feat(cli): gRPC/SSL/Traceroute typed result rendering + IaC constructs (#1362)

* feat(reporters): per-type TRACEROUTE/GRPC/SSL result rendering (P4-CLI-RESULTS)

Render failure-debug diagnostics for the three uptime monitor types across
every CLI result surface, mirroring the 4.1 public check-results fields:

- rest/check-results.ts: typed TracerouteCheckResult/GrpcCheckResult/
  SslCheckResult interfaces + additive fields on CheckResult/CheckResultField.
- formatters/check-result-detail.ts: per-type terminal + markdown diagnostic
  block (checks results get) keyed on the typed fields.
- reporters/util.ts: GRPC/SSL/TRACEROUTE branches in formatCheckResult
  (checkly test terminal), sourced from the runner artifact (checkRunData).
- formatters/batch-stats.ts: add the three types to TIMING_TYPES.
- reporters/json.ts: emit a per-type diagnostics object in the JSON report
  for a failed run (checkly test --reporter json).

Snapshot + assertion tests for each type across all three surfaces.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

* feat(constructs): add GrpcMonitor, SslMonitor, TracerouteMonitor IaC constructs

Implement the missing CLI constructs so users can author and deploy gRPC, SSL
and Traceroute uptime monitors via checkly/constructs, and so backend CLI export
templates that import these classes compile.

Constructs follow the DNS/TCP/ICMP monitor pattern (extend Monitor, register
with Session, validate, synthesize):

- GrpcMonitor / GrpcRequest / GrpcConfig / GrpcMetadata + GrpcAssertionBuilder
  (RESPONSE_TIME, GRPC_STATUS_CODE, GRPC_HEALTHCHECK_STATUS, GRPC_RESPONSE,
  GRPC_METADATA). checkType GRPC, top-level degraded/maxResponseTime (<=30000).
- SslMonitor / SslRequest / SslConfig / SecurityBaseline + SslAssertionBuilder
  (cert expiry, chain, hostname, TLS version, cipher, key size, etc). checkType
  SSL; response-time limits live in sslConfig (degraded/maxResponseTimeMs).
- TracerouteMonitor / TracerouteRequest + TracerouteAssertionBuilder
  (RESPONSE_TIME, HOP_COUNT, PACKET_LOSS). checkType TRACEROUTE, top-level
  degraded/maxResponseTime (<=30000); port dropped for ICMP probes.

Request shapes mirror the public API (verified against checkly-go-sdk types and
the p5-parity captured payloads). Wires exports in constructs/index.ts, import
codegen in check-codegen.ts (GRPC/SSL/TRACEROUTE -> *MonitorCodegen), and adds
the three types to constants.CheckTypes.

Tests: construct synthesize/validation/grouping specs, codegen specs (incl.
ICMP port-strip and assertion builders), and a regression spec asserting the
backend-style export snippets compile against checkly/constructs.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

* fix(deploy): skip code-bundle upload when nothing was bundled

archive.store() (the 'Uploading Playwright tests' step) was called
unconditionally on every deploy. For a project of only uptime monitors
(GRPC/SSL/TRACEROUTE), the bundler registers no files, so this uploaded an
empty Playwright bundle — an unnecessary code-bundle upload in production, and
a hard failure in devenv where it 500s on the storage backend.

The remote code bundle is consumed only by Playwright check suites (via
bundler.marker -> playwright-check.ts); browser checks upload snapshots
separately. Add Bundler.isEmpty and skip store() when no files were registered.

Refs T65.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

* feat(cli): wire gRPC/SSL/Traceroute analytics paths + connection-error rendering

Addresses review (Simo) new-monitor checklist gaps:
- src/rest/analytics.ts: add checkTypeToPath (grpc-checks/ssl/traceroute) and
  defaultMetrics for the three types, matching the backend analytics routes +
  metric registries (gRPC total_*, SSL handshakeTimeMs_*/daysUntilExpiry_avg,
  TRACEROUTE finalHopLatencyAvg_*/totalHops_avg).
- src/reporters/util.ts: add the Connection Error subsection to the GRPC/SSL/
  TRACEROUTE result blocks, mirroring ICMP/DNS.

