hfs 3.3.2 → 3.4.0-alpha1

package/src/acme.js

@@ -3,7 +3,10 @@ var __importDefault = (this && this.__importDefault) || function (mod) {
     return (mod && mod.__esModule) ? mod : { "default": mod };
 };
 Object.defineProperty(exports, "__esModule", { value: true });
-exports.acmeRenewError = exports.makeCert = exports.acmeMiddleware = void 0;
+exports.acmeRenewError = exports.acmeMiddleware = void 0;
+exports.getAcmeStatus = getAcmeStatus;
+exports.getAcmeStatusEvents = getAcmeStatusEvents;
+exports.makeCert = makeCert;
 const misc_1 = require("./misc");
 const http_1 = require("http");
 const nat_1 = require("./nat");
@@ -12,7 +15,11 @@ const apiMiddleware_1 = require("./apiMiddleware");
 const acme_client_1 = __importDefault(require("acme-client"));
 const debounceAsync_1 = require("./debounceAsync");
 const promises_1 = __importDefault(require("fs/promises"));
-const config_1 = require("./config");
+const acmeConfig_1 = require("./acmeConfig");
+const acmeDns_1 = require("./acmeDns");
+const github_1 = require("./github");
+const promises_2 = require("node:dns/promises");
+const node_stream_1 = require("node:stream");
 const events_1 = __importDefault(require("./events"));
 const selfCheck_1 = require("./selfCheck");
 const net_1 = require("net");
@@ -49,32 +56,52 @@ const TEMP_MAP = (0, nat_1.upnpMappingParam)(80, 80, 'hfs temporary', 5000); //
     stop();
     return client.removeMapping(TEMP_MAP);
 });
-async function generateSSLCert(domain, email, altNames = []) {
-    const ipCertificate = [domain, ...altNames].some(net_1.isIP);
-    // will answer the challenge through our koa app (if on port 80) or must we spawn a dedicated server?
-    const nat = await (0, nat_1.getNatInfo)();
-    const { http } = await (0, listen_1.getServerStatus)();
-    const tempSrv = nat.externalPort === 80 || http.listening && http.port === 80 ? undefined
-        : (0, http_1.createServer)((req, res) => acmeListener(req, res) || res.end('HFS')); // also satisfy self-check
-    if (tempSrv)
-        await new Promise(resolve => tempSrv.listen(80, resolve).on('error', (e) => {
-            console.debug("Cannot listen on 80", e.code || e);
-            resolve(); // go on anyway
-        }));
-    acmeOngoing = true;
-    console.debug("ACME challenge server ready");
+async function generateSSLCert(names, email) {
+    const domain = names[0];
+    const method = acmeConfig_1.acmeChallenge.get();
+    const ipCertificate = names.some(net_1.isIP);
+    if (!['http-01', 'dns-01'].includes(method))
+        throw Error("Invalid certificate validation method");
+    if (method === 'http-01' && names.some(n => n.startsWith('*.')))
+        throw Error("Select a DNS provider for wildcard certificates");
+    if (method === 'dns-01' && ipCertificate)
+        throw Error("DNS validation cannot be used for IP addresses");
+    const config = structuredClone(acmeConfig_1.acmeDns.get()[0]);
+    const info = method === 'dns-01' ? await (0, github_1.getProjectInfo)() : undefined;
+    const provider = info && config && (0, acmeDns_1.getDnsProviders)(info.acmeDns).get(config.provider);
+    if (method === 'dns-01') {
+        if (!provider?.available || config?.config_version !== provider.config_version)
+            throw Error("DNS provider unavailable or incompatible; update HFS or reconfigure the provider");
+        if (Object.keys(provider.fields).some(k => !config.credentials?.[k]))
+            throw Error("Enter the DNS provider credentials");
+    }
+    const resolver = new promises_2.Resolver({ timeout: 3000, tries: 2 });
+    if (info)
+        resolver.setServers(info.dnsServers);
+    const cleanups = new Map();
+    const cleanupErrors = [];
+    let tempSrv;
     let tempMap;
+    acmeOngoing = true;
     try {
-        const checkUrl = `http://${(0, misc_1.ipForUrl)(domain)}`;
-        let check = await (0, selfCheck_1.selfCheck)(checkUrl); // some check services may not consider the domain, but we already verified that
-        if (check?.success === false && nat.upnp && !nat.mapped80) {
-            console.debug("Setting temporary port forward");
-            tempMap = await (0, misc_1.haveTimeout)(10_000, (0, nat_1.getUpnpClient)().createMapping(TEMP_MAP)).catch(() => { });
-            check = await (0, selfCheck_1.selfCheck)(checkUrl); // repeat test
+        if (method === 'http-01') {
+            progress("Checking port 80");
