@openstatus/health-tls 0.1.4-dev.0

package/README.md

@@ -0,0 +1,78 @@
+# @openstatus/health-tls
+
+TLS probe for [`@openstatus/health`](https://jsr.io/@openstatus/health).
+Completes a TLS handshake with `host:port`, requires the certificate to
+chain to a trusted CA and fails the check when it expires within
+`minDaysValid` days — so a certificate that is about to lapse turns the
+report `degraded` two weeks before browsers start refusing it.
+
+```sh
+deno add jsr:@openstatus/health jsr:@openstatus/health-tls
+npm install @openstatus/health @openstatus/health-tls
+```
+
+```ts
+import { createHealthHandler } from "@openstatus/health";
+import { tlsProbe } from "@openstatus/health-tls";
+
+Deno.serve(
+  createHealthHandler({
+    probes: [
+      tlsProbe({ host: "api.example.com" }),
+      tlsProbe({ name: "db-tls", host: "db.example.com", port: 5432 }),
+    ],
+  }),
+);
+```
+
+`host` is sent as the SNI server name, so the probe sees the same
+certificate a client would. The socket is closed as soon as the handshake
+completes; no application data is sent. A self-signed or mis-chained
+certificate fails with the runtime's verification error
+(`SELF_SIGNED_CERT_IN_CHAIN`, `CERT_HAS_EXPIRED`, …), and one that is
+about to expire fails with `TlsCertificateExpiryError`, which carries
+`expiresAt` and `daysLeft`.
+
+Point it at your own public hostname to catch a renewal that did not run,
+or at a dependency to be warned before its certificate takes you down.
+Give each probe a `name` when you mount more than one.
+
+```ts
+tlsProbe({
+  host: "api.example.com",
+  port: 443,
+  minDaysValid: 30,
+  // optional overrides from the Probe contract
+  name: "certificate",
+  critical: false,
+  timeoutMs: 3000,
+  skip: () => env.NODE_ENV !== "production",
+});
+```
+
+Non-critical by default: an expiring certificate is something to act on,
+not a reason to take the instance out of rotation today. Set
+`critical: true` when the handshake is with a dependency requests cannot
+proceed without.
+
+This probe uses `node:tls`, so it runs on Node.js, Deno and Bun but not on
+edge runtimes without a socket API. `connect` is typed structurally and can
+be replaced for tests.
+
+## About openstatus
+
+[openstatus](https://www.openstatus.dev/) is the open-source uptime monitoring
+and status page platform. This package is part of
+[`@openstatus/health`](https://github.com/openstatusHQ/health), the `/health`
+endpoints behind openstatus's own services, extracted so any JavaScript server
+can expose one. Point an
+[openstatus monitor](https://www.openstatus.dev/docs/reference/http-monitor)
+at the endpoint and assert on `status` in the body to be alerted on
+`degraded` before it becomes `unhealthy`.
+
+Source: [github.com/openstatusHQ/health](https://github.com/openstatusHQ/health).
+Issues and PRs welcome.
+
+## License
+
+[MIT](https://github.com/openstatusHQ/health/blob/main/LICENSE)

package/dist/_virtual/rolldown_runtime.cjs

@@ -0,0 +1,30 @@
+//#region rolldown:runtime
+var __create = Object.create;
+var __defProp = Object.defineProperty;
+var __getOwnPropDesc = Object.getOwnPropertyDescriptor;
+var __getOwnPropNames = Object.getOwnPropertyNames;
+var __getProtoOf = Object.getPrototypeOf;
+var __hasOwnProp = Object.prototype.hasOwnProperty;
+var __copyProps = (to, from, except, desc) => {
+	if (from && typeof from === "object" || typeof from === "function") for (var keys = __getOwnPropNames(from), i = 0, n = keys.length, key; i < n; i++) {
+		key = keys[i];
+		if (!__hasOwnProp.call(to, key) && key !== except) __defProp(to, key, {
+			get: ((k) => from[k]).bind(null, key),
+			enumerable: !(desc = __getOwnPropDesc(from, key)) || desc.enumerable
+		});
+	}
+	return to;
+};
+var __toESM = (mod, isNodeMode, target) => (target = mod != null ? __create(__getProtoOf(mod)) : {}, __copyProps(isNodeMode || !mod || !mod.__esModule ? __defProp(target, "default", {
+	value: mod,
+	enumerable: true
+}) : target, mod));
+
+//#endregion
+
+Object.defineProperty(exports, '__toESM', {
+  enumerable: true,
+  get: function () {
+    return __toESM;
+  }
+});

