checkly
diff --git a/‎packages/cli/src/ai-context/references/configure-traceroute-monitors.md‎
Lines changed: 1 addition & 0 deletions b/‎packages/cli/src/ai-context/references/configure-traceroute-monitors.md‎
Lines changed: 1 addition & 0 deletions
diff --git a/‎packages/cli/src/constructs/__tests__/grpc-monitor.spec.ts‎
Lines changed: 119 additions & 3 deletions b/‎packages/cli/src/constructs/__tests__/grpc-monitor.spec.ts‎
Lines changed: 119 additions & 3 deletions
diff --git a/‎packages/cli/src/constructs/__tests__/ssl-assertion-codegen.spec.ts‎
Lines changed: 46 additions & 0 deletions b/‎packages/cli/src/constructs/__tests__/ssl-assertion-codegen.spec.ts‎
Lines changed: 46 additions & 0 deletions
diff --git a/‎packages/cli/src/constructs/__tests__/ssl-assertion.spec.ts‎
Lines changed: 42 additions & 0 deletions b/‎packages/cli/src/constructs/__tests__/ssl-assertion.spec.ts‎
Lines changed: 42 additions & 0 deletions
@@ -8,6 +8,7 @@
 - Use `request.maxHops` (default: 30) and `request.maxUnknownHops` (default: 15) to control trace depth.
 - Use `degradedResponseTime` and `maxResponseTime` (milliseconds) to configure response time thresholds.
 - Traceroute assertions support `RESPONSE_TIME`, `HOP_COUNT`, and `PACKET_LOSS` sources.
+- `TracerouteAssertionBuilder.responseTime()` takes an optional property — `'avg'` (default), `'min'`, `'max'`, or `'stdDev'`. `hopCount()` and `packetLoss()` take no property.
 - **Plan-gated properties:** `retryStrategy`, `runParallel`, and higher frequencies are not available on all plans. Check entitlements matching `UPTIME_CHECKS_*` before using these. Omit any property whose entitlement is disabled. See `npx checkly skills manage` for details.
 
 <!-- EXAMPLE: TRACEROUTE_MONITOR -->
@@ -109,19 +109,49 @@ describe('GrpcMonitor', () => {
   })
 
   describe('validation', () => {
-    it('should error if degradedResponseTime is above 30000', async () => {
+    it('should error if degradedResponseTime is above 180000', async () => {
       setupProject()
       const check = new GrpcMonitor('test-check', {
         name: 'Test Check',
         request,
-        degradedResponseTime: 30001,
+        degradedResponseTime: 180001,
       })
       const diags = new Diagnostics()
       await check.validate(diags)
       expect(diags.isFatal()).toEqual(true)
       expect(diags.observations).toEqual(expect.arrayContaining([
         expect.objectContaining({
-          message: expect.stringContaining('The value of "degradedResponseTime" must be 30000 or lower.'),
+          message: expect.stringContaining('The value of "degradedResponseTime" must be 180000 or lower.'),
+        }),
+      ]))
+    })
+
+    it('should not error for a response time above 30000 (gRPC allows up to 180000)', async () => {
+      setupProject()
+      const check = new GrpcMonitor('test-check', {
+        name: 'Test Check',
+        request,
+        degradedResponseTime: 90000,
+        maxResponseTime: 120000,
+      })
+      const diags = new Diagnostics()
+      await check.validate(diags)
+      expect(diags.isFatal()).toEqual(false)
+    })
+
+    it('should error when degradedResponseTime exceeds the default maxResponseTime', async () => {
+      setupProject()
+      const check = new GrpcMonitor('test-check', {
+        name: 'Test Check',
+        request,
+        degradedResponseTime: 30000,
+      })
+      const diags = new Diagnostics()
+      await check.validate(diags)
+      expect(diags.isFatal()).toEqual(true)
+      expect(diags.observations).toEqual(expect.arrayContaining([
+        expect.objectContaining({
+          message: expect.stringContaining('must be less than or equal to the default "maxResponseTime" of 20000'),
         }),
       ]))
     })
@@ -138,5 +168,91 @@ describe('GrpcMonitor', () => {
       await check.validate(diags)
       expect(diags.isFatal()).toEqual(false)
     })
+
+    it('should error on an assertion with an unknown source', async () => {
+      setupProject()
+      const check = new GrpcMonitor('test-check', {
+        name: 'Test Check',
+        request: {
+          ...request,
+          // HOP_COUNT belongs to traceroute, not gRPC.
