checkly 8.16.0 → 8.17.0-prerelease-b6e0d74

package/dist/constructs/ssl-assertion-grammar.js

@@ -0,0 +1,90 @@
+import { booleanTarget, comparisonsForGrammar, defineGrammar, numberTarget, stringTarget, valueTypeForGrammar, } from './internal/assertion-grammar.js';
+// The single declaration of the SSL certificate/connection assertion grammar. Each row is
+// a property's entire contract — the operators it exposes and the type of its target. The
+// public `SslAssertionBuilder`, its property unions, the validation whitelist, and codegen
+// all derive from these two tables, so a property cannot gain an operator the whitelist
+// rejects, or a target type codegen renders wrong, without editing this one row.
+export const certificateGrammar = defineGrammar({
+    /** Days until the certificate expires (numeric). */
+    daysUntilExpiry: { operators: ['equals', 'notEquals', 'greaterThan', 'lessThan'], target: numberTarget() },
+    /** Certificate key size in bits (numeric). */
+    keySizeBits: { operators: ['equals', 'notEquals', 'greaterThan', 'lessThan'], target: numberTarget() },
+    /** Certificate subject common name (free-form string). */
+    subjectCN: { operators: ['equals', 'notEquals', 'contains', 'notContains'], target: stringTarget() },
+    /** Certificate issuer common name (free-form string). */
+    issuerCN: { operators: ['equals', 'notEquals', 'contains', 'notContains'], target: stringTarget() },
+    /** Certificate serial number — an opaque identifier, compared whole. */
+    serialNumber: { operators: ['equals', 'notEquals'], target: stringTarget() },
+    /** Certificate SHA-256 fingerprint — an opaque identifier, compared whole. */
+    fingerprintSha256: { operators: ['equals', 'notEquals'], target: stringTarget() },
+    /** Issuer SHA-256 fingerprint — an opaque identifier, compared whole. */
+    issuerFingerprintSha256: { operators: ['equals', 'notEquals'], target: stringTarget() },
+    /** Certificate public key algorithm (e.g. `'RSA'`, `'ECDSA'`), compared whole. */
+    keyAlgorithm: { operators: ['equals', 'notEquals'], target: stringTarget() },
+    /** Certificate signature algorithm — a Go `x509 SignatureAlgorithm.String()` value. */
+    signatureAlgorithm: { operators: ['equals', 'notEquals'], target: stringTarget() },
+    /** Certificate subject alternative names. A list, so only membership can be asserted. */
+    sans: { operators: ['contains', 'notContains'], target: stringTarget() },
+    /** Whether the certificate is self-signed (boolean). */
+    selfSigned: { operators: ['equals'], target: booleanTarget() },
+    /** Whether the certificate is a CA certificate (boolean). */
+    isCA: { operators: ['equals'], target: booleanTarget() },
+});
+export const connectionGrammar = defineGrammar({
+    /** Negotiated TLS version. Ordered, so `greaterThan` expresses a minimum. */
+    tlsVersion: { operators: ['equals', 'notEquals', 'greaterThan', 'lessThan'], target: stringTarget() },
+    /** Negotiated cipher suite (free-form string; hundreds of IANA names). */
+    cipherSuite: { operators: ['equals', 'notEquals', 'contains', 'notContains'], target: stringTarget() },
+    /** Whether the hostname is verified against the certificate (boolean). */
+    hostnameVerified: { operators: ['equals'], target: booleanTarget() },
+    /** Whether the certificate chain is trusted (boolean). */
+    chainTrusted: { operators: ['equals'], target: booleanTarget() },
+    /** Whether a stapled OCSP response was provided during the handshake (boolean). */
+    ocspStapled: { operators: ['equals'], target: booleanTarget() },
+    /** OCSP revocation status (e.g. `'good'`, `'revoked'`), compared whole. */
+    ocspStatus: { operators: ['equals', 'notEquals'], target: stringTarget() },
+    /** The IP address the hostname resolved to (free-form string). */
+    resolvedIp: { operators: ['equals', 'notEquals', 'contains', 'notContains'], target: stringTarget() },
+});
+const grammarBySource = {
+    CERTIFICATE: certificateGrammar,
+    CONNECTION: connectionGrammar,
+};
+function propertyGrammar(source, property) {
+    const grammar = Object.hasOwn(grammarBySource, source) ? grammarBySource[source] : undefined;
+    if (grammar === undefined || !Object.hasOwn(grammar, property)) {
+        return undefined;
+    }
+    return grammar[property];
+}
+/**
+ * The wire comparisons each property of a source accepts, keyed by property name. Empty for
+ * a source with no property-scoped grammar. Used by validation to reject an unsupported
+ * comparison written as an object literal.
+ */
+export function sslComparisonsForSource(source) {
+    const grammar = Object.hasOwn(grammarBySource, source) ? grammarBySource[source] : {};
+    return Object.fromEntries(Object.entries(grammar).map(([property, decl]) => [property, comparisonsForGrammar(decl)]));
+}
+/**
+ * How the target of a property-scoped SSL assertion is written, or `undefined` for a
+ * property the backend does not define. Callers must handle the unknown case: object
+ * literals bypass the builder's compile-time check and are reported by
+ * `validateSslAssertion` instead.
+ */
+export function sslPropertyValueType(source, property) {
+    const decl = propertyGrammar(source, property);
+    return decl === undefined ? undefined : valueTypeForGrammar(decl);
+}
+/**
+ * Whether a target is one this CLI treats as a number.
+ *
+ * Validation and codegen must agree: anything validation accepts, codegen has to render as
+ * a bare numeric literal, because the property's operators take a `number` and a quoted
+ * target would not compile. Targets are plain strings on the wire and reach here from object
+ * literals and remote monitors, so this is a runtime predicate rather than a type.
