@cocreate/acme 1.3.2 → 1.4.1

package/.github/workflows/automated.yml

@@ -1,8 +1,10 @@
 name: Automated Workflow
+
 on:
   push:
     branches:
       - master
+
 jobs:
   about:
     runs-on: ubuntu-latest
@@ -18,27 +20,37 @@ jobs:
         with:
           direction: overwrite-github
           githubToken: "${{ secrets.GITHUB }}"
+
   release:
     runs-on: ubuntu-latest
     steps:
       - name: Checkout
-        uses: actions/checkout@v3
-      - name: Setup Node.js
-        uses: actions/setup-node@v3
+        uses: actions/checkout@v4
         with:
-          node-version: 14
-      - name: Semantic Release
-        uses: cycjimmy/semantic-release-action@v3
-        id: semantic
+          fetch-depth: 0 # Required so semantic-release can trace git tags/history
+
+      - name: Setup Node.js
+        uses: actions/setup-node@v4
         with:
-          extra_plugins: |
-            @semantic-release/changelog
+          node-version: 22
+
+      - name: Install Semantic Release & Plugins
+        # Installs semantic-release and its plugins on the runner
+        run: |
+          npm install -g semantic-release \
+            @semantic-release/changelog \
+            @semantic-release/npm \
+            @semantic-release/github \
             @semantic-release/git
-            @semantic-release/github
+
+      - name: Run Semantic Release (Native)
+        id: semantic
+        # This will automatically pick up your export default config file in the repository root
+        run: npx semantic-release
         env:
-          GITHUB_TOKEN: "${{ secrets.GITHUB }}"
+          GITHUB_TOKEN: "${{ secrets.GITHUB_TOKEN }}"
           NPM_TOKEN: "${{ secrets.NPM_TOKEN }}"
+
     outputs:
       new_release_published: "${{ steps.semantic.outputs.new_release_published }}"
-      new_release_version: "${{ steps.semantic.outputs.new_release_version }}"
-
+      new_release_version: "${{ steps.semantic.outputs.new_release_version }}"

package/.github/workflows/manual.yml

@@ -14,8 +14,7 @@ jobs:
         env:
             DRY_RUN: ${{ github.event.inputs.dry_run }}
             GITHUB_TOKEN: "${{ secrets.GITHUB }}"
-            NPM_TOKEN: "${{ secrets.NPM_TOKEN }}"
-
+  
         steps:
             - name: Checkout
               uses: actions/checkout@v3

package/CHANGELOG.md

@@ -1,3 +1,33 @@
+## [1.4.1](https://github.com/CoCreate-app/CoCreate-acme/compare/v1.4.0...v1.4.1) (2026-07-17)
+
+
+### Bug Fixes
+
+* bump dependencies ([a6c9134](https://github.com/CoCreate-app/CoCreate-acme/commit/a6c9134248057e7c99472f7c59f1a6b5db961784))
+* update acme-client dependency version to ^5.4.0 ([31be66c](https://github.com/CoCreate-app/CoCreate-acme/commit/31be66c2cfecb9fb82efd8e99d0e076fc4a178d5))
+
+# [1.4.0](https://github.com/CoCreate-app/CoCreate-acme/compare/v1.3.3...v1.4.0) (2026-07-17)
+
+
+### Bug Fixes
+
+* improve error handling and remove redundant server reference assignments in init function ([69831fe](https://github.com/CoCreate-app/CoCreate-acme/commit/69831fee351f103e60579b34bb915fbed655b3a1))
+
+
+### Features
+
+* update automated workflow and release configuration for improved semantic release handling ([90145c1](https://github.com/CoCreate-app/CoCreate-acme/commit/90145c12f6421d03cbb66d8f4b7c29891b1d2ef0))
+
+## [1.3.3](https://github.com/CoCreate-app/CoCreate-acme/compare/v1.3.2...v1.3.3) (2026-07-14)
+
+
+### Bug Fixes
+
+* removed post install ([cc2012f](https://github.com/CoCreate-app/CoCreate-acme/commit/cc2012f8ada625665074ecbaad14b895358a3ae7))
+* semantic version handling. Reorganize .gitignore for improved clarity and structure ([6e69e47](https://github.com/CoCreate-app/CoCreate-acme/commit/6e69e47e1643255a623bee33279320d0a825ce4f))
+* update module export to ES6 syntax in release.config.js ([5833855](https://github.com/CoCreate-app/CoCreate-acme/commit/58338552088e727bb7abbeb77107dcb87f82bfa5))
+* update package.json to use ESM and restructure server/client entry points ([6eb6796](https://github.com/CoCreate-app/CoCreate-acme/commit/6eb679673260922698716bf5e5e35a5044a1dbd1))
+
 ## [1.3.2](https://github.com/CoCreate-app/CoCreate-acme/compare/v1.3.1...v1.3.2) (2025-09-06)
 