* docs(cli): AI context references + examples for gRPC/SSL/Traceroute monitors

Addresses review (Simo) new-monitor checklist Phases 5 & 7:
- ai-context/references/configure-{grpc,ssl,traceroute}-monitors.md + REFERENCES
  and EXAMPLE_CONFIGS entries in context.ts (inline exampleConfig).
- examples/advanced-project{,-js}/src/__checks__/uptime/{grpc,ssl,traceroute}
  TS + JS examples with group, assertions, and doc-link comments.

* test(cli): e2e deploy fixtures + Create assertions for gRPC/SSL/Traceroute

Addresses review (Simo) new-monitor checklist Phase 6:
- e2e/__tests__/fixtures/deploy-project/{grpc,ssl,traceroute}.check.ts (activated:false)
- deploy.spec.ts: assert the three logical IDs in the Create output.

* feat(cli): support TEXT_BODY assertions for gRPC monitors

Mirror monorepo #2730 which added TEXT_BODY to grpcMonitorAssertionSources.
Adds GrpcAssertionBuilder.textBody() (source TEXT_BODY) + codegen case,
matching the API check's textBody() builder.

* refactor(cli): restructure SslMonitor props per review (wire shape unchanged)

Per @sorccu's review: make SslMonitor ergonomics consistent with other monitors.
- degradedResponseTime/maxResponseTime -> construct top level (were in sslConfig)
- hostname/port/ipFamily -> request top level (were in sslConfig)
- sslClientCertificateId -> into sslConfig (was on request)
synthesize() remaps to the identical API wire shape (request.sslConfig.* +
request.sslClientCertificateId), so the payload the backend receives is unchanged.
Updated codegen (wire->construct), unit + codegen + export-snippet tests,
examples (ts+js), e2e fixture, and AI context.

* refactor(cli): drop Ms suffix on SslConfig.handshakeTimeout per review

@sorccu: we don't suffix timeout properties with Ms even when the value is
milliseconds. Renames the construct field handshakeTimeoutMs -> handshakeTimeout;
synthesize() and the codegen wire interface keep the API's handshakeTimeoutMs.

---------

Co-authored-by: Ubuntu <ubuntu@ip-172-31-7-108.eu-central-1.compute.internal>
Co-authored-by: Claude Opus 4.8 <noreply@anthropic.com>

Author: 3 people

examples/advanced-project-js/src/__checks__/uptime/grpc.check.js

@@ -0,0 +1,26 @@
+const { GrpcMonitor, GrpcAssertionBuilder } = require('checkly/constructs')
+const { uptimeGroup } = require('../utils/website-groups.check')
+
+// gRPC monitors check gRPC service health or invoke unary methods to validate responses.
+// They support HEALTH mode (standard gRPC health-check) and BEHAVIOR mode (custom method calls).
+// Read more: https://www.checklyhq.com/docs/grpc-monitors/
+
+new GrpcMonitor('grpc-api-health', {
+  name: 'gRPC API Health Monitor',
+  activated: true,
+  group: uptimeGroup,
+  degradedResponseTime: 2000,
+  maxResponseTime: 5000,
+  request: {
+    url: 'grpc.example.com',
+    port: 50051,
+    grpcConfig: {
+      mode: 'HEALTH',
+      tls: true,
+    },
+    assertions: [
+      GrpcAssertionBuilder.healthCheckStatus().equals('SERVING'),
+      GrpcAssertionBuilder.responseTime().lessThan(1000),
+    ],
+  },
+})

