fix(cli): emit ocspStapled in SSL assertion codegen [SIM-313] (#1396)

* fix(cli): emit ocspStapled in SSL assertion codegen [SIM-313]

PR #1392 added 'OCSP_STAPLED' to SslAssertionSource and the matching
SslAssertionBuilder.ocspStapled() builder, but never added the codegen case.
valueForSslAssertion fell through to its `default:` clause, so `checkly import`
threw `Unsupported SSL assertion source OCSP_STAPLED` and aborted whenever it
rendered an SSL monitor carrying an OCSP-stapling assertion.

Add the case, mapping to ocspStapled with the existing generalNoArgs shape —
the same no-property/no-regex shape as the neighbouring CHAIN_TRUSTED,
HOSTNAME_VERIFIED and CERT_NOT_EXPIRED cases.

Also extend the SSL codegen round-trip test to cover all 12 assertion sources
with their exact emitted call chains; it previously exercised only
CERT_EXPIRES_IN_DAYS and CHAIN_TRUSTED, which is why the gap went unnoticed.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

* refactor(cli): make assertion-source codegen switches exhaustive [SIM-313]

Every assertion-source `switch (assertion.source)` ended in `default: throw`,
which leaves the switch non-exhaustive at compile time: adding a member to an
assertion source union produces no type error, so tsc stays green and the
missing codegen case surfaces only as a runtime throw during `checkly import`.
That is exactly how the OCSP_STAPLED gap reached main.

Add a shared unsupportedAssertionSource(source: never, kind?: string) guard and
use it as the default clause in all eight switches (api, dns, grpc, icmp, ssl,
tcp, traceroute, url). Since Assertion<Source>.source is typed as the literal
union, TypeScript narrows it to never in an exhaustive default, so an unhandled
member now fails to compile. The runtime throw is retained because wire data may
carry a source this version of the CLI does not know about.

`kind` is optional because the API check's message carries no kind word; all
eight messages remain byte-identical, now locked by assertion-codegen.spec.ts.

The comparison switches cannot be guarded the same way: Assertion.comparison is
typed `string` rather than the Comparison union, which would need wire-data
retyping.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

---------

Co-authored-by: Claude Opus 4.8 <noreply@anthropic.com>

Author: sorccu

packages/cli/src/constructs/__tests__/assertion-codegen.spec.ts

@@ -0,0 +1,54 @@
+import { describe, it, expect } from 'vitest'
+
+import { GeneratedFile } from '../../sourcegen/index.js'
+import { valueForAssertion } from '../api-assertion-codegen.js'
+import { valueForDnsAssertion } from '../dns-assertion-codegen.js'
+import { valueForGrpcAssertion } from '../grpc-assertion-codegen.js'
+import { valueForIcmpAssertion } from '../icmp-assertion-codegen.js'
+import { valueForSslAssertion } from '../ssl-assertion-codegen.js'
+import { valueForTcpAssertion } from '../tcp-monitor-codegen.js'
+import { valueForTracerouteAssertion } from '../traceroute-assertion-codegen.js'
+import { valueForUrlAssertion } from '../url-assertion-codegen.js'
+
+const genfile = new GeneratedFile('foo.ts')
+
+// A source no assertion union contains. The compile-time exhaustiveness guard is
+// what normally prevents this, so reaching it requires bypassing the type — wire
+// data from a newer backend can still carry such a source at runtime.
+const unknownSource = {
+  source: 'NOT_A_REAL_SOURCE',
+  property: '',
+  comparison: 'EQUALS',
+  target: 'x',
+  regex: null,
+} as unknown as never
+
+describe('unsupportedAssertionSource', () => {
+  // Locks the exact user-visible text of every assertion-source default clause.
+  // The shared helper builds these messages from an optional `kind`, so a
+  // regression there (an empty-string kind, a changed template) would otherwise
+  // pass silently — note the API check's message deliberately carries no kind word.
+  it.each([
+    ['API', () => valueForAssertion(genfile, unknownSource), 'Unsupported assertion source NOT_A_REAL_SOURCE'],
+    ['DNS', () => valueForDnsAssertion(genfile, unknownSource), 'Unsupported DNS assertion source NOT_A_REAL_SOURCE'],
+    ['gRPC', () => valueForGrpcAssertion(genfile, unknownSource), 'Unsupported gRPC assertion source NOT_A_REAL_SOURCE'],
+    ['ICMP', () => valueForIcmpAssertion(genfile, unknownSource), 'Unsupported ICMP assertion source NOT_A_REAL_SOURCE'],
+    ['SSL', () => valueForSslAssertion(genfile, unknownSource), 'Unsupported SSL assertion source NOT_A_REAL_SOURCE'],
+    ['TCP', () => valueForTcpAssertion(genfile, unknownSource), 'Unsupported TCP assertion source NOT_A_REAL_SOURCE'],
+    [
+      'traceroute',
+      () => valueForTracerouteAssertion(genfile, unknownSource),
+      'Unsupported traceroute assertion source NOT_A_REAL_SOURCE',
+    ],
+    ['URL', () => valueForUrlAssertion(genfile, unknownSource), 'Unsupported URL assertion source NOT_A_REAL_SOURCE'],
+  ])('%s codegen throws with its own message for an unknown source', (_name, valueFor, message) => {
+    let thrown: unknown
+    try {
+      valueFor()
+    } catch (err) {
+      thrown = err
+    }
+    expect(thrown).toBeInstanceOf(Error)
+    expect((thrown as Error).message).toBe(message)
+  })
+})