 

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@cocreate/acme",
-  "version": "1.3.2",
+  "version": "1.4.1",
   "description": "Dynamic SSL certificate management leveraging the ACME protocol, designed for direct API accessibility within applications. Automates certificate creation, renewal, and retrieval, ideal for distributed applications requiring real-time, secure certificate operations.",
   "keywords": [
     "acme",
@@ -20,10 +20,9 @@
     "access": "public"
   },
   "scripts": {
-    "start": "npx webpack --config webpack.config.js",
-    "build": "npx webpack --mode=production --config webpack.config.js",
-    "dev": "npx webpack --config webpack.config.js --watch",
-    "postinstall": "node -e \"const { execSync } = require('child_process'); try { execSync('coc --version', { stdio: 'ignore' }); } catch (error) { try { execSync('npm install -g @cocreate/cli', { stdio: 'inherit' }); console.log('Installed \"@cocreate/cli\" globally.'); } catch (error) { console.error('Failed to install \"@cocreate/cli\" globally:', error); } }\""
+    "start": "webpack --config webpack.config.js",
+    "build": "webpack --mode=production --config webpack.config.js",
+    "dev": "webpack --config webpack.config.js --watch"
   },
   "repository": {
     "type": "git",
@@ -39,8 +38,9 @@
     "type": "GitHub Sponsors ❤",
     "url": "https://github.com/sponsors/CoCreate-app"
   },
+  "type": "module",
   "main": "./src/index.js",
   "dependencies": {
-    "acme-client": "^5.0.0"
+    "acme-client": "^5.4.0"
   }
 }

package/release.config.js

@@ -1,4 +1,4 @@
-module.exports = {
+export default {
   dryRun: false,
   branches: ["master"],
   plugins: [
@@ -10,12 +10,20 @@ module.exports = {
         changelogFile: "CHANGELOG.md",
       },
     ],
-    "@semantic-release/npm",
-    "@semantic-release/github",
+    "@semantic-release/npm", 
     [
-      "@semantic-release/git",
+      "@semantic-release/github", 
       {
+        successComment: false,
+        failTitle: false,
+      },
+    ],
+    [
+      "@semantic-release/git", 
+      {
+        // Only stage and commit the changelog and package.json
         assets: ["CHANGELOG.md", "package.json"],
+        message: "chore(release): ${nextRelease.version} [skip ci]",
       },
     ],
   ],

package/src/index.js

@@ -1,356 +1,325 @@
-const { Client, forge } = require("acme-client");
-const fs = require("fs");
-const util = require("node:util");
-const exec = util.promisify(require("node:child_process").exec);
-
+/********************************************************************************
+ * Copyright (C) 2023 CoCreate and Contributors.
+ *
+ * This program is free software: you can redistribute it and/or modify
+ * it under the terms of the GNU Affero General Public License as published
+ * by the Free Software Foundation, either version 3 of the License, or
+ * (at your option) any later version.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
+ * GNU Affero General Public License for more details.
+ *
+ * You should have received a copy of the GNU Affero General Public License
+ * along with this program. If not, see <https://www.gnu.org/licenses/>.
+ ********************************************************************************/
+
+import { Client, forge } from "acme-client";
+import fs from "fs";
+import tls from "tls";
+import { promisify } from "node:util";
+import { exec as childExec } from "node:child_process";
+
+const exec = promisify(childExec);
+
+// ==========================================
+// Module-Level Sandbox State (ESM Singleton Container)
+// ==========================================
+let server = null; // Direct reference used across all module functions
 const certificates = {};
 const email = "ssl@cocreate.app";
 const keyPath = "/etc/certificates/";
 let client;
 const hosts = {};
 