+            const nat = await (0, nat_1.getNatInfo)();
+            const { http } = await (0, listen_1.getServerStatus)();
+            if (!(nat.externalPort === 80 || http.listening && http.port === 80)) {
+                tempSrv = (0, http_1.createServer)((req, res) => acmeListener(req, res) || res.end('HFS'));
+                await new Promise(resolve => tempSrv.listen(80, resolve).on('error', () => resolve()));
+            }
+            const checkUrl = `http://${(0, misc_1.ipForUrl)(domain)}`;
+            let check = await (0, selfCheck_1.selfCheck)(checkUrl);
+            if (check?.success === false && nat.upnp && !nat.mapped80) {
+                tempMap = await (0, misc_1.haveTimeout)(10_000, (0, nat_1.getUpnpClient)().createMapping(TEMP_MAP)).catch(() => undefined);
+                check = await (0, selfCheck_1.selfCheck)(checkUrl);
+            }
+            if (check?.success === false)
+                throw new apiMiddleware_1.ApiError(misc_1.HTTP_FAILED_DEPENDENCY, "port 80 is not working on the specified domain");
         }
-        //if (!check) throw new ApiError(HTTP_FAILED_DEPENDENCY, "couldn't test port 80")
-        if (check?.success === false)
-            throw new apiMiddleware_1.ApiError(misc_1.HTTP_FAILED_DEPENDENCY, "port 80 is not working on the specified domain");
+        progress("Requesting certificate");
         const acmeClient = new acme_client_1.default.Client({
             accountKey: await acme_client_1.default.crypto.createPrivateKey(),
             directoryUrl: acme_client_1.default.directory.letsencrypt.production
@@ -90,19 +117,57 @@ async function generateSSLCert(domain, email, altNames = []) {
         acme_client_1.default.setLogger(console.debug);
         const [key, csr] = await acme_client_1.default.crypto.createCsr({
             commonName: (0, net_1.isIP)(domain) ? undefined : domain, // rejected because Boulder doesn't accept IP addresses in the Common Name
-            altNames: [domain, ...altNames],
+            altNames: names,
         });
         const cert = await acmeClient.auto({
             csr,
             email,
-            challengePriority: ['http-01'],
+            challengePriority: [method],
             skipChallengeVerification: true, // on NAT, trying to connect to your external ip will likely get your modem instead of the challenge server
             termsOfServiceAgreed: true,
-            async challengeCreateFn(_, c, ka) { acmeTokens[c.token] = ka; },
-            async challengeRemoveFn(_, c) { delete acmeTokens[c.token]; },
+            async challengeCreateFn(auth, challenge, value) {
+                if (challenge.type !== method)
+                    throw Error("Unsupported ACME challenge");
+                if (method === 'http-01') {
+                    acmeTokens[challenge.token] = value;
+                }
+                else {
+                    progress("Creating DNS TXT record", auth.identifier.value);
+                    const record = await (0, acmeDns_1.dnsChallengeRecord)(auth.identifier.value, value, resolver);
+                    cleanups.set(challenge.token, await provider.present(record, config.credentials));
+                    progress("Waiting for DNS propagation", auth.identifier.value);
+                    await (0, acmeDns_1.waitForDnsRecord)(record, resolver, provider.propagation_timeout === undefined ? undefined : provider.propagation_timeout * 1000);
+                }
+                progress("Validating domain", auth.identifier.value);
+            },
+            async challengeRemoveFn(_, challenge) {
+                delete acmeTokens[challenge.token];
+                const cleanup = cleanups.get(challenge.token);
+                if (cleanup) {
+                    cleanups.delete(challenge.token);
+                    // acme-client suppresses cleanup errors, so keep them visible in the final status
+                    try {
+                        await cleanup();
+                    }
+                    catch {
+                        cleanupErrors.push("Could not remove a DNS challenge TXT record");
+                    }
+                }
+            },
         });
         console.log("ACME certificate generated");
-        return { key, cert };
+        return { key, cert, warning: cleanupErrors.join("; ") || undefined };
+    }
+    catch (error) {
+        if (method === 'http-01' && error instanceof Error) {
