.gitignore

@@ -1,12 +1,6 @@
-greenlock.json*
+TODO.txt
-TODO*
 link.sh
 .env
-.greenlockrc
-# generated by init
-app.js
-server.js
-example.js
 
 # ---> Node
 # Logs

MIGRATION_GUIDE_V2_V3.md

@@ -1,36 +1,4 @@
-# Migrating Guide
+# Migrating from Greenlock v2 to v3
-
-Greenlock v4 is the current version.
-
-# v3 to v4
-
-v4 is a very minor, but breaking, change from v3
-
-### `configFile` is replaced with `configDir`
-
-The default config file `./greenlock.json` is now `./greenlock.d/config.json`.
-
-This was change was mode to eliminate unnecessary configuration that was inadvertantly introduced in v3.
-
-### `.greenlockrc` is auto-generated
-
-`.greenlockrc` exists for the sake of tooling - so that the CLI, Web API, and your code naturally stay in sync.
-
-It looks like this:
-
-```json
-{
-    "manager": {
-        "module": "@greenlock/manager"
-    },
-    "configDir": "./greenlock.d"
-}
-```
-
-If you deploy to a read-only filesystem, it is best that you create the `.greenlockrc` file as part
-of your image and use that rather than including any configuration in your code.
-
-# v2 to v4
 
 **Greenlock Express** uses Greenlock directly, the same as before.
 
@@ -227,11 +195,11 @@ as well as a set of callbacks for easy configurability.
 
 ### Default Manager
 
-The default manager is `@greenlock/manager` and the default `configDir` is `./.greenlock.d`.
+The default manager is `greenlock-manager-fs` and the default `configFile` is `~/.config/greenlock/manager.json`.
 
 The config file should look something like this:
 
-`./greenlock.d/config.json`:
+`~/.config/greenlock/manager.json`:
 
 ```json
 {
@@ -288,20 +256,29 @@ The same is true with `greenlock-store-*` plugins:
 
 ### Customer Manager, the lazy way
 
-At the very least you have to implement `get({ servername, wildname })`.
+At the very least you have to implement `find({ servername })`.
+
+Since this is a very common use case, it's supported out of the box as part of the default manager plugin:
 
 ```js
 var greenlock = Greenlock.create({
     packageAgent: pkg.name + '/' + pkg.version,
     maintainerEmail: 'jon@example.com',
     notify: notify,
-
+    find: find
-    packageRoot: __dirname,
-    manager: {
-        module: './manager.js'
-    }
 });
 
+// In the simplest case you can ignore all incoming options
+// and return a single site config in the same format as the config file
+
+function find(options) {
+    var servername = options.servername; // www.example.com
+    var wildname = options.wildname; // *.example.com
+    return Promise.resolve([
+        { subject: 'example.com', altnames: ['example.com', 'www.example.com'] }
+    ]);
+}
+
 function notify(ev, args) {
     if ('error' === ev || 'warning' === ev) {
         console.error(ev, args);
@@ -311,61 +288,102 @@ function notify(ev, args) {
 }
 ```
 
-In the simplest case you can ignore all incoming options
+If you want to use wildcards or local domains, you must specify the `dns-01` challenge plugin to use:
-and return a single site config in the same format as the config file
-
-`./manager.js`:
 
 ```js
-'use strict';
+function find(options) {
-
+    var subject = options.subject;
-module.exports.create = function() {
+    // may include wildcard
-    return {
+    var altnames = options.altnames;
-        get: async function({ servername }) {
+    var wildname = options.wildname; // *.example.com
-            // do something to fetch the site
+    return Promise.resolve([
-            var site = {
+        {
-                subject: 'example.com',
-                altnames: ['example.com', 'www.example.com']
-            };
-
-            return site;
-        }
-    };
-};
-```
-
-If you want to use wildcards or local domains for a specific domain, you must specify the `dns-01` challenge plugin to use:
-
-```js
-'use strict';
-
-module.exports.create = function() {
-    return {
-        get: async function({ servername }) {
-            // do something to fetch the site
-            var site = {
             subject: 'example.com',
             altnames: ['example.com', 'www.example.com'],
-
-                // dns-01 challenge
             challenges: {
-                    'dns-01': {
+                'dns-01': { module: 'acme-dns-01-namedotcom', apikey: 'xxxx' }
-                        module: 'acme-dns-01-namedotcom',
-                        apikey: 'xxxx'
             }
         }
+    ]);
+}
+```
+
+### Customer Manager, complete
+
+To use a fully custom manager, you give the npm package name, or absolute path to the file to load
+
+```js
+Greenlock.create({
+    // Greenlock Options
+    maintainerEmail: 'jon@example.com',
+    packageAgent: 'my-package/v2.1.1',
+    notify: notify,
+
+    // file path or npm package name
+    manager: '/path/to/manager.js',
+    // options that get passed to the manager
+    myFooOption: 'whatever'
+});
+```
+
+The manager itself is, again relatively simple:
+
+-   find(options)
+-   set(siteConfig)
+-   remove(options)
+-   defaults(globalOptions) (as setter)
+    -   defaults() => globalOptions (as getter)
+
+`/path/to/manager.js`:
+
+```js
+'use strict';
+
+module.exports.create = function() {
+    var manager = {};
+
+    manager.find = async function({ subject, altnames, renewBefore }) {
+        if (subject) {
+            return getSiteConfigBySubject(subject);
+        }
+
+        if (altnames) {
+            // may include wildcards
+            return getSiteConfigByAnyAltname(altnames);
+        }
+
+        if (renewBefore) {
+            return getSiteConfigsWhereRenewAtIsLessThan(renewBefore);
+        }
+
+        return [];
     };
 
-            return site;
+    manage.set = function(opts) {
+        // this is called by greenlock.add({ subject, altnames })
+        // it's also called by greenlock._update({ subject, renewAt })
+
+        return mergSiteConfig(subject, opts);
+    };
+
+    manage.remove = function({ subject, altname }) {
+        if (subject) {
+            return removeSiteConfig(subject);
         }
+
+        return removeFromSiteConfigAndResetRenewAtToZero(altname);
+    };
+
+    // set the global config
+    manage.defaults = function(options) {
+        if (!options) {
+            return getGlobalConfig();
+        }
+        return mergeGlobalConfig(options);
     };
 };
 ```
 
-### Customer Manager, Complete
-
-See <https://git.rootprojects.org/root/greenlock-manager-test.js#quick-start>
-
 # ACME Challenge Plugins
 
 The ACME challenge plugins are just a few simple callbacks:
@@ -401,3 +419,99 @@ They are described here:
 -   [greenlock store documentation](https://git.rootprojects.org/root/greenlock-store-test.js)
 
 If you are just implenting in-house and are not going to publish a module, you can also do some hack things like this:
+
+### Custome Store, The hacky / lazy way
+
+`/path/to/project/my-hacky-store.js`:
+
+```js
+'use strict';
+
+module.exports.create = function(options) {
+    // ex: /path/to/account.ecdsa.jwk.json
+    var accountJwk = require(options.accountJwkPath);
+    // ex: /path/to/privkey.rsa.pem
+    var serverPem = fs.readFileSync(options.serverPemPath, 'ascii');
+    var accounts = {};
+    var certificates = {};
+    var store = { accounts, certificates };
+
+    // bare essential account callbacks
+    accounts.checkKeypair = function() {
+        // ignore all options and just return a single, global keypair
+
+        return Promise.resolve({
+            privateKeyJwk: accountJwk
+        });
+    };
+    accounts.setKeypair = function() {
+        // this will never get called if checkKeypair always returns
+
+        return Promise.resolve({});
+    };
+
+    // bare essential cert and key callbacks
+    certificates.checkKeypair = function() {
+        // ignore all options and just return a global server keypair
+
+        return {
+            privateKeyPem: serverPem
+        };
+    };
+    certificates.setKeypair = function() {
+        // never gets called if checkKeypair always returns an existing key
+
+        return Promise.resolve(null);
+    };
+
+    certificates.check = function(args) {
+        var subject = args.subject;
+        // make a database call or whatever to get a certificate
+        return goGetCertBySubject(subject).then(function() {
+            return {
+                pems: {
+                    chain: '<PEM>',
+                    cert: '<PEM>'
+                }
+            };
+        });
+    };
+    certificates.set = function(args) {
+        var subject = args.subject;
+        var cert = args.pems.cert;
+        var chain = args.pems.chain;
+
+        // make a database call or whatever to get a certificate
+        return goSaveCert({
+            subject,
+            cert,
+            chain
+        });
+    };
+};
+```
+
+### Using the hacky / lazy store plugin
+
+That sort of implementation won't pass the test suite, but it'll work just fine a use case where you only have one subscriber email (most of the time),
+you only have one server key (not recommended, but works), and you only really want to worry about storing cetificates.
+
+Then you could assign it as the default for all of your sites:
+
+```json
+{
+    "subscriberEmail": "jon@example.com",
+    "agreeToTerms": true,
+    "sites": {
+        "example.com": {
+            "subject": "example.com",
+            "altnames": ["example.com", "www.example.com"]
+        }
+    },
+    "store": {
+        "module": "/path/to/project/my-hacky-store.js",
+        "accountJwkPath": "/path/to/account.ecdsa.jwk.json",
+        "serverPemPath": "/path/to/privkey.rsa.pem"
+    }
+}
+```

README.md

@@ -1,10 +1,12 @@
-# New Documentation & [v4 Migration Guide](https://git.rootprojects.org/root/greenlock.js/src/branch/master/MIGRATION_GUIDE.md)
+# New Documentation & [v2/v3 Migration Guide](https://git.rootprojects.org/root/greenlock.js/src/branch/v3/MIGRATION_GUIDE_V2_V3.md)
+
+Greenlock v3 was just released from private beta **today** (Nov 1st, 2019).
 
 We're still working on the full documentation for this new version,
 so please be patient.
 
 To start, check out the
-[Migration Guide](https://git.rootprojects.org/root/greenlock.js/src/branch/master/MIGRATION_GUIDE.md).
+[Migration Guide](https://git.rootprojects.org/root/greenlock.js/src/branch/v3/MIGRATION_GUIDE_V2_V3.md).
 
 !["Greenlock Logo"](https://git.rootprojects.org/root/greenlock.js/raw/branch/master/logo/greenlock-1063x250.png 'Greenlock lock logo and work mark')
 
@@ -83,11 +85,12 @@ Certificates are renewed every 45 days by default, and renewal checks will happe
 var pkg = require('./package.json');
 var Greenlock = require('greenlock');
 var greenlock = Greenlock.create({
-    packageRoot: __dirname,
-    configDir: "./greenlock.d/",
     packageAgent: pkg.name + '/' + pkg.version,
     maintainerEmail: pkg.author,
     staging: true,
+    manager: require('greenlock-manager-fs').create({
+        configFile: '~/.config/greenlock/manager.json'
+    }),
     notify: function(event, details) {
         if ('error' === event) {
             // `details` is an error object in this case
@@ -168,7 +171,7 @@ greenlock
 -->
 
 <details>
-<summary>Greenlock.create({ configDir, packageAgent, maintainerEmail, staging })</summary>
+<summary>Greenlock.create({ packageAgent, maintainerEmail, staging })</summary>
 
 ## Greenlock.create()
 
@@ -178,15 +181,12 @@ Creates an instance of greenlock with _environment_-level values.
 
 var pkg = require('./package.json');
 var gl = Greenlock.create({
-    configDir: './greenlock.d/',
-
     // Staging for testing environments
     staging: true,
 
     // This should be the contact who receives critical bug and security notifications
     // Optionally, you may receive other (very few) updates, such as important new features
     maintainerEmail: 'jon@example.com',
-
     // for an RFC 8555 / RFC 7231 ACME client user agent
     packageAgent: pkg.name + '/' pkg.version
 });
@@ -194,7 +194,6 @@ var gl = Greenlock.create({
 
 | Parameter       | Description                                                                          |
 | --------------- | ------------------------------------------------------------------------------------ |
-| configDir       | the directory to use for file-based plugins                                          |
 | maintainerEmail | the developer contact for critical bug and security notifications                    |
 | packageAgent    | if you publish your package for others to use, `require('./package.json').name` here |
 | staging         | use the Let's Encrypt staging URL instead of the production URL                      |
@@ -403,8 +402,8 @@ Greenlock comes with reasonable defaults but when you install it,
 you should also install any plugins that you need.
 
