checkly 8.16.0 → 8.17.1-prerelease-14d5b2d

package/dist/constructs/ssl-assertion.d.ts

@@ -1,10 +1,13 @@
-import { Assertion as CoreAssertion } from './internal/assertion.js';
+import { Assertion as CoreAssertion, GeneralAssertionBuilder, NumericAssertionBuilder } from './internal/assertion.js';
+import { PropertyOperators } from './internal/assertion-grammar.js';
+import { certificateGrammar, connectionGrammar } from './ssl-assertion-grammar.js';
 /**
- * Known TLS protocol versions for use with {@link SslAssertionBuilder.tlsVersion}.
+ * Known TLS protocol versions for use as a target of the `tlsVersion` property on
+ * the {@link SslAssertionBuilder.connection} builder.
  *
  * @example
  * ```typescript
- * SslAssertionBuilder.tlsVersion().equals(TlsVersion.TLS1_3)
+ * SslAssertionBuilder.connection('tlsVersion').equals(TlsVersion.TLS1_3)
  * ```
  */
 export declare const TlsVersion: {
@@ -17,11 +20,12 @@ export type TlsVersionValue = (typeof TlsVersion)[keyof typeof TlsVersion];
 /**
  * Signature algorithms as reported by Go's `x509.Certificate.SignatureAlgorithm.String()`.
  * These are the exact values the SSL runner evaluates assertions against — use these
- * constants (or the string literals they represent) with {@link SslAssertionBuilder.signatureAlgorithm}.
+ * constants (or the string literals they represent) as a target of the
+ * `signatureAlgorithm` property on the {@link SslAssertionBuilder.certificate} builder.
  *
  * @example
  * ```typescript
- * SslAssertionBuilder.signatureAlgorithm().equals(SignatureAlgorithm.SHA256_RSA)
+ * SslAssertionBuilder.certificate('signatureAlgorithm').equals(SignatureAlgorithm.SHA256_RSA)
  * ```
  */
 export declare const SignatureAlgorithm: {
@@ -44,14 +48,14 @@ export declare const SignatureAlgorithm: {
 };
 export type SignatureAlgorithmValue = (typeof SignatureAlgorithm)[keyof typeof SignatureAlgorithm];
 /**
- * Commonly-used IANA cipher suite names for use with
- * {@link SslAssertionBuilder.cipherSuite}. Includes TLS 1.3 suites and
- * widely-deployed TLS 1.2 suites.
+ * Commonly-used IANA cipher suite names for use as a target of the `cipherSuite`
+ * property on the {@link SslAssertionBuilder.connection} builder. Includes TLS 1.3
+ * suites and widely-deployed TLS 1.2 suites.
  *
  * @example
  * ```typescript
- * SslAssertionBuilder.cipherSuite().equals(CipherSuite.TLS_AES_256_GCM_SHA384)
- * SslAssertionBuilder.cipherSuite().equals(CipherSuite.TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256)
+ * SslAssertionBuilder.connection('cipherSuite').equals(CipherSuite.TLS_AES_256_GCM_SHA384)
+ * SslAssertionBuilder.connection('cipherSuite').equals(CipherSuite.TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256)
  * ```
  */
 export declare const CipherSuite: {
@@ -72,126 +76,67 @@ export declare const CipherSuite: {
     readonly TLS_RSA_WITH_AES_256_CBC_SHA: "TLS_RSA_WITH_AES_256_CBC_SHA";
 };
 export type CipherSuiteValue = (typeof CipherSuite)[keyof typeof CipherSuite];
-type SslAssertionSource = 'CERT_EXPIRES_IN_DAYS' | 'CERT_NOT_EXPIRED' | 'HOSTNAME_VERIFIED' | 'CHAIN_TRUSTED' | 'TLS_VERSION' | 'CIPHER_SUITE' | 'ISSUER_CN' | 'CERT_FINGERPRINT_SHA256' | 'ISSUER_FINGERPRINT_SHA256' | 'KEY_SIZE_BITS' | 'SIGNATURE_ALGORITHM' | 'OCSP_STAPLED';
+type SslAssertionSource = 'CERTIFICATE' | 'CONNECTION' | 'RESPONSE_TIME' | 'JSON_RESPONSE' | 'TEXT_RESPONSE';
 export type SslAssertion = CoreAssertion<SslAssertionSource>;
-/** Days until the certificate expires (numeric). */
-declare class CertExpiresInDaysAssertionBuilder {
-    equals(target: number): SslAssertion;
-    notEquals(target: number): SslAssertion;
-    lessThan(target: number): SslAssertion;
-    greaterThan(target: number): SslAssertion;
-}
-/** Certificate key size in bits (numeric, exact match only). */
-declare class KeySizeBitsAssertionBuilder {
-    equals(target: number): SslAssertion;
-}
-/** Whether the certificate is not expired (boolean). */
-declare class CertNotExpiredAssertionBuilder {
-    equals(target: boolean): SslAssertion;
-}
-/** Whether the hostname is verified (boolean). */
-declare class HostnameVerifiedAssertionBuilder {
-    equals(target: boolean): SslAssertion;
-}
-/** Whether the certificate chain is trusted (boolean). */
-declare class ChainTrustedAssertionBuilder {
-    equals(target: boolean): SslAssertion;
-}
-/** Whether a stapled OCSP response was provided during the handshake (boolean). */
-declare class OcspStapledAssertionBuilder {
-    equals(target: boolean): SslAssertion;
-}
-/** Negotiated TLS version — `.equals()` accepts only known TLS version strings. */
-declare class TlsVersionAssertionBuilder {
-    equals(target: TlsVersionValue): SslAssertion;
-}
-/**
- * Certificate signature algorithm. `.equals()` takes a Go
- * `x509.Certificate.SignatureAlgorithm.String()` value; `.matches()` takes a regex.
