roster-server 2.0.4 → 2.1.0

package/skills/roster-server/SKILL.md

@@ -40,8 +40,10 @@ project/
 ├── www/
 │   ├── example.com/
 │   │   └── index.js   # Handler for example.com
-│   └── api.example.com/
-│       └── index.js   # Handler for subdomain
+│   ├── api.example.com/
+│   │   └── index.js   # Handler for subdomain
+│   └── *.example.com/
+│       └── index.js   # Wildcard: one handler for all subdomains
 └── server.js          # Your setup
 ```
 
@@ -104,6 +106,10 @@ roster.register('example.com', (httpsServer) => {
 
 // With custom port
 roster.register('api.example.com:8443', handler);
+
+// Wildcard: one handler for all subdomains (default port or custom)
+roster.register('*.example.com', handler);
+roster.register('*.example.com:8080', handler);
 ```
 
 ## Key Configuration Options
@@ -113,6 +119,7 @@ new Roster({
     email: 'admin@example.com',      // Required for SSL
     wwwPath: '/srv/www',             // Site handlers directory
     greenlockStorePath: '/srv/greenlock.d',  // SSL storage
+    dnsChallenge: { ... },          // Optional override. Default is local/manual DNS-01 (acme-dns-01-cli)
     
     // Environment
     local: false,                    // true = HTTP, false = HTTPS
@@ -138,13 +145,13 @@ new Roster({
 Loads sites, generates SSL config, starts servers. Returns `Promise<void>`.
 
 ### `roster.register(domain, handler)`
-Manually register a domain handler. Domain can include port: `'api.com:8443'`.
+Manually register a domain handler. Domain can include port: `'api.com:8443'`. For wildcards use `'*.example.com'` or `'*.example.com:8080'`.
 
 ### `roster.getUrl(domain)`
 Get environment-aware URL:
 - Local mode: `http://localhost:{port}`
 - Production: `https://{domain}` or `https://{domain}:{port}`
-- Returns `null` if domain not registered
+- Returns `null` if domain not registered. Supports wildcard-matched hosts (e.g. `getUrl('api.example.com')` when `*.example.com` is registered).
 
 ## How It Works
 
@@ -170,6 +177,7 @@ Each domain gets isolated server instance that simulates `http.Server`:
 - Auto-renewal 45 days before expiration
 - SNI support for multiple domains
 - Custom ports reuse certificates via SNI callback
+- **Wildcard** (`*.example.com`): use folder `www/*.example.com/` or `roster.register('*.example.com', handler)`. Default DNS-01 plugin is local/manual `acme-dns-01-cli`; set `dnsChallenge` only when overriding provider integration.
 