packages/cli/src/constructs/__tests__/uptime-monitor-codegen.spec.ts

@@ -181,6 +181,46 @@ describe('SslMonitorCodegen', () => {
     expect(source).toContain('certExpiresInDays()')
     expect(source).toContain('chainTrusted()')
   })
+
+  it('emits every SslAssertionBuilder source with its target', async () => {
+    const source = await renderResource(env, p => new SslMonitorCodegen(p), resource({
+      request: {
+        sslConfig: { hostname: 'example.com' },
+        assertions: [
+          { source: 'CERT_EXPIRES_IN_DAYS', property: '', comparison: 'GREATER_THAN', target: '20', regex: null },
+          { source: 'KEY_SIZE_BITS', property: '', comparison: 'EQUALS', target: '2048', regex: null },
+          { source: 'CERT_NOT_EXPIRED', property: '', comparison: 'EQUALS', target: 'true', regex: null },
+          { source: 'HOSTNAME_VERIFIED', property: '', comparison: 'EQUALS', target: 'true', regex: null },
+          { source: 'CHAIN_TRUSTED', property: '', comparison: 'EQUALS', target: 'true', regex: null },
+          { source: 'OCSP_STAPLED', property: '', comparison: 'EQUALS', target: 'true', regex: null },
+          { source: 'TLS_VERSION', property: '', comparison: 'EQUALS', target: 'TLS1.3', regex: null },
+          {
+            source: 'CIPHER_SUITE',
+            property: '',
+            comparison: 'EQUALS',
+            target: 'TLS_AES_256_GCM_SHA384',
+            regex: null,
+          },
+          { source: 'SIGNATURE_ALGORITHM', property: '', comparison: 'EQUALS', target: 'SHA256-RSA', regex: null },
+          { source: 'ISSUER_CN', property: '', comparison: 'EQUALS', target: 'Example CA', regex: null },
+          { source: 'CERT_FINGERPRINT_SHA256', property: '', comparison: 'EQUALS', target: 'abc123', regex: null },
+          { source: 'ISSUER_FINGERPRINT_SHA256', property: '', comparison: 'EQUALS', target: 'def456', regex: null },
+        ],
+      },
+    }))
+    expect(source).toContain('certExpiresInDays().greaterThan(20)')
+    expect(source).toContain('keySizeBits().equals(2048)')
+    expect(source).toContain('certNotExpired().equals(\'true\')')
+    expect(source).toContain('hostnameVerified().equals(\'true\')')
+    expect(source).toContain('chainTrusted().equals(\'true\')')
+    expect(source).toContain('ocspStapled().equals(\'true\')')
+    expect(source).toContain('tlsVersion().equals(\'TLS1.3\')')
+    expect(source).toContain('cipherSuite().equals(\'TLS_AES_256_GCM_SHA384\')')
+    expect(source).toContain('signatureAlgorithm().equals(\'SHA256-RSA\')')
+    expect(source).toContain('issuerCn().equals(\'Example CA\')')
+    expect(source).toContain('certFingerprintSha256().equals(\'abc123\')')
+    expect(source).toContain('issuerFingerprintSha256().equals(\'def456\')')
+  })
 })
 