+ */
+export function isSslNumericTarget(target) {
+    return target.trim() !== '' && Number.isFinite(Number(target));
+}
+//# sourceMappingURL=ssl-assertion-grammar.js.map

package/dist/constructs/ssl-assertion-grammar.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"ssl-assertion-grammar.js","sourceRoot":"","sources":["../../src/constructs/ssl-assertion-grammar.ts"],"names":[],"mappings":"AAAA,OAAO,EAGL,aAAa,EACb,qBAAqB,EACrB,aAAa,EACb,YAAY,EACZ,YAAY,EACZ,mBAAmB,GACpB,MAAM,iCAAiC,CAAA;AAGxC,0FAA0F;AAC1F,0FAA0F;AAC1F,2FAA2F;AAC3F,wFAAwF;AACxF,iFAAiF;AAEjF,MAAM,CAAC,MAAM,kBAAkB,GAAG,aAAa,CAAC;IAC9C,oDAAoD;IACpD,eAAe,EAAE,EAAE,SAAS,EAAE,CAAC,QAAQ,EAAE,WAAW,EAAE,aAAa,EAAE,UAAU,CAAC,EAAE,MAAM,EAAE,YAAY,EAAE,EAAE;IAC1G,8CAA8C;IAC9C,WAAW,EAAE,EAAE,SAAS,EAAE,CAAC,QAAQ,EAAE,WAAW,EAAE,aAAa,EAAE,UAAU,CAAC,EAAE,MAAM,EAAE,YAAY,EAAE,EAAE;IACtG,0DAA0D;IAC1D,SAAS,EAAE,EAAE,SAAS,EAAE,CAAC,QAAQ,EAAE,WAAW,EAAE,UAAU,EAAE,aAAa,CAAC,EAAE,MAAM,EAAE,YAAY,EAAE,EAAE;IACpG,yDAAyD;IACzD,QAAQ,EAAE,EAAE,SAAS,EAAE,CAAC,QAAQ,EAAE,WAAW,EAAE,UAAU,EAAE,aAAa,CAAC,EAAE,MAAM,EAAE,YAAY,EAAE,EAAE;IACnG,wEAAwE;IACxE,YAAY,EAAE,EAAE,SAAS,EAAE,CAAC,QAAQ,EAAE,WAAW,CAAC,EAAE,MAAM,EAAE,YAAY,EAAE,EAAE;IAC5E,8EAA8E;IAC9E,iBAAiB,EAAE,EAAE,SAAS,EAAE,CAAC,QAAQ,EAAE,WAAW,CAAC,EAAE,MAAM,EAAE,YAAY,EAAE,EAAE;IACjF,yEAAyE;IACzE,uBAAuB,EAAE,EAAE,SAAS,EAAE,CAAC,QAAQ,EAAE,WAAW,CAAC,EAAE,MAAM,EAAE,YAAY,EAAE,EAAE;IACvF,kFAAkF;IAClF,YAAY,EAAE,EAAE,SAAS,EAAE,CAAC,QAAQ,EAAE,WAAW,CAAC,EAAE,MAAM,EAAE,YAAY,EAAE,EAAE;IAC5E,uFAAuF;IACvF,kBAAkB,EAAE,EAAE,SAAS,EAAE,CAAC,QAAQ,EAAE,WAAW,CAAC,EAAE,MAAM,EAAE,YAAY,EAA2B,EAAE;IAC3G,yFAAyF;IACzF,IAAI,EAAE,EAAE,SAAS,EAAE,CAAC,UAAU,EAAE,aAAa,CAAC,EAAE,MAAM,EAAE,YAAY,EAAE,EAAE;IACxE,wDAAwD;IACxD,UAAU,EAAE,EAAE,SAAS,EAAE,CAAC,QAAQ,CAAC,EAAE,MAAM,EAAE,aAAa,EAAE,EAAE;IAC9D,6DAA6D;IAC7D,IAAI,EAAE,EAAE,SAAS,EAAE,CAAC,QAAQ,CAAC,EAAE,MAAM,EAAE,aAAa,EAAE,EAAE;CACzD,CAAC,CAAA;AAEF,MAAM,CAAC,MAAM,iBAAiB,GAAG,aAAa,CAAC;IAC7C,6EAA6E;IAC7E,UAAU,EAAE,EAAE,SAAS,EAAE,CAAC,QAAQ,EAAE,WAAW,EAAE,aAAa,EAAE,UAAU,CAAC,EAAE,MAAM,EAAE,YAAY,EAAmB,EAAE;IACtH,0EAA0E;IAC1E,WAAW,EAAE,EAAE,SAAS,EAAE,CAAC,QAAQ,EAAE,WAAW,EAAE,UAAU,EAAE,aAAa,CAAC,EAAE,MAAM,EAAE,YAAY,EAAE,EAAE;IACtG,0EAA0E;IAC1E,gBAAgB,EAAE,EAAE,SAAS,EAAE,CAAC,QAAQ,CAAC,EAAE,MAAM,EAAE,aAAa,EAAE,EAAE;IACpE,0DAA0D;IAC1D,YAAY,EAAE,EAAE,SAAS,EAAE,CAAC,QAAQ,CAAC,EAAE,MAAM,EAAE,aAAa,EAAE,EAAE;IAChE,mFAAmF;IACnF,WAAW,EAAE,EAAE,SAAS,EAAE,CAAC,QAAQ,CAAC,EAAE,MAAM,EAAE,aAAa,EAAE,EAAE;IAC/D,2EAA2E;IAC3E,UAAU,EAAE,EAAE,SAAS,EAAE,CAAC,QAAQ,EAAE,WAAW,CAAC,EAAE,MAAM,EAAE,YAAY,EAAE,EAAE;IAC1E,kEAAkE;IAClE,UAAU,EAAE,EAAE,SAAS,EAAE,CAAC,QAAQ,EAAE,WAAW,EAAE,UAAU,EAAE,aAAa,CAAC,EAAE,MAAM,EAAE,YAAY,EAAE,EAAE;CACtG,CAAC,CAAA;AAEF,MAAM,eAAe,GAAoD;IACvE,WAAW,EAAE,kBAAkB;IAC/B,UAAU,EAAE,iBAAiB;CAC9B,CAAA;AAED,SAAS,eAAe,CAAE,MAAc,EAAE,QAAgB;IACxD,MAAM,OAAO,GAAG,MAAM,CAAC,MAAM,CAAC,eAAe,EAAE,MAAM,CAAC,CAAC,CAAC,CAAC,eAAe,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,SAAS,CAAA;IAC5F,IAAI,OAAO,KAAK,SAAS,IAAI,CAAC,MAAM,CAAC,MAAM,CAAC,OAAO,EAAE,QAAQ,CAAC,EAAE,CAAC;QAC/D,OAAO,SAAS,CAAA;IAClB,CAAC;IACD,OAAO,OAAO,CAAC,QAAQ,CAAC,CAAA;AAC1B,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,uBAAuB,CAAE,MAAc;IACrD,MAAM,OAAO,GAAG,MAAM,CAAC,MAAM,CAAC,eAAe,EAAE,MAAM,CAAC,CAAC,CAAC,CAAC,eAAe,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,EAAE,CAAA;IACrF,OAAO,MAAM,CAAC,WAAW,CACvB,MAAM,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,QAAQ,EAAE,IAAI,CAAC,EAAE,EAAE,CAAC,CAAC,QAAQ,EAAE,qBAAqB,CAAC,IAAI,CAAC,CAAC,CAAC,CAC3F,CAAA;AACH,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,oBAAoB,CAAE,MAAc,EAAE,QAAgB;IACpE,MAAM,IAAI,GAAG,eAAe,CAAC,MAAM,EAAE,QAAQ,CAAC,CAAA;IAC9C,OAAO,IAAI,KAAK,SAAS,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,mBAAmB,CAAC,IAAI,CAAC,CAAA;AACnE,CAAC;AAED;;;;;;;GAOG;AACH,MAAM,UAAU,kBAAkB,CAAE,MAAc;IAChD,OAAO,MAAM,CAAC,IAAI,EAAE,KAAK,EAAE,IAAI,MAAM,CAAC,QAAQ,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,CAAA;AAChE,CAAC"}

package/dist/constructs/ssl-assertion-validation.d.ts

@@ -1,13 +1,13 @@
 import { Diagnostics } from './diagnostics.js';
 import { SslAssertion } from './ssl-assertion.js';
 /**
- * Reports SSL assertions whose source, comparison or boolean target the backend does
- * not accept.