 ```bash
-npm install --save @root/greenlock@v4
+npm install --save @root/greenlock
-npm install --save @greenlock/manager
+npm install --save greenlock-manager-fs
 npm install --save greenlock-store-fs
 npm install --save acme-http-01-standalone
 ```
@@ -465,7 +464,7 @@ This is what keeps the mapping of domains <-> certificates.
 In many cases it will interact with the same database as the Key & Cert Store, and probably the code as well.
 
 -   set({ subject, altnames, renewAt })
--   find({ servernames, renewBefore })
+-   find({ altnames, renewBefore })
     ```js
     // should return a list of site configs:
     [

bin/add.js

@@ -1,91 +0,0 @@
-'use strict';
-
-var args = process.argv.slice(3);
-var cli = require('./lib/cli.js');
-//var path = require('path');
-//var pkgpath = path.join(__dirname, '..', 'package.json');
-//var pkgpath = path.join(process.cwd(), 'package.json');
-
-var Flags = require('./lib/flags.js');
-
-Flags.init().then(function({ flagOptions, greenlock, mconf }) {
-    var myFlags = {};
-    [
-        'subject',
-        'altnames',
-        'renew-offset',
-        'subscriber-email',
-        'customer-email',
-        'server-key-type',
-        'challenge-http-01',
-        'challenge-http-01-xxxx',
-        'challenge-dns-01',
-        'challenge-dns-01-xxxx',
-        'challenge-tls-alpn-01',
-        'challenge-tls-alpn-01-xxxx',
-        'challenge',
-        'challenge-xxxx',
-        'challenge-json',
-        'force-save'
-    ].forEach(function(k) {
-        myFlags[k] = flagOptions[k];
-    });
-
-    cli.parse(myFlags);
-    cli.main(function(argList, flags) {
-        Flags.mangleFlags(flags, mconf);
-        main(argList, flags, greenlock);
-    }, args);
-});
-
-async function main(_, flags, greenlock) {
-    if (!flags.subject || !flags.altnames) {
-        console.error(
-            '--subject and --altnames must be provided and should be valid domains'
-        );
-        process.exit(1);
-        return;
-    }
-
-    greenlock
-        .add(flags)
-        .catch(function(err) {
-            console.error();
-            console.error('error:', err.message);
-            console.error();
-            process.exit(1);
-        })
-        .then(function() {
-            return greenlock
-                ._config({
-                    servername:
-                        flags.altnames[
-                            Math.floor(Math.random() * flags.altnames.length)
-                        ]
-                })
-                .then(function(site) {
-                    if (!site) {
-                        console.info();
-                        console.info(
-                            'Internal bug or configuration mismatch: No config found.'
-                        );
-                        console.info();
-                        process.exit(1);
-                        return;
-                    }
-
-                    console.info();
-                    Object.keys(site).forEach(function(k) {
-                        if ('defaults' === k) {
-                            console.info(k + ':');
-                            Object.keys(site.defaults).forEach(function(key) {
-                                var value = JSON.stringify(site.defaults[key]);
-                                console.info('\t' + key + ':' + value);
-                            });
-                        } else {
-                            console.info(k + ': ' + JSON.stringify(site[k]));
-                        }
-                    });
-                });
-        });
-}

bin/cli.js

@@ -12,13 +12,6 @@ CLI.parse = function(conf) {
 
     Object.keys(conf).forEach(function(k) {
         var v = conf[k];
-        if (!v) {
-            console.error(
-                'Developer Error: missing cli flag definition for',
-                JSON.stringify(k)
-            );
-            process.exit(1);
-        }
         var aliases = v[5];
         var bag;
         var bagName;
@@ -92,6 +85,7 @@ CLI.main = function(cb, args) {
         if (bag !== flag.slice(0, bag.length)) {
             return false;
         }
+        console.log(bagName, toCamel(flag.slice(bag.length)));
         opts[bagName][toCamel(flag.slice(bag.length))] = args.shift();
         return true;
     }
@@ -119,7 +113,7 @@ CLI.main = function(cb, args) {
 
         // only long names are actually used
         if ('--' !== flag.slice(0, 2)) {
-            console.error("error: unrecognized flag '" + flag + "'");
+            console.error("Unrecognized argument '" + flag + "'");
             process.exit(1);
         }
 
@@ -131,7 +125,7 @@ CLI.main = function(cb, args) {
             }
 
             // other arbitrary args are not used
-            console.error("unrecognized elided flag '" + flag + "'");
+            console.error("Unrecognized flag '" + flag + "'");
             process.exit(1);
         }
 

bin/config.js

@@ -1,96 +0,0 @@
-'use strict';
-
-var args = process.argv.slice(3);
-var cli = require('./lib/cli.js');
-//var path = require('path');
-//var pkgpath = path.join(__dirname, '..', 'package.json');
-//var pkgpath = path.join(process.cwd(), 'package.json');
-
-var Flags = require('./lib/flags.js');
-
-Flags.init().then(function({ flagOptions, greenlock, mconf }) {
-    var myFlags = {};
-    ['all', 'subject', 'servername' /*, 'servernames', 'altnames'*/].forEach(
-        function(k) {
-            myFlags[k] = flagOptions[k];
-        }
-    );
-
-    cli.parse(myFlags);
-    cli.main(function(argList, flags) {
-        Flags.mangleFlags(flags, mconf);
-        main(argList, flags, greenlock);
-    }, args);
-});
-
-async function main(_, flags, greenlock) {
-    var servernames = [flags.subject]
-        .concat([flags.servername])
-        //.concat(flags.servernames)
-        //.concat(flags.altnames)
-        .filter(Boolean);
-    delete flags.subject;
-    delete flags.altnames;
-    flags.servernames = servernames;
-    if (!flags.all && flags.servernames.length > 1) {
-        console.error('Error: should specify either --subject OR --servername');
-        process.exit(1);
-        return;
-    } else if (!flags.all && flags.servernames.length !== 1) {
-        console.error('error: missing --servername <example.com>');
-        process.exit(1);
-        return;
-    }
-    if (!flags.all) {
-        flags.servername = flags.servernames[0];
-    } else if (flags.servername) {
-        console.error(
-            'error: missing cannot have --all and --servername / --subject'
-        );
-        process.exit(1);
-    }
-    delete flags.servernames;
-
-    var getter = function() {
-        return greenlock._config(flags);
-    };
-    if (flags.all) {
-        getter = function() {
-            return greenlock._configAll(flags);
-        };
-    }
-    return getter()
-        .catch(function(err) {
-            console.error();
-            console.error('error:', err.message);
-            //console.log(err.stack);
-            console.error();
-            process.exit(1);
-        })
-        .then(function(sites) {
-            if (!sites) {
-                console.info();
-                if (flags.all) {
-                    console.info('No configs found');
-                } else {
-                    console.info('No config found for', flags.servername);
-                }
-                console.info();
-                process.exit(1);
-                return;
-            }
-            if (!Array.isArray(sites)) {
-                sites = [sites];
-            }
-
-            sites.forEach(function(site) {
-                console.info();
-                console.info(
-                    'Config for ' +
-                        JSON.stringify(flags.servername || site.subject) +
-                        ':'
-                );
-                console.info(JSON.stringify(site, null, 2));
-            });
-        });
-}

bin/defaults.js

@@ -1,62 +0,0 @@
-'use strict';
-
-var args = process.argv.slice(3);
-var cli = require('./lib/cli.js');
-//var path = require('path');
-//var pkgpath = path.join(__dirname, '..', 'package.json');
-//var pkgpath = path.join(process.cwd(), 'package.json');
-
-var Flags = require('./lib/flags.js');
-
-Flags.init({ forceSave: true }).then(function({
-    flagOptions,
-    greenlock,
-    mconf
-}) {
-    var myFlags = {};
-    [
-        'agree-to-terms',
-        'account-key-type',
-        'server-key-type',
-        'subscriber-email',
-        'renew-offset',
-        'store',
-        'store-xxxx',
-        'challenge-http-01-xxxx',
-        'challenge-dns-01',
-        'challenge-dns-01-xxxx',
-        'challenge-tls-alpn-01',
-        'challenge-tls-alpn-01-xxxx',
-        'challenge',
-        'challenge-xxxx',
-        'challenge-http-01'
-    ].forEach(function(k) {
-        myFlags[k] = flagOptions[k];
-    });
-
-    cli.parse(myFlags);
-    cli.main(function(argList, flags) {
-        Flags.mangleFlags(flags, mconf, null, { forceSave: true });
-        main(argList, flags, greenlock);
-    }, args);
-});
-
-async function main(_, flags, greenlock) {
-    greenlock.manager
-        .defaults(flags)
-        .catch(function(err) {
-            console.error();
-            console.error('error:', err.message);
-            //console.log(err.stack);
-            console.error();
-            process.exit(1);
-        })
-        .then(function() {
-            return greenlock.manager.defaults();
-        })
-        .then(function(dconf) {
-            console.info();
-            console.info('Global config');
-            console.info(JSON.stringify(dconf, null, 2));
-        });
-}

bin/greenlock.js

@@ -2,25 +2,12 @@
 'use strict';
 
 var args = process.argv.slice(2);
-var arg0 = args[0];
 //console.log(args);
-
+//['certonly', 'add', 'config', 'defaults', 'remove']
-var found = [
+if ('certonly' === args[0]) {
-    'certonly',
+    require('./certonly.js');
-    'add',
+    return;
-    'update',
-    'config',
-    'defaults',
-    'remove',
-    'init'
-].some(function(k) {
-    if (k === arg0) {
-        require('./' + k);
-        return true;
-    }
-});
-
-if (!found) {
-    console.error(arg0 + ': command not yet implemented');
-    process.exit(1);
 }
+
+console.error("command not yet implemented");
+process.exit();

bin/init.js

@@ -1,162 +0,0 @@
-'use strict';
-
-var P = require('../plugins.js');
-var args = process.argv.slice(3);
-var cli = require('./lib/cli.js');
-var Greenlock = require('../');
-
-var Flags = require('./lib/flags.js');
-
-var flagOptions = Flags.flags();
-var myFlags = {};
-[
-    'config-dir',
-    'maintainer-email',
-    'cluster',
-    'manager',
-    'manager-xxxx'
-].forEach(function(k) {
-    myFlags[k] = flagOptions[k];
-});
-
-cli.parse(myFlags);
-cli.main(async function(argList, flags) {
-    var pkgRoot = process.cwd();
-    var manager = flags.manager;
-
-    if (['fs', 'cloud'].includes(manager)) {
-        manager = '@greenlock/manager';
-    }
-    if (['cloud'].includes(manager)) {
-        flags.managerOpts.cloud = true;
-    }
-
-    flags.manager = flags.managerOpts;
-    delete flags.managerOpts;
-    flags.manager.module = manager;
-
-    try {
-        if ('.' === String(manager)[0]) {
-            manager = require('path').resolve(pkgRoot, manager);
-        }
-        P._loadSync(manager);
-    } catch (e) {
-        try {
-            P._installSync(manager);
-        } catch (e) {
-            console.error(
-                'error:',
-                JSON.stringify(manager),
-                'could not be loaded, and could not be installed.'
-            );
-            process.exit(1);
-        }
-    }
-
-    var greenlock = Greenlock.create({
-        packageRoot: pkgRoot,
-        manager: flags.manager,
-        configDir: flags.configDir,
-        maintainerEmail: flags.maintainerEmail,
-        _mustPackage: true
-    });
-    await greenlock.manager.defaults();
-
-    //writeGreenlockJs(pkgdir, flags);
-    writeServerJs(pkgRoot, flags);
-    writeAppJs(pkgRoot);
-
-    /*
-    rc._bin_mode = true;
-    var Greenlock = require('../');
-    // this is a copy, so it's safe to modify
-    var greenlock = Greenlock.create(rc);
-    var mconf = await greenlock.manager.defaults();
-    var flagOptions = Flags.flags(mconf, myOpts);
-    */
-}, args);
-
-/*
-function writeGreenlockJs(pkgdir, flags) {
-    var greenlockJs = 'greenlock.js';
-    var fs = require('fs');
-    var path = require('path');
-    var tmpl = fs.readFileSync(
-        path.join(__dirname, 'tmpl/greenlock.tmpl.js'),
-        'utf8'
-    );
-
-    try {
-        fs.accessSync(path.join(pkgdir, greenlockJs));
-        console.warn("[skip] '%s' exists", greenlockJs);
-        return;
-    } catch (e) {
-        // continue
-    }
-
-    if (flags.maintainerEmail) {
-        tmpl = tmpl.replace(
-            /pkg.author/g,
-            JSON.stringify(flags.maintainerEmail)
-        );
-    }
-    fs.writeFileSync(path.join(pkgdir, greenlockJs), tmpl);
-    console.info("created '%s'", greenlockJs);
-}
-*/
-
-function writeServerJs(pkgdir, flags) {
-    var serverJs = 'server.js';
-    var fs = require('fs');
-    var path = require('path');
-    var tmpl;
-
-    try {
-        fs.accessSync(path.join(pkgdir, serverJs));
-        console.warn("[skip] '%s' exists", serverJs);
-        return;
-    } catch (e) {
-        // continue
-    }
-
-    if (flags.cluster) {
-        tmpl = fs.readFileSync(
-            path.join(__dirname, 'tmpl/cluster.tmpl.js'),
-            'utf8'
-        );
-        tmpl = tmpl.replace(/cluster: false/g, 'cluster: true');
-    } else {
-        tmpl = fs.readFileSync(
-            path.join(__dirname, 'tmpl/server.tmpl.js'),
-            'utf8'
-        );
-    }
-
-    if (flags.maintainerEmail) {
-        tmpl = tmpl
-            .replace(/pkg.author/g, JSON.stringify(flags.maintainerEmail))
-            .replace(/\/\/maintainerEmail/g, 'maintainerEmail');
-    }
-
-    fs.writeFileSync(path.join(pkgdir, serverJs), tmpl);
-    console.info("created '%s'", serverJs);
-}
-
-function writeAppJs(pkgdir) {
-    var appJs = 'app.js';
-    var fs = require('fs');
-    var path = require('path');
-    var tmpl = fs.readFileSync(
-        path.join(__dirname, 'tmpl/app.tmpl.js'),
-        'utf8'
-    );
-
-    try {
-        fs.accessSync(path.join(pkgdir, appJs));
-        console.warn("[skip] '%s' exists", appJs);
-        return;
-    } catch (e) {
-        fs.writeFileSync(path.join(pkgdir, appJs), tmpl);
-        console.info("created '%s'", appJs);
-    }
-}

bin/lib/flags.js

@@ -1,400 +0,0 @@
-'use strict';
-
-var Flags = module.exports;
-
-//var path = require('path');
-var pkgRoot = process.cwd();
-//var Init = require('../../lib/init.js');
-
-// These are ALL options
-// The individual CLI files each select a subset of them
-Flags.flags = function(mconf, myOpts) {
-    // Current Manager Config
-    if (!mconf) {
-        mconf = {};
-    }
-
-    // Extra Override Options
-    if (!myOpts) {
-        myOpts = {};
-    }
-
-    return {
-        all: [
-            false,
-            'search all site configs rather than by --subject or --servernames',
-            'boolean'
-        ],
-        'agree-to-terms': [
-            false,
-            "agree to the Let's Encrypts Subscriber Agreement and Greenlock Terms of Use",
-            'boolean'
-        ],
-        subject: [
-            false,
-            'the "subject" (primary domain) of the certificate',
-            'string'
-        ],
-        altnames: [
-            false,
-            'the "subject alternative names" (additional domains) on the certificate, the first of which MUST be the subject',
-            'string'
-        ],
-        servername: [
-            false,
-            'a name that matches a subject or altname',
-            'string'
-        ],
-        servernames: [
-            false,
-            'a list of names that matches a subject or altname',
-            'string'
-        ],
-        cluster: [false, 'initialize with cluster mode on', 'boolean', false],
-        'renew-offset': [
-            false,
-            "time to wait until renewing the cert such as '45d' (45 days after being issued) or '-3w' (3 weeks before expiration date)",
-            'string',
-            mconf.renewOffset
-        ],
-        'customer-email': [
-            false,
-            "the email address of the owner of the domain or site (not necessarily the Let's Encrypt or ACME subscriber)",
-            'string'
-        ],
-        'subscriber-email': [
-            false,
-            "the email address of the Let's Encrypt or ACME Account subscriber (not necessarily the domain owner)",
-            'string'
-        ],
-        'config-dir': [
-            false,