 ## Common Issues & Solutions
 

package/test/roster-server.test.js

@@ -0,0 +1,446 @@
+'use strict';
+
+const { describe, it } = require('node:test');
+const assert = require('node:assert');
+const path = require('path');
+const fs = require('fs');
+const http = require('http');
+const os = require('os');
+const Roster = require('../index.js');
+const { wildcardRoot, hostMatchesWildcard } = require('../index.js');
+
+function closePortServers(roster) {
+    if (roster.portServers && typeof roster.portServers === 'object') {
+        for (const server of Object.values(roster.portServers)) {
+            try {
+                server.close();
+            } catch (_) {}
+        }
+    }
+}
+
+function httpGet(host, port, pathname = '/') {
+    return new Promise((resolve, reject) => {
+        const req = http.get(
+            { host, port, path: pathname, headers: { host: host + (port === 80 ? '' : ':' + port) } },
+            (res) => {
+                let body = '';
+                res.on('data', (chunk) => { body += chunk; });
+                res.on('end', () => resolve({ statusCode: res.statusCode, headers: res.headers, body }));
+            }
+        );
+        req.on('error', reject);
+        req.setTimeout(2000, () => { req.destroy(); reject(new Error('timeout')); });
+    });
+}
+
+describe('wildcardRoot', () => {
+    it('returns root domain for *.example.com', () => {
+        assert.strictEqual(wildcardRoot('*.example.com'), 'example.com');
+    });
+    it('returns root for *.sub.example.com', () => {
+        assert.strictEqual(wildcardRoot('*.sub.example.com'), 'sub.example.com');
+    });
+    it('returns null for non-wildcard', () => {
+        assert.strictEqual(wildcardRoot('example.com'), null);
+        assert.strictEqual(wildcardRoot('api.example.com'), null);
+    });
+    it('returns null for empty or null', () => {
+        assert.strictEqual(wildcardRoot(''), null);
+        assert.strictEqual(wildcardRoot(null), null);
+    });
+});
+
+describe('hostMatchesWildcard', () => {
+    it('matches subdomain to pattern', () => {
+        assert.strictEqual(hostMatchesWildcard('api.example.com', '*.example.com'), true);
+        assert.strictEqual(hostMatchesWildcard('app.example.com', '*.example.com'), true);
+        assert.strictEqual(hostMatchesWildcard('a.example.com', '*.example.com'), true);
+    });
+    it('does not match apex domain', () => {
+        assert.strictEqual(hostMatchesWildcard('example.com', '*.example.com'), false);
+    });
+    it('does not match other zones', () => {
+        assert.strictEqual(hostMatchesWildcard('api.other.com', '*.example.com'), false);
+        assert.strictEqual(hostMatchesWildcard('example.com.evil.com', '*.example.com'), false);
+    });
+    it('returns false for invalid pattern', () => {
+        assert.strictEqual(hostMatchesWildcard('api.example.com', 'example.com'), false);
+        assert.strictEqual(hostMatchesWildcard('api.example.com', ''), false);
+        assert.strictEqual(hostMatchesWildcard('api.example.com', null), false);
+    });
+    it('matches case-insensitively (Host header may be any case)', () => {
+        assert.strictEqual(hostMatchesWildcard('Admin.Tagnu.com', '*.tagnu.com'), true);
+        assert.strictEqual(hostMatchesWildcard('API.EXAMPLE.COM', '*.example.com'), true);
+    });
+});
+
+describe('Roster', () => {
+    describe('parseDomainWithPort', () => {
+        it('parses *.example.com with default port', () => {
+            const roster = new Roster({ local: true });
+            assert.deepStrictEqual(roster.parseDomainWithPort('*.example.com'), {
+                domain: '*.example.com',
+                port: 443
+            });
+        });
+        it('parses *.example.com:8080', () => {
+            const roster = new Roster({ local: true });
+            assert.deepStrictEqual(roster.parseDomainWithPort('*.example.com:8080'), {
+                domain: '*.example.com',
+                port: 8080
+            });
+        });
+        it('parses normal domain with port', () => {
+            const roster = new Roster({ local: true });