+ * Reports SSL assertions whose source, property, comparison or boolean target the
+ * backend does not accept.
  *
  * Assertions written as plain object literals bypass SslAssertionBuilder and are
- * type-legal, because the fields are declared as plain strings. The backend rejects
- * an unknown source or an operator not allowed for the source with a 400; a boolean
- * source with a non-`true`/`false` target is accepted at deploy but never matches at
- * evaluation, so it is reported too.
+ * type-legal, because the fields are declared as plain strings. The backend rejects an
+ * unknown source, an unknown property or an operator not allowed for the property with
+ * a 400; a boolean or numeric property whose target is not of that type is accepted at
+ * deploy but never matches at evaluation, so it is reported too.
  */
 export declare function validateSslAssertion(diagnostics: Diagnostics, assertion: SslAssertion, index: number): void;

package/dist/constructs/ssl-assertion-validation.js

@@ -1,30 +1,87 @@
 import { addAssertionDiagnostic, quotedKeys } from './internal/assertion-validation.js';
-// The operators the backend accepts per source, minus the CLI-dropped
-// GREATER_THAN_OR_EQUAL. Keyed by the source union so adding a source without a rule
-// fails to compile.
+import { isSslNumericTarget, sslComparisonsForSource, sslPropertyValueType } from './ssl-assertion-grammar.js';
+const NUMBER = { EQUALS: true, NOT_EQUALS: true, GREATER_THAN: true, LESS_THAN: true };
+// Keyed by the source union so adding a source without a rule fails to compile.
 const rules = {
-    CERT_EXPIRES_IN_DAYS: { comparisons: { EQUALS: true, NOT_EQUALS: true, GREATER_THAN: true, LESS_THAN: true } },
-    KEY_SIZE_BITS: { comparisons: { EQUALS: true } },
-    CERT_NOT_EXPIRED: { comparisons: { EQUALS: true }, booleanTarget: true },
-    HOSTNAME_VERIFIED: { comparisons: { EQUALS: true }, booleanTarget: true },
-    CHAIN_TRUSTED: { comparisons: { EQUALS: true }, booleanTarget: true },
-    OCSP_STAPLED: { comparisons: { EQUALS: true }, booleanTarget: true },
-    TLS_VERSION: { comparisons: { EQUALS: true } },
-    SIGNATURE_ALGORITHM: { comparisons: { EQUALS: true, MATCHES: true } },
-    CIPHER_SUITE: { comparisons: { EQUALS: true, NOT_EQUALS: true, MATCHES: true } },
-    ISSUER_CN: { comparisons: { EQUALS: true, NOT_EQUALS: true, MATCHES: true } },
-    CERT_FINGERPRINT_SHA256: { comparisons: { EQUALS: true } },
-    ISSUER_FINGERPRINT_SHA256: { comparisons: { EQUALS: true } },
+    CERTIFICATE: { properties: sslComparisonsForSource('CERTIFICATE') },
+    CONNECTION: { properties: sslComparisonsForSource('CONNECTION') },
+    RESPONSE_TIME: { comparisons: NUMBER, valueType: 'number' },
+    JSON_RESPONSE: {
+        comparisons: {
+            EQUALS: true,
+            NOT_EQUALS: true,
+            IS_EMPTY: true,
+            NOT_EMPTY: true,
+            GREATER_THAN: true,
+            LESS_THAN: true,
+            CONTAINS: true,
+            NOT_CONTAINS: true,
+            IS_NULL: true,
+            NOT_NULL: true,
+        },
+    },
+    TEXT_RESPONSE: {
+        comparisons: {
+            EQUALS: true,
+            NOT_EQUALS: true,
+            IS_EMPTY: true,
+            NOT_EMPTY: true,
+            CONTAINS: true,
+            NOT_CONTAINS: true,
+            GREATER_THAN: true,
+            LESS_THAN: true,
+        },
+    },
 };
+function isPropertyScoped(rule) {
+    return 'properties' in rule;
+}
+function formatValue(value) {
+    return value === '' ? '(none)' : `"${value}"`;
+}
 /**
- * Reports SSL assertions whose source, comparison or boolean target the backend does
- * not accept.
+ * Reports a target that is not of the value type its source or property expects.
+ *
+ * Target *values* are checked where the accepted set is universal — booleans are two
+ * values, numbers are a total predicate — so a typo is a pure footgun the backend will not
+ * catch: it accepts any target string at deploy and simply never matches at evaluation,
+ * leaving an assertion that looks configured but silently never fires.
+ *
+ * The closed *enumerated* sets (tlsVersion, signatureAlgorithm) are deliberately not
+ * checked: the builder's typed operators already constrain them, and restating their
+ * members here would duplicate the value unions.
