roster-server 2.0.6 → 2.1.0

package/README.md

@@ -46,17 +46,42 @@ Your project should look something like this:
 └── www/
     ├── example.com/
     │   └── index.js
-    └── subdomain.example.com/
+    ├── subdomain.example.com/
     │   └── index.js
-    └── other-domain.com/
-        └── index.js        
+    ├── other-domain.com/
+    │   └── index.js
+    └── *.example.com/          # Wildcard: one handler for all subdomains (api.example.com, app.example.com, etc.)
+        └── index.js
 ```
 
+### Wildcard DNS (*.example.com)
+
+You can serve all subdomains of a domain with a single handler in three ways:
+
+1. **Folder**: Create a directory named literally `*.example.com` under `www` (e.g. `www/*.example.com/index.js`). Any request to `api.example.com`, `app.example.com`, etc. will use that handler.
+2. **Register (default port)**: `roster.register('*.example.com', handler)` for the default HTTPS port.
+3. **Register (custom port)**: `roster.register('*.example.com:8080', handler)` for a specific port.
+
+Wildcard SSL certificates require **DNS-01** validation (Let's Encrypt does not support HTTP-01 for wildcards). By default Roster uses `acme-dns-01-cli` through an internal wrapper (adds `propagationDelay` and modern plugin signatures). Override with a custom plugin:
+
+```javascript
+import Roster from 'roster-server';
+
+const roster = new Roster({
+    email: 'admin@example.com',
+    wwwPath: '/srv/www',
+    greenlockStorePath: '/srv/greenlock.d',
+    dnsChallenge: { module: 'acme-dns-01-route53', /* provider options */ }  // optional override
+});
+```
+
+Set `dnsChallenge: false` to disable. For other DNS providers install the plugin in your app and pass it. See [Greenlock DNS plugins](https://git.rootprojects.org/root/greenlock-express.js#dns-01-challenge-plugins).
+
 ### Setting Up Your Server
 
 ```javascript
 // /srv/roster/server.js
-const Roster = require('roster-server');
+import Roster from 'roster-server';
 
 const options = {
     email: 'admin@example.com',
@@ -78,7 +103,7 @@ I'll help analyze the example files shown. You have 3 different implementations
 
 1. **Basic HTTP Handler**:
 ```javascript:demo/www/example.com/index.js
-module.exports = (httpsServer) => {
+export default (httpsServer) => {
     return (req, res) => {
         res.writeHead(200, { 'Content-Type': 'text/plain; charset=utf-8' });
         res.end('"Loco de pensar, queriendo entrar en razón, y el corazón tiene razones que la propia razón nunca entenderá."');
@@ -88,9 +113,9 @@ module.exports = (httpsServer) => {
 
 2. **Express App**:
 ```javascript:demo/www/express.example.com/index.js
-const express = require('express');
+import express from 'express';
 
-module.exports = (httpsServer) => {
+export default (httpsServer) => {
     const app = express();
     app.get('/', (req, res) => {
         res.setHeader('Content-Type', 'text/plain; charset=utf-8');
@@ -103,9 +128,9 @@ module.exports = (httpsServer) => {
 
 3. **Socket.IO Server**:
 ```javascript:demo/www/sio.example.com/index.js
-const { Server } = require('socket.io');
+import { Server } from 'socket.io';
 
-module.exports = (httpsServer) => {
+export default (httpsServer) => {
     const io = new Server(httpsServer);
 
     io.on('connection', (socket) => {
@@ -185,6 +210,7 @@ When creating a new `RosterServer` instance, you can pass the following options:
 - `email` (string): Your email for Let's Encrypt notifications.
 - `wwwPath` (string): Path to your `www` directory containing your sites.
 - `greenlockStorePath` (string): Directory for Greenlock configuration.
+- `dnsChallenge` (object|false): Optional override for wildcard DNS-01 challenge config. Default is local/manual `acme-dns-01-cli` wrapper with `propagationDelay: 120000`, `autoContinue: false`, and `dryRunDelay: 120000`. This is safer for manual DNS providers (Linode/Cloudflare UI) because Roster waits longer and does not auto-advance in interactive terminals. Set `false` to disable. You can pass `{ module: '...', propagationDelay: 180000 }` to tune DNS wait time (ms). Set `autoContinue: true` (or env `ROSTER_DNS_AUTO_CONTINUE=1`) to continue automatically after delay. For Greenlock dry-runs (`_greenlock-dryrun-*`), delay defaults to `dryRunDelay` (same as `propagationDelay` unless overridden with `dnsChallenge.dryRunDelay` or env `ROSTER_DNS_DRYRUN_DELAY_MS`).
 - `staging` (boolean): Set to `true` to use Let's Encrypt's staging environment (for testing).
 - `local` (boolean): Set to `true` to run in local development mode.
 - `minLocalPort` (number): Minimum port for local mode (default: 4000).
@@ -199,6 +225,8 @@ When `{ local: true }` is enabled, RosterServer **Skips SSL/HTTPS**: Runs pure H
 ### Setting Up Local Mode
 
 ```javascript
+import Roster from 'roster-server';
+
 const server = new Roster({
     wwwPath: '/srv/www',
     local: true,  // Enable local development mode
@@ -219,6 +247,8 @@ In local mode, domains are automatically assigned ports based on a CRC32 hash of
 You can customize the port range:
 
 ```javascript
+import Roster from 'roster-server';
+
 const roster = new Roster({ 
     local: true,
     minLocalPort: 5000,  // Start from port 5000
@@ -233,6 +263,8 @@ RosterServer provides a method to get the URL for a domain that adapts automatic
 **Instance Method: `roster.getUrl(domain)`**
 
 ```javascript
+import Roster from 'roster-server';
+
 const roster = new Roster({ local: true });
 roster.register('example.com', handler);
 
@@ -255,6 +287,8 @@ This method:
 **Example Usage:**
 
 ```javascript
+import Roster from 'roster-server';
+
 // Local development
 const localRoster = new Roster({ local: true });
 localRoster.register('example.com', handler);

package/demo/wildcard-example.js

@@ -0,0 +1,31 @@
+/**
+ * Wildcard DNS demo: one handler for all subdomains (*.example.com)
+ *
+ * Run from repo root: node demo/wildcard-example.js
+ * Then open the printed URL (or use curl with Host header) to see the wildcard response.
+ * Any subdomain (api.example.com, app.example.com, foo.example.com) uses the same handler.