+            assert.deepStrictEqual(roster.parseDomainWithPort('example.com:8443'), {
+                domain: 'example.com',
+                port: 8443
+            });
+        });
+    });
+
+    describe('register (wildcard)', () => {
+        it('registers *.example.com and resolves handler for subdomain', () => {
+            const roster = new Roster({ local: true });
+            const handler = () => {};
+            roster.register('*.example.com', handler);
+            assert.strictEqual(roster.getHandlerForHost('api.example.com'), handler);
+            assert.strictEqual(roster.getHandlerForHost('app.example.com'), handler);
+            assert.strictEqual(roster.getHandlerForHost('example.com'), null);
+            assert.ok(roster.wildcardZones.has('example.com'));
+        });
+        it('registers *.example.com:8080 with custom port', () => {
+            const roster = new Roster({ local: true });
+            const handler = () => {};
+            roster.register('*.example.com:8080', handler);
+            assert.strictEqual(roster.sites['*.example.com:8080'], handler);
+            assert.ok(roster.wildcardZones.has('example.com'));
+        });
+        it('getHandlerAndKeyForHost returns handler and siteKey for wildcard match', () => {
+            const roster = new Roster({ local: true });
+            const handler = () => {};
+            roster.register('*.example.com', handler);
+            const resolved = roster.getHandlerAndKeyForHost('api.example.com');
+            assert.ok(resolved);
+            assert.strictEqual(resolved.handler, handler);
+            assert.strictEqual(resolved.siteKey, '*.example.com');
+        });
+        it('exact match takes precedence over wildcard', () => {
+            const roster = new Roster({ local: true });
+            const exactHandler = () => {};
+            const wildcardHandler = () => {};
+            roster.register('api.example.com', exactHandler);
+            roster.register('*.example.com', wildcardHandler);
+            assert.strictEqual(roster.getHandlerForHost('api.example.com'), exactHandler);
+        });
+    });
+
+    describe('getHandlerForPortData', () => {
+        it('returns exact match when present', () => {
+            const roster = new Roster({ local: true });
+            const vs = roster.createVirtualServer('example.com');
+            const handler = () => {};
+            const portData = {
+                virtualServers: { 'example.com': vs },
+                appHandlers: { 'example.com': handler }
+            };
+            const resolved = roster.getHandlerForPortData('example.com', portData);
+            assert.ok(resolved);
+            assert.strictEqual(resolved.virtualServer, vs);
+            assert.strictEqual(resolved.appHandler, handler);
+        });
+        it('returns wildcard match for subdomain', () => {
+            const roster = new Roster({ local: true });
+            const vs = roster.createVirtualServer('*.example.com');
+            const handler = () => {};
+            const portData = {
+                virtualServers: { '*.example.com': vs },
+                appHandlers: { '*.example.com': handler }
+            };
+            const resolved = roster.getHandlerForPortData('api.example.com', portData);
+            assert.ok(resolved);
+            assert.strictEqual(resolved.virtualServer, vs);
+            assert.strictEqual(resolved.appHandler, handler);
+        });
+        it('returns null when no match', () => {
+            const roster = new Roster({ local: true });
+            const portData = { virtualServers: {}, appHandlers: {} };
+            assert.strictEqual(roster.getHandlerForPortData('unknown.com', portData), null);
+        });
+    });
+
+    describe('getUrl (wildcard)', () => {
+        it('returns URL for wildcard-matched host in local mode', () => {
+            const roster = new Roster({ local: true });
+            roster.register('*.example.com', () => {});
+            roster.domainPorts = { '*.example.com': 9999 };
+            roster.local = true;