+            if (error.message.includes('Timeout'))
+                error = Error("ensure your router is forwarding port 80 correctly");
+            else if (error.message.includes('not match this challenge'))
+                error = Error("a different server is responding on port 80 of your domain(s)");
+        }
+        if (cleanupErrors.length)
+            throw Error(`${error instanceof Error ? error.message : error}; ${cleanupErrors.join('; ')}`);
+        throw error;
     }
     finally {
         if (tempMap && nat_1.upnpEnabled.get()) {
@@ -110,33 +175,61 @@ async function generateSSLCert(domain, email, altNames = []) {
             (0, nat_1.getUpnpClient)().removeMapping(TEMP_MAP).catch(() => { }); // clean after ourselves
         }
         acmeOngoing = false;
-        if (tempSrv)
-            await new Promise(res => tempSrv.close(res));
+        if (tempSrv?.listening)
+            await new Promise(res => tempSrv.close(() => res()));
         console.debug('ACME terminated');
     }
 }
-exports.makeCert = (0, debounceAsync_1.debounceAsync)(async (domain, email, altNames) => {
-    const res = await generateSSLCert(domain, email, altNames).catch(e => {
-        throw e.message?.includes('Timeout') ? Error("ensure your router is forwarding port 80 correctly")
-            : e.message?.includes('not match this challenge') ? Error("a different server is responding on port 80 of your domain(s)")
-                : e;
+let acmeStatus = { id: 0, state: 'idle', message: '' };
+function getAcmeStatus() { return acmeStatus; }
+function progress(message, domain) {
+    acmeStatus = { ...acmeStatus, message, domain };
+    events_1.default.emit('acmeStatus', acmeStatus);
+}
+function getAcmeStatusEvents() {
+    let off;
+    return new node_stream_1.Readable({
+        objectMode: true,
+        read() {
+            if (off)
+                return;
+            off = events_1.default.on('acmeStatus', status => this.push(status));
+            this.once('close', off);
+            this.push(acmeStatus);
+        },
     });
-    const CERT_FILE = 'acme.cer';
-    const KEY_FILE = 'acme.key';
-    await promises_1.default.writeFile(CERT_FILE, res.cert);
-    await promises_1.default.writeFile(KEY_FILE, res.key);
-    listen_1.cert.set(CERT_FILE); // update config
-    listen_1.privateKey.set(KEY_FILE);
-    exports.acmeRenewError = '';
-});
+}
+async function makeCert(domain, email, altNames = []) {
+    if (acmeStatus.state === 'running')
+        throw Error("Certificate request already running");
+    acmeStatus = { id: acmeStatus.id + 1, state: 'running', message: '' };
+    progress("Starting certificate request");
+    try {
+        const names = (0, acmeDns_1.certificateNames)([domain, ...altNames]);
+        const res = await generateSSLCert(names, email);
+        progress("Installing certificate");
+        const CERT_FILE = 'acme.cer';
+        const KEY_FILE = 'acme.key';
+        await promises_1.default.writeFile(KEY_FILE, res.key, { mode: 0o600 });
+        await promises_1.default.writeFile(CERT_FILE, res.cert);
+        listen_1.cert.set(CERT_FILE);
+        listen_1.privateKey.set(KEY_FILE);
+        exports.acmeRenewError = '';
+        acmeStatus = { ...acmeStatus, state: 'done', warning: res.warning };
+        progress("Certificate created");
+    }
+    catch (error) {
+        acmeStatus = { ...acmeStatus, state: 'error' };
+        progress(error instanceof Error ? error.message : String(error));
+        throw error;
+    }
+}
 exports.acmeRenewError = '';
-const acmeDomain = (0, config_1.defineConfig)(misc_1.CFG.acme_domain, '');
-const acmeRenew = (0, config_1.defineConfig)(misc_1.CFG.acme_renew, false); // handle config changes
 events_1.default.once('httpsReady', () => (0, misc_1.repeat)(misc_1.HOUR, renewCert));
 // checks if the cert is near expiration date, and if so renews it
 const renewCert = (0, debounceAsync_1.debounceAsync)(async () => {
-    const [domain, ...altNames] = acmeDomain.get().split(',');
-    if (!acmeRenew.get() || !domain)
+    const [domain, ...altNames] = acmeConfig_1.acmeDomain.get().split(',');
+    if (!acmeConfig_1.acmeRenew.get() || !domain)
         return;
     const cert = (0, listen_1.getCertObject)();
     if (!cert)
@@ -148,6 +241,6 @@ const renewCert = (0, debounceAsync_1.debounceAsync)(async () => {
     const renewBefore = (validTo.getTime() - validFrom.getTime()) / 3;
