@get-dx/cli 0.7.0 → 0.9.0

package/dist/doctor/config.js

@@ -0,0 +1,119 @@
+import dayjs from "dayjs";
+import { inspectConfigFile, parseWebBaseUrl, resolveApiBaseUrlWithSource, resolveWebBaseUrlWithSource, } from "../config.js";
+import { getTokenWithSource } from "../secrets.js";
+import { maskToken } from "../ui.js";
+import { formatBytes, tildify } from "./format.js";
+import { check } from "./types.js";
+export async function checkConfig() {
+    const checks = [];
+    checks.push(configFileCheck());
+    const api = resolveApiBaseUrlWithSource();
+    const web = resolveWebBaseUrlWithSource();
+    checks.push(check("api_base_url", "API base URL", "ok", api.url, {
+        source: api.source,
+        data: { url: api.url },
+    }), check("web_base_url", "Web base URL", "ok", web.url, {
+        source: web.source,
+        data: { url: web.url },
+    }));
+    if (process.env.DX_API_BASE_URL && !process.env.DX_WEB_BASE_URL) {
+        checks.push(check("base_url_env", "Base URL env vars", "fail", "DX_API_BASE_URL is set but DX_WEB_BASE_URL is not", {
+            hint: "Set DX_WEB_BASE_URL to your DX web app URL (e.g. https://acme.getdx.io) or unset DX_API_BASE_URL.",
+        }));
+    }
+    checks.push(deploymentCheck(web.url));
+    const { check: tokenCheck, token } = await tokenCheckFor(api.url);
+    checks.push(tokenCheck);
+    return {
+        section: { id: "config", title: "Config", checks },
+        facts: { apiBaseUrl: api.url, webBaseUrl: web.url, token },
+    };
+}
+function configFileCheck() {
+    const inspection = inspectConfigFile();
+    const displayPath = tildify(inspection.path);
+    switch (inspection.status) {
+        case "missing":
+            if (process.env.DX_API_TOKEN) {
+                return check("config_file", "Config file", "ok", `${displayPath} not present (using env/defaults)`, { data: { path: displayPath, exists: false } });
+            }
+            return check("config_file", "Config file", "warn", `${displayPath} not present`, {
+                hint: "This usually means `dx auth login` has never completed. Run `dx auth login`.",
+                data: { path: displayPath, exists: false },
+            });
+        case "invalid":
+            return check("config_file", "Config file", "fail", `${displayPath} could not be read (${inspection.error})`, {
+                hint: "The file is ignored while it is invalid. Fix or delete it, then run `dx auth login`.",
+                data: { path: displayPath, exists: true, error: inspection.error },
+            });
+        case "ok": {
+            const modifiedAt = dayjs(inspection.modifiedAt).format();
+            return check("config_file", "Config file", "ok", `${displayPath} (${formatBytes(inspection.sizeBytes)}, modified ${modifiedAt})`, {
+                data: {
+                    path: displayPath,
+                    exists: true,
+                    size_bytes: inspection.sizeBytes,
+                    modified_at: modifiedAt,
+                },
+            });
+        }
+    }
+}
+function deploymentCheck(webBaseUrl) {
+    const parsed = parseWebBaseUrl(webBaseUrl);
+    switch (parsed.type) {
+        case "cloud":
+            return check("deployment", "Deployment", "ok", "cloud", {
+                data: { type: "cloud" },
+            });
+        case "dedicated":
+            return check("deployment", "Deployment", "ok", `dedicated (${parsed.accountName})`, { data: { type: "dedicated", account: parsed.accountName } });
+        case "managed":
+            return check("deployment", "Deployment", "ok", "managed (custom domain)", {
+                data: { type: "managed" },
+            });
+        case "invalid":
+            return check("deployment", "Deployment", "fail", `could not recognize web base URL "${parsed.input}"`, {
+                hint: "Expected https://app.getdx.com, https://<account>.getdx.io, or a custom domain.",
