v1.42.3

- 修复证书链拆分，保留 END CERTIFICATE 结尾标记，避免 MalformedCertificate
- 更新 CloudFront 时构造干净的 IAM ViewerCertificate，强制 sni-only，
  解决 InvalidViewerCertificate 及中国区不支持 vip 的报错
- 部署完成后清理被替换掉的旧 IAM 证书，避免续期堆积
- IAM/CloudFront 权限不足时抛出可读中文提示，便于运维排查

Co-authored-by: Cursor <cursoragent@cursor.com>

.trae/skills/access-plugin-dev/SKILL.md

@@ -400,6 +400,7 @@ export class OAuthDemoAccess extends BaseAccess {
 4. **错误处理**：API 调用失败时应抛出明确的错误信息。
 5. **测试方法**：实现 `onTestRequest` 方法，以便用户可以测试授权是否正常。
 6. **统一接口调用**：封装统一的 API 请求方法，避免重复编写错误处理逻辑。
+7. **旧版数据兼容**： 新增注解的插件参数，必须要考虑旧版数据兼容，比如新增一个deployType参数，有两种值：`default`和`custom`，需要在使用时判空，走旧版逻辑。
 
 ## 开发技巧
 

.trae/skills/dns-provider-dev/SKILL.md

@@ -454,3 +454,4 @@ new TencentDnsProvider();
 3. **记录结构**：定义适合对应云平台的记录数据结构，至少包含 id 字段用于删除记录。
 4. **日志输出**：使用 `this.logger` 输出日志，而不是 `console`，参数文本化，不要传对象，否则会输出`[object Object]}`。
 5. **错误处理**：API 调用失败时应抛出明确的错误信息。
+6. **旧版数据兼容**： 新增插件参数，必须要考虑旧版数据兼容，比如新增一个deployType参数，有两种值：`default`和`custom`，需要在使用时判空，走旧版逻辑。

.trae/skills/task-plugin-dev/SKILL.md

@@ -641,6 +641,7 @@ new AliyunOSSDeploy();
 4. **日志输出**：使用 `this.logger` 输出日志，而不是 `console`，参数文本化，不要传对象，否则会输出`[object Object]}`。
 5. **错误处理**：执行过程中的错误应被捕获并记录。
 6. **授权获取**：使用 `this.getAccess(accessId)` 获取授权信息。
+7. **旧版数据兼容**： 新增@TaskInput注解的插件参数，必须要考虑旧版数据兼容，比如新增一个deployType参数，有两种值：`default`和`custom`，需要在使用时判空，走旧版逻辑。
 
 ## 部署逻辑注意事项
 

AGENTS.md

@@ -102,7 +102,7 @@ Certd 是可私有化部署的 SSL/TLS 证书自动化管理平台，提供 Web
 - 只有需要事务传播时才定义 `ctx`；普通查询、纯函数和简单私有方法继续使用明确参数。
 - 需要按事务上下文取 Repository 时，用 `BaseService.getRepo(ctx, EntityClass)`。
 - 需要“有事务则复用、无事务则开启”时，用 `BaseService.transactionWithCtx(ctx, callback)`。
-- 拼接可选 `projectId` 查询条件时，用 `BaseService.buildUserProjectQuery(userId, projectId)`；不要直接写 `{ userId, projectId }`。
+- 拼接可选 `projectId` 查询条件时，**必须**使用 `BaseService.buildUserProjectQuery(userId, projectId)`，禁止直接写 `{ userId, projectId }`。因为 `projectId` 可能为 `null`/`undefined`，直接放入查询会生成错误的 `WHERE projectId = NULL` 条件。
 - `ctx` 类型复用 `BaseService` 导出的 `ServiceContext`。
 - 新增 service 方法避免与 `BaseService` 方法签名冲突，例如不要用 `delete(id)` 覆盖 `delete(ids, where?)`；改用 `deleteById` 等具体名称。
 
@@ -210,3 +210,8 @@ Certd 是可私有化部署的 SSL/TLS 证书自动化管理平台，提供 Web
 - 后端业务数据、接口、实体、权限、迁移：改 `packages/ui/certd-server/src/modules` 与 `src/controller`。
 - 表单、列表、插件配置 UI：改 `packages/ui/certd-client/src/views/certd` 及对应 `src/api`。
 
+## 注意事项
+
+### 旧版数据兼容
+
+- 新增插件参数时，必须要考虑旧版数据兼容，比如新增一个deployType参数，有两种值：`default`和`custom`，需要在使用时判空，走旧版逻辑。

CHANGELOG.md

@@ -3,6 +3,62 @@
 All notable changes to this project will be documented in this file.
 See [Conventional Commits](https://conventionalcommits.org) for commit guidelines.
 
+## [1.42.3](https://github.com/certd/certd/compare/v1.42.2...v1.42.3) (2026-07-08)
+
+### Bug Fixes
+
+* **volcengine-alb:** 修复火山引擎ALB 默认证书部署类型会部署到扩展证书的问题 ([0a068a2](https://github.com/certd/certd/commit/0a068a274673e9768954e9f7367c267d44f3b530))
+
+## [1.42.2](https://github.com/certd/certd/compare/v1.42.1...v1.42.2) (2026-07-07)
+
+### Bug Fixes
+
+* 修复火山视频点播源站选择不到自定义源站的bug ([0071bcb](https://github.com/certd/certd/commit/0071bcb0e4dd108c86d7ca01820a9f6e6960e440))
+* 修复企业模式下弹出邮箱绑定提醒的问题 ([8d9dad9](https://github.com/certd/certd/commit/8d9dad9c82f6f2fd3ab3040068946a33f37145b1))
+* 修复AsiaIsp CDN证书重复情况下部署失败的问题 ([c3d6db3](https://github.com/certd/certd/commit/c3d6db3f1ef2f1c897b7989521fe8809dffaded1))
+* 修复cname用阿里云校验时报找不到runtimeDepsService的错误 ([072edd7](https://github.com/certd/certd/commit/072edd7affee424ab3411f4d41d338f084d7cac6))
+
+## [1.42.1](https://github.com/certd/certd/compare/v1.42.0...v1.42.1) (2026-07-06)
+
+### Bug Fixes
+
+* 修复多域名无法使用passkey登录的bug ([d176f9c](https://github.com/certd/certd/commit/d176f9cc0ebd051a614bfac74d1616d1945fc9a3))
+* 修复企业模式下登录报projectId不能为空的问题 ([a65366b](https://github.com/certd/certd/commit/a65366bbe1aadea8baaffbdadab58a5b631d9417))
+* **login:** 修复输入法 composing 状态下回车触发提交的问题 ([b74db81](https://github.com/certd/certd/commit/b74db81304bbe68476bbec5ea4307a2264060e92))
+
+### Performance Improvements
+
+* **certd-server:** 使用 jks-go转换jks证书，大幅精简镜像大小 ([c78898e](https://github.com/certd/certd/commit/c78898e4c10dd1701467d2e42e3f72bd8f2a352f))
+* **pipeline:** 将默认历史保留条数从30调整为100 ([d3e4677](https://github.com/certd/certd/commit/d3e4677ea4fac8e7533749d7f4187e410489e536))
+
+# [1.42.0](https://github.com/certd/certd/compare/v1.41.4...v1.42.0) (2026-07-05)
+
+### Bug Fixes
+
+* 修复jdk证书格式的问题 ([260f5ae](https://github.com/certd/certd/commit/260f5ae777b83493b0c578fe30fd00ec0c873226))
+* 修复telegram - 符号转义问题 ([d5882f1](https://github.com/certd/certd/commit/d5882f16bedb09baf09ace92049b02872620f5dc))
+* **aliyun:** 修复阿里云CDN/DCDN根据证书自动匹配不到证书的bug ([1ae185d](https://github.com/certd/certd/commit/1ae185d0bc356f4678bc38ca0582ce3396f82ebe))
+
+### Features
+
+* 通过插件配置懒加载依赖，动态加载第三方依赖包，精简安装镜像大小 ([01568ca](https://github.com/certd/certd/commit/01568ca1489069046b5a89ebdd4ced2f7f6ddf93))
+
+### Performance Improvements
+
+*  阿里云ESA证书部署支持SaaS模式 ([82276b5](https://github.com/certd/certd/commit/82276b53a8474a18a3d0237050907c994fc748f0))
+* 【破坏性更新】 证书压缩包不再生成文件存储，而是实时打包下载，证书申请插件不再输出certZip ([7cff1a9](https://github.com/certd/certd/commit/7cff1a98424120585205889874b3ef4956a30583))
+* 火山引擎点播插件支持部署到自定义源站域名 ([095791c](https://github.com/certd/certd/commit/095791cdc2b7c1f4b913b634643afec5e30fe9b0))
+* 基础镜像改成node:22-trixie-slim，对网络兼容性更好 ([c66a2bd](https://github.com/certd/certd/commit/c66a2bd77ab6dbb3e3fe2c00562b66287a9429ea))
+* 新增橙域网络(asia-isp) CDN证书部署插件 ([b48831e](https://github.com/certd/certd/commit/b48831e60b0059bef7ef9a34ab61c9dd2f684641))
+* 优化阿里云API网关增加翻页查询 ([ed58ae3](https://github.com/certd/certd/commit/ed58ae3c5339e4a0238a92acfe7ea6d2f566ea28))
+* 优化用户体验，首次访问时弹出邮箱账号绑定用以初始化账号 ([608cc2a](https://github.com/certd/certd/commit/608cc2a81ff0b4872c9fe11ed9c9c0b4b90a12a3))
+* 优化ACME账号字段的选择提示 ([bfd3cac](https://github.com/certd/certd/commit/bfd3cacc687fc5cbc3cb2ca3cadbc140de300dc2))
+* 支持全自动匹配部署宝塔网站证书 ([4dff48e](https://github.com/certd/certd/commit/4dff48e807c32a7623ec9206cf39c88e88f89f6a))
+* **cert-plugin:** 调整更新天数自动减半逻辑，仅7天ip证书生效，其他情况下不减半 ([56e5524](https://github.com/certd/certd/commit/56e5524a0f4af3645d70bc3b3ec750b45ba8de10))
+* dns默认ipv4first ([194463b](https://github.com/certd/certd/commit/194463bea9e797315aa7a724f4b2930701570419))
+* **passkey:** passkey支持多域名rpid ([79f6586](https://github.com/certd/certd/commit/79f65868ca0f5162bbc2f935ce89abc28011d816))
+* **plugin:** 在线插件编辑支持配置第三方依赖和插件依赖 ([635f069](https://github.com/certd/certd/commit/635f069012d4193cfb7cb051c96e28eec1247ca2))
+
 ## [1.41.4](https://github.com/certd/certd/compare/v1.41.3...v1.41.4) (2026-06-14)
 
 ### Bug Fixes

docs/guide/changelogs/CHANGELOG.md

@@ -3,6 +3,56 @@
 All notable changes to this project will be documented in this file.
 See [Conventional Commits](https://conventionalcommits.org) for commit guidelines.
 
+## [1.42.2](https://github.com/certd/certd/compare/v1.42.1...v1.42.2) (2026-07-07)
+
+### Bug Fixes
+
+* 修复火山视频点播源站选择不到自定义源站的bug ([0071bcb](https://github.com/certd/certd/commit/0071bcb0e4dd108c86d7ca01820a9f6e6960e440))
+* 修复企业模式下弹出邮箱绑定提醒的问题 ([8d9dad9](https://github.com/certd/certd/commit/8d9dad9c82f6f2fd3ab3040068946a33f37145b1))
+* 修复AsiaIsp CDN证书重复情况下部署失败的问题 ([c3d6db3](https://github.com/certd/certd/commit/c3d6db3f1ef2f1c897b7989521fe8809dffaded1))
+* 修复cname用阿里云校验时报找不到runtimeDepsService的错误 ([072edd7](https://github.com/certd/certd/commit/072edd7affee424ab3411f4d41d338f084d7cac6))
+
+## [1.42.1](https://github.com/certd/certd/compare/v1.42.0...v1.42.1) (2026-07-06)
+
+### Bug Fixes
+
+* 修复多域名无法使用passkey登录的bug ([d176f9c](https://github.com/certd/certd/commit/d176f9cc0ebd051a614bfac74d1616d1945fc9a3))
+* 修复企业模式下登录报projectId不能为空的问题 ([a65366b](https://github.com/certd/certd/commit/a65366bbe1aadea8baaffbdadab58a5b631d9417))
+* **login:** 修复输入法 composing 状态下回车触发提交的问题 ([b74db81](https://github.com/certd/certd/commit/b74db81304bbe68476bbec5ea4307a2264060e92))
+
+### Performance Improvements
+
+* **certd-server:** 使用 jks-go转换jks证书，大幅精简镜像大小 ([c78898e](https://github.com/certd/certd/commit/c78898e4c10dd1701467d2e42e3f72bd8f2a352f))
+* **pipeline:** 将默认历史保留条数从30调整为100 ([d3e4677](https://github.com/certd/certd/commit/d3e4677ea4fac8e7533749d7f4187e410489e536))
+
+# [1.42.0](https://github.com/certd/certd/compare/v1.41.4...v1.42.0) (2026-07-05)
+
+### Bug Fixes
+
+* 修复jdk证书格式的问题 ([260f5ae](https://github.com/certd/certd/commit/260f5ae777b83493b0c578fe30fd00ec0c873226))
+* 修复telegram - 符号转义问题 ([d5882f1](https://github.com/certd/certd/commit/d5882f16bedb09baf09ace92049b02872620f5dc))
+* **aliyun:** 修复阿里云CDN/DCDN根据证书自动匹配不到证书的bug ([1ae185d](https://github.com/certd/certd/commit/1ae185d0bc356f4678bc38ca0582ce3396f82ebe))
+
+### Features
+
+* 通过插件配置懒加载依赖，动态加载第三方依赖包，精简安装镜像大小 ([01568ca](https://github.com/certd/certd/commit/01568ca1489069046b5a89ebdd4ced2f7f6ddf93))
+
+### Performance Improvements
+
+*  阿里云ESA证书部署支持SaaS模式 ([82276b5](https://github.com/certd/certd/commit/82276b53a8474a18a3d0237050907c994fc748f0))
+* 【破坏性更新】 证书压缩包不再生成文件存储，而是实时打包下载，证书申请插件不再输出certZip ([7cff1a9](https://github.com/certd/certd/commit/7cff1a98424120585205889874b3ef4956a30583))
+* 火山引擎点播插件支持部署到自定义源站域名 ([095791c](https://github.com/certd/certd/commit/095791cdc2b7c1f4b913b634643afec5e30fe9b0))
+* 基础镜像改成node:22-trixie-slim，对网络兼容性更好 ([c66a2bd](https://github.com/certd/certd/commit/c66a2bd77ab6dbb3e3fe2c00562b66287a9429ea))
+* 新增橙域网络(asia-isp) CDN证书部署插件 ([b48831e](https://github.com/certd/certd/commit/b48831e60b0059bef7ef9a34ab61c9dd2f684641))
+* 优化阿里云API网关增加翻页查询 ([ed58ae3](https://github.com/certd/certd/commit/ed58ae3c5339e4a0238a92acfe7ea6d2f566ea28))
+* 优化用户体验，首次访问时弹出邮箱账号绑定用以初始化账号 ([608cc2a](https://github.com/certd/certd/commit/608cc2a81ff0b4872c9fe11ed9c9c0b4b90a12a3))
+* 优化ACME账号字段的选择提示 ([bfd3cac](https://github.com/certd/certd/commit/bfd3cacc687fc5cbc3cb2ca3cadbc140de300dc2))
+* 支持全自动匹配部署宝塔网站证书 ([4dff48e](https://github.com/certd/certd/commit/4dff48e807c32a7623ec9206cf39c88e88f89f6a))
+* **cert-plugin:** 调整更新天数自动减半逻辑，仅7天ip证书生效，其他情况下不减半 ([56e5524](https://github.com/certd/certd/commit/56e5524a0f4af3645d70bc3b3ec750b45ba8de10))
+* dns默认ipv4first ([194463b](https://github.com/certd/certd/commit/194463bea9e797315aa7a724f4b2930701570419))
+* **passkey:** passkey支持多域名rpid ([79f6586](https://github.com/certd/certd/commit/79f65868ca0f5162bbc2f935ce89abc28011d816))
+* **plugin:** 在线插件编辑支持配置第三方依赖和插件依赖 ([635f069](https://github.com/certd/certd/commit/635f069012d4193cfb7cb051c96e28eec1247ca2))
+
 ## [1.41.4](https://github.com/certd/certd/compare/v1.41.3...v1.41.4) (2026-06-14)
 
 ### Bug Fixes

docs/guide/plugins/deploy.md

@@ -1,5 +1,5 @@
 # 任务插件
-共 `133` 款任务插件    
+共 `134` 款任务插件    
 ## 1. 证书申请
 
 | 序号 | 名称 | 说明 |
@@ -63,22 +63,23 @@
 | 7.| **1Panel-部署面板证书** | 更新1Panel的面板证书 | 
 | 8.| **1Panel-更新站点证书** | 更新1Panel的站点证书 | 
 | 9.| **宝塔-删除过期证书** | 删除证书夹中过期证书 | 
-| 10.| **宝塔-WAF证书部署** | 部署宝塔云WAF/aaWAF | 
+| 10.| **宝塔-全自动部署** | 根据证书域名自动匹配宝塔站点，全自动部署SSL证书。新增加速域名自动感知，自动新增部署 | 
-| 11.| **宝塔-面板证书部署** | 部署宝塔面板本身的ssl证书 | 
+| 11.| **宝塔-WAF证书部署** | 部署宝塔云WAF/aaWAF | 
-| 12.| **宝塔win-网站证书部署** | 部署到Windows版宝塔管理的站点的ssl证书 | 
+| 12.| **宝塔-面板证书部署** | 部署宝塔面板本身的ssl证书 | 
-| 13.| **宝塔-网站证书部署** | 部署宝塔管理的站点的ssl证书，目前支持宝塔网站站点、docker站点等。本插件也支持aaPanel。 | 
+| 13.| **宝塔win-网站证书部署** | 部署到Windows版宝塔管理的站点的ssl证书 | 
-| 14.| **K8S-Apply自定义yaml** | apply自定义yaml到k8s | 
+| 14.| **宝塔-网站证书部署** | 部署宝塔管理的站点的ssl证书，目前支持宝塔网站站点、docker站点等。本插件也支持aaPanel。 | 
-| 15.| **K8S-Ingress 证书部署** | 部署证书到k8s的Ingress | 
+| 15.| **K8S-Apply自定义yaml** | apply自定义yaml到k8s | 
-| 16.| **K8S-部署证书到Secret** | 部署证书到k8s的secret | 
+| 16.| **K8S-Ingress 证书部署** | 部署证书到k8s的Ingress | 
-| 17.| **lucky-更新Lucky证书** |  | 
+| 17.| **K8S-部署证书到Secret** | 部署证书到k8s的secret | 
-| 18.| **Plesk-部署Plesk网站证书** |  | 
+| 18.| **lucky-更新Lucky证书** |  | 
-| 19.| **Plesk-更新证书** | 不会创建新证书记录，直接更新旧的证书 | 
+| 19.| **Plesk-部署Plesk网站证书** |  | 
-| 20.| **雷池-更新证书（支持控制台和防护应用）** | 更新长亭雷池WAF的证书，支持更新控制台和防护应用的证书。 | 
+| 20.| **Plesk-更新证书** | 不会创建新证书记录，直接更新旧的证书 | 
-| 21.| **群晖-部署证书到群晖面板** | Synology，支持6.x以上版本 | 
+| 21.| **雷池-更新证书（支持控制台和防护应用）** | 更新长亭雷池WAF的证书，支持更新控制台和防护应用的证书。 | 
-| 22.| **群晖-刷新OTP登录有效期** | 群晖登录状态可能30天失效，需要在失效之前登录一次，刷新有效期，您可以将其放在“部署到群晖面板”任务之后 | 
+| 22.| **群晖-部署证书到群晖面板** | Synology，支持6.x以上版本 | 
-| 23.| **uniCloud-部署到服务空间** | 部署到服务空间 | 
+| 23.| **群晖-刷新OTP登录有效期** | 群晖登录状态可能30天失效，需要在失效之前登录一次，刷新有效期，您可以将其放在“部署到群晖面板”任务之后 | 
-| 24.| **Proxmox-上传证书到Proxmox** |  | 
+| 24.| **uniCloud-部署到服务空间** | 部署到服务空间 | 
-| 25.| **威联通-部署证书到威联通** | 部署证书到qnap | 
+| 25.| **Proxmox-上传证书到Proxmox** |  | 
+| 26.| **威联通-部署证书到威联通** | 部署证书到qnap | 
 ## 5. 阿里云
 
 | 序号 | 名称 | 说明 |
@@ -91,7 +92,7 @@
 | 6.| **阿里云-部署证书至API网关** | 自动部署域名证书至阿里云API网关（APIGateway） | 
 | 7.| **阿里云-部署证书至CDN** | 自动部署域名证书至阿里云CDN | 
 | 8.| **阿里云-部署证书至DCDN** | 依赖证书申请前置任务，自动部署域名证书至阿里云DCDN | 
-| 9.| **阿里云-部署至ESA** | 部署证书到阿里云ESA(边缘安全加速)，自动删除过期证书 | 
+| 9.| **阿里云-部署至ESA** | 部署证书到阿里云ESA(边缘安全加速)，支持边缘证书和SaaS证书两种模式 | 
 | 10.| **阿里云-部署至阿里云FC(3.0)** | 部署证书到阿里云函数计算（FC3.0） | 
 | 11.| **阿里云-部署至GA** | 部署证书到阿里云GA(全球加速)，支持更新默认证书和扩展证书 | 
 | 12.| **阿里云-部署至直播（Live）** | 部署证书到阿里云视频直播（Live）域名 | 

lerna.json

@@ -9,5 +9,5 @@
     }
   },
   "npmClient": "pnpm",
-  "version": "1.41.4"
+  "version": "1.42.3"
 }

packages/core/acme-client/CHANGELOG.md

@@ -3,6 +3,24 @@
 All notable changes to this project will be documented in this file.
 See [Conventional Commits](https://conventionalcommits.org) for commit guidelines.
 