     if (now > validFrom && now < validTo && validTo.getTime() - now.getTime() >= renewBefore)
         return console.log("Certificate still good");
-    await (0, exports.makeCert)(domain, undefined, altNames)
+    await makeCert(domain, undefined, altNames)
         .catch(e => console.log(exports.acmeRenewError = `Error renewing certificate, expiring ${(0, misc_1.formatDate)(validTo)}: ${String(e.message || e)}`));
 }, { retain: misc_1.HOUR }); // short-lived certificates leave a renew window of just 2 days, and a failed renew is retained as a success here

package/src/acmeConfig.js

@@ -0,0 +1,43 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.acmeDns = exports.acmeChallenge = exports.acmeRenew = exports.acmeDomain = void 0;
+exports.getAcmeSettings = getAcmeSettings;
+exports.setAcmeSettings = setAcmeSettings;
+const config_1 = require("./config");
+const cross_const_1 = require("./cross-const");
+const github_1 = require("./github");
+const acmeDns_1 = require("./acmeDns");
+exports.acmeDomain = (0, config_1.defineConfig)(cross_const_1.CFG.acme_domain, '');
+exports.acmeRenew = (0, config_1.defineConfig)(cross_const_1.CFG.acme_renew, false);
+exports.acmeChallenge = (0, config_1.defineConfig)(cross_const_1.CFG.acme_challenge, 'http-01');
+exports.acmeDns = (0, config_1.defineConfig)(cross_const_1.CFG.acme_dns, []);
+async function getAcmeSettings() {
+    return {
+        domain: exports.acmeDomain.get(), renew: exports.acmeRenew.get(), challenge: exports.acmeChallenge.get(),
+        dns: exports.acmeDns.get(), providers: (0, acmeDns_1.dnsProviderInfo)((await (0, github_1.getProjectInfo)()).acmeDns),
+    };
+}
+async function setAcmeSettings(settings) {
+    if (typeof settings.domain !== 'string' || typeof settings.renew !== 'boolean'
+        || !['http-01', 'dns-01'].includes(settings.challenge) || !Array.isArray(settings.dns) || settings.dns.length > 1)
+        throw Error("Invalid certificate settings");
+    const providers = (0, acmeDns_1.dnsProviderInfo)((await (0, github_1.getProjectInfo)()).acmeDns);
+    const configs = settings.dns.map(config => {
+        if (!config || typeof config.id !== 'string' || !config.id || !config.credentials || typeof config.credentials !== 'object'
+            || Object.values(config.credentials).some(value => typeof value !== 'string'))
+            throw Error("Invalid DNS configuration");
+        const previous = exports.acmeDns.get().find(c => c.id === config.id && c.provider === config.provider && c.config_version === config.config_version);
+        const provider = providers.find(p => p.id === config.provider && p.config_version === config.config_version);
+        // retain unavailable credentials so switching back to HTTP doesn't require discarding them
+        if (!provider && previous)
+            return config;
+        if (!provider || Object.keys(config.credentials).some(key => !(key in provider.fields)))
+            throw Error("Invalid DNS configuration; select a supported provider");
+        return { id: config.id, provider: config.provider, config_version: config.config_version, credentials: config.credentials };
+    });
+    await (0, config_1.setConfig)({
+        [cross_const_1.CFG.acme_domain]: settings.domain, [cross_const_1.CFG.acme_renew]: settings.renew,
+        [cross_const_1.CFG.acme_challenge]: settings.challenge, [cross_const_1.CFG.acme_dns]: configs,
+    });
+    return getAcmeSettings();
+}

package/src/acmeDns.js

@@ -0,0 +1,285 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.registerAcmeDnsProvider = registerAcmeDnsProvider;
+exports.getDnsProviders = getDnsProviders;
+exports.dnsProviderInfo = dnsProviderInfo;
+exports.presentHttpDns = presentHttpDns;
+exports.certificateNames = certificateNames;
+exports.dnsChallengeRecord = dnsChallengeRecord;
+exports.waitForDnsRecord = waitForDnsRecord;
+const node_url_1 = require("node:url");
+const node_net_1 = require("node:net");
+const node_crypto_1 = require("node:crypto");
+const util_http_1 = require("./util-http");
+const promises_1 = require("node:timers/promises");
+const plugins = new Map();
+function registerAcmeDnsProvider(id, provider) {
+    if (!id || plugins.has(id))
+        throw Error("DNS provider ID already registered");
+    if (!Number.isInteger(provider.config_version) || provider.config_version < 1 || typeof provider.present !== 'function')
+        throw Error("Invalid DNS provider");