+            assert.strictEqual(roster.getUrl('api.example.com'), 'http://localhost:9999');
+        });
+        it('returns https URL for wildcard-matched host in production', () => {
+            const roster = new Roster({ local: false });
+            roster.register('*.example.com', () => {});
+            roster.local = false;
+            assert.strictEqual(roster.getUrl('api.example.com'), 'https://api.example.com');
+        });
+        it('returns null for host that matches no site', () => {
+            const roster = new Roster({ local: true });
+            assert.strictEqual(roster.getUrl('unknown.com'), null);
+        });
+    });
+
+    describe('register validation', () => {
+        it('throws when domain is missing', () => {
+            const roster = new Roster({ local: true });
+            assert.throws(() => roster.register('', () => {}), /Domain is required/);
+            assert.throws(() => roster.register(null, () => {}), /Domain is required/);
+        });
+        it('throws when handler is not a function', () => {
+            const roster = new Roster({ local: true });
+            assert.throws(() => roster.register('*.example.com', {}), /requestHandler must be a function/);
+        });
+    });
+
+    describe('constructor', () => {
+        it('throws when port is 80 and not local', () => {
+            assert.throws(() => new Roster({ port: 80, local: false }), /Port 80 is reserved/);
+        });
+        it('allows port 80 when local is true', () => {
+            const roster = new Roster({ port: 80, local: true });
+            assert.strictEqual(roster.defaultPort, 80);
+        });
+        it('sets defaultPort 443 when port not given', () => {
+            const roster = new Roster({ local: true });
+            assert.strictEqual(roster.defaultPort, 443);
+        });
+        it('uses acme-dns-01-cli by default (resolved to absolute path for Greenlock)', () => {
+            const roster = new Roster({ local: false });
+            assert.ok(roster.dnsChallenge);
+            assert.strictEqual(typeof roster.dnsChallenge.module, 'string');
+            assert.ok(require('path').isAbsolute(roster.dnsChallenge.module));
+            assert.ok(roster.dnsChallenge.module.includes('acme-dns-01-cli-wrapper'));
+            assert.strictEqual(roster.dnsChallenge.propagationDelay, 120000);
+            assert.strictEqual(roster.dnsChallenge.autoContinue, false);
+            assert.strictEqual(roster.dnsChallenge.dryRunDelay, 120000);
+        });
+        it('normalizes explicit acme-dns-01-cli module to wrapper and sets default propagationDelay', () => {
+            const roster = new Roster({ local: false, dnsChallenge: { module: 'acme-dns-01-cli' } });
+            assert.ok(require('path').isAbsolute(roster.dnsChallenge.module));
+            assert.ok(roster.dnsChallenge.module.includes('acme-dns-01-cli-wrapper'));
+            assert.strictEqual(roster.dnsChallenge.propagationDelay, 120000);
+            assert.strictEqual(roster.dnsChallenge.autoContinue, false);
+            assert.strictEqual(roster.dnsChallenge.dryRunDelay, 120000);
+        });
+        it('keeps explicit non-cli dnsChallenge module as-is', () => {
+            const roster = new Roster({ local: false, dnsChallenge: { module: 'acme-dns-01-route53', token: 'x' } });
+            assert.strictEqual(roster.dnsChallenge.module, 'acme-dns-01-route53');
+            assert.strictEqual(roster.dnsChallenge.token, 'x');
+            assert.strictEqual(roster.dnsChallenge.propagationDelay, 120000);
+            assert.strictEqual(roster.dnsChallenge.autoContinue, false);
+            assert.strictEqual(roster.dnsChallenge.dryRunDelay, 120000);
+        });
+        it('normalizes explicit acme-dns-01-cli absolute path to wrapper', () => {
+            const path = require('path');
+            const roster = new Roster({
+                local: false,
+                dnsChallenge: { module: path.join('/srv/roster/node_modules/acme-dns-01-cli', 'index.js') }
+            });
+            assert.ok(require('path').isAbsolute(roster.dnsChallenge.module));
