6.1.2

.gitea/workflows/default_nottags.yaml

@@ -0,0 +1,66 @@
+name: Default (not tags)
+
+on:
+  push:
+    tags-ignore:
+      - '**'
+
+env:
+  IMAGE: code.foss.global/host.today/ht-docker-node:npmci
+  NPMCI_COMPUTED_REPOURL: https://${{gitea.repository_owner}}:${{secrets.GITEA_TOKEN}}@/${{gitea.repository}}.git
+  NPMCI_TOKEN_NPM: ${{secrets.NPMCI_TOKEN_NPM}}
+  NPMCI_TOKEN_NPM2: ${{secrets.NPMCI_TOKEN_NPM2}}
+  NPMCI_GIT_GITHUBTOKEN: ${{secrets.NPMCI_GIT_GITHUBTOKEN}}
+  NPMCI_URL_CLOUDLY: ${{secrets.NPMCI_URL_CLOUDLY}}
+
+jobs:
+  security:
+    runs-on: ubuntu-latest
+    continue-on-error: true
+    container:
+      image: ${{ env.IMAGE }}
+
+    steps:
+      - uses: actions/checkout@v3
+
+      - name: Install pnpm and npmci
+        run: |
+          pnpm install -g pnpm
+          pnpm install -g @ship.zone/npmci
+
+      - name: Run npm prepare
+        run: npmci npm prepare
+
+      - name: Audit production dependencies
+        run: |
+          npmci command npm config set registry https://registry.npmjs.org
+          npmci command pnpm audit --audit-level=high --prod
+        continue-on-error: true
+
+      - name: Audit development dependencies
+        run: |
+          npmci command npm config set registry https://registry.npmjs.org
+          npmci command pnpm audit --audit-level=high --dev
+        continue-on-error: true
+
+  test:
+    if: ${{ always() }}
+    needs: security
+    runs-on: ubuntu-latest
+    container:
+      image: ${{ env.IMAGE }}
+
+    steps:
+      - uses: actions/checkout@v3
+
+      - name: Test stable
+        run: |
+          npmci node install stable
+          npmci npm install
+          npmci npm test
+
+      - name: Test build
+        run: |
+          npmci node install stable
+          npmci npm install
+          npmci npm build

.gitea/workflows/default_tags.yaml

@@ -0,0 +1,124 @@
+name: Default (tags)
+
+on:
+  push:
+    tags:
+      - '*'
+
+env:
+  IMAGE: code.foss.global/host.today/ht-docker-node:npmci
+  NPMCI_COMPUTED_REPOURL: https://${{gitea.repository_owner}}:${{secrets.GITEA_TOKEN}}@/${{gitea.repository}}.git
+  NPMCI_TOKEN_NPM: ${{secrets.NPMCI_TOKEN_NPM}}
+  NPMCI_TOKEN_NPM2: ${{secrets.NPMCI_TOKEN_NPM2}}
+  NPMCI_GIT_GITHUBTOKEN: ${{secrets.NPMCI_GIT_GITHUBTOKEN}}
+  NPMCI_URL_CLOUDLY: ${{secrets.NPMCI_URL_CLOUDLY}}
+
+jobs:
+  security:
+    runs-on: ubuntu-latest
+    continue-on-error: true
+    container:
+      image: ${{ env.IMAGE }}
+
+    steps:
+      - uses: actions/checkout@v3
+
+      - name: Prepare
+        run: |
+          pnpm install -g pnpm
+          pnpm install -g @ship.zone/npmci
+          npmci npm prepare
+
+      - name: Audit production dependencies
+        run: |
+          npmci command npm config set registry https://registry.npmjs.org
+          npmci command pnpm audit --audit-level=high --prod
+        continue-on-error: true
+
+      - name: Audit development dependencies
+        run: |
+          npmci command npm config set registry https://registry.npmjs.org
+          npmci command pnpm audit --audit-level=high --dev
+        continue-on-error: true
+
+  test:
+    if: ${{ always() }}
+    needs: security
+    runs-on: ubuntu-latest
+    container:
+      image: ${{ env.IMAGE }}
+
+    steps:
+      - uses: actions/checkout@v3
+
+      - name: Prepare
+        run: |
+          pnpm install -g pnpm
+          pnpm install -g @ship.zone/npmci
+          npmci npm prepare
+
+      - name: Test stable
+        run: |
+          npmci node install stable
+          npmci npm install
+          npmci npm test
+
+      - name: Test build
+        run: |
+          npmci node install stable
+          npmci npm install
+          npmci npm build
+
+  release:
+    needs: test
+    if: github.event_name == 'push' && startsWith(github.ref, 'refs/tags/')
+    runs-on: ubuntu-latest
+    container:
+      image: ${{ env.IMAGE }}
+
+    steps:
+      - uses: actions/checkout@v3
+
+      - name: Prepare
+        run: |
+          pnpm install -g pnpm
+          pnpm install -g @ship.zone/npmci
+          npmci npm prepare
+
+      - name: Release
+        run: |
+          npmci node install stable
+          npmci npm publish
+
+  metadata:
+    needs: test
+    if: github.event_name == 'push' && startsWith(github.ref, 'refs/tags/')
+    runs-on: ubuntu-latest
+    container:
+      image: ${{ env.IMAGE }}
+    continue-on-error: true
+
+    steps:
+      - uses: actions/checkout@v3
+
+      - name: Prepare
+        run: |
+          pnpm install -g pnpm
+          pnpm install -g @ship.zone/npmci
+          npmci npm prepare
+
+      - name: Code quality
+        run: |
+          npmci command npm install -g typescript
+          npmci npm install
+
+      - name: Trigger
+        run: npmci trigger
+
+      - name: Build docs and upload artifacts
+        run: |
+          npmci node install stable
+          npmci npm install
+          pnpm install -g @git.zone/tsdoc
+          npmci command tsdoc
+        continue-on-error: true

.gitignore

@@ -3,7 +3,6 @@
 # artifacts
 coverage/
 public/
-pages/
 
 # installs
 node_modules/
@@ -15,8 +14,6 @@ node_modules/
 
 # builds
 dist/
-dist_web/
-dist_serve/
-dist_ts_web/
+dist_*/
 
-# custom
+#------# custom

.gitlab-ci.yml

@@ -1,126 +0,0 @@
-# gitzone ci_default
-image: registry.gitlab.com/hosttoday/ht-docker-node:npmci
-
-cache:
-  paths:
-    - .npmci_cache/
-  key: '$CI_BUILD_STAGE'
-
-stages:
-  - security
-  - test
-  - release
-  - metadata
-
-# ====================
-# security stage
-# ====================
-mirror:
-  stage: security
-  script:
-    - npmci git mirror
-  tags:
-    - lossless
-    - docker
-    - notpriv
-
-snyk:
-  image: registry.gitlab.com/hosttoday/ht-docker-node:snyk
-  stage: security
-  script:
-    - npmci npm prepare
-    - npmci command npm install --ignore-scripts
-    - npmci command snyk test
-  tags:
-    - lossless
-    - docker
-    - notpriv
-
-# ====================
-# test stage
-# ====================
-
-testStable:
-  stage: test
-  script:
-    - npmci npm prepare
-    - npmci node install stable
-    - npmci npm install
-    - npmci npm test
-  coverage: /\d+.?\d+?\%\s*coverage/
-  tags:
-    - lossless
-    - docker
-    - priv
-
-testBuild:
-  stage: test
-  script:
-    - npmci npm prepare
-    - npmci node install stable
-    - npmci npm install
-    - npmci command npm run build
-  coverage: /\d+.?\d+?\%\s*coverage/
-  tags:
-    - lossless
-    - docker
-    - notpriv
-
-release:
-  stage: release
-  script:
-    - npmci node install stable
-    - npmci npm publish
-  only:
-    - tags
-  tags:
-    - lossless
-    - docker
-    - notpriv
-
-# ====================
-# metadata stage
-# ====================
-codequality:
-  stage: metadata
-  allow_failure: true
-  script:
-    - npmci command npm install -g tslint typescript
-    - npmci npm prepare
-    - npmci npm install
-    - npmci command "tslint -c tslint.json ./ts/**/*.ts"
-  tags:
-    - lossless
-    - docker
-    - priv
-
-trigger:
-  stage: metadata
-  script:
-    - npmci trigger
-  only:
-    - tags
-  tags:
-    - lossless
-    - docker
-    - notpriv
-
-pages:
-  stage: metadata
-  script:
-    - npmci node install lts
-    - npmci command npm install -g @gitzone/tsdoc
-    - npmci npm prepare
-    - npmci npm install
-    - npmci command tsdoc
-  tags:
-    - lossless
-    - docker
-    - notpriv
-  only:
-    - tags
-  artifacts:
-    expire_in: 1 week
-    paths:
-      - public
-  allow_failure: true

.snyk

@@ -1,12 +0,0 @@
-# Snyk (https://snyk.io) policy file, patches or ignores known vulnerabilities.
-version: v1.12.0
-# ignores vulnerabilities until expiry date; change duration by modifying expiry date
-ignore:
-  'npm:node-forge:20180226':
-    - rsa-compat > node-forge:
-        reason: None given
-        expires: '2018-09-11T19:17:24.148Z'
-    - acme-v2 > rsa-compat > node-forge:
-        reason: None given
-        expires: '2018-09-11T19:17:24.148Z'
-patch: {}

.vscode/launch.json

@@ -2,28 +2,10 @@
   "version": "0.2.0",
   "configurations": [
     {
-      "name": "current file",
-      "type": "node",
+      "command": "npm test",
+      "name": "Run npm test",
       "request": "launch",
-      "args": [
-        "${relativeFile}"
-      ],
-      "runtimeArgs": ["-r", "@gitzone/tsrun"],
-      "cwd": "${workspaceRoot}",
-      "protocol": "inspector",
-      "internalConsoleOptions": "openOnSessionStart"
-    },
-    {
-      "name": "test.ts",
-      "type": "node",
-      "request": "launch",
-      "args": [
-        "test/test.ts"
-      ],
-      "runtimeArgs": ["-r", "@gitzone/tsrun"],
-      "cwd": "${workspaceRoot}",
-      "protocol": "inspector",
-      "internalConsoleOptions": "openOnSessionStart"
+      "type": "node-terminal"
     }
   ]
 }