+    plugins.set(id, provider);
+    return () => { if (plugins.get(id) === provider)
+        plugins.delete(id); };
+}
+function getDnsProviders(catalog) {
+    const providers = new Map();
+    if (!Array.isArray(catalog))
+        throw Error("Invalid DNS provider catalog");
+    for (const raw of catalog) {
+        try {
+            if (!raw || typeof raw !== 'object' || !raw.providers || typeof raw.providers !== 'object')
+                throw Error("Invalid DNS provider catalog");
+            const recipe = raw;
+            if (recipe.driver !== 'http-json1')
+                continue;
+            validateRecipe(recipe);
+            for (const [id, entry] of Object.entries(recipe.providers)) {
+                try {
+                    if (!entry || typeof entry.endpoint !== 'string' || new URL(entry.endpoint).protocol !== 'https:')
+                        throw Error("Unsupported DNS API endpoint");
+                    if (providers.has(id))
+                        throw Error("Duplicate DNS provider");
+                    providers.set(id, {
+                        label: entry.label, config_version: recipe.config_version, fields: recipe.fields,
+                        available: entry.enabled !== false, propagation_timeout: recipe.propagation_timeout, help_url: entry.help_url || recipe.help_url,
+                        present: (record, credentials) => presentHttpDns(recipe, entry.endpoint, record, credentials),
+                    });
+                }
+                catch (error) {
+                    console.warn("Skipping DNS provider", id, error instanceof Error ? error.message : String(error));
+                }
+            }
+        }
+        // a broken recipe must not prevent independent providers from being used
+        catch (error) {
+            console.warn("Skipping DNS recipe", error instanceof Error ? error.message : String(error));
+        }
+    }
+    for (const [id, provider] of plugins) {
+        if (providers.has(id))
+            throw Error("Duplicate DNS provider");
+        providers.set(id, { ...provider, available: true });
+    }
+    return providers;
+}
+function dnsProviderInfo(catalog) {
+    return Array.from(getDnsProviders(catalog), ([id, p]) => ({
+        id, label: p.label || id, config_version: p.config_version, fields: p.fields, available: p.available, help_url: p.help_url,
+    })).sort((a, b) => a.label.localeCompare(b.label));
+}
+function validateRecipe(recipe) {
+    if (!Number.isInteger(recipe.config_version) || recipe.config_version < 1 || !recipe.fields || typeof recipe.fields !== 'object' || Array.isArray(recipe.fields)
+        || !recipe.headers || typeof recipe.headers !== 'object' || Array.isArray(recipe.headers)
+        || Object.values(recipe.headers).some(value => typeof value !== 'string')
+        || !Array.isArray(recipe.create) || !recipe.create.length || !Array.isArray(recipe.remove) || !recipe.remove.length
+        || recipe.prepare !== undefined && !Array.isArray(recipe.prepare))
+        throw Error("Invalid DNS recipe");
+    if (recipe.auth !== undefined && recipe.auth !== 'ovh'
+        && (!recipe.auth || typeof recipe.auth !== 'object' || typeof recipe.auth.basic !== 'string'))
+        throw Error("Invalid DNS authentication");
+    if (recipe.propagation_timeout !== undefined && (!Number.isInteger(recipe.propagation_timeout) || recipe.propagation_timeout <= 0))
+        throw Error("Invalid DNS propagation timeout");
+    for (const field of Object.values(recipe.fields))
+        if (!field || typeof field !== 'object' || field.label !== undefined && typeof field.label !== 'string'
+            || field.secret !== undefined && typeof field.secret !== 'boolean')
+            throw Error("Invalid DNS field");
+    for (const step of [...recipe.prepare || [], ...recipe.create, ...recipe.remove])
+        if (!step || !['GET', 'POST', 'DELETE'].includes(step.method) || typeof step.path !== 'string'
+            || !step.path.startsWith('/') || step.path.startsWith('//')
+            || step.expect !== undefined && (!Array.isArray(step.expect) || step.expect.length !== 2 || typeof step.expect[0] !== 'string')
+            || step.select !== undefined && (!step.select || typeof step.select !== 'object'
+                || typeof step.select.field !== 'string' || typeof step.select.equals !== 'string')
