certops 1.0.2 → 1.0.4

package/dist/api.js

@@ -15,13 +15,28 @@ export function createApiClient(options) {
         }
         return body.data;
     }
+    async function requestBinary(path) {
+        const res = await fetch(`${base}/api/cli${path}`, {
+            headers: { 'Authorization': `Bearer ${options.apiKey}` },
+        });
+        if (!res.ok) {
+            let msg = `HTTP ${res.status}`;
+            try {
+                const body = (await res.json());
+                msg = body.errors?.[0]?.message ?? msg;
+            }
+            catch { /* ignore */ }
+            throw new Error(msg);
+        }
+        return Buffer.from(await res.arrayBuffer());
+    }
     return {
         async listCerts() {
             const data = await request('/certs');
             return data.certs;
         },
         async downloadCert(id) {
-            return request(`/certs/${id}/download`);
+            return requestBinary(`/certs/${id}/download`);
         },
     };
 }

package/dist/commands/download.js

@@ -2,26 +2,28 @@ import { Command } from 'commander';
 import select from '@inquirer/select';
 import {} from '../api.js';
 import { getConfiguredClient } from '../client.js';
-import { saveCert } from '../files.js';
+import { saveZip } from '../files.js';
 async function performDownload(cert, client) {
     process.stdout.write(`\nDownloading ${cert.certName}…\n`);
-    const files = await client.downloadCert(cert._id);
-    const { certPath, keyPath } = await saveCert(files.certName, files.certPem, files.keyPem);
-    process.stdout.write(`  ✓ Certificate : ${certPath}\n`);
-    process.stdout.write(`  ✓ Private key : ${keyPath}\n`);
-    if (files.expiryDate) {
-        process.stdout.write(`  ✓ Expires     : ${new Date(files.expiryDate).toLocaleDateString()}\n`);
+    const zipBuffer = await client.downloadCert(cert._id);
+    const paths = await saveZip(cert.certName, zipBuffer);
+    process.stdout.write(`  ✓ Fullchain   : ${paths.fullchainPath}\n`);
+    process.stdout.write(`  ✓ Certificate : ${paths.certPath}\n`);
+    process.stdout.write(`  ✓ Chain       : ${paths.chainPath}\n`);
+    process.stdout.write(`  ✓ Private key : ${paths.keyPath}\n`);
+    if (cert.expiryDate) {
+        process.stdout.write(`  ✓ Expires     : ${new Date(cert.expiryDate).toLocaleDateString()}\n`);
     }
     process.stdout.write('\n');
 }
 export const downloadCommand = new Command('download')
-    .description('Download a certificate to /etc/certops/certs/<domain>/ — requires sudo')
-    .argument('[certName]', 'Certificate name, e.g. *.example.com (omit to pick interactively)')
+    .description('Download a certificate to /etc/certops/<domain>/ — requires sudo')
+    .argument('[certName]', 'Certificate name or identifier, e.g. *.example.com (omit to pick interactively)')
     .option('-i, --id <id>', 'Download by certificate ID')
     .addHelpText('after', `
 Examples:
   sudo certops download                         Interactive picker
-  sudo certops download '*.example.com'         By domain name
+  sudo certops download '*.example.com'         By domain name or identifier
   sudo certops download --id 6643abc...         By certificate ID
 `)
     .action(async (certName, opts) => {
@@ -44,10 +46,10 @@ Examples:
             return;
         }
         if (certName) {
-            const match = certs.find(c => c.certName === certName);
+            const match = certs.find(c => c.certName === certName || c.identifiers.includes(certName));
             if (!match) {
                 process.stderr.write(`\nError: no certificate found for "${certName}"\n`);
-                process.stderr.write('Run "sp list" to see available certificates.\n\n');
+                process.stderr.write('Run "certops list" to see available certificates.\n\n');
                 process.exit(1);
             }
             if (!DOWNLOADABLE.has(match.status)) {
@@ -65,13 +67,11 @@ Examples:
         const chosen = await select({
             message: 'Select a certificate to download:',
             choices: active.map(c => {
-                const expiry = c.expiryDate
-                    ? `expires ${new Date(c.expiryDate).toLocaleDateString()}`
-                    : 'no expiry';
+                const expiry = c.expiryDate ? `expires ${new Date(c.expiryDate).toLocaleDateString()}` : 'no expiry';
                 const renewingTag = c.status === 'renewing' ? ' [renewing]' : '';
-                const tag = c.certType === 'wildcard' ? ' [wildcard]' : c.certType === 'apex' ? ' [apex]' : '';
+                const wildcardTag = c.identifiers.some(id => id.startsWith('*.')) ? ' [wildcard]' : '';
                 return {
-                    name: `${c.certName}${tag}${renewingTag}  —  ${expiry}`,
+                    name: `${c.certName}${wildcardTag}${renewingTag}  —  ${expiry}`,
                     value: c,
                 };
             }),