+ */
+function validateTargetValue(diagnostics, assertion, location, valueType, subject) {
+    // `target` is declared a string, but object-literal assertions are not typechecked when
+    // a check file is loaded, so a hand-written `target: 30` or an omitted target reaches
+    // here as a non-string. Report it rather than dereferencing it — a TypeError out of
+    // validate() would abort the command with no location or message.
+    const target = assertion.target;
+    if (typeof target !== 'string') {
+        if (valueType !== undefined) {
+            addAssertionDiagnostic(diagnostics, `The ${subject} assertion at "${location}" must compare against a ${valueType} written as a string, `
+                + `but got ${JSON.stringify(target) ?? String(target)}.`);
+        }
+        return;
+    }
+    if (valueType === 'boolean' && target !== 'true' && target !== 'false') {
+        addAssertionDiagnostic(diagnostics, `The ${subject} assertion at "${location}" must compare against "true" or "false", `
+            + `but got "${target}".`);
+    }
+    if (valueType === 'number' && !isSslNumericTarget(target)) {
+        addAssertionDiagnostic(diagnostics, `The ${subject} assertion at "${location}" must compare against a number, `
+            + `but got ${formatValue(target)}.`);
+    }
+}
+/**
+ * Reports SSL assertions whose source, property, comparison or boolean target the
+ * backend does not accept.
  *
  * Assertions written as plain object literals bypass SslAssertionBuilder and are
- * type-legal, because the fields are declared as plain strings. The backend rejects
- * an unknown source or an operator not allowed for the source with a 400; a boolean
- * source with a non-`true`/`false` target is accepted at deploy but never matches at
- * evaluation, so it is reported too.
+ * type-legal, because the fields are declared as plain strings. The backend rejects an
+ * unknown source, an unknown property or an operator not allowed for the property with
+ * a 400; a boolean or numeric property whose target is not of that type is accepted at
+ * deploy but never matches at evaluation, so it is reported too.
  */
 export function validateSslAssertion(diagnostics, assertion, index) {
     const location = `request.assertions[${index}]`;
@@ -36,14 +93,26 @@ export function validateSslAssertion(diagnostics, assertion, index) {
             + `Expected one of ${quotedKeys(rules)}.`);
         return;
     }
-    if (!Object.hasOwn(rule.comparisons, assertion.comparison)) {
-        addAssertionDiagnostic(diagnostics, `The ${assertion.source} assertion at "${location}" has an unsupported comparison `
-            + `${assertion.comparison === '' ? '(none)' : `"${assertion.comparison}"`}. `
-            + `Expected one of ${quotedKeys(rule.comparisons)}.`);
+    if (!isPropertyScoped(rule)) {
+        if (!Object.hasOwn(rule.comparisons, assertion.comparison)) {
+            addAssertionDiagnostic(diagnostics, `The ${assertion.source} assertion at "${location}" has an unsupported comparison `
+                + `${formatValue(assertion.comparison)}. Expected one of ${quotedKeys(rule.comparisons)}.`);
+        }
+        validateTargetValue(diagnostics, assertion, location, rule.valueType, assertion.source);
+        return;
+    }
+    const comparisons = Object.hasOwn(rule.properties, assertion.property)
+        ? rule.properties[assertion.property]
+        : undefined;
+    if (comparisons === undefined) {
+        addAssertionDiagnostic(diagnostics, `The ${assertion.source} assertion at "${location}" has an unknown property `
+            + `${formatValue(assertion.property)}. Expected one of ${quotedKeys(rule.properties)}.`);
+        return;
     }
-    if (rule.booleanTarget && assertion.target !== 'true' && assertion.target !== 'false') {