+            || step.capture !== undefined && (!step.capture || typeof step.capture !== 'object' || Array.isArray(step.capture)
+                || Object.values(step.capture).some(value => typeof value !== 'string')))
+            throw Error("Invalid DNS request");
+}
+function property(value, path) {
+    for (const key of path ? path.split('.') : []) {
+        if (!value || typeof value !== 'object' || !Object.hasOwn(value, key))
+            throw Error("Missing DNS API response field");
+        value = value[key];
+    }
+    if (value === undefined)
+        throw Error("Missing DNS API response field");
+    return value;
+}
+function expand(value, variables, url = false) {
+    if (typeof value === 'string') {
+        const whole = /^\{([\w.]+)\}$/.exec(value);
+        if (whole && !url)
+            return property(variables, whole[1]);
+        return value.replace(/\{([\w.]+)\}/g, (_, key) => {
+            const v = property(variables, key);
+            if (typeof v !== 'string' && typeof v !== 'number')
+                throw Error("Invalid DNS request parameter");
+            return url ? encodeURIComponent(v) : String(v);
+        });
+    }
+    if (Array.isArray(value))
+        return value.map(v => expand(v, variables));
+    if (value && typeof value === 'object')
+        return Object.fromEntries(Object.entries(value).map(([k, v]) => [k, expand(v, variables)]));
+    return value;
+}
+async function presentHttpDns(recipe, endpoint, record, credentials) {
+    // retain the recipe and credentials used to create the record until cleanup finishes
+    recipe = structuredClone(recipe);
+    credentials = { ...credentials };
+    const vars = Object.assign(Object.create(null), { credentials, ...record });
+    let ovhOffset = 0;
+    async function run(steps, authenticate = true) {
+        for (const step of steps) {
+            const url = new URL(endpoint.replace(/\/$/, '') + expand(step.path, vars, true));
+            if (url.origin !== new URL(endpoint).origin || url.username || url.password)
+                throw Error("Invalid DNS API URL");
+            const body = step.body === undefined ? undefined : JSON.stringify(expand(step.body, vars));
+            const headers = { 'content-type': 'application/json', ...expand(recipe.headers, vars) };
+            if (authenticate && recipe.auth) {
+                if (recipe.auth === 'ovh') {
+                    // sign the exact bytes sent, using server time to tolerate an incorrect local clock
+                    const timestamp = Math.floor((Date.now() + ovhOffset) / 1000);
+                    Object.assign(headers, {
+                        'X-Ovh-Application': credentials.applicationKey,
+                        'X-Ovh-Consumer': credentials.consumerKey,
+                        'X-Ovh-Timestamp': String(timestamp),
+                        'X-Ovh-Signature': '$1$' + (0, node_crypto_1.createHash)('sha1').update([
+                            credentials.applicationSecret, credentials.consumerKey, step.method, url.href, body || '', timestamp,
+                        ].join('+')).digest('hex'),
+                    });
+                }
+                else
+                    Object.assign(headers, { Authorization: 'Basic ' + Buffer.from(String(expand(recipe.auth.basic, vars))).toString('base64') });
+            }
+            // avoid exposing raw response bodies; OVH diagnostic fields are redacted below
+            const response = await (0, util_http_1.httpStream)(url.href, {
+                method: step.method, headers, body,
+                timeout: 20_000, noRedirect: true, httpThrow: false,
+            }).catch((error) => {
+                throw Error(`DNS API connection failed (${error.code || 'network error'})`);
+            });
+            let data;
+            try {
+                const body = await (0, util_http_1.readTextLimited)(response, 1024 * 1024).catch((error) => {
+                    throw Error(`DNS API response interrupted (${error.code || 'network error'})`);
+                });
+                if (!response.statusCode || response.statusCode < 200 || response.statusCode >= 300) {
+                    let detail = '';
+                    if (recipe.auth === 'ovh' && !('error' in body)) {
+                        try {
+                            const { errorCode, message } = JSON.parse(body.text);
+                            detail = [errorCode, message].filter(value => typeof value === 'string').join(': ');
