docs(ssl): accurate assertion value types / comparison sets (review)

Daniel-review: the property value-type taxonomy collapsed version/enum/id into
'string', wrongly implying CONTAINS/NOT_CONTAINS on exact-match properties and
hiding tlsVersion's GREATER_THAN/LESS_THAN ordering. Split into number / version
/ string / exact / list / boolean with an accurate comparison table, and document
the RESPONSE_TIME / JSON_RESPONSE / TEXT_RESPONSE comparison sets.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_013AYwkvoaANQTH5dGStbBj2

Author: danielpaulus

constructs/ssl-monitor.mdx

@@ -287,9 +287,9 @@ Define `assertions` using the `SslAssertionBuilder`. Five entry points map to th
 | `jsonResponse(jsonPath)` | `JSON_RESPONSE` | Assert on any response field via a JSONPath expression |
 | `textResponse(regex?)` | `TEXT_RESPONSE` | Extract a value from the serialized response with a regex, then compare |
 
-`certificate(property)` properties: `daysUntilExpiry` (number), `keySizeBits` (number), `subjectCN` / `issuerCN` / `serialNumber` / `fingerprintSha256` / `issuerFingerprintSha256` / `keyAlgorithm` / `signatureAlgorithm` (string), `sans` (list — use `CONTAINS`), `selfSigned` / `isCA` (boolean).
+`certificate(property)` properties: `daysUntilExpiry` / `keySizeBits` (number — `EQUALS` / `NOT_EQUALS` / `GREATER_THAN` / `LESS_THAN`), `subjectCN` / `issuerCN` (string — also `CONTAINS` / `NOT_CONTAINS`), `serialNumber` / `fingerprintSha256` / `issuerFingerprintSha256` / `keyAlgorithm` / `signatureAlgorithm` (exact — `EQUALS` / `NOT_EQUALS` only), `sans` (list — `CONTAINS` / `NOT_CONTAINS`), `selfSigned` / `isCA` (boolean — `EQUALS`).
 
-`connection(property)` properties: `tlsVersion` / `cipherSuite` / `ocspStatus` / `resolvedIp` (string), `hostnameVerified` / `chainTrusted` / `ocspStapled` (boolean).
+`connection(property)` properties: `tlsVersion` (version — `EQUALS` / `NOT_EQUALS` / `GREATER_THAN` / `LESS_THAN`, ordered TLS1.0 < TLS1.3), `cipherSuite` / `resolvedIp` (string — also `CONTAINS` / `NOT_CONTAINS`), `ocspStatus` (exact — `good` / `revoked` / `unknown`), `hostnameVerified` / `chainTrusted` / `ocspStapled` (boolean — `EQUALS`).
 
 Examples:
 
@@ -302,7 +302,8 @@ SslAssertionBuilder.certificate("daysUntilExpiry").greaterThan(30)
 SslAssertionBuilder.connection("chainTrusted").equals(true)
 // Equivalent to: { source: 'CONNECTION', property: 'chainTrusted', comparison: 'EQUALS', target: 'true' }
 
-// Negotiate TLS 1.3 (use the security baseline's minTLSVersion for a "1.2-or-newer" policy)
+// Assert an exact TLS version — tlsVersion is ordered, so greaterThan/lessThan also work
+// (the security baseline's minTLSVersion is the usual way to enforce a "1.2-or-newer" floor)
 SslAssertionBuilder.connection("tlsVersion").equals(TlsVersion.TLS1_3)
 // Equivalent to: { source: 'CONNECTION', property: 'tlsVersion', comparison: 'EQUALS', target: 'TLS1.3' }
 

