checkly 8.16.0 → 8.17.1-prerelease-14d5b2d

package/dist/constructs/ssl-assertion-codegen.js

@@ -1,34 +1,72 @@
 import { unsupportedAssertionSource, valueForBooleanAssertion, valueForGeneralAssertion, valueForNumericAssertion, } from './internal/assertion-codegen.js';
-const generalNoArgs = { hasProperty: false, hasRegex: false };
-// The string sources additionally accept the MATCHES (regex) operator.
-const generalWithMatches = { hasProperty: false, hasRegex: false, hasMatches: true };
+import { isSslNumericTarget, sslPropertyValueType } from './ssl-assertion-grammar.js';
+// Every SSL source addresses its value through the property slot — CERTIFICATE /
+// CONNECTION use a field selector, JSON_RESPONSE a JSONPath, and TEXT_RESPONSE a
+// regex (the backend and runner read the TEXT_RESPONSE pattern from `property`,
+// not `regex`). The regex slot is never emitted.
+const withProperty = { hasProperty: true, hasRegex: false };
+// The comparisons each typed helper can render. A comparison outside the set makes the
+// helper throw, which would abort the whole import over a single assertion, so the
+// dispatch below checks membership rather than relying on the throw. Exported so the
+// grammar consistency spec can assert numeric properties declare only operators this
+// renders, rather than restating the set.
+export const numericComparisons = {
+    EQUALS: true, NOT_EQUALS: true, GREATER_THAN: true, LESS_THAN: true,
+};
+// The boolean helper renders only EQUALS as a bare boolean literal; any other comparison
+// falls through to the quoted-string form, which would not compile against a boolean
+// operator. The grammar spec asserts boolean properties declare only this.
+export const booleanComparisons = {
+    EQUALS: true,
+};
+// The operators for a numeric or boolean property take a `number` / `boolean`, so their
+// targets must be emitted as bare literals rather than quoted strings — otherwise the
+// generated code does not compile.
+//
+// Each typed path is guarded on the assertion actually fitting it, because remote data is
+// not bound by the builder's types: the backend accepts any target string, so a monitor
+// created via the UI or API can carry `selfSigned = 'yes'` or `keySizeBits = ''`. Coercing
+// those would silently rewrite the assertion on the next deploy ('yes' would become
+// `false`), so they fall through to the string form, which round-trips the value untouched
+// and is reported by validateSslAssertion instead.
+function valueForPropertyScopedAssertion(method, assertion) {
+    const valueType = sslPropertyValueType(assertion.source, assertion.property);
+    // Rendered with Number, not the helper's default parseInt: isSslNumericTarget has
+    // already established the whole target is a number, and parseInt would truncate '30.5'
+    // to 30 — a silently different assertion on the next deploy. Sharing the predicate with
+    // validateSslAssertion is what keeps the two honest: every target validation accepts is
+    // rendered as a numeric literal the property's operators take, so no assertion the CLI
+    // calls valid is emitted as code that does not compile.
+    const isRenderableNumber = valueType === 'number'
+        && Object.hasOwn(numericComparisons, assertion.comparison)
+        && isSslNumericTarget(assertion.target);
+    if (isRenderableNumber) {
+        return valueForNumericAssertion('SslAssertionBuilder', method, assertion, {
+            hasProperty: true,
+            parse: Number,
+        });
+    }
+    const isRenderableBoolean = valueType === 'boolean'
+        && Object.hasOwn(booleanComparisons, assertion.comparison)
+        && (assertion.target === 'true' || assertion.target === 'false');
+    if (isRenderableBoolean) {
+        return valueForBooleanAssertion('SslAssertionBuilder', method, assertion, { hasProperty: true });
+    }
+    return valueForGeneralAssertion('SslAssertionBuilder', method, assertion, withProperty);
+}
 export function valueForSslAssertion(genfile, assertion) {
     genfile.namedImport('SslAssertionBuilder', 'checkly/constructs');
     switch (assertion.source) {
-        case 'CERT_EXPIRES_IN_DAYS':
-            return valueForNumericAssertion('SslAssertionBuilder', 'certExpiresInDays', assertion);
-        case 'KEY_SIZE_BITS':
-            return valueForNumericAssertion('SslAssertionBuilder', 'keySizeBits', assertion);
-        case 'CERT_NOT_EXPIRED':
-            return valueForBooleanAssertion('SslAssertionBuilder', 'certNotExpired', assertion);
-        case 'HOSTNAME_VERIFIED':
-            return valueForBooleanAssertion('SslAssertionBuilder', 'hostnameVerified', assertion);
-        case 'CHAIN_TRUSTED':
-            return valueForBooleanAssertion('SslAssertionBuilder', 'chainTrusted', assertion);
-        case 'OCSP_STAPLED':
-            return valueForBooleanAssertion('SslAssertionBuilder', 'ocspStapled', assertion);
-        case 'TLS_VERSION':
-            return valueForGeneralAssertion('SslAssertionBuilder', 'tlsVersion', assertion, generalNoArgs);
-        case 'CIPHER_SUITE':
-            return valueForGeneralAssertion('SslAssertionBuilder', 'cipherSuite', assertion, generalWithMatches);
-        case 'ISSUER_CN':
-            return valueForGeneralAssertion('SslAssertionBuilder', 'issuerCn', assertion, generalWithMatches);
-        case 'CERT_FINGERPRINT_SHA256':
-            return valueForGeneralAssertion('SslAssertionBuilder', 'certFingerprintSha256', assertion, generalNoArgs);
-        case 'ISSUER_FINGERPRINT_SHA256':
-            return valueForGeneralAssertion('SslAssertionBuilder', 'issuerFingerprintSha256', assertion, generalNoArgs);
-        case 'SIGNATURE_ALGORITHM':
-            return valueForGeneralAssertion('SslAssertionBuilder', 'signatureAlgorithm', assertion, generalWithMatches);
+        case 'CERTIFICATE':
+            return valueForPropertyScopedAssertion('certificate', assertion);
+        case 'CONNECTION':
+            return valueForPropertyScopedAssertion('connection', assertion);
+        case 'JSON_RESPONSE':
+            return valueForGeneralAssertion('SslAssertionBuilder', 'jsonResponse', assertion, withProperty);
+        case 'TEXT_RESPONSE':
+            return valueForGeneralAssertion('SslAssertionBuilder', 'textResponse', assertion, withProperty);
+        case 'RESPONSE_TIME':
+            return valueForNumericAssertion('SslAssertionBuilder', 'responseTime', assertion);
         default:
             return unsupportedAssertionSource(assertion.source, 'SSL');
     }