+ */
+const Roster = require('../index.js');
+const path = require('path');
+const { wildcardRoot } = require('../index.js');
+
+const roster = new Roster({
+    local: true,
+    wwwPath: path.join(__dirname, 'www'),
+});
+
+roster.start().then(() => {
+    const wildcardPattern = roster.domains.find((d) => d.startsWith('*.'));
+    const subdomain = wildcardPattern ? 'api.' + wildcardRoot(wildcardPattern) : 'api.example.com';
+    const wildcardUrl = roster.getUrl(subdomain);
+
+    console.log('\n🌐 Wildcard demo');
+    console.log('   Loaded:', wildcardPattern ? `https://${wildcardPattern}` : '(none)');
+    console.log('   Any subdomain uses the same handler.\n');
+    console.log('   Try:', wildcardUrl || '(no wildcard site in www path)');
+    if (wildcardUrl) {
+        const host = wildcardPattern ? 'api.' + wildcardRoot(wildcardPattern) : 'api.example.com';
+        console.log('   Or:  curl -H "Host: ' + host + '"', wildcardUrl);
+    }
+    console.log('');
+});

package/index.js

@@ -33,6 +33,20 @@ function domainToPort(domain, minPort = 3000, maxPort = 65535) {
     return minPort + (hash % portRange);
 }
 
+// Wildcard helpers: *.example.com -> root "example.com"
+function wildcardRoot(pattern) {
+    if (!pattern || !pattern.startsWith('*.')) return null;
+    return pattern.split('.').slice(1).join('.');
+}
+
+// Check if host matches wildcard pattern (e.g. api.example.com matches *.example.com)
+function hostMatchesWildcard(host, pattern) {
+    if (!pattern || !pattern.startsWith('*.')) return false;
+    const h = (host || '').toLowerCase();
+    const suffix = pattern.slice(2).toLowerCase(); // "example.com"
+    return h.endsWith('.' + suffix) && h.length > suffix.length;
+}
+
 // Virtual Server that completely isolates applications
 class VirtualServer extends EventEmitter {
     constructor(domain) {
@@ -158,6 +172,7 @@ class Roster {
         this.local = options.local || false;
         this.domains = [];
         this.sites = {};
+        this.wildcardZones = new Set(); // Root domains that have a wildcard site (e.g. "example.com" for *.example.com)
         this.domainServers = {}; // Store separate servers for each domain
         this.portServers = {}; // Store servers by port
         this.domainPorts = {}; // Store domain → port mapping for local mode
@@ -174,6 +189,38 @@ class Roster {
             throw new Error('⚠️  Port 80 is reserved for ACME challenge. Please use a different port.');
         }
         this.defaultPort = port;
+        // Use a local wrapper around acme-dns-01-cli so we can provide propagationDelay,
+        // zones(), and Promise-style signatures expected by newer ACME validators.
+        const defaultDnsChallengeModule = path.join(__dirname, 'vendor', 'acme-dns-01-cli-wrapper.js');
+        const shouldUseCliWrapper = (moduleName) =>
+            typeof moduleName === 'string' &&
+            /(^|[\\/])acme-dns-01-cli([\\/]|$)/.test(moduleName);
+
+        if (options.dnsChallenge === false) {
+            this.dnsChallenge = null;
+        } else if (options.dnsChallenge) {
+            const provided = { ...options.dnsChallenge };
+            if (shouldUseCliWrapper(provided.module) || provided.module === 'acme-dns-01-cli') {
+                provided.module = defaultDnsChallengeModule;
+            }
+            if (provided.propagationDelay === undefined) {
+                provided.propagationDelay = 120000;
+            }
+            if (provided.autoContinue === undefined) {
+                provided.autoContinue = false;
+            }
+            if (provided.dryRunDelay === undefined) {
+                provided.dryRunDelay = provided.propagationDelay;
+            }
+            this.dnsChallenge = provided;
+        } else {
+            this.dnsChallenge = {
+                module: defaultDnsChallengeModule,
+                propagationDelay: 120000,
+                autoContinue: false,
+                dryRunDelay: 120000
+            };
+        }
     }
 
     async loadSites() {
@@ -212,13 +259,21 @@ class Roster {
             }
 
             if (siteApp) {
-                const domainEntries = [domain, `www.${domain}`];
-                this.domains.push(...domainEntries);
-                domainEntries.forEach(d => {
-                    this.sites[d] = siteApp;
-                });
-
-                log.info(`(✔) Loaded site: https://${domain}`);
+                if (domain.startsWith('*.')) {
+                    // Wildcard site: one handler for all subdomains (e.g. *.example.com)
+                    this.domains.push(domain);
+                    this.sites[domain] = siteApp;
+                    const root = wildcardRoot(domain);
+                    if (root) this.wildcardZones.add(root);
+                    log.info(`(✔) Loaded wildcard site: https://${domain}`);
+                } else {
+                    const domainEntries = [domain, `www.${domain}`];
+                    this.domains.push(...domainEntries);
+                    domainEntries.forEach(d => {
+                        this.sites[d] = siteApp;
+                    });
+                    log.info(`(✔) Loaded site: https://${domain}`);
+                }
             } else {
                 log.warn(`⚠️  No index file (js/mjs/cjs) found in ${domainPath}`);
             }
@@ -237,8 +292,8 @@ class Roster {
         const uniqueDomains = new Set();
 
         this.domains.forEach(domain => {
-            const rootDomain = domain.replace(/^www\./, '');
-            uniqueDomains.add(rootDomain);
+            const root = domain.startsWith('*.') ? wildcardRoot(domain) : domain.replace(/^www\./, '');
+            if (root) uniqueDomains.add(root);
         });
 
         let existingConfig = {};
@@ -252,6 +307,9 @@ class Roster {
             if ((domain.match(/\./g) || []).length < 2) {
                 altnames.push(`www.${domain}`);
             }
+            if (this.wildcardZones.has(domain)) {
+                altnames.push(`*.${domain}`);
+            }
 
             let existingSite = null;
             if (existingConfig.sites) {
@@ -264,7 +322,35 @@ class Roster {
             };
 
             if (existingSite && existingSite.renewAt) {
-                siteConfig.renewAt = existingSite.renewAt;
+                const existingAltnames = Array.isArray(existingSite.altnames)
+                    ? [...existingSite.altnames].sort()
+                    : [];
+                const nextAltnames = [...altnames].sort();
+                const sameAltnames =
+                    existingAltnames.length === nextAltnames.length &&
+                    existingAltnames.every((name, idx) => name === nextAltnames[idx]);
+
+                // Keep renewAt only when certificate identifiers are unchanged.
+                // If altnames changed (e.g. wildcard added), force immediate re-issue.
+                if (sameAltnames) {
+                    siteConfig.renewAt = existingSite.renewAt;
+                }
+            }
+
+            if (this.wildcardZones.has(domain) && this.dnsChallenge) {
+                const dns01 = { ...this.dnsChallenge };
+                if (dns01.propagationDelay === undefined) {
+                    dns01.propagationDelay = 120000; // 120s default for manual DNS (acme-dns-01-cli)
+                }
+                if (dns01.autoContinue === undefined) {
+                    dns01.autoContinue = false;
+                }
+                if (dns01.dryRunDelay === undefined) {
+                    dns01.dryRunDelay = dns01.propagationDelay;
+                }
+                siteConfig.challenges = {
+                    'dns-01': dns01
+                };
             }
 
             sitesConfig.push(siteConfig);
@@ -310,6 +396,47 @@ class Roster {
         log.info(`📁  config.json generated at ${configPath}`);
     }
 
+    /**
+     * Resolve handler for a host (exact match, then wildcard). Used when port is not in the key.