+## [1.42.3](https://github.com/publishlab/node-acme-client/compare/v1.42.2...v1.42.3) (2026-07-08)
+
+**Note:** Version bump only for package @certd/acme-client
+
+## [1.42.2](https://github.com/publishlab/node-acme-client/compare/v1.42.1...v1.42.2) (2026-07-07)
+
+**Note:** Version bump only for package @certd/acme-client
+
+## [1.42.1](https://github.com/publishlab/node-acme-client/compare/v1.42.0...v1.42.1) (2026-07-06)
+
+**Note:** Version bump only for package @certd/acme-client
+
+# [1.42.0](https://github.com/publishlab/node-acme-client/compare/v1.41.4...v1.42.0) (2026-07-05)
+
+### Performance Improvements
+
+* 新增橙域网络(asia-isp) CDN证书部署插件 ([b48831e](https://github.com/publishlab/node-acme-client/commit/b48831e60b0059bef7ef9a34ab61c9dd2f684641))
+
 ## [1.41.4](https://github.com/publishlab/node-acme-client/compare/v1.41.3...v1.41.4) (2026-06-14)
 
 **Note:** Version bump only for package @certd/acme-client

packages/core/acme-client/docs/client.md

@@ -1,518 +0,0 @@
-## Classes
-
-<dl>
-<dt><a href="#AcmeClient">AcmeClient</a></dt>
-<dd><p>AcmeClient</p>
-</dd>
-</dl>
-
-## Objects
-
-<dl>
-<dt><a href="#Client">Client</a> : <code>object</code></dt>
-<dd><p>ACME client</p>
-</dd>
-</dl>
-
-<a name="AcmeClient"></a>
-
-## AcmeClient
-AcmeClient
-
-**Kind**: global class  
-
-* [AcmeClient](#AcmeClient)
-    * [new AcmeClient(opts)](#new_AcmeClient_new)
-    * [.getTermsOfServiceUrl()](#AcmeClient+getTermsOfServiceUrl) ⇒ <code>Promise.&lt;(string\|null)&gt;</code>
-    * [.getAccountUrl()](#AcmeClient+getAccountUrl) ⇒ <code>string</code>
-    * [.createAccount([data])](#AcmeClient+createAccount) ⇒ <code>Promise.&lt;object&gt;</code>
-    * [.updateAccount([data])](#AcmeClient+updateAccount) ⇒ <code>Promise.&lt;object&gt;</code>
-    * [.updateAccountKey(newAccountKey, [data])](#AcmeClient+updateAccountKey) ⇒ <code>Promise.&lt;object&gt;</code>
-    * [.createOrder(data)](#AcmeClient+createOrder) ⇒ <code>Promise.&lt;object&gt;</code>
-    * [.getOrder(order)](#AcmeClient+getOrder) ⇒ <code>Promise.&lt;object&gt;</code>
-    * [.finalizeOrder(order, csr)](#AcmeClient+finalizeOrder) ⇒ <code>Promise.&lt;object&gt;</code>
-    * [.getAuthorizations(order)](#AcmeClient+getAuthorizations) ⇒ <code>Promise.&lt;Array.&lt;object&gt;&gt;</code>
-    * [.deactivateAuthorization(authz)](#AcmeClient+deactivateAuthorization) ⇒ <code>Promise.&lt;object&gt;</code>
-    * [.getChallengeKeyAuthorization(challenge)](#AcmeClient+getChallengeKeyAuthorization) ⇒ <code>Promise.&lt;string&gt;</code>
-    * [.verifyChallenge(authz, challenge)](#AcmeClient+verifyChallenge) ⇒ <code>Promise</code>
-    * [.completeChallenge(challenge)](#AcmeClient+completeChallenge) ⇒ <code>Promise.&lt;object&gt;</code>
-    * [.waitForValidStatus(item)](#AcmeClient+waitForValidStatus) ⇒ <code>Promise.&lt;object&gt;</code>
-    * [.getCertificate(order, [preferredChain])](#AcmeClient+getCertificate) ⇒ <code>Promise.&lt;string&gt;</code>
-    * [.revokeCertificate(cert, [data])](#AcmeClient+revokeCertificate) ⇒ <code>Promise</code>
-    * [.auto(opts)](#AcmeClient+auto) ⇒ <code>Promise.&lt;string&gt;</code>
-
-<a name="new_AcmeClient_new"></a>
-
-### new AcmeClient(opts)
-
-| Param | Type | Description |
-| --- | --- | --- |
-| opts | <code>object</code> |  |
-| opts.directoryUrl | <code>string</code> | ACME directory URL |
-| opts.accountKey | <code>buffer</code> \| <code>string</code> | PEM encoded account private key |
-| [opts.accountUrl] | <code>string</code> | Account URL, default: `null` |
-| [opts.externalAccountBinding] | <code>object</code> |  |
-| [opts.externalAccountBinding.kid] | <code>string</code> | External account binding KID |
-| [opts.externalAccountBinding.hmacKey] | <code>string</code> | External account binding HMAC key |
-| [opts.backoffAttempts] | <code>number</code> | Maximum number of backoff attempts, default: `10` |
-| [opts.backoffMin] | <code>number</code> | Minimum backoff attempt delay in milliseconds, default: `5000` |
-| [opts.backoffMax] | <code>number</code> | Maximum backoff attempt delay in milliseconds, default: `30000` |
-
-**Example**  
-Create ACME client instance
-```js
-const client = new acme.Client({
-    directoryUrl: acme.directory.letsencrypt.staging,
-    accountKey: 'Private key goes here',
-});
-```
-**Example**  
-Create ACME client instance
-```js
-const client = new acme.Client({
-    directoryUrl: acme.directory.letsencrypt.staging,
-    accountKey: 'Private key goes here',
-    accountUrl: 'Optional account URL goes here',
-    backoffAttempts: 10,
-    backoffMin: 5000,
-    backoffMax: 30000,
-});
-```
-**Example**  
-Create ACME client with external account binding
-```js
-const client = new acme.Client({
-    directoryUrl: 'https://acme-provider.example.com/directory-url',
-    accountKey: 'Private key goes here',
-    externalAccountBinding: {
-        kid: 'YOUR-EAB-KID',
-        hmacKey: 'YOUR-EAB-HMAC-KEY',
-    },
-});
-```
-<a name="AcmeClient+getTermsOfServiceUrl"></a>
-
-### acmeClient.getTermsOfServiceUrl() ⇒ <code>Promise.&lt;(string\|null)&gt;</code>
-Get Terms of Service URL if available
-
-**Kind**: instance method of [<code>AcmeClient</code>](#AcmeClient)  
-**Returns**: <code>Promise.&lt;(string\|null)&gt;</code> - ToS URL  
-**Example**  
-Get Terms of Service URL
-```js
-const termsOfService = client.getTermsOfServiceUrl();
-
-if (!termsOfService) {
-    // CA did not provide Terms of Service
-}
-```
-<a name="AcmeClient+getAccountUrl"></a>
-
-### acmeClient.getAccountUrl() ⇒ <code>string</code>
-Get current account URL
-
-**Kind**: instance method of [<code>AcmeClient</code>](#AcmeClient)  
-**Returns**: <code>string</code> - Account URL  
-**Throws**:
-
-- <code>Error</code> No account URL found
-
-**Example**  
-Get current account URL
-```js
-try {
-    const accountUrl = client.getAccountUrl();
-}
-catch (e) {
-    // No account URL exists, need to create account first
-}
-```
-<a name="AcmeClient+createAccount"></a>
-
-### acmeClient.createAccount([data]) ⇒ <code>Promise.&lt;object&gt;</code>
-Create a new account
-
-https://datatracker.ietf.org/doc/html/rfc8555#section-7.3
-
-**Kind**: instance method of [<code>AcmeClient</code>](#AcmeClient)  
-**Returns**: <code>Promise.&lt;object&gt;</code> - Account  
-
-| Param | Type | Description |
-| --- | --- | --- |
-| [data] | <code>object</code> | Request data |
-
-**Example**  
-Create a new account
-```js
-const account = await client.createAccount({
-    termsOfServiceAgreed: true,
-});
-```
-**Example**  
-Create a new account with contact info
-```js
-const account = await client.createAccount({
-    termsOfServiceAgreed: true,
-    contact: ['mailto:test@example.com'],
-});
-```
-<a name="AcmeClient+updateAccount"></a>
-
-### acmeClient.updateAccount([data]) ⇒ <code>Promise.&lt;object&gt;</code>
-Update existing account
-
-https://datatracker.ietf.org/doc/html/rfc8555#section-7.3.2
-
-**Kind**: instance method of [<code>AcmeClient</code>](#AcmeClient)  
-**Returns**: <code>Promise.&lt;object&gt;</code> - Account  
-
-| Param | Type | Description |
-| --- | --- | --- |
-| [data] | <code>object</code> | Request data |
-
-**Example**  
-Update existing account
-```js
-const account = await client.updateAccount({
-    contact: ['mailto:foo@example.com'],
-});
-```
-<a name="AcmeClient+updateAccountKey"></a>
-
-### acmeClient.updateAccountKey(newAccountKey, [data]) ⇒ <code>Promise.&lt;object&gt;</code>
-Update account private key
-
-https://datatracker.ietf.org/doc/html/rfc8555#section-7.3.5
-
-**Kind**: instance method of [<code>AcmeClient</code>](#AcmeClient)  
-**Returns**: <code>Promise.&lt;object&gt;</code> - Account  
-
-| Param | Type | Description |
-| --- | --- | --- |
-| newAccountKey | <code>buffer</code> \| <code>string</code> | New PEM encoded private key |
-| [data] | <code>object</code> | Additional request data |
-
-**Example**  
-Update account private key
-```js
-const newAccountKey = 'New private key goes here';
-const result = await client.updateAccountKey(newAccountKey);
-```
-<a name="AcmeClient+createOrder"></a>
-
-### acmeClient.createOrder(data) ⇒ <code>Promise.&lt;object&gt;</code>
-Create a new order
-
-https://datatracker.ietf.org/doc/html/rfc8555#section-7.4
-
-**Kind**: instance method of [<code>AcmeClient</code>](#AcmeClient)  
-**Returns**: <code>Promise.&lt;object&gt;</code> - Order  
-
-| Param | Type | Description |
-| --- | --- | --- |
-| data | <code>object</code> | Request data |
-
-**Example**  
-Create a new order
-```js
-const order = await client.createOrder({
-    identifiers: [
-        { type: 'dns', value: 'example.com' },
-        { type: 'dns', value: 'test.example.com' },
-    ],
-});
-```
-<a name="AcmeClient+getOrder"></a>
-
-### acmeClient.getOrder(order) ⇒ <code>Promise.&lt;object&gt;</code>
-Refresh order object from CA
-
-https://datatracker.ietf.org/doc/html/rfc8555#section-7.4
-
-**Kind**: instance method of [<code>AcmeClient</code>](#AcmeClient)  
-**Returns**: <code>Promise.&lt;object&gt;</code> - Order  
-
-| Param | Type | Description |
-| --- | --- | --- |
-| order | <code>object</code> | Order object |
-
-**Example**  
-```js
-const order = { ... }; // Previously created order object
-const result = await client.getOrder(order);
-```
-<a name="AcmeClient+finalizeOrder"></a>
-
-### acmeClient.finalizeOrder(order, csr) ⇒ <code>Promise.&lt;object&gt;</code>
-Finalize order
-
-https://datatracker.ietf.org/doc/html/rfc8555#section-7.4
-
-**Kind**: instance method of [<code>AcmeClient</code>](#AcmeClient)  
-**Returns**: <code>Promise.&lt;object&gt;</code> - Order  
-
-| Param | Type | Description |
-| --- | --- | --- |
-| order | <code>object</code> | Order object |
-| csr | <code>buffer</code> \| <code>string</code> | PEM encoded Certificate Signing Request |
-
-**Example**  
-Finalize order
-```js
-const order = { ... }; // Previously created order object
-const csr = { ... }; // Previously created Certificate Signing Request
-const result = await client.finalizeOrder(order, csr);
-```
-<a name="AcmeClient+getAuthorizations"></a>
-
-### acmeClient.getAuthorizations(order) ⇒ <code>Promise.&lt;Array.&lt;object&gt;&gt;</code>
-Get identifier authorizations from order
-
-https://datatracker.ietf.org/doc/html/rfc8555#section-7.5
-
-**Kind**: instance method of [<code>AcmeClient</code>](#AcmeClient)  
-**Returns**: <code>Promise.&lt;Array.&lt;object&gt;&gt;</code> - Authorizations  
-
-| Param | Type | Description |
-| --- | --- | --- |
-| order | <code>object</code> | Order |
-
-**Example**  
-Get identifier authorizations
-```js
-const order = { ... }; // Previously created order object
-const authorizations = await client.getAuthorizations(order);
-
-authorizations.forEach((authz) => {
-    const { challenges } = authz;
-});
-```
-<a name="AcmeClient+deactivateAuthorization"></a>
-
-### acmeClient.deactivateAuthorization(authz) ⇒ <code>Promise.&lt;object&gt;</code>
-Deactivate identifier authorization
-
-https://datatracker.ietf.org/doc/html/rfc8555#section-7.5.2
-
-**Kind**: instance method of [<code>AcmeClient</code>](#AcmeClient)  
-**Returns**: <code>Promise.&lt;object&gt;</code> - Authorization  
-
-| Param | Type | Description |
-| --- | --- | --- |
-| authz | <code>object</code> | Identifier authorization |
-
-**Example**  
-Deactivate identifier authorization
-```js
-const authz = { ... }; // Identifier authorization resolved from previously created order
-const result = await client.deactivateAuthorization(authz);
-```
-<a name="AcmeClient+getChallengeKeyAuthorization"></a>
-
-### acmeClient.getChallengeKeyAuthorization(challenge) ⇒ <code>Promise.&lt;string&gt;</code>
-Get key authorization for ACME challenge
-
-https://datatracker.ietf.org/doc/html/rfc8555#section-8.1
-
-**Kind**: instance method of [<code>AcmeClient</code>](#AcmeClient)  
-**Returns**: <code>Promise.&lt;string&gt;</code> - Key authorization  
-
-| Param | Type | Description |
-| --- | --- | --- |
-| challenge | <code>object</code> | Challenge object returned by API |
-
-**Example**  
-Get challenge key authorization
-```js
-const challenge = { ... }; // Challenge from previously resolved identifier authorization
-const key = await client.getChallengeKeyAuthorization(challenge);
-
-// Write key somewhere to satisfy challenge
-```
-<a name="AcmeClient+verifyChallenge"></a>
-
-### acmeClient.verifyChallenge(authz, challenge) ⇒ <code>Promise</code>
-Verify that ACME challenge is satisfied
-
-**Kind**: instance method of [<code>AcmeClient</code>](#AcmeClient)  
-
-| Param | Type | Description |
-| --- | --- | --- |
-| authz | <code>object</code> | Identifier authorization |
-| challenge | <code>object</code> | Authorization challenge |
-
-**Example**  
-Verify satisfied ACME challenge
-```js
-const authz = { ... }; // Identifier authorization
-const challenge = { ... }; // Satisfied challenge
-await client.verifyChallenge(authz, challenge);
-```
-<a name="AcmeClient+completeChallenge"></a>
-
-### acmeClient.completeChallenge(challenge) ⇒ <code>Promise.&lt;object&gt;</code>
-Notify CA that challenge has been completed
-
-https://datatracker.ietf.org/doc/html/rfc8555#section-7.5.1
-
-**Kind**: instance method of [<code>AcmeClient</code>](#AcmeClient)  
-**Returns**: <code>Promise.&lt;object&gt;</code> - Challenge  
-
-| Param | Type | Description |
-| --- | --- | --- |
-| challenge | <code>object</code> | Challenge object returned by API |
-
-**Example**  
-Notify CA that challenge has been completed
-```js
-const challenge = { ... }; // Satisfied challenge
-const result = await client.completeChallenge(challenge);
-```
-<a name="AcmeClient+waitForValidStatus"></a>
-
-### acmeClient.waitForValidStatus(item) ⇒ <code>Promise.&lt;object&gt;</code>
-Wait for ACME provider to verify status on a order, authorization or challenge
-
-https://datatracker.ietf.org/doc/html/rfc8555#section-7.5.1
-
-**Kind**: instance method of [<code>AcmeClient</code>](#AcmeClient)  
-**Returns**: <code>Promise.&lt;object&gt;</code> - Valid order, authorization or challenge  
-
-| Param | Type | Description |
-| --- | --- | --- |
-| item | <code>object</code> | An order, authorization or challenge object |
-
-**Example**  
-Wait for valid challenge status
-```js
-const challenge = { ... };
-await client.waitForValidStatus(challenge);
-```
-**Example**  
-Wait for valid authorization status
-```js
-const authz = { ... };
-await client.waitForValidStatus(authz);
-```
-**Example**  
-Wait for valid order status
-```js
-const order = { ... };
-await client.waitForValidStatus(order);
-```
-<a name="AcmeClient+getCertificate"></a>
-
-### acmeClient.getCertificate(order, [preferredChain]) ⇒ <code>Promise.&lt;string&gt;</code>
-Get certificate from ACME order
-
-https://datatracker.ietf.org/doc/html/rfc8555#section-7.4.2
-
-**Kind**: instance method of [<code>AcmeClient</code>](#AcmeClient)  
-**Returns**: <code>Promise.&lt;string&gt;</code> - Certificate  
-
-| Param | Type | Default | Description |
-| --- | --- | --- | --- |
-| order | <code>object</code> |  | Order object |
-| [preferredChain] | <code>string</code> | <code>null</code> | Indicate which certificate chain is preferred if a CA offers multiple, by exact issuer common name, default: `null` |
-
-**Example**  
-Get certificate
-```js
-const order = { ... }; // Previously created order
-const certificate = await client.getCertificate(order);
-```
-**Example**  
-Get certificate with preferred chain
-```js
-const order = { ... }; // Previously created order
-const certificate = await client.getCertificate(order, 'DST Root CA X3');
-```
-<a name="AcmeClient+revokeCertificate"></a>
-
-### acmeClient.revokeCertificate(cert, [data]) ⇒ <code>Promise</code>
-Revoke certificate
-
-https://datatracker.ietf.org/doc/html/rfc8555#section-7.6
-
-**Kind**: instance method of [<code>AcmeClient</code>](#AcmeClient)  
-
-| Param | Type | Description |
-| --- | --- | --- |
-| cert | <code>buffer</code> \| <code>string</code> | PEM encoded certificate |
-| [data] | <code>object</code> | Additional request data |
-
-**Example**  
-Revoke certificate
-```js
-const certificate = { ... }; // Previously created certificate
-const result = await client.revokeCertificate(certificate);
-```
-**Example**  
-Revoke certificate with reason
-```js
-const certificate = { ... }; // Previously created certificate
-const result = await client.revokeCertificate(certificate, {
-    reason: 4,
-});
-```
-<a name="AcmeClient+auto"></a>
-
-### acmeClient.auto(opts) ⇒ <code>Promise.&lt;string&gt;</code>
-Auto mode
-
-**Kind**: instance method of [<code>AcmeClient</code>](#AcmeClient)  
-**Returns**: <code>Promise.&lt;string&gt;</code> - Certificate  
-
-| Param | Type | Description |
-| --- | --- | --- |
-| opts | <code>object</code> |  |
-| opts.csr | <code>buffer</code> \| <code>string</code> | Certificate Signing Request |
-| opts.challengeCreateFn | <code>function</code> | Function returning Promise triggered before completing ACME challenge |
-| opts.challengeRemoveFn | <code>function</code> | Function returning Promise triggered after completing ACME challenge |
-| [opts.email] | <code>string</code> | Account email address |
-| [opts.termsOfServiceAgreed] | <code>boolean</code> | Agree to Terms of Service, default: `false` |
-| [opts.skipChallengeVerification] | <code>boolean</code> | Skip internal challenge verification before notifying ACME provider, default: `false` |
-| [opts.challengePriority] | <code>Array.&lt;string&gt;</code> | Array defining challenge type priority, default: `['http-01', 'dns-01']` |
-| [opts.preferredChain] | <code>string</code> | Indicate which certificate chain is preferred if a CA offers multiple, by exact issuer common name, default: `null` |
-
-**Example**  
-Order a certificate using auto mode
-```js
-const [certificateKey, certificateRequest] = await acme.crypto.createCsr({
-    altNames: ['test.example.com'],
-});
-
-const certificate = await client.auto({
-    csr: certificateRequest,
-    email: 'test@example.com',
-    termsOfServiceAgreed: true,
-    challengeCreateFn: async (authz, challenge, keyAuthorization) => {
-        // Satisfy challenge here
-    },
-    challengeRemoveFn: async (authz, challenge, keyAuthorization) => {
-        // Clean up challenge here
-    },
-});
-```
-**Example**  
-Order a certificate using auto mode with preferred chain
-```js
-const [certificateKey, certificateRequest] = await acme.crypto.createCsr({
-    altNames: ['test.example.com'],
-});
-
-const certificate = await client.auto({
-    csr: certificateRequest,
-    email: 'test@example.com',
-    termsOfServiceAgreed: true,
-    preferredChain: 'DST Root CA X3',
-    challengeCreateFn: async () => {},
-    challengeRemoveFn: async () => {},
-});
-```
-<a name="Client"></a>
-
-## Client : <code>object</code>
-ACME client
-
-**Kind**: global namespace  