-        addAssertionDiagnostic(diagnostics, `The ${assertion.source} assertion at "${location}" must compare against "true" or "false", `
-            + `but got "${assertion.target}".`);
+    if (!Object.hasOwn(comparisons, assertion.comparison)) {
+        addAssertionDiagnostic(diagnostics, `The ${assertion.source} "${assertion.property}" assertion at "${location}" has an unsupported comparison `
+            + `${formatValue(assertion.comparison)}. Expected one of ${quotedKeys(comparisons)}.`);
     }
+    validateTargetValue(diagnostics, assertion, location, sslPropertyValueType(assertion.source, assertion.property), `${assertion.source} "${assertion.property}"`);
 }
 //# sourceMappingURL=ssl-assertion-validation.js.map

package/dist/constructs/ssl-assertion-validation.js.map

@@ -1 +1 @@
-{"version":3,"file":"ssl-assertion-validation.js","sourceRoot":"","sources":["../../src/constructs/ssl-assertion-validation.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,sBAAsB,EAAE,UAAU,EAAE,MAAM,oCAAoC,CAAA;AAevF,sEAAsE;AACtE,qFAAqF;AACrF,oBAAoB;AACpB,MAAM,KAAK,GAAkD;IAC3D,oBAAoB,EAAE,EAAE,WAAW,EAAE,EAAE,MAAM,EAAE,IAAI,EAAE,UAAU,EAAE,IAAI,EAAE,YAAY,EAAE,IAAI,EAAE,SAAS,EAAE,IAAI,EAAE,EAAE;IAC9G,aAAa,EAAE,EAAE,WAAW,EAAE,EAAE,MAAM,EAAE,IAAI,EAAE,EAAE;IAChD,gBAAgB,EAAE,EAAE,WAAW,EAAE,EAAE,MAAM,EAAE,IAAI,EAAE,EAAE,aAAa,EAAE,IAAI,EAAE;IACxE,iBAAiB,EAAE,EAAE,WAAW,EAAE,EAAE,MAAM,EAAE,IAAI,EAAE,EAAE,aAAa,EAAE,IAAI,EAAE;IACzE,aAAa,EAAE,EAAE,WAAW,EAAE,EAAE,MAAM,EAAE,IAAI,EAAE,EAAE,aAAa,EAAE,IAAI,EAAE;IACrE,YAAY,EAAE,EAAE,WAAW,EAAE,EAAE,MAAM,EAAE,IAAI,EAAE,EAAE,aAAa,EAAE,IAAI,EAAE;IACpE,WAAW,EAAE,EAAE,WAAW,EAAE,EAAE,MAAM,EAAE,IAAI,EAAE,EAAE;IAC9C,mBAAmB,EAAE,EAAE,WAAW,EAAE,EAAE,MAAM,EAAE,IAAI,EAAE,OAAO,EAAE,IAAI,EAAE,EAAE;IACrE,YAAY,EAAE,EAAE,WAAW,EAAE,EAAE,MAAM,EAAE,IAAI,EAAE,UAAU,EAAE,IAAI,EAAE,OAAO,EAAE,IAAI,EAAE,EAAE;IAChF,SAAS,EAAE,EAAE,WAAW,EAAE,EAAE,MAAM,EAAE,IAAI,EAAE,UAAU,EAAE,IAAI,EAAE,OAAO,EAAE,IAAI,EAAE,EAAE;IAC7E,uBAAuB,EAAE,EAAE,WAAW,EAAE,EAAE,MAAM,EAAE,IAAI,EAAE,EAAE;IAC1D,yBAAyB,EAAE,EAAE,WAAW,EAAE,EAAE,MAAM,EAAE,IAAI,EAAE,EAAE;CAC7D,CAAA;AAED;;;;;;;;;GASG;AACH,MAAM,UAAU,oBAAoB,CAClC,WAAwB,EACxB,SAAuB,EACvB,KAAa;IAEb,MAAM,QAAQ,GAAG,sBAAsB,KAAK,GAAG,CAAA;IAE/C,MAAM,IAAI,GAAG,MAAM,CAAC,MAAM,CAAC,KAAK,EAAE,SAAS,CAAC,MAAM,CAAC;QACjD,CAAC,CAAC,KAAK,CAAC,SAAS,CAAC,MAAgC,CAAC;QACnD,CAAC,CAAC,SAAS,CAAA;IACb,IAAI,IAAI,KAAK,SAAS,EAAE,CAAC;QACvB,sBAAsB,CAAC,WAAW,EAChC,qBAAqB,QAAQ,4BAA4B,SAAS,CAAC,MAAM,KAAK;cAC5E,mBAAmB,UAAU,CAAC,KAAK,CAAC,GAAG,CAAC,CAAA;QAC5C,OAAM;IACR,CAAC;IAED,IAAI,CAAC,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,WAAW,EAAE,SAAS,CAAC,UAAU,CAAC,EAAE,CAAC;QAC3D,sBAAsB,CAAC,WAAW,EAChC,OAAO,SAAS,CAAC,MAAM,kBAAkB,QAAQ,kCAAkC;cACjF,GAAG,SAAS,CAAC,UAAU,KAAK,EAAE,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,IAAI,SAAS,CAAC,UAAU,GAAG,IAAI;cAC3E,mBAAmB,UAAU,CAAC,IAAI,CAAC,WAAW,CAAC,GAAG,CAAC,CAAA;IACzD,CAAC;IAED,IAAI,IAAI,CAAC,aAAa,IAAI,SAAS,CAAC,MAAM,KAAK,MAAM,IAAI,SAAS,CAAC,MAAM,KAAK,OAAO,EAAE,CAAC;QACtF,sBAAsB,CAAC,WAAW,EAChC,OAAO,SAAS,CAAC,MAAM,kBAAkB,QAAQ,4CAA4C;cAC3F,YAAY,SAAS,CAAC,MAAM,IAAI,CAAC,CAAA;IACvC,CAAC;AACH,CAAC"}
+{"version":3,"file":"ssl-assertion-validation.js","sourceRoot":"","sources":["../../src/constructs/ssl-assertion-validation.