@cocreate/acme 1.3.1 → 1.4.0

package/.github/workflows/automated.yml

@@ -1,8 +1,10 @@
 name: Automated Workflow
+
 on:
   push:
     branches:
       - master
+
 jobs:
   about:
     runs-on: ubuntu-latest
@@ -18,27 +20,37 @@ jobs:
         with:
           direction: overwrite-github
           githubToken: "${{ secrets.GITHUB }}"
+
   release:
     runs-on: ubuntu-latest
     steps:
       - name: Checkout
-        uses: actions/checkout@v3
-      - name: Setup Node.js
-        uses: actions/setup-node@v3
+        uses: actions/checkout@v4
         with:
-          node-version: 14
-      - name: Semantic Release
-        uses: cycjimmy/semantic-release-action@v3
-        id: semantic
+          fetch-depth: 0 # Required so semantic-release can trace git tags/history
+
+      - name: Setup Node.js
+        uses: actions/setup-node@v4
         with:
-          extra_plugins: |
-            @semantic-release/changelog
+          node-version: 22
+
+      - name: Install Semantic Release & Plugins
+        # Installs semantic-release and its plugins on the runner
+        run: |
+          npm install -g semantic-release \
+            @semantic-release/changelog \
+            @semantic-release/npm \
+            @semantic-release/github \
             @semantic-release/git
-            @semantic-release/github
+
+      - name: Run Semantic Release (Native)
+        id: semantic
+        # This will automatically pick up your export default config file in the repository root
+        run: npx semantic-release
         env:
-          GITHUB_TOKEN: "${{ secrets.GITHUB }}"
+          GITHUB_TOKEN: "${{ secrets.GITHUB_TOKEN }}"
           NPM_TOKEN: "${{ secrets.NPM_TOKEN }}"
+
     outputs:
       new_release_published: "${{ steps.semantic.outputs.new_release_published }}"
-      new_release_version: "${{ steps.semantic.outputs.new_release_version }}"
-
+      new_release_version: "${{ steps.semantic.outputs.new_release_version }}"

package/.github/workflows/manual.yml

@@ -14,8 +14,7 @@ jobs:
         env:
             DRY_RUN: ${{ github.event.inputs.dry_run }}
             GITHUB_TOKEN: "${{ secrets.GITHUB }}"
-            NPM_TOKEN: "${{ secrets.NPM_TOKEN }}"
-
+  
         steps:
             - name: Checkout
               uses: actions/checkout@v3

package/CHANGELOG.md

@@ -1,3 +1,33 @@
+# [1.4.0](https://github.com/CoCreate-app/CoCreate-acme/compare/v1.3.3...v1.4.0) (2026-07-17)
+
+
+### Bug Fixes
+
+* improve error handling and remove redundant server reference assignments in init function ([69831fe](https://github.com/CoCreate-app/CoCreate-acme/commit/69831fee351f103e60579b34bb915fbed655b3a1))
+
+
+### Features
+
+* update automated workflow and release configuration for improved semantic release handling ([90145c1](https://github.com/CoCreate-app/CoCreate-acme/commit/90145c12f6421d03cbb66d8f4b7c29891b1d2ef0))
+
+## [1.3.3](https://github.com/CoCreate-app/CoCreate-acme/compare/v1.3.2...v1.3.3) (2026-07-14)
+
+
+### Bug Fixes
+
+* removed post install ([cc2012f](https://github.com/CoCreate-app/CoCreate-acme/commit/cc2012f8ada625665074ecbaad14b895358a3ae7))
+* semantic version handling. Reorganize .gitignore for improved clarity and structure ([6e69e47](https://github.com/CoCreate-app/CoCreate-acme/commit/6e69e47e1643255a623bee33279320d0a825ce4f))
+* update module export to ES6 syntax in release.config.js ([5833855](https://github.com/CoCreate-app/CoCreate-acme/commit/58338552088e727bb7abbeb77107dcb87f82bfa5))
+* update package.json to use ESM and restructure server/client entry points ([6eb6796](https://github.com/CoCreate-app/CoCreate-acme/commit/6eb679673260922698716bf5e5e35a5044a1dbd1))
+
+## [1.3.2](https://github.com/CoCreate-app/CoCreate-acme/compare/v1.3.1...v1.3.2) (2025-09-06)
+
+
+### Bug Fixes
+
+* await async function calls ([cf151f1](https://github.com/CoCreate-app/CoCreate-acme/commit/cf151f186b4893411f273a6a3e3f08b87093b72c))
+* formating ([bcce249](https://github.com/CoCreate-app/CoCreate-acme/commit/bcce24906478e43aa4b1845c9f9099623551128e))
+
 ## [1.3.1](https://github.com/CoCreate-app/CoCreate-acme/compare/v1.3.0...v1.3.1) (2025-05-01)
 