- */
-declare class SignatureAlgorithmAssertionBuilder {
-    equals(target: SignatureAlgorithmValue): SslAssertion;
-    matches(target: string): SslAssertion;
-}
-/** Negotiated cipher suite (string) — exact, not-equal, or regex match. */
-declare class CipherSuiteAssertionBuilder {
-    equals(target: string): SslAssertion;
-    notEquals(target: string): SslAssertion;
-    matches(target: string): SslAssertion;
-}
-/** Certificate issuer common name (string) — exact, not-equal, or regex match. */
-declare class IssuerCnAssertionBuilder {
-    equals(target: string): SslAssertion;
-    notEquals(target: string): SslAssertion;
-    matches(target: string): SslAssertion;
-}
-/** Certificate SHA-256 fingerprint (string, exact match only). */
-declare class CertFingerprintSha256AssertionBuilder {
-    equals(target: string): SslAssertion;
-}
-/** Issuer SHA-256 fingerprint (string, exact match only). */
-declare class IssuerFingerprintSha256AssertionBuilder {
-    equals(target: string): SslAssertion;
-}
+/** The certificate properties an assertion can be made against. */
+export type SslCertificateProperty = keyof typeof certificateGrammar;
+/** The connection properties an assertion can be made against. */
+export type SslConnectionProperty = keyof typeof connectionGrammar;
 /**
  * Builder class for creating SSL monitor assertions.
- * Provides methods to create assertions for TLS certificates.
+ *
+ * Assertions are property-scoped: {@link certificate} and {@link connection} take the
+ * name of a certificate/connection property, {@link jsonResponse} takes a JSONPath and
+ * {@link textResponse} an optional regex. The comparison operators the backend accepts
+ * depend on the property's value type and are validated at deploy time.
  *
  * @example
  * ```typescript
- * // Alert when the certificate is within 30 days of expiry
- * SslAssertionBuilder.certExpiresInDays().greaterThan(30)
+ * // Certificate facts, addressed by property name
+ * SslAssertionBuilder.certificate('daysUntilExpiry').greaterThan(30)
+ * SslAssertionBuilder.certificate('issuerCN').contains("Let's Encrypt")
+ * SslAssertionBuilder.certificate('signatureAlgorithm').equals(SignatureAlgorithm.SHA256_RSA)
+ * SslAssertionBuilder.certificate('selfSigned').equals(false)
  *
- * // Require a trusted chain and a verified hostname
- * SslAssertionBuilder.chainTrusted().equals(true)
- * SslAssertionBuilder.hostnameVerified().equals(true)
+ * // Connection / handshake facts
+ * SslAssertionBuilder.connection('tlsVersion').equals(TlsVersion.TLS1_3)
+ * SslAssertionBuilder.connection('cipherSuite').equals(CipherSuite.TLS_AES_256_GCM_SHA384)
+ * SslAssertionBuilder.connection('chainTrusted').equals(true)
  *
- * // Enforce a specific TLS version and key size
- * SslAssertionBuilder.tlsVersion().equals('TLS1.3')
- * SslAssertionBuilder.keySizeBits().equals(2048)
- *
- * // Match the issuer or cipher suite against a regex
- * SslAssertionBuilder.issuerCn().matches("^Let's Encrypt")
- * SslAssertionBuilder.cipherSuite().matches('TLS_(AES|CHACHA)')
+ * // Response time, JSON and text responses
+ * SslAssertionBuilder.responseTime().lessThan(1000)
+ * SslAssertionBuilder.jsonResponse('$.status').equals('ok')
+ * SslAssertionBuilder.textResponse().contains('healthy')
  * ```
  */
 export declare class SslAssertionBuilder {
-    /** Assertion builder for the number of days until the certificate expires. */
-    static certExpiresInDays(): CertExpiresInDaysAssertionBuilder;
-    /** Assertion builder for the certificate key size in bits. */
-    static keySizeBits(): KeySizeBitsAssertionBuilder;
-    /** Assertion builder for whether the certificate is not expired. */
-    static certNotExpired(): CertNotExpiredAssertionBuilder;
-    /** Assertion builder for whether the hostname is verified. */
-    static hostnameVerified(): HostnameVerifiedAssertionBuilder;
-    /** Assertion builder for whether the certificate chain is trusted. */
-    static chainTrusted(): ChainTrustedAssertionBuilder;
     /**
-     * Assertion builder for the negotiated TLS version. `.equals()` accepts only the
-     * known TLS version strings — use the {@link TlsVersion} constants or the string
-     * literals `'TLS1.0'`…`'TLS1.3'`.
+     * Creates an assertion builder for a certificate property.
+     * @param property The certificate property to assert on (e.g. `'daysUntilExpiry'`,
+     *   `'issuerCN'`, `'signatureAlgorithm'`, `'sans'`, `'selfSigned'`).
+     */
+    static certificate<Property extends SslCertificateProperty>(property: Property): PropertyOperators<'CERTIFICATE', typeof certificateGrammar[Property]>;
+    /**
+     * Creates an assertion builder for a connection property.
+     * @param property The connection property to assert on (e.g. `'tlsVersion'`,
+     *   `'cipherSuite'`, `'hostnameVerified'`, `'ocspStatus'`, `'resolvedIp'`).
+     */
+    static connection<Property extends SslConnectionProperty>(property: Property): PropertyOperators<'CONNECTION', typeof connectionGrammar[Property]>;
+    /**
+     * Creates an assertion builder for the TLS handshake response time in milliseconds.
      */
-    static tlsVersion(): TlsVersionAssertionBuilder;
+    static responseTime(): NumericAssertionBuilder<SslAssertionSource, string>;
     /**
-     * Assertion builder for the negotiated cipher suite. Go's `tls.CipherSuiteName()`
-     * can return hundreds of IANA names plus `0x....` hex fallbacks, so `.equals()` is
-     * unconstrained; use the {@link CipherSuite} constants for common suites, or
-     * `.matches()` with a regex pattern.
+     * Creates an assertion builder for a JSON response body.
+     * @param property Optional JSONPath to a specific value (e.g. `'$.status'`).
      */
-    static cipherSuite(): CipherSuiteAssertionBuilder;
-    /** Assertion builder for the certificate issuer common name. */
-    static issuerCn(): IssuerCnAssertionBuilder;
-    /** Assertion builder for the certificate SHA-256 fingerprint. */
-    static certFingerprintSha256(): CertFingerprintSha256AssertionBuilder;
-    /** Assertion builder for the issuer SHA-256 fingerprint. */
-    static issuerFingerprintSha256(): IssuerFingerprintSha256AssertionBuilder;
+    static jsonResponse(property?: string): GeneralAssertionBuilder<SslAssertionSource, string | number | boolean>;
     /**
-     * Assertion builder for the certificate signature algorithm. `.equals()` takes a
-     * Go `x509.Certificate.SignatureAlgorithm.String()` value (e.g. `'SHA256-RSA'`) —
-     * use the {@link SignatureAlgorithm} constants — or `.matches()` with a regex.