.vscode/settings.json

@@ -15,7 +15,7 @@
             "properties": {
               "projectType": {
                 "type": "string",
-                "enum": ["website", "element", "service", "npm"]
+                "enum": ["website", "element", "service", "npm", "wcc"]
               }
             }
           }

README.md

@@ -1,36 +0,0 @@
-# @pushrocks/smartuniverse
-acme with an easy yet powerful interface in TypeScript
-
-## Availabililty and Links
-* [npmjs.org (npm package)](https://www.npmjs.com/package/@pushrocks/smartuniverse)
-* [gitlab.com (source)](https://gitlab.com/pushrocks/smartuniverse)
-* [github.com (source mirror)](https://github.com/pushrocks/smartuniverse)
-* [docs (typedoc)](https://pushrocks.gitlab.io/smartuniverse/)
-
-## Status for master
-[![build status](https://gitlab.com/pushrocks/smartuniverse/badges/master/build.svg)](https://gitlab.com/pushrocks/smartuniverse/commits/master)
-[![coverage report](https://gitlab.com/pushrocks/smartuniverse/badges/master/coverage.svg)](https://gitlab.com/pushrocks/smartuniverse/commits/master)
-[![npm downloads per month](https://img.shields.io/npm/dm/@pushrocks/smartuniverse.svg)](https://www.npmjs.com/package/@pushrocks/smartuniverse)
-[![Known Vulnerabilities](https://snyk.io/test/npm/@pushrocks/smartuniverse/badge.svg)](https://snyk.io/test/npm/@pushrocks/smartuniverse)
-[![TypeScript](https://img.shields.io/badge/TypeScript->=%203.x-blue.svg)](https://nodejs.org/dist/latest-v10.x/docs/api/)
-[![node](https://img.shields.io/badge/node->=%2010.x.x-blue.svg)](https://nodejs.org/dist/latest-v10.x/docs/api/)
-[![JavaScript Style Guide](https://img.shields.io/badge/code%20style-standard-brightgreen.svg)](http://standardjs.com/)
-
-## Usage
-
-Use TypeScript for best in class instellisense.
-
-```javascript
-import { SmartAcme } from 'smartacme';
-
-let smac = new SmartAcme()
-
-// TODO
-```
-
-For further information read the linked docs at the top of this readme.
-
-> MIT licensed | **©** [Lossless GmbH](https://lossless.gmbh)
-| By using this npm module you agree to our [privacy policy](https://lossless.gmbH/privacy.html)
-
-[![repo-footer](https://pushrocks.gitlab.io/assets/repo-footer.svg)](https://maintainedby.lossless.com)

changelog.md

@@ -0,0 +1,156 @@
+# Changelog
+
+## 2025-04-27 - 6.1.2 - fix(repo)
+Update repository metadata by replacing the LICENSE file with a license.md file for improved consistency.
+
+- Removed the old LICENSE file.
+- Introduced license.md as the new license documentation file.
+
+## 2025-04-27 - 6.1.1 - fix(readme)
+Fix license link reference in documentation
+
+- Updated the license link from [license](license) to [license.md](license.md) in the License and Legal Information section
+
+## 2025-04-27 - 6.1.0 - feat(readme)
+Update documentation with detailed built-in challenge handlers and custom handler examples
+
+- Expanded readme to include sections on Dns01Handler and Http01Handler usage
+- Added examples for creating and registering custom ACME challenge handlers
+- Improved clarity of ACME certificate management instructions using SmartAcme
+
+## 2025-04-27 - 6.0.1 - fix(readme)
+Remove extraneous code fence markers from license section in readme
+
+- Removed unnecessary triple backticks wrapping the license information
+- Improved clarity of the license section in the documentation
+
+## 2025-04-27 - 6.0.0 - BREAKING CHANGE(SmartAcme)
+Refactor challenge handling by removing legacy setChallenge/removeChallenge in favor of pluggable challengeHandlers and update documentation and tests accordingly
+
+- Removed legacy challenge methods and introduced new 'challengeHandlers' and 'challengePriority' options
+- Updated readme examples to demonstrate usage with DNS-01 (and HTTP-01) handlers
+- Refactored internal SmartAcme flow to select and process challenges via the new handler interface
+- Adjusted tests (including integration tests) to align with the updated challenge handling mechanism
+
+## 2025-04-27 - 5.1.0 - feat(smartacme)
+Implement exponential backoff retry logic and graceful shutdown handling in SmartAcme; update acme-client dependency to v5.4.0
+
+- Added retry helper with exponential backoff for ACME client operations
+- Introduced retryOptions in ISmartAcmeOptions for configurable retry parameters
+- Enhanced graceful shutdown handling by cleaning up pending DNS challenges on signal
+- Updated acme-client dependency from v4.2.5 to v5.4.0
+
+## 2025-04-26 - 5.0.1 - fix(build)
+Update CI workflows, bump dependency versions, and refine import and TypeScript configuration
+
+- Changed CI workflow image and npmci package from '@shipzone/npmci' to '@ship.zone/npmci', and updated repository URLs
+- Bumped several dependency versions in package.json (e.g. @api.global/typedserver, @push.rocks/lik, @push.rocks/smartdata, @push.rocks/smartdns, @tsclass/tsclass) to newer releases
+- Adjusted smartdns import to use the smartdnsClient module for proper module resolution
+- Updated tsconfig.json to add emitDecoratorMetadata and baseUrl settings
+- Minor markdown and formatting tweaks in readme and gitignore files, and slight improvements in test async handling
+
+## 2024-06-16 - 5.0.0 - No significant changes  
+This release contains no user‑facing changes.
+
+## 2024-06-16 - 4.0.8 - Structure and configuration updates  
+- BREAKING CHANGE(structure): renamed classes to avoid confusion  
+- update description  
+- update tsconfig  
+- update npmextra.json: githost
+
+## 2024-01-28 - 4.0.7–4.0.6 - Internal fixes and updates  
+- A series of releases with routine bug fixes and maintenance updates.
+
+## 2023-07-21 - 4.0.5–4.0.4 - Internal fixes and updates  
+- Multiple releases addressing internal issues and maintenance improvements.
+
+## 2023-07-10 - 4.0.3 - Organizational changes  
+- switch to new org scheme
+
+## 2022-09-27 - 4.0.0–4.0.2 - Internal fixes and updates  
+- Routine maintenance and internal bug fixes.
+
+## 2022-09-27 - 3.0.15 - Breaking changes  
+- BREAKING CHANGE(core): update
+
+## 2021-01-22 - 3.0.9–3.0.14 - Internal fixes and updates  
+- A range of releases focused on routine internal updates.
+
+## 2020-11-18 - 3.0.0–3.0.8 - Internal fixes and updates  
+- Routine maintenance and internal bug fixes.
+
+## 2020-02-10 - 2.1.2 - Breaking changes  
+- BREAKING CHANGE(core): streamline scope to certificate retrieval using dns challenge
+
+## 2020-02-10 - 2.1.0–2.1.1 - Internal fixes and updates  
+- Routine fixes and updates.
+
+## 2019-02-06 - 2.0.36 - New feature  
+- feat(Cert): now has validity check
+
+## 2019-01-18 - 2.0.2–2.0.35 - Internal fixes and updates  
+- Routine internal updates and maintenance.
+
+## 2018-10-07 - 2.0.0–2.0.1 - Internal fixes and updates  
+- Routine internal updates and maintenance.
+
+## 2018-10-07 - 1.1.4 - Breaking changes  
+- BREAKING CHANGE(scope): change to @pushrocks
+
+## 2018-08-12 - 1.1.1 - NPM publishing fix  
+- fix(npm publishing): update
+
+## 2018-08-11 - 1.1.0 - Certificate issuance update  
+- fix(core): now creating certs all right
+
+## 2018-08-11 - 1.0.11 - Feature update  
+- feat(swaitch to acme-v2): switch to letsencrypt v2
+
+## 2017-04-28 - 1.0.10 - CI improvements  
+- add updated ci config
+
+## 2017-04-28 - 1.0.9 - Standards update  
+- update to latest standards
+
+## 2017-01-27 - 1.0.8 - Basic functionality  
+- basic functionality
+
+## 2017-01-25 - 1.0.7 - Response and validation improvements  
+- now getting a valid response  
+- update validation  
+- improve README
+
+## 2017-01-15 - 1.0.6 - Async and documentation improvements  
+- improve README  
+- add async checkDNS
+
+## 2017-01-15 - 1.0.5 - Standards and process updates  
+- update to new standards  
+- now has working requestValidation method  
+- fix som things  
+- start better segregation of concerns  
+- start with certificate signing process
+
+## 2017-01-01 - 1.0.4 - Certificate acquisition improvements  
+- now getting certificates  
+- can now agree to TOS  
+- remove test keys
+
+## 2017-01-01 - 1.0.3 - NPM extra configuration  
+- add npmextra.json
+
+## 2017-01-01 - 1.0.2 - README and integration update  
+- add better readme  
+- switch to rawacme for more basic letsencrypt access
+
+## 2016-11-17 - 1.0.1 - Promise fix  
+- fix promise
+
+## 2016-11-17 - 1.0.0 - Major initial release changes  
+- remove superflouous key creation  
+- switch to acme core  
+- prepare switch to le‑acme‑core  
+- improve upon keyCreation  
+- update to use more promises  
+- add README  
+- first version

license.md

@@ -1,4 +1,4 @@
-Copyright (C) 2016, Lossless GmbH
+Copyright (C) 2016, Task Venture Capital GmbH
 