package/dist/constructs/ssl-assertion-codegen.js.map

@@ -1 +1 @@
-{"version":3,"file":"ssl-assertion-codegen.js","sourceRoot":"","sources":["../../src/constructs/ssl-assertion-codegen.ts"],"names":[],"mappings":"AACA,OAAO,EACL,0BAA0B,EAC1B,wBAAwB,EACxB,wBAAwB,EACxB,wBAAwB,GACzB,MAAM,iCAAiC,CAAA;AAGxC,MAAM,aAAa,GAAG,EAAE,WAAW,EAAE,KAAK,EAAE,QAAQ,EAAE,KAAK,EAAE,CAAA;AAC7D,uEAAuE;AACvE,MAAM,kBAAkB,GAAG,EAAE,WAAW,EAAE,KAAK,EAAE,QAAQ,EAAE,KAAK,EAAE,UAAU,EAAE,IAAI,EAAE,CAAA;AAEpF,MAAM,UAAU,oBAAoB,CAAE,OAAsB,EAAE,SAAuB;IACnF,OAAO,CAAC,WAAW,CAAC,qBAAqB,EAAE,oBAAoB,CAAC,CAAA;IAEhE,QAAQ,SAAS,CAAC,MAAM,EAAE,CAAC;QACzB,KAAK,sBAAsB;YACzB,OAAO,wBAAwB,CAAC,qBAAqB,EAAE,mBAAmB,EAAE,SAAS,CAAC,CAAA;QACxF,KAAK,eAAe;YAClB,OAAO,wBAAwB,CAAC,qBAAqB,EAAE,aAAa,EAAE,SAAS,CAAC,CAAA;QAClF,KAAK,kBAAkB;YACrB,OAAO,wBAAwB,CAAC,qBAAqB,EAAE,gBAAgB,EAAE,SAAS,CAAC,CAAA;QACrF,KAAK,mBAAmB;YACtB,OAAO,wBAAwB,CAAC,qBAAqB,EAAE,kBAAkB,EAAE,SAAS,CAAC,CAAA;QACvF,KAAK,eAAe;YAClB,OAAO,wBAAwB,CAAC,qBAAqB,EAAE,cAAc,EAAE,SAAS,CAAC,CAAA;QACnF,KAAK,cAAc;YACjB,OAAO,wBAAwB,CAAC,qBAAqB,EAAE,aAAa,EAAE,SAAS,CAAC,CAAA;QAClF,KAAK,aAAa;YAChB,OAAO,wBAAwB,CAAC,qBAAqB,EAAE,YAAY,EAAE,SAAS,EAAE,aAAa,CAAC,CAAA;QAChG,KAAK,cAAc;YACjB,OAAO,wBAAwB,CAAC,qBAAqB,EAAE,aAAa,EAAE,SAAS,EAAE,kBAAkB,CAAC,CAAA;QACtG,KAAK,WAAW;YACd,OAAO,wBAAwB,CAAC,qBAAqB,EAAE,UAAU,EAAE,SAAS,EAAE,kBAAkB,CAAC,CAAA;QACnG,KAAK,yBAAyB;YAC5B,OAAO,wBAAwB,CAAC,qBAAqB,EAAE,uBAAuB,EAAE,SAAS,EAAE,aAAa,CAAC,CAAA;QAC3G,KAAK,2BAA2B;YAC9B,OAAO,wBAAwB,CAAC,qBAAqB,EAAE,yBAAyB,EAAE,SAAS,EAAE,aAAa,CAAC,CAAA;QAC7G,KAAK,qBAAqB;YACxB,OAAO,wBAAwB,CAAC,qBAAqB,EAAE,oBAAoB,EAAE,SAAS,EAAE,kBAAkB,CAAC,CAAA;QAC7G;YACE,OAAO,0BAA0B,CAAC,SAAS,CAAC,MAAM,EAAE,KAAK,CAAC,CAAA;IAC9D,CAAC;AACH,CAAC"}
+{"version":3,"file":"ssl-assertion-codegen.js","sourceRoot":"","sources":["../../src/constructs/ssl-assertion-codegen.ts"],"names":[],"mappings":"AACA,OAAO,EACL,0BAA0B,EAC1B,wBAAwB,EACxB,wBAAwB,EACxB,wBAAwB,GACzB,MAAM,iCAAiC,CAAA;AACxC,OAAO,EAAE,kBAAkB,EAAE,oBAAoB,EAAE,MAAM,4BAA4B,CAAA;AAGrF,iFAAiF;AACjF,iFAAiF;AACjF,gFAAgF;AAChF,iDAAiD;AACjD,MAAM,YAAY,GAAG,EAAE,WAAW,EAAE,IAAI,EAAE,QAAQ,EAAE,KAAK,EAAE,CAAA;AAE3D,uFAAuF;AACvF,mFAAmF;AACnF,qFAAqF;AACrF,qFAAqF;AACrF,0CAA0C;AAC1C,MAAM,CAAC,MAAM,kBAAkB,GAAyB;IACtD,MAAM,EAAE,IAAI,EAAE,UAAU,EAAE,IAAI,EAAE,YAAY,EAAE,IAAI,EAAE,SAAS,EAAE,IAAI;CACpE,CAAA;AAED,yFAAyF;AACzF,qFAAqF;AACrF,2EAA2E;AAC3E,MAAM,CAAC,MAAM,kBAAkB,GAAyB;IACtD,MAAM,EAAE,IAAI;CACb,CAAA;AAED,wFAAwF;AACxF,sFAAsF;AACtF,mCAAmC;AACnC,EAAE;AACF,0FAA0F;AAC1F,wFAAwF;AACxF,2FAA2F;AAC3F,oFAAoF;AACpF,2FAA2F;AAC3F,mDAAmD;AACnD,SAAS,+BAA+B,CAAE,MAAc,EAAE,SAAuB;IAC/E,MAAM,SAAS,GAAG,oBAAoB,CAAC,SAAS,CAAC,MAAM,EAAE,SAAS,CAAC,QAAQ,CAAC,CAAA;IAE5E,kFAAkF;IAClF,uFAAuF;IACvF,wFAAwF;IACxF,wFAAwF;IACxF,uFAAuF;IACvF,wDAAwD;IACxD,MAAM,kBAAkB,GAAG,SAAS,KAAK,QAAQ;WAC5C,MAAM,CAAC,MAAM,CAAC,kBAAkB,EAAE,SAAS,CAAC,UAAU,CAAC;WACvD,kBAAkB,CAAC,SAAS,CAAC,MAAM,CAAC,CAAA;IACzC,IAAI,kBAAkB,EAAE,CAAC;QACvB,OAAO,wBAAwB,CAAC,qBAAqB,EAAE,MAAM,EAAE,SAAS,EAAE;YACxE,WAAW,EAAE,IAAI;YACjB,KAAK,EAAE,MAAM;SACd,CAAC,CAAA;IACJ,CAAC;IAED,MAAM,mBAAmB,GAAG,SAAS,KAAK,SAAS;WAC9C,MAAM,CAAC,MAAM,CAAC,kBAAkB,EAAE,SAAS,CAAC,UAAU,CAAC;WACvD,CAAC,SAAS,CAAC,MAAM,KAAK,MAAM,IAAI,SAAS,CAAC,MAAM,KAAK,OAAO,CAAC,CAAA;IAClE,IAAI,mBAAmB,EAAE,CAAC;QACxB,OAAO,wBAAwB,CAAC,qBAAqB,EAAE,MAAM,EAAE,SAAS,EAAE,EAAE,WAAW,EAAE,IAAI,EAAE,CAAC,CAAA;IAClG,CAAC;IAED,OAAO,wBAAwB,CAAC,qBAAqB,EAAE,MAAM,EAAE,SAAS,EAAE,YAAY,CAAC,CAAA;AACzF,CAAC;AAED,MAAM,UAAU,oBAAoB,CAAE,OAAsB,EAAE,SAAuB;IACnF,OAAO,CAAC,WAAW,CAAC,qBAAqB,EAAE,oBAAoB,CAAC,CAAA;IAEhE,QAAQ,SAAS,CAAC,MAAM,EAAE,CAAC;QACzB,KAAK,aAAa;YAChB,OAAO,+BAA+B,CAAC,aAAa,EAAE,SAAS,CAAC,CAAA;QAClE,KAAK,YAAY;YACf,OAAO,+BAA+B,CAAC,YAAY,EAAE,SAAS,CAAC,CAAA;QACjE,KAAK,eAAe;YAClB,OAAO,wBAAwB,CAAC,qBAAqB,EAAE,cAAc,EAAE,SAAS,EAAE,YAAY,CAAC,CAAA;QACjG,KAAK,eAAe;YAClB,OAAO,wBAAwB,CAAC,qBAAqB,EAAE,cAAc,EAAE,SAAS,EAAE,YAAY,CAAC,CAAA;QACjG,KAAK,eAAe;YAClB,OAAO,wBAAwB,CAAC,qBAAqB,EAAE,cAAc,EAAE,SAAS,CAAC,CAAA;QACnF;YACE,OAAO,0BAA0B,CAAC,SAAS,CAAC,MAAM,EAAE,KAAK,CAAC,CAAA;IAC9D,CAAC;AACH,CAAC"}

