fix(cli): key SSL property whitelists by their property unions

The runtime whitelists in ssl-assertion-validation.ts were typed
Record<string, PropertyRule>, so nothing tied them to the property
unions in ssl-assertion.ts that they mirror. A union member added
without a matching rule compiled clean and autocompleted, then failed
at the user's checkly deploy with "unknown property".

Key them by the unions instead, matching traceroute-assertion-validation.ts
and this file's own source-level rule. A missing or misspelled entry is
now a compile error.

The unions are exported to make that possible, which also lets users name
them when building typed wrappers, as the traceroute analogue already
allows. They are prefixed Ssl- to suit the flat public export namespace,
following the IcmpLatencyProperty / TracerouteResponseTimeProperty
convention; both names are new to the public API, so nothing breaks.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

Author: sorccu

packages/cli/src/constructs/__tests__/ssl-assertion.spec.ts

@@ -134,9 +134,9 @@ describe('SslAssertionBuilder', () => {
     })
 
     it('rejects unknown property names', () => {
-      // @ts-expect-error 'bogusProperty' is not a CertificateProperty
+      // @ts-expect-error 'bogusProperty' is not an SslCertificateProperty
       SslAssertionBuilder.certificate('bogusProperty')
-      // @ts-expect-error 'bogusProperty' is not a ConnectionProperty
+      // @ts-expect-error 'bogusProperty' is not an SslConnectionProperty
       SslAssertionBuilder.connection('bogusProperty')
     })
 

packages/cli/src/constructs/ssl-assertion-validation.ts

@@ -1,6 +1,6 @@
 import { Diagnostics } from './diagnostics.js'
 import { addAssertionDiagnostic, quotedKeys } from './internal/assertion-validation.js'
-import { SslAssertion } from './ssl-assertion.js'
+import { SslAssertion, SslCertificateProperty, SslConnectionProperty } from './ssl-assertion.js'
 
 // The comparisons the backend accepts per value type. The `>=` operator and the regex
 // operator are both dropped for SSL, so neither appears in any set.
@@ -34,7 +34,10 @@ type SslSourceRule =
   | { properties: Record<string, PropertyRule> }
   | { comparisons: Comparisons }
 
-const certificateProperties: Record<string, PropertyRule> = {
+// Runtime counterparts of unions that exist only at compile time. Typing them as a
+// Record keyed by the union makes a missing or misspelled entry a compile-time error,
+// so neither list can drift from the union it mirrors.
+const certificateProperties: Record<SslCertificateProperty, PropertyRule> = {
   daysUntilExpiry: { comparisons: NUMBER },
   keySizeBits: { comparisons: NUMBER },
   subjectCN: { comparisons: STRING },
@@ -49,7 +52,7 @@ const certificateProperties: Record<string, PropertyRule> = {
   isCA: { comparisons: BOOLEAN, booleanTarget: true },
 }
 
-const connectionProperties: Record<string, PropertyRule> = {
+const connectionProperties: Record<SslConnectionProperty, PropertyRule> = {
   tlsVersion: { comparisons: VERSION },
   cipherSuite: { comparisons: STRING },
   hostnameVerified: { comparisons: BOOLEAN, booleanTarget: true },

packages/cli/src/constructs/ssl-assertion.ts

@@ -106,9 +106,10 @@ export type SslAssertion = CoreAssertion<SslAssertionSource>
 
 // The certificate/connection property names the backend understands. Narrowing the
 // `property` parameter to these unions turns a typo into a compile error and drives
-// autocomplete. The runtime whitelist in ssl-assertion-validation.ts is the source of
-// truth for object-literal assertions that bypass the builder.
-type CertificateProperty =
+// autocomplete. Object-literal assertions bypass the builder and are checked at deploy
+// time against the runtime whitelists in ssl-assertion-validation.ts, which are keyed
+// by these unions — so adding a member here without a matching rule fails to compile.
+export type SslCertificateProperty =
   | 'daysUntilExpiry'
   | 'subjectCN'
   | 'issuerCN'
@@ -122,7 +123,7 @@ type CertificateProperty =
   | 'selfSigned'
   | 'isCA'
 
-type ConnectionProperty =
+export type SslConnectionProperty =
   | 'tlsVersion'
   | 'cipherSuite'
   | 'hostnameVerified'
@@ -165,8 +166,8 @@ export class SslAssertionBuilder {
    *   `'issuerCN'`, `'signatureAlgorithm'`, `'sans'`, `'selfSigned'`).
    */
   static certificate (property: 'signatureAlgorithm'): GeneralAssertionBuilder<SslAssertionSource, SignatureAlgorithmValue>
-  static certificate (property: CertificateProperty): GeneralAssertionBuilder<SslAssertionSource>
-  static certificate (property: CertificateProperty) {
+  static certificate (property: SslCertificateProperty): GeneralAssertionBuilder<SslAssertionSource>
+  static certificate (property: SslCertificateProperty) {
     return new GeneralAssertionBuilder<SslAssertionSource>('CERTIFICATE', property)
   }
 
@@ -176,8 +177,8 @@ export class SslAssertionBuilder {
    *   `'cipherSuite'`, `'hostnameVerified'`, `'ocspStatus'`, `'resolvedIp'`).
    */
   static connection (property: 'tlsVersion'): GeneralAssertionBuilder<SslAssertionSource, TlsVersionValue>
-  static connection (property: ConnectionProperty): GeneralAssertionBuilder<SslAssertionSource>
-  static connection (property: ConnectionProperty) {
+  static connection (property: SslConnectionProperty): GeneralAssertionBuilder<SslAssertionSource>
+  static connection (property: SslConnectionProperty) {
     return new GeneralAssertionBuilder<SslAssertionSource>('CONNECTION', property)
   }