+     * Creates an assertion builder for a text response body.
+     * @param regex Optional regex pattern (with a capture group) used to extract the value
+     *   to compare from the serialized response document. Carried in the assertion's
+     *   `property` field — the slot the backend and runner read the pattern from.
      */
-    static signatureAlgorithm(): SignatureAlgorithmAssertionBuilder;
-    /** Assertion builder for whether a stapled OCSP response was provided. */
-    static ocspStapled(): OcspStapledAssertionBuilder;
+    static textResponse(regex?: string): GeneralAssertionBuilder<SslAssertionSource, string | number | boolean>;
 }
 export {};

package/dist/constructs/ssl-assertion.js

@@ -1,10 +1,13 @@
-import { toAssertion } from './internal/assertion.js';
+import { GeneralAssertionBuilder, NumericAssertionBuilder, } from './internal/assertion.js';
+import { operatorsForProperty } from './internal/assertion-grammar.js';
+import { certificateGrammar, connectionGrammar } from './ssl-assertion-grammar.js';
 /**
- * Known TLS protocol versions for use with {@link SslAssertionBuilder.tlsVersion}.
+ * Known TLS protocol versions for use as a target of the `tlsVersion` property on
+ * the {@link SslAssertionBuilder.connection} builder.
  *
  * @example
  * ```typescript
- * SslAssertionBuilder.tlsVersion().equals(TlsVersion.TLS1_3)
+ * SslAssertionBuilder.connection('tlsVersion').equals(TlsVersion.TLS1_3)
  * ```
  */
 export const TlsVersion = {
@@ -16,11 +19,12 @@ export const TlsVersion = {
 /**
  * Signature algorithms as reported by Go's `x509.Certificate.SignatureAlgorithm.String()`.
  * These are the exact values the SSL runner evaluates assertions against — use these
- * constants (or the string literals they represent) with {@link SslAssertionBuilder.signatureAlgorithm}.
+ * constants (or the string literals they represent) as a target of the
+ * `signatureAlgorithm` property on the {@link SslAssertionBuilder.certificate} builder.
  *
  * @example
  * ```typescript
- * SslAssertionBuilder.signatureAlgorithm().equals(SignatureAlgorithm.SHA256_RSA)
+ * SslAssertionBuilder.certificate('signatureAlgorithm').equals(SignatureAlgorithm.SHA256_RSA)
  * ```
  */
 export const SignatureAlgorithm = {
@@ -46,14 +50,14 @@ export const SignatureAlgorithm = {
     ED25519: 'Ed25519',
 };
 /**
- * Commonly-used IANA cipher suite names for use with
- * {@link SslAssertionBuilder.cipherSuite}. Includes TLS 1.3 suites and
- * widely-deployed TLS 1.2 suites.
+ * Commonly-used IANA cipher suite names for use as a target of the `cipherSuite`
+ * property on the {@link SslAssertionBuilder.connection} builder. Includes TLS 1.3
+ * suites and widely-deployed TLS 1.2 suites.
  *
  * @example
  * ```typescript
- * SslAssertionBuilder.cipherSuite().equals(CipherSuite.TLS_AES_256_GCM_SHA384)
- * SslAssertionBuilder.cipherSuite().equals(CipherSuite.TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256)
+ * SslAssertionBuilder.connection('cipherSuite').equals(CipherSuite.TLS_AES_256_GCM_SHA384)
+ * SslAssertionBuilder.connection('cipherSuite').equals(CipherSuite.TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256)
  * ```
  */
 export const CipherSuite = {
@@ -76,192 +80,71 @@ export const CipherSuite = {
     TLS_RSA_WITH_AES_128_CBC_SHA: 'TLS_RSA_WITH_AES_128_CBC_SHA',
     TLS_RSA_WITH_AES_256_CBC_SHA: 'TLS_RSA_WITH_AES_256_CBC_SHA',
 };
-// One builder class per SSL source, each exposing only the operators (and value
-// type) the backend accepts for that source. The classes are stateless — the source
-// is baked into each `toAssertion` call — and are not exported: they are reachable
-// only through `SslAssertionBuilder`, so they stay out of the package's public API.
-/** Days until the certificate expires (numeric). */
-class CertExpiresInDaysAssertionBuilder {
-    equals(target) {
-        return toAssertion('CERT_EXPIRES_IN_DAYS', 'EQUALS', target);
-    }
-    notEquals(target) {
-        return toAssertion('CERT_EXPIRES_IN_DAYS', 'NOT_EQUALS', target);
-    }
-    lessThan(target) {
-        return toAssertion('CERT_EXPIRES_IN_DAYS', 'LESS_THAN', target);
-    }
-    greaterThan(target) {
-        return toAssertion('CERT_EXPIRES_IN_DAYS', 'GREATER_THAN', target);
-    }
-}
-/** Certificate key size in bits (numeric, exact match only). */
-class KeySizeBitsAssertionBuilder {
-    equals(target) {
-        return toAssertion('KEY_SIZE_BITS', 'EQUALS', target);
-    }
-}
-/** Whether the certificate is not expired (boolean). */
-class CertNotExpiredAssertionBuilder {
-    equals(target) {
-        return toAssertion('CERT_NOT_EXPIRED', 'EQUALS', target);
-    }
-}
-/** Whether the hostname is verified (boolean). */
-class HostnameVerifiedAssertionBuilder {
-    equals(target) {
-        return toAssertion('HOSTNAME_VERIFIED', 'EQUALS', target);
-    }
-}
-/** Whether the certificate chain is trusted (boolean). */
-class ChainTrustedAssertionBuilder {
-    equals(target) {
-        return toAssertion('CHAIN_TRUSTED', 'EQUALS', target);
-    }
-}
-/** Whether a stapled OCSP response was provided during the handshake (boolean). */
-class OcspStapledAssertionBuilder {
-    equals(target) {
-        return toAssertion('OCSP_STAPLED', 'EQUALS', target);
-    }
-}
-/** Negotiated TLS version — `.equals()` accepts only known TLS version strings. */
-class TlsVersionAssertionBuilder {
-    equals(target) {
-        return toAssertion('TLS_VERSION', 'EQUALS', target);
-    }
-}
-/**
- * Certificate signature algorithm. `.equals()` takes a Go
- * `x509.Certificate.SignatureAlgorithm.String()` value; `.matches()` takes a regex.
