certops 1.0.2 → 1.0.6

package/dist/api.js

@@ -1,27 +1,57 @@
 export function createApiClient(options) {
     const base = (options.apiUrl ?? 'https://ssl-manager.dcom.at').replace(/\/$/, '');
+    const baseHeaders = {
+        'Authorization': `Bearer ${options.apiKey}`,
+        'X-CLI-Version': options.cliVersion,
+    };
+    function handleErrorResponse(status, errors) {
+        const code = errors?.[0]?.code;
+        const msg = errors?.[0]?.message ?? `HTTP ${status}`;
+        if (status === 426 || code === 'CLI_UPDATE_REQUIRED') {
+            throw new Error(`Your certops CLI is out of date (current: v${options.cliVersion}).\n\n` +
+                `  Update now:\n` +
+                `    npm install -g certops@latest\n`);
+        }
+        if (status === 400 && code === 'INVALID_CLI_VERSION') {
+            throw new Error(`Server rejected CLI version header (sent: v${options.cliVersion}).\n\n` +
+                `  Update now:\n` +
+                `    npm install -g certops@latest\n`);
+        }
+        throw new Error(msg);
+    }
     async function request(path) {
         const res = await fetch(`${base}/api/cli${path}`, {
-            headers: {
-                'Authorization': `Bearer ${options.apiKey}`,
-                'Content-Type': 'application/json',
-            },
+            headers: { ...baseHeaders, 'Content-Type': 'application/json' },
         });
         const body = (await res.json());
         if (!res.ok || 'errors' in body) {
             const errBody = body;
-            const msg = errBody.errors?.[0]?.message ?? `HTTP ${res.status}`;
-            throw new Error(msg);
+            handleErrorResponse(res.status, errBody.errors);
         }
         return body.data;
     }
+    async function requestBinary(path) {
+        const res = await fetch(`${base}/api/cli${path}`, {
+            headers: baseHeaders,
+        });
+        if (!res.ok) {
+            let errors = [];
+            try {
+                const body = (await res.json());
+                errors = body.errors ?? [];
+            }
+            catch { /* ignore */ }
+            handleErrorResponse(res.status, errors);
+        }
+        return Buffer.from(await res.arrayBuffer());
+    }
     return {
         async listCerts() {
             const data = await request('/certs');
             return data.certs;
         },
         async downloadCert(id) {
-            return request(`/certs/${id}/download`);
+            return requestBinary(`/certs/${id}/download`);
         },
     };
 }

package/dist/client.js

@@ -1,6 +1,7 @@
 import input from '@inquirer/input';
 import { readConfig } from './config.js';
 import { createApiClient } from './api.js';
+import { CLI_VERSION } from './version.js';
 export async function getConfiguredClient() {
     let apiKey = process.env['CERTOPS_API_KEY'];
     if (!apiKey) {
@@ -17,5 +18,5 @@ export async function getConfiguredClient() {
         });
     }
     const config = await readConfig();
-    return createApiClient({ apiKey, apiUrl: config.apiUrl });
+    return createApiClient({ apiKey, apiUrl: config.apiUrl, cliVersion: CLI_VERSION });
 }