 

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@cocreate/acme",
-  "version": "1.3.1",
+  "version": "1.4.0",
   "description": "Dynamic SSL certificate management leveraging the ACME protocol, designed for direct API accessibility within applications. Automates certificate creation, renewal, and retrieval, ideal for distributed applications requiring real-time, secure certificate operations.",
   "keywords": [
     "acme",
@@ -22,8 +22,7 @@
   "scripts": {
     "start": "npx webpack --config webpack.config.js",
     "build": "npx webpack --mode=production --config webpack.config.js",
-    "dev": "npx webpack --config webpack.config.js --watch",
-    "postinstall": "node -e \"const { execSync } = require('child_process'); try { execSync('coc --version', { stdio: 'ignore' }); } catch (error) { try { execSync('npm install -g @cocreate/cli', { stdio: 'inherit' }); console.log('Installed \"@cocreate/cli\" globally.'); } catch (error) { console.error('Failed to install \"@cocreate/cli\" globally:', error); } }\""
+    "dev": "npx webpack --config webpack.config.js --watch"
   },
   "repository": {
     "type": "git",
@@ -39,6 +38,7 @@
     "type": "GitHub Sponsors ❤",
     "url": "https://github.com/sponsors/CoCreate-app"
   },
+  "type": "module",
   "main": "./src/index.js",
   "dependencies": {
     "acme-client": "^5.0.0"

package/release.config.js

@@ -1,4 +1,4 @@
-module.exports = {
+export default {
   dryRun: false,
   branches: ["master"],
   plugins: [
@@ -10,12 +10,20 @@ module.exports = {
         changelogFile: "CHANGELOG.md",
       },
     ],
-    "@semantic-release/npm",
-    "@semantic-release/github",
+    "@semantic-release/npm", 
     [
-      "@semantic-release/git",
+      "@semantic-release/github", 
       {
+        successComment: false,
+        failTitle: false,
+      },
+    ],
+    [
+      "@semantic-release/git", 
+      {
+        // Only stage and commit the changelog and package.json
         assets: ["CHANGELOG.md", "package.json"],
+        message: "chore(release): ${nextRelease.version} [skip ci]",
       },
     ],
   ],