package/dist/constructs/ssl-assertion-grammar.d.ts

@@ -0,0 +1,123 @@
+import { TargetValueType } from './internal/assertion-grammar.js';
+import type { SignatureAlgorithmValue, TlsVersionValue } from './ssl-assertion.js';
+export declare const certificateGrammar: {
+    /** Days until the certificate expires (numeric). */
+    readonly daysUntilExpiry: {
+        readonly operators: readonly ["equals", "notEquals", "greaterThan", "lessThan"];
+        readonly target: import("./internal/assertion-grammar.js").TargetSpec<number>;
+    };
+    /** Certificate key size in bits (numeric). */
+    readonly keySizeBits: {
+        readonly operators: readonly ["equals", "notEquals", "greaterThan", "lessThan"];
+        readonly target: import("./internal/assertion-grammar.js").TargetSpec<number>;
+    };
+    /** Certificate subject common name (free-form string). */
+    readonly subjectCN: {
+        readonly operators: readonly ["equals", "notEquals", "contains", "notContains"];
+        readonly target: import("./internal/assertion-grammar.js").TargetSpec<string>;
+    };
+    /** Certificate issuer common name (free-form string). */
+    readonly issuerCN: {
+        readonly operators: readonly ["equals", "notEquals", "contains", "notContains"];
+        readonly target: import("./internal/assertion-grammar.js").TargetSpec<string>;
+    };
+    /** Certificate serial number — an opaque identifier, compared whole. */
+    readonly serialNumber: {
+        readonly operators: readonly ["equals", "notEquals"];
+        readonly target: import("./internal/assertion-grammar.js").TargetSpec<string>;
+    };
+    /** Certificate SHA-256 fingerprint — an opaque identifier, compared whole. */
+    readonly fingerprintSha256: {
+        readonly operators: readonly ["equals", "notEquals"];
+        readonly target: import("./internal/assertion-grammar.js").TargetSpec<string>;
+    };
+    /** Issuer SHA-256 fingerprint — an opaque identifier, compared whole. */
+    readonly issuerFingerprintSha256: {
+        readonly operators: readonly ["equals", "notEquals"];
+        readonly target: import("./internal/assertion-grammar.js").TargetSpec<string>;
+    };
+    /** Certificate public key algorithm (e.g. `'RSA'`, `'ECDSA'`), compared whole. */
+    readonly keyAlgorithm: {
+        readonly operators: readonly ["equals", "notEquals"];
+        readonly target: import("./internal/assertion-grammar.js").TargetSpec<string>;
+    };
+    /** Certificate signature algorithm — a Go `x509 SignatureAlgorithm.String()` value. */
+    readonly signatureAlgorithm: {
+        readonly operators: readonly ["equals", "notEquals"];
+        readonly target: import("./internal/assertion-grammar.js").TargetSpec<SignatureAlgorithmValue>;
+    };
+    /** Certificate subject alternative names. A list, so only membership can be asserted. */
+    readonly sans: {
+        readonly operators: readonly ["contains", "notContains"];
+        readonly target: import("./internal/assertion-grammar.js").TargetSpec<string>;
+    };
+    /** Whether the certificate is self-signed (boolean). */
+    readonly selfSigned: {
+        readonly operators: readonly ["equals"];
+        readonly target: import("./internal/assertion-grammar.js").TargetSpec<boolean>;
+    };
+    /** Whether the certificate is a CA certificate (boolean). */
+    readonly isCA: {
+        readonly operators: readonly ["equals"];
+        readonly target: import("./internal/assertion-grammar.js").TargetSpec<boolean>;
+    };
+};
+export declare const connectionGrammar: {
+    /** Negotiated TLS version. Ordered, so `greaterThan` expresses a minimum. */
+    readonly tlsVersion: {
+        readonly operators: readonly ["equals", "notEquals", "greaterThan", "lessThan"];
+        readonly target: import("./internal/assertion-grammar.js").TargetSpec<TlsVersionValue>;
+    };
+    /** Negotiated cipher suite (free-form string; hundreds of IANA names). */
+    readonly cipherSuite: {
+        readonly operators: readonly ["equals", "notEquals", "contains", "notContains"];
+        readonly target: import("./internal/assertion-grammar.js").TargetSpec<string>;
+    };
+    /** Whether the hostname is verified against the certificate (boolean). */
+    readonly hostnameVerified: {
+        readonly operators: readonly ["equals"];
+        readonly target: import("./internal/assertion-grammar.js").TargetSpec<boolean>;
+    };
+    /** Whether the certificate chain is trusted (boolean). */
+    readonly chainTrusted: {
+        readonly operators: readonly ["equals"];
+        readonly target: import("./internal/assertion-grammar.js").TargetSpec<boolean>;
+    };
+    /** Whether a stapled OCSP response was provided during the handshake (boolean). */
+    readonly ocspStapled: {
+        readonly operators: readonly ["equals"];
+        readonly target: import("./internal/assertion-grammar.js").TargetSpec<boolean>;
+    };
+    /** OCSP revocation status (e.g. `'good'`, `'revoked'`), compared whole. */
+    readonly ocspStatus: {
+        readonly operators: readonly ["equals", "notEquals"];
+        readonly target: import("./internal/assertion-grammar.js").TargetSpec<string>;
+    };
+    /** The IP address the hostname resolved to (free-form string). */
+    readonly resolvedIp: {
+        readonly operators: readonly ["equals", "notEquals", "contains", "notContains"];
+        readonly target: import("./internal/assertion-grammar.js").TargetSpec<string>;
+    };
+};
+/**
+ * The wire comparisons each property of a source accepts, keyed by property name. Empty for
+ * a source with no property-scoped grammar. Used by validation to reject an unsupported
+ * comparison written as an object literal.
+ */
+export declare function sslComparisonsForSource(source: string): Record<string, Record<string, true>>;
+/**
+ * How the target of a property-scoped SSL assertion is written, or `undefined` for a
+ * property the backend does not define. Callers must handle the unknown case: object
+ * literals bypass the builder's compile-time check and are reported by
+ * `validateSslAssertion` instead.
+ */
+export declare function sslPropertyValueType(source: string, property: string): TargetValueType | undefined;
+/**
+ * Whether a target is one this CLI treats as a number.
+ *
+ * Validation and codegen must agree: anything validation accepts, codegen has to render as
+ * a bare numeric literal, because the property's operators take a `number` and a quoted
+ * target would not compile. Targets are plain strings on the wire and reach here from object
+ * literals and remote monitors, so this is a runtime predicate rather than a type.
+ */
+export declare function isSslNumericTarget(target: string): boolean;