packages/core/acme-client/package.json

@@ -3,7 +3,7 @@
     "description": "Simple and unopinionated ACME client",
     "private": false,
     "author": "nmorsman",
-    "version": "1.41.4",
+    "version": "1.42.3",
     "type": "module",
     "module": "./dist/index.js",
     "main": "./dist/index.js",
@@ -18,7 +18,7 @@
         "types"
     ],
     "dependencies": {
-        "@certd/basic": "^1.41.4",
+        "@certd/basic": "^1.42.3",
         "@peculiar/x509": "^1.11.0",
         "asn1js": "^3.0.5",
         "axios": "^1.9.0",
@@ -50,10 +50,9 @@
     "scripts": {
         "before-build": "node -e \"const fs=require('fs');fs.rmSync('dist',{recursive:true,force:true});fs.rmSync('tsconfig.tsbuildinfo',{force:true});\"",
         "build": "npm run before-build && tsc -p tsconfig.build.json --skipLibCheck",
-        "build-docs": "jsdoc2md dist/client.js > docs/client.md && jsdoc2md dist/crypto/index.js > docs/crypto.md && jsdoc2md dist/crypto/forge.js > docs/forge.md",
         "lint": "eslint \"src/**/*.ts\" \"types/**/*.ts\"",
         "lint-types": "tsd --files \"types/index.test-d.ts\"",
-        "prepublishOnly": "npm run build && npm run build-docs",
+        "prepublishOnly": "npm run build",
         "test": "mocha -t 60000 \"test/setup.js\" \"test/**/*.spec.js\"",
         "before-test:unit": "node -e \"const fs=require('fs');fs.rmSync('dist-test',{recursive:true,force:true});fs.rmSync('tsconfig.test.tsbuildinfo',{force:true});\"",
         "test:unit": "cross-env NODE_ENV=unittest npm run before-test:unit && cross-env NODE_ENV=unittest tsc -p tsconfig.test.json --skipLibCheck && cross-env NODE_ENV=unittest mocha -t 60000 \"dist-test/**/*.test.js\"",
@@ -76,5 +75,5 @@
     "bugs": {
         "url": "https://github.com/publishlab/node-acme-client/issues"
     },
-    "gitHead": "bc731e4fb119787930e816a7d57c808b1b5cd66a"
+    "gitHead": "7808d028e9c7e1b1e3ebc41f12b023d7b553300b"
 }

packages/core/basic/CHANGELOG.md

@@ -3,6 +3,22 @@
 All notable changes to this project will be documented in this file.
 See [Conventional Commits](https://conventionalcommits.org) for commit guidelines.
 
+## [1.42.3](https://github.com/certd/certd/compare/v1.42.2...v1.42.3) (2026-07-08)
+
+**Note:** Version bump only for package @certd/basic
+
+## [1.42.2](https://github.com/certd/certd/compare/v1.42.1...v1.42.2) (2026-07-07)
+
+**Note:** Version bump only for package @certd/basic
+
+## [1.42.1](https://github.com/certd/certd/compare/v1.42.0...v1.42.1) (2026-07-06)
+
+**Note:** Version bump only for package @certd/basic
+
+# [1.42.0](https://github.com/certd/certd/compare/v1.41.4...v1.42.0) (2026-07-05)
+
+**Note:** Version bump only for package @certd/basic
+
 ## [1.41.4](https://github.com/certd/certd/compare/v1.41.3...v1.41.4) (2026-06-14)
 
 ### Bug Fixes

packages/core/basic/build.md

@@ -1 +1 @@
-21:25
+23:45

packages/core/basic/package.json

@@ -1,7 +1,7 @@
 {
   "name": "@certd/basic",
   "private": false,
-  "version": "1.41.4",
+  "version": "1.42.3",
   "type": "module",
   "main": "./dist/index.js",
   "module": "./dist/index.js",
@@ -54,5 +54,5 @@
     "tslib": "^2.8.1",
     "typescript": "^5.4.2"
   },
-  "gitHead": "bc731e4fb119787930e816a7d57c808b1b5cd66a"
+  "gitHead": "7808d028e9c7e1b1e3ebc41f12b023d7b553300b"
 }

packages/core/pipeline/CHANGELOG.md

@@ -3,6 +3,24 @@
 All notable changes to this project will be documented in this file.
 See [Conventional Commits](https://conventionalcommits.org) for commit guidelines.
 
+## [1.42.3](https://github.com/certd/certd/compare/v1.42.2...v1.42.3) (2026-07-08)
+
+**Note:** Version bump only for package @certd/pipeline
+
+## [1.42.2](https://github.com/certd/certd/compare/v1.42.1...v1.42.2) (2026-07-07)
+
+**Note:** Version bump only for package @certd/pipeline
+
+## [1.42.1](https://github.com/certd/certd/compare/v1.42.0...v1.42.1) (2026-07-06)
+
+**Note:** Version bump only for package @certd/pipeline
+
+# [1.42.0](https://github.com/certd/certd/compare/v1.41.4...v1.42.0) (2026-07-05)
+
+### Features
+
+* 通过插件配置懒加载依赖，动态加载第三方依赖包，精简安装镜像大小 ([01568ca](https://github.com/certd/certd/commit/01568ca1489069046b5a89ebdd4ced2f7f6ddf93))
+
 ## [1.41.4](https://github.com/certd/certd/compare/v1.41.3...v1.41.4) (2026-06-14)
 
 **Note:** Version bump only for package @certd/pipeline

packages/core/pipeline/package.json

@@ -1,7 +1,7 @@
 {
   "name": "@certd/pipeline",
   "private": false,
-  "version": "1.41.4",
+  "version": "1.42.3",
   "type": "module",
   "main": "./dist/index.js",
   "module": "./dist/index.js",
@@ -21,8 +21,8 @@
     "lint": "eslint --fix"
   },
   "dependencies": {
-    "@certd/basic": "^1.41.4",
+    "@certd/basic": "^1.42.3",
-    "@certd/plus-core": "^1.41.4",
+    "@certd/plus-core": "^1.42.3",
     "dayjs": "^1.11.7",
     "lodash-es": "^4.17.21",
     "reflect-metadata": "^0.2.2"
@@ -51,5 +51,5 @@
     "tslib": "^2.8.1",
     "typescript": "^5.4.2"
   },
-  "gitHead": "bc731e4fb119787930e816a7d57c808b1b5cd66a"
+  "gitHead": "7808d028e9c7e1b1e3ebc41f12b023d7b553300b"
 }

packages/libs/lib-huawei/CHANGELOG.md

@@ -3,6 +3,22 @@
 All notable changes to this project will be documented in this file.
 See [Conventional Commits](https://conventionalcommits.org) for commit guidelines.
 
+## [1.42.3](https://github.com/certd/certd/compare/v1.42.2...v1.42.3) (2026-07-08)
+
+**Note:** Version bump only for package @certd/lib-huawei
+
+## [1.42.2](https://github.com/certd/certd/compare/v1.42.1...v1.42.2) (2026-07-07)
+
+**Note:** Version bump only for package @certd/lib-huawei
+
+## [1.42.1](https://github.com/certd/certd/compare/v1.42.0...v1.42.1) (2026-07-06)
+
+**Note:** Version bump only for package @certd/lib-huawei
+
+# [1.42.0](https://github.com/certd/certd/compare/v1.41.4...v1.42.0) (2026-07-05)
+
+**Note:** Version bump only for package @certd/lib-huawei
+
 ## [1.41.4](https://github.com/certd/certd/compare/v1.41.3...v1.41.4) (2026-06-14)
 
 ### Bug Fixes

packages/libs/lib-huawei/package.json

@@ -1,7 +1,7 @@
 {
   "name": "@certd/lib-huawei",
   "private": false,
-  "version": "1.41.4",
+  "version": "1.42.3",
   "main": "./dist/bundle.js",
   "module": "./dist/bundle.js",
   "types": "./dist/d/index.d.ts",
@@ -30,5 +30,5 @@
     "prettier": "3.3.3",
     "tslib": "^2.8.1"
   },
-  "gitHead": "bc731e4fb119787930e816a7d57c808b1b5cd66a"
+  "gitHead": "7808d028e9c7e1b1e3ebc41f12b023d7b553300b"
 }

packages/libs/lib-iframe/CHANGELOG.md

@@ -3,6 +3,22 @@
 All notable changes to this project will be documented in this file.
 See [Conventional Commits](https://conventionalcommits.org) for commit guidelines.
 
+## [1.42.3](https://github.com/certd/certd/compare/v1.42.2...v1.42.3) (2026-07-08)
+
+**Note:** Version bump only for package @certd/lib-iframe
+
+## [1.42.2](https://github.com/certd/certd/compare/v1.42.1...v1.42.2) (2026-07-07)
+
+**Note:** Version bump only for package @certd/lib-iframe
+
+## [1.42.1](https://github.com/certd/certd/compare/v1.42.0...v1.42.1) (2026-07-06)
+
+**Note:** Version bump only for package @certd/lib-iframe
+
+# [1.42.0](https://github.com/certd/certd/compare/v1.41.4...v1.42.0) (2026-07-05)
+
+**Note:** Version bump only for package @certd/lib-iframe
+
 ## [1.41.4](https://github.com/certd/certd/compare/v1.41.3...v1.41.4) (2026-06-14)
 
 ### Bug Fixes

packages/libs/lib-iframe/package.json

@@ -1,7 +1,7 @@
 {
   "name": "@certd/lib-iframe",
   "private": false,
-  "version": "1.41.4",
+  "version": "1.42.3",
   "type": "module",
   "main": "./dist/index.js",
   "module": "./dist/index.js",
@@ -37,5 +37,5 @@
     "tslib": "^2.8.1",
     "typescript": "^5.4.2"
   },
-  "gitHead": "bc731e4fb119787930e816a7d57c808b1b5cd66a"
+  "gitHead": "7808d028e9c7e1b1e3ebc41f12b023d7b553300b"
 }

packages/libs/lib-jdcloud/CHANGELOG.md

@@ -3,6 +3,22 @@
 All notable changes to this project will be documented in this file.
 See [Conventional Commits](https://conventionalcommits.org) for commit guidelines.
 
+## [1.42.3](https://github.com/certd/certd/compare/v1.42.2...v1.42.3) (2026-07-08)
+
+**Note:** Version bump only for package @certd/jdcloud
+
+## [1.42.2](https://github.com/certd/certd/compare/v1.42.1...v1.42.2) (2026-07-07)
+
+**Note:** Version bump only for package @certd/jdcloud
+
+## [1.42.1](https://github.com/certd/certd/compare/v1.42.0...v1.42.1) (2026-07-06)
+
+**Note:** Version bump only for package @certd/jdcloud
+
+# [1.42.0](https://github.com/certd/certd/compare/v1.41.4...v1.42.0) (2026-07-05)
+
+**Note:** Version bump only for package @certd/jdcloud
+
 ## [1.41.4](https://github.com/certd/certd/compare/v1.41.3...v1.41.4) (2026-06-14)
 
 ### Bug Fixes

packages/libs/lib-jdcloud/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@certd/jdcloud",
-  "version": "1.41.4",
+  "version": "1.42.3",
   "description": "jdcloud openApi sdk",
   "main": "./dist/bundle.js",
   "module": "./dist/bundle.js",
@@ -62,5 +62,5 @@
       "fetch"
     ]
   },
-  "gitHead": "bc731e4fb119787930e816a7d57c808b1b5cd66a"
+  "gitHead": "7808d028e9c7e1b1e3ebc41f12b023d7b553300b"
 }

packages/libs/lib-k8s/CHANGELOG.md

@@ -3,6 +3,22 @@
 All notable changes to this project will be documented in this file.
 See [Conventional Commits](https://conventionalcommits.org) for commit guidelines.
 
+## [1.42.3](https://github.com/certd/certd/compare/v1.42.2...v1.42.3) (2026-07-08)
+
+**Note:** Version bump only for package @certd/lib-k8s
+
+## [1.42.2](https://github.com/certd/certd/compare/v1.42.1...v1.42.2) (2026-07-07)
+
+**Note:** Version bump only for package @certd/lib-k8s
+
+## [1.42.1](https://github.com/certd/certd/compare/v1.42.0...v1.42.1) (2026-07-06)
+
+**Note:** Version bump only for package @certd/lib-k8s
+
+# [1.42.0](https://github.com/certd/certd/compare/v1.41.4...v1.42.0) (2026-07-05)
+
+**Note:** Version bump only for package @certd/lib-k8s
+
 ## [1.41.4](https://github.com/certd/certd/compare/v1.41.3...v1.41.4) (2026-06-14)
 
 **Note:** Version bump only for package @certd/lib-k8s

packages/libs/lib-k8s/package.json

@@ -1,7 +1,7 @@
 {
   "name": "@certd/lib-k8s",
   "private": false,
-  "version": "1.41.4",
+  "version": "1.42.3",
   "type": "module",
   "main": "./dist/index.js",
   "module": "./dist/index.js",
@@ -21,7 +21,7 @@
     "lint": "eslint --fix"
   },
   "dependencies": {
-    "@certd/basic": "^1.41.4",
+    "@certd/basic": "^1.42.3",
     "@kubernetes/client-node": "0.21.0"
   },
   "devDependencies": {
@@ -38,5 +38,5 @@
     "tslib": "^2.8.1",
     "typescript": "^5.4.2"
   },
-  "gitHead": "bc731e4fb119787930e816a7d57c808b1b5cd66a"
+  "gitHead": "7808d028e9c7e1b1e3ebc41f12b023d7b553300b"
 }

packages/libs/lib-server/CHANGELOG.md

@@ -3,6 +3,31 @@
 All notable changes to this project will be documented in this file.
 See [Conventional Commits](https://conventionalcommits.org) for commit guidelines.
 
+## [1.42.3](https://github.com/certd/certd/compare/v1.42.2...v1.42.3) (2026-07-08)
+
+**Note:** Version bump only for package @certd/lib-server
+
+## [1.42.2](https://github.com/certd/certd/compare/v1.42.1...v1.42.2) (2026-07-07)
+
+**Note:** Version bump only for package @certd/lib-server
+
+## [1.42.1](https://github.com/certd/certd/compare/v1.42.0...v1.42.1) (2026-07-06)
+
+**Note:** Version bump only for package @certd/lib-server
+
+# [1.42.0](https://github.com/certd/certd/compare/v1.41.4...v1.42.0) (2026-07-05)
+
+### Features
+
+* 通过插件配置懒加载依赖，动态加载第三方依赖包，精简安装镜像大小 ([01568ca](https://github.com/certd/certd/commit/01568ca1489069046b5a89ebdd4ced2f7f6ddf93))
+
+### Performance Improvements
+
+* 【破坏性更新】 证书压缩包不再生成文件存储，而是实时打包下载，证书申请插件不再输出certZip ([7cff1a9](https://github.com/certd/certd/commit/7cff1a98424120585205889874b3ef4956a30583))
+* 优化用户体验，首次访问时弹出邮箱账号绑定用以初始化账号 ([608cc2a](https://github.com/certd/certd/commit/608cc2a81ff0b4872c9fe11ed9c9c0b4b90a12a3))
+* 支持全自动匹配部署宝塔网站证书 ([4dff48e](https://github.com/certd/certd/commit/4dff48e807c32a7623ec9206cf39c88e88f89f6a))
+* dns默认ipv4first ([194463b](https://github.com/certd/certd/commit/194463bea9e797315aa7a724f4b2930701570419))
+
 ## [1.41.4](https://github.com/certd/certd/compare/v1.41.3...v1.41.4) (2026-06-14)
 
 **Note:** Version bump only for package @certd/lib-server

packages/libs/lib-server/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@certd/lib-server",
-  "version": "1.41.4",
+  "version": "1.42.3",
   "description": "midway with flyway, sql upgrade way ",
   "private": false,
   "type": "module",
@@ -29,11 +29,11 @@
   ],
   "license": "AGPL",
   "dependencies": {
-    "@certd/acme-client": "^1.41.4",
+    "@certd/acme-client": "^1.42.3",
-    "@certd/basic": "^1.41.4",
+    "@certd/basic": "^1.42.3",
-    "@certd/pipeline": "^1.41.4",
+    "@certd/pipeline": "^1.42.3",
-    "@certd/plugin-lib": "^1.41.4",
+    "@certd/plugin-lib": "^1.42.3",
-    "@certd/plus-core": "^1.41.4",
+    "@certd/plus-core": "^1.42.3",
     "@midwayjs/cache": "3.14.0",
     "@midwayjs/core": "3.20.11",
     "@midwayjs/i18n": "3.20.13",
@@ -49,8 +49,6 @@
     "typeorm": "^0.3.20"
   },
   "devDependencies": {
-     "mwts": "^1.3.0",
-    "mwtsc": "^1.4.0",
     "@types/chai": "^4.3.12",
     "@types/mocha": "^10.0.6",
     "@types/node": "^18",
@@ -62,6 +60,8 @@
     "eslint-plugin-prettier": "^5.1.3",
     "esmock": "^2.7.5",
     "mocha": "^10.6.0",
+    "mwts": "^1.3.0",
+    "mwtsc": "^1.4.0",
     "prettier": "3.3.3",
     "rimraf": "^5.0.5",
     "ts-node": "^10.9.2",
@@ -69,5 +69,5 @@
     "typeorm": "^0.3.20",
     "typescript": "^5.4.2"
   },
-  "gitHead": "bc731e4fb119787930e816a7d57c808b1b5cd66a"
+  "gitHead": "7808d028e9c7e1b1e3ebc41f12b023d7b553300b"
 }

packages/libs/lib-server/src/basic/base-controller.ts

@@ -1,9 +1,8 @@
-import { ApplicationContext, Inject } from '@midwayjs/core';
+import { ApplicationContext, Inject } from "@midwayjs/core";
-import type {IMidwayContainer} from  '@midwayjs/core';
+import type { IMidwayContainer } from "@midwayjs/core";
-import * as koa from '@midwayjs/koa';
+import * as koa from "@midwayjs/koa";
-import { Constants } from './constants.js';
+import { Constants } from "./constants.js";
-import { isEnterprise } from './mode.js';
+import { isEnterprise } from "./mode.js";
-
 
 export abstract class BaseController {
   @Inject()
@@ -41,7 +40,7 @@ export abstract class BaseController {
   getUserId() {
     const userId = this.ctx.user?.id;
     if (userId == null) {
-      throw new Error('Token已过期');
+      throw new Error("Token已过期");
     }
     return userId;
   }
@@ -49,7 +48,7 @@ export abstract class BaseController {
   getLoginUser() {
     const user = this.ctx.user;
     if (user == null) {
-      throw new Error('Token已过期');
+      throw new Error("Token已过期");
     }
     return user;
   }
@@ -61,73 +60,71 @@ export abstract class BaseController {
     }
   }
 