+                data: { type: "invalid" },
+            });
+    }
+}
+async function tokenCheckFor(apiBaseUrl) {
+    const lookup = await getTokenWithSource(apiBaseUrl);
+    switch (lookup.source) {
+        case "env":
+        case "keychain": {
+            const masked = maskToken(lookup.token);
+            return {
+                token: lookup.token,
+                check: check("token", "Token", "ok", masked ?? "", {
+                    source: lookup.source,
+                    data: { source: lookup.source, masked_token: masked },
+                }),
+            };
+        }
+        case "none":
+            return {
+                token: null,
+                check: check("token", "Token", "fail", `no token found (checked DX_API_TOKEN and ${lookup.storeName})`, {
+                    hint: "Run `dx auth login`, or set DX_API_TOKEN.",
+                    data: { source: null },
+                }),
+            };
+        case "error":
+            return {
+                token: null,
+                check: check("token", "Token", "fail", `could not read ${lookup.storeName ?? "the OS secret store"}: ${lookup.error}`, {
+                    hint: tokenStoreHint(),
+                    data: { source: null, error: lookup.error },
+                }),
+            };
+    }
+}
+function tokenStoreHint() {
+    if (process.platform === "linux") {
+        return "Install `libsecret-tools` and make sure a Secret Service provider (e.g. GNOME Keyring) is running, or set DX_API_TOKEN instead.";
+    }
+    return "Set DX_API_TOKEN in the environment instead of storing the token in the OS secret store.";
+}

package/dist/doctor/environment.js

@@ -0,0 +1,60 @@
+import fs from "node:fs";
+import { maskToken } from "../ui.js";
+import { redactUrlCredentials, tildify } from "./format.js";
+import { check } from "./types.js";
+const PROXY_VARS = ["HTTP_PROXY", "HTTPS_PROXY", "ALL_PROXY", "NO_PROXY"];
+/** Variable names that likely hold credentials, so their values are masked. */
+const SENSITIVE_NAME_PATTERN = /TOKEN|SECRET|PASSWORD|PASSWD|CREDENTIAL|API_?KEY|PRIVATE_?KEY|AUTH|COOKIE|SESSION_?KEY/i;
+export function isSensitiveEnvName(name) {
+    return SENSITIVE_NAME_PATTERN.test(name);
+}
+export function checkEnvironment(env = process.env) {
+    const checks = [];
+    const names = Object.keys(env).sort();
+    for (const name of names.filter((name) => name.startsWith("DX_"))) {
+        const raw = env[name] ?? "";
+        const sensitive = isSensitiveEnvName(name);
+        const value = sensitive ? (maskToken(raw) ?? "") : raw;
+        checks.push(check(name.toLowerCase(), name, "ok", value, {
+            data: { masked: sensitive },
+        }));
+    }
+    for (const name of names.filter((name) => PROXY_VARS.includes(name.toUpperCase()))) {
+        const value = redactUrlCredentials(env[name] ?? "");
+        checks.push(check(name.toLowerCase(), name, "warn", value, {
+            hint: "dx-cli does not use proxy environment variables. Requests go directly to the DX API.",
+            data: { value },
+        }));
+    }
+    const extraCaCerts = env.NODE_EXTRA_CA_CERTS;
+    if (extraCaCerts) {
+        const displayPath = tildify(extraCaCerts);
+        const exists = fs.existsSync(extraCaCerts);
+        checks.push(exists
+            ? check("node_extra_ca_certs", "NODE_EXTRA_CA_CERTS", "ok", `${displayPath} (file exists)`, { data: { path: displayPath, exists } })
+            : check("node_extra_ca_certs", "NODE_EXTRA_CA_CERTS", "warn", `${displayPath} (file not found)`, {
+                hint: "Node ignores this setting when the file does not exist. Point it at your CA bundle in PEM format.",
+                data: { path: displayPath, exists },
+            }));
+    }
+    const useSystemCa = env.NODE_USE_SYSTEM_CA;
+    if (useSystemCa) {
+        checks.push(check("node_use_system_ca", "NODE_USE_SYSTEM_CA", "ok", useSystemCa));