- */
-class SignatureAlgorithmAssertionBuilder {
-    equals(target) {
-        return toAssertion('SIGNATURE_ALGORITHM', 'EQUALS', target);
-    }
-    matches(target) {
-        return toAssertion('SIGNATURE_ALGORITHM', 'MATCHES', target);
-    }
-}
-/** Negotiated cipher suite (string) — exact, not-equal, or regex match. */
-class CipherSuiteAssertionBuilder {
-    equals(target) {
-        return toAssertion('CIPHER_SUITE', 'EQUALS', target);
-    }
-    notEquals(target) {
-        return toAssertion('CIPHER_SUITE', 'NOT_EQUALS', target);
-    }
-    matches(target) {
-        return toAssertion('CIPHER_SUITE', 'MATCHES', target);
-    }
-}
-/** Certificate issuer common name (string) — exact, not-equal, or regex match. */
-class IssuerCnAssertionBuilder {
-    equals(target) {
-        return toAssertion('ISSUER_CN', 'EQUALS', target);
-    }
-    notEquals(target) {
-        return toAssertion('ISSUER_CN', 'NOT_EQUALS', target);
-    }
-    matches(target) {
-        return toAssertion('ISSUER_CN', 'MATCHES', target);
-    }
-}
-/** Certificate SHA-256 fingerprint (string, exact match only). */
-class CertFingerprintSha256AssertionBuilder {
-    equals(target) {
-        return toAssertion('CERT_FINGERPRINT_SHA256', 'EQUALS', target);
-    }
-}
-/** Issuer SHA-256 fingerprint (string, exact match only). */
-class IssuerFingerprintSha256AssertionBuilder {
-    equals(target) {
-        return toAssertion('ISSUER_FINGERPRINT_SHA256', 'EQUALS', target);
-    }
-}
 /**
  * Builder class for creating SSL monitor assertions.
- * Provides methods to create assertions for TLS certificates.
+ *
+ * Assertions are property-scoped: {@link certificate} and {@link connection} take the
+ * name of a certificate/connection property, {@link jsonResponse} takes a JSONPath and
+ * {@link textResponse} an optional regex. The comparison operators the backend accepts
+ * depend on the property's value type and are validated at deploy time.
  *
  * @example
  * ```typescript
- * // Alert when the certificate is within 30 days of expiry
- * SslAssertionBuilder.certExpiresInDays().greaterThan(30)
- *
- * // Require a trusted chain and a verified hostname
- * SslAssertionBuilder.chainTrusted().equals(true)
- * SslAssertionBuilder.hostnameVerified().equals(true)
+ * // Certificate facts, addressed by property name
+ * SslAssertionBuilder.certificate('daysUntilExpiry').greaterThan(30)
+ * SslAssertionBuilder.certificate('issuerCN').contains("Let's Encrypt")
+ * SslAssertionBuilder.certificate('signatureAlgorithm').equals(SignatureAlgorithm.SHA256_RSA)
+ * SslAssertionBuilder.certificate('selfSigned').equals(false)
  *
- * // Enforce a specific TLS version and key size
- * SslAssertionBuilder.tlsVersion().equals('TLS1.3')
- * SslAssertionBuilder.keySizeBits().equals(2048)
+ * // Connection / handshake facts
+ * SslAssertionBuilder.connection('tlsVersion').equals(TlsVersion.TLS1_3)
+ * SslAssertionBuilder.connection('cipherSuite').equals(CipherSuite.TLS_AES_256_GCM_SHA384)
+ * SslAssertionBuilder.connection('chainTrusted').equals(true)
  *
- * // Match the issuer or cipher suite against a regex
- * SslAssertionBuilder.issuerCn().matches("^Let's Encrypt")
- * SslAssertionBuilder.cipherSuite().matches('TLS_(AES|CHACHA)')
+ * // Response time, JSON and text responses
+ * SslAssertionBuilder.responseTime().lessThan(1000)
+ * SslAssertionBuilder.jsonResponse('$.status').equals('ok')
+ * SslAssertionBuilder.textResponse().contains('healthy')
  * ```
  */
 export class SslAssertionBuilder {
-    /** Assertion builder for the number of days until the certificate expires. */
-    static certExpiresInDays() {
-        return new CertExpiresInDaysAssertionBuilder();
-    }
-    /** Assertion builder for the certificate key size in bits. */
-    static keySizeBits() {
-        return new KeySizeBitsAssertionBuilder();
-    }
-    /** Assertion builder for whether the certificate is not expired. */
-    static certNotExpired() {
-        return new CertNotExpiredAssertionBuilder();
-    }
-    /** Assertion builder for whether the hostname is verified. */
-    static hostnameVerified() {
-        return new HostnameVerifiedAssertionBuilder();
-    }
-    /** Assertion builder for whether the certificate chain is trusted. */
-    static chainTrusted() {
-        return new ChainTrustedAssertionBuilder();
-    }
     /**
-     * Assertion builder for the negotiated TLS version. `.equals()` accepts only the
-     * known TLS version strings — use the {@link TlsVersion} constants or the string
-     * literals `'TLS1.0'`…`'TLS1.3'`.
+     * Creates an assertion builder for a certificate property.
+     * @param property The certificate property to assert on (e.g. `'daysUntilExpiry'`,
+     *   `'issuerCN'`, `'signatureAlgorithm'`, `'sans'`, `'selfSigned'`).
      */
-    static tlsVersion() {
-        return new TlsVersionAssertionBuilder();
+    static certificate(property) {
+        return operatorsForProperty(certificateGrammar, 'CERTIFICATE', property);
     }
     /**
-     * Assertion builder for the negotiated cipher suite. Go's `tls.CipherSuiteName()`
-     * can return hundreds of IANA names plus `0x....` hex fallbacks, so `.equals()` is
-     * unconstrained; use the {@link CipherSuite} constants for common suites, or
-     * `.matches()` with a regex pattern.