package/dist/commands/list.js

@@ -1,5 +1,12 @@
 import { Command } from 'commander';
+import {} from '../api.js';
 import { getConfiguredClient } from '../client.js';
+function isWildcard(c) {
+    return c.identifiers?.some(id => id.startsWith('*.')) ?? false;
+}
+function typeTag(c) {
+    return isWildcard(c) ? '[wildcard]' : '[single]  ';
+}
 export const listCommand = new Command('list')
     .description('List all certificates in your organisation')
     .action(async () => {
@@ -14,21 +21,19 @@ export const listCommand = new Command('list')
         const inactive = certs.filter(c => c.status !== 'active');
         const maxLen = Math.max(...certs.map(c => c.certName.length), 10);
         const pad = (s, n) => s.padEnd(n);
-        const typeTag = (type) => type === 'wildcard' ? '[wildcard]' : type === 'apex' ? '[apex]    ' : '[single]  ';
         process.stdout.write(`\nFound ${certs.length} certificate(s)\n`);
         if (active.length > 0) {
             process.stdout.write(`\nACTIVE (${active.length})\n`);
             for (const c of active) {
-                const expiry = c.expiryDate
-                    ? `expires ${new Date(c.expiryDate).toLocaleDateString()}`
-                    : 'no expiry info';
-                process.stdout.write(`  ${pad(c.certName, maxLen)}  ${typeTag(c.certType)}  ${expiry}\n`);
+                const expiry = c.expiryDate ? `expires ${new Date(c.expiryDate).toLocaleDateString()}` : 'no expiry info';
+                const covered = c.coveredByWildcardId ? '  [covered by wildcard]' : '';
+                process.stdout.write(`  ${pad(c.certName, maxLen)}  ${typeTag(c)}  ${expiry}${covered}\n`);
             }
         }
         if (inactive.length > 0) {
             process.stdout.write(`\nOTHER (${inactive.length})\n`);
             for (const c of inactive) {
-                process.stdout.write(`  ${pad(c.certName, maxLen)}  ${typeTag(c.certType)}  ${c.status}\n`);
+                process.stdout.write(`  ${pad(c.certName, maxLen)}  ${typeTag(c)}  ${c.status}\n`);
             }
         }
         process.stdout.write('\n');

package/dist/commands/service/install.js

@@ -2,7 +2,7 @@ import { Command } from 'commander';
 import input from '@inquirer/input';
 import { writeFile, mkdir } from 'fs/promises';
 import { spawnSync } from 'child_process';
-import { readConfig, writeConfig, CERTS_DIR, HOOKS_DIR } from '../../config.js';
+import { readConfig, writeConfig, SSL_PILOT_DIR, HOOKS_DIR } from '../../config.js';
 import { domainHookPath, GLOBAL_HOOK } from '../../hooks.js';
 const UNIT_PATH = '/etc/systemd/system/certops.service';
 function buildUnitContent(apiKey) {
@@ -28,10 +28,12 @@ WantedBy=multi-user.target
 }
 const HOOK_TEMPLATE = `#!/usr/bin/env bash
 # Available env vars:
-#   SSL_PILOT_CERT_NAME  — certificate name (e.g. *.example.com)
-#   SSL_PILOT_DOMAIN     — domain without wildcard (e.g. example.com)
-#   SSL_PILOT_CERT_PATH  — path to certificate.crt
-#   SSL_PILOT_KEY_PATH   — path to private.key
+#   SSL_PILOT_CERT_NAME       — certificate name (e.g. *.example.com)
+#   SSL_PILOT_DOMAIN          — domain name (certName from API)
+#   SSL_PILOT_FULLCHAIN_PATH  — path to fullchain.pem
+#   SSL_PILOT_CERT_PATH       — path to cert.pem
+#   SSL_PILOT_CHAIN_PATH      — path to chain.pem
+#   SSL_PILOT_KEY_PATH        — path to privkey.pem
 