-            'the directory in which config.json and other config and storage files should be written',
-            'string'
-        ],
-        'maintainer-email': [
-            false,
-            'the maintainance contact for security and critical bug notices',
-            'string'
-        ],
-        'account-key-type': [
-            false,
-            "either 'P-256' (ECDSA) or 'RSA-2048'  - although other values are technically supported, they don't make sense and won't work with many services (More bits != More security)",
-            'string',
-            mconf.accountKeyType
-        ],
-        'server-key-type': [
-            false,
-            "either 'RSA-2048' or 'P-256' (ECDSA) - although other values are technically supported, they don't make sense and won't work with many services (More bits != More security)",
-            'string',
-            mconf.serverKeyType
-        ],
-        store: [
-            false,
-            'the module name or file path of the store module to use',
-            'string'
-            //mconf.store.module
-        ],
-        'store-xxxx': [
-            false,
-            'an option for the chosen store module, such as --store-apikey or --store-bucket',
-            'bag'
-        ],
-        manager: [
-            false,
-            'the module name or file path of the manager module to use',
-            'string',
-            '@greenlock/manager'
-        ],
-        'manager-xxxx': [
-            false,
-            'an option for the chosen manager module, such as --manager-apikey or --manager-dburl',
-            'bag'
-        ],
-        challenge: [
-            false,
-            'the module name or file path of the HTTP-01, DNS-01, or TLS-ALPN-01 challenge module to use',
-            'string',
-            ''
-            /*
-                Object.keys(mconf.challenges)
-                    .map(function(typ) {
-                        return mconf.challenges[typ].module;
-                    })
-                    .join(',')
-                */
-        ],
-        'challenge-xxxx': [
-            false,
-            'an option for the chosen challenge module, such as --challenge-apikey or --challenge-bucket',
-            'bag'
-        ],
-        'challenge-json': [
-            false,
-            'a JSON string containing all option for the chosen challenge module (instead of --challenge-xxxx)',
-            'json',
-            '{}'
-        ],
-        'challenge-http-01': [
-            false,
-            'the module name or file path of the HTTP-01 to add',
-            'string'
-            //(mconf.challenges['http-01'] || {}).module
-        ],
-        'challenge-http-01-xxxx': [
-            false,
-            'an option for the chosen challenge module, such as --challenge-http-01-apikey or --challenge-http-01-bucket',
-            'bag'
-        ],
-        'challenge-dns-01': [
-            false,
-            'the module name or file path of the DNS-01 to add',
-            'string'
-            //(mconf.challenges['dns-01'] || {}).module
-        ],
-        'challenge-dns-01-xxxx': [
-            false,
-            'an option for the chosen challenge module, such as --challenge-dns-01-apikey or --challenge-dns-01-bucket',
-            'bag'
-        ],
-        'challenge-tls-alpn-01': [
-            false,
-            'the module name or file path of the DNS-01 to add',
-            'string'
-            //(mconf.challenges['tls-alpn-01'] || {}).module
-        ],
-        'challenge-tls-alpn-01-xxxx': [
-            false,
-            'an option for the chosen challenge module, such as --challenge-tls-alpn-01-apikey or --challenge-tls-alpn-01-bucket',
-            'bag'
-        ],
-        'force-save': [
-            false,
-            "save all options for this site, even if it's the same as the defaults",
-            'boolean',
-            myOpts.forceSave || false
-        ]
-    };
-};
-
-Flags.init = async function(myOpts) {
-    var Greenlock = require('../../');
-
-    // this is a copy, so it's safe to modify
-    var greenlock = Greenlock.create({
-        packageRoot: pkgRoot,
-        _mustPackage: true,
-        _init: true,
-        _bin_mode: true
-    });
-    var mconf = await greenlock.manager.defaults();
-    var flagOptions = Flags.flags(mconf, myOpts);
-    return {
-        flagOptions,
-        greenlock,
-        mconf
-    };
-};
-
-Flags.mangleFlags = function(flags, mconf, sconf, extras) {
-    if (extras) {
-        if (extras.forceSave) {
-            flags.forceSave = true;
-        }
-    }
-    //console.log('debug a:', flags);
-
-    if ('altnames' in flags) {
-        flags.altnames = (flags.altnames || '').split(/[,\s]+/).filter(Boolean);
-    }
-    if ('servernames' in flags) {
-        flags.servernames = (flags.servernames || '')
-            .split(/[,\s]+/)
-            .filter(Boolean);
-    }
-
-    var store;
-    if (flags.store) {
-        store = flags.storeOpts;
-        store.module = flags.store;
-        flags.store = store;
-    } else {
-        delete flags.store;
-    }
-    delete flags.storeOpts;
-
-    // If this is additive, make an object to hold all values
-    var isAdditive = [
-        ['http-01', 'Http01'],
-        ['dns-01', 'Dns01'],
-        ['tls-alpn-01', 'TlsAlpn01']
-    ].some(function(types) {
-        var typCamel = types[1];
-        var modname = 'challenge' + typCamel;
-        if (flags[modname]) {
-            if (!flags.challenges) {
-                flags.challenges = {};
-            }
-            return true;
-        }
-    });
-    if (isAdditive && sconf) {
-        // copy over the old
-        var schallenges = sconf.challenges || {};
-        Object.keys(schallenges).forEach(function(k) {
-            if (!flags.challenges[k]) {
-                flags.challenges[k] = schallenges[k];
-            }
-        });
-    }
-
-    var typ;
-    var challenge;
-    if (flags.challenge) {
-        // this varient of the flag is exclusive
-        flags.challenges = {};
-        isAdditive = false;
-
-        if (/http-01/.test(flags.challenge)) {
-            typ = 'http-01';
-        } else if (/dns-01/.test(flags.challenge)) {
-            typ = 'dns-01';
-        } else if (/tls-alpn-01/.test(flags.challenge)) {
-            typ = 'tls-alpn-01';
-        }
-
-        var modname = 'challenge';
-        var optsname = 'challengeOpts';
-        challenge = flags[optsname];
-        // JSON may already have module name
-        if (challenge.module) {
-            if (flags[modname] && challenge.module !== flags[modname]) {
-                console.error(
-                    'module names do not match:',
-                    JSON.stringify(challenge.module),
-                    JSON.stringify(flags[modname])
-                );
-                process.exit(1);
-            }
-        } else {
-            challenge.module = flags[modname];
-        }
-        flags.challenges[typ] = challenge;
-
-        var chall = mconf.challenges[typ];
-        if (chall && challenge.module === chall.module) {
-            var keys = Object.keys(challenge);
-            var same =
-                !keys.length ||
-                keys.every(function(k) {
-                    return chall[k] === challenge[k];
-                });
-            if (same && !flags.forceSave) {
-                delete flags.challenges;
-            }
-        }
-    }
-    delete flags.challenge;
-    delete flags.challengeOpts;
-
-    // Add each of the values, including the existing
-    [
-        ['http-01', 'Http01'],
-        ['dns-01', 'Dns01'],
-        ['tls-alpn-01', 'TlsAlpn01']
-    ].forEach(function(types) {
-        var typ = types[0];
-        var typCamel = types[1];
-        var modname = 'challenge' + typCamel;
-        var optsname = 'challenge' + typCamel + 'Opts';
-        var chall = mconf.challenges[typ];
-        var challenge = flags[optsname];
-
-        // this variant of the flag is additive
-        if (isAdditive && chall && flags.forceSave) {
-            if (flags.challenges && !flags.challenges[typ]) {
-                flags.challenges[typ] = chall;
-            }
-        }
-
-        if (!flags[modname]) {
-            delete flags[modname];
-            delete flags[optsname];
-            return;
-        }
-
-        // JSON may already have module name
-        if (challenge.module) {
-            if (flags[modname] && challenge.module !== flags[modname]) {
-                console.error(
-                    'module names do not match:',
-                    JSON.stringify(challenge.module),
-                    JSON.stringify(flags[modname])
-                );
-                process.exit(1);
-            }
-        } else {
-            challenge.module = flags[modname];
-        }
-        if (flags[modname]) {
-            if (!flags.challenges) {
-                flags.challenges = {};
-            }
-            flags.challenges[typ] = challenge;
-        }
-
-        // Check to see if this is already what's set in the defaults
-        if (chall && challenge.module === chall.module) {
-            var keys = Object.keys(challenge);
-            // Check if all of the options are also the same
-            var same =
-                !keys.length ||
-                keys.every(function(k) {
-                    return chall[k] === challenge[k];
-                });
-            if (same && !flags.forceSave) {
-                // If it's already the global, don't make it the per-site
-                delete flags[modname];
-                delete flags[optsname];
-            }
-        }
-
-        delete flags[modname];
-        delete flags[optsname];
-    });
-
-    [
-        ['accountKeyType', [/256/, /384/, /EC/], 'EC-P256'],
-        ['serverKeyType', [/RSA/], 'RSA-2048']
-    ].forEach(function(k) {
-        var key = k[0];
-        var vals = k[1];
-        var val = flags[key];
-        if (val) {
-            if (
-                !vals.some(function(v) {
-                    return v.test(val);
-                })
-            ) {
-                flags[key] = k[2];
-                console.warn(
-                    key,
-                    "does not allow the value '",
-                    val,
-                    "' using the default '",
-                    k[2],
-                    "' instead."
-                );
-            }
-        }
-    });
-
-    Object.keys(flags).forEach(function(k) {
-        if (flags[k] === mconf[k] && !flags.forceSave) {
-            delete flags[k];
-        }
-    });
-
-    //console.log('debug z:', flags);
-    delete flags.forceSave;
-};

bin/remove.js

@@ -1,55 +0,0 @@
-'use strict';
-
-var args = process.argv.slice(3);
-var cli = require('./lib/cli.js');
-//var path = require('path');
-//var pkgpath = path.join(__dirname, '..', 'package.json');
-//var pkgpath = path.join(process.cwd(), 'package.json');
-
-var Flags = require('./lib/flags.js');
-
-Flags.init().then(function({ flagOptions, greenlock, mconf }) {
-    var myFlags = {};
-    ['subject'].forEach(function(k) {
-        myFlags[k] = flagOptions[k];
-    });
-
-    cli.parse(myFlags);
-    cli.main(function(argList, flags) {
-        Flags.mangleFlags(flags, mconf);
-        main(argList, flags, greenlock);
-    }, args);
-});
-
-async function main(_, flags, greenlock) {
-    if (!flags.subject) {
-        console.error('--subject must be provided as a valid domain');
-        process.exit(1);
-        return;
-    }
-
-    greenlock
-        .remove(flags)
-        .catch(function(err) {
-            console.error();
-            console.error('error:', err.message);
-            //console.log(err.stack);
-            console.error();
-            process.exit(1);
-        })
-        .then(function(site) {
-            if (!site) {
-                console.info();
-                console.info('No config found for', flags.subject);
-                console.info();
-                process.exit(1);
-                return;
-            }
-            console.info();
-            console.info(
-                'Deleted config for ' + JSON.stringify(flags.subject) + ':'
-            );
-            console.info(JSON.stringify(site, null, 2));
-            console.info();
-        });
-}

bin/tmpl/app.tmpl.js

@@ -1,9 +0,0 @@
-'use strict';
-
-// Here's a vanilla HTTP app to start,
-// but feel free to replace it with Express, Koa, etc
-var app = function(req, res) {
-    res.end('Hello, Encrypted World!');
-};
-
-module.exports = app;

bin/tmpl/cluster.tmpl.js

@@ -1,30 +0,0 @@
-'use strict';
-
-require('greenlock-express')
-    .init(function() {
-        // var pkg = require('./package.json');
-
-        return {
-            // where to find .greenlockrc and set default paths
-            packageRoot: __dirname,
-
-            // name & version for ACME client user agent
-            //packageAgent: pkg.name + '/' + pkg.version,
-
-            // contact for security and critical bug notices
-            //maintainerEmail: pkg.author,
-
-            // where to look for configuration
-            configDir: './greenlock.d',
-
-            // whether or not to run at cloudscale
-            cluster: true
-        };
-    })
-    .ready(function(glx) {
-        var app = require('./app.js');
-
-        // Serves on 80 and 443
-        // Get's SSL certificates magically!
-        glx.serveApp(app);
-    });

bin/tmpl/greenlock.tmpl.js

@@ -1,13 +0,0 @@
-'use strict';
-
-var pkg = require('./package.json');
-module.exports = require('@root/greenlock').create({
-    // name & version for ACME client user agent
-    packageAgent: pkg.name + '/' + pkg.version,
-
-    // contact for security and critical bug notices
-    //maintainerEmail: pkg.author,
-
-    // where to find .greenlockrc and set default paths
-    packageRoot: __dirname
-});

bin/tmpl/server.tmpl.js

@@ -1,20 +0,0 @@
-'use strict';
-
-var app = require('./app.js');
-
-require('greenlock-express')
-    .init({
-        packageRoot: __dirname,
-
-        // contact for security and critical bug notices
-        //maintainerEmail: pkg.author,
-
-        // where to look for configuration
-        configDir: './greenlock.d',
-
-        // whether or not to run at cloudscale
-        cluster: false
-    })
-    // Serves on 80 and 443
-    // Get's SSL certificates magically!
-    .serve(app);

bin/update.js

@@ -1,79 +0,0 @@
-'use strict';
-
-var args = process.argv.slice(3);
-var cli = require('./lib/cli.js');
-var Flags = require('./lib/flags.js');
-
-Flags.init().then(function({ flagOptions, greenlock, mconf }) {
-    var myFlags = {};
-    [
-        'subject',
-        'altnames',
-        'renew-offset',
-        'subscriber-email',
-        'customer-email',
-        'server-key-type',
-        'challenge-http-01',
-        'challenge-http-01-xxxx',
-        'challenge-dns-01',
-        'challenge-dns-01-xxxx',
-        'challenge-tls-alpn-01',
-        'challenge-tls-alpn-01-xxxx',
-        'challenge',
-        'challenge-xxxx',
-        'challenge-json',
-        'force-save'
-    ].forEach(function(k) {
-        myFlags[k] = flagOptions[k];
-    });
-
-    cli.parse(myFlags);
-    cli.main(async function(argList, flags) {
-        var sconf = await greenlock._config({ servername: flags.subject });
-        Flags.mangleFlags(flags, mconf, sconf);
-        main(argList, flags, greenlock);
-    }, args);
-});
-
-async function main(_, flags, greenlock) {
-    if (!flags.subject) {
-        console.error('--subject must be provided as a valid domain');
-        process.exit(1);
-        return;
-    }
-
-    greenlock
-        .update(flags)
-        .catch(function(err) {
-            console.error();
-            console.error('error:', err.message);
-            console.error();
-            process.exit(1);
-        })
-        .then(function() {
-            return greenlock
-                ._config({ servername: flags.subject })
-                .then(function(site) {
-                    if (!site) {
-                        console.info();
-                        console.info('No config found for', flags.subject);
-                        console.info();
-                        process.exit(1);
-                        return;
-                    }
-
-                    console.info();
-                    Object.keys(site).forEach(function(k) {
-                        if ('defaults' === k) {
-                            console.info(k + ':');
-                            Object.keys(site.defaults).forEach(function(key) {
-                                var value = JSON.stringify(site.defaults[key]);
-                                console.info('\t' + key + ':' + value);
-                            });
-                        } else {
-                            console.info(k + ': ' + JSON.stringify(site[k]));