+     * Creates an assertion builder for a connection property.
+     * @param property The connection property to assert on (e.g. `'tlsVersion'`,
+     *   `'cipherSuite'`, `'hostnameVerified'`, `'ocspStatus'`, `'resolvedIp'`).
      */
-    static cipherSuite() {
-        return new CipherSuiteAssertionBuilder();
-    }
-    /** Assertion builder for the certificate issuer common name. */
-    static issuerCn() {
-        return new IssuerCnAssertionBuilder();
+    static connection(property) {
+        return operatorsForProperty(connectionGrammar, 'CONNECTION', property);
     }
-    /** Assertion builder for the certificate SHA-256 fingerprint. */
-    static certFingerprintSha256() {
-        return new CertFingerprintSha256AssertionBuilder();
-    }
-    /** Assertion builder for the issuer SHA-256 fingerprint. */
-    static issuerFingerprintSha256() {
-        return new IssuerFingerprintSha256AssertionBuilder();
+    /**
+     * Creates an assertion builder for the TLS handshake response time in milliseconds.
+     */
+    static responseTime() {
+        return new NumericAssertionBuilder('RESPONSE_TIME');
     }
     /**
-     * Assertion builder for the certificate signature algorithm. `.equals()` takes a
-     * Go `x509.Certificate.SignatureAlgorithm.String()` value (e.g. `'SHA256-RSA'`) —
-     * use the {@link SignatureAlgorithm} constants — or `.matches()` with a regex.
+     * Creates an assertion builder for a JSON response body.
+     * @param property Optional JSONPath to a specific value (e.g. `'$.status'`).
      */
-    static signatureAlgorithm() {
-        return new SignatureAlgorithmAssertionBuilder();
+    static jsonResponse(property) {
+        return new GeneralAssertionBuilder('JSON_RESPONSE', property);
     }
-    /** Assertion builder for whether a stapled OCSP response was provided. */
-    static ocspStapled() {
-        return new OcspStapledAssertionBuilder();
+    /**
+     * Creates an assertion builder for a text response body.
+     * @param regex Optional regex pattern (with a capture group) used to extract the value
+     *   to compare from the serialized response document. Carried in the assertion's
+     *   `property` field — the slot the backend and runner read the pattern from.
+     */
+    static textResponse(regex) {
+        return new GeneralAssertionBuilder('TEXT_RESPONSE', regex);
     }
 }
 //# sourceMappingURL=ssl-assertion.js.map

package/dist/constructs/ssl-assertion.js.map

@@ -1 +1 @@
-{"version":3,"file":"ssl-assertion.js","sourceRoot":"","sources":["../../src/constructs/ssl-assertion.ts"],"names":[],"mappings":"AAAA,OAAO,EAA8B,WAAW,EAAE,MAAM,yBAAyB,CAAA;AAEjF;;;;;;;GAOG;AACH,MAAM,CAAC,MAAM,UAAU,GAAG;IACxB,MAAM,EAAE,QAAQ;IAChB,MAAM,EAAE,QAAQ;IAChB,MAAM,EAAE,QAAQ;IAChB,MAAM,EAAE,QAAQ;CACR,CAAA;AAIV;;;;;;;;;GASG;AACH,MAAM,CAAC,MAAM,kBAAkB,GAAG;IAChC,MAAM;IACN,OAAO,EAAE,SAAS;IAClB,OAAO,EAAE,SAAS;IAClB,QAAQ,EAAE,UAAU;IACpB,UAAU,EAAE,YAAY;IACxB,UAAU,EAAE,YAAY;IACxB,UAAU,EAAE,YAAY;IACxB,aAAa,EAAE,eAAe;IAC9B,aAAa,EAAE,eAAe;IAC9B,aAAa,EAAE,eAAe;IAC9B,MAAM;IACN,QAAQ,EAAE,UAAU;IACpB,UAAU,EAAE,YAAY;IACxB,QAAQ;IACR,UAAU,EAAE,YAAY;IACxB,YAAY,EAAE,cAAc;IAC5B,YAAY,EAAE,cAAc;IAC5B,YAAY,EAAE,cAAc;IAC5B,QAAQ;IACR,OAAO,EAAE,SAAS;CACV,CAAA;AAIV;;;;;;;;;;GAUG;AACH,MAAM,CAAC,MAAM,WAAW,GAAG;IACzB,UAAU;IACV,sBAAsB,EAAE,wBAAwB;IAChD,sBAAsB,EAAE,wBAAwB;IAChD,4BAA4B,EAAE,8BAA8B;IAC5D,8CAA8C;IAC9C,qCAAqC,EAAE,uCAAuC;IAC9E,qCAAqC,EAAE,uCAAuC;IAC9E,uCAAuC,EAAE,yCAAyC;IAClF,uCAAuC,EAAE,yCAAyC;IAClF,2CAA2C,EAAE,6CAA6C;IAC1F,6CAA6C,EAAE,+CAA+C;IAC9F,6BAA6B;IAC7B,+BAA+B,EAAE,iCAAiC;IAClE,+BAA+B,EAAE,iCAAiC;IAClE,+BAA+B,EAAE,iCAAiC;IAClE,+BAA+B,EAAE,iCAAiC;IAClE,4BAA4B,EAAE,8BAA8B;IAC5D,