 # Example: reload nginx after cert update
 # systemctl reload nginx
@@ -49,7 +51,7 @@ export const installCommand = new Command('install')
         const existing = await readConfig();
         // API key — env takes precedence, otherwise prompt
         const apiKey = process.env['CERTOPS_API_KEY'] ?? await input({
-            message: 'SSL Pilot API key (sslpilot_...):',
+            message: 'API key (sslpilot_...):',
             validate: (v) => v.startsWith('sslpilot_') && v.length > 10
                 ? true
                 : 'Key must start with sslpilot_',
@@ -80,7 +82,7 @@ export const installCommand = new Command('install')
         };
         // Write config + create directories
         await writeConfig(config);
-        await mkdir(CERTS_DIR, { recursive: true });
+        await mkdir(SSL_PILOT_DIR, { recursive: true });
         await mkdir(HOOKS_DIR, { recursive: true });
         console.log('\n✓ Config written to /etc/certops/config.json');
         // Create hook stubs only if they don't exist yet

package/dist/commands/service/renew.js

@@ -1,5 +1,5 @@
 import { createApiClient } from '../../api.js';
-import { saveCert } from '../../files.js';
+import { saveZip } from '../../files.js';
 import { readConfig } from '../../config.js';
 import { readState, updateCertState } from '../../state.js';
 import { runHooks } from '../../hooks.js';
@@ -25,9 +25,9 @@ export async function runRenewalCycle(apiKey, log) {
     const client = createApiClient({ apiKey, apiUrl: config.apiUrl });
     const allCerts = await client.listCerts();
     const DOWNLOADABLE = new Set(['active', 'renewing']);
-    const certs = config.watchDomains.length > 0
+    const certs = (config.watchDomains.length > 0
         ? allCerts.filter(c => config.watchDomains.includes(c.certName))
-        : allCerts.filter(c => DOWNLOADABLE.has(c.status));
+        : allCerts.filter(c => DOWNLOADABLE.has(c.status))).filter(c => !c.coveredByWildcardId);
     const state = await readState();
     const thresholdMs = config.renewalThresholdDays * 24 * 60 * 60 * 1000;
     const maxRetries = Math.max(0, config.maxDownloadRetries);
@@ -61,15 +61,17 @@ export async function runRenewalCycle(apiKey, log) {
                 await sleep(delay);
             }
             try {
-                const files = await client.downloadCert(cert._id);
-                const { certPath, keyPath } = await saveCert(files.certName, files.certPem, files.keyPem);
-                log(`  cert : ${certPath}`);
-                log(`  key  : ${keyPath}`);
-                await updateCertState(cert.certName, files.expiryDate ?? cert.expiryDate ?? '');
+                const zipBuffer = await client.downloadCert(cert._id);
+                const paths = await saveZip(cert.certName, zipBuffer);
+                log(`  fullchain : ${paths.fullchainPath}`);
+                log(`  key       : ${paths.keyPath}`);
+                await updateCertState(cert.certName, cert.expiryDate ?? '');
                 await runHooks(cert.certName, {
-                    SSL_PILOT_DOMAIN: cert.certName.replace(/^\*\./, ''),
-                    SSL_PILOT_CERT_PATH: certPath,
-                    SSL_PILOT_KEY_PATH: keyPath,
+                    SSL_PILOT_DOMAIN: cert.certName,
+                    SSL_PILOT_FULLCHAIN_PATH: paths.fullchainPath,
+                    SSL_PILOT_CERT_PATH: paths.certPath,
+                    SSL_PILOT_CHAIN_PATH: paths.chainPath,
+                    SSL_PILOT_KEY_PATH: paths.keyPath,
                 }, log);
                 downloaded++;
                 lastError = undefined;