-                        }
-                    });
-                });
-        });
-}

certificates.js

@@ -127,10 +127,7 @@ C._rawOrder = function(gnlck, mconf, db, acme, chs, acc, email, args) {
     var query = {
         subject: args.subject,
         certificate: args.certificate || {},
-        directoryUrl:
+        directoryUrl: args.directoryUrl || gnlck._defaults.directoryUrl
-            args.directoryUrl ||
-            mconf.directoryUrl ||
-            gnlck._defaults.directoryUrl
     };
     rawPending[id] = U._getOrCreateKeypair(db, args.subject, query, keyType)
         .then(function(kresult) {
@@ -211,10 +208,7 @@ C._check = function(gnlck, mconf, db, args) {
         subject: args.subject,
         // may contain certificate.id
         certificate: args.certificate,
-        directoryUrl:
+        directoryUrl: args.directoryUrl || gnlck._defaults.directoryUrl
-            args.directoryUrl ||
-            mconf.directoryUrl ||
-            gnlck._defaults.directoryUrl
     };
     return db.check(query).then(function(pems) {
         if (!pems) {

challenges-underlay.js

@@ -0,0 +1,96 @@
+'use strict';
+
+var Greenlock = require('./');
+
+module.exports.wrap = function(greenlock) {
+    greenlock.challenges.get = function(chall) {
+        // TODO pick one and warn on the others
+        // (just here due to some backwards compat issues with early v3 plugins)
+        var servername =
+            chall.servername ||
+            chall.altname ||
+            (chall.identifier && chall.identifier.value);
+
+        // TODO some sort of caching to prevent database hits?
+        return greenlock
+            ._config({ servername: servername })
+            .then(function(site) {
+                if (!site) {
+                    return null;
+                }
+
+                // Hmm... this _should_ be impossible
+                if (!site.challenges || !site.challenges['http-01']) {
+                    var copy = JSON.parse(JSON.stringify(site));
+                    sanitizeCopiedConf(copy);
+                    sanitizeCopiedConf(copy.store);
+                    if (site.challenges) {
+                        sanitizeCopiedConf(copy.challenges['http-01']);
+                        sanitizeCopiedConf(copy.challenges['dns-01']);
+                        sanitizeCopiedConf(copy.challenges['tls-alpn-01']);
+                    }
+                    console.warn('[Bug] Please report this error:');
+                    console.warn(
+                        '\terror: http-01 challenge requested, but not even a default http-01 config exists'
+                    );
+                    console.warn('\tservername:', JSON.stringify(servername));
+                    console.warn('\tsite:', JSON.stringify(copy));
+                    return null;
+                }
+
+                return Greenlock._loadChallenge(site.challenges, 'http-01');
+            })
+            .then(function(plugin) {
+                if (!plugin) {
+                    return null;
+                }
+                return plugin
+                    .get({
+                        challenge: {
+                            type: chall.type,
+                            //hostname: chall.servername,
+                            altname: chall.servername,
+                            identifier: { value: chall.servername },
+                            token: chall.token
+                        }
+                    })
+                    .then(function(result) {
+                        var keyAuth;
+                        var keyAuthDigest;
+                        if (result) {
+                            // backwards compat that shouldn't be dropped
+                            // because new v3 modules had to do this to be
+                            // backwards compatible with Greenlock v2.7 at
+                            // the time.
+                            if (result.challenge) {
+                                result = result.challenge;
+                            }
+                            keyAuth = result.keyAuthorization;
+                            keyAuthDigest = result.keyAuthorizationDigest;
+                        }
+                        if (/dns/.test(chall.type)) {
+                            return {
+                                keyAuthorizationDigest: keyAuthDigest
+                            };
+                        }
+                        return {
+                            keyAuthorization: keyAuth
+                        };
+                    });
+            });
+    };
+};
+
+function sanitizeCopiedConf(copy) {
+    if (!copy) {
+        return;
+    }
+
+    Object.keys(copy).forEach(function(k) {
+        if (/(api|key|token)/i.test(k) && 'string' === typeof copy[k]) {
+            copy[k] = '**redacted**';
+        }
+    });
+
+    return copy;
+}

greenlock.js

@@ -5,7 +5,6 @@ var pkg = require('./package.json');
 var ACME = require('@root/acme');
 var Greenlock = module.exports;
 var request = require('@root/request');
-var process = require('process');
 
 var G = Greenlock;
 var U = require('./utils.js');
@@ -13,13 +12,7 @@ var E = require('./errors.js');
 var P = require('./plugins.js');
 var A = require('./accounts.js');
 var C = require('./certificates.js');
-
-var DIR = require('./lib/directory-url.js');
-var ChWrapper = require('./lib/challenges-wrapper.js');
-var MngWrapper = require('./lib/manager-wrapper.js');
-
 var UserEvents = require('./user-events.js');
-var Init = require('./lib/init.js');
 
 var caches = {};
 
@@ -30,9 +23,9 @@ G.create = function(gconf) {
     if (!gconf) {
         gconf = {};
     }
+    var manager;
 
     greenlock._create = function() {
-        if (!gconf._bin_mode) {
         if (!gconf.maintainerEmail) {
             throw E.NO_MAINTAINER('create');
         }
@@ -47,7 +40,6 @@ G.create = function(gconf) {
             // maybe move this to init and don't exit the process, just in case
             process.exit(1);
         });
-        }
 
         if ('function' === typeof gconf.notify) {
             gdefaults.notify = gconf.notify;
@@ -55,51 +47,43 @@ G.create = function(gconf) {
             gdefaults.notify = _notify;
         }
 
-        gconf = Init._init(gconf);
+        if (gconf.directoryUrl) {
-
+            gdefaults = gconf.directoryUrl;
-        // OK: /path/to/blah
+            if (gconf.staging) {
-        // OK: npm-name-blah
+                throw new Error(
-        // NOT OK: ./rel/path/to/blah
+                    'supply `directoryUrl` or `staging`, but not both'
-        // Error: .blah
-        if ('.' === (gconf.manager.module || '')[0]) {
-            if (!gconf.packageRoot) {
-                gconf.packageRoot = process.cwd();
-                console.warn(
-                    '`packageRoot` not defined, trying ' + gconf.packageRoot
                 );
             }
-            gconf.manager.module =
+        } else if (gconf.staging) {
-                gconf.packageRoot + '/' + gconf.manager.module.slice(2);
+            gdefaults.directoryUrl =
+                'https://acme-staging-v02.api.letsencrypt.org/directory';
+        } else {
+            gdefaults.directoryUrl =
+                'https://acme-v02.api.letsencrypt.org/directory';
         }
+        console.info('ACME Directory URL:', gdefaults.directoryUrl);
+
+        manager = normalizeManager(gconf);
 
         // Wraps each of the following with appropriate error checking
         // greenlock.manager.defaults
-        // greenlock.sites.add
+        // greenlock.manager.add
-        // greenlock.sites.update
+        // greenlock.manager.update
-        // greenlock.sites.remove
+        // greenlock.manager.remove
-        // greenlock.sites.find
+        // greenlock.manager.find
-        // greenlock.sites.get
+        require('./manager-underlay.js').wrap(greenlock, manager, gconf);
-        MngWrapper.wrap(greenlock, gconf);
         // The goal here is to reduce boilerplate, such as error checking
         // and duration parsing, that a manager must implement
         greenlock.sites.add = greenlock.add = greenlock.manager.add;
-        greenlock.sites.update = greenlock.update = greenlock.manager.update;
-        greenlock.sites.remove = greenlock.remove = greenlock.manager.remove;
 
         // Exports challenges.get for Greenlock Express HTTP-01,
         // and whatever odd use case pops up, I suppose
         // greenlock.challenges.get
-        ChWrapper.wrap(greenlock);
+        require('./challenges-underlay.js').wrap(greenlock, manager, gconf);
-
-        DIR._getDefaultDirectoryUrl('', gconf.staging, '');
-        if (gconf.directoryUrl) {
-            gdefaults.directoryUrl = gconf.directoryUrl;
-        }
 
         greenlock._defaults = gdefaults;
         greenlock._defaults.debug = gconf.debug;
 
-        if (!gconf._bin_mode && false !== gconf.renew) {
         // renew every 90-ish minutes (random for staggering)
         // the weak setTimeout (unref) means that when run as a CLI process this
         // will still finish as expected, and not wait on the timeout
@@ -109,7 +93,6 @@ G.create = function(gconf) {
                 renew();
             }, Math.PI * 30 * 60 * 1000).unref();
         })();
-        }
     };
 
     // The purpose of init is to make MCONF the source of truth
@@ -119,30 +102,31 @@ G.create = function(gconf) {
             return p;
         };
 
-        p = greenlock.manager
+        if (manager.init) {
-            .init({
+            // TODO punycode?
+            p = manager.init({
                 request: request
                 //punycode: require('punycode')
-            })
+            });
-            .then(async function() {
+        } else {
-                var MCONF = await greenlock.manager._defaults();
+            p = Promise.resolve();
+        }
+        p = p
+            .then(function() {
+                return manager.defaults().then(function(MCONF) {
                     mergeDefaults(MCONF, gconf);
                     if (true === MCONF.agreeToTerms) {
                         gdefaults.agreeToTerms = function(tos) {
                             return Promise.resolve(tos);
                         };
                     }
-
+                    return manager.defaults(MCONF);
-                return greenlock.manager._defaults(MCONF);
+                });
             })
             .catch(function(err) {
-                if ('load_plugin' !== err.context) {
                 console.error('Fatal error during greenlock init:');
-                    console.error(err.message);
+                console.error(err);
-                }
-                if (!gconf._bin_mode) {
                 process.exit(1);
-                }
             });
         return p;
     };
@@ -206,10 +190,14 @@ G.create = function(gconf) {
     };
 
     // certs.get
-    greenlock.get = async function(args) {
+    greenlock.get = function(args) {
-        greenlock._single(args);
+        return greenlock
+            ._single(args)
+            .then(function() {
                 args._includePems = true;
-        var results = await greenlock.renew(args);
+                return greenlock.renew(args);
+            })
+            .then(function(results) {
                 if (!results || !results.length) {
                     // TODO throw an error here?
                     return null;
@@ -241,12 +229,12 @@ G.create = function(gconf) {
                 // site for plugin options, such as http-01 challenge
                 // pems for the obvious reasons
                 return result;
+            });
     };
 
-    // TODO remove async here, it doesn't matter
+    greenlock._single = function(args) {
-    greenlock._single = async function(args) {
         if ('string' !== typeof args.servername) {
-            throw new Error('no `servername` given');
+            return Promise.reject(new Error('no `servername` given'));
         }
         // www.example.com => *.example.com
         args.wildname =
@@ -255,87 +243,73 @@ G.create = function(gconf) {
                 .split('.')
                 .slice(1)
                 .join('.');
-        if (args.wildname.split('.').length < 3) {
-            // No '*.com'
-            args.wildname = '';
-        }
         if (
             args.servernames ||
-            //TODO I think we need to block altnames as well, but I don't want to break anything
-            //args.altnames ||
             args.subject ||
             args.renewBefore ||
             args.issueBefore ||
             args.expiresBefore
         ) {
-            throw new Error(
+            return Promise.reject(
+                new Error(
                     'bad arguments, did you mean to call greenlock.renew()?'
+                )
             );
         }
         // duplicate, force, and others still allowed
-        return args;
+        return Promise.resolve(args);
     };
 
-    greenlock._config = async function(args) {
+    greenlock._config = function(args) {
-        greenlock._single(args);
+        return greenlock
-        var sites = await greenlock._configAll(args);
+            ._single(args)
-        return sites[0];
+            .then(function() {
-    };
+                return greenlock._find(args);
-    greenlock._configAll = async function(args) {
+            })
-        var sites = await greenlock._find(args);
+            .then(function(sites) {
                 if (!sites || !sites.length) {
-            return [];
+                    return null;
                 }
-        sites = JSON.parse(JSON.stringify(sites));
+                var site = sites[0];
-        var mconf = await greenlock.manager._defaults();
+                site = JSON.parse(JSON.stringify(site));
-        return sites.map(function(site) {
                 if (site.store && site.challenges) {
                     return site;
                 }
-
+                return manager.defaults().then(function(mconf) {
-            var dconf = site;
-            // TODO make cli and api mode the same
-            if (gconf._bin_mode) {
-                dconf = site.defaults = {};
-            }
                     if (!site.store) {
-                dconf.store = mconf.store;
+                        site.store = mconf.store;
                     }
                     if (!site.challenges) {
-                dconf.challenges = mconf.challenges;
+                        site.challenges = mconf.challenges;
                     }
                     return site;
                 });
+            });
     };
 
     // needs to get info about the renewal, such as which store and challenge(s) to use
-    greenlock.renew = async function(args) {
+    greenlock.renew = function(args) {
-        await greenlock._init();
+        return greenlock._init().then(function() {
-        var mconf = await greenlock.manager._defaults();
+            return manager.defaults().then(function(mconf) {
                 return greenlock._renew(mconf, args);
+            });
+        });
     };
-    greenlock._renew = async function(mconf, args) {
+    greenlock._renew = function(mconf, args) {
         if (!args) {
             args = {};
         }
 
         var renewedOrFailed = [];
         //console.log('greenlock._renew find', args);
-        var sites = await greenlock._find(args);
+        return greenlock._find(args).then(function(sites) {
             // Note: the manager must guaranteed that these are mutable copies
             //console.log('greenlock._renew found', sites);;
 
-        if (!Array.isArray(sites)) {
+            function next() {
-            throw new Error(
-                'Developer Error: not an array of sites returned from find: ' +
-                    JSON.stringify(sites)
-            );
-        }
-
-        await (async function next() {
                 var site = sites.shift();
                 if (!site) {
-                return null;
+                    return Promise.resolve(null);
                 }
 
                 var order = { site: site };
@@ -366,12 +340,15 @@ G.create = function(gconf) {
                     .then(function() {
                         return next();
                     });
-        })();
+            }
 
+            return next().then(function() {
                 return renewedOrFailed;
+            });
+        });
     };
 
-    greenlock._acme = async function(mconf, args, dirUrl) {
+    greenlock._acme = function(args) {
         var packageAgent = gconf.packageAgent || '';
         // because Greenlock_Express/v3.x Greenlock/v3 is redundant
         if (!/greenlock/i.test(packageAgent)) {
@@ -383,100 +360,84 @@ G.create = function(gconf) {