+     */
+    getHandlerForHost(host) {
+        const resolved = this.getHandlerAndKeyForHost(host);
+        return resolved ? resolved.handler : null;
+    }
+
+    /**
+     * Resolve handler and site key for a host (exact match, then wildcard). Used by getUrl for wildcard lookups.
+     */
+    getHandlerAndKeyForHost(host) {
+        const siteApp = this.sites[host];
+        if (siteApp) return { handler: siteApp, siteKey: host };
+        for (const key of Object.keys(this.sites)) {
+            if (key.startsWith('*.')) {
+                const pattern = key.split(':')[0];
+                if (hostMatchesWildcard(host, pattern)) return { handler: this.sites[key], siteKey: key };
+            }
+        }
+        return null;
+    }
+
+    /**
+     * Resolve virtualServer and appHandler for a host from portData (exact then wildcard).
+     */
+    getHandlerForPortData(host, portData) {
+        const virtualServer = portData.virtualServers[host];
+        const appHandler = portData.appHandlers[host];
+        if (virtualServer && appHandler !== undefined) return { virtualServer, appHandler };
+        for (const key of Object.keys(portData.appHandlers)) {
+            if (key.startsWith('*.') && hostMatchesWildcard(host, key)) {
+                return {
+                    virtualServer: portData.virtualServers[key],
+                    appHandler: portData.appHandlers[key]
+                };
+            }
+        }
+        return null;
+    }
+
     handleRequest(req, res) {
         const host = req.headers.host || '';
 
@@ -320,7 +447,8 @@ class Roster {
             return;
         }
 
-        const siteApp = this.sites[host];
+        const hostWithoutPort = host.split(':')[0];
+        const siteApp = this.getHandlerForHost(hostWithoutPort);
         if (siteApp) {
             siteApp(req, res);
         } else {
@@ -339,6 +467,16 @@ class Roster {
 
         const { domain, port } = this.parseDomainWithPort(domainString);
 
+        if (domain.startsWith('*.')) {
+            const domainKey = port === this.defaultPort ? domain : `${domain}:${port}`;
+            this.domains.push(domain);
+            this.sites[domainKey] = requestHandler;
+            const root = wildcardRoot(domain);
+            if (root) this.wildcardZones.add(root);
+            log.info(`(✔) Registered wildcard site: ${domain}${port !== this.defaultPort ? ':' + port : ''}`);
+            return this;
+        }
+
         const domainEntries = [domain];
         if ((domain.match(/\./g) || []).length < 2) {
             domainEntries.push(`www.${domain}`);
@@ -346,7 +484,6 @@ class Roster {
 
         this.domains.push(...domainEntries);
         domainEntries.forEach(d => {
-            // Store with port information
             const domainKey = port === this.defaultPort ? d : `${d}:${port}`;
             this.sites[domainKey] = requestHandler;
         });
@@ -370,31 +507,25 @@ class Roster {
 
     /**
      * Get the URL for a domain based on the current environment
-     * @param {string} domain - The domain name
-     * @returns {string|null} The URL if domain is registered, null otherwise
+     * @param {string} domain - The domain name (or subdomain that matches a wildcard site)
+     * @returns {string|null} The URL if domain is registered (exact or wildcard), null otherwise
      */
     getUrl(domain) {
-        // Remove www prefix if present
         const cleanDomain = domain.startsWith('www.') ? domain.slice(4) : domain;
 
-        // Check if domain is registered
-        const isRegistered = this.sites[cleanDomain] || this.sites[`www.${cleanDomain}`];
-        if (!isRegistered) {
-            return null;
-        }
+        const exactMatch = this.sites[cleanDomain] || this.sites[`www.${cleanDomain}`];
+        const resolved = exactMatch ? { handler: exactMatch, siteKey: cleanDomain } : this.getHandlerAndKeyForHost(cleanDomain);
+        if (!resolved) return null;
 
-        // Return URL based on environment
         if (this.local) {
-            // Local mode: return localhost URL with assigned port
-            if (this.domainPorts && this.domainPorts[cleanDomain]) {
-                return `http://localhost:${this.domainPorts[cleanDomain]}`;
+            const pattern = resolved.siteKey.split(':')[0];
+            if (this.domainPorts && this.domainPorts[pattern] !== undefined) {
+                return `http://localhost:${this.domainPorts[pattern]}`;
             }
             return null;
-        } else {
-            // Production mode: return HTTPS URL
-            const port = this.defaultPort === 443 ? '' : `:${this.defaultPort}`;
-            return `https://${cleanDomain}${port}`;
         }
+        const port = this.defaultPort === 443 ? '' : `:${this.defaultPort}`;
+        return `https://${cleanDomain}${port}`;
     }
 
     createVirtualServer(domain) {
@@ -517,7 +648,18 @@ class Roster {
             configDir: this.greenlockStorePath,
             maintainerEmail: this.email,
             cluster: this.cluster,
-            staging: this.staging
+            staging: this.staging,
+            notify: (event, details) => {
+                const msg = typeof details === 'string' ? details : (details?.message ?? JSON.stringify(details));
+                // Suppress known benign warnings from ACME when using acme-dns-01-cli
+                if (event === 'warning' && typeof msg === 'string') {
+                    if (/acme-dns-01-cli.*(incorrect function signatures|deprecated use of callbacks)/i.test(msg)) return;
+                    if (/dns-01 challenge plugin should have zones/i.test(msg)) return;
+                }
+                if (event === 'error') log.error(msg);
+                else if (event === 'warning') log.warn(msg);
+                else log.info(msg);
+            }
         });
 
         return greenlock.ready(glx => {
@@ -535,15 +677,15 @@ class Roster {
                         };
                     }
 
-                    // Create completely isolated virtual server
                     const virtualServer = this.createVirtualServer(domain);
                     sitesByPort[port].virtualServers[domain] = virtualServer;
                     this.domainServers[domain] = virtualServer;
 
-                    // Initialize app with virtual server
                     const appHandler = siteApp(virtualServer);
                     sitesByPort[port].appHandlers[domain] = appHandler;
-                    sitesByPort[port].appHandlers[`www.${domain}`] = appHandler;
+                    if (!domain.startsWith('*.')) {
+                        sitesByPort[port].appHandlers[`www.${domain}`] = appHandler;
+                    }
                 }
             }
 
@@ -552,27 +694,27 @@ class Roster {
                 return (req, res) => {
                     const host = req.headers.host || '';
 
-                    // Remove port from host header if present (e.g., "domain.com:8080" -> "domain.com")
-                    const hostWithoutPort = host.split(':')[0];
+                    const hostWithoutPort = host.split(':')[0].toLowerCase();
                     const domain = hostWithoutPort.startsWith('www.') ? hostWithoutPort.slice(4) : hostWithoutPort;
 
-                    // Handle www redirects
                     if (hostWithoutPort.startsWith('www.')) {
                         res.writeHead(301, { Location: `https://${domain}${req.url}` });
                         res.end();
                         return;
                     }
 
-                    const virtualServer = portData.virtualServers[domain];
-                    const appHandler = portData.appHandlers[domain];
+                    const resolved = this.getHandlerForPortData(domain, portData);
+                    if (!resolved) {
+                        res.writeHead(404);
+                        res.end('Site not found');
+                        return;
+                    }
+                    const { virtualServer, appHandler } = resolved;
 
                     if (virtualServer && virtualServer.requestListeners.length > 0) {
-                        // Set fallback handler on virtual server for non-Socket.IO requests
                         virtualServer.fallbackHandler = appHandler;
-                        // App registered listeners on virtual server - use them
                         virtualServer.processRequest(req, res);
                     } else if (appHandler) {