+    }
+    const rejectUnauthorized = env.NODE_TLS_REJECT_UNAUTHORIZED;
+    if (rejectUnauthorized !== undefined) {
+        checks.push(rejectUnauthorized === "0"
+            ? check("node_tls_reject_unauthorized", "NODE_TLS_REJECT_UNAUTHORIZED", "warn", "0 (certificate verification disabled)", {
+                hint: "This disables TLS certificate checks and is insecure. Use NODE_EXTRA_CA_CERTS to trust your corporate CA instead.",
+            })
+            : check("node_tls_reject_unauthorized", "NODE_TLS_REJECT_UNAUTHORIZED", "ok", rejectUnauthorized));
+    }
+    const nodeOptions = env.NODE_OPTIONS;
+    if (nodeOptions) {
+        checks.push(check("node_options", "NODE_OPTIONS", "ok", nodeOptions));
+    }
+    if (checks.length === 0) {
+        checks.push(check("none", "Variables", "ok", "(none set)"));
+    }
+    return { id: "environment", title: "Environment", checks };
+}

package/dist/doctor/format.js

@@ -0,0 +1,68 @@
+import os from "node:os";
+import { describeFetchFailure } from "../http.js";
+import { CHECK_TIMEOUT_MS, ProbeTimeoutError } from "./probes.js";
+/** Replace the home directory with `~` so paths don't reveal usernames. */
+export function tildify(filePath) {
+    const home = os.homedir();
+    if (home &&
+        (filePath === home ||
+            filePath.startsWith(home + "/") ||
+            filePath.startsWith(home + "\\"))) {
+        return "~" + filePath.slice(home.length);
+    }
+    return filePath;
+}
+export function formatBytes(bytes) {
+    if (bytes < 1024) {
+        return `${bytes} B`;
+    }
+    const units = ["KB", "MB", "GB"];
+    let value = bytes / 1024;
+    let unit = 0;
+    while (value >= 1024 && unit < units.length - 1) {
+        value /= 1024;
+        unit += 1;
+    }
+    return `${value.toFixed(1)} ${units[unit]}`;
+}
+/** Remove credentials from a URL-like string, e.g. a proxy URL. */
+export function redactUrlCredentials(value) {
+    return value.replace(/\/\/[^/@\s]+@/g, "//***@");
+}
+export function isTimeout(error) {
+    if (error instanceof ProbeTimeoutError) {
+        return true;
+    }
+    let current = error;
+    while (current instanceof Error) {
+        if (current.name === "TimeoutError") {
+            return true;
+        }
+        current = current.cause;
+    }
+    return false;
+}
+/** The error code (e.g. `ECONNRESET`) of an error or anything in its cause chain. */
+export function errorCode(error) {
+    let current = error;
+    while (current instanceof Error) {
+        const { code } = current;
+        if (typeof code === "string") {
+            return code;
+        }
+        current = current.cause;
+    }
+    return null;
+}
+export function describeError(error, action) {
+    if (isTimeout(error)) {
+        const timeoutMs = error instanceof ProbeTimeoutError ? error.timeoutMs : CHECK_TIMEOUT_MS;
+        return `${action} timed out after ${timeoutMs / 1000}s`;
+    }
+    return describeFetchFailure(error);
+}
+export async function timed(fn) {
+    const start = performance.now();
+    const value = await fn();
+    return { value, ms: Math.round(performance.now() - start) };
+}

package/dist/doctor/index.js

@@ -0,0 +1,81 @@
+import { buildLogger } from "../runtime.js";
+import { checkAuth } from "./auth.js";
+import { checkCli, defaultLatestVersionLookup, detectInstall, } from "./cli.js";
+import { checkConfig } from "./config.js";
+import { checkEnvironment } from "./environment.js";
+import { checkNetwork } from "./network.js";
+import { defaultProbes } from "./probes.js";
+import { checkSkill } from "./skill.js";
+import cliPackage from "../../package.json" with { type: "json" };
+const defaultDependencies = {
+    probes: defaultProbes,
+    latestVersion: defaultLatestVersionLookup,
+    install: () => detectInstall(),
+    now: () => new Date(),
+};
+/**
+ * Run every doctor check. Never throws: problems are reported as checks.