             notify: greenlock._notify,
             debug: greenlock._defaults.debug || args.debug
         });
+        var dirUrl = args.directoryUrl || greenlock._defaults.directoryUrl;
 
         var dir = caches[dirUrl];
+
         // don't cache more than an hour
         if (dir && Date.now() - dir.ts < 1 * 60 * 60 * 1000) {
             return dir.promise;
         }
 
-        await acme.init(dirUrl).catch(function(err) {
+        return acme
-            // TODO this is a special kind of failure mode. What should we do?
+            .init(dirUrl)
-            console.error(
+            .then(function(/*meta*/) {
-                "[debug] Let's Encrypt may be down for maintenance or `directoryUrl` may be wrong"
-            );
-            throw err;
-        });
-
                 caches[dirUrl] = {
                     promise: Promise.resolve(acme),
                     ts: Date.now()
                 };
                 return acme;
+            })
+            .catch(function(err) {
+                // TODO
+                // let's encrypt is possibly down for maintenaince...
+                // this is a special kind of failure mode
+                throw err;
+            });
     };
 
-    greenlock.order = async function(siteConf) {
+    greenlock.order = function(args) {
-        await greenlock._init();
+        return greenlock._init().then(function() {
-        var mconf = await greenlock.manager._defaults();
+            return manager.defaults().then(function(mconf) {
-        return greenlock._order(mconf, siteConf);
+                return greenlock._order(mconf, args);
+            });
+        });
     };
-    greenlock._order = async function(mconf, siteConf) {
+    greenlock._order = function(mconf, args) {
         // packageAgent, maintainerEmail
-
+        return greenlock._acme(args).then(function(acme) {
-        var dirUrl = DIR._getDirectoryUrl(
+            var storeConf = args.store || mconf.store;
-            siteConf.directoryUrl || mconf.directoryUrl,
+            return P._loadStore(storeConf).then(function(store) {
-            siteConf.subject
+                return A._getOrCreate(
-        );
-
-        var acme = await greenlock._acme(mconf, siteConf, dirUrl);
-        var storeConf = siteConf.store || mconf.store;
-        storeConf = JSON.parse(JSON.stringify(storeConf));
-        storeConf.packageRoot = gconf.packageRoot;
-
-        if (!storeConf.basePath) {
-            storeConf.basePath = gconf.configDir;
-        }
-
-        if ('.' === (storeConf.basePath || '')[0]) {
-            if (!gconf.packageRoot) {
-                gconf.packageRoot = process.cwd();
-                console.warn(
-                    '`packageRoot` not defined, trying ' + gconf.packageRoot
-                );
-            }
-            storeConf.basePath = require('path').resolve(
-                gconf.packageRoot || '',
-                storeConf.basePath
-            );
-        }
-
-        storeConf.directoryUrl = dirUrl;
-        var store = await P._loadStore(storeConf);
-        var account = await A._getOrCreate(
                     greenlock,
                     mconf,
                     store.accounts,
                     acme,
-            siteConf
+                    args
-        );
+                ).then(function(account) {
-        var challengeConfs = siteConf.challenges || mconf.challenges;
+                    var challengeConfs = args.challenges || mconf.challenges;
-        var challenges = {};
+                    return Promise.all(
-        var arr = await Promise.all(
                         Object.keys(challengeConfs).map(function(typ01) {
                             return P._loadChallenge(challengeConfs, typ01);
                         })
-        );
+                    ).then(function(arr) {
+                        var challenges = {};
                         arr.forEach(function(el) {
                             challenges[el._type] = el;
                         });
-
+                        return C._getOrOrder(
-        var pems = await C._getOrOrder(
                             greenlock,
                             mconf,
                             store.certificates,
                             acme,
                             challenges,
                             account,
-            siteConf
+                            args
-        );
+                        ).then(function(pems) {
                             if (!pems) {
                                 throw new Error('no order result');
                             }
                             if (!pems.privkey) {
-            throw new Error('missing private key, which is kinda important');
+                                throw new Error(
+                                    'missing private key, which is kinda important'
+                                );
                             }
-
                             return pems;
+                        });
+                    });
+                });
+            });
+        });
     };
 
     greenlock._create();
@@ -494,6 +455,104 @@ function errorToJSON(e) {
     return error;
 }
 
+function normalizeManager(gconf) {
+    var m;
+    // 1. Get the manager
+    // 2. Figure out if we need to wrap it
+
+    if (!gconf.manager) {
+        gconf.manager = 'greenlock-manager-fs';
+        if (gconf.find) {
+            // { manager: 'greenlock-manager-fs', find: function () { } }
+            warpFind(gconf);
+        }
+    }
+
+    if ('string' === typeof gconf.manager) {
+        try {
+            // wrap this to be safe for greenlock-manager-fs
+            m = require(gconf.manager).create(gconf);
+        } catch (e) {
+            console.error(e.code);
+            console.error(e.message);
+        }
+    } else {
+        m = gconf.manager;
+    }
+
+    if (!m) {
+        console.error();
+        console.error(
+            'Failed to load manager plugin ',
+            JSON.stringify(gconf.manager)
+        );
+        console.error();
+        process.exit(1);
+    }
+
+    if (
+        ['set', 'remove', 'find', 'defaults'].every(function(k) {
+            return 'function' === typeof m[k];
+        })
+    ) {
+        return m;
+    }
+
+    // { manager: { find: function () {  } } }
+    if (m.find) {
+        warpFind(m);
+    }
+    // m.configFile could also be set
+    m = require('greenlock-manager-fs').create(m);
+
+    if ('function' !== typeof m.find) {
+        console.error();
+        console.error(
+            JSON.stringify(gconf.manager),
+            'must implement `find()` and should implement `set()`, `remove()`, `defaults()`, and `init()`'
+        );
+        console.error();
+        process.exit(1);
+    }
+
+    return m;
+}
+
+function warpFind(gconf) {
+    gconf.__gl_find = gconf.find;
+    gconf.find = function(args) {
+        // the incoming args will be normalized by greenlock
+        return gconf.__gl_find(args).then(function(sites) {
+            // we also need to error check the incoming sites,
+            // as if they were being passed through `add()` or `set()`
+            // (effectively they are) because the manager assumes that
+            // they're not bad
+            sites.forEach(function(s) {
+                if (!s || 'string' !== typeof s.subject) {
+                    throw new Error('missing subject');
+                }
+                if (
+                    !Array.isArray(s.altnames) ||
+                    !s.altnames.length ||
+                    !s.altnames[0] ||
+                    s.altnames[0] !== s.subject
+                ) {
+                    throw new Error('missing or malformed altnames');
+                }
+                ['renewAt', 'issuedAt', 'expiresAt'].forEach(function(k) {
+                    if (s[k]) {
+                        throw new Error(
+                            '`' +
+                                k +
+                                '` should be updated by `set()`, not by `find()`'
+                        );
+                    }
+                });
+            });
+        });
+    };
+}
+
 function mergeDefaults(MCONF, gconf) {
     if (
         gconf.agreeToTerms === true ||
@@ -509,29 +568,19 @@ function mergeDefaults(MCONF, gconf) {
         MCONF.subscriberEmail = gconf.subscriberEmail;
     }
 
+    var homedir;
     // Load the default store module
     if (!MCONF.store) {
         if (gconf.store) {
             MCONF.store = gconf.store;
         } else {
+            homedir = require('os').homedir();
             MCONF.store = {
-                module: 'greenlock-store-fs'
+                module: 'greenlock-store-fs',
+                basePath: homedir + '/.config/greenlock/'
             };
-            console.info('[default] store.module: ' + MCONF.store.module);
         }
     }
-
-    /*
-    if ('greenlock-store-fs' === MCONF.store.module && !MCONF.store.basePath) {
-        //homedir = require('os').homedir();
-        if (gconf.configFile) {
-            MCONF.store.basePath = gconf.configFile.replace(/\.json$/i, '.d');
-        } else {
-            MCONF.store.basePath = './greenlock.d';
-        }
-    }
-    */
-
     // just to test that it loads
     P._loadSync(MCONF.store.module);
 
@@ -542,10 +591,6 @@ function mergeDefaults(MCONF, gconf) {
     }
     if (!challenges['http-01'] && !challenges['dns-01']) {
         challenges['http-01'] = { module: 'acme-http-01-standalone' };
-        console.info(
-            '[default] challenges.http-01.module: ' +
-                challenges['http-01'].module
-        );
     }
     if (challenges['http-01']) {
         if ('string' !== typeof challenges['http-01'].module) {
@@ -569,40 +614,16 @@ function mergeDefaults(MCONF, gconf) {
 
     if (!MCONF.renewOffset) {
         MCONF.renewOffset = gconf.renewOffset || '-45d';
-        console.info('[default] renewOffset: ' + MCONF.renewOffset);
     }
     if (!MCONF.renewStagger) {
         MCONF.renewStagger = gconf.renewStagger || '3d';
-        console.info('[default] renewStagger: ' + MCONF.renewStagger);
     }
 
-    var vers = process.versions.node.split('.');
-    var defaultKeyType = 'EC-P256';
-    if (vers[0] < 10 || (vers[0] === '10' && vers[1] < '12')) {
-        defaultKeyType = 'RSA-2048';
-    }
     if (!MCONF.accountKeyType) {
-        MCONF.accountKeyType = gconf.accountKeyType || defaultKeyType;
+        MCONF.accountKeyType = gconf.accountKeyType || 'EC-P256';
-        console.info('[default] accountKeyType: ' + MCONF.accountKeyType);
     }
     if (!MCONF.serverKeyType) {
         MCONF.serverKeyType = gconf.serverKeyType || 'RSA-2048';
-        console.info('[default] serverKeyType: ' + MCONF.serverKeyType);
-    }
-
-    if (!MCONF.subscriberEmail && false !== MCONF.subscriberEmail) {
-        MCONF.subscriberEmail =
-            gconf.subscriberEmail || gconf.maintainerEmail || undefined;
-        MCONF.agreeToTerms = gconf.agreeToTerms || undefined;
-        console.info('');
-        console.info('[default] subscriberEmail: ' + MCONF.subscriberEmail);
-        console.info(
-            '[default] agreeToTerms: ' +
-                (MCONF.agreeToTerms ||
-                    gconf.agreeToTerms ||
-                    '(show notice on use)')
-        );
-        console.info('');
     }
 }
 

greenlockrc.js

@@ -1,191 +0,0 @@
-'use strict';
-
-// TODO how to handle path differences when run from npx vs when required by greenlock?
-
-var fs = require('fs');
-var path = require('path');
-
-function saveFile(rcpath, data, enc) {
-    // because this may have a database url or some such
-    fs.writeFileSync(rcpath, data, enc);
-    return fs.chmodSync(rcpath, parseInt('0600', 8));
-}
-
-var GRC = (module.exports = function(pkgpath, manager, rc) {
-    // TODO when run from package
-    // Run from the package root (assumed) or exit
-    var pkgdir = path.dirname(pkgpath);
-
-    try {
-        require(pkgpath);
-    } catch (e) {
-        console.error(
-            'npx greenlock must be run from the package root (where package.json is)'
-        );
-        process.exit(1);
-    }
-
-    try {
-        return module.exports._defaults(pkgdir, manager, rc);
-    } catch (e) {
-        if ('package.json' === e.context) {
-            console.error(e.desc);
-            process.exit(1);
-        }
-        console.error(e.message);
-        process.exit(1);
-    }
-});
-
-// Figure out what to do between what's hard-coded,
-// what's in the config file, and what's left unset
-module.exports.resolve = function(gconf) {
-    var rc = GRC.read(gconf.packageRoot);
-    if (gconf.configFile) {
-        rc = { configFile: gconf.configFile };
-    }
-
-    var manager;
-    var updates;
-
-    if (rc.manager) {
-        if (gconf.manager && rc.manager !== gconf.manager) {
-            console.warn(
-                'warn: ignoring hard-coded ' +
-                    gconf.manager +
-                    ' in favor of ' +
-                    rc.manager
-            );
-        }
-        gconf.manager = rc.manager;
-    } else if (gconf.manager) {
-        manager = gconf.manager;
-    }
-
-    if (rc.configFile) {
-        if (gconf.configFile && rc.configFile !== gconf.configFile) {
-            console.warn(
-                'warn: ignoring hard-coded ' +
-                    gconf.configFile +
-                    ' in favor of ' +
-                    rc.configFile
-            );
-        }
-        gconf.configFile = rc.configFile;
-    } else if (gconf.manager) {
-        updates = { configFile: gconf.configFile };
-    }
-
-    return GRC._defaults(gconf.packageRoot, manager, rc);
-};
-
-module.exports._defaults = function(pkgdir, manager, rc) {
-    var rcpath = path.join(pkgdir, '.greenlockrc');
-    var _rc;
-    var created = false;
-
-    if (manager) {
-        if ('.' === manager[0]) {
-            manager = path.resolve(pkgdir, manager);
-        }
-        try {
-            require(manager);
-        } catch (e) {
-            console.error('could not load ' + manager + ' from ' + pkgdir);
-            throw e;
-        }
-    }
-
-    var stuff = module.exports._read(pkgdir);
-    _rc = stuff.rc;
-    created = stuff.created;
-
-    var changed;
-    if (manager) {
-        if (!_rc.manager) {
-            _rc.manager = manager;
-        }
-        if (_rc.manager !== manager) {
-            console.info('Switching manager:');
-            var older = _rc.manager;
-            var newer = manager;
-            if ('/' === older[0]) {
-                older = path.relative(pkgdir, older);
-            }
-            if ('/' === newer[0]) {
-                newer = path.relative(pkgdir, newer);
-            }
-            console.info('\told: ' + older);
-            console.info('\tnew: ' + newer);
-            changed = true;
-        }
-    }
-
-    if (rc) {
-        changed = true;
-        Object.keys(rc).forEach(function(k) {
-            _rc[k] = rc[k];
-        });
-    }
-
-    if (['@greenlock/manager', 'greenlock-manager-fs'].includes(_rc.manager)) {
-        if (!_rc.configFile) {
-            changed = true;
-            _rc.configFile = path.join(pkgdir, 'greenlock.json');
-        }
-    }
-
-    if (!changed) {
-        return _rc;
-    }
-
-    var data = JSON.stringify(_rc, null, 2);
-    if (created) {
-        console.info('Wrote ' + rcpath);
-    }
-    saveFile(rcpath, data, 'utf8');
-    return _rc;
-};
-
-module.exports.read = function(pkgdir) {
-    return module.exports._read(pkgdir).rc;
-};
-
-module.exports._read = function(pkgdir) {
-    var created;
-    var rcpath = path.join(pkgdir, '.greenlockrc');
-    var _data;
-    try {
-        _data = fs.readFileSync(rcpath, 'utf8');
-    } catch (err) {
-        if ('ENOENT' !== err.code) {
-            throw err;
-        }
-        try {
-            require(path.resolve(path.join(pkgdir, './package.json')));
-        } catch (e) {
-            e.context = 'package.json';
-            e.desc =
-                'run `greenlock` from the same directory as `package.json`, or specify `packageRoot` of `.greenlockrc`';
-            throw e;
-        }
-        console.info('Creating ' + rcpath);
-        created = true;
-        _data = '{}';
-        saveFile(rcpath, _data, 'utf8');
-    }
-
-    var rc;
-    try {
-        rc = JSON.parse(_data);
-    } catch (e) {
-        console.error("couldn't parse " + rcpath, _data);
-        console.error('(perhaps you should just delete it and try again?)');
-        process.exit(1);
-    }
-
-    return {
-        created: created,
-        rc: rc
-    };
-};

lib/challenges-wrapper.js

@@ -1,88 +0,0 @@
-'use strict';
-
-var Greenlock = require('../');
-
-module.exports.wrap = function(greenlock) {
-    greenlock.challenges = {};
-    greenlock.challenges.get = async function(chall) {