package/src/index.js

@@ -1,310 +1,325 @@
-const { Client, forge } = require('acme-client');
-const fs = require('fs');
-const util = require('node:util');
-const exec = util.promisify(require('node:child_process').exec);
-
-const certificates = {}
-const email = 'ssl@cocreate.app';
-const keyPath = '/etc/certificates/';
-let client
-const hosts = {}
-
-// Run this once per server to generate random constants
-const DAYS = Math.floor(Math.random() * 7);  // Random days between 0-6
-const HOURS = Math.floor(Math.random() * 24);  // Random hours between 0-23
-const MINUTES = Math.floor(Math.random() * 60);  // Random minutes between 0-59
-
-// Store these constants in a configuration file, environment variable, or database
-
-class CoCreateAcme {
-    constructor(proxy, crud) {
-        this.proxy = proxy
-        this.crud = crud
-        // this.check = this.checkCertificate
-        this.init().catch(err => {
-            console.error('Error initializing ACME client:', err);
-            // TODO: Handle initialization error (possibly retry or exit)
-        });
-
-    }
-
-    async init() {
-        await exec('sudo mkdir -p /etc/certificates');
-        await exec('sudo chmod 777 /etc/certificates');
+/********************************************************************************
+ * Copyright (C) 2023 CoCreate and Contributors.
+ *
+ * This program is free software: you can redistribute it and/or modify
+ * it under the terms of the GNU Affero General Public License as published
+ * by the Free Software Foundation, either version 3 of the License, or
+ * (at your option) any later version.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
+ * GNU Affero General Public License for more details.
+ *
+ * You should have received a copy of the GNU Affero General Public License
+ * along with this program. If not, see <https://www.gnu.org/licenses/>.
+ ********************************************************************************/
+
+import { Client, forge } from "acme-client";
+import fs from "fs";
+import tls from "tls";
+import { promisify } from "node:util";
+import { exec as childExec } from "node:child_process";
+
+const exec = promisify(childExec);
+
+// ==========================================
+// Module-Level Sandbox State (ESM Singleton Container)
+// ==========================================
+let server = null; // Direct reference used across all module functions
+const certificates = {};
+const email = "ssl@cocreate.app";
+const keyPath = "/etc/certificates/";
+let client;
+const hosts = {};
+
+const DAYS = Math.floor(Math.random() * 7);
+const HOURS = Math.floor(Math.random() * 24);
+const MINUTES = Math.floor(Math.random() * 60);
+
+/**
+ * Bootstraps the ACME account keys, directories, and instantiates the
+ * secure HTTPS server context, attaching it back to the parent server reference.
+ * @param {Object} parentServer - Parent CoCreateServer singleton instance
+ */
+export async function init(parentServer) {
+    try {
+        server = parentServer;
+
+        await exec("sudo mkdir -p /etc/certificates");
+        await exec("sudo chmod 777 /etc/certificates");
+
+        const accountKeyPath = `${keyPath}account.pem`;
+        let accountKey = "";
+        let isNewAccount = false;
 
-        // if (!fs.existsSync(keyPath)) {
-        //     fs.mkdirSync(keyPath, { recursive: true }); // Create the directory if it doesn't exist
-        // }
-
-        const accountKeyPath = keyPath + 'account.pem';
-
-        let accountKey = '';
-        let isNewAccount = false; // Flag to check if the account is new
-
-        // Check if the account key exists and load it; otherwise, create a new one
         if (!fs.existsSync(accountKeyPath)) {
-            fs.writeFileSync(accountKeyPath, accountKey); // Store the account key
             accountKey = await forge.createPrivateKey();
-            isNewAccount = true; // New account, so will need to register it
-            fs.writeFileSync(accountKeyPath, accountKey); // Store the account key
-            // fs.chmodSync(accountKeyPath, '400')
+            isNewAccount = true;
+            fs.writeFileSync(accountKeyPath, accountKey);
         } else {
-            accountKey = fs.readFileSync(accountKeyPath, 'utf8');
+            accountKey = fs.readFileSync(accountKeyPath, "utf8");
         }
 
-        // Initialize the ACME client with the account key
         client = new Client({
-            directoryUrl: 'https://acme-v02.api.letsencrypt.org/directory', // https://acme-v02.api.letsencrypt.org/directory https://acme-staging-v02.api.letsencrypt.org/directory
+            directoryUrl: "https://acme-v02.api.letsencrypt.org/directory",
             accountKey: accountKey
         });
 
-        // Register the new account if it was just created
         if (isNewAccount) {
             try {
-                // Attempt to create an account
                 await client.createAccount({
                     termsOfServiceAgreed: true,
-                    contact: ['mailto:' + email]
+                    contact: [`mailto:${email}`]
                 });
-                console.log("ACME account created successfully!");
+                console.log("[@cocreate/acme] ACME authority account created successfully!");
             } catch (error) {
-                fs.unlinkSync(accountKeyPath)
-                // Handle errors that occur during account creation
-                console.error("Error creating ACME account:", error.message);
-                // Depending on the type of error, you might want to retry, log the error, alert someone, etc.
+                try {
+                    fs.unlinkSync(accountKeyPath);
+                } catch (_) {}
+                console.error("[@cocreate/acme] Error creating account credentials:", error.message);
             }
         }
+        
+           
+    } catch (err) {
+        console.error("[@cocreate/acme] Error initializing certificate client:", err);
+        throw err;
     }
+}
 