 Permission is hereby granted, free of charge, to any person obtaining a copy of
 this software and associated documentation files (the "Software"), to deal in

npmextra.json

@@ -2,17 +2,37 @@
   "gitzone": {
     "projectType": "npm",
     "module": {
-      "githost": "gitlab.com",
-      "gitscope": "pushrocks",
-      "gitrepo": "smartuniverse",
-      "shortDescription": "acme with an easy yet powerful interface in TypeScript",
-      "npmPackagename": "@pushrocks/smartuniverse",
+      "githost": "code.foss.global",
+      "gitscope": "push.rocks",
+      "gitrepo": "smartacme",
+      "description": "A TypeScript-based ACME client for LetsEncrypt certificate management with a focus on simplicity and power.",
+      "npmPackagename": "@push.rocks/smartacme",
       "license": "MIT",
-      "projectDomain": "push.rocks"
+      "projectDomain": "push.rocks",
+      "keywords": [
+        "ACME",
+        "LetsEncrypt",
+        "TypeScript",
+        "certificate management",
+        "DNS challenges",
+        "SSL/TLS",
+        "secure communication",
+        "domain validation",
+        "automation",
+        "crypto",
+        "MongoDB",
+        "dns-01 challenge",
+        "token-based challenges",
+        "certificate renewal",
+        "wildcard certificates"
+      ]
     }
   },
   "npmci": {
     "npmGlobalTools": [],
     "npmAccessLevel": "public"
+  },
+  "tsdoc": {
+    "legal": "\n## License and Legal Information\n\nThis repository contains open-source code that is licensed under the MIT License. A copy of the MIT License can be found in the [license](license) file within this repository. \n\n**Please note:** The MIT License does not grant permission to use the trade names, trademarks, service marks, or product names of the project, except as required for reasonable and customary use in describing the origin of the work and reproducing the content of the NOTICE file.\n\n### Trademarks\n\nThis project is owned and maintained by Task Venture Capital GmbH. The names and logos associated with Task Venture Capital GmbH and any related products or services are trademarks of Task Venture Capital GmbH and are not included within the scope of the MIT license granted herein. Use of these trademarks must comply with Task Venture Capital GmbH's Trademark Guidelines, and any usage must be approved in writing by Task Venture Capital GmbH.\n\n### Company Information\n\nTask Venture Capital GmbH  \nRegistered at District court Bremen HRB 35230 HB, Germany\n\nFor any legal inquiries or if you require further information, please contact us via email at hello@task.vc.\n\nBy using this repository, you acknowledge that you have read this section, agree to comply with its terms, and understand that the licensing of the code does not imply endorsement by Task Venture Capital GmbH of any derivative works.\n"
   }
 }

package.json

@@ -1,64 +1,84 @@
 {
-  "name": "@pushrocks/smartacme",
-  "version": "3.0.1",
+  "name": "@push.rocks/smartacme",
+  "version": "6.1.2",
   "private": false,
-  "description": "acme with an easy yet powerful interface in TypeScript",
-  "main": "dist/index.js",
-  "typings": "dist/index.d.ts",
+  "description": "A TypeScript-based ACME client for LetsEncrypt certificate management with a focus on simplicity and power.",
+  "main": "dist_ts/index.js",
+  "typings": "dist_ts/index.d.ts",
+  "type": "module",
   "scripts": {
     "test": "(tstest test/)",
-    "build": "(tsbuild)"
+    "build": "(tsbuild --web --allowimplicitany)",
+    "buildDocs": "tsdoc"
   },
   "repository": {
     "type": "git",
-    "url": "git+ssh://git@gitlab.com/umbrellazone/smartacme.git"
+    "url": "https://code.foss.global/push.rocks/smartacme.git"
   },
   "keywords": [
+    "ACME",
+    "LetsEncrypt",
     "TypeScript",
-    "acme",
-    "letsencrypt"
+    "certificate management",
+    "DNS challenges",
+    "SSL/TLS",
+    "secure communication",
+    "domain validation",
+    "automation",
+    "crypto",
+    "MongoDB",
+    "dns-01 challenge",
+    "token-based challenges",
+    "certificate renewal",
+    "wildcard certificates"
   ],
-  "author": "Lossless GmbH",
+  "author": "Task Venture Capital GmbH",
   "license": "MIT",
   "bugs": {
-    "url": "https://gitlab.com/umbrellazone/smartacme/issues"
+    "url": "https://code.foss.global/push.rocks/smartacme/issues"
   },
-  "homepage": "https://gitlab.com/umbrellazone/smartacme#README",
+  "homepage": "https://code.foss.global/push.rocks/smartacme#readme",
   "dependencies": {
-    "@pushrocks/lik": "^3.0.17",
-    "@pushrocks/smartdata": "^3.1.25",
-    "@pushrocks/smartdelay": "^2.0.6",
-    "@pushrocks/smartdns": "^3.0.8",
-    "@pushrocks/smartexpress": "^3.0.57",
-    "@pushrocks/smartlog": "^2.0.21",
-    "@pushrocks/smartpromise": "^3.0.6",
-    "@pushrocks/smartrequest": "^1.1.47",
-    "@pushrocks/smartstring": "^3.0.18",
-    "@pushrocks/smarttime": "^3.0.12",
-    "@pushrocks/smartunique": "^3.0.1",
-    "@tsclass/tsclass": "^3.0.4",
-    "acme-client": "^3.3.1"
+    "@api.global/typedserver": "^3.0.74",
+    "@push.rocks/lik": "^6.2.2",
+    "@push.rocks/smartdata": "^5.15.1",
+    "@push.rocks/smartdelay": "^3.0.5",
+    "@push.rocks/smartdns": "^6.2.2",
+    "@push.rocks/smartlog": "^3.0.7",
+    "@push.rocks/smartpromise": "^4.2.3",
+    "@push.rocks/smartrequest": "^2.1.0",
+    "@push.rocks/smartstring": "^4.0.15",
+    "@push.rocks/smarttime": "^4.1.1",
+    "@push.rocks/smartunique": "^3.0.9",
+    "@tsclass/tsclass": "^9.0.0",
+    "acme-client": "^5.4.0"
   },
   "devDependencies": {
-    "@gitzone/tsbuild": "^2.1.17",
-    "@gitzone/tsrun": "^1.2.8",
-    "@gitzone/tstest": "^1.0.28",
-    "@mojoio/cloudflare": "^4.0.3",
-    "@pushrocks/qenv": "^4.0.6",
-    "@pushrocks/tapbundle": "^3.2.0",
-    "@types/node": "^13.7.0",
-    "tslint": "^6.0.0",
-    "tslint-config-prettier": "^1.18.0"
+    "@apiclient.xyz/cloudflare": "^6.3.2",
+    "@git.zone/tsbuild": "^2.3.2",
+    "@git.zone/tsrun": "^1.3.3",
+    "@git.zone/tstest": "^1.0.96",
+    "@push.rocks/qenv": "^6.1.0",
+    "@push.rocks/tapbundle": "^5.6.3",
+    "@types/node": "^22.15.2"
   },
   "files": [
     "ts/**/*",
     "ts_web/**/*",
     "dist/**/*",
-    "dist_web/**/*",
+    "dist_*/**/*",
+    "dist_ts/**/*",
     "dist_ts_web/**/*",
     "assets/**/*",
     "cli.js",
     "npmextra.json",
     "readme.md"
-  ]
+  ],
+  "browserslist": [
+    "last 1 chrome versions"
+  ],
+  "packageManager": "pnpm@10.7.0+sha512.6b865ad4b62a1d9842b61d674a393903b871d9244954f652b8842c2b553c72176b278f64c463e52d40fff8aba385c235c8c9ecf5cc7de4fd78b8bb6d49633ab6",
+  "pnpm": {
+    "overrides": {}
+  }
 }

qenv.yml

@@ -1,6 +1,5 @@
 required:
-  - CF_EMAIL
-  - CF_KEY
+  - CF_TOKEN
   - MONGODB_URL
   - MONGODB_PASSWORD
   - MONGODB_DATABASE

readme.hints.md

@@ -0,0 +1,2 @@
+ - this repo is dependent on letsencrypt and its limits
+ - to simpify the outside API, smartacme is stateful, meaning it works with a mongodb and a collection called 'SmartacmeCert'.