+            assert.ok(roster.dnsChallenge.module.includes('acme-dns-01-cli-wrapper'));
+            assert.strictEqual(roster.dnsChallenge.propagationDelay, 120000);
+            assert.strictEqual(roster.dnsChallenge.autoContinue, false);
+            assert.strictEqual(roster.dnsChallenge.dryRunDelay, 120000);
+        });
+        it('allows disabling DNS challenge with dnsChallenge: false', () => {
+            const roster = new Roster({ local: false, dnsChallenge: false });
+            assert.strictEqual(roster.dnsChallenge, null);
+        });
+    });
+
+    describe('register (normal domain)', () => {
+        it('adds domain and www when domain has fewer than 2 dots', () => {
+            const roster = new Roster({ local: true });
+            const handler = () => {};
+            roster.register('example.com', handler);
+            assert.strictEqual(roster.sites['example.com'], handler);
+            assert.strictEqual(roster.sites['www.example.com'], handler);
+        });
+        it('does not add www for multi-label domain', () => {
+            const roster = new Roster({ local: true });
+            const handler = () => {};
+            roster.register('api.example.com', handler);
+            assert.strictEqual(roster.sites['api.example.com'], handler);
+            assert.strictEqual(roster.sites['www.api.example.com'], undefined);
+        });
+    });
+
+    describe('getUrl (exact domain)', () => {
+        it('returns http://localhost:PORT in local mode for registered domain', () => {
+            const roster = new Roster({ local: true });
+            roster.register('exact.local', () => {});
+            roster.domainPorts = { 'exact.local': 4567 };
+            roster.local = true;
+            assert.strictEqual(roster.getUrl('exact.local'), 'http://localhost:4567');
+        });
+        it('returns https URL in production for registered domain', () => {
+            const roster = new Roster({ local: false });
+            roster.register('example.com', () => {});
+            roster.local = false;
+            assert.strictEqual(roster.getUrl('example.com'), 'https://example.com');
+        });
+        it('strips www and returns canonical URL (same as non-www)', () => {
+            const roster = new Roster({ local: false });
+            roster.register('example.com', () => {});
+            assert.strictEqual(roster.getUrl('www.example.com'), 'https://example.com');
+            assert.strictEqual(roster.getUrl('example.com'), 'https://example.com');
+        });
+    });
+
+    describe('handleRequest', () => {
+        it('redirects www to non-www with 301', () => {
+            const roster = new Roster({ local: true });
+            const res = {
+                writeHead: (status, headers) => {
+                    assert.strictEqual(status, 301);
+                    assert.strictEqual(headers.Location, 'https://example.com/');
+                },
+                end: () => {}
+            };
+            roster.handleRequest(
+                { headers: { host: 'www.example.com' }, url: '/' },
+                res
+            );
+        });
+        it('returns 404 when host has no handler', () => {
+            const roster = new Roster({ local: true });
+            let status;
+            const res = {
+                writeHead: (s) => { status = s; },
+                end: () => {}
+            };
+            roster.handleRequest(
+                { headers: { host: 'unknown.example.com' }, url: '/' },
+                res
+            );
+            assert.strictEqual(status, 404);
+        });
+        it('invokes handler for registered host', () => {
+            const roster = new Roster({ local: true });
+            let called = false;
+            roster.register('example.com', (req, res) => {
+                called = true;
+                res.writeHead(200);
+                res.end('ok');
+            });
+            const res = {
+                writeHead: () => {},
+                end: () => {}
+            };
+            roster.handleRequest(
+                { headers: { host: 'example.com' }, url: '/' },
+                res
