyCredential(credential)) {\n throw new Error(`No API key credential available for provider: ${input.provider}`);\n }\n return credential;\n }\n}\n\nfunction hasApiKeyCredential(credential: ResolvedCredential | null): credential is ApiKeyResolvedCredential {\n return typeof credential?.apiKey === 'string' && credential.apiKey.length > 0;\n}\n\nfunction toAiCredential(credential: ApiKeyResolvedCredential): AiCredential {\n return {\n provider: credential.provider,\n apiKey: credential.apiKey,\n credentialId: credential.credentialId,\n baseUrl: credential.baseUrl,\n proxyUrl: credential.proxyUrl,\n };\n}\n\nfunction parseModelRef(model: string): RuntimeModelRef {\n const trimmed = model.trim();\n if (!trimmed) {\n throw new Error('Model URI is required');\n }\n\n const [withoutFragment, fragment] = trimmed.split('#');\n const provider = providerFromModelPath(withoutFragment);\n const modelId = fragment?.trim() || lastPathSegment(withoutFragment);\n if (!provider || !modelId) {\n throw new Error(`Cannot derive provider/model from model URI: ${model}`);\n }\n return {\n iri: trimmed,\n provider,\n model: decodeURIComponent(modelId),\n };\n}\n\nfunction providerFromModelPath(value: string): string {\n const clean = value.replace(/\\/+$/u, '');\n const segments = clean.split('/').filter(Boolean);\n const last = segments[segments.length - 1] ?? '';\n if (last.endsWith('.ttl')) {\n return normalizeProviderId(last.slice(0, -4));\n }\n const providerSegment = segments[segments.length - 2] ?? last;\n return normalizeProviderId(providerSegment.replace(/\\.ttl$/u, ''));\n}\n\nfunction lastPathSegment(value: string): string {\n const clean = value.replace(/\\/+$/u, '');\n return clean.split('/').filter(Boolean).pop() ?? '';\n}\n\nfunction normalizeProviderId(value: string): string {\n const id = decodeURIComponent(value).trim().toLowerCase();\n return id === 'paddle' ? 'paddleocr' : id;\n}\n\nfunction normalizeResourceKey(value?: string): string | undefined {\n if (!value?.trim()) return undefined;\n const trimmed = value.trim();\n if (trimmed.includes('#')) return trimmed.split('#').pop() || trimmed;\n const clean = trimmed.replace(/\\/+$/u, '');\n const tail = clean.split('/').filter(Boolean).pop() ?? clean;\n return tail.endsWith('.ttl') ? tail.slice(0, -4) : tail;\n}\n\nfunction normalizeReaderOutput(output: ExtensionReadInput['output']): ReaderOutput {\n if (output === 'text') return 'text';\n if (output === 'structured') return 'structured';\n return 'markdown';\n}\n"]}

package/dist/extensions/PodCredentialResolver.d.ts ADDED Viewed

@@ -0,0 +1,23 @@
+import type { AiCredential } from '../ai/service/types';
+import type { CredentialResolveInput, CredentialResolver, ExtensionContext, ExtensionFetch, ResolvedCredential } from './types';
+export interface CredentialReaderLike {
+    getAiCredential(podBaseUrl: string, providerId: string, authenticatedFetch: ExtensionFetch, webId?: string, options?: {
+        credentialId?: string;
+    }): Promise<AiCredential | null>;
+}
+export interface PodCredentialResolverOptions {
+    credentialReader?: CredentialReaderLike;
+    genericCredentialReader?: GenericCredentialReaderLike;
+}
+export interface GenericCredentialReaderLike {
+    getCredential(input: CredentialResolveInput, context: ExtensionContext): Promise<ResolvedCredential | null>;
+}
+export declare class PodCredentialResolver implements CredentialResolver {
+    private readonly credentialReader;
+    private readonly genericCredentialReader;
+    constructor(options?: PodCredentialResolverOptions);
+    resolve(input: CredentialResolveInput, context: ExtensionContext): Promise<ResolvedCredential | null>;
+}
+export declare class PodGenericCredentialReader implements GenericCredentialReaderLike {
+    getCredential(input: CredentialResolveInput, context: ExtensionContext): Promise<ResolvedCredential | null>;
+}