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,sBAAsB,EAAE,UAAU,EAAE,MAAM,oCAAoC,CAAA;AAEvF,OAAO,EAAE,kBAAkB,EAAE,uBAAuB,EAAE,oBAAoB,EAAE,MAAM,4BAA4B,CAAA;AAO9G,MAAM,MAAM,GAAgB,EAAE,MAAM,EAAE,IAAI,EAAE,UAAU,EAAE,IAAI,EAAE,YAAY,EAAE,IAAI,EAAE,SAAS,EAAE,IAAI,EAAE,CAAA;AAYnG,gFAAgF;AAChF,MAAM,KAAK,GAAkD;IAC3D,WAAW,EAAE,EAAE,UAAU,EAAE,uBAAuB,CAAC,aAAa,CAAC,EAAE;IACnE,UAAU,EAAE,EAAE,UAAU,EAAE,uBAAuB,CAAC,YAAY,CAAC,EAAE;IACjE,aAAa,EAAE,EAAE,WAAW,EAAE,MAAM,EAAE,SAAS,EAAE,QAAQ,EAAE;IAC3D,aAAa,EAAE;QACb,WAAW,EAAE;YACX,MAAM,EAAE,IAAI;YACZ,UAAU,EAAE,IAAI;YAChB,QAAQ,EAAE,IAAI;YACd,SAAS,EAAE,IAAI;YACf,YAAY,EAAE,IAAI;YAClB,SAAS,EAAE,IAAI;YACf,QAAQ,EAAE,IAAI;YACd,YAAY,EAAE,IAAI;YAClB,OAAO,EAAE,IAAI;YACb,QAAQ,EAAE,IAAI;SACf;KACF;IACD,aAAa,EAAE;QACb,WAAW,EAAE;YACX,MAAM,EAAE,IAAI;YACZ,UAAU,EAAE,IAAI;YAChB,QAAQ,EAAE,IAAI;YACd,SAAS,EAAE,IAAI;YACf,QAAQ,EAAE,IAAI;YACd,YAAY,EAAE,IAAI;YAClB,YAAY,EAAE,IAAI;YAClB,SAAS,EAAE,IAAI;SAChB;KACF;CACF,CAAA;AAED,SAAS,gBAAgB,CAAE,IAAmB;IAC5C,OAAO,YAAY,IAAI,IAAI,CAAA;AAC7B,CAAC;AAED,SAAS,WAAW,CAAE,KAAa;IACjC,OAAO,KAAK,KAAK,EAAE,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,IAAI,KAAK,GAAG,CAAA;AAC/C,CAAC;AAED;;;;;;;;;;;GAWG;AACH,SAAS,mBAAmB,CAC1B,WAAwB,EACxB,SAAuB,EACvB,QAAgB,EAChB,SAAsC,EACtC,OAAe;IAEf,wFAAwF;IACxF,sFAAsF;IACtF,oFAAoF;IACpF,kEAAkE;IAClE,MAAM,MAAM,GAAY,SAAS,CAAC,MAAM,CAAA;IACxC,IAAI,OAAO,MAAM,KAAK,QAAQ,EAAE,CAAC;QAC/B,IAAI,SAAS,KAAK,SAAS,EAAE,CAAC;YAC5B,sBAAsB,CAAC,WAAW,EAChC,OAAO,OAAO,kBAAkB,QAAQ,4BAA4B,SAAS,wBAAwB;kBACnG,WAAW,IAAI,CAAC,SAAS,CAAC,MAAM,CAAC,IAAI,MAAM,CAAC,MAAM,CAAC,GAAG,CAAC,CAAA;QAC7D,CAAC;QACD,OAAM;IACR,CAAC;IAED,IAAI,SAAS,KAAK,SAAS,IAAI,MAAM,KAAK,MAAM,IAAI,MAAM,KAAK,OAAO,EAAE,CAAC;QACvE,sBAAsB,CAAC,WAAW,EAChC,OAAO,OAAO,kBAAkB,QAAQ,4CAA4C;cAClF,YAAY,MAAM,IAAI,CAAC,CAAA;IAC7B,CAAC;IAED,IAAI,SAAS,KAAK,QAAQ,IAAI,CAAC,kBAAkB,CAAC,MAAM,CAAC,EAAE,CAAC;QAC1D,sBAAsB,CAAC,WAAW,EAChC,OAAO,OAAO,kBAAkB,QAAQ,mCAAmC;cACzE,WAAW,WAAW,CAAC,MAAM,CAAC,GAAG,CAAC,CAAA;IACxC,CAAC;AACH,CAAC;AAED;;;;;;;;;GASG;AACH,MAAM,UAAU,oBAAoB,CAClC,WAAwB,EACxB,SAAuB,EACvB,KAAa;IAEb,MAAM,QAAQ,GAAG,sBAAsB,KAAK,GAAG,CAAA;IAE/C,MAAM,IAAI,GAAG,MAAM,CAAC,MAAM,CAAC,KAAK,EAAE,SAAS,CAAC,MAAM,CAAC;QACjD,CAAC,CAAC,KAAK,CAAC,SAAS,CAAC,MAAgC,CAAC;QACnD,CAAC,CAAC,SAAS,CAAA;IACb,IAAI,IAAI,KAAK,SAAS,EAAE,CAAC;QACvB,sBAAsB,CAAC,WAAW,EAChC,qBAAqB,QAAQ,4BAA4B,SAAS,CAAC,MAAM,KAAK;cAC5E,mBAAmB,UAAU,CAAC,KAAK,CAAC,GAAG,CAAC,CAAA;QAC5C,OAAM;IACR,CAAC;IAED,IAAI,CAAC,gBAAgB,CAAC,IAAI,CAAC,EAAE,CAAC;QAC5B,IAAI,CAAC,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,WAAW,EAAE,SAAS,CAAC,UAAU,CAAC,EAAE,CAAC;YAC3D,sBAAsB,CAAC,WAAW,EAChC,OAAO,SAAS,CAAC,MAAM,kBAAkB,QAAQ,kCAAkC;kBACjF,GAAG,WAAW,CAAC,SAAS,CAAC,UAAU,CAAC,qBAAqB,UAAU,CAAC,IAAI,CAAC,WAAW,CAAC,GAAG,CAAC,CAAA;QAC/F,CAAC;QACD,mBAAmB,CAAC,WAAW,EAAE,SAAS,EAAE,QAAQ,EAAE,IAAI,CAAC,SAAS,EAAE,SAAS,CAAC,MAAM,CAAC,CAAA;QACvF,OAAM;IACR,CAAC;IAED,MAAM,WAAW,GAAG,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,UAAU,EAAE,SAAS,CAAC,QAAQ,CAAC;QACpE,CAAC,CAAC,IAAI,CAAC,UAAU,CAAC,SAAS,CAAC,QAAQ,CAAC;QACrC,CAAC,CAAC,SAAS,CAAA;IACb,IAAI,WAAW,KAAK,SAAS,EAAE,CAAC;QAC9B,sBAAsB,CAAC,WAAW,EAChC,OAAO,SAAS,CAAC,MAAM,kBAAkB,QAAQ,4BAA4B;cAC3E,GAAG,WAAW,CAAC,SAAS,CAAC,QAAQ,CAAC,qBAAqB,UAAU,CAAC,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,CAAA;QAC1F,OAAM;IACR,CAAC;IAED,IAAI,CAAC,MAAM,CAAC,MAAM,CAAC,WAAW,EAAE,SAAS,CAAC,UAAU,CAAC,EAAE,CAAC;QACtD,sBAAsB,CAAC,WAAW,EAChC,OAAO,SAAS,CAAC,MAAM,KAAK,SAAS,CAAC,QAAQ,mBAAmB,QAAQ,kCAAkC;cACzG,GAAG,WAAW,CAAC,SAAS,CAAC,UAAU,CAAC,qBAAqB,UAAU,CAAC,WAAW,CAAC,GAAG,CAAC,CAAA;IAC1F,CAAC;IAED,mBAAmB,CACjB,WAAW,EACX,SAAS,EACT,QAAQ,EACR,oBAAoB,CAAC,SAAS,CAAC,MAAM,EAAE,SAAS,CAAC,QAAQ,CAAC,EAC1D,GAAG,SAAS,CAAC,MAAM,KAAK,SAAS,CAAC,QAAQ,GAAG,CAC9C,CAAA;AACH,CAAC"}

package/dist/constructs/ssl-assertion.d.ts

@@ -1,10 +1,13 @@
-import { Assertion as CoreAssertion } from './internal/assertion.js';
+import { Assertion as CoreAssertion, GeneralAssertionBuilder, NumericAssertionBuilder } from './internal/assertion.js';
+import { PropertyOperators } from './internal/assertion-grammar.js';
+import { certificateGrammar, connectionGrammar } from './ssl-assertion-grammar.js';
 /**
- * Known TLS protocol versions for use with {@link SslAssertionBuilder.tlsVersion}.
+ * Known TLS protocol versions for use as a target of the `tlsVersion` property on
+ * the {@link SslAssertionBuilder.connection} builder.