-// Run this once per server to generate random constants
-const DAYS = Math.floor(Math.random() * 7); // Random days between 0-6
-const HOURS = Math.floor(Math.random() * 24); // Random hours between 0-23
-const MINUTES = Math.floor(Math.random() * 60); // Random minutes between 0-59
-
-// Store these constants in a configuration file, environment variable, or database
-
-class CoCreateAcme {
-	constructor(proxy, crud) {
-		this.proxy = proxy;
-		this.crud = crud;
-		// this.check = this.checkCertificate
-		this.init().catch((err) => {
-			console.error("Error initializing ACME client:", err);
-			// TODO: Handle initialization error (possibly retry or exit)
-		});
-	}
-
-	async init() {
-		await exec("sudo mkdir -p /etc/certificates");
-		await exec("sudo chmod 777 /etc/certificates");
-
-		// if (!fs.existsSync(keyPath)) {
-		//     fs.mkdirSync(keyPath, { recursive: true }); // Create the directory if it doesn't exist
-		// }
-
-		const accountKeyPath = keyPath + "account.pem";
-
-		let accountKey = "";
-		let isNewAccount = false; // Flag to check if the account is new
-
-		// Check if the account key exists and load it; otherwise, create a new one
-		if (!fs.existsSync(accountKeyPath)) {
-			fs.writeFileSync(accountKeyPath, accountKey); // Store the account key
-			accountKey = await forge.createPrivateKey();
-			isNewAccount = true; // New account, so will need to register it
-			fs.writeFileSync(accountKeyPath, accountKey); // Store the account key
-			// fs.chmodSync(accountKeyPath, '400')
-		} else {
-			accountKey = fs.readFileSync(accountKeyPath, "utf8");
-		}
-
-		// Initialize the ACME client with the account key
-		client = new Client({
-			directoryUrl: "https://acme-v02.api.letsencrypt.org/directory", // https://acme-v02.api.letsencrypt.org/directory https://acme-staging-v02.api.letsencrypt.org/directory
-			accountKey: accountKey
-		});
-
-		// Register the new account if it was just created
-		if (isNewAccount) {
-			try {
-				// Attempt to create an account
-				await client.createAccount({
-					termsOfServiceAgreed: true,
-					contact: ["mailto:" + email]
-				});
-				console.log("ACME account created successfully!");
-			} catch (error) {
-				fs.unlinkSync(accountKeyPath);
-				// Handle errors that occur during account creation
-				console.error("Error creating ACME account:", error.message);
-				// Depending on the type of error, you might want to retry, log the error, alert someone, etc.
-			}
-		}
-	}
-
-	async requestCertificate(
-		host,
-		hostPosition,
-		hostObject,
-		organization_id,
-		wildcard = false
-	) {
-		try {
-			const self = this;
-
-			const hostKeyPath = keyPath + host + "/";
-			if (!fs.existsSync(hostKeyPath)) {
-				fs.mkdirSync(hostKeyPath, { recursive: true });
-			}
-
-			const domains = wildcard ? [host, `*.${host}`] : [host];
-
-			/* Create certificate request */
-			let [key, csr] = await forge.createCsr({
-				commonName: domains[0],
-				altNames: domains
-			});
-
-			let challenge_id = "";
-
-			/* Request certificate */
-			const cert = await client.auto({
-				csr,
-				email: [email], // Replace with your email
-				termsOfServiceAgreed: true,
-				challengeCreateFn: async (
-					authz,
-					challenge,
-					keyAuthorization
-				) => {
-					console.log(
-						`Challenge added for host: ${host} token: ${challenge.token}`
-					);
-
-					if (challenge.type === "http-01") {
-						const httpChallenge = await self.crud.send({
-							method: "object.create",
-							host,
-							array: "files",
-							object: {
-								"content-type": "text/plain",
-								directory: "acme-challenge",
-								host: [authz.identifier.value],
-								name: challenge.token,
-								organization_id: "652c8d62679eca03e0b116a7",
-								path: "/.well-known/acme-challenge/",
-								pathname: `/.well-known/acme-challenge/${challenge.token}`,
-								public: "true",
-								src: keyAuthorization
-							},
-							organization_id
-						});
-
-						if (
-							httpChallenge &&
-							httpChallenge.object &&
-							httpChallenge.object[0]
-						)
-							challenge_id = httpChallenge.object[0]._id;