package/dist/constructs/ssl-assertion-grammar.js

@@ -0,0 +1,90 @@
+import { booleanTarget, comparisonsForGrammar, defineGrammar, numberTarget, stringTarget, valueTypeForGrammar, } from './internal/assertion-grammar.js';
+// The single declaration of the SSL certificate/connection assertion grammar. Each row is
+// a property's entire contract — the operators it exposes and the type of its target. The
+// public `SslAssertionBuilder`, its property unions, the validation whitelist, and codegen
+// all derive from these two tables, so a property cannot gain an operator the whitelist
+// rejects, or a target type codegen renders wrong, without editing this one row.
+export const certificateGrammar = defineGrammar({
+    /** Days until the certificate expires (numeric). */
+    daysUntilExpiry: { operators: ['equals', 'notEquals', 'greaterThan', 'lessThan'], target: numberTarget() },
+    /** Certificate key size in bits (numeric). */
+    keySizeBits: { operators: ['equals', 'notEquals', 'greaterThan', 'lessThan'], target: numberTarget() },
+    /** Certificate subject common name (free-form string). */
+    subjectCN: { operators: ['equals', 'notEquals', 'contains', 'notContains'], target: stringTarget() },
+    /** Certificate issuer common name (free-form string). */
+    issuerCN: { operators: ['equals', 'notEquals', 'contains', 'notContains'], target: stringTarget() },
+    /** Certificate serial number — an opaque identifier, compared whole. */
+    serialNumber: { operators: ['equals', 'notEquals'], target: stringTarget() },
+    /** Certificate SHA-256 fingerprint — an opaque identifier, compared whole. */
+    fingerprintSha256: { operators: ['equals', 'notEquals'], target: stringTarget() },
+    /** Issuer SHA-256 fingerprint — an opaque identifier, compared whole. */
+    issuerFingerprintSha256: { operators: ['equals', 'notEquals'], target: stringTarget() },
+    /** Certificate public key algorithm (e.g. `'RSA'`, `'ECDSA'`), compared whole. */
+    keyAlgorithm: { operators: ['equals', 'notEquals'], target: stringTarget() },
+    /** Certificate signature algorithm — a Go `x509 SignatureAlgorithm.String()` value. */
+    signatureAlgorithm: { operators: ['equals', 'notEquals'], target: stringTarget() },
+    /** Certificate subject alternative names. A list, so only membership can be asserted. */
+    sans: { operators: ['contains', 'notContains'], target: stringTarget() },
+    /** Whether the certificate is self-signed (boolean). */
+    selfSigned: { operators: ['equals'], target: booleanTarget() },
+    /** Whether the certificate is a CA certificate (boolean). */
+    isCA: { operators: ['equals'], target: booleanTarget() },
+});
+export const connectionGrammar = defineGrammar({
+    /** Negotiated TLS version. Ordered, so `greaterThan` expresses a minimum. */
+    tlsVersion: { operators: ['equals', 'notEquals', 'greaterThan', 'lessThan'], target: stringTarget() },
+    /** Negotiated cipher suite (free-form string; hundreds of IANA names). */
+    cipherSuite: { operators: ['equals', 'notEquals', 'contains', 'notContains'], target: stringTarget() },
+    /** Whether the hostname is verified against the certificate (boolean). */
+    hostnameVerified: { operators: ['equals'], target: booleanTarget() },
+    /** Whether the certificate chain is trusted (boolean). */
+    chainTrusted: { operators: ['equals'], target: booleanTarget() },
+    /** Whether a stapled OCSP response was provided during the handshake (boolean). */
+    ocspStapled: { operators: ['equals'], target: booleanTarget() },
+    /** OCSP revocation status (e.g. `'good'`, `'revoked'`), compared whole. */
+    ocspStatus: { operators: ['equals', 'notEquals'], target: stringTarget() },
+    /** The IP address the hostname resolved to (free-form string). */
+    resolvedIp: { operators: ['equals', 'notEquals', 'contains', 'notContains'], target: stringTarget() },
+});
+const grammarBySource = {
+    CERTIFICATE: certificateGrammar,
+    CONNECTION: connectionGrammar,
+};
+function propertyGrammar(source, property) {
+    const grammar = Object.hasOwn(grammarBySource, source) ? grammarBySource[source] : undefined;
+    if (grammar === undefined || !Object.hasOwn(grammar, property)) {
+        return undefined;
+    }
+    return grammar[property];
+}
+/**
+ * The wire comparisons each property of a source accepts, keyed by property name. Empty for
+ * a source with no property-scoped grammar. Used by validation to reject an unsupported
+ * comparison written as an object literal.
+ */
+export function sslComparisonsForSource(source) {
+    const grammar = Object.hasOwn(grammarBySource, source) ? grammarBySource[source] : {};
+    return Object.fromEntries(Object.entries(grammar).map(([property, decl]) => [property, comparisonsForGrammar(decl)]));
+}
+/**
+ * How the target of a property-scoped SSL assertion is written, or `undefined` for a
+ * property the backend does not define. Callers must handle the unknown case: object
+ * literals bypass the builder's compile-time check and are reported by
+ * `validateSslAssertion` instead.
+ */
+export function sslPropertyValueType(source, property) {
+    const decl = propertyGrammar(source, property);
+    return decl === undefined ? undefined : valueTypeForGrammar(decl);
+}
+/**
+ * Whether a target is one this CLI treats as a number.
+ *
+ * Validation and codegen must agree: anything validation accepts, codegen has to render as
+ * a bare numeric literal, because the property's operators take a `number` and a quoted
+ * target would not compile. Targets are plain strings on the wire and reach here from object
+ * literals and remote monitors, so this is a runtime predicate rather than a type.
+ */
+export function isSslNumericTarget(target) {
+    return target.trim() !== '' && Number.isFinite(Number(target));
+}
+//# sourceMappingURL=ssl-assertion-grammar.js.map