-    async requestCertificate(host, hostPosition, hostObject, organization_id, wildcard = false) {
-        try {
-
-            const self = this
-
-            const hostKeyPath = keyPath + host + '/';
-            if (!fs.existsSync(hostKeyPath)) {
-                fs.mkdirSync(hostKeyPath, { recursive: true });
-            }
-
-            const domains = wildcard ? [host, `*.${host}`] : [host];
-
-            /* Create certificate request */
-            let [key, csr] = await forge.createCsr({
-                commonName: domains[0],
-                altNames: domains
-            });
-
-            let challenge_id = ''
-
-            /* Request certificate */
-            const cert = await client.auto({
-                csr,
-                email: [email], // Replace with your email
-                termsOfServiceAgreed: true,
-                challengeCreateFn: async (authz, challenge, keyAuthorization) => {
-                    console.log(`Challenge added for host: ${host} token: ${challenge.token}`);
-
-                    if (challenge.type === 'http-01') {
-                        const httpChallenge = await self.crud.send({
-                            method: 'object.create',
-                            host,
-                            array: 'files',
-                            object: {
-                                "content-type": "text/plain",
-                                "directory": "acme-challenge",
-                                "host": [
-                                    authz.identifier.value
-                                ],
-                                "name": challenge.token,
-                                "organization_id": "652c8d62679eca03e0b116a7",
-                                "path": "/.well-known/acme-challenge/",
-                                "pathname": `/.well-known/acme-challenge/${challenge.token}`,
-                                "public": "true",
-                                "src": keyAuthorization
-                            },
-                            organization_id,
-                        });
-
-                        if (httpChallenge && httpChallenge.object && httpChallenge.object[0])
-                            challenge_id = httpChallenge.object[0]._id
-                        else
-                            console.error('error creating challenge url')
-
-                    } else if (challenge.type === 'dns-01') {
-                        // Calculate the DNS TXT record value
-                        const dnsRecordName = `_acme-challenge.${authz.identifier.value}`;
-                        const dnsRecordValue = await client.getChallengeKeyAuthorization(challenge);
-
-                        console.log(`Add this TXT record to your DNS:`);
-                        console.log(`Name: ${dnsRecordName}`);
-                        console.log(`Value: ${dnsRecordValue}`);
-
-                        // Here, implement the logic to add the TXT record to your DNS
-                        // await updateDnsTxtRecord(dnsRecordName, dnsRecordValue); // Hypothetical function to update DNS
-                    }
+/**
+ * Interface Contract:
+ * Reads SSL credentials dynamically from the secure file system.
+ * @param {string} domain - Target host address
+ * @returns {{key: Buffer, cert: Buffer}} Native Node TLS credential buffer
+ */
+export function load(domain) {
+    try {
+        return {
+            key: fs.readFileSync(`${keyPath}${domain}/private-key.pem`),
+            cert: fs.readFileSync(`${keyPath}${domain}/fullchain.pem`),
+        };
+    } catch (error) {
+        console.error(`[@cocreate/acme] Error loading SSL certificates for domain: ${domain}`, error);
+        throw error;
+    }
+}
 
-                },
+/**
+ * Core SNI Handshake implementation. Resolves domains dynamically and loads TLS Context.
+ * @param {string} domain - Incoming target SNI hostname
+ * @param {Function} cb - Resolution completion callback
+ */
+export async function sniCallback(domain, cb) {
+    try {
+        // Verify domain authorization
+        const isValidDomain = await check(domain);
+        
+        if (isValidDomain) {
+            const credentials = load(domain);
+            const sslContext = tls.createSecureContext(credentials);
+            cb(null, sslContext);
+        } else {
+            cb(new Error(`[@cocreate/acme] Unauthorized secure request for domain: ${domain}`));
+        }
+    } catch (error) {
+        console.error(`[@cocreate/acme] Error in SNI callback for domain: ${domain}`, error);
+        cb(error);
+    }
+}
 
