checkly 8.14.1 → 8.15.0

package/dist/constructs/internal/assertion.js.map

@@ -1 +1 @@
-{"version":3,"file":"assertion.js","sourceRoot":"","sources":["../../../src/constructs/internal/assertion.ts"],"names":[],"mappings":"AAwBA,MAAM,OAAO,uBAAuB;IAClC,MAAM,CAAQ;IACd,QAAQ,CAAW;IAEnB,YAAa,MAAc,EAAE,QAAmB;QAC9C,IAAI,CAAC,MAAM,GAAG,MAAM,CAAA;QACpB,IAAI,CAAC,QAAQ,GAAG,QAAQ,CAAA;IAC1B,CAAC;IAED,MAAM,CAAE,MAAc;QACpB,OAAO,IAAI,CAAC,YAAY,CAAC,QAAQ,EAAE,MAAM,CAAC,CAAA;IAC5C,CAAC;IAED,SAAS,CAAE,MAAc;QACvB,OAAO,IAAI,CAAC,YAAY,CAAC,YAAY,EAAE,MAAM,CAAC,CAAA;IAChD,CAAC;IAED,QAAQ,CAAE,MAAc;QACtB,OAAO,IAAI,CAAC,YAAY,CAAC,WAAW,EAAE,MAAM,CAAC,CAAA;IAC/C,CAAC;IAED,WAAW,CAAE,MAAc;QACzB,OAAO,IAAI,CAAC,YAAY,CAAC,cAAc,EAAE,MAAM,CAAC,CAAA;IAClD,CAAC;IAED,eAAe;IACP,YAAY,CAAE,UAAsB,EAAE,MAAc;QAC1D,OAAO;YACL,MAAM,EAAE,IAAI,CAAC,MAAM;YACnB,UAAU;YACV,QAAQ,EAAE,IAAI,CAAC,QAAQ,IAAI,EAAE;YAC7B,MAAM,EAAE,MAAM,CAAC,QAAQ,EAAE;YACzB,KAAK,EAAE,IAAI;SACZ,CAAA;IACH,CAAC;CACF;AAED,MAAM,OAAO,uBAAuB;IAClC,MAAM,CAAQ;IACd,QAAQ,CAAS;IACjB,KAAK,CAAS;IAEd,YAAa,MAAc,EAAE,QAAiB,EAAE,KAAc;QAC5D,IAAI,CAAC,MAAM,GAAG,MAAM,CAAA;QACpB,IAAI,CAAC,QAAQ,GAAG,QAAQ,CAAA;QACxB,IAAI,CAAC,KAAK,GAAG,KAAK,CAAA;IACpB,CAAC;IAED,MAAM,CAAE,MAAiC;QACvC,OAAO,IAAI,CAAC,YAAY,CAAC,QAAQ,EAAE,MAAM,CAAC,CAAA;IAC5C,CAAC;IAED,SAAS,CAAE,MAAiC;QAC1C,OAAO,IAAI,CAAC,YAAY,CAAC,YAAY,EAAE,MAAM,CAAC,CAAA;IAChD,CAAC;IAED,MAAM,CAAE,MAAc;QACpB,OAAO,IAAI,CAAC,YAAY,CAAC,SAAS,EAAE,MAAM,CAAC,CAAA;IAC7C,CAAC;IAED,SAAS,CAAE,MAAc;QACvB,OAAO,IAAI,CAAC,YAAY,CAAC,aAAa,EAAE,MAAM,CAAC,CAAA;IACjD,CAAC;IAED,QAAQ,CAAE,MAAiC;QACzC,OAAO,IAAI,CAAC,YAAY,CAAC,WAAW,EAAE,MAAM,CAAC,CAAA;IAC/C,CAAC;IAED,WAAW,CAAE,MAAiC;QAC5C,OAAO,IAAI,CAAC,YAAY,CAAC,eAAe,EAAE,MAAM,CAAC,CAAA;IACnD,CAAC;IAED,OAAO;QACL,OAAO,IAAI,CAAC,YAAY,CAAC,UAAU,CAAC,CAAA;IACtC,CAAC;IAED,QAAQ;QACN,OAAO,IAAI,CAAC,YAAY,CAAC,WAAW,CAAC,CAAA;IACvC,CAAC;IAED,QAAQ,CAAE,MAAiC;QACzC,OAAO,IAAI,CAAC,YAAY,CAAC,WAAW,EAAE,MAAM,CAAC,CAAA;IAC/C,CAAC;IAED,WAAW,CAAE,MAAiC;QAC5C,OAAO,IAAI,CAAC,YAAY,CAAC,cAAc,EAAE,MAAM,CAAC,CAAA;IAClD,CAAC;IAED,QAAQ,CAAE,MAAc;QACtB,OAAO,IAAI,CAAC,YAAY,CAAC,UAAU,EAAE,MAAM,CAAC,CAAA;IAC9C,CAAC;IAED,WAAW,CAAE,MAAc;QACzB,OAAO,IAAI,CAAC,YAAY,CAAC,cAAc,EAAE,MAAM,CAAC,CAAA;IAClD,CAAC;IAED,MAAM;QACJ,OAAO,IAAI,CAAC,YAAY,CAAC,SAAS,CAAC,CAAA;IACrC,CAAC;IAED,SAAS;QACP,OAAO,IAAI,CAAC,YAAY,CAAC,UAAU,CAAC,CAAA;IACtC,CAAC;IAED,eAAe;IACP,YAAY,CAAE,UAAsB,EAAE,MAAkC;QAC9E,OAAO;YACL,MAAM,EAAE,IAAI,CAAC,MAAM;YACnB,UAAU;YACV,QAAQ,EAAE,IAAI,CAAC,QAAQ,IAAI,EAAE;YAC7B,MAAM,EAAE,MAAM,EAAE,QAAQ,EAAE,IAAI,EAAE;YAChC,KAAK,EAAE,IAAI,CAAC,KAAK,IAAI,IAAI;SAC1B,CAAA;IACH,CAAC;CACF"}
+{"version":3,"file":"assertion.js","sourceRoot":"","sources":["../../../src/constructs/internal/assertion.ts"],"names":[],"mappings":"AAQA,oFAAoF;AACpF,mFAAmF;AACnF,mFAAmF;AACnF,MAAM,UAAU,WAAW,CAKzB,MAAc,EACd,UAAsB,EACtB,MAAe,EACf,QAAiB,EACjB,KAAqB;IAErB,OAAO;QACL,MAAM;QACN,UAAU;QACV,QAAQ,EAAE,QAAQ,IAAI,EAAE;QACxB,MAAM,EAAE,MAAM,EAAE,QAAQ,EAAE,IAAI,EAAE;QAChC,KAAK,EAAE,KAAK,IAAI,IAAI;KACrB,CAAA;AACH,CAAC;AAED,MAAM,OAAO,uBAAuB;IAClC,MAAM,CAAQ;IACd,QAAQ,CAAW;IAEnB,YAAa,MAAc,EAAE,QAAmB;QAC9C,IAAI,CAAC,MAAM,GAAG,MAAM,CAAA;QACpB,IAAI,CAAC,QAAQ,GAAG,QAAQ,CAAA;IAC1B,CAAC;IAED,MAAM,CAAE,MAAc;QACpB,OAAO,WAAW,CAAC,IAAI,CAAC,MAAM,EAAE,QAAQ,EAAE,MAAM,EAAE,IAAI,CAAC,QAAQ,CAAC,CAAA;IAClE,CAAC;IAED,SAAS,CAAE,MAAc;QACvB,OAAO,WAAW,CAAC,IAAI,CAAC,MAAM,EAAE,YAAY,EAAE,MAAM,EAAE,IAAI,CAAC,QAAQ,CAAC,CAAA;IACtE,CAAC;IAED,QAAQ,CAAE,MAAc;QACtB,OAAO,WAAW,CAAC,IAAI,CAAC,MAAM,EAAE,WAAW,EAAE,MAAM,EAAE,IAAI,CAAC,QAAQ,CAAC,CAAA;IACrE,CAAC;IAED,WAAW,CAAE,MAAc;QACzB,OAAO,WAAW,CAAC,IAAI,CAAC,MAAM,EAAE,cAAc,EAAE,MAAM,EAAE,IAAI,CAAC,QAAQ,CAAC,CAAA;IACxE,CAAC;CACF;AAED;;;;;;;;GAQG;AACH,MAAM,OAAO,uBAAuB;IAIlC,MAAM,CAAQ;IACd,QAAQ,CAAS;IACjB,KAAK,CAAS;IAEd,YAAa,MAAc,EAAE,QAAiB,EAAE,KAAc;QAC5D,IAAI,CAAC,MAAM,GAAG,MAAM,CAAA;QACpB,IAAI,CAAC,QAAQ,GAAG,QAAQ,CAAA;QACxB,IAAI,CAAC,KAAK,GAAG,KAAK,CAAA;IACpB,CAAC;IAED,MAAM,CAAE,MAAkB;QACxB,OAAO,WAAW,CAAC,IAAI,CAAC,MAAM,EAAE,QAAQ,EAAE,MAAM,EAAE,IAAI,CAAC,QAAQ,EAAE,IAAI,CAAC,KAAK,CAAC,CAAA;IAC9E,CAAC;IAED,SAAS,CAAE,MAAkB;QAC3B,OAAO,WAAW,CAAC,IAAI,CAAC,MAAM,EAAE,YAAY,EAAE,MAAM,EAAE,IAAI,CAAC,QAAQ,EAAE,IAAI,CAAC,KAAK,CAAC,CAAA;IAClF,CAAC;IAED,MAAM,CAAE,MAAc;QACpB,OAAO,WAAW,CAAC,IAAI,CAAC,MAAM,EAAE,SAAS,EAAE,MAAM,EAAE,IAAI,CAAC,QAAQ,EAAE,IAAI,CAAC,KAAK,CAAC,CAAA;IAC/E,CAAC;IAED,SAAS,CAAE,MAAc;QACvB,OAAO,WAAW,CAAC,IAAI,CAAC,MAAM,EAAE,aAAa,EAAE,MAAM,EAAE,IAAI,CAAC,QAAQ,EAAE,IAAI,CAAC,KAAK,CAAC,CAAA;IACnF,CAAC;IAED,QAAQ,CAAE,MAAkB;QAC1B,OAAO,WAAW,CAAC,IAAI,CAAC,MAAM,EAAE,WAAW,EAAE,MAAM,EAAE,IAAI,CAAC,QAAQ,EAAE,IAAI,CAAC,KAAK,CAAC,CAAA;IACjF,CAAC;IAED,WAAW,CAAE,MAAkB;QAC7B,OAAO,WAAW,CAAC,IAAI,CAAC,MAAM,EAAE,eAAe,EAAE,MAAM,EAAE,IAAI,CAAC,QAAQ,EAAE,IAAI,CAAC,KAAK,CAAC,CAAA;IACrF,CAAC;IAED,OAAO;QACL,OAAO,WAAW,CAAC,IAAI,CAAC,MAAM,EAAE,UAAU,EAAE,SAAS,EAAE,IAAI,CAAC,QAAQ,EAAE,IAAI,CAAC,KAAK,CAAC,CAAA;IACnF,CAAC;IAED,QAAQ;QACN,OAAO,WAAW,CAAC,IAAI,CAAC,MAAM,EAAE,WAAW,EAAE,SAAS,EAAE,IAAI,CAAC,QAAQ,EAAE,IAAI,CAAC,KAAK,CAAC,CAAA;IACpF,CAAC;IAED,QAAQ,CAAE,MAAkB;QAC1B,OAAO,WAAW,CAAC,IAAI,CAAC,MAAM,EAAE,WAAW,EAAE,MAAM,EAAE,IAAI,CAAC,QAAQ,EAAE,IAAI,CAAC,KAAK,CAAC,CAAA;IACjF,CAAC;IAED,WAAW,CAAE,MAAkB;QAC7B,OAAO,WAAW,CAAC,IAAI,CAAC,MAAM,EAAE,cAAc,EAAE,MAAM,EAAE,IAAI,CAAC,QAAQ,EAAE,IAAI,CAAC,KAAK,CAAC,CAAA;IACpF,CAAC;IAED,QAAQ,CAAE,MAAc;QACtB,OAAO,WAAW,CAAC,IAAI,CAAC,MAAM,EAAE,UAAU,EAAE,MAAM,EAAE,IAAI,CAAC,QAAQ,EAAE,IAAI,CAAC,KAAK,CAAC,CAAA;IAChF,CAAC;IAED,WAAW,CAAE,MAAc;QACzB,OAAO,WAAW,CAAC,IAAI,CAAC,MAAM,EAAE,cAAc,EAAE,MAAM,EAAE,IAAI,CAAC,QAAQ,EAAE,IAAI,CAAC,KAAK,CAAC,CAAA;IACpF,CAAC;IAED,MAAM;QACJ,OAAO,WAAW,CAAC,IAAI,CAAC,MAAM,EAAE,SAAS,EAAE,SAAS,EAAE,IAAI,CAAC,QAAQ,EAAE,IAAI,CAAC,KAAK,CAAC,CAAA;IAClF,CAAC;IAED,SAAS;QACP,OAAO,WAAW,CAAC,IAAI,CAAC,MAAM,EAAE,UAAU,EAAE,SAAS,EAAE,IAAI,CAAC,QAAQ,EAAE,IAAI,CAAC,KAAK,CAAC,CAAA;IACnF,CAAC;CACF"}