package/dist/constructs/ssl-assertion-grammar.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"ssl-assertion-grammar.js","sourceRoot":"","sources":["../../src/constructs/ssl-assertion-grammar.ts"],"names":[],"mappings":"AAAA,OAAO,EAGL,aAAa,EACb,qBAAqB,EACrB,aAAa,EACb,YAAY,EACZ,YAAY,EACZ,mBAAmB,GACpB,MAAM,iCAAiC,CAAA;AAGxC,0FAA0F;AAC1F,0FAA0F;AAC1F,2FAA2F;AAC3F,wFAAwF;AACxF,iFAAiF;AAEjF,MAAM,CAAC,MAAM,kBAAkB,GAAG,aAAa,CAAC;IAC9C,oDAAoD;IACpD,eAAe,EAAE,EAAE,SAAS,EAAE,CAAC,QAAQ,EAAE,WAAW,EAAE,aAAa,EAAE,UAAU,CAAC,EAAE,MAAM,EAAE,YAAY,EAAE,EAAE;IAC1G,8CAA8C;IAC9C,WAAW,EAAE,EAAE,SAAS,EAAE,CAAC,QAAQ,EAAE,WAAW,EAAE,aAAa,EAAE,UAAU,CAAC,EAAE,MAAM,EAAE,YAAY,EAAE,EAAE;IACtG,0DAA0D;IAC1D,SAAS,EAAE,EAAE,SAAS,EAAE,CAAC,QAAQ,EAAE,WAAW,EAAE,UAAU,EAAE,aAAa,CAAC,EAAE,MAAM,EAAE,YAAY,EAAE,EAAE;IACpG,yDAAyD;IACzD,QAAQ,EAAE,EAAE,SAAS,EAAE,CAAC,QAAQ,EAAE,WAAW,EAAE,UAAU,EAAE,aAAa,CAAC,EAAE,MAAM,EAAE,YAAY,EAAE,EAAE;IACnG,wEAAwE;IACxE,YAAY,EAAE,EAAE,SAAS,EAAE,CAAC,QAAQ,EAAE,WAAW,CAAC,EAAE,MAAM,EAAE,YAAY,EAAE,EAAE;IAC5E,8EAA8E;IAC9E,iBAAiB,EAAE,EAAE,SAAS,EAAE,CAAC,QAAQ,EAAE,WAAW,CAAC,EAAE,MAAM,EAAE,YAAY,EAAE,EAAE;IACjF,yEAAyE;IACzE,uBAAuB,EAAE,EAAE,SAAS,EAAE,CAAC,QAAQ,EAAE,WAAW,CAAC,EAAE,MAAM,EAAE,YAAY,EAAE,EAAE;IACvF,kFAAkF;IAClF,YAAY,EAAE,EAAE,SAAS,EAAE,CAAC,QAAQ,EAAE,WAAW,CAAC,EAAE,MAAM,EAAE,YAAY,EAAE,EAAE;IAC5E,uFAAuF;IACvF,kBAAkB,EAAE,EAAE,SAAS,EAAE,CAAC,QAAQ,EAAE,WAAW,CAAC,EAAE,MAAM,EAAE,YAAY,EAA2B,EAAE;IAC3G,yFAAyF;IACzF,IAAI,EAAE,EAAE,SAAS,EAAE,CAAC,UAAU,EAAE,aAAa,CAAC,EAAE,MAAM,EAAE,YAAY,EAAE,EAAE;IACxE,wDAAwD;IACxD,UAAU,EAAE,EAAE,SAAS,EAAE,CAAC,QAAQ,CAAC,EAAE,MAAM,EAAE,aAAa,EAAE,EAAE;IAC9D,6DAA6D;IAC7D,IAAI,EAAE,EAAE,SAAS,EAAE,CAAC,QAAQ,CAAC,EAAE,MAAM,EAAE,aAAa,EAAE,EAAE;CACzD,CAAC,CAAA;AAEF,MAAM,CAAC,MAAM,iBAAiB,GAAG,aAAa,CAAC;IAC7C,6EAA6E;IAC7E,UAAU,EAAE,EAAE,SAAS,EAAE,CAAC,QAAQ,EAAE,WAAW,EAAE,aAAa,EAAE,UAAU,CAAC,EAAE,MAAM,EAAE,YAAY,EAAmB,EAAE;IACtH,0EAA0E;IAC1E,WAAW,EAAE,EAAE,SAAS,EAAE,CAAC,QAAQ,EAAE,WAAW,EAAE,UAAU,EAAE,aAAa,CAAC,EAAE,MAAM,EAAE,YAAY,EAAE,EAAE;IACtG,0EAA0E;IAC1E,gBAAgB,EAAE,EAAE,SAAS,EAAE,CAAC,QAAQ,CAAC,EAAE,MAAM,EAAE,aAAa,EAAE,EAAE;IACpE,0DAA0D;IAC1D,YAAY,EAAE,EAAE,SAAS,EAAE,CAAC,QAAQ,CAAC,EAAE,MAAM,EAAE,aAAa,EAAE,EAAE;IAChE,mFAAmF;IACnF,WAAW,EAAE,EAAE,SAAS,EAAE,CAAC,QAAQ,CAAC,EAAE,MAAM,EAAE,aAAa,EAAE,EAAE;IAC/D,2EAA2E;IAC3E,UAAU,EAAE,EAAE,SAAS,EAAE,CAAC,QAAQ,EAAE,WAAW,CAAC,EAAE,MAAM,EAAE,YAAY,EAAE,EAAE;IAC1E,kEAAkE;IAClE,UAAU,EAAE,EAAE,SAAS,EAAE,CAAC,QAAQ,EAAE,WAAW,EAAE,UAAU,EAAE,aAAa,CAAC,EAAE,MAAM,EAAE,YAAY,EAAE,EAAE;CACtG,CAAC,CAAA;AAEF,MAAM,eAAe,GAAoD;IACvE,WAAW,EAAE,kBAAkB;IAC/B,UAAU,EAAE,iBAAiB;CAC9B,CAAA;AAED,SAAS,eAAe,CAAE,MAAc,EAAE,QAAgB;IACxD,MAAM,OAAO,GAAG,MAAM,CAAC,MAAM,CAAC,eAAe,EAAE,MAAM,CAAC,CAAC,CAAC,CAAC,eAAe,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,SAAS,CAAA;IAC5F,IAAI,OAAO,KAAK,SAAS,IAAI,CAAC,MAAM,CAAC,MAAM,CAAC,OAAO,EAAE,QAAQ,CAAC,EAAE,CAAC;QAC/D,OAAO,SAAS,CAAA;IAClB,CAAC;IACD,OAAO,OAAO,CAAC,QAAQ,CAAC,CAAA;AAC1B,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,uBAAuB,CAAE,MAAc;IACrD,MAAM,OAAO,GAAG,MAAM,CAAC,MAAM,CAAC,eAAe,EAAE,MAAM,CAAC,CAAC,CAAC,CAAC,eAAe,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,EAAE,CAAA;IACrF,OAAO,MAAM,CAAC,WAAW,CACvB,MAAM,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,QAAQ,EAAE,IAAI,CAAC,EAAE,EAAE,CAAC,CAAC,QAAQ,EAAE,qBAAqB,CAAC,IAAI,CAAC,CAAC,CAAC,CAC3F,CAAA;AACH,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,oBAAoB,CAAE,MAAc,EAAE,QAAgB;IACpE,MAAM,IAAI,GAAG,eAAe,CAAC,MAAM,EAAE,QAAQ,CAAC,CAAA;IAC9C,OAAO,IAAI,KAAK,SAAS,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,mBAAmB,CAAC,IAAI,CAAC,CAAA;AACnE,CAAC;AAED;;;;;;;GAOG;AACH,MAAM,UAAU,kBAAkB,CAAE,MAAc;IAChD,OAAO,MAAM,CAAC,IAAI,EAAE,KAAK,EAAE,IAAI,MAAM,CAAC,QAAQ,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,CAAA;AAChE,CAAC"}

package/dist/constructs/ssl-assertion-validation.d.ts

@@ -1,13 +1,13 @@
 import { Diagnostics } from './diagnostics.js';
 import { SslAssertion } from './ssl-assertion.js';
 /**
- * Reports SSL assertions whose source, comparison or boolean target the backend does
- * not accept.
+ * Reports SSL assertions whose source, property, comparison or boolean target the
+ * backend does not accept.
  *
  * Assertions written as plain object literals bypass SslAssertionBuilder and are
- * type-legal, because the fields are declared as plain strings. The backend rejects
- * an unknown source or an operator not allowed for the source with a 400; a boolean
- * source with a non-`true`/`false` target is accepted at deploy but never matches at
- * evaluation, so it is reported too.
+ * type-legal, because the fields are declared as plain strings. The backend rejects an
+ * unknown source, an unknown property or an operator not allowed for the property with
+ * a 400; a boolean or numeric property whose target is not of that type is accepted at
+ * deploy but never matches at evaluation, so it is reported too.
  */
 export declare function validateSslAssertion(diagnostics: Diagnostics, assertion: SslAssertion, index: number): void;