-                        // App returned a handler function - use it
                         appHandler(req, res);
                     } else {
                         res.writeHead(404);
@@ -585,19 +727,16 @@ class Roster {
                 log.info('HTTP server listening on port 80');
             });
 
-            // Create upgrade handler for WebSocket connections
             const createUpgradeHandler = (portData) => {
                 return (req, socket, head) => {
                     const host = req.headers.host || '';
-                    const hostWithoutPort = host.split(':')[0];
+                    const hostWithoutPort = host.split(':')[0].toLowerCase();
                     const domain = hostWithoutPort.startsWith('www.') ? hostWithoutPort.slice(4) : hostWithoutPort;
 
-                    const virtualServer = portData.virtualServers[domain];
-
-                    if (virtualServer) {
-                        virtualServer.processUpgrade(req, socket, head);
+                    const resolved = this.getHandlerForPortData(domain, portData);
+                    if (resolved && resolved.virtualServer) {
+                        resolved.virtualServer.processUpgrade(req, socket, head);
                     } else {
-                        // No virtual server found, destroy the socket
                         socket.destroy();
                     }
                 };
@@ -618,7 +757,9 @@ class Roster {
 
                     if (isBunRuntime) {
                         const primaryDomain = Object.keys(portData.virtualServers)[0];
-                        const certPath = path.join(this.greenlockStorePath, 'live', primaryDomain);
+                        // Greenlock stores certs by subject (e.g. tagnu.com), not by wildcard (*.tagnu.com)
+                        const certSubject = primaryDomain.startsWith('*.') ? wildcardRoot(primaryDomain) : primaryDomain;
+                        const certPath = path.join(this.greenlockStorePath, 'live', certSubject);
                         const keyPath = path.join(certPath, 'privkey.pem');
                         const certFilePath = path.join(certPath, 'cert.pem');
                         const chainPath = path.join(certPath, 'chain.pem');
@@ -634,7 +775,7 @@ class Roster {
                             }, dispatcher);
                             log.warn(`⚠️  Bun runtime detected: using static TLS cert for ${primaryDomain} on port ${portNum}`);
                         } else {
-                            log.warn(`⚠️  Bun runtime detected but cert files missing for ${primaryDomain}; falling back to Greenlock HTTPS server`);
+                            log.warn(`⚠️  Bun runtime detected but cert files missing for ${certSubject} (${primaryDomain}); falling back to Greenlock HTTPS server`);
                             httpsServer = glx.httpsServer(tlsOpts, dispatcher);
                         }
                     } else {
@@ -651,28 +792,34 @@ class Roster {
                     });
                 } else {
                     // Create HTTPS server for custom ports using Greenlock certificates
+                    const greenlockStorePath = this.greenlockStorePath;
+                    const loadCert = (subjectDir) => {
+                        const certPath = path.join(greenlockStorePath, 'live', subjectDir);
+                        const keyPath = path.join(certPath, 'privkey.pem');
+                        const certFilePath = path.join(certPath, 'cert.pem');
+                        const chainPath = path.join(certPath, 'chain.pem');
+                        if (fs.existsSync(keyPath) && fs.existsSync(certFilePath) && fs.existsSync(chainPath)) {
+                            return {
+                                key: fs.readFileSync(keyPath, 'utf8'),
+                                cert: fs.readFileSync(certFilePath, 'utf8') + fs.readFileSync(chainPath, 'utf8')
+                            };
+                        }
+                        return null;
+                    };
                     const httpsOptions = {
                         minVersion: this.tlsMinVersion,
                         maxVersion: this.tlsMaxVersion,
-                        // SNI callback to get certificates dynamically
-                        SNICallback: (domain, callback) => {
+                        SNICallback: (servername, callback) => {
                             try {
-                                const certPath = path.join(this.greenlockStorePath, 'live', domain);
-                                const keyPath = path.join(certPath, 'privkey.pem');
-                                const certFilePath = path.join(certPath, 'cert.pem');
-                                const chainPath = path.join(certPath, 'chain.pem');
-
-                                if (fs.existsSync(keyPath) && fs.existsSync(certFilePath) && fs.existsSync(chainPath)) {
-                                    const key = fs.readFileSync(keyPath, 'utf8');
-                                    const cert = fs.readFileSync(certFilePath, 'utf8');
-                                    const chain = fs.readFileSync(chainPath, 'utf8');
-
-                                    callback(null, tls.createSecureContext({
-                                        key: key,
-                                        cert: cert + chain
-                                    }));
+                                let pems = loadCert(servername);
+                                if (!pems && hostMatchesWildcard(servername, '*.' + servername.split('.').slice(1).join('.'))) {
+                                    const zoneSubject = servername.split('.').slice(1).join('.');
+                                    pems = loadCert(zoneSubject);
+                                }
+                                if (pems) {
+                                    callback(null, tls.createSecureContext({ key: pems.key, cert: pems.cert }));
                                 } else {
-                                    callback(new Error(`No certificate files available for ${domain}`));
+                                    callback(new Error(`No certificate files available for ${servername}`));
                                 }
                             } catch (error) {
                                 callback(error);
@@ -711,4 +858,6 @@ class Roster {
     }
 }
 
-module.exports = Roster;
+module.exports = Roster;
+module.exports.wildcardRoot = wildcardRoot;
+module.exports.hostMatchesWildcard = hostMatchesWildcard;

package/package.json

@@ -1,10 +1,10 @@
 {
     "name": "roster-server",
-    "version": "2.0.6",
+    "version": "2.1.0",
     "description": "👾 RosterServer - A domain host router to host multiple HTTPS.",
     "main": "index.js",
     "scripts": {
-        "test": "echo \"Error: no test specified\" && exit 1"
+        "test": "node --test 'test/**/*.test.js'"
     },
     "repository": {
         "type": "git",
@@ -37,6 +37,7 @@
     "homepage": "https://github.com/clasen/RosterServer#readme",
     "dependencies": {
         "@root/greenlock": "^4.0.5",
+        "acme-dns-01-cli": "^3.0.7",
         "lemonlog": "^1.2.0",
         "redirect-https": "^1.3.1"
     }

package/skills/roster-server/SKILL.md

@@ -40,8 +40,10 @@ project/
 ├── www/
 │   ├── example.com/
 │   │   └── index.js   # Handler for example.com
-│   └── api.example.com/
-│       └── index.js   # Handler for subdomain
+│   ├── api.example.com/
+│   │   └── index.js   # Handler for subdomain
+│   └── *.example.com/
+│       └── index.js   # Wildcard: one handler for all subdomains
 └── server.js          # Your setup
 ```
 
@@ -104,6 +106,10 @@ roster.register('example.com', (httpsServer) => {
 
 // With custom port
 roster.register('api.example.com:8443', handler);
+
+// Wildcard: one handler for all subdomains (default port or custom)
+roster.register('*.example.com', handler);
+roster.register('*.example.com:8080', handler);
 ```
 
 ## Key Configuration Options
@@ -113,6 +119,7 @@ new Roster({
     email: 'admin@example.com',      // Required for SSL
     wwwPath: '/srv/www',             // Site handlers directory
     greenlockStorePath: '/srv/greenlock.d',  // SSL storage
+    dnsChallenge: { ... },          // Optional override. Default is local/manual DNS-01 (acme-dns-01-cli)
     
     // Environment
     local: false,                    // true = HTTP, false = HTTPS
@@ -138,13 +145,13 @@ new Roster({
 Loads sites, generates SSL config, starts servers. Returns `Promise<void>`.