package/dist/commands/download.js

@@ -2,26 +2,28 @@ import { Command } from 'commander';
 import select from '@inquirer/select';
 import {} from '../api.js';
 import { getConfiguredClient } from '../client.js';
-import { saveCert } from '../files.js';
+import { saveZip } from '../files.js';
 async function performDownload(cert, client) {
     process.stdout.write(`\nDownloading ${cert.certName}…\n`);
-    const files = await client.downloadCert(cert._id);
-    const { certPath, keyPath } = await saveCert(files.certName, files.certPem, files.keyPem);
-    process.stdout.write(`  ✓ Certificate : ${certPath}\n`);
-    process.stdout.write(`  ✓ Private key : ${keyPath}\n`);
-    if (files.expiryDate) {
-        process.stdout.write(`  ✓ Expires     : ${new Date(files.expiryDate).toLocaleDateString()}\n`);
+    const zipBuffer = await client.downloadCert(cert._id);
+    const paths = await saveZip(cert.certName, zipBuffer);
+    process.stdout.write(`  ✓ Fullchain   : ${paths.fullchainPath}\n`);
+    process.stdout.write(`  ✓ Certificate : ${paths.certPath}\n`);
+    process.stdout.write(`  ✓ Chain       : ${paths.chainPath}\n`);
+    process.stdout.write(`  ✓ Private key : ${paths.keyPath}\n`);
+    if (cert.expiryDate) {
+        process.stdout.write(`  ✓ Expires     : ${new Date(cert.expiryDate).toLocaleDateString()}\n`);
     }
     process.stdout.write('\n');
 }
 export const downloadCommand = new Command('download')
-    .description('Download a certificate to /etc/certops/certs/<domain>/ — requires sudo')
-    .argument('[certName]', 'Certificate name, e.g. *.example.com (omit to pick interactively)')
+    .description('Download a certificate to /etc/certops/<domain>/ — requires sudo')
+    .argument('[certName]', 'Certificate name or identifier, e.g. *.example.com (omit to pick interactively)')
     .option('-i, --id <id>', 'Download by certificate ID')
     .addHelpText('after', `
 Examples:
   sudo certops download                         Interactive picker
-  sudo certops download '*.example.com'         By domain name
+  sudo certops download '*.example.com'         By domain name or identifier
   sudo certops download --id 6643abc...         By certificate ID
 `)
     .action(async (certName, opts) => {
@@ -44,10 +46,10 @@ Examples:
             return;
         }
         if (certName) {
-            const match = certs.find(c => c.certName === certName);
+            const match = certs.find(c => c.certName === certName || c.identifiers.includes(certName));
             if (!match) {
                 process.stderr.write(`\nError: no certificate found for "${certName}"\n`);
-                process.stderr.write('Run "sp list" to see available certificates.\n\n');
+                process.stderr.write('Run "certops list" to see available certificates.\n\n');
                 process.exit(1);
             }
             if (!DOWNLOADABLE.has(match.status)) {
@@ -65,13 +67,11 @@ Examples:
         const chosen = await select({
             message: 'Select a certificate to download:',
             choices: active.map(c => {
-                const expiry = c.expiryDate
-                    ? `expires ${new Date(c.expiryDate).toLocaleDateString()}`
-                    : 'no expiry';
+                const expiry = c.expiryDate ? `expires ${new Date(c.expiryDate).toLocaleDateString()}` : 'no expiry';
                 const renewingTag = c.status === 'renewing' ? ' [renewing]' : '';
-                const tag = c.certType === 'wildcard' ? ' [wildcard]' : c.certType === 'apex' ? ' [apex]' : '';
+                const wildcardTag = c.identifiers.some(id => id.startsWith('*.')) ? ' [wildcard]' : '';
                 return {
-                    name: `${c.certName}${tag}${renewingTag}  —  ${expiry}`,
+                    name: `${c.certName}${wildcardTag}${renewingTag}  —  ${expiry}`,
                     value: c,
                 };
             }),