4BAA4B,EAAE,8BAA8B;CACpD,CAAA;AAoBV,gFAAgF;AAChF,oFAAoF;AACpF,mFAAmF;AACnF,oFAAoF;AAEpF,oDAAoD;AACpD,MAAM,iCAAiC;IACrC,MAAM,CAAE,MAAc;QACpB,OAAO,WAAW,CAAC,sBAAsB,EAAE,QAAQ,EAAE,MAAM,CAAC,CAAA;IAC9D,CAAC;IAED,SAAS,CAAE,MAAc;QACvB,OAAO,WAAW,CAAC,sBAAsB,EAAE,YAAY,EAAE,MAAM,CAAC,CAAA;IAClE,CAAC;IAED,QAAQ,CAAE,MAAc;QACtB,OAAO,WAAW,CAAC,sBAAsB,EAAE,WAAW,EAAE,MAAM,CAAC,CAAA;IACjE,CAAC;IAED,WAAW,CAAE,MAAc;QACzB,OAAO,WAAW,CAAC,sBAAsB,EAAE,cAAc,EAAE,MAAM,CAAC,CAAA;IACpE,CAAC;CACF;AAED,gEAAgE;AAChE,MAAM,2BAA2B;IAC/B,MAAM,CAAE,MAAc;QACpB,OAAO,WAAW,CAAC,eAAe,EAAE,QAAQ,EAAE,MAAM,CAAC,CAAA;IACvD,CAAC;CACF;AAED,wDAAwD;AACxD,MAAM,8BAA8B;IAClC,MAAM,CAAE,MAAe;QACrB,OAAO,WAAW,CAAC,kBAAkB,EAAE,QAAQ,EAAE,MAAM,CAAC,CAAA;IAC1D,CAAC;CACF;AAED,kDAAkD;AAClD,MAAM,gCAAgC;IACpC,MAAM,CAAE,MAAe;QACrB,OAAO,WAAW,CAAC,mBAAmB,EAAE,QAAQ,EAAE,MAAM,CAAC,CAAA;IAC3D,CAAC;CACF;AAED,0DAA0D;AAC1D,MAAM,4BAA4B;IAChC,MAAM,CAAE,MAAe;QACrB,OAAO,WAAW,CAAC,eAAe,EAAE,QAAQ,EAAE,MAAM,CAAC,CAAA;IACvD,CAAC;CACF;AAED,mFAAmF;AACnF,MAAM,2BAA2B;IAC/B,MAAM,CAAE,MAAe;QACrB,OAAO,WAAW,CAAC,cAAc,EAAE,QAAQ,EAAE,MAAM,CAAC,CAAA;IACtD,CAAC;CACF;AAED,mFAAmF;AACnF,MAAM,0BAA0B;IAC9B,MAAM,CAAE,MAAuB;QAC7B,OAAO,WAAW,CAAC,aAAa,EAAE,QAAQ,EAAE,MAAM,CAAC,CAAA;IACrD,CAAC;CACF;AAED;;;GAGG;AACH,MAAM,kCAAkC;IACtC,MAAM,CAAE,MAA+B;QACrC,OAAO,WAAW,CAAC,qBAAqB,EAAE,QAAQ,EAAE,MAAM,CAAC,CAAA;IAC7D,CAAC;IAED,OAAO,CAAE,MAAc;QACrB,OAAO,WAAW,CAAC,qBAAqB,EAAE,SAAS,EAAE,MAAM,CAAC,CAAA;IAC9D,CAAC;CACF;AAED,2EAA2E;AAC3E,MAAM,2BAA2B;IAC/B,MAAM,CAAE,MAAc;QACpB,OAAO,WAAW,CAAC,cAAc,EAAE,QAAQ,EAAE,MAAM,CAAC,CAAA;IACtD,CAAC;IAED,SAAS,CAAE,MAAc;QACvB,OAAO,WAAW,CAAC,cAAc,EAAE,YAAY,EAAE,MAAM,CAAC,CAAA;IAC1D,CAAC;IAED,OAAO,CAAE,MAAc;QACrB,OAAO,WAAW,CAAC,cAAc,EAAE,SAAS,EAAE,MAAM,CAAC,CAAA;IACvD,CAAC;CACF;AAED,kFAAkF;AAClF,MAAM,wBAAwB;IAC5B,MAAM,CAAE,MAAc;QACpB,OAAO,WAAW,CAAC,WAAW,EAAE,QAAQ,EAAE,MAAM,CAAC,CAAA;IACnD,CAAC;IAED,SAAS,CAAE,MAAc;QACvB,OAAO,WAAW,CAAC,WAAW,EAAE,YAAY,EAAE,MAAM,CAAC,CAAA;IACvD,CAAC;IAED,OAAO,CAAE,MAAc;QACrB,OAAO,WAAW,CAAC,WAAW,EAAE,SAAS,EAAE,MAAM,CAAC,CAAA;IACpD,CAAC;CACF;AAED,kEAAkE;AAClE,MAAM,qCAAqC;IACzC,MAAM,CAAE,MAAc;QACpB,OAAO,WAAW,CAAC,yBAAyB,EAAE,QAAQ,EAAE,MAAM,CAAC,CAAA;IACjE,CAAC;CACF;AAED,6DAA6D;AAC7D,MAAM,uCAAuC;IAC3C,MAAM,CAAE,MAAc;QACpB,OAAO,WAAW,CAAC,2BAA2B,EAAE,QAAQ,EAAE,MAAM,CAAC,CAAA;IACnE,CAAC;CACF;AAED;;;;;;;;;;;;;;;;;;;;;GAqBG;AACH,MAAM,OAAO,mBAAmB;IAC9B,8EAA8E;IAC9E,MAAM,CAAC,iBAAiB;QACtB,OAAO,IAAI,iCAAiC,EAAE,CAAA;IAChD,CAAC;IAED,8DAA8D;IAC9D,MAAM,CAAC,WAAW;QAChB,OAAO,IAAI,2BAA2B,EAAE,CAAA;IAC1C,CAAC;IAED,oEAAoE;IACpE,MAAM,CAAC,cAAc;QACnB,OAAO,IAAI,8BAA8B,EAAE,CAAA;IAC7C,CAAC;IAED,8DAA8D;IAC9D,MAAM,CAAC,gBAAgB;QACrB,OAAO,IAAI,gCAAgC,EAAE,CAAA;IAC/C,CAAC;IAED,sEAAsE;IACtE,MAAM,CAAC,YAAY;QACjB,OAAO,IAAI,4BAA4B,EAAE,CAAA;IAC3C,CAAC;IAED;;;;OAIG;IACH,MAAM,CAAC,UAAU;QACf,OAAO,IAAI,0BAA0B,EAAE,CAAA;IACzC,CAAC;IAED;;;;;OAKG;IACH,MAAM,CAAC,WAAW;QAChB,OAAO,IAAI,2BAA2B,EAAE,CAAA;IAC1C,CAAC;IAED,gEAAgE;IAChE,MAAM,CAAC,QAAQ;QACb,OAAO,IAAI,wBAAwB,EAAE,CAAA;IACvC,CAAC;IAED,iEAAiE;IACjE,MAAM,CAAC,qBAAqB;QAC1B,OAAO,IAAI,qCAAqC,EAAE,CAAA;IACpD,CAAC;IAED,4DAA4D;IAC5D,MAAM,CAAC,uBAAuB;QAC5B,OAAO,IAAI,uCAAuC,EAAE,CAAA;IACtD,CAAC;IAED;;;;OAIG;IACH,MAAM,CAAC,kBAAkB;QACvB,OAAO,IAAI,kCAAkC,EAAE,CAAA;IACjD,CAAC;IAED,0EAA0E;IAC1E,MAAM,CAAC,WAAW;QAChB,OAAO,IAAI,2BAA2B,EAAE,CAAA;IAC1C,CAAC;CACF"}