 
 ### `roster.register(domain, handler)`
-Manually register a domain handler. Domain can include port: `'api.com:8443'`.
+Manually register a domain handler. Domain can include port: `'api.com:8443'`. For wildcards use `'*.example.com'` or `'*.example.com:8080'`.
 
 ### `roster.getUrl(domain)`
 Get environment-aware URL:
 - Local mode: `http://localhost:{port}`
 - Production: `https://{domain}` or `https://{domain}:{port}`
-- Returns `null` if domain not registered
+- Returns `null` if domain not registered. Supports wildcard-matched hosts (e.g. `getUrl('api.example.com')` when `*.example.com` is registered).
 
 ## How It Works
 
@@ -170,6 +177,7 @@ Each domain gets isolated server instance that simulates `http.Server`:
 - Auto-renewal 45 days before expiration
 - SNI support for multiple domains
 - Custom ports reuse certificates via SNI callback
+- **Wildcard** (`*.example.com`): use folder `www/*.example.com/` or `roster.register('*.example.com', handler)`. Default DNS-01 plugin is local/manual `acme-dns-01-cli`; set `dnsChallenge` only when overriding provider integration.
 
 ## Common Issues & Solutions
 

package/test/roster-server.test.js

@@ -0,0 +1,446 @@
+'use strict';
+
+const { describe, it } = require('node:test');
+const assert = require('node:assert');
+const path = require('path');
+const fs = require('fs');
+const http = require('http');
+const os = require('os');
+const Roster = require('../index.js');
+const { wildcardRoot, hostMatchesWildcard } = require('../index.js');
+
+function closePortServers(roster) {
+    if (roster.portServers && typeof roster.portServers === 'object') {
+        for (const server of Object.values(roster.portServers)) {
+            try {
+                server.close();
+            } catch (_) {}
+        }
+    }
+}
+
+function httpGet(host, port, pathname = '/') {
+    return new Promise((resolve, reject) => {
+        const req = http.get(
+            { host, port, path: pathname, headers: { host: host + (port === 80 ? '' : ':' + port) } },
+            (res) => {
+                let body = '';
+                res.on('data', (chunk) => { body += chunk; });
+                res.on('end', () => resolve({ statusCode: res.statusCode, headers: res.headers, body }));
+            }
+        );
+        req.on('error', reject);
+        req.setTimeout(2000, () => { req.destroy(); reject(new Error('timeout')); });
+    });
+}
+
+describe('wildcardRoot', () => {
+    it('returns root domain for *.example.com', () => {
+        assert.strictEqual(wildcardRoot('*.example.com'), 'example.com');
+    });
+    it('returns root for *.sub.example.com', () => {
+        assert.strictEqual(wildcardRoot('*.sub.example.com'), 'sub.example.com');
+    });
+    it('returns null for non-wildcard', () => {
+        assert.strictEqual(wildcardRoot('example.com'), null);
+        assert.strictEqual(wildcardRoot('api.example.com'), null);
+    });
+    it('returns null for empty or null', () => {
+        assert.strictEqual(wildcardRoot(''), null);
+        assert.strictEqual(wildcardRoot(null), null);
+    });
+});
+
+describe('hostMatchesWildcard', () => {
+    it('matches subdomain to pattern', () => {
+        assert.strictEqual(hostMatchesWildcard('api.example.com', '*.example.com'), true);
+        assert.strictEqual(hostMatchesWildcard('app.example.com', '*.example.com'), true);
+        assert.strictEqual(hostMatchesWildcard('a.example.com', '*.example.com'), true);
+    });
+    it('does not match apex domain', () => {
+        assert.strictEqual(hostMatchesWildcard('example.com', '*.example.com'), false);
+    });
+    it('does not match other zones', () => {
+        assert.strictEqual(hostMatchesWildcard('api.other.com', '*.example.com'), false);
+        assert.strictEqual(hostMatchesWildcard('example.com.evil.com', '*.example.com'), false);
+    });
+    it('returns false for invalid pattern', () => {
+        assert.strictEqual(hostMatchesWildcard('api.example.com', 'example.com'), false);
+        assert.strictEqual(hostMatchesWildcard('api.example.com', ''), false);
+        assert.strictEqual(hostMatchesWildcard('api.example.com', null), false);
+    });
+    it('matches case-insensitively (Host header may be any case)', () => {
+        assert.strictEqual(hostMatchesWildcard('Admin.Tagnu.com', '*.tagnu.com'), true);
+        assert.strictEqual(hostMatchesWildcard('API.EXAMPLE.COM', '*.example.com'), true);
+    });
+});
+
+describe('Roster', () => {
+    describe('parseDomainWithPort', () => {
+        it('parses *.example.com with default port', () => {
+            const roster = new Roster({ local: true });
+            assert.deepStrictEqual(roster.parseDomainWithPort('*.example.com'), {
+                domain: '*.example.com',
+                port: 443
+            });
+        });
+        it('parses *.example.com:8080', () => {
+            const roster = new Roster({ local: true });
+            assert.deepStrictEqual(roster.parseDomainWithPort('*.example.com:8080'), {
+                domain: '*.example.com',
+                port: 8080
+            });
+        });
+        it('parses normal domain with port', () => {
+            const roster = new Roster({ local: true });
+            assert.deepStrictEqual(roster.parseDomainWithPort('example.com:8443'), {
+                domain: 'example.com',
+                port: 8443
+            });
+        });
+    });
+
+    describe('register (wildcard)', () => {
+        it('registers *.example.com and resolves handler for subdomain', () => {
+            const roster = new Roster({ local: true });
+            const handler = () => {};
+            roster.register('*.example.com', handler);
+            assert.strictEqual(roster.getHandlerForHost('api.example.com'), handler);
+            assert.strictEqual(roster.getHandlerForHost('app.example.com'), handler);
+            assert.strictEqual(roster.getHandlerForHost('example.com'), null);
+            assert.ok(roster.wildcardZones.has('example.com'));
+        });
+        it('registers *.example.com:8080 with custom port', () => {
+            const roster = new Roster({ local: true });
+            const handler = () => {};
+            roster.register('*.example.com:8080', handler);
+            assert.strictEqual(roster.sites['*.example.com:8080'], handler);
+            assert.ok(roster.wildcardZones.has('example.com'));
+        });
+        it('getHandlerAndKeyForHost returns handler and siteKey for wildcard match', () => {
+            const roster = new Roster({ local: true });
+            const handler = () => {};
+            roster.register('*.example.com', handler);
+            const resolved = roster.getHandlerAndKeyForHost('api.example.com');
+            assert.ok(resolved);
+            assert.strictEqual(resolved.handler, handler);