readme.md

@@ -0,0 +1,325 @@
+# @push.rocks/smartacme
+
+A TypeScript-based ACME client with an easy yet powerful interface for LetsEncrypt certificate management.
+
+## Install
+
+To install `@push.rocks/smartacme`, you can use npm or yarn. Run one of the following commands in your project directory:
+
+```bash
+npm install @push.rocks/smartacme --save
+```
+
+or
+
+```bash
+yarn add @push.rocks/smartacme
+```
+
+Make sure your project is set up to use TypeScript and supports ECMAScript Modules (ESM).
+
+## Usage
+
+This guide will walk you through using `@push.rocks/smartacme` to set up and manage ACME (Automated Certificate Management Environment) certificates with a focus on the Let's Encrypt service, which provides free SSL certificates. The library provides an easy yet powerful TypeScript interface to automate the process of obtaining, renewing, and installing your SSL certificates.
+
+### Table of Contents
+
+1. [Setting Up Your Project](#setting-up-your-project)
+2. [Creating a SmartAcme Instance](#creating-a-smartacme-instance)
+3. [Initializing SmartAcme](#initializing-smartacme)
+4. [Obtaining a Certificate for a Domain](#obtaining-a-certificate-for-a-domain)
+5. [Automating DNS Challenges](#automating-dns-challenges)
+6. [Managing Certificates](#managing-certificates)
+7. [Environmental Considerations](#environmental-considerations)
+8. [Complete Example](#complete-example)
+
+### Setting Up Your Project
+
+Ensure your project includes the necessary TypeScript configuration and dependencies. You'll need to have TypeScript installed and configured for ECMAScript Modules. If you are new to TypeScript, review its [documentation](https://www.typescriptlang.org/docs/) to get started.
+
+### Creating a SmartAcme Instance
+
+Start by importing the `SmartAcme` class and any built-in handlers you plan to use. For example, to use DNS-01 via Cloudflare:
+
+```typescript
+import { SmartAcme } from '@push.rocks/smartacme';
+import * as cloudflare from '@apiclient.xyz/cloudflare';
+import { Dns01Handler } from '@push.rocks/smartacme/ts/handlers/Dns01Handler.js';
+
+// Create a Cloudflare account client with your API token
+const cfAccount = new cloudflare.CloudflareAccount('YOUR_CF_TOKEN');
+
+// Instantiate SmartAcme with one or more ACME challenge handlers
+const smartAcmeInstance = new SmartAcme({
+  accountEmail: 'youremail@example.com',
+  mongoDescriptor: {
+    mongoDbUrl: 'mongodb://yourmongoURL',
+    mongoDbName: 'yourDbName',
+    mongoDbPass: 'yourDbPassword',
+  },
+  environment: 'integration', // 'production' to request real certificates
+  retryOptions: {},         // optional retry/backoff settings
+  challengeHandlers: [
+    new Dns01Handler(cfAccount),
+    // you can add more handlers, e.g. Http01Handler
+  ],
+  challengePriority: ['dns-01'], // optional ordering of challenge types
+});
+```
+
+### Initializing SmartAcme
+
+Before proceeding to request certificates, start your SmartAcme instance:
+
+```typescript
+await smartAcmeInstance.start();
+```
+
+### Obtaining a Certificate for a Domain
+
+To obtain a certificate for a specific domain, use the `getCertificateForDomain` method. This function ensures that if a valid certificate is already present, it will be reused; otherwise, a new certificate is obtained:
+
+```typescript
+const myDomain = 'example.com';
+const myCert = await smartAcmeInstance.getCertificateForDomain(myDomain);
+console.log('Certificate:', myCert);
+```
+
+### Automating DNS Challenges
+
+SmartAcme uses pluggable ACME challenge handlers (see built-in handlers below) to automate domain validation. You configure handlers via the `challengeHandlers` array when creating the instance, and SmartAcme will invoke each handler’s `prepare`, optional `verify`, and `cleanup` methods during the ACME order flow.
+
+### Managing Certificates
+
+The library automatically handles fetching, renewing, and storing your certificates in a MongoDB database specified in your configuration. Ensure your MongoDB instance is accessible and properly configured for use with SmartAcme.
+
+```typescript
+const mongoDescriptor = {
+  mongoDbUrl: 'mongodb://yourmongoURL',
+  mongoDbName: 'yourDbName',
+  mongoDbPass: 'yourDbPassword',
+};
+```
+
+### Environmental Considerations
+
+When creating an instance of `SmartAcme`, you can specify an `environment` option. This is particularly useful for testing, as you can use the `integration` environment to avoid hitting rate limits and for testing your setup without issuing real certificates. Switch to `production` when you are ready to obtain actual certificates.
+
+### Complete Example
+
+Below is a complete example demonstrating how to use `@push.rocks/smartacme` to obtain and manage an ACME certificate with Let's Encrypt using a DNS-01 handler:
+
+```typescript
+import { SmartAcme } from '@push.rocks/smartacme';
+import * as cloudflare from '@apiclient.xyz/cloudflare';
+import { Qenv } from '@push.rocks/qenv';
+
+const qenv = new Qenv('./', './.nogit/');
+const cloudflareAccount = new cloudflare.CloudflareAccount(qenv.getEnvVarOnDemand('CF_TOKEN'));
+
+async function main() {
+  const smartAcmeInstance = new SmartAcme({
+    accountEmail: 'youremail@example.com',
+    mongoDescriptor: {
+      mongoDbUrl: qenv.getEnvVarRequired('MONGODB_URL'),
+      mongoDbName: qenv.getEnvVarRequired('MONGODB_DATABASE'),
+      mongoDbPass: qenv.getEnvVarRequired('MONGODB_PASSWORD'),
+    },
+    environment: 'integration',
+    challengeHandlers: [ new Dns01Handler(cloudflareAccount) ],
+  });
+
+  await smartAcmeInstance.start();
+
+  const myDomain = 'example.com';
+  const myCert = await smartAcmeInstance.getCertificateForDomain(myDomain);
+  console.log('Certificate:', myCert);
+
+  await smartAcmeInstance.stop();
+}
+
+ main().catch(console.error);
+ ```
+ 
+ ## Built-in Challenge Handlers
+ 
+ This module includes two out-of-the-box ACME challenge handlers:
+ 
+ - **Dns01Handler**
+   - Uses a Cloudflare account (from `@apiclient.xyz/cloudflare`) and Smartdns client to set and remove DNS TXT records, then wait for propagation.
+   - Import path:
+     ```typescript
+     import { Dns01Handler } from '@push.rocks/smartacme/ts/handlers/Dns01Handler.js';
+     ```
+   - Example:
+     ```typescript
+     import * as cloudflare from '@apiclient.xyz/cloudflare';
+     const cfAccount = new cloudflare.CloudflareAccount('CF_TOKEN');
+     const dnsHandler = new Dns01Handler(cfAccount);
+     ```
+ 
+ - **Http01Handler**
+   - Writes ACME HTTP-01 challenge files under a file-system webroot (`/.well-known/acme-challenge/`), and removes them on cleanup.
+   - Import path:
+     ```typescript
+     import { Http01Handler } from '@push.rocks/smartacme/ts/handlers/Http01Handler.js';
+     ```
+   - Example:
+     ```typescript
+     const httpHandler = new Http01Handler({ webroot: '/var/www/html' });
+     ```
+ 
+ Both handlers implement the `IChallengeHandler<T>` interface and can be combined in the `challengeHandlers` array.
+ 
+ ## Creating Custom Handlers
+ 
+ To support additional challenge types or custom validation flows, implement the `IChallengeHandler<T>` interface:
+ 
+ ```typescript
+ import type { IChallengeHandler } from '@push.rocks/smartacme/ts/handlers/IChallengeHandler.js';
+ 
+ // Define your custom challenge payload type
+ interface MyChallenge { type: string; /* ... */ }
+ 
+ class MyCustomHandler implements IChallengeHandler<MyChallenge> {
+   getSupportedTypes(): string[] {
+     return ['my-01'];
+   }
+ 
+   // Prepare the challenge (set DNS records, start servers, etc.)
+   async prepare(ch: MyChallenge): Promise<void> {
+     // preparation logic
+   }
+ 
+   // Optional verify step after prepare
+   async verify?(ch: MyChallenge): Promise<void> {
+     // verification logic
+   }
+ 
+   // Cleanup after challenge (remove records, stop servers)
+   async cleanup(ch: MyChallenge): Promise<void> {
+     // cleanup logic
+   }
+ }
+ 
+ // Then register your handler:
+ const customInstance = new SmartAcme({
+   /* other options */, 
+   challengeHandlers: [ new MyCustomHandler() ],
+   challengePriority: ['my-01'],
+ });
+
+In this example, `Qenv` is used to manage environment variables, and `cloudflare` library is used to handle DNS challenges required by Let's Encrypt ACME protocol. The `setChallenge` and `removeChallenge` methods are essential for automating the DNS challenge process, which is a key part of domain validation.
+
+## Additional Details
+
+### Certificate Object
+
+The certificate object obtained from the `getCertificateForDomain` method has the following properties:
+
+- `id`: Unique identifier for the certificate.
+- `domainName`: The domain name for which the certificate is issued.
+- `created`: Timestamp of when the certificate was created.
+- `privateKey`: The private key associated with the certificate.
+- `publicKey`: The public key or certificate itself.
+- `csr`: Certificate Signing Request (CSR) used to obtain the certificate.
+- `validUntil`: Timestamp indicating the expiration date of the certificate.
+
+### Methods Summary
+
+- **start()**: Initializes the SmartAcme instance, sets up the ACME client, and registers the account with Let's Encrypt.
+- **stop()**: Closes the MongoDB connection and performs any necessary cleanup.
+- **getCertificateForDomain(domainArg: string)**: Retrieves or obtains a certificate for the specified domain name. If a valid certificate exists in the database, it is returned. Otherwise, a new certificate is requested and stored.
+- **setChallenge(dnsChallenge: any)**: Automates the process of setting DNS challenge records.
+- **removeChallenge(dnsChallenge: any)**: Automates the process of removing DNS challenge records.
+
+### Handling Domain Matching
+
+The `SmartacmeCertMatcher` class is responsible for matching certificates with the broadest scope for wildcard certificates. The `getCertificateDomainNameByDomainName` method ensures that domains at various levels are correctly matched.
+
+```typescript
+import { SmartacmeCertMatcher } from '@push.rocks/smartacme';
+
+const certMatcher = new SmartacmeCertMatcher();
+const certDomainName = certMatcher.getCertificateDomainNameByDomainName('subdomain.example.com');
+console.log('Certificate Domain Name:', certDomainName); // Output: example.com
+```
+
+### Testing
+
+Automated tests can be added to ensure that the setup and functions work as expected. Using a testing framework such as `tap` and mock services for DNS providers (e.g., Cloudflare), you can simulate the process of obtaining and managing certificates without the need for actual domain ownership.
+
+```typescript
+import { tap, expect } from '@push.rocks/tapbundle';
+import { Qenv } from '@push.rocks/qenv';
+import * as cloudflare from '@apiclient.xyz/cloudflare';
+import * as smartacme from '@push.rocks/smartacme';
+
+const testQenv = new Qenv('./', './.nogit/');
+const testCloudflare = new cloudflare.CloudflareAccount(testQenv.getEnvVarOnDemand('CF_TOKEN'));
+
+let smartAcmeInstance: smartacme.SmartAcme;
+
+tap.test('should create a valid instance of SmartAcme', async () => {
+  smartAcmeInstance = new smartacme.SmartAcme({
+    accountEmail: 'domains@lossless.org',
+    accountPrivateKey: null,
+    mongoDescriptor: {
+      mongoDbName: testQenv.getEnvVarRequired('MONGODB_DATABASE'),
+      mongoDbPass: testQenv.getEnvVarRequired('MONGODB_PASSWORD'),
+      mongoDbUrl: testQenv.getEnvVarRequired('MONGODB_URL'),
+    },
+    setChallenge: async (dnsChallenge) => {
+      await testCloudflare.convenience.acmeSetDnsChallenge(dnsChallenge);
+    },
+    removeChallenge: async (dnsChallenge) => {
+      await testCloudflare.convenience.acmeRemoveDnsChallenge(dnsChallenge);
+    },
+    environment: 'integration',
+  });
+  await smartAcmeInstance.init();
+  expect(smartAcmeInstance).toBeInstanceOf(smartacme.SmartAcme);
+});
+
+tap.test('should get a domain certificate', async () => {
+  const certificate = await smartAcmeInstance.getCertificateForDomain('example.com');
+  console.log('Certificate:', certificate);
+  expect(certificate).toHaveProperty('domainName', 'example.com');
+});
+
+tap.test('certmatcher should correctly match domains', async () => {
+  const certMatcher = new smartacme.SmartacmeCertMatcher();
+  const matchedCert = certMatcher.getCertificateDomainNameByDomainName('subdomain.example.com');
+  expect(matchedCert).toBe('example.com');
+});
+
+tap.test('should stop correctly', async () => {
+  await smartAcmeInstance.stop();
+  expect(smartAcmeInstance).toHaveProperty('client', null);
+});
+
+tap.start();
+```
+
+This comprehensive guide ensures you can set up, manage, and test ACME certificates efficiently and effectively using `@push.rocks/smartacme`.
+
+---
+
+## License and Legal Information
+
+This repository contains open-source code that is licensed under the MIT License. A copy of the MIT License can be found in the [license.md](license.md) file within this repository.
+
+**Please note:** The MIT License does not grant permission to use the trade names, trademarks, service marks, or product names of the project, except as required for reasonable and customary use in describing the origin of the work and reproducing the content of the NOTICE file.
+
+### Trademarks
+
+This project is owned and maintained by Task Venture Capital GmbH. The names and logos associated with Task Venture Capital GmbH and any related products or services are trademarks of Task Venture Capital GmbH and are not included within the scope of the MIT license granted herein. Use of these trademarks must comply with Task Venture Capital GmbH's Trademark Guidelines, and any usage must be approved in writing by Task Venture Capital GmbH.
+
+### Company Information
+
+Task Venture Capital GmbH
+Registered at District court Bremen HRB 35230 HB, Germany
+
+For any legal inquiries or if you require further information, please contact us via email at hello@task.vc.
+
+By using this repository, you acknowledge that you have read this section, agree to comply with its terms, and understand that the licensing of the code does not imply endorsement by Task Venture Capital GmbH of any derivative works.