  *
  * @example
  * ```typescript
- * SslAssertionBuilder.tlsVersion().equals(TlsVersion.TLS1_3)
+ * SslAssertionBuilder.connection('tlsVersion').equals(TlsVersion.TLS1_3)
  * ```
  */
 export declare const TlsVersion: {
@@ -17,11 +20,12 @@ export type TlsVersionValue = (typeof TlsVersion)[keyof typeof TlsVersion];
 /**
  * Signature algorithms as reported by Go's `x509.Certificate.SignatureAlgorithm.String()`.
  * These are the exact values the SSL runner evaluates assertions against — use these
- * constants (or the string literals they represent) with {@link SslAssertionBuilder.signatureAlgorithm}.
+ * constants (or the string literals they represent) as a target of the
+ * `signatureAlgorithm` property on the {@link SslAssertionBuilder.certificate} builder.
  *
  * @example
  * ```typescript
- * SslAssertionBuilder.signatureAlgorithm().equals(SignatureAlgorithm.SHA256_RSA)
+ * SslAssertionBuilder.certificate('signatureAlgorithm').equals(SignatureAlgorithm.SHA256_RSA)
  * ```
  */
 export declare const SignatureAlgorithm: {
@@ -44,14 +48,14 @@ export declare const SignatureAlgorithm: {
 };
 export type SignatureAlgorithmValue = (typeof SignatureAlgorithm)[keyof typeof SignatureAlgorithm];
 /**
- * Commonly-used IANA cipher suite names for use with
- * {@link SslAssertionBuilder.cipherSuite}. Includes TLS 1.3 suites and
- * widely-deployed TLS 1.2 suites.
+ * Commonly-used IANA cipher suite names for use as a target of the `cipherSuite`
+ * property on the {@link SslAssertionBuilder.connection} builder. Includes TLS 1.3
+ * suites and widely-deployed TLS 1.2 suites.
  *
  * @example
  * ```typescript
- * SslAssertionBuilder.cipherSuite().equals(CipherSuite.TLS_AES_256_GCM_SHA384)
- * SslAssertionBuilder.cipherSuite().equals(CipherSuite.TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256)
+ * SslAssertionBuilder.connection('cipherSuite').equals(CipherSuite.TLS_AES_256_GCM_SHA384)
+ * SslAssertionBuilder.connection('cipherSuite').equals(CipherSuite.TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256)
  * ```
  */
 export declare const CipherSuite: {
@@ -72,126 +76,67 @@ export declare const CipherSuite: {
     readonly TLS_RSA_WITH_AES_256_CBC_SHA: "TLS_RSA_WITH_AES_256_CBC_SHA";
 };
 export type CipherSuiteValue = (typeof CipherSuite)[keyof typeof CipherSuite];
-type SslAssertionSource = 'CERT_EXPIRES_IN_DAYS' | 'CERT_NOT_EXPIRED' | 'HOSTNAME_VERIFIED' | 'CHAIN_TRUSTED' | 'TLS_VERSION' | 'CIPHER_SUITE' | 'ISSUER_CN' | 'CERT_FINGERPRINT_SHA256' | 'ISSUER_FINGERPRINT_SHA256' | 'KEY_SIZE_BITS' | 'SIGNATURE_ALGORITHM' | 'OCSP_STAPLED';
+type SslAssertionSource = 'CERTIFICATE' | 'CONNECTION' | 'RESPONSE_TIME' | 'JSON_RESPONSE' | 'TEXT_RESPONSE';
 export type SslAssertion = CoreAssertion<SslAssertionSource>;
-/** Days until the certificate expires (numeric). */
-declare class CertExpiresInDaysAssertionBuilder {
-    equals(target: number): SslAssertion;
-    notEquals(target: number): SslAssertion;
-    lessThan(target: number): SslAssertion;
-    greaterThan(target: number): SslAssertion;
-}
-/** Certificate key size in bits (numeric, exact match only). */
-declare class KeySizeBitsAssertionBuilder {
-    equals(target: number): SslAssertion;
-}
-/** Whether the certificate is not expired (boolean). */
-declare class CertNotExpiredAssertionBuilder {
-    equals(target: boolean): SslAssertion;
-}
-/** Whether the hostname is verified (boolean). */
-declare class HostnameVerifiedAssertionBuilder {
-    equals(target: boolean): SslAssertion;
-}
-/** Whether the certificate chain is trusted (boolean). */
-declare class ChainTrustedAssertionBuilder {
-    equals(target: boolean): SslAssertion;
-}
-/** Whether a stapled OCSP response was provided during the handshake (boolean). */
-declare class OcspStapledAssertionBuilder {
-    equals(target: boolean): SslAssertion;
-}
-/** Negotiated TLS version — `.equals()` accepts only known TLS version strings. */
-declare class TlsVersionAssertionBuilder {
-    equals(target: TlsVersionValue): SslAssertion;
-}
-/**
- * Certificate signature algorithm. `.equals()` takes a Go
- * `x509.Certificate.SignatureAlgorithm.String()` value; `.matches()` takes a regex.
- */
-declare class SignatureAlgorithmAssertionBuilder {
-    equals(target: SignatureAlgorithmValue): SslAssertion;
-    matches(target: string): SslAssertion;
-}
-/** Negotiated cipher suite (string) — exact, not-equal, or regex match. */
-declare class CipherSuiteAssertionBuilder {
-    equals(target: string): SslAssertion;
-    notEquals(target: string): SslAssertion;
-    matches(target: string): SslAssertion;
-}
-/** Certificate issuer common name (string) — exact, not-equal, or regex match. */
-declare class IssuerCnAssertionBuilder {
-    equals(target: string): SslAssertion;
-    notEquals(target: string): SslAssertion;
-    matches(target: string): SslAssertion;
-}
-/** Certificate SHA-256 fingerprint (string, exact match only). */
-declare class CertFingerprintSha256AssertionBuilder {
-    equals(target: string): SslAssertion;
-}
-/** Issuer SHA-256 fingerprint (string, exact match only). */
-declare class IssuerFingerprintSha256AssertionBuilder {
-    equals(target: string): SslAssertion;
-}
+/** The certificate properties an assertion can be made against. */
+export type SslCertificateProperty = keyof typeof certificateGrammar;
+/** The connection properties an assertion can be made against. */
+export type SslConnectionProperty = keyof typeof connectionGrammar;
 /**
  * Builder class for creating SSL monitor assertions.