+            );
+            assert.strictEqual(called, true);
+        });
+    });
+});
+
+describe('Roster local mode (local: true)', () => {
+    it('starts HTTP server and responds for registered domain', async () => {
+        const roster = new Roster({
+            local: true,
+            minLocalPort: 19090,
+            maxLocalPort: 19099,
+            hostname: 'localhost'
+        });
+        const body = 'local-mode-ok';
+        roster.register('testlocal.example', (server) => {
+            return (req, res) => {
+                res.writeHead(200, { 'Content-Type': 'text/plain' });
+                res.end(body);
+            };
+        });
+        await roster.start();
+        try {
+            const port = roster.domainPorts['testlocal.example'];
+            assert.ok(typeof port === 'number' && port >= 19090 && port <= 19099);
+            await new Promise((r) => setTimeout(r, 50));
+            const result = await httpGet('localhost', port, '/');
+            assert.strictEqual(result.statusCode, 200);
+            assert.strictEqual(result.body, body);
+        } finally {
+            closePortServers(roster);
+        }
+    });
+
+    it('getUrl returns localhost URL after start', async () => {
+        const roster = new Roster({
+            local: true,
+            minLocalPort: 19100,
+            maxLocalPort: 19109
+        });
+        roster.register('geturltest.example', () => () => {});
+        await roster.start();
+        try {
+            const url = roster.getUrl('geturltest.example');
+            assert.ok(url && url.startsWith('http://localhost:'));
+            assert.ok(roster.domainPorts['geturltest.example'] !== undefined);
+        } finally {
+            closePortServers(roster);
+        }
+    });
+});
+
+describe('Roster loadSites', () => {
+    it('loads site from www directory and registers domain + www', async () => {
+        const tmpDir = fs.mkdtempSync(path.join(os.tmpdir(), 'roster-test-'));
+        const wwwPath = path.join(tmpDir, 'www');
+        const siteDir = path.join(wwwPath, 'loaded.example');
+        fs.mkdirSync(siteDir, { recursive: true });
+        fs.writeFileSync(
+            path.join(siteDir, 'index.js'),
+            'module.exports = () => (req, res) => { res.writeHead(200); res.end("loaded"); };',
+            'utf8'
+        );
+        try {
+            const roster = new Roster({ wwwPath, local: true });
+            await roster.loadSites();
+            assert.ok(roster.sites['loaded.example']);
+            assert.ok(roster.sites['www.loaded.example']);
+            const handler = roster.sites['loaded.example'];
+            assert.strictEqual(typeof handler, 'function');
+        } finally {
+            fs.rmSync(tmpDir, { recursive: true, force: true });
+        }
+    });
+
+    it('loads wildcard site from www/*.example.com directory', async () => {
+        const tmpDir = fs.mkdtempSync(path.join(os.tmpdir(), 'roster-test-'));
+        const wwwPath = path.join(tmpDir, 'www');
+        const siteDir = path.join(wwwPath, '*.wildcard.example');
+        fs.mkdirSync(siteDir, { recursive: true });
+        fs.writeFileSync(
+            path.join(siteDir, 'index.js'),
+            'module.exports = () => (req, res) => { res.writeHead(200); res.end("wildcard"); };',
+            'utf8'
+        );
+        try {
+            const roster = new Roster({ wwwPath, local: true });
+            await roster.loadSites();
+            assert.ok(roster.sites['*.wildcard.example']);
+            assert.ok(roster.wildcardZones.has('wildcard.example'));
+            assert.strictEqual(roster.getHandlerForHost('api.wildcard.example'), roster.sites['*.wildcard.example']);
+        } finally {
+            fs.rmSync(tmpDir, { recursive: true, force: true });
+        }
+    });
+
+    it('does not throw when www path does not exist', async () => {
+        const roster = new Roster({
+            wwwPath: path.join(os.tmpdir(), 'roster-nonexistent-' + Date.now()),
+            local: true
+        });
+        await assert.doesNotReject(roster.loadSites());
+    });
+});