package/dist/mod.cjs

@@ -0,0 +1,88 @@
+const require_rolldown_runtime = require('./_virtual/rolldown_runtime.cjs');
+const node_tls = require_rolldown_runtime.__toESM(require("node:tls"));
+const __openstatus_health = require_rolldown_runtime.__toESM(require("@openstatus/health"));
+
+//#region src/mod.ts
+/** Probe name when `name` is unset. */
+const tlsDefaultName = "tls";
+/** Port when `port` is unset. */
+const tlsDefaultPort = 443;
+/** Minimum remaining validity when `minDaysValid` is unset. */
+const tlsDefaultMinDaysValid = 14;
+/** Thrown by the probe when the certificate expires within `minDaysValid` days. */
+var TlsCertificateExpiryError = class extends Error {
+	/** When the certificate expires. */
+	expiresAt;
+	/** Days left, rounded down; negative once expired. */
+	daysLeft;
+	/** Build the error for a certificate expiring at `expiresAt` against `minDaysValid`. */
+	constructor(expiresAt, daysLeft, minDaysValid) {
+		super(daysLeft < 0 ? `certificate expired ${expiresAt.toISOString()}` : `certificate expires in ${daysLeft} days, fewer than ${minDaysValid}`);
+		this.name = "TlsCertificateExpiryError";
+		this.expiresAt = expiresAt;
+		this.daysLeft = daysLeft;
+	}
+};
+/** A probe that completes a TLS handshake and checks certificate trust and expiry; non-critical by default. Throws `ProbeConfigError` for an empty `host`, an invalid `port` or a negative `minDaysValid`. */
+function tlsProbe(options) {
+	const host = options.host;
+	if (typeof host !== "string" || host.length === 0) throw new __openstatus_health.ProbeConfigError("tlsProbe", "host", typeof host !== "string" ? `must be a string, got ${String(host)}` : "must not be empty");
+	const port = options.port ?? tlsDefaultPort;
+	if (!Number.isInteger(port) || port < 1 || port > 65535) throw new __openstatus_health.ProbeConfigError("tlsProbe", "port", `must be an integer between 1 and 65535, got ${String(port)}`);
+	const minDaysValid = options.minDaysValid ?? tlsDefaultMinDaysValid;
+	if (!Number.isFinite(minDaysValid) || minDaysValid < 0) throw new __openstatus_health.ProbeConfigError("tlsProbe", "minDaysValid", `must be a non-negative number, got ${String(minDaysValid)}`);
+	const connect = options.connect ?? node_tls.connect;
+	return {
+		name: options.name ?? tlsDefaultName,
+		critical: options.critical ?? false,
+		timeoutMs: options.timeoutMs,
+		skip: options.skip,
+		run: (signal) => new Promise((resolve, reject) => {
+			const socket = connect({
+				host,
+				port,
+				servername: host
+			});
+			const settle = (finish) => {
+				signal.removeEventListener("abort", onAbort);
+				socket.destroy();
+				finish();
+			};
+			const onAbort = () => settle(() => reject(signal.reason));
+			socket.once("secureConnect", () => {
+				let result;
+				try {
+					result = inspect(socket, minDaysValid);
+				} catch (error) {
+					settle(() => reject(error));
+					return;
+				}
+				settle(() => resolve(result));
+			});
+			socket.once("error", (error) => settle(() => reject(error ?? /* @__PURE__ */ new Error("socket error"))));
+			signal.addEventListener("abort", onAbort, { once: true });
+		})
+	};
+}
+function inspect(socket, minDaysValid) {
+	if (!socket.authorized) {
+		const reason = socket.authorizationError;
+		throw reason instanceof Error ? reason : new Error(reason == null ? "certificate not trusted" : String(reason));
+	}
+	const expiresAt = new Date(socket.getPeerCertificate().valid_to);
+	if (Number.isNaN(expiresAt.getTime())) throw new Error("certificate has no readable expiry");
+	const msLeft = expiresAt.getTime() - Date.now();
+	const daysLeft = Math.floor(msLeft / 864e5);
+	if (msLeft < minDaysValid * 864e5) throw new TlsCertificateExpiryError(expiresAt, daysLeft, minDaysValid);
+	return {
+		expiresAt: expiresAt.toISOString(),
+		daysLeft
+	};
+}
+
+//#endregion
+exports.TlsCertificateExpiryError = TlsCertificateExpiryError;
+exports.tlsDefaultMinDaysValid = tlsDefaultMinDaysValid;
+exports.tlsDefaultName = tlsDefaultName;
+exports.tlsDefaultPort = tlsDefaultPort;
+exports.tlsProbe = tlsProbe;