package/dist/constructs/ssl-assertion-validation.js

@@ -1,30 +1,87 @@
 import { addAssertionDiagnostic, quotedKeys } from './internal/assertion-validation.js';
-// The operators the backend accepts per source, minus the CLI-dropped
-// GREATER_THAN_OR_EQUAL. Keyed by the source union so adding a source without a rule
-// fails to compile.
+import { isSslNumericTarget, sslComparisonsForSource, sslPropertyValueType } from './ssl-assertion-grammar.js';
+const NUMBER = { EQUALS: true, NOT_EQUALS: true, GREATER_THAN: true, LESS_THAN: true };
+// Keyed by the source union so adding a source without a rule fails to compile.
 const rules = {
-    CERT_EXPIRES_IN_DAYS: { comparisons: { EQUALS: true, NOT_EQUALS: true, GREATER_THAN: true, LESS_THAN: true } },
-    KEY_SIZE_BITS: { comparisons: { EQUALS: true } },
-    CERT_NOT_EXPIRED: { comparisons: { EQUALS: true }, booleanTarget: true },
-    HOSTNAME_VERIFIED: { comparisons: { EQUALS: true }, booleanTarget: true },
-    CHAIN_TRUSTED: { comparisons: { EQUALS: true }, booleanTarget: true },
-    OCSP_STAPLED: { comparisons: { EQUALS: true }, booleanTarget: true },
-    TLS_VERSION: { comparisons: { EQUALS: true } },
-    SIGNATURE_ALGORITHM: { comparisons: { EQUALS: true, MATCHES: true } },
-    CIPHER_SUITE: { comparisons: { EQUALS: true, NOT_EQUALS: true, MATCHES: true } },
-    ISSUER_CN: { comparisons: { EQUALS: true, NOT_EQUALS: true, MATCHES: true } },
-    CERT_FINGERPRINT_SHA256: { comparisons: { EQUALS: true } },
-    ISSUER_FINGERPRINT_SHA256: { comparisons: { EQUALS: true } },
+    CERTIFICATE: { properties: sslComparisonsForSource('CERTIFICATE') },
+    CONNECTION: { properties: sslComparisonsForSource('CONNECTION') },
+    RESPONSE_TIME: { comparisons: NUMBER, valueType: 'number' },
+    JSON_RESPONSE: {
+        comparisons: {
+            EQUALS: true,
+            NOT_EQUALS: true,
+            IS_EMPTY: true,
+            NOT_EMPTY: true,
+            GREATER_THAN: true,
+            LESS_THAN: true,
+            CONTAINS: true,
+            NOT_CONTAINS: true,
+            IS_NULL: true,
+            NOT_NULL: true,
+        },
+    },
+    TEXT_RESPONSE: {
+        comparisons: {
+            EQUALS: true,
+            NOT_EQUALS: true,
+            IS_EMPTY: true,
+            NOT_EMPTY: true,
+            CONTAINS: true,
+            NOT_CONTAINS: true,
+            GREATER_THAN: true,
+            LESS_THAN: true,
+        },
+    },
 };
+function isPropertyScoped(rule) {
+    return 'properties' in rule;
+}
+function formatValue(value) {
+    return value === '' ? '(none)' : `"${value}"`;
+}
 /**
- * Reports SSL assertions whose source, comparison or boolean target the backend does
- * not accept.
+ * Reports a target that is not of the value type its source or property expects.
+ *
+ * Target *values* are checked where the accepted set is universal — booleans are two
+ * values, numbers are a total predicate — so a typo is a pure footgun the backend will not
+ * catch: it accepts any target string at deploy and simply never matches at evaluation,
+ * leaving an assertion that looks configured but silently never fires.
+ *
+ * The closed *enumerated* sets (tlsVersion, signatureAlgorithm) are deliberately not
+ * checked: the builder's typed operators already constrain them, and restating their
+ * members here would duplicate the value unions.
+ */
+function validateTargetValue(diagnostics, assertion, location, valueType, subject) {
+    // `target` is declared a string, but object-literal assertions are not typechecked when
+    // a check file is loaded, so a hand-written `target: 30` or an omitted target reaches
+    // here as a non-string. Report it rather than dereferencing it — a TypeError out of
+    // validate() would abort the command with no location or message.
+    const target = assertion.target;
+    if (typeof target !== 'string') {
+        if (valueType !== undefined) {
+            addAssertionDiagnostic(diagnostics, `The ${subject} assertion at "${location}" must compare against a ${valueType} written as a string, `
+                + `but got ${JSON.stringify(target) ?? String(target)}.`);
+        }
+        return;
+    }
+    if (valueType === 'boolean' && target !== 'true' && target !== 'false') {
+        addAssertionDiagnostic(diagnostics, `The ${subject} assertion at "${location}" must compare against "true" or "false", `
+            + `but got "${target}".`);
+    }
+    if (valueType === 'number' && !isSslNumericTarget(target)) {
+        addAssertionDiagnostic(diagnostics, `The ${subject} assertion at "${location}" must compare against a number, `
+            + `but got ${formatValue(target)}.`);
+    }
+}
+/**
+ * Reports SSL assertions whose source, property, comparison or boolean target the
+ * backend does not accept.
  *
  * Assertions written as plain object literals bypass SslAssertionBuilder and are
- * type-legal, because the fields are declared as plain strings. The backend rejects
- * an unknown source or an operator not allowed for the source with a 400; a boolean
- * source with a non-`true`/`false` target is accepted at deploy but never matches at
- * evaluation, so it is reported too.
+ * type-legal, because the fields are declared as plain strings. The backend rejects an
+ * unknown source, an unknown property or an operator not allowed for the property with
+ * a 400; a boolean or numeric property whose target is not of that type is accepted at
+ * deploy but never matches at evaluation, so it is reported too.
  */
 export function validateSslAssertion(diagnostics, assertion, index) {
     const location = `request.assertions[${index}]`;
@@ -36,14 +93,26 @@ export function validateSslAssertion(diagnostics, assertion, index) {
             + `Expected one of ${quotedKeys(rules)}.`);
         return;
     }
-    if (!Object.hasOwn(rule.comparisons, assertion.comparison)) {
-        addAssertionDiagnostic(diagnostics, `The ${assertion.source} assertion at "${location}" has an unsupported comparison `
-            + `${assertion.comparison === '' ? '(none)' : `"${assertion.comparison}"`}. `
-            + `Expected one of ${quotedKeys(rule.comparisons)}.`);
+    if (!isPropertyScoped(rule)) {
+        if (!Object.hasOwn(rule.comparisons, assertion.comparison)) {
+            addAssertionDiagnostic(diagnostics, `The ${assertion.source} assertion at "${location}" has an unsupported comparison `
+                + `${formatValue(assertion.comparison)}. Expected one of ${quotedKeys(rule.comparisons)}.`);
+        }
+        validateTargetValue(diagnostics, assertion, location, rule.valueType, assertion.source);
+        return;
+    }
+    const comparisons = Object.hasOwn(rule.properties, assertion.property)
+        ? rule.properties[assertion.property]
+        : undefined;
+    if (comparisons === undefined) {
+        addAssertionDiagnostic(diagnostics, `The ${assertion.source} assertion at "${location}" has an unknown property `
+            + `${formatValue(assertion.property)}. Expected one of ${quotedKeys(rule.properties)}.`);
+        return;
     }
-    if (rule.booleanTarget && assertion.target !== 'true' && assertion.target !== 'false') {
-        addAssertionDiagnostic(diagnostics, `The ${assertion.source} assertion at "${location}" must compare against "true" or "false", `
-            + `but got "${assertion.target}".`);
+    if (!Object.hasOwn(comparisons, assertion.comparison)) {
+        addAssertionDiagnostic(diagnostics, `The ${assertion.source} "${assertion.property}" assertion at "${location}" has an unsupported comparison `
+            + `${formatValue(assertion.comparison)}. Expected one of ${quotedKeys(comparisons)}.`);
     }
+    validateTargetValue(diagnostics, assertion, location, sslPropertyValueType(assertion.source, assertion.property), `${assertion.source} "${assertion.property}"`);
 }
 //# sourceMappingURL=ssl-assertion-validation.js.map