package/dist/constructs/internal/common-diagnostics.d.ts

@@ -16,6 +16,7 @@ type ResponseTimeProps = {
 type ResponseTimeLimits = {
     degradedResponseTime: number;
     maxResponseTime: number;
+    defaultMaxResponseTime?: number;
 };
 export declare function validateResponseTimes(diagnostics: Diagnostics, props: ResponseTimeProps, limits: ResponseTimeLimits): Promise<void>;
 export {};

package/dist/constructs/internal/common-diagnostics.js

@@ -80,5 +80,19 @@ export async function validateResponseTimes(diagnostics, props, limits) {
                 + `The current value is ${value}.`)));
         }
     }
+    // When `maxResponseTime` is omitted the backend applies a per-type default, so
+    // compare `degradedResponseTime` against that effective max. This catches the
+    // case where an explicit degraded value exceeds the default max (which would
+    // otherwise pass CLI validation but produce a broken check server-side).
+    const effectiveMaxResponseTime = props.maxResponseTime ?? limits.defaultMaxResponseTime;
+    if (props.degradedResponseTime !== undefined
+        && effectiveMaxResponseTime !== undefined
+        && props.degradedResponseTime > effectiveMaxResponseTime) {
+        diagnostics.add(new InvalidPropertyValueDiagnostic('degradedResponseTime', new Error(props.maxResponseTime !== undefined
+            ? `The value of "degradedResponseTime" must be less than or equal to "maxResponseTime".`
+            : `The value of "degradedResponseTime" must be less than or equal to the default `
+                + `"maxResponseTime" of ${effectiveMaxResponseTime}. Set an explicit "maxResponseTime" `
+                + `if you need a higher limit.`)));
+    }
 }
 //# sourceMappingURL=common-diagnostics.js.map