+            assert.strictEqual(resolved.siteKey, '*.example.com');
+        });
+        it('exact match takes precedence over wildcard', () => {
+            const roster = new Roster({ local: true });
+            const exactHandler = () => {};
+            const wildcardHandler = () => {};
+            roster.register('api.example.com', exactHandler);
+            roster.register('*.example.com', wildcardHandler);
+            assert.strictEqual(roster.getHandlerForHost('api.example.com'), exactHandler);
+        });
+    });
+
+    describe('getHandlerForPortData', () => {
+        it('returns exact match when present', () => {
+            const roster = new Roster({ local: true });
+            const vs = roster.createVirtualServer('example.com');
+            const handler = () => {};
+            const portData = {
+                virtualServers: { 'example.com': vs },
+                appHandlers: { 'example.com': handler }
+            };
+            const resolved = roster.getHandlerForPortData('example.com', portData);
+            assert.ok(resolved);
+            assert.strictEqual(resolved.virtualServer, vs);
+            assert.strictEqual(resolved.appHandler, handler);
+        });
+        it('returns wildcard match for subdomain', () => {
+            const roster = new Roster({ local: true });
+            const vs = roster.createVirtualServer('*.example.com');
+            const handler = () => {};
+            const portData = {
+                virtualServers: { '*.example.com': vs },
+                appHandlers: { '*.example.com': handler }
+            };
+            const resolved = roster.getHandlerForPortData('api.example.com', portData);
+            assert.ok(resolved);
+            assert.strictEqual(resolved.virtualServer, vs);
+            assert.strictEqual(resolved.appHandler, handler);
+        });
+        it('returns null when no match', () => {
+            const roster = new Roster({ local: true });
+            const portData = { virtualServers: {}, appHandlers: {} };
+            assert.strictEqual(roster.getHandlerForPortData('unknown.com', portData), null);
+        });
+    });
+
+    describe('getUrl (wildcard)', () => {
+        it('returns URL for wildcard-matched host in local mode', () => {
+            const roster = new Roster({ local: true });
+            roster.register('*.example.com', () => {});
+            roster.domainPorts = { '*.example.com': 9999 };
+            roster.local = true;
+            assert.strictEqual(roster.getUrl('api.example.com'), 'http://localhost:9999');
+        });
+        it('returns https URL for wildcard-matched host in production', () => {
+            const roster = new Roster({ local: false });
+            roster.register('*.example.com', () => {});
+            roster.local = false;
+            assert.strictEqual(roster.getUrl('api.example.com'), 'https://api.example.com');
+        });
+        it('returns null for host that matches no site', () => {
+            const roster = new Roster({ local: true });
+            assert.strictEqual(roster.getUrl('unknown.com'), null);
+        });
+    });
+
+    describe('register validation', () => {
+        it('throws when domain is missing', () => {
+            const roster = new Roster({ local: true });
+            assert.throws(() => roster.register('', () => {}), /Domain is required/);
+            assert.throws(() => roster.register(null, () => {}), /Domain is required/);
+        });
+        it('throws when handler is not a function', () => {
+            const roster = new Roster({ local: true });
+            assert.throws(() => roster.register('*.example.com', {}), /requestHandler must be a function/);
+        });
+    });
+
+    describe('constructor', () => {
+        it('throws when port is 80 and not local', () => {
+            assert.throws(() => new Roster({ port: 80, local: false }), /Port 80 is reserved/);
+        });
+        it('allows port 80 when local is true', () => {
+            const roster = new Roster({ port: 80, local: true });
+            assert.strictEqual(roster.defaultPort, 80);
+        });
+        it('sets defaultPort 443 when port not given', () => {
+            const roster = new Roster({ local: true });
+            assert.strictEqual(roster.defaultPort, 443);
+        });
+        it('uses acme-dns-01-cli by default (resolved to absolute path for Greenlock)', () => {
+            const roster = new Roster({ local: false });
+            assert.ok(roster.dnsChallenge);
+            assert.strictEqual(typeof roster.dnsChallenge.module, 'string');
+            assert.ok(require('path').isAbsolute(roster.dnsChallenge.module));
+            assert.ok(roster.dnsChallenge.module.includes('acme-dns-01-cli-wrapper'));
+            assert.strictEqual(roster.dnsChallenge.propagationDelay, 120000);
+            assert.strictEqual(roster.dnsChallenge.autoContinue, false);
+            assert.strictEqual(roster.dnsChallenge.dryRunDelay, 120000);
+        });
+        it('normalizes explicit acme-dns-01-cli module to wrapper and sets default propagationDelay', () => {
+            const roster = new Roster({ local: false, dnsChallenge: { module: 'acme-dns-01-cli' } });
+            assert.ok(require('path').isAbsolute(roster.dnsChallenge.module));
+            assert.ok(roster.dnsChallenge.module.includes('acme-dns-01-cli-wrapper'));
+            assert.strictEqual(roster.dnsChallenge.propagationDelay, 120000);
+            assert.strictEqual(roster.dnsChallenge.autoContinue, false);
+            assert.strictEqual(roster.dnsChallenge.dryRunDelay, 120000);
+        });
+        it('keeps explicit non-cli dnsChallenge module as-is', () => {
+            const roster = new Roster({ local: false, dnsChallenge: { module: 'acme-dns-01-route53', token: 'x' } });
+            assert.strictEqual(roster.dnsChallenge.module, 'acme-dns-01-route53');
+            assert.strictEqual(roster.dnsChallenge.token, 'x');
+            assert.strictEqual(roster.dnsChallenge.propagationDelay, 120000);
+            assert.strictEqual(roster.dnsChallenge.autoContinue, false);
+            assert.strictEqual(roster.dnsChallenge.dryRunDelay, 120000);
+        });
+        it('normalizes explicit acme-dns-01-cli absolute path to wrapper', () => {
+            const path = require('path');
+            const roster = new Roster({
+                local: false,
+                dnsChallenge: { module: path.join('/srv/roster/node_modules/acme-dns-01-cli', 'index.js') }
+            });
+            assert.ok(require('path').isAbsolute(roster.dnsChallenge.module));
+            assert.ok(roster.dnsChallenge.module.includes('acme-dns-01-cli-wrapper'));
+            assert.strictEqual(roster.dnsChallenge.propagationDelay, 120000);