package/vendor/acme-dns-01-cli-wrapper.js

@@ -0,0 +1,161 @@
+'use strict';
+
+const legacyCli = require('acme-dns-01-cli');
+
+function toPromise(fn, context) {
+    if (typeof fn !== 'function') {
+        return async function () {
+            return null;
+        };
+    }
+
+    return async function (opts) {
+        return new Promise((resolve, reject) => {
+            let done = false;
+            const finish = (err, result) => {
+                if (done) return;
+                done = true;
+                if (err) reject(err);
+                else resolve(result);
+            };
+
+            try {
+                // Legacy callback style
+                if (fn.length >= 2) {
+                    fn.call(context, opts, finish);
+                    return;
+                }
+
+                // Promise or sync style
+                Promise.resolve(fn.call(context, opts)).then(
+                    (result) => finish(null, result),
+                    finish
+                );
+            } catch (err) {
+                finish(err);
+            }
+        });
+    };
+}
+
+module.exports.create = function create(config = {}) {
+    const challenger = legacyCli.create(config);
+    const propagationDelay = Number.isFinite(config.propagationDelay)
+        ? config.propagationDelay
+        : 120000;
+    const envAutoContinue = process.env.ROSTER_DNS_AUTO_CONTINUE;
+    const parseAutoContinue = (value, fallback) => {
+        if (value === undefined || value === null || value === '') return fallback;
+        const normalized = String(value).trim().toLowerCase();
+        if (['1', 'true', 'yes', 'on'].includes(normalized)) return true;
+        if (['0', 'false', 'no', 'off'].includes(normalized)) return false;
+        return fallback;
+    };
+    const autoContinue = config.autoContinue !== undefined
+        ? parseAutoContinue(config.autoContinue, false)
+        : parseAutoContinue(envAutoContinue, false);
+    const dryRunDelay = Number.isFinite(config.dryRunDelay)
+        ? config.dryRunDelay
+        : Number.isFinite(Number(process.env.ROSTER_DNS_DRYRUN_DELAY_MS))
+            ? Number(process.env.ROSTER_DNS_DRYRUN_DELAY_MS)
+            : propagationDelay;
+
+    function sleep(ms) {
+        return new Promise((resolve) => setTimeout(resolve, ms));
+    }
+
+    const presentedByHost = new Map();
+
+    async function setChallenge(opts) {
+        const isInteractive = Boolean(process.stdin && process.stdin.isTTY);
+        if (isInteractive && !autoContinue) {
+            return toPromise(challenger.set, challenger)(opts);
+        }
+
+        const ch = opts?.challenge || {};
+        console.info('');
+        console.info("[ACME dns-01 '" + (ch.altname || opts?.altname || 'unknown') + "' CHALLENGE]");
+        console.info("You're about to receive the following DNS query:");
+        console.info('');
+        const dnsHost = String(ch.dnsHost || '');
+        const dnsAuth = ch.dnsAuthorization || opts?.dnsAuthorization || null;
+        if (dnsHost && dnsAuth) {
+            presentedByHost.set(dnsHost, dnsAuth);
+        }
+        const isDryRunChallenge = dnsHost.includes('_greenlock-dryrun-');
+        const effectiveDelay = isDryRunChallenge
+            ? Math.max(0, dryRunDelay)
+            : propagationDelay;
+
+        console.info(
+            '\tTXT\t' +
+                (ch.dnsHost || '_acme-challenge.<domain>') +
+                '\t' +
+                (ch.dnsAuthorization || '<dns-authorization-token>') +
+                '\tTTL 60'
+        );
+        console.info('');
+        console.info(
+            'Non-interactive mode (or autoContinue) detected. ' +
+            'Set the TXT record now. Continuing automatically in ' +
+            effectiveDelay +
+            'ms...'
+        );
+        await sleep(effectiveDelay);
+        return null;
+    }
+
+    async function getChallenge(opts) {
+        const ch = opts?.challenge || {};
+        const dnsHost = String(ch.dnsHost || opts?.dnsHost || '');
+        const dnsAuthorization =
+            ch.dnsAuthorization ||
+            opts?.dnsAuthorization ||
+            (dnsHost ? presentedByHost.get(dnsHost) : null);
+
+        if (!dnsAuthorization) {
+            return null;
+        }
+
+        return {
+            ...(typeof ch === 'object' ? ch : {}),
+            dnsAuthorization
+        };
+    }
+
+    const wrapped = {
+        propagationDelay,
+        set: setChallenge,
+        remove: toPromise(challenger.remove, challenger),
+        get: getChallenge,
+        zones: async (opts) => {
+            const dnsHost =
+                opts?.dnsHost ||
+                opts?.challenge?.dnsHost ||
+                opts?.challenge?.altname ||
+                opts?.altname;
+
+            if (!dnsHost || typeof dnsHost !== 'string') {
+                return [];
+            }
+
+            // Best-effort root zone extraction for legacy/manual flow.
+            const zone = dnsHost
+                .replace(/^_acme-challenge\./, '')
+                .replace(/^_greenlock-[^.]+\./, '')
+                .replace(/\.$/, '');
+
+            return zone ? [zone] : [];
+        }
+    };
+
+    if (typeof challenger.init === 'function') {
+        wrapped.init = toPromise(challenger.init, challenger);
+    }
+
+    if (challenger.options && typeof challenger.options === 'object') {
+        wrapped.options = { ...challenger.options };
+    }
+
+    return wrapped;
+};