detect/uptime-monitoring/ssl-monitors/configuration.mdx

@@ -84,29 +84,40 @@ Each assertion has a `source`, an optional `property` (a field selector), a `com
 | `daysUntilExpiry` | number | Days until the certificate expires |
 | `subjectCN` | string | Certificate subject common name |
 | `issuerCN` | string | Common name of the certificate issuer |
-| `serialNumber` | string | Certificate serial number |
-| `fingerprintSha256` | string | SHA-256 fingerprint of the leaf certificate |
-| `issuerFingerprintSha256` | string | SHA-256 fingerprint of the issuer certificate |
+| `serialNumber` | exact | Certificate serial number |
+| `fingerprintSha256` | exact | SHA-256 fingerprint of the leaf certificate |
+| `issuerFingerprintSha256` | exact | SHA-256 fingerprint of the issuer certificate |
 | `keySizeBits` | number | Leaf certificate public key size in bits |
-| `keyAlgorithm` | string | Public key algorithm (e.g. `RSA`, `ECDSA`) |
-| `signatureAlgorithm` | string | Leaf certificate signature algorithm (e.g. `SHA256-RSA`, `ECDSA-SHA256`) |
-| `sans` | list | Subject Alternative Names — use `CONTAINS` / `NOT_CONTAINS` to test membership |
+| `keyAlgorithm` | exact | Public key algorithm (e.g. `RSA`, `ECDSA`) |
+| `signatureAlgorithm` | exact | Leaf certificate signature algorithm (e.g. `SHA256-RSA`, `ECDSA-SHA256`) |
+| `sans` | list | Subject Alternative Names |
 | `selfSigned` | boolean | The leaf certificate is self-signed |
 | `isCA` | boolean | The leaf certificate is a CA certificate |
 
 `CONNECTION` `property` values:
 
 | `property` | Type | Description |
 |-----------|------|-------------|
-| `tlsVersion` | string | Negotiated TLS protocol version (e.g. `TLS1.2`, `TLS1.3`) |
+| `tlsVersion` | version | Negotiated TLS protocol version (e.g. `TLS1.2`, `TLS1.3`) |
 | `cipherSuite` | string | IANA cipher suite name negotiated during the handshake |
 | `hostnameVerified` | boolean | The certificate's SANs cover the monitored hostname |
 | `chainTrusted` | boolean | The full certificate chain is trusted by the system root store |
 | `ocspStapled` | boolean | A stapled OCSP response was included in the handshake |
-| `ocspStatus` | string | Decoded stapled-OCSP status: `good`, `revoked`, or `unknown` |
+| `ocspStatus` | exact | Decoded stapled-OCSP status: `good`, `revoked`, or `unknown` |
 | `resolvedIp` | string | The IP address the hostname resolved to |
 
-Comparisons follow the property's type: numbers support `EQUALS`, `NOT_EQUALS`, `GREATER_THAN`, `LESS_THAN`; strings add `CONTAINS` / `NOT_CONTAINS`; booleans use `EQUALS`; the `sans` list uses `CONTAINS` / `NOT_CONTAINS`.
+The comparisons available depend on the property's type:
+
+| Type | Comparisons |
+|------|-------------|
+| `number` | `EQUALS`, `NOT_EQUALS`, `GREATER_THAN`, `LESS_THAN` |
+| `version` | `EQUALS`, `NOT_EQUALS`, `GREATER_THAN`, `LESS_THAN` (ordered `TLS1.0` < `TLS1.1` < `TLS1.2` < `TLS1.3`) |
+| `string` | `EQUALS`, `NOT_EQUALS`, `CONTAINS`, `NOT_CONTAINS` |
+| `exact` | `EQUALS`, `NOT_EQUALS` |
+| `list` | `CONTAINS`, `NOT_CONTAINS` (SAN membership) |
+| `boolean` | `EQUALS` |
+
+The other sources take their own comparison sets: `RESPONSE_TIME` uses the `number` set; `JSON_RESPONSE` accepts `EQUALS`, `NOT_EQUALS`, `GREATER_THAN`, `LESS_THAN`, `CONTAINS`, `NOT_CONTAINS`, `IS_EMPTY`, `NOT_EMPTY`, `IS_NULL`, `NOT_NULL`; `TEXT_RESPONSE` accepts `EQUALS`, `NOT_EQUALS`, `CONTAINS`, `NOT_CONTAINS`, `IS_EMPTY`, `NOT_EMPTY`, `GREATER_THAN`, `LESS_THAN`.
 
 <Note>
 Certificate validity, minimum TLS version and minimum key size are also enforced by the security baseline above — reach for assertions when you need an exact value check (a specific issuer, fingerprint pinning, a SAN, etc.).