don't ignore .well-known (or any dot files)

lib/package-server.js

@@ -89,13 +89,18 @@ function loadPages(pkgConf, route, req, res, next) {
   if (!route._promise_app) {
     route._promise_app = new PromiseA(function (resolve, reject) {
       fs.exists(pkgpath, function (exists) {
+        var staticServer;
+
         if (!exists) {
           reject(new Error("package is registered but does not exist"));
           return;
         }
 
         //console.log('[static mount]', pkgpath);
-        resolve(require('serve-static')(pkgpath));
+        // https://github.com/expressjs/serve-static/issues/54
+        // https://example.com/.well-known/acme-challenge/xxxxxxxxxxxxxxx
+        staticServer = require('serve-static')(pkgpath, { dotfiles: 'allow' });
+        resolve(staticServer);
       });
     });
   }
@@ -374,10 +379,27 @@ function mapToApp(opts, req, res, next) {
     return;
   }
 
+  // TODO .well-known can be an API (webfinger, letsencrypt, oauth3)
+  // or static (...???)
+
   if (!router._re_api.test(req.url)) {
     //console.log('[static router]');
     //console.log(router._re_api, req.url);
-    layerItUp(pkgConf, router, req, res, next);
+    layerItUp(pkgConf, router, req, res, function (err) {
+      if (err) {
+        next(err);
+        return;
+      }
+
+      if (/\/\.well-known([\/?]|$)/.test(req.url)) {
+        console.log('[TODO] handle .well-known as API');
+        // rewrite api as /api/org.ietf/.well-known ?
+        // pass through simply as /.well-known ?
+        // runApi(opts, router, req, res, next)
+      }
+
+      next();
+    });
     return;
   }