-        // TODO pick one and warn on the others
-        // (just here due to some backwards compat issues with early v3 plugins)
-        var servername =
-            chall.servername ||
-            chall.altname ||
-            (chall.identifier && chall.identifier.value);
-
-        // TODO some sort of caching to prevent database hits?
-        var site = await greenlock._config({ servername: servername });
-        if (!site) {
-            return null;
-        }
-
-        // Hmm... this _should_ be impossible
-        if (!site.challenges || !site.challenges['http-01']) {
-            var copy = JSON.parse(JSON.stringify(site));
-            sanitizeCopiedConf(copy);
-            sanitizeCopiedConf(copy.store);
-            if (site.challenges) {
-                sanitizeCopiedConf(copy.challenges['http-01']);
-                sanitizeCopiedConf(copy.challenges['dns-01']);
-                sanitizeCopiedConf(copy.challenges['tls-alpn-01']);
-            }
-            console.warn('[Bug] Please report this error:');
-            console.warn(
-                '\terror: http-01 challenge requested, but not even a default http-01 config exists'
-            );
-            console.warn('\tservername:', JSON.stringify(servername));
-            console.warn('\tsite:', JSON.stringify(copy));
-            return null;
-        }
-
-        var plugin = await Greenlock._loadChallenge(site.challenges, 'http-01');
-        if (!plugin) {
-            return null;
-        }
-
-        var keyAuth;
-        var keyAuthDigest;
-        var result = await plugin.get({
-            challenge: {
-                type: chall.type,
-                //hostname: chall.servername,
-                altname: chall.servername,
-                identifier: { value: chall.servername },
-                token: chall.token
-            }
-        });
-        if (result) {
-            // backwards compat that shouldn't be dropped
-            // because new v3 modules had to do this to be
-            // backwards compatible with Greenlock v2.7 at
-            // the time.
-            if (result.challenge) {
-                result = result.challenge;
-            }
-            keyAuth = result.keyAuthorization;
-            keyAuthDigest = result.keyAuthorizationDigest;
-        }
-
-        if (/dns/.test(chall.type)) {
-            return { keyAuthorizationDigest: keyAuthDigest };
-        }
-
-        return { keyAuthorization: keyAuth };
-    };
-};
-
-function sanitizeCopiedConf(copy) {
-    if (!copy) {
-        return;
-    }
-
-    Object.keys(copy).forEach(function(k) {
-        if (/(api|key|token)/i.test(k) && 'string' === typeof copy[k]) {
-            copy[k] = '**redacted**';
-        }
-    });
-
-    return copy;
-}

lib/directory-url.js

@@ -1,46 +0,0 @@
-var DIR = module.exports;
-
-// This will ALWAYS print out a notice if the URL is clearly a staging URL
-DIR._getDirectoryUrl = function(dirUrl, domain) {
-    var liveUrl = 'https://acme-v02.api.letsencrypt.org/directory';
-    dirUrl = DIR._getDefaultDirectoryUrl(dirUrl, '', domain);
-    if (!dirUrl) {
-        dirUrl = liveUrl;
-        // This will print out a notice (just once) if no directoryUrl has been supplied
-        if (!DIR._shownDirectoryUrl) {
-            DIR._shownDirectoryUrl = true;
-            console.info('ACME Directory URL:', dirUrl);
-        }
-    }
-    return dirUrl;
-};
-
-// Handle staging URLs, pebble test server, etc
-DIR._getDefaultDirectoryUrl = function(dirUrl, staging, domain) {
-    var stagingUrl = 'https://acme-staging-v02.api.letsencrypt.org/directory';
-    var stagingRe = /(^http:|staging|^127\.0\.|^::|localhost)/;
-    var env = '';
-    var args = [];
-    if ('undefined' !== typeof process) {
-        env = (process.env && process.env.ENV) || '';
-        args = (process.argv && process.argv.slice(1)) || [];
-    }
-
-    if (
-        staging ||
-        stagingRe.test(dirUrl) ||
-        args.includes('--staging') ||
-        /DEV|STAG/i.test(env)
-    ) {
-        if (!stagingRe.test(dirUrl)) {
-            dirUrl = stagingUrl;
-        }
-        console.info('[staging] ACME Staging Directory URL:', dirUrl, env);
-        console.warn('FAKE CERTIFICATES (for testing) only', env, domain);
-        console.warn('');
-    }
-
-    return dirUrl;
-};
-
-DIR._shownDirectoryUrl = false;

lib/init.js

@@ -1,194 +0,0 @@
-'use strict';
-
-var Init = module.exports;
-
-var fs = require('fs');
-var path = require('path');
-//var promisify = require("util").promisify;
-
-Init._init = function(opts) {
-    //var Rc = require("@root/greenlock/rc");
-    var Rc = require('./rc.js');
-    var pkgText;
-    var pkgErr;
-    var msgErr;
-    //var emailErr;
-    var realPkg;
-    var userPkg;
-    var myPkg = {};
-    // we want to be SUPER transparent that we're reading from package.json
-    // we don't want anything unexpected
-    var implicitConfig = [];
-    var rc;
-
-    if (opts.packageRoot) {
-        try {
-            pkgText = fs.readFileSync(
-                path.resolve(opts.packageRoot, 'package.json'),
-                'utf8'
-            );
-            opts._hasPackage = true;
-        } catch (e) {
-            pkgErr = e;
-            if (opts._mustPackage) {
-                console.error(
-                    'Should be run from package root (the same directory as `package.json`)'
-                );
-                process.exit(1);
-                return;
-            }
-            console.warn(
-                '`packageRoot` should be the root of the package (probably `__dirname`)'
-            );
-        }
-    }
-
-    if (pkgText) {
-        try {
-            realPkg = JSON.parse(pkgText);
-        } catch (e) {
-            pkgErr = e;
-        }
-    }
-
-    userPkg = opts.package;
-
-    if (realPkg || userPkg) {
-        userPkg = userPkg || {};
-        realPkg = realPkg || {};
-
-        // build package agent
-        if (!opts.packageAgent) {
-            // name
-            myPkg.name = userPkg.name;
-            if (!myPkg.name) {
-                myPkg.name = realPkg.name;
-                implicitConfig.push('name');
-            }
-
-            // version
-            myPkg.version = userPkg.version;
-            if (!myPkg.version) {
-                myPkg.version = realPkg.version;
-                implicitConfig.push('version');
-            }
-            if (myPkg.name && myPkg.version) {
-                opts.packageAgent = myPkg.name + '/' + myPkg.version;
-            }
-        }
-
-        // build author
-        myPkg.author = opts.maintainerEmail;
-        if (!myPkg.author) {
-            myPkg.author =
-                (userPkg.author && userPkg.author.email) || userPkg.author;
-        }
-        if (!myPkg.author) {
-            implicitConfig.push('author');
-            myPkg.author =
-                (realPkg.author && realPkg.author.email) || realPkg.author;
-        }
-        if (!opts._init) {
-            opts.maintainerEmail = myPkg.author;
-        }
-    }
-
-    if (!opts.packageAgent) {
-        msgErr =
-            'missing `packageAgent` and also failed to read `name` and/or `version` from `package.json`';
-        if (pkgErr) {
-            msgErr += ': ' + pkgErr.message;
-        }
-        throw new Error(msgErr);
-    }
-
-    if (!opts._init) {
-        opts.maintainerEmail = parseMaintainer(opts.maintainerEmail);
-        if (!opts.maintainerEmail) {
-            msgErr =
-                'missing or malformed `maintainerEmail` (or `author` from `package.json`), which is used as the contact for support notices';
-            throw new Error(msgErr);
-        }
-    }
-
-    if (opts.packageRoot) {
-        // Place the rc file in the packageroot
-        rc = Rc._initSync(opts.packageRoot, opts.manager, opts.configDir);
-        opts.configDir = rc.configDir;
-        opts.manager = rc.manager;
-    }
-
-    if (!opts.configDir && !opts.manager) {
-        throw new Error(
-            'missing `packageRoot` and `configDir`, but no `manager` was supplied'
-        );
-    }
-
-    opts.configFile = path.join(
-        path.resolve(opts.packageRoot, opts.configDir),
-        'config.json'
-    );
-    var config;
-    try {
-        config = JSON.parse(fs.readFileSync(opts.configFile));
-    } catch (e) {
-        if ('ENOENT' !== e.code) {
-            throw e;
-        }
-        config = { defaults: {} };
-    }
-
-    opts.manager =
-        rc.manager ||
-        (config.defaults && config.defaults.manager) ||
-        config.manager;
-    if (!opts.manager) {
-        opts.manager = '@greenlock/manager';
-    }
-    if ('string' === typeof opts.manager) {
-        opts.manager = {
-            module: opts.manager
-        };
-    }
-    opts.manager = JSON.parse(JSON.stringify(opts.manager));
-
-    var confconf = ['configDir', 'configFile', 'staging', 'directoryUrl'];
-    Object.keys(opts).forEach(function(k) {
-        if (!confconf.includes(k)) {
-            return;
-        }
-        if ('undefined' !== typeof opts.manager[k]) {
-            return;
-        }
-        opts.manager[k] = opts[k];
-    });
-
-    /*
-    var ignore = ["packageRoot", "maintainerEmail", "packageAgent", "staging", "directoryUrl", "manager"];
-    Object.keys(opts).forEach(function(k) {
-        if (ignore.includes(k)) {
-            return;
-        }
-        opts.manager[k] = opts[k];
-    });
-    */
-
-    // Place the rc file in the configDir itself
-    //Rc._initSync(opts.configDir, opts.configDir);
-    return opts;
-};
-
-// ex: "John Doe <john@example.com> (https://john.doe)"
-// ex: "John Doe <john@example.com>"
-// ex: "<john@example.com>"
-// ex: "john@example.com"
-var looseEmailRe = /(^|[\s<])([^'" <>:;`]+@[^'" <>:;`]+\.[^'" <>:;`]+)/;
-function parseMaintainer(maintainerEmail) {
-    try {
-        maintainerEmail = maintainerEmail.match(looseEmailRe)[2];
-    } catch (e) {
-        maintainerEmail = null;
-    }
-
-    return maintainerEmail;
-}

lib/manager-wrapper.js

@@ -1,645 +0,0 @@
-'use strict';
-
-var U = require('../utils.js');
-var E = require('../errors.js');
-
-var warned = {};
-
-// The purpose of this file is to try to auto-build
-// partial managers so that the external API can be smaller.
-
-module.exports.wrap = function(greenlock, gconf) {
-    var myFind = gconf.find;
-    delete gconf.find;
-
-    var mega = mergeManager(greenlock, gconf);
-
-    greenlock.manager = {};
-    greenlock.sites = {};
-    //greenlock.accounts = {};
-    //greenlock.certs = {};
-
-    greenlock.manager._modulename = gconf.manager.module;
-    if ('/' === String(gconf.manager.module)[0]) {
-        greenlock.manager._modulename = require('path').relative(
-            gconf.packageRoot,
-            greenlock.manager._modulename
-        );
-        if ('.' !== String(greenlock.manager._modulename)[0]) {
-            greenlock.manager._modulename =
-                './' + greenlock.manager._modulename;
-        }
-    }
-
-    var allowed = [
-        'accountKeyType', //: ["P-256", "RSA-2048"],
-        'serverKeyType', //: ["RSA-2048", "P-256"],
-        'store', // : { module, specific opts },
-        'challenges', // : { "http-01", "dns-01", "tls-alpn-01" },
-        'subscriberEmail',
-        'agreeToTerms',
-        'agreeTos',
-        'customerEmail',
-        'renewOffset',
-        'renewStagger',
-        'module', // not allowed, just ignored
-        'manager'
-    ];
-
-    // get / set default site settings such as
-    // subscriberEmail, store, challenges, renewOffset, renewStagger
-    greenlock.manager.defaults = function(conf) {
-        return greenlock._init().then(function() {
-            if (!conf) {
-                return mega.defaults();
-            }
-
-            if (conf.sites) {
-                throw new Error('cannot set sites as global config');
-            }
-            if (conf.routes) {
-                throw new Error('cannot set routes as global config');
-            }
-
-            // disallow keys we know to be bad
-            [
-                'subject',
-                'deletedAt',
-                'altnames',
-                'lastAttemptAt',
-                'expiresAt',
-                'issuedAt',
-                'renewAt',
-                'sites',
-                'routes'
-            ].some(function(k) {
-                if (k in conf) {
-                    throw new Error(
-                        '`' + k + '` not allowed as a default setting'
-                    );
-                }
-            });
-            Object.keys(conf).forEach(function(k) {
-                if (!allowed.includes(k) && !warned[k]) {
-                    warned[k] = true;
-                    console.warn(
-                        k +
-                            " isn't a known key. Please open an issue and let us know the use case."
-                    );
-                }
-            });
-
-            Object.keys(conf).forEach(function(k) {
-                if (-1 !== ['module', 'manager'].indexOf(k)) {
-                    return;
-                }
-
-                if ('undefined' === typeof k) {
-                    throw new Error(
-                        "'" +
-                            k +
-                            "' should be set to a value, or `null`, but not left `undefined`"
-                    );
-                }
-            });
-
-            return mega.defaults(conf);
-        });
-    };
-
-    greenlock.manager._defaults = function(opts) {
-        return mega.defaults(opts);
-    };
-
-    greenlock.manager.add = function(args) {
-        if (!args || !Array.isArray(args.altnames) || !args.altnames.length) {
-            throw new Error(
-                'you must specify `altnames` when adding a new site'
-            );
-        }
-        if (args.renewAt) {
-            throw new Error(
-                'you cannot specify `renewAt` when adding a new site'
-            );
-        }
-
-        return greenlock.manager.set(args);
-    };
-
-    // TODO agreeToTerms should be handled somewhere... maybe?
-
-    // Add and update remains because I said I had locked the API
-    greenlock.manager.set = greenlock.manager.update = function(args) {
-        return greenlock._init().then(function() {
-            // The goal is to make this decently easy to manage by hand without mistakes
-            // but also reasonably easy to error check and correct
-            // and to make deterministic auto-corrections
-
-            args.subject = checkSubject(args);
-
-            //var subscriberEmail = args.subscriberEmail;
-
-            // TODO shortcut the other array checks when not necessary
-            if (Array.isArray(args.altnames)) {
-                args.altnames = checkAltnames(args.subject, args);
-            }
-
-            // at this point we know that subject is the first of altnames
-            return Promise.all(
-                (args.altnames || []).map(function(d) {
-                    d = d.replace('*.', '');
-                    return U._validDomain(d);
-                })
-            ).then(function() {
-                if (!U._uniqueNames(args.altnames || [])) {
-                    throw E.NOT_UNIQUE(
-                        'add',
-                        "'" + args.altnames.join("' '") + "'"
-                    );
-                }
-
-                // durations
-                if (args.renewOffset) {
-                    args.renewOffset = U._parseDuration(args.renewOffset);
-                }
-                if (args.renewStagger) {
-                    args.renewStagger = U._parseDuration(args.renewStagger);
-                }
-
-                return mega.set(args).then(function(result) {
-                    if (!gconf._bin_mode) {
-                        greenlock.renew({}).catch(function(err) {
-                            if (!err.context) {
-                                err.contxt = 'renew';
-                            }
-                            greenlock._notify('error', err);
-                        });
-                    }
-                    return result;
-                });
-            });
-        });
-    };
-
-    greenlock.manager.get = greenlock.sites.get = function(args) {
-        return Promise.resolve().then(function() {
-            if (args.subject) {
-                throw new Error(
-                    'get({ servername }) searches certificates by altnames, not by subject specifically'
-                );
-            }
-            if (args.servernames || args.altnames || args.renewBefore) {
-                throw new Error(
-                    'get({ servername }) does not take arguments that could lead to multiple results'
-                );
-            }
-            return mega.get(args);