+{"version":3,"file":"ssl-assertion.js","sourceRoot":"","sources":["../../src/constructs/ssl-assertion.ts"],"names":[],"mappings":"AAAA,OAAO,EAEL,uBAAuB,EACvB,uBAAuB,GACxB,MAAM,yBAAyB,CAAA;AAChC,OAAO,EAAqB,oBAAoB,EAAE,MAAM,iCAAiC,CAAA;AACzF,OAAO,EAAE,kBAAkB,EAAE,iBAAiB,EAAE,MAAM,4BAA4B,CAAA;AAElF;;;;;;;;GAQG;AACH,MAAM,CAAC,MAAM,UAAU,GAAG;IACxB,MAAM,EAAE,QAAQ;IAChB,MAAM,EAAE,QAAQ;IAChB,MAAM,EAAE,QAAQ;IAChB,MAAM,EAAE,QAAQ;CACR,CAAA;AAIV;;;;;;;;;;GAUG;AACH,MAAM,CAAC,MAAM,kBAAkB,GAAG;IAChC,MAAM;IACN,OAAO,EAAE,SAAS;IAClB,OAAO,EAAE,SAAS;IAClB,QAAQ,EAAE,UAAU;IACpB,UAAU,EAAE,YAAY;IACxB,UAAU,EAAE,YAAY;IACxB,UAAU,EAAE,YAAY;IACxB,aAAa,EAAE,eAAe;IAC9B,aAAa,EAAE,eAAe;IAC9B,aAAa,EAAE,eAAe;IAC9B,MAAM;IACN,QAAQ,EAAE,UAAU;IACpB,UAAU,EAAE,YAAY;IACxB,QAAQ;IACR,UAAU,EAAE,YAAY;IACxB,YAAY,EAAE,cAAc;IAC5B,YAAY,EAAE,cAAc;IAC5B,YAAY,EAAE,cAAc;IAC5B,QAAQ;IACR,OAAO,EAAE,SAAS;CACV,CAAA;AAIV;;;;;;;;;;GAUG;AACH,MAAM,CAAC,MAAM,WAAW,GAAG;IACzB,UAAU;IACV,sBAAsB,EAAE,wBAAwB;IAChD,sBAAsB,EAAE,wBAAwB;IAChD,4BAA4B,EAAE,8BAA8B;IAC5D,8CAA8C;IAC9C,qCAAqC,EAAE,uCAAuC;IAC9E,qCAAqC,EAAE,uCAAuC;IAC9E,uCAAuC,EAAE,yCAAyC;IAClF,uCAAuC,EAAE,yCAAyC;IAClF,2CAA2C,EAAE,6CAA6C;IAC1F,6CAA6C,EAAE,+CAA+C;IAC9F,6BAA6B;IAC7B,+BAA+B,EAAE,iCAAiC;IAClE,+BAA+B,EAAE,iCAAiC;IAClE,+BAA+B,EAAE,iCAAiC;IAClE,+BAA+B,EAAE,iCAAiC;IAClE,4BAA4B,EAAE,8BAA8B;IAC5D,4BAA4B,EAAE,8BAA8B;CACpD,CAAA;AA4BV;;;;;;;;;;;;;;;;;;;;;;;;;;GA0BG;AACH,MAAM,OAAO,mBAAmB;IAC9B;;;;OAIG;IACH,MAAM,CAAC,WAAW,CAChB,QAAkB;QAElB,OAAO,oBAAoB,CAAC,kBAAkB,EAAE,aAAa,EAAE,QAAQ,CAAC,CAAA;IAC1E,CAAC;IAED;;;;OAIG;IACH,MAAM,CAAC,UAAU,CACf,QAAkB;QAElB,OAAO,oBAAoB,CAAC,iBAAiB,EAAE,YAAY,EAAE,QAAQ,CAAC,CAAA;IACxE,CAAC;IAED;;OAEG;IACH,MAAM,CAAC,YAAY;QACjB,OAAO,IAAI,uBAAuB,CAAqB,eAAe,CAAC,CAAA;IACzE,CAAC;IAED;;;OAGG;IACH,MAAM,CAAC,YAAY,CAAE,QAAiB;QACpC,OAAO,IAAI,uBAAuB,CAAqB,eAAe,EAAE,QAAQ,CAAC,CAAA;IACnF,CAAC;IAED;;;;;OAKG;IACH,MAAM,CAAC,YAAY,CAAE,KAAc;QACjC,OAAO,IAAI,uBAAuB,CAAqB,eAAe,EAAE,KAAK,CAAC,CAAA;IAChF,CAAC;CACF"}

package/dist/constructs/traceroute-assertion-grammar.d.ts

@@ -0,0 +1,33 @@
+export declare const tracerouteResponseTimeGrammar: {
+    /** Average round-trip time in milliseconds. */
+    readonly avg: {
+        readonly operators: readonly ["equals", "notEquals", "greaterThan", "lessThan"];
+        readonly target: import("./internal/assertion-grammar.js").TargetSpec<number>;
+    };
+    /** Minimum round-trip time in milliseconds. */
+    readonly min: {
+        readonly operators: readonly ["equals", "notEquals", "greaterThan", "lessThan"];
+        readonly target: import("./internal/assertion-grammar.js").TargetSpec<number>;
+    };
+    /** Maximum round-trip time in milliseconds. */
+    readonly max: {
+        readonly operators: readonly ["equals", "notEquals", "greaterThan", "lessThan"];
+        readonly target: import("./internal/assertion-grammar.js").TargetSpec<number>;
+    };
+    /** Standard deviation of round-trip times. */
+    readonly stdDev: {
+        readonly operators: readonly ["equals", "notEquals", "greaterThan", "lessThan"];
+        readonly target: import("./internal/assertion-grammar.js").TargetSpec<number>;
+    };
+};
+/** Number of network hops. The backend omits notEquals. */
+export declare const hopCountGrammar: {
+    readonly operators: readonly ["equals", "greaterThan", "lessThan"];
+    readonly target: import("./internal/assertion-grammar.js").TargetSpec<number>;
+};
+/** Packet loss percentage (0-100). The backend omits notEquals. */
+export declare const packetLossGrammar: {
+    readonly operators: readonly ["equals", "greaterThan", "lessThan"];
+    readonly target: import("./internal/assertion-grammar.js").TargetSpec<number>;
+};
+export declare const tracerouteResponseTimeComparisons: Record<string, Record<string, true>>;

package/dist/constructs/traceroute-assertion-grammar.js

@@ -0,0 +1,33 @@
+import { comparisonsForGrammar, defineGrammar, numberTarget } from './internal/assertion-grammar.js';
+// The single declaration of the traceroute assertion grammar. RESPONSE_TIME is
+// property-scoped over statistical properties, each taking the full numeric operator set.