- * Provides methods to create assertions for TLS certificates.
+ *
+ * Assertions are property-scoped: {@link certificate} and {@link connection} take the
+ * name of a certificate/connection property, {@link jsonResponse} takes a JSONPath and
+ * {@link textResponse} an optional regex. The comparison operators the backend accepts
+ * depend on the property's value type and are validated at deploy time.
  *
  * @example
  * ```typescript
- * // Alert when the certificate is within 30 days of expiry
- * SslAssertionBuilder.certExpiresInDays().greaterThan(30)
+ * // Certificate facts, addressed by property name
+ * SslAssertionBuilder.certificate('daysUntilExpiry').greaterThan(30)
+ * SslAssertionBuilder.certificate('issuerCN').contains("Let's Encrypt")
+ * SslAssertionBuilder.certificate('signatureAlgorithm').equals(SignatureAlgorithm.SHA256_RSA)
+ * SslAssertionBuilder.certificate('selfSigned').equals(false)
  *
- * // Require a trusted chain and a verified hostname
- * SslAssertionBuilder.chainTrusted().equals(true)
- * SslAssertionBuilder.hostnameVerified().equals(true)
+ * // Connection / handshake facts
+ * SslAssertionBuilder.connection('tlsVersion').equals(TlsVersion.TLS1_3)
+ * SslAssertionBuilder.connection('cipherSuite').equals(CipherSuite.TLS_AES_256_GCM_SHA384)
+ * SslAssertionBuilder.connection('chainTrusted').equals(true)
  *
- * // Enforce a specific TLS version and key size
- * SslAssertionBuilder.tlsVersion().equals('TLS1.3')
- * SslAssertionBuilder.keySizeBits().equals(2048)
- *
- * // Match the issuer or cipher suite against a regex
- * SslAssertionBuilder.issuerCn().matches("^Let's Encrypt")
- * SslAssertionBuilder.cipherSuite().matches('TLS_(AES|CHACHA)')
+ * // Response time, JSON and text responses
+ * SslAssertionBuilder.responseTime().lessThan(1000)
+ * SslAssertionBuilder.jsonResponse('$.status').equals('ok')
+ * SslAssertionBuilder.textResponse().contains('healthy')
  * ```
  */
 export declare class SslAssertionBuilder {
-    /** Assertion builder for the number of days until the certificate expires. */
-    static certExpiresInDays(): CertExpiresInDaysAssertionBuilder;
-    /** Assertion builder for the certificate key size in bits. */
-    static keySizeBits(): KeySizeBitsAssertionBuilder;
-    /** Assertion builder for whether the certificate is not expired. */
-    static certNotExpired(): CertNotExpiredAssertionBuilder;
-    /** Assertion builder for whether the hostname is verified. */
-    static hostnameVerified(): HostnameVerifiedAssertionBuilder;
-    /** Assertion builder for whether the certificate chain is trusted. */
-    static chainTrusted(): ChainTrustedAssertionBuilder;
     /**
-     * Assertion builder for the negotiated TLS version. `.equals()` accepts only the
-     * known TLS version strings — use the {@link TlsVersion} constants or the string
-     * literals `'TLS1.0'`…`'TLS1.3'`.
+     * Creates an assertion builder for a certificate property.
+     * @param property The certificate property to assert on (e.g. `'daysUntilExpiry'`,
+     *   `'issuerCN'`, `'signatureAlgorithm'`, `'sans'`, `'selfSigned'`).
+     */
+    static certificate<Property extends SslCertificateProperty>(property: Property): PropertyOperators<'CERTIFICATE', typeof certificateGrammar[Property]>;
+    /**
+     * Creates an assertion builder for a connection property.
+     * @param property The connection property to assert on (e.g. `'tlsVersion'`,
+     *   `'cipherSuite'`, `'hostnameVerified'`, `'ocspStatus'`, `'resolvedIp'`).
+     */
+    static connection<Property extends SslConnectionProperty>(property: Property): PropertyOperators<'CONNECTION', typeof connectionGrammar[Property]>;
+    /**
+     * Creates an assertion builder for the TLS handshake response time in milliseconds.
      */
-    static tlsVersion(): TlsVersionAssertionBuilder;
+    static responseTime(): NumericAssertionBuilder<SslAssertionSource, string>;
     /**
-     * Assertion builder for the negotiated cipher suite. Go's `tls.CipherSuiteName()`
-     * can return hundreds of IANA names plus `0x....` hex fallbacks, so `.equals()` is
-     * unconstrained; use the {@link CipherSuite} constants for common suites, or
-     * `.matches()` with a regex pattern.
+     * Creates an assertion builder for a JSON response body.
+     * @param property Optional JSONPath to a specific value (e.g. `'$.status'`).
      */
-    static cipherSuite(): CipherSuiteAssertionBuilder;
-    /** Assertion builder for the certificate issuer common name. */
-    static issuerCn(): IssuerCnAssertionBuilder;
-    /** Assertion builder for the certificate SHA-256 fingerprint. */
-    static certFingerprintSha256(): CertFingerprintSha256AssertionBuilder;
-    /** Assertion builder for the issuer SHA-256 fingerprint. */
-    static issuerFingerprintSha256(): IssuerFingerprintSha256AssertionBuilder;
+    static jsonResponse(property?: string): GeneralAssertionBuilder<SslAssertionSource, string | number | boolean>;
     /**
-     * Assertion builder for the certificate signature algorithm. `.equals()` takes a
-     * Go `x509.Certificate.SignatureAlgorithm.String()` value (e.g. `'SHA256-RSA'`) —
-     * use the {@link SignatureAlgorithm} constants — or `.matches()` with a regex.
+     * Creates an assertion builder for a text response body.
+     * @param regex Optional regex pattern (with a capture group) used to extract the value
+     *   to compare from the serialized response document. Carried in the assertion's
+     *   `property` field — the slot the backend and runner read the pattern from.
      */
-    static signatureAlgorithm(): SignatureAlgorithmAssertionBuilder;
-    /** Assertion builder for whether a stapled OCSP response was provided. */
-    static ocspStapled(): OcspStapledAssertionBuilder;
+    static textResponse(regex?: string): GeneralAssertionBuilder<SslAssertionSource, string | number | boolean>;
 }
 export {};