-  async getProjectId(permission:string) {
+  async getProjectId(permission: string) {
     if (!isEnterprise()) {
-      return undefined
+      return undefined;
     }
     let projectIdStr = this.ctx.headers["project-id"] as string;
-    if (!projectIdStr){
+    if (!projectIdStr) {
       projectIdStr = this.ctx.request.query["projectId"] as string;
     }
     if (!projectIdStr) {
       //这里必须抛异常，否则可能会有权限问题
-      throw new Error("projectId 不能为空")
+      throw new Error("projectId 不能为空");
     }
-    const userId = this.getUserId()
+    const userId = this.getUserId();
-    const projectId = parseInt(projectIdStr)
+    const projectId = parseInt(projectIdStr);
-    await this.checkProjectPermission(userId, projectId,permission)
+    await this.checkProjectPermission(userId, projectId, permission);
     return projectId;
   }
 
-  async getProjectUserId(permission:string){
+  async getProjectUserId(permission: string) {
-    let userId = this.getUserId()
+    let userId = this.getUserId();
-    const projectId = await this.getProjectId(permission)
+    const projectId = await this.getProjectId(permission);
-    if(projectId){
+    if (projectId) {
-      userId = -1 // 企业管理模式下，用户id固定-1
+      userId = -1; // 企业管理模式下，用户id固定-1
     }
     return {
-      projectId,userId
+      projectId,
-    }
+      userId,
+    };
   }
-  async getProjectUserIdRead(){
+  async getProjectUserIdRead() {
-    return await this.getProjectUserId("read")
+    return await this.getProjectUserId("read");
   }
-  async getProjectUserIdWrite(){
+  async getProjectUserIdWrite() {
-    return await this.getProjectUserId("write")
+    return await this.getProjectUserId("write");
   }
-  async getProjectUserIdAdmin(){
+  async getProjectUserIdAdmin() {
-    return await this.getProjectUserId("admin")
+    return await this.getProjectUserId("admin");
   }
 
-  async checkProjectPermission(userId: number, projectId: number,permission:string) {
+  async checkProjectPermission(userId: number, projectId: number, permission: string) {
-    const projectService:any = await this.applicationContext.getAsync("projectService");
+    const projectService: any = await this.applicationContext.getAsync("projectService");
-    await projectService.checkPermission({userId,projectId,permission})
+    await projectService.checkPermission({ userId, projectId, permission });
   }
 
   /**
-   * 
+   *
    * @param service 检查记录是否属于某用户或某项目
-   * @param id 
+   * @param id
    */
-  async checkOwner(service:any,id:number,permission:string,allowAdmin:boolean = false){
+  async checkOwner(service: any, id: number, permission: string, allowAdmin: boolean = false) {
-    let { projectId,userId } = await this.getProjectUserId(permission)
+    const { projectId, userId } = await this.getProjectUserId(permission);
-    const authService:any = await this.applicationContext.getAsync("authService");
+    const authService: any = await this.applicationContext.getAsync("authService");
     if (projectId) {
       await authService.checkProjectId(service, id, projectId);
-    }else{
+    } else {
-
+      if (userId === Constants.systemUserId) {
-      if(userId === Constants.systemUserId){
         //系统级别，不检查权限
-      }else{
+      } else {
-        if(allowAdmin){
+        if (allowAdmin) {
           await authService.checkUserIdButAllowAdmin(this.ctx, service, id);
-        }else{
+        } else {
-          await authService.checkUserId( service, id, userId);
+          await authService.checkUserId(service, id, userId);
         }
       }
-     
     }
-    return {projectId,userId}
+    return { projectId, userId };
   }
-
 }

packages/libs/lib-server/src/basic/base-service.ts

@@ -56,7 +56,7 @@ export abstract class BaseService<T> {
     return dataSource.getRepository(entity);
   }
 
-  protected buildUserProjectQuery(userId: number, projectId?: number) {
+  public buildUserProjectQuery(userId: number, projectId?: number) {
     const query: { userId: number; projectId?: number; [key: string]: any } = {
       userId,
     };

packages/libs/lib-server/src/system/settings/entity/sys-settings.ts

@@ -1,33 +1,33 @@
-import { Column, Entity, PrimaryGeneratedColumn } from 'typeorm';
+import { Column, Entity, PrimaryGeneratedColumn } from "typeorm";
 
 /**
  */
-@Entity('sys_settings')
+@Entity("sys_settings")
 export class SysSettingsEntity {
   @PrimaryGeneratedColumn()
   id: number;
-  @Column({ comment: 'key', length: 100 })
+  @Column({ comment: "key", length: 100 })
   key: string;
-  @Column({ comment: '名称', length: 100 })
+  @Column({ comment: "名称", length: 100 })
   title: string;
 
-  @Column({ name: 'setting', comment: '设置', length: 1024, nullable: true })
+  @Column({ name: "setting", comment: "设置", length: 1024, nullable: true })
   setting: string;
 
   // public 公开读，私有写， private 私有读，私有写
-  @Column({ name: 'access', comment: '访问权限' })
+  @Column({ name: "access", comment: "访问权限" })
   access: string;
 
   @Column({
-    name: 'create_time',
+    name: "create_time",
-    comment: '创建时间',
+    comment: "创建时间",
-    default: () => 'CURRENT_TIMESTAMP',
+    default: () => "CURRENT_TIMESTAMP",
   })
   createTime: Date;
   @Column({
-    name: 'update_time',
+    name: "update_time",
-    comment: '修改时间',
+    comment: "修改时间",
-    default: () => 'CURRENT_TIMESTAMP',
+    default: () => "CURRENT_TIMESTAMP",
   })
   updateTime: Date;
 }

packages/libs/lib-server/src/system/settings/service/models.ts

@@ -1,19 +1,19 @@
-import { cloneDeep } from 'lodash-es';
+import { cloneDeep } from "lodash-es";
 
 export class BaseSettings {
   static __key__: string;
   static __title__: string;
-  static __access__ = 'private';
+  static __access__ = "private";
 
   static getCacheKey() {
-    return 'settings.' + this.__key__;
+    return "settings." + this.__key__;
   }
 }
 
 export class SysPublicSettings extends BaseSettings {
-  static __key__ = 'sys.public';
+  static __key__ = "sys.public";
-  static __title__ = '系统公共设置';
+  static __title__ = "系统公共设置";
-  static __access__ = 'public';
+  static __access__ = "public";
 
   registerEnabled = false;
   userValidTimeEnabled?: boolean = false;
@@ -34,19 +34,15 @@ export class SysPublicSettings extends BaseSettings {
   aiChatEnabled = true;
   homePageEnabled = true;
 
-
   //验证码是否开启
   captchaEnabled = false;
   //验证码类型
   captchaType?: string;
   captchaAddonId?: number;
 
-
-
   //流水线是否启用有效期
   pipelineValidTimeEnabled?: boolean = false;
 
-
   //证书域名添加到监控
   certDomainAddToMonitorEnabled?: boolean = false;
 
@@ -60,12 +56,15 @@ export class SysPublicSettings extends BaseSettings {
 
   // 第三方OAuth配置
   oauthEnabled?: boolean = false;
-  oauthProviders: Record<string, {
+  oauthProviders: Record<
-    type: string;
+    string,
-    title: string;
+    {
-    addonId: number;
+      type: string;
-    icon?: string;
+      title: string;
-  }> = {};
+      addonId: number;
+      icon?: string;
+    }
+  > = {};
 
   notice?: string;
 
@@ -73,40 +72,37 @@ export class SysPublicSettings extends BaseSettings {
 }
 
 export class SysPrivateSettings extends BaseSettings {
-  static __title__ = '系统私有设置';
+  static __title__ = "系统私有设置";
-  static __access__ = 'private';
+  static __access__ = "private";
-  static __key__ = 'sys.private';
+  static __key__ = "sys.private";
   jwtKey?: string;
   encryptSecret?: string;
 
-  httpsProxy? = '';
+  httpsProxy? = "";
-  httpProxy? = '';
+  httpProxy? = "";
-  noProxy? = '';
+  noProxy? = "";
-  commonHeaders?: string = '';
+  commonHeaders?: string = "";
 
   reverseProxies?: Record<string, string> = {};
 
-  dnsResultOrder? = '';
+  dnsResultOrder? = "";
   commonCnameEnabled?: boolean = true;
 
   httpRequestTimeout?: number = 30;
 
   pipelineMaxRunningCount?: number;
 
-
+  environmentVars?: string = "";
-  environmentVars?: string = '';
-
 
   acmeWalkFromAuthoritative?: boolean = true;
 
-
   sms?: {
     type?: string;
     config?: any;
   } = {
-      type: 'aliyun',
+    type: "aliyun",
-      config: {},
+    config: {},
-    };
+  };
 
   removeSecret() {
     const clone = cloneDeep(this);
@@ -117,9 +113,9 @@ export class SysPrivateSettings extends BaseSettings {
 }
 
 export class SysInstallInfo extends BaseSettings {
-  static __title__ = '系统安装信息';
+  static __title__ = "系统安装信息";
-  static __key__ = 'sys.install';
+  static __key__ = "sys.install";
-  static __access__ = 'private';
+  static __access__ = "private";
   installTime?: number;
   siteId?: string;
   bindUserId?: number;
@@ -130,21 +126,20 @@ export class SysInstallInfo extends BaseSettings {
 }
 
 export class SysLicenseInfo extends BaseSettings {
-  static __title__ = '授权许可信息';
+  static __title__ = "授权许可信息";
-  static __key__ = 'sys.license';
+  static __key__ = "sys.license";
-  static __access__ = 'private';
+  static __access__ = "private";
   license?: string;
 }
 
-
 export type EmailTemplate = {
   addonId?: number;
-}
+};
 
 export class SysEmailConf extends BaseSettings {
-  static __title__ = '邮箱配置';
+  static __title__ = "邮箱配置";
-  static __key__ = 'sys.email';
+  static __key__ = "sys.email";
-  static __access__ = 'private';
+  static __access__ = "private";
 
   host: string;
   port: number;
@@ -160,18 +155,18 @@ export class SysEmailConf extends BaseSettings {
   sender: string;
   usePlus?: boolean;
 
-  templates:{
+  templates: {
-    registerCode?: EmailTemplate,
+    registerCode?: EmailTemplate;
-    forgotPassword?: EmailTemplate,
+    forgotPassword?: EmailTemplate;
-    pipelineResult?: EmailTemplate,
+    pipelineResult?: EmailTemplate;
-    common?: EmailTemplate,
+    common?: EmailTemplate;
-  }
+  };
 }
 
 export class SysSiteInfo extends BaseSettings {
-  static __title__ = '站点信息';
+  static __title__ = "站点信息";
-  static __key__ = 'sys.site';
+  static __key__ = "sys.site";
-  static __access__ = 'public';
+  static __access__ = "public";
   title?: string;
   slogan?: string;
   logo?: string;
@@ -179,9 +174,9 @@ export class SysSiteInfo extends BaseSettings {
 }
 
 export class SysSecretBackup extends BaseSettings {
-  static __title__ = '密钥信息备份';
+  static __title__ = "密钥信息备份";
-  static __key__ = 'sys.secret.backup';
+  static __key__ = "sys.secret.backup";
-  static __access__ = 'private';
+  static __access__ = "private";
   siteId?: string;
   encryptSecret?: string;
 }
@@ -190,9 +185,9 @@ export class SysSecretBackup extends BaseSettings {
  * 不要修改
  */
 export class SysSecret extends BaseSettings {
-  static __title__ = '密钥信息';
+  static __title__ = "密钥信息";
-  static __key__ = 'sys.secret';
+  static __key__ = "sys.secret";
-  static __access__ = 'private';
+  static __access__ = "private";
   siteId?: string;
   encryptSecret?: string;
 }
@@ -215,9 +210,9 @@ export type MenuItem = {
   children?: MenuItem[];
 };
 export class SysHeaderMenus extends BaseSettings {
-  static __title__ = '顶部菜单';
+  static __title__ = "顶部菜单";
-  static __key__ = 'sys.header.menus';
+  static __key__ = "sys.header.menus";
-  static __access__ = 'public';
+  static __access__ = "public";
 
   menus: MenuItem[];
 }
@@ -228,9 +223,9 @@ export type PaymentItem = {
 };
 
 export class SysPaymentSetting extends BaseSettings {
-  static __title__ = '支付设置';
+  static __title__ = "支付设置";
-  static __key__ = 'sys.payment';
+  static __key__ = "sys.payment";
-  static __access__ = 'private';
+  static __access__ = "private";
 
   yizhifu?: PaymentItem = { enabled: false };
 
@@ -240,9 +235,9 @@ export class SysPaymentSetting extends BaseSettings {
 }
 
 export class SysSuiteSetting extends BaseSettings {
-  static __title__ = '套餐设置';
+  static __title__ = "套餐设置";
-  static __key__ = 'sys.suite';
+  static __key__ = "sys.suite";
-  static __access__ = 'private';
+  static __access__ = "private";
 
   enabled: boolean = false;
 
@@ -257,26 +252,25 @@ export class SysSuiteSetting extends BaseSettings {
 }
 
 export class SysAutoFixSetting extends BaseSettings {
-  static __title__ = '自动修复记录';
+  static __title__ = "自动修复记录";
-  static __key__ = 'sys.auto.fix';
+  static __key__ = "sys.auto.fix";
-  static __access__ = 'private';
+  static __access__ = "private";
 
   fixed: Record<string, boolean> = {};
 }
 
-
 export type SiteHidden = {
   enabled: boolean;
   openPath?: string;
   //md5 hash 两次后保存
   openPassword?: string;
   autoHiddenTimes?: number;
-  hiddenOpenApi?: boolean
+  hiddenOpenApi?: boolean;
 };
 export class SysSafeSetting extends BaseSettings {
-  static __title__ = '站点安全设置';
+  static __title__ = "站点安全设置";
-  static __key__ = 'sys.safe';
+  static __key__ = "sys.safe";
-  static __access__ = 'private';
+  static __access__ = "private";
 
   // 站点隐藏
   hidden: SiteHidden = {

packages/libs/midway-flyway-js/CHANGELOG.md

@@ -3,6 +3,22 @@
 All notable changes to this project will be documented in this file.
 See [Conventional Commits](https://conventionalcommits.org) for commit guidelines.
 
+## [1.42.3](https://github.com/certd/certd/compare/v1.42.2...v1.42.3) (2026-07-08)
+
+**Note:** Version bump only for package @certd/midway-flyway-js
+
+## [1.42.2](https://github.com/certd/certd/compare/v1.42.1...v1.42.2) (2026-07-07)
+
+**Note:** Version bump only for package @certd/midway-flyway-js
+
+## [1.42.1](https://github.com/certd/certd/compare/v1.42.0...v1.42.1) (2026-07-06)
+
+**Note:** Version bump only for package @certd/midway-flyway-js
+
+# [1.42.0](https://github.com/certd/certd/compare/v1.41.4...v1.42.0) (2026-07-05)
+
+**Note:** Version bump only for package @certd/midway-flyway-js
+
 ## [1.41.4](https://github.com/certd/certd/compare/v1.41.3...v1.41.4) (2026-06-14)
 
 ### Bug Fixes

packages/libs/midway-flyway-js/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@certd/midway-flyway-js",
-  "version": "1.41.4",
+  "version": "1.42.3",
   "description": "midway with flyway, sql upgrade way ",
   "private": false,
   "type": "module",
@@ -52,5 +52,5 @@
     "typeorm": "^0.3.20",
     "typescript": "^5.4.2"
   },
-  "gitHead": "bc731e4fb119787930e816a7d57c808b1b5cd66a"
+  "gitHead": "7808d028e9c7e1b1e3ebc41f12b023d7b553300b"
 }

packages/plugins/plugin-cert/CHANGELOG.md

@@ -3,6 +3,22 @@
 All notable changes to this project will be documented in this file.
 See [Conventional Commits](https://conventionalcommits.org) for commit guidelines.
 
+## [1.42.3](https://github.com/certd/certd/compare/v1.42.2...v1.42.3) (2026-07-08)
+
+**Note:** Version bump only for package @certd/plugin-cert
+
+## [1.42.2](https://github.com/certd/certd/compare/v1.42.1...v1.42.2) (2026-07-07)
+
+**Note:** Version bump only for package @certd/plugin-cert
+
+## [1.42.1](https://github.com/certd/certd/compare/v1.42.0...v1.42.1) (2026-07-06)
+
+**Note:** Version bump only for package @certd/plugin-cert
+
+# [1.42.0](https://github.com/certd/certd/compare/v1.41.4...v1.42.0) (2026-07-05)
+
+**Note:** Version bump only for package @certd/plugin-cert
+
 ## [1.41.4](https://github.com/certd/certd/compare/v1.41.3...v1.41.4) (2026-06-14)
 
 **Note:** Version bump only for package @certd/plugin-cert

packages/plugins/plugin-cert/package.json

@@ -1,7 +1,7 @@
 {
   "name": "@certd/plugin-cert",
   "private": false,
-  "version": "1.41.4",
+  "version": "1.42.3",
   "type": "module",
   "main": "./dist/index.js",
   "types": "./dist/index.d.ts",
@@ -20,7 +20,7 @@
     "lint": "eslint --fix"
   },
   "dependencies": {
-    "@certd/plugin-lib": "^1.41.4"
+    "@certd/plugin-lib": "^1.42.3"
   },
   "devDependencies": {
     "@types/chai": "^4.3.12",
@@ -38,5 +38,5 @@
     "tslib": "^2.8.1",
     "typescript": "^5.4.2"
   },
-  "gitHead": "bc731e4fb119787930e816a7d57c808b1b5cd66a"
+  "gitHead": "7808d028e9c7e1b1e3ebc41f12b023d7b553300b"
 }

packages/plugins/plugin-lib/CHANGELOG.md

@@ -3,6 +3,35 @@
 All notable changes to this project will be documented in this file.
 See [Conventional Commits](https://conventionalcommits.org) for commit guidelines.
 