package/dist/mod.d.cts

@@ -0,0 +1,60 @@
+import { Probe, ProbeOverrides } from "@openstatus/health";
+
+//#region src/mod.d.ts
+
+/** Probe name when `name` is unset. */
+declare const tlsDefaultName = "tls";
+/** Port when `port` is unset. */
+declare const tlsDefaultPort = 443;
+/** Minimum remaining validity when `minDaysValid` is unset. */
+declare const tlsDefaultMinDaysValid = 14;
+/** The subset of a peer certificate the probe reads. */
+interface TlsPeerCertificate {
+  /** Expiry, as the date string `getPeerCertificate()` returns. */
+  readonly valid_to: string;
+}
+/** The subset of a `tls.TLSSocket` the probe uses. */
+interface TlsLikeSocket {
+  /** Listen once for `secureConnect` (handshake done) or `error` (failed). */
+  once(event: "secureConnect" | "error", listener: (error?: Error) => void): TlsLikeSocket;
+  /** Whether the peer certificate chained to a trusted CA. */
+  readonly authorized: boolean;
+  /** Why it did not, when `authorized` is false. */
+  readonly authorizationError?: Error | string | null;
+  /** The peer certificate after the handshake. */
+  getPeerCertificate(): TlsPeerCertificate;
+  /** Close the socket. */
+  destroy(): void;
+}
+/** What the probe connects with; `tls.connect` by default. */
+type TlsConnect = (options: {
+  readonly host: string;
+  readonly port: number;
+  readonly servername: string;
+}) => TlsLikeSocket;
+/** Options for `tlsProbe()`. */
+interface TlsProbeOptions extends ProbeOverrides {
+  /** Hostname; also sent as the SNI server name. */
+  readonly host: string;
+  /** Port. Default `tlsDefaultPort`. */
+  readonly port?: number;
+  /** Fail when the certificate expires in fewer days than this. Default `tlsDefaultMinDaysValid`. */
+  readonly minDaysValid?: number;
+  /** Replacement `connect`, for tests. */
+  readonly connect?: TlsConnect;
+}
+/** Thrown by the probe when the certificate expires within `minDaysValid` days. */
+declare class TlsCertificateExpiryError extends Error {
+  /** When the certificate expires. */
+  readonly expiresAt: Date;
+  /** Days left, rounded down; negative once expired. */
+  readonly daysLeft: number;
+  /** Build the error for a certificate expiring at `expiresAt` against `minDaysValid`. */
+  constructor(expiresAt: Date, daysLeft: number, minDaysValid: number);
+}
+/** A probe that completes a TLS handshake and checks certificate trust and expiry; non-critical by default. Throws `ProbeConfigError` for an empty `host`, an invalid `port` or a negative `minDaysValid`. */
+declare function tlsProbe(options: TlsProbeOptions): Probe;
+//# sourceMappingURL=mod.d.ts.map
+//#endregion
+export { TlsCertificateExpiryError, TlsConnect, TlsLikeSocket, TlsPeerCertificate, TlsProbeOptions, tlsDefaultMinDaysValid, tlsDefaultName, tlsDefaultPort, tlsProbe };
+//# sourceMappingURL=mod.d.cts.map

package/dist/mod.d.cts.map

@@ -0,0 +1 @@
+{"version":3,"file":"mod.d.cts","names":[],"sources":["../src/mod.ts"],"sourcesContent":[],"mappings":";;;;;AAuEqB,cA/CR,cAAA,GA+CQ,KAAA;;AARkC,cArC1C,cAAA,GAqC0C,GAAA;AAYvD;AAAuC,cA/C1B,sBAAA,GA+C0B,EAAA;;AAOd,UAnDR,kBAAA,CAmDQ;EAAI;EAPuB,SAAA,QAAA,EAAA,MAAA;AAoBpD;;AAAkC,UA1DjB,aAAA,CA0DiB;EAAe;EAAQ,IAAA,CAAA,KAAA,EAAA,eAAA,GAAA,OAAA,EAAA,QAAA,EAAA,CAAA,KAAA,CAAA,EAtDlC,KAsDkC,EAAA,GAAA,IAAA,CAAA,EArDpD,aAqDoD;;;;gCAjDzB;;wBAER;;;;;KAMZ,UAAA;;;;MAMP;;UAGY,eAAA,SAAwB;;;;;;;;qBAQpB;;;cAIR,yBAAA,SAAkC,KAAA;;sBAEzB;;;;yBAKG;;;iBAaT,QAAA,UAAkB,kBAAkB"}

