fix(ssl): carry the textResponse regex in the assertion property slot

The backend Joi schema and the go-runner (EvaluateRegExp) read the
TEXT_RESPONSE extraction pattern from `property`; the `regex` field is
never consulted. textResponse(pattern) previously emitted the pattern into
`regex`, so it validated fine but was silently ignored at evaluation —
the comparison ran against the whole serialized response document. Emit it
as `property` (builder + import codegen) and pin the wire shape in tests.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01DXP63MTUyPnuc48ZWGovhR

Author: danielpaulus

packages/cli/src/constructs/__tests__/ssl-assertion-codegen.spec.ts

@@ -48,14 +48,14 @@ describe('SSL Assertion Codegen', () => {
         input: { source: 'JSON_RESPONSE', property: '$.status', comparison: 'EQUALS', target: 'ok', regex: null },
         expected: 'SslAssertionBuilder.jsonResponse(\'$.status\').equals(\'ok\')\n',
       },
-      // TEXT_RESPONSE emits the regex slot, not a property.
+      // TEXT_RESPONSE carries its regex in the property slot (the backend/runner contract).
       {
         input: { source: 'TEXT_RESPONSE', property: '', comparison: 'CONTAINS', target: 'healthy', regex: null },
         expected: 'SslAssertionBuilder.textResponse().contains(\'healthy\')\n',
       },
       {
-        input: { source: 'TEXT_RESPONSE', property: '', comparison: 'EQUALS', target: 'ok', regex: 'status: OK' },
-        expected: 'SslAssertionBuilder.textResponse(\'status: OK\').equals(\'ok\')\n',
+        input: { source: 'TEXT_RESPONSE', property: 'status: (\\w+)', comparison: 'EQUALS', target: 'ok', regex: null },
+        expected: 'SslAssertionBuilder.textResponse(\'status: (\\\\w+)\').equals(\'ok\')\n',
       },
     ]
     for (const test of cases) {

packages/cli/src/constructs/__tests__/ssl-assertion.spec.ts

@@ -117,8 +117,10 @@ describe('SslAssertionBuilder', () => {
       expect(SslAssertionBuilder.textResponse().contains('healthy')).toMatchObject({
         source: 'TEXT_RESPONSE', property: '', comparison: 'CONTAINS', target: 'healthy', regex: null,
       })
+      // The pattern rides in `property` — the slot the backend Joi schema and the
+      // go-runner (EvaluateRegExp) read the TEXT_RESPONSE pattern from; `regex` is dead.
       expect(SslAssertionBuilder.textResponse('status: (\\w+)').equals('ok')).toMatchObject({
-        source: 'TEXT_RESPONSE', property: '', comparison: 'EQUALS', target: 'ok', regex: 'status: (\\w+)',
+        source: 'TEXT_RESPONSE', property: 'status: (\\w+)', comparison: 'EQUALS', target: 'ok', regex: null,
       })
     })
   })

packages/cli/src/constructs/ssl-assertion-codegen.ts

@@ -8,11 +8,11 @@ import {
 import { isSslNumericTarget, sslPropertyValueType } from './internal/ssl-properties.js'
 import { SslAssertion } from './ssl-assertion.js'
 
-// CERTIFICATE / CONNECTION / JSON_RESPONSE address a value by property name and carry
-// no regex, so the property slot is emitted and the regex slot suppressed.
+// Every SSL source addresses its value through the property slot — CERTIFICATE /
+// CONNECTION use a field selector, JSON_RESPONSE a JSONPath, and TEXT_RESPONSE a
+// regex (the backend and runner read the TEXT_RESPONSE pattern from `property`,
+// not `regex`). The regex slot is never emitted.
 const withProperty = { hasProperty: true, hasRegex: false }
-// TEXT_RESPONSE carries a regex and no property.
-const withRegex = { hasProperty: false, hasRegex: true }
 
 // The comparisons each typed helper can render. A comparison outside the set makes the
 // helper throw, which would abort the whole import over a single assertion, so the
@@ -71,7 +71,7 @@ export function valueForSslAssertion (genfile: GeneratedFile, assertion: SslAsse
     case 'JSON_RESPONSE':
       return valueForGeneralAssertion('SslAssertionBuilder', 'jsonResponse', assertion, withProperty)
     case 'TEXT_RESPONSE':
-      return valueForGeneralAssertion('SslAssertionBuilder', 'textResponse', assertion, withRegex)
+      return valueForGeneralAssertion('SslAssertionBuilder', 'textResponse', assertion, withProperty)
     case 'RESPONSE_TIME':
       return valueForNumericAssertion('SslAssertionBuilder', 'responseTime', assertion)
     default:

packages/cli/src/constructs/ssl-assertion.ts

@@ -501,9 +501,11 @@ export class SslAssertionBuilder {
 
   /**
    * Creates an assertion builder for a text response body.
-   * @param regex Optional regex pattern applied to the response text before comparison.
+   * @param regex Optional regex pattern (with a capture group) used to extract the value
+   *   to compare from the serialized response document. Carried in the assertion's
+   *   `property` field — the slot the backend and runner read the pattern from.
    */
   static textResponse (regex?: string) {
-    return new GeneralAssertionBuilder<SslAssertionSource>('TEXT_RESPONSE', undefined, regex)
+    return new GeneralAssertionBuilder<SslAssertionSource>('TEXT_RESPONSE', regex)
   }
 }