-						else console.error("error creating challenge url");
-					} else if (challenge.type === "dns-01") {
-						// Calculate the DNS TXT record value
-						const dnsRecordName = `_acme-challenge.${authz.identifier.value}`;
-						const dnsRecordValue =
-							await client.getChallengeKeyAuthorization(
-								challenge
-							);
-
-						console.log(`Add this TXT record to your DNS:`);
-						console.log(`Name: ${dnsRecordName}`);
-						console.log(`Value: ${dnsRecordValue}`);
-
-						// Here, implement the logic to add the TXT record to your DNS
-						// await updateDnsTxtRecord(dnsRecordName, dnsRecordValue); // Hypothetical function to update DNS
-					}
-				},
-
-				challengeRemoveFn: async (
-					authz,
-					challenge,
-					keyAuthorization
-				) => {
-					/* Clean up challenge response here if necessary */
-					console.log(
-						`Challenge removed for token: ${challenge.token}`
-					);
-					if (challenge.type === "http-01") {
-						self.crud.send({
-							method: "object.delete",
-							host,
-							array: "files",
-							object: {
-								_id: challenge_id
-							},
-							organization_id
-						});
-					} else if (challenge.type === "dns-01") {
-						// await removeDnsTxtRecord(challenge); // A hypothetical function to clean up DNS
-					}
-				}
-			});
-
-			let expires = await forge.readCertificateInfo(cert);
-			expires = expires.notAfter;
-			this.setCertificate(
-				host,
-				expires,
-				organization_id,
-				hostKeyPath,
-				cert,
-				key
-			);
-
-			key = key.toString("utf8");
-
-			this.crud.send({
-				method: "object.update",
-				host,
-				array: "organizations",
-				object: {
-					_id: organization_id,
-					[`host[${hostPosition}]`]: {
-						...hostObject,
-						name: host,
-						cert,
-						key,
-						expires
-					}
-				},
-				organization_id
-			});
-
-			console.log(`Certificate successfully created for ${host}!'`);
-			return true;
-		} catch (error) {
-			console.log(`Certificate failed to create for ${host}!`);
-			delete hosts[host];
-			return false;
-		}
-	}
-
-	async getCertificate(host, organization_id) {
-		const hostKeyPath = keyPath + host + "/";
-		let hostPosition, hostObject;
-
-		let organization = await this.crud.getOrganization({
-			host,
-			organization_id
-		});
-		if (organization.error) return false;
-		if (!organization_id) organization_id = organization._id;
-
-		if (organization.host) {
-			for (let i = 0; i < organization.host.length; i++) {
-				if (organization.host[i].name === host) {
-					hostPosition = i;
-					hostObject = organization.host[i];
-					if (organization.host[i].cert && organization.host[i].key) {
-						let expires = await forge.readCertificateInfo(
-							organization.host[i].cert
-						);
-						expires = expires.notAfter;
-						if (this.isValid(expires)) {
-							this.setCertificate(
-								host,
-								expires,
-								organization_id,
-								hostKeyPath,
-								organization.host[i].cert,
-								organization.host[i].key
-							);
-							return true;
-						}
-					}
-					break;
-				}
-			}
-
-			if (!hostPosition && hostPosition !== 0) return false;
-		}
-
-		return await this.requestCertificate(
-			host,
-			hostPosition,
-			hostObject,
-			organization_id,
-			false
-		);
-	}
-
-	async checkCertificate(host, organization_id, pathname = "") {
-		let hostname = host.split(":")[0];
-		if (
-			hostname === "localhost" ||
-			hostname === "127.0.0.1" ||
-			pathname.startsWith("/.well-known/acme-challenge/")
-		)
-			return true;
-
-		if (certificates[host]) {
-			return true;
-		}
-
-		const hostKeyPath = keyPath + host + "/";
-		if (fs.existsSync(hostKeyPath + "fullchain.pem")) {
-			let cert = fs.readFileSync(hostKeyPath + "fullchain.pem", "utf8");
-			let expires = await forge.readCertificateInfo(cert);
-			expires = expires.notAfter;
-			if (this.isValid(expires)) {
-				this.setCertificate(host, expires, organization_id);
-				return true;
-			}
-		}
-
-		if (!hosts[host])
-			hosts[host] = await this.getCertificate(host, organization_id);
-		return hosts[host];
-	}
-
-	isValid(expires) {
-		let currentDate = new Date();
-		currentDate.setDate(currentDate.getDate() + DAYS);