+ *
+ * Checks run in dependency order (config before network before auth), but the
+ * report lists sections in reading order.
+ */
+export async function runDoctor(context, options = {}) {
+    const deps = { ...defaultDependencies, ...options.dependencies };
+    const onPhase = options.onPhase ?? (() => { });
+    const now = deps.now();
+    onPhase("config");
+    const environment = checkEnvironment();
+    const config = await checkConfig();
+    const { apiBaseUrl, webBaseUrl, token } = config.facts;
+    const runtime = token
+        ? {
+            apiBaseUrl,
+            webBaseUrl,
+            token,
+            context,
+            version: cliPackage.version,
+            logger: buildLogger(context),
+        }
+        : null;
+    onPhase("network");
+    const network = await checkNetwork({
+        apiBaseUrl,
+        webBaseUrl,
+        version: cliPackage.version,
+        probes: deps.probes,
+    });
+    const { apiReachable } = network.facts;
+    onPhase("auth");
+    const auth = await checkAuth({ runtime, apiReachable, now });
+    onPhase("version");
+    const cli = await checkCli({
+        runtime,
+        apiReachable,
+        install: deps.install(),
+        latestVersion: deps.latestVersion,
+        now,
+    });
+    const skill = await checkSkill();
+    return buildReport([
+        cli,
+        environment,
+        config.section,
+        network.section,
+        auth,
+        skill,
+    ]);
+}
+function buildReport(sections) {
+    const summary = {
+        ok: 0,
+        warn: 0,
+        fail: 0,
+        skip: 0,
+    };
+    for (const section of sections) {
+        for (const check of section.checks) {
+            summary[check.status] += 1;
+        }
+    }
+    return { ok: summary.fail === 0, summary, sections };
+}

package/dist/doctor/network.js

@@ -0,0 +1,224 @@
+import { describeError, errorCode, timed } from "./format.js";
+import { CHECK_TIMEOUT_MS, DOCTOR_HEADER, } from "./probes.js";
+import { check } from "./types.js";
+const TLS_VERIFY_HINT = "Your network may be intercepting HTTPS traffic with its own certificate.\nSet NODE_EXTRA_CA_CERTS to your corporate CA bundle (PEM), or ask your network team to allow {host}.";
+const CONNECTION_RESET_HINT = "A firewall or proxy on your network is likely interrupting HTTPS traffic to {host}.\nAsk your network team to allow {host}, or set NODE_EXTRA_CA_CERTS to your corporate CA bundle.";
+export async function checkNetwork(options) {
+    const { apiBaseUrl, webBaseUrl, version, probes } = options;
+    const checks = [];
+    let url;
+    try {
+        url = new URL(apiBaseUrl);
+    }
+    catch {
+        checks.push(check("dns", "DNS", "fail", `invalid API base URL "${apiBaseUrl}"`, {
+            hint: "Check DX_API_BASE_URL or the apiBaseUrl in your config file.",
+        }), await webAppCheck(webBaseUrl, version, probes));
+        return {
+            section: { id: "network", title: "Network", checks },
+            facts: { apiReachable: false },
+        };
+    }
+    const host = url.hostname;
+    const isHttps = url.protocol === "https:";
+    const port = url.port ? Number(url.port) : isHttps ? 443 : 80;
+    const fill = (text) => text.replaceAll("{host}", host);
+    let skipReason = null;
+    const skip = (id, label) => check(id, label, "skip", `skipped because ${skipReason}`);
+    // 1. DNS
+    try {
+        const { value: addresses, ms } = await timed(() => probes.lookup(host));
+        checks.push(check("dns", "DNS", "ok", `resolved to ${addresses.join(", ")} (${ms}ms)`, { data: { addresses, ms } }));
+    }
+    catch (error) {
+        const code = errorCode(error);
+        checks.push(check("dns", "DNS", "fail", describeError(error, "DNS lookup"), {
+            hint: code === "ENOTFOUND"
+                ? fill("{host} could not be resolved. Check the API base URL, your VPN, and your DNS settings.")