package/dist/mod.d.ts

@@ -0,0 +1,60 @@
+import { Probe, ProbeOverrides } from "@openstatus/health";
+
+//#region src/mod.d.ts
+
+/** Probe name when `name` is unset. */
+declare const tlsDefaultName = "tls";
+/** Port when `port` is unset. */
+declare const tlsDefaultPort = 443;
+/** Minimum remaining validity when `minDaysValid` is unset. */
+declare const tlsDefaultMinDaysValid = 14;
+/** The subset of a peer certificate the probe reads. */
+interface TlsPeerCertificate {
+  /** Expiry, as the date string `getPeerCertificate()` returns. */
+  readonly valid_to: string;
+}
+/** The subset of a `tls.TLSSocket` the probe uses. */
+interface TlsLikeSocket {
+  /** Listen once for `secureConnect` (handshake done) or `error` (failed). */
+  once(event: "secureConnect" | "error", listener: (error?: Error) => void): TlsLikeSocket;
+  /** Whether the peer certificate chained to a trusted CA. */
+  readonly authorized: boolean;
+  /** Why it did not, when `authorized` is false. */
+  readonly authorizationError?: Error | string | null;
+  /** The peer certificate after the handshake. */
+  getPeerCertificate(): TlsPeerCertificate;
+  /** Close the socket. */
+  destroy(): void;
+}
+/** What the probe connects with; `tls.connect` by default. */
+type TlsConnect = (options: {
+  readonly host: string;
+  readonly port: number;
+  readonly servername: string;
+}) => TlsLikeSocket;
+/** Options for `tlsProbe()`. */
+interface TlsProbeOptions extends ProbeOverrides {
+  /** Hostname; also sent as the SNI server name. */
+  readonly host: string;
+  /** Port. Default `tlsDefaultPort`. */
+  readonly port?: number;
+  /** Fail when the certificate expires in fewer days than this. Default `tlsDefaultMinDaysValid`. */
+  readonly minDaysValid?: number;
+  /** Replacement `connect`, for tests. */
+  readonly connect?: TlsConnect;
+}
+/** Thrown by the probe when the certificate expires within `minDaysValid` days. */
+declare class TlsCertificateExpiryError extends Error {
+  /** When the certificate expires. */
+  readonly expiresAt: Date;
+  /** Days left, rounded down; negative once expired. */
+  readonly daysLeft: number;
+  /** Build the error for a certificate expiring at `expiresAt` against `minDaysValid`. */
+  constructor(expiresAt: Date, daysLeft: number, minDaysValid: number);
+}
+/** A probe that completes a TLS handshake and checks certificate trust and expiry; non-critical by default. Throws `ProbeConfigError` for an empty `host`, an invalid `port` or a negative `minDaysValid`. */
+declare function tlsProbe(options: TlsProbeOptions): Probe;
+//# sourceMappingURL=mod.d.ts.map
+//#endregion
+export { TlsCertificateExpiryError, TlsConnect, TlsLikeSocket, TlsPeerCertificate, TlsProbeOptions, tlsDefaultMinDaysValid, tlsDefaultName, tlsDefaultPort, tlsProbe };
+//# sourceMappingURL=mod.d.ts.map

package/dist/mod.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"mod.d.ts","names":[],"sources":["../src/mod.ts"],"sourcesContent":[],"mappings":";;;;;AAuEqB,cA/CR,cAAA,GA+CQ,KAAA;;AARkC,cArC1C,cAAA,GAqC0C,GAAA;AAYvD;AAAuC,cA/C1B,sBAAA,GA+C0B,EAAA;;AAOd,UAnDR,kBAAA,CAmDQ;EAAI;EAPuB,SAAA,QAAA,EAAA,MAAA;AAoBpD;;AAAkC,UA1DjB,aAAA,CA0DiB;EAAe;EAAQ,IAAA,CAAA,KAAA,EAAA,eAAA,GAAA,OAAA,EAAA,QAAA,EAAA,CAAA,KAAA,CAAA,EAtDlC,KAsDkC,EAAA,GAAA,IAAA,CAAA,EArDpD,aAqDoD;;;;gCAjDzB;;wBAER;;;;;KAMZ,UAAA;;;;MAMP;;UAGY,eAAA,SAAwB;;;;;;;;qBAQpB;;;cAIR,yBAAA,SAAkC,KAAA;;sBAEzB;;;;yBAKG;;;iBAaT,QAAA,UAAkB,kBAAkB"}