-		currentDate.setHours(currentDate.getHours() + HOURS);
-		currentDate.setMinutes(currentDate.getMinutes() + MINUTES);
-
-		if (expires && currentDate < expires) {
-			return true; // SSL is still valid, no need to renew
-		}
-	}
-
-	setCertificate(host, expires, organization_id, hostKeyPath, cert, key) {
-		// let expireDate = new Date(expires);
-		// let currentDate = new Date();
-
-		// Adjust the expireDate by the DAYS, HOURS, and MINUTES constants
-		// expireDate.setDate(expireDate.getDate() - DAYS); // Subtracting to renew earlier
-		// expireDate.setHours(expireDate.getHours() - HOURS);
-		// expireDate.setMinutes(expireDate.getMinutes() - MINUTES);
-
-		// Calculate the time difference in milliseconds
-		// let timeoutDuration = expireDate.getTime() - currentDate.getTime();
-
-		// Ensure we're not setting a negative timeout in case of past dates or errors
-		// timeoutDuration = Math.max(timeoutDuration, 0);
-
-		// Clear any existing timeout for the host
-		// if (certificates[host] && certificates[host].timeout) {
-		//     clearTimeout(certificates[host].timeout);
-		// }
-
-		// Set the timeout to call checkCertificate before the actual expiration
-		// let timeout = setTimeout(() => {
-		//     this.checkCertificate(host, organization_id);
-		// }, timeoutDuration);
-
-		// Store the timeout and organization_id for later reference or cancellation
-
-		if (hostKeyPath) {
-			if (!fs.existsSync(hostKeyPath)) {
-				fs.mkdirSync(hostKeyPath, { recursive: true });
-			}
-			fs.writeFileSync(hostKeyPath + "fullchain.pem", cert);
-			// fs.chmodSync(keyPath + 'fullchain.pem', '444')
-			fs.writeFileSync(hostKeyPath + "private-key.pem", key);
-			// fs.chmodSync(keyPath + 'private-key.pem', '400')
-		}
-
-		this.proxy.createServer(host);
-
-		certificates[host] = { expires, organization_id };
-	}
+const DAYS = Math.floor(Math.random() * 7);
+const HOURS = Math.floor(Math.random() * 24);
+const MINUTES = Math.floor(Math.random() * 60);
+
+/**
+ * Bootstraps the ACME account keys, directories, and instantiates the
+ * secure HTTPS server context, attaching it back to the parent server reference.
+ * @param {Object} parentServer - Parent CoCreateServer singleton instance
+ */
+export async function init(parentServer) {
+    try {
+        server = parentServer;
+
+        await exec("sudo mkdir -p /etc/certificates");
+        await exec("sudo chmod 777 /etc/certificates");
+
+        const accountKeyPath = `${keyPath}account.pem`;
+        let accountKey = "";
+        let isNewAccount = false;
+
+        if (!fs.existsSync(accountKeyPath)) {
+            accountKey = await forge.createPrivateKey();
+            isNewAccount = true;
+            fs.writeFileSync(accountKeyPath, accountKey);
+        } else {
+            accountKey = fs.readFileSync(accountKeyPath, "utf8");
+        }
+
+        client = new Client({
+            directoryUrl: "https://acme-v02.api.letsencrypt.org/directory",
+            accountKey: accountKey
+        });
+
+        if (isNewAccount) {
+            try {
+                await client.createAccount({
+                    termsOfServiceAgreed: true,
+                    contact: [`mailto:${email}`]
+                });
+                console.log("[@cocreate/acme] ACME authority account created successfully!");
+            } catch (error) {
+                try {
+                    fs.unlinkSync(accountKeyPath);
+                } catch (_) {}
+                console.error("[@cocreate/acme] Error creating account credentials:", error.message);
+            }
+        }
+        
+           
+    } catch (err) {
+        console.error("[@cocreate/acme] Error initializing certificate client:", err);
+        throw err;
+    }
+}
+
+/**
+ * Interface Contract:
+ * Reads SSL credentials dynamically from the secure file system.
+ * @param {string} domain - Target host address
+ * @returns {{key: Buffer, cert: Buffer}} Native Node TLS credential buffer
+ */
+export function load(domain) {
+    try {
+        return {
+            key: fs.readFileSync(`${keyPath}${domain}/private-key.pem`),
+            cert: fs.readFileSync(`${keyPath}${domain}/fullchain.pem`),