package/dist/constructs/internal/common-diagnostics.js.map

@@ -1 +1 @@
-{"version":3,"file":"common-diagnostics.js","sourceRoot":"","sources":["../../../src/constructs/internal/common-diagnostics.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,QAAQ,IAAI,YAAY,EAAE,MAAM,MAAM,CAAA;AAE/C,OAAO,EACL,4BAA4B,EAC5B,8BAA8B,EAC9B,yBAAyB,EACzB,6BAA6B,GAC9B,MAAM,6BAA6B,CAAA;AASpC,yCAAyC;AACzC,KAAK,UAAU,mBAAmB,CAChC,WAAwB,EACxB,IAAwD,EACxD,KAAyB;IAEzB,IAAI,KAAK,CAAC,WAAW,KAAK,SAAS,EAAE,CAAC;QACpC,IAAI,KAAK,CAAC,WAAW,EAAE,CAAC;YACtB,WAAW,CAAC,GAAG,CAAC,IAAI,IAAI,CACtB,aAAa,EACb,IAAI,KAAK,CACP,6DAA6D;kBAC3D,kCAAkC;kBAClC,MAAM;kBACN,0CAA0C;kBAC1C,sBAAsB;kBACtB,8BAA8B;kBAC9B,gCAAgC;kBAChC,0BAA0B;kBAC1B,MAAM,CACT,CACF,CAAC,CAAA;QACJ,CAAC;aAAM,CAAC;YACN,WAAW,CAAC,GAAG,CAAC,IAAI,IAAI,CACtB,aAAa,EACb,IAAI,KAAK,CACP,8DAA8D;kBAC5D,kCAAkC;kBAClC,MAAM;kBACN,oCAAoC,CACvC,CACF,CAAC,CAAA;QACJ,CAAC;IACH,CAAC;AACH,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,6BAA6B,CAAE,WAAwB,EAAE,KAAyB;IACtG,IAAI,KAAK,CAAC,WAAW,KAAK,SAAS,EAAE,CAAC;QACpC,IAAI,KAAK,CAAC,aAAa,EAAE,CAAC;YACxB,WAAW,CAAC,GAAG,CAAC,IAAI,8BAA8B,CAChD,aAAa,EACb,IAAI,KAAK,CAAC,wDAAwD,CAAC,CACpE,CAAC,CAAA;QACJ,CAAC;QAED,MAAM,mBAAmB,CAAC,WAAW,EAAE,4BAA4B,EAAE,KAAK,CAAC,CAAA;IAC7E,CAAC;AACH,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,0BAA0B,CAAE,WAAwB,EAAE,KAAyB;IACnG,MAAM,mBAAmB,CAAC,WAAW,EAAE,yBAAyB,EAAE,KAAK,CAAC,CAAA;AAC1E,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,8BAA8B,CAAE,WAAwB,EAAE,KAAyB;IACvG,MAAM,mBAAmB,CAAC,WAAW,EAAE,6BAA6B,EAAE,KAAK,CAAC,CAAA;AAC9E,CAAC;AAED,yCAAyC;AACzC,MAAM,CAAC,KAAK,UAAU,2BAA2B,CAC/C,WAAwB,EACxB,aAAqB,EACrB,UAAuC;IAEvC,IAAI,UAAU,KAAK,SAAS,EAAE,CAAC;QAC7B,WAAW,CAAC,GAAG,CAAC,IAAI,8BAA8B,CAChD,YAAY,EACZ,IAAI,KAAK,CAAC,oBAAoB,CAAC,CAChC,CAAC,CAAA;QACF,OAAM;IACR,CAAC;IACD,IAAI,OAAO,UAAU,KAAK,QAAQ,EAAE,CAAC;QACnC,WAAW,CAAC,GAAG,CAAC,IAAI,8BAA8B,CAChD,YAAY,EACZ,IAAI,KAAK,CACP,yBAAyB;cACvB,MAAM;cACN,sBAAsB,aAAa,yDAAyD,CAC/F,CACF,CAAC,CAAA;IACJ,CAAC;AACH,CAAC;AAED,yCAAyC;AACzC,MAAM,CAAC,KAAK,UAAU,wBAAwB,CAC5C,WAAwB,EACxB,aAAqB,EACrB,UAAuC;IAEvC,IAAI,UAAU,KAAK,SAAS,EAAE,CAAC;QAC7B,WAAW,CAAC,GAAG,CAAC,IAAI,8BAA8B,CAChD,YAAY,EACZ,IAAI,KAAK,CAAC,oBAAoB,CAAC,CAChC,CAAC,CAAA;QACF,OAAM;IACR,CAAC;IACD,IAAI,CAAC,YAAY,CAAC,MAAM,CAAC,UAAU,CAAC,CAAC,EAAE,CAAC;QACtC,WAAW,CAAC,GAAG,CAAC,IAAI,8BAA8B,CAChD,YAAY,EACZ,IAAI,KAAK,CACP,6BAA6B;cAC3B,MAAM;cACN,sBAAsB,aAAa,6DAA6D,CACnG,CACF,CAAC,CAAA;IACJ,CAAC;AACH,CAAC;AAYD,yCAAyC;AACzC,MAAM,CAAC,KAAK,UAAU,qBAAqB,CACzC,WAAwB,EACxB,KAAwB,EACxB,MAA0B;IAE1B,IAAI,KAAK,CAAC,oBAAoB,KAAK,SAAS,EAAE,CAAC;QAC7C,MAAM,KAAK,GAAG,KAAK,CAAC,oBAAoB,CAAA;QACxC,MAAM,KAAK,GAAG,MAAM,CAAC,oBAAoB,CAAA;QACzC,IAAI,KAAK,GAAG,KAAK,EAAE,CAAC;YAClB,WAAW,CAAC,GAAG,CAAC,IAAI,8BAA8B,CAChD,sBAAsB,EACtB,IAAI,KAAK,CACP,+CAA+C,KAAK,YAAY;kBAC9D,MAAM;kBACN,wBAAwB,KAAK,GAAG,CACnC,CACF,CAAC,CAAA;QACJ,CAAC;IACH,CAAC;IAED,IAAI,KAAK,CAAC,eAAe,KAAK,SAAS,EAAE,CAAC;QACxC,MAAM,KAAK,GAAG,KAAK,CAAC,eAAe,CAAA;QACnC,MAAM,KAAK,GAAG,MAAM,CAAC,eAAe,CAAA;QACpC,IAAI,KAAK,GAAG,KAAK,EAAE,CAAC;YAClB,WAAW,CAAC,GAAG,CAAC,IAAI,8BAA8B,CAChD,iBAAiB,EACjB,IAAI,KAAK,CACP,0CAA0C,KAAK,YAAY;kBACzD,MAAM;kBACN,wBAAwB,KAAK,GAAG,CACnC,CACF,CAAC,CAAA;QACJ,CAAC;IACH,CAAC;AACH,CAAC"}
+{"version":3,"file":"common-diagnostics.js","sourceRoot":"","sources":["../../../src/constructs/internal/common-diagnostics.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,QAAQ,IAAI,YAAY,EAAE,MAAM,MAAM,CAAA;AAE/C,OAAO,EACL,4BAA4B,EAC5B,8BAA8B,EAC9B,yBAAyB,EACzB,6BAA6B,GAC9B,MAAM,6BAA6B,CAAA;AASpC,yCAAyC;AACzC,KAAK,UAAU,mBAAmB,CAChC,WAAwB,EACxB,IAAwD,EACxD,KAAyB;IAEzB,IAAI,KAAK,CAAC,WAAW,KAAK,SAAS,EAAE,CAAC;QACpC,IAAI,KAAK,CAAC,WAAW,EAAE,CAAC;YACtB,WAAW,CAAC,GAAG,CAAC,IAAI,IAAI,CACtB,aAAa,EACb,IAAI,KAAK,CACP,6DAA6D;kBAC3D,kCAAkC;kBAClC,MAAM;kBACN,0CAA0C;kBAC1C,sBAAsB;kBACtB,8BAA8B;kBAC9B,gCAAgC;kBAChC,0BAA0B;kBAC1B,MAAM,CACT,CACF,CAAC,CAAA;QACJ,CAAC;aAAM,CAAC;YACN,WAAW,CAAC,GAAG,CAAC,IAAI,IAAI,CACtB,aAAa,EACb,IAAI,KAAK,CACP,8DAA8D;kBAC5D,kCAAkC;kBAClC,MAAM;kBACN,oCAAoC,CACvC,CACF,CAAC,CAAA;QACJ,CAAC;IACH,CAAC;AACH,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,6BAA6B,CAAE,WAAwB,EAAE,KAAyB;IACtG,IAAI,KAAK,CAAC,WAAW,KAAK,SAAS,EAAE,CAAC;QACpC,IAAI,KAAK,CAAC,aAAa,EAAE,CAAC;YACxB,WAAW,CAAC,GAAG,CAAC,IAAI,8BAA8B,CAChD,aAAa,EACb,IAAI,KAAK,CAAC,wDAAwD,CAAC,CACpE,CAAC,CAAA;QACJ,CAAC;QAED,MAAM,mBAAmB,CAAC,WAAW,EAAE,4BAA4B,EAAE,KAAK,CAAC,CAAA;IAC7E,CAAC;AACH,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,0BAA0B,CAAE,WAAwB,EAAE,KAAyB;IACnG,MAAM,mBAAmB,CAAC,WAAW,EAAE,yBAAyB,EAAE,KAAK,CAAC,CAAA;AAC1E,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,8BAA8B,CAAE,WAAwB,EAAE,KAAyB;IACvG,MAAM,mBAAmB,CAAC,WAAW,EAAE,6BAA6B,EAAE,KAAK,CAAC,CAAA;AAC9E,CAAC;AAED,yCAAyC;AACzC,MAAM,CAAC,KAAK,UAAU,2BAA2B,CAC/C,WAAwB,EACxB,aAAqB,EACrB,UAAuC;IAEvC,IAAI,UAAU,KAAK,SAAS,EAAE,CAAC;QAC7B,WAAW,CAAC,GAAG,CAAC,IAAI,8BAA8B,CAChD,YAAY,EACZ,IAAI,KAAK,CAAC,oBAAoB,CAAC,CAChC,CAAC,CAAA;QACF,OAAM;IACR,CAAC;IACD,IAAI,OAAO,UAAU,KAAK,QAAQ,EAAE,CAAC;QACnC,WAAW,CAAC,GAAG,CAAC,IAAI,8BAA8B,CAChD,YAAY,EACZ,IAAI,KAAK,CACP,yBAAyB;cACvB,MAAM;cACN,sBAAsB,aAAa,yDAAyD,CAC/F,CACF,CAAC,CAAA;IACJ,CAAC;AACH,CAAC;AAED,yCAAyC;AACzC,MAAM,CAAC,KAAK,UAAU,wBAAwB,CAC5C,WAAwB,EACxB,aAAqB,EACrB,UAAuC;IAEvC,IAAI,UAAU,KAAK,SAAS,EAAE,CAAC;QAC7B,WAAW,CAAC,GAAG,CAAC,IAAI,8BAA8B,CAChD,YAAY,EACZ,IAAI,KAAK,CAAC,oBAAoB,CAAC,CAChC,CAAC,CAAA;QACF,OAAM;IACR,CAAC;IACD,IAAI,CAAC,YAAY,CAAC,MAAM,CAAC,UAAU,CAAC,CAAC,EAAE,CAAC;QACtC,WAAW,CAAC,GAAG,CAAC,IAAI,8BAA8B,CAChD,YAAY,EACZ,IAAI,KAAK,CACP,6BAA6B;cAC3B,MAAM;cACN,sBAAsB,aAAa,6DAA6D,CACnG,CACF,CAAC,CAAA;IACJ,CAAC;AACH,CAAC;AAgBD,yCAAyC;AACzC,MAAM,CAAC,KAAK,UAAU,qBAAqB,CACzC,WAAwB,EACxB,KAAwB,EACxB,MAA0B;IAE1B,IAAI,KAAK,CAAC,oBAAoB,KAAK,SAAS,EAAE,CAAC;QAC7C,MAAM,KAAK,GAAG,KAAK,CAAC,oBAAoB,CAAA;QACxC,MAAM,KAAK,GAAG,MAAM,CAAC,oBAAoB,CAAA;QACzC,IAAI,KAAK,GAAG,KAAK,EAAE,CAAC;YAClB,WAAW,CAAC,GAAG,CAAC,IAAI,8BAA8B,CAChD,sBAAsB,EACtB,IAAI,KAAK,CACP,+CAA+C,KAAK,YAAY;kBAC9D,MAAM;kBACN,wBAAwB,KAAK,GAAG,CACnC,CACF,CAAC,CAAA;QACJ,CAAC;IACH,CAAC;IAED,IAAI,KAAK,CAAC,eAAe,KAAK,SAAS,EAAE,CAAC;QACxC,MAAM,KAAK,GAAG,KAAK,CAAC,eAAe,CAAA;QACnC,MAAM,KAAK,GAAG,MAAM,CAAC,eAAe,CAAA;QACpC,IAAI,KAAK,GAAG,KAAK,EAAE,CAAC;YAClB,WAAW,CAAC,GAAG,CAAC,IAAI,8BAA8B,CAChD,iBAAiB,EACjB,IAAI,KAAK,CACP,0CAA0C,KAAK,YAAY;kBACzD,MAAM;kBACN,wBAAwB,KAAK,GAAG,CACnC,CACF,CAAC,CAAA;QACJ,CAAC;IACH,CAAC;IAED,+EAA+E;IAC/E,8EAA8E;IAC9E,6EAA6E;IAC7E,yEAAyE;IACzE,MAAM,wBAAwB,GAAG,KAAK,CAAC,eAAe,IAAI,MAAM,CAAC,sBAAsB,CAAA;IACvF,IACE,KAAK,CAAC,oBAAoB,KAAK,SAAS;WACrC,wBAAwB,KAAK,SAAS;WACtC,KAAK,CAAC,oBAAoB,GAAG,wBAAwB,EACxD,CAAC;QACD,WAAW,CAAC,GAAG,CAAC,IAAI,8BAA8B,CAChD,sBAAsB,EACtB,IAAI,KAAK,CACP,KAAK,CAAC,eAAe,KAAK,SAAS;YACjC,CAAC,CAAC,sFAAsF;YACxF,CAAC,CAAC,gFAAgF;kBAC9E,wBAAwB,wBAAwB,sCAAsC;kBACtF,6BAA6B,CACpC,CACF,CAAC,CAAA;IACJ,CAAC;AACH,CAAC"}