package/dist/mod.js

@@ -0,0 +1,84 @@
+import { connect } from "node:tls";
+import { ProbeConfigError } from "@openstatus/health";
+
+//#region src/mod.ts
+/** Probe name when `name` is unset. */
+const tlsDefaultName = "tls";
+/** Port when `port` is unset. */
+const tlsDefaultPort = 443;
+/** Minimum remaining validity when `minDaysValid` is unset. */
+const tlsDefaultMinDaysValid = 14;
+/** Thrown by the probe when the certificate expires within `minDaysValid` days. */
+var TlsCertificateExpiryError = class extends Error {
+	/** When the certificate expires. */
+	expiresAt;
+	/** Days left, rounded down; negative once expired. */
+	daysLeft;
+	/** Build the error for a certificate expiring at `expiresAt` against `minDaysValid`. */
+	constructor(expiresAt, daysLeft, minDaysValid) {
+		super(daysLeft < 0 ? `certificate expired ${expiresAt.toISOString()}` : `certificate expires in ${daysLeft} days, fewer than ${minDaysValid}`);
+		this.name = "TlsCertificateExpiryError";
+		this.expiresAt = expiresAt;
+		this.daysLeft = daysLeft;
+	}
+};
+/** A probe that completes a TLS handshake and checks certificate trust and expiry; non-critical by default. Throws `ProbeConfigError` for an empty `host`, an invalid `port` or a negative `minDaysValid`. */
+function tlsProbe(options) {
+	const host = options.host;
+	if (typeof host !== "string" || host.length === 0) throw new ProbeConfigError("tlsProbe", "host", typeof host !== "string" ? `must be a string, got ${String(host)}` : "must not be empty");
+	const port = options.port ?? tlsDefaultPort;
+	if (!Number.isInteger(port) || port < 1 || port > 65535) throw new ProbeConfigError("tlsProbe", "port", `must be an integer between 1 and 65535, got ${String(port)}`);
+	const minDaysValid = options.minDaysValid ?? tlsDefaultMinDaysValid;
+	if (!Number.isFinite(minDaysValid) || minDaysValid < 0) throw new ProbeConfigError("tlsProbe", "minDaysValid", `must be a non-negative number, got ${String(minDaysValid)}`);
+	const connect$1 = options.connect ?? connect;
+	return {
+		name: options.name ?? tlsDefaultName,
+		critical: options.critical ?? false,
+		timeoutMs: options.timeoutMs,
+		skip: options.skip,
+		run: (signal) => new Promise((resolve, reject) => {
+			const socket = connect$1({
+				host,
+				port,
+				servername: host
+			});
+			const settle = (finish) => {
+				signal.removeEventListener("abort", onAbort);
+				socket.destroy();
+				finish();
+			};
+			const onAbort = () => settle(() => reject(signal.reason));
+			socket.once("secureConnect", () => {
+				let result;
+				try {
+					result = inspect(socket, minDaysValid);
+				} catch (error) {
+					settle(() => reject(error));
+					return;
+				}
+				settle(() => resolve(result));
+			});
+			socket.once("error", (error) => settle(() => reject(error ?? /* @__PURE__ */ new Error("socket error"))));
+			signal.addEventListener("abort", onAbort, { once: true });
+		})
+	};
+}
+function inspect(socket, minDaysValid) {
+	if (!socket.authorized) {
+		const reason = socket.authorizationError;
+		throw reason instanceof Error ? reason : new Error(reason == null ? "certificate not trusted" : String(reason));
+	}
+	const expiresAt = new Date(socket.getPeerCertificate().valid_to);
+	if (Number.isNaN(expiresAt.getTime())) throw new Error("certificate has no readable expiry");
+	const msLeft = expiresAt.getTime() - Date.now();
+	const daysLeft = Math.floor(msLeft / 864e5);
+	if (msLeft < minDaysValid * 864e5) throw new TlsCertificateExpiryError(expiresAt, daysLeft, minDaysValid);
+	return {
+		expiresAt: expiresAt.toISOString(),
+		daysLeft
+	};
+}
+
+//#endregion
+export { TlsCertificateExpiryError, tlsDefaultMinDaysValid, tlsDefaultName, tlsDefaultPort, tlsProbe };
+//# sourceMappingURL=mod.js.map