package/dist/commands/list.js

@@ -1,5 +1,12 @@
 import { Command } from 'commander';
+import {} from '../api.js';
 import { getConfiguredClient } from '../client.js';
+function isWildcard(c) {
+    return c.identifiers?.some(id => id.startsWith('*.')) ?? false;
+}
+function typeTag(c) {
+    return isWildcard(c) ? '[wildcard]' : '[single]  ';
+}
 export const listCommand = new Command('list')
     .description('List all certificates in your organisation')
     .action(async () => {
@@ -14,21 +21,19 @@ export const listCommand = new Command('list')
         const inactive = certs.filter(c => c.status !== 'active');
         const maxLen = Math.max(...certs.map(c => c.certName.length), 10);
         const pad = (s, n) => s.padEnd(n);
-        const typeTag = (type) => type === 'wildcard' ? '[wildcard]' : type === 'apex' ? '[apex]    ' : '[single]  ';
         process.stdout.write(`\nFound ${certs.length} certificate(s)\n`);
         if (active.length > 0) {
             process.stdout.write(`\nACTIVE (${active.length})\n`);
             for (const c of active) {
-                const expiry = c.expiryDate
-                    ? `expires ${new Date(c.expiryDate).toLocaleDateString()}`
-                    : 'no expiry info';
-                process.stdout.write(`  ${pad(c.certName, maxLen)}  ${typeTag(c.certType)}  ${expiry}\n`);
+                const expiry = c.expiryDate ? `expires ${new Date(c.expiryDate).toLocaleDateString()}` : 'no expiry info';
+                const covered = c.coveredByWildcardId ? '  [covered by wildcard]' : '';
+                process.stdout.write(`  ${pad(c.certName, maxLen)}  ${typeTag(c)}  ${expiry}${covered}\n`);
             }
         }
         if (inactive.length > 0) {
             process.stdout.write(`\nOTHER (${inactive.length})\n`);
             for (const c of inactive) {
-                process.stdout.write(`  ${pad(c.certName, maxLen)}  ${typeTag(c.certType)}  ${c.status}\n`);
+                process.stdout.write(`  ${pad(c.certName, maxLen)}  ${typeTag(c)}  ${c.status}\n`);
             }
         }
         process.stdout.write('\n');

package/dist/commands/service/install.js

@@ -2,7 +2,7 @@ import { Command } from 'commander';
 import input from '@inquirer/input';
 import { writeFile, mkdir } from 'fs/promises';
 import { spawnSync } from 'child_process';
-import { readConfig, writeConfig, CERTS_DIR, HOOKS_DIR } from '../../config.js';
+import { readConfig, writeConfig, SSL_PILOT_DIR, HOOKS_DIR } from '../../config.js';
 import { domainHookPath, GLOBAL_HOOK } from '../../hooks.js';
 const UNIT_PATH = '/etc/systemd/system/certops.service';
 function buildUnitContent(apiKey) {
@@ -28,10 +28,12 @@ WantedBy=multi-user.target
 }
 const HOOK_TEMPLATE = `#!/usr/bin/env bash
 # Available env vars:
-#   SSL_PILOT_CERT_NAME  — certificate name (e.g. *.example.com)
-#   SSL_PILOT_DOMAIN     — domain without wildcard (e.g. example.com)
-#   SSL_PILOT_CERT_PATH  — path to certificate.crt
-#   SSL_PILOT_KEY_PATH   — path to private.key
+#   SSL_PILOT_CERT_NAME       — certificate name (e.g. *.example.com)
+#   SSL_PILOT_DOMAIN          — domain name (certName from API)
+#   SSL_PILOT_FULLCHAIN_PATH  — path to fullchain.pem
+#   SSL_PILOT_CERT_PATH       — path to cert.pem
+#   SSL_PILOT_CHAIN_PATH      — path to chain.pem
+#   SSL_PILOT_KEY_PATH        — path to privkey.pem
 
 # Example: reload nginx after cert update
 # systemctl reload nginx
@@ -49,7 +51,7 @@ export const installCommand = new Command('install')
         const existing = await readConfig();
         // API key — env takes precedence, otherwise prompt
         const apiKey = process.env['CERTOPS_API_KEY'] ?? await input({
-            message: 'SSL Pilot API key (sslpilot_...):',
+            message: 'API key (sslpilot_...):',
             validate: (v) => v.startsWith('sslpilot_') && v.length > 10
                 ? true
                 : 'Key must start with sslpilot_',
@@ -80,7 +82,7 @@ export const installCommand = new Command('install')
         };
         // Write config + create directories
         await writeConfig(config);
-        await mkdir(CERTS_DIR, { recursive: true });
+        await mkdir(SSL_PILOT_DIR, { recursive: true });
         await mkdir(HOOKS_DIR, { recursive: true });
         console.log('\n✓ Config written to /etc/certops/config.json');
         // Create hook stubs only if they don't exist yet