package/dist/constructs/ssl-assertion-codegen.d.ts

@@ -0,0 +1,3 @@
+import { GeneratedFile, Value } from '../sourcegen/index.js';
+import { SslAssertion } from './ssl-assertion.js';
+export declare function valueForSslAssertion(genfile: GeneratedFile, assertion: SslAssertion): Value;

package/dist/constructs/ssl-assertion-codegen.js

@@ -0,0 +1,36 @@
+import { unsupportedAssertionSource, valueForBooleanAssertion, valueForGeneralAssertion, valueForNumericAssertion, } from './internal/assertion-codegen.js';
+const generalNoArgs = { hasProperty: false, hasRegex: false };
+// The string sources additionally accept the MATCHES (regex) operator.
+const generalWithMatches = { hasProperty: false, hasRegex: false, hasMatches: true };
+export function valueForSslAssertion(genfile, assertion) {
+    genfile.namedImport('SslAssertionBuilder', 'checkly/constructs');
+    switch (assertion.source) {
+        case 'CERT_EXPIRES_IN_DAYS':
+            return valueForNumericAssertion('SslAssertionBuilder', 'certExpiresInDays', assertion);
+        case 'KEY_SIZE_BITS':
+            return valueForNumericAssertion('SslAssertionBuilder', 'keySizeBits', assertion);
+        case 'CERT_NOT_EXPIRED':
+            return valueForBooleanAssertion('SslAssertionBuilder', 'certNotExpired', assertion);
+        case 'HOSTNAME_VERIFIED':
+            return valueForBooleanAssertion('SslAssertionBuilder', 'hostnameVerified', assertion);
+        case 'CHAIN_TRUSTED':
+            return valueForBooleanAssertion('SslAssertionBuilder', 'chainTrusted', assertion);
+        case 'OCSP_STAPLED':
+            return valueForBooleanAssertion('SslAssertionBuilder', 'ocspStapled', assertion);
+        case 'TLS_VERSION':
+            return valueForGeneralAssertion('SslAssertionBuilder', 'tlsVersion', assertion, generalNoArgs);
+        case 'CIPHER_SUITE':
+            return valueForGeneralAssertion('SslAssertionBuilder', 'cipherSuite', assertion, generalWithMatches);
+        case 'ISSUER_CN':
+            return valueForGeneralAssertion('SslAssertionBuilder', 'issuerCn', assertion, generalWithMatches);
+        case 'CERT_FINGERPRINT_SHA256':
+            return valueForGeneralAssertion('SslAssertionBuilder', 'certFingerprintSha256', assertion, generalNoArgs);
+        case 'ISSUER_FINGERPRINT_SHA256':
+            return valueForGeneralAssertion('SslAssertionBuilder', 'issuerFingerprintSha256', assertion, generalNoArgs);
+        case 'SIGNATURE_ALGORITHM':
+            return valueForGeneralAssertion('SslAssertionBuilder', 'signatureAlgorithm', assertion, generalWithMatches);
+        default:
+            return unsupportedAssertionSource(assertion.source, 'SSL');
+    }
+}
+//# sourceMappingURL=ssl-assertion-codegen.js.map

