Add read-only live TLS probe

trustlab/examples/probe.js

@@ -0,0 +1,36 @@
+#!/usr/bin/env node
+import { probeTls } from "../src/index.js";
+
+const args = process.argv.slice(2);
+const json = args.includes("--json");
+const target = args.find((argument) => !argument.startsWith("--"));
+
+if (!target) {
+  console.error("Usage: npm run probe -- hostname[:port] [--json]");
+  process.exitCode = 2;
+} else {
+  try {
+    const report = await probeTls(target);
+    if (json) console.log(JSON.stringify(report, null, 2));
+    else printReport(report);
+  } catch (error) {
+    console.error(`Probe failed: ${error.message}`);
+    process.exitCode = 1;
+  }
+}
+
+function printReport({ facts, findings, caveats }) {
+  console.log(`${facts.hostname}:${facts.port} — ${facts.validation.toUpperCase()}`);
+  console.log(`TLS ${facts.tls.version ?? "unknown"}; cipher ${facts.tls.cipher ?? "unknown"}`);
+  console.log(`Conventional trust: ${facts.tls.conventionalTrust ? "yes" : `no (${facts.tls.conventionalTrustError})`}`);
+  console.log("\nObserved certificate chain:");
+  facts.presentedChain.forEach((certificate, index) => {
+    console.log(`${index + 1}. ${certificate.subject}`);
+    console.log(`   SHA-256 ${certificate.sha256}`);
+    console.log(`   ${certificate.validFrom} — ${certificate.validUntil}${certificate.isCa ? " · CA" : ""}${certificate.selfSigned ? " · self-signed" : ""}`);
+  });
+  console.log("\nFindings:");
+  if (findings.length === 0) console.log("- No failure found by the current checks.");
+  else findings.forEach((item) => console.log(`- [${item.check}] ${item.summary}`));
+  console.log(`\nCaveat: ${caveats[0]}`);
+}