package/dist/constructs/ssl-assertion-validation.js.map

@@ -1 +1 @@
-{"version":3,"file":"ssl-assertion-validation.js","sourceRoot":"","sources":["../../src/constructs/ssl-assertion-validation.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,sBAAsB,EAAE,UAAU,EAAE,MAAM,oCAAoC,CAAA;AAevF,sEAAsE;AACtE,qFAAqF;AACrF,oBAAoB;AACpB,MAAM,KAAK,GAAkD;IAC3D,oBAAoB,EAAE,EAAE,WAAW,EAAE,EAAE,MAAM,EAAE,IAAI,EAAE,UAAU,EAAE,IAAI,EAAE,YAAY,EAAE,IAAI,EAAE,SAAS,EAAE,IAAI,EAAE,EAAE;IAC9G,aAAa,EAAE,EAAE,WAAW,EAAE,EAAE,MAAM,EAAE,IAAI,EAAE,EAAE;IAChD,gBAAgB,EAAE,EAAE,WAAW,EAAE,EAAE,MAAM,EAAE,IAAI,EAAE,EAAE,aAAa,EAAE,IAAI,EAAE;IACxE,iBAAiB,EAAE,EAAE,WAAW,EAAE,EAAE,MAAM,EAAE,IAAI,EAAE,EAAE,aAAa,EAAE,IAAI,EAAE;IACzE,aAAa,EAAE,EAAE,WAAW,EAAE,EAAE,MAAM,EAAE,IAAI,EAAE,EAAE,aAAa,EAAE,IAAI,EAAE;IACrE,YAAY,EAAE,EAAE,WAAW,EAAE,EAAE,MAAM,EAAE,IAAI,EAAE,EAAE,aAAa,EAAE,IAAI,EAAE;IACpE,WAAW,EAAE,EAAE,WAAW,EAAE,EAAE,MAAM,EAAE,IAAI,EAAE,EAAE;IAC9C,mBAAmB,EAAE,EAAE,WAAW,EAAE,EAAE,MAAM,EAAE,IAAI,EAAE,OAAO,EAAE,IAAI,EAAE,EAAE;IACrE,YAAY,EAAE,EAAE,WAAW,EAAE,EAAE,MAAM,EAAE,IAAI,EAAE,UAAU,EAAE,IAAI,EAAE,OAAO,EAAE,IAAI,EAAE,EAAE;IAChF,SAAS,EAAE,EAAE,WAAW,EAAE,EAAE,MAAM,EAAE,IAAI,EAAE,UAAU,EAAE,IAAI,EAAE,OAAO,EAAE,IAAI,EAAE,EAAE;IAC7E,uBAAuB,EAAE,EAAE,WAAW,EAAE,EAAE,MAAM,EAAE,IAAI,EAAE,EAAE;IAC1D,yBAAyB,EAAE,EAAE,WAAW,EAAE,EAAE,MAAM,EAAE,IAAI,EAAE,EAAE;CAC7D,CAAA;AAED;;;;;;;;;GASG;AACH,MAAM,UAAU,oBAAoB,CAClC,WAAwB,EACxB,SAAuB,EACvB,KAAa;IAEb,MAAM,QAAQ,GAAG,sBAAsB,KAAK,GAAG,CAAA;IAE/C,MAAM,IAAI,GAAG,MAAM,CAAC,MAAM,CAAC,KAAK,EAAE,SAAS,CAAC,MAAM,CAAC;QACjD,CAAC,CAAC,KAAK,CAAC,SAAS,CAAC,MAAgC,CAAC;QACnD,CAAC,CAAC,SAAS,CAAA;IACb,IAAI,IAAI,KAAK,SAAS,EAAE,CAAC;QACvB,sBAAsB,CAAC,WAAW,EAChC,qBAAqB,QAAQ,4BAA4B,SAAS,CAAC,MAAM,KAAK;cAC5E,mBAAmB,UAAU,CAAC,KAAK,CAAC,GAAG,CAAC,CAAA;QAC5C,OAAM;IACR,CAAC;IAED,IAAI,CAAC,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,WAAW,EAAE,SAAS,CAAC,UAAU,CAAC,EAAE,CAAC;QAC3D,sBAAsB,CAAC,WAAW,EAChC,OAAO,SAAS,CAAC,MAAM,kBAAkB,QAAQ,kCAAkC;cACjF,GAAG,SAAS,CAAC,UAAU,KAAK,EAAE,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,IAAI,SAAS,CAAC,UAAU,GAAG,IAAI;cAC3E,mBAAmB,UAAU,CAAC,IAAI,CAAC,WAAW,CAAC,GAAG,CAAC,CAAA;IACzD,CAAC;IAED,IAAI,IAAI,CAAC,aAAa,IAAI,SAAS,CAAC,MAAM,KAAK,MAAM,IAAI,SAAS,CAAC,MAAM,KAAK,OAAO,EAAE,CAAC;QACtF,sBAAsB,CAAC,WAAW,EAChC,OAAO,SAAS,CAAC,MAAM,kBAAkB,QAAQ,4CAA4C;cAC3F,YAAY,SAAS,CAAC,MAAM,IAAI,CAAC,CAAA;IACvC,CAAC;AACH,CAAC"}
+{"version":3,"file":"ssl-assertion-validation.js","sourceRoot":"","sources":["../../src/constructs/ssl-assertion-validation.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,sBAAsB,EAAE,UAAU,EAAE,MAAM,oCAAoC,CAAA;AAEvF,OAAO,EAAE,kBAAkB,EAAE,uBAAuB,EAAE,oBAAoB,EAAE,MAAM,4BAA4B,CAAA;AAO9G,MAAM,MAAM,GAAgB,EAAE,MAAM,EAAE,IAAI,EAAE,UAAU,EAAE,IAAI,EAAE,YAAY,EAAE,IAAI,EAAE,SAAS,EAAE,IAAI,EAAE,CAAA;AAYnG,gFAAgF;AAChF,MAAM,KAAK,GAAkD;IAC3D,WAAW,EAAE,EAAE,UAAU,EAAE,uBAAuB,CAAC,aAAa,CAAC,EAAE;IACnE,UAAU,EAAE,EAAE,UAAU,EAAE,uBAAuB,CAAC,YAAY,CAAC,EAAE;IACjE,aAAa,EAAE,EAAE,WAAW,EAAE,MAAM,EAAE,SAAS,EAAE,QAAQ,EAAE;IAC3D,aAAa,EAAE;QACb,WAAW,EAAE;YACX,MAAM,EAAE,IAAI;YACZ,UAAU,EAAE,IAAI;YAChB,QAAQ,EAAE,IAAI;YACd,SAAS,EAAE,IAAI;YACf