package/dist/constructs/ssl-assertion-codegen.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"ssl-assertion-codegen.js","sourceRoot":"","sources":["../../src/constructs/ssl-assertion-codegen.ts"],"names":[],"mappings":"AACA,OAAO,EACL,0BAA0B,EAC1B,wBAAwB,EACxB,wBAAwB,EACxB,wBAAwB,GACzB,MAAM,iCAAiC,CAAA;AAGxC,MAAM,aAAa,GAAG,EAAE,WAAW,EAAE,KAAK,EAAE,QAAQ,EAAE,KAAK,EAAE,CAAA;AAC7D,uEAAuE;AACvE,MAAM,kBAAkB,GAAG,EAAE,WAAW,EAAE,KAAK,EAAE,QAAQ,EAAE,KAAK,EAAE,UAAU,EAAE,IAAI,EAAE,CAAA;AAEpF,MAAM,UAAU,oBAAoB,CAAE,OAAsB,EAAE,SAAuB;IACnF,OAAO,CAAC,WAAW,CAAC,qBAAqB,EAAE,oBAAoB,CAAC,CAAA;IAEhE,QAAQ,SAAS,CAAC,MAAM,EAAE,CAAC;QACzB,KAAK,sBAAsB;YACzB,OAAO,wBAAwB,CAAC,qBAAqB,EAAE,mBAAmB,EAAE,SAAS,CAAC,CAAA;QACxF,KAAK,eAAe;YAClB,OAAO,wBAAwB,CAAC,qBAAqB,EAAE,aAAa,EAAE,SAAS,CAAC,CAAA;QAClF,KAAK,kBAAkB;YACrB,OAAO,wBAAwB,CAAC,qBAAqB,EAAE,gBAAgB,EAAE,SAAS,CAAC,CAAA;QACrF,KAAK,mBAAmB;YACtB,OAAO,wBAAwB,CAAC,qBAAqB,EAAE,kBAAkB,EAAE,SAAS,CAAC,CAAA;QACvF,KAAK,eAAe;YAClB,OAAO,wBAAwB,CAAC,qBAAqB,EAAE,cAAc,EAAE,SAAS,CAAC,CAAA;QACnF,KAAK,cAAc;YACjB,OAAO,wBAAwB,CAAC,qBAAqB,EAAE,aAAa,EAAE,SAAS,CAAC,CAAA;QAClF,KAAK,aAAa;YAChB,OAAO,wBAAwB,CAAC,qBAAqB,EAAE,YAAY,EAAE,SAAS,EAAE,aAAa,CAAC,CAAA;QAChG,KAAK,cAAc;YACjB,OAAO,wBAAwB,CAAC,qBAAqB,EAAE,aAAa,EAAE,SAAS,EAAE,kBAAkB,CAAC,CAAA;QACtG,KAAK,WAAW;YACd,OAAO,wBAAwB,CAAC,qBAAqB,EAAE,UAAU,EAAE,SAAS,EAAE,kBAAkB,CAAC,CAAA;QACnG,KAAK,yBAAyB;YAC5B,OAAO,wBAAwB,CAAC,qBAAqB,EAAE,uBAAuB,EAAE,SAAS,EAAE,aAAa,CAAC,CAAA;QAC3G,KAAK,2BAA2B;YAC9B,OAAO,wBAAwB,CAAC,qBAAqB,EAAE,yBAAyB,EAAE,SAAS,EAAE,aAAa,CAAC,CAAA;QAC7G,KAAK,qBAAqB;YACxB,OAAO,wBAAwB,CAAC,qBAAqB,EAAE,oBAAoB,EAAE,SAAS,EAAE,kBAAkB,CAAC,CAAA;QAC7G;YACE,OAAO,0BAA0B,CAAC,SAAS,CAAC,MAAM,EAAE,KAAK,CAAC,CAAA;IAC9D,CAAC;AACH,CAAC"}

package/dist/constructs/ssl-assertion-validation.d.ts

@@ -0,0 +1,13 @@
+import { Diagnostics } from './diagnostics.js';
+import { SslAssertion } from './ssl-assertion.js';
+/**
+ * Reports SSL assertions whose source, comparison or boolean target the backend does
+ * not accept.
+ *
+ * Assertions written as plain object literals bypass SslAssertionBuilder and are
+ * type-legal, because the fields are declared as plain strings. The backend rejects
+ * an unknown source or an operator not allowed for the source with a 400; a boolean
+ * source with a non-`true`/`false` target is accepted at deploy but never matches at
+ * evaluation, so it is reported too.
+ */
+export declare function validateSslAssertion(diagnostics: Diagnostics, assertion: SslAssertion, index: number): void;

package/dist/constructs/ssl-assertion-validation.js

@@ -0,0 +1,49 @@
+import { addAssertionDiagnostic, quotedKeys } from './internal/assertion-validation.js';
+// The operators the backend accepts per source, minus the CLI-dropped
+// GREATER_THAN_OR_EQUAL. Keyed by the source union so adding a source without a rule
+// fails to compile.
+const rules = {
+    CERT_EXPIRES_IN_DAYS: { comparisons: { EQUALS: true, NOT_EQUALS: true, GREATER_THAN: true, LESS_THAN: true } },
+    KEY_SIZE_BITS: { comparisons: { EQUALS: true } },
+    CERT_NOT_EXPIRED: { comparisons: { EQUALS: true }, booleanTarget: true },
+    HOSTNAME_VERIFIED: { comparisons: { EQUALS: true }, booleanTarget: true },
+    CHAIN_TRUSTED: { comparisons: { EQUALS: true }, booleanTarget: true },
+    OCSP_STAPLED: { comparisons: { EQUALS: true }, booleanTarget: true },
+    TLS_VERSION: { comparisons: { EQUALS: true } },
+    SIGNATURE_ALGORITHM: { comparisons: { EQUALS: true, MATCHES: true } },
+    CIPHER_SUITE: { comparisons: { EQUALS: true, NOT_EQUALS: true, MATCHES: true } },
+    ISSUER_CN: { comparisons: { EQUALS: true, NOT_EQUALS: true, MATCHES: true } },
+    CERT_FINGERPRINT_SHA256: { comparisons: { EQUALS: true } },
+    ISSUER_FINGERPRINT_SHA256: { comparisons: { EQUALS: true } },
+};
+/**
+ * Reports SSL assertions whose source, comparison or boolean target the backend does
+ * not accept.
+ *
+ * Assertions written as plain object literals bypass SslAssertionBuilder and are
+ * type-legal, because the fields are declared as plain strings. The backend rejects
+ * an unknown source or an operator not allowed for the source with a 400; a boolean
+ * source with a non-`true`/`false` target is accepted at deploy but never matches at
+ * evaluation, so it is reported too.
+ */
+export function validateSslAssertion(diagnostics, assertion, index) {
+    const location = `request.assertions[${index}]`;
+    const rule = Object.hasOwn(rules, assertion.source)
+        ? rules[assertion.source]
+        : undefined;
+    if (rule === undefined) {
+        addAssertionDiagnostic(diagnostics, `The assertion at "${location}" has an unknown source "${assertion.source}". `
+            + `Expected one of ${quotedKeys(rules)}.`);
+        return;
+    }
+    if (!Object.hasOwn(rule.comparisons, assertion.comparison)) {
+        addAssertionDiagnostic(diagnostics, `The ${assertion.source} assertion at "${location}" has an unsupported comparison `
+            + `${assertion.comparison === '' ? '(none)' : `"${assertion.comparison}"`}. `
+            + `Expected one of ${quotedKeys(rule.comparisons)}.`);
+    }
+    if (rule.booleanTarget && assertion.target !== 'true' && assertion.target !== 'false') {
+        addAssertionDiagnostic(diagnostics, `The ${assertion.source} assertion at "${location}" must compare against "true" or "false", `
+            + `but got "${assertion.target}".`);
+    }
+}
+//# sourceMappingURL=ssl-assertion-validation.js.map