+            assert.strictEqual(roster.dnsChallenge.autoContinue, false);
+            assert.strictEqual(roster.dnsChallenge.dryRunDelay, 120000);
+        });
+        it('allows disabling DNS challenge with dnsChallenge: false', () => {
+            const roster = new Roster({ local: false, dnsChallenge: false });
+            assert.strictEqual(roster.dnsChallenge, null);
+        });
+    });
+
+    describe('register (normal domain)', () => {
+        it('adds domain and www when domain has fewer than 2 dots', () => {
+            const roster = new Roster({ local: true });
+            const handler = () => {};
+            roster.register('example.com', handler);
+            assert.strictEqual(roster.sites['example.com'], handler);
+            assert.strictEqual(roster.sites['www.example.com'], handler);
+        });
+        it('does not add www for multi-label domain', () => {
+            const roster = new Roster({ local: true });
+            const handler = () => {};
+            roster.register('api.example.com', handler);
+            assert.strictEqual(roster.sites['api.example.com'], handler);
+            assert.strictEqual(roster.sites['www.api.example.com'], undefined);
+        });
+    });
+
+    describe('getUrl (exact domain)', () => {
+        it('returns http://localhost:PORT in local mode for registered domain', () => {
+            const roster = new Roster({ local: true });
+            roster.register('exact.local', () => {});
+            roster.domainPorts = { 'exact.local': 4567 };
+            roster.local = true;
+            assert.strictEqual(roster.getUrl('exact.local'), 'http://localhost:4567');
+        });
+        it('returns https URL in production for registered domain', () => {
+            const roster = new Roster({ local: false });
+            roster.register('example.com', () => {});
+            roster.local = false;
+            assert.strictEqual(roster.getUrl('example.com'), 'https://example.com');
+        });
+        it('strips www and returns canonical URL (same as non-www)', () => {
+            const roster = new Roster({ local: false });
+            roster.register('example.com', () => {});
+            assert.strictEqual(roster.getUrl('www.example.com'), 'https://example.com');
+            assert.strictEqual(roster.getUrl('example.com'), 'https://example.com');
+        });
+    });
+
+    describe('handleRequest', () => {
+        it('redirects www to non-www with 301', () => {
+            const roster = new Roster({ local: true });
+            const res = {
+                writeHead: (status, headers) => {
+                    assert.strictEqual(status, 301);
+                    assert.strictEqual(headers.Location, 'https://example.com/');
+                },
+                end: () => {}
+            };
+            roster.handleRequest(
+                { headers: { host: 'www.example.com' }, url: '/' },
+                res
+            );
+        });
+        it('returns 404 when host has no handler', () => {
+            const roster = new Roster({ local: true });
+            let status;
+            const res = {
+                writeHead: (s) => { status = s; },
+                end: () => {}
+            };
+            roster.handleRequest(
+                { headers: { host: 'unknown.example.com' }, url: '/' },
+                res
+            );
+            assert.strictEqual(status, 404);
+        });
+        it('invokes handler for registered host', () => {
+            const roster = new Roster({ local: true });
+            let called = false;
+            roster.register('example.com', (req, res) => {
+                called = true;
+                res.writeHead(200);
+                res.end('ok');
+            });
+            const res = {
+                writeHead: () => {},
+                end: () => {}
+            };
+            roster.handleRequest(
+                { headers: { host: 'example.com' }, url: '/' },
+                res
+            );
+            assert.strictEqual(called, true);
+        });
+    });
+});
+
+describe('Roster local mode (local: true)', () => {
+    it('starts HTTP server and responds for registered domain', async () => {
+        const roster = new Roster({
+            local: true,
+            minLocalPort: 19090,
+            maxLocalPort: 19099,
+            hostname: 'localhost'
+        });
+        const body = 'local-mode-ok';
+        roster.register('testlocal.example', (server) => {
+            return (req, res) => {
+                res.writeHead(200, { 'Content-Type': 'text/plain' });
+                res.end(body);
+            };
+        });
+        await roster.start();
+        try {
+            const port = roster.domainPorts['testlocal.example'];
+            assert.ok(typeof port === 'number' && port >= 19090 && port <= 19099);
+            await new Promise((r) => setTimeout(r, 50));
+            const result = await httpGet('localhost', port, '/');
+            assert.strictEqual(result.statusCode, 200);
+            assert.strictEqual(result.body, body);
+        } finally {
+            closePortServers(roster);
+        }
+    });
+
+    it('getUrl returns localhost URL after start', async () => {
+        const roster = new Roster({
+            local: true,
+            minLocalPort: 19100,
+            maxLocalPort: 19109
+        });
+        roster.register('geturltest.example', () => () => {});
+        await roster.start();
+        try {
+            const url = roster.getUrl('geturltest.example');
+            assert.ok(url && url.startsWith('http://localhost:'));
+            assert.ok(roster.domainPorts['geturltest.example'] !== undefined);
+        } finally {
+            closePortServers(roster);
+        }
+    });
+});
+
+describe('Roster loadSites', () => {
+    it('loads site from www directory and registers domain + www', async () => {
+        const tmpDir = fs.mkdtempSync(path.join(os.tmpdir(), 'roster-test-'));
+        const wwwPath = path.join(tmpDir, 'www');
+        const siteDir = path.join(wwwPath, 'loaded.example');
+        fs.mkdirSync(siteDir, { recursive: true });
+        fs.writeFileSync(
+            path.join(siteDir, 'index.js'),
+            'module.exports = () => (req, res) => { res.writeHead(200); res.end("loaded"); };',
+            'utf8'
+        );
+        try {
+            const roster = new Roster({ wwwPath, local: true });
+            await roster.loadSites();
+            assert.ok(roster.sites['loaded.example']);
+            assert.ok(roster.sites['www.loaded.example']);
+            const handler = roster.sites['loaded.example'];
+            assert.strictEqual(typeof handler, 'function');
+        } finally {
+            fs.rmSync(tmpDir, { recursive: true, force: true });
+        }