+                : "Check your network connection, VPN, and DNS settings.",
+            data: { code },
+        }));
+        skipReason = "DNS lookup failed";
+    }
+    // 2. TCP
+    if (skipReason) {
+        checks.push(skip("tcp", "TCP connect"));
+    }
+    else {
+        try {
+            const { ms } = await timed(() => probes.tcpConnect(host, port));
+            checks.push(check("tcp", "TCP connect", "ok", `port ${port} open (${ms}ms)`, {
+                data: { port, ms },
+            }));
+        }
+        catch (error) {
+            checks.push(check("tcp", "TCP connect", "fail", describeError(error, `connecting to port ${port}`), {
+                hint: fill(`A firewall may be blocking outbound connections to {host} on port ${port}.`),
+                data: { port, code: errorCode(error) },
+            }));
+            skipReason = "the TCP connection failed";
+        }
+    }
+    // 3. TLS
+    if (!isHttps) {
+        checks.push(check("tls", "TLS handshake", "skip", "skipped because the API base URL does not use HTTPS"));
+    }
+    else if (skipReason) {
+        checks.push(skip("tls", "TLS handshake"));
+    }
+    else {
+        const tlsCheck = await tlsHandshakeCheck(host, port, probes, fill);
+        checks.push(tlsCheck);
+        if (tlsCheck.status === "fail") {
+            skipReason = "the TLS handshake failed";
+        }
+    }
+    // 4. HTTPS request to the API
+    let apiReachable = false;
+    if (skipReason) {
+        checks.push(skip("https", "HTTPS"));
+    }
+    else {
+        const httpsCheck = await apiRequestCheck(apiBaseUrl, version, probes, fill);
+        checks.push(httpsCheck);
+        apiReachable = httpsCheck.status === "ok";
+    }
+    // 5. Web app, independent of the API checks
+    checks.push(await webAppCheck(webBaseUrl, version, probes));
+    return {
+        section: { id: "network", title: `Network (${host})`, checks },
+        facts: { apiReachable },
+    };
+}
+async function tlsHandshakeCheck(host, port, probes, fill) {
+    try {
+        const { value: result, ms } = await timed(() => probes.tlsHandshake(host, port));
+        const { certificate } = result;
+        const parts = [
+            result.protocol,
+            certificate.issuer ? `issuer "${certificate.issuer}"` : null,
+            certificate.validTo
+                ? `valid until ${certificate.validTo.slice(0, 10)}`
+                : null,
+        ].filter(Boolean);
+        const summary = `${parts.join("; ")} (${ms}ms)`;
+        const data = {
+            protocol: result.protocol,
+            subject: certificate.subject,
+            issuer: certificate.issuer,
+            valid_to: certificate.validTo,
+            authorized: result.authorized,
+            authorization_error: result.authorizationError,
+            root: result.rootIssuer,
+            root_is_bundled: result.rootIsBundled,
+            ms,
+        };
+        if (!result.authorized) {
+            return check("tls", "TLS handshake", "fail", `certificate not trusted (${result.authorizationError ?? "unknown error"}); ${summary}`, { hint: fill(TLS_VERIFY_HINT), data });
+        }
+        if (result.rootIsBundled === false) {
+            return check("tls", "TLS handshake", "warn", `trusted via a non-public CA "${result.rootIssuer}"; ${summary}`, {
+                hint: `Traffic appears to be intercepted by "${result.rootIssuer}". This works because that CA is trusted locally, but requests are being inspected by your network.`,
+                data,
+            });
+        }
+        return check("tls", "TLS handshake", "ok", summary, { data });
+    }
+    catch (error) {
+        const code = errorCode(error);
+        const reset = code === "ECONNRESET" || code === "EPIPE";
+        return check("tls", "TLS handshake", "fail", reset
+            ? `connection reset by peer during handshake (${code})`
+            : describeError(error, "TLS handshake"), {
+            hint: fill(reset ? CONNECTION_RESET_HINT : TLS_VERIFY_HINT),
+            data: { code },
+        });
+    }
+}
+async function apiRequestCheck(apiBaseUrl, version, probes, fill) {
+    const url = `${apiBaseUrl}/auth.info`;
+    try {