+        };
+    } catch (error) {
+        console.error(`[@cocreate/acme] Error loading SSL certificates for domain: ${domain}`, error);
+        throw error;
+    }
+}
+
+/**
+ * Core SNI Handshake implementation. Resolves domains dynamically and loads TLS Context.
+ * @param {string} domain - Incoming target SNI hostname
+ * @param {Function} cb - Resolution completion callback
+ */
+export async function sniCallback(domain, cb) {
+    try {
+        // Verify domain authorization
+        const isValidDomain = await check(domain);
+        
+        if (isValidDomain) {
+            const credentials = load(domain);
+            const sslContext = tls.createSecureContext(credentials);
+            cb(null, sslContext);
+        } else {
+            cb(new Error(`[@cocreate/acme] Unauthorized secure request for domain: ${domain}`));
+        }
+    } catch (error) {
+        console.error(`[@cocreate/acme] Error in SNI callback for domain: ${domain}`, error);
+        cb(error);
+    }
+}
+
+/**
+ * Requests certificate generation dynamically via ACME protocols.
+ */
+export async function request(host, hostPosition, hostObject, organization_id, wildcard = false) {
+    try {
+        const hostKeyPath = `${keyPath}${host}/`;
+        
+        if (!fs.existsSync(hostKeyPath)) {
+            fs.mkdirSync(hostKeyPath, { recursive: true });
+        }
+
+        const domains = wildcard ? [host, `*.${host}`] : [host];
+        let [key, csr] = await forge.createCsr({ commonName: domains[0], altNames: domains });
+        let challenge_id = "";
+
+        const cert = await client.auto({
+            csr,
+            email: [email],
+            termsOfServiceAgreed: true,
+            challengeCreateFn: async (authz, challenge, keyAuthorization) => {
+                if (challenge.type === "http-01" && server && server.crud) {
+                    const httpChallenge = await server.crud.send({
+                        method: "object.create",
+                        host,
+                        array: "files",
+                        object: {
+                            "content-type": "text/plain",
+                            directory: "acme-challenge",
+                            host: [authz.identifier.value],
+                            name: challenge.token,
+                            organization_id: "652c8d62679eca03e0b116a7",
+                            path: "/.well-known/acme-challenge/",
+                            pathname: `/.well-known/acme-challenge/${challenge.token}`,
+                            public: "true",
+                            src: keyAuthorization
+                        },
+                        organization_id
+                    });
+                    if (httpChallenge?.object?.[0]) challenge_id = httpChallenge.object[0]._id;
+                }
+            },
+            challengeRemoveFn: async (authz, challenge, keyAuthorization) => {
+                if (challenge.type === "http-01" && server && server.crud) {
+                    server.crud.send({
+                        method: "object.delete",
+                        host,
+                        array: "files",
+                        object: { _id: challenge_id },
+                        organization_id
+                    });
+                }
+            }
+        });
+
+        let expires = await forge.readCertificateInfo(cert);
+        expires = expires.notAfter;
+        
+        set(host, expires, organization_id, hostKeyPath, cert, key);
+        key = key.toString("utf8");
+
+        if (server && server.crud) {
+            server.crud.send({
+                method: "object.update",
+                host,
+                array: "organizations",
+                object: {
+                    _id: organization_id,
+                    [`host[${hostPosition}]`]: { ...hostObject, name: host, cert, key, expires }
+                },
+                organization_id
+            });
+        }
+
+        return true;
+    } catch (error) {
+        console.error(`[@cocreate/acme] Certificate failed to create for ${host}!`, error);