test/test.certmatcher.ts

@@ -0,0 +1,21 @@
+import { tap, expect } from '@push.rocks/tapbundle';
+import { SmartacmeCertMatcher } from '../ts/smartacme.classes.certmatcher.js';
+
+tap.test('should match 2-level domain', async () => {
+  const matcher = new SmartacmeCertMatcher();
+  expect(matcher.getCertificateDomainNameByDomainName('example.com')).toEqual('example.com');
+});
+
+tap.test('should match 3-level domain', async () => {
+  const matcher = new SmartacmeCertMatcher();
+  expect(matcher.getCertificateDomainNameByDomainName('subdomain.example.com')).toEqual('example.com');
+});
+
+tap.test('should return undefined for deeper domain', async () => {
+  const matcher = new SmartacmeCertMatcher();
+  // domain with 4 or more levels
+  const result = matcher.getCertificateDomainNameByDomainName('a.b.example.com');
+  expect(result).toEqual(undefined);
+});
+
+export default tap.start();

test/test.handlers-dns01.ts

@@ -0,0 +1,38 @@
+import { tap, expect } from '@push.rocks/tapbundle';
+import { Dns01Handler } from '../ts/handlers/Dns01Handler.js';
+
+tap.test('Dns01Handler prepare and cleanup calls Cloudflare and DNS functions', async () => {
+  let setCalled = false;
+  let removeCalled = false;
+  // fake Cloudflare API
+  const fakeCF: any = {
+    convenience: {
+      acmeSetDnsChallenge: async (ch: any) => {
+        setCalled = true;
+        expect(ch).toHaveProperty('hostName');
+        expect(ch).toHaveProperty('challenge');
+      },
+      acmeRemoveDnsChallenge: async (ch: any) => {
+        removeCalled = true;
+        expect(ch).toHaveProperty('hostName');
+        expect(ch).toHaveProperty('challenge');
+      },
+    },
+  };
+  // fake DNS checker
+  const fakeDNS: any = {
+    checkUntilAvailable: async (host: string, rr: string, val: string, count: number, interval: number) => {
+      expect(host).toEqual('test.host');
+      expect(rr).toEqual('TXT');
+      expect(val).toEqual('token');
+    },
+  };
+  const handler = new Dns01Handler(fakeCF, fakeDNS);
+  const input = { hostName: 'test.host', challenge: 'token' };
+  await handler.prepare(input);
+  expect(setCalled).toEqual(true);
+  await handler.cleanup(input);
+  expect(removeCalled).toEqual(true);
+});
+
+export default tap.start();

test/test.handlers-http01.ts

@@ -0,0 +1,26 @@
+import { tap, expect } from '@push.rocks/tapbundle';
+import { Http01Handler } from '../ts/handlers/Http01Handler.js';
+import { promises as fs } from 'fs';
+import * as path from 'path';
+import os from 'os';
+
+tap.test('Http01Handler writes challenge file and removes it on cleanup', async () => {
+  // create temporary webroot directory
+  const tmpDir = await fs.mkdtemp(path.join(os.tmpdir(), 'http01-'));
+  const handler = new Http01Handler({ webroot: tmpDir });
+  const token = 'testtoken';
+  const keyAuth = 'keyAuthValue';
+  const webPath = `/.well-known/acme-challenge/${token}`;
+  const input = { type: 'http-01', token, keyAuthorization: keyAuth, webPath };
+  // prepare should write the file
+  await handler.prepare(input);
+  const filePath = path.join(tmpDir, webPath);
+  const content = await fs.readFile(filePath, 'utf8');
+  expect(content).toEqual(keyAuth);
+  // cleanup should remove the file
+  await handler.cleanup(input);
+  const exists = await fs.stat(filePath).then(() => true).catch(() => false);
+  expect(exists).toEqual(false);
+});
+
+export default tap.start();

test/test.smartacme.integration.ts

@@ -0,0 +1,47 @@
+import { tap, expect } from '@push.rocks/tapbundle';
+import { Qenv } from '@push.rocks/qenv';
+import * as cloudflare from '@apiclient.xyz/cloudflare';
+import { SmartAcme } from '../ts/index.js';
+import { Dns01Handler } from '../ts/handlers/Dns01Handler.js';
+
+// Load environment variables for credentials (stored under .nogit/)
+const testQenv = new Qenv('./', './.nogit/');
+// Cloudflare API token for DNS-01 challenge (must be set in .nogit/ or env)
+const cfToken = (await testQenv.getEnvVarOnDemand('CF_TOKEN'))!;
+const cfAccount = new cloudflare.CloudflareAccount(cfToken);
+// MongoDB connection settings for certificate storage (must be set in .nogit/ or env)
+const mongoDbName = (await testQenv.getEnvVarOnDemand('MONGODB_DATABASE'))!;
+const mongoDbPass = (await testQenv.getEnvVarOnDemand('MONGODB_PASSWORD'))!;
+const mongoDbUrl = (await testQenv.getEnvVarOnDemand('MONGODB_URL'))!;
+
+let smartAcmeInstance: SmartAcme;
+
+tap.test('create SmartAcme instance with DNS-01 handler and start', async () => {
+  smartAcmeInstance = new SmartAcme({
+    accountEmail: 'domains@lossless.org',
+    mongoDescriptor: { mongoDbName, mongoDbPass, mongoDbUrl },
+    environment: 'integration',
+    retryOptions: {},
+    challengeHandlers: [new Dns01Handler(cfAccount)],
+    challengePriority: ['dns-01'],
+  });
+  await smartAcmeInstance.start();
+  expect(smartAcmeInstance).toBeInstanceOf(SmartAcme);
+});
+
+tap.test('get a domain certificate via DNS-01 challenge', async () => {
+  // Replace 'bleu.de' with your test domain if different
+  const domain = 'bleu.de';
+  const cert = await smartAcmeInstance.getCertificateForDomain(domain);
+  expect(cert).toHaveProperty('domainName');
+  expect(cert.domainName).toEqual(domain);
+  expect(cert).toHaveProperty('publicKey');
+  expect(typeof cert.publicKey).toEqual('string');
+  expect(cert.publicKey.length).toBeGreaterThan(0);
+});
+
+tap.test('stop SmartAcme instance', async () => {
+  await smartAcmeInstance.stop();
+});
+
+export default tap.start();

test/test.smartacme.ts

@@ -0,0 +1,32 @@
+import { tap, expect } from '@push.rocks/tapbundle';
+import { SmartAcme } from '../ts/index.js';
+import type { IChallengeHandler } from '../ts/handlers/IChallengeHandler.js';
+
+// Dummy handler for testing
+class DummyHandler implements IChallengeHandler<any> {
+  getSupportedTypes(): string[] { return ['dns-01']; }
+  async prepare(_: any): Promise<void> { /* no-op */ }
+  async cleanup(_: any): Promise<void> { /* no-op */ }
+}
+
+tap.test('constructor throws without challengeHandlers', async () => {
+  expect(() => new SmartAcme({
+    accountEmail: 'test@example.com',
+    mongoDescriptor: { mongoDbName: 'db', mongoDbPass: 'pass', mongoDbUrl: 'url' },
+    environment: 'integration',
+    retryOptions: {},
+  } as any)).toThrow();
+});
+
+tap.test('constructor accepts valid challengeHandlers', async () => {
+  const sa = new SmartAcme({
+    accountEmail: 'test@example.com',
+    mongoDescriptor: { mongoDbName: 'db', mongoDbPass: 'pass', mongoDbUrl: 'url' },
+    environment: 'integration',
+    retryOptions: {},
+    challengeHandlers: [new DummyHandler()],
+  });
+  expect(sa).toBeInstanceOf(SmartAcme);
+});
+
+export default tap.start();

test/test.ts

@@ -1,50 +0,0 @@
-import { tap, expect } from '@pushrocks/tapbundle';
-import { Qenv } from '@pushrocks/qenv';
-import * as cloudflare from '@mojoio/cloudflare';
-
-const testQenv = new Qenv('./', './.nogit/');
-const testCloudflare = new cloudflare.CloudflareAccount({
-  email: testQenv.getEnvVarOnDemand('CF_EMAIL'),
-  key: testQenv.getEnvVarOnDemand('CF_KEY')
-});
-
-import * as smartacme from '../ts/index';
-
-let smartAcmeInstance: smartacme.SmartAcme;
-
-tap.test('should create a valid instance of SmartAcme', async () => {
-  smartAcmeInstance = new smartacme.SmartAcme({
-    accountEmail: 'domains@lossless.org',
-    accountPrivateKey: null,
-    mongoDescriptor: {
-      mongoDbName: testQenv.getEnvVarRequired('MONGODB_DATABASE'),
-      mongoDbPass: testQenv.getEnvVarRequired('MONGODB_PASSWORD'),
-      mongoDbUrl: testQenv.getEnvVarRequired('MONGODB_URL')
-    },
-    removeChallenge: async (dnsChallenge) => {
-      testCloudflare.convenience.acmeRemoveDnsChallenge(dnsChallenge);
-    },
-    setChallenge: async (dnsChallenge) => {
-      testCloudflare.convenience.acmeSetDnsChallenge(dnsChallenge);
-    },
-    environment: 'integration'
-  });
-  await smartAcmeInstance.init();
-});
-
-tap.test('should get a domain certificate', async () => {
-  await smartAcmeInstance.getCertificateForDomain('bleu.de');
-});
-
-tap.test('certmatcher should correctly match domains', async () => {
-  const certMatcherMod = await import('../ts/smartacme.classes.certmatcher');
-  const certMatcher = new certMatcherMod.CertMatcher();
-  const matchedCert = certMatcher.getCertificateDomainNameByDomainName('level3.level2.level1');
-  expect(matchedCert).to.equal('level2.level1');
-});
-
-tap.test('should stop correctly', async () => {
-  await smartAcmeInstance.stop();
-});
-
-tap.start();