-                challengeRemoveFn: async (authz, challenge, keyAuthorization) => {
-                    /* Clean up challenge response here if necessary */
-                    console.log(`Challenge removed for token: ${challenge.token}`);
-                    if (challenge.type === 'http-01') {
-                        self.crud.send({
-                            method: 'object.delete',
-                            host,
-                            array: 'files',
-                            object: {
-                                _id: challenge_id
-                            },
-                            organization_id,
-                        });
-                    } else if (challenge.type === 'dns-01') {
-                        // await removeDnsTxtRecord(challenge); // A hypothetical function to clean up DNS
-                    }
+/**
+ * Requests certificate generation dynamically via ACME protocols.
+ */
+export async function request(host, hostPosition, hostObject, organization_id, wildcard = false) {
+    try {
+        const hostKeyPath = `${keyPath}${host}/`;
+        
+        if (!fs.existsSync(hostKeyPath)) {
+            fs.mkdirSync(hostKeyPath, { recursive: true });
+        }
 
+        const domains = wildcard ? [host, `*.${host}`] : [host];
+        let [key, csr] = await forge.createCsr({ commonName: domains[0], altNames: domains });
+        let challenge_id = "";
+
+        const cert = await client.auto({
+            csr,
+            email: [email],
+            termsOfServiceAgreed: true,
+            challengeCreateFn: async (authz, challenge, keyAuthorization) => {
+                if (challenge.type === "http-01" && server && server.crud) {
+                    const httpChallenge = await server.crud.send({
+                        method: "object.create",
+                        host,
+                        array: "files",
+                        object: {
+                            "content-type": "text/plain",
+                            directory: "acme-challenge",
+                            host: [authz.identifier.value],
+                            name: challenge.token,
+                            organization_id: "652c8d62679eca03e0b116a7",
+                            path: "/.well-known/acme-challenge/",
+                            pathname: `/.well-known/acme-challenge/${challenge.token}`,
+                            public: "true",
+                            src: keyAuthorization
+                        },
+                        organization_id
+                    });
+                    if (httpChallenge?.object?.[0]) challenge_id = httpChallenge.object[0]._id;
                 }
-            });
-
-            let expires = await forge.readCertificateInfo(cert);
-            expires = expires.notAfter;
-            this.setCertificate(host, expires, organization_id, hostKeyPath, cert, key)
+            },
+            challengeRemoveFn: async (authz, challenge, keyAuthorization) => {
+                if (challenge.type === "http-01" && server && server.crud) {
+                    server.crud.send({
+                        method: "object.delete",
+                        host,
+                        array: "files",
+                        object: { _id: challenge_id },
+                        organization_id
+                    });
+                }
+            }
+        });
 
-            key = key.toString('utf8');
+        let expires = await forge.readCertificateInfo(cert);
+        expires = expires.notAfter;
+        
+        set(host, expires, organization_id, hostKeyPath, cert, key);
+        key = key.toString("utf8");
 
-            this.crud.send({
-                method: 'object.update',
+        if (server && server.crud) {
+            server.crud.send({
+                method: "object.update",
                 host,
-                array: 'organizations',
+                array: "organizations",
                 object: {
                     _id: organization_id,
-                    [`host[${hostPosition}]`]: { ...hostObject, name: host, cert, key, expires },
+                    [`host[${hostPosition}]`]: { ...hostObject, name: host, cert, key, expires }
                 },
                 organization_id
             });
-
-            console.log(`Certificate successfully created for ${host}!'`);
-            return true
-        } catch (error) {
-            console.log(`Certificate failed to create for ${host}!`);
-            delete hosts[host]
-            return false
         }
 
+        return true;
+    } catch (error) {
+        console.error(`[@cocreate/acme] Certificate failed to create for ${host}!`, error);
+        delete hosts[host];
+        return false;
     }
+}
 