+        delete hosts[host];
+        return false;
+    }
+}
+
+/**
+ * Resolves organization records and matches valid certificate credentials.
+ */
+export async function get(host, organization_id) {
+    const hostKeyPath = `${keyPath}${host}/`;
+    let hostPosition, hostObject;
+
+    if (!server || !server.crud) return false;
+
+    let organization;
+    try {
+        organization = await server.crud.getOrganization({ host, organization_id });
+    } catch (error) {
+        console.error(`[@cocreate/acme] Failed database lookup during organization query for ${host}:`, error.message);
+        return false;
+    }
+
+    // Safety check: Prevent TypeErrors if the DB yields undefined or returns an explicit error
+    if (!organization || organization.error) {
+        console.warn(`[@cocreate/acme] Organization query for host "${host}" returned empty or error state.`);
+        return false;
+    }
+
+    if (organization.host) {
+        for (let i = 0; i < organization.host.length; i++) {
+            if (organization.host[i].name === host) {
+                hostPosition = i;
+                hostObject = organization.host[i];
+                
+                if (organization.host[i].cert && organization.host[i].key) {
+                    let expires = await forge.readCertificateInfo(organization.host[i].cert);
+                    expires = expires.notAfter;
+                    
+                    if (isValid(expires)) {
+                        set(host, expires, organization_id, hostKeyPath, organization.host[i].cert, organization.host[i].key);
+                        return true;
+                    }
+                }
+                break;
+            }
+        }
+        if (!hostPosition && hostPosition !== 0) return false;
+    }
+
+    return await request(host, hostPosition, hostObject, organization_id, false);
+}
+
+/**
+ * Checks database registries or local systems to verify if a valid cert exists.
+ */
+export async function check(host, organization_id, pathname = "") {
+    let hostname = host.split(":")[0];
+    if (hostname === "localhost" || hostname === "127.0.0.1" || pathname.startsWith("/.well-known/acme-challenge/")) {
+        return true;
+    }
+    if (certificates[host]) return true;
+
+    const hostKeyPath = `${keyPath}${host}/`;
+    if (fs.existsSync(`${hostKeyPath}fullchain.pem`)) {
+        let cert = fs.readFileSync(`${hostKeyPath}fullchain.pem`, "utf8");
+        let expires = await forge.readCertificateInfo(cert);
+        expires = expires.notAfter;
+        
+        if (isValid(expires)) {
+            set(host, expires, organization_id);
+            return true;
+        }
+    }
+
+    if (!hosts[host]) hosts[host] = await get(host, organization_id);
+    return hosts[host];
+}
+
+/**
+ * Validates if a certificate has expired based on standard and randomized drift margins.
+ */
+export function isValid(expires) {
+    let currentDate = new Date();
+    currentDate.setDate(currentDate.getDate() + DAYS);
+    currentDate.setHours(currentDate.getHours() + HOURS);
+    currentDate.setMinutes(currentDate.getMinutes() + MINUTES);
+
+    return (expires && currentDate < expires);
+}
+
+/**
+ * Writes dynamic credentials to disk and triggers an update on the host ingress config if applicable.
+ */
+export function set(host, expires, organization_id, hostKeyPath, cert, key) {
+    if (hostKeyPath) {
+        if (!fs.existsSync(hostKeyPath)) fs.mkdirSync(hostKeyPath, { recursive: true });
+        fs.writeFileSync(`${hostKeyPath}fullchain.pem`, cert);
+        fs.writeFileSync(`${hostKeyPath}private-key.pem`, key);
+    }
+
+    // Safely bypassed if Nginx is entirely removed/omitted from this deployment
+    if (server && server.ingress && typeof server.ingress.createServer === "function") {
+        server.ingress.createServer(host);
+    }
+    certificates[host] = { expires, organization_id };
 }
 
-module.exports = CoCreateAcme;
+// Default export mimics the functional API entry point
+export default {
+    init,
+    load,
+    sniCallback,
+    request,
+    get,
+    check,
+    isValid,
+    set
+};