examples/advanced-project-js/src/__checks__/uptime/ssl.check.js

@@ -0,0 +1,27 @@
+const { SslMonitor, SslAssertionBuilder } = require('checkly/constructs')
+const { uptimeGroup } = require('../utils/website-groups.check')
+
+// SSL monitors validate TLS certificates: expiry, chain trust, TLS version, and more.
+// Configure alertDaysBeforeExpiry to be notified before a certificate expires.
+// Read more: https://www.checklyhq.com/docs/ssl-monitors/
+
+new SslMonitor('example-com-ssl', {
+  name: 'example.com SSL Certificate',
+  activated: true,
+  group: uptimeGroup,
+  degradedResponseTime: 3000,
+  maxResponseTime: 10000,
+  request: {
+    hostname: 'example.com',
+    port: 443,
+    sslConfig: {
+      alertDaysBeforeExpiry: 30,
+    },
+    assertions: [
+      SslAssertionBuilder.certExpiresInDays().greaterThan(30),
+      SslAssertionBuilder.chainTrusted().equals(true),
+      SslAssertionBuilder.hostnameVerified().equals(true),
+      SslAssertionBuilder.tlsVersion().equals('TLS1.3'),
+    ],
+  },
+})

examples/advanced-project-js/src/__checks__/uptime/traceroute.check.js

@@ -0,0 +1,24 @@
+const { TracerouteMonitor, TracerouteAssertionBuilder } = require('checkly/constructs')
+const { uptimeGroup } = require('../utils/website-groups.check')
+
+// Traceroute monitors map the network path to a host and can detect routing issues,
+// excessive hops, or high packet loss along the path.
+// Read more: https://www.checklyhq.com/docs/traceroute-monitors/
+
+new TracerouteMonitor('example-com-traceroute', {
+  name: 'example.com Traceroute',
+  activated: true,
+  group: uptimeGroup,
+  degradedResponseTime: 10000,
+  maxResponseTime: 20000,
+  request: {
+    url: 'example.com',
+    protocol: 'TCP',
+    port: 443,
+    maxHops: 30,
+    assertions: [
+      TracerouteAssertionBuilder.hopCount().lessThan(20),
+      TracerouteAssertionBuilder.packetLoss().lessThan(10),
+    ],
+  },
+})

examples/advanced-project/src/__checks__/uptime/grpc.check.ts

@@ -0,0 +1,26 @@
+import { GrpcMonitor, GrpcAssertionBuilder } from 'checkly/constructs'
+import { uptimeGroup } from '../utils/website-groups.check'
+
+// gRPC monitors check gRPC service health or invoke unary methods to validate responses.
+// They support HEALTH mode (standard gRPC health-check) and BEHAVIOR mode (custom method calls).
+// Read more: https://www.checklyhq.com/docs/grpc-monitors/
+
+new GrpcMonitor('grpc-api-health', {
+  name: 'gRPC API Health Monitor',
+  activated: true,
+  group: uptimeGroup,
+  degradedResponseTime: 2000,
+  maxResponseTime: 5000,
+  request: {
+    url: 'grpc.example.com',
+    port: 50051,
+    grpcConfig: {
+      mode: 'HEALTH',
+      tls: true,
+    },
+    assertions: [
+      GrpcAssertionBuilder.healthCheckStatus().equals('SERVING'),
+      GrpcAssertionBuilder.responseTime().lessThan(1000),
+    ],
+  },
+})

examples/advanced-project/src/__checks__/uptime/ssl.check.ts

@@ -0,0 +1,27 @@
+import { SslMonitor, SslAssertionBuilder } from 'checkly/constructs'
+import { uptimeGroup } from '../utils/website-groups.check'
+
+// SSL monitors validate TLS certificates: expiry, chain trust, TLS version, and more.
+// Configure alertDaysBeforeExpiry to be notified before a certificate expires.
+// Read more: https://www.checklyhq.com/docs/ssl-monitors/
+
+new SslMonitor('example-com-ssl', {
+  name: 'example.com SSL Certificate',
+  activated: true,
+  group: uptimeGroup,
+  degradedResponseTime: 3000,
+  maxResponseTime: 10000,
+  request: {
+    hostname: 'example.com',
+    port: 443,
+    sslConfig: {
+      alertDaysBeforeExpiry: 30,
+    },
+    assertions: [
+      SslAssertionBuilder.certExpiresInDays().greaterThan(30),
+      SslAssertionBuilder.chainTrusted().equals(true),
+      SslAssertionBuilder.hostnameVerified().equals(true),
+      SslAssertionBuilder.tlsVersion().equals('TLS1.3'),
+    ],
+  },
+})