+        const { value: response, ms } = await timed(async () => {
+            const response = await probes.fetch(url, {
+                headers: {
+                    ...clientHeaders(version),
+                    ...DOCTOR_HEADER,
+                    Accept: "application/json",
+                },
+                signal: AbortSignal.timeout(CHECK_TIMEOUT_MS),
+            });
+            return { status: response.status, text: await response.text() };
+        });
+        const data = { url, status: response.status, ms };
+        if (!isJson(response.text)) {
+            return check("https", "HTTPS", "fail", `unexpected non-JSON response (HTTP ${response.status}) (${ms}ms)`, {
+                hint: fill("Something other than the DX API answered. A proxy, firewall, or captive portal may be intercepting requests to {host}."),
+                data,
+            });
+        }
+        if (response.status >= 500) {
+            return check("https", "HTTPS", "fail", `DX API returned HTTP ${response.status} (${ms}ms)`, {
+                hint: "The DX API is having problems. Try again in a few minutes.",
+                data,
+            });
+        }
+        const message = response.status === 401
+            ? `DX API responded (401 without token, as expected) (${ms}ms)`
+            : `DX API responded (HTTP ${response.status}) (${ms}ms)`;
+        return check("https", "HTTPS", "ok", message, { data });
+    }
+    catch (error) {
+        return check("https", "HTTPS", "fail", describeError(error, "request"), {
+            hint: fill("Requests to {host} are failing even though the connection succeeded. A proxy or firewall may be interfering."),
+            data: { url, code: errorCode(error) },
+        });
+    }
+}
+async function webAppCheck(webBaseUrl, version, probes) {
+    try {
+        const { value: status, ms } = await timed(async () => {
+            const response = await probes.fetch(webBaseUrl, {
+                headers: { ...clientHeaders(version), ...DOCTOR_HEADER },
+                signal: AbortSignal.timeout(CHECK_TIMEOUT_MS),
+            });
+            await response.body?.cancel();
+            return response.status;
+        });
+        const data = { url: webBaseUrl, status, ms };
+        if (status >= 500) {
+            return check("web_app", "Web app reachable", "fail", `${webBaseUrl} returned HTTP ${status} (${ms}ms)`, {
+                hint: "The DX web app is having problems. Browser login may not work.",
+                data,
+            });
+        }
+        if (status >= 400) {
+            return check("web_app", "Web app reachable", "warn", `${webBaseUrl} returned HTTP ${status} (${ms}ms)`, {
+                hint: "The web app answered with an error. A proxy or firewall may be blocking it, and browser login may not work.",
+                data,
+            });
+        }
+        return check("web_app", "Web app reachable", "ok", `${webBaseUrl} responded ${status} (${ms}ms)`, { data });
+    }
+    catch (error) {
+        return check("web_app", "Web app reachable", "fail", `${webBaseUrl}: ${describeError(error, "request")}`, {
+            hint: "Browser login (`dx auth login` without --token) needs the web app. Check your network, or log in with --token instead.",
+            data: { url: webBaseUrl, code: errorCode(error) },
+        });
+    }
+}
+function clientHeaders(version) {
+    return {
+        "X-Client-Type": "dx-cli",
+        "X-Client-Version": version,
+        "User-Agent": `dx-cli/${version}`,
+    };
+}
+function isJson(text) {
+    try {
+        JSON.parse(text);
+        return true;
+    }
+    catch {
+        return false;
+    }
+}

package/dist/doctor/probes.js

@@ -0,0 +1,130 @@
+import { X509Certificate } from "node:crypto";
+import dns from "node:dns";
+import net from "node:net";
+import tls from "node:tls";
+export const CHECK_TIMEOUT_MS = 10_000;
+/** Headers sent on doctor's requests, so they can be told apart in logs. */
+export const DOCTOR_HEADER = { "X-DX-Doctor": "1" };
+export class ProbeTimeoutError extends Error {
+    timeoutMs;
+    constructor(timeoutMs) {
+        super(`timed out after ${timeoutMs / 1000}s`);
+        this.name = "ProbeTimeoutError";
+        this.timeoutMs = timeoutMs;
+    }
+}