+                            for (const secret of Object.values(credentials))
+                                if (secret)
+                                    detail = detail.replaceAll(secret, '[redacted]');
+                            detail = detail.slice(0, 500);
+                        }
+                        catch { } // non-JSON errors still report the HTTP status
+                    }
+                    throw Error(`DNS API returned HTTP ${response.statusCode || 'unknown'} (${step.method} ${url.hostname} ${step.path})${detail ? ': ' + detail : ''}`);
+                }
+                if ('error' in body)
+                    throw Error("DNS API response exceeds 1 MB");
+                try {
+                    data = body.text ? JSON.parse(body.text) : null;
+                }
+                catch {
+                    throw Error("DNS API returned invalid JSON");
+                }
+            }
+            finally {
+                response.destroy();
+            }
+            if (step.select) {
+                if (!Array.isArray(data))
+                    throw Error("Invalid DNS list response");
+                const { field, equals } = step.select;
+                const selected = data.filter(item => property(item, field) === expand(equals, vars));
+                if (selected.length !== 1)
+                    throw Error("DNS zone missing or ambiguous");
+                data = selected[0];
+            }
+            if (step.expect && property(data, step.expect[0]) !== step.expect[1])
+                throw Error("DNS API rejected the request");
+            for (const [key, path] of Object.entries(step.capture || {}))
+                vars[key] = property(data, path);
+        }
+    }
+    if (recipe.auth === 'ovh') {
+        await run([{ method: 'GET', path: '/auth/time', capture: { serverTime: '' } }], false);
+        if (typeof vars.serverTime !== 'number' || !Number.isFinite(vars.serverTime))
+            throw Error("Invalid DNS API server time");
+        ovhOffset = vars.serverTime * 1000 - Date.now();
+    }
+    await run(recipe.prepare || []);
+    try {
+        await run(recipe.create);
+    }
+    catch (error) {
+        if ('recordId' in vars) {
+            try {
+                await run(recipe.remove);
+            }
+            catch {
+                throw Error("DNS creation and cleanup failed; check the challenge TXT record");
+            }
+        }
+        throw error;
+    }
+    return () => run(recipe.remove);
+}
+function certificateNames(names) {
+    const normalized = names.flatMap(name => {
+        name = name.trim().replace(/\.$/, '').toLowerCase();
+        const wildcard = name.startsWith('*.');
+        const host = wildcard ? name.slice(2) : name;
+        const ascii = (0, node_net_1.isIP)(host) ? host : (0, node_url_1.domainToASCII)(host);
+        if (!ascii || host.includes('*') || !(0, node_net_1.isIP)(host) && (!ascii.includes('.') || ascii.length > 253
+            || ascii.split('.').some(part => !/^[a-z0-9](?:[a-z0-9-]{0,61}[a-z0-9])?$/.test(part)))
+            || wildcard && (0, node_net_1.isIP)(host))
+            throw Error("Invalid certificate domain");
+        return wildcard ? ['*.' + ascii, ascii] : [ascii];
+    });
+    if (!normalized.length)
+        throw Error("Enter a domain for the certificate");
+    return [...new Set(normalized)];
+}
+async function dnsChallengeRecord(domain, value, resolver) {
+    let name = '_acme-challenge.' + domain.replace(/^\*\./, '');
+    const visited = new Set();
+    // follow only the validation name: the website's CNAME is unrelated to DNS-01
+    for (;;) {
+        if (visited.has(name) || visited.size >= 16)
+            throw Error("DNS challenge CNAME loop");
+        visited.add(name);
+        const aliases = await resolver.resolveCname(name).catch(ignoreMissingDns);
+        if (!aliases?.length)
+            break;
+        name = aliases[0].toLowerCase().replace(/\.$/, '');
+    }
+    let zone = name;
+    for (;;) {
+        const soa = await resolver.resolveSoa(zone).catch(ignoreMissingDns);
+        if (soa)
+            break;
+        const dot = zone.indexOf('.');
+        if (dot < 0)
+            throw Error("Cannot find the authoritative DNS zone");
+        zone = zone.slice(dot + 1);
+    }