-        });
-    };
-
-    greenlock.manager.remove = function(args) {
-        return Promise.resolve().then(function() {
-            args.subject = checkSubject(args);
-            if (args.servername) {
-                throw new Error(
-                    'remove() should be called with `subject` only, if you wish to remove altnames use `update()`'
-                );
-            }
-            if (args.altnames) {
-                throw new Error(
-                    'remove() should be called with `subject` only, not `altnames`'
-                );
-            }
-            // TODO check no altnames
-            return mega.remove(args);
-        });
-    };
-
-    /*
-    {
-        subject: site.subject,
-        altnames: site.altnames,
-        //issuedAt: site.issuedAt,
-        //expiresAt: site.expiresAt,
-        renewOffset: site.renewOffset,
-        renewStagger: site.renewStagger,
-        renewAt: site.renewAt,
-        subscriberEmail: site.subscriberEmail,
-        customerEmail: site.customerEmail,
-        challenges: site.challenges,
-        store: site.store
-    };
-    */
-
-    // no transaction promise here because it calls set
-    greenlock._find = async function(args) {
-        args = _mangleFindArgs(args);
-        var ours = await mega.find(args);
-        if (!myFind) {
-            return ours;
-        }
-
-        // if the user has an overlay find function we'll do a diff
-        // between the managed state and the overlay, and choose
-        // what was found.
-        var theirs = await myFind(args);
-        theirs = theirs.filter(function(site) {
-            if (!site || 'string' !== typeof site.subject) {
-                throw new Error('found site is missing subject');
-            }
-            if (
-                !Array.isArray(site.altnames) ||
-                !site.altnames.length ||
-                !site.altnames[0] ||
-                site.altnames[0] !== site.subject
-            ) {
-                throw new Error('missing or malformed altnames');
-            }
-            ['renewAt', 'issuedAt', 'expiresAt'].forEach(function(k) {
-                if (site[k]) {
-                    throw new Error(
-                        '`' +
-                            k +
-                            '` should be updated by `set()`, not by `find()`'
-                    );
-                }
-            });
-            if (!site) {
-                return;
-            }
-            if (args.subject && site.subject !== args.subject) {
-                return false;
-            }
-
-            var servernames = args.servernames || args.altnames;
-            if (
-                servernames &&
-                !site.altnames.some(function(altname) {
-                    return servernames.includes(altname);
-                })
-            ) {
-                return false;
-            }
-
-            return site.renewAt < (args.renewBefore || Infinity);
-        });
-        return _mergeFind(ours, theirs);
-    };
-
-    function _mergeFind(ours, theirs) {
-        var toUpdate = [];
-        theirs.forEach(function(_newer) {
-            var hasCurrent = ours.some(function(_older) {
-                var changed = false;
-                if (_newer.subject !== _older.subject) {
-                    return false;
-                }
-
-                // BE SURE TO SET THIS UNDEFINED AFTERWARDS
-                _older._exists = true;
-
-                _newer.deletedAt = _newer.deletedAt || 0;
-                Object.keys(_newer).forEach(function(k) {
-                    if (_older[k] !== _newer[k]) {
-                        changed = true;
-                        _older[k] = _newer[k];
-                    }
-                });
-                if (changed) {
-                    toUpdate.push(_older);
-                }
-
-                // handled the (only) match
-                return true;
-            });
-            if (!hasCurrent) {
-                toUpdate.push(_newer);
-            }
-        });
-
-        // delete the things that are gone
-        ours.forEach(function(_older) {
-            if (!_older._exists) {
-                _older.deletedAt = Date.now();
-                toUpdate.push(_older);
-            }
-            _older._exists = undefined;
-        });
-
-        Promise.all(
-            toUpdate.map(function(site) {
-                return greenlock.sites.update(site).catch(function(err) {
-                    console.error(
-                        'Developer Error: cannot update sites from user-supplied `find()`:'
-                    );
-                    console.error(err);
-                });
-            })
-        );
-
-        // ours is updated from theirs
-        return ours;
-    }
-
-    greenlock.manager.init = mega.init;
-};
-
-function checkSubject(args) {
-    if (!args || !args.subject) {
-        throw new Error('you must specify `subject` when configuring a site');
-    }
-    /*
-		if (!args.subject) {
-			throw E.NO_SUBJECT('add');
-		}
-    */
-
-    var subject = (args.subject || '').toLowerCase();
-    if (subject !== args.subject) {
-        console.warn('`subject` must be lowercase', args.subject);
-    }
-
-    return U._encodeName(subject);
-}
-
-function checkAltnames(subject, args) {
-    // the things we have to check and get right
-    var altnames = (args.altnames || []).map(function(name) {
-        return String(name || '').toLowerCase();
-    });
-
-    // punycode BEFORE validation
-    // (set, find, remove)
-    if (altnames.join() !== args.altnames.join()) {
-        console.warn(
-            'all domains in `altnames` must be lowercase:',
-            args.altnames
-        );
-    }
-
-    args.altnames = args.altnames.map(U._encodeName);
-    if (
-        !args.altnames.every(function(d) {
-            return U._validName(d);
-        })
-    ) {
-        throw E.INVALID_HOSTNAME('add', "'" + args.altnames.join("' '") + "'");
-    }
-
-    if (subject && subject !== args.altnames[0]) {
-        throw E.BAD_ORDER(
-            'add',
-            '(' + args.subject + ") '" + args.altnames.join("' '") + "'"
-        );
-    }
-    /*
-    if (subject && subject !== altnames[0]) {
-        throw new Error(
-            '`subject` must be the first domain in `altnames`',
-            args.subject,
-            altnames.join(' ')
-        );
-    }
-    */
-
-    return altnames;
-}
-
-function loadManager(gconf) {
-    var m;
-    // 1. Get the manager
-    // 2. Figure out if we need to wrap it
-
-    /*
-    if (!gconf.manager) {
-        gconf.manager = '@greenlock/manager';
-    }
-
-    if ('string' !== typeof gconf.manager) {
-        throw new Error(
-            '`manager` should be a string representing the npm name or file path of the module'
-        );
-    }
-    */
-
-    try {
-        // wrap this to be safe for @greenlock/manager
-        m = require(gconf.manager.module).create(gconf.manager);
-    } catch (e) {
-        console.error('Error loading manager:');
-        console.error(e.code);
-        console.error(e.message);
-    }
-
-    if (!m) {
-        console.error();
-        console.error(
-            'Failed to load manager plugin ',
-            JSON.stringify(gconf.manager)
-        );
-        console.error();
-        process.exit(1);
-    }
-
-    return m;
-}
-
-function mergeManager(greenlock, gconf) {
-    var mng;
-    function m() {
-        if (mng) {
-            return mng;
-        }
-        mng = require('@greenlock/manager').create(gconf);
-        return mng;
-    }
-
-    var mini = loadManager(gconf);
-    var mega = {};
-    // optional
-    if (mini.defaults) {
-        mega.defaults = function(opts) {
-            return mini.defaults(opts);
-        };
-    } else {
-        mega.defaults = m().defaults;
-    }
-
-    // optional
-    if (mini.remove) {
-        mega.remove = function(opts) {
-            return mini.remove(opts);
-        };
-    } else {
-        mega.remove = function(opts) {
-            mega.get(opts).then(function(site) {
-                if (!site) {
-                    return null;
-                }
-                site.deletedAt = Date.now();
-                return mega.set(site).then(function() {
-                    return site;
-                });
-            });
-        };
-    }
-
-    if (mini.find) {
-        // without this there cannot be fully automatic renewal
-        mega.find = function(opts) {
-            return mini.find(opts);
-        };
-    }
-
-    // set and (find and/or get) should be from the same set
-    if (mini.set) {
-        mega.set = function(opts) {
-            if (!mini.find) {
-                // TODO create the list so that find can be implemented
-            }
-            return mini.set(opts);
-        };
-    } else {
-        mega.set = m().set;
-        mega.get = m().get;
-    }
-
-    if (mini.get) {
-        mega.get = async function(opts) {
-            if (mini.set) {
-                return mini.get(opts);
-            }
-
-            if (!mega._get) {
-                mega._get = m().get;
-            }
-
-            var existing = await mega._get(opts);
-            var site = await mini.get(opts);
-            if (!existing) {
-                // Add
-                if (!site) {
-                    return;
-                }
-                site.renewAt = 1;
-                site.deletedAt = 0;
-                await mega.set(site);
-                existing = await mega._get(opts);
-            } else if (!site) {
-                // Delete
-                existing.deletedAt = site.deletedAt || Date.now();
-                await mega.set(existing);
-                existing = null;
-            } else if (
-                site.subject !== existing.subject ||
-                site.altnames.join(' ') !== existing.altnames.join(' ')
-            ) {
-                // Update
-                site.renewAt = 1;
-                site.deletedAt = 0;
-                await mega.set(site);
-                existing = await mega._get(opts);
-                if (!existing) {
-                    throw new Error('failed to `get` after `set`');
-                }
-            }
-
-            return existing;
-        };
-    } else if (mini.find) {
-        mega.get = function(opts) {
-            var servername = opts.servername;
-            delete opts.servername;
-            opts.servernames = (servername && [servername]) || undefined;
-            return mini.find(opts).then(function(sites) {
-                return sites.filter(function(site) {
-                    return site.altnames.include(servername);
-                })[0];
-            });
-        };
-    } else if (mini.set) {
-        throw new Error(
-            gconf.manager.module +
-                ' implements `set()`, but not `get()` or `find()`'
-        );
-    } else {
-        mega.find = m().find;
-        mega.get = m().get;
-    }
-
-    if (!mega.find) {
-        mega._nofind = false;
-        mega.find = async function(opts) {
-            if (!mega._nofind) {
-                console.warn(
-                    'Warning: manager `' +
-                        greenlock.manager._modulename +
-                        '` does not implement `find({})`\n'
-                );
-                mega._nofind = true;
-            }
-            return [];
-        };
-    }
-
-    if (!mega.get) {
-        mega.get = function(opts) {
-            var servername = opts.servername;
-            delete opts.servername;
-            opts.servernames = (servername && [servername]) || undefined;
-            return mega.find(opts).then(function(sites) {
-                return sites.filter(function(site) {
-                    return site.altnames.include(servername);
-                })[0];
-            });
-        };
-    }
-
-    mega.init = function(deps) {
-        if (mini.init) {
-            return mini.init(deps).then(function() {
-                if (mng) {
-                    return mng.init(deps);
-                }
-            });
-        } else if (mng) {
-            return mng.init(deps);
-        } else {
-            return Promise.resolve(null);
-        }
-    };
-
-    return mega;
-}
-
-function _mangleFindArgs(args) {
-    var servernames = (args.servernames || [])
-        .concat(args.altnames || [])
-        .filter(Boolean)
-        .slice(0);
-    var modified = servernames.slice(0);
-
-    // servername, wildname, and altnames are all the same
-    ['wildname', 'servername'].forEach(function(k) {
-        var altname = args[k] || '';
-        if (altname && !modified.includes(altname)) {
-            modified.push(altname);
-        }
-    });
-
-    if (modified.length) {
-        servernames = modified;
-        servernames = servernames.map(U._encodeName);
-        args.altnames = servernames;
-        args.servernames = args.altnames = checkAltnames(false, args);
-    }
-
-    // documented as args.servernames
-    // preserved as args.altnames for v3 beta backwards compat
-    // my only hesitancy in this choice is that a "servername"
-    // may NOT contain '*.', in which case `altnames` is a better choice.
-    // However, `altnames` is ambiguous - as if it means to find a
-    // certificate by that specific collection of altnames.
-    // ... perhaps `domains` could work?
-    return args;
-}

lib/rc.js

@@ -1,77 +0,0 @@
-'use strict';
-
-var Rc = module.exports;
-var fs = require('fs');
-var path = require('path');
-
-// This is only called if packageRoot is specified
-// (which it should be most of the time)
-Rc._initSync = function(dirname, manager, configDir) {
-    if (!dirname) {
-        return {};
-    }
-
-    // dirname / opts.packageRoot
-    var rcpath = path.resolve(dirname, '.greenlockrc');
-    var rc;
-
-    try {
-        rc = JSON.parse(fs.readFileSync(rcpath));
-    } catch (e) {
-        if ('ENOENT' !== e.code) {
-            throw e;
-        }
-        rc = {};
-    }
-
-    var changed = true;
-
-    // In the general case the manager should be specified in the
-    // config file, which is in the config dir, but for the specific
-    // case in which all custom plugins are being used and no config
-    // dir is needed, we allow the manager to be read from the rc.
-    // ex: manager: { module: 'name', xxxx: 'xxxx' }
-    if (manager) {
-        if (rc.manager) {
-            if (
-                ('string' === typeof rc.manager && rc.manager !== manager) ||
-                ('string' !== typeof rc.manager &&
-                    rc.manager.module !== manager.module)
-            ) {
-                changed = true;
-                console.info(
-                    "changing `manager` from '%s' to '%s'",
-                    rc.manager.module || rc.manager,
-                    manager.module || manager
-                );
-            }
-        }
-        rc.manager = manager;
-    }
-
-    if (!configDir) {
-        configDir = rc.configDir;
-    }
-
-    if (configDir && configDir !== rc.configDir) {
-        if (rc.configDir) {
-            console.info(
-                "changing `configDir` from '%s' to '%s'",
-                rc.configDir,
-                configDir
-            );
-        }
-        changed = true;
-        rc.configDir = configDir;
-    } else if (!rc.configDir) {
-        changed = true;
-        configDir = './greenlock.d';
-        rc.configDir = configDir;
-    }
-
-    if (changed) {
-        fs.writeFileSync(rcpath, JSON.stringify(rc));
-    }
-
-    return rc;
-};

manager-underlay.js

@@ -0,0 +1,258 @@
+'use strict';
+
+var U = require('./utils.js');
+var E = require('./errors.js');
+
+var warned = {};
+
+module.exports.wrap = function(greenlock, manager) {
+    greenlock.manager = {};
+    greenlock.sites = {};
+    //greenlock.accounts = {};
+    //greenlock.certs = {};
+
+    var allowed = [
+        'accountKeyType', //: ["P-256", "RSA-2048"],
+        'serverKeyType', //: ["RSA-2048", "P-256"],
+        'store', // : { module, specific opts },
+        'challenges', // : { "http-01", "dns-01", "tls-alpn-01" },
+        'subscriberEmail',
+        'agreeToTerms',
+        'agreeTos',
+        'customerEmail',
+        'renewOffset',
+        'renewStagger',
+        'module', // not allowed, just ignored
+        'manager'
+    ];
+
+    // get / set default site settings such as
+    // subscriberEmail, store, challenges, renewOffset, renewStagger
+    greenlock.manager.defaults = function(conf) {
+        return greenlock._init().then(function() {
+            if (!conf) {
+                return manager.defaults();
+            }
+
+            if (conf.sites) {
+                throw new Error('cannot set sites as global config');
+            }