,YAAY,EAAE,IAAI;YAClB,SAAS,EAAE,IAAI;YACf,QAAQ,EAAE,IAAI;YACd,YAAY,EAAE,IAAI;YAClB,OAAO,EAAE,IAAI;YACb,QAAQ,EAAE,IAAI;SACf;KACF;IACD,aAAa,EAAE;QACb,WAAW,EAAE;YACX,MAAM,EAAE,IAAI;YACZ,UAAU,EAAE,IAAI;YAChB,QAAQ,EAAE,IAAI;YACd,SAAS,EAAE,IAAI;YACf,QAAQ,EAAE,IAAI;YACd,YAAY,EAAE,IAAI;YAClB,YAAY,EAAE,IAAI;YAClB,SAAS,EAAE,IAAI;SAChB;KACF;CACF,CAAA;AAED,SAAS,gBAAgB,CAAE,IAAmB;IAC5C,OAAO,YAAY,IAAI,IAAI,CAAA;AAC7B,CAAC;AAED,SAAS,WAAW,CAAE,KAAa;IACjC,OAAO,KAAK,KAAK,EAAE,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,IAAI,KAAK,GAAG,CAAA;AAC/C,CAAC;AAED;;;;;;;;;;;GAWG;AACH,SAAS,mBAAmB,CAC1B,WAAwB,EACxB,SAAuB,EACvB,QAAgB,EAChB,SAAsC,EACtC,OAAe;IAEf,wFAAwF;IACxF,sFAAsF;IACtF,oFAAoF;IACpF,kEAAkE;IAClE,MAAM,MAAM,GAAY,SAAS,CAAC,MAAM,CAAA;IACxC,IAAI,OAAO,MAAM,KAAK,QAAQ,EAAE,CAAC;QAC/B,IAAI,SAAS,KAAK,SAAS,EAAE,CAAC;YAC5B,sBAAsB,CAAC,WAAW,EAChC,OAAO,OAAO,kBAAkB,QAAQ,4BAA4B,SAAS,wBAAwB;kBACnG,WAAW,IAAI,CAAC,SAAS,CAAC,MAAM,CAAC,IAAI,MAAM,CAAC,MAAM,CAAC,GAAG,CAAC,CAAA;QAC7D,CAAC;QACD,OAAM;IACR,CAAC;IAED,IAAI,SAAS,KAAK,SAAS,IAAI,MAAM,KAAK,MAAM,IAAI,MAAM,KAAK,OAAO,EAAE,CAAC;QACvE,sBAAsB,CAAC,WAAW,EAChC,OAAO,OAAO,kBAAkB,QAAQ,4CAA4C;cAClF,YAAY,MAAM,IAAI,CAAC,CAAA;IAC7B,CAAC;IAED,IAAI,SAAS,KAAK,QAAQ,IAAI,CAAC,kBAAkB,CAAC,MAAM,CAAC,EAAE,CAAC;QAC1D,sBAAsB,CAAC,WAAW,EAChC,OAAO,OAAO,kBAAkB,QAAQ,mCAAmC;cACzE,WAAW,WAAW,CAAC,MAAM,CAAC,GAAG,CAAC,CAAA;IACxC,CAAC;AACH,CAAC;AAED;;;;;;;;;GASG;AACH,MAAM,UAAU,oBAAoB,CAClC,WAAwB,EACxB,SAAuB,EACvB,KAAa;IAEb,MAAM,QAAQ,GAAG,sBAAsB,KAAK,GAAG,CAAA;IAE/C,MAAM,IAAI,GAAG,MAAM,CAAC,MAAM,CAAC,KAAK,EAAE,SAAS,CAAC,MAAM,CAAC;QACjD,CAAC,CAAC,KAAK,CAAC,SAAS,CAAC,MAAgC,CAAC;QACnD,CAAC,CAAC,SAAS,CAAA;IACb,IAAI,IAAI,KAAK,SAAS,EAAE,CAAC;QACvB,sBAAsB,CAAC,WAAW,EAChC,qBAAqB,QAAQ,4BAA4B,SAAS,CAAC,MAAM,KAAK;cAC5E,mBAAmB,UAAU,CAAC,KAAK,CAAC,GAAG,CAAC,CAAA;QAC5C,OAAM;IACR,CAAC;IAED,IAAI,CAAC,gBAAgB,CAAC,IAAI,CAAC,EAAE,CAAC;QAC5B,IAAI,CAAC,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,WAAW,EAAE,SAAS,CAAC,UAAU,CAAC,EAAE,CAAC;YAC3D,sBAAsB,CAAC,WAAW,EAChC,OAAO,SAAS,CAAC,MAAM,kBAAkB,QAAQ,kCAAkC;kBACjF,GAAG,WAAW,CAAC,SAAS,CAAC,UAAU,CAAC,qBAAqB,UAAU,CAAC,IAAI,CAAC,WAAW,CAAC,GAAG,CAAC,CAAA;QAC/F,CAAC;QACD,mBAAmB,CAAC,WAAW,EAAE,SAAS,EAAE,QAAQ,EAAE,IAAI,CAAC,SAAS,EAAE,SAAS,CAAC,MAAM,CAAC,CAAA;QACvF,OAAM;IACR,CAAC;IAED,MAAM,WAAW,GAAG,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,UAAU,EAAE,SAAS,CAAC,QAAQ,CAAC;QACpE,CAAC,CAAC,IAAI,CAAC,UAAU,CAAC,SAAS,CAAC,QAAQ,CAAC;QACrC,CAAC,CAAC,SAAS,CAAA;IACb,IAAI,WAAW,KAAK,SAAS,EAAE,CAAC;QAC9B,sBAAsB,CAAC,WAAW,EAChC,OAAO,SAAS,CAAC,MAAM,kBAAkB,QAAQ,4BAA4B;cAC3E,GAAG,WAAW,CAAC,SAAS,CAAC,QAAQ,CAAC,qBAAqB,UAAU,CAAC,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,CAAA;QAC1F,OAAM;IACR,CAAC;IAED,IAAI,CAAC,MAAM,CAAC,MAAM,CAAC,WAAW,EAAE,SAAS,CAAC,UAAU,CAAC,EAAE,CAAC;QACtD,sBAAsB,CAAC,WAAW,EAChC,OAAO,SAAS,CAAC,MAAM,KAAK,SAAS,CAAC,QAAQ,mBAAmB,QAAQ,kCAAkC;cACzG,GAAG,WAAW,CAAC,SAAS,CAAC,UAAU,CAAC,qBAAqB,UAAU,CAAC,WAAW,CAAC,GAAG,CAAC,CAAA;IAC1F,CAAC;IAED,mBAAmB,CACjB,WAAW,EACX,SAAS,EACT,QAAQ,EACR,oBAAoB,CAAC,SAAS,CAAC,MAAM,EAAE,SAAS,CAAC,QAAQ,CAAC,EAC1D,GAAG,SAAS,CAAC,MAAM,KAAK,SAAS,CAAC,QAAQ,GAAG,CAC9C,CAAA;AACH,CAAC"}