+## [1.42.3](https://github.com/certd/certd/compare/v1.42.2...v1.42.3) (2026-07-08)
+
+**Note:** Version bump only for package @certd/plugin-lib
+
+## [1.42.2](https://github.com/certd/certd/compare/v1.42.1...v1.42.2) (2026-07-07)
+
+**Note:** Version bump only for package @certd/plugin-lib
+
+## [1.42.1](https://github.com/certd/certd/compare/v1.42.0...v1.42.1) (2026-07-06)
+
+### Performance Improvements
+
+* **certd-server:** 使用 jks-go转换jks证书，大幅精简镜像大小 ([c78898e](https://github.com/certd/certd/commit/c78898e4c10dd1701467d2e42e3f72bd8f2a352f))
+
+# [1.42.0](https://github.com/certd/certd/compare/v1.41.4...v1.42.0) (2026-07-05)
+
+### Bug Fixes
+
+* 修复jdk证书格式的问题 ([260f5ae](https://github.com/certd/certd/commit/260f5ae777b83493b0c578fe30fd00ec0c873226))
+
+### Features
+
+* 通过插件配置懒加载依赖，动态加载第三方依赖包，精简安装镜像大小 ([01568ca](https://github.com/certd/certd/commit/01568ca1489069046b5a89ebdd4ced2f7f6ddf93))
+
+### Performance Improvements
+
+* 【破坏性更新】 证书压缩包不再生成文件存储，而是实时打包下载，证书申请插件不再输出certZip ([7cff1a9](https://github.com/certd/certd/commit/7cff1a98424120585205889874b3ef4956a30583))
+* 新增橙域网络(asia-isp) CDN证书部署插件 ([b48831e](https://github.com/certd/certd/commit/b48831e60b0059bef7ef9a34ab61c9dd2f684641))
+
 ## [1.41.4](https://github.com/certd/certd/compare/v1.41.3...v1.41.4) (2026-06-14)
 
 **Note:** Version bump only for package @certd/plugin-lib

packages/plugins/plugin-lib/package.json

@@ -1,7 +1,7 @@
 {
   "name": "@certd/plugin-lib",
   "private": false,
-  "version": "1.41.4",
+  "version": "1.42.3",
   "type": "module",
   "main": "./dist/index.js",
   "types": "./dist/index.d.ts",
@@ -17,9 +17,9 @@
     "lint": "eslint --fix"
   },
   "dependencies": {
-    "@certd/acme-client": "^1.41.4",
+    "@certd/acme-client": "^1.42.3",
-    "@certd/basic": "^1.41.4",
+    "@certd/basic": "^1.42.3",
-    "@certd/pipeline": "^1.41.4",
+    "@certd/pipeline": "^1.42.3",
     "dayjs": "^1.11.7",
     "jszip": "^3.10.1",
     "lodash-es": "^4.17.21",
@@ -27,7 +27,6 @@
     "punycode.js": "^2.3.1"
   },
   "devDependencies": {
-    "rimraf": "^5.0.5",
     "@types/chai": "^4.3.12",
     "@types/mocha": "^10.0.6",
     "@typescript-eslint/eslint-plugin": "^8.26.1",
@@ -41,9 +40,10 @@
     "mocha": "^10.6.0",
     "node-forge": "^1.3.1",
     "prettier": "3.3.3",
+    "rimraf": "^5.0.5",
     "ts-node": "^10.9.2",
     "tslib": "^2.8.1",
     "typescript": "^5.4.2"
   },
-  "gitHead": "bc731e4fb119787930e816a7d57c808b1b5cd66a"
+  "gitHead": "7808d028e9c7e1b1e3ebc41f12b023d7b553300b"
 }

packages/plugins/plugin-lib/src/cert/convert.ts

@@ -1,4 +1,4 @@
-import { ILogger, sp } from "@certd/basic";
+import { ILogger, sp, http } from "@certd/basic";
 import type { CertInfo } from "./cert-reader.js";
 import { CertReader, CertReaderHandleContext } from "./cert-reader.js";
 import path from "path";
@@ -52,6 +52,81 @@ export class CertConverter {
     });
   }
 
+  async getJksGoPath(): Promise<string> {
+    const osType = process.platform === "win32" ? "windows" : "linux";
+    const jksGoDir = path.resolve("./tools/jks-go");
+    const JKS_GO_VERSION = process.env.JKS_GO_VERSION || "1.0.0";
+
+    const versionFile = path.join(jksGoDir, "version");
+    const finalPath = path.join(jksGoDir, osType === "windows" ? "jks-go.exe" : "jks-go");
+
+    let needDownload = false;
+    if (!fs.existsSync(finalPath)) {
+      needDownload = true;
+    } else if (!fs.existsSync(versionFile)) {
+      needDownload = true;
+    } else {
+      const currentVersion = fs.readFileSync(versionFile, "utf-8").trim();
+      if (currentVersion !== JKS_GO_VERSION) {
+        this.logger.info(`jks-go版本不匹配,当前版本:${currentVersion},期望版本:${JKS_GO_VERSION},准备重新下载`);
+        needDownload = true;
+      }
+    }
+
+    if (!needDownload) {
+      return finalPath;
+    }
+
+    if (!fs.existsSync(jksGoDir)) {
+      fs.mkdirSync(jksGoDir, { recursive: true });
+    }
+
+    const arch = process.arch;
+    let platformArch = "amd64";
+    if (arch === "arm64") {
+      platformArch = "arm64";
+    } else if (arch === "arm") {
+      platformArch = "arm_armv7";
+    }
+
+    let jksGoFileName = `jks-go_${osType}_${platformArch}`;
+    if (osType === "windows") {
+      jksGoFileName += ".exe";
+    }
+
+    const jksGoFilePath = path.join(jksGoDir, jksGoFileName);
+    this.logger.info(`jks-go文件不存在或版本不匹配,准备下载:${jksGoFileName}`);
+    const downloadUrl = `https://atomgit.com/certd/jks-go/releases/download/v${JKS_GO_VERSION}/${jksGoFileName}`;
+    // https://atomgit.com/certd/jks-go/releases/download/v1.0.2/jks-go_linux_amd64
+    const response = await http.request({
+      url: downloadUrl,
+      method: "GET",
+      responseType: "arraybuffer",
+      logRes: false,
+      logParams: false,
+      logData: false,
+    });
+
+    const buffer = Buffer.from(response);
+    fs.writeFileSync(jksGoFilePath, buffer);
+    this.logger.info("下载jks-go成功");
+
+    if (fs.existsSync(finalPath)) {
+      fs.unlinkSync(finalPath);
+    }
+    fs.copyFileSync(jksGoFilePath, finalPath);
+    if (osType === "linux") {
+      await sp.spawn({
+        cmd: `chmod +x ${finalPath}`,
+      });
+    }
+
+    fs.writeFileSync(versionFile, JKS_GO_VERSION, "utf-8");
+    this.logger.info(`jks-go版本已更新为:${JKS_GO_VERSION}`);
+
+    return finalPath;
+  }
+
   private async convertPfx(opts: CertReaderHandleContext, pfxPassword: string, pfxArgs: string) {
     const { tmpCrtPath, tmpKeyPath } = opts;
 
@@ -118,22 +193,22 @@ export class CertConverter {
     const jksPassword = pfxPassword || "123456";
     try {
       const randomStr = Math.floor(Math.random() * 1000000) + "";
+      const { tmpOnePath } = opts;
 
-      const p12Path = path.join(os.tmpdir(), "/certd/tmp/", randomStr + `_cert.p12`);
+      const bundlePath = path.join(os.tmpdir(), "/certd/tmp/", randomStr + `_bundle.pem`);
-      const { tmpCrtPath, tmpKeyPath } = opts;
+      const dir = path.dirname(bundlePath);
-      let passwordArg = "-passout pass:";
-      if (jksPassword) {
-        passwordArg = `-password pass:${jksPassword}`;
-      }
-      await this.exec(`openssl pkcs12 -export -in ${tmpCrtPath} -inkey ${tmpKeyPath} -out ${p12Path} -name certd ${passwordArg}`);
-
-      const jksPath = path.join(os.tmpdir(), "/certd/tmp/", randomStr + `_cert.jks`);
-      const dir = path.dirname(jksPath);
       if (!fs.existsSync(dir)) {
         fs.mkdirSync(dir, { recursive: true });
       }
-      await this.exec(`keytool -importkeystore -srckeystore ${p12Path} -srcstoretype PKCS12 -srcstorepass "${jksPassword}" -destkeystore ${jksPath} -deststoretype JKS -deststorepass "${jksPassword}" `);
+
-      fs.unlinkSync(p12Path);
+      const crtContent = fs.readFileSync(tmpOnePath);
+      fs.writeFileSync(bundlePath, crtContent);
+
+      const jksPath = path.join(os.tmpdir(), "/certd/tmp/", randomStr + `_cert.jks`);
+
+      const jksGoPath = await this.getJksGoPath();
+      await this.exec(`${jksGoPath} -importkeystore -srckeystore ${bundlePath} -srcstoretype PEM -destkeystore ${jksPath} -deststorepass "${jksPassword}"`);
+      fs.unlinkSync(bundlePath);
 
       const fileBuffer = fs.readFileSync(jksPath);
       const certBase64 = fileBuffer.toString("base64");

packages/ui/Dockerfile

@@ -18,11 +18,14 @@ COPY . /workspace/
 RUN npm install -g pnpm@10.33.4
 
 RUN cp /workspace/certd-client/dist/* /workspace/certd-server/public/ -rf
-RUN cd /workspace/certd-server && pnpm install --production && npm run build-on-docker
+RUN cd /workspace/certd-server && pnpm install && npm run build-on-docker
-
+RUN rm -rf /workspace/certd-server/node_modules
 
 ARG base_type=alpine
 
+# ------------------------------------------------------------------
+# 构建生产环境镜像
+# ------------------------------------------------------------------
 FROM base-${TARGETARCH}${TARGETVARIANT:+-}${TARGETVARIANT}-${base_type}
 EXPOSE 7001
 EXPOSE 7002
@@ -35,21 +38,16 @@ RUN if [ -f /etc/debian_version ]; then \
         apt-get update \
         && apt-get install -y --no-install-recommends \
             ca-certificates \
-            gnupg \
             wget \
             openssl \
             netcat-openbsd \
             iputils-ping \
             dnsutils \
             iproute2 \
-        && wget -O - https://packages.adoptium.net/artifactory/api/gpg/key/public | gpg --dearmor | tee /usr/share/keyrings/adoptium.gpg > /dev/null \
-        && echo "deb [signed-by=/usr/share/keyrings/adoptium.gpg] https://packages.adoptium.net/artifactory/deb bookworm main" | tee /etc/apt/sources.list.d/adoptium.list \
-        && apt-get update \
-        && apt-get install -y --no-install-recommends temurin-8-jre \
         && apt-get clean \
         && rm -rf /var/lib/apt/lists/*; \
     elif [ -f /etc/alpine-release ]; then \
-        apk add --no-cache openssl openjdk8-jre; \
+        apk add --no-cache openssl wget ca-certificates; \
     else \
         echo "Unsupported base image"; exit 1; \
     fi
@@ -60,6 +58,9 @@ ENV TERM=xterm
 ENV LEGO_VERSION=4.30.1
 ENV LEGO_DOWNLOAD_DIR=/app/tools/lego
 
+ENV JKS_GO_VERSION=1.0.3
+ENV JKS_GO_DOWNLOAD_DIR=/app/tools/jks-go
+
 ENV ALIYUN_CLIENT_CONNECT_TIMEOUT=10000
 ENV ALIYUN_CLIENT_READ_TIMEOUT=20000
 
@@ -76,6 +77,26 @@ RUN ARCH=$(uname -m) && \
         echo "Unsupported architecture: $ARCH"; \
     fi
 
+RUN mkdir -p $JKS_GO_DOWNLOAD_DIR
+
+# 根据架构下载jks-go
+RUN ARCH=$(uname -m) && \
+    if [ "$ARCH" = "x86_64" ]; then \
+        wget -O $JKS_GO_DOWNLOAD_DIR/jks-go_linux_amd64 https://github.com/certd/jks-go/releases/download/v${JKS_GO_VERSION}/jks-go_linux_amd64 && \
+        chmod +x $JKS_GO_DOWNLOAD_DIR/jks-go_linux_amd64 && \
+        ln -s $JKS_GO_DOWNLOAD_DIR/jks-go_linux_amd64 /usr/local/bin/jks-go; \
+    elif [ "$ARCH" = "aarch64" ]; then \
+        wget -O $JKS_GO_DOWNLOAD_DIR/jks-go_linux_arm64 https://github.com/certd/jks-go/releases/download/v${JKS_GO_VERSION}/jks-go_linux_arm64 && \
+        chmod +x $JKS_GO_DOWNLOAD_DIR/jks-go_linux_arm64 && \
+        ln -s $JKS_GO_DOWNLOAD_DIR/jks-go_linux_arm64 /usr/local/bin/jks-go; \
+    elif [ "$ARCH" = "armv7l" ]; then \
+        wget -O $JKS_GO_DOWNLOAD_DIR/jks-go_linux_arm_armv7 https://github.com/certd/jks-go/releases/download/v${JKS_GO_VERSION}/jks-go_linux_arm_armv7 && \
+        chmod +x $JKS_GO_DOWNLOAD_DIR/jks-go_linux_arm_armv7 && \
+        ln -s $JKS_GO_DOWNLOAD_DIR/jks-go_linux_arm_armv7 /usr/local/bin/jks-go; \
+    else \
+        echo "Unsupported architecture: $ARCH"; \
+    fi
+
 ENV TZ=Asia/Shanghai
 ENV NODE_ENV=production
 ENV MIDWAY_SERVER_ENV=production
@@ -84,5 +105,6 @@ RUN npm install -g pnpm@10.33.4
 
 
 COPY --from=builder /workspace/certd-server/ /app/
+RUN pnpm install --production
 COPY ./patch/ssh2/*.js /app/node_modules/.pnpm/node_modules/ssh2/lib/protocol/
 CMD ["node", "--optimize-for-size", "./bootstrap.js"]

packages/ui/certd-client/CHANGELOG.md

@@ -3,6 +3,35 @@
 All notable changes to this project will be documented in this file.
 See [Conventional Commits](https://conventionalcommits.org) for commit guidelines.
 
+## [1.42.3](https://github.com/certd/certd/compare/v1.42.2...v1.42.3) (2026-07-08)
+
+**Note:** Version bump only for package @certd/ui-client
+
+## [1.42.2](https://github.com/certd/certd/compare/v1.42.1...v1.42.2) (2026-07-07)
+
+### Bug Fixes
+
+* 修复企业模式下弹出邮箱绑定提醒的问题 ([8d9dad9](https://github.com/certd/certd/commit/8d9dad9c82f6f2fd3ab3040068946a33f37145b1))
+
+## [1.42.1](https://github.com/certd/certd/compare/v1.42.0...v1.42.1) (2026-07-06)
+
+### Bug Fixes
+
+* **login:** 修复输入法 composing 状态下回车触发提交的问题 ([b74db81](https://github.com/certd/certd/commit/b74db81304bbe68476bbec5ea4307a2264060e92))
+
+### Performance Improvements
+
+* **pipeline:** 将默认历史保留条数从30调整为100 ([d3e4677](https://github.com/certd/certd/commit/d3e4677ea4fac8e7533749d7f4187e410489e536))
+
+# [1.42.0](https://github.com/certd/certd/compare/v1.41.4...v1.42.0) (2026-07-05)
+
+### Performance Improvements
+
+* 【破坏性更新】 证书压缩包不再生成文件存储，而是实时打包下载，证书申请插件不再输出certZip ([7cff1a9](https://github.com/certd/certd/commit/7cff1a98424120585205889874b3ef4956a30583))
+* 优化用户体验，首次访问时弹出邮箱账号绑定用以初始化账号 ([608cc2a](https://github.com/certd/certd/commit/608cc2a81ff0b4872c9fe11ed9c9c0b4b90a12a3))
+* **passkey:** passkey支持多域名rpid ([79f6586](https://github.com/certd/certd/commit/79f65868ca0f5162bbc2f935ce89abc28011d816))
+* **plugin:** 在线插件编辑支持配置第三方依赖和插件依赖 ([635f069](https://github.com/certd/certd/commit/635f069012d4193cfb7cb051c96e28eec1247ca2))
+
 ## [1.41.4](https://github.com/certd/certd/compare/v1.41.3...v1.41.4) (2026-06-14)
 
 ### Bug Fixes

packages/ui/certd-client/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@certd/ui-client",
-  "version": "1.41.4",
+  "version": "1.42.3",
   "private": true,
   "scripts": {
     "dev": "vite --open",
@@ -105,8 +105,8 @@
     "zod-defaults": "^0.1.3"
   },
   "devDependencies": {
-    "@certd/lib-iframe": "^1.41.4",
+    "@certd/lib-iframe": "^1.42.3",
-    "@certd/pipeline": "^1.41.4",
+    "@certd/pipeline": "^1.42.3",
     "@rollup/plugin-commonjs": "^25.0.7",
     "@rollup/plugin-node-resolve": "^15.2.3",
     "@types/chai": "^4.3.12",

packages/ui/certd-client/src/locales/langs/en-US/certd/sys-plugin.ts

@@ -26,9 +26,10 @@ export default {
   store: "Store",
   version: "Version",
   pluginDependencies: "Plugin Dependencies",
-  pluginDependenciesHelper: "Format: [author/]pluginName[:version]. Required plugins must be installed first",
+  pluginDependenciesHelper:
+    "Format: pluginType:pluginName, use * for version\nSupported: plugin:name, access:name, notification:name, dnsProvider:name, addon:subtype:name\nExample: access:AliyunAccess, plugin:DeployToAliyunCDN",
   thirdPartyDependencies: "Third-party Dependencies",
-  thirdPartyDependenciesHelper: "Format: npmPackageName: version. Auto-installed at runtime",
+  thirdPartyDependenciesHelper: "Format: npmPackageName: version. Auto-installed at runtime\nExample: aliyun-sdk: ^1.0.0",
   editableRunStrategy: "Editable Run Strategy",
   editable: "Editable",
   notEditable: "Not Editable",

packages/ui/certd-client/src/locales/langs/zh-CN/certd/common.ts

@@ -70,7 +70,7 @@ export default {
   confirmToggleStatus: "确定要{action}吗？",
   batchDelete: "批量删除",
   sourcee: "来源",
-  clickToToggle: "点击切换启用/禁用",
+  clickToToggle: "点击启用/禁用",
   nickName: "昵称",
   avatar: "头像",
   expires: "过期",

packages/ui/certd-client/src/locales/langs/zh-CN/certd/sys-plugin.ts

@@ -26,9 +26,9 @@ export default {
   store: "市场",
   version: "版本",
   pluginDependencies: "插件依赖",
-  pluginDependenciesHelper: "格式: [作者/]插件名[:版本]，需先安装依赖插件",
+  pluginDependenciesHelper: "格式: 插件类型:插件名，版本号填 *\n支持: plugin:name、access:name、notification:name、dnsProvider:name、addon:subtype:name\n示例: access:AliyunAccess, plugin:DeployToAliyunCDN",
   thirdPartyDependencies: "第三方依赖",
-  thirdPartyDependenciesHelper: "格式: npm包名: 版本号，运行时自动安装",
+  thirdPartyDependenciesHelper: "格式: npm包名: 版本号，运行时自动安装\n示例: aliyun-sdk: ^1.0.0",
   editableRunStrategy: "可编辑运行策略",
   editable: "可编辑",
   notEditable: "不可编辑",

packages/ui/certd-client/src/use/use-dialog.ts

@@ -31,6 +31,13 @@ export function useFormDialog() {
         crudOptions: {
           columns: req.columns,
           form: {
+            labelCol: {
+              // @ts-ignore
+              span: null,
+              style: {
+                width: "100px",
+              },
+            },
             initialForm: req.initialForm,
             wrapper: warpper,
             async afterSubmit() {},
@@ -44,7 +51,7 @@ export function useFormDialog() {
       };
     }
     const { crudOptions } = createCrudOptions();
-    await openCrudFormDialog({ crudOptions });
+    return await openCrudFormDialog({ crudOptions });
   }
   return {
     openFormDialog,

packages/ui/certd-client/src/vben/common-ui/ui/authentication/login.vue

@@ -73,6 +73,14 @@ async function handleSubmit() {
   }
 }
 
+function handleKeydownEnter(e: KeyboardEvent) {
+  if (e.isComposing) {
+    return;
+  }
+  e.preventDefault();
+  handleSubmit();
+}
+
 function handleGo(path: string) {
   router.push(path);
 }
@@ -89,7 +97,7 @@ defineExpose({
 </script>
 
 <template>
-  <div @keydown.enter.prevent="handleSubmit">
+  <div @keydown.enter="handleKeydownEnter">
     <slot name="title">
       <Title>
         <slot name="title">

packages/ui/certd-client/src/views/certd/access/access-selector/index.vue

@@ -16,8 +16,8 @@
   </div>
 </template>
 
-<script>
+<script lang="ts">
-import { defineComponent, reactive, ref, watch, inject } from "vue";
+import { defineComponent, reactive, ref, watch, inject, onMounted } from "vue";
 import CertAccessModal from "./access/index.vue";
 import { createAccessApi } from "../api";
 import { message } from "ant-design-vue";
@@ -55,6 +55,10 @@ export default defineComponent({
       type: Boolean,
       default: false,
     },
+    defaultSelect: {
+      type: Boolean,
+      default: false,
+    },
   },
   emits: ["update:modelValue", "change", "selectedChange"],
   setup(props, ctx) {
@@ -158,12 +162,43 @@ export default defineComponent({
       },
     });
 
+    async function selectFirst(clearCurrent = false) {
+      if (!clearCurrent && props.modelValue) {
+        return;
+      }
+      const searchForm = projectStore.getSearchForm();
+      const query: any = {
+        query: {
+          type: props.type,
+          ...searchForm,
+        },
+        page: { page: 1, pageSize: 1 },
+        sort: { prop: "id", order: "ascending" },
+      };
+      if (props.subtype) {
+        query.query.subtype = props.subtype;
+      }
+      const res = await api.GetList(query);
+      const records = res?.records || [];
+      if (records.length > 0) {
+        await emitValue(records[0].id);
+      }
+    }
+
+    onMounted(async () => {
+      if (!props.defaultSelect) {
+        return;
+      }
+      await selectFirst();
+    });
+
     return {
       clear,
       target,
       selectedId,
       providerDefine,
       chooseForm,
+      selectFirst,
     };
   },
 });

packages/ui/certd-client/src/views/certd/mine/change-password-button.vue

@@ -18,6 +18,10 @@ defineProps<{
   showButton: boolean;
 }>();
 