+          assertions: [{ source: 'HOP_COUNT', property: '', comparison: 'LESS_THAN', target: '5', regex: null }],
+        },
+      })
+      const diags = new Diagnostics()
+      await check.validate(diags)
+      expect(diags.isFatal()).toEqual(true)
+      expect(diags.observations).toEqual(expect.arrayContaining([
+        expect.objectContaining({
+          message: expect.stringContaining(
+            'The assertion at "request.assertions[0]" has an unknown source "HOP_COUNT".',
+          ),
+        }),
+      ]))
+    })
+
+    it('should error on an assertion with an unsupported comparison', async () => {
+      setupProject()
+      const check = new GrpcMonitor('test-check', {
+        name: 'Test Check',
+        request: {
+          ...request,
+          // GREATER_THAN_OR_EQUAL is an SSL-only operator, not in the gRPC set.
+          assertions: [
+            { source: 'GRPC_STATUS_CODE', property: '', comparison: 'GREATER_THAN_OR_EQUAL', target: '0', regex: null },
+          ],
+        },
+      })
+      const diags = new Diagnostics()
+      await check.validate(diags)
+      expect(diags.isFatal()).toEqual(true)
+      expect(diags.observations).toEqual(expect.arrayContaining([
+        expect.objectContaining({
+          message: expect.stringContaining('has an unsupported comparison "GREATER_THAN_OR_EQUAL"'),
+        }),
+      ]))
+    })
+
+    it('should accept every comparison in the backend gRPC set', async () => {
+      setupProject()
+      // Pins the full accepted set so silently dropping one from the validator's list
+      // is caught, since it is not compile-checked against a union.
+      const comparisons = [
+        'EQUALS', 'NOT_EQUALS', 'HAS_KEY', 'NOT_HAS_KEY', 'HAS_VALUE', 'NOT_HAS_VALUE',
+        'IS_EMPTY', 'NOT_EMPTY', 'GREATER_THAN', 'LESS_THAN', 'CONTAINS', 'NOT_CONTAINS',
+        'IS_NULL', 'NOT_NULL',
+      ]
+      const check = new GrpcMonitor('test-check', {
+        name: 'Test Check',
+        request: {
+          ...request,
+          assertions: comparisons.map(comparison => (
+            { source: 'GRPC_RESPONSE', property: '', comparison, target: 'x', regex: null }
+          )),
+        },
+      })
+      const diags = new Diagnostics()
+      await check.validate(diags)
+      expect(diags.isFatal()).toEqual(false)
+    })
+
+    it('should not error on a property carried by any gRPC source', async () => {
+      setupProject()
+      const check = new GrpcMonitor('test-check', {
+        name: 'Test Check',
+        request: {
+          ...request,
+          // gRPC places no source/property constraint, so a property on RESPONSE_TIME
+          // (which the traceroute validator would reject) is accepted here.
+          assertions: [
+            { source: 'RESPONSE_TIME', property: 'avg', comparison: 'LESS_THAN', target: '5000', regex: null },
+            GrpcAssertionBuilder.responseMetadata('content-type').contains('grpc'),
+          ],
+        },
+      })
+      const diags = new Diagnostics()
+      await check.validate(diags)
+      expect(diags.isFatal()).toEqual(false)
+    })
   })
 })
@@ -0,0 +1,46 @@
+import { describe, it, expect } from 'vitest'
+
+import { valueForSslAssertion } from '../ssl-assertion-codegen.js'
+import { SslAssertion } from '../ssl-assertion.js'
+import { GeneratedFile, Output } from '../../sourcegen/index.js'
+
+function render (assertion: SslAssertion): string {
+  const output = new Output()
+  const file = new GeneratedFile('foo.ts')
+  const result = valueForSslAssertion(file, assertion)
+  result.render(output)
+  return output.finalize()
+}
+
+describe('SSL Assertion Codegen', () => {
+  it('generates the new SSL assertion sources', () => {
+    const cases: { input: SslAssertion, expected: string }[] = [
+      // Boolean sources emit a boolean literal, not a quoted string.
