@econ-v1/domain 6.10.0 → 6.12.0

package/dist/services/certificate-trust-service.d.ts

@@ -38,5 +38,6 @@ export type CertificateTrustServiceOptions = {
     platform: CertificateTrustPlatform;
     probe: CertificateTrustProbePort;
     onChange?: (snapshot: CertificateTrustSnapshot) => void;
+    liveness?: () => boolean;
 };
 //# sourceMappingURL=certificate-trust-service.d.ts.map

package/dist/services/certificate-trust-service.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"certificate-trust-service.d.ts","sourceRoot":"","sources":["../../src/services/certificate-trust-service.js"],"names":[],"mappings":"AACA,4FAA4F;AAC5F,8FAA8F;AAC9F;IAWE;;OAEG;IACH,qBAFW,8BAA8B,EAYxC;IACD;;OAEG;IACH,UAFa,wBAAwB,CAIpC;IACD;;OAEG;IACH,kBAFa,wBAAwB,CAIpC;IACD;;OAEG;IACH,QAFa,wBAAwB,CAIpC;IACD;;OAEG;IACH,UAFa,OAAO,CAAC,wBAAwB,CAAC,CAoC7C;;CAkBF;uCApGa,OAAO,gBAAgB,EAAE,wBAAwB;wCACjD,OAAO,gBAAgB,EAAE,yBAAyB;qCAoGlD,SAAS,GAAG,YAAY,GAAG,UAAU,GAAG,QAAQ,GAAG,SAAS,GAAG,aAAa;;YAG5E,sBAAsB;YACtB,MAAM;cACN,wBAAwB;kBACxB,MAAM;gBACN,MAAM;;;YAIN,MAAM;cACN,wBAAwB;WACxB,yBAAyB;eACzB,CAAC,QAAQ,EAAE,wBAAwB,KAAK,IAAI"}
+{"version":3,"file":"certificate-trust-service.d.ts","sourceRoot":"","sources":["../../src/services/certificate-trust-service.js"],"names":[],"mappings":"AACA,4FAA4F;AAC5F,8FAA8F;AAC9F;IAaE;;OAEG;IACH,qBAFW,8BAA8B,EAaxC;IACD;;OAEG;IACH,UAFa,wBAAwB,CAIpC;IACD;;OAEG;IACH,kBAFa,wBAAwB,CAIpC;IACD;;OAEG;IACH,QAFa,wBAAwB,CAIpC;IACD;;OAEG;IACH,UAFa,OAAO,CAAC,wBAAwB,CAAC,CAmD7C;;CAkBF;uCAtHa,OAAO,gBAAgB,EAAE,wBAAwB;wCACjD,OAAO,gBAAgB,EAAE,yBAAyB;qCAsHlD,SAAS,GAAG,YAAY,GAAG,UAAU,GAAG,QAAQ,GAAG,SAAS,GAAG,aAAa;;YAG5E,sBAAsB;YACtB,MAAM;cACN,wBAAwB;kBACxB,MAAM;gBACN,MAAM;;;YAIN,MAAM;cACN,wBAAwB;WACxB,yBAAyB;eACzB,CAAC,QAAQ,EAAE,wBAAwB,KAAK,IAAI;eAC5C,MAAM,OAAO"}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@econ-v1/domain",
-  "version": "6.10.0",
+  "version": "6.12.0",
   "description": "Platform-neutral domain contracts and errors for Node clients",
   "license": "MIT OR Apache-2.0",
   "author": "Node contributors",
@@ -57,6 +57,6 @@
     "access": "public"
   },
   "dependencies": {
-    "@econ-v1/ports": "6.10.0"
+    "@econ-v1/ports": "6.12.0"
   }
 }

package/src/services/certificate-trust-service.js

@@ -10,6 +10,8 @@ export class CertificateTrustService {
   #probe;
   /** @readonly @type {(snapshot: CertificateTrustSnapshot) => void} */
   #onChange;
+  /** @readonly @type {(() => boolean) | undefined} */
+  #liveness;
   /** @type {CertificateTrustSnapshot} */
   #snapshot;
   /**
@@ -20,6 +22,7 @@ export class CertificateTrustService {
     this.#platform = options.platform;
     this.#probe = options.probe;
     this.#onChange = options.onChange ?? (() => undefined);
+    this.#liveness = options.liveness;
     this.#snapshot = {
       status: "unknown",
       origin: options.origin,
@@ -65,7 +68,22 @@ export class CertificateTrustService {
       // trust the CA yet" here would tell someone to go re-install a certificate
       // when the real problem is that nothing is listening — the same unmet
       // prerequisite reported as the wrong one.
+      //
+      // `fetch` cannot tell a rejected TLS handshake from a dead socket — the
+      // Fetch spec deliberately hides the reason — so both arrive here as
+      // `unreachable`. When some OTHER channel is currently talking to this
+      // node, the socket plainly is not dead, and the only remaining
+      // explanation is that this browser refuses the chain. Reporting that as
+      // "could not be reached" sends someone to check their network when what
+      // they actually need is to install the CA.
       if (result.status === "unreachable") {
+        if (this.#liveness?.() === true) {
+          return this.#set({
+            status: "failed",
+            lastError:
+              "This device does not trust the node's certificate authority yet.",
+          });
+        }
         return this.#set({
           status: "unavailable",
           lastError: "The node could not be reached over HTTPS.",
@@ -115,5 +133,6 @@ export class CertificateTrustService {
  * @property {CertificateTrustPlatform} platform
  * @property {CertificateTrustProbePort} probe
  * @property {(snapshot: CertificateTrustSnapshot) => void} [onChange]
+ * @property {() => boolean} [liveness]
  */
 // @ts-check