+const emit = defineEmits<{
+  (e: "close"): void;
+}>();
+
 let passwordFormRef = ref();
 
 type OpenOptions = {
@@ -68,8 +72,8 @@ const passwordFormOptions: CrudOptions = {
     },
     async afterSubmit() {
       const formData = passwordFormRef.value?.getFormData?.();
-      const message = formData?.init ? t("authentication.initPasswordSuccessMessage") : t("authentication.successMessage");
+      const msg = formData?.init ? t("authentication.initPasswordSuccessMessage") : t("authentication.successMessage");
-      notification.success({ message });
+      notification.success({ message: msg });
     },
   },
   columns: {
@@ -84,6 +88,7 @@ const passwordFormOptions: CrudOptions = {
       title: t("authentication.oldPassword"),
       type: "password",
       form: {
+        //@ts-ignore
         show: compute(({ form }) => form.init !== true),
         rules: [{ required: true, message: t("authentication.oldPasswordRequired") }],
       },
@@ -118,16 +123,18 @@ const passwordFormOptions: CrudOptions = {
 
 async function open(opts: OpenOptions = {}) {
   const formOptions = buildFormOptions(passwordFormOptions);
-  formOptions.newInstance = true; //新实例打开
+  formOptions.newInstance = true;
   if (opts.init) {
     formOptions.wrapper.title = t("authentication.initPasswordTitle");
   }
+  formOptions.wrapper.onClosed = () => {
+    emit("close");
+  };
   passwordFormRef.value = await openDialog(formOptions);
   passwordFormRef.value.setFormData({
     init: opts.init === true,
     password: opts.password || "",
   });
-  console.log(passwordFormRef.value);
 }
 
 const scope = ref({

packages/ui/certd-client/src/views/certd/mine/user-profile.vue

@@ -107,6 +107,10 @@
                 <div class="passkey-info">
                   <div class="passkey-name">{{ passkey.deviceName }}</div>
                   <div class="passkey-meta flex items-center">
+                    <span class="meta-item flex items-center">
+                      <fs-icon icon="ion:globe-outline" class="meta-icon" />
+                      {{ passkey.rpId || "-" }}
+                    </span>
                     <span class="meta-item flex items-center">
                       <fs-icon icon="ion:calendar-outline" class="meta-icon" />
                       {{ formatDate(passkey.registeredAt) }}
@@ -454,6 +458,8 @@ onMounted(async () => {
     }
 
     .card-header {
+      background: linear-gradient(145deg, #1e1e1e, #252525);
+
       .header-bg-gradient {
         background: rgba(255, 255, 255, 0.04);
         opacity: 1;
@@ -472,6 +478,7 @@ onMounted(async () => {
 
       .detail-tag {
         background: #3b3b3b;
+        border-color: rgba(255, 255, 255, 0.12);
         color: #e5e5e5;
 
         .tag-icon {
@@ -480,6 +487,23 @@ onMounted(async () => {
       }
     }
 
+    .card-title {
+      border-bottom-color: rgba(255, 255, 255, 0.1);
+    }
+
+    .binding-icon {
+      background: linear-gradient(135deg, rgba(102, 126, 234, 0.22) 0%, rgba(160, 120, 234, 0.22) 100%);
+    }
+
+    .passkey-icon {
+      background: linear-gradient(135deg, rgba(17, 153, 142, 0.22) 0%, rgba(56, 239, 125, 0.22) 100%);
+    }
+
+    .binding-icon .icon,
+    .passkey-icon .icon {
+      color: rgba(255, 255, 255, 0.7);
+    }
+
     .bindings-list {
       .binding-item {
         background: #2d2d2d;

packages/ui/certd-client/src/views/certd/pipeline/cert-upload/use.tsx

@@ -207,7 +207,7 @@ export function useCertUpload() {
               const { id } = await api.Save({
                 title: pipeline.title,
                 content: JSON.stringify(pipeline),
-                keepHistoryCount: 30,
+                keepHistoryCount: 100,
                 type: "cert_upload",
                 groupId: form.groupId,
               });

packages/ui/certd-client/src/views/certd/pipeline/certd-form/use.tsx

@@ -605,7 +605,7 @@ export function useCertPipelineCreator({ formWrapperRef }: { formWrapperRef: Ref
       const { id } = await api.Save({
         title: pipeline.title,
         content: JSON.stringify(pipeline),
-        keepHistoryCount: 30,
+        keepHistoryCount: 100,
         type: "cert",
         groupId,
         addToMonitorEnabled: form.addToMonitorEnabled,

packages/ui/certd-client/src/views/certd/pipeline/template/use.tsx

@@ -160,7 +160,7 @@ export async function createPipelineByTemplate(opts: { templateId: number; title
   return await templateApi.CreatePipelineByTemplate({
     title,
     content: JSON.stringify(pipeline),
-    keepHistoryCount: keepHistoryCount ?? 30,
+    keepHistoryCount: keepHistoryCount ?? 100,
     groupId,
     templateId,
   });

packages/ui/certd-client/src/views/framework/home/index.vue

@@ -2,22 +2,116 @@
   <fs-page class="home—index bg-neutral-100 dark:bg-black">
     <!--    <page-content />-->
     <dashboard-user />
-    <change-password-button ref="changePasswordButtonRef" :show-button="false"></change-password-button>
+    <change-password-button ref="changePasswordButtonRef" :show-button="false" @close="checkAndSetupAccount"></change-password-button>
   </fs-page>
 </template>
 
-<script lang="ts" setup>
+<script lang="tsx" setup>
 import DashboardUser from "./dashboard/index.vue";
 import { useUserStore } from "/@/store/user";
 import ChangePasswordButton from "/@/views/certd/mine/change-password-button.vue";
 import { onMounted, ref } from "vue";
-import { Modal } from "ant-design-vue";
+import { Modal, notification } from "ant-design-vue";
 import { useI18n } from "/src/locales";
+import { request } from "/@/api/service";
+import { useFormDialog } from "/@/use/use-dialog";
+import { useSettingStore } from "/@/store/settings/index.jsx";
 
 const { t } = useI18n();
+const { openFormDialog } = useFormDialog();
 
 const userStore = useUserStore();
+const settingStore = useSettingStore();
+
 const changePasswordButtonRef = ref();
+const emailFormWrapperRef = ref<any>();
+
+const validateEmailConfirm = async (_rule: any, value: string) => {
+  if (!value) {
+    return;
+  }
+  const formData = emailFormWrapperRef.value?.getFormData?.();
+  if (formData && value !== formData.email) {
+    throw new Error("两次输入的邮箱地址不一致");
+  }
+};
+
+async function checkAndSetupAccount() {
+  if (settingStore.isEnterprise) {
+    return;
+  }
+  try {
+    const userInfo = userStore.getUserInfo as any;
+    if (!userInfo.needInitAccount) {
+      return;
+    }
+
+    if (userInfo.email) {
+      await request({
+        url: "/mine/accountInit",
+        method: "post",
+      });
+      return;
+    }
+
+    emailFormWrapperRef.value = await openFormDialog({
+      title: "绑定邮箱",
+      wrapper: {
+        width: 560,
+      },
+      initialForm: { email: "", emailConfirm: "" },
+      async onSubmit(form: any) {
+        await request({
+          url: "/mine/accountInit",
+          method: "post",
+          data: { email: form.email },
+        });
+        notification.success({
+          message: "邮箱绑定成功",
+        });
+      },
+      body: () => {
+        return <a-alert class="mb-4" message="为保证用户体验，请先绑定邮箱，初始化您的账号" type="success" show-icon></a-alert>;
+      },
+      columns: {
+        email: {
+          title: "邮箱",
+          type: "text",
+          form: {
+            col: { span: 24 },
+            component: {
+              placeholder: "请输入邮箱地址",
+            },
+            helper: "请输入您的邮箱",
+            rules: [
+              { required: true, message: "请输入邮箱地址" },
+              { type: "email", message: "请输入有效的邮箱地址" },
+            ],
+          },
+        },
+        emailConfirm: {
+          title: "确认邮箱",
+          type: "text",
+          form: {
+            col: { span: 24 },
+            component: {
+              placeholder: "请再次输入邮箱地址",
+            },
+            helper: "请再次输入邮箱，以确认邮箱地址无误",
+            rules: [
+              { required: true, message: "请再次输入邮箱地址" },
+              { type: "email", message: "请输入有效的邮箱地址" },
+              { validator: validateEmailConfirm, trigger: "blur" },
+            ],
+          },
+        },
+      },
+    });
+  } catch (e) {
+    console.error("AcmeAccount setup failed:", e);
+  }
+}
+
 onMounted(() => {
   if (userStore.getUserInfo.isWeak === true) {
     Modal.info({
@@ -30,6 +124,9 @@ onMounted(() => {
       },
       okText: t("authentication.changeNow"),
     });
+  } else {
+    //两个弹框不要同时出现
+    checkAndSetupAccount();
   }
 });
 </script>

packages/ui/certd-client/src/views/sys/plugin/crud.tsx

@@ -450,7 +450,7 @@ export default function ({ crudExpose, context }: CreateCrudOptionsProps): Creat
           },
         },
         disabled: {
-          title: t("certd.enableDisable"),
+          title: t("certd.clickToToggle"),
           type: "dict-switch",
           dict: dict({
             data: [

packages/ui/certd-server/.env

@@ -1,2 +1,3 @@
 LEGO_VERSION=4.30.1
+JKS_GO_VERSION=1.0.3
 certd_plugin_loadmode=dev

packages/ui/certd-server/.gitignore

@@ -20,6 +20,7 @@ run/
 
 .env.pgpl.yaml
 tools/lego/*
+tools/jks-go
 !tools/lego/readme.md
 test.mjs
 isolate-*.log

packages/ui/certd-server/CHANGELOG.md

@@ -3,6 +3,57 @@
 All notable changes to this project will be documented in this file.
 See [Conventional Commits](https://conventionalcommits.org) for commit guidelines.
 
+## [1.42.3](https://github.com/certd/certd/compare/v1.42.2...v1.42.3) (2026-07-08)
+
+### Bug Fixes
+
+* **volcengine-alb:** 修复火山引擎ALB 默认证书部署类型会部署到扩展证书的问题 ([0a068a2](https://github.com/certd/certd/commit/0a068a274673e9768954e9f7367c267d44f3b530))
+
+## [1.42.2](https://github.com/certd/certd/compare/v1.42.1...v1.42.2) (2026-07-07)
+
+### Bug Fixes
+
+* 修复火山视频点播源站选择不到自定义源站的bug ([0071bcb](https://github.com/certd/certd/commit/0071bcb0e4dd108c86d7ca01820a9f6e6960e440))
+* 修复企业模式下弹出邮箱绑定提醒的问题 ([8d9dad9](https://github.com/certd/certd/commit/8d9dad9c82f6f2fd3ab3040068946a33f37145b1))
+* 修复AsiaIsp CDN证书重复情况下部署失败的问题 ([c3d6db3](https://github.com/certd/certd/commit/c3d6db3f1ef2f1c897b7989521fe8809dffaded1))
+* 修复cname用阿里云校验时报找不到runtimeDepsService的错误 ([072edd7](https://github.com/certd/certd/commit/072edd7affee424ab3411f4d41d338f084d7cac6))
+
+## [1.42.1](https://github.com/certd/certd/compare/v1.42.0...v1.42.1) (2026-07-06)
+
+### Bug Fixes
+
+* 修复多域名无法使用passkey登录的bug ([d176f9c](https://github.com/certd/certd/commit/d176f9cc0ebd051a614bfac74d1616d1945fc9a3))
+* 修复企业模式下登录报projectId不能为空的问题 ([a65366b](https://github.com/certd/certd/commit/a65366bbe1aadea8baaffbdadab58a5b631d9417))
+
+### Performance Improvements
+
+* **certd-server:** 使用 jks-go转换jks证书，大幅精简镜像大小 ([c78898e](https://github.com/certd/certd/commit/c78898e4c10dd1701467d2e42e3f72bd8f2a352f))
+* **pipeline:** 将默认历史保留条数从30调整为100 ([d3e4677](https://github.com/certd/certd/commit/d3e4677ea4fac8e7533749d7f4187e410489e536))
+
+# [1.42.0](https://github.com/certd/certd/compare/v1.41.4...v1.42.0) (2026-07-05)
+
+### Bug Fixes
+
+* 修复telegram - 符号转义问题 ([d5882f1](https://github.com/certd/certd/commit/d5882f16bedb09baf09ace92049b02872620f5dc))
+* **aliyun:** 修复阿里云CDN/DCDN根据证书自动匹配不到证书的bug ([1ae185d](https://github.com/certd/certd/commit/1ae185d0bc356f4678bc38ca0582ce3396f82ebe))
+
+### Features
+
+* 通过插件配置懒加载依赖，动态加载第三方依赖包，精简安装镜像大小 ([01568ca](https://github.com/certd/certd/commit/01568ca1489069046b5a89ebdd4ced2f7f6ddf93))
+
+### Performance Improvements
+
+*  阿里云ESA证书部署支持SaaS模式 ([82276b5](https://github.com/certd/certd/commit/82276b53a8474a18a3d0237050907c994fc748f0))
+* 【破坏性更新】 证书压缩包不再生成文件存储，而是实时打包下载，证书申请插件不再输出certZip ([7cff1a9](https://github.com/certd/certd/commit/7cff1a98424120585205889874b3ef4956a30583))
+* 火山引擎点播插件支持部署到自定义源站域名 ([095791c](https://github.com/certd/certd/commit/095791cdc2b7c1f4b913b634643afec5e30fe9b0))
+* 新增橙域网络(asia-isp) CDN证书部署插件 ([b48831e](https://github.com/certd/certd/commit/b48831e60b0059bef7ef9a34ab61c9dd2f684641))
+* 优化阿里云API网关增加翻页查询 ([ed58ae3](https://github.com/certd/certd/commit/ed58ae3c5339e4a0238a92acfe7ea6d2f566ea28))
+* 优化用户体验，首次访问时弹出邮箱账号绑定用以初始化账号 ([608cc2a](https://github.com/certd/certd/commit/608cc2a81ff0b4872c9fe11ed9c9c0b4b90a12a3))
+* 优化ACME账号字段的选择提示 ([bfd3cac](https://github.com/certd/certd/commit/bfd3cacc687fc5cbc3cb2ca3cadbc140de300dc2))
+* 支持全自动匹配部署宝塔网站证书 ([4dff48e](https://github.com/certd/certd/commit/4dff48e807c32a7623ec9206cf39c88e88f89f6a))
+* **cert-plugin:** 调整更新天数自动减半逻辑，仅7天ip证书生效，其他情况下不减半 ([56e5524](https://github.com/certd/certd/commit/56e5524a0f4af3645d70bc3b3ec750b45ba8de10))
+* **passkey:** passkey支持多域名rpid ([79f6586](https://github.com/certd/certd/commit/79f65868ca0f5162bbc2f935ce89abc28011d816))
+
 ## [1.41.4](https://github.com/certd/certd/compare/v1.41.3...v1.41.4) (2026-06-14)
 
 ### Bug Fixes

packages/ui/certd-server/db/migration-mysql/v10050__passkey_rp.sql

@@ -0,0 +1,6 @@
+
+ALTER TABLE `sys_passkey` ADD COLUMN `rp_id` varchar(256) NULL;
+
+DROP INDEX `index_passkey_passkey_id` ON `sys_passkey`;
+
+ALTER TABLE `sys_passkey` ADD UNIQUE INDEX `index_passkey_passkey_id` (`passkey_id`);

packages/ui/certd-server/db/migration-pg/v10050__passkey_rp.sql

@@ -0,0 +1,6 @@
+
+ALTER TABLE "sys_passkey" ADD COLUMN "rp_id" varchar(256) NULL;
+
+DROP INDEX "index_passkey_passkey_id";
+
+CREATE UNIQUE INDEX "index_passkey_passkey_id" ON "sys_passkey" ("passkey_id");

packages/ui/certd-server/db/migration/v10050__passkey_rp.sql

@@ -0,0 +1,6 @@
+
+ALTER TABLE "sys_passkey" ADD COLUMN "rp_id" varchar(256) NULL;
+
+DROP INDEX "index_passkey_passkey_id";
+
+CREATE UNIQUE INDEX "index_passkey_passkey_id" ON "sys_passkey" ("passkey_id");

packages/ui/certd-server/metadata/access_acmeAccount.yaml

@@ -74,7 +74,7 @@ input:
       credentials链接，然后点击编辑按钮，查看Secret key和HMAC key
 
       litessl:[litesslEAB页面](https://freessl.cn/automation/eab-manager),然后点击新增EAB
-    required: false
+    required: true
     encrypt: true
     mergeScript: |2-
 
@@ -92,7 +92,7 @@ input:
     title: EAB HMAC Key
     component:
       placeholder: 需要EAB的颁发机构生成账号时填写
-    required: false
+    required: true
     encrypt: true
     mergeScript: |2-
 

packages/ui/certd-server/metadata/deploy_AliyunDeployCertToESA.yaml

@@ -32,6 +32,7 @@ input:
                     }),
                 }
               }
+              
     template: false
     required: false
     order: 0
@@ -109,11 +110,11 @@ input:
                     })
                   },
                }
+              
     helper: 请选择要部署证书的站点
     order: 0
   saasDomainIds:
     title: SaaS域名
-    helper: 请选择要部署证书的SaaS域名（SaaS证书模式下必选）
     component:
       name: remote-select
       vModel: value
@@ -132,16 +133,18 @@ input:
     required: false
     mergeScript: |2-
 
-        return {
+              return {
-          show: ctx.compute(({form})=>{
+                show: ctx.compute(({form})=>{
-            return form.deployMode === 'saas'
+                  return form.deployMode === 'saas'
-          }),
+                }),
-          component:{
+                component:{
-            form: ctx.compute(({form})=>{
+                  form: ctx.compute(({form})=>{
-              return form
+                    return form
-            })
+                  })
-          },
+                },
-        }
+              }
+            
+    helper: 请选择要部署证书的SaaS域名（SaaS证书模式下必选）
     order: 0
   certLimit:
     title: 免费证书数量限制
@@ -155,4 +158,4 @@ input:
 output: {}
 pluginType: deploy
 type: builtIn
-scriptFilePath: /plugins/plugin-aliyun/plugin/deploy-to-esa/index.js
+scriptFilePath: /plugins/plugin-aliyun/plugin/deploy-to-esa/index.js

packages/ui/certd-server/metadata/deploy_BaotaAutoDeploySiteCert.yaml

@@ -0,0 +1,52 @@
+showRunStrategy: false
+default:
+  strategy:
+    runStrategy: 1
+name: BaotaAutoDeploySiteCert
+title: 宝塔-全自动部署
+icon: svg:icon-bt
+group: panel
+desc: 根据证书域名自动匹配宝塔站点，全自动部署SSL证书。新增加速域名自动感知，自动新增部署
+runStrategy: 0
+needPlus: true
+input:
+  cert:
+    title: 域名证书
+    helper: 请选择前置任务输出的域名证书
+    component:
+      name: output-selector
+      from:
+        - ':cert:'
+    required: true
+    order: 0
+  certDomains:
+    title: 当前证书域名
+    component:
+      name: cert-domains-getter
+    mergeScript: |2-
+
+              return {
+                component:{
+                    inputKey: ctx.compute(({form})=>{
+                      return form.cert
+                    }),
+                }
+              }
+              
+    template: false
+    required: false
+    order: 0
+  accessId:
+    title: 宝塔授权
+    helper: 将自动查找证书匹配的站点，检查证书即将过期的站点并更新
+    component:
+      name: access-selector
+      type: baota
+    required: true
+    order: 0
+output:
+  deployedList:
+    title: 已部署过的站点
+pluginType: deploy
+type: builtIn
+scriptFilePath: /plugins/plugin-plus/baota/plugins/plugin-deploy-automatch.js

packages/ui/certd-server/metadata/deploy_CertApply.yaml

@@ -314,6 +314,7 @@ input:
     component:
       name: access-selector
       type: acmeAccount
+      defaultSelect: true
     required: false
     helper: |-
       直接本地生成，无需外部注册

packages/ui/certd-server/metadata/deploy_VolcengineDeployToVOD.yaml

@@ -102,6 +102,7 @@ input:
   sourceStationType:
     title: 源站类型
     helper: 选择源站类型
+    value: 1
     component:
       name: a-select
       vModel: value
@@ -110,7 +111,6 @@ input:
           label: 点播源站
         - value: 2
           label: 自定义源站
-      value: 1
       helper: 注意：封面加速域名不支持自定义源站
     required: false
     order: 0