+// HOP_COUNT and PACKET_LOSS are single scalar sources whose backend grammar omits
+// notEquals, so they exist as their own one-off declarations. The builder, its property
+// union, and the validation whitelist all derive from these tables.
+export const tracerouteResponseTimeGrammar = defineGrammar({
+    /** Average round-trip time in milliseconds. */
+    avg: { operators: ['equals', 'notEquals', 'greaterThan', 'lessThan'], target: numberTarget() },
+    /** Minimum round-trip time in milliseconds. */
+    min: { operators: ['equals', 'notEquals', 'greaterThan', 'lessThan'], target: numberTarget() },
+    /** Maximum round-trip time in milliseconds. */
+    max: { operators: ['equals', 'notEquals', 'greaterThan', 'lessThan'], target: numberTarget() },
+    /** Standard deviation of round-trip times. */
+    stdDev: { operators: ['equals', 'notEquals', 'greaterThan', 'lessThan'], target: numberTarget() },
+});
+/** Number of network hops. The backend omits notEquals. */
+export const hopCountGrammar = {
+    operators: ['equals', 'greaterThan', 'lessThan'],
+    target: numberTarget(),
+};
+/** Packet loss percentage (0-100). The backend omits notEquals. */
+export const packetLossGrammar = {
+    operators: ['equals', 'greaterThan', 'lessThan'],
+    target: numberTarget(),
+};
+// The wire comparisons each response-time property accepts, keyed by property. Derived here,
+// beside the grammar (as SSL keeps its comparison derivation), so validation is a thin
+// consumer and the two monitors resolve the same concept in the same place. Per-property
+// rather than one shared set, so a property that later diverges is validated against its own
+// row.
+export const tracerouteResponseTimeComparisons = Object.fromEntries(Object.entries(tracerouteResponseTimeGrammar).map(([property, decl]) => [property, comparisonsForGrammar(decl)]));
+//# sourceMappingURL=traceroute-assertion-grammar.js.map

package/dist/constructs/traceroute-assertion-grammar.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"traceroute-assertion-grammar.js","sourceRoot":"","sources":["../../src/constructs/traceroute-assertion-grammar.ts"],"names":[],"mappings":"AAAA,OAAO,EAAmB,qBAAqB,EAAE,aAAa,EAAE,YAAY,EAAE,MAAM,iCAAiC,CAAA;AAErH,+EAA+E;AAC/E,0FAA0F;AAC1F,kFAAkF;AAClF,wFAAwF;AACxF,oEAAoE;AAEpE,MAAM,CAAC,MAAM,6BAA6B,GAAG,aAAa,CAAC;IACzD,+CAA+C;IAC/C,GAAG,EAAE,EAAE,SAAS,EAAE,CAAC,QAAQ,EAAE,WAAW,EAAE,aAAa,EAAE,UAAU,CAAC,EAAE,MAAM,EAAE,YAAY,EAAE,EAAE;IAC9F,+CAA+C;IAC/C,GAAG,EAAE,EAAE,SAAS,EAAE,CAAC,QAAQ,EAAE,WAAW,EAAE,aAAa,EAAE,UAAU,CAAC,EAAE,MAAM,EAAE,YAAY,EAAE,EAAE;IAC9F,+CAA+C;IAC/C,GAAG,EAAE,EAAE,SAAS,EAAE,CAAC,QAAQ,EAAE,WAAW,EAAE,aAAa,EAAE,UAAU,CAAC,EAAE,MAAM,EAAE,YAAY,EAAE,EAAE;IAC9F,8CAA8C;IAC9C,MAAM,EAAE,EAAE,SAAS,EAAE,CAAC,QAAQ,EAAE,WAAW,EAAE,aAAa,EAAE,UAAU,CAAC,EAAE,MAAM,EAAE,YAAY,EAAE,EAAE;CAClG,CAAC,CAAA;AAEF,2DAA2D;AAC3D,MAAM,CAAC,MAAM,eAAe,GAAG;IAC7B,SAAS,EAAE,CAAC,QAAQ,EAAE,aAAa,EAAE,UAAU,CAAC;IAChD,MAAM,EAAE,YAAY,EAAE;CACY,CAAA;AAEpC,mEAAmE;AACnE,MAAM,CAAC,MAAM,iBAAiB,GAAG;IAC/B,SAAS,EAAE,CAAC,QAAQ,EAAE,aAAa,EAAE,UAAU,CAAC;IAChD,MAAM,EAAE,YAAY,EAAE;CACY,CAAA;AAEpC,6FAA6F;AAC7F,uFAAuF;AACvF,yFAAyF;AACzF,6FAA6F;AAC7F,OAAO;AACP,MAAM,CAAC,MAAM,iCAAiC,GAC5C,MAAM,CAAC,WAAW,CAChB,MAAM,CAAC,OAAO,CAAC,6BAA6B,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,QAAQ,EAAE,IAAI,CAAC,EAAE,EAAE,CAAC,CAAC,QAAQ,EAAE,qBAAqB,CAAC,IAAI,CAAC,CAAC,CAAC,CACjH,CAAA"}