ts/00_commitinfo_data.ts

@@ -0,0 +1,8 @@
+/**
+ * autocreated commitinfo by @push.rocks/commitinfo
+ */
+export const commitinfo = {
+  name: '@push.rocks/smartacme',
+  version: '6.1.2',
+  description: 'A TypeScript-based ACME client for LetsEncrypt certificate management with a focus on simplicity and power.'
+}

ts/handlers/Dns01Handler.ts

@@ -0,0 +1,40 @@
+import * as plugins from '../smartacme.plugins.js';
+import type { IChallengeHandler } from './IChallengeHandler.js';
+
+/**
+ * DNS-01 challenge handler using CloudflareAccount and Smartdns.
+ */
+export class Dns01Handler implements IChallengeHandler<plugins.tsclass.network.IDnsChallenge> {
+  private cf: any;
+  private smartdns: plugins.smartdnsClient.Smartdns;
+
+  constructor(
+    cloudflareAccount: any,
+    smartdnsInstance?: plugins.smartdnsClient.Smartdns,
+  ) {
+    this.cf = cloudflareAccount;
+    this.smartdns = smartdnsInstance ?? new plugins.smartdnsClient.Smartdns({});
+  }
+
+  public getSupportedTypes(): string[] {
+    return ['dns-01'];
+  }
+
+  public async prepare(ch: plugins.tsclass.network.IDnsChallenge): Promise<void> {
+    // set DNS TXT record
+    await this.cf.convenience.acmeSetDnsChallenge(ch);
+    // wait for DNS propagation
+    await this.smartdns.checkUntilAvailable(
+      ch.hostName,
+      'TXT',
+      ch.challenge,
+      100,
+      5000,
+    );
+  }
+
+  public async cleanup(ch: plugins.tsclass.network.IDnsChallenge): Promise<void> {
+    // remove DNS TXT record
+    await this.cf.convenience.acmeRemoveDnsChallenge(ch);
+  }
+}

ts/handlers/Http01Handler.ts

@@ -0,0 +1,54 @@
+import { promises as fs } from 'fs';
+import * as path from 'path';
+import type { IChallengeHandler } from './IChallengeHandler.js';
+
+/**
+ * HTTP-01 ACME challenge handler using file-system webroot.
+ * Writes and removes the challenge file under <webroot>/.well-known/acme-challenge/. 
+ */
+export interface Http01HandlerOptions {
+  /**
+   * Directory that serves HTTP requests for /.well-known/acme-challenge
+   */
+  webroot: string;
+}
+
+export class Http01Handler implements IChallengeHandler<{
+  type: string;
+  token: string;
+  keyAuthorization: string;
+  webPath: string;
+}> {
+  private webroot: string;
+
+  constructor(options: Http01HandlerOptions) {
+    this.webroot = options.webroot;
+  }
+
+  public getSupportedTypes(): string[] {
+    return ['http-01'];
+  }
+
+  public async prepare(ch: { token: string; keyAuthorization: string; webPath: string }): Promise<void> {
+    const relWebPath = ch.webPath.replace(/^\/+/, '');
+    const filePath = path.join(this.webroot, relWebPath);
+    const dir = path.dirname(filePath);
+    await fs.mkdir(dir, { recursive: true });
+    await fs.writeFile(filePath, ch.keyAuthorization, 'utf8');
+  }
+
+  public async verify(ch: { webPath: string; keyAuthorization: string }): Promise<void> {
+    // Optional: implement HTTP polling if desired
+    return;
+  }
+
+  public async cleanup(ch: { token: string; webPath: string }): Promise<void> {
+    const relWebPath = ch.webPath.replace(/^\/+/, '');
+    const filePath = path.join(this.webroot, relWebPath);
+    try {
+      await fs.unlink(filePath);
+    } catch {
+      // ignore missing file
+    }
+  }
+}

ts/handlers/IChallengeHandler.ts

@@ -0,0 +1,22 @@
+/**
+ * Pluggable interface for ACME challenge handlers.
+ * Supports DNS-01, HTTP-01, TLS-ALPN-01, or custom challenge types.
+ */
+export interface IChallengeHandler<T> {
+  /**
+   * ACME challenge types this handler supports (e.g. ['dns-01']).
+   */
+  getSupportedTypes(): string[];
+  /**
+   * Prepare the challenge: set DNS record, start HTTP/TLS server, etc.
+   */
+  prepare(ch: T): Promise<void>;
+  /**
+   * Optional extra verify step (HTTP GET, ALPN handshake).
+   */
+  verify?(ch: T): Promise<void>;
+  /**
+   * Clean up resources: remove DNS record, stop server.
+   */
+  cleanup(ch: T): Promise<void>;
+}

ts/handlers/index.ts

@@ -0,0 +1,4 @@
+export type { IChallengeHandler } from './IChallengeHandler.js';
+// Removed legacy handler adapter
+export { Dns01Handler } from './Dns01Handler.js';
+export { Http01Handler } from './Http01Handler.js';

ts/index.ts

@@ -1 +1,2 @@
-export * from './smartacme.classes.smartacme';
+export * from './smartacme.classes.smartacme.js';
+export { SmartacmeCert as Cert } from './smartacme.classes.cert.js';

ts/interfaces/index.ts

@@ -1 +1 @@
-export * from './accountdata';
+export * from './accountdata.js';

ts/smartacme.classes.cert.ts

@@ -1,15 +1,18 @@
-import * as plugins from './smartacme.plugins';
+import * as plugins from './smartacme.plugins.js';
 
-import * as interfaces from './interfaces';
+import * as interfaces from './interfaces/index.js';
 
-import { CertManager } from './smartacme.classes.certmanager';
+import { SmartacmeCertManager } from './smartacme.classes.certmanager.js';
 
-import { Collection, svDb, unI } from '@pushrocks/smartdata';
+import { Collection, svDb, unI } from '@push.rocks/smartdata';
 
 @plugins.smartdata.Collection(() => {
-  return CertManager.activeDB;
+  return SmartacmeCertManager.activeDB;
 })
-export class Cert extends plugins.smartdata.SmartDataDbDoc<Cert> implements plugins.tsclass.network.ICert {
+export class SmartacmeCert
+  extends plugins.smartdata.SmartDataDbDoc<SmartacmeCert, plugins.tsclass.network.ICert>
+  implements plugins.tsclass.network.ICert
+{
   @unI()
   public id: string;
 
@@ -39,22 +42,21 @@ export class Cert extends plugins.smartdata.SmartDataDbDoc<Cert> implements plug
     const shouldBeValidAtLeastUntil =
       Date.now() +
       plugins.smarttime.getMilliSecondsFromUnits({
-        days: 10
+        days: 10,
       });
-    return this.validUntil >= shouldBeValidAtLeastUntil;
+    return !(this.validUntil >= shouldBeValidAtLeastUntil);
   }
 
   public update(certDataArg: plugins.tsclass.network.ICert) {
-    Object.keys(certDataArg).forEach(key => {
+    Object.keys(certDataArg).forEach((key) => {
       this[key] = certDataArg[key];
     });
   }
 
-
   constructor(optionsArg: plugins.tsclass.network.ICert) {
     super();
     if (optionsArg) {
-      Object.keys(optionsArg).forEach(key => {
+      Object.keys(optionsArg).forEach((key) => {
         this[key] = optionsArg[key];
       });
     }

ts/smartacme.classes.certmanager.ts

@@ -1,10 +1,10 @@
-import * as plugins from './smartacme.plugins';
-import { Cert } from './smartacme.classes.cert';
-import { SmartAcme } from './smartacme.classes.smartacme';
+import * as plugins from './smartacme.plugins.js';
+import { SmartacmeCert } from './smartacme.classes.cert.js';
+import { SmartAcme } from './smartacme.classes.smartacme.js';
 
-import * as interfaces from './interfaces';
+import * as interfaces from './interfaces/index.js';
 
-export class CertManager {
+export class SmartacmeCertManager {
   // =========
   // STATIC
   // =========
@@ -16,13 +16,13 @@ export class CertManager {
   private mongoDescriptor: plugins.smartdata.IMongoDescriptor;
   public smartdataDb: plugins.smartdata.SmartdataDb;
 
-  public interestMap: plugins.lik.InterestMap<string, Cert>;
+  public interestMap: plugins.lik.InterestMap<string, SmartacmeCert>;
 
   constructor(
     smartAcmeArg: SmartAcme,
     optionsArg: {
       mongoDescriptor: plugins.smartdata.IMongoDescriptor;
-    }
+    },
   ) {
     this.mongoDescriptor = optionsArg.mongoDescriptor;
   }
@@ -31,7 +31,7 @@ export class CertManager {
     // Smartdata DB
     this.smartdataDb = new plugins.smartdata.SmartdataDb(this.mongoDescriptor);
     await this.smartdataDb.init();
-    CertManager.activeDB = this.smartdataDb;
+    SmartacmeCertManager.activeDB = this.smartdataDb;
 