examples/advanced-project/src/__checks__/uptime/traceroute.check.ts

@@ -0,0 +1,24 @@
+import { TracerouteMonitor, TracerouteAssertionBuilder } from 'checkly/constructs'
+import { uptimeGroup } from '../utils/website-groups.check'
+
+// Traceroute monitors map the network path to a host and can detect routing issues,
+// excessive hops, or high packet loss along the path.
+// Read more: https://www.checklyhq.com/docs/traceroute-monitors/
+
+new TracerouteMonitor('example-com-traceroute', {
+  name: 'example.com Traceroute',
+  activated: true,
+  group: uptimeGroup,
+  degradedResponseTime: 10000,
+  maxResponseTime: 20000,
+  request: {
+    url: 'example.com',
+    protocol: 'TCP',
+    port: 443,
+    maxHops: 30,
+    assertions: [
+      TracerouteAssertionBuilder.hopCount().lessThan(20),
+      TracerouteAssertionBuilder.packetLoss().lessThan(10),
+    ],
+  },
+})

packages/cli/e2e/__tests__/deploy.spec.ts

@@ -205,10 +205,13 @@ describe('deploy', { timeout: 45_000 }, () => {
     DnsMonitor: dns-nonexistent-all-assertion-types
     DnsMonitor: dns-welcome-a
     DnsMonitor: dns-welcome-aaaa
+    GrpcMonitor: grpc-monitor
     HeartbeatMonitor: heartbeat-monitor-1
     BrowserCheck: homepage-browser-check
     IcmpMonitor: icmp-welcome
+    SslMonitor: ssl-monitor
     TcpMonitor: tcp-monitor
+    TracerouteMonitor: traceroute-monitor
     CheckGroupV2: my-group-1
     CheckGroupV1: my-group-2-v1
     Dashboard: dashboard-1
@@ -227,11 +230,14 @@ describe('deploy', { timeout: 45_000 }, () => {
     DnsMonitor: dns-nonexistent-all-assertion-types
     DnsMonitor: dns-welcome-a
     DnsMonitor: dns-welcome-aaaa
+    GrpcMonitor: grpc-monitor
     HeartbeatMonitor: heartbeat-monitor-1
     BrowserCheck: homepage-browser-check
     IcmpMonitor: icmp-welcome
     BrowserCheck: snapshot-test.test.ts
+    SslMonitor: ssl-monitor
     TcpMonitor: tcp-monitor
+    TracerouteMonitor: traceroute-monitor
     CheckGroupV2: my-group-1
     CheckGroupV1: my-group-2-v1
     Dashboard: dashboard-1

packages/cli/e2e/__tests__/fixtures/deploy-project/grpc.check.ts

@@ -0,0 +1,13 @@
+import { GrpcMonitor } from 'checkly/constructs'
+
+new GrpcMonitor('grpc-monitor', {
+  name: 'gRPC Monitor',
+  activated: false,
+  request: {
+    url: 'grpc.example.com',
+    port: 50051,
+    grpcConfig: {
+      mode: 'HEALTH',
+    },
+  },
+})

packages/cli/e2e/__tests__/fixtures/deploy-project/ssl.check.ts

@@ -0,0 +1,10 @@
+import { SslMonitor } from 'checkly/constructs'
+
+new SslMonitor('ssl-monitor', {
+  name: 'SSL Monitor',
+  activated: false,
+  request: {
+    hostname: 'example.com',
+    sslConfig: {},
+  },
+})

packages/cli/e2e/__tests__/fixtures/deploy-project/traceroute.check.ts

@@ -0,0 +1,9 @@
+import { TracerouteMonitor } from 'checkly/constructs'
+
+new TracerouteMonitor('traceroute-monitor', {
+  name: 'Traceroute Monitor',
+  activated: false,
+  request: {
+    url: 'example.com',
+  },
+})