package/dist/constructs/ssl-assertion-validation.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"ssl-assertion-validation.js","sourceRoot":"","sources":["../../src/constructs/ssl-assertion-validation.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,sBAAsB,EAAE,UAAU,EAAE,MAAM,oCAAoC,CAAA;AAevF,sEAAsE;AACtE,qFAAqF;AACrF,oBAAoB;AACpB,MAAM,KAAK,GAAkD;IAC3D,oBAAoB,EAAE,EAAE,WAAW,EAAE,EAAE,MAAM,EAAE,IAAI,EAAE,UAAU,EAAE,IAAI,EAAE,YAAY,EAAE,IAAI,EAAE,SAAS,EAAE,IAAI,EAAE,EAAE;IAC9G,aAAa,EAAE,EAAE,WAAW,EAAE,EAAE,MAAM,EAAE,IAAI,EAAE,EAAE;IAChD,gBAAgB,EAAE,EAAE,WAAW,EAAE,EAAE,MAAM,EAAE,IAAI,EAAE,EAAE,aAAa,EAAE,IAAI,EAAE;IACxE,iBAAiB,EAAE,EAAE,WAAW,EAAE,EAAE,MAAM,EAAE,IAAI,EAAE,EAAE,aAAa,EAAE,IAAI,EAAE;IACzE,aAAa,EAAE,EAAE,WAAW,EAAE,EAAE,MAAM,EAAE,IAAI,EAAE,EAAE,aAAa,EAAE,IAAI,EAAE;IACrE,YAAY,EAAE,EAAE,WAAW,EAAE,EAAE,MAAM,EAAE,IAAI,EAAE,EAAE,aAAa,EAAE,IAAI,EAAE;IACpE,WAAW,EAAE,EAAE,WAAW,EAAE,EAAE,MAAM,EAAE,IAAI,EAAE,EAAE;IAC9C,mBAAmB,EAAE,EAAE,WAAW,EAAE,EAAE,MAAM,EAAE,IAAI,EAAE,OAAO,EAAE,IAAI,EAAE,EAAE;IACrE,YAAY,EAAE,EAAE,WAAW,EAAE,EAAE,MAAM,EAAE,IAAI,EAAE,UAAU,EAAE,IAAI,EAAE,OAAO,EAAE,IAAI,EAAE,EAAE;IAChF,SAAS,EAAE,EAAE,WAAW,EAAE,EAAE,MAAM,EAAE,IAAI,EAAE,UAAU,EAAE,IAAI,EAAE,OAAO,EAAE,IAAI,EAAE,EAAE;IAC7E,uBAAuB,EAAE,EAAE,WAAW,EAAE,EAAE,MAAM,EAAE,IAAI,EAAE,EAAE;IAC1D,yBAAyB,EAAE,EAAE,WAAW,EAAE,EAAE,MAAM,EAAE,IAAI,EAAE,EAAE;CAC7D,CAAA;AAED;;;;;;;;;GASG;AACH,MAAM,UAAU,oBAAoB,CAClC,WAAwB,EACxB,SAAuB,EACvB,KAAa;IAEb,MAAM,QAAQ,GAAG,sBAAsB,KAAK,GAAG,CAAA;IAE/C,MAAM,IAAI,GAAG,MAAM,CAAC,MAAM,CAAC,KAAK,EAAE,SAAS,CAAC,MAAM,CAAC;QACjD,CAAC,CAAC,KAAK,CAAC,SAAS,CAAC,MAAgC,CAAC;QACnD,CAAC,CAAC,SAAS,CAAA;IACb,IAAI,IAAI,KAAK,SAAS,EAAE,CAAC;QACvB,sBAAsB,CAAC,WAAW,EAChC,qBAAqB,QAAQ,4BAA4B,SAAS,CAAC,MAAM,KAAK;cAC5E,mBAAmB,UAAU,CAAC,KAAK,CAAC,GAAG,CAAC,CAAA;QAC5C,OAAM;IACR,CAAC;IAED,IAAI,CAAC,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,WAAW,EAAE,SAAS,CAAC,UAAU,CAAC,EAAE,CAAC;QAC3D,sBAAsB,CAAC,WAAW,EAChC,OAAO,SAAS,CAAC,MAAM,kBAAkB,QAAQ,kCAAkC;cACjF,GAAG,SAAS,CAAC,UAAU,KAAK,EAAE,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,IAAI,SAAS,CAAC,UAAU,GAAG,IAAI;cAC3E,mBAAmB,UAAU,CAAC,IAAI,CAAC,WAAW,CAAC,GAAG,CAAC,CAAA;IACzD,CAAC;IAED,IAAI,IAAI,CAAC,aAAa,IAAI,SAAS,CAAC,MAAM,KAAK,MAAM,IAAI,SAAS,CAAC,MAAM,KAAK,OAAO,EAAE,CAAC;QACtF,sBAAsB,CAAC,WAAW,EAChC,OAAO,SAAS,CAAC,MAAM,kBAAkB,QAAQ,4CAA4C;cAC3F,YAAY,SAAS,CAAC,MAAM,IAAI,CAAC,CAAA;IACvC,CAAC;AACH,CAAC"}

package/dist/constructs/ssl-assertion.d.ts

@@ -0,0 +1,197 @@
+import { Assertion as CoreAssertion } from './internal/assertion.js';
+/**
+ * Known TLS protocol versions for use with {@link SslAssertionBuilder.tlsVersion}.
+ *
+ * @example
+ * ```typescript
+ * SslAssertionBuilder.tlsVersion().equals(TlsVersion.TLS1_3)
+ * ```
+ */
+export declare const TlsVersion: {
+    readonly TLS1_0: "TLS1.0";
+    readonly TLS1_1: "TLS1.1";
+    readonly TLS1_2: "TLS1.2";
+    readonly TLS1_3: "TLS1.3";
+};
+export type TlsVersionValue = (typeof TlsVersion)[keyof typeof TlsVersion];
+/**
+ * Signature algorithms as reported by Go's `x509.Certificate.SignatureAlgorithm.String()`.
+ * These are the exact values the SSL runner evaluates assertions against — use these
+ * constants (or the string literals they represent) with {@link SslAssertionBuilder.signatureAlgorithm}.
+ *
+ * @example
+ * ```typescript
+ * SslAssertionBuilder.signatureAlgorithm().equals(SignatureAlgorithm.SHA256_RSA)
+ * ```
+ */
+export declare const SignatureAlgorithm: {
+    readonly MD2_RSA: "MD2-RSA";
+    readonly MD5_RSA: "MD5-RSA";
+    readonly SHA1_RSA: "SHA1-RSA";
+    readonly SHA256_RSA: "SHA256-RSA";
+    readonly SHA384_RSA: "SHA384-RSA";
+    readonly SHA512_RSA: "SHA512-RSA";
+    readonly SHA256_RSAPSS: "SHA256-RSAPSS";
+    readonly SHA384_RSAPSS: "SHA384-RSAPSS";
+    readonly SHA512_RSAPSS: "SHA512-RSAPSS";
+    readonly DSA_SHA1: "DSA-SHA1";
+    readonly DSA_SHA256: "DSA-SHA256";
+    readonly ECDSA_SHA1: "ECDSA-SHA1";
+    readonly ECDSA_SHA256: "ECDSA-SHA256";
+    readonly ECDSA_SHA384: "ECDSA-SHA384";
+    readonly ECDSA_SHA512: "ECDSA-SHA512";
+    readonly ED25519: "Ed25519";
+};
+export type SignatureAlgorithmValue = (typeof SignatureAlgorithm)[keyof typeof SignatureAlgorithm];
+/**
+ * Commonly-used IANA cipher suite names for use with
+ * {@link SslAssertionBuilder.cipherSuite}. Includes TLS 1.3 suites and
+ * widely-deployed TLS 1.2 suites.
+ *
+ * @example
+ * ```typescript
+ * SslAssertionBuilder.cipherSuite().equals(CipherSuite.TLS_AES_256_GCM_SHA384)
+ * SslAssertionBuilder.cipherSuite().equals(CipherSuite.TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256)
+ * ```
+ */
+export declare const CipherSuite: {
+    readonly TLS_AES_128_GCM_SHA256: "TLS_AES_128_GCM_SHA256";
+    readonly TLS_AES_256_GCM_SHA384: "TLS_AES_256_GCM_SHA384";
+    readonly TLS_CHACHA20_POLY1305_SHA256: "TLS_CHACHA20_POLY1305_SHA256";
+    readonly TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256: "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256";
+    readonly TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384: "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384";
+    readonly TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256: "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256";
+    readonly TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384: "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384";
+    readonly TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256: "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256";
+    readonly TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256: "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256";
+    readonly TLS_RSA_WITH_AES_128_GCM_SHA256: "TLS_RSA_WITH_AES_128_GCM_SHA256";
+    readonly TLS_RSA_WITH_AES_256_GCM_SHA384: "TLS_RSA_WITH_AES_256_GCM_SHA384";
+    readonly TLS_RSA_WITH_AES_128_CBC_SHA256: "TLS_RSA_WITH_AES_128_CBC_SHA256";
+    readonly TLS_RSA_WITH_AES_256_CBC_SHA256: "TLS_RSA_WITH_AES_256_CBC_SHA256";
+    readonly TLS_RSA_WITH_AES_128_CBC_SHA: "TLS_RSA_WITH_AES_128_CBC_SHA";