+            if (conf.routes) {
+                throw new Error('cannot set routes as global config');
+            }
+
+            // disallow keys we know to be bad
+            [
+                'subject',
+                'deletedAt',
+                'altnames',
+                'lastAttemptAt',
+                'expiresAt',
+                'issuedAt',
+                'renewAt',
+                'sites',
+                'routes'
+            ].some(function(k) {
+                if (k in conf) {
+                    throw new Error(
+                        '`' + k + '` not allowed as a default setting'
+                    );
+                }
+            });
+            Object.keys(conf).forEach(function(k) {
+                if (!allowed.includes(k) && !warned[k]) {
+                    warned[k] = true;
+                    console.warn(
+                        k +
+                            " isn't a known key. Please open an issue and let us know the use case."
+                    );
+                }
+            });
+
+            Object.keys(conf).forEach(function(k) {
+                if (-1 !== ['module', 'manager'].indexOf(k)) {
+                    return;
+                }
+
+                if ('undefined' === typeof k) {
+                    throw new Error(
+                        "'" +
+                            k +
+                            "' should be set to a value, or `null`, but not left `undefined`"
+                    );
+                }
+            });
+
+            return manager.defaults(conf);
+        });
+    };
+
+    greenlock.add = greenlock.manager.add = function(args) {
+        if (!args || !Array.isArray(args.altnames) || !args.altnames.length) {
+            throw new Error(
+                'you must specify `altnames` when adding a new site'
+            );
+        }
+        if (args.renewAt) {
+            throw new Error(
+                'you cannot specify `renewAt` when adding a new site'
+            );
+        }
+
+        return greenlock.manager.set(args);
+    };
+
+    // TODO agreeToTerms should be handled somewhere... maybe?
+
+    // Add and update remains because I said I had locked the API
+    greenlock.manager.set = greenlock.manager.update = function(args) {
+        return greenlock._init().then(function() {
+            // The goal is to make this decently easy to manage by hand without mistakes
+            // but also reasonably easy to error check and correct
+            // and to make deterministic auto-corrections
+
+            args.subject = checkSubject(args);
+
+            //var subscriberEmail = args.subscriberEmail;
+
+            // TODO shortcut the other array checks when not necessary
+            if (Array.isArray(args.altnames)) {
+                args.altnames = checkAltnames(args.subject, args);
+            }
+
+            // at this point we know that subject is the first of altnames
+            return Promise.all(
+                (args.altnames || []).map(function(d) {
+                    d = d.replace('*.', '');
+                    return U._validDomain(d);
+                })
+            ).then(function() {
+                if (!U._uniqueNames(args.altnames || [])) {
+                    throw E.NOT_UNIQUE(
+                        'add',
+                        "'" + args.altnames.join("' '") + "'"
+                    );
+                }
+
+                // durations
+                if (args.renewOffset) {
+                    args.renewOffset = U._parseDuration(args.renewOffset);
+                }
+                if (args.renewStagger) {
+                    args.renewStagger = U._parseDuration(args.renewStagger);
+                }
+
+                return manager.set(args).then(function(result) {
+                    greenlock.renew({}).catch(function(err) {
+                        if (!err.context) {
+                            err.contxt = 'renew';
+                        }
+                        greenlock._notify('error', err);
+                    });
+                    return result;
+                });
+            });
+        });
+    };
+
+    greenlock.manager.remove = function(args) {
+        args.subject = checkSubject(args);
+        // TODO check no altnames
+        return manager.remove(args);
+    };
+
+    /*
+  {
+    subject: site.subject,
+    altnames: site.altnames,
+    //issuedAt: site.issuedAt,
+    //expiresAt: site.expiresAt,
+    renewOffset: site.renewOffset,
+    renewStagger: site.renewStagger,
+    renewAt: site.renewAt,
+    subscriberEmail: site.subscriberEmail,
+    customerEmail: site.customerEmail,
+    challenges: site.challenges,
+    store: site.store
+  };
+  */
+
+    greenlock._find = function(args) {
+        var altnames = args.altnames || [];
+
+        // servername, wildname, and altnames are all the same
+        ['wildname', 'servername'].forEach(function(k) {
+            var altname = args[k] || '';
+            if (altname && !altnames.includes(altname)) {
+                altnames.push(altname);
+            }
+        });
+
+        if (altnames.length) {
+            args.altnames = altnames;
+            args.altnames = args.altnames.map(U._encodeName);
+            args.altnames = checkAltnames(false, args);
+        }
+
+        return manager.find(args);
+    };
+};
+
+function checkSubject(args) {
+    if (!args || !args.subject) {
+        throw new Error('you must specify `subject` when configuring a site');
+    }
+    /*
+		if (!args.subject) {
+			throw E.NO_SUBJECT('add');
+		}
+    */
+
+    var subject = (args.subject || '').toLowerCase();
+    if (subject !== args.subject) {
+        console.warn('`subject` must be lowercase', args.subject);
+    }
+
+    return U._encodeName(subject);
+}
+
+function checkAltnames(subject, args) {
+    // the things we have to check and get right
+    var altnames = (args.altnames || []).map(function(name) {
+        return String(name || '').toLowerCase();
+    });
+
+    if (subject && subject !== altnames[0]) {
+        throw new Error(
+            '`subject` must be the first domain in `altnames`',
+            args.subject,
+            altnames.join(' ')
+        );
+    }
+
+    /*
+		if (args.subject !== args.altnames[0]) {
+			throw E.BAD_ORDER(
+				'add',
+				'(' + args.subject + ") '" + args.altnames.join("' '") + "'"
+			);
+		}
+  */
+
+    // punycode BEFORE validation
+    // (set, find, remove)
+    args.altnames = args.altnames.map(U._encodeName);
+    if (
+        !args.altnames.every(function(d) {
+            return U._validName(d);
+        })
+    ) {
+        throw E.INVALID_HOSTNAME('add', "'" + args.altnames.join("' '") + "'");
+    }
+
+    if (altnames.join() !== args.altnames.join()) {
+        console.warn('all domains in `altnames` must be lowercase', altnames);
+    }
+
+    return altnames;
+}

package-lock.json

@@ -1,46 +1,19 @@
 {
     "name": "@root/greenlock",
-    "version": "4.0.5",
+    "version": "3.0.18",
     "lockfileVersion": 1,
     "requires": true,
     "dependencies": {
-        "@greenlock/manager": {
-            "version": "3.1.0",
-            "resolved": "https://registry.npmjs.org/@greenlock/manager/-/manager-3.1.0.tgz",
-            "integrity": "sha512-PBy5CMK+j4oD7sj7hF5qE+xKEOSiiuL2hHd5X5ttEbtnTSDKjNeqbrR5k2ZddwVNdjOVeBIeuqlm81IFZ+Ftew==",
-            "requires": {
-                "greenlock-manager-fs": "^3.1.0"
-            },
-            "dependencies": {
-                "greenlock-manager-fs": {
-                    "version": "3.1.1",
-                    "resolved": "https://registry.npmjs.org/greenlock-manager-fs/-/greenlock-manager-fs-3.1.1.tgz",
-                    "integrity": "sha512-np6qdnPIOZx40PAcSQcqK1eMPWjTKxsxcgRd/OVg0ai49WC1Ds74CTrwmB84pq2n53ikbnDBQFmKEQ4AC0DK8w==",
-                    "requires": {
-                        "@root/mkdirp": "^1.0.0",
-                        "safe-replace": "^1.1.0"
-                    }
-                }
-            }
-        },
         "@root/acme": {
-            "version": "3.1.0",
+            "version": "3.0.8",
-            "resolved": "https://registry.npmjs.org/@root/acme/-/acme-3.1.0.tgz",
+            "resolved": "https://registry.npmjs.org/@root/acme/-/acme-3.0.8.tgz",
-            "integrity": "sha512-GAyaW63cpSYd2KvVp5lHLbCWeEhJPKZK9nsJvZJOKsD9Uv88KEttn4FpDZEJ+2q3Jsey0DWpuQ2I4ft0JV9p2w==",
+            "integrity": "sha512-VmBvLvWdCDkolkanI9Dzm1ouSWPaAa2eCCwcDZcVQbWoNiUIOqbbd57fcMA/gZxLyuJPStD2WXFuEuSMPDxcww==",
             "requires": {
-                "@root/csr": "^0.8.1",
                 "@root/encoding": "^1.0.1",
-                "@root/keypairs": "^0.10.0",
+                "@root/keypairs": "^0.9.0",
                 "@root/pem": "^1.0.4",
-                "@root/request": "^1.6.1",
+                "@root/request": "^1.3.11",
                 "@root/x509": "^0.7.2"
-            },
-            "dependencies": {
-                "@root/request": {
-                    "version": "1.6.1",
-                    "resolved": "https://registry.npmjs.org/@root/request/-/request-1.6.1.tgz",
-                    "integrity": "sha512-8wrWyeBLRp7T8J36GkT3RODJ6zYmL0/maWlAUD5LOXT28D3TDquUepyYDKYANNA3Gc8R5ZCgf+AXvSTYpJEWwQ=="
-                }
             }
         },
         "@root/asn1": {
@@ -67,9 +40,9 @@
             "integrity": "sha512-OaEub02ufoU038gy6bsNHQOjIn8nUjGiLcaRmJ40IUykneJkIW5fxDqKxQx48cszuNflYldsJLPPXCrGfHs8yQ=="
         },
         "@root/keypairs": {
-            "version": "0.10.0",
+            "version": "0.9.0",
-            "resolved": "https://registry.npmjs.org/@root/keypairs/-/keypairs-0.10.0.tgz",
+            "resolved": "https://registry.npmjs.org/@root/keypairs/-/keypairs-0.9.0.tgz",
-            "integrity": "sha512-t8VocY46Mtb0NTsxzyLLf5tsgfw0BXLYVADAyiRdEdqHcvPFGJdjkXNtHVQuSV/FMaC65iTOHVP4E6X8iT3Ikg==",
+            "integrity": "sha512-NXE2L9Gv7r3iC4kB/gTPZE1vO9Ox/p14zDzAJ5cGpTpytbWOlWF7QoHSJbtVX4H7mRG/Hp7HR3jWdWdb2xaaXg==",
             "requires": {
                 "@root/encoding": "^1.0.1",
                 "@root/pem": "^1.0.4",
@@ -87,9 +60,9 @@
             "integrity": "sha512-rEUDiUsHtild8GfIjFE9wXtcVxeS+ehCJQBwbQQ3IVfORKHK93CFnRtkr69R75lZFjcmKYVc+AXDB+AeRFOULA=="
         },
         "@root/request": {
-            "version": "1.6.1",
+            "version": "1.3.11",
-            "resolved": "https://registry.npmjs.org/@root/request/-/request-1.6.1.tgz",
+            "resolved": "https://registry.npmjs.org/@root/request/-/request-1.3.11.tgz",
-            "integrity": "sha512-8wrWyeBLRp7T8J36GkT3RODJ6zYmL0/maWlAUD5LOXT28D3TDquUepyYDKYANNA3Gc8R5ZCgf+AXvSTYpJEWwQ=="
+            "integrity": "sha512-3a4Eeghcjsfe6zh7EJ+ni1l8OK9Fz2wL1OjP4UCa0YdvtH39kdXB9RGWuzyNv7dZi0+Ffkc83KfH0WbPMiuJFw=="
         },
         "@root/x509": {
             "version": "0.7.2",
@@ -116,10 +89,19 @@
             "integrity": "sha512-8sJ78ElpbDJBHNeBzUbUVLsqKdccaa/BXF1uPTw3GrvQTBgrQrtObr2mUrE38vzYd8cEv+m/JBfDLioYcfXoaw==",
             "dev": true
         },
+        "greenlock-manager-fs": {
+            "version": "3.0.1",
+            "resolved": "https://registry.npmjs.org/greenlock-manager-fs/-/greenlock-manager-fs-3.0.1.tgz",
+            "integrity": "sha512-vZfGFq1TTKxaAqdGDUwNservrNzXx0xCwT/ovG/N378GrhS+U5S8B8LUlNtQU7Fdw6RToMiBcm22OOxSrvZ2zw==",
+            "requires": {
+                "@root/mkdirp": "^1.0.0",
+                "safe-replace": "^1.1.0"
+            }
+        },
         "greenlock-store-fs": {
-            "version": "3.2.2",
+            "version": "3.2.0",
-            "resolved": "https://registry.npmjs.org/greenlock-store-fs/-/greenlock-store-fs-3.2.2.tgz",
+            "resolved": "https://registry.npmjs.org/greenlock-store-fs/-/greenlock-store-fs-3.2.0.tgz",
-            "integrity": "sha512-92ejLB4DyV4qv/2b6VLGF2nKfYQeIfg3o+e/1cIoYLjlIaUFdbBXkzLTRozFlHsQPZt2ALi5qYrpC9IwH7GK8A==",
+            "integrity": "sha512-zqcPnF+173oYq5qU7FoGtuqeG8dmmvAiSnz98kEHAHyvgRF9pE1T0MM0AuqDdj45I3kXlCj2gZBwutnRi37J3g==",
             "requires": {
                 "@root/mkdirp": "^1.0.0",
                 "safe-replace": "^1.1.0"

package.json

@@ -1,13 +1,10 @@
 {
     "name": "@root/greenlock",
-    "version": "4.0.5",
+    "version": "3.0.23",
     "description": "The easiest Let's Encrypt client for Node.js and Browsers",
     "homepage": "https://rootprojects.org/greenlock/",
     "main": "greenlock.js",
     "browser": {},
-    "bin": {
-        "greenlock": "bin/greenlock.js"
-    },
     "files": [
         "*.js",
         "lib",
@@ -38,15 +35,15 @@
     "author": "AJ ONeal <coolaj86@gmail.com> (https://coolaj86.com/)",
     "license": "MPL-2.0",
     "dependencies": {
-        "@greenlock/manager": "^3.1.0",
+        "@root/acme": "^3.0.8",
-        "@root/acme": "^3.1.0",
         "@root/csr": "^0.8.1",
-        "@root/keypairs": "^0.10.0",
+        "@root/keypairs": "^0.9.0",
         "@root/mkdirp": "^1.0.0",
-        "@root/request": "^1.6.1",
+        "@root/request": "^1.3.10",
         "acme-http-01-standalone": "^3.0.5",
         "cert-info": "^1.5.1",
-        "greenlock-store-fs": "^3.2.2",
+        "greenlock-manager-fs": "^3.0.1",
+        "greenlock-store-fs": "^3.2.0",
         "safe-replace": "^1.1.0"
     },
     "devDependencies": {

plugins.js

@@ -31,7 +31,6 @@ P._loadHelper = function(modname) {
         console.error("Could not load '%s'", modname);
         console.error('Did you install it?');
         console.error('\tnpm install --save %s', modname);
-        e.context = 'load_plugin';
         throw e;
 
         // Fun experiment, bad idea
@@ -146,7 +145,7 @@ P._normalizeChallenge = function(name, ch) {
         };
     }
 
-    // init, zones, set, get, remove, propagationDelay
+    // init, zones, set, get, remove
     if (ch.init) {
         if (2 === ch.init.length) {
             warn();
@@ -183,9 +182,6 @@ P._normalizeChallenge = function(name, ch) {
         }
         gch.get = wrappy(ch.get);
     }
-    if("number" === typeof ch.propagationDelay) {
-        gch.propagationDelay = ch.propagationDelay;
-    }
 
     return gch;
 };
@@ -197,7 +193,6 @@ P._loadSync = function(modname) {
         console.error("Could not load '%s'", modname);
         console.error('Did you install it?');
         console.error('\tnpm install --save %s', modname);
-        e.context = 'load_plugin';
         throw e;
     }
     /*
@@ -211,11 +206,6 @@ P._loadSync = function(modname) {
 };
 
 P._installSync = function(moduleName) {
-    try {
-        return require(moduleName);
-    } catch (e) {
-        // continue
-    }
     var npm = 'npm';
     var args = ['install', '--save', moduleName];
     var out = '';

tests/cli.sh

@@ -1,31 +0,0 @@
-#!/bin/bash
-
-set -e
-
-# TODO notify if wildcard is selected and no dns challenge is present
-node bin/greenlock.js add --subject example.com --altnames 'example.com,*.example.com'
-node bin/greenlock.js update --subject example.com
-node bin/greenlock.js config --subject example.com
-node bin/greenlock.js config --subject *.example.com
-node bin/greenlock.js defaults
-node bin/greenlock.js defaults --account-key-type
-node bin/greenlock.js defaults
-# using --challenge-xx-xx-xxx is additive
-node bin/greenlock.js defaults --challenge-dns-01 foo-http-01-bar --challenge-dns-01-token BIG_TOKEN
-# using --challenge is exclusive (will delete things not mentioned)
-node bin/greenlock.js defaults --challenge acme-http-01-standalone
-# should delete all and add just this one anew
-node bin/greenlock.js update --subject example.com --challenge bar-http-01-baz
-# should add, leaving the existing
-node bin/greenlock.js update --subject example.com --challenge-dns-01 baz-dns-01-qux --challenge-dns-01-token BIG_TOKEN
-# should delete all and add just this one anew
-node bin/greenlock.js update --subject example.com --challenge bar-http-01-baz
-node bin/greenlock.js remove --subject example.com
-
-# TODO test for failure
-# node bin/greenlock.js add --subject example.com
-# node bin/greenlock.js add --subject example --altnames example
-# node bin/greenlock.js add --subject example.com --altnames '*.example.com'
-# node bin/greenlock.js add --subject example.com --altnames '*.example.com,example.com'
-# node bin/greenlock.js update --altnames example.com
-# node bin/greenlock.js config foo.example.com

utils.js

@@ -59,7 +59,7 @@ U._validName = function(str) {
     // Note: _ (underscore) is only allowed for "domain names", not "hostnames"
     // Note: - (hyphen) is not allowed as a first character (but a number is)
     return (
-        /^(\*\.)?[a-z0-9_\.\-]+\.[a-z0-9_\.\-]+$/.test(str) &&
+        /^(\*\.)?[a-z0-9_\.\-]+$/.test(str) &&
         str.length < 254 &&
         str.split('.').every(function(label) {
             return label.length > 0 && label.length < 64;