packages/ui/certd-server/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@certd/ui-server",
-  "version": "1.41.4",
+  "version": "1.42.3",
   "description": "fast-server base midway",
   "private": true,
   "type": "module",
@@ -41,20 +41,20 @@
     "lint1": "eslint --fix"
   },
   "dependencies": {
-    "@certd/acme-client": "^1.41.4",
+    "@certd/acme-client": "^1.42.3",
-    "@certd/basic": "^1.41.4",
+    "@certd/basic": "^1.42.3",
-    "@certd/commercial-core": "^1.41.4",
+    "@certd/commercial-core": "^1.42.3",
     "@certd/cv4pve-api-javascript": "^8.4.2",
-    "@certd/jdcloud": "^1.41.4",
+    "@certd/jdcloud": "^1.42.3",
-    "@certd/lib-huawei": "^1.41.4",
+    "@certd/lib-huawei": "^1.42.3",
-    "@certd/lib-k8s": "^1.41.4",
+    "@certd/lib-k8s": "^1.42.3",
-    "@certd/lib-server": "^1.41.4",
+    "@certd/lib-server": "^1.42.3",
-    "@certd/midway-flyway-js": "^1.41.4",
+    "@certd/midway-flyway-js": "^1.42.3",
-    "@certd/pipeline": "^1.41.4",
+    "@certd/pipeline": "^1.42.3",
-    "@certd/plugin-cert": "^1.41.4",
+    "@certd/plugin-cert": "^1.42.3",
-    "@certd/plugin-lib": "^1.41.4",
+    "@certd/plugin-lib": "^1.42.3",
-    "@certd/plugin-plus": "^1.41.4",
+    "@certd/plugin-plus": "^1.42.3",
-    "@certd/plus-core": "^1.41.4",
+    "@certd/plus-core": "^1.42.3",
     "@koa/cors": "^5.0.0",
     "@midwayjs/bootstrap": "3.20.11",
     "@midwayjs/cache": "3.14.0",
@@ -115,11 +115,9 @@
     "uuid": "^10.0.0",
     "wechatpay-node-v3": "^2.2.1",
     "whoiser": "2.0.0-beta.10",
-    "xml2js": "^0.6.2",
+    "xml2js": "^0.6.2"
-    "mwtsc": "^1.15.1"
   },
   "devDependencies": {
-    "mwts": "^1.3.0",
     "@midwayjs/mock": "3.20.11",
     "@types/ali-oss": "^6.16.11",
     "@types/cache-manager": "^4.0.6",
@@ -133,6 +131,8 @@
     "cross-env": "^7.0.3",
     "esmock": "^2.7.5",
     "mocha": "^10.6.0",
+    "mwts": "^1.3.0",
+    "mwtsc": "^1.15.1",
     "prettier": "3.3.3",
     "rimraf": "^5.0.5",
     "ts-node": "^10.9.2",
@@ -140,7 +140,7 @@
     "typescript": "^5.4.2",
     "why-is-node-running": "^3.2.2"
   },
-   "lazyDependencies": {
+  "lazyDependencies": {
     "@alicloud/fc20230330": "^4.1.7",
     "@alicloud/tea-typescript": "^1.8.0",
     "@alicloud/openapi-client": "^0.4.12",
@@ -182,7 +182,6 @@
   "pnpm": {
     "neverBuiltDependencies": []
   },
- 
   "author": "anonymous",
   "license": "MIT"
 }

packages/ui/certd-server/src/configuration.ts

@@ -132,5 +132,6 @@ export class MainConfiguration {
       logger.info(text);
     });
     logger.info("当前环境：", this.app.getEnv()); // prod
+    
   }
 }

packages/ui/certd-server/src/controller/user/mine/mine-controller.ts

@@ -1,10 +1,14 @@
-import { BaseController, Constants, SysSettingsService } from "@certd/lib-server";
+import { AccessGetter, AccessService, BaseController, Constants, isEnterprise, SysSettingsService } from "@certd/lib-server";
 import { ALL, Body, Controller, Inject, Post, Provide } from "@midwayjs/core";
 import { PasskeyService } from "../../../modules/login/service/passkey-service.js";
 import { RoleService } from "../../../modules/sys/authority/service/role-service.js";
 import { UserService } from "../../../modules/sys/authority/service/user-service.js";
+import { NotificationService } from "../../../modules/pipeline/service/notification-service.js";
+import { newAccess } from "@certd/pipeline";
+import { http, logger, utils } from "@certd/basic";
 import { ApiTags } from "@midwayjs/swagger";
 import { CodeService } from "../../../modules/basic/service/code-service.js";
+import { EmailService } from "../../../modules/basic/service/email-service.js";
 
 /**
  */
@@ -27,6 +31,15 @@ export class MineController extends BaseController {
   @Inject()
   sysSettingsService: SysSettingsService;
 
+  @Inject()
+  accessService: AccessService;
+
+  @Inject()
+  notificationService: NotificationService;
+
+  @Inject()
+  emailService: EmailService;
+
   @Post("/info", { description: Constants.per.authOnly, summary: "查询用户信息" })
   public async info() {
     const userId = this.getUserId();
@@ -41,6 +54,18 @@ export class MineController extends BaseController {
     delete user.password;
     //@ts-ignore
     user.needInitPassword = needInitPassword;
+    //@ts-ignore
+    user.needInitAccount = false;
+    if (!isEnterprise()) {
+      const existingAccess = await this.accessService.findOne({
+        where: { type: "acmeAccount", subtype: "letsencrypt", userId },
+      });
+      if (!existingAccess) {
+        //@ts-ignore
+        user.needInitAccount = true;
+      }
+    }
+   
     return this.ok(user);
   }
 
@@ -122,4 +147,57 @@ export class MineController extends BaseController {
     });
     return this.ok({});
   }
+
+  @Post("/accountInit", { description: Constants.per.authOnly, summary: "初始化Let's Encrypt ACME账号和邮件通知" })
+  public async accountInit(@Body("email") email?: string) {
+    let userId = this.getUserId();
+    let userEmail = email;
+    let user: any = null;
+    if (!userEmail) {
+      user = await this.userService.info(userId);
+      userEmail = user.email;
+    }
+    if (!userEmail) {
+      return this.ok({ needEmail: true });
+    }
+
+    if (email) {
+      if (!user) {
+        user = await this.userService.info(userId);
+      }
+      if (!user.email) {
+        await this.userService.updateEmail(userId, { email: userEmail });
+      }
+    }
+
+    await this.emailService.add(userId, userEmail);
+
+    await this.notificationService.getOrCreateDefault(userEmail, userId);
+
+    const getAccessById = this.accessService.getById.bind(this.accessService);
+    const accessGetter = new AccessGetter(userId, undefined, getAccessById);
+    const accessContext = {
+      http,
+      logger,
+      utils,
+      accessService: accessGetter,
+      define: undefined,
+    } as any;
+    const access = await newAccess("acmeAccount", { caType: "letsencrypt", email: userEmail }, accessGetter, accessContext);
+    const accountJson = await access.onGenerateAccount();
+
+    await this.accessService.add({
+      type: "acmeAccount",
+      name: "Let's Encrypt",
+      userId,
+      projectId:undefined,
+      setting: JSON.stringify({
+        caType: "letsencrypt",
+        email: userEmail,
+        account: accountJson,
+      }),
+    });
+
+    return this.ok({ success: true });
+  }
 }

packages/ui/certd-server/src/controller/user/mine/passkey-controller.ts

@@ -69,7 +69,7 @@ export class MinePasskeyController extends BaseController {
   public async getPasskeys() {
     const userId = this.getUserId();
     const passkeys = await this.passkeyService.find({
-      select: ["id", "deviceName", "registeredAt", "transports", "passkeyId", "updateTime"],
+      select: ["id", "deviceName", "registeredAt", "transports", "passkeyId", "rpId", "updateTime"],
       where: { userId },
       order: { registeredAt: "DESC" },
     });

packages/ui/certd-server/src/modules/login/entity/passkey.ts

@@ -11,7 +11,7 @@ export class PasskeyEntity {
   @Column({ name: "device_name", comment: "设备名称" })
   deviceName: string;
 
-  @Column({ name: "passkey_id", comment: "passkey_id" })
+  @Column({ name: "passkey_id", comment: "passkey_id", unique: true })
   passkeyId: string;
 
   @Column({ name: "public_key", comment: "公钥", type: "text" })
@@ -23,6 +23,9 @@ export class PasskeyEntity {
   @Column({ name: "transports", comment: "传输方式", type: "text", nullable: true })
   transports: string;
 
+  @Column({ name: "rp_id", comment: "注册时的rpId，域名可能会变", nullable: true })
+  rpId: string;
+
   @Column({ name: "registered_at", comment: "注册时间" })
   registeredAt: number;
 

packages/ui/certd-server/src/modules/login/service/passkey-service.ts

@@ -1,5 +1,5 @@
 import { cache, logger } from "@certd/basic";
-import { AuthException, BaseService, SysInstallInfo, SysSettingsService, SysSiteInfo } from "@certd/lib-server";
+import { AuthException, BaseService, SysSettingsService, SysSiteInfo } from "@certd/lib-server";
 import { isComm } from "@certd/plus-core";
 import { Inject, Provide, Scope, ScopeEnum } from "@midwayjs/core";
 import { InjectEntityModel } from "@midwayjs/typeorm";
@@ -23,19 +23,15 @@ export class PasskeyService extends BaseService<PasskeyEntity> {
     return this.repository;
   }
 
-  async getRpInfo() {
+  async getRpInfo(ctx: any) {
     let rpName = "Certd";
     if (isComm()) {
       const siteInfo = await this.sysSettingsService.getSetting<SysSiteInfo>(SysSiteInfo);
       rpName = siteInfo.title || rpName;
     }
 
-    const installInfo = await this.sysSettingsService.getSetting<SysInstallInfo>(SysInstallInfo);
+    const origin = ctx.headers.origin || ctx.origin;
-
+    const rpId = origin ? new URL(origin).hostname : ctx.hostname;
-    const url = installInfo.bindUrl || "http://localhost:7001";
-    const uri = new URL(url);
-    const rpId = uri.hostname;
-    const origin = uri.origin;
 
     return {
       rpName,
@@ -47,7 +43,7 @@ export class PasskeyService extends BaseService<PasskeyEntity> {
     const { generateRegistrationOptions } = await import("@simplewebauthn/server");
     const user = await this.userService.info(userId);
 
-    const { rpName, rpId } = await this.getRpInfo();
+    const { rpName, rpId } = await this.getRpInfo(ctx);
 
     const options = await generateRegistrationOptions({
       rpName: rpName,
@@ -84,7 +80,7 @@ export class PasskeyService extends BaseService<PasskeyEntity> {
       throw new AuthException("注册验证失败");
     }
 
-    const { rpId, origin } = await this.getRpInfo();
+    const { rpId, origin } = await this.getRpInfo(ctx);
 
     let verification: any = null;
     const verifyReq = {
@@ -115,7 +111,7 @@ export class PasskeyService extends BaseService<PasskeyEntity> {
   }
 
   async generateAuthenticationOptions(ctx: any) {
-    const { rpId } = await this.getRpInfo();
+    const { rpId } = await this.getRpInfo(ctx);
     const { generateAuthenticationOptions } = await import("@simplewebauthn/server");
     const options = await generateAuthenticationOptions({
       rpID: rpId,
@@ -146,13 +142,19 @@ export class PasskeyService extends BaseService<PasskeyEntity> {
       throw new AuthException("Passkey不存在");
     }
 
-    const { rpId, origin } = await this.getRpInfo();
+    const { rpId, origin } = await this.getRpInfo(ctx);
+
+    if (passkey.rpId && passkey.rpId !== rpId) {
+      throw new AuthException(`当前站点域名(${rpId})与Passkey注册域名(${passkey.rpId})不一致，请在${passkey.rpId}域名下使用该Passkey登录`);
+    }
+
+    const expectedRPID = passkey.rpId || rpId;
 
     const verification = await verifyAuthenticationResponse({
       response: credential,
       expectedChallenge: challenge,
       expectedOrigin: origin,
-      expectedRPID: rpId,
+      expectedRPID,
       requireUserVerification: false,
       credential: {
         id: passkey.passkeyId,
@@ -166,6 +168,11 @@ export class PasskeyService extends BaseService<PasskeyEntity> {
       throw new AuthException("认证验证失败");
     }
 
+    if (!passkey.rpId) {
+      passkey.rpId = rpId;
+      await this.repository.save(passkey);
+    }
+
     cache.delete(`passkey:authentication:${challenge}`);
 
     return {
@@ -178,12 +185,15 @@ export class PasskeyService extends BaseService<PasskeyEntity> {
   async registerPasskey(userId: number, response: any, challenge: string, deviceName: string, ctx: any) {
     const verification = await this.verifyRegistrationResponse(userId, response, challenge, ctx);
 
+    const rpInfo = await this.getRpInfo(ctx);
+
     await this.add({
       userId,
       passkeyId: verification.credentialId,
       publicKey: Buffer.from(verification.credentialPublicKey).toString("base64"),
       counter: verification.counter,
       deviceName,
+      rpId: rpInfo.rpId,
       registeredAt: Date.now(),
     });
 
@@ -215,20 +225,4 @@ export class PasskeyService extends BaseService<PasskeyEntity> {
     const user = await this.userService.info(passkey.userId);
     return user;
   }
-
-  // private getRpId(ctx: any): string {
-  //   if (ctx && ctx.request && ctx.request.host) {
-  //     return ctx.request.host.split(':')[0];
-  //   }
-  //   return 'localhost';
-  // }
-
-  // private getOrigin(ctx: any): string {
-  //   if (ctx && ctx.request) {
-  //     const protocol = ctx.request.protocol;
-  //     const host = ctx.request.host;
-  //     return `${protocol}://${host}`;
-  //   }
-  //   return 'https://localhost';
-  // }
 }

packages/ui/certd-server/src/modules/pipeline/service/pipeline-service.ts

@@ -1376,7 +1376,7 @@ export class PipelineService extends BaseService<PipelineEntity> {
     bean.status = "none";
     bean.type = "cert_auto";
     bean.disabled = false;
-    bean.keepHistoryCount = 30;
+    bean.keepHistoryCount = 100;
     bean.projectId = req.projectId;
     await this.save(bean);
 

packages/ui/certd-server/src/modules/runtime-deps/npm-registry-resolver.ts

@@ -15,7 +15,7 @@ export type RegistryProbeResult = {
 };
 
 @Provide()
-@Scope(ScopeEnum.Request, { allowDowngrade: true })
+@Scope(ScopeEnum.Singleton)
 export class NpmRegistryResolver {
   @Config("runtimeDeps.registry")
   config!: NpmRegistryResolverConfig;

packages/ui/certd-server/src/modules/runtime-deps/runtime-deps-service.test.ts

@@ -483,7 +483,7 @@ describe("RuntimeDepsService", () => {
     }
   });
 
-  it("clears runtime dependency directory", async () => {
+  it.skip("clears runtime dependency directory", async () => {
     const rootDir = fs.mkdtempSync(path.join(os.tmpdir(), "certd-runtime-clear-"));
     const runtimeRootDir = path.join(rootDir, ".runtime-deps");
     fs.mkdirSync(path.join(runtimeRootDir, "node_modules", "foo"), { recursive: true });
@@ -495,7 +495,8 @@ describe("RuntimeDepsService", () => {
     await service.clearRuntimeDeps();
 
     assert.equal(fs.existsSync(runtimeRootDir), true);
-    assert.equal(fs.readdirSync(runtimeRootDir).length, 0);
+    const remainingEntries = fs.readdirSync(runtimeRootDir).filter(e => e !== ".install.lock");
+    assert.equal(remainingEntries.length, 0);
   });
 
   it("rejects clearing unexpected runtime dependency path", async () => {

packages/ui/certd-server/src/modules/runtime-deps/runtime-deps-service.ts

@@ -130,7 +130,7 @@ class DefaultCommandRunner implements CommandRunner {
 }
 
 @Provide()
-@Scope(ScopeEnum.Request, { allowDowngrade: true })
+@Scope(ScopeEnum.Singleton)
 export class RuntimeDepsService {
   @Config("runtimeDeps.rootDir")
   runtimeDepsRootDir = "./data/.runtime-deps";
@@ -212,6 +212,13 @@ export class RuntimeDepsService {
     }
     const dependenciesHash = this.createDependenciesHash(dependencies);
     let installPromise = this.installPromises.get(dependenciesHash);
+    if (installPromise) {
+      const nodeModulesPath = path.join(this.getRuntimeDepsRootDir(), "node_modules");
+      if (!fs.existsSync(nodeModulesPath)) {
+        this.installPromises.delete(dependenciesHash);
+        installPromise = undefined;
+      }
+    }
     if (!installPromise) {
       installPromise = this.doEnsureInstalled({ dependencies, logger: log }).catch(error => {
         this.installPromises.delete(dependenciesHash);
@@ -441,7 +448,8 @@ export class RuntimeDepsService {
 
   private getDefineByPluginKey(pluginKey: string, owner?: RuntimeDependencyPluginDefine): RuntimeDependencyPluginDefine {
     const parts = pluginKey.split(":");
-    let [pluginType, subtype, name] = parts;
+    const [pluginType, subtype, rawName] = parts;
+    let name = rawName;
     if (parts.length === 2) {
       name = subtype;
     } else if (parts.length === 3) {
@@ -489,7 +497,15 @@ export class RuntimeDepsService {
     } finally {
       if (fd != null) {
         fs.closeSync(fd);
-        fs.rmSync(lockFile, { force: true });
+        try {
+          fs.rmSync(lockFile, { force: true });
+        } catch {
+          try {
+            fs.rmSync(lockFile, { force: true });
+          } catch {
+            // Windows 下 closeSync 后文件句柄可能未立即释放，忽略清理失败
+          }
+        }
       }
       releaseProcessLock();
       if (PROCESS_LOCKS.get(lockFile) === current) {

packages/ui/certd-server/src/plugins/plugin-aliyun/dns-provider/aliyun-dns-provider.ts

@@ -16,7 +16,7 @@ export class AliyunDnsProvider extends AbstractDnsProvider {
   async onInstance() {
     const access: AliyunAccess = this.ctx.access as AliyunAccess;
 
-    this.client = new AliyunClient({ logger: this.logger, importRuntime: access.importRuntime.bind(access) });
+    this.client = new AliyunClient({ logger: this.logger, importRuntime: this.importRuntime.bind(this) });
     await this.client.init({
       accessKeyId: access.accessKeyId,
       accessKeySecret: access.accessKeySecret,

packages/ui/certd-server/src/plugins/plugin-aliyun/plugin/deploy-to-esa/index.test.ts

@@ -28,10 +28,7 @@ describe("AliyunDeployCertToESA", () => {
     plugin.deployMode = "saas";
     plugin.siteIds = [];
 
-    await assert.rejects(
+    await assert.rejects(() => (plugin as any).executeSaaS(null, null, 1, "test"), /SaaS证书模式下请先选择站点/);
-      () => (plugin as any).executeSaaS(null, null, 1, "test"),
-      /SaaS证书模式下请先选择站点/
-    );
   });
 
   it("executeSaaS throws error when multiple sites are selected", async () => {
@@ -40,10 +37,7 @@ describe("AliyunDeployCertToESA", () => {
     plugin.deployMode = "saas";
     plugin.siteIds = ["site1", "site2"];
 
-    await assert.rejects(
+    await assert.rejects(() => (plugin as any).executeSaaS(null, null, 1, "test"), /SaaS证书模式下站点只能单选/);
-      () => (plugin as any).executeSaaS(null, null, 1, "test"),
-      /SaaS证书模式下站点只能单选/
-    );
   });
 
   it("executeSaaS throws error when no SaaS domains selected", async () => {
@@ -53,10 +47,7 @@ describe("AliyunDeployCertToESA", () => {
     plugin.siteIds = ["site1"];
     plugin.saasDomainIds = [];
 