+    readonly TLS_RSA_WITH_AES_256_CBC_SHA: "TLS_RSA_WITH_AES_256_CBC_SHA";
+};
+export type CipherSuiteValue = (typeof CipherSuite)[keyof typeof CipherSuite];
+type SslAssertionSource = 'CERT_EXPIRES_IN_DAYS' | 'CERT_NOT_EXPIRED' | 'HOSTNAME_VERIFIED' | 'CHAIN_TRUSTED' | 'TLS_VERSION' | 'CIPHER_SUITE' | 'ISSUER_CN' | 'CERT_FINGERPRINT_SHA256' | 'ISSUER_FINGERPRINT_SHA256' | 'KEY_SIZE_BITS' | 'SIGNATURE_ALGORITHM' | 'OCSP_STAPLED';
+export type SslAssertion = CoreAssertion<SslAssertionSource>;
+/** Days until the certificate expires (numeric). */
+declare class CertExpiresInDaysAssertionBuilder {
+    equals(target: number): SslAssertion;
+    notEquals(target: number): SslAssertion;
+    lessThan(target: number): SslAssertion;
+    greaterThan(target: number): SslAssertion;
+}
+/** Certificate key size in bits (numeric, exact match only). */
+declare class KeySizeBitsAssertionBuilder {
+    equals(target: number): SslAssertion;
+}
+/** Whether the certificate is not expired (boolean). */
+declare class CertNotExpiredAssertionBuilder {
+    equals(target: boolean): SslAssertion;
+}
+/** Whether the hostname is verified (boolean). */
+declare class HostnameVerifiedAssertionBuilder {
+    equals(target: boolean): SslAssertion;
+}
+/** Whether the certificate chain is trusted (boolean). */
+declare class ChainTrustedAssertionBuilder {
+    equals(target: boolean): SslAssertion;
+}
+/** Whether a stapled OCSP response was provided during the handshake (boolean). */
+declare class OcspStapledAssertionBuilder {
+    equals(target: boolean): SslAssertion;
+}
+/** Negotiated TLS version — `.equals()` accepts only known TLS version strings. */
+declare class TlsVersionAssertionBuilder {
+    equals(target: TlsVersionValue): SslAssertion;
+}
+/**
+ * Certificate signature algorithm. `.equals()` takes a Go
+ * `x509.Certificate.SignatureAlgorithm.String()` value; `.matches()` takes a regex.
+ */
+declare class SignatureAlgorithmAssertionBuilder {
+    equals(target: SignatureAlgorithmValue): SslAssertion;
+    matches(target: string): SslAssertion;
+}
+/** Negotiated cipher suite (string) — exact, not-equal, or regex match. */
+declare class CipherSuiteAssertionBuilder {
+    equals(target: string): SslAssertion;
+    notEquals(target: string): SslAssertion;
+    matches(target: string): SslAssertion;
+}
+/** Certificate issuer common name (string) — exact, not-equal, or regex match. */
+declare class IssuerCnAssertionBuilder {
+    equals(target: string): SslAssertion;
+    notEquals(target: string): SslAssertion;
+    matches(target: string): SslAssertion;
+}
+/** Certificate SHA-256 fingerprint (string, exact match only). */
+declare class CertFingerprintSha256AssertionBuilder {
+    equals(target: string): SslAssertion;
+}
+/** Issuer SHA-256 fingerprint (string, exact match only). */
+declare class IssuerFingerprintSha256AssertionBuilder {
+    equals(target: string): SslAssertion;
+}
+/**
+ * Builder class for creating SSL monitor assertions.
+ * Provides methods to create assertions for TLS certificates.
+ *
+ * @example
+ * ```typescript
+ * // Alert when the certificate is within 30 days of expiry
+ * SslAssertionBuilder.certExpiresInDays().greaterThan(30)
+ *
+ * // Require a trusted chain and a verified hostname
+ * SslAssertionBuilder.chainTrusted().equals(true)
+ * SslAssertionBuilder.hostnameVerified().equals(true)
+ *
+ * // Enforce a specific TLS version and key size
+ * SslAssertionBuilder.tlsVersion().equals('TLS1.3')
+ * SslAssertionBuilder.keySizeBits().equals(2048)
+ *
+ * // Match the issuer or cipher suite against a regex
+ * SslAssertionBuilder.issuerCn().matches("^Let's Encrypt")
+ * SslAssertionBuilder.cipherSuite().matches('TLS_(AES|CHACHA)')
+ * ```
+ */
+export declare class SslAssertionBuilder {
+    /** Assertion builder for the number of days until the certificate expires. */
+    static certExpiresInDays(): CertExpiresInDaysAssertionBuilder;
+    /** Assertion builder for the certificate key size in bits. */
+    static keySizeBits(): KeySizeBitsAssertionBuilder;
+    /** Assertion builder for whether the certificate is not expired. */
+    static certNotExpired(): CertNotExpiredAssertionBuilder;
+    /** Assertion builder for whether the hostname is verified. */
+    static hostnameVerified(): HostnameVerifiedAssertionBuilder;
+    /** Assertion builder for whether the certificate chain is trusted. */
+    static chainTrusted(): ChainTrustedAssertionBuilder;
+    /**
+     * Assertion builder for the negotiated TLS version. `.equals()` accepts only the
+     * known TLS version strings — use the {@link TlsVersion} constants or the string
+     * literals `'TLS1.0'`…`'TLS1.3'`.
+     */
+    static tlsVersion(): TlsVersionAssertionBuilder;
+    /**
+     * Assertion builder for the negotiated cipher suite. Go's `tls.CipherSuiteName()`
+     * can return hundreds of IANA names plus `0x....` hex fallbacks, so `.equals()` is
+     * unconstrained; use the {@link CipherSuite} constants for common suites, or
+     * `.matches()` with a regex pattern.
+     */
+    static cipherSuite(): CipherSuiteAssertionBuilder;
+    /** Assertion builder for the certificate issuer common name. */
+    static issuerCn(): IssuerCnAssertionBuilder;
+    /** Assertion builder for the certificate SHA-256 fingerprint. */
+    static certFingerprintSha256(): CertFingerprintSha256AssertionBuilder;
+    /** Assertion builder for the issuer SHA-256 fingerprint. */
+    static issuerFingerprintSha256(): IssuerFingerprintSha256AssertionBuilder;
+    /**
+     * Assertion builder for the certificate signature algorithm. `.equals()` takes a
+     * Go `x509.Certificate.SignatureAlgorithm.String()` value (e.g. `'SHA256-RSA'`) —
+     * use the {@link SignatureAlgorithm} constants — or `.matches()` with a regex.
+     */
+    static signatureAlgorithm(): SignatureAlgorithmAssertionBuilder;
+    /** Assertion builder for whether a stapled OCSP response was provided. */
+    static ocspStapled(): OcspStapledAssertionBuilder;
+}
+export {};