package/dist/mod.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"mod.js","names":["expiresAt: Date","daysLeft: number","minDaysValid: number","options: TlsProbeOptions","connect","tlsConnect","finish: () => void","result: { expiresAt: string; daysLeft: number }","socket: TlsLikeSocket"],"sources":["../src/mod.ts"],"sourcesContent":["/**\n * TLS probe for `@openstatus/health`: completes a handshake with\n * `host:port`, requires a trusted certificate and fails when it expires\n * within `minDaysValid` days.\n *\n * ```ts\n * import { tlsProbe } from \"@openstatus/health-tls\";\n *\n * const probe = tlsProbe({ host: \"api.example.com\" });\n * ```\n *\n * Node.js, Deno and Bun only: it uses `node:tls`.\n *\n * @module\n */\n\nimport { connect as tlsConnect } from \"node:tls\";\nimport {\n  type Probe,\n  ProbeConfigError,\n  type ProbeOverrides,\n} from \"@openstatus/health\";\n\n/** Probe name when `name` is unset. */\nexport const tlsDefaultName = \"tls\";\n/** Port when `port` is unset. */\nexport const tlsDefaultPort = 443;\n/** Minimum remaining validity when `minDaysValid` is unset. */\nexport const tlsDefaultMinDaysValid = 14;\n\n/** The subset of a peer certificate the probe reads. */\nexport interface TlsPeerCertificate {\n  /** Expiry, as the date string `getPeerCertificate()` returns. */\n  readonly valid_to: string;\n}\n\n/** The subset of a `tls.TLSSocket` the probe uses. */\nexport interface TlsLikeSocket {\n  /** Listen once for `secureConnect` (handshake done) or `error` (failed). */\n  once(\n    event: \"secureConnect\" | \"error\",\n    listener: (error?: Error) => void,\n  ): TlsLikeSocket;\n  /** Whether the peer certificate chained to a trusted CA. */\n  readonly authorized: boolean;\n  /** Why it did not, when `authorized` is false. */\n  readonly authorizationError?: Error | string | null;\n  /** The peer certificate after the handshake. */\n  getPeerCertificate(): TlsPeerCertificate;\n  /** Close the socket. */\n  destroy(): void;\n}\n\n/** What the probe connects with; `tls.connect` by default. */\nexport type TlsConnect = (\n  options: {\n    readonly host: string;\n    readonly port: number;\n    readonly servername: string;\n  },\n) => TlsLikeSocket;\n\n/** Options for `tlsProbe()`. */\nexport interface TlsProbeOptions extends ProbeOverrides {\n  /** Hostname; also sent as the SNI server name. */\n  readonly host: string;\n  /** Port. Default `tlsDefaultPort`. */\n  readonly port?: number;\n  /** Fail when the certificate expires in fewer days than this. Default `tlsDefaultMinDaysValid`. */\n  readonly minDaysValid?: number;\n  /** Replacement `connect`, for tests. */\n  readonly connect?: TlsConnect;\n}\n\n/** Thrown by the probe when the certificate expires within `minDaysValid` days. */\nexport class TlsCertificateExpiryError extends Error {\n  /** When the certificate expires. */\n  readonly expiresAt: Date;\n  /** Days left, rounded down; negative once expired. */\n  readonly daysLeft: number;\n\n  /** Build the error for a certificate expiring at `expiresAt` against `minDaysValid`. */\n  constructor(expiresAt: Date, daysLeft: number, minDaysValid: number) {\n    super(\n      daysLeft < 0\n        ? `certificate expired ${expiresAt.toISOString()}`\n        : `certificate expires in ${daysLeft} days, fewer than ${minDaysValid}`,\n    );\n    this.name = \"TlsCertificateExpiryError\";\n    this.expiresAt = expiresAt;\n    this.daysLeft = daysLeft;\n  }\n}\n\n/** A probe that completes a TLS handshake and checks certificate trust and expiry; non-critical by default. Throws `ProbeConfigError` for an empty `host`, an invalid `port` or a negative `minDaysValid`. */\nexport function tlsProbe(options: TlsProbeOptions): Probe {\n  const host = options.host;\n  if (typeof host !== \"string\" || host.length === 0) {\n    throw new ProbeConfigError(\n      \"tlsProbe\",\n      \"host\",\n      typeof host !