package/dist/commands/service/renew.js

@@ -1,8 +1,9 @@
 import { createApiClient } from '../../api.js';
-import { saveCert } from '../../files.js';
+import { saveZip } from '../../files.js';
 import { readConfig } from '../../config.js';
 import { readState, updateCertState } from '../../state.js';
 import { runHooks } from '../../hooks.js';
+import { CLI_VERSION } from '../../version.js';
 const BASE_RETRY_DELAY_MS = 2_000; // 2 s → 4 s → 8 s …
 function sleep(ms) {
     return new Promise(resolve => setTimeout(resolve, ms));
@@ -22,12 +23,12 @@ export async function resolveApiKey() {
 }
 export async function runRenewalCycle(apiKey, log) {
     const config = await readConfig();
-    const client = createApiClient({ apiKey, apiUrl: config.apiUrl });
+    const client = createApiClient({ apiKey, apiUrl: config.apiUrl, cliVersion: CLI_VERSION });
     const allCerts = await client.listCerts();
     const DOWNLOADABLE = new Set(['active', 'renewing']);
-    const certs = config.watchDomains.length > 0
+    const certs = (config.watchDomains.length > 0
         ? allCerts.filter(c => config.watchDomains.includes(c.certName))
-        : allCerts.filter(c => DOWNLOADABLE.has(c.status));
+        : allCerts.filter(c => DOWNLOADABLE.has(c.status))).filter(c => !c.coveredByWildcardId);
     const state = await readState();
     const thresholdMs = config.renewalThresholdDays * 24 * 60 * 60 * 1000;
     const maxRetries = Math.max(0, config.maxDownloadRetries);
@@ -61,15 +62,17 @@ export async function runRenewalCycle(apiKey, log) {
                 await sleep(delay);
             }
             try {
-                const files = await client.downloadCert(cert._id);
-                const { certPath, keyPath } = await saveCert(files.certName, files.certPem, files.keyPem);
-                log(`  cert : ${certPath}`);
-                log(`  key  : ${keyPath}`);
-                await updateCertState(cert.certName, files.expiryDate ?? cert.expiryDate ?? '');
+                const zipBuffer = await client.downloadCert(cert._id);
+                const paths = await saveZip(cert.certName, zipBuffer);
+                log(`  fullchain : ${paths.fullchainPath}`);
+                log(`  key       : ${paths.keyPath}`);
+                await updateCertState(cert.certName, cert.expiryDate ?? '');
                 await runHooks(cert.certName, {
-                    SSL_PILOT_DOMAIN: cert.certName.replace(/^\*\./, ''),
-                    SSL_PILOT_CERT_PATH: certPath,
-                    SSL_PILOT_KEY_PATH: keyPath,
+                    SSL_PILOT_DOMAIN: cert.certName,
+                    SSL_PILOT_FULLCHAIN_PATH: paths.fullchainPath,
+                    SSL_PILOT_CERT_PATH: paths.certPath,
+                    SSL_PILOT_CHAIN_PATH: paths.chainPath,
+                    SSL_PILOT_KEY_PATH: paths.keyPath,
                 }, log);
                 downloaded++;
                 lastError = undefined;

package/dist/config.js

@@ -1,7 +1,6 @@
 import { readFile, writeFile, mkdir } from 'fs/promises';
 import { join } from 'path';
 export const SSL_PILOT_DIR = '/etc/certops';
-export const CERTS_DIR = join(SSL_PILOT_DIR, 'certs');
 export const HOOKS_DIR = join(SSL_PILOT_DIR, 'hooks');
 const CONFIG_PATH = join(SSL_PILOT_DIR, 'config.json');
 const DEFAULTS = {