 describe('TracerouteMonitorCodegen', () => {

packages/cli/src/constructs/api-assertion-codegen.ts

@@ -1,6 +1,6 @@
 import { GeneratedFile, Value } from '../sourcegen/index.js'
 import { Assertion } from './api-assertion.js'
-import { valueForGeneralAssertion, valueForNumericAssertion } from './internal/assertion-codegen.js'
+import { unsupportedAssertionSource, valueForGeneralAssertion, valueForNumericAssertion } from './internal/assertion-codegen.js'
 
 export function valueForAssertion (genfile: GeneratedFile, assertion: Assertion): Value {
   genfile.namedImport('AssertionBuilder', 'checkly/constructs')
@@ -17,6 +17,6 @@ export function valueForAssertion (genfile: GeneratedFile, assertion: Assertion)
     case 'RESPONSE_TIME':
       return valueForNumericAssertion('AssertionBuilder', 'responseTime', assertion)
     default:
-      throw new Error(`Unsupported assertion source ${assertion.source}`)
+      return unsupportedAssertionSource(assertion.source)
   }
 }

packages/cli/src/constructs/dns-assertion-codegen.ts

@@ -1,5 +1,5 @@
 import { GeneratedFile, Value } from '../sourcegen/index.js'
-import { valueForGeneralAssertion, valueForNumericAssertion } from './internal/assertion-codegen.js'
+import { unsupportedAssertionSource, valueForGeneralAssertion, valueForNumericAssertion } from './internal/assertion-codegen.js'
 import { DnsAssertion } from './dns-assertion.js'
 
 export function valueForDnsAssertion (genfile: GeneratedFile, assertion: DnsAssertion): Value {
@@ -24,6 +24,6 @@ export function valueForDnsAssertion (genfile: GeneratedFile, assertion: DnsAsse
         hasRegex: false,
       })
     default:
-      throw new Error(`Unsupported DNS assertion source ${assertion.source}`)
+      return unsupportedAssertionSource(assertion.source, 'DNS')
   }
 }

packages/cli/src/constructs/grpc-assertion-codegen.ts

@@ -1,5 +1,5 @@
 import { GeneratedFile, Value } from '../sourcegen/index.js'
-import { valueForGeneralAssertion, valueForNumericAssertion } from './internal/assertion-codegen.js'
+import { unsupportedAssertionSource, valueForGeneralAssertion, valueForNumericAssertion } from './internal/assertion-codegen.js'
 import { GrpcAssertion } from './grpc-assertion.js'
 
 export function valueForGrpcAssertion (genfile: GeneratedFile, assertion: GrpcAssertion): Value {
@@ -31,6 +31,6 @@ export function valueForGrpcAssertion (genfile: GeneratedFile, assertion: GrpcAs
         hasRegex: false,
       })
     default:
-      throw new Error(`Unsupported gRPC assertion source ${assertion.source}`)
+      return unsupportedAssertionSource(assertion.source, 'gRPC')
   }
 }

packages/cli/src/constructs/icmp-assertion-codegen.ts

@@ -1,5 +1,5 @@
 import { GeneratedFile, Value } from '../sourcegen/index.js'
-import { valueForGeneralAssertion, valueForNumericAssertion } from './internal/assertion-codegen.js'
+import { unsupportedAssertionSource, valueForGeneralAssertion, valueForNumericAssertion } from './internal/assertion-codegen.js'
 import { IcmpAssertion } from './icmp-assertion.js'
 
 export function valueForIcmpAssertion (genfile: GeneratedFile, assertion: IcmpAssertion): Value {
@@ -16,6 +16,6 @@ export function valueForIcmpAssertion (genfile: GeneratedFile, assertion: IcmpAs
         hasRegex: false,
       })
     default:
-      throw new Error(`Unsupported ICMP assertion source ${assertion.source}`)
+      return unsupportedAssertionSource(assertion.source, 'ICMP')
   }
 }

packages/cli/src/constructs/internal/assertion-codegen.ts

@@ -1,6 +1,19 @@
 import { expr, ident, Value } from '../../sourcegen/index.js'
 import { Assertion } from './assertion.js'
 