== \"string\"\n        ? `must be a string, got ${String(host)}`\n        : \"must not be empty\",\n    );\n  }\n  const port = options.port ?? tlsDefaultPort;\n  if (!Number.isInteger(port) || port < 1 || port > 65535) {\n    throw new ProbeConfigError(\n      \"tlsProbe\",\n      \"port\",\n      `must be an integer between 1 and 65535, got ${String(port)}`,\n    );\n  }\n  const minDaysValid = options.minDaysValid ?? tlsDefaultMinDaysValid;\n  if (!Number.isFinite(minDaysValid) || minDaysValid < 0) {\n    throw new ProbeConfigError(\n      \"tlsProbe\",\n      \"minDaysValid\",\n      `must be a non-negative number, got ${String(minDaysValid)}`,\n    );\n  }\n  const connect = options.connect ?? tlsConnect;\n  return {\n    name: options.name ?? tlsDefaultName,\n    critical: options.critical ?? false,\n    timeoutMs: options.timeoutMs,\n    skip: options.skip,\n    run: (signal) =>\n      new Promise<{ expiresAt: string; daysLeft: number }>(\n        (resolve, reject) => {\n          const socket = connect({ host, port, servername: host });\n          const settle = (finish: () => void) => {\n            signal.removeEventListener(\"abort\", onAbort);\n            socket.destroy();\n            finish();\n          };\n          const onAbort = () => settle(() => reject(signal.reason));\n          socket.once(\"secureConnect\", () => {\n            let result: { expiresAt: string; daysLeft: number };\n            try {\n              result = inspect(socket, minDaysValid);\n            } catch (error) {\n              settle(() => reject(error));\n              return;\n            }\n            settle(() => resolve(result));\n          });\n          socket.once(\n            \"error\",\n            (error) => settle(() => reject(error ?? new Error(\"socket error\"))),\n          );\n          signal.addEventListener(\"abort\", onAbort, { once: true });\n        },\n      ),\n  };\n}\n\nfunction inspect(\n  socket: TlsLikeSocket,\n  minDaysValid: number,\n): { expiresAt: string; daysLeft: number } {\n  if (!socket.authorized) {\n    const reason = socket.authorizationError;\n    throw reason instanceof Error\n      ? reason\n      : new Error(reason == null ? \"certificate not trusted\" : String(reason));\n  }\n  const expiresAt = new Date(socket.getPeerCertificate().valid_to);\n  if (Number.isNaN(expiresAt.getTime())) {\n    throw new Error(\"certificate has no readable expiry\");\n  }\n  const msLeft = expiresAt.getTime() - Date.now();\n  const daysLeft = Math.floor(msLeft / 86_400_000);\n  if (msLeft < minDaysValid * 86_400_000) {\n    throw new TlsCertificateExpiryError(expiresAt, daysLeft, minDaysValid);\n  }\n  return { expiresAt: expiresAt.toISOString(), daysLeft };\n}\n"],"mappings":";;;;;AAwBA,MAAa,iBAAiB;;AAE9B,MAAa,iBAAiB;;AAE9B,MAAa,yBAAyB;;AA+CtC,IAAa,4BAAb,cAA+C,MAAM;;CAEnD,AAAS;;CAET,AAAS;;CAGT,YAAYA,WAAiBC,UAAkBC,cAAsB;AACnE,QACE,WAAW,KACN,sBAAsB,UAAU,aAAa,CAAC,KAC9C,yBAAyB,SAAS,oBAAoB,aAAa,EACzE;AACD,OAAK,OAAO;AACZ,OAAK,YAAY;AACjB,OAAK,WAAW;CACjB;AACF;;AAGD,SAAgB,SAASC,SAAiC;CACxD,MAAM,OAAO,QAAQ;AACrB,YAAW,SAAS,YAAY,KAAK,WAAW,EAC9C,OAAM,IAAI,iBACR,YACA,eACO,SAAS,YACX,wBAAwB,OAAO,KAAK,CAAC,IACtC;CAGR,MAAM,OAAO,QAAQ,QAAQ;AAC7B,MAAK,OAAO,UAAU,KAAK,IAAI,OAAO,KAAK,OAAO,MAChD,OAAM,IAAI,iBACR,YACA,SACC,8CAA8C,OAAO,KAAK,CAAC;CAGhE,MAAM,eAAe,QAAQ,gBAAgB;AAC7C,MAAK,OAAO,SAAS,aAAa,IAAI,eAAe,EACnD,OAAM,IAAI,iBACR,YACA,iBACC,qCAAqC,OAAO,aAAa,CAAC;CAG/D,MAAMC,YAAU,QAAQ,WAAWC;AACnC,QAAO;EACL,MAAM,QAAQ,QAAQ;EACtB,UAAU,QAAQ,YAAY;EAC9B,WAAW,QAAQ;EACnB,MAAM,QAAQ;EACd,KAAK,CAAC,WACJ,IAAI,QACF,CAAC,SAAS,WAAW;GACnB,MAAM,SAAS,UAAQ;IAAE;IAAM;IAAM,YAAY;GAAM,EAAC;GACxD,MAAM,SAAS,CAACC,WAAuB;AACrC,WAAO,oBAAoB,SAAS,QAAQ;AAC5C,WAAO,SAAS;AAChB,YAAQ;GACT;GACD,MAAM,UAAU,MAAM,OAAO,MAAM,OAAO,OAAO,OAAO,CAAC;AACzD,UAAO,KAAK,iBAAiB,MAAM;IACjC,IAAIC;AACJ,QAAI;AACF,cAAS,QAAQ,QAAQ,aAAa;IACvC,SAAQ,OAAO;AACd,YAAO,MAAM,OAAO,MAAM,CAAC;AAC3B;IACD;AACD,WAAO,MAAM,QAAQ,OAAO,CAAC;GAC9B,EAAC;AACF,UAAO,KACL,SACA,CAAC,UAAU,OAAO,MAAM,OAAO,yBAAS,IAAI,MAAM,gBAAgB,CAAC,CACpE;AACD,UAAO,iBAAiB,SAAS,SAAS,EAAE,MAAM,KAAM,EAAC;EAC1D;CAEN;AACF;AAED,SAAS,QACPC,QACAN,cACyC;AACzC,MAAK,OAAO,YAAY;EACtB,MAAM,SAAS,OAAO;AACtB,QAAM,kBAAkB,QACpB,SACA,IAAI,MAAM,UAAU,OAAO,4BAA4B,OAAO,OAAO;CAC1E;CACD,MAAM,YAAY,IAAI,KAAK,OAAO,oBAAoB,CAAC;AACvD,KAAI,OAAO,MAAM,UAAU,SAAS,CAAC,CACnC,OAAM,IAAI,MAAM;CAElB,MAAM,SAAS,UAAU,SAAS,GAAG,KAAK,KAAK;CAC/C,MAAM,WAAW,KAAK,MAAM,SAAS,MAAW;AAChD,KAAI,SAAS,eAAe,MAC1B,OAAM,IAAI,0BAA0B,WAAW,UAAU;AAE3D,QAAO;EAAE,WAAW,UAAU,aAAa;EAAE;CAAU;AACxD"}