-    async getCertificate(host, organization_id) {
-        const hostKeyPath = keyPath + host + '/';
-        let hostPosition, hostObject
-
-        let organization = await this.crud.getOrganization({ host, organization_id });
-        if (organization.error)
-            return false
-        if (!organization_id)
-            organization_id = organization._id
-
-        if (organization.host) {
-            for (let i = 0; i < organization.host.length; i++) {
-                if (organization.host[i].name === host) {
-                    hostPosition = i
-                    hostObject = organization.host[i]
-                    if (organization.host[i].cert && organization.host[i].key) {
-                        let expires = await forge.readCertificateInfo(organization.host[i].cert);
-                        expires = expires.notAfter;
-                        if (this.isValid(expires)) {
-                            this.setCertificate(host, expires, organization_id, hostKeyPath, organization.host[i].cert, organization.host[i].key)
-                            return true
-                        }
-                    }
-                    break
-                }
-            }
-
-            if (!hostPosition && hostPosition !== 0)
-                return false
-        }
-
-        return await this.requestCertificate(host, hostPosition, hostObject, organization_id, false)
+/**
+ * Resolves organization records and matches valid certificate credentials.
+ */
+export async function get(host, organization_id) {
+    const hostKeyPath = `${keyPath}${host}/`;
+    let hostPosition, hostObject;
+
+    if (!server || !server.crud) return false;
+
+    let organization;
+    try {
+        organization = await server.crud.getOrganization({ host, organization_id });
+    } catch (error) {
+        console.error(`[@cocreate/acme] Failed database lookup during organization query for ${host}:`, error.message);
+        return false;
     }
 
-    async checkCertificate(host, organization_id, pathname = '') {
-        let hostname = host.split(':')[0]
-        if (hostname === 'localhost' || hostname === '127.0.0.1' || pathname.startsWith('/.well-known/acme-challenge/'))
-            return true
-
-        if (certificates[host]) {
-            return true
-        }
+    // Safety check: Prevent TypeErrors if the DB yields undefined or returns an explicit error
+    if (!organization || organization.error) {
+        console.warn(`[@cocreate/acme] Organization query for host "${host}" returned empty or error state.`);
+        return false;
+    }
 
-        const hostKeyPath = keyPath + host + '/';
-        if (fs.existsSync(hostKeyPath + 'fullchain.pem')) {
-            let cert = fs.readFileSync(hostKeyPath + 'fullchain.pem', 'utf8');
-            let expires = await forge.readCertificateInfo(cert);
-            expires = expires.notAfter;
-            if (this.isValid(expires)) {
-                this.setCertificate(host, expires, organization_id)
-                return true
+    if (organization.host) {
+        for (let i = 0; i < organization.host.length; i++) {
+            if (organization.host[i].name === host) {
+                hostPosition = i;
+                hostObject = organization.host[i];
+                
+                if (organization.host[i].cert && organization.host[i].key) {
+                    let expires = await forge.readCertificateInfo(organization.host[i].cert);
+                    expires = expires.notAfter;
+                    
+                    if (isValid(expires)) {
+                        set(host, expires, organization_id, hostKeyPath, organization.host[i].cert, organization.host[i].key);
+                        return true;
+                    }
+                }
+                break;
             }
         }
-
-        if (!hosts[host])
-            hosts[host] = this.getCertificate(host, organization_id)
-        return hosts[host]
+        if (!hostPosition && hostPosition !== 0) return false;
     }
 
-    isValid(expires) {
-        let currentDate = new Date();
-        currentDate.setDate(currentDate.getDate() + DAYS);
-        currentDate.setHours(currentDate.getHours() + HOURS);
-        currentDate.setMinutes(currentDate.getMinutes() + MINUTES);
+    return await request(host, hostPosition, hostObject, organization_id, false);
+}
 