+/**
+ * Rejects an assertion source that has no codegen case.
+ *
+ * The `never` parameter makes an unhandled source a compile-time error: adding a
+ * member to a monitor's assertion source union without adding the matching codegen
+ * case fails to typecheck. The runtime throw remains because wire data may carry a
+ * source this version of the CLI does not know about.
+ */
+export function unsupportedAssertionSource (source: never, kind?: string): never {
+  const prefix = kind === undefined ? 'Unsupported' : `Unsupported ${kind}`
+  throw new Error(`${prefix} assertion source ${String(source)}`)
+}
+
 export interface ValueForNumericAssertionOptions {
   hasProperty?: boolean
 }

packages/cli/src/constructs/ssl-assertion-codegen.ts

@@ -1,5 +1,5 @@
 import { GeneratedFile, Value } from '../sourcegen/index.js'
-import { valueForGeneralAssertion, valueForNumericAssertion } from './internal/assertion-codegen.js'
+import { unsupportedAssertionSource, valueForGeneralAssertion, valueForNumericAssertion } from './internal/assertion-codegen.js'
 import { SslAssertion } from './ssl-assertion.js'
 
 const generalNoArgs = { hasProperty: false, hasRegex: false }
@@ -18,6 +18,8 @@ export function valueForSslAssertion (genfile: GeneratedFile, assertion: SslAsse
       return valueForGeneralAssertion('SslAssertionBuilder', 'hostnameVerified', assertion, generalNoArgs)
     case 'CHAIN_TRUSTED':
       return valueForGeneralAssertion('SslAssertionBuilder', 'chainTrusted', assertion, generalNoArgs)
+    case 'OCSP_STAPLED':
+      return valueForGeneralAssertion('SslAssertionBuilder', 'ocspStapled', assertion, generalNoArgs)
     case 'TLS_VERSION':
       return valueForGeneralAssertion('SslAssertionBuilder', 'tlsVersion', assertion, generalNoArgs)
     case 'CIPHER_SUITE':
@@ -31,6 +33,6 @@ export function valueForSslAssertion (genfile: GeneratedFile, assertion: SslAsse
     case 'SIGNATURE_ALGORITHM':
       return valueForGeneralAssertion('SslAssertionBuilder', 'signatureAlgorithm', assertion, generalNoArgs)
     default:
-      throw new Error(`Unsupported SSL assertion source ${assertion.source}`)
+      return unsupportedAssertionSource(assertion.source, 'SSL')
   }
 }

packages/cli/src/constructs/tcp-monitor-codegen.ts

@@ -1,5 +1,5 @@
 import { expr, GeneratedFile, ident, Value } from '../sourcegen/index.js'
-import { valueForGeneralAssertion, valueForNumericAssertion } from './internal/assertion-codegen.js'
+import { unsupportedAssertionSource, valueForGeneralAssertion, valueForNumericAssertion } from './internal/assertion-codegen.js'
 import { Codegen, Context } from './internal/codegen/index.js'
 import { buildMonitorProps, MonitorResource } from './monitor-codegen.js'
 import { TcpAssertion, TcpRequest } from './tcp-monitor.js'
@@ -20,7 +20,7 @@ export function valueForTcpAssertion (genfile: GeneratedFile, assertion: TcpAsse
     case 'RESPONSE_TIME':
       return valueForNumericAssertion('TcpAssertionBuilder', 'responseTime', assertion)
     default:
-      throw new Error(`Unsupported TCP assertion source ${assertion.source}`)
+      return unsupportedAssertionSource(assertion.source, 'TCP')
   }
 }
 

packages/cli/src/constructs/traceroute-assertion-codegen.ts

@@ -1,5 +1,5 @@
 import { GeneratedFile, Value } from '../sourcegen/index.js'
-import { valueForNumericAssertion } from './internal/assertion-codegen.js'
+import { unsupportedAssertionSource, valueForNumericAssertion } from './internal/assertion-codegen.js'
 import { TracerouteAssertion } from './traceroute-assertion.js'
 
 export function valueForTracerouteAssertion (genfile: GeneratedFile, assertion: TracerouteAssertion): Value {
@@ -13,6 +13,6 @@ export function valueForTracerouteAssertion (genfile: GeneratedFile, assertion:
     case 'PACKET_LOSS':
       return valueForNumericAssertion('TracerouteAssertionBuilder', 'packetLoss', assertion)
     default:
-      throw new Error(`Unsupported traceroute assertion source ${assertion.source}`)
+      return unsupportedAssertionSource(assertion.source, 'traceroute')
   }
 }