package/dist/config.js

@@ -1,7 +1,6 @@
 import { readFile, writeFile, mkdir } from 'fs/promises';
 import { join } from 'path';
 export const SSL_PILOT_DIR = '/etc/certops';
-export const CERTS_DIR = join(SSL_PILOT_DIR, 'certs');
 export const HOOKS_DIR = join(SSL_PILOT_DIR, 'hooks');
 const CONFIG_PATH = join(SSL_PILOT_DIR, 'config.json');
 const DEFAULTS = {

package/dist/files.js

@@ -1,42 +1,52 @@
 import { mkdir, writeFile, chmod } from 'fs/promises';
 import { join } from 'path';
-import { CERTS_DIR } from './config.js';
-function domainDir(certName) {
-    return join(CERTS_DIR, certName.replace(/^\*\./, ''));
-}
-export async function saveCert(certName, certPem, keyPem) {
-    const dir = domainDir(certName);
-    const certPath = join(dir, 'certificate.crt');
-    const keyPath = join(dir, 'private.key');
+import { unzipSync } from 'fflate';
+import { SSL_PILOT_DIR } from './config.js';
+export async function saveZip(certName, zipBuffer) {
+    const zipDirName = certName.replace(/^\*\./, 'wildcard.');
+    const dir = join(SSL_PILOT_DIR, zipDirName);
+    let entries;
     try {
-        await mkdir(dir, { recursive: true });
+        entries = unzipSync(new Uint8Array(zipBuffer));
     }
     catch (err) {
-        fsError(err, certName, dir);
+        throw new Error(`Failed to extract ZIP: ${err.message}`);
     }
+    const filemap = [
+        { key: 'fullchainPath', zipName: 'fullchain.pem', mode: 0o644 },
+        { key: 'certPath', zipName: 'cert.pem', mode: 0o644 },
+        { key: 'chainPath', zipName: 'chain.pem', mode: 0o644 },
+        { key: 'keyPath', zipName: 'privkey.pem', mode: 0o600 },
+    ];
     try {
-        await writeFile(certPath, certPem, 'utf8');
-        await chmod(certPath, 0o644);
+        await mkdir(dir, { recursive: true });
     }
     catch (err) {
-        fsError(err, certName, certPath);
-    }
-    try {
-        await writeFile(keyPath, keyPem, 'utf8');
-        await chmod(keyPath, 0o600);
+        fsError(err, certName, dir);
     }
-    catch (err) {
-        fsError(err, certName, keyPath);
+    const paths = {};
+    for (const { key, zipName, mode } of filemap) {
+        const data = entries[`${zipDirName}/${zipName}`];
+        if (!data)
+            throw new Error(`ZIP missing expected file: ${zipDirName}/${zipName}`);
+        const filePath = join(dir, zipName);
+        paths[key] = filePath;
+        try {
+            await writeFile(filePath, data);
+            await chmod(filePath, mode);
+        }
+        catch (err) {
+            fsError(err, certName, filePath);
+        }
     }
-    return { certPath, keyPath };
+    return paths;
 }
 function fsError(err, certName, path) {
     const e = err instanceof Error ? err : null;
     if (e?.code === 'EACCES' || e?.code === 'EPERM') {
-        const name = certName.startsWith('*.') ? `'${certName}'` : certName;
         process.stderr.write(`\nPermission denied: ${path}\n`);
-        process.stderr.write(`/etc/certops/certs requires root. Re-run:\n\n`);
-        process.stderr.write(`  sudo sp download ${name}\n\n`);
+        process.stderr.write(`/etc/certops requires root. Re-run:\n\n`);
+        process.stderr.write(`  sudo certops download '${certName}'\n\n`);
         process.exit(1);
     }
     throw err;

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "certops",
-  "version": "1.0.2",
+  "version": "1.0.4",
   "description": "SSL Pilot CLI — download and manage your SSL certificates",
   "type": "module",
   "files": [
@@ -20,7 +20,8 @@
   "dependencies": {
     "@inquirer/input": "^4.0.0",
     "@inquirer/select": "^4.0.0",
-    "commander": "^12.0.0"
+    "commander": "^12.0.0",
+    "fflate": "^0.8.0"
   },
   "devDependencies": {
     "@types/node": "^20.0.0",