-        if (expires && currentDate < expires) {
-            return true; // SSL is still valid, no need to renew
+/**
+ * Checks database registries or local systems to verify if a valid cert exists.
+ */
+export async function check(host, organization_id, pathname = "") {
+    let hostname = host.split(":")[0];
+    if (hostname === "localhost" || hostname === "127.0.0.1" || pathname.startsWith("/.well-known/acme-challenge/")) {
+        return true;
+    }
+    if (certificates[host]) return true;
+
+    const hostKeyPath = `${keyPath}${host}/`;
+    if (fs.existsSync(`${hostKeyPath}fullchain.pem`)) {
+        let cert = fs.readFileSync(`${hostKeyPath}fullchain.pem`, "utf8");
+        let expires = await forge.readCertificateInfo(cert);
+        expires = expires.notAfter;
+        
+        if (isValid(expires)) {
+            set(host, expires, organization_id);
+            return true;
         }
     }
 
-    setCertificate(host, expires, organization_id, hostKeyPath, cert, key) {
-        // let expireDate = new Date(expires);
-        // let currentDate = new Date();
-
-        // Adjust the expireDate by the DAYS, HOURS, and MINUTES constants
-        // expireDate.setDate(expireDate.getDate() - DAYS); // Subtracting to renew earlier
-        // expireDate.setHours(expireDate.getHours() - HOURS);
-        // expireDate.setMinutes(expireDate.getMinutes() - MINUTES);
-
-        // Calculate the time difference in milliseconds
-        // let timeoutDuration = expireDate.getTime() - currentDate.getTime();
-
-        // Ensure we're not setting a negative timeout in case of past dates or errors
-        // timeoutDuration = Math.max(timeoutDuration, 0);
-
-        // Clear any existing timeout for the host
-        // if (certificates[host] && certificates[host].timeout) {
-        //     clearTimeout(certificates[host].timeout);
-        // }
-
-        // Set the timeout to call checkCertificate before the actual expiration
-        // let timeout = setTimeout(() => {
-        //     this.checkCertificate(host, organization_id);
-        // }, timeoutDuration);
-
-        // Store the timeout and organization_id for later reference or cancellation
-
-        if (hostKeyPath) {
-            if (!fs.existsSync(hostKeyPath)) {
-                fs.mkdirSync(hostKeyPath, { recursive: true });
-            }
-            fs.writeFileSync(hostKeyPath + 'fullchain.pem', cert);
-            // fs.chmodSync(keyPath + 'fullchain.pem', '444')
-            fs.writeFileSync(hostKeyPath + 'private-key.pem', key);
-            // fs.chmodSync(keyPath + 'private-key.pem', '400')
-        }
+    if (!hosts[host]) hosts[host] = await get(host, organization_id);
+    return hosts[host];
+}
 
-        this.proxy.createServer(host)
+/**
+ * Validates if a certificate has expired based on standard and randomized drift margins.
+ */
+export function isValid(expires) {
+    let currentDate = new Date();
+    currentDate.setDate(currentDate.getDate() + DAYS);
+    currentDate.setHours(currentDate.getHours() + HOURS);
+    currentDate.setMinutes(currentDate.getMinutes() + MINUTES);
 
-        certificates[host] = { expires, organization_id }
+    return (expires && currentDate < expires);
+}
 
+/**
+ * Writes dynamic credentials to disk and triggers an update on the host ingress config if applicable.
+ */
+export function set(host, expires, organization_id, hostKeyPath, cert, key) {
+    if (hostKeyPath) {
+        if (!fs.existsSync(hostKeyPath)) fs.mkdirSync(hostKeyPath, { recursive: true });
+        fs.writeFileSync(`${hostKeyPath}fullchain.pem`, cert);
+        fs.writeFileSync(`${hostKeyPath}private-key.pem`, key);
     }
 
+    // Safely bypassed if Nginx is entirely removed/omitted from this deployment
+    if (server && server.ingress && typeof server.ingress.createServer === "function") {
+        server.ingress.createServer(host);
+    }
+    certificates[host] = { expires, organization_id };
 }
 
-module.exports = CoCreateAcme;
+// Default export mimics the functional API entry point
+export default {
+    init,
+    load,
+    sniCallback,
+    request,
+    get,
+    check,
+    isValid,
+    set
+};