+      {
+        input: { source: 'OCSP_STAPLED', property: '', comparison: 'EQUALS', target: 'true', regex: null },
+        expected: 'SslAssertionBuilder.ocspStapled().equals(true)\n',
+      },
+      {
+        input: { source: 'CERT_NOT_EXPIRED', property: '', comparison: 'EQUALS', target: 'true', regex: null },
+        expected: 'SslAssertionBuilder.certNotExpired().equals(true)\n',
+      },
+      {
+        input: { source: 'CHAIN_TRUSTED', property: '', comparison: 'EQUALS', target: 'false', regex: null },
+        expected: 'SslAssertionBuilder.chainTrusted().equals(false)\n',
+      },
+      // Numeric key size emits an unquoted number.
+      {
+        input: { source: 'KEY_SIZE_BITS', property: '', comparison: 'EQUALS', target: '2048', regex: null },
+        expected: 'SslAssertionBuilder.keySizeBits().equals(2048)\n',
+      },
+      // The string sources support the MATCHES (regex) operator.
+      {
+        input: { source: 'CIPHER_SUITE', property: '', comparison: 'MATCHES', target: 'TLS_(AES|CHACHA)', regex: null },
+        expected: 'SslAssertionBuilder.cipherSuite().matches(\'TLS_(AES|CHACHA)\')\n',
+      },
+    ]
+    for (const test of cases) {
+      expect(render(test.input)).toEqual(test.expected)
+    }
+  })
+})
@@ -98,4 +98,46 @@ describe('SslAssertionBuilder — typed target values', () => {
       expect(SslAssertionBuilder.cipherSuite().equals('TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA256')).toBeTruthy()
     })
   })
+
+  describe('matches() — regex operator on the string sources', () => {
+    it('produces a MATCHES assertion for cipherSuite / issuerCn / signatureAlgorithm', () => {
+      expect(SslAssertionBuilder.cipherSuite().matches('TLS_(AES|CHACHA)')).toMatchObject({
+        source: 'CIPHER_SUITE', comparison: 'MATCHES', target: 'TLS_(AES|CHACHA)',
+      })
+      expect(SslAssertionBuilder.issuerCn().matches('^Let\'s Encrypt')).toMatchObject({
+        source: 'ISSUER_CN', comparison: 'MATCHES', target: '^Let\'s Encrypt',
+      })
+      expect(SslAssertionBuilder.signatureAlgorithm().matches('SHA(256|384)')).toMatchObject({
+        source: 'SIGNATURE_ALGORITHM', comparison: 'MATCHES', target: 'SHA(256|384)',
+      })
+    })
+  })
+
+  describe('per-source builders reject operators the backend does not allow', () => {
+    it('rejects them at compile time', () => {
+      // Compile-time-only checks: the removed methods do not exist at runtime, so the
+      // body is type-checked but never executed (an uncalled function).
+
+      const _typeChecks = () => {
+        // keySizeBits supports EQUALS only (GREATER_THAN_OR_EQUAL was dropped)
+        // @ts-expect-error greaterThan is not available on the key-size builder
+        SslAssertionBuilder.keySizeBits().greaterThan(2048)
+        // @ts-expect-error notEquals is not available on the key-size builder
+        SslAssertionBuilder.keySizeBits().notEquals(2048)
+        // boolean sources take a boolean, not the string 'true'
+        // @ts-expect-error 'true' (string) is not assignable to boolean
+        SslAssertionBuilder.certNotExpired().equals('true')
+        // matches is not offered on non-string sources
+        // @ts-expect-error matches is not available on the cert-not-expired builder
+        SslAssertionBuilder.certNotExpired().matches('x')
+        // the general string operators are not offered on SSL string sources
+        // @ts-expect-error contains is not available on the cipher-suite builder
+        SslAssertionBuilder.cipherSuite().contains('x')
+        // tlsVersion supports EQUALS only
+        // @ts-expect-error notEquals is not available on the tls-version builder
+        SslAssertionBuilder.tlsVersion().notEquals('TLS1.3')
+      }
+      expect(_typeChecks).toBeDefined()
+    })
+  })
 })