+export const defaultProbes = {
+    lookup: (hostname) => withTimeout(dns.promises
+        .lookup(hostname, { all: true })
+        .then((results) => results.map((result) => result.address))),
+    tcpConnect,
+    tlsHandshake,
+    fetch: (input, init) => globalThis.fetch(input, init),
+};
+function withTimeout(promise) {
+    return new Promise((resolve, reject) => {
+        const timer = setTimeout(() => reject(new ProbeTimeoutError(CHECK_TIMEOUT_MS)), CHECK_TIMEOUT_MS);
+        timer.unref?.();
+        promise.then((value) => {
+            clearTimeout(timer);
+            resolve(value);
+        }, (error) => {
+            clearTimeout(timer);
+            reject(error);
+        });
+    });
+}
+function tcpConnect(hostname, port) {
+    return new Promise((resolve, reject) => {
+        const socket = net.connect({ host: hostname, port });
+        socket.setTimeout(CHECK_TIMEOUT_MS, () => {
+            socket.destroy();
+            reject(new ProbeTimeoutError(CHECK_TIMEOUT_MS));
+        });
+        socket.once("connect", () => {
+            socket.destroy();
+            resolve();
+        });
+        socket.once("error", (error) => {
+            socket.destroy();
+            reject(error);
+        });
+    });
+}
+function tlsHandshake(hostname, port) {
+    return new Promise((resolve, reject) => {
+        // Verify manually after the handshake so a bad chain is reported with its
+        // details instead of only as an error.
+        const socket = tls.connect({
+            host: hostname,
+            port,
+            servername: net.isIP(hostname) ? undefined : hostname,
+            rejectUnauthorized: false,
+        });
+        socket.setTimeout(CHECK_TIMEOUT_MS, () => {
+            socket.destroy();
+            reject(new ProbeTimeoutError(CHECK_TIMEOUT_MS));
+        });
+        socket.once("secureConnect", () => {
+            const peer = socket.getPeerCertificate(true);
+            const root = findChainRoot(peer);
+            const authorizationError = socket.authorizationError;
+            resolve({
+                protocol: socket.getProtocol() ?? null,
+                authorized: socket.authorized,
+                authorizationError: authorizationError
+                    ? String(authorizationError.code ??
+                        authorizationError)
+                    : null,
+                certificate: {
+                    subject: certificateName(peer.subject),
+                    issuer: certificateName(peer.issuer),
+                    validTo: peer.valid_to ? new Date(peer.valid_to).toISOString() : null,
+                },
+                rootIsBundled: root
+                    ? bundledRootFingerprints().has(root.fingerprint256)
+                    : null,
+                rootIssuer: root ? certificateName(root.subject) : null,
+            });
+            socket.destroy();
+        });
+        socket.once("error", (error) => {
+            socket.destroy();
+            reject(error);
+        });
+    });
+}
+/** The self-signed root at the top of a peer chain, if Node resolved one. */
+function findChainRoot(certificate) {
+    let current = certificate;
+    const seen = new Set();
+    while (current?.fingerprint256 && !seen.has(current.fingerprint256)) {
+        seen.add(current.fingerprint256);
+        const issuer = current.issuerCertificate;
+        if (!issuer || issuer.fingerprint256 === current.fingerprint256) {
+            return issuer ? current : null;
+        }
+        current = issuer;
+    }
+    return null;
+}
+let bundledFingerprints;
+function bundledRootFingerprints() {
+    bundledFingerprints ??= new Set(tls.rootCertificates.map((pem) => new X509Certificate(pem).fingerprint256));
+    return bundledFingerprints;
+}
+function certificateName(name) {
+    if (!name) {
+        return null;
+    }
+    const value = (key) => {
+        const field = name[key];
+        return Array.isArray(field) ? field[0] : field;
+    };
+    const commonName = value("CN");
+    const organization = value("O");
+    if (commonName && organization && commonName !== organization) {
+        return `${commonName} (${organization})`;
+    }
+    return commonName ?? organization ?? null;
+}