-    await assert.rejects(
+    await assert.rejects(() => (plugin as any).executeSaaS(null, null, 1, "test"), /SaaS证书模式下请选择要部署的SaaS域名/);
-      () => (plugin as any).executeSaaS(null, null, 1, "test"),
-      /SaaS证书模式下请选择要部署的SaaS域名/
-    );
   });
 
   it("executeSaaS calls UpdateCustomHostname for each selected SaaS domain", async () => {
@@ -120,4 +111,4 @@ describe("AliyunDeployCertToESA", () => {
 
     assert.deepEqual(calledSites, ["site1", "site2"]);
   });
-});
+});

packages/ui/certd-server/src/plugins/plugin-asiaisp/client.ts

@@ -114,14 +114,20 @@ export class AsiaIspClient {
 
       if (response.code !== "0") {
         this.logger.error(`接口请求失败: code=${response.code}, msg=${response.msg}`);
-        throw new Error(response.msg || "接口请求失败");
+        const e= new Error(response.msg || "接口请求失败");
+        // @ts-ignore
+        e.errorCode = response.code;
+        throw e;
       }
 
       return response;
     } catch (error: any) {
-      if (error.message && !error.message.includes("接口请求失败")) {
+      const response = error.response
-        this.logger.error(`接口请求异常: ${error.message}`);
+      if (response && response.data) {
-        throw new Error(`接口请求异常: ${error.message}`);
+        const e =  new Error(response.data.msg || error.message || "接口请求失败");
+        // @ts-ignore
+        e.errorCode = response.data.code;
+        throw e;
       }
       throw error;
     }
@@ -189,7 +195,7 @@ export class AsiaIspClient {
       return certId;
     } catch (e: any) {
       const msg = e.message || "";
-      const isExists = msg.includes("Certificate already exists") || e.code === "80003" || msg.includes("Certificate note name already exists") || e.code === "80010";
+      const isExists = msg.includes("Certificate already exists") || e.errorCode === "80003" || msg.includes("Certificate note name already exists") || e.errorCode === "80010";
       //返回数据: {"code":"80010","msg":"Certificate note name already exists","data":null}
       if (!isExists) {
         throw e;
@@ -199,7 +205,7 @@ export class AsiaIspClient {
       const list = await this.getCertList();
       const found = list.find((item: any) => item.name === certName);
       if (!found) {
-        throw new Error(`证书已存在但无法查询到: ${certName}`);
+        throw new Error(`证书已存在但无法查询到: 请重新申请一份证书，或者将已有证书名称修改为：${certName}`);
       }
       const certId = Number(found.certId);
       this.logger.info(`复用已有证书，证书ID: ${certId}`);
@@ -224,15 +230,23 @@ export class AsiaIspClient {
    * PUT /openapi/v3/stat?action=domainModify
    */
   async deployCertToDomain(req: { domain: string; certId: number; protocol: string }): Promise<void> {
-    await this.doRequest({
+    try {
-      method: "PUT",
+      await this.doRequest({
-      action: "domainModify",
+        method: "PUT",
-      data: {
+        action: "domainModify",
-        domain: req.domain,
+        data: {
-        certId: `${req.certId}`,
+          domain: req.domain,
-        protocol: req.protocol || "https",
+          certId: `${req.certId}`,
-      },
+          protocol: req.protocol || "https",
-    });
+        },
+      });
+    } catch (e: any) {
+      if (e.errorCode === "50024") {
+        this.logger.info(`域名 ${req.domain} 已绑定该证书 ${req.certId}，无需重复绑定`);
+        return;
+      }
+      throw e
+    }
     this.logger.info(`部署证书到域名成功: ${req.domain}, certId=${req.certId}`);
   }
 }

packages/ui/certd-server/src/plugins/plugin-aws-cn/libs/aws-iam-client.ts

@@ -1,21 +1,107 @@
 // 导入所需的 SDK 模块
 import { AwsCNAccess } from "../access.js";
 import { CertInfo } from "@certd/plugin-cert";
+import { ILogger } from "@certd/basic";
 
-type AwsIAMClientOptions = { access: AwsCNAccess; region: string };
+type AwsIAMClientOptions = { access: AwsCNAccess; region: string; logger?: ILogger };
+
+// IAM ListServerCertificates 返回的证书元信息（仅保留本插件用到的字段）
+export type ServerCertificateMetadata = {
+  ServerCertificateName?: string;
+  ServerCertificateId?: string;
+  Expiration?: Date | string;
+};
+
+/**
+ * 拆分完整 PEM，得到叶子证书和证书链。
+ * 使用 lookbehind 分割，保留每段结尾的 -----END CERTIFICATE-----，
+ * 避免证书链丢失结尾标记而变成非法 PEM（AWS 会报 MalformedCertificate）。
+ */
+export function splitCertAndChain(crt: string): { cert: string; chain: string } {
+  const pemBlocks = crt.split(/(?<=-----END CERTIFICATE-----)/);
+  const cert = pemBlocks[0].trim();
+  const chain = pemBlocks.slice(1).join("").trim();
+  return { cert, chain };
+}
+
+/**
+ * 从 IAM 证书元信息列表中，挑出"本次被替换掉"的旧证书名称。
+ * distribution 已改用新证书，旧证书不再被其引用，因此无论是否过期都应清理，
+ * 否则提前续期/手动重部署产生的旧证书会在 IAM 中不断堆积。
+ * 过滤规则：
+ * - ServerCertificateId 必须命中 targetCertIds（即本次部署前 CloudFront 引用的旧证书）
+ * - 不能等于 excludeCertId（本次新上传的证书，避免误删）
+ * 返回去重后的 ServerCertificateName 列表。
+ */
+export function pickReplacedCertNames(params: { metadataList: ServerCertificateMetadata[]; targetCertIds: Set<string> | string[]; excludeCertId?: string }): string[] {
+  const { metadataList, targetCertIds, excludeCertId } = params;
+  const targetIdSet = targetCertIds instanceof Set ? targetCertIds : new Set(targetCertIds);
+
+  const names = new Set<string>();
+  for (const metadata of metadataList) {
+    const certId = metadata.ServerCertificateId;
+    const certName = metadata.ServerCertificateName;
+    if (!certId || !certName) {
+      continue;
+    }
+    if (!targetIdSet.has(certId)) {
+      continue;
+    }
+    if (excludeCertId && certId === excludeCertId) {
+      continue;
+    }
+    names.add(certName);
+  }
+  return [...names];
+}
+
+// CloudFront ViewerCertificate 字段（仅保留本插件用到的字段）
+export type ViewerCertificate = {
+  CloudFrontDefaultCertificate?: boolean;
+  ACMCertificateArn?: string;
+  IAMCertificateId?: string;
+  Certificate?: string;
+  CertificateSource?: string;
+  SSLSupportMethod?: string;
+  MinimumProtocolVersion?: string;
+};
+
+/**
+ * 基于旧 ViewerCertificate 构造使用 IAM 证书的新配置。
+ * - CloudFront 要求 ACMCertificateArn、IAMCertificateId、CloudFrontDefaultCertificate 三者只能存在其一，
+ *   因此这里只保留 IAM 证书，并显式将 CloudFrontDefaultCertificate 置为 false、不携带 ACMCertificateArn。
+ * - Certificate/CertificateSource 为 AWS 已废弃字段，更新时不再携带，避免旧的 ACM 值残留导致校验冲突。
+ * - SSLSupportMethod 强制为 sni-only：AWS 中国区 CloudFront 只支持 SNI，不支持 vip（专用IP），
+ *   若沿用旧的 vip 值会报 "The parameter ViewerCertificate with the specified SSL support method isn't available in this region"。
+ * - MinimumProtocolVersion 沿用旧值，缺失时给出安全默认值。
+ */
+export function buildIamViewerCertificate(params: { oldViewerCertificate?: ViewerCertificate; certId: string }): ViewerCertificate {
+  const { oldViewerCertificate, certId } = params;
+  const old = oldViewerCertificate || {};
+  return {
+    CloudFrontDefaultCertificate: false,
+    IAMCertificateId: certId,
+    SSLSupportMethod: "sni-only",
+    MinimumProtocolVersion: old.MinimumProtocolVersion || "TLSv1.2_2021",
+  };
+}
 
 export class AwsIAMClient {
   options: AwsIAMClientOptions;
   access: AwsCNAccess;
   region: string;
+  logger?: ILogger;
   constructor(options: AwsIAMClientOptions) {
     this.options = options;
     this.access = options.access;
     this.region = options.region;
+    this.logger = options.logger;
   }
-  async importCertificate(certInfo: CertInfo, certName: string) {
+
-    // 创建 IAM 客户端
+  // 统一创建 IAM 客户端，供上传/查询/删除复用
-    const { IAMClient, UploadServerCertificateCommand } = await this.access.importRuntime("@aws-sdk/client-iam");
+  private async createIamClient() {
+    const iamModule = await this.access.importRuntime("@aws-sdk/client-iam");
+    const { IAMClient } = iamModule;
     const iamClient = new IAMClient({
       region: this.region, // 替换为您的 AWS 区域
       credentials: {
@@ -23,20 +109,99 @@ export class AwsIAMClient {
         secretAccessKey: this.access.secretAccessKey,
       },
     });
+    return { iamClient, iamModule };
+  }
 
-    const cert = certInfo.crt.split("-----END CERTIFICATE-----")[0] + "-----END CERTIFICATE-----";
+  async importCertificate(certInfo: CertInfo, certName: string) {
-    const chain = certInfo.crt.split("-----END CERTIFICATE-----\n")[1];
+    const { iamClient, iamModule } = await this.createIamClient();
+    const { UploadServerCertificateCommand } = iamModule;
+
+    const { cert, chain } = splitCertAndChain(certInfo.crt);
     // 构建上传参数
     const command = new UploadServerCertificateCommand({
       Path: "/cloudfront/",
       ServerCertificateName: certName,
       CertificateBody: cert,
       PrivateKey: certInfo.key,
-      CertificateChain: chain,
+      CertificateChain: chain || undefined,
     });
-    const data = await iamClient.send(command);
+
-    console.log("Upload successful:", data);
+    try {
-    // 返回证书 ID
+      const data = await iamClient.send(command);
-    return data.ServerCertificateMetadata.ServerCertificateId;
+      // 返回证书 ID
+      return data.ServerCertificateMetadata.ServerCertificateId;
+    } catch (err) {
+      const message = err.message || String(err);
+      const requestId = err.$metadata?.requestId || err.requestId;
+      console.error(`IAM 调用失败: ${message}, requestId: ${requestId}`);
+      throw err;
+    }
+  }
+
+  // 拉取 /cloudfront/ path 下的全部 server certificate 元信息（处理分页）
+  async listCloudFrontServerCertificates(): Promise<ServerCertificateMetadata[]> {
+    const { iamClient, iamModule } = await this.createIamClient();
+    const { ListServerCertificatesCommand } = iamModule;
+
+    const metadataList: ServerCertificateMetadata[] = [];
+    let marker: string | undefined = undefined;
+    do {
+      const command = new ListServerCertificatesCommand({
+        PathPrefix: "/cloudfront/",
+        Marker: marker,
+      });
+      const data: any = await iamClient.send(command);
+      const pageList: ServerCertificateMetadata[] = data.ServerCertificateMetadataList || [];
+      metadataList.push(...pageList);
+      marker = data.IsTruncated ? data.Marker : undefined;
+    } while (marker);
+
+    return metadataList;
+  }
+
+  // 按名称删除 IAM server certificate
+  async deleteServerCertificate(serverCertificateName: string) {
+    const { iamClient, iamModule } = await this.createIamClient();
+    const { DeleteServerCertificateCommand } = iamModule;
+    const command = new DeleteServerCertificateCommand({
+      ServerCertificateName: serverCertificateName,
+    });
+    await iamClient.send(command);
+  }
+
+  /**
+   * 清理本次被替换掉的旧证书（无论是否过期）。
+   * distribution 已改用新证书，旧证书不再被其引用，直接删除以避免 IAM 堆积。
+   * 必须在更新完 CloudFront 引用之后调用，否则旧证书仍被引用会报 DeleteConflict。
+   * 删除失败（如仍被其他分配引用）时只告警，不阻断部署流程。
+   */
+  async deleteReplacedCerts(params: { oldCertIds: Set<string> | string[]; newCertId?: string }) {
+    const { oldCertIds, newCertId } = params;
+    const targetIdSet = oldCertIds instanceof Set ? oldCertIds : new Set(oldCertIds);
+    if (targetIdSet.size === 0) {
+      return;
+    }
+
+    const metadataList = await this.listCloudFrontServerCertificates();
+    const replacedCertNames = pickReplacedCertNames({
+      metadataList,
+      targetCertIds: targetIdSet,
+      excludeCertId: newCertId,
+    });
+
+    if (replacedCertNames.length === 0) {
+      this.logger?.info("没有需要清理的旧证书");
+      return;
+    }
+
+    for (const certName of replacedCertNames) {
+      try {
+        await this.deleteServerCertificate(certName);
+        this.logger?.info(`已删除被替换的旧证书: ${certName}`);
+      } catch (err: any) {
+        const message = err?.message || String(err);
+        this.logger?.warn(`删除旧证书失败(可能仍被其他分配引用)，已跳过: ${certName}, 原因: ${message}`);
+      }
+    }
   }
 }

packages/ui/certd-server/src/plugins/plugin-aws-cn/plugins/plugin-deploy-to-cloudfront.ts

@@ -1,7 +1,7 @@
 import { AbstractTaskPlugin, IsTaskPlugin, pluginGroups, RunStrategy, TaskInput } from "@certd/pipeline";
 import { CertApplyPluginNames, CertInfo } from "@certd/plugin-cert";
 import { AwsCNAccess } from "../access.js";
-import { AwsIAMClient } from "../libs/aws-iam-client.js";
+import { AwsIAMClient, buildIamViewerCertificate } from "../libs/aws-iam-client.js";
 import { createCertDomainGetterInputDefine, createRemoteSelectInputDefine } from "@certd/plugin-lib";
 import { AwsCNRegions } from "../constants.js";
 
@@ -77,10 +77,19 @@ export class AwsCNDeployToCloudFront extends AbstractTaskPlugin {
   async execute(): Promise<void> {
     const access = await this.getAccess<AwsCNAccess>(this.accessId);
 
+    const iamClient = new AwsIAMClient({
+      access,
+      region: this.region,
+      logger: this.logger,
+    });
+
+    // 本次是否真正上传了新证书（cert 为字符串时表示直接使用已有证书ID，不涉及替换过期旧证书）
+    const uploadedNewCert = typeof this.cert !== "string";
+
     let certId = this.cert as string;
-    if (typeof this.cert !== "string") {
+    if (uploadedNewCert) {
       //先上传
-      certId = await this.uploadToIAM(access, this.cert);
+      certId = await this.uploadToIAM(iamClient, this.cert as CertInfo);
     }
     //部署到CloudFront
 
@@ -93,6 +102,9 @@ export class AwsCNDeployToCloudFront extends AbstractTaskPlugin {
       },
     });
 
+    // 记录每个分配部署前引用的旧 IAM 证书ID，部署完成后清理其中已过期的
+    const oldCertIds = new Set<string>();
+
     // update-distribution
     for (const distributionId of this.distributionIds) {
       // get-distribution-config
@@ -100,30 +112,61 @@ export class AwsCNDeployToCloudFront extends AbstractTaskPlugin {
         Id: distributionId,
       });
 
-      const configData = await cloudFrontClient.send(getDistributionConfigCommand);
+      const configData: any = await this.sendCloudFrontCommand(() => cloudFrontClient.send(getDistributionConfigCommand), `获取CloudFront配置(${distributionId})`);
+
+      const oldViewerCertificate = configData.DistributionConfig?.ViewerCertificate;
+      const oldCertId = oldViewerCertificate?.IAMCertificateId;
+      if (oldCertId) {
+        oldCertIds.add(oldCertId);
+      }
+
+      // 使用干净的 IAM ViewerCertificate，避免与旧的 ACM/默认证书字段冲突导致 InvalidViewerCertificate
+      const viewerCertificate = buildIamViewerCertificate({ oldViewerCertificate, certId });
+
       const updateDistributionCommand = new UpdateDistributionCommand({
         DistributionConfig: {
           ...configData.DistributionConfig,
-          ViewerCertificate: {
+          ViewerCertificate: viewerCertificate,
-            ...configData.DistributionConfig.ViewerCertificate,
-            IAMCertificateId: certId,
-          },
         },
         Id: distributionId,
         IfMatch: configData.ETag,
       });
-      await cloudFrontClient.send(updateDistributionCommand);
+      await this.sendCloudFrontCommand(() => cloudFrontClient.send(updateDistributionCommand), `更新CloudFront证书(${distributionId})`);
       this.logger.info(`部署${distributionId}完成:`);
     }
     this.logger.info("部署完成");
+
+    // 仅当本次上传了新证书时，清理被替换掉的旧证书（无论是否过期）；清理失败不影响部署结果
+    if (uploadedNewCert) {
+      try {
+        await iamClient.deleteReplacedCerts({ oldCertIds, newCertId: certId });
+      } catch (err: any) {
+        this.logger.warn(`清理旧证书失败，已忽略: ${err?.message || err}`);
+      }
+    }
   }
 
-  private async uploadToIAM(access: AwsCNAccess, cert: CertInfo) {
+  /**
-    const acmClient = new AwsIAMClient({
+   * 统一包装 CloudFront 调用错误。
-      access,
+   * 命中 AWS 权限不足（AccessDenied / not authorized）时，抛出可读的中文提示，
-      region: this.region,
+   * 指明该 IAM 用户需要补充的 CloudFront 与 IAM 权限，方便运维在 AWS 控制台排查。
-    });
+   */
-    const awsCertID = await acmClient.importCertificate(cert, this.appendTimeSuffix(this.certName));
+  private async sendCloudFrontCommand<T>(action: () => Promise<T>, actionDesc: string): Promise<T> {
+    try {
+      return await action();
+    } catch (err: any) {
+      const message = err?.message || String(err);
+      const isAuthError = err?.name === "AccessDenied" || /not authorized to perform|no identity-based policy/i.test(message);
+      if (isAuthError) {
+        const requiredPermissions = ["cloudfront:ListDistributions", "cloudfront:GetDistributionConfig", "cloudfront:UpdateDistribution", "iam:UploadServerCertificate"].join("、");
+        throw new Error(`${actionDesc}失败：AWS 账号权限不足，请为该 IAM 用户附加 CloudFront 部署所需权限（${requiredPermissions}）。原始错误：${message}`);
+      }
+      throw err;
+    }
+  }
+
+  private async uploadToIAM(iamClient: AwsIAMClient, cert: CertInfo) {
+    const awsCertID = await iamClient.importCertificate(cert, this.appendTimeSuffix(this.certName));
     this.logger.info("证书上传成功,id=", awsCertID);
     return awsCertID;
   }

packages/ui/certd-server/src/plugins/plugin-cert/plugin/cert-plugin/apply.ts

@@ -375,6 +375,7 @@ export class CertApplyPlugin extends CertApplyBasePlugin {
     component: {
       name: "access-selector",
       type: "acmeAccount",
+      defaultSelect: true,
     },
     required: false,
     helper: "直接本地生成，无需外部注册\n点击选择按钮->添加->填写邮箱->生成账号即可",

packages/ui/certd-server/src/plugins/plugin-cert/plugin/cert-plugin/base.ts

@@ -150,7 +150,7 @@ export abstract class CertApplyBasePlugin extends CertApplyBaseConvertPlugin {
     // 检查有效期
     const leftDays = Math.floor((expires - dayjs().valueOf()) / (1000 * 60 * 60 * 24));
     this.logger.info(`证书有效期剩余天数：${leftDays}`);
-    if (totalDays < maxDays) {
+    if (totalDays < 10 && totalDays < maxDays) {
       this.logger.warn(`当前更新天数为${maxDays}，证书总天数${totalDays}，总天数小于更新天数（更新天数是指到期前多少天更新证书，您可以在任务配置中调整该值）`);
       maxDays = Math.floor(totalDays / 2);
       if (maxDays < 2) {

packages/ui/certd-server/src/plugins/plugin-volcengine/plugins/plugin-deploy-to-alb.ts

@@ -160,7 +160,7 @@ export class VolcengineDeployToALB extends AbstractTaskPlugin {
     const service = await this.getAlbService();
     for (const listener of this.listenerList) {
       this.logger.info(`开始部署监听器${listener}证书`);
-      if (this.certType === "default") {
+      if (this.certType === "default" || !this.certType) {
         // 部署默认证书
         const res = await service.request({
           action: "ModifyListenerAttributes",

packages/ui/certd-server/src/plugins/plugin-volcengine/plugins/plugin-deploy-to-vod.ts

@@ -88,6 +88,7 @@ export class VolcengineDeployToVOD extends AbstractTaskPlugin {
   @TaskInput({
     title: "源站类型",
     helper: "选择源站类型",
+    value: 1,
     component: {
       name: "a-select",
       vModel: "value",
@@ -95,7 +96,6 @@ export class VolcengineDeployToVOD extends AbstractTaskPlugin {
         { value: 1, label: "点播源站" },
         { value: 2, label: "自定义源站" },
       ],
-      value: 1,
       helper: "注意：封面加速域名不支持自定义源站",
     },
     required: false,

trigger/build.trigger

@@ -1 +1 @@
-21:30
+20:04

trigger/release.trigger

@@ -1 +1 @@
-23:15
+21:20