+    });
+
+    it('loads wildcard site from www/*.example.com directory', async () => {
+        const tmpDir = fs.mkdtempSync(path.join(os.tmpdir(), 'roster-test-'));
+        const wwwPath = path.join(tmpDir, 'www');
+        const siteDir = path.join(wwwPath, '*.wildcard.example');
+        fs.mkdirSync(siteDir, { recursive: true });
+        fs.writeFileSync(
+            path.join(siteDir, 'index.js'),
+            'module.exports = () => (req, res) => { res.writeHead(200); res.end("wildcard"); };',
+            'utf8'
+        );
+        try {
+            const roster = new Roster({ wwwPath, local: true });
+            await roster.loadSites();
+            assert.ok(roster.sites['*.wildcard.example']);
+            assert.ok(roster.wildcardZones.has('wildcard.example'));
+            assert.strictEqual(roster.getHandlerForHost('api.wildcard.example'), roster.sites['*.wildcard.example']);
+        } finally {
+            fs.rmSync(tmpDir, { recursive: true, force: true });
+        }
+    });
+
+    it('does not throw when www path does not exist', async () => {
+        const roster = new Roster({
+            wwwPath: path.join(os.tmpdir(), 'roster-nonexistent-' + Date.now()),
+            local: true
+        });
+        await assert.doesNotReject(roster.loadSites());
+    });
+});

package/vendor/acme-dns-01-cli-wrapper.js

@@ -0,0 +1,161 @@
+'use strict';
+
+const legacyCli = require('acme-dns-01-cli');
+
+function toPromise(fn, context) {
+    if (typeof fn !== 'function') {
+        return async function () {
+            return null;
+        };
+    }
+
+    return async function (opts) {
+        return new Promise((resolve, reject) => {
+            let done = false;
+            const finish = (err, result) => {
+                if (done) return;
+                done = true;
+                if (err) reject(err);
+                else resolve(result);
+            };
+
+            try {
+                // Legacy callback style
+                if (fn.length >= 2) {
+                    fn.call(context, opts, finish);
+                    return;
+                }
+
+                // Promise or sync style
+                Promise.resolve(fn.call(context, opts)).then(
+                    (result) => finish(null, result),
+                    finish
+                );
+            } catch (err) {
+                finish(err);
+            }
+        });
+    };
+}
+
+module.exports.create = function create(config = {}) {
+    const challenger = legacyCli.create(config);
+    const propagationDelay = Number.isFinite(config.propagationDelay)
+        ? config.propagationDelay
+        : 120000;
+    const envAutoContinue = process.env.ROSTER_DNS_AUTO_CONTINUE;
+    const parseAutoContinue = (value, fallback) => {
+        if (value === undefined || value === null || value === '') return fallback;
+        const normalized = String(value).trim().toLowerCase();
+        if (['1', 'true', 'yes', 'on'].includes(normalized)) return true;
+        if (['0', 'false', 'no', 'off'].includes(normalized)) return false;
+        return fallback;
+    };
+    const autoContinue = config.autoContinue !== undefined
+        ? parseAutoContinue(config.autoContinue, false)
+        : parseAutoContinue(envAutoContinue, false);
+    const dryRunDelay = Number.isFinite(config.dryRunDelay)
+        ? config.dryRunDelay
+        : Number.isFinite(Number(process.env.ROSTER_DNS_DRYRUN_DELAY_MS))
+            ? Number(process.env.ROSTER_DNS_DRYRUN_DELAY_MS)
+            : propagationDelay;
+
+    function sleep(ms) {
+        return new Promise((resolve) => setTimeout(resolve, ms));
+    }
+
+    const presentedByHost = new Map();
+
+    async function setChallenge(opts) {
+        const isInteractive = Boolean(process.stdin && process.stdin.isTTY);
+        if (isInteractive && !autoContinue) {
+            return toPromise(challenger.set, challenger)(opts);
+        }
+
+        const ch = opts?.challenge || {};
+        console.info('');
+        console.info("[ACME dns-01 '" + (ch.altname || opts?.altname || 'unknown') + "' CHALLENGE]");
+        console.info("You're about to receive the following DNS query:");
+        console.info('');
+        const dnsHost = String(ch.dnsHost || '');
+        const dnsAuth = ch.dnsAuthorization || opts?.dnsAuthorization || null;
+        if (dnsHost && dnsAuth) {
+            presentedByHost.set(dnsHost, dnsAuth);
+        }
+        const isDryRunChallenge = dnsHost.includes('_greenlock-dryrun-');
+        const effectiveDelay = isDryRunChallenge
+            ? Math.max(0, dryRunDelay)
+            : propagationDelay;
+
+        console.info(
+            '\tTXT\t' +
+                (ch.dnsHost || '_acme-challenge.<domain>') +
+                '\t' +
+                (ch.dnsAuthorization || '<dns-authorization-token>') +
+                '\tTTL 60'
+        );
+        console.info('');
+        console.info(
+            'Non-interactive mode (or autoContinue) detected. ' +
+            'Set the TXT record now. Continuing automatically in ' +
+            effectiveDelay +
+            'ms...'
+        );
+        await sleep(effectiveDelay);
+        return null;
+    }
+
+    async function getChallenge(opts) {
+        const ch = opts?.challenge || {};
+        const dnsHost = String(ch.dnsHost || opts?.dnsHost || '');
+        const dnsAuthorization =
+            ch.dnsAuthorization ||
+            opts?.dnsAuthorization ||
+            (dnsHost ? presentedByHost.get(dnsHost) : null);
+
+        if (!dnsAuthorization) {
+            return null;
+        }
+
+        return {
+            ...(typeof ch === 'object' ? ch : {}),
+            dnsAuthorization
+        };
+    }
+
+    const wrapped = {
+        propagationDelay,
+        set: setChallenge,
+        remove: toPromise(challenger.remove, challenger),
+        get: getChallenge,
+        zones: async (opts) => {
+            const dnsHost =
+                opts?.dnsHost ||
+                opts?.challenge?.dnsHost ||
+                opts?.challenge?.altname ||
+                opts?.altname;
+
+            if (!dnsHost || typeof dnsHost !== 'string') {
+                return [];
+            }
+
+            // Best-effort root zone extraction for legacy/manual flow.
+            const zone = dnsHost
+                .replace(/^_acme-challenge\./, '')
+                .replace(/^_greenlock-[^.]+\./, '')
+                .replace(/\.$/, '');
+
+            return zone ? [zone] : [];
+        }
+    };
+
+    if (typeof challenger.init === 'function') {
+        wrapped.init = toPromise(challenger.init, challenger);
+    }
+
+    if (challenger.options && typeof challenger.options === 'object') {
+        wrapped.options = { ...challenger.options };
+    }
+
+    return wrapped;
+};