package/dist/constructs/ssl-assertion.js

@@ -0,0 +1,267 @@
+import { toAssertion } from './internal/assertion.js';
+/**
+ * Known TLS protocol versions for use with {@link SslAssertionBuilder.tlsVersion}.
+ *
+ * @example
+ * ```typescript
+ * SslAssertionBuilder.tlsVersion().equals(TlsVersion.TLS1_3)
+ * ```
+ */
+export const TlsVersion = {
+    TLS1_0: 'TLS1.0',
+    TLS1_1: 'TLS1.1',
+    TLS1_2: 'TLS1.2',
+    TLS1_3: 'TLS1.3',
+};
+/**
+ * Signature algorithms as reported by Go's `x509.Certificate.SignatureAlgorithm.String()`.
+ * These are the exact values the SSL runner evaluates assertions against — use these
+ * constants (or the string literals they represent) with {@link SslAssertionBuilder.signatureAlgorithm}.
+ *
+ * @example
+ * ```typescript
+ * SslAssertionBuilder.signatureAlgorithm().equals(SignatureAlgorithm.SHA256_RSA)
+ * ```
+ */
+export const SignatureAlgorithm = {
+    // RSA
+    MD2_RSA: 'MD2-RSA',
+    MD5_RSA: 'MD5-RSA',
+    SHA1_RSA: 'SHA1-RSA',
+    SHA256_RSA: 'SHA256-RSA',
+    SHA384_RSA: 'SHA384-RSA',
+    SHA512_RSA: 'SHA512-RSA',
+    SHA256_RSAPSS: 'SHA256-RSAPSS',
+    SHA384_RSAPSS: 'SHA384-RSAPSS',
+    SHA512_RSAPSS: 'SHA512-RSAPSS',
+    // DSA
+    DSA_SHA1: 'DSA-SHA1',
+    DSA_SHA256: 'DSA-SHA256',
+    // ECDSA
+    ECDSA_SHA1: 'ECDSA-SHA1',
+    ECDSA_SHA256: 'ECDSA-SHA256',
+    ECDSA_SHA384: 'ECDSA-SHA384',
+    ECDSA_SHA512: 'ECDSA-SHA512',
+    // EdDSA
+    ED25519: 'Ed25519',
+};
+/**
+ * Commonly-used IANA cipher suite names for use with
+ * {@link SslAssertionBuilder.cipherSuite}. Includes TLS 1.3 suites and
+ * widely-deployed TLS 1.2 suites.
+ *
+ * @example
+ * ```typescript
+ * SslAssertionBuilder.cipherSuite().equals(CipherSuite.TLS_AES_256_GCM_SHA384)
+ * SslAssertionBuilder.cipherSuite().equals(CipherSuite.TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256)
+ * ```
+ */
+export const CipherSuite = {
+    // TLS 1.3
+    TLS_AES_128_GCM_SHA256: 'TLS_AES_128_GCM_SHA256',
+    TLS_AES_256_GCM_SHA384: 'TLS_AES_256_GCM_SHA384',
+    TLS_CHACHA20_POLY1305_SHA256: 'TLS_CHACHA20_POLY1305_SHA256',
+    // TLS 1.2 — ECDHE (forward-secret, preferred)
+    TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256: 'TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256',
+    TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384: 'TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384',
+    TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256: 'TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256',
+    TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384: 'TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384',
+    TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256: 'TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256',
+    TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256: 'TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256',
+    // TLS 1.2 — RSA key exchange
+    TLS_RSA_WITH_AES_128_GCM_SHA256: 'TLS_RSA_WITH_AES_128_GCM_SHA256',
+    TLS_RSA_WITH_AES_256_GCM_SHA384: 'TLS_RSA_WITH_AES_256_GCM_SHA384',
+    TLS_RSA_WITH_AES_128_CBC_SHA256: 'TLS_RSA_WITH_AES_128_CBC_SHA256',
+    TLS_RSA_WITH_AES_256_CBC_SHA256: 'TLS_RSA_WITH_AES_256_CBC_SHA256',
+    TLS_RSA_WITH_AES_128_CBC_SHA: 'TLS_RSA_WITH_AES_128_CBC_SHA',
+    TLS_RSA_WITH_AES_256_CBC_SHA: 'TLS_RSA_WITH_AES_256_CBC_SHA',
+};
+// One builder class per SSL source, each exposing only the operators (and value
+// type) the backend accepts for that source. The classes are stateless — the source
+// is baked into each `toAssertion` call — and are not exported: they are reachable
+// only through `SslAssertionBuilder`, so they stay out of the package's public API.
+/** Days until the certificate expires (numeric). */
+class CertExpiresInDaysAssertionBuilder {
+    equals(target) {
+        return toAssertion('CERT_EXPIRES_IN_DAYS', 'EQUALS', target);
+    }
+    notEquals(target) {
+        return toAssertion('CERT_EXPIRES_IN_DAYS', 'NOT_EQUALS', target);
+    }
+    lessThan(target) {
+        return toAssertion('CERT_EXPIRES_IN_DAYS', 'LESS_THAN', target);
+    }
+    greaterThan(target) {
+        return toAssertion('CERT_EXPIRES_IN_DAYS', 'GREATER_THAN', target);
+    }
+}
+/** Certificate key size in bits (numeric, exact match only). */
+class KeySizeBitsAssertionBuilder {
+    equals(target) {
+        return toAssertion('KEY_SIZE_BITS', 'EQUALS', target);
+    }
+}
+/** Whether the certificate is not expired (boolean). */
+class CertNotExpiredAssertionBuilder {
+    equals(target) {
+        return toAssertion('CERT_NOT_EXPIRED', 'EQUALS', target);
+    }
+}
+/** Whether the hostname is verified (boolean). */
+class HostnameVerifiedAssertionBuilder {
+    equals(target) {
+        return toAssertion('HOSTNAME_VERIFIED', 'EQUALS', target);
+    }
+}
+/** Whether the certificate chain is trusted (boolean). */
+class ChainTrustedAssertionBuilder {
+    equals(target) {
+        return toAssertion('CHAIN_TRUSTED', 'EQUALS', target);
+    }
+}
+/** Whether a stapled OCSP response was provided during the handshake (boolean). */
+class OcspStapledAssertionBuilder {
+    equals(target) {
+        return toAssertion('OCSP_STAPLED', 'EQUALS', target);
+    }
+}
+/** Negotiated TLS version — `.equals()` accepts only known TLS version strings. */
+class TlsVersionAssertionBuilder {
+    equals(target) {
+        return toAssertion('TLS_VERSION', 'EQUALS', target);
+    }
+}
+/**
+ * Certificate signature algorithm. `.equals()` takes a Go
+ * `x509.Certificate.SignatureAlgorithm.String()` value; `.matches()` takes a regex.
+ */
+class SignatureAlgorithmAssertionBuilder {
+    equals(target) {
+        return toAssertion('SIGNATURE_ALGORITHM', 'EQUALS', target);
+    }
+    matches(target) {
+        return toAssertion('SIGNATURE_ALGORITHM', 'MATCHES', target);
+    }
+}
+/** Negotiated cipher suite (string) — exact, not-equal, or regex match. */
+class CipherSuiteAssertionBuilder {
+    equals(target) {
+        return toAssertion('CIPHER_SUITE', 'EQUALS', target);
+    }
+    notEquals(target) {
+        return toAssertion('CIPHER_SUITE', 'NOT_EQUALS', target);
+    }
+    matches(target) {
+        return toAssertion('CIPHER_SUITE', 'MATCHES', target);
+    }
+}
+/** Certificate issuer common name (string) — exact, not-equal, or regex match. */
+class IssuerCnAssertionBuilder {
+    equals(target) {
+        return toAssertion('ISSUER_CN', 'EQUALS', target);
+    }
+    notEquals(target) {
+        return toAssertion('ISSUER_CN', 'NOT_EQUALS', target);
+    }
+    matches(target) {
+        return toAssertion('ISSUER_CN', 'MATCHES', target);
+    }
+}
+/** Certificate SHA-256 fingerprint (string, exact match only). */
+class CertFingerprintSha256AssertionBuilder {
+    equals(target) {
+        return toAssertion('CERT_FINGERPRINT_SHA256', 'EQUALS', target);
+    }
+}
+/** Issuer SHA-256 fingerprint (string, exact match only). */
+class IssuerFingerprintSha256AssertionBuilder {
+    equals(target) {
+        return toAssertion('ISSUER_FINGERPRINT_SHA256', 'EQUALS', target);
+    }
+}
+/**
+ * Builder class for creating SSL monitor assertions.
+ * Provides methods to create assertions for TLS certificates.
+ *
+ * @example
+ * ```typescript
+ * // Alert when the certificate is within 30 days of expiry
+ * SslAssertionBuilder.certExpiresInDays().greaterThan(30)
+ *
+ * // Require a trusted chain and a verified hostname
+ * SslAssertionBuilder.chainTrusted().equals(true)
+ * SslAssertionBuilder.hostnameVerified().equals(true)
+ *
+ * // Enforce a specific TLS version and key size
+ * SslAssertionBuilder.tlsVersion().equals('TLS1.3')
+ * SslAssertionBuilder.keySizeBits().equals(2048)
+ *
+ * // Match the issuer or cipher suite against a regex
+ * SslAssertionBuilder.issuerCn().matches("^Let's Encrypt")
+ * SslAssertionBuilder.cipherSuite().matches('TLS_(AES|CHACHA)')
+ * ```
+ */
+export class SslAssertionBuilder {
+    /** Assertion builder for the number of days until the certificate expires. */
+    static certExpiresInDays() {
+        return new CertExpiresInDaysAssertionBuilder();
+    }
+    /** Assertion builder for the certificate key size in bits. */
+    static keySizeBits() {
+        return new KeySizeBitsAssertionBuilder();
+    }
+    /** Assertion builder for whether the certificate is not expired. */
+    static certNotExpired() {
+        return new CertNotExpiredAssertionBuilder();
+    }
+    /** Assertion builder for whether the hostname is verified. */
+    static hostnameVerified() {
+        return new HostnameVerifiedAssertionBuilder();
+    }
+    /** Assertion builder for whether the certificate chain is trusted. */
+    static chainTrusted() {
+        return new ChainTrustedAssertionBuilder();
+    }
+    /**
+     * Assertion builder for the negotiated TLS version. `.equals()` accepts only the
+     * known TLS version strings — use the {@link TlsVersion} constants or the string
+     * literals `'TLS1.0'`…`'TLS1.3'`.
+     */
+    static tlsVersion() {
+        return new TlsVersionAssertionBuilder();
+    }
+    /**
+     * Assertion builder for the negotiated cipher suite. Go's `tls.CipherSuiteName()`
+     * can return hundreds of IANA names plus `0x....` hex fallbacks, so `.equals()` is
+     * unconstrained; use the {@link CipherSuite} constants for common suites, or
+     * `.matches()` with a regex pattern.
+     */
+    static cipherSuite() {
+        return new CipherSuiteAssertionBuilder();
+    }
+    /** Assertion builder for the certificate issuer common name. */
+    static issuerCn() {
+        return new IssuerCnAssertionBuilder();
+    }
+    /** Assertion builder for the certificate SHA-256 fingerprint. */
+    static certFingerprintSha256() {
+        return new CertFingerprintSha256AssertionBuilder();
+    }
+    /** Assertion builder for the issuer SHA-256 fingerprint. */
+    static issuerFingerprintSha256() {
+        return new IssuerFingerprintSha256AssertionBuilder();
+    }
+    /**
+     * Assertion builder for the certificate signature algorithm. `.equals()` takes a
+     * Go `x509.Certificate.SignatureAlgorithm.String()` value (e.g. `'SHA256-RSA'`) —
+     * use the {@link SignatureAlgorithm} constants — or `.matches()` with a regex.
+     */
+    static signatureAlgorithm() {
+        return new SignatureAlgorithmAssertionBuilder();
+    }
+    /** Assertion builder for whether a stapled OCSP response was provided. */
+    static ocspStapled() {
+        return new OcspStapledAssertionBuilder();
+    }
+}
+//# sourceMappingURL=ssl-assertion.js.map