feat: add download command to retrieve PEM bundle from Key Vault

src/cli.ts

@@ -1,4 +1,5 @@
 #!/usr/bin/env node
+import { writeFileSync } from 'node:fs';
 import { Command } from 'commander';
 import { loadConfig } from './lib/config.js';
 import { domainToCertName, Provisioner } from './lib/provisioner.js';
@@ -119,6 +120,24 @@ sharedOptions(
   if (result.errors.length > 0) process.exit(1);
 });
 
+sharedOptions(
+  program
+    .command('download <domain>')
+    .description('Download the PEM bundle (private key + certificate + chain) for a domain')
+    .option('--output <file>', 'Write to file instead of stdout')
+).action(async (domain: string, options: Record<string, unknown>) => {
+  applyOverrides(options);
+  const config = loadConfig();
+  const provisioner = new Provisioner(config);
+  const pem = await provisioner.download(domain);
+  if (options['output']) {
+    writeFileSync(String(options['output']), pem, 'utf8');
+    console.log(`Certificate written to ${options['output']}`);
+  } else {
+    process.stdout.write(pem);
+  }
+});
+
 program.parseAsync(process.argv).catch((err: unknown) => {
   console.error(err instanceof Error ? err.message : String(err));
   process.exit(1);