     // Pending Map
     this.interestMap = new plugins.lik.InterestMap((certName) => certName);
@@ -42,9 +42,9 @@ export class CertManager {
    * @returns the Cert class or null
    * @param certDomainNameArg the domain Name to retrieve the vcertificate for
    */
-  public async retrieveCertificate(certDomainNameArg: string): Promise<Cert> {
-    const existingCertificate: Cert = await Cert.getInstance({
-      domainName: certDomainNameArg
+  public async retrieveCertificate(certDomainNameArg: string): Promise<SmartacmeCert> {
+    const existingCertificate: SmartacmeCert = await SmartacmeCert.getInstance<SmartacmeCert>({
+      domainName: certDomainNameArg,
     });
 
     if (existingCertificate) {
@@ -59,7 +59,7 @@ export class CertManager {
    * @param optionsArg
    */
   public async storeCertificate(optionsArg: plugins.tsclass.network.ICert) {
-    const cert = new Cert(optionsArg);
+    const cert = new SmartacmeCert(optionsArg);
     await cert.save();
     const interest = this.interestMap.findInterest(cert.domainName);
     if (interest) {
@@ -69,8 +69,8 @@ export class CertManager {
   }
 
   public async deleteCertificate(certDomainNameArg: string) {
-    const cert: Cert = await Cert.getInstance({
-      domainName: certDomainNameArg
+    const cert: SmartacmeCert = await SmartacmeCert.getInstance<SmartacmeCert>({
+      domainName: certDomainNameArg,
     });
     await cert.delete();
   }

ts/smartacme.classes.certmatcher.ts

@@ -1,10 +1,10 @@
-import * as plugins from './smartacme.plugins';
-import * as interfaces from './interfaces';
+import * as plugins from './smartacme.plugins.js';
+import * as interfaces from './interfaces/index.js';
 
 /**
  * certmatcher is responsible for matching certificates
  */
-export class CertMatcher {
+export class SmartacmeCertMatcher {
   /**
    * creates a domainName for the certificate that will include the broadest scope
    * for wild card certificates

ts/smartacme.classes.smartacme.ts

@@ -1,7 +1,8 @@
-import * as plugins from './smartacme.plugins';
-import { Cert } from './smartacme.classes.cert';
-import { CertManager } from './smartacme.classes.certmanager';
-import { CertMatcher } from './smartacme.classes.certmatcher';
+import * as plugins from './smartacme.plugins.js';
+import { SmartacmeCert } from './smartacme.classes.cert.js';
+import { SmartacmeCertManager } from './smartacme.classes.certmanager.js';
+import { SmartacmeCertMatcher } from './smartacme.classes.certmatcher.js';
+import { commitinfo } from './00_commitinfo_data.js';
 
 /**
  * the options for the class @see SmartAcme
@@ -10,10 +11,30 @@ export interface ISmartAcmeOptions {
   accountPrivateKey?: string;
   accountEmail: string;
   mongoDescriptor: plugins.smartdata.IMongoDescriptor;
-  setChallenge: (dnsChallengeArg: plugins.tsclass.network.IDnsChallenge) => Promise<any>;
-  removeChallenge: (dnsChallengeArg: plugins.tsclass.network.IDnsChallenge) => Promise<any>;
+  // Removed legacy setChallenge/removeChallenge in favor of `challengeHandlers`
   environment: 'production' | 'integration';
-  logger?: plugins.smartlog.Smartlog;
+  /**
+   * Optional retry/backoff configuration for transient failures
+   */
+  retryOptions?: {
+    /** number of retry attempts */
+    retries?: number;
+    /** backoff multiplier */
+    factor?: number;
+    /** initial delay in milliseconds */
+    minTimeoutMs?: number;
+    /** maximum delay cap in milliseconds */
+    maxTimeoutMs?: number;
+  };
+  /**
+   * Pluggable ACME challenge handlers (DNS-01, HTTP-01, TLS-ALPN-01, etc.)
+   */
+  challengeHandlers?: plugins.handlers.IChallengeHandler<any>[];
+  /**
+   * Order of challenge types to try (e.g. ['http-01','dns-01']).
+   * Defaults to ['dns-01'] or first supported type from handlers.
+   */
+  challengePriority?: string[];
 }
 
 /**
@@ -30,48 +51,70 @@ export class SmartAcme {
   private options: ISmartAcmeOptions;
 
   // the acme client
-  private client: any;
-  private smartdns = new plugins.smartdns.Smartdns();
+  private client: plugins.acme.Client;
+  private smartdns = new plugins.smartdnsClient.Smartdns({});
   public logger: plugins.smartlog.Smartlog;
 
   // the account private key
   private privateKey: string;
 
-  // challenge fullfillment
-  private setChallenge: (dnsChallengeArg: plugins.tsclass.network.IDnsChallenge) => Promise<any>;
-  private removeChallenge: (dnsChallengeArg: plugins.tsclass.network.IDnsChallenge) => Promise<any>;
 
   // certmanager
-  private certmanager: CertManager;
-  private certmatcher: CertMatcher;
+  private certmanager: SmartacmeCertManager;
+  private certmatcher: SmartacmeCertMatcher;
+  // retry/backoff configuration (resolved with defaults)
+  private retryOptions: { retries: number; factor: number; minTimeoutMs: number; maxTimeoutMs: number };
+  // track pending DNS challenges for graceful shutdown
+  private pendingChallenges: plugins.tsclass.network.IDnsChallenge[] = [];
+  // configured pluggable ACME challenge handlers
+  private challengeHandlers: plugins.handlers.IChallengeHandler<any>[];
+  // priority order of challenge types
+  private challengePriority: string[];
 
   constructor(optionsArg: ISmartAcmeOptions) {
     this.options = optionsArg;
-    this.options.logger
-      ? (this.logger = optionsArg.logger)
-      : (this.logger = plugins.smartlog.defaultLogger);
+    this.logger = plugins.smartlog.Smartlog.createForCommitinfo(commitinfo);
+    // enable console output for structured logging
+    this.logger.enableConsole();
+    // initialize retry/backoff options
+    this.retryOptions = {
+      retries: optionsArg.retryOptions?.retries ?? 3,
+      factor: optionsArg.retryOptions?.factor ?? 2,
+      minTimeoutMs: optionsArg.retryOptions?.minTimeoutMs ?? 1000,
+      maxTimeoutMs: optionsArg.retryOptions?.maxTimeoutMs ?? 30000,
+    };
+    // initialize challenge handlers (must provide at least one)
+    if (!optionsArg.challengeHandlers || optionsArg.challengeHandlers.length === 0) {
+      throw new Error(
+        'You must provide at least one ACME challenge handler via options.challengeHandlers',
+      );
+    }
+    this.challengeHandlers = optionsArg.challengeHandlers;
+    // initialize challenge priority
+    this.challengePriority =
+      optionsArg.challengePriority && optionsArg.challengePriority.length > 0
+        ? optionsArg.challengePriority
+        : this.challengeHandlers.map((h) => h.getSupportedTypes()[0]);
   }
 
   /**
-   * inits the instance
+   * starts the instance
    * ```ts
-   * await myCloudlyInstance.init() // does not support options
+   * await myCloudlyInstance.start() // does not support options
    * ```
    */
-  public async init() {
+  public async start() {
     this.privateKey =
       this.options.accountPrivateKey || (await plugins.acme.forge.createPrivateKey()).toString();
-    this.setChallenge = this.options.setChallenge;
-    this.removeChallenge = this.options.removeChallenge;
 
     // CertMangaer
-    this.certmanager = new CertManager(this, {
-      mongoDescriptor: this.options.mongoDescriptor
+    this.certmanager = new SmartacmeCertManager(this, {
+      mongoDescriptor: this.options.mongoDescriptor,
     });
     await this.certmanager.init();
 
     // CertMatcher
-    this.certmatcher = new CertMatcher();
+    this.certmatcher = new SmartacmeCertMatcher();
 
     // ACME Client
     this.client = new plugins.acme.Client({
@@ -82,19 +125,73 @@ export class SmartAcme {
           return plugins.acme.directory.letsencrypt.staging;
         }
       })(),
-      accountKey: this.privateKey
+      accountKey: this.privateKey,
     });
 
     /* Register account */
     await this.client.createAccount({
       termsOfServiceAgreed: true,
-      contact: [`mailto:${this.options.accountEmail}`]
+      contact: [`mailto:${this.options.accountEmail}`],
     });
+    // Setup graceful shutdown handlers
+    process.on('SIGINT', () => this.handleSignal('SIGINT'));
+    process.on('SIGTERM', () => this.handleSignal('SIGTERM'));
   }
 
-  public async stop() {
-    await this.certmanager.smartdataDb.close();
-  }
+    public async stop() {
+      await this.certmanager.smartdataDb.close();
+    }
+    /** Retry helper with exponential backoff */
+    private async retry<T>(operation: () => Promise<T>, operationName: string = 'operation'): Promise<T> {
+      let attempt = 0;
+      let delay = this.retryOptions.minTimeoutMs;
+      while (true) {
+        try {
+          return await operation();
+        } catch (err) {
+          attempt++;
+          if (attempt > this.retryOptions.retries) {
+            await this.logger.log('error', `Operation ${operationName} failed after ${attempt} attempts`, err);
+            throw err;
+          }
+          await this.logger.log('warn', `Operation ${operationName} failed on attempt ${attempt}, retrying in ${delay}ms`, err);
+          await plugins.smartdelay.delayFor(delay);
+          delay = Math.min(delay * this.retryOptions.factor, this.retryOptions.maxTimeoutMs);
+        }
+      }
+    }
+    /** Clean up pending challenges and shut down */
+    private async handleShutdown(): Promise<void> {
+      for (const input of [...this.pendingChallenges]) {
+        const type: string = (input as any).type;
+        const handler = this.challengeHandlers.find((h) => h.getSupportedTypes().includes(type));
+        if (handler) {
+          try {
+            await handler.cleanup(input);
+            await this.logger.log('info', `Removed pending ${type} challenge during shutdown`, input);
+          } catch (err) {
+            await this.logger.log('error', `Failed to remove pending ${type} challenge during shutdown`, err);
+          }
+        } else {
+          await this.logger.log(
+            'warn',
+            `No handler for pending challenge type '${type}' during shutdown; skipping cleanup`,
+            input,
+          );
+        }
+      }
+      this.pendingChallenges = [];
+      await this.stop();
+    }
+    /** Handle process signals for graceful shutdown */
+    private handleSignal(sig: string): void {
+      this.logger.log('info', `Received signal ${sig}, shutting down gracefully`);
+      this.handleShutdown()
+        .then(() => process.exit(0))
+        .catch((err) => {
+          this.logger.log('error', 'Error during shutdown', err).then(() => process.exit(1));
+        });
+    }
 