package/dist/files.js

@@ -1,42 +1,52 @@
 import { mkdir, writeFile, chmod } from 'fs/promises';
 import { join } from 'path';
-import { CERTS_DIR } from './config.js';
-function domainDir(certName) {
-    return join(CERTS_DIR, certName.replace(/^\*\./, ''));
-}
-export async function saveCert(certName, certPem, keyPem) {
-    const dir = domainDir(certName);
-    const certPath = join(dir, 'certificate.crt');
-    const keyPath = join(dir, 'private.key');
+import { unzipSync } from 'fflate';
+import { SSL_PILOT_DIR } from './config.js';
+export async function saveZip(certName, zipBuffer) {
+    const zipDirName = certName.replace(/^\*\./, 'wildcard.');
+    const dir = join(SSL_PILOT_DIR, zipDirName);
+    let entries;
     try {
-        await mkdir(dir, { recursive: true });
+        entries = unzipSync(new Uint8Array(zipBuffer));
     }
     catch (err) {
-        fsError(err, certName, dir);
+        throw new Error(`Failed to extract ZIP: ${err.message}`);
     }
+    const filemap = [
+        { key: 'fullchainPath', zipName: 'fullchain.pem', mode: 0o644 },
+        { key: 'certPath', zipName: 'cert.pem', mode: 0o644 },
+        { key: 'chainPath', zipName: 'chain.pem', mode: 0o644 },
+        { key: 'keyPath', zipName: 'privkey.pem', mode: 0o600 },
+    ];
     try {
-        await writeFile(certPath, certPem, 'utf8');
-        await chmod(certPath, 0o644);
+        await mkdir(dir, { recursive: true });
     }
     catch (err) {
-        fsError(err, certName, certPath);
-    }
-    try {
-        await writeFile(keyPath, keyPem, 'utf8');
-        await chmod(keyPath, 0o600);
+        fsError(err, certName, dir);
     }
-    catch (err) {
-        fsError(err, certName, keyPath);
+    const paths = {};
+    for (const { key, zipName, mode } of filemap) {
+        const data = entries[`${zipDirName}/${zipName}`];
+        if (!data)
+            throw new Error(`ZIP missing expected file: ${zipDirName}/${zipName}`);
+        const filePath = join(dir, zipName);
+        paths[key] = filePath;
+        try {
+            await writeFile(filePath, data);
+            await chmod(filePath, mode);
+        }
+        catch (err) {
+            fsError(err, certName, filePath);
+        }
     }
-    return { certPath, keyPath };
+    return paths;
 }
 function fsError(err, certName, path) {
     const e = err instanceof Error ? err : null;
     if (e?.code === 'EACCES' || e?.code === 'EPERM') {
-        const name = certName.startsWith('*.') ? `'${certName}'` : certName;
         process.stderr.write(`\nPermission denied: ${path}\n`);
-        process.stderr.write(`/etc/certops/certs requires root. Re-run:\n\n`);
-        process.stderr.write(`  sudo sp download ${name}\n\n`);
+        process.stderr.write(`/etc/certops requires root. Re-run:\n\n`);
+        process.stderr.write(`  sudo certops download '${certName}'\n\n`);
         process.exit(1);
     }
     throw err;

package/dist/version.js

@@ -0,0 +1,18 @@
+import { readFileSync } from 'node:fs';
+import { dirname, join } from 'node:path';
+import { fileURLToPath } from 'node:url';
+function isPackageJson(value) {
+    return (typeof value === 'object' &&
+        value !== null &&
+        'version' in value &&
+        typeof value.version === 'string');
+}
+function readCliVersion() {
+    const dir = dirname(fileURLToPath(import.meta.url));
+    const path = join(dir, '..', 'package.json');
+    const raw = JSON.parse(readFileSync(path, 'utf8'));
+    if (!isPackageJson(raw))
+        throw new Error('package.json is missing a valid version field');
+    return raw.version;
+}
+export const CLI_VERSION = readCliVersion();

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "certops",
-  "version": "1.0.2",
+  "version": "1.0.6",
   "description": "SSL Pilot CLI — download and manage your SSL certificates",
   "type": "module",
   "files": [
@@ -20,7 +20,8 @@
   "dependencies": {
     "@inquirer/input": "^4.0.0",
     "@inquirer/select": "^4.0.0",
-    "commander": "^12.0.0"
+    "commander": "^12.0.0",
+    "fflate": "^0.8.0"
   },
   "devDependencies": {
     "@types/node": "^20.0.0",