package/package.json

@@ -0,0 +1,63 @@
+{
+  "name": "@openstatus/health-tls",
+  "version": "0.1.4-dev.0",
+  "description": "TLS certificate probe for @openstatus/health",
+  "keywords": [
+    "openstatus",
+    "health",
+    "healthcheck",
+    "tls",
+    "ssl",
+    "certificate",
+    "expiry"
+  ],
+  "license": "MIT",
+  "author": {
+    "name": "openstatus",
+    "url": "https://www.openstatus.dev/"
+  },
+  "homepage": "https://github.com/openstatusHQ/health",
+  "repository": {
+    "type": "git",
+    "url": "git+https://github.com/openstatusHQ/health.git",
+    "directory": "packages/tls/"
+  },
+  "bugs": {
+    "url": "https://github.com/openstatusHQ/health/issues"
+  },
+  "type": "module",
+  "module": "./dist/mod.js",
+  "main": "./dist/mod.cjs",
+  "types": "./dist/mod.d.ts",
+  "exports": {
+    ".": {
+      "types": {
+        "import": "./dist/mod.d.ts",
+        "require": "./dist/mod.d.cts"
+      },
+      "import": "./dist/mod.js",
+      "require": "./dist/mod.cjs"
+    },
+    "./package.json": "./package.json"
+  },
+  "sideEffects": false,
+  "files": [
+    "dist/"
+  ],
+  "engines": {
+    "node": ">=22"
+  },
+  "peerDependencies": {
+    "@openstatus/health": "^0.1.4-dev.0"
+  },
+  "devDependencies": {
+    "@types/node": ">=22",
+    "tsdown": "^0.12.7",
+    "typescript": "^5.8.3"
+  },
+  "scripts": {
+    "build": "tsdown",
+    "prepack": "tsdown",
+    "test": "node --experimental-transform-types --test"
+  }
+}