   /**
    * gets a certificate
@@ -110,71 +207,91 @@ export class SmartAcme {
    *
    * @param domainArg
    */
-  public async getCertificateForDomain(domainArg: string): Promise<Cert> {
+  public async getCertificateForDomain(domainArg: string): Promise<SmartacmeCert> {
     const certDomainName = this.certmatcher.getCertificateDomainNameByDomainName(domainArg);
     const retrievedCertificate = await this.certmanager.retrieveCertificate(certDomainName);
 
-    if (!retrievedCertificate && await this.certmanager.interestMap.checkInterest(certDomainName)) {
+    if (
+      !retrievedCertificate &&
+      (await this.certmanager.interestMap.checkInterest(certDomainName))
+    ) {
       const existingCertificateInterest = this.certmanager.interestMap.findInterest(certDomainName);
       const certificate = existingCertificateInterest.interestFullfilled;
       return certificate;
     } else if (retrievedCertificate && !retrievedCertificate.shouldBeRenewed()) {
       return retrievedCertificate;
-    } else if (retrievedCertificate && retrievedCertificate.shouldBeRenewed) {
+    } else if (retrievedCertificate && retrievedCertificate.shouldBeRenewed()) {
       await retrievedCertificate.delete();
     }
 
     // lets make sure others get the same interest
-    await this.certmanager.interestMap.addInterest(certDomainName);
-    
+    const currentDomainInterst = await this.certmanager.interestMap.addInterest(certDomainName);
 
-    /* Place new order */
-    const order = await this.client.createOrder({
+    /* Place new order with retry */
+    const order = await this.retry(() => this.client.createOrder({
       identifiers: [
         { type: 'dns', value: certDomainName },
-        { type: 'dns', value: `*.${certDomainName}` }
-      ]
-    });
+        { type: 'dns', value: `*.${certDomainName}` },
+      ],
+    }), 'createOrder');
 
     /* Get authorizations and select challenges */
-    const authorizations = await this.client.getAuthorizations(order);
+    const authorizations = await this.retry(() => this.client.getAuthorizations(order), 'getAuthorizations');
 
     for (const authz of authorizations) {
-      console.log(authz);
-      const fullHostName: string = `_acme-challenge.${authz.identifier.value}`;
-      const dnsChallenge: string = authz.challenges.find(challengeArg => {
-        return challengeArg.type === 'dns-01';
-      });
-      // process.exit(1);
-      const keyAuthorization: string = await this.client.getChallengeKeyAuthorization(dnsChallenge);
-
+      await this.logger.log('debug', 'Authorization received', authz);
+      // select a handler based on configured priority
+      let selectedHandler: { type: string; handler: plugins.handlers.IChallengeHandler<any> } | null = null;
+      let selectedChallengeArg: any = null;
+      for (const type of this.challengePriority) {
+        const candidate = authz.challenges.find((c: any) => c.type === type);
+        if (!candidate) continue;
+        const handler = this.challengeHandlers.find((h) => h.getSupportedTypes().includes(type));
+        if (handler) {
+          selectedHandler = { type, handler };
+          selectedChallengeArg = candidate;
+          break;
+        }
+      }
+      if (!selectedHandler) {
+        throw new Error(`No challenge handler for domain ${authz.identifier.value}: supported types [${this.challengePriority.join(',')}]`);
+      }
+      const { type, handler } = selectedHandler;
+      // build handler input with keyAuthorization
+      let input: any;
+      // retrieve keyAuthorization for challenge
+      const keyAuth = await this.client.getChallengeKeyAuthorization(selectedChallengeArg);
+      if (type === 'dns-01') {
+        input = { type, hostName: `_acme-challenge.${authz.identifier.value}`, challenge: keyAuth };
+      } else if (type === 'http-01') {
+        // HTTP-01 requires serving token at webPath
+        input = {
+          type,
+          token: (selectedChallengeArg as any).token,
+          keyAuthorization: keyAuth,
+          webPath: `/.well-known/acme-challenge/${(selectedChallengeArg as any).token}`,
+        };
+      } else {
+        // generic challenge input: include raw challenge properties
+        input = { type, keyAuthorization: keyAuth, ...selectedChallengeArg };
+      }
+      this.pendingChallenges.push(input);
       try {
-        /* Satisfy challenge */
-        await this.setChallenge({
-          hostName: fullHostName,
-          challenge: keyAuthorization
-        });
-        await this.smartdns.checkUntilAvailable(fullHostName, 'TXT', keyAuthorization, 100, 5000);
-        console.log('Cool down an extra 60 second for region availability');
-        await plugins.smartdelay.delayFor(60000);
-
-        /* Verify that challenge is satisfied */
-        await this.client.verifyChallenge(authz, dnsChallenge);
-
-        /* Notify ACME provider that challenge is satisfied */
-        await this.client.completeChallenge(dnsChallenge);
-
-        /* Wait for ACME provider to respond with valid status */
-        await this.client.waitForValidStatus(dnsChallenge);
+        await this.retry(() => handler.prepare(input), `${type}.prepare`);
+        if (handler.verify) {
+          await this.retry(() => handler.verify!(input), `${type}.verify`);
+        } else {
+          await this.retry(() => this.client.verifyChallenge(authz, selectedChallengeArg), `${type}.verifyChallenge`);
+        }
+        await this.retry(() => this.client.completeChallenge(selectedChallengeArg), `${type}.completeChallenge`);
+        await this.retry(() => this.client.waitForValidStatus(selectedChallengeArg), `${type}.waitForValidStatus`);
       } finally {
-        /* Clean up challenge response */
         try {
-          await this.removeChallenge({
-            hostName: fullHostName,
-            challenge: keyAuthorization
-          });
-        } catch (e) {
-          console.log(e);
+          await this.retry(() => handler.cleanup(input), `${type}.cleanup`);
+        } catch (err) {
+          await this.logger.log('error', `Error during ${type}.cleanup`, err);
+        } finally {
+          this.pendingChallenges = this.pendingChallenges.filter((c) => c !== input);
         }
       }
     }
@@ -182,11 +299,11 @@ export class SmartAcme {
     /* Finalize order */
     const [key, csr] = await plugins.acme.forge.createCsr({
       commonName: `*.${certDomainName}`,
-      altNames: [certDomainName]
+      altNames: [certDomainName],
     });
 
-    await this.client.finalizeOrder(order, csr);
-    const cert = await this.client.getCertificate(order);
+    await this.retry(() => this.client.finalizeOrder(order, csr), 'finalizeOrder');
+    const cert = await this.retry(() => this.client.getCertificate(order), 'getCertificate');
 
     /* Done */
 
@@ -200,11 +317,17 @@ export class SmartAcme {
       validUntil:
         Date.now() +
         plugins.smarttime.getMilliSecondsFromUnits({
-          days: 90
-        })
+          days: 90,
+        }),
     });
 
     const newCertificate = await this.certmanager.retrieveCertificate(certDomainName);
+    currentDomainInterst.fullfillInterest(newCertificate);
+    currentDomainInterst.destroy();
     return newCertificate;
   }
+
+  public async getAllCertificates(): Promise<SmartacmeCert[]> {
+    return SmartacmeCert.getInstances({});
+  }
 }

ts/smartacme.plugins.ts

@@ -1,38 +1,42 @@
+// @apiglobal scope
+import * as typedserver from '@api.global/typedserver';
+
+export { typedserver };
+
 // @pushrocks scope
-import * as lik from '@pushrocks/lik';
-import * as smartdata from '@pushrocks/smartdata';
-import * as smartdelay from '@pushrocks/smartdelay';
-import * as smartdns from '@pushrocks/smartdns';
-import * as smartexpress from '@pushrocks/smartexpress';
-import * as smartlog from '@pushrocks/smartlog';
-import * as smartpromise from '@pushrocks/smartpromise';
-import * as smartrequest from '@pushrocks/smartrequest';
-import * as smartunique from '@pushrocks/smartunique';
-import * as smartstring from '@pushrocks/smartstring';
-import * as smarttime from '@pushrocks/smarttime';
+import * as lik from '@push.rocks/lik';
+import * as smartdata from '@push.rocks/smartdata';
+import * as smartdelay from '@push.rocks/smartdelay';
+import * as smartdnsClient from '@push.rocks/smartdns/client';
+import * as smartlog from '@push.rocks/smartlog';
+import * as smartpromise from '@push.rocks/smartpromise';
+import * as smartrequest from '@push.rocks/smartrequest';
+import * as smartunique from '@push.rocks/smartunique';
+import * as smartstring from '@push.rocks/smartstring';
+import * as smarttime from '@push.rocks/smarttime';
 
 export {
   lik,
   smartdata,
   smartdelay,
-  smartdns,
-  smartexpress,
+  smartdnsClient,
   smartlog,
   smartpromise,
   smartrequest,
   smartunique,
   smartstring,
-  smarttime
+  smarttime,
 };
 
 // @tsclass scope
 import * as tsclass from '@tsclass/tsclass';
 
-export {
-  tsclass
-}
+export { tsclass };
 
 // third party scope
 import * as acme from 'acme-client';
 
 export { acme };
+// local handlers for challenge types
+import * as handlers from './handlers/index.js';
+export { handlers };

tsconfig.json

@@ -1,7 +1,22 @@
 {
   "compilerOptions": {
     "experimentalDecorators": true,
-    "target": "es2017",
-    "module": "commonjs"
-  }
-}
+    "emitDecoratorMetadata": true,
+    "useDefineForClassFields": false,
+    "target": "ES2022",
+    "module": "NodeNext",
+    "moduleResolution": "NodeNext",
+    "esModuleInterop": true,
+    "verbatimModuleSyntax": true,
+    "baseUrl": ".",
+    "paths": {}
+  },
+  "include": [
+    "ts/**/*.ts"
+  ],
+  "exclude": [
+    "node_modules",
+    "test",
+    "dist_*/**/*.d.ts"
+  ]
+}

tslint.json

@@ -1,17 +0,0 @@
-{
-  "extends": ["tslint:latest", "tslint-config-prettier"],
-  "rules": {
-    "semicolon": [true, "always"],
-    "no-console": false,
-    "ordered-imports": false,
-    "object-literal-sort-keys": false,
-    "member-ordering": {
-      "options":{
-        "order": [
-          "static-method"
-        ]
-      }
-    }
-  },
-  "defaultSeverity": "warning"
-}