+    return { name, zone, relative: name === zone ? '' : name.slice(0, -zone.length - 1), value };
+}
+function ignoreMissingDns(error) {
+    if (error.code !== 'ENODATA' && error.code !== 'ENOTFOUND')
+        throw error;
+}
+async function waitForDnsRecord(record, resolver, timeout = 5 * 60_000) {
+    const until = Date.now() + timeout;
+    do {
+        const values = await resolver.resolveTxt(record.name).catch(ignoreMissingDns);
+        if (values?.some(parts => parts.join('') === record.value))
+            return;
+        await (0, promises_1.setTimeout)(Math.min(2000, Math.max(0, until - Date.now())));
+    } while (Date.now() < until);
+    throw Error("Timed out waiting for the DNS TXT record to propagate");
+}

package/src/admin-langs/embedded.js

@@ -0,0 +1,33 @@
+"use strict";
+var __importDefault = (this && this.__importDefault) || function (mod) {
+    return (mod && mod.__esModule) ? mod : { "default": mod };
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+const hfs_admin_lang_en_json_1 = __importDefault(require("./hfs-admin-lang-en.json"));
+const hfs_admin_lang_it_json_1 = __importDefault(require("./hfs-admin-lang-it.json"));
+const hfs_admin_lang_zh_json_1 = __importDefault(require("./hfs-admin-lang-zh.json"));
+const hfs_admin_lang_ru_json_1 = __importDefault(require("./hfs-admin-lang-ru.json"));
+const hfs_admin_lang_ro_json_1 = __importDefault(require("./hfs-admin-lang-ro.json"));
+const hfs_admin_lang_sr_json_1 = __importDefault(require("./hfs-admin-lang-sr.json"));
+const hfs_admin_lang_sr_latn_json_1 = __importDefault(require("./hfs-admin-lang-sr-latn.json"));
+const hfs_admin_lang_ko_json_1 = __importDefault(require("./hfs-admin-lang-ko.json"));
+const hfs_admin_lang_ms_json_1 = __importDefault(require("./hfs-admin-lang-ms.json"));
+const hfs_admin_lang_zh_tw_json_1 = __importDefault(require("./hfs-admin-lang-zh-tw.json"));
+const hfs_admin_lang_fr_json_1 = __importDefault(require("./hfs-admin-lang-fr.json"));
+const hfs_admin_lang_pl_json_1 = __importDefault(require("./hfs-admin-lang-pl.json"));
+const hfs_admin_lang_pt_br_json_1 = __importDefault(require("./hfs-admin-lang-pt-br.json"));
+const hfs_admin_lang_vi_json_1 = __importDefault(require("./hfs-admin-lang-vi.json"));
+const hfs_admin_lang_es_json_1 = __importDefault(require("./hfs-admin-lang-es.json"));
+const hfs_admin_lang_nl_json_1 = __importDefault(require("./hfs-admin-lang-nl.json"));
+const hfs_admin_lang_el_json_1 = __importDefault(require("./hfs-admin-lang-el.json"));
+const hfs_admin_lang_de_json_1 = __importDefault(require("./hfs-admin-lang-de.json"));
+const hfs_admin_lang_fi_json_1 = __importDefault(require("./hfs-admin-lang-fi.json"));
+const hfs_admin_lang_hu_json_1 = __importDefault(require("./hfs-admin-lang-hu.json"));
+const hfs_admin_lang_ja_json_1 = __importDefault(require("./hfs-admin-lang-ja.json"));
+const hfs_admin_lang_tr_json_1 = __importDefault(require("./hfs-admin-lang-tr.json"));
+const hfs_admin_lang_th_json_1 = __importDefault(require("./hfs-admin-lang-th.json"));
+const hfs_admin_lang_uk_json_1 = __importDefault(require("./hfs-admin-lang-uk.json"));
+const hfs_admin_lang_ar_json_1 = __importDefault(require("./hfs-admin-lang-ar.json"));
+const hfs_admin_lang_lt_json_1 = __importDefault(require("./hfs-admin-lang-lt.json"));
+const hfs_admin_lang_bg_json_1 = __importDefault(require("./hfs-admin-lang-bg.json"));
+exports.default = { en: hfs_admin_lang_en_json_1.default, it: hfs_admin_lang_it_json_1.default, zh: hfs_admin_lang_zh_json_1.default, ru: hfs_admin_lang_ru_json_1.default, ro: hfs_admin_lang_ro_json_1.default, sr: hfs_admin_lang_sr_json_1.default, 'sr-latn': hfs_admin_lang_sr_latn_json_1.default, ko: hfs_admin_lang_ko_json_1.default, ms: hfs_admin_lang_ms_json_1.default, 'zh-tw': hfs_admin_lang_zh_tw_json_1.default, fr: hfs_admin_lang_fr_json_1.default, pl: hfs_admin_lang_pl_json_1.default, 'pt-br': hfs_admin_lang_pt_br_json_1.default, vi: hfs_admin_lang_vi_json_1.default, es: hfs_admin_lang_es_json_1.default, nl: hfs_admin_lang_nl_json_1.default, el: hfs_admin_lang_el_json_1.default, de: hfs_admin_lang_de_json_1.default, fi: hfs_admin_lang_fi_json_1.default, hu: hfs_admin_lang_hu_json_1.default, ja: hfs_admin_lang_ja_json_1.default, tr: hfs_admin_lang_tr_json_1.default, th: hfs_admin_lang_th_json_1.default, uk: hfs_admin_lang_uk_json_1.default, ar: hfs_admin_lang_ar_json_1.default, lt: hfs_admin_lang_lt_json